> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Service Catalog Portfolio

> Managing AWS Service Catalog portfolios to publish approved products, grant IAM access, and enable governed self service provisioning of standardized infrastructure

In this lesson we explore AWS Service Catalog portfolios: how to create a portfolio, associate approved products (for example a Simple S3 product), grant access to principals, and allow users to provision those products through a controlled workflow. Using portfolios helps organizations enforce governance while enabling self-service provisioning of standardized infrastructure.

To perform the tasks in this demo you need appropriate AWS permissions (Service Catalog and IAM). Typical permissions include `servicecatalog:CreatePortfolio`, `servicecatalog:AssociateProductWithPortfolio`, `servicecatalog:AssociatePrincipalWithPortfolio`, and `servicecatalog:ProvisionProduct`. Many provisioning flows also require `iam:PassRole` so CloudFormation can assume an execution role defined by the product. Ensure the IAM principal you grant access to has the Service Catalog permissions needed to view and launch products.

## Quick overview (what we'll do)

* Create a portfolio in AWS Service Catalog.
* Associate an existing product (the Simple S3 product) with that portfolio.
* Grant an IAM principal (user, group, or role) permission to access the portfolio.
* From the principal’s perspective, launch the product and provision the approved resource.

## Step-by-step console flow

| Step | Console location | What to do |
| - | - | - |
| 1 | AWS Management Console → Service Catalog | If needed, open the left-hand navigation and select **Portfolios** to create and manage portfolios. |
| 2 | Portfolios → Create portfolio | Provide a name, owner, description, and tags for the portfolio. |
| 3 | Service Catalog → Products | Select the product to expose (this demo uses the Simple **S3** product). |
| 4 | Product page | Associate the product with the portfolio you created. |
| 5 | Portfolio → Access | Associate the appropriate IAM principal (user, group, or role) with the portfolio so they can view/launch products. |
| 6 | Principal’s Console → Service Catalog | The granted principal can now launch the product; follow the provisioning workflow to create the provisioned product (CloudFormation stack or other supported resource). |

Once a principal has access, they can launch the product. The console shows the provisioning workflow that prompts for a provisioned product name, provisioning artifact (version), and any runtime parameters before launching.

![A screenshot of the AWS Service Catalog console showing the "Launch: Simple S3" workflow, with a "Provisioned product name" field populated (Simple\_S3-09302332) and a checked "Generate name" option. The page header and navigation elements of the AWS web console are visible.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Demo-Service-Catalog-Portfolio/aws-service-catalog-launch-simple-s3.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=d448123ef16aa81c74cd3237af6edeb4)

## Launch view explained

* Provisioned product name\
  The name identifies the deployed resource in the Service Catalog console. Service Catalog can auto-generate a name, or you can supply a custom name.

* Provisioning artifact (version)\
  Choose the desired provisioning artifact — typically a CloudFormation template version that defines how the product is provisioned.

* Launch action\
  Clicking **Launch** triggers Service Catalog to provision the product on behalf of the user. Under the hood most products are backed by AWS CloudFormation stacks or other supported provisioning mechanisms.

## Post-launch details

After provisioning, the console shows details for the provisioned product:

* Product name, ARN, who launched it (IAM principal), creation date, and current provisioning status.
* A successful provisioning typically results in a status like `CREATE_COMPLETE`, indicating the underlying resources (for example, an S3 bucket) were created successfully.

## What a provisioned product represents

* The provisioned product is the deployed instance created from a Service Catalog product (commonly implemented as a CloudFormation stack that creates resources such as S3 buckets).
* Portfolios and product associations let organizations share standardized, approved infrastructure without exposing raw CloudFormation templates or requiring users to write infrastructure code.

## Key IAM permissions (quick reference)

| Permission | Purpose / When required |
| - | - |
| `servicecatalog:CreatePortfolio` | Create portfolios to group approved products |
| `servicecatalog:AssociateProductWithPortfolio` | Add a product to a portfolio |
| `servicecatalog:AssociatePrincipalWithPortfolio` | Grant an IAM principal (user/group/role) access to a portfolio |
| `servicecatalog:ProvisionProduct` | Allow the principal to launch/provision a product |
| `iam:PassRole` | Required in many cases so CloudFormation can assume the execution role specified by the product |

If a product’s CloudFormation template requires an IAM role for execution, the principal used to provision the product may need `iam:PassRole`. Be cautious and follow least-privilege principles when granting `iam:PassRole`, and restrict which roles can be passed.

## Benefits (why use Service Catalog portfolios)

* Governance and compliance: Enforce organizational standards by exposing only approved products and versions.
* Self-service provisioning: Users can deploy standardized infrastructure from the console without writing CloudFormation or other IaC.
* Centralized management: Administrators manage product versions, updates, and which principals have access.

## Troubleshooting tips

* If a user cannot see a product, confirm the product is associated with a portfolio and the user (or the group/role the user belongs to) is associated with that portfolio.
* If provisioning fails, check CloudFormation stack events and the Service Catalog provisioning history for error messages.
* Verify any required `iam:PassRole` permissions are in place and the role ARN referenced by the product exists and is allowed.

## References

* [AWS Service Catalog documentation](https://docs.aws.amazon.com/servicecatalog/latest/dg/what-is-service-catalog.html)
* [AWS CloudFormation basics](https://learn.kodekloud.com/user/courses/aws-cloud-formation)
* [AWS IAM](https://learn.kodekloud.com/user/courses/aws-iam)
* [Simple S3 course (example product)](https://learn.kodekloud.com/user/courses/amazon-simple-storage-service)

In summary: use Service Catalog portfolios to group approved products, control who can access them, and enable secure, repeatable provisioning of infrastructure across your organization.

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/42510d3c-bacc-4a37-adb8-2cfea86f1a36/lesson/2e969fc5-0333-4341-a921-29592ef2c601)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.