ASSOCPRINCIPALWITHPORTFOLIO()`¶

About AssociatePrincipalWithPortfolio¶

Associates the specified principal ARN with the specified portfolio.

If you share the portfolio with principal name sharing enabled, the PrincipalARN association is included in the share.

The PortfolioID, PrincipalARN, and PrincipalType parameters are required.

You can associate a maximum of 10 Principals with a portfolio using PrincipalType as IAM_PATTERN.

When you associate a principal with portfolio, a potential privilege escalation path may occur when that portfolio is then shared with other accounts. For a user in a recipient account who is not an Service Catalog Admin, but still has the ability to create Principals (Users/Groups/Roles), that user could create a role that matches a principal name association for the portfolio. Although this user may not know which principal names are associated through Service Catalog, they may be able to guess the user. If this potential escalation path is a concern, then Service Catalog recommends using PrincipalType as IAM. With this configuration, the PrincipalARN must already exist in the recipient account before it can be associated.

Method Signature¶

METHODS /AWS1/IF_SCG~ASSOCPRINCIPALWITHPORTFOLIO
  IMPORTING
    !IV_ACCEPTLANGUAGE TYPE /AWS1/SCGACCEPTLANGUAGE OPTIONAL
    !IV_PORTFOLIOID TYPE /AWS1/SCGID OPTIONAL
    !IV_PRINCIPALARN TYPE /AWS1/SCGPRINCIPALARN OPTIONAL
    !IV_PRINCIPALTYPE TYPE /AWS1/SCGPRINCIPALTYPE OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_scgascprpwportfolio01
  RAISING
    /AWS1/CX_SCGINVALIDPARAMSEX
    /AWS1/CX_SCGLIMITEXCEEDEDEX
    /AWS1/CX_SCGRESOURCENOTFOUNDEX
    /AWS1/CX_SCGCLIENTEXC
    /AWS1/CX_SCGSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING¶

Required arguments:¶

`iv_portfolioid` `TYPE /AWS1/SCGID` `/AWS1/SCGID`¶

The portfolio identifier.

`iv_principalarn` `TYPE /AWS1/SCGPRINCIPALARN` `/AWS1/SCGPRINCIPALARN`¶

The ARN of the principal (user, role, or group). If the PrincipalType is IAM, the supported value is a fully defined IAM Amazon Resource Name (ARN). If the PrincipalType is IAM_PATTERN, the supported value is an IAM ARN without an AccountID in the following format:

arn:partition:iam:::resource-type/resource-id

The ARN resource-id can be either:

A fully formed resource-id. For example, arn:aws:iam:::role/resource-name or arn:aws:iam:::role/resource-path/resource-name

A wildcard ARN. The wildcard ARN accepts IAM_PATTERN values with a "" or "?" in the resource-id segment of the ARN. For example arn:partition:service:::resource-type/resource-path/resource-name. The new symbols are exclusive to the resource-path and resource-name and cannot replace the resource-type or other ARN values.

The ARN path and principal name allow unlimited wildcard characters.

Examples of an acceptable wildcard ARN:

arn:aws:iam:::role/ResourceName_

arn:aws:iam:::role//ResourceName_?

Examples of an unacceptable wildcard ARN:

arn:aws:iam:::/ResourceName

You can associate multiple IAM_PATTERNs even if the account has no principal with that name.

The "?" wildcard character matches zero or one of any character. This is similar to ".?" in regular regex context. The "" wildcard character matches any number of any characters. This is similar to "." in regular regex context.

In the IAM Principal ARN format (arn:partition:iam:::resource-type/resource-path/resource-name), valid resource-type values include user/, group/, or role/. The "?" and "" characters are allowed only after the resource-type in the resource-id segment. You can use special characters anywhere within the resource-id.

The "" character also matches the "/" character, allowing paths to be formed within the resource-id. For example, arn:aws:iam:::role/*/ResourceName_? matches both arn:aws:iam:::role/pathA/pathB/ResourceName_1 and arn:aws:iam:::role/pathA/ResourceName_1.

`iv_principaltype` `TYPE /AWS1/SCGPRINCIPALTYPE` `/AWS1/SCGPRINCIPALTYPE`¶

The principal type. The supported value is IAM if you use a fully defined Amazon Resource Name (ARN), or IAM_PATTERN if you use an ARN with no accountID, with or without wildcard characters.

Optional arguments:¶

`iv_acceptlanguage` `TYPE /AWS1/SCGACCEPTLANGUAGE` `/AWS1/SCGACCEPTLANGUAGE`¶

The language code.

jp - Japanese

zh - Chinese

RETURNING¶

`oo_output` `TYPE REF TO /aws1/cl_scgascprpwportfolio01` `/AWS1/CL_SCGASCPRPWPORTFOLIO01`¶

Domain /AWS1/RT_ACCOUNT_ID

Primitive Type NUMC

Examples¶

Syntax Example¶

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->assocprincipalwithportfolio(
  iv_acceptlanguage = |string|
  iv_portfolioid = |string|
  iv_principalarn = |string|
  iv_principaltype = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
ENDIF.

/AWS1/IF_SCG=>ASSOCPRINCIPALWITHPORTFOLIO()¶