In this video, you’ll see how to share portfolios across accounts in AWS Service Catalog.
With this feature, you can control access to a portfolio’s products,
share portfolios with individual AWS accounts,
and share portfolios across your AWS Organization.
For the purposes of this example, a portfolio has already been set up on our primary account.
Let’s start by finding it in Service Catalog.
We will be sharing this EC2 Reference Architecture portfolio,
which contains four products used to deploy configured EC2 instances.
Take note of the portfolio ID in the top left-hand corner of the details pane.
Each product in this portfolio has been configured to utilize an AWS Identity and Access Management
(IAM) role that serves as a launch constraint for the product deployments.
Let’s take a look at the launch constraints.
Here you can see launch constraints associated with three products in the portfolio,
all requiring the same launch role.
We can easily share this Service Catalog portfolio with another AWS account.
We’ll just enter the AWS Account ID of the account we’re sharing the portfolio with and click Share.
Now that we’ve successfully shared the portfolio,
let’s switch to the perspective of the AWS account receiving it.
Before we can accept the Service Catalog portfolio, we must deploy the IAM roles
used by the launch constraints.
To do so, let’s launch a preconfigured CloudFormation stack
that deploys the necessary roles from a Git repository.
Note that roles can also be created manually if you know what permissions to use.
In this example, we’re using an EC2 reference architecture.
Proceed through the CloudFormation stack creation wizard to deploy the role.
For our purposes, we’ll use the default values.
Create the stack.
It can take a few minutes for the deployment to finish creating the needed IAM role.
When deployment is finished, we can see the role on the Resources tab.
The name of the IAM role matches the name of the role required by the portfolio’s launch constraints.
Now we can proceed to Service Catalog to accept the portfolio.
Service Catalog portfolios shared to an individual AWS account can be found on the “Imported” tab.
A portfolio does not appear until it is specifically accepted by the account.
Let’s accept the shared portfolio now.
We’ll enter the portfolio ID we noted earlier.
The portfolio now appears in the Service Catalog administration dashboard.
The portfolio contains the products we saw in the master account.
It also inherited the launch constraints that require the role we just deployed.
You can also share a portfolio with all the member accounts in an AWS Organization.
Let’s return to the organization’s master account and see how.
This time, we’ll select the option to share the portfolio with the organization.
In order to share AWS Service Catalog portfolios organization-wide, the feature must first be enabled.
Provide the organization ID and share the portfolio.
The organization now appears on the portfolio’s Share tab.
Let’s take the perspective of a member account within the organization
that already has the necessary IAM role to fulfill the launch constraints.
Let’s head to Service Catalog to ensure the portfolio shows up in our Portfolio dashboard.
Portfolios shared with an organization automatically appear in the member accounts.
Let’s check to see if all products show up as expected.
As you can see, the products show up as expected, along with the three launch constraints.
You’ve just seen how to share portfolios across accounts in AWS Service Catalog.
Thanks for watching.
Now it’s your turn to try.