Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Service Catalog

AWS Service Catalog (service prefix: servicecatalog) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Service Catalog
Actions defined by AWS Service Catalog
Permission-only actions for AWS Service Catalog
Resource types defined by AWS Service Catalog
Condition keys for AWS Service Catalog

API operations defined by AWS Service Catalog

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
AcceptPortfolioShare	servicecatalog	servicecatalog:AcceptPortfolioShare			Write
AssociateBudgetWithResource	servicecatalog	servicecatalog:AssociateBudgetWithResource			Write
AssociatePrincipalWithPortfolio	servicecatalog	servicecatalog:AssociatePrincipalWithPortfolio			Write
AssociateProductWithPortfolio	servicecatalog	servicecatalog:AssociateProductWithPortfolio			Write
AssociateServiceActionWithProvisioningArtifact	servicecatalog	servicecatalog:AssociateServiceActionWithProvisioningArtifact			Write
AssociateTagOptionWithResource	servicecatalog	servicecatalog:AssociateTagOptionWithResource			Write
BatchAssociateServiceActionWithProvisioningArtifact	servicecatalog	servicecatalog:BatchAssociateServiceActionWithProvisioningArtifact			Write
BatchDisassociateServiceActionFromProvisioningArtifact	servicecatalog	servicecatalog:BatchDisassociateServiceActionFromProvisioningArtifact			Write
CopyProduct	servicecatalog	servicecatalog:CopyProduct			Write
CreateConstraint	servicecatalog	servicecatalog:CreateConstraint			Write
CreateConstraint	servicecatalog	iam:PassRole	iam:PassedToService	servicecatalog.amazonaws.com	Write
CreatePortfolio	servicecatalog	servicecatalog:CreatePortfolio			Write
CreatePortfolio	servicecatalog	servicecatalog:TagResource			Tagging, Write
CreatePortfolioShare	servicecatalog	servicecatalog:CreatePortfolioShare			Permissions management, Write
CreateProduct	servicecatalog	servicecatalog:CreateProduct			Write
		servicecatalog:TagResource			Tagging, Write
		codestar-connections:PassConnection			Read
CreateProvisionedProductPlan	servicecatalog	servicecatalog:CreateProvisionedProductPlan			Write
CreateProvisioningArtifact	servicecatalog	servicecatalog:CreateProvisioningArtifact			Write
CreateServiceAction	servicecatalog	servicecatalog:CreateServiceAction			Write
CreateServiceAction	servicecatalog	iam:PassRole	iam:PassedToService	servicecatalog.amazonaws.com	Write
CreateTagOption	servicecatalog	servicecatalog:CreateTagOption			Write
DeleteConstraint	servicecatalog	servicecatalog:DeleteConstraint			Write
DeletePortfolio	servicecatalog	servicecatalog:DeletePortfolio			Write
DeletePortfolioShare	servicecatalog	servicecatalog:DeletePortfolioShare			Permissions management, Write
DeleteProduct	servicecatalog	servicecatalog:DeleteProduct			Write
DeleteProvisionedProductPlan	servicecatalog	servicecatalog:DeleteProvisionedProductPlan			Write
DeleteProvisioningArtifact	servicecatalog	servicecatalog:DeleteProvisioningArtifact			Write
DeleteServiceAction	servicecatalog	servicecatalog:DeleteServiceAction			Write
DeleteTagOption	servicecatalog	servicecatalog:DeleteTagOption			Write
DescribeConstraint	servicecatalog	servicecatalog:DescribeConstraint			Read
DescribeCopyProductStatus	servicecatalog	servicecatalog:DescribeCopyProductStatus			Read
DescribePortfolio	servicecatalog	servicecatalog:DescribePortfolio			Read
DescribePortfolioShareStatus	servicecatalog	servicecatalog:DescribePortfolioShareStatus			Read
DescribePortfolioShares	servicecatalog	servicecatalog:DescribePortfolioShares			List
DescribeProduct	servicecatalog	servicecatalog:DescribeProduct			Read
DescribeProductAsAdmin	servicecatalog	servicecatalog:DescribeProductAsAdmin			Read
DescribeProductView	servicecatalog	servicecatalog:DescribeProductView			Read
DescribeProvisionedProduct	servicecatalog	servicecatalog:DescribeProvisionedProduct			Read
DescribeProvisionedProductPlan	servicecatalog	servicecatalog:DescribeProvisionedProductPlan			Read
DescribeProvisioningArtifact	servicecatalog	servicecatalog:DescribeProvisioningArtifact			Read
DescribeProvisioningParameters	servicecatalog	servicecatalog:DescribeProvisioningParameters			Read
DescribeRecord	servicecatalog	servicecatalog:DescribeRecord			Read
DescribeServiceAction	servicecatalog	servicecatalog:DescribeServiceAction			Read
DescribeServiceActionExecutionParameters	servicecatalog	servicecatalog:DescribeServiceActionExecutionParameters			Read
DescribeTagOption	servicecatalog	servicecatalog:DescribeTagOption			Read
DisableAWSOrganizationsAccess	servicecatalog	servicecatalog:DisableAWSOrganizationsAccess			Write
DisassociateBudgetFromResource	servicecatalog	servicecatalog:DisassociateBudgetFromResource			Write
DisassociatePrincipalFromPortfolio	servicecatalog	servicecatalog:DisassociatePrincipalFromPortfolio			Write
DisassociateProductFromPortfolio	servicecatalog	servicecatalog:DisassociateProductFromPortfolio			Write
DisassociateServiceActionFromProvisioningArtifact	servicecatalog	servicecatalog:DisassociateServiceActionFromProvisioningArtifact			Write
DisassociateTagOptionFromResource	servicecatalog	servicecatalog:DisassociateTagOptionFromResource			Write
EnableAWSOrganizationsAccess	servicecatalog	servicecatalog:EnableAWSOrganizationsAccess			Write
ExecuteProvisionedProductPlan	servicecatalog	servicecatalog:ExecuteProvisionedProductPlan			Write
ExecuteProvisionedProductServiceAction	servicecatalog	servicecatalog:ExecuteProvisionedProductServiceAction			Write
GetAWSOrganizationsAccessStatus	servicecatalog	servicecatalog:GetAWSOrganizationsAccessStatus			Read
GetProvisionedProductOutputs	servicecatalog	servicecatalog:GetProvisionedProductOutputs			Read
ImportAsProvisionedProduct	servicecatalog	servicecatalog:ImportAsProvisionedProduct			Write
ListAcceptedPortfolioShares	servicecatalog	servicecatalog:ListAcceptedPortfolioShares			List
ListBudgetsForResource	servicecatalog	servicecatalog:ListBudgetsForResource			List
ListConstraintsForPortfolio	servicecatalog	servicecatalog:ListConstraintsForPortfolio			List
ListLaunchPaths	servicecatalog	servicecatalog:ListLaunchPaths			List
ListOrganizationPortfolioAccess	servicecatalog	servicecatalog:ListOrganizationPortfolioAccess			List
ListPortfolioAccess	servicecatalog	servicecatalog:ListPortfolioAccess			List
ListPortfolios	servicecatalog	servicecatalog:ListPortfolios			List
ListPortfoliosForProduct	servicecatalog	servicecatalog:ListPortfoliosForProduct			List
ListPrincipalsForPortfolio	servicecatalog	servicecatalog:ListPrincipalsForPortfolio			List
ListProvisionedProductPlans	servicecatalog	servicecatalog:ListProvisionedProductPlans			List
ListProvisioningArtifacts	servicecatalog	servicecatalog:ListProvisioningArtifacts			List
ListProvisioningArtifactsForServiceAction	servicecatalog	servicecatalog:ListProvisioningArtifactsForServiceAction			List
ListRecordHistory	servicecatalog	servicecatalog:ListRecordHistory			List
ListResourcesForTagOption	servicecatalog	servicecatalog:ListResourcesForTagOption			List
ListServiceActions	servicecatalog	servicecatalog:ListServiceActions			List
ListServiceActionsForProvisioningArtifact	servicecatalog	servicecatalog:ListServiceActionsForProvisioningArtifact			List
ListStackInstancesForProvisionedProduct	servicecatalog	servicecatalog:ListStackInstancesForProvisionedProduct			List
ListTagOptions	servicecatalog	servicecatalog:ListTagOptions			List
NotifyProvisionProductEngineWorkflowResult	servicecatalog	servicecatalog:NotifyProvisionProductEngineWorkflowResult			Write
NotifyTerminateProvisionedProductEngineWorkflowResult	servicecatalog	servicecatalog:NotifyTerminateProvisionedProductEngineWorkflowResult			Write
NotifyUpdateProvisionedProductEngineWorkflowResult	servicecatalog	servicecatalog:NotifyUpdateProvisionedProductEngineWorkflowResult			Write
ProvisionProduct	servicecatalog	servicecatalog:ProvisionProduct			Write
RejectPortfolioShare	servicecatalog	servicecatalog:RejectPortfolioShare			Write
ScanProvisionedProducts	servicecatalog	servicecatalog:ScanProvisionedProducts			List
SearchProducts	servicecatalog	servicecatalog:SearchProducts			List
SearchProductsAsAdmin	servicecatalog	servicecatalog:SearchProductsAsAdmin			List
SearchProvisionedProducts	servicecatalog	servicecatalog:SearchProvisionedProducts			List
TerminateProvisionedProduct	servicecatalog	servicecatalog:TerminateProvisionedProduct			Write
UpdateConstraint	servicecatalog	servicecatalog:UpdateConstraint			Write
UpdateConstraint	servicecatalog	iam:PassRole	iam:PassedToService	servicecatalog.amazonaws.com	Write
UpdatePortfolio	servicecatalog	servicecatalog:TagResource			Tagging, Write
		servicecatalog:UntagResource			Tagging, Write
		servicecatalog:UpdatePortfolio			Write
UpdatePortfolioShare	servicecatalog	servicecatalog:UpdatePortfolioShare			Permissions management, Write
UpdateProduct	servicecatalog	servicecatalog:TagResource			Tagging, Write
		servicecatalog:UntagResource			Tagging, Write
		servicecatalog:UpdateProduct			Write
		codestar-connections:PassConnection			Read
UpdateProvisionedProduct	servicecatalog	servicecatalog:UpdateProvisionedProduct			Write
UpdateProvisionedProductProperties	servicecatalog	servicecatalog:UpdateProvisionedProductProperties			Write
UpdateProvisioningArtifact	servicecatalog	servicecatalog:UpdateProvisioningArtifact			Write
UpdateServiceAction	servicecatalog	servicecatalog:UpdateServiceAction			Write
UpdateServiceAction	servicecatalog	iam:PassRole	iam:PassedToService	servicecatalog.amazonaws.com	Write
UpdateTagOption	servicecatalog	servicecatalog:UpdateTagOption			Write
AssociateAttributeGroup	servicecatalog-appregistry	servicecatalog:AssociateAttributeGroup			Write
AssociateResource	servicecatalog-appregistry	servicecatalog:AssociateResource			Write
CreateApplication	servicecatalog-appregistry	servicecatalog:CreateApplication			Write
CreateApplication	servicecatalog-appregistry	servicecatalog:TagResource			Tagging, Write
CreateAttributeGroup	servicecatalog-appregistry	servicecatalog:CreateAttributeGroup			Write
CreateAttributeGroup	servicecatalog-appregistry	servicecatalog:TagResource			Tagging, Write
DeleteApplication	servicecatalog-appregistry	servicecatalog:DeleteApplication			Write
DeleteAttributeGroup	servicecatalog-appregistry	servicecatalog:DeleteAttributeGroup			Write
DisassociateAttributeGroup	servicecatalog-appregistry	servicecatalog:DisassociateAttributeGroup			Write
DisassociateResource	servicecatalog-appregistry	servicecatalog:DisassociateResource			Write
GetApplication	servicecatalog-appregistry	servicecatalog:GetApplication			Read
GetAssociatedResource	servicecatalog-appregistry	servicecatalog:GetAssociatedResource			Read
GetAttributeGroup	servicecatalog-appregistry	servicecatalog:GetAttributeGroup			Read
GetConfiguration	servicecatalog-appregistry	servicecatalog:GetConfiguration			Read
ListApplications	servicecatalog-appregistry	servicecatalog:ListApplications			List
ListAssociatedAttributeGroups	servicecatalog-appregistry	servicecatalog:ListAssociatedAttributeGroups			List
ListAssociatedResources	servicecatalog-appregistry	servicecatalog:ListAssociatedResources			List
ListAttributeGroups	servicecatalog-appregistry	servicecatalog:ListAttributeGroups			List
ListAttributeGroupsForApplication	servicecatalog-appregistry	servicecatalog:ListAttributeGroupsForApplication			List
ListTagsForResource	servicecatalog-appregistry	servicecatalog:ListTagsForResource			Read
PutConfiguration	servicecatalog-appregistry	servicecatalog:PutConfiguration			Write
SyncResource	servicecatalog-appregistry	servicecatalog:SyncResource			Write
TagResource	servicecatalog-appregistry	servicecatalog:TagResource			Tagging, Write
UntagResource	servicecatalog-appregistry	servicecatalog:UntagResource			Tagging, Write
UpdateApplication	servicecatalog-appregistry	servicecatalog:UpdateApplication			Write
UpdateAttributeGroup	servicecatalog-appregistry	servicecatalog:UpdateAttributeGroup			Write

Actions defined by AWS Service Catalog

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptPortfolioShare	Grants permission to accept a portfolio that has been shared with you	Portfolio*	aws:ResourceTag/${TagKey}	Write
AssociateAttributeGroup	Grants permission to associate an attribute group with an application	Application*	aws:ResourceTag/${TagKey}	Write
AssociateAttributeGroup		AttributeGroup*	aws:ResourceTag/${TagKey}	Write
AssociateBudgetWithResource	Grants permission to associate a budget with a resource			Write
AssociatePrincipalWithPortfolio	Grants permission to associate an IAM principal with a portfolio, giving the specified principal access to any products associated with the specified portfolio	Portfolio*	aws:ResourceTag/${TagKey}	Write
AssociateProductWithPortfolio	Grants permission to associate a product with a portfolio			Write
AssociateResource	Grants permission to associate a resource with an application	Application*	aws:ResourceTag/${TagKey} servicecatalog:Resource servicecatalog:ResourceType	Write
AssociateServiceActionWithProvisioningArtifact	Grants permission to associate an action with a provisioning artifact	Product*	aws:ResourceTag/${TagKey}	Write
AssociateTagOptionWithResource	Grants permission to associate the specified TagOption with the specified portfolio or product	Portfolio	aws:ResourceTag/${TagKey}	Write
AssociateTagOptionWithResource		Product	aws:ResourceTag/${TagKey}	Write
BatchAssociateServiceActionWithProvisioningArtifact	Grants permission to associate multiple self-service actions with provisioning artifacts			Write
BatchDisassociateServiceActionFromProvisioningArtifact	Grants permission to disassociate a batch of self-service actions from the specified provisioning artifact			Write
CopyProduct	Grants permission to copy the specified source product to the specified target product or a new product			Write
CreateApplication	Grants permission to create an application	Application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAttributeGroup	Grants permission to create an attribute group	AttributeGroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConstraint	Grants permission to create a constraint on an associated product and portfolio	Product*	aws:ResourceTag/${TagKey}	Write
CreatePortfolio	Grants permission to create a portfolio	Portfolio*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePortfolioShare	Grants permission to share a portfolio you own with another AWS account	Portfolio*	aws:ResourceTag/${TagKey}	Permissions management, Write
CreateProduct	Grants permission to create a product and that product's first provisioning artifact	Product*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProvisionedProductPlan	Grants permission to add a new provisioned product plan		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Write
CreateProvisioningArtifact	Grants permission to add a new provisioning artifact to an existing product	Product*	aws:ResourceTag/${TagKey}	Write
CreateServiceAction	Grants permission to create a self-service action			Write
CreateTagOption	Grants permission to create a TagOption			Write
DeleteApplication	Grants permission to delete an application if all associations have been removed from the application	Application*	aws:ResourceTag/${TagKey}	Write
DeleteAttributeGroup	Grants permission to delete an attribute group if all associations have been removed from the attribute group	AttributeGroup*	aws:ResourceTag/${TagKey}	Write
DeleteConstraint	Grants permission to remove and delete an existing constraint from an associated product and portfolio			Write
DeletePortfolio	Grants permission to delete a portfolio if all associations and shares have been removed from the portfolio	Portfolio*	aws:ResourceTag/${TagKey}	Write
DeletePortfolioShare	Grants permission to unshare a portfolio you own from an AWS account you previously shared the portfolio with	Portfolio*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteProduct	Grants permission to delete a product if all associations have been removed from the product	Product*	aws:ResourceTag/${TagKey}	Write
DeleteProvisionedProductPlan	Grants permission to delete a provisioned product plan		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Write
DeleteProvisioningArtifact	Grants permission to delete a provisioning artifact from a product	Product*	aws:ResourceTag/${TagKey}	Write
DeleteServiceAction	Grants permission to delete a self-service action			Write
DeleteTagOption	Grants permission to delete the specified TagOption			Write
DescribeConstraint	Grants permission to describe a constraint			Read
DescribeCopyProductStatus	Grants permission to get the status of the specified copy product operation			Read
DescribePortfolio	Grants permission to describe a portfolio	Portfolio*	aws:ResourceTag/${TagKey}	Read
DescribePortfolioShareStatus	Grants permission to get the status of the specified portfolio share operation			Read
DescribePortfolioShares	Grants permission to view a summary of each of the portfolio shares that were created for the specified portfolio	Portfolio*	aws:ResourceTag/${TagKey}	List
DescribeProduct	Grants permission to describe a product as an end-user	Product*	aws:ResourceTag/${TagKey}	Read
DescribeProductAsAdmin	Grants permission to describe a product as an admin	Product*	aws:ResourceTag/${TagKey}	Read
DescribeProductView	Grants permission to describe a product as an end-user			Read
DescribeProvisionedProduct	Grants permission to describe a provisioned product		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Read
DescribeProvisionedProductPlan	Grants permission to describe a provisioned product plan		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Read
DescribeProvisioningArtifact	Grants permission to describe a provisioning artifact	Product*	aws:ResourceTag/${TagKey}	Read
DescribeProvisioningParameters	Grants permission to describe the parameters that you need to specify to successfully provision a specified provisioning artifact	Product*	aws:ResourceTag/${TagKey}	Read
DescribeRecord	Grants permission to describe a record and lists any outputs		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Read
DescribeServiceAction	Grants permission to describe a self-service action			Read
DescribeServiceActionExecutionParameters	Grants permission to get the default parameters if you executed the specified Service Action on the specified Provisioned Product		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Read
DescribeTagOption	Grants permission to get information about the specified TagOption			Read
DisableAWSOrganizationsAccess	Grants permission to disable portfolio sharing through AWS Organizations feature			Write
DisassociateAttributeGroup	Grants permission to disassociate an attribute group from an application	Application*	aws:ResourceTag/${TagKey}	Write
DisassociateAttributeGroup		AttributeGroup*	aws:ResourceTag/${TagKey}	Write
DisassociateBudgetFromResource	Grants permission to disassociate a budget from a resource			Write
DisassociatePrincipalFromPortfolio	Grants permission to disassociate an IAM principal from a portfolio	Portfolio*	aws:ResourceTag/${TagKey}	Write
DisassociateProductFromPortfolio	Grants permission to disassociate a product from a portfolio			Write
DisassociateResource	Grants permission to disassociate a resource from an application	Application*	aws:ResourceTag/${TagKey}