Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Service Catalog

AWS Service Catalog (service prefix: servicecatalog) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Service Catalog
Actions defined by AWS Service Catalog
Permission-only actions for AWS Service Catalog
Resource types defined by AWS Service Catalog
Condition keys for AWS Service Catalog

API operations defined by AWS Service Catalog

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
AcceptPortfolioShare	servicecatalog	servicecatalog:AcceptPortfolioShare			Write
AssociateBudgetWithResource	servicecatalog	servicecatalog:AssociateBudgetWithResource			Write
AssociatePrincipalWithPortfolio	servicecatalog	servicecatalog:AssociatePrincipalWithPortfolio			Write
AssociateProductWithPortfolio	servicecatalog	servicecatalog:AssociateProductWithPortfolio			Write
AssociateServiceActionWithProvisioningArtifact	servicecatalog	servicecatalog:AssociateServiceActionWithProvisioningArtifact			Write
AssociateTagOptionWithResource	servicecatalog	servicecatalog:AssociateTagOptionWithResource			Write
BatchAssociateServiceActionWithProvisioningArtifact	servicecatalog	servicecatalog:BatchAssociateServiceActionWithProvisioningArtifact			Write
BatchDisassociateServiceActionFromProvisioningArtifact	servicecatalog	servicecatalog:BatchDisassociateServiceActionFromProvisioningArtifact			Write
CopyProduct	servicecatalog	servicecatalog:CopyProduct			Write
CreateConstraint	servicecatalog	servicecatalog:CreateConstraint			Write
CreateConstraint	servicecatalog	iam:PassRole	iam:PassedToService	servicecatalog.amazonaws.com	Write
CreatePortfolio	servicecatalog	servicecatalog:CreatePortfolio			Write
CreatePortfolio	servicecatalog	servicecatalog:TagResource			Tagging, Write
CreatePortfolioShare	servicecatalog	servicecatalog:CreatePortfolioShare			Permissions management, Write
CreateProduct	servicecatalog	servicecatalog:CreateProduct			Write
		servicecatalog:TagResource			Tagging, Write
		codestar-connections:PassConnection			Read
CreateProvisionedProductPlan	servicecatalog	servicecatalog:CreateProvisionedProductPlan			Write
CreateProvisioningArtifact	servicecatalog	servicecatalog:CreateProvisioningArtifact			Write
CreateServiceAction	servicecatalog	servicecatalog:CreateServiceAction			Write
CreateTagOption	servicecatalog	servicecatalog:CreateTagOption			Write
DeleteConstraint	servicecatalog	servicecatalog:DeleteConstraint			Write
DeletePortfolio	servicecatalog	servicecatalog:DeletePortfolio			Write
DeletePortfolioShare	servicecatalog	servicecatalog:DeletePortfolioShare			Permissions management, Write
DeleteProduct	servicecatalog	servicecatalog:DeleteProduct			Write
DeleteProvisionedProductPlan	servicecatalog	servicecatalog:DeleteProvisionedProductPlan			Write
DeleteProvisioningArtifact	servicecatalog	servicecatalog:DeleteProvisioningArtifact			Write
DeleteServiceAction	servicecatalog	servicecatalog:DeleteServiceAction			Write
DeleteTagOption	servicecatalog	servicecatalog:DeleteTagOption			Write
DescribeConstraint	servicecatalog	servicecatalog:DescribeConstraint			Read
DescribeCopyProductStatus	servicecatalog	servicecatalog:DescribeCopyProductStatus			Read
DescribePortfolio	servicecatalog	servicecatalog:DescribePortfolio			Read
DescribePortfolioShareStatus	servicecatalog	servicecatalog:DescribePortfolioShareStatus			Read
DescribePortfolioShares	servicecatalog	servicecatalog:DescribePortfolioShares			List
DescribeProduct	servicecatalog	servicecatalog:DescribeProduct			Read
DescribeProductAsAdmin	servicecatalog	servicecatalog:DescribeProductAsAdmin			Read
DescribeProductView	servicecatalog	servicecatalog:DescribeProductView			Read
DescribeProvisionedProduct	servicecatalog	servicecatalog:DescribeProvisionedProduct			Read
DescribeProvisionedProductPlan	servicecatalog	servicecatalog:DescribeProvisionedProductPlan			Read
DescribeProvisioningArtifact	servicecatalog	servicecatalog:DescribeProvisioningArtifact			Read
DescribeProvisioningParameters	servicecatalog	servicecatalog:DescribeProvisioningParameters			Read
DescribeRecord	servicecatalog	servicecatalog:DescribeRecord			Read
DescribeServiceAction	servicecatalog	servicecatalog:DescribeServiceAction			Read
DescribeServiceActionExecutionParameters	servicecatalog	servicecatalog:DescribeServiceActionExecutionParameters			Read
DescribeTagOption	servicecatalog	servicecatalog:DescribeTagOption			Read
DisableAWSOrganizationsAccess	servicecatalog	servicecatalog:DisableAWSOrganizationsAccess			Write
DisassociateBudgetFromResource	servicecatalog	servicecatalog:DisassociateBudgetFromResource			Write
DisassociatePrincipalFromPortfolio	servicecatalog	servicecatalog:DisassociatePrincipalFromPortfolio			Write
DisassociateProductFromPortfolio	servicecatalog	servicecatalog:DisassociateProductFromPortfolio			Write
DisassociateServiceActionFromProvisioningArtifact	servicecatalog	servicecatalog:DisassociateServiceActionFromProvisioningArtifact			Write
DisassociateTagOptionFromResource	servicecatalog	servicecatalog:DisassociateTagOptionFromResource			Write
EnableAWSOrganizationsAccess	servicecatalog	servicecatalog:EnableAWSOrganizationsAccess			Write
ExecuteProvisionedProductPlan	servicecatalog	servicecatalog:ExecuteProvisionedProductPlan			Write
ExecuteProvisionedProductServiceAction	servicecatalog	servicecatalog:ExecuteProvisionedProductServiceAction			Write
GetAWSOrganizationsAccessStatus	servicecatalog	servicecatalog:GetAWSOrganizationsAccessStatus			Read
GetProvisionedProductOutputs	servicecatalog	servicecatalog:GetProvisionedProductOutputs			Read
ImportAsProvisionedProduct	servicecatalog	servicecatalog:ImportAsProvisionedProduct			Write
ListAcceptedPortfolioShares	servicecatalog	servicecatalog:ListAcceptedPortfolioShares			List
ListBudgetsForResource	servicecatalog	servicecatalog:ListBudgetsForResource			List
ListConstraintsForPortfolio	servicecatalog	servicecatalog:ListConstraintsForPortfolio			List
ListLaunchPaths	servicecatalog	servicecatalog:ListLaunchPaths			List
ListOrganizationPortfolioAccess	servicecatalog	servicecatalog:ListOrganizationPortfolioAccess			List
ListPortfolioAccess	servicecatalog	servicecatalog:ListPortfolioAccess			List
ListPortfolios	servicecatalog	servicecatalog:ListPortfolios			List
ListPortfoliosForProduct	servicecatalog	servicecatalog:ListPortfoliosForProduct			List
ListPrincipalsForPortfolio	servicecatalog	servicecatalog:ListPrincipalsForPortfolio			List
ListProvisionedProductPlans	servicecatalog	servicecatalog:ListProvisionedProductPlans			List
ListProvisioningArtifacts	servicecatalog	servicecatalog:ListProvisioningArtifacts			List
ListProvisioningArtifactsForServiceAction	servicecatalog	servicecatalog:ListProvisioningArtifactsForServiceAction			List
ListRecordHistory	servicecatalog	servicecatalog:ListRecordHistory			List
ListResourcesForTagOption	servicecatalog	servicecatalog:ListResourcesForTagOption			List
ListServiceActions	servicecatalog	servicecatalog:ListServiceActions			List
ListServiceActionsForProvisioningArtifact	servicecatalog	servicecatalog:ListServiceActionsForProvisioningArtifact			List
ListStackInstancesForProvisionedProduct	servicecatalog	servicecatalog:ListStackInstancesForProvisionedProduct			List
ListTagOptions	servicecatalog	servicecatalog:ListTagOptions			List
NotifyProvisionProductEngineWorkflowResult	servicecatalog	servicecatalog:NotifyProvisionProductEngineWorkflowResult			Write
NotifyTerminateProvisionedProductEngineWorkflowResult	servicecatalog	servicecatalog:NotifyTerminateProvisionedProductEngineWorkflowResult			Write
NotifyUpdateProvisionedProductEngineWorkflowResult	servicecatalog	servicecatalog:NotifyUpdateProvisionedProductEngineWorkflowResult			Write
ProvisionProduct	servicecatalog	servicecatalog:ProvisionProduct			Write
RejectPortfolioShare	servicecatalog	servicecatalog:RejectPortfolioShare			Write
ScanProvisionedProducts	servicecatalog	servicecatalog:ScanProvisionedProducts			List
SearchProducts	servicecatalog	servicecatalog:SearchProducts			List
SearchProductsAsAdmin	servicecatalog	servicecatalog:SearchProductsAsAdmin			List
SearchProvisionedProducts	servicecatalog	servicecatalog:SearchProvisionedProducts			List
TerminateProvisionedProduct	servicecatalog	servicecatalog:TerminateProvisionedProduct			Write
UpdateConstraint	servicecatalog	servicecatalog:UpdateConstraint			Write
UpdateConstraint	servicecatalog	iam:PassRole	iam:PassedToService	servicecatalog.amazonaws.com	Write
UpdatePortfolio	servicecatalog	servicecatalog:UpdatePortfolio			Write
UpdatePortfolioShare	servicecatalog	servicecatalog:UpdatePortfolioShare			Permissions management, Write
UpdateProduct	servicecatalog	servicecatalog:UpdateProduct			Write
UpdateProduct	servicecatalog	codestar-connections:PassConnection			Read
UpdateProvisionedProduct	servicecatalog	servicecatalog:UpdateProvisionedProduct			Write
UpdateProvisionedProductProperties	servicecatalog	servicecatalog:UpdateProvisionedProductProperties			Write
UpdateProvisioningArtifact	servicecatalog	servicecatalog:UpdateProvisioningArtifact			Write
UpdateServiceAction	servicecatalog	servicecatalog:UpdateServiceAction			Write
UpdateTagOption	servicecatalog	servicecatalog:UpdateTagOption			Write
AssociateAttributeGroup	servicecatalog-appregistry	servicecatalog:AssociateAttributeGroup			Write
AssociateResource	servicecatalog-appregistry	servicecatalog:AssociateResource			Write
CreateApplication	servicecatalog-appregistry	servicecatalog:CreateApplication			Write
CreateApplication	servicecatalog-appregistry	servicecatalog:TagResource			Tagging, Write
CreateAttributeGroup	servicecatalog-appregistry	servicecatalog:CreateAttributeGroup			Write
CreateAttributeGroup	servicecatalog-appregistry	servicecatalog:TagResource			Tagging, Write
DeleteApplication	servicecatalog-appregistry	servicecatalog:DeleteApplication			Write
DeleteAttributeGroup	servicecatalog-appregistry	servicecatalog:DeleteAttributeGroup			Write
DisassociateAttributeGroup	servicecatalog-appregistry	servicecatalog:DisassociateAttributeGroup			Write
DisassociateResource	servicecatalog-appregistry	servicecatalog:DisassociateResource			Write
GetApplication	servicecatalog-appregistry	servicecatalog:GetApplication			Read
GetAssociatedResource	servicecatalog-appregistry	servicecatalog:GetAssociatedResource			Read
GetAttributeGroup	servicecatalog-appregistry	servicecatalog:GetAttributeGroup			Read
GetConfiguration	servicecatalog-appregistry	servicecatalog:GetConfiguration			Read
ListApplications	servicecatalog-appregistry	servicecatalog:ListApplications			List
ListAssociatedAttributeGroups	servicecatalog-appregistry	servicecatalog:ListAssociatedAttributeGroups			List
ListAssociatedResources	servicecatalog-appregistry	servicecatalog:ListAssociatedResources			List
ListAttributeGroups	servicecatalog-appregistry	servicecatalog:ListAttributeGroups			List
ListAttributeGroupsForApplication	servicecatalog-appregistry	servicecatalog:ListAttributeGroupsForApplication			List
ListTagsForResource	servicecatalog-appregistry	servicecatalog:ListTagsForResource			Read
PutConfiguration	servicecatalog-appregistry	servicecatalog:PutConfiguration			Write
SyncResource	servicecatalog-appregistry	servicecatalog:SyncResource			Write
TagResource	servicecatalog-appregistry	servicecatalog:TagResource			Tagging, Write
UntagResource	servicecatalog-appregistry	servicecatalog:UntagResource			Tagging, Write
UpdateApplication	servicecatalog-appregistry	servicecatalog:UpdateApplication			Write
UpdateAttributeGroup	servicecatalog-appregistry	servicecatalog:UpdateAttributeGroup			Write

Actions defined by AWS Service Catalog

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptPortfolioShare	Grants permission to accept a portfolio that has been shared with you	Portfolio*	aws:ResourceTag/${TagKey}	Write
AssociateAttributeGroup	Grants permission to associate an attribute group with an application	Application*	aws:ResourceTag/${TagKey}	Write
AssociateAttributeGroup		AttributeGroup*	aws:ResourceTag/${TagKey}	Write
AssociateBudgetWithResource	Grants permission to associate a budget with a resource			Write
AssociatePrincipalWithPortfolio	Grants permission to associate an IAM principal with a portfolio, giving the specified principal access to any products associated with the specified portfolio	Portfolio*	aws:ResourceTag/${TagKey}	Write
AssociateProductWithPortfolio	Grants permission to associate a product with a portfolio			Write
AssociateResource	Grants permission to associate a resource with an application	Application*	aws:ResourceTag/${TagKey} servicecatalog:Resource servicecatalog:ResourceType	Write
AssociateServiceActionWithProvisioningArtifact	Grants permission to associate an action with a provisioning artifact	Product*	aws:ResourceTag/${TagKey}	Write
AssociateTagOptionWithResource	Grants permission to associate the specified TagOption with the specified portfolio or product	Portfolio	aws:ResourceTag/${TagKey}	Write
AssociateTagOptionWithResource		Product	aws:ResourceTag/${TagKey}	Write
BatchAssociateServiceActionWithProvisioningArtifact	Grants permission to associate multiple self-service actions with provisioning artifacts			Write
BatchDisassociateServiceActionFromProvisioningArtifact	Grants permission to disassociate a batch of self-service actions from the specified provisioning artifact			Write
CopyProduct	Grants permission to copy the specified source product to the specified target product or a new product			Write
CreateApplication	Grants permission to create an application	Application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAttributeGroup	Grants permission to create an attribute group	AttributeGroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConstraint	Grants permission to create a constraint on an associated product and portfolio	Product*	aws:ResourceTag/${TagKey}	Write
CreatePortfolio	Grants permission to create a portfolio	Portfolio*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePortfolioShare	Grants permission to share a portfolio you own with another AWS account	Portfolio*	aws:ResourceTag/${TagKey}	Permissions management, Write
CreateProduct	Grants permission to create a product and that product's first provisioning artifact	Product*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProvisionedProductPlan	Grants permission to add a new provisioned product plan		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Write
CreateProvisioningArtifact	Grants permission to add a new provisioning artifact to an existing product	Product*	aws:ResourceTag/${TagKey}	Write
CreateServiceAction	Grants permission to create a self-service action			Write
CreateTagOption	Grants permission to create a TagOption			Write
DeleteApplication	Grants permission to delete an application if all associations have been removed from the application	Application*	aws:ResourceTag/${TagKey}	Write
DeleteAttributeGroup	Grants permission to delete an attribute group if all associations have been removed from the attribute group	AttributeGroup*	aws:ResourceTag/${TagKey}	Write
DeleteConstraint	Grants permission to remove and delete an existing constraint from an associated product and portfolio			Write
DeletePortfolio	Grants permission to delete a portfolio if all associations and shares have been removed from the portfolio	Portfolio*	aws:ResourceTag/${TagKey}	Write
DeletePortfolioShare	Grants permission to unshare a portfolio you own from an AWS account you previously shared the portfolio with	Portfolio*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteProduct	Grants permission to delete a product if all associations have been removed from the product	Product*	aws:ResourceTag/${TagKey}	Write
DeleteProvisionedProductPlan	Grants permission to delete a provisioned product plan		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Write
DeleteProvisioningArtifact	Grants permission to delete a provisioning artifact from a product	Product*	aws:ResourceTag/${TagKey}	Write
DeleteServiceAction	Grants permission to delete a self-service action			Write
DeleteTagOption	Grants permission to delete the specified TagOption			Write
DescribeConstraint	Grants permission to describe a constraint			Read
DescribeCopyProductStatus	Grants permission to get the status of the specified copy product operation			Read
DescribePortfolio	Grants permission to describe a portfolio	Portfolio*	aws:ResourceTag/${TagKey}	Read
DescribePortfolioShareStatus	Grants permission to get the status of the specified portfolio share operation			Read
DescribePortfolioShares	Grants permission to view a summary of each of the portfolio shares that were created for the specified portfolio	Portfolio*	aws:ResourceTag/${TagKey}	List
DescribeProduct	Grants permission to describe a product as an end-user	Product*	aws:ResourceTag/${TagKey}	Read
DescribeProductAsAdmin	Grants permission to describe a product as an admin	Product*	aws:ResourceTag/${TagKey}	Read
DescribeProductView	Grants permission to describe a product as an end-user			Read
DescribeProvisionedProduct	Grants permission to describe a provisioned product		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Read
DescribeProvisionedProductPlan	Grants permission to describe a provisioned product plan		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Read
DescribeProvisioningArtifact	Grants permission to describe a provisioning artifact	Product*	aws:ResourceTag/${TagKey}	Read
DescribeProvisioningParameters	Grants permission to describe the parameters that you need to specify to successfully provision a specified provisioning artifact	Product*	aws:ResourceTag/${TagKey}	Read
DescribeRecord	Grants permission to describe a record and lists any outputs		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Read
DescribeServiceAction	Grants permission to describe a self-service action			Read
DescribeServiceActionExecutionParameters	Grants permission to get the default parameters if you executed the specified Service Action on the specified Provisioned Product		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Read
DescribeTagOption	Grants permission to get information about the specified TagOption			Read
DisableAWSOrganizationsAccess	Grants permission to disable portfolio sharing through AWS Organizations feature			Write
DisassociateAttributeGroup	Grants permission to disassociate an attribute group from an application	Application*	aws:ResourceTag/${TagKey}	Write
DisassociateAttributeGroup		AttributeGroup*	aws:ResourceTag/${TagKey}	Write
DisassociateBudgetFromResource	Grants permission to disassociate a budget from a resource			Write
DisassociatePrincipalFromPortfolio	Grants permission to disassociate an IAM principal from a portfolio	Portfolio*	aws:ResourceTag/${TagKey}	Write
DisassociateProductFromPortfolio	Grants permission to disassociate a product from a portfolio			Write
DisassociateResource	Grants permission to disassociate a resource from an application	Application*	aws:ResourceTag/${TagKey} servicecatalog:Resource servicecatalog:ResourceType	Write
DisassociateServiceActionFromProvisioningArtifact	Grants permission to disassociate the specified self-service action association from the specified provisioning artifact	Product*	aws:ResourceTag/${TagKey}	Write
DisassociateTagOptionFromResource	Grants permission to disassociate the specified TagOption from the specified resource	Portfolio	aws:ResourceTag/${TagKey}	Write
DisassociateTagOptionFromResource		Product	aws:ResourceTag/${TagKey}	Write
EnableAWSOrganizationsAccess	Grants permission to enable portfolio sharing feature through AWS Organizations			Write
ExecuteProvisionedProductPlan	Grants permission to execute a provisioned product plan		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Write
ExecuteProvisionedProductServiceAction	Grants permission to executes a provisioned product plan		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Write
GetAWSOrganizationsAccessStatus	Grants permission to get the access status of AWS Organization portfolio share feature			Read
GetApplication	Grants permission to get an application	Application*	aws:ResourceTag/${TagKey}	Read
GetAssociatedResource	Grants permission to get information about a resource associated to an application	Application*	aws:ResourceTag/${TagKey} servicecatalog:Resource servicecatalog:ResourceType	Read
GetAttributeGroup	Grants permission to get an attribute group	AttributeGroup*	aws:ResourceTag/${TagKey}	Read
GetConfiguration	Grants permission to read AppRegistry configurations			Read
GetProvisionedProductOutputs	Grants permission to get the provisioned product output with either provisioned product id or name			Read
ImportAsProvisionedProduct	Grants permission to import a resource into a provisioned product	Product*	aws:ResourceTag/${TagKey}	Write
ListAcceptedPortfolioShares	Grants permission to list the portfolios that have been shared with you and you have accepted			List
ListApplications	Grants permission to list your applications			List
ListAssociatedAttributeGroups	Grants permission to list the attribute groups associated with an application	Application*	aws:ResourceTag/${TagKey}	List
ListAssociatedResources	Grants permission to list the resources associated with an application	Application*	aws:ResourceTag/${TagKey}	List
ListAttributeGroups	Grants permission to list your attribute groups			List
ListAttributeGroupsForApplication	Grants permission to list the associated attribute groups for a given application	Application*	aws:ResourceTag/${TagKey}	List
ListBudgetsForResource	Grants permission to list all the budgets associated to a resource			List
ListConstraintsForPortfolio	Grants permission to list constraints associated with a given portfolio			List
ListLaunchPaths	Grants permission to list the different ways to launch a given product as an end-user	Product*	aws:ResourceTag/${TagKey}	List
ListOrganizationPortfolioAccess	Grants permission to list the organization nodes that have access to the specified portfolio			List
ListPortfolioAccess	Grants permission to list the AWS accounts you have shared a given portfolio with	Portfolio*	aws:ResourceTag/${TagKey}	List
ListPortfolios	Grants permission to list the portfolios in your account			List
ListPortfoliosForProduct	Grants permission to list the portfolios associated with a given product	Product*	aws:ResourceTag/${TagKey}	List
ListPrincipalsForPortfolio	Grants permission to list the IAM principals associated with a given portfolio	Portfolio*	aws:ResourceTag/${TagKey}	List
ListProvisionedProductPlans	Grants permission to list the provisioned product plans		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	List
ListProvisioningArtifacts	Grants permission to list the provisioning artifacts associated with a given product	Product*	aws:ResourceTag/${TagKey}	List
ListProvisioningArtifactsForServiceAction	Grants permission to list all provisioning artifacts for the specified self-service action			List
ListRecordHistory	Grants permission to list all the records in your account or all the records related to a given provisioned product		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	List
ListResourcesForTagOption	Grants permission to list the resources associated with the specified TagOption			List
ListServiceActions	Grants permission to list all self-service actions			List
ListServiceActionsForProvisioningArtifact	Grants permission to list all the service actions associated with the specified provisioning artifact in your account	Product*	aws:ResourceTag/${TagKey} servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	List
ListStackInstancesForProvisionedProduct	Grants permission to list account, region and status of each stack instances that are associated with a CFN_STACKSET type provisioned product		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	List
ListTagOptions	Grants permission to list the specified TagOptions or all TagOptions			List
ListTagsForResource	Grants permission to list the tags for a service catalog appregistry resource	Application	aws:ResourceTag/${TagKey}	Read
ListTagsForResource		AttributeGroup	aws:ResourceTag/${TagKey}	Read
NotifyProvisionProductEngineWorkflowResult	Grants permission to notify the result of the provisioning engine execution			Write
NotifyTerminateProvisionedProductEngineWorkflowResult	Grants permission to notify the result of the terminate engine execution			Write
NotifyUpdateProvisionedProductEngineWorkflowResult	Grants permission to notify the result of the update engine execution			Write
ProvisionProduct	Grants permission to provision a product with a specified provisioning artifact and launch parameters	Product*	aws:ResourceTag/${TagKey}	Write
PutConfiguration	Grants permission to assign AppRegistry configurations			Write
RejectPortfolioShare	Grants permission to reject a portfolio that has been shared with you that you previously accepted	Portfolio*	aws:ResourceTag/${TagKey}	Write
ScanProvisionedProducts	Grants permission to list all the provisioned products in your account		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	List
SearchProducts	Grants permission to list the products available to you as an end-user			List
SearchProductsAsAdmin	Grants permission to list all the products in your account or all the products associated with a given portfolio			List
SearchProvisionedProducts	Grants permission to list all the provisioned products in your account		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	List
SyncResource	Grants permission to sync a resource with its current state in AppRegistry			Write
TagResource	Grants permission to tag a service catalog appregistry resource	Application	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource		AttributeGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TerminateProvisionedProduct	Grants permission to terminate an existing provisioned product		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Write
UntagResource	Grants permission to remove a tag from a service catalog appregistry resource	Application	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		AttributeGroup	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateApplication	Grants permission to update the attributes of an existing application	Application*	aws:ResourceTag/${TagKey}	Write
UpdateAttributeGroup	Grants permission to update the attributes of an existing attribute group	AttributeGroup*	aws:ResourceTag/${TagKey}	Write
UpdateConstraint	Grants permission to update the metadata fields of an existing constraint			Write
UpdatePortfolio	Grants permission to update the metadata fields and/or tags of an existing portfolio	Portfolio*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdatePortfolioShare	Grants permission to enable or disable resource sharing for an existing portfolio share	Portfolio*	aws:ResourceTag/${TagKey}	Permissions management, Write
UpdateProduct	Grants permission to update the metadata fields and/or tags of an existing product	Product*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateProvisionedProduct	Grants permission to update an existing provisioned product		servicecatalog:accountLevel servicecatalog:roleLevel servicecatalog:userLevel	Write
UpdateProvisionedProductProperties	Grants permission to update the properties of an existing provisioned product			Write
UpdateProvisioningArtifact	Grants permission to update the metadata fields of an existing provisioning artifact	Product*	aws:ResourceTag/${TagKey}	Write
UpdateServiceAction	Grants permission to update a self-service action			Write
UpdateTagOption	Grants permission to update the specified TagOption			Write

Permission-only actions for AWS Service Catalog

The following actions are defined by AWS Service Catalog but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
DeleteResourcePolicy	Grants permission to delete a resource-based policy for the specified resource	Application	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy		AttributeGroup	aws:ResourceTag/${TagKey}	Write
GetResourcePolicy	Grants permission to get a resource-based policy for the specified resource	Application	aws:ResourceTag/${TagKey}	Read
GetResourcePolicy		AttributeGroup	aws:ResourceTag/${TagKey}	Read
PutResourcePolicy	Grants permission to add a resource-based policy for the specified resource	Application	aws:ResourceTag/${TagKey}	Write
PutResourcePolicy		AttributeGroup	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Service Catalog

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Application	arn:${Partition}:servicecatalog:${Region}:${Account}:/applications/${ApplicationId}	aws:ResourceTag/${TagKey}
AttributeGroup	arn:${Partition}:servicecatalog:${Region}:${Account}:/attribute-groups/${AttributeGroupId}	aws:ResourceTag/${TagKey}
Portfolio	arn:${Partition}:catalog:${Region}:${Account}:portfolio/${PortfolioId}	aws:ResourceTag/${TagKey}
Product	arn:${Partition}:catalog:${Region}:${Account}:product/${ProductId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Service Catalog

AWS Service Catalog defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
servicecatalog:Resource	Filters access by controlling what value can be specified as the Resource parameter in an AppRegistry associate resource API	String
servicecatalog:ResourceType	Filters access by controlling what value can be specified as the ResourceType parameter in an AppRegistry associate resource API	String
servicecatalog:accountLevel	Filters access by user to see and perform actions on resources created by anyone in the account	String
servicecatalog:roleLevel	Filters access by user to see and perform actions on resources created either by them or by anyone federating into the same role as them	String
servicecatalog:userLevel	Filters access by user to see and perform actions on only resources that they created	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Service - Oracle Database@AWS (odb)

AWS service providing managed private networks (private-networks)