# Managing Products You can create products, update products by creating a new version based on an updated template, and group products together into portfolios to distribute them to users. New versions of products are propagated to all users who have access to the product through a portfolio. When you distribute an update, end users can update existing provisioned products. **Topics** + [Viewing the Products Page](#productmgmt-menu) + [Creating Products](productmgmt-cloudresource.md) + [Adding products to portfolios](catalogs_portfolios_adding-products.md) + [Updating products](productmgmt-update.md) + [Syncing products to template files from GitHub, GitHub Enterprise, or Bitbucket](git-synced-sc-products.md) + [Deleting products](productmgmt-delete.md) + [Managing Versions](managing-versions.md) ## Viewing the Products Page You manage products from the **Products list** page in the AWS Service Catalog administrator console. **To view the **Products list** page** 1. Open the Service Catalog console at [https://console.aws.amazon.com/servicecatalog/](https://console.aws.amazon.com/servicecatalog/). 1. Choose **Product list**. # Creating Products You create products from the **Products** page in the AWS Service Catalog administrator console. **Note** Creating Terraform products require additional configuration, including a Terraform provisioning engine and launch role. For more information, review [Getting started with a Terraform product](getstarted-Terraform.md). **To create a new AWS Service Catalog product** 1. Navigate to the **Products list** page. 1. Choose **Create product**, and the choose **Create product**. 1. **Product details** – Enables you to choose the type of product you want to create. AWS Service Catalog supports CloudFormation, Terraform Cloud, and External (supports Terraform Community Edition) product types. Product details also contains the metadata that appears when you search for and view products in a list or detail page. Enter the following: + **Product name** – The name of the product. + **Product description **– The description shows in the product listing to help you choose the correct product. + **Owner** – The person or organization that publishes this product. The owner could be the name of your IT organization, or administrator. + **Distributor **(optional) – The name of the application's publisher. This field allows you to sort the products list to make it easier to find products. 1. **Version details ** enables you to add your template file and build your product. Enter the following: + **Choose method** – There are four ways to add a template file. + **Use a local template file** - Upload an CloudFormation template or a Terraform tar.gz configuration file from a local drive. + **Use an Amazon S3 URL** - Specify a URL that points to an CloudFormation template or a Terraform tar.gz configuration file stored in Amazon S3. If you specify an Amazon S3 URL, it must begin with `https://`. + **Use an external repository** - Specify your GitHub, GitHub Enterprise, or Bitbucket code repository. AWS Service Catalog allows you to sync products to template files. For Terraform products, the template file format is required to be a single file archived in Tar and compressed in Gzip. + **Use an existing CloudFormation stack** - Enter the ARN for an existing CloudFormation stack. This method does not support Terraform Cloud or External products. + **Version name** (optional) – The name of the product version (e.g., "v1", "v2beta"). No spaces are allowed. + **Description** (optional) – A description of the product version, including how this version differs from the other versions. + **Guidance** – Managed in the versions tab on a **Product details** page. When a product version is created—during the create product workflow—guidance for that version is set to default. To learn more about guidance, see [Managing Versions](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/managing-versions.html). 1. **Support details **identifies the organization within your company, and provides a point of contact for support. Enter the following: + **Email contact** (optional) – The email address for reporting issues with the product. + **Support link** (optional) – An URL to a site where users can find support information or file tickets. The URL must begin with `http://` or `https://`. Administrators are responsible for maintaining the accuracy and access of support information. + **Support description** (optional) – A description of how you should use the **Email contact** and **Support** link. 1. **Manage tags** (optional) – In addition to using tags to categorize your resources, you can also use them to authenticate your permissions to create this resource. 1. **Create product** – When you have completed the form, select **Create product**. After a few seconds, the product appears on the **Products list** page. You might need to refresh your browser to see the product. You can also use CodePipeline to create and configure a pipeline to deploy your product template to AWS Service Catalog and deliver changes you have made in your source repository. For more information, see[ Tutorial: Create a Pipeline That Deploys to AWS Service Catalog](https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-S3-servicecatalog.html). You can define parameter properties in your CloudFormation or Terraform template and enforce those rules during provisioning. These properties can define the minimum and maximum length, minimum and maximum values, allowed values, and a regular expression for the value. AWS Service Catalog issues a warning during provisioning if the value provided does not adhere to the parameter property. To learn more about parameter properties, see [Parameters ](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html) in the *CloudFormation User Guide*. ## Troubleshooting You must have permission to retrieve objects from Amazon S3 buckets. Otherwise, you might encounter the following error when launching or updating a product. ``` Error: failed to process product version s3 access denied exception ``` If you encounter this message, ensure have permission to retrieve objects from the following buckets: + The bucket where the provisioning artifact template is stored. + The bucket that begins with "***cf-templates-\$1***" and where AWS Service Catalog stores the provisioning artifact template. + The internal bucket that begins with "***sc-\$1***" and where AWS Service Catalog stores metadata. You won't be able to see this bucket from your account. The following example policy shows the minimum permissions that are required to retrieve objects from the previously mentioned buckets. ``` { "Sid": "VisualEditor1", "Effect": "Allow", "Action": "s3:GetObject*", "Resource": [ "arn:aws:s3:::YOUR_TEMPLATE_BUCKET", "arn:aws:s3:::YOUR_TEMPLATE_BUCKET/*", "arn:aws:s3:::cf-templates-*", "arn:aws:s3:::cf-templates-*/*", "arn:aws:s3:::sc-*", "arn:aws:s3:::sc-*/*" ] } ``` # Adding products to portfolios You can add products to any number of portfolios. When a product is updated, all of the portfolios (including shared portfolios) that contain the product automatically receive the new version. **To add a product from your catalog to a portfolio** 1. Navigate to the **Products list** page. 1. Select a product, and then choose **Actions**. From the dropdown menu, choose **Add product to portfolio**. You're directed to the **Add *name-of-product* to portfolio** page. 1. Choose a portfolio, and then choose **Add product to portfolio**. When adding a Terraform product to a portfolio, the product requires a launch constraint. You must select an IAM role from your account, enter an IAM role ARN, or enter a role name. If you specify a role name and if an account uses the launch constraint, the account uses that name for the IAM role. This allows launch-role constraints to be account-agnostic, ensuring you can create fewer resources per shared account. For details and instructions, review [Step 6: Add a Launch constraint to your Terraform product](getstarted-launchconstraint-Terraform.md) A portfolio can contain numerous products that are mix of CloudFormation and Terraform product types. # Updating products When you update a product's template, you create a new version of the product. New product versions are automatically available to all users who have access to a portfolio containing the product. **Note** When updating an existing product, you cannot change the product type (CloudFormation or Teraform). For example, if you update a CloudFormation product, you cannot replace the existing CloudFormation template with a Terraform tar.gz configuration file. You must update the existing CloudFormation template file with a new CloudFormation template file. End users who are currently running a provisioned product of the previous product version can update their provisioned product to the new version. When a new version of a product is available, users can use the **Update provisioned product** command on the **Provisioned product list** or **Provisioned product details** pages. Before you create a new version of a product, AWS Service Catalog recommends that you test your product updates in CloudFormation or in the Terraform engine to ensure that they function properly. **To create a new product version** 1. Navigate to the **Product list** page. 1. Choose the product product that you would like to update. You're directed to the *Product details * page. 1. On the *Product details * page, expand the **Versions** tab, and then choose **Create new version**. 1. Under **Version details**, perform the following: + **Choose template** – There are four ways to add a template file. *Use a local template file* - Upload an CloudFormation template or a Terraform tar.gz configuration file from a local drive. *Use an Amazon S3 URL* - Specify a URL that points to an CloudFormation template or a Terraform tar.gz configuration file stored in Amazon S3. If you specify an Amazon S3 URL, it must begin with https://. *Use an external repository* - Specify your GitHub, GitHub Enterprise, or Bitbucket code repository. AWS Service Catalog allows you to sync products to template files. For Terraform products, the template file format is required to be a single file archived in Tar and compressed in Gzip. *Use an existing CloudFormation stack* - Enter the ARN for an existing CloudFormation stack. This method does not support Terraform Cloud or External products. + **Version title** – The name of the product version (e.g., "v1", "v2beta"). No spaces are allowed. + **Description** (optional) – A description of the product version, including how this version differs from the previous version. 1. Choose **Create product version**. You can also use CodePipeline to create and configure a pipeline to deploy your product template to AWS Service Catalog, and deliver your changes in your source repository. For more information, see [Tutorial: Create a Pipeline That Deploys to AWS Service Catalog](https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-S3-servicecatalog.html). # Syncing products to template files from GitHub, GitHub Enterprise, or Bitbucket AWS Service Catalog allows you to sync products to template files that are managed through external repository provider. AWS Service Catalog refers to products with this type of template connection as *Git-synced* products. Repository options include GitHub, GitHub Enterprise, or Bitbucket. After you authorize your AWS account with an external repository account, you can create new AWS Service Catalog products or update existing products to sync to a template file in the repository. When changes are made to the template file and committed in the repository (for example, using git-push), AWS Service Catalog automatically detects the changes and creates a new product version (artifact). **Topics** + [Required permissions to sync products to external template files](#required-perms-synced-repo) + [Create an account connection](#create-synced-product) + [Viewing Git-synced product connections](#view-repo-sync) + [Updating Git-synced product connections](#update-repo-sync) + [Deleting Git-synced product connections](#delete-repo-sync) + [Syncing Terraform products to template files from GitHub, GitHub Enterprise, or Bitbucket](#git-synced-Terraform) + [AWS Region support for Git-synced products](git-sync-supported-regions.md) ## Required permissions to sync products to external template files You can use the following AWS Identity and Access Management (IAM) policy as a template to enable AWS Service Catalog administrators to sync products to template files from an external repository. This policy includes required permissions from both CodeConnections and AWS Service Catalog. AWS Service Catalog recommends that you copy the template policy below, and also use the AWS Service Catalog `AWSServiceCatalogAdminFullAccess` [managed policy](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/security-iam-awsmanpol) when enabling repository-synced products. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "CodeStarAccess", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection", "codestar-connections:PassConnection", "codestar-connections:CreateConnection", "codestar-connections:DeleteConnection", "codestar-connections:GetConnection", "codestar-connections:ListConnections", "codestar-connections:ListInstallationTargets", "codestar-connections:GetInstallationUrl", "codestar-connections:StartOAuthHandshake", "codestar-connections:UpdateConnectionInstallation", "codestar-connections:GetIndividualAccessToken" ], "Resource": "arn:aws:codestar-connections:*:*:connection/*" }, { "Sid": "CreateSLR", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/sync.servicecatalog.amazonaws.com/AWSServiceRoleForServiceCatalogArtifactSync", "Condition": { "StringLike": { "iam:AWSServiceName": "sync.servicecatalog.amazonaws.com" } } } ] } ``` ------ ## Create an account connection Before syncing a template file to a AWS Service Catalog product, you must create and authorize a one-time, account-to-account connection. You use this connection to specify the details of the repository containing the desired template file. You can create a connection using the AWS Service Catalog console, CodeConnections console, AWS Command Line Interface (CLI), or CodeConnections APIs. After establishing a connection, you can use the AWS Service Catalog console, AWS Service Catalog API, or CLI to create a synced AWS Service Catalog product. AWS Service Catalog administrators can create new or update existing AWS Service Catalog products based on a template file in a repository and branch. If a change is committed in the repository, AWS Service Catalog automatically detects the change and creates a new product version. Previous product versions are maintained up to the prescribed version limit and assigned a **deprecated** status. Additionally, AWS Service Catalog automatically creates a service-linked role (SLR) after the connection is created. This SLR allows AWS Service Catalog to detect any template file changes that are committed to the repository. The SLR also allows AWS Service Catalog to automatically create new product versions for synced products. For more information about SLR permissions and functionality, refer to [Service-linked roles for AWS Service Catalog](#required-perms-synced-repo). **To create a new Git-synced product** 1. In the left navigation panel, choose **Product list**, and then choose **Create product**. 1. Enter the **Product details**. 1. In Version details, choose **Specify your code repository using an AWS CodeStar provider**, and then choose the **Create a new AWS CodeStar connection** link. 1. After you create the connection, refresh the connections list, and then select the new connection. Specify the repository details, including the **repository**, **branch**, and **template file path**. For infomration about using a Terraform configuration file, see [Syncing Terraform products to template files from GitHub, GitHub Enterprise, or Bitbucket](#git-synced-Terraform). 1. (Optional when creating a new AWS Service Catalog product resource) In the **Support Details** section, add metadata for the product. 1. (Optional when creating a new AWS Service Catalog product resource) In the **Tags** section, choose **Add new tag** and enter the **Key** and **Value** pairs. 1. Choose **Create new product**. **To create multiple Git-synced products** 1. In the AWS Service Catalog console left navigation panel, choose **Product list**, and then choose **Create multiple git-managed products**. 1. Enter the **Common product details**. 1. In External repository details, select an **AWS CodeStar connection**, and then specify the **repository** and **branch**. 1. In the Add products pane, enter the **Template file path** and **Product name**. Choose **Add new item** and continue adding products as desired. 1. After adding all desired products, choose **Bulk create products**. **To connect an existing AWS Service Catalog product to an external repository** 1. In the AWS Service Catalog console left navigation panel, choose **Product list**, and then choose **Connect products to an external repository**. 1. On the Select products page, select the products you want to connect to an external repository, and then choose **Next**. 1. On the Specify source details page, select an existing AWS CodeStar connection, and then specify the **repository**,the **branch**, and the **template file path**. 1. Choose **Next**. 1. On the Review and submit page, verify the connection details, and then choose **Connect products to an external repository**. ## Viewing Git-synced product connections You can use the AWS Service Catalog console, API, or AWS CLI to view repository connection details. For AWS Service Catalog products that are linked to a template file, you can retrieve information about the repository connection and the last time the template was synced with the product from the **Last Sync Status**. **Note** You can view repository information and the **Last Sync Status** at the product level. Users must have IAM permissions in the CodeConnections APIs to view repository details. Refer to [Required permissions to sync AWS Service Catalog products to template files](#required-perms-synced-repo) for more information about the required policy for these IAM permissions. **To view connection and repository details using AWS Management Console** 1. In the left navigation panel, choose **Product list**. 1. Select the product from the list. 1. On the **Product** page, navigate to the **Product source details** section. 1. To view the source revision ID for a product version, choose the **Last version created** link. The **Version details** section display the source revision ID. **To view connection and repository details using AWS CLI** From the AWS CLI, run the following commands: `$ aws servicecatalog describe-product-as-admin` `$ aws servicecatalog describe-provisioning-artifact` `$ aws servicecatalog search-product-as-admin` `$ aws servicecatalog list-provisioning-artifacts` ## Updating Git-synced product connections You can update existing account connections and Git-synced products using the AWS Service Catalog console, AWS Service Catalog API, or AWS CLI. To learn how to connect an existing AWS Service Catalog product to a template file, refer to [ Creating new Git-synced product connections](#create-synced-product). **To update existing products to Git-synced products** 1. In the left navigation panel, choose **Product list**, and then choose one of the following options: + To update a **single product**, select the product, navigate to the **Product source details** section, and then choose **Edit details**. + To update **multiple products**, choose **Connect products to an external repository**, select up to ten products, and then choose **Next**. 1. In the **Product source details** section, perform the following updates: + Specify the connection. + Specify the repository. + Specify the branch. + Name the template file. 1. Choose **Save changes**. **Note** For products not yet connected to an external repository, you can use the **Connect to an external repository** option displayed in the alert at the top of the product info page after selecting the product. You can also use the AWS Service Catalog console or the AWS CLI to + Connect an existing AWS Service Catalog product to a template file in an external repository + Update product metadata, including the product name, description, and tags. + Reconfigure (update the sync to use a different repository source) a connection for a previously connected AWS Service Catalog product. **To update connection and repository details using AWS Service Catalog console** 1. In the AWS Service Catalog console left navigation panel, choose **Product list**, and then select a product that is currently connected to an external repository. 1. In the **Product source details** section, choose **Edit product source**. 1. In the **Product source details** section, specify the new desired repository. 1. Choose **Save changes**. **To update connection and repository details using AWS CLI** From the AWS CLI run the `$ aws servicecatalog update-product` and `$ aws servicecatalog update-provisioning-artifact` commands. ## Deleting Git-synced product connections You can delete a connection between a AWS Service Catalog product and a template file using the AWS Service Catalog console, CodeConnections API, or AWS CLI. When you disconnect a product from a template file, the synced AWS Service Catalog product switches to a regularly managed product. After disconnecting the product, if the template file is changed and committed in the previously connected repository, the changes are *not* reflected. To re-connect a AWS Service Catalog product to a template file in an external repository, refer to [Updating connections and synced AWS Service Catalog products](). **To disconnect a Git-synced product using the AWS Service Catalog console** 1. In the AWS Management Console, choose **Product list** from the left navigation panel. 1. Select a product from the list. 1. On the **Product** page, navigate to the **Product source details** section. 1. Choose **Disconnect**. 1. Confirm the action, and then choose **Disconnect**. **To disconnect a Git-synced product using AWS CLI** From the AWS CLI, run the `$ aws servicecatalog update-product` command. In the `ConnectionParameters` input, remove the specified connection. **To delete a connection using the CodeConnections API or AWS CLI** In the CodeConnections API or AWS CLI, run the `$ aws codestar-connections delete-connection` command. ## Syncing Terraform products to template files from GitHub, GitHub Enterprise, or Bitbucket When creating a Git-synced product using a Terraform configuration file, the file path only accepts the tar.gz format. Terraform folder formats are not accepted in the file path. # AWS Region support for Git-synced products AWS Service Catalog supports Git-synced produtcs in AWS Regions as indicated in the table below. **** | AWS Region name | AWS Region identity | Support for Git-synced products | | --- | --- | --- | | US East (N. Virginia) | us-east-1 | Yes | | US East (Ohio) | us-east-2 | Yes | | US West (N. California) | us-west-1 | Yes | | US West (Oregon) | us-west-2 | Yes | | Africa (Cape Town) | af-south-1 | No | | Asia Pacific (Hong Kong) | ap-east-1 | No | | Asia Pacific (Jakarta) | ap-southeast-3 | No | | Asia Pacific (Mumbai) | ap-south-1 | Yes | | Asia Pacific (Osaka) | ap-northeast-3 | No | | Asia Pacific (Seoul) | ap-northeast-2 | Yes | | Asia Pacific (Singapore) | ap-southeast-1 | Yes | | Asia Pacific (Sydney) | ap-southeast-2 | Yes | | Asia Pacific (Tokyo) | ap-northeast-1 | Yes | | Canada (Central) | ca-central-1 | Yes | | Europe (Frankfurt) | eu-central-1 | Yes | | Europe (Ireland) | eu-west-1 | Yes | | Europe (London) | eu-west-2 | Yes | | Europe (Milan) | eu-south-1 | No | | Europe (Paris) | eu-west-3 | Yes | | Europe (Stockholm) | eu-north-1 | Yes | | Middle East (Bahrain) | me-south-1 | No | | South America (São Paulo) | sa-east-1 | Yes | | AWS GovCloud (US-East) | us-gov-east-1 | No | | AWS GovCloud (US-West) | us-gov-west-1 | No | # Deleting products When you delete a product, AWS Service Catalog removes all product versions from every portfolio containing the product. AWS Service Catalog allows you to delete a product using the AWS Service Catalog console or AWS CLI. To successfully delete a product, you must disassociate all resources associated with the product first. Examples of product resource associations include portfolio associations, budgets, TagOptions, and Service Actions. **Important** You cannot recover a product after it is deleted. **To delete a product using the AWS Service Catalog console** 1. Navigate to the **Portfolios** page and select the portfolio containing the product you want to delete. 1. Select the product that you want to delete, and then choose **Delete** on the upper right of the product pane. 1. For products *without associated resources*, confirm the product you want to delete by entering **delete** in the text box, and then choose **Delete**. For products *with associated resources*, continue to step 4. 1. In the **Delete product** window, review the **Associations** table, which displays all of the product's associated resources. AWS Service Catalog attempts to disassociate these resources when you delete the product. 1. Confirm you want to delete the product and remove all of its associated resources by entering **delete** in the text box. 1. Choose **Disassociate and delete**. If AWS Service Catalog is unable to disassociate all of the product's resources, the product is not deleted. The **Delete product** window displays the number of failed disassociations and a description for each failure. For more information about resolving failed resource disassociations when deleting a product, see * Resolving failed resource disassociations when deleting a product* below. **Topics** + [Deleting products using the AWS CLI](product-delete-cli.md) + [Resolving failed resource disassociations when deleting a product](product-delete-exception.md) # Deleting products using the AWS CLI AWS Service Catalog allows you to use the [AWS Command Line Interface](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html) (AWS CLI) to delete products from your portfolio. The AWS CLI is an open source tool that enables you to interact with AWS services using commands in your command-line shell. The AWS Service Catalog force-delete function requires an [AWS CLI alias](https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-alias.html), which is a shortcut you can create in the AWS CLI to shorten commands or scripts that you frequently use. ## Prerequisites + Install and configure the AWS CLI. For more information, see [ Installing or updating the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) and [ Configuration basics](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html). Use a minimum AWS CLI version of 1.11.24 or 2.0.0. + The delete product CLI alias requires a bash-compatible terminal and the JQ command-line JSON processor. For more information about installing the Command-line JSON processor, see [Download jq](https://stedolan.github.io/jq/download/). + Create a AWS CLI Alias to batch `Disassociation` API calls, enabling you to delete a product in a single command. To successfully delete a product, you must disassociate all resources associated with the product first. Examples of product resource associations include portfolio associations, budgets, Tag Options, and Service Actions. When using the CLI to delete a product, the CLI `force-delete-product` alias enables you to call the `Disassociate` API to disassociate any resources that would prevent the `DeleteProduct` API. This avoids a seperate call for individual disassociations. **Note** The file paths shown in the procedures below may vary depending on which operating system you use to perform these actions. ## Creating an AWS CLI alias to delete AWS Service Catalog products When using the AWS CLI to delete a AWS Service Catalog product, the CLI `force-delete-product` alias enables you to call the `Disassociate` API to disassociate any resources that would prevent the `DeleteProduct` call. **Create an `alias` file in your AWS CLI configuration folder** 1. In the AWS CLI console, navigate to the configuraiton folder. By default, the configuration folder path is `~/.aws/` on Linux and macOS, or `%USERPROFILE%\.aws\` on Windows. 1. Create a sub-folder named `cli` using file navigation or by entering the following command in your preferred terminal: ``` $ mkdir -p ~/.aws/cli ``` The resulting `cli` folder default path is `~/.aws/cli/` on Linux and MacOS, or `%USERPROFILE%\.aws\cli` on Windows. 1. In the new `cli` folder, create a text file named `alias` with no file extension. You can create the `alias` file using file navigation or by entering the following command in your preferred terminal: ``` $ touch ~/.aws/cli/alias ``` 1. Enter `[toplevel]` on the first line. 1. Save the file. Next, you can add the force-delete-product alias to your `alias` file by manually pasting the alias script into the file, or by using a command in the terminal window. **Manually add the force-delete-product alias to your `alias` file** 1. In the AWS CLI console, navigate to your AWS CLI configuration folder and open the `alias` file. 1. Enter the following code alias into the file, below the `[toplevel]` line: ``` [command servicecatalog] force-delete-product = !f() { if [ "$#" -ne 1 ]; then echo "Illegal number of parameters" exit 1 fi if [[ "$1" != prod-* ]]; then echo "Please provide a valid product id." exit 1 fi productId=$1 describeProductAsAdminResponse=$(aws servicecatalog describe-product-as-admin --id $productId) listPortfoliosForProductResponse=$(aws servicecatalog list-portfolios-for-product --product-id $productId) tagOptions=$(echo "$describeProductAsAdminResponse" | jq -r '.TagOptions[].Id') budgetName=$(echo "$describeProductAsAdminResponse" | jq -r '.Budgets[].BudgetName') portfolios=$(echo "$listPortfoliosForProductResponse" | jq -r '.PortfolioDetails[].Id') provisioningArtifacts=$(echo "$describeProductAsAdminResponse" | jq -r '.ProvisioningArtifactSummaries[].Id') provisioningArtifactServiceActionAssociations=() for provisioningArtifactId in $provisioningArtifacts; do listServiceActionsForProvisioningArtifactResponse=$(aws servicecatalog list-service-actions-for-provisioning-artifact --product-id $productId --provisioning-artifact-id $provisioningArtifactId) serviceActions=$(echo "$listServiceActionsForProvisioningArtifactResponse" | jq -r '[.ServiceActionSummaries[].Id] | join(",")') if [[ -n "$serviceActions" ]]; then provisioningArtifactServiceActionAssociations+=("${provisioningArtifactId}:${serviceActions}") fi done echo "Before deleting a product, the following associated resources must be disassociated. These resources will not be deleted. This action may take some time, depending on the number of resources being disassociated." echo "Portfolios:" for portfolioId in $portfolios; do echo "\t${portfolioId}" done echo "Budgets:" if [[ -n "$budgetName" ]]; then echo "\t${budgetName}" fi echo "Tag Options:" for tagOptionId in $tagOptions; do echo "\t${tagOptionId}" done echo "Service Actions on Provisioning Artifact:" for association in "${provisioningArtifactServiceActionAssociations[@]}"; do echo "\t${association}" done read -p "Are you sure you want to delete ${productId}? y,n " if [[ ! $REPLY =~ ^[Yy]$ ]]; then exit fi for portfolioId in $portfolios; do echo "Disassociating ${portfolioId}" aws servicecatalog disassociate-product-from-portfolio --product-id $productId --portfolio-id $portfolioId done if [[ -n "$budgetName" ]]; then echo "Disassociating ${budgetName}" aws servicecatalog disassociate-budget-from-resource --budget-name "$budgetName" --resource-id $productId fi for tagOptionId in $tagOptions; do echo "Disassociating ${tagOptionId}" aws servicecatalog disassociate-tag-option-from-resource --tag-option-id $tagOptionId --resource-id $productId done for association in "${provisioningArtifactServiceActionAssociations[@]}"; do associationPair=(${association//:/ }) provisioningArtifactId=${associationPair[0]} serviceActionsList=${associationPair[1]} serviceActionIds=${serviceActionsList//,/ } for serviceActionId in $serviceActionIds; do echo "Disassociating ${serviceActionId} from ${provisioningArtifactId}" aws servicecatalog disassociate-service-action-from-provisioning-artifact --product-id $productId --provisioning-artifact-id $provisioningArtifactId --service-action-id $serviceActionId done done echo "Deleting product ${productId}" aws servicecatalog delete-product --id $productId }; f ``` 1. Save the file. **Use the terminal window to add the force-delete-product alias to your `alias` file** 1. Open your terminal window and run the following command `$ cat >> ~/.aws/cli/alias` 1. Paste the alias script to the terminal window, and then press *CTRL\$1D* to exit the `cat` command. **Call the force-delete-product alias** 1. In your terminal window, run the following command to call the delete product alias `$ aws servicecatalog force-delete-product {product-id} ` The example below shows the `force-delete-product` alias command and its resulting response ``` $ aws servicecatalog force-delete-product prod-123 ``` ``` Before deleting a product, the following associated resources must be disassociated. These resources will not be deleted. This action may take some time, depending on the number of resources being disassociated. Portfolios: port-123 Budgets: budgetName Tag Options: tag-123 Service Actions on Provisioning Artifact: pa-123:act-123 Are you sure you want to delete prod-123? y,n ``` 1. Enter `y` to confirm you want to delete the product. After successfully deleting the product, the terminal window displays the following results ``` Disassociating port-123 Disassociating budgetName Disassociating tag-123 Disassociating act-123 from pa-123 Deleting product prod-123 ``` ## Additional resources For more information about AWS CLI, using aliases, and deleting AWS Service Catalog products, review the following resources: + [ Creating and using AWS CLI aliases](https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-alias.html) in the *AWS Command Line Interface (CLI)* user guide. + [AWS CLI alias repository](https://github.com/awslabs/awscli-aliases) git repository. + [Deleting AWS Service Catalog products](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/productmgmt-delete.html). + [AWS re:Invent 2016: The Effective AWS CLI User](https://youtu.be/Xc1dHtWa9-Q?t=1593) on *YouTube*. # Resolving failed resource disassociations when deleting a product If your prior attempt to [delete a product](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/productmgmt-delete.html) failed due to resource disassociation exceptions, review the list of exceptions and their resolutions below. **Note** If you closed the **Deleting products** window prior to receiving the failed resource disassociation message, you can follow steps one through three in the proceeding *Delete a product* section to open the window again. **To resolve a failed resource disassociation** In the **Delete product** window, review the Associations table **Status** column. Identify the failed resource disassociation exception and the suggested resolutions: **** | Status exception type | Cause | Resolution | | --- | --- | --- | | Product prod-\$1\$1\$1\$1 | AWS Service Catalog could not delete the product because the product still has associated TagOptions, budgets, at least one ProvisioningArtifact with associated actions, the product is still assigned to a Portfolio, the product has users, or the product has constraints. | Attempt to delete the product again. | | User: username is not authorized to perform: | The user attempting to delete the product does not have the necessary permissions to disassociate the product's resources. | AWS Service Catalog recommends contacting your account administrator for more information about disassociating product resources you do not currently have permissions to disassociate. | # Managing Versions You assign product versions when you create a product, and you can update product versions any time. Versions have an CloudFormation template, a title, a description, a status, and guidance. ## Version Status A version can have one of three statuses: + **Active** - An active version appears in the version list and allows users to launch it. + **Inactive** - An inactive version is hidden from the version list. Existing provisioned products launched from this version will not be affected. + **Deleted** - A deleted version is removed from the version list. Deleting a version cannot be undone. ## Version Guidance You can set version guidance to provide information to end users about the product version. Version guidance only affects active product versions. There are two options for version guidance: + **None** - By default, product versions do not have any guidance. End users can use that version to update and launch provisioned products. + **Deprecated** - Users cannot launch new provisioned products using a deprecated product version. If a p provisioned product launched previously uses a now deprecated version, users can only update that provisioned product using the existing version or a new version. ## Updating Versions You assign product versions when creating a product, and you can also update a version any time. For more information about creating a product, see [Creating Products](productmgmt-cloudresource.md). **To update a product version** 1. In the AWS Service Catalog console, choose **Products**. 1. From the product list, choose the product you want to update the version of. 1. On the **Product details** page, choose the **Versions** tab, then choose the version you want to update. 1. On the **Version details** page, edit the product version, then choose **Save changes**.