AWS Service Catalog

code for article pfeilbr/aws-service-catalog-playground

learn aws service catalog

aws-service-catalog-playground

Concepts

products are cloudformation templates
portfolio is collection of products
- access to portfolios is via IAM users, groups, roles
IT administrator creates products and portfolios and grants access
End user accesses products and deploys them
example use cases: approved self-service products from Solution Factory
- e.g. static web site. S3 + CloudFormation + WAF + ACM (certificate) + Route 53 (hosted zone, domain)
- e.g. Oracle RDS DB with all security, tags, etc. in place
Service Actions - enable end users to perform operational tasks, troubleshoot issues, run approved commands, or request permissions in AWS Service Catalog via SSM docs.
can include/reference existing product(s) in your product cloudformation template. This enables modular composition and nesting.

Service Catalog Pipeline

Service catalog can be used to deliver products to all spoke accounts in an org.

Central hub account that provisions AWS Service Catalog Products into spoke accounts on your behalf

CloudFormation Support

Service Catalog resources can be created using CloudFormation. See AWS Service Catalog resource type reference.

Provision a Service Catalog Product Instance using CloudFormation

You can provision a Service Catalog Product using the AWS::ServiceCatalog::CloudFormationProvisionedProduct resource type.

For example, if you have a service catalog product named MyProduct you can provision an instance of it using the following cfn.


      AWSTemplateFormatVersion: '2010-09-09'
      Description: My Service Catalog Provisioned Product
      Resources:
         MyProvisionedProduct:
           Type: AWS::ServiceCatalog::CloudFormationProvisionedProduct
           Properties:
            ProductName: MyProduct
            ProvisioningArtifactName: '1.0'
            ProvisioningParameters:
               -
                  Key: param1
                  Value: "param1value"
               -
                  Key: param2
                  Value: "param2Value"

Composing Solutions with AWS Service Catalog Provisioned Products

AWS Service Catalog now supports obtaining outputs from a Service Catalog provisioned product in an AWS CloudFormation template. Product outputs provide the interface from one product to another. With this new feature, administrators and developers can easily refer to those outputs in order to combine the products needed for their applications, which saves time building applications that use more than one product, such as a three-tier web application.

Example cfn from docs

     // Example 1
    AWSTemplateFormatVersion: 2010-09-09
    Transform: 'AWS::ServiceCatalog'
    Resources:
      ExampleParameter:
        Type: 'AWS::SSM::Parameter'
        Properties:
          Type: String
          Value: '[[servicecatalog:provisionedproduct:SampleProvisionedProduct:SampleOutputKey]]'

    // Example 2
    AWSTemplateFormatVersion: 2010-09-09
    Transform: 'AWS::ServiceCatalog'
    Resources:
      ExampleParameter:
        Type: 'AWS::SSM::Parameter'
        Properties:
          Type: String
          Value: '[[servicecatalog:provisionedproduct:SampleProvisionedProduct:SampleOutputKey]]'


    // Example 3
    AWSTemplateFormatVersion: 2010-09-09
    Transform: AWS::ServiceCatalog
    Resources:
      ExampleParameter:
        Type: 'AWS::SSM::Parameter'
        Properties:
          Type: String
          Value: "[[servicecatalog:provisionedproduct:SampleProvisionedProduct:SampleOutputKey]]"


    // Example 4

    AWSTemplateFormatVersion: 2010-09-09
    Transform: AWS::ServiceCatalog
    Resources:
      ExampleParameter:
        Type: 'AWS::SSM::Parameter'
        Properties:
          Type: String
          Value: >-
                        [[servicecatalog:provisionedproduct:SampleProvisionedProduct:SampleOutputKey]]


    // Example 5
    AWSTemplateFormatVersion: 2010-09-09
    Transform: AWS::ServiceCatalog
    Resources:
      ExampleParameter2:
        Type: 'AWS::SSM::Parameter'
        Properties:
          Type: String
          Value: [[servicecatalog:provisionedproduct:SSMProductProvisionedProduct:SampleOutputKey]]

Example Use Case | Static Website

The following is a simple example of a “Static Website” product for the service catalog. It’s an S3 bucket with website enabled for it. This product is purposely kept simple to keep the focus on Service Catalog, but a product can be make up of anything that can be expressed via a CloudFormation template.

Define Launch Constraint

the IAM role the cloudformation stack provisioning runs under

Allows you to assign an IAM role that is used to provision the resources at launch, so you can restrict user permissions without impacting users' ability to provision products from the catalog.

Launch constraint for a product must be added at Portfolio level

see AWS Service Catalog Launch Constraints