Table of Contents |
---|
Excerpt |
---|
Any AWS Account within the Cornell AWS Organization has access to the IT@Cornell Service Catalog Portfolio. Service Catalog is an AWS offering that allows us to give our member AWS Account Administrators templated, self-service "Products" which define a standalone IT service or tool. |
Info |
---|
Account Administrators have full control over which IAM Groups, Roles and Users are allowed to launch Products from the IT@Cornell Portfolio. By default, shib-admin and sso-admin members can launch our Portfolio products. |
Launching Products
- Browse to the Service Catalog service → Select Products
- Select desired product → Launch Product button
Granting Additional IAM Principal Access
To enable additional IAM Principals to the IT@Cornell Products for your account. (ie. sso-devs, shib-devs, shib-dbas, etc...) our Portfolio is visible within member accounts but no IAM Roles are given permission to launch any Products contained within it. This document describes the steps to enable IT@Cornell Products for your account's shib-admin
IAM Role within the AWS Console.It is certainly possible to use this same process to enable the same Products for other IAM Roles in your account. If that is your goal, make sure to follow the AWS Documentation to ensure the Role has the proper permissions to launch Service Catalog Products and their underlying resources.
- Log in to your Cornell AWS Account
- Make sure you are in the us-east-1 (N. Virginia) Region
- Navigate to the Imported Portfolios section of the AWS Service Catalog Console
- Click the IT@Cornell Portfolio
- Select the "Access" tab
- Click the "Grant access" button
- Select the "IAM Principal" radio button
- Wildcards are now supported for granting access via Principal Names as well, ie. arn:aws:iam:::role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_sso-admin_*
- Select the "Roles" tab
- Search for
shib-admin
and select theshib-admin
Rolethe desired role to add - Click the "Grant Access" button
- Confirm that the The IT@Cornell Products are now visible and launchable launch-able in the Products Section
...
- for the newly provisioned IAM Principal.