(service-catalog): (CfnPortfolioPrincipalAssociation should support IAM_PATTERN)

[gbvanrenswoude]

Describe the bug

Using

    new sc.CfnPortfolioPrincipalAssociation(
      this,
      'CfnPortfolioPrincipalAssociation',
      {
        portfolioId: portfolio.portfolioId,
        principalArn: `arn:aws:iam:::role/somerole`,
        principalType: 'IAM_PATTERN',
      },
    );

throws Property validation failure: [Value for property {/PrincipalType} does not match pattern {IAM}]

Expected Behavior

IAM is not the only supported pattern. Per https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/ServiceCatalog.html#associatePrincipalWithPortfolio-property (used in the AWS Custom Resources Framework of the CDK) usage of IAM_PATTERN is supported. Writing a Custom Resource using it yields the expected results:

    new cr.AwsCustomResource(this, "sharePortfolioWithPrincipalName", {
      installLatestAwsSdk: true,
      onCreate: {
        service: "ServiceCatalog",
        action: "associatePrincipalWithPortfolio",
        physicalResourceId: cr.PhysicalResourceId.of(
          "sharePortfolioWithPrincipalName"
        ),
        parameters: {
          PortfolioId: portfolio.portfolioId,
          PrincipalARN: `arn:aws:iam:::role/somerole`,
          PrincipalType: "IAM_PATTERN",
        },
      },
      onDelete: {
        service: "ServiceCatalog",
        action: "disassociatePrincipalFromPortfolio",
        physicalResourceId: cr.PhysicalResourceId.of(
          "sharePortfolioWithPrincipalName"
        ),
        parameters: {
          PortfolioId: portfolio.portfolioId,
          PrincipalARN: `arn:aws:iam:::role/somerole`,
          PrincipalType: "IAM_PATTERN",
        },
      },
      policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
        resources: [portfolio.portfolioArn],
      }),
    });

mystack: creating CloudFormation changeset...

 ✅  mystack

✨  Deployment time: 1073.13s

Current Behavior

Throws Error: Property validation failure: [Value for property {/PrincipalType} does not match pattern {IAM}]

Reproduction Steps

See code attachments above

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.66.1

Framework Version

No response

Node.js Version

17

OS

MacOs

Language

Typescript

Language Version

TS 4

Other information

No response

[pahud]

From what I can see in the CFN doc, IAM_PATTERN should be accepted. I will try reproduce it in my account.

[pahud]

I can reproduce this issue with the code below:

export class ServicecatalogTsStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const portfolio = new sc.Portfolio(this, 'PF', {
      displayName: 'my-portfolio',
      providerName: 'my-provider',
    });

    new sc.CfnPortfolioPrincipalAssociation(
      this,
      'CfnPortfolioPrincipalAssociation',
      {
        portfolioId: portfolio.portfolioId,
        principalArn: `arn:aws:iam:::role/somerole`,
        principalType: 'IAM_PATTERN',
      },
    );
  }
}

And the error:

This seems to be a bug from CloudFormation. I'll escalate this internally.

[pahud]

Looking at the doc again. Seems the only accepted value is IAM so IAM_PATTERN would be an invalid value for cloudformation.

PrincipalType
The principal type. The supported value is IAM.

Allowed Values: IAM

Required: Yes

Type: String

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.