Service Catalog Product Module

This Terraform module creates an AWS Service Catalog product with an associated portfolio, enabling self-service deployment of CloudFormation templates.

Features

Flexible Template Input: Supports both inline CloudFormation template content and S3 URLs
Automatic S3 Upload: Uploads templates to S3 when using template_content
Portfolio Management: Create new portfolios or use existing ones with data source lookup
Complete Service Catalog Setup: Creates portfolio, product, and associations
Access Control: Configurable IAM principal access to the portfolio
Validation: Built-in validation for template sources and ARN formats
Comprehensive Outputs: Exposes all relevant resource attributes

Usage

Example 1: Creating New Portfolio with Template Content

module "new_portfolio_product" {
  source = "./cfn-service-catalog"
  
  # Required
  product_name    = "Web Application Stack"
  template_bucket = "my-cloudformation-templates"
  
  # Template as string content
  template_content = file("${path.module}/templates/webapp.yml")
  
  # Create new portfolio (default behavior)
  create_portfolio = true
  portfolio_name        = "Development Tools"
  portfolio_description = "Self-service development infrastructure"
  
  # Product details
  product_description = "Complete web application stack with ALB, ECS, and RDS"
  product_owner      = "Platform Team"
  
  # Access control
  principal_arns = [
    "arn:aws:iam::123456789012:role/DeveloperRole",
    "arn:aws:iam::123456789012:group/DevOpsTeam"
  ]
  
  tags = {
    Environment = "dev"
    Team        = "platform"
  }
}

Example 2: Using Existing Portfolio

module "existing_portfolio_product" {
  source = "./cfn-service-catalog"
  
  # Required
  product_name    = "Database Stack"
  template_bucket = "my-cloudformation-templates"
  
  # Template from existing S3 location
  template_url = "https://my-templates.s3.amazonaws.com/database/rds-stack.yml"
  
  # Use existing portfolio
  create_portfolio      = false
  existing_portfolio_id = "port-12345abcde"
  
  # Product details
  product_description = "RDS database with backup and monitoring"
  
  principal_arns = [
    "arn:aws:iam::123456789012:role/DatabaseAdminRole"
  ]
}

Example 3: Multiple Products in Same Portfolio

# First product creates the portfolio
module "portfolio_product_1" {
  source = "./cfn-service-catalog"
  
  product_name    = "Web App Stack"
  template_bucket = "my-templates"
  template_content = file("${path.module}/templates/webapp.yml")
  
  create_portfolio = true
  portfolio_name   = "Shared Infrastructure Portfolio"
  
  principal_arns = [
    "arn:aws:iam::123456789012:role/DeveloperRole"
  ]
}

# Second product uses the existing portfolio
module "portfolio_product_2" {
  source = "./cfn-service-catalog"
  
  product_name    = "Database Stack"
  template_bucket = "my-templates"
  template_content = file("${path.module}/templates/database.yml")
  
  # Use the portfolio created by the first product
  create_portfolio      = false
  existing_portfolio_id = module.portfolio_product_1.portfolio_id
  
  principal_arns = [
    "arn:aws:iam::123456789012:role/DeveloperRole"
  ]
  
  depends_on = [module.portfolio_product_1]
}

Example 4: Migration from aws-image-pipeline-cfn

# Read the existing main template
locals {
  main_template_content = templatefile("${path.module}/templates/main.yml.tftpl", {
    kms_template_url      = "https://my-bucket.s3.amazonaws.com/kms.yml"
    iam_template_url      = "https://my-bucket.s3.amazonaws.com/iam.yml"
    s3_template_url       = "https://my-bucket.s3.amazonaws.com/s3.yml"
    codebuild_template_url = "https://my-bucket.s3.amazonaws.com/codebuild.yml"
    codepipeline_template_url = "https://my-bucket.s3.amazonaws.com/codepipeline.yml"
    additional_security_group_id = ""
  })
}

module "image_pipeline_service_catalog" {
  source = "./cfn-service-catalog"
  
  product_name    = "AWS Image Building Pipeline"
  template_bucket = "image-pipeline-templates"
  
  # Use the processed template content
  template_content = local.main_template_content
  
  # Portfolio configuration
  create_portfolio      = true
  portfolio_name        = "DevOps Image Pipeline Portfolio"
  portfolio_description = "Self-service deployment of standardized AWS image building pipelines"
  
  # Product configuration
  product_description   = "Automated pipeline for building custom AMIs using Packer, Ansible, and CodePipeline"
  product_owner        = "DevOps Team"
  
  principal_arns = [
    "arn:aws-us-gov:iam::123456789012:role/DeveloperRole",
    "arn:aws-us-gov:iam::123456789012:group/DevOpsTeam"
  ]
  
  tags = {
    Project     = "image-pipeline"
    Environment = "production"
  }
}

Requirements

Name	Version
terraform	>= 1.2.0
aws	~> 5.0

Providers

Name	Version
aws	~> 5.0

Inputs

Name	Description	Type	Default	Required
product_name	Name of the Service Catalog product	`string`	n/a	yes
template_bucket	S3 bucket name where CloudFormation templates will be stored	`string`	n/a	yes
template_content	CloudFormation template content as a string. Mutually exclusive with template_url	`string`	`null`	no*
template_url	S3 URL to existing CloudFormation template. Mutually exclusive with template_content	`string`	`null`	no*
create_portfolio	Whether to create a new portfolio (true) or use an existing one (false)	`bool`	`true`	no
existing_portfolio_id	ID of existing Service Catalog portfolio to use. Required when create_portfolio is false	`string`	`null`	no**
portfolio_name	Name of the Service Catalog portfolio (used only when creating new portfolio)	`string`	`"Self-Service Infrastructure"`	no
portfolio_description	Description of the Service Catalog portfolio (used only when creating new portfolio)	`string`	`"Self-service deployment of standardized infrastructure components"`	no
portfolio_provider_name	Name of the portfolio provider/owner (used only when creating new portfolio)	`string`	`"Platform Engineering"`	no
product_owner	Owner of the Service Catalog product	`string`	`"Platform Team"`	no
product_description	Description of the Service Catalog product	`string`	`""`	no
product_distributor	Distributor (vendor) of the Service Catalog product	`string`	`null`	no
support_description	Support information about the product	`string`	`null`	no
support_email	Support email for the product	`string`	`null`	no
support_url	Support URL for the product	`string`	`null`	no
provisioning_artifact_name	Name of the provisioning artifact (version)	`string`	`"v1.0"`	no
provisioning_artifact_description	Description of the provisioning artifact	`string`	`"Initial version"`	no
disable_template_validation	Whether to disable CloudFormation template validation	`bool`	`false`	no
template_prefix	Prefix/folder path for CloudFormation templates in S3	`string`	`""`	no
principal_arns	List of IAM principal ARNs to grant access to the portfolio	`list(string)`	`[]`	no
tags	A map of tags to assign to all resources	`map(string)`	`{}`	no

*Either template_content or template_url must be provided, but not both. **Required when create_portfolio is false.

Outputs

Name	Description
portfolio_id	ID of the Service Catalog portfolio (created or existing)
portfolio_arn	ARN of the Service Catalog portfolio (created or existing)
portfolio_name	Name of the Service Catalog portfolio (created or existing)
portfolio_created_time	Time when the portfolio was created
portfolio_provider_name	Provider name of the Service Catalog portfolio
portfolio_description	Description of the Service Catalog portfolio
portfolio_creation_mode	Whether the portfolio was created by this module or was existing
product_id	ID of the Service Catalog product
product_arn	ARN of the Service Catalog product
product_name	Name of the Service Catalog product
product_status	Status of the Service Catalog product
product_created_time	Time when the Service Catalog product was created
product_has_default_path	Whether the product has a default path
template_url	URL of the CloudFormation template used by the Service Catalog product
template_s3_key	S3 key of the uploaded template (if template_content was used)
template_s3_etag	ETag of the uploaded template (if template_content was used)
principal_associations	List of principal ARNs that have access to the portfolio
principal_association_count	Number of principals granted access to the portfolio
portfolio_product_association_id	ID of the portfolio-product association

Validation Rules

Template Source: Exactly one of template_content or template_url must be provided
Portfolio Configuration: When create_portfolio is false, existing_portfolio_id must be provided
Product Name: Must be between 1 and 100 characters
Template URL: Must be a valid S3 HTTPS URL when provided
Principal ARNs: Must be valid IAM user, role, or group ARNs
Portfolio ID: Must match Service Catalog portfolio ID format (port-xxxxxxxxx) when provided

Use Cases

Portfolio Management Strategies

Single Portfolio per Team: Create one portfolio and add multiple products to it
Product-Specific Portfolios: Create separate portfolios for different product categories
Shared Enterprise Portfolios: Use existing centrally-managed portfolios
Development vs Production: Separate portfolios for different environments

Template Management Options

Inline Templates: Use template_content for templates managed in your Terraform code
External Templates: Use template_url for templates stored separately in S3
Generated Templates: Use templatefile() function with the template_content option
Version Control: Template content allows for proper version control and change tracking

Notes

When using template_content, the module automatically uploads the template to S3
The S3 bucket specified in template_bucket must already exist
IAM permissions are required for Service Catalog operations and S3 access
Templates are uploaded with application/x-yml content type
Portfolio data source requires servicecatalog:DescribePortfolio permissions
Multiple products can share the same portfolio by using existing_portfolio_id
Portfolio configuration variables are ignored when create_portfolio is false

License

This module is provided under the MIT License.

CSVD/terraform-cfn-service-catalog

About

Resources

Stars

Watchers

Forks

Releases

Languages