serviceCatalog: Incorrect service in arn generation #20849

joostvdwsd · 2022-06-23T14:47:25Z

Describe the bug

The generated portfolio arn is using service "servicecatalog". However, arns of service catalog have the service "catalog":
arn:aws:catalog:<>:<>:portfolio/<>

aws-cdk/packages/@aws-cdk/aws-servicecatalog/lib/portfolio.ts

Line 331 in 2f6dd37

this.portfolioArn = cdk.Stack.of(this).formatArn({

Expected Behavior

Use the correct service in the generated arn

Current Behavior

Incorrect generated arn resulting in permission errors i.e. when used in a policy statement

Reproduction Steps

const portfolio = new servicecatalog.Portfolio(this, 'Portfolio', {
displayName: 'My Portfolio',
providerName: 'AWS',
});

console.log(portfolio.portfolioArn)

Possible Solution

aws-cdk/packages/@aws-cdk/aws-servicecatalog/lib/portfolio.ts

Line 331 in 2f6dd37

this.portfolioArn = cdk.Stack.of(this).formatArn({

change into:
cdk.Stack.of(this).formatArn({
service: 'catalog',
resource: 'portfolio',
resourceName: this.portfolioId,
})

Additional Information/Context

No response

CDK CLI Version

latest

Framework Version

No response

Node.js Version

any

OS

any

Language

Typescript

Language Version

No response

Other information

No response

mackalex · 2022-06-27T21:10:03Z

Hi @joostvdwsd, thank you for raising this issue. This is certainly a valid bug and I will reproduce it locally and determine the most appropriate next steps. Based on your included possible solution, I suspect that this will be a relatively trivial fix.

indrora · 2022-08-25T16:48:50Z

There are two ARN services that are defined in Service Catalog - both servicecatalog and catalog. Why? Who knows.

It's documented where each is used in different places: https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsservicecatalog.html#awsservicecatalog-resources-for-iam-policies

…21770) Portfolio construct code uses the incorrect service name when generating the ARN for the portfolio. The ARN generated uses the service name "servicecatalog" instead of "catalog". CLI documentation confirms ARN should use catalog instead of servicecatalog: https://docs.aws.amazon.com/cli/latest/reference/servicecatalog/create-portfolio.html Added a single unit test to check arn formatting. fixes #20849 ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

github-actions · 2022-08-29T14:21:40Z

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

…ws#21770) Portfolio construct code uses the incorrect service name when generating the ARN for the portfolio. The ARN generated uses the service name "servicecatalog" instead of "catalog". CLI documentation confirms ARN should use catalog instead of servicecatalog: https://docs.aws.amazon.com/cli/latest/reference/servicecatalog/create-portfolio.html Added a single unit test to check arn formatting. fixes aws#20849 ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

joostvdwsd added bug needs-triage labels Jun 23, 2022

github-actions bot added the @aws-cdk/aws-servicecatalog label Jun 23, 2022

indrora assigned rix0rrr Aug 25, 2022

indrora added p1 @aws-cdk/cfnspec service-api and removed needs-triage labels Aug 25, 2022

edyl-berkeley mentioned this issue Aug 25, 2022

fix(servicecatalog): incorrect service in portfolio arn generation #21770

Merged

3 tasks

mergify bot closed this as completed in #21770 Aug 29, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

serviceCatalog: Incorrect service in arn generation #20849

serviceCatalog: Incorrect service in arn generation #20849

joostvdwsd commented Jun 23, 2022

mackalex commented Jun 27, 2022

indrora commented Aug 25, 2022

github-actions bot commented Aug 29, 2022