Self Service Option for End users to request AWS Services using AWS Service Catalog
Tags: selfservice, servicecatalog, servicenow, aws
Published: 2023-07-05 03:39:04

Hi All,

In this blog I am going to explain how to leverage AWS service catalog to provide a self service option for end users to request AWS Services. To demonstrate the capability, I am enabling the users with an option to request an S3 bucket via service catalog.

## What is AWS Service catalog

Service Catalog enables organizations to create and manage catalogs of IT services that are approved for AWS. These IT services can include everything from virtual machine images, servers, software, databases, and more to complete multi-tier application architectures. End users can quickly deploy only the approved IT services they need, following the constraints set by your organization.

Ref:- https://docs.aws.amazon.com/servicecatalog/latest/adminguide/introduction.html

## **Components involved in the Integration**

1. **AWS Service catalog**:- The AWS service for enabling end users to request AWS Services

1. **Cloud formation**:- When a user requests for a product via AWS service catalog, a cloud formation template will be initiated and perform the build on behalf of end user.

1. **S3 bucket**:- Place where the cloud formation script is saved

1. **IAM role**:- A custom IAM role which will do the authorization of aws services onbehalf of end users.

**Create the custom IAM role**
Navigate to IAM and create a custom role with the permissions needed to perform the below actions.

- AWS Service catalog enduser full access policy

- Cloud formation template read policy

- AWS Service read, write and delete permissions(the specific service which we are enabling for end users via service catalog. in this example s3 bucket bucket create, read and delete permissions).
You need to also provide trust entities to assume the Service catalog role on behalf of end users.

My final IAM permissions looks like the below:-

**IAM Permissions**
![Custom policy permissions](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/efkk0xvy7jvj5mvepf4b.png)
**Custom policy permissions**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hlyash8gw0ga5j75s0jr.png)
**Trust entity**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g7xpqtcssq98w6r1r9gw.png)

## Creating the Service catalog portfolio and product
**Portfolio** as the name suggests contains a portfolio of services.
To create an AWS Service catalog portfolio, navigate to AWS console-->Service catalog.
Under portfolios, click on "Create portfolio".

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/smb5zr183f821ocd3t6n.png)
In the portfolio creation wizard, provide the portfolio name, description and the owner details.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/91s0cde5i2hwqp99b9l8.png)
**Creating the product**
Product is where you will be providing the code for creating the AWS product. For example, I am creating a product to "provision a S3 bucket". To create a product,open the newly created portfolio and click on "Create product"

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/502bibe4by9wk94ojr2k.png)
In the create product wizard, select which product type to use. You can select either Cloud formation or terraform open source. Product type is simply the Infra-as-a-code platform which will be used to provision and manage your product.
_Note:- If we select terraform open source, then the integration of terraform open source with AWS service catalog to be performed. Terraform integration script will create a parallel environment to support the AWS service catalog integration which includes a VPC, s3 buckets, etc._
Provide a friendly product name, description and owner.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/85rwcrzkmsv1fivf24db.png)
In the version details, either upload the cloud formation code which contains the automation workflow or you can map to the s3 bucket where the code is placed. You can also point the product to use an existing stack.

I used a simple S3 bucket cloud formation script for this blog.

> AWSTemplateFormatVersion: 2010-09-09
Parameters:
  S3BucketName:
    Type: String
    Description: The name of the S3 bucket to create
Resources:
  MyS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref S3BucketName

Outputs:
  BucketName:
    Value: !Ref MyS3Bucket

> 

Provide the version number and description. Any new updates to the code will be handled as a new version in the existing product.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kj9oqwtx1gdtl4n89j7y.png)
You can optionally provide the support details and tags.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5pzc54f1a3isb0wthe55.png)
Click on "create product" to create the product.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mfk2hpo91zyjmkaca245.png)


## Launch Constraint
Once the product is created, the next step is create a launch constraint and attach to the product. To create a constraint, click on "create constraint" from the constraint tab next to product.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tri65cos97b7z0eujl5q.png)
In the constraint details, select the product to which you need to enable the constraint. Select the constraint type. As we are creating S3 bucket, I am selecting the constraint type as launch.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tk8irfq3kellgrxncx9g.png)

Under the methods, provide the IAM role created in the previous step and click Create.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qf45er2a9tpek05584ta.png)

## Provide access to IAM users
The last step of the integration is to provide the IAM users access to the product and portfolio created. To provide access, go to the Access tab next to constraint and click on 'Grant access'.
Select the IAM group or user and click on grant access to provide access to the product.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hwfxgvmcdedztqwb0idr.png)

_Optionally, the product can be shared to an AWS organization or account_

## Testing the functionality
To test the functionality, login to AWS console as a normal IAM user.
Once the IAM user logins and navigates to the service catalog, the user will be displayed with the available products.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7mw7m8vvv1t2kgo5fetn.png)
Click on 'launch product' to launch the s3 provision request tab.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jvjltj01gfwrb0fozys9.png)
Provide a friendly name for your product request, and provide the response to the parameter. In this blog, I made S3bucket name as a parameter and pass it via Cloudformation template.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3rp5qb4y1c9b0aen8neo.png)
 Once you click on launch product, a cloud formation job will kicks in to perform the action.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/otacgpcd4heiacurtxlx.png)
Once the user submit a request, a cloud formation stack will get initiated and the job will get executed.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ua4rgpcs3rk9c4hdjsht.png)
The S3 bucket will get created in the AWS account.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/loxa6hckozuejcdfziip.png)

In the next blog, I will be explaining how to integrate Service catalog with Service now. Please let me know your comments and feedback.