Servicecatalog Diagnostics

AWS Service Catalog Diagnostics

When to use

Any AWS Service Catalog investigation — portfolio management, product provisioning, constraints, provisioned products, governance, organization sharing, StackSet constraints, or Terraform product configuration.

Investigation workflow

Step 1 — Collect and triage

aws servicecatalog list-portfolios --query 'PortfolioDetails[*].{Id:Id,Name:DisplayName,Provider:ProviderName}'
aws servicecatalog search-products-as-admin --query 'ProductViewDetails[*].ProductViewSummary.{Id:ProductId,Name:Name,Type:Type}'
aws servicecatalog scan-provisioned-products --query 'ProvisionedProducts[*].{Id:Id,Name:Name,Status:Status}'

Step 2 — Domain deep dive

aws servicecatalog describe-portfolio --id <portfolio-id>
aws servicecatalog describe-product-as-admin --id <product-id>
aws servicecatalog describe-provisioned-product --id <provisioned-product-id>

Step 3 — Detailed investigation

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=servicecatalog.amazonaws.com --max-results 20
aws servicecatalog list-constraints-for-portfolio --portfolio-id <portfolio-id>
aws servicecatalog describe-record --id <record-id> --query 'RecordDetail.{Status:Status,RecordErrors:RecordErrors}'

Read references/guardrails.md before concluding on any Service Catalog issue.

Tool quick reference

Gotchas: AWS Service Catalog

• Service Catalog has TWO personas: administrators (manage portfolios/products) and end users (provision products). Permissions differ significantly.
• Launch constraints specify the IAM role used to provision the product. Without a launch constraint, the end user's permissions are used, which often fails.
• Template constraints restrict CloudFormation parameter values. They use JSON rules syntax, not IAM policy syntax.
• Provisioned products are CloudFormation stacks under the hood. Stack failures are the most common provisioning issue.
• Portfolio sharing can be done via account ID, organization, or organizational unit. Organization sharing requires Organizations integration.
• Tag options are different from resource tags. Tag options enforce specific tag key-value pairs during provisioning.
• Terraform products use the Terraform Cloud/Enterprise engine. They require a Terraform Cloud workspace connection.

Anti-hallucination rules

1. Always cite specific portfolio IDs, product IDs, or record IDs as evidence.
2. Launch constraints and template constraints are DIFFERENT. Never conflate them.
3. End user permissions vs admin permissions are separate. Never mix them up.
4. Provisioned products are CloudFormation stacks. Always check stack events for failures.
5. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.

14 runbooks