Create a launch constraint-Service Catalog(ServiceCatalog)-阿里云帮助中心

After you add products to a product portfolio, you can configure launch constraints that specify the permissions required to launch products. This eliminates the need to separately grant management permissions on multiple product instances to each end user, simplifying authorization.

Prerequisites

An administrator has Service Catalog administrator permissions. Grant permissions to an administrator.
A product portfolio is created and a product is added to the product portfolio. For more information, see Add a product to a product portfolio.

Background information

A launch constraint takes effect on all versions of a product. When an end user launches the product, the end user can select a version based on business requirements.

Each constraint applies to a single product within a portfolio. To allow end users to launch all products in a portfolio, create a constraint for each product.

Step 1: Create a launch role and grant permissions to the launch role

Before you create a constraint, you must create a launch role with the following permissions:

Management permissions on Resource Orchestration Service (ROS). You can use the AliyunROSFullAccess policy to grant the permissions.
Management permissions on the resources defined in the Terraform template used to create the product.

This topic uses the create_ecs template as an example. This template creates an Elastic Compute Service (ECS) instance and defines ECS and Virtual Private Cloud (VPC) resources. You must grant the launch role management permissions on ECS (AliyunECSFullAccess) and VPC (AliyunVPCFullAccess).

Log on to the RAM console.
Create a RAM role named TerraformExecutionRole whose trusted entity is Service Catalog.
For more information, see Create a service RAM role

Attach the following system policies to the RAM role.

Policy	Description
AliyunROSFullAccess	Grants the RAM role management permissions on Resource Orchestration Service (ROS) to create a stack when launching the product.
AliyunECSFullAccess	Grants the RAM role management permissions on ECS to create an ECS instance when launching the product.
AliyunVPCFullAccess	Grants the RAM role management permissions on VPC to create a VPC when launching the product.

For more information, see Manage permissions for a RAM role

Step 2: Create a launch constraint

Log on to the Service Catalog console as the administrator.
In the left-side navigation pane, choose Administrator > Portfolio management.
On the Portfolio management page, click the name of the target product portfolio.
Click the Constraints tab, and then click Create constraint.
On the Create constraint page, configure the parameters.
1. From the Products drop-down list, select the product you created.
2. In the Constraint description area, enter a description for the constraint.
3. In the Constraint type area, select Launch Constraint.
4. From the The RAM role used to start drop-down list, select the RAM role you created in Step 1: Create a launch role and grant permissions.
Click Confirm.