# AssociatePrincipalWithPortfolio
<a name="API_AssociatePrincipalWithPortfolio"></a>

Associates the specified principal ARN with the specified portfolio.

If you share the portfolio with principal name sharing enabled, the `PrincipalARN` association is included in the share. 

The `PortfolioID`, `PrincipalARN`, and `PrincipalType` parameters are required. 

You can associate a maximum of 10 Principals with a portfolio using `PrincipalType` as `IAM_PATTERN`. 

**Note**  
When you associate a principal with portfolio, a potential privilege escalation path may occur when that portfolio is then shared with other accounts. For a user in a recipient account who is *not* an Service Catalog Admin, but still has the ability to create Principals (Users/Groups/Roles), that user could create a role that matches a principal name association for the portfolio. Although this user may not know which principal names are associated through Service Catalog, they may be able to guess the user. If this potential escalation path is a concern, then Service Catalog recommends using `PrincipalType` as `IAM`. With this configuration, the `PrincipalARN` must already exist in the recipient account before it can be associated. 

## Request Syntax
<a name="API_AssociatePrincipalWithPortfolio_RequestSyntax"></a>

```
{
   "AcceptLanguage": "string",
   "PortfolioId": "string",
   "PrincipalARN": "string",
   "PrincipalType": "string"
}
```

## Request Parameters
<a name="API_AssociatePrincipalWithPortfolio_RequestParameters"></a>

The request accepts the following data in JSON format.

 ** [AcceptLanguage](#API_AssociatePrincipalWithPortfolio_RequestSyntax) **   <a name="servicecatalog-AssociatePrincipalWithPortfolio-request-AcceptLanguage"></a>
The language code.  
+  `jp` - Japanese
+  `zh` - Chinese
Type: String  
Length Constraints: Maximum length of 100.  
Required: No

 ** [PortfolioId](#API_AssociatePrincipalWithPortfolio_RequestSyntax) **   <a name="servicecatalog-AssociatePrincipalWithPortfolio-request-PortfolioId"></a>
The portfolio identifier.  
Type: String  
Length Constraints: Minimum length of 1. Maximum length of 100.  
Pattern: `^[a-zA-Z0-9_\-]*`   
Required: Yes

 ** [PrincipalARN](#API_AssociatePrincipalWithPortfolio_RequestSyntax) **   <a name="servicecatalog-AssociatePrincipalWithPortfolio-request-PrincipalARN"></a>
The ARN of the principal (user, role, or group). If the `PrincipalType` is `IAM`, the supported value is a fully defined [IAM Amazon Resource Name (ARN)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). If the `PrincipalType` is `IAM_PATTERN`, the supported value is an `IAM` ARN *without an AccountID* in the following format:  
 *arn:partition:iam:::resource-type/resource-id*   
The ARN resource-id can be either:  
+ A fully formed resource-id. For example, *arn:aws:iam:::role/resource-name* or *arn:aws:iam:::role/resource-path/resource-name* 
+ A wildcard ARN. The wildcard ARN accepts `IAM_PATTERN` values with a "\$1" or "?" in the resource-id segment of the ARN. For example *arn:partition:service:::resource-type/resource-path/resource-name*. The new symbols are exclusive to the **resource-path** and **resource-name** and cannot replace the **resource-type** or other ARN values. 

  The ARN path and principal name allow unlimited wildcard characters.
Examples of an **acceptable** wildcard ARN:  
+ arn:aws:iam:::role/ResourceName\$1\$1
+ arn:aws:iam:::role/\$1/ResourceName\$1?
Examples of an **unacceptable** wildcard ARN:  
+ arn:aws:iam:::\$1/ResourceName
You can associate multiple `IAM_PATTERN`s even if the account has no principal with that name.   
The "?" wildcard character matches zero or one of any character. This is similar to ".?" in regular regex context. The "\$1" wildcard character matches any number of any characters. This is similar to ".\$1" in regular regex context.  
In the IAM Principal ARN format (*arn:partition:iam:::resource-type/resource-path/resource-name*), valid resource-type values include **user/**, **group/**, or **role/**. The "?" and "\$1" characters are allowed only after the resource-type in the resource-id segment. You can use special characters anywhere within the resource-id.   
The "\$1" character also matches the "/" character, allowing paths to be formed *within* the resource-id. For example, *arn:aws:iam:::role/**\$1**/ResourceName\$1?* matches both *arn:aws:iam:::role/pathA/pathB/ResourceName\$11* and *arn:aws:iam:::role/pathA/ResourceName\$11*.   
Type: String  
Length Constraints: Minimum length of 1. Maximum length of 1000.  
Required: Yes

 ** [PrincipalType](#API_AssociatePrincipalWithPortfolio_RequestSyntax) **   <a name="servicecatalog-AssociatePrincipalWithPortfolio-request-PrincipalType"></a>
The principal type. The supported value is `IAM` if you use a fully defined Amazon Resource Name (ARN), or `IAM_PATTERN` if you use an ARN with no `accountID`, with or without wildcard characters.   
Type: String  
Valid Values: `IAM | IAM_PATTERN`   
Required: Yes

## Response Elements
<a name="API_AssociatePrincipalWithPortfolio_ResponseElements"></a>

If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.

## Errors
<a name="API_AssociatePrincipalWithPortfolio_Errors"></a>

 ** InvalidParametersException **   
One or more parameters provided to the operation are not valid.  
HTTP Status Code: 400

 ** LimitExceededException **   
The current limits of the service would have been exceeded by this operation. Decrease your resource use or increase your service limits and retry the operation.  
HTTP Status Code: 400

 ** ResourceNotFoundException **   
The specified resource was not found.  
HTTP Status Code: 400

## See Also
<a name="API_AssociatePrincipalWithPortfolio_SeeAlso"></a>

For more information about using this API in one of the language-specific AWS SDKs, see the following:
+  [AWS Command Line Interface V2](https://docs.aws.amazon.com/goto/cli2/servicecatalog-2015-12-10/AssociatePrincipalWithPortfolio) 
+  [AWS SDK for .NET V4](https://docs.aws.amazon.com/goto/DotNetSDKV4/servicecatalog-2015-12-10/AssociatePrincipalWithPortfolio) 
+  [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/servicecatalog-2015-12-10/AssociatePrincipalWithPortfolio) 
+  [AWS SDK for Go v2](https://docs.aws.amazon.com/goto/SdkForGoV2/servicecatalog-2015-12-10/AssociatePrincipalWithPortfolio) 
+  [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/servicecatalog-2015-12-10/AssociatePrincipalWithPortfolio) 
+  [AWS SDK for JavaScript V3](https://docs.aws.amazon.com/goto/SdkForJavaScriptV3/servicecatalog-2015-12-10/AssociatePrincipalWithPortfolio) 
+  [AWS SDK for Kotlin](https://docs.aws.amazon.com/goto/SdkForKotlin/servicecatalog-2015-12-10/AssociatePrincipalWithPortfolio) 
+  [AWS SDK for PHP V3](https://docs.aws.amazon.com/goto/SdkForPHPV3/servicecatalog-2015-12-10/AssociatePrincipalWithPortfolio) 
+  [AWS SDK for Python](https://docs.aws.amazon.com/goto/boto3/servicecatalog-2015-12-10/AssociatePrincipalWithPortfolio) 
+  [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/servicecatalog-2015-12-10/AssociatePrincipalWithPortfolio)