Service Catalog portfolios should be shared within an AWS organization only

Checks that a Service Catalog portfolio is shared only through AWS Organizations: any account-to-account share (type ACCOUNT) fails it, even one to an account in your organization and even if not yet imported. Sharing to the organization, an OU or a member account keeps the portfolio from reaching the wrong account. A share an external account really needs cannot pass; suppress that finding.

service: ServiceCatalog
severity: Medium
scope: evaluated in every region

How to fix it

Can break clients: Unsharing stops sharing the portfolio with that account, so share an organization member through AWS Organizations first, and an account outside the organization loses it.

In the console

Service Catalog → Portfolios → Local portfolios → the portfolio → Share

AWS Organizations: The root, an OU or the member account; only the management or a delegated administrator account can share this way
Accounts shared with: No account shared by account ID: Unshare each one

With the AWS CLI

aws servicecatalog delete-portfolio-share --portfolio-id <portfolio-id> --account-id <account-id> --region <region>

With Terraform

Replaces the resource: type forces a new share, so the apply deletes the ACCOUNT share before it creates the organization one, leaving the account without the portfolio in between.

resource "aws_servicecatalog_portfolio_share" "this" {
  portfolio_id = var.portfolio_id
  principal_id = var.account_id
  type         = "ORGANIZATION_MEMBER_ACCOUNT"
}

See which of your accounts this check is failing on.

Book a live scan