Service Catalog portfolio is shared only in the Org

Check ID: servicecatalog_portfolio_shared_within_organization_only
Provider: AWS
Service: servicecatalog
Severity: HIGH
Categories: trust-boundaries
Resource type: Other

What this check verifies

AWS Service Catalog portfolios are assessed to confirm sharing occurs via AWS Organizations integration, not direct ACCOUNT shares. It reviews shared portfolios and identifies those targeted to individual accounts instead of organizational scopes.

Risk

Sharing with individual accounts enables recipients to import and launch products outside centralized guardrails, inheriting launch roles. This can cause unauthorized provisioning, data exposure, and configuration drift-impacting confidentiality, integrity, and availability through misused privileges and uncontrolled costs.

Recommendation

Prefer organizational sharing for portfolios and avoid ACCOUNT targets. Enforce least privilege on portfolio access and launch roles, and review shares regularly. Apply separation of duties and defense in depth so only governed accounts consume products and blast radius remains constrained.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws servicecatalog create-portfolio-share —portfolio-id <portfolio-id> —organization-ids <org-id>

# Share Service Catalog portfolio only within the AWS Organization
resource "aws_servicecatalog_portfolio_share" "<example_resource_name>" {
  portfolio_id = "<example_resource_id>"

  organization_node {           # CRITICAL: share within AWS Organizations
    type  = "ORGANIZATION"     # Shares the portfolio with the entire org
    value = "<example_resource_id>"  # e.g., o-xxxxxxxxxx
  }
}

# CloudFormation: Share Service Catalog portfolio only within the AWS Organization
Resources:
  <example_resource_name>:
    Type: AWS::ServiceCatalog::PortfolioShare
    Properties:
      PortfolioId: <example_resource_id>
      OrganizationNode:               # CRITICAL: share within AWS Organizations
        Type: ORGANIZATION            # Shares the portfolio with the entire org
        Value: <example_resource_id>  # e.g., o-xxxxxxxxxx

References

https://docs.aws.amazon.com/servicecatalog/latest/adminguide/catalogs_portfolios_sharing.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = servicecatalog_portfolio_shared_within_organization_only. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Security Hub is enabled with standards configured SES identity resource policy does not allow public access

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires