Learn about the basic concepts of Service Catalog, such as products, product portfolios, and constraints.
| Term | Description |
| administrator | Administrators define, manage, and distribute compliant IT services. |
| end user | End users can query and deploy approved IT services. They are typically members of business teams, such as R&D engineers, test engineers, salespersons, data scientists, and training course participants. |
| product | A product is a cloud resource template built on Terraform. It can represent a single cloud resource or a group of cloud resources. |
| product version | A new product version is generated each time the cloud resource template of a product changes. Multiple versions can coexist. The administrator can disable a version to prevent end users from using it. |
| product portfolio | A product portfolio groups one or more products. Administrators use product portfolios to manage products and configure launch constraints and permissions for end users. |
| product instance | A product instance is a set of cloud resources created by an end user from a product. It can be a single cloud resource or multiple cloud resources. For example, a product instance can be an Elastic Cloud Service (ECS) instance, or a combination of multiple ECS instances, one database, and one virtual private cloud (VPC). |
| constraint | Launch constraints define the permissions required to launch products in a product portfolio. By configuring constraints, the administrator authorizes end users to launch products without granting each user separate management permissions on individual product instances. This simplifies authorization and reduces administrative overhead. |
| launch role | A launch role is a Resource Access Management (RAM) role specified when the administrator creates a constraint. By assuming a launch role, an end user gains the permissions to orchestrate and create the cloud resources required for a product. |
| authorization | The administrator grants an end user permissions to view all products in a product portfolio in the Service Catalog console. An end user can be a RAM user or a RAM role. Before an end user can launch a product, the administrator must configure a constraint that specifies a RAM role (launch role). The launch role carries the operation permissions on the product, while the end user holds the access permissions. This separation of access and operation permissions reduces security compliance risks. |
| product portfolio sharing | For enterprises with multiple Alibaba Cloud accounts, the administrator can share the configurations of a product portfolio from one account to other accounts. This enables centralized management of product portfolios across accounts. |