A RAM role authorized in a product portfolio serves as an end user identity that can access products in the Service Catalog console. A RAM role specified when a constraint is created serves as a launch role used to launch products. These two types of RAM roles serve different purposes.
| RAM role | Description | References |
| A RAM role that is authorized in a product portfolio | A RAM role authorized in a product portfolio acts as an end user. After authorization, the end user can view all products in the product portfolios on which the end user has permissions in the Service Catalog console. | Grant access to an end user |
| A RAM role that is specified when a constraint is created | A RAM role specified when a constraint is created acts as a launch role used to launch products. This launch role cannot log on to the Service Catalog console, but has permissions to perform operations on specific cloud services. This way, administrators can grant end users only the required permissions in Service Catalog, which reduces security and compliance risks. |
Step 1: Create a launch role and grant permissions to the launch role |