def lambda_handler(event, context):

import boto3

import traceback

import sys

import time

import json

#import pdb

AccountId = 802169185211

#AccountId = event['AccountId']

region = 'us-east-1'

user = 'test'

client = boto3.client('sts')

role = 'arn:aws:iam::'+str(AccountId)+':role/OrganizationAccountAccessRole'

print (role)

res = client.assume_role(

RoleArn=role,

RoleSessionName=user

acc_key = res['Credentials']['AccessKeyId']

sec_key = res['Credentials']['SecretAccessKey']

token = res['Credentials']['SessionToken']

print (acc_key)
#create session to user account to create new role

session =
boto3.Session(aws_access_key_id=acc_key,aws_secret_access_key=sec_key,aws_session_to
ken=token,region_name=region)

Servicecatalog_conn_client1 = session.client('servicecatalog')

service_type = 'servicecatalog'

#source_region is the region for Source AWS account and destination_region is the region
for destination AWS account

source_region = 'us-east-1'

destination_region = 'us-east-1'

#access_key = ''

#secret_key = ''

#Servicecatalog_conn_client = boto3.client(service_type, source_region,

aws_access_key_id=access_key,aws_secret_access_key=secret_key)

Servicecatalog_conn_client = boto3.client(service_type, source_region)

# Now create Portfolios share to copy products to SUB-ACCOUNT

response = Servicecatalog_conn_client.list_portfolios()

portfolio_list = []

for ids in response["PortfolioDetails"]:

portfolio_list.append(ids["Id"])

portfoliolist = portfolio_list

for portid in portfoliolist:

response = Servicecatalog_conn_client.create_portfolio_share(

PortfolioId=portid,
 AccountId="802169185211"

# Creating service catalog Portfolios at Destination AWS Account

response = Servicecatalog_conn_client1.create_portfolio(

DisplayName="InnovationLab",

Description="This portfolio will hold product for Innovation Lab users.",

ProviderName="Capgemini"

response = Servicecatalog_conn_client1.create_portfolio(

DisplayName="ProfessionalLab",

Description="This Portfolio will hold hold products for Professional Lab Users",

ProviderName="Capgemini"

response = Servicecatalog_conn_client1.create_portfolio(

DisplayName="PartnerLab",

Description="This Portfolio will hold hold products for Partner Sandbox Lab Users.",

ProviderName="Capgemini"

# Copy service catalog Products from Source Account to destination AWS account"

paginator = Servicecatalog_conn_client.get_paginator('search_products_as_admin')
response = paginator.paginate(

PaginationConfig={

'MaxItems': 3000

out = []

for ids in response:

for j in (ids["ProductViewDetails"]):

out.append(j['ProductARN'])

arn = out

for productarn in arn:

print productarn

response = Servicecatalog_conn_client1.copy_product(

SourceProductArn=productarn,

# Copying Product is Asynchronious process, so please wait for a moment !

time.sleep(150)
 # Now remove Portfolios share

response = Servicecatalog_conn_client.list_portfolios()

portfolio_list = []

for ids in response["PortfolioDetails"]:

portfolio_list.append(ids["Id"])

portfoliolist = portfolio_list

for portid in portfoliolist:

response = Servicecatalog_conn_client.delete_portfolio_share(

PortfolioId=portid,

AccountId="802169185211"

# Search common Products for innovation and Professional Labs

paginator1 = Servicecatalog_conn_client1.get_paginator('search_products_as_admin')

response = paginator1.paginate(

Filters={'Owner': ['InnoProLab']},

PaginationConfig={

'MaxItems': 3000

)
product_id = []

for ids in response:

for j in (ids["ProductViewDetails"]):

product_id.append(j['ProductViewSummary']['ProductId'])

prodid = product_id

paginator2 = Servicecatalog_conn_client1.get_paginator('search_products_as_admin')

response = paginator2.paginate(

Filters={'Owner': ['InnovationLab']},

PaginationConfig={

'MaxItems': 3000

product_id1 = []

for ids in response:

for j in (ids["ProductViewDetails"]):

product_id1.append(j['ProductViewSummary']['ProductId'])

prodid1 = product_id1

# Search Products for Partner Lab

 paginator3 = Servicecatalog_conn_client1.get_paginator('search_products_as_admin')

response = paginator3.paginate(

PaginationConfig={

'MaxItems': 3000

product_id2 = []

for ids in response:

for j in (ids["ProductViewDetails"]):

product_id2.append(j['ProductViewSummary']['ProductId'])

prodid2 = product_id2

# Find out the Portfolio ID of portfolios from Destination AWS account and Associate
products with portfolios"

response = Servicecatalog_conn_client1.list_portfolios()

portfolio_list = []

portfolio_list1 = []

portfolio_list2 = []

for ids in response["PortfolioDetails"]:

 if (ids["DisplayName"]) == "ProfessionalLab":

portfolio_list.append(ids["Id"])

portfoliolist = portfolio_list

else:

if (ids["DisplayName"]) == "InnovationLab":

portfolio_list1.append(ids["Id"])

portfoliolist1 = portfolio_list1

else:

(ids["DisplayName"]) == "PartnerLab"

portfolio_list2.append(ids["Id"])

portfoliolist2 = portfolio_list2

#Assocaite Common products to ProfessionalLab Portfolio

for portid in portfoliolist:

for productid in prodid:

response = Servicecatalog_conn_client1.associate_product_with_portfolio(

ProductId=productid,

PortfolioId=portid

#Assocaite common products to Innovation Lab Portfolio

for portid1 in portfoliolist1:

 for productid in prodid:

response = Servicecatalog_conn_client1.associate_product_with_portfolio(

ProductId=productid,

PortfolioId=portid1

#Assocaite Innovation Lab products to InnovationLab Portfolio

for portid1 in portfoliolist1:

for productid1 in prodid1:

response = Servicecatalog_conn_client1.associate_product_with_portfolio(

ProductId=productid1,

PortfolioId=portid1

#Assocaite Partner Lab products to PartnerLab Portfolio

for portid2 in portfoliolist2:

for productid2 in prodid2:

response = Servicecatalog_conn_client1.associate_product_with_portfolio(

ProductId=productid2,

PortfolioId=portid2
 )

#create session to user account to create new role

session =
boto3.Session(aws_access_key_id=acc_key,aws_secret_access_key=sec_key,aws_session_to
ken=token)

iam = session.client('iam')

my_managed_policy = {

"Version": "2012-10-17",

"Statement": [

"Effect": "Allow",

"Action": [

"catalog-user:*",

"cloudformation:CreateStack",

"cloudformation:DeleteStack",

"cloudformation:DescribeStackEvents",

"cloudformation:DescribeStacks",

"cloudformation:GetTemplateSummary",

"cloudformation:SetStackPolicy",

"cloudformation:ValidateTemplate",

"cloudformation:UpdateStack",

"cloudformation:ListStacks",

"cloudformation:*",
 "servicecatalog:DescribeProduct",

"servicecatalog:DescribeProductView",

"servicecatalog:DescribeProvisioningParameters",

"servicecatalog:ListLaunchPaths",

"servicecatalog:ProvisionProduct",

"servicecatalog:SearchProducts",

"s3:*",

"ec2:*",

"rds:*",

"ecs:*",

"es:*",

"kinesis:*",

"firehose:*",

"elasticache:*",

"dynamodb:*",

"elasticmapreduce:*",

"application-autoscaling:*",

"autoscaling:*",

"cloudwatch:*",

"logs:*",

"iam:*",

"elasticloadbalancing:*",

"SNS:*"

],

"Resource": "*"
 },

"Effect": "Allow",

"Action": [

"servicecatalog:DescribeProvisionedProduct",

"servicecatalog:DescribeRecord",

"servicecatalog:ListRecordHistory",

"servicecatalog:ScanProvisionedProducts",

"servicecatalog:TerminateProvisionedProduct",

"servicecatalog:UpdateProvisionedProduct"

],

"Resource": "*",

"Condition": {

"StringEquals": {

"servicecatalog:userLevel": "self"

trust_policy = {

"Version": "2012-10-17",

"Statement": {

"Effect": "Allow",
 "Principal": {"Service": ["ec2.amazonaws.com", "servicecatalog.amazonaws.com"],

"AWS": ["arn:aws:iam::293952640683:role/Portal",

"arn:aws:iam::293952640683:root"

},

"Action": "sts:AssumeRole"

policy = iam.create_policy(

PolicyName='ServiceCatalogPolicy',

PolicyDocument=json.dumps(my_managed_policy),

create_role = iam.create_role(

RoleName='ServiceCatalogRole',

AssumeRolePolicyDocument=json.dumps(trust_policy)

#print create_role

rolearn = create_role["Role"]["Arn"]

#print (rolearn)

# Attach a role policy

ServiceCatalogRole=iam.attach_role_policy(

PolicyArn='arn:aws:iam::'+str(AccountId)+':policy/ServiceCatalogPolicy',

RoleName='ServiceCatalogRole'

)
# Findout the Portfolio ID of portfolios from Destination AWS account

response = Servicecatalog_conn_client1.list_portfolios()

portfolio_list = []

for ids in response["PortfolioDetails"]:

portfolio_list.append(ids["Id"])

portfoliolist = portfolio_list

for portid in portfoliolist:

#Attach IAM Group to Service Catalog Portfolios

response = Servicecatalog_conn_client1.associate_principal_with_portfolio(

PortfolioId=portid,

PrincipalARN=rolearn,

PrincipalType='IAM'