principalArn

The ARN of the principal (user, role, or group). This field allows for an ARN with no accountID, with or without wildcard characters if the PrincipalType is an IAM_PATTERN.

For more information, review associate-principal-with-portfolio in the Amazon Web Services CLI Command Reference.