AWS marketplace medium security documentation change
Summary
Updated documentation to emphasize AWS account ID over deprecated customer identifier, reduced token expiration time from 4 hours to 1 hour, and strengthened security recommendations
Security assessment
Changes deprecate customer identifier (potential security weakness) in favor of AWS account ID, reduce token expiration time to limit attack window, and explicitly state security responsibility for validating credentials. Specific security improvements include token lifetime reduction and guidance to store AWS account IDs securely.
Diff
diff --git a/marketplace/latest/userguide/saas-product-customer-setup.md b/marketplace/latest/userguide/saas-product-customer-setup.md index f852d6f2d..425eaa347 100644 --- a/marketplace/latest/userguide/saas-product-customer-setup.md +++ b/marketplace/latest/userguide/saas-product-customer-setup.md @@ -5 +5 @@ -Configuring your SaaS product to accept new buyers +Configuring your SaaS product to accept new buyersSecurity and ordering @@ -13 +13 @@ When creating your SaaS product listing, you provide a URL to your registration -The registration landing page must be able to identify and accept the `x-amzn-marketplace-token` token in the form data from AWS Marketplace with the customer’s identifier for billing. It should then pass that token value to the AWS Marketplace Metering Service to resolve for the unique customer identifier, customer AWS account ID, and corresponding product code. For a code example, see [ResolveCustomer code example](./saas-code-examples.html#saas-resolvecustomer-example). +The registration landing page must be able to identify and accept the `x-amzn-marketplace-token` token in the form data from AWS Marketplace with the customer’s identifier for billing. It should then pass that token value to the AWS Marketplace Metering Service to resolve for the unique customer AWS account ID, customer identifier (deprecated after December 31, 2025), and corresponding product code. For a code example, see [ResolveCustomer code example](./saas-code-examples.html#saas-resolvecustomer-example). @@ -27 +27 @@ You're responsible for correctly configuring your SaaS software to accept new cu - 3. A registration token is generated for the customer that contains their customer identifier and your product code. + 3. A registration token is generated for the customer that contains their AWS account ID, customer identifier, and your product code. @@ -33 +33 @@ You're responsible for correctly configuring your SaaS software to accept new cu - 6. To redeem this registration token for a customer identifier, customer AWS account ID, and product code, your website must call [ResolveCustomer](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_ResolveCustomer.html) on the AWS Marketplace Metering Service. For an example of a `ResolveCustomer` call, see [ResolveCustomer code example](./saas-code-examples.html#saas-resolvecustomer-example). The customer identifier isn't the customer’s AWS account ID, but it's universal between products and should be saved to an internal source as part of your customer records. The product code is a unique string for your SaaS product that AWS provides to you. Each AWS product has one unique product code, which is assigned to you during registration. + 6. To redeem this registration token for a customer AWS account ID, customer identifier, and product code, your website must call [ResolveCustomer](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_ResolveCustomer.html) on the AWS Marketplace Metering Service. For an example of a `ResolveCustomer` call, see [ResolveCustomer code example](./saas-code-examples.html#saas-resolvecustomer-example). The customer identifier isn't the customer’s AWS account ID, but it's universal between products and should be saved to an internal source as part of your customer records. The product code is a unique string for your SaaS product that AWS provides to you. Each AWS product has one unique product code, which is assigned to you during registration. @@ -39 +39 @@ You're responsible for correctly configuring your SaaS software to accept new cu -If setting up or linking to an existing customer account in your product requires a manual process by your team, you can use a contact-us form to collect the customer's contact information. After collecting their contact information and resolving their AWS Marketplace unique customer identifier (as obtained in step 6), display a notification message for the customer. In the notification, state that their account is being set up and ask that they wait for you to contact them. Provide the customer with the expected turnaround time and your contact information. Also send an email message to the customer with the same details. +If setting up or linking to an existing customer account in your product requires a manual process by your team, you can use a contact-us form to collect the customer's contact information. After collecting their contact information and resolving their AWS account ID and unique customer identifier (as obtained in step 6), display a notification message for the customer. In the notification, state that their account is being set up and request that they wait for you to contact them. Provide the customer with the expected turnaround time and your contact information. Also send an email message to the customer with the same details. @@ -41 +41 @@ If setting up or linking to an existing customer account in your product require - 8. The customer is now signed in to your website using credentials specific to that SaaS product. In your accounts database, you can have an entry for each customer. Your accounts database must have a column for the AWS customer identifier, which you populate with the customer identifier that you obtained in step 6. Verify that no other accounts in your system share this customer identifier. For customers who subscribe to multiple products through AWS Marketplace, the customer identifier will remain the same, with each subscription having a unique product code. + 8. The customer is now signed in to your website using credentials specific to that SaaS product. In your accounts database, you can have an entry for each customer. Your accounts database must have a column for the AWS account ID. Verify that no other accounts in your system share the AWS account ID. @@ -55 +55 @@ Do not activate a product subscription unless you receive a `subscribe-success` - 10. Use the customer identifier stored in your database to meter for usage through the AWS Marketplace Metering Service or check for entitlements through the AWS Marketplace Entitlement Service. + 10. Use the AWS account ID stored in your database to meter for usage through the AWS Marketplace Metering Service or check for entitlements through the AWS Marketplace Entitlement Service. @@ -60 +60 @@ Do not activate a product subscription unless you receive a `subscribe-success` -### Security and ordering +## Security and ordering @@ -62 +62 @@ Do not activate a product subscription unless you receive a `subscribe-success` -As a seller, it’s your responsibility to trust only customer identifiers that are immediately returned from AWS or those that your system has signed. We recommend that you resolve the registration token immediately because it expires after four hours. After you resolve the registration token, store the customer identifier as a signed attribute on the customer’s browser session until the registration is complete. +As a seller, it’s your responsibility to trust only AWS account IDs that are immediately returned from AWS or those that your system has signed. We recommend that you resolve the registration token immediately because it may expire after approximately one hour. After you resolve the registration token, store the AWS account ID as a signed attribute on the customer’s browser session until the registration is complete.