AWS marketplace documentation change
Summary
Updated SaaS deployment requirements, clarified AWS hosting patterns, added data processing restrictions, and architecture diagram requirements
Security assessment
Added restrictions about third-party services handling application data and security/monitoring agents. While these relate to data governance and security controls, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/marketplace/latest/userguide/saas-guidelines.md b/marketplace/latest/userguide/saas-guidelines.md index 727595d9b..a9f17af5d 100644 --- a//marketplace/latest/userguide/saas-guidelines.md +++ b//marketplace/latest/userguide/saas-guidelines.md @@ -94 +94 @@ The following guidelines go into effect on May 1, 2025. - * You can publish all SaaS architectures. However, for AWS Marketplace to consider your product as deployed on AWS, your SaaS application must conform to one of the AWS hosting patterns listed below. Products that are deployed on AWS receive a special designation in the AWS Marketplace search results, and in their product details pages. + * You can publish all SaaS architectures. @@ -96 +96 @@ The following guidelines go into effect on May 1, 2025. - * The product runs entirely on AWS. This includes both the [application and control planes](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/control-plane-vs.-application-plane.html). The _application plane_ can run in the seller's AWS account, the buyer's AWS account, or both. The SaaS application can use content delivery networks (CDNs), domain name systems (DNSs), and corporate identity providers (IdPs) from other providers. + * Products that are deployed on AWS receive a special designation in the AWS Marketplace search results and their product details pages. For AWS Marketplace to consider your product as deployed on AWS, your product must run entirely on AWS. This includes the application and control planes. The _application plane_ can run in the seller's AWS account, the buyer's AWS account, or both. For more information, refer to the [Control plane vs. application plane](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/control-plane-vs.-application-plane.html) whitepaper. @@ -98 +98,9 @@ The following guidelines go into effect on May 1, 2025. - * The product is designed to replicate data or migrate workloads to AWS only. Except for clients and gateways running outside of AWS, the application and control planes must run on AWS. AWS must be the only available target. If the product also supports replication to environments outside of AWS, you must remove that capability and publish a separate product with that capability. AWS Marketplace won't consider that second product as deployed on AWS. +Third-party services used by the product to transmit, store, or process application data—except content delivery networks (CDNs), domain name systems (DNSs), and corporate identity providers (IdPs)—must also run entirely on AWS. + +###### Note + +Application data is data that belongs to or is generated for the buyer. + +Agents or gateways used by the product for security, monitoring, data replication, or migration can run on buyer-owned environments outside AWS, including on premises, but must send data only to AWS for storage and analysis. + +You must include an architecture diagram for review. For more information, refer to Architecture diagram in the next section. @@ -102 +110 @@ The following guidelines go into effect on May 1, 2025. - * Your [control plane](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/control-plane-vs.-application-plane.html)—as defined in the _SaaS Architecture Fundamentals AWS Whitepaper_ —must reside in infrastructure that you manage for your product to be considered a SaaS product and not a managed service. For more information, see the [SaaS vs. Managed Service Provider](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/saas-vs.-managed-service-provider-msp.html) whitepaper. + * To be considered a SaaS product and not a managed service, your control plane—as defined in the [SaaS Architecture Fundamentals](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/saas-architecture-fundamentals.html) AWS whitepaper—must reside in infrastructure that you manage. For more information, refer to the [SaaS vs. Managed Service Provider](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/saas-vs.-managed-service-provider-msp.html) whitepaper. @@ -133 +141 @@ The following guidelines go into effect on May 1, 2025. -For more information on SaaS architectures, refer to [SaaS Architecture Fundamentals](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/saas-architecture-fundamentals.html). +For more information on SaaS architectures, refer to the [SaaS Architecture Fundamentals](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/saas-architecture-fundamentals.html) AWS whitepaper. @@ -137 +145 @@ For more information on SaaS architectures, refer to [SaaS Architecture Fundamen -To receive the special designation that your product is deployed on AWS, [update your product's architecture details](./saas-product-settings.html#updating-architecture-details) in AWS Marketplace Management Portal. Select a hosting pattern that is deployed on AWS and upload an architecture diagram that will be reviewed by AWS. For hosting patterns that AWS Marketplace considers deployed on AWS, refer to Guidelines effective May 1, 2025, previously in this guide. +To receive the special designation that your product is deployed on AWS, [update your product's architecture details](./saas-product-settings.html#updating-architecture-details) in the AWS Marketplace Management Portal. Select a hosting pattern that is deployed on AWS and upload an architecture diagram that AWS reviews. For hosting patterns that AWS Marketplace considers deployed on AWS, refer to Guidelines effective May 1, 2025 in the previous section. If your hosting pattern changes, you must update your product's architecture details. @@ -155,0 +164,4 @@ Use the following criteria when creating a diagram: +###### Note + +The architecture diagram that you use to update the architecture details of your SaaS product is not published and not publicly available to buyers. +