AWS partner-central documentation change
Summary
Restructured documentation to clarify CRM integration prerequisites, roles, and processes. Added specific requirements for AWS accounts, IAM users, and S3 permissions. Removed detailed technical explanations of S3 bucket structures and IAM policies.
Security assessment
The changes add documentation about required IAM user creation for authentication and S3 permissions management, which are security-related configurations. However, there is no evidence of addressing a specific vulnerability or security incident - these are standard security best practice documentation updates.
Diff
diff --git a/partner-central/latest/crm/crm-integration-setting-up.md b/partner-central/latest/crm/crm-integration-setting-up.md index d8f342d61..29316c557 100644 --- a//partner-central/latest/crm/crm-integration-setting-up.md +++ b//partner-central/latest/crm/crm-integration-setting-up.md @@ -5 +5 @@ -Prerequisites for CRM IntegrationWho’s involved in setting up the Integration?AWS concepts involved in the Integration +# Integration prerequisites @@ -7 +7 @@ Prerequisites for CRM IntegrationWho’s involved in setting up the Integration? -# Setting up +The following topics list the prerequisites needed for using the AWS Partner CRM connector, and for a Partner Central API integration. For information about the prerequisites for a third-party integration, contact your integration provider. @@ -9 +9 @@ Prerequisites for CRM IntegrationWho’s involved in setting up the Integration? -To set up the CRM Integration with Amazon Web Services (AWS), regardless of your Integration path, you must have access to AWS owned Amazon Simple Storage Service (Amazon S3) buckets in APN Customer Engagements (ACE) for each environment. The bucket is an intermediary for bidirectional file transfers. The following sections can help you set up your CRM Integration with AWS. +Expand each section to learn more. @@ -11 +11 @@ To set up the CRM Integration with Amazon Web Services (AWS), regardless of your -## Prerequisites for CRM Integration +To use the CRM connector or create a Partner Central API integration, you must have the following prerequisites. @@ -13 +13 @@ To set up the CRM Integration with Amazon Web Services (AWS), regardless of your -Before you set up the CRM Integration, ensure you meet the following criteria: + * **An AWS Marketplace seller account in the us-east-1 Region**. You can create an AWS account and register it as an AWS Marketplace seller account, or you can register an existing account as a seller account. @@ -15 +15 @@ Before you set up the CRM Integration, ensure you meet the following criteria: - 1. You must be an [ACE eligible partner](https://aws.amazon.com/partners/programs/ace/). For more information, refer to [FAQ](./crm-integration-faq.html). +To create an AWS account, navigate to [Sign up for AWS](https://signin.aws.amazon.com/signup?request_type=register). For information about creating an AWS Marketplace seller account, refer to [ Registering as an AWS Marketplace seller](https://docs.aws.amazon.com/marketplace/latest/userguide/seller-registration-process.html) in the _AWS Marketplace Seller Guide_. @@ -17 +17 @@ Before you set up the CRM Integration, ensure you meet the following criteria: - 2. The partner alliance lead must complete the onboarding process described in this document. Other profiles will not have access to the CRM Integration onboarding experience. + * **An AWS Partner Central account**. For information about creating the account, refer to [Registering in AWS Partner Central](https://docs.aws.amazon.com/partner-central/latest/getting-started/registering.html) in the _AWS Partner Central Getting Started Guide_. @@ -19 +19 @@ Before you set up the CRM Integration, ensure you meet the following criteria: - 3. The team implementing the Integration must be familiar with the ACE program and the coselling process. For more information, refer to the following resources on Partner Central: + * **Linked Partner Central and AWS Marketplace seller accounts**. For information about linking the accounts, refer to [Linking your AWS Partner Central and AWS Marketplace accounts](./link-pc-mkt-accounts.html) later in this guide. @@ -21 +21 @@ Before you set up the CRM Integration, ensure you meet the following criteria: - * [ACE Opportunity Submission Quick Guide](https://partnercentral.awspartner.com/partnercentral2/s/resources?Id=0698W00000Za2z3QAB) + * **An IAM user in your AWS Marketplace seller account**. The user enables the connector to authenticate Salesforce on AWS. For more information, refer to [Creating the IAM user in your AWS Marketplace seller account](./create-iam-user-seller-account.html) later in this guide. @@ -23 +23 @@ Before you set up the CRM Integration, ensure you meet the following criteria: - * [ACE Validation Process](https://partnercentral.awspartner.com/apex/WebcastMain?Id=a1G0h00000CvZqlEAF) + * **[Amazon S3 permissions for the AWS Marketplace IAM user](./s3-iam-perms.html).** @@ -25 +24,0 @@ Before you set up the CRM Integration, ensure you meet the following criteria: - * [ACE Program FAQs](https://partnercentral.awspartner.com/Resources?Id=0690h000003xjjXAAQ) @@ -27 +25,0 @@ Before you set up the CRM Integration, ensure you meet the following criteria: - * [What is ACE Pipeline Manager?](https://docs.aws.amazon.com/partner-central/latest/sales-guide/what-is-ace-pipeline-manager.html) @@ -29,0 +28 @@ Before you set up the CRM Integration, ensure you meet the following criteria: +Setting up an integration requires people with the following roles: @@ -30,0 +30 @@ Before you set up the CRM Integration, ensure you meet the following criteria: + * A **System integration manager** in Salesforce. @@ -32 +32 @@ Before you set up the CRM Integration, ensure you meet the following criteria: -## Who’s involved in setting up the Integration? + * **Partner alliance lead** – Has permission to initiate a new Integration request through Partner Central. The partner alliance lead oversees the progress of the Integration and monitors the status from the CRM Integration page in Partner Central. @@ -34 +34 @@ Before you set up the CRM Integration, ensure you meet the following criteria: -The following roles are essential in setting up the CRM Integration: + * **Program manager** – Entrusted with driving the Integration process from the partner’s side. This person is able to define essential processes and necessary enablement post-integration. @@ -36 +36 @@ The following roles are essential in setting up the CRM Integration: - 1. **Partner alliance lead** : Has permission to initiate a new Integration request through Partner Central. The partner alliance lead oversees the progress of the Integration and monitors the status from the CRM Integration page within Partner Central. + * **Partner CRM administrator** – Helps map fields between AWS and the partner’s CRM. If partners choose an Integration through the AWS Partner CRM connector, the administrator is critical to its setup. @@ -38 +38 @@ The following roles are essential in setting up the CRM Integration: - 2. **Program manager** : Entrusted with driving the Integration process from the partner’s side. This person is able to define essential processes and necessary enablement post-integration. + * **Developers** – For partners who choose the custom option, developers build and implement the custom Integration. @@ -40 +40 @@ The following roles are essential in setting up the CRM Integration: - 3. **Partner CRM administrator** : Helps map fields between AWS and the partner’s CRM. If partners choose an Integration through the AWS Partner CRM connector, the administrator is critical to its setup. + * **Partner cloud operations and IT team** – Configures authentication credentials, such as the IAM user or role. This involves creating an AWS account and an AWS user for secure access. @@ -42 +42 @@ The following roles are essential in setting up the CRM Integration: - 4. **Developers** : For partners that choose the custom option, developers build and implement the custom Integration. + * **AWS Partner development manager (PDM)** – The partner’s AWS contact. You route all communication with the AWS team through the PDM. For more information, refer to [Integration FAQ](./crm-integration-faq.html) later in this guide. @@ -44 +44 @@ The following roles are essential in setting up the CRM Integration: - 5. **Partner cloud operations and IT team** : Configures authentication credentials, such as AWS Identity and Access Management (IAM) user/role. This involves creating an AWS account and an AWS user for secure access. + * **AWS Partner solutions architect (PSA)** – Works closely with the PDM to assist with any technical questions from the partner. @@ -46 +46 @@ The following roles are essential in setting up the CRM Integration: - 6. **AWS Partner development manager (PDM)** : The partner’s AWS point of contact. All communication with the AWS team is routed through the PDM. For more information, refer to [FAQ](./crm-integration-faq.html). + * **AWS CRM Integration support** – Addresses technical support issues that partners raise through the Support Center in Partner Central. @@ -48 +47,0 @@ The following roles are essential in setting up the CRM Integration: - 7. **AWS Partner solutions architect (PSA)** : Works closely with the PDM to assist with any technical questions the partner has. @@ -50 +48,0 @@ The following roles are essential in setting up the CRM Integration: - 8. **AWS CRM Integration support** : Addresses technical support issues that partners raise through Support Center in Partner Central. @@ -52,0 +51 @@ The following roles are essential in setting up the CRM Integration: +After you install the connector, you configure it to work with the following types of CRM integrations and services: @@ -53,0 +53 @@ The following roles are essential in setting up the CRM Integration: + * An AWS Partner Central API integration. @@ -55 +55 @@ The following roles are essential in setting up the CRM Integration: -## AWS concepts involved in the Integration + * An earlier CRM with Amazon S3 integration, but only if you created the integration before 2024. @@ -57 +57 @@ The following roles are essential in setting up the CRM Integration: -### Environments and access + * AWS Marketplace. @@ -59 +58,0 @@ The following roles are essential in setting up the CRM Integration: -The CRM Integration operates within two distinct environments: sandbox (also known as UAT or Beta) and production (also known as Prod). AWS creates an AWS owned Amazon S3 bucket within the AWS Partner Network (APN) for each environment. The sandbox S3 bucket connects to the APN sandbox environment, and the production S3 bucket connects to the APN production environment. @@ -61 +59,0 @@ The CRM Integration operates within two distinct environments: sandbox (also kno -To access each S3 bucket securely, you need to set up (or reuse) an AWS account for each environment. If you’re an independent software vendor (ISV), we recommend reusing your existing AWS Marketplace account. In the AWS account, you need to create an IAM user (for AWS Partner CRM connector) or IAM role (for third-party or custom Integration). The IAM role or user is used for provisioning access to the S3 bucket that AWS sets up for the partner. Partners have programmatic access to the AWS created buckets. During the onboarding process, AWS generates an access policy that you have to attach to these IAMs. You can create an AWS account and IAM user or role for each environment, at the beginning of the Integration onboarding process. However, AWS allows programmatic access to the production bucket only after you successfully test your solution’s sandbox environment (connector, third-party, or custom Integration). @@ -63 +60,0 @@ To access each S3 bucket securely, you need to set up (or reuse) an AWS account -### Amazon S3 buckets @@ -65 +62 @@ To access each S3 bucket securely, you need to set up (or reuse) an AWS account -To access a bucket for each environment, refer to [Stage 1: Onboarding prerequisites](./stage-1-prerequisites.html). To ensure secure interaction with S3 files, AWS uses IAM policies for partner authentication. These policies rigorously control partner permissions for uploading and downloading S3 files. +You must configure the connector for each type of integration. In turn, the configurations enable Salesforce to exchange data with the corresponding integration. @@ -67 +64 @@ To access a bucket for each environment, refer to [Stage 1: Onboarding prerequis -Each bucket created for partners follows the naming convention below. +The following topics list and describe the prerequisites for each type of configuration. Expand each section to learn more. @@ -69 +66 @@ Each bucket created for partners follows the naming convention below. -`ace-apn-[partner-id]-[environment]-us-west-2` +Complete the tasks listed in [General prerequisites](./stage-1-prerequisites.html) earlier in this section. @@ -71 +68 @@ Each bucket created for partners follows the naming convention below. - * **`partner-id`** : A numerical unique identifier assigned to each partner in the AWS Partner Network, consisting of up to 10 digits. Partners can locate their Partner ID by navigating to: **AWS Partner Central** > **My Company** > **Partner Scorecard** > **Partner ID**. +To use the CRM connector with AWS Marketplace, you must have must have the following prerequisites: @@ -73 +70 @@ Each bucket created for partners follows the naming convention below. - * **`environment`** : This field accepts two values: + * The [general prerequisites](./stage-1-prerequisites.html) listed earlier in this section. @@ -75 +72 @@ Each bucket created for partners follows the naming convention below. - * `beta`: Indicates a bucket pointing to a sandbox environment. + * At least one product listed on AWS Marketplace. For information about listing products, refer to [ Preparing your product for AWS Marketplace](https://docs.aws.amazon.com/marketplace/latest/userguide/product-preparation.html) in the _AWS Marketplace Seller Guide_. @@ -77 +74 @@ Each bucket created for partners follows the naming convention below. - * `prod`: Indicates a bucket pointing to a production environment. + * An Amazon S3 bucket for storing your custom end user license agreements. For more information about creating a bucket, refer to [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html) in the _Amazon S3 User Guide_. @@ -78,0 +76 @@ Each bucket created for partners follows the naming convention below. + * A service-linked role for Resale Authorization. Independent software vendors and AWS Marketplace Channel Partners must create a service-linked role that provides resource-sharing permissions to AWS. Refer to [CPPO Prerequisites](https://docs.aws.amazon.com/marketplace/latest/APIReference/work-with-cppos.html#cppo-prerequisites) in the _AWS Marketplace API Reference_ , and [Using service-linked roles for Resale Authorization with AWS Marketplace](https://docs.aws.amazon.com/marketplace/latest/userguide/using-roles-for-resale-authorization.html) in the _AWS Marketplace Seller Guide_. @@ -79,0 +78 @@ Each bucket created for partners follows the naming convention below. + * Amazon EventBridge for real-time notifications. For information about setting up notifications, refer to [Setting up real-time notifications for AWS Partner Central and AWS Marketplace events](./set-up-real-time-notifications.html) later in this section. @@ -82 +80,0 @@ Each bucket created for partners follows the naming convention below. -### Folder structure in Amazon S3 bucket @@ -84,22 +81,0 @@ Each bucket created for partners follows the naming convention below. -AWS uses S3 buckets with different folders for the Integration, as shown in table 1. - -# | Purpose | Folder name | Description ----|---|---|--- -1 | Retrieve ACE leads | **`lead-outbound`** | Contains new leads or updates existing leads. Partners have read and delete access to this folder. After a file is processed, delete it. -2 | Retrieve ACE opportunities | **`opportunity-outbound`** | Contains a file of new or updated opportunities. Partners have read and delete access to this folder. -3 | Send new or update existing ACE opportunities. | **`opportunity-inbound`** | Contains files with new or updated opportunities. -4 | Send ACE updates about leads | **`lead-inbound`** | Contains files with updated leads. -5 | Retrieve results for opportunities sent to ACE | **`opportunity-inbound-processed-results`** | Contains files with the results of processed opportunities. Partners have read and delete access to this folder. -6 | Retrieve results for leads from ACE | **`lead-inbound-processed-results`** | Contains files with the results of processed leads. Partners have read and delete access to this folder. - -_Table 1: Folder structure of S3 bucket_ - -###### Note - -Amazon S3 treats folders as objects that are only visible if they contain files. But partners can read and add files to folders even if a folder doesn’t appear. - -### IAM - -AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. With IAM, you can centrally manage permissions that control which AWS resources users can access. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources. For more information, refer to [Introduction to AWS Identity and Access Management (IAM)](https://www.aws.training/learningobject/video?id=16448). - -Your access to the Amazon S3 buckets provisioned by AWS is managed through an IAM user/role. Each IAM user/role is allow-listed for access to their respective bucket. To configure access, you need to create one IAM user/role for each environment, sandbox and production. For more information, refer to [Getting started](./crm-integration-getting-started.html). @@ -113 +89 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Business flows +Integration options @@ -115 +91 @@ Business flows -Getting started +Working with referrals, leads, and opportunities