AWS marketplace documentation change
Summary
Expanded documentation for AWSPrivateMarketplaceRequests policy to clarify permission groups, including legacy deprecation notice, request management permissions, and optional tagging capabilities. Added changelog entry for policy updates.
Security assessment
The changes primarily clarify policy structure and permissions without addressing vulnerabilities. While tagging permissions are added, there's no explicit security context provided. Deprecation of legacy permissions is operational, not security-focused.
Diff
diff --git a/marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.md b/marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.md index c6e246dd9..1ae81665d 100644 --- a//marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.md +++ b//marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.md @@ -155 +155,16 @@ You can attach the `AWSPrivateMarketplaceRequests` policy to your IAM identities -This policy grants contributor permissions that allow access to request products be added to your private marketplace, and to view those requests. These requests must be approved or denied by a private marketplace administrator. +This policy grants contributor permissions that allow access to request products to be added to their Private Marketplace experience, and to view those requests. These requests must be approved or declined by a Private Marketplace administrator. + +The permissions are organized into multiple groups: + + 1. `LegacyPrivateMarketplaceRequestsPermissions`: These permissions are used by legacy Private Marketplace which will be deprecated. For details, see [Private marketplaces in AWS Marketplace (legacy version)](./private-marketplace.html). + + 2. `PrivateMarketplaceManageRequestsPermissions`: These permissions are required to create and cancel product approval requests. + + 3. `PrivateMarketplaceReadRequestsPermissions` and `PrivateMarketplaceListRequestsPermissions`: These permissions are required to list and get details of the product approval requests. + + 4. `PrivateMarketplaceReadChangeSetPermissions`: These permissions are required to list and get details of change sets to create and cancel requests. See [Working with change sets](https://docs.aws.amazon.com/marketplace/latest/APIReference/catalog-apis.html#working-with-change-sets) in the _AWS Marketplace API Reference_. + + 5. `PrivateMarketplaceTaggingRequestsPermissions`: The tagging permissions are optional and allow users to tag the requests. See [Managing tags on resources](https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/managing-tags.html) in the _AWS Marketplace API Reference_. + + + @@ -206,0 +222 @@ Change | Description | Date +AWSPrivateMarketplaceRequests — updates to existing policy | AWS Marketplace added permissions to create and cancel product approval requests, list and get details of the product approval requests, and allow users to tag the requests. | November 17, 2025