AWS partner-central documentation change
Summary
Updated account selection guidance for AWS Partner Central, emphasizing permanent account linking after migration and adding specific requirements for account ownership, type, and characteristics.
Security assessment
The changes enhance security documentation by specifying that accounts must be owned by the company (not distributors) and must not be developer/sandbox/personal accounts. This prevents potential security risks from using inappropriate accounts, but doesn't address a specific vulnerability.
Diff
diff --git a/partner-central/latest/getting-started/linking-prerequisites.md b/partner-central/latest/getting-started/linking-prerequisites.md index dfe0dae2b..2d93ada49 100644 --- a//partner-central/latest/getting-started/linking-prerequisites.md +++ b//partner-central/latest/getting-started/linking-prerequisites.md @@ -7 +7 @@ -User roles and permissionsSelecting the right AWS accountGranting IAM permissionsUnderstanding the role permissionsCreating a permission set for single sign-on +User roles and permissionsSelect an AWS account for AWS Partner CentralGranting IAM permissionsUnderstanding the role permissionsCreating a permission set for single sign-on @@ -21 +21 @@ Due to user interface, feature, and performance issues, account linking does not - * Selecting the right AWS account + * Select an AWS account for AWS Partner Central @@ -46 +46 @@ Your company's primary account administrator. This person must have a business d -## Selecting the right AWS account +## Select an AWS account for AWS Partner Central @@ -48 +48 @@ Your company's primary account administrator. This person must have a business d -Use the information in the following table to help decide which AWS account you should link with your Partner Central account. +Choose the AWS account you'll link to your AWS Partner Central profile. This applies whether you're registering as a new AWS partner or migrating from the legacy AWS Partner Network (APN) portal. @@ -50 +50 @@ Use the information in the following table to help decide which AWS account you -###### Important +The AWS account you choose for AWS Partner Central will manage APN fee payments, solutions, and APN Customer Engagement (ACE) opportunity tracking. All APN resources, including ACE opportunities, opportunity history, and multi-partner opportunity invitations, are created in the account and cannot be transferred to other AWS accounts. @@ -52 +52 @@ Use the information in the following table to help decide which AWS account you -Consider the following when selecting an AWS account: +If you are an AWS Partner who has access to legacy Partner Central and needs to link an AWS account to pay APN fees or for Partner Central migration, **account linking is permanent after migration**. Before migration, you can unlink your account and select a different one. After migration, the linked account cannot be changed. All AWS Partner Network resources, including ACE opportunities, opportunity history, and multi-partner opportunity invitations, are permanently associated with this account. @@ -54 +54 @@ Consider the following when selecting an AWS account: - * AWS Partner Central requires an AWS account that uses IAM policies to control access. +Use the information in the following table to help decide which AWS account you should link or select for your AWS Partner Central account. @@ -56 +56 @@ Consider the following when selecting an AWS account: - * The linked AWS account manages APN fee payment, solutions, and APN Customer Engagement (ACE) opportunity tracking using the Partner Central APIs. +###### Account selection checklist @@ -58 +58 @@ Consider the following when selecting an AWS account: - * AWS Partner Network features and APIs are available through the linked AWS account. +**Your account must:** @@ -60 +60 @@ Consider the following when selecting an AWS account: - * AWS resources such as ACE opportunities, opportunity history, and multi-partner opportunity invitations are created in the linked AWS account and can't be transferred to other AWS accounts. + * **Use a paid AWS account plan and be in good standing** — The account must use a paid AWS account plan (not Free Tier) and maintain good standing with AWS and APN. To upgrade to a paid account plan, see [Choosing an AWS Free Tier plan](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-free-tier.html) in the _AWS Billing User Guide_. @@ -62 +62 @@ Consider the following when selecting an AWS account: - * The AWS account that you link to must be on a Paid AWS account plan. When you sign up for an AWS account, choose the Paid account plan. To upgrade an AWS account to the Paid AWS account plan, refer to [ Choosing an AWS Free Tier plan](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/free-tier-plans.html) in the _AWS Billing User Guide_. + * **Be owned by your company** — The account must be owned by your company and belong to an AWS organization that your company controls. It must **not** be owned by a distributor or another organization, or be a member account within a distributor's organization. @@ -64 +64 @@ Consider the following when selecting an AWS account: - * AWS recommends linking an AWS account that is _not_ used for the following purposes. + * **Be able to onboard future AWS Partner Central users** — Users who need to create opportunities, solutions, and fund requests will need access to this account. @@ -66 +66 @@ Consider the following when selecting an AWS account: - * A management account, where you manage the account information and metadata for all of the AWS accounts in your organization. + * **Have a legal entity (tax) address matching your primary business location** — The account's billing address becomes the headquarters location for your partner profile. Choose an account with a billing address that matches your primary business location. @@ -68 +67,0 @@ Consider the following when selecting an AWS account: - * A production account, where users and data interact with applications and services. @@ -70 +68,0 @@ Consider the following when selecting an AWS account: - * A developer or sandbox account, where developers write code. @@ -72 +69,0 @@ Consider the following when selecting an AWS account: - * A personal account where individuals for learn, experiment, and work on personal projects. @@ -74 +71 @@ Consider the following when selecting an AWS account: - * An AWS Marketplace buyer account, where you procure products from AWS Marketplace. +**Your account must not be:** @@ -76 +73,12 @@ Consider the following when selecting an AWS account: -Keeping the linked account separate from your AWS Partner Network engagements ensures flexibility for configurations specific to AWS Partner Central without affecting other environments. Doing so also simplifies financial tracking, tax reporting, and audits. + * **Developer or sandbox accounts** for code development and testing + + * **Personal accounts** for individual learning or projects + + * **Test accounts** + + + + +**Recommended not to choose:** + + * **Management (or primary payer) accounts** for AWS Organizations