AWS marketplace: Documented s3:PutObject IAM permission for private offer uploads
Summary
Added a note stating that uploading files in the 'Custom legal terms and other offer documents' section requires the s3:PutObject permission on the aws-partner-central-marketplace-ephemeral-writeonly-files bucket, that AWSMarketplaceSellerFullAccess and AWSMarketplaceSellerProductsFullAccess include it, and how to escalate an 'Access denied to s3:PutObject' error.
Security assessment
The added note documents the exact IAM permission (s3:PutObject) and resource ARN scope needed for a write operation, plus which managed policies grant it and how to handle an access-denied error — this is least-privilege/permission documentation rather than a fix for a specific vulnerability, so it is security documentation of medium severity.
Evidence
+To upload files in the **Custom legal terms and other offer documents** section, your IAM identity must have the `s3:PutObject` permission on `arn:aws:s3:::aws-partner-central-marketplace-ephemeral-writeonly-files/`account-id`/*`. The `AWSMarketplaceSellerFullAccess` and `AWSMarketplaceSellerProductsFullAccess` managed policies include this permission. If the upload fails with an `Access denied to s3:PutObject` error, copy the text in the error message and send it to your AWS administrator. For more information, see [Policies and permissions for AWS Marketplace sellers](./detailed-management-portal-permissions.html).
Diff
diff --git a/marketplace/latest/userguide/creating-private-offer.md b/marketplace/latest/userguide/creating-private-offer.md index 3d98ded..83b61e1 100644 --- a//marketplace/latest/userguide/creating-private-offer.md +++ b//marketplace/latest/userguide/creating-private-offer.md @@ -144,0 +145,4 @@ All public offers and private offers with consumption pricing can only be create +###### Note + +To upload files in the **Custom legal terms and other offer documents** section, your IAM identity must have the `s3:PutObject` permission on `arn:aws:s3:::aws-partner-central-marketplace-ephemeral-writeonly-files/`account-id`/*`. The `AWSMarketplaceSellerFullAccess` and `AWSMarketplaceSellerProductsFullAccess` managed policies include this permission. If the upload fails with an `Access denied to s3:PutObject` error, copy the text in the error message and send it to your AWS administrator. For more information, see [Policies and permissions for AWS Marketplace sellers](./detailed-management-portal-permissions.html). +