AWS marketplace: Document s3:PutObject permission for AWS Partner Central uploads
Summary
Adds documentation for the s3:PutObject permission used to upload files (e.g., custom legal terms and offer documents) in AWS Partner Central, including the specific write-only S3 bucket ARN and noting which managed policies include it.
Security assessment
This documents an IAM permission and explicitly scopes it to a single AWS-owned write-only bucket ARN (arn:aws:s3:::aws-partner-central-marketplace-ephemeral-writeonly-files/account-id/*), clarifying least-privilege write access; it is security-relevant IAM guidance but does not address a specific vulnerability.
Evidence
**`s3:PutObject`**
Diff
diff --git a/marketplace/latest/userguide/detailed-management-portal-permissions.md b/marketplace/latest/userguide/detailed-management-portal-permissions.md index c3feb98..7281b18 100644 --- a//marketplace/latest/userguide/detailed-management-portal-permissions.md +++ b//marketplace/latest/userguide/detailed-management-portal-permissions.md @@ -197,0 +198,5 @@ Allows access to view the details of assessments pending seller action. +**`s3:PutObject`** + + +Allows access to upload files in AWS Partner Central. For example, you can upload custom legal terms and other offer documents when you create a private offer or amend an agreement. Use this permission with the following ARN: `arn:aws:s3:::aws-partner-central-marketplace-ephemeral-writeonly-files/`account-id`/*`. AWS Marketplace owns this bucket, and you can only upload files to it. The `AWSMarketplaceSellerFullAccess` and `AWSMarketplaceSellerProductsFullAccess` managed policies include this permission. +