AWS marketplace: Document new AWSMarketplaceSubsidiaryAuthorizationServiceRolePolicy and partnercentral perms
Summary
Adds a new section for the AWSMarketplaceSubsidiaryAuthorizationServiceRolePolicy service role policy (used by AWS Marketplace to share SubsidiaryAuthorization entities between parent/subsidiary seller accounts via AWS RAM), documents newly added read-only `partnercentral` connection-viewing permissions in AWSMarketplaceSellerFullAccess and AWSMarketplaceSellerProductsFullAccess, notes the SubsidiaryAuthorization resource type added to AWSMarketplaceSellerOfferManagement, and updates the policy-name list and change log.
Security assessment
The diff is documentation of AWS managed IAM policies and their permission scopes, including an explicit note that the new `partnercentral` grants are read-only and limited to the calling account's own connections, and that the new service role policy scopes AWS RAM resource shares to SubsidiaryAuthorization entities. This is IAM/permission-boundary guidance with security relevance (least privilege, scoped cross-account sharing), but it does not reference or remediate any specific vulnerability, CVE, or incident.
Evidence
* `partnercentral` – Grants permission to view the partner account connections for the principal's account, including subsidiary connections, so that a principal can select a subsidiary account when creating a subsidiary authorization. This permission is read-only: it doesn't grant permission to create, accept, reject, or cancel a connection or a connection invitation.
Diff
diff --git a/marketplace/latest/userguide/security-iam-awsmanpol.md b/marketplace/latest/userguide/security-iam-awsmanpol.md index f150cc1..8a9bdd9 100644 --- a//marketplace/latest/userguide/security-iam-awsmanpol.md +++ b//marketplace/latest/userguide/security-iam-awsmanpol.md @@ -7 +7 @@ -AWSMarketplaceAmiIngestionAWSMarketplaceFullAccessAWSMarketplaceGetEntitlementsAWSMarketplaceMeteringFullAccessAWSMarketplaceMeteringRegisterUsageAWSMarketplaceSellerFullAccessAWSMarketplaceSellerProductsFullAccessAWSMarketplaceSellerProductsReadOnlyAWSMarketplaceSellerOfferManagementAWSMarketplaceResaleAuthorizationServiceRolePolicyAWSVendorInsightsVendorFullAccessAWSVendorInsightsVendorReadOnlyPolicy updates +AWSMarketplaceAmiIngestionAWSMarketplaceFullAccessAWSMarketplaceGetEntitlementsAWSMarketplaceMeteringFullAccessAWSMarketplaceMeteringRegisterUsageAWSMarketplaceSellerFullAccessAWSMarketplaceSellerProductsFullAccessAWSMarketplaceSellerProductsReadOnlyAWSMarketplaceSellerOfferManagementAWSMarketplaceResaleAuthorizationServiceRolePolicyAWSMarketplaceSubsidiaryAuthorizationServiceRolePolicyAWSVendorInsightsVendorFullAccessAWSVendorInsightsVendorReadOnlyPolicy updates @@ -42,0 +43,2 @@ This section lists each of the policies used to manage seller access to AWS Mark + * AWS managed policy: AWSMarketplaceSubsidiaryAuthorizationServiceRolePolicy + @@ -156,0 +159,2 @@ This policy includes the following permissions: + * `partnercentral` – Grants permission to view the partner account connections for the principal's account, including subsidiary connections, so that a principal can select a subsidiary account when creating a subsidiary authorization. This permission is read-only: it doesn't grant permission to create, accept, reject, or cancel a connection or a connection invitation. + @@ -171,0 +176,2 @@ This policy grants contributor permissions that allow full access to manage prod +This policy grants `partnercentral` permission to view the partner account connections for the principal's account, including subsidiary connections, so that a principal can select a subsidiary account when creating a subsidiary authorization. This permission is read-only: it doesn't grant permission to create, accept, reject, or cancel a connection or a connection invitation. + @@ -198 +204 @@ This policy includes the following permissions: - * `aws-marketplace` – Allows principals to list and retrieve details about marketplace entities including offers, products, and resale authorizations. + * `aws-marketplace` – Allows principals to list and retrieve details about marketplace entities including offers, products, resale authorizations, and subsidiary authorizations. @@ -218,0 +225,8 @@ To view the permissions for this policy, see [AWSMarketplaceResaleAuthorizationS +## AWS managed policy: AWSMarketplaceSubsidiaryAuthorizationServiceRolePolicy + +This policy is attached to a service role that allows AWS Marketplace to perform actions on your behalf for Subsidiary Authorization. When you enable Subsidiary Authorization for your account, AWS Marketplace uses this policy to share SubsidiaryAuthorization entities between Parent and Subsidiary seller accounts using AWS Resource Access Manager (AWS RAM). + +This policy grants permissions for AWS RAM actions to create, associate, accept, and delete resource shares scoped to SubsidiaryAuthorization entities, and for AWS Marketplace operations to manage resource policies through AWS RAM and to describe SubsidiaryAuthorization entities. + +To view the permissions for this policy, see [AWSMarketplaceSubsidiaryAuthorizationServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceSubsidiaryAuthorizationServiceRolePolicy.html) in the _AWS Managed Policy Reference_. + @@ -240,0 +255,4 @@ Change | Description | Date +AWSMarketplaceSellerOfferManagement – Update to an existing policy | AWS Marketplace added the `SubsidiaryAuthorization` resource type to the `AWSMarketplaceEntitiesReadAccess` statement, which allows principals to retrieve details about subsidiary authorization entities using `aws-marketplace:DescribeEntity`. | October 26, 2026 +AWSMarketplaceSubsidiaryAuthorizationServiceRolePolicy – New policy | AWS Marketplace added a new service role policy that allows AWS Marketplace to share SubsidiaryAuthorization entities between Parent and Subsidiary seller accounts using AWS Resource Access Manager. The policy grants permissions to create and manage AWS RAM resource shares scoped to SubsidiaryAuthorization entities and to manage resource policies through AWS RAM. | October 26, 2026 +AWSMarketplaceSellerFullAccess – Update to an existing policy | AWS Marketplace added `partnercentral:ListConnections` and `partnercentral:GetConnection` so that sellers can view their account's partner account connections and select a subsidiary when creating a Subsidiary Authorization. The access is read-only and is limited to the calling account's own connections. | October 22, 2026 +AWSMarketplaceSellerProductsFullAccess – Update to an existing policy | AWS Marketplace added `partnercentral:ListConnections` and `partnercentral:GetConnection` so that sellers can view their account's partner account connections and select a subsidiary when creating a Subsidiary Authorization from the product management page. The access is read-only and is limited to the calling account's own connections. | October 22, 2026