AWS marketplace: Update Resale Authorization service-linked role creation steps and IAM permissions
Summary
Rewrites the procedure for creating the AWSServiceRoleForMarketplaceResaleAuthorization service-linked role, moving it from the AWS Marketplace Management Portal to AWS Partner Central, and adds the required IAM permissions (iam:GetRole, iam:CreateServiceLinkedRole) plus a CLI example.
Security assessment
The change documents the IAM permissions needed to view and create a service-linked role and how to create it via CLI/API. This is IAM permission guidance rather than a fix for a specific vulnerability, so it is security-adjacent documentation.
Evidence
+To view the role status, you need the `iam:GetRole` permission. To create the role, you also need the `iam:CreateServiceLinkedRole` permission.
Diff
diff --git a/marketplace/latest/userguide/using-roles-for-resale-authorization.md b/marketplace/latest/userguide/using-roles-for-resale-authorization.md index b41ef60..1e577bf 100644 --- a//marketplace/latest/userguide/using-roles-for-resale-authorization.md +++ b//marketplace/latest/userguide/using-roles-for-resale-authorization.md @@ -55 +55,3 @@ You must configure permissions to allow your users, groups, or roles to create, -You don't need to manually create a service-linked role. When you choose a service-linked role in the AWS Marketplace Management Portal, AWS Marketplace creates the service-linked role for you. +You create the AWSServiceRoleForMarketplaceResaleAuthorization service-linked role in AWS Partner Central. You don't need to create it manually in IAM. Both manufacturers (ISVs) and channel partners need this role in the AWS account that they use for Selling Authorizations and channel partner private offers. + +To view the role status, you need the `iam:GetRole` permission. To create the role, you also need the `iam:CreateServiceLinkedRole` permission. @@ -59 +61,17 @@ You don't need to manually create a service-linked role. When you choose a servi - 1. In the [AWS Marketplace Management Portal](http://aws.amazon.com/marketplace/management/), sign in to the management account and choose **Settings**. + 1. Sign in to [AWS Partner Central](https://us-east-1.console.aws.amazon.com/partnercentral/home) with the AWS account that you sell from. + + 2. In the navigation pane, under **Settings** , choose **Account**. + + 3. Choose the **Service roles** tab. + + 4. In the **Seller service-linked roles** section, check the status of the Resale Authorizations service-linked role. + +If the status is **AWS Marketplace Resale Authorization service-linked role created** , the role already exists in your account and you don't need to create it. + + 5. Choose **Create service-linked role**. + + 6. On the **Service-linked role for Resale Authorizations** page, under **Review service-linked role** , review the information about the role. + + 7. Select **AWS Marketplace Resale Authorization service-linked role for this account** , and then choose **Create service-linked role**. + +The **Service roles** tab opens and shows the message **Service-linked role was successfully created**. The status might take a few minutes to update. @@ -61 +78,0 @@ You don't need to manually create a service-linked role. When you choose a servi - 2. In the **Settings** section, select the **Service-linked roles** tab. @@ -63 +79,0 @@ You don't need to manually create a service-linked role. When you choose a servi - 3. On the **Service-linked roles** page, select **Service-linked role for Selling Authorizations** or **Selling Authorizations integration** , and then choose **Create service-linked role** or **Configure integration**. @@ -65 +80,0 @@ You don't need to manually create a service-linked role. When you choose a servi - 4. On the **Service-linked role for Selling Authorizations** or **Create Selling Authorizations integrations** page, review the information and confirm by choosing **Create service-linked role** or **Create integration**. @@ -67 +82 @@ You don't need to manually create a service-linked role. When you choose a servi -A message appears on the **Service-linked roles** page, indicating that the Selling Authorization service-linked role was successfully created. +If you delete the service-linked role, you can follow these steps to recreate it. @@ -68,0 +84 @@ A message appears on the **Service-linked roles** page, indicating that the Sell +You can also create the role by using the AWS CLI or the IAM API. For example, run the following command in the account that needs the role. @@ -70,0 +87 @@ A message appears on the **Service-linked roles** page, indicating that the Sell + aws iam create-service-linked-role --aws-service-name resale-authorization.marketplace.amazonaws.com @@ -72 +89 @@ A message appears on the **Service-linked roles** page, indicating that the Sell -If you delete a service-linked role, you can follow these steps to recreate it. +For more information, see [Creating a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role) in the _IAM User Guide_.