AWS marketplace: Add selling authorization EventBridge events to seller notifications
Summary
Renames the "Events for new offers" section/table entries to "Events for offers" and adds a new "Events for selling authorizations" section documenting the `Resale Authorization Released` and `Resale Authorization Restricted` detail types (source `aws.marketplacecatalog`). Adds `issuedAuthorization` and `receivedAuthorization` detail objects (id, ARN, name, issuer/recipient account IDs and names) to offer-created event examples, and states that a restricted selling authorization can no longer be used to create selling authorizations or offers.
Security assessment
The diff documents EventBridge notifications for the selling-authorization (resale delegation) lifecycle, including `Resale Authorization Released` and `Resale Authorization Restricted` events delivered to both issuer and recipient, plus `issuedAuthorization`/`receivedAuthorization` payloads exposing issuer/recipient account IDs and ARNs. This is authorization-delegation and audit/monitoring documentation rather than a fix for a specific vulnerability, so it is authorization-adjacent hardening/observability guidance (medium), not a remediation of a known flaw.
Evidence
+When a selling authorization is restricted, the issuer and the recipient of the selling authorization receive an event with the following detail type: `Resale Authorization Restricted`. A restricted selling authorization can no longer be used to create selling authorizations or offers.
Diff
diff --git a/marketplace/latest/userguide/notifications-eventbridge.md b/marketplace/latest/userguide/notifications-eventbridge.md index 28723f6..878beca 100644 --- a//marketplace/latest/userguide/notifications-eventbridge.md +++ b//marketplace/latest/userguide/notifications-eventbridge.md @@ -7 +7 @@ -Events for new offersEvents for change setsEvents for security summary reportEvents for disbursementsEvents for agreementsEvents for licensesEvents for cancellationsEvents for billing adjustments +Events for offersEvents for selling authorizationsEvents for change setsEvents for security summary reportEvents for disbursementsEvents for agreementsEvents for licensesEvents for cancellationsEvents for billing adjustments @@ -15 +15,3 @@ As a seller, you can use Amazon EventBridge to receive notifications for events - * Events for new offers + * Events for offers + + * Events for selling authorizations @@ -38,5 +40,8 @@ Action by seller | Event received | Related topic -Independent software vendor (ISV) creates an offer and makes it available for purchase | `Offer Released` | Events for new offers -ISV's product is used by a channel partner to create an offer | `Offer Released` | Events for new offers -Channel partner creates an offer | `Offer Released` | Events for new offers -ISV creates a new offer set | `OfferSet Released` | Events for new offers -Channel partner creates a new offer set | `OfferSet Released` | Events for new offers +Independent software vendor (ISV) creates an offer and makes it available for purchase | `Offer Released` | Events for offers +Another seller creates an offer from a selling authorization that the ISV issued | `Offer Released` | Events for offers +A seller creates an offer from a selling authorization that it received | `Offer Released` | Events for offers +ISV creates a new offer set | `OfferSet Released` | Events for offers +Channel partner creates a new offer set | `OfferSet Released` | Events for offers +A seller publishes a selling authorization | `Resale Authorization Released` | Events for selling authorizations +The recipient of an ISV's selling authorization uses it to publish a selling authorization to another partner | `Resale Authorization Released` | Events for selling authorizations +A selling authorization is restricted and can no longer be used to create selling authorizations or offers | `Resale Authorization Restricted` | Events for selling authorizations @@ -68 +73 @@ Billing adjustment fails validation | `Purchase Agreement Billing Adjustment Fai -## Events for new offers +## Events for offers @@ -70 +75 @@ Billing adjustment fails validation | `Purchase Agreement Billing Adjustment Fai -When sellers create an offer and make it available for purchase, they can receive an event with the following detail type: `Offer Released`. +When an offer is published, the proposer receives an event with the following detail type: `Offer Released`. If the manufacturer isn't the proposer, the manufacturer also receives the event. @@ -120 +125 @@ The following is an example event body for a new offer created by an ISV. -The following is an example event body for when an ISV's product is used by a channel partner to create an offer. +When another seller creates an offer from a selling authorization that the manufacturer issued, the manufacturer's event includes an `issuedAuthorization` object that describes that selling authorization. The following JSON example shows the event body that the manufacturer receives: @@ -156,0 +162,14 @@ The following is an example event body for when an ISV's product is used by a ch + "issuedAuthorization": { + "resaleAuthorization": { + "id": "resaleauthz-1a2b3c4d5e6f7", + "arn": "arn:aws:aws-marketplace:us-east-1:123456789012:AWSMarketplace/ResaleAuthorization/resaleauthz-1a2b3c4d5e6f7", + "name": "Example selling authorization", + "issuer": { + "accountId": "123456789012", + "name": "Manufacturer Account Name" + }, + "recipient": { + "accountId": "987654321098", + "name": "Seller Account Name" + } + } @@ -162 +181 @@ The following is an example event body for when an ISV's product is used by a ch -The following is an example event body for when a channel partner creates an offer. +When the proposer creates an offer from a selling authorization that it received, the proposer's event includes a `receivedAuthorization` object that describes that selling authorization. The following JSON example shows the event body that the proposer receives: @@ -198,0 +218,13 @@ The following is an example event body for when a channel partner creates an off + "receivedAuthorization": { + "resaleAuthorization": { + "id": "resaleauthz-1a2b3c4d5e6f7", + "arn": "arn:aws:aws-marketplace:us-east-1:123456789012:AWSMarketplace/ResaleAuthorization/resaleauthz-1a2b3c4d5e6f7", + "name": "Example selling authorization", + "issuer": { + "accountId": "123456789012", + "name": "Manufacturer Account Name" + }, + "recipient": { + "accountId": "987654321098", + "name": "Seller Account Name" + } @@ -201,0 +234,2 @@ The following is an example event body for when a channel partner creates an off + } + @@ -202,0 +237 @@ The following is an example event body for when a channel partner creates an off +The `issuedAuthorization` and `receivedAuthorization` objects each contain a `resaleAuthorization` object with the selling authorization's `id`, `arn`, and `name`, and the AWS account ID and name of its `issuer` and `recipient`. If the selling authorization reached the proposer through another partner, the manufacturer's `issuedAuthorization` describes the selling authorization that the manufacturer issued to that partner, and the proposer's `receivedAuthorization` describes the selling authorization that the proposer received from that partner. @@ -204 +239 @@ The following is an example event body for when a channel partner creates an off -The following is an example event body for a new offer set published by a partners (ISV or Channel partner). +The following is an example event body for a new offer set published by a seller. @@ -239,0 +275,147 @@ The following is an example event body for a new offer set published by a partne +## Events for selling authorizations + +When a selling authorization is published, the issuer and the recipient of the selling authorization receive an event with the following detail type: `Resale Authorization Released`. When a selling authorization is restricted, they receive an event with the detail type `Resale Authorization Restricted`. The source for these events is `aws.marketplacecatalog`. + +The `resaleAuthorization` object describes the published selling authorization: its `id`, `arn`, and `name`, and the AWS account ID and name of its `issuer` and `recipient`. + +The following JSON example shows the event body that the issuer and the recipient receive when a manufacturer publishes a selling authorization: + + + { + "version": "0", + "id": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", + "detail-type": "Resale Authorization Released", + "source": "aws.marketplacecatalog", + "account": "<issuer's or recipient's account id>", + "time": "2023-08-26T00:00:00Z", + "region": "us-east-1", + "resources": [ + "arn:aws:aws-marketplace:us-east-1:123456789012:AWSMarketplace/ResaleAuthorization/resaleauthz-1a2b3c4d5e6f7" + ], + "detail": { + "requestId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333", + "catalog": "AWSMarketplace", + "resaleAuthorization": { + "id": "resaleauthz-1a2b3c4d5e6f7", + "arn": "arn:aws:aws-marketplace:us-east-1:123456789012:AWSMarketplace/ResaleAuthorization/resaleauthz-1a2b3c4d5e6f7", + "name": "Example selling authorization", + "issuer": { + "accountId": "123456789012", + "name": "Manufacturer Account Name" + }, + "recipient": { + "accountId": "987654321098", + "name": "Partner Account Name" + } + }, + "product": { + "id": "bbbbaaaa-abcd-1111-abcd-666666666666", + "arn": "arn:aws:aws-marketplace:us-east-1:123456789012:AWSMarketplace/SaaSProduct/bbbbaaaa-abcd-1111-abcd-666666666666", + "title": "Product-1" + }, + "manufacturer": { + "accountId": "123456789012", + "name": "Manufacturer Account Name" + } + } + } + +When the recipient of a manufacturer's selling authorization uses it to publish a selling authorization to another partner, the manufacturer also receives a `Resale Authorization Released` event. In that event, `resaleAuthorization` describes the new selling authorization, and `issuedAuthorization` describes the selling authorization that the manufacturer issued. The following JSON example shows the event body that the manufacturer receives: + + + { + "version": "0", + "id": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222", + "detail-type": "Resale Authorization Released", + "source": "aws.marketplacecatalog", + "account": "<manufacturer's account id>", + "time": "2023-08-26T00:00:00Z", + "region": "us-east-1", + "resources": [ + "arn:aws:aws-marketplace:us-east-1:987654321098:AWSMarketplace/ResaleAuthorization/resaleauthz-yaxjqxiskysxa" + ], + "detail": { + "requestId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333", + "catalog": "AWSMarketplace", + "resaleAuthorization": { + "id": "resaleauthz-yaxjqxiskysxa", + "arn": "arn:aws:aws-marketplace:us-east-1:987654321098:AWSMarketplace/ResaleAuthorization/resaleauthz-yaxjqxiskysxa", + "name": "Example partner selling authorization", + "issuer": { + "accountId": "987654321098", + "name": "Partner Account Name" + }, + "recipient": { + "accountId": "444455556666", + "name": "Seller Account Name" + } + }, + "issuedAuthorization": { + "resaleAuthorization": { + "id": "resaleauthz-1a2b3c4d5e6f7", + "arn": "arn:aws:aws-marketplace:us-east-1:123456789012:AWSMarketplace/ResaleAuthorization/resaleauthz-1a2b3c4d5e6f7", + "name": "Example selling authorization", + "issuer": { + "accountId": "123456789012", + "name": "Manufacturer Account Name" + }, + "recipient": { + "accountId": "987654321098", + "name": "Partner Account Name" + } + } + }, + "product": { + "id": "bbbbaaaa-abcd-1111-abcd-666666666666", + "arn": "arn:aws:aws-marketplace:us-east-1:123456789012:AWSMarketplace/SaaSProduct/bbbbaaaa-abcd-1111-abcd-666666666666", + "title": "Product-1" + }, + "manufacturer": { + "accountId": "123456789012", + "name": "Manufacturer Account Name" + } + } + } + +When a selling authorization is restricted, the issuer and the recipient of the selling authorization receive an event with the following detail type: `Resale Authorization Restricted`. A restricted selling authorization can no longer be used to create selling authorizations or offers. The `resaleAuthorization` object describes the restricted selling authorization, with the same fields as in the `Resale Authorization Released` event. The following JSON example shows the event body that the issuer and the recipient receive: + + + { + "version": "0", + "id": "a1b2c3d4-5678-90ab-cdef-EXAMPLE66666", + "detail-type": "Resale Authorization Restricted", + "source": "aws.marketplacecatalog", + "account": "<issuer's or recipient's account id>", + "time": "2023-08-26T00:00:00Z", + "region": "us-east-1", + "resources": [ + "arn:aws:aws-marketplace:us-east-1:123456789012:AWSMarketplace/ResaleAuthorization/resaleauthz-1a2b3c4d5e6f7" + ], + "detail": { + "requestId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE77777", + "catalog": "AWSMarketplace", + "resaleAuthorization": { + "id": "resaleauthz-1a2b3c4d5e6f7",