AWS Marketplace Setup

Connect your AWS Marketplace seller account to Automatum for seamless integration.

Prerequisites

Before connecting your AWS account, ensure you have:

• An active AWS Marketplace seller account
• IAM permissions to create roles and policies
• Your AWS Account ID
• Automatum organization created

Integration Overview

Automatum uses AWS IAM role assumption to securely access your AWS Marketplace data. This approach:

• ✅ Follows AWS security best practices
• ✅ Grants only necessary permissions
• ✅ Can be revoked at any time
• ✅ Provides audit trails

Step 1: Create IAM Role

The easiest way to set up the IAM role is using our CloudFormation template:

Option A: CloudFormation Template (Recommended)

1. Download the CloudFormation template from your Automatum dashboard
2. Navigate to AWS Console > CloudFormation > Create Stack
3. Upload the template
4. Enter the required parameters:
   • ExternalId: Copy from Automatum dashboard (Settings > Integrations > AWS Marketplace)
   • S3BucketName: Name for analytics data (e.g., your-company-aws-marketplace-analytics)
   • SetupAnalytics: Choose true to enable analytics
   • CreateResaleAuthorizationServiceRole: Keep true unless the AWSServiceRoleForMarketplaceResaleAuthorization role already exists in your account (see Service-Linked Roles)
5. Click Create Stack

Option B: Manual Setup

Create an IAM role named AutomatumCrossAccount with this trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::909302513239:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

External ID

The External ID is auto-generated and provided in the Automatum platform under Settings > Integrations > AWS Marketplace. Copy it exactly as shown.

Step 2: Attach Required Policies

CloudFormation Template

If you used the CloudFormation template, these policies are automatically attached. Skip to Step 3.

Managed Policy (Required)

Attach this AWS managed policy to the role:

• AWSMarketplaceFullAccess - Required for syncing listings, creating private offers, and managing marketplace entities

Required for Core Features

This managed policy provides access to the AWS Marketplace Catalog API, which is essential for:

• Syncing products from AWS Marketplace
• Creating and managing private offers
• Updating product information
• Managing changesets

Custom Policies (Required)

Add these two inline policies to the role:

Policy 1: AWSMarketplaceActions

Enables customer entitlement synchronization and usage metering:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-marketplace:GetEntitlements",
        "aws-marketplace:BatchMeterUsage",
        "aws-marketplace:ResolveCustomer"
      ],
      "Resource": "*"
    }
  ]
}

Policy 2: AWSMarketplaceAutomatumIntegration

Enables real-time event notifications from AWS Marketplace:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeChangeSet",
        "cloudformation:DescribeStacks",
        "cloudformation:GetTemplate",
        "cloudformation:ListStackResources",
        "cloudformation:CreateChangeSet",
        "cloudformation:ExecuteChangeSet",
        "cloudformation:DeleteChangeSet",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResource",
        "cloudformation:DescribeStackResources",
        "sns:Subscribe",
        "sns:Unsubscribe",
        "sqs:CreateQueue",
        "sqs:SetQueueAttributes",
        "sqs:GetQueueAttributes",
        "sqs:DeleteMessage",
        "sqs:ReceiveMessage",
        "sqs:SendMessage",
        "iam:CreatePolicy",
        "iam:AttachRolePolicy",
        "iam:DetachRolePolicy"
      ],
      "Resource": "*"
    }
  ]
}

What Each Policy Does

Policy	Purpose	Used For
AWSMarketplaceFullAccess	Marketplace Catalog API access	Syncing listings, creating private offers, updating products
AWSMarketplaceActions	Customer & metering operations	Fetching customer entitlements, submitting usage data
AWSMarketplaceAutomatumIntegration	Event notification infrastructure	Setting up SNS/SQS for real-time marketplace events

Service-Linked Roles

AWS Marketplace uses service-linked roles for some features. AWS creates and manages the permissions of these roles. You only activate them once per account.

AWSServiceRoleForMarketplaceResaleAuthorization

This role is required for resale authorizations (CPPO). AWS Marketplace uses it to share resale authorizations between ISVs and channel partners through AWS Resource Access Manager.

• ISVs need the role to share new resale authorizations with channel partners.
• Channel partners need the role to accept resale authorizations.

Without this role, resale authorization requests fail with an error that names AWSServiceRoleForMarketplaceResaleAuthorization.

How to activate the role

Use one of these three options:

Option 1: CloudFormation template (default)

The Automatum CloudFormation template creates the role for you. The CreateResaleAuthorizationServiceRole parameter controls this and defaults to true.

Role already exists?

CloudFormation cannot create a service-linked role that already exists. If your account already has the role, set CreateResaleAuthorizationServiceRole to false. Otherwise, the stack create or update fails and rolls back.

Option 2: AWS Marketplace Management Portal

1. Sign in to the AWS Marketplace Management Portal with the management account
2. Choose Settings > Service-linked roles
3. Select Service-linked role for Selling Authorizations
4. Choose Create service-linked role

Option 3: AWS CLI

aws iam create-service-linked-role \
  --aws-service-name resale-authorization.marketplace.amazonaws.com

If the role already exists, this command returns an InvalidInput error that says the role name "has been taken". That error is safe to ignore.

Verify the role

aws iam get-role --role-name AWSServiceRoleForMarketplaceResaleAuthorization

Only one seller-side role

AWS Marketplace defines other service-linked roles (license management, purchase orders, private marketplace), but those apply to buyer accounts. The resale authorization role is the only one your seller account needs for Automatum. There is no service-linked role for the generic aws-marketplace.amazonaws.com service name.

Step 3: Configure in Automatum

Connect Your AWS Account

1. Navigate to Settings > Integrations > AWS Marketplace
2. Note the External ID displayed (you used this in Step 1)
3. Enter your AWS Account ID
4. Click Test Connection
5. If successful, click Save

The connection test verifies:

• IAM role exists with name AutomatumCrossAccount
• Trust policy is configured correctly
• External ID matches
• Required permissions are attached

Step 4: Sync Products

After connecting your account:

1. Go to Listings
2. Click Sync from AWS
3. Select the products you want to manage in Automatum
4. Click Import Selected

Initial Sync

The first sync may take several minutes depending on the number of products and offers in your AWS Marketplace account.

Verification

Verify your integration is working:

1. Check that your products appear in the Listings page
2. Verify that existing private offers are visible
3. Try creating a test private offer
4. Check that metrics are updating

Troubleshooting

Connection Failed

Error: Access Denied

• Verify the IAM role trust relationship includes Automatum's account
• Check that the External ID matches exactly
• Ensure the role has the required policies attached

Error: Invalid Role Name

• Ensure the role is named exactly AutomatumCrossAccount
• Verify the role exists in your AWS account
• Check the ARN format: arn:aws:iam::ACCOUNT_ID:role/AutomatumCrossAccount

Products Not Syncing

• Ensure your AWS Marketplace seller account has published products
• Check that the IAM role has aws-marketplace:DescribeEntity permission
• Try manually triggering a sync from Listings > Sync from AWS

Offers Not Creating

• Verify the IAM role has aws-marketplace:StartChangeSet permission
• Check that the product is published and active
• Ensure pricing information is complete

Resale Authorization Fails

Error mentions AWSServiceRoleForMarketplaceResaleAuthorization

• The service-linked role is missing in your seller account
• Activate it with one of the options in Service-Linked Roles
• Both the ISV account and the channel partner account need the role

Security Best Practices

1. Enable CloudTrail to audit all API calls made by Automatum
2. Use Service Control Policies to restrict role usage if needed
3. Review IAM policies regularly to ensure least privilege
4. Rotate External IDs periodically (regenerate in Automatum dashboard)
5. Monitor Role Usage through CloudWatch and IAM Access Analyzer

Next Steps

• Create your first private offer
• Set up usage metering
• Configure notifications
• Explore analytics

Need Help?

Contact support@automatum.io or use the in-app chat for assistance with AWS integration.