Controlling access in AWS Marketplace Vendor Insights

AWS Identity and Access Management (IAM) is an AWS service that helps you control access to AWS resources. IAM is an AWS service that you can use with no additional charge. If you're an administrator, you control who can be authenticated (signed in) and authorized (have permissions) to use AWS Marketplace resources. AWS Marketplace Vendor Insights uses IAM to control access to seller data, assessments, seller self-attestation, and industry standard audit reports.

The recommended way to control who can do what in AWS Marketplace Management Portal is to use IAM to create users and groups. Then you add the users to the groups, and manage the groups. You can assign a policy or permissions to the group that provide read-only permissions. If you have other users that need read-only access, you can add them to the group you created rather than adding permissions for the user.

A policy is a document that defines the permissions that apply to a user, group, or role. The permissions determine what users can do in AWS. A policy typically allows access to specific actions, and can optionally grant that the actions are allowed for specific resources, like Amazon EC2 instances, Amazon S3 buckets, and so on. Policies can also explicitly deny access. A permission is a statement within a policy that allows or denies access to a particular resource.

AWS Marketplace has permissions defined to control the actions that someone with those permissions can take in the AWS Marketplace Management Portal. There are also policies that AWS Marketplace created and manages that combine several permissions. The AWSMarketplaceSellerProductsFullAccess policy gives the user full access to products in the AWS Marketplace Management Portal.

For more information about the actions, resources, and condition keys that are available, see Actions, resources, and condition keys for AWS Marketplace Vendor Insights in the Service Authorization Reference.

Permissions for AWS Marketplace Vendor Insights sellers

You can use the following permissions in IAM policies for AWS Marketplace Vendor Insights. You can combine permissions into a single IAM policy to grant the permissions you want.

CreateDataSource

CreateDataSource allows the user to create a new data source resource. Supported data sources are:

Action groups: Read-write

Required resources: None

Creates resources: DataSource

DeleteDataSource

DeleteDataSource allows the user to delete a data source that they own. A data source must be disassociated from any profile to be deleted. For more information, see AssociateDataSource.

Action groups: Read-write

Required resources: DataSource

GetDataSource

GetDataSource allows the user to retrieve the details of a data source. Details of a data source include metadata information such as associated timestamps, original creation parameters, and processing information, if any.

Action groups: Read-only, read-write

Required resources: DataSource

UpdateDataSource

UpdateDataSource allows the user to update the details of a data source. Details include metadata information, such as the name and source information (for example, roles, source Amazon Resource Name (ARN), and source content).

Action groups: Read-only, read-write

Required resources: DataSource

ListDataSources

ListDataSources allows the user to list the data sources that they own.

Action groups: Read-only, read-write, list-only

Required resources: None

CreateSecurityProfile

CreateSecurityProfile allows the user to create a new security profile. A security profile is a resource to manage how and when a snapshot is generated. Users can also control how buyers can access snapshots by controlling the status and applicable terms of the profile.

Action groups: Read-only, read-write, list-only

Required resources: None

Creates resources: SecurityProfile

ListSecurityProfiles

ListSecurityProfiles allows the user to list the security profiles that they own.

Action groups: Read-only, read-write, list-only

Required resources: None

GetSecurityProfile

CreateSecurityProfile allows users to get the details of a security profile.

Action groups: Read-only and read-write

Required resources: SecurityProfile

AssociateDataSource

AssociateDataSource allows users to associate an existing DataSource with an AWS Marketplace Vendor Insights profile. Users can control the content of the snapshot by associating or disassociating a data source to a profile.

Action groups: Read-write

Required resources: SecurityProfile and DataSource

DisassociateDataSource

DisassociateDataSource allows users to disassociate an existing DataSource with an AWS Marketplace Vendor Insights profile. Users can control the content of the snapshot by associating or disassociating a data source to a profile.

Action groups: Read-write

Required resources: SecurityProfile and DataSource

UpdateSecurityProfile

UpdateSecurityProfile allows users to modify security profile attributes such as name and description.

Action groups: Read-write

Required resources: SecurityProfile

ActivateSecurityProfile

ActivateSecurityProfile allows users to set an Active status for a security profile. After a security profile is activated, new snapshots can be created in a Staged state which makes it possible to release them if other conditions are met. For more information, see UpdateSecurityProfileSnapshotReleaseConfiguration.

An Active security profile with at least one Released snapshot is eligible for AWS Marketplace Vendor Insights discovery for end users.

Action groups: Read-write

Required resources: SecurityProfile

DeactivateSecurityProfile

DeactivateSecurityProfile allows users to set an Inactive status for a security profile. This terminal state for a security profile is equivalent to taking down the profile from shared state. Users can only deactivate a security profile if there are no active subscribers to the profile.

Action groups: Read-write

Required resources: SecurityProfile

UpdateSecurityProfileSnapshotCreationConfiguration

UpdateSecurityProfileSnapshotCreationConfiguration allows users to define custom schedules for the snapshot creation configuration. The default creation configuration of weekly creation can be overridden with this action.

Users can use this action to change the schedule including to cancel a schedule, postpone the schedule to a future date, or initiate a new snapshot creation for an earlier time.

Action groups: Read-write

Required resources: SecurityProfile

UpdateSecurityProfileSnapshotReleaseConfiguration

UpdateSecurityProfileSnapshotReleaseConfiguration allows users to define custom schedules for the snapshot release configuration. The default creation configuration of weekly releases with a two-day staging period to review can be overridden with this action.

Users can use this action to change the schedule including to cancel a schedule or postpone the schedule to a future date.

Action groups: Read-write

Required resources: SecurityProfile

ListSecurityProfileSnapshots

ListSecurityProfileSnapshots allows users to list the snapshots for a security profile that they own.

Action groups: Read-only, list-only, and read-write

Required resources: SecurityProfile

GetSecurityProfileSnapshot

GetSecurityProfileSnapshot allows users to get the snapshots for a security profile that they own.

Action groups: Read-only and read-write

Required resources: SecurityProfile

TagResource

TagResource allows users to add new tags to a resource. Supported resources are SecurityProfile and DataSource.

Action groups: Tagging

Optional resources: SecurityProfile and DataSource

UntagResource

UntagResource allows users to remove tags from a resource. Supported resources are SecurityProfile and DataSource.

Action groups: Tagging

Optional resources: SecurityProfile and DataSource

ListTagsForResource

ListTagsForResource allows users to list resource tags for a resource. Supported resources are SecurityProfile and DataSource.

Action groups: Read-only

Optional resources: SecurityProfile and DataSource

Additional resources

The following resources in the IAM User Guide provide more information about getting started and using IAM: