# Linking AWS Partner Central and AWS accounts AWS recently updated the [AWS Partner Central Network (APN) fee policy](https://partnercentral.awspartner.com/partnercentral2/s/newsletter?url=APN-Fee-Requirement-Changes-for-2025). The change requires partners to link an AWS account to their AWS Partner Central account in order to confirm their AWS Partner Network (APN) membership. The linked AWS account becomes the primary account for managing Partner Central engagements and activities, including APN fee billing, solutions management, and APN Customer Engagement (ACE) opportunity tracking using the Partner Central APIs. **Important** This change is part of a larger migration to using AWS Identity and Access Management (IAM) to control user access to Partner Central. You must link to an AWS account that has the IAM roles and permissions needed to access Partner Central. Account linking has other benefits: + You can use **Partner Connections** to work on coselling deals with other partners. This can progress deals faster and expand your reach. For more information, see [Partner connections](https://docs.aws.amazon.com/partner-central/latest/sales-guide/partner-connections.html) in the *AWS Partner Central Sales Guide*. + You can use the [AWS Partner Central API](https://docs.aws.amazon.com/partner-central/latest/APIReference/aws-partner-central-api-reference-guide.html) to integrate Partner Central with your CRM system. Integration synchronizes engagements, opportunities, solutions, and real-time event notifications. For more information, refer to [AWS Partner CRM integration](https://docs.aws.amazon.com/partner-central/latest/crm/aws-partner-crm-integration.html) in the *AWS Partner CRM Integration Guide*. + If you're an ACE eligible partner who links to an AWS Marketplace seller account, AWS Demand Generation Representatives pre-qualify leads from AWS Marketplace and transfer validated AWS originated opportunities to you. The following topics explain how to link accounts. **Topics** + [Prerequisites](linking-prerequisites.md) + [Linking AWS Partner Central and AWS accounts](linking-apc-aws-marketplace.md) + [Unlinking AWS Partner Central and AWS accounts](unlinking-apc-aws-marketplace.md) + [Account linking FAQ](account-linking-faq.md) # Prerequisites The following topics list the prerequisites needed to link AWS Partner Central and AWS accounts. We recommend following the topics in the order listed. **Note** Due to user interface, feature, and performance issues, account linking does not support Firefox Extended Support Release (Firefox ESR). We recommend using the regular version of Firefox or one of the chrome browsers. **Topics** + [User roles and permissions](#people-roles) + [Selecting the right AWS account](#which-accounts-to-link) + [Granting IAM permissions](#grant-iam-permissions) + [Understanding the role permissions](#standard-role-permissions) + [Creating a permission set for single sign-on](#create-permission-set) ## User roles and permissions To link your AWS account with an AWS Partner Central account, you need people in the following roles: **Identity and Access Management (IAM ) Administrator** Manages user permissions through IAM . Typically works in IT Security, Information Security, dedicated IAM teams, or Governance and Compliance organizations. Responsible for implementing IAM policies, configuring SSO solutions, handling compliance reviews, and maintaining role-based access control structures. **AWS Partner Central Alliance Lead or Cloud Administrator** Your company's primary account administrator. This person must have a business development or business leadership role and legal authority to accept AWS Partner Network terms and conditions. The Alliance Lead can delegate account linking to a Partner Central user with the Cloud Admin user role. ## Selecting the right AWS account Use the information in the following table to help decide which AWS account you should link with your Partner Central account. **Important** Consider the following when selecting an AWS account: AWS Partner Central requires an AWS account that uses IAM policies to control access. The linked AWS account manages APN fee payment, solutions, and APN Customer Engagement (ACE) opportunity tracking using the Partner Central APIs. AWS Partner Network features and APIs are available through the linked AWS account. AWS resources such as ACE opportunities, opportunity history, and multi-partner opportunity invitations are created in the linked AWS account and can't be transferred to other AWS accounts. The AWS account that you link to must be on a Paid AWS account plan. When you sign up for an AWS account, choose the Paid account plan. To upgrade an AWS account to the Paid AWS account plan, refer to [ Choosing an AWS Free Tier plan](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/free-tier-plans.html) in the *AWS Billing User Guide*. AWS recommends linking an AWS account that is *not* used for the following purposes. A management account, where you manage the account information and metadata for all of the AWS accounts in your organization. A production account, where users and data interact with applications and services. A developer or sandbox account, where developers write code. A personal account where individuals for learn, experiment, and work on personal projects. An AWS Marketplace buyer account, where you procure products from AWS Marketplace. Keeping the linked account separate from your AWS Partner Network engagements ensures flexibility for configurations specific to AWS Partner Central without affecting other environments. Doing so also simplifies financial tracking, tax reporting, and audits. | AWS Partner scenario | Example | AWS account options | Considerations | | --- | --- | --- | --- | | Scenario 1: You own AWS account(s) managed by a third-party and you are not registered as an AWS Marketplace seller | AWS Partners working with AWS Distributor partners | **Option 1:** Create an AWS account and link to it. **Option 2:** Link to an existing AWS account | **Option 1:** [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) **Option 2:** [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) | | Scenario 2: You own AWS account(s) and are not registered as an AWS Marketplace seller | AWS Partners who don't transact through AWS Marketplace or partners in countries where AWS Marketplace is not available | Same as Scenario 1 | Same as Scenario 1 | | Scenario 3: You own AWS account(s) and are registered as an AWS Marketplace seller with a single Marketplace seller account | AWS Partners who have a consolidated product listing in a single country or operate globally | **Option 1:** Create and link to a new AWS account **Option 2:** Link to an existing AWS account **Option 3:** Link to an AWS Marketplace seller account | **Option 1:** [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) **Option 2:** [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) **Option 3:** [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) | | Scenario 4: You own AWS account(s) and are registered as an AWS Marketplace seller with multiple seller accounts | AWS Partners who have multiple product listings under different lines of business or have to meet regulatory and compliance requirements | Same as Scenario 3 | Same as Scenario 3 | ## Granting IAM permissions The IAM policy listed in this section grants AWS Partner Central users limited access to a linked AWS account. The level of access depends on the IAM role assigned to the user. For more information about permission levels, refer to [Understanding the role permissions](#standard-role-permissions) later in this topic. To create the policy, you must be an IT administrator responsible for an AWS environment. When finished, you must assign the policy to an IAM user or role. The steps in this section explain how to use the IAM console to create the policy. **Note** If you're an alliance lead or cloud admin, and you already have an IAM user or role with AWS administrator permissions, skip to [Linking AWS Partner Central and AWS accounts](linking-apc-aws-marketplace.md). **To create the policy** 1. Sign in to the [IAM console](https://console.aws.amazon.com/iam/). 1. Under **Access management**, choose **Policies**. 1. Choose **Create policy**, choose **JSON**, and add the following policy: ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "CreatePartnerCentralRoles", "Effect": "Allow", "Action": [ "iam:CreateRole" ], "Resource": [ "arn:aws:iam::*:role/PartnerCentralRoleForCloudAdmin*", "arn:aws:iam::*:role/PartnerCentralRoleForAce*", "arn:aws:iam::*:role/PartnerCentralRoleForAlliance*" ] }, { "Sid": "AttachPolicyToPartnerCentralCloudAdminRole", "Effect": "Allow", "Action": "iam:AttachRolePolicy", "Resource": "arn:aws:iam::*:role/PartnerCentralRoleForCloudAdmin*", "Condition": { "ArnLike": { "iam:PolicyARN": [ "arn:aws:iam::*:policy/PartnerCentralAccountManagementUserRoleAssociation", "arn:aws:iam::*:policy/AWSPartnerCentralFullAccess", "arn:aws:iam::*:policy/AWSMarketplaceSellerFullAccess" ] } } }, { "Sid": "AttachPolicyToPartnerCentralAceRole", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/PartnerCentralRoleForAce*", "Condition": { "ArnLike": { "iam:PolicyARN": [ "arn:aws:iam::*:policy/AWSPartnerCentralOpportunityManagement", "arn:aws:iam::*:policy/AWSMarketplaceSellerOfferManagement" ] } } }, { "Sid": "AttachPolicyToPartnerCentralAllianceRole", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy" ], "Resource": "arn:aws:iam::*:role/PartnerCentralRoleForAlliance*", "Condition": { "ArnLike": { "iam:PolicyARN": [ "arn:aws:iam::*:policy/AWSPartnerCentralFullAccess", "arn:aws:iam::*:policy/AWSMarketplaceSellerFullAccess" ] } } }, { "Sid": "AssociatePartnerAccount", "Effect": "Allow", "Action": [ "partnercentral-account-management:AssociatePartnerAccount" ], "Resource": "*" }, { "Sid": "SellerRegistration", "Effect": "Allow", "Action": [ "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:StartChangeSet", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity" ], "Resource": "*" } ] } ``` ------ 1. Choose **Next**. 1. Under **Policy details**, in the **Policy name** box, enter a name for the policy and an optional description. 1. Review the policy permissions, add tags as needed, and then choose **Create policy**. 1. Attach your IAM user or role to the policy. For information on attaching, refer to [Adding IAM identity permissions (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#add-policies-console) in the *IAM User Guide*. ## Understanding the role permissions After the IT administrator completes the steps in the previous section, alliance leads and others in AWS Partner Central can assign security policies and map user roles. The following table lists and describes the standard roles created during account linking, and the tasks available to each role. | **Standard IAM role** | **AWS Partner Central managed policies used** | **Can do** | **Cannot do** | | --- | --- | --- | --- | | Cloud admin | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) | | | Alliance team | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) | Map or assign IAM roles to AWS Partner Central users. Only alliance leads and cloud admins map or assign roles. | | ACE team | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) | ## Creating a permission set for single sign-on The following steps explain how to use the IAM Identity Center to create a permission set that enables single sign-on for accessing AWS Partner Central. For more information about permission sets, refer to [Create a permission set](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) in the *AWS IAM Identity Center User Guide*. 1. Sign in to the [IAM Identity Center console](https://console.aws.amazon.com/singlesignon). 1. Under **Multi-account permissions**, choose **Permission sets**. 1. Choose **Create permission set**. 1. On the **Select permission set type** page, under **Permission set type**, choose **Custom permission set**, then choose **Next**. 1. Do the following: 1. On the **Specify policies and permission boundary** page, choose the types of IAM policies that you want to apply to the permission set. By default, you can add any combination of up to 10 AWS managed policies and customer managed policies to your permission set. IAM sets this quota. To raise it, request an increase to the IAM quota **Managed policies attached to an IAM role** in the Service Quotas console in each AWS account where you want to assign the permission set. 1. Expand **Inline policy** to add custom JSON-formatted policy text. Inline policies don't correspond to existing IAM resources. To create an inline policy, enter custom policy language in the provided form. IAM Identity Center adds the policy to the IAM resources that it creates in your member accounts. For more information, see [Inline policies](https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetcustom.html#permissionsetsinlineconcept). 1. Copy and paste the JSON policy from [AWS Partner Central and AWS Account Linking pre-requisite](https://docs.aws.amazon.com/partner-central/latest/getting-started/account-linking.html#linking-prerequisites) 1. On the **Specify permission set details** page, do the following: 1. Under **Permission set name**, type a name to identify this permission set in IAM Identity Center. The name that you specify for this permission set appears in the AWS access portal as an available role. Users sign into the AWS access portal, choose an AWS account, and then choose the role. 1. (Optional) You can also type a description. The description appears in the IAM Identity Center console only, not the AWS access portal. 1. (Optional) Specify the value for **Session duration**. This value determines the length of time that a user can be logged on before the console logs them out of their session. For more information, see [Set session duration for AWS accounts](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtosessionduration.html). 1. (Optional) Specify the value for **Relay state**. This value is used in the federation process to redirect users within the account. For more information, refer to [Set relay state for quick access to the AWS Management Console](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtopermrelaystate.html). **Note** You must use an AWS Management Console URL for the relay state. For example: `https://console.aws.amazon.com/ec2/` 1. Expand **Tags (optional)**, choose **Add tag**, and then specify values for **Key** and **Value (optional)**. For information about tags, refer to [Tagging AWS IAM Identity Center resources](https://docs.aws.amazon.com/singlesignon/latest/userguide/tagging.html). 1. Choose **Next**. 1. On the **Review and create** page, review the selections that you made, and then choose **Create**. By default, when you create a permission set, the permission set isn't provisioned (used in any AWS accounts). To provision a permission set in an AWS account, you must assign IAM Identity Center access to users and groups in the account, and then apply the permission set to those users and groups. For more information, refer to [Assign user access to AWS accounts](https://docs.aws.amazon.com/singlesignon/latest/userguide/assignusers.html) in the *AWS IAM Identity Center User Guide*. # Linking AWS Partner Central and AWS accounts The following steps explain how to use AWS Partner Central to link your accounts. You must be an alliance lead or cloud admin to complete these steps. Also, the IAM permissions policy listed earlier in this guide controls the linking and role mapping tasks you and other AWS Partner Central users can perform. For more information about those tasks, refer to [Granting IAM permissions](linking-prerequisites.md#grant-iam-permissions). For more information about account linking, refer to the [Account Linking User Guide](https://partnercentral.awspartner.com/partnercentral2/s/article?article=AWS-Partner-Central&category=Introductory_resources) in Partner Central. **Note** AWS Partner Central uses the term *AWS Marketplace Account Linking*, but all partners can link accounts, including partners without AWS Marketplace accounts. Partners in Amazon Web Services India Private Limited (AWS India) can link without registering a business name. 1. Sign in to [AWS Partner Central](https://partnercentral.awspartner.com/APNLogin) as an alliance lead or cloud admin. **Note** If your organization uses single sign-on (SSO), use those credentials to sign in to your AWS account first, then sign in to AWS Partner Central. 1. In the **AWS Marketplace** section of the AWS Partner Central home page, choose **Link Account**. 1. On the **AWS Marketplace Account linking** page, choose **Link Account**. 1. On the AWS account sign-in page, choose **IAM user**. 1. Enter the ID of the AWS account and sign in. **Note** If you need account information, contact the administrator who completed the prerequisites listed above. SSO users automatically skip to the next step. 1. Navigate through the self-service linking experience: 1. Review the AWS account ID and the associated AWS Marketplace seller profile legal name and choose **Next**. **Note** If your AWS account is not registered as a seller, provide your legal business name to be registered on AWS Marketplace. Partners in Amazon Web Services India Private Limited (AWS India) can link without registering a business name. Proceed by choosing **Next**. 1. Review the IAM roles and the managed policies attached to them, then choose **Next**. 1. (Optional) To bulk map the IAM roles to the partner users with Alliance team and ACE partner roles, select the checkbox under each role section. A partner user cannot access AWS Marketplace features, such as linking private offers to ACE opportunities, without an IAM role mapped to their partner user account. If you choose not to bulk assign, you must manually map an IAM role to a partner user after linking the accounts. 1. Review the information, then choose **Submit**. You are directed to AWS Partner Central with your account successfully linked and the default IAM roles created in your account. 1. (Optional) To use custom policies that enable access to AWS Marketplace features within AWS Partner Central, refer to the next topic, [Using custom policies to map users](user-role-mapping.md). # Using custom policies to map users The topics in this section explain how to map AWS Partner Central users to AWS IAM roles. Mapping enables single sign-on access for users across AWS Partner Central and AWS. plus other features such as product and offer linking. **Topics** + [Role mapping prerequisites](#role-mapping-prereqs) + [Connecting ACE opportunities with AWS Marketplace private offers](#connect-ace-to-marketplace) ## Role mapping prerequisites Before mapping, you must complete the following prerequistites: + Create IAM roles in the AWS account. For more ionformation, refer to [Create a role using custom trust policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-custom.html) in the *AWS Identity and Access Management User Guide*. + To allow AWS Partner Central to map AWS IAM roles, add the following custom trust policy to the roles. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "partnercentral-account-management.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } ``` ------ + For AWS Partner Central users with the ACE user role, grant permissions to perform the `ListEntities` and `SearchAgreements` actions. For more information, refer to [Controlling access to AWS Marketplace Management Portal](https://docs.aws.amazon.com/marketplace/latest/userguide/marketplace-management-portal-user-access.html) in the *AWS Marketplace Seller Guide*. + [Link your AWS Partner Central account to an AWS Marketplace account](linking-apc-aws-marketplace.md). To map IAM roles to your AWS Partner Central users, you must create IAM roles with the permissions you want to provide to your users. For cloud admin users, you can only map the cloud admin IAM role created in your account during the account linking process. You can create one or more IAM roles to associate with your AWS Partner Central users. The role names must start with **PartnerCentralRoleFor**. You can't choose a role unless the name begins with that text. You can attach custom or managed policies to the IAM role. You can attach the AWS Marketplace managed policies such as `AWSMarketplaceSellerFullAccess` to the IAM roles and provide access to your AWS Partner Central users. For more information about creating roles, refer to [ Creating an IAM role (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html#roles-creatingrole-user-console) in the *IAM User Guide*. ## Connecting ACE opportunities with AWS Marketplace private offers To enable ACE users to attach AWS Marketplace private offers to ACE opportunities, map them to an AWS IAM role in AWS Partner Central. ### Prerequisites Complete the following before mapping users to AWS Marketplace IAM roles: + When you link an AWS Marketplace account to AWS Partner Central, provide `AWSMarketplaceSellerFullAccess` or, minimally, `ListEntities`/`SearchAgreements` to the IAM role assigned to ACE users. This is required to enable ACE users to attach AWS Marketplace private offers to ACE opportunities. + (Optional) To grant minimal permission, add a customer managed policy to your AWS account and to the IAM role you create for ACE managers and users. Refer to the following policy as an example: ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Action": [ "aws-marketplace:SearchAgreements", "aws-marketplace:DescribeAgreement", "aws-marketplace:GetAgreementTerms", "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:StartChangeSet" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "aws-marketplace:PartyType": "Proposer" }, "ForAllValues:StringEquals": { "aws-marketplace:AgreementType": [ "PurchaseAgreement" ] } } } ] } ``` ------ ### Mapping users to AWS IAM roles Use the procedures in this section to map and unmap AWS Partner Central users to AWS IAM roles. **To map an AWS Partner Central user to an AWS IAM role** 1. Sign in to [AWS Partner Central](https://partnercentral.awspartner.com/APNLogin) as a user with the alliance lead or cloud admin role. 1. In the **Account linking** section of the AWS Partner Central homepage, choose **Manage linked account**. 1. In the **Non-cloud admin users** section of the **Account Linking** page, choose a user. 1. Choose **Map to IAM role**. 1. Choose an IAM role from the dropdown list. 1. Choose **Map role**. **To ummap an AWS Partner Central user from an AWS IAM role.** 1. Sign in to [AWS Partner Central](https://partnercentral.awspartner.com/APNLogin) as a user with the alliance lead or cloud admin role. 1. In the **Account linking** section of the AWS Partner Central homepage, choose **Manage linked account**. 1. In the **Non-cloud admin users** section of the **Account Linking** page, choose the user you want to unmap. 1. Choose **Unmap role**. # Unlinking AWS Partner Central and AWS accounts When you link AWS Partner Central to an AWS account, AWS resources, such as APN Customer Engagement (ACE) opportunities, are created in the linked AWS account. If you unlink to that AWS account and then link to a different AWS account, you lose access to the AWS resources in the original account. The following list describes what happens to your AWS resources when you unlink from an original account and link to a different account. Consider the impact on your business before you submit an unlinking request. **AWS Partner Central users lose the ability to perform tasks listed in [Understanding the role permissions](linking-prerequisites.md#standard-role-permissions). You must reassign the applicable IAM permissions after linking the new AWS account.** For example, ACE users can't link ACE opportunities with private offers until IAM permissions in the new AWS account have been reassigned. **You lose access to pending multi-partner opportunity invitations, and partners must re-invite you to them.** For example, say AnyCompany has five unique invitations from AWS partners to collaborate on multi-partner opportunities. If AnyCompany unlinks from the original AWS account and links to a different account without accepting the invitations, all five partners must re-invite AnyCompany in order to collaborate on multi-partner deals. **You lose access to shared multi-partner opportunities, and partners must re-share them even if you're the primary ACE opportunity owner.** For example, say AnyCompany uses Partner Connections to share an ACE opportunity with Example Corp. If AnyCompany unlinks from the original account and links to a different account, the ACE opportunity still exists, but AnyCompany can't access it, even as a primary owner, until Example Corp shares the opportunity again. **The APIs stop sending updates to ACE opportunities. For this reason, AWS recommends completing your sales engagements prior to unlinking.** For example, say AnyCompany uses the Partner Central APIs to integrate their CRM systems with AWS Partner Central, and AnyCompany uses their CRM system to manage those ACE opportunities. If AnyCompany unlinks from the original account and links to a different account, any AWS updates to the ACE opportunities by will not sync and partners won't be notified about the updates. **You can't access or edit linked private offers associated with ACE opportunities.** For example, say AnyCompany linked AWS Partner Central with an AWS Marketplace seller account, and then associated the ACE opportunities with private offers. If AnyCompany unlinks from the original account and links to a different account, AnyCompany can't access linked ACE opportunities and private offers. In addition, the linked private offers can't be associated with ACE opportunities from the newly linked AWS account. **The system automatically rejects AWS Originated (AO) opportunities pending acceptance. AWS Sales teams see the AO's as rejected and share them again with the partner. ** For example, if AnyCompany unlinks from the original account and connects to a different account, AnyCompany can't accept or reject pending AO's, which expire automatically in five days. The AWS Sales team sees the rejected AO's and has to share them again. If you decide to link to a different AWS account, AWS recommends: + Accepting or rejecting pending AWS originated opportunities. + Accepting or rejecting pending multi-partner opportunity invitations. + For ACE opportunities linking to or disconnecting from private offers as needed. + Completing sales engagements prior to unlinking if possible. **Note** There is no impact if you relink to the original AWS account. **To request unlinking** 1. Sign in to [AWS Partner Central](https://partnercentral.awspartner.com/APNLogin) as an alliance lead or cloud administrator. 1. Under **Account linking**, choose **Manage linked account**. 1. Choose **Unlink account**. 1. Review the warning message and select a reason for unlinking your account. 1. Enter **confirm** and choose **Open support case**. 1. On the confirmation banner, choose **View case details** to track the progress of your request. # Account linking FAQ The following topics answer frequently asked questions about linking AWS Partner Central accounts with other AWS accounts. ## Who can link AWS Partner Central and AWS accounts? Alliance Leads and Cloud Admins can link accounts, but only after an IAM administrator completes the [prerequisites](https://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html). Alliance Leads can delegate linking by assigning Cloud Admin roles to existing users. For more information, refer to [Managing user roles and assignments](https://docs.aws.amazon.com/partner-central/latest/getting-started/managing-user-roles-and-assignments.html) later in this guide. ## Is there any technical effort required, and what should I plan for? Identify an IAM administrator with console access to your target AWS account. The IAM administrator must complete the [prerequisites](https://docs.aws.amazon.com/partner-central/latest/getting-started/linking-prerequisites.html) before you initiate linking. ## Who is my IAM administrator? IAM administrators typically work in IT security, information security, or dedicated IAM teams. They implement policies, configure SSO, handle compliance reviews, and maintain access controls. ## Why do we need to have a Paid account to link AWS Partner Central and AWS accounts? Starting November 15, 2025, you must have a Paid account plan to renew your APN membership. On that date, AWS begins processing APN fee billings only for Partner Central accounts with linked AWS accounts at renewal. For more information, refer to [APN Fee Requirement Change for 2025](https://partnercentral.awspartner.com/partnercentral2/s/newsletter?url=APN-Fee-Requirement-Changes-for-2025). Marketplace sellers also need paid accounts for service usage. ## Can I unlink and re-link a new account, if I do not want to use my existing linked account as my primary account? You can unlink an AWS account, but doing so creates data persistence issues and requires manual reconciliation efforts. For more information about unlinking AWS accounts, refer to [Unlinking AWS Partner Central and AWS accounts](unlinking-apc-aws-marketplace.md) earlier in this guide. ## I don't have an AWS account that I can use for APN engagement. How do I create one? Coordinate with your IAM administrator to identify the team responsible for account approval and provisioning. For instructions on setting up an AWS account, refer to [Create an AWS account](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html) in the *AWS Account Management Reference Guide*. Be sure to select the [Paid account plan](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/free-tier-plans.html). ## How do I provision a new AWS account? Your IAM administrator should know the team responsible for account approval and provisioning. For information about setting up a new AWS account, refer to [Create an AWS account](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html) in the *AWS Account Management Reference Guide*. During that process, be sure to select the **Paid account plan**. For more information about account plans, refer to [Choosing an AWS Free Tier plan](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/free-tier-plans.html) in the *AWS Billing User Guide*. ## Which IAM policies should I use? You use AWS managed policies for the account linking prerequisites. By default, account linking uses AWS managed policies to assign IAM roles during account linking. However, IT admins can use custom AWS Marketplace policies to assign IAM roles to AWS Partner Central users such as an ACE team. The roles enable users to link ACE opportunities with AWS Marketplace private offers. For more information, refer to [Using custom policies to map users](user-role-mapping.md) later in this guide. The links in the following list take you to the *AWS Managed Policy Reference*. **AWS managed policies** + [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPartnerCentralFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPartnerCentralFullAccess) – Provides full access to AWS Partner Central; features and related AWS services. + [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPartnerCentralOpportunityManagement](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPartnerCentralOpportunityManagement) – Provides necessary access for opportunity management activities. + [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceSellerOfferManagement](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceSellerOfferManagement) – Enables seller access to offer and agreement management activities. For more information about the AWS Partner Central managed policies, refer to [AWS managed policies for AWS Partner Central users](managed-policies.md) later in this guide. For more information about the AWS Marketplace managed policy, refer to [AWS managed policies for AWS Marketplace sellers](https://docs.aws.amazon.com/marketplace/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awsmarketplaceselleroffermanagement) in the *AWS Marketplace Seller Guide*. **Custom AWS Marketplace policies** + `aws-marketplace:ListEntities` and `aws-marketplace:SearchAgreements` – Enables users to link ACE opportunities and AWS Marketplace private offers. + `aws-marketplace:GetSellerDashboard:` – Grants access to the AWS Partner Central & Marketplace dashboard. For more information about the custom AWS Marketplace policies, refer to [ Policies and permissions for AWS Marketplace sellers](https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html#seller-ammp-permissions) in the *AWS Marketplace Seller Guide*. ## Why can’t I complete account linking? I have alliance lead privileges You must have the alliance lead or cloud admin *role*, not the privileges. ## How do I unlink accounts? Follow the steps in [Unlinking AWS Partner Central and AWS accounts](unlinking-apc-aws-marketplace.md) earlier in this guide. ## What happens to linked ACE opportunities \$1 MPPO if I unlink an account? If you unlink and re-link to a different AWS Marketplace seller or AWS account, linked objects disappear. If a partner re-links to the same AWS Marketplace seller or AWS account, linked objects remain. ## How can I manage partner user access to a linked account? Alliance leads use AWS Partner Central User Management to assign IAM roles to AWS Partner Central users and grant them access to a linked account. They can also remove the mapped roles to remove access a linked account. In addition, each standard IAM role created during account linking comes with limited permissions. For more information about them, refer to [Understanding the role permissions](linking-prerequisites.md#standard-role-permissions) earlier in this guide. ## Selecting the PartnerCentralAceRole checkbox created 3 roles. Why? You use that option to bulk assign IAM roles to the Alliance, Cloud Admin, and ACE teams. The linking process creates the roles. Partners can use the IAM console to delete unwanted roles. For more information, refer to [ Updated Account Linking User Guide](https://partnercentral.awspartner.com/partnercentral2/s/article?article=AWS-Partner-Central&category=Introductory_resources) in AWS Partner Central. ## Why can't we register our legal business name during account linking? Ensure you submitted an accurate account name. The AWS ID you select may already be in use, and it cannot be shared by multiple parties, especially if your company is merging. For guidance on what to during a merger, refer to: + [AWS Partners M&A Policy and FAQs](https://partnercentral.awspartner.com/partnercentral2/s/resources?sfdc.tabName=01r8a000001A846&Id=kA08W000000BiR2SAK) + [How do I merge AWS Partner Central accounts?](https://partnercentral.awspartner.com/partnercentral2/s/resources?sfdc.tabName=01r8a000001A846&Id=kA08W000000BiR2SAK) ## Why do I get the “Missing IAM Role Mapping”, “Missing Permission”, “Access denied”, and “Your AWS Marketplace IAM role does not have the required permissions” errors? The messages appear for the following reasons: + An AWS Partner Central user wasn't mapped to an IAM role. Ask the alliance lead or cloud admin to map the appropriate role to the user. For more information, refer to the [AWS Partner Central & AWS account linking guide](https://partnercentral.awspartner.com/partnercentral2/s/article?article=AWS-Partner-Central&category=Introductory_resources). + AWS Partner Central users with mapped IAM roles need to update their existing policies. For more information about the latest prerequisites, refer to [Prerequisites](linking-prerequisites.md) earlier in this guide. ## Can I associate AWS Marketplace private offers and Channel Partner private offers with ACE opportunities? Yes, but you must link accounts first. You use AWS Partner Central to associate AWS Marketplace private offers with ACE opportunities. You use **Partner Connections** to associate Channel Partner private offers with ACE opportunities. Both methods require account linking before you can use them. For more information, refer to [Partner Connections](https://docs.aws.amazon.com/partner-central/latest/sales-guide/partner-connections.html) in the *AWS Partner Central Sales Guide*.