# Security on AWS Marketplace We list software from high-quality sellers, and actively work to maintain the quality of our selection. Because every customer is different, our goal is to provide enough information about the products listed on AWS Marketplace so that customers can make good purchasing decisions. **Note** For information about security for data products from AWS Data Exchange, see [Security](https://docs.aws.amazon.com/data-exchange/latest/userguide/security.html) in the *AWS Data Exchange User Guide*. For information about security for sellers on AWS Marketplace, see [AWS Marketplace Security](https://docs.aws.amazon.com/marketplace/latest/userguide/security.html) in the *AWS Marketplace Seller Guide*. ## Subscriber information shared with sellers We may share your contact information with our sellers for the following reasons: + If it is necessary for them to provide customer training and technical support. + For software activation, configuration, and customization of content. + Compensate their sales teams internally. In addition, we may share information such as company name, full address and usage fees with sellers in order for sellers to compensate their sales teams. We may also share certain information with sellers to help them evaluate the effectiveness of their marketing campaigns. Sellers may use this information along with information that they already possess to determine rewards for their sales teams or usage for a particular buyer. Otherwise, we generally do not share customer information with sellers, and any information shared is not personally identifiable, unless you have given us permission to share such information, or we believe that providing the information to sellers is necessary to comply with laws or regulations. # Upgrading IAM policies to IPv6 AWS Marketplace customers use IAM policies to set an allowed range of IP addresses and prevent any IP addresses outside the configured range from being able to access AWS Marketplace resources. The AWS Marketplace website domain is being upgraded to the IPv6 protocol. IP address filtering policies that are not updated to handle IPv6 addresses might result in clients losing access to the resources on AWS Marketplace website. ## Customers impacted by upgrade from IPv4 to IPv6 Customers who are using dual addressing are impacted by this upgrade. Dual addressing means that the network supports both IPv4 and IPv6. If you are using dual addressing, you must update your IAM policies that are currently configured with IPv4 format addresses to include IPv6 format addresses. For help with access issues, contact [Support](https://support.console.aws.amazon.com/support/home/?nc1=f_dr#/case/create). **Note** The following customers are *not* impacted by this upgrade: Customers who are on *only* IPv4 networks. Customers who are on *only* IPv6 networks. ## What is IPv6? IPv6 is the next generation IP standard intended to eventually replace IPv4. The previous version, IPv4, uses a 32-bit addressing scheme to support 4.3 billion devices. IPv6 instead uses 128-bit addressing to support approximately 340 trillion trillion trillion (or 2 to the 128th power) devices. ``` 2001:cdba:0000:0000:0000:0000:3257:9652 2001:cdba:0:0:0:0:3257:9652 2001:cdba::3257:965 ``` ## Updating an IAM policy for IPv6 IAM policies are currently used to set an allowed range of IP addresses using the `aws:SourceIp` filter. Dual addressing supports both IPv4 and IPV6 traffic. If your network uses dual addressing, you must ensure that any IAM polices that are used for IP address filtering are updated to include IPv6 address ranges. For example, this IAM identity-based policy identifies allowed IPv4 address CIDR ranges 192.0.2.0/24 and 203.0.113.0/24 in the Condition element. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": { "Effect": "Deny", "Action": "aws-marketplace:*", "Resource": "*", "Condition": { "NotIpAddress": { "aws:SourceIp": [ "192.0.2.0/24", "203.0.113.0/24" ] }, "Bool": { "aws:ViaAWSService": "false" } } } } ``` ------ For more information about the IAM identity-based policy example, see [AWS: Denies access to AWS based on the source IP](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-ip.html) in the *AWS Identity and Access Management User Guide*. To update this policy, the policy's `Condition` element is updated to include IPv6 address ranges `2001:DB8:1234:5678::/64` and `2001:cdba:3257:8593::/64`. **Note** DO NOT REMOVE the existing IPv4 addresses because they are needed for backward compatibility. ``` "Condition": { "NotIpAddress": { "aws:SourceIp": [ "192.0.2.0/24", <> "203.0.113.0/24", <> "2001:DB8:1234:5678::/64", <> "2001:cdba:3257:8593::/64" <> ] }, "Bool": { "aws:ViaAWSService": "false" } } ``` For more information about managing access permissions with IAM, see [Managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html) in the *AWS Identity and Access Management User Guide*. ## Testing network after update from IPv4 to IPv6 After you update your IAM policies to the IPv6 format, you can test whether your network is accessing the IPv6 endpoint and the AWS Marketplace website functionality. **Topics** + [Testing network with Linux/Unix or Mac OS X](#testing-linux) + [Testing network with Windows 7 or Windows 10](#testing-widows) + [Testing the AWS Marketplace website](#testing-website) ### Testing network with Linux/Unix or Mac OS X If you are using Linux/Unix or Mac OS X, you can test whether your network is accessing the IPv6 endpoint by using the following curl command. ``` curl -v -s -o /dev/null http://ipv6.ec2-reachability.amazonaws.com/ ``` For example, if you are connected over IPv6, the connected IP address displays the following information. ``` * About to connect() to aws.amazon.com port 443 (#0) * Trying IPv6 address... connected * Connected to aws.amazon.com (IPv6 address) port 443 (#0) > GET / HTTP/1.1 > User-Agent: curl/7.18.1 (x86_64-unknown-linux-gnu) libcurl/7.18.1 OpenSSL/1.0.1t zlib/1.2.3 > Host: aws.amazon.com ``` ### Testing network with Windows 7 or Windows 10 If you are using Windows 7 or Windows 10, you can test whether your network can access a dual-stack endpoint over IPv6 or IPv4. Use the `ping` command as shown in the following example. ``` ping aws.amazon.com ``` This command returns IPv6 addresses if you are accessing an endpoint over IPv6. ### Testing the AWS Marketplace website Testing the AWS Marketplace website functionality after the update depends primarily on how your policy is written and what it is used for. In general, you should verify that the functionality specified in the policy works as intended. The following scenarios can help you get started with testing the AWS Marketplace website functionality. As a buyer on the AWS Marketplace website, test whether you can do the following tasks: + Subscribe to an AWS Marketplace product. + Configure an AWS Marketplace product. + Launch or fulfill an AWS Marketplace product. As a seller on the AWS Marketplace website, test whether you can do the following tasks: + Manage your existing AWS Marketplace products. + Create an AWS Marketplace product. # Controlling access to AWS Marketplace subscriptions AWS IAM Identity Center helps you securely create or connect your workforce identities and manage their access centrally across AWS accounts and applications. IAM Identity Center is the recommended approach for workforce authentication and authorization in AWS for organizations of any size and type. For additional configuration guidance, review the [AWS Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/org-management.html#mgmt-sso). IAM Identity Center provides a user portal where your users can find and access their assigned AWS account, roles, cloud applications, and custom applications in one place. IAM Identity Center assigns single sign-on access to users and groups in your connected directory and uses permission sets to determine their level of access. This enables temporary security credentials. You can define their level of access by assigning specific AWS managed roles for AWS Marketplace access to delegate the management of AWS Marketplace subscriptions across your AWS organization. For example, Customer A assumes a role through federation with the `ManagedMarketplace_ViewOnly` policy attached to the role. This means Customer A can only view subscriptions in AWS Marketplace. You can create an IAM role with permissions to view subscriptions and grant permission to Customer A to [assume this role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html). ## Creating IAM roles for AWS Marketplace access You can use IAM roles to delegate access to your AWS resources. **To create IAM roles for assigning AWS Marketplace permissions** 1. Open the [IAM Console](https://console.aws.amazon.com/iam/). 1. In the left navigation pane, choose **Roles** and then choose **Create role**. 1. Choose your AWS account. 1. From **Add permissions**, select one of the following policies: + To allow permissions only to view subscriptions, but not change them, choose **AWSMarketplaceRead-only**. + To allow permissions to subscribe and unsubscribe, choose **AWSMarketplaceManageSubscriptions**. + To allow complete control of your subscriptions, choose **AWSMarketplaceFullAccess**. 1. Choose **Next**. 1. For **Role name**, enter a name for the role. For example, *MarketplaceReadOnly* or *MarketplaceFullAccess*. Then choose **Create role**. For more information, see [Creating IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html). **Note** The administrator of the specified account can grant permission to assume this role to any user in that account. Repeat the preceding steps to create more roles with different permission sets so that each user persona can use the IAM role with customized permissions. You're not limited to the permissions in the AWS managed policies that are described here. You can use IAM to create policies with custom permissions and then add those policies to IAM roles. For more information, see [Managing IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html) and [Adding IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#add-policies-console) in the *IAM User Guide*. ## AWS managed policies for AWS Marketplace You can use AWS managed policies to provide basic AWS Marketplace permissions. Then, for any unique scenarios, you can create your own policies and apply them to the roles with the specific requirements for your scenario. The following basic AWS Marketplace managed policies are available to you to control who has which permissions. The following links take you to the [AWS Managed Policy Reference](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/about-managed-policy-reference.html). + [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceRead-only.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceRead-only.html)`` + [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceManageSubscriptions.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceManageSubscriptions.html) + [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPrivateMarketplaceRequests.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPrivateMarketplaceRequests.html) + [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPrivateMarketplaceAdminFullAccess.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPrivateMarketplaceAdminFullAccess.html) + [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceFullAccess.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceFullAccess.html) AWS Marketplace also provides specialized managed policies for specific scenarios. For a full list of AWS managed policies for AWS Marketplace buyers, as well as descriptions of what permissions they provide, see [AWS managed policies for AWS Marketplace buyers](buyer-security-iam-awsmanpol.md) in this section. ## Permissions for working with License Manager AWS Marketplace integrates with AWS License Manager to manage and share licenses for products that you subscribe to between accounts in your organization. To view the full details of your subscriptions in AWS Marketplace, a user must be able to list license information from AWS License Manager. To make sure that your users have the permissions they need to see all the data about their AWS Marketplace products and subscriptions, add the following permission: + `license-manager:ListReceivedLicenses` For more information about setting permissions, see [Managing IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html) in the *IAM User Guide*. ## Additional resources For more information about managing IAM roles, see [IAM Identities (users, user groups, and roles)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html) in the *IAM User Guide*. For more information about managing IAM permissions and policies, see [Controlling access to AWS resources using policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_controlling.html) in the *IAM User Guide*. For more information about managing IAM permissions and policies for data products in AWS Data Exchange, see [Identity and access management in AWS Data Exchange](https://docs.aws.amazon.com/data-exchange/latest/userguide/auth-access.html) in the *AWS Data Exchange User Guide*. # AWS managed policies for AWS Marketplace buyers An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles. Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining [ customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#customer-managed-policies) that are specific to your use cases. You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services. For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) in the *IAM User Guide*. This section lists each of the policies used to manage buyer access to AWS Marketplace. For information about seller policies, see [AWS managed policies for AWS Marketplace sellers](https://docs.aws.amazon.com/marketplace/latest/userguide/security-iam-awsmanpol.html) in the *AWS Marketplace Seller Guide*. **Topics** + [AWS managed policy: AWSMarketplaceDeploymentServiceRolePolicy](#deployment-service-manpol) + [AWS managed policy: AWSMarketplaceFullAccess](#security-iam-awsmanpol-awsmarketplacefullaccess) + [AWS managed policy: AWSMarketplaceImageBuildFullAccess (Deprecated)](#security-iam-awsmanpol-awsmarketplaceimagebuildfullaccess) + [AWS managed policy: AWSMarketplaceLicenseManagementServiceRolePolicy](#security-iam-awsmanpol-awsmarketplacelicensemanagementservicerolepolicy) + [AWS managed policy: AWSMarketplaceManageSubscriptions](#security-iam-awsmanpol-awsmarketplacemanagesubscriptions) + [AWS managed policy: AWSMarketplaceProcurementSystemAdminFullAccess](#security-iam-awsmanpol-awsmarketplaceprocurementsystemadminfullaccess) + [AWS managed policy: AWSMarketplaceRead-only](#security-iam-awsmanpol-awsmarketplaceread-only) + [AWS managed policy: AWSPrivateMarketplaceAdminFullAccess](#security-iam-awsmanpol-awsprivatemarketplaceadminfullaccess) + [AWS managed policy: AWSPrivateMarketplaceRequests](#security-iam-awsmanpol-awsprivatemarketplacerequests) + [AWS managed policy: AWSServiceRoleForPrivateMarketplaceAdminPolicy](#private-marketplace-slr-manpol) + [AWS managed policy: AWSVendorInsightsAssessorFullAccess](#aws-vi-assessor-full-access) + [AWS managed policy: AWSVendorInsightsAssessorReadOnly](#aws-vi-assessor-read-only) + [AWS managed policy: AWSServiceRoleForProcurementInsightsPolicy](#aws-procurement-insights) + [AWS Marketplace updates to AWS managed policies](#buyer-security-iam-awsmanpol-updates) ## AWS managed policy: AWSMarketplaceDeploymentServiceRolePolicy You can't attach the `AWSMarketplaceDeploymentServiceRolePolicy` to your IAM entities. This policy is attached to a service-linked role that allows AWS Marketplace to perform actions on your behalf. For more information, see [Using service-linked roles for AWS Marketplace](buyer-using-service-linked-roles.md). This policy grants contributor permissions that allow AWS Marketplace to manage deployment-related parameters, which are stored as secrets in [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html), on your behalf. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceDeploymentServiceRolePolicy.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceDeploymentServiceRolePolicy.html) in the *AWS Managed Policy Reference*. ## AWS managed policy: AWSMarketplaceFullAccess You can attach the `AWSMarketplaceFullAccess` policy to your IAM identities. This policy grants administrative permissions that allow full access to AWS Marketplace and related services, both as a buyer and a seller. These permissions include the ability to subscribe and unsubscribe to AWS Marketplace software, manage AWS Marketplace software instances from the AWS Marketplace, creating and managing private marketplace in your account, as well as access to Amazon EC2, CloudFormation, and Amazon EC2 Systems Manager. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceFullAccess.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceFullAccess.html) in the *AWS Managed Policy Reference*. ## AWS managed policy: AWSMarketplaceImageBuildFullAccess (Deprecated) This policy granted contributor permissions that allow full access to the AWS Marketplace private image build feature. In addition to creating private images, it also provided permissions to add tags to images, and to launch and terminate Amazon EC2 instances. For more information, see [Deprecated AWS managed policies](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/about-managed-policy-reference.html#deprecated-managed-policies) in the *AWS Managed Policy Reference Guide*. ## AWS managed policy: AWSMarketplaceLicenseManagementServiceRolePolicy You can't attach the `AWSMarketplaceLicenseManagementServiceRolePolicy` to your IAM entities. This policy is attached to a service-linked role that allows AWS Marketplace to perform actions on your behalf. For more information, see [Using service-linked roles for AWS Marketplace](buyer-using-service-linked-roles.md). This policy grants contributor permissions that allow AWS Marketplace to manage licenses on your behalf. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceLicenseManagementServiceRolePolicy.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceLicenseManagementServiceRolePolicy.html) in the *AWS Managed Policy Reference*. ## AWS managed policy: AWSMarketplaceManageSubscriptions You can attach the `AWSMarketplaceManageSubscriptions` policy to your IAM identities. This policy grants contributor permissions that allow subscribing and unsubscribing to AWS Marketplace products. It also allows buyers to access Express Private Offers and manage agreement cancellation requests. The permissions are organized into the following groups: + `aws-marketplace` – Allows principals to view, subscribe to, and unsubscribe from AWS Marketplace products. + `aws-marketplace` – Allows principals to create and manage private marketplace requests and view private product listings. + `aws-marketplace` – Allows principals to manage purchase orders and handle payment requests for purchase agreements, including accepting or rejecting payment requests and viewing agreement charges. These permissions are restricted to agreements of type PurchaseAgreement. + `aws-marketplace` – Allows principals to view and describe changesets in the AWS Marketplace catalog. + `aws-marketplace` – Allows principals to create and manage agent token containers and express private offers through the changeset mechanism. These permissions are limited to specific change types: CreateAgentTokenContainer, RequestExpressPrivateOffer, and ExpireToken. + `aws-marketplace` – Allows principals to list and describe entities in the AWS Marketplace catalog, such as products, offers, and agreements. + `aws-marketplace` – Allows principals to manage agreement cancellation requests as the accepting party, including listing, retrieving, accepting, rejecting cancellation requests, and directly canceling agreements. These permissions are restricted to PurchaseAgreement type and Acceptor party type. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceManageSubscriptions.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceManageSubscriptions.html) in the *AWS Managed Policy Reference*. ## AWS managed policy: AWSMarketplaceProcurementSystemAdminFullAccess You can attach the `AWSMarketplaceProcurementSystemAdminFullAccess` policy to your IAM identities. This policy grants admin permissions that allow managing all aspects of an AWS Marketplace eProcurement integration, including listing the accounts in your organization and managing procurement portal preferences. For more information about eProcurement integrations, see [Integrating AWS Marketplace with procurement systems](procurement-system-integration.md) . The permissions are organized into the following groups: + `aws-marketplace` – Allows managing AWS Marketplace procurement system configuration. + `organizations` – Allows listing and describing accounts and organizational structure in AWS Organizations. + `invoicing` – Allows creating, retrieving, and listing procurement portal preferences. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceProcurementSystemAdminFullAccess.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceProcurementSystemAdminFullAccess.html) in the *AWS Managed Policy Reference*. ## AWS managed policy: AWSMarketplaceRead-only You can attach the `AWSMarketplaceRead-only` policy to your IAM identities. This policy grants read-only permissions that allows viewing products, private offers, and subscriptions for your account on AWS Marketplace, as well as viewing the Amazon EC2, AWS Identity and Access Management, and Amazon SNS resources in the account. The permissions are organized into the following groups: + `aws-marketplace` – Allows principals to view subscriptions and list agreement charges. + `ec2` – Allows principals to describe account attributes, addresses, images, instances, key pairs, security groups, subnets, and VPCs. + `iam` – Allows principals to list roles and instance profiles. + `sns` – Allows principals to get topic attributes and list topics. + `aws-marketplace` – Allows principals to list and describe private marketplace requests, and view agreement payment requests. + `aws-marketplace` – Allows principals to list private product listings. + `aws-marketplace` – Allows principals to list and view agreement cancellation requests. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceRead-only.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceRead-only.html) in the *AWS Managed Policy Reference*. ## AWS managed policy: AWSPrivateMarketplaceAdminFullAccess You can attach the `AWSPrivateMarketplaceAdminFullAccess` policy to your IAM identities. This identity-based policy enables administrators to manage AWS Private Marketplace configurations and associated organizational controls. This policy includes IAM and Organizations permissions. It grants permissions to do the following actions: 1. Manage Private Marketplace service-linked roles (SLR). 1. Get role information for `AWSServiceRoleForPrivateMarketplaceAdmin`. 1. Create service-linked roles for Private Marketplace administration. 1. Handle organizational delegated administration. 1. Register and deregister delegated administrators for Private Marketplace. 1. Enable AWS service access for Private Marketplace within Organizations. 1. Manage Private Marketplace products and requests. 1. Associate and disassociate products with Private Marketplace. 1. List and describe Private Marketplace requests. 1. Perform catalog operations (list entities, describe entities, manage change sets). 1. Handle resource tagging for AWS Marketplace resources. 1. Access Organizations information. 1. View organization details, organizational units, and accounts. 1. List organizational hierarchy information. 1. Monitor AWS service access and delegated administrators. This policy is designed for administrators who need to set up and manage Private Marketplace across an Organizations structure, granting both console and programmatic access to these functions. The policy includes specific conditions to ensure Private Marketplace service principal validation and appropriate resource-level permissions for IAM roles and organizational management. For more information about using multiple administrators, see [Example policies for private marketplace administrators](it-administrator.md#creating-custom-policies-for-private-marketplace-admin). To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPrivateMarketplaceAdminFullAccess.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPrivateMarketplaceAdminFullAccess.html) in the *AWS Managed Policy Reference*. ## AWS managed policy: AWSPrivateMarketplaceRequests You can attach the `AWSPrivateMarketplaceRequests` policy to your IAM identities. This policy grants contributor permissions that allow access to request products to be added to their Private Marketplace experience, and to view those requests. These requests must be approved or declined by a Private Marketplace administrator. The permissions are organized into multiple groups: 1. `LegacyPrivateMarketplaceRequestsPermissions`: These permissions are used by legacy Private Marketplace which will be deprecated. For details, see [Private marketplaces in AWS Marketplace (legacy version)](private-marketplace.md). 1. `PrivateMarketplaceManageRequestsPermissions`: These permissions are required to create and cancel product approval requests. 1. `PrivateMarketplaceReadRequestsPermissions` and `PrivateMarketplaceListRequestsPermissions`: These permissions are required to list and get details of the product approval requests. 1. `PrivateMarketplaceReadChangeSetPermissions`: These permissions are required to list and get details of change sets to create and cancel requests. See [Working with change sets](https://docs.aws.amazon.com/marketplace/latest/APIReference/catalog-apis.html#working-with-change-sets) in the *AWS Marketplace API Reference*. 1. `PrivateMarketplaceTaggingRequestsPermissions`: The tagging permissions are optional and allow users to tag the requests. See [Managing tags on resources](https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/managing-tags.html) in the *AWS Marketplace API Reference*. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPrivateMarketplaceRequests.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPrivateMarketplaceRequests.html) in the *AWS Managed Policy Reference*. ## AWS managed policy: AWSServiceRoleForPrivateMarketplaceAdminPolicy You can't attach the `AWSServiceRoleForPrivateMarketplaceAdminPolicy` to your IAM entities. This policy is attached to a service-linked role that allows AWS Marketplace to perform actions on your behalf. For more information, see [Using service-linked roles for AWS Marketplace](buyer-using-service-linked-roles.md). This policy grants contributor permissions that allow AWS Marketplace to describe and update Private Marketplace resources and describe AWS Organizations. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSServiceRoleForPrivateMarketplaceAdminPolicy.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSServiceRoleForPrivateMarketplaceAdminPolicy.html) in the *AWS Managed Policy Reference*. ## AWS managed policy: AWSVendorInsightsAssessorFullAccess You can attach the `AWSVendorInsightsAssessorFullAccess` policy to your IAM identities. This policy grants full access for viewing entitled AWS Marketplace Vendor Insights resources and managing AWS Marketplace Vendor Insights subscriptions. These requests must be approved or denied by an administrator. It allows read-only access to AWS Artifact third-party reports. AWS Marketplace Vendor Insights identifies assessor is equal to buyer and vendor is equal to seller. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSVendorInsightsAssessorFullAccess.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSVendorInsightsAssessorFullAccess.html) in the *AWS Managed Policy Reference*. ## AWS managed policy: AWSVendorInsightsAssessorReadOnly You can attach the `AWSVendorInsightsAssessorReadOnly` policy to your IAM identities. This policy grants read-only access for viewing entitled AWS Marketplace Vendor Insights resources. These requests must be approved or denied by an administrator. It allows read-only access to reports in AWS Artifact. requests must be approved or denied by an administrator. It allows read-only access to AWS Artifact third-party reports. AWS Marketplace Vendor Insights identifies assessor as the buyer and vendor is equal to the seller for the purposes of this guide. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSVendorInsightsAssessorReadOnly.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSVendorInsightsAssessorReadOnly.html) in the *AWS Managed Policy Reference*. ## AWS managed policy: AWSServiceRoleForProcurementInsightsPolicy You can attach the `AWSServiceRoleForProcurementInsightsPolicy` policy to your IAM identities. This policy grants the `AWSServiceRoleForProcurementInsightsPolicy` access to the resource data in your AWS organization.. AWS Marketplace uses the data to populate the [Procurement insights dashboard](https://docs.aws.amazon.com/marketplace/latest/buyerguide/procurement-insights.html). The dashboard enables buyers with management accounts to view all the agreements across all the accounts in an organization. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSServiceRoleForProcurementInsightsPolicy.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSServiceRoleForProcurementInsightsPolicy.html) in the *AWS Managed Policy Reference*. ## AWS Marketplace updates to AWS managed policies View details about updates to AWS managed policies for AWS Marketplace since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the AWS Marketplace [Document history for AWS Marketplace Buyer Guide](document-history.md) **Note** In AWS Marketplace Vendor Insights, an assessor is equal to a buyer, and a vendor is equal to a seller for the purposes of this guide. | Change | Description | Date | | --- | --- | --- | | [AWSMarketplaceProcurementSystemAdminFullAccess](#security-iam-awsmanpol-awsmarketplaceprocurementsystemadminfullaccess) — updates to existing policy | AWS Marketplace added permissions for creating, retrieving, and listing procurement portal preferences. | April 7, 2026 | | [AWSMarketplaceRead-only](#security-iam-awsmanpol-awsmarketplaceread-only) — updates to existing policy | AWS Marketplace added permissions for listing and viewing agreement cancellation requests. | March 31, 2026 | | [AWSMarketplaceManageSubscriptions](#security-iam-awsmanpol-awsmarketplacemanagesubscriptions) — updates to existing policy | AWS Marketplace added permissions for managing agreement cancellation requests, including listing, retrieving, accepting, rejecting cancellation requests, and directly canceling agreements. | March 31, 2026 | | [AWSMarketplaceManageSubscriptions](#security-iam-awsmanpol-awsmarketplacemanagesubscriptions) — updates to existing policy | AWS Marketplace added permissions for buyers to access Express Private Offers. | November 30, 2025 | | [AWSPrivateMarketplaceRequests](#security-iam-awsmanpol-awsprivatemarketplacerequests) — updates to existing policy | AWS Marketplace added permissions to create and cancel product approval requests, list and get details of the product approval requests, and allow users to tag the requests. | November 17, 2025 | | [AWSPrivateMarketplaceAdminFullAccess](#security-iam-awsmanpol-awsprivatemarketplaceadminfullaccess) — updates to existing policy | AWS Marketplace added service-linked role and Organizations integration permissions for Private Marketplace administrators. | June 5, 2025 | | [AWSMarketplaceRead-only](#security-iam-awsmanpol-awsmarketplaceread-only) and [AWSMarketplaceFullAccess](#security-iam-awsmanpol-awsmarketplacemanagesubscriptions) — updates to existing policies | AWS Marketplace updated existing policies to remove policies related to the discontinued Private Image Build delivery method. | May 7, 2025 | | [AWSMarketplaceRead-only](#security-iam-awsmanpol-awsmarketplaceread-only) and [AWSMarketplaceManageSubscriptions](#security-iam-awsmanpol-awsmarketplacemanagesubscriptions) — updates to existing policies | AWS Marketplace updated existing policies to support listing agreement charges and updating purchase orders in the AWS Marketplace console. | November 21, 2024 | | Added the [AWSServiceRoleForProcurementInsightsPolicy](https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.html#aws-procurement-insights). | AWS Marketplace added a new policy for accessing and describing the data in an Organizations. AWS Marketplace uses the data to populate the [Procurement insights dashboard](https://docs.aws.amazon.com/marketplace/latest/buyerguide/procurement-insights.html). | October 3, 2024 | | Deprecated the legacy AWSMarketplaceImageBuildFullAccess AWS Marketplace policy | AWS Marketplace discontinued the Private Image Build delivery method, so the AWSMarketplaceImageBuildFullAcces policy was also discontinued. | May 30, 2024 | | [https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.html#private-marketplace-slr-manpol](https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.html#private-marketplace-slr-manpol) — Added policy for new feature in AWS Marketplace | AWS Marketplace added a new policy to support managing Private Marketplace resources and describing AWS Organizations. | February 16, 2024 | | [AWSPrivateMarketplaceAdminFullAccess](#security-iam-awsmanpol-awsprivatemarketplaceadminfullaccess) — Update to existing policy | AWS Marketplace updated the policy to support reading AWS Organizations data. | February 16, 2024 | | [https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.html#deployment-service-manpol](https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.html#deployment-service-manpol) — Added policy for new feature in AWS Marketplace | AWS Marketplace added a new policy to support managing deployment-related parameters. | November 29, 2023 | | [AWSMarketplaceRead-only](#security-iam-awsmanpol-awsmarketplaceread-only) and [AWSMarketplaceManageSubscriptions](#security-iam-awsmanpol-awsmarketplacemanagesubscriptions) — updates to existing policies | AWS Marketplace updated existing policies to allow access to the Private offers page. | January 19, 2023 | | [AWSPrivateMarketplaceAdminFullAccess](#security-iam-awsmanpol-awsprivatemarketplaceadminfullaccess) — Update to existing policy | AWS Marketplace updated the policy for the new tag-based authorization feature. | December 9, 2022 | | [AWSVendorInsightsAssessorReadOnly](#aws-vi-assessor-read-only) AWS Marketplace updated AWSVendorInsightsAssessorReadOnly | AWS Marketplace updated AWSVendorInsightsAssessorReadOnly to add read-only access to reports in AWS Artifact third-party report (preview). | November 30, 2022 | | [AWSVendorInsightsAssessorFullAccess](#aws-vi-assessor-full-access) AWS Marketplace updated AWSVendorInsightsAssessorFullAccess | AWS Marketplace updated `AWSVendorInsightsAssessorFullAccess` to add agreement search and read-only access to AWS Artifact third-party report (preview). | November 30, 2022 | | [AWSVendorInsightsAssessorFullAccess](#aws-vi-assessor-full-access) and [AWSVendorInsightsAssessorReadOnly](#aws-vi-assessor-read-only) — Added policies for new feature in AWS Marketplace | AWS Marketplace added policies for the new feature AWS Marketplace Vendor Insights: `AWSVendorInsightsAssessorFullAccess` and `AWSVendorInsightsAssessorReadOnly` | July 26, 2022 | | [AWSMarketplaceFullAccess](#security-iam-awsmanpol-awsmarketplacefullaccess) and AWSMarketplaceImageBuildFullAccess — Updates to an existing policies | AWS Marketplace removed unneeded permissions to improve security. | March 4, 2022 | | [AWSPrivateMarketplaceAdminFullAccess](#security-iam-awsmanpol-awsprivatemarketplaceadminfullaccess) — Update to an existing policy | AWS Marketplace removed unused permissions from the `AWSPrivateMarketplaceAdminFullAccess` policy. | August 27, 2021 | | [AWSMarketplaceFullAccess](#security-iam-awsmanpol-awsmarketplacefullaccess) — Update to an existing policy | AWS Marketplace removed a duplicate `ec2:DescribeAccountAttributes` permission from the `AWSMarketplaceFullAccess` policy. | July 20, 2021 | | AWS Marketplace started tracking changes | AWS Marketplace started tracking changes for its AWS managed policies. | April 20, 2021 | # Using service-linked roles for AWS Marketplace AWS Marketplace uses AWS Identity and Access Management (IAM)[ service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role). A service-linked role is a unique type of IAM role that is linked directly to AWS Marketplace. Service-linked roles are predefined by AWS Marketplace and include all the permissions that the service requires to call other AWS services on your behalf. A service-linked role makes setting up AWS Marketplace easier because you don't have to add the necessary permissions manually. AWS Marketplace defines the permissions of its service-linked roles, and unless defined otherwise, only AWS Marketplace can assume its roles. The defined permissions include the trust policy and the permissions policy. That permissions policy can't be attached to any other IAM entity. For information about other services that support service-linked roles, see [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html), and look for the services with **Yes ** in the **Service-linked roles** column. Choose a **Yes ** with a link to view the service-linked role documentation for that service. # Creating a service-linked role for AWS Marketplace AWS Marketplace creates the service-linked role for you when you set up integration with AWS License Manager. You can specify that AWS Marketplace create the service-linked role for all accounts in your organization at once, or you can create the service-linked role for one account at a time. The option to create service-linked roles across all accounts is only available if your organization has **All features** enabled. For more details, see [ Enabling all features in your organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html) in the *AWS Organizations User Guide*. **To create service-linked roles across all accounts** 1. In [AWS Marketplace console](https://console.aws.amazon.com/marketplace/), sign in and choose **Settings**. 1. In the **AWS Marketplace procurement insights integration** section, select **View setting details**. 1. On the **Create AWS Marketplace procurement insights integration** page, select **Enable trusted access across your organization**, then choose **Create integration**. **Note** This setting enables trust within AWS Organizations. As a result, in addition to the current action, future accounts that are added to the organization have the service-linked role added automatically. **To create service-linked roles for the current account** 1. In [AWS Marketplace console](https://console.aws.amazon.com/marketplace/), sign in and choose **Settings**. 1. In the **AWS License Manager integration** section, select **View setting details**. 1. On the **Create AWS License Manager integration** page, under **Enable AWS Marketplace to manage licenses for your AWS Organizations accounts**, select **AWS Marketplace license management service-linked role for this account**, then choose **Create integration**. **Important** If you create the service-linked role only for the current account, you do not enable trusted access across your organization, and you must repeat these steps for each account that wants to share (giving or receiving) licenses in AWS Marketplace. This includes all future accounts. # Editing a service-linked role for AWS Marketplace AWS Marketplace doesn't allow you to edit the service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the *IAM User Guide*. # Deleting a service-linked role for AWS Marketplace If you no longer need to use a feature or service that requires a service-linked role, we recommend that you delete that role. That way you don’t have an unused entity that is not actively monitored or maintained. However, you must clean up the resources for your service-linked role before you can manually delete it. **Note** If the AWS Marketplace service is using the role when you try to delete the resources, then the deletion might fail. If that happens, wait for a few minutes and try the operation again. **To manually delete the service-linked role using IAM** Use the IAM console, the AWS CLI, or the AWS API to delete the `AWSServiceRoleForMarketplaceLicenseManagement` service-linked role. For more information, see [Deleting a Service-Linked Role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the *IAM User Guide *. ## Supported Regions for AWS Marketplace service-linked roles AWS Marketplace supports using service-linked roles in all of the AWS Regions where the service is available. For more information, see [AWS Marketplace Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/aws-marketplace.html#aws-marketplace_region). # Service-linked role to share entitlements for AWS Marketplace To share your AWS Marketplace subscriptions to other accounts in your AWS organization with AWS License Manager, you must give AWS Marketplace permissions for each account you want to share with. Do this by using the **AWSServiceRoleForMarketplaceLicenseManagement** role. This role provides AWS Marketplace with permissions to create and manage licenses in AWS License Manager for the products that you subscribe to in AWS Marketplace. The `AWSServiceRoleForMarketplaceLicenseManagement` service-linked role trusts the following service to perform actions in License Manager on your behalf: + `license-management.marketplace.amazonaws.com` The `AWSMarketplaceLicenseManagementServiceRolePolicy` allows AWS Marketplace to complete the following actions on the specified resources: + Actions: + `"organizations:DescribeOrganization"` + `"license-manager:ListReceivedGrants"` + `"license-manager:ListDistributedGrants"` + `"license-manager:GetGrant"` + `"license-manager:CreateGrant"` + `"license-manager:CreateGrantVersion"` + `"license-manager:DeleteGrant"` + `"license-manager:AcceptGrant"` + Resources: + All resources (`"*"`) You must configure permissions to allow an IAM entity (such as a user, group, or role) to create, edit, or delete a service-linked role. For more information, see [ Service-linked role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions) in the *IAM User Guide*. # Service-linked role to configure and launch products in AWS Marketplace AWS Marketplace uses the service-linked role named `AWSServiceRoleForMarketplaceDeployment` to allow AWS Marketplace to manage deployment-related parameters, which are stored as secrets in [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html), on your behalf. These secrets can be referenced by sellers in CloudFormation templates, which you can launch when configuring products that have Quick Launch enabled in AWS Marketplace. The `AWSServiceRoleForMarketplaceDeployment` service-linked role trusts the following services to assume the role: + `deployment.marketplace.amazonaws.com` The `AWSMarketplaceDeploymentServiceRolePolicy` allows AWS Marketplace to complete the following actions on your resources. **Note** For more information about AWS Marketplace managed policies, see [AWS managed policies for AWS Marketplace buyers](buyer-security-iam-awsmanpol.md). ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "ManageMarketplaceDeploymentSecrets", "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:PutSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:RemoveRegionsFromReplication" ], "Resource": [ "arn:aws:secretsmanager:*:*:secret:marketplace-deployment*!*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "ListSecrets", "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets" ], "Resource": [ "*" ] }, { "Sid": "TagMarketplaceDeploymentSecrets", "Effect": "Allow", "Action": [ "secretsmanager:TagResource" ], "Resource": "arn:aws:secretsmanager:*:*:secret:marketplace-deployment!*", "Condition": { "Null": { "aws:RequestTag/expirationDate": "false" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "expirationDate" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } ``` ------ You must configure permissions to allow your users, groups, or roles to create, edit, or delete a service-linked role. For more information, see [Service-linked role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions) in the *IAM User Guide*. # Service-linked role to configure Private Marketplace in AWS Marketplace AWS Marketplace uses the service-linked role named `AWSServiceRoleForPrivateMarketplaceAdmin` to describe and update Private Marketplace resources and describe AWS Organizations. The `AWSServiceRoleForPrivateMarketplaceAdmin` service-linked role trusts the following services to assume the role: + `private-marketplace.marketplace.amazonaws.com` The `AWSServiceRoleForPrivateMarketplaceAdminPolicy` policy allows AWS Marketplace to perform the following actions on specified resources. **Note** For more information about AWS Marketplace managed policies, see [AWS managed policies for AWS Marketplace buyers](buyer-security-iam-awsmanpol.md) in this guide. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "PrivateMarketplaceCatalogDescribePermissions", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity" ], "Resource": [ "arn:aws:aws-marketplace:*:*:AWSMarketplace/Experience/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/Audience/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/ProcurementPolicy/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/BrandingSettings/*" ] }, { "Sid": "PrivateMarketplaceCatalogDescribeChangeSetPermissions", "Effect": "Allow", "Action": [ "aws-marketplace:DescribeChangeSet" ], "Resource": "*" }, { "Sid": "PrivateMarketplaceCatalogListPermissions", "Effect": "Allow", "Action": [ "aws-marketplace:ListEntities", "aws-marketplace:ListChangeSets" ], "Resource": "*" }, { "Sid": "PrivateMarketplaceStartChangeSetPermissions", "Effect": "Allow", "Action": [ "aws-marketplace:StartChangeSet" ], "Condition": { "StringEquals": { "catalog:ChangeType": [ "AssociateAudience", "DisassociateAudience" ] } }, "Resource": [ "arn:aws:aws-marketplace:*:*:AWSMarketplace/Experience/*", "arn:aws:aws-marketplace:*:*:AWSMarketplace/ChangeSet/*" ] }, { "Sid": "PrivateMarketplaceOrganizationPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganizationalUnit", "organizations:ListDelegatedAdministrators", "organizations:ListChildren" ], "Resource": [ "*" ] } ] } ``` ------ You must configure permissions to allow your users, groups, or roles to create, edit, or delete a service-linked role. For more information, see [Service-linked role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions) in the *IAM User Guide*. # Service-linked role to share procurement data AWS Marketplace uses the `AWSServiceRoleForProcurementInsightsPolicy` service-linked role to access and describe the data in your AWS organization. You must create this role in order to use the [Procurement insights dashboard](procurement-insights.md). The `AWSServiceRoleForProcurementInsightsPolicy` service-linked role trusts the following services to assume the role: + `procurement-insights.marketplace.amazonaws.com` The `AWSServiceRoleForProcurementInsightsPolicy` allows AWS Marketplace to perform the following actions on specified resources. **Note** For more information about AWS Marketplace managed policies, see [AWS managed policies for AWS Marketplace buyers](buyer-security-iam-awsmanpol.md). ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "ProcurementInsightsPermissions", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts" ], "Resource": [ "*" ] } ] } ``` ------ You must configure permissions to allow your users, groups, or roles to create, edit, or delete a service-linked role. For more information, see [Service-linked role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions) in the *IAM User Guide*. # Creating a private marketplace administrator You can create an administrators group to manage your company’s [private marketplace](private-marketplace.md) settings. After private marketplace is enabled for your organization, administrators for the private marketplace can perform many tasks including the following: + View and create experiences and audiences. + Add products to private marketplace experiences. + Remove products from private marketplace experiences. + Configure the user interface of private marketplace experiences. + Enable and disable private marketplace experiences. + Call the AWS Marketplace Catalog API to manage private marketplace experiences programmatically. To create multiple private marketplace administrators where each administrator is limited to a subset of tasks, see [Example policies for private marketplace administrators](#creating-custom-policies-for-private-marketplace-admin). **Note** Enabling private marketplace is a one-time action that must happen from the management account. For more information, see [Getting started with private marketplace](https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-catalog-administration.html#private-marketplace-getting-started). You grant AWS Identity and Access Management (IAM) permissions to administer your private marketplace by attaching the [AWS managed policy: AWSPrivateMarketplaceAdminFullAccess](buyer-security-iam-awsmanpol.md#security-iam-awsmanpol-awsprivatemarketplaceadminfullaccess) to a user, group, or role. We recommend using a group or role. For more information about how to attach the policy, see [Attaching a policy to a user group](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage_attach-policy) in the *IAM User Guide*. For more information about the permissions in the `AWSPrivateMarketplaceAdminFullAccess` policy, see [AWS managed policy: AWSPrivateMarketplaceAdminFullAccess](buyer-security-iam-awsmanpol.md#security-iam-awsmanpol-awsprivatemarketplaceadminfullaccess). To learn about other policies for use in AWS Marketplace, sign in to the AWS Management Console, and go to the [IAM policies page](https://console.aws.amazon.com/iam/home?#/policies). In the search box, enter **Marketplace** to find all of the policies that are associated with AWS Marketplace. ## Example policies for private marketplace administrators Your organization can create multiple private marketplace administrators where each administrator is limited to a subset of tasks. You can tune AWS Identity and Access Management (IAM) policies to specify condition keys and resources on AWS Marketplace Catalog API actions listed in [Actions, resources, and condition keys for AWS Marketplace Catalog](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacecatalog.html#awsmarketplacecatalog-catalog_ChangeType). The general mechanism to use AWS Marketplace Catalog API change types and resources to tune IAM policies is described in the [AWS Marketplace Catalog API guide](https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/api-access-control.html). For a list of all change types available in the private AWS Marketplace, see [Working with a private marketplace.](https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/private-marketplace.html) To create customer managed policies, see [Creating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html). Following is an example policy JSON that you can use to create an administrator who can only add or remove products from private marketplaces. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:AssociateProductsWithPrivateMarketplace", "aws-marketplace:DisassociateProductsFromPrivateMarketplace", "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "aws-marketplace:DescribeEntity", "aws-marketplace:ListEntities", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:StartChangeSet" ], "Condition": { "StringEquals": { "catalog:ChangeType": [ "AllowProductProcurement", "DenyProductProcurement" ] } }, "Resource": "*" } ] } ``` ------ A policy can also be limited to manage a subset of private marketplace resources. Following is an example policy JSON you can use to create an administrator who can only manage a specific private marketplace experience. This example uses a resource string with `exp-1234example` as the `Experience` identifier. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-marketplace:AssociateProductsWithPrivateMarketplace", "aws-marketplace:DisassociateProductsFromPrivateMarketplace", "aws-marketplace:ListPrivateMarketplaceRequests", "aws-marketplace:DescribePrivateMarketplaceRequests" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "aws-marketplace:ListEntities", "aws-marketplace:DescribeEntity", "aws-marketplace:ListChangeSets", "aws-marketplace:DescribeChangeSet", "aws-marketplace:CancelChangeSet" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "aws-marketplace:StartChangeSet" ], "Resource": [ "arn:aws:aws-marketplace:*:*:AWSMarketplace/Experience/exp-1234example" ] } ] } ``` ------ For details about how entity identifiers can be retrieved and to view the set of private marketplace resources, see [Working with a private marketplace](https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/private-marketplace.html).