# SaaS-based products in AWS Marketplace SaaS products With software as a service (SaaS) products, you can deploy software hosted on AWS infrastructure and grant AWS Marketplace buyers access to the software in your AWS environment. You are responsible for managing customer access, account creation, resource provisioning, and account management within your software. After you create your initial SaaS product, you can submit change requests and configure its properties in AWS Marketplace, including your product description, availability by country, pricing, and so on. You also configure your SaaS subscription and contract integration. The following topics provide you with information that you need to get started. For information about integrating your APIs with Amazon API Gateway, see [Sell your API Gateway APIs through AWS Marketplace](https://docs.aws.amazon.com/apigateway/latest/developerguide/sell-api-as-saas-on-aws-marketplace.html) in the *Amazon API Gateway Developer Guide*. For assistance with your SaaS products, contact the [AWS Marketplace Seller Operations](https://aws.amazon.com/marketplace/management/contact-us/) team. **Topics** + [ # Getting started with SaaS products on AWS Marketplace ](saas-getting-started.md) + [ # Planning your SaaS product ](saas-prepare.md) + [ # SaaS product guidelines for AWS Marketplace ](saas-guidelines.md) + [ # SaaS product pricing in AWS Marketplace ](saas-pricing-models.md) + [ # Creating a SaaS free trial offer in AWS Marketplace ](saas-free-trials.md) + [ # Onboarding customers to your SaaS product through AWS Marketplace ](saas-product-customer-setup.md) + [ # Amazon SNS notifications for SaaS products ](saas-notification.md) + [ # Managing SaaS subscription events with Amazon EventBridge ](saas-eventbridge-integration.md) + [ # Accessing the AWS Marketplace Metering and Entitlement Service APIs ](saas-integration-metering-and-entitlement-apis.md) + [ # Reporting for SaaS products on AWS Marketplace ](saas-reporting.md) + [ # Code examples for SaaS product integration ](saas-code-examples.md) + [ # Delivering your products through a Amazon VPC using AWS PrivateLink ](privatelink.md) + [ # Troubleshooting SaaS products ](troubleshoot-saas.md) # Getting started with SaaS products on AWS Marketplace Getting started with SaaS products As an AWS Marketplace seller, you can add your software as a service (SaaS) product to AWS Marketplace. This includes integrating your SaaS product with the appropriate AWS Marketplace API operations, based on the SaaS product's billing model. This topic provides an overview of the process for creating and configuring SaaS products, starting with the necessary prerequisites that you need to get started. ## Prerequisites Before you get started, you must complete the following prerequisites: 1. Access and use the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management/). This is the tool that you use to register as a seller and manage the products that you sell in AWS Marketplace. For more information, see [AWS Marketplace Management Portal](user-guide-for-sellers.md#aws-marketplace-management-portal). 1. Register as a seller, and submit your tax and banking information. For more information, see [Registration process](registration-process.md). 1. Plan how you'll create and integrate your SaaS product in AWS Marketplace. For more information, see [Planning your SaaS product](saas-prepare.md). ## Next steps After you complete the required prerequisites, you can create and configure your SaaS product. **Topics** + [ ## Prerequisites ](#saas-prereqs) + [ ## Next steps ](#saas-next-steps) + [ # SaaS product lifecycle in AWS Marketplace ](saas-product-lifecycle.md) + [ # Creating a SaaS product in AWS Marketplace ](saas-create-product.md) + [ # Creating an initial SaaS product page on AWS Marketplace ](saas-create-product-page.md) + [ # Configuring SaaS product settings in AWS Marketplace ](saas-product-settings.md) + [ # Integrating your SaaS subscription or Pay-As-You-Go product with AWS Marketplace ](saas-integrate-subscription.md) + [ # Integrating your SaaS contract product with AWS Marketplace ](saas-integrate-contract.md) + [ # Integrating your SaaS contract-based product with AWS Marketplace ](saas-integrate-contract-with-pay.md) + [ # Deploying a serverless SaaS integration ](deploy-serverless-saas.md) # SaaS product lifecycle in AWS Marketplace SaaS product lifecycle When you create a software as a service (SaaS) product in AWS Marketplace, it's initially published with limited visibility so that only your account can access it. When you're ready, you can publish it to the AWS Marketplace catalog to allow buyers to subscribe and purchase your product. The following topic provides information about the SaaS product lifecycle. For more information about creating a SaaS product, see [Creating a SaaS product in AWS Marketplace](saas-create-product.md), On the SaaS product page, you can view the list of your products. Depending on its stage in the product lifecycle, the product will have one of the following statuses: + **Staging** – An incomplete product for which you're still adding information. At the first **Save and exit** from the self-service experience, the successful change request creates an unpublished product with information from the completed steps that you submitted. From this status, you can continue adding information to the product or change already submitted details through change requests. + **Limited** – A product is complete after it is submitted to the system and passes all validation in the system. Then the product is released to a **Limited** status. At this point, the product has a detail page that is only accessible to your account and whoever you have allowlisted. You can test your product through the detail page. For more information or help, contact the [AWS Marketplace Seller Operations](https://aws.amazon.com/marketplace/management/contact-us/) team. + **Public** – When you're ready to publish the product so that buyers can view and subscribe to the product, you use the **Update visibility** change request. This request initiates a workflow for the AWS Marketplace Seller Operations team to review and audit your product against AWS policies. After the product is approved and the change request is processed, the product is moved from a status of **Limited** to **Public**. For information about AWS guidelines, see [SaaS product guidelines](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-guidelines.html). + **Restricted** – If you want to stop new users from subscribing to your product, you can restrict the product by using the **Update visibility** change request. A **Restricted** status means that existing users can continue to use the product. However, the product will no longer be visible to the public or be available to new users. You can update your product at the **Staging**, **Limited**, and **Public** statuses. For more information, see [Updating product information](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-product-settings.html#update-product-information). # Creating a SaaS product in AWS Marketplace Creating a SaaS product As an AWS Marketplace seller, you can add your software as a service (SaaS) product to AWS Marketplace. This includes creating your SaaS product and integrating it with the appropriate AWS Marketplace API operations, based on your billing model. To sell software as a SaaS products in AWS Marketplace, you follow these broad steps: + Create the SaaS product in AWS Marketplace. + Integrate the SaaS [subscription](saas-integrate-subscription.md), [contract](saas-integrate-contract.md), or [contract with pay-as-you-go](saas-integrate-contract-with-pay.md) product with AWS Marketplace. + Test the [subscription](saas-integrate-subscription.md#saas-subscription-integration-testing), [contract](saas-integrate-contract.md#saas-contract-integration-testing), or [contract with pay-as-you-go](saas-integrate-contract-with-pay.md#saas-contract-consumption-integration-testing) product's integration with AWS Marketplace. + Submit your product for launch. The following procedure shows you how to create a SaaS product in AWS Marketplace. ## Create a SaaS product **To create a SaaS product** 1. **Decide to list a SaaS product** Have a SaaS product that you would like to sell in AWS Marketplace. Review and understand how to [Planning your SaaS product](saas-prepare.md). 1. **Determine pricing and offer type** There are three offer types for SaaS products: subscriptions, contracts, and contracts with pay-as-you-go. Your choice of offer type affects how you integrate your SaaS product with AWS Marketplace. For more information, see [Plan your pricing](saas-prepare.md#plan-pricing). 1. **Collect assets** Collect the assets needed to submit your product. Assets include: + Product logo URL – A publicly accessible Amazon S3 URL that contains a clear image of the logo for the product that you're providing. + End User License Agreement (EULA) URL – Your product must have a EULA that's available as a PDF file. You must provide a link to an Amazon S3 bucket where customers can review the EULA on your product's AWS Marketplace page. + Product registration URL – This is the URL where buyers are redirected after successfully subscribing to your product in AWS Marketplace. + Metadata about your product – You provide the metadata in the product creation wizard of the AWS Marketplace Management Portal. + Support information for your product – This information includes email addresses and URLs for your product's support channels. 1. **Submit your product for integration** Use your seller account and the AWS Marketplace Management Portal to [Creating an initial SaaS product page on AWS Marketplace](saas-create-product-page.md). AWS Marketplace will publish your product as a limited product, which means that it's only available to use for integration and testing. Your product code and Amazon EventBridge event configuration will be available to you on the product overview page. **Note** Your product must remain at a reduced price so you and the AWS Marketplace Seller Operations team can test your product without incurring a large cost. We'll ask you for the product’s actual price when you request public visibility for your product. 1. **Integrate with AWS Marketplace** Your product must support customers onboarding and using your product, including validating their subscription before giving them access, and, in some cases, metering for their usage. How you integrate with AWS Marketplace depends on the offer type you're using for your product. For more information about integration, based on offer type, see the following topics: + [ Subscription integration](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-integrate-subscription.html) + [ Contract integration](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-integrate-contract.html) + [ Contract with pay-as-you-go integration](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-integrate-contract-with-pay.html) The final step of integrating your product with AWS Marketplace is to test it to ensure that the integration works properly. 1. **Product testing and contract cancellation** After you have completed the integration process, we recommend that you subscribe to your own product to evaluate and confirm the customer experience. Creating a test subscription allows you to: + Review product information + Examine available purchase options + Process test payments + Verify links to your own product website **Important** Cancel your pay-as-you-go subscription before changing your product's visibility from limited to public by following the instructions at [Canceling your SaaS subscription](https://docs.aws.amazon.com/marketplace/latest/buyerguide/cancel-subscription.html#cancel-saas-subscription). To cancel contract, contact the AWS Marketplace Seller Operations team by [submitting a support ticket](https://aws.amazon.com/marketplace/management/contact-us/). 1. **Submit your product for launch** After you verify your integration and you’re ready for the product to be live, choose **Update visibility**. The AWS Marketplace Seller Operations team will review your product and update the price before the visibility can be updated to Public. **Note** AWS Marketplace Seller Operations uses a manual process to verify and update SaaS products. The process takes 7–10 business days to update visibility to public, and longer if the team finds errors. For more information about timing, see [Timing and expectations](https://docs.aws.amazon.com/marketplace/latest/userguide/product-submission.html#timing-and-expectations) in this guide. # Creating an initial SaaS product page on AWS Marketplace Creating an initial SaaS product page You can use your software as a service (SaaS) application metadata to create an initial SaaS product page in the AWS Marketplace catalog, using the AWS Marketplace Management Portal. You can then also add product information, product deployment details, and public offer details. Optionally, you can add accounts to the allowlist to test the product. For more information see the following procedure. **To create an initial SaaS product page** 1. Sign in to the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management/homepage). 1. Choose **Create SaaS product**, and then choose **SaaS product**. 1. Generate a SaaS product ID and code. You can also add optional tags to support tag-based authorization. **Note** For information about tag-based authorization, see [Controlling access to AWS resources using tags](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-resources) in the *AWS Identity and Access Management User Guide*. 1. Use the self-service experience to create the AWS Marketplace listing. Add product information, product deployment details, and public offer details. Optionally, you can also add accounts to the allowlist to test the product. **Note** If you need to end your session before finishing the steps, choose the **Save and exit** option to save your current selections to the staging area. This option creates a request to validate the information that you provided. While your request is being validated, you can't edit the product. If your request is successful, you can continue creating your product by choosing **Resume product creation**. If your request isn't successful, it's because of a validation error, which is visible on the product request log. Select the request to view the error, and choose **Copy to new** under **Actions** to correct the error and resubmit the request. To update previous steps, open the product detail page and submit a change request. **Note** For products using non-free pricing models (contract, usage, or contract with consumption), your price will default to \$10.001 per dimension during testing. This price allows you to test your product in the **Limited** state without incurring a large bill. For products using the Free pricing model, dimensions will default to \$10.00. For non-free pricing models, you'll provide your actual price when making your product public. Note that if all dimensions are set to \$10.00, the product will automatically convert to the Free pricing model. 1. Choose **Submit**. Then, AWS Marketplace validates the information. If the validation succeeds, AWS Marketplace releases the product in a **Limited** status. After the validation succeeds, you can preview, integrate, and test your product. **Note** While the validation is in progress, you can't edit the product. When your product is initially published, it's only accessible for the AWS account used to create the product and the AWS Marketplace Seller Operations team's test account. If you view the product from the **SaaS products** page, you can choose **View on AWS Marketplace** to view the product details as they will appear in AWS Marketplace for buyers. This detail listing isn't visible to other AWS Marketplace users. # Configuring SaaS product settings in AWS Marketplace Configuring SaaS product settings After you [create a software as a service (SaaS) product](saas-create-product.md) in AWS Marketplace, you can modify many of the product settings. The following sections show you how to submit change requests and modify product settings, such as updating pricing details, product visibility, and other settings. **Topics** + [ ## Manage change requests ](#create-change-request) + [ ## Update product information ](#update-product-information) + [ ## Update architecture details ](#updating-architecture-details) + [ ## Update the allowlist of AWS account IDs ](#update-allowlist) + [ ## Update product visibility ](#saas-update-visibility) + [ ## Update pricing terms ](#saas-update-pricing-terms) + [ ## Add pricing dimensions ](#saas-add-pricing-dimensions) + [ ## Update pricing dimensions ](#saas-update-dimension) + [ ## Restrict pricing dimensions ](#restrict-pricing-dimensions) + [ ## Determine how buyers will access your product ](#configure-product-access) + [ ## Configure Quick Launch ](#saas-quick-launch) + [ ## Update availability by country ](#saas-availability-by-country) + [ ## Update the refund policy of a product ](#update-refund-policy) + [ ## Update the end user license agreement (EULA) ](#saas-update-eula) ## Manage change requests In a [self-service listing](saas-create-product.md#saas-creating-self-service), you use a *change request* to make changes to your product. Your current requests can be found on the AWS Marketplace Management Portal on the [**Requests** tab](https://aws.amazon.com/marketplace/management/requests). You can make new requests through the **Request changes** dropdown list that is located under the navigation bar. **To create a change request for a SaaS product** 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management), and sign in to your seller account. 1. From the **Products** tab, select **SaaS** from the dropdown list. 1. After the request is submitted, it begins processing. The change request goes through the following statuses: **Under review**, **Preparing changes**, and **Applying changes**. 1. When the request's processing is completed, its status changes to one of the following values: + **Succeeded** – This status indicates that your requested change was processed and changes are reflected in the system. + **Failed** – This status indicates that something went wrong with the request and the changes were not processed. If the status is **Failed**, you can select the request to find **Error Codes** that provide recommendations on how to correct the issue. You can troubleshoot the errors and create a new request for the change. To make the process faster, you can use a **Copy to new request** function which copies the details of the **Failed** request. You can make needed changes and resubmit the request. Change requests that start with an update will load the current details of the project. Then, you can make updates, which overwrite the existing details. Add and restrict request pairs are specifically for updates that are provisioned after each request succeeds (after you choose **Save and exit** and **Submit** actions in the self-service experience). This means existing subscribers can continue to use the product until their subscription or contract ends. However, no new subscribers can be added to a product that is in a **Restricted** status. ## Update product information After you create your product, you might want to change the information associated with it in AWS Marketplace. 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management), and sign in to your seller account. 1. From the [SaaS Products](https://aws.amazon.com/marketplace/management/products/saas) page, on the **SaaS products** tab, select the product that you want to modify. 1. From the **Request changes** dropdown list, choose **Update product information**. 1. Update any of the following fields that you want to change: + **Product title** + **SKU** + **Short description** + **Long description** + **Product logo URL** + **Highlights** + **Product categories** + **Keywords** + **Product video URL** + **Resources** + **Support information** **Note** For details about the logo format, see [Company and product logo requirements](https://docs.aws.amazon.com/marketplace/latest/userguide/product-submission.html#seller-and-product-logos). 1. To update the product information, choose **Submit**. 1. Verify that the request appears on the **Requests** tab with the **Under review** status. You might need to refresh the page to see your new request. ## Update architecture details To receive the special designation that your product is deployed on AWS, update your product's architecture details in the AWS Marketplace Management Portal (AMMP) by selecting a hosting pattern and uploading an architecture diagram. For list of hosting patterns that AWS considers deployed on AWS, see [Guidelines](saas-guidelines.md#march-saas-guidelines). **To update architecture details** 1. Sign into the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management). 1. On the **Products** menu, choose **SaaS**. 1. In the **SaaS products** table, choose your product. 1. For **Request changes**, choose **Update architecture details**. 1. Choose a hosting pattern. If you select a hosting pattern that AWS Marketplace considers deployed on AWS, complete the following two additional steps. For more information about patterns considered deployed on AWS, see [Guidelines](saas-guidelines.md#march-saas-guidelines), previously in this guide. 1. If prompted, in the **Architecture diagram** section, choose **Choose file** to upload your architecture diagram in PNG or JPG format. For more information about diagrams, see [Creating architecture diagrams](saas-guidelines.md#arch-diagram). 1. If prompted, in the **Application plane**, choose where your application runs. For more information, see [Control plane vs. application plane](https://docs.aws.amazon.com//whitepapers/latest/saas-architecture-fundamentals/control-plane-vs.-application-plane.html). 1. Choose **Update architecuture details**. Once the request completes, **Request status** changes to **Succeeded**. To check request status, choose your product in the **SaaS products** table and choose the **Request log** tab. To view your assessment results, choose your product in the **SaaS products** table and choose the **Architecture details** tab. ## Update the allowlist of AWS account IDs You can change the list of AWS account IDs that can view your product in a limited state. 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management), and sign in to your seller account. 1. From the [SaaS products](https://aws.amazon.com/marketplace/management/products/saas) page, on the **SaaS products** tab, select the product that you want to modify. 1. From the **Request changes** dropdown list, select **Update allowlist**. A list shows the AWS account IDs that are currently allowlisted. 1. In the **Allowlisted AWS accounts** field, enter the AWS account IDs and separate them using a comma. 1. To update the allowlist of AWS account IDs, choose **Submit**. ## Update product visibility To change which buyers can view your Quick Launch experience in AWS Marketplace, you can use **Update visibility**. 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management), and sign in to your seller account. 1. From the [SaaS products](https://console.aws.amazon.com/marketplace/latest/userguide/saas-guidelines.html) page, select the product that you want to modify. 1. From the **Request changes** dropdown, choose **Update visibility**. **Note** You can request that the product be moved from a **Limited** status to a **Public** status by using this change request. However, the change request must go through an AWS Marketplace Seller Operations team approval process to be moved to **Public**. 1. When you publish to public, you'll provide the actual price for your product. This price will be applied after your listing is approved for public visibility. 1. To submit your request for review, choose **Submit**. 1. Verify that the **Requests** tab shows the **Request status** as **Under review**. When the request completes, the status becomes **Succeeded**. ## Update pricing terms To change the pricing per dimension on your SaaS product, use **Update pricing terms**. **Note** A pricing increase for any dimension results in the pricing update option being unavailable for at least the next 90 days. If updating both a price decrease and an increase, update the price decrease first. 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management) and sign in to your seller account. 1. From the [SaaS Products](https://aws.amazon.com/marketplace/management/products/saas) page, on the **SaaS products** tab, select the product that you want to modify. 1. From the **Request changes** dropdown list, select **Update public offers**, and then select **Update pricing terms**. 1. Current pricing is pre-filled in the fields. You can delete the current price, and then add your new price. 1. To submit your request for review, choose **Submit**. 1. Verify that the **Requests** tab shows the **Request status** as **Under review**. When the request completes, the status will update to **Succeeded** or **Failed**. ## Add pricing dimensions You can add a dimension that you want to use to charge your product. A dimension is the foundational unit of measure that your buyer is charged for when using your product. **Note** To update the name or description of an existing pricing dimension, see [Update pricing dimensions](#saas-update-dimension). 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management), and sign in to your seller account. 1. From the [SaaS Products](https://aws.amazon.com/marketplace/management/products/saas) tab, select the product that you want to modify. 1. From the **Request changes** dropdown, choose **Update pricing dimensions** and then **Add pricing dimensions**. 1. Provide a dimension API identifier, display name, and description to add a new dimension to your product, and then choose **Next**. **Note** The API identifier and name must be unique across all dimensions. You can't change the API identifier and unit after the dimension is created. 1. Define the prices for each dimension you've added, and then choose **Next** to review your changes. **Note** You can only add dimensions for the pricing model selected for your product (for example, contract, usage, contract with consumption, or Free). For limited products using non-free pricing models, the prices for the newly added dimensions are set to \$10.01. For products using the Free pricing model, newly added dimensions must be set to \$10.00. For non-free pricing models, you can update the prices when the product is ready for public visibility. If all dimensions are set to \$10.00, the product will automatically convert to the Free pricing model. 1. Choose **Submit** to submit your request for review. 1. In the **Requests** tab, verify that the request status is **Under review**. When the request is complete, the status changes to **Succeeded**. ## Update pricing dimensions You can update a dimension that you want to use to charge your product. A dimension is the foundational unit of measure that your buyer is charged for when using your product. 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management), and sign in to your seller account. 1. From the [SaaS Products](https://aws.amazon.com/marketplace/management/products/saas) tab, select the product that you want to modify. 1. From the **Request changes** dropdown, choose **Update pricing dimensions** and then **Update dimension information**. 1. Find the dimension you want to update, and then choose the name or description. 1. Provide the new name or description, and then choose the **checkmark** to confirm your update. The dimension name must be unique. 1. Choose **Submit** to submit your request for review. 1. In the **Requests** tab, verify that the request status is **Under review**. When the request is complete, the status will change to **Succeeded**. ## Restrict pricing dimensions You can restrict a dimension that is currently listed in the product. This request removes the selected dimension from the product. 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management), and sign in to your seller account. 1. From the [SaaS Products](https://aws.amazon.com/marketplace/management/products/saas) tab, select the product that you want to modify. 1. From the **Request changes** dropdown, choose **Update pricing dimensions** and then **Restrict pricing dimensions**. 1. For limited and public products, you'll be prompted to contact the AWS Marketplace Seller Operations team using the **[Contact Us](https://aws.amazon.com/marketplace/management/contact-us/)** button. Using the form, provide details for the dimensions you want to remove from your product listing. **Note** Operations may not always be able to restrict pricing dimensions. ## Determine how buyers will access your product You can choose one of the following options for how customers can access your product: + [Update the SaaS URL fulfillment option](#update-fulfillment-options) – Customers use a URL for the site that they are redirected to after subscribing to your product in AWS Marketplace. + [Configure Quick Launch](#saas-quick-launch) – Customers use a simplified process to configure and launch your product. You can complete this configuration for existing products with either Limited or Public visibility. ### Update the SaaS URL fulfillment option To update the URL that is used to fulfill your SaaS product, use the **Update fulfillment options** tab. 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management), and sign in to your seller account. 1. From the [SaaS Products](https://aws.amazon.com/marketplace/management/products/saas) page, on the **SaaS products** tab, choose the product that you want to modify. 1. From the **Request changes** dropdown list, choose **Update fulfillment options**, and then choose **Edit default fulfillment URL**. 1. In the **Fulfillment URL** field, enter the new URL for the SaaS product fulfillment option. 1. To submit your request for review, choose **Submit**. 1. Verify that the **Requests** tab shows the **Request status** as **Under review**. When the request completes, the status will update to **Succeeded** or **Failed**. ## Configure Quick Launch SaaS products listed in AWS Marketplace often require AWS resources to be deployed in the subscribing buyer's account (for example, IAM roles). Quick Launch allows you to provide your buyers with guided, step-by-step instructions and resource deployment using CloudFormation templates. Buyers use the CloudFormation templates to configure and launch products. To learn more about the Quick Launch configuration process, see the [Enable SaaS Quick Launch](https://catalog.workshops.aws/mpseller/en-US/saas/quick-launch-integration) lab. To configure a Quick Launch experience that customers can use to launch your SaaS product, use the **Fulfillment options** tab. 1. From the [SaaS Products](https://aws.amazon.com/marketplace/management/products/saas) page, on the **SaaS products** tab, select the product that you want to modify. **Note** To configure the Quick Launch experience, the product must have either Limited or Public visibility. 1. On the product detail page, choose the **Fulfillment options** tab. 1. For **Quick Launch**, choose the **Activate and configure** button. 1. For **Account login details**, provide a URL for your site where the buyer can log in or create an account. This URL opens a new tab in the buyer experience. Buyers then log in or create an account and return to AWS Marketplace to launch the template. 1. Create an CloudFormation template. **Tip** Follow the AWS Well-Architected Framework when creating your AWS CloudFormation template that deploys resources into the buyer's AWS account. For more information and resources, [AWS Well-Architected](https://aws.amazon.com/architecture/well-architected/) and read the [AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html). For **CloudFormation template**, choose the **Add CloudFormation template** button and provide the following information: + **Title** – Provide the name of your CloudFormation deployment. + **Description** – Provide a description of the template. + **Stack name** – Provide a name for the stack. This name is the stack name for the buyer in CloudFormation. + **CloudFormation template URL** – Provide the Amazon Simple Storage Service will review this template. **Note** To simplify the launch process for your customers, we suggest minimizing the number of templates that are associated with your configuration process. Ideally, you want one template that deploys the resources needed to use the product. For questions related to your CloudFormation template, contact your AWS Marketplace business development partner or the [AWS Marketplace Seller Operations](https://aws.amazon.com/marketplace/management/contact-us/) team. + **Required IAM permissions** – Provide the permissions that are required to deploy the CloudFormation template. If you want to share deployment parameters, which are stored as secrets in [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html) for the buyer, your policy must include the following actions: + `secretsManager:ListSecrets` + `secretsManager:DescribeSecret` + `secretsManager:ReplicateSecretToRegions` + `secretsManager:GetSecretValue` **Note** If your product requires seller-provided CloudFormation deployment parameters (for example, API keys and [external IDs](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html)), use the `PutDeploymentParameter` operation to share the parameter with your customers. For more information, see [https://docs.aws.amazon.com/marketplace-deployment/latest/api-reference/API_PutDeploymentParameter.html](https://docs.aws.amazon.com/marketplace-deployment/latest/api-reference/API_PutDeploymentParameter.html) in the *AWS Marketplace Deployment Service API Reference*. 1. (Optional) For **Manual configuration instructions**, provide instructions for buyers who want to configure your product manually. Consider including links to your product's onboarding guide and documentation. 1. For **Launch details**, provide the URL where buyers will access the product after the CloudFormation stack has been deployed. 1. (Optional) For **Allowlisted accounts for Quick Launch**, provide a comma-separated list of AWS accounts that can view the Quick Launch experience with Limited visibility. 1. Choose the **Submit** button. The Quick Launch experience will have Limited visibility, meaning it will only be visible to your account and allowlisted accounts. With Limited visibility, you can test your configuration using the **Configure and launch** page after subscribing to your product and choosing the **Set up your account** button. + To preview the page from the buyer's perspective, choose **Preview**. Your configuration changes will reflect on the preview while both pages are open. 1. When you're ready, you can publish the Quick Launch experience in the AWS Marketplace catalog. Use the **Update Quick Launch visibility** button on the **Fulfillment options** tab on the product detail page. When you change the visibility to Public, the AWS Marketplace Seller Operations team will review the configuration, conduct buyer testing, and publish the experience. **Note** If you need support as you enable the Quick Launch experience, contact the [AWS Marketplace Seller Operations](https://aws.amazon.com/marketplace/management/contact-us/) team. ## Update availability by country You can define the countries in which your product can be offered. 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management), and sign in to your seller account. 1. From the [SaaS Products](https://aws.amazon.com/marketplace/management/products/saas) tab, select the product that you want to modify. 1. From the **Request changes** dropdown, select **Update public offer** and then choose **Update availability by country**. 1. Choose one of the following options: + All countries – Available in all supported countries. + All countries with exclusions – Available in all supported countries except in selected countries. + Allowlisted countries only – Specific list of countries where the product is available. 1. Choose **Submit** to submit your request for review. 1. In the **Requests** tab, verify that the request status is **Under review**. When the request is complete, the status will change to **Succeeded**. ## Update the refund policy of a product You can update the refund policy for your product by using **Update refund policy**. 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management), and sign in to your seller account. 1. From the [SaaS Products](https://aws.amazon.com/marketplace/management/products/saas) page, on the **SaaS products** tab, select the product that you want to modify. 1. From the **Request changes** dropdown list, select **Update public offer**, and then select **Update refund policy**. 1. The current refund policy details are provided in the text box. Review and modify the details as you want. Submitting the request overwrites the current refund policy. 1. To submit your request for review, choose **Submit**. 1. Verify that the **Requests** tab shows the **Request status** as **Under review**. When the request completes, the status will update to **Succeeded** or **Failed**. ## Update the end user license agreement (EULA) You can update your EULA for new users subscribing to your product. 1. Open the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management), and sign in to your seller account. 1. From the [SaaS Products](https://aws.amazon.com/marketplace/management/products/saas) tab, select the product that you want to modify. 1. From the **Request changes** dropdown, choose **Update public offer** and then **Update EULA**. 1. You can choose the [Standard Contract for AWS Marketplace (SCMP)](https://docs.aws.amazon.com/marketplace/latest/userguide/standardized-license-terms.html) or submit a custom EULA. For a custom EULA, you must provide an Amazon Simple Storage Service (Amazon S3) URL for the contract. Your Amazon S3 bucket must be publicly accessible. 1. Choose **Submit** to submit your request for review. 1. In the **Requests** tab, verify that the request status is **Under review**. When the request is complete, the status will change to **Succeeded**. # Integrating your SaaS subscription or Pay-As-You-Go product with AWS Marketplace Integrating your SaaS subscription or Pay-As-You-Go product **Integration requirements changing June 1, 2026 for new SaaS products** AWS Marketplace is introducing support for Concurrent Agreements, enabling multiple purchases of the same product on a single AWS account during the same agreement period. Starting June 1, 2026, all new SaaS products will be required to support updated integration requirements. [Review the new integration for Concurrent Agreements](https://catalog.workshops.aws/mpseller/en-US/saas/integration-for-concurrent-agreements). Integrating your product with AWS Marketplace is one step in [Creating a SaaS product in AWS Marketplace](saas-create-product.md). To integrate your software as a service (SaaS) subscription product with AWS Marketplace, you must write code and demonstrate that it can respond successfully to several customer scenarios. The following sections show you how to integrate your SaaS subscription model with AWS Marketplace. **Important** This guide is for *Pay-As-You-Go (PAYG)* SaaS products. If you are implementing a *contract-based* SaaS product, use [Integrating your SaaS contract-based product with AWS Marketplace](saas-integrate-contract-with-pay.md) instead. PAYG products do not use entitlement SNS topics or the GetEntitlements API. **Note** Before you begin, make sure you've chosen the right pricing model for your software-as-a-service (SaaS) product in AWS Marketplace. For more information, see [Planning your SaaS product](saas-prepare.md). **Topics** + [ ## Scenario: Your service validates new customers ](#saas-subscription-validate-customer) + [ ## Scenario: Meter usage ](#saas-subscription-meter-usage) + [ ## Scenario: Monitor changes to user subscriptions ](#saas-subscription-monitor-changes) + [ ## Scenario: Verify customer subscription ](#saas-subscription-verify-subscriptions) + [ ## Testing your SaaS subscription product integration ](#saas-subscription-integration-testing) ## Scenario: Your service validates new customers When a customer subscribes to your product, they are redirected to your registration URL which is an HTTP POST request with a temporary `x-amzn-marketplace-token` token. Respond to this request in the following ways: 1. Exchange the token for a `CustomerIdentifier`, `CustomerAWSAccountId`, `LicenseArn`, and `ProductCode` by calling the `[ResolveCustomer](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_ResolveCustomer.html)` API operation in the AWS Marketplace Metering Service. 1. Persist the `CustomerIdentifier`, `CustomerAWSAccountId`, `LicenseArn`, and `ProductCode` in your system for future calls. You must store whether the customer has a valid subscription, along with whatever information you need about the customer. 1. As a response to the request, you must show your user's first use experience (as applicable for your service). ## Scenario: Meter usage When the customer starts to use your service, you must send metering records hourly. For details on how to meter, see [Configuring metering for usage with SaaS subscriptions](metering-for-usage.md). We recommend that you use AWS CloudTrail to monitor activity to ensure that billing information is being sent to AWS. Keep the following in mind when sending metering records: + Metering requests are de-duplicated on the hour. + Records sent every hour are cumulative. + We strongly recommend as a best practice that, even if there were no records in the last hour, you send metering records every hour, with usage of 0. ## Scenario: Monitor changes to user subscriptions Set up an Amazon Simple Queue Service (Amazon SQS) queue, and subscribe to your product's Amazon SNS topic. Your SNS topic information was included in the email message that you received from the AWS Marketplace Seller Operations team when you created your product. For more information, see [Creating a SaaS product in AWS Marketplace](saas-create-product.md). By subscribing to your SNS topic, you receive notifications about changes to customer subscriptions, including providing or revoking access for specific customers. **Note** An Amazon SNS topic Amazon Resource Name (ARN) looks like `arn:aws:sns:us-east-1::aws-mp-subscription-notification-`. The notifications that you must respond to are: + `subscribe-success` – The customer is subscribed, and you can successfully meter against their customer ID. + `unsubscribe-pending` – The customer is in the process of unsubscribing. You should send any last metering records. + `unsubscribe-success` – The customer has unsubscribed. Metering records for the customer will no longer be accepted. Follow your practices for shutting down customer resources, adhering to your retention policies. + `subscribe-fail` – The customer subscription failed. You should not meter against their customer ID or create resources on behalf of the customer. ## Scenario: Verify customer subscription Before creating resources on the customer's behalf, verify that the customer should have access to your product. Store the latest status of the customer from the notifications you receive via Amazon SQS to know if the customer has access. ## Testing your SaaS subscription product integration After you've integrated your SaaS subscription product with AWS Marketplace, you must conduct in-depth testing to ensure that the integration is successful. The following procedure outlines the steps to verify your product integration. **Note** Use your own accounts to subscribe to your product and test that the integration is successful. Prices can be temporarily reduced so that you can test the purchase flow without incurring high charges in those accounts. For more information about temporarily reducing the prices or allowing additional test accounts to access your product, contact the [AWS Marketplace Seller Operations](https://aws.amazon.com/marketplace/management/contact-us/) team. After your product is launched, the service must continue to respond to these scenarios for new customers. 1. Use an allowed account to test the customer experience by subscribing to your product. 1. After you've subscribed with the allowed account, ensure that the account is redirected to the registration URL, and that the redirect is a POST request that includes a temporary token. Make sure that your application persists the customer ID for future calls. This tests part of [Scenario: Your service validates new customers](#saas-subscription-validate-customer). 1. After verifying the test account in the previous step, onboard the account into your application. For example, you can have the test customer fill out a form to create a new user. Or, provide them with other next steps to get access to your SaaS application. This tests part of [Scenario: Your service validates new customers](#saas-subscription-validate-customer). 1. After the test customer is onboarded, make requests that will send metering records to AWS for billing purposes by using the `BatchMeterUsage` API operation in the AWS Marketplace Metering Service. This tests [Scenario: Meter usage](#saas-subscription-meter-usage). 1. Test for subscription changes. Possible scenarios include unsubscribes, successful subscriptions, and failed subscriptions. This tests [Scenario: Monitor changes to user subscriptions](#saas-subscription-monitor-changes). 1. Verify a successful subscription. After you receive an Amazon SNS notification for your test account with a successful subscription message, metering can begin. Records that are sent to the AWS Marketplace Metering Service before you receive the Amazon SNS notification aren't metered. This tests [Scenario: Verify customer subscription](#saas-subscription-verify-subscriptions). **Note** To prevent billing issues, we strongly recommend programmatically waiting for this notification before launching resources on behalf of your customers. 1. After you have completed all of the integration requirements and tested the solution, notify the AWS Marketplace Seller Operations team. They will run a series of final tests on the solution by verifying that you have successfully sent metered records with the `BatchMeterUsage` API operation. After your integration and testing is complete, you can perform a final review and list your product on the public AWS Marketplace. For more information, see [Creating a SaaS product in AWS Marketplace](saas-create-product.md). # Integrating your SaaS contract product with AWS Marketplace Integrating your SaaS contract product **Integration requirements changing June 1, 2026 for new SaaS products** AWS Marketplace is introducing support for Concurrent Agreements, enabling multiple purchases of the same product on a single AWS account during the same agreement period. Starting June 1, 2026, all new SaaS products will be required to support updated integration requirements. [Review the new integration for Concurrent Agreements](https://catalog.workshops.aws/mpseller/en-US/saas/integration-for-concurrent-agreements). Integrating your software as a service (SaaS) contract product with AWS Marketplace is one step in [Creating a SaaS product in AWS Marketplace](saas-create-product.md). To integrate your software as a service (SaaS) contract product with AWS Marketplace, you must write code and demonstrate that it can respond successfully to several customer scenarios. The following sections describe these scenarios, explain how to respond to them, and provide an overview of testing your integration. **Note** Before you begin, make sure you've chosen the right pricing model for your software as a service (SaaS) product in AWS Marketplace. For more information, see [Planning your SaaS product](saas-prepare.md). **Topics** + [ ## Scenario: Your service validates new customers ](#saas-contract-validate-customer) + [ ## Scenario: Your service handles customer requests ](#saas-contract-customer-requests) + [ ## Scenario: Monitor changes to user subscriptions ](#saas-contract-monitor-changes) + [ ## Testing your SaaS contract product integration ](#saas-contract-integration-testing) ## Scenario: Your service validates new customers When a customer subscribes to your product, they are redirected to your registration URL, which is an HTTP POST request with a temporary `x-amzn-marketplace-token` token. Respond to this request in the following ways: 1. Exchange the token for a `CustomerIdentifier`, `CustomerAWSAccountId`, `LicenseArn`, and `ProductCode` by calling the `[ ResolveCustomer](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_ResolveCustomer.html)` API operation in the AWS Marketplace Metering Service**. 1. Verify the subscription and quantity (if applicable) the customer has access to by calling the `[ GetEntitlements](https://docs.aws.amazon.com/marketplaceentitlement/latest/APIReference/API_GetEntitlements.html)` API operation in the AWS Marketplace Entitlement Service. 1. Persist the `CustomerIdentifier`, `CustomerAWSAccountId`, `LicenseArn`, and `ProductCode` in your system for future calls. Store whether the customer has a valid subscription, along with whatever information you need about the customer. 1. As a response to the request, you must show your user's first use experience (as applicable for your service). ## Scenario: Your service handles customer requests When a customer makes a request to your service, you must respond to the following scenarios with appropriate actions or messaging: + They don't have a customer ID in your system. This means that they have not yet subscribed. You should tell the user how to subscribe. + They have a customer ID, and the `GetEntitlements` API operation returns an appropriate entitlement. In this scenario, you should fulfill the request. + They do have a customer ID, but the `GetEntitlements` API operation returns no entitlement, or not enough quantity to fulfill the request. In this scenario, you must determine how to handle access and manage their experience. ## Scenario: Monitor changes to user subscriptions **Important** SNS notifications for AWS Marketplace SaaS products are being replaced with Amazon EventBridge notifications. If you have existing SaaS products integrated with SNS, they will continue to function. New listings will eventually transition to using Amazon EventBridge instead of SNS. For more information, see [Managing SaaS subscription events with Amazon EventBridge](saas-eventbridge-integration.md). Set up an Amazon Simple Queue Service (Amazon SQS) queue as a target for your Amazon EventBridge rules to receive events about changes to customer entitlements. Your Amazon EventBridge event configuration was provided when you created your product. For more information, see [Creating a SaaS product in AWS Marketplace](saas-create-product.md). By configuring Amazon EventBridge rules, you receive events about changes to customer entitlements, including providing or revoking access for specific customers. The only notification that you must respond to is: + License Updated Amazon EventBridge events – The customer entitlement has changed, and you must call the `GetEntitlements` API operation to see the new status. Update your customer store, and, if applicable (for example, the customer's contract has lapsed), follow your practices for shutting down customer resources, adhering to your retention policies. **Note** For additional information, see [Checking entitlements using the AWS Marketplace Entitlement Service](checking-entitlements.md). ## Testing your SaaS contract product integration After you've integrated your SaaS contract product with AWS Marketplace, you must conduct in-depth testing to ensure that the integration is successful. The following procedure outlines the steps to verify your product integration. **Note** Use your own accounts to subscribe to your product and test that the integration is successful. Prices can be temporarily reduced so that you can test the purchase flow without incurring high charges in those accounts. For more information about temporarily reducing the prices or allowing additional test accounts to access your product, [contact us](https://aws.amazon.com/marketplace/management/contact-us/). After your product is launched, the service must continue to respond to these scenarios for new customers. 1. Use an allowed account to test the customer experience by getting a contract for your product. 1. After the account has the contract, ensure that the account is redirected to the registration URL, and that the redirect is a POST request that includes a temporary token. Make sure that your application persists the customer ID for future calls and correctly handles the entitlement the customer has. This tests part of [Scenario: Your service validates new customers](#saas-contract-validate-customer). 1. After verifying the test account in the previous step, onboard the account into your application. For example, you can have the test customer fill out a form to create a new user. Or, provide them with other next steps to get access to your SaaS application. This tests part of [Scenario: Your service validates new customers](#saas-contract-validate-customer). 1. If no entitlement is returned from the `GetEntitlements` API operation, either during onboarding or in your ongoing verification passes, your application must correctly manage access and the experience for users who are not entitled. This tests [Scenario: Your service handles customer requests](#saas-contract-customer-requests). 1. Test for subscription changes. Verify that your application correctly handles unsubscribes, successful subscription, and failed subscription scenarios. This tests [Scenario: Monitor changes to user subscriptions](#saas-contract-monitor-changes). 1. After you have completed all the integration requirements and tested the solution, notify the AWS Marketplace Operations team. They will then test the solution by verifying that you have successfully called the `GetEntitlements` API operation and sufficiently onboarded new customers. After your integration and testing is complete, you can perform a final review and list your product on the public AWS Marketplace. For more information, see [Creating a SaaS product in AWS Marketplace](saas-create-product.md). You can also cancel your test subscription by completing a Refund Request Form. For more information on cancelling a subscription, see the [Requesting a billing adjustment (refund)](refunds.md#refund-process). # Integrating your SaaS contract-based product with AWS Marketplace Integrating your SaaS contract-based product **Integration requirements changing June 1, 2026 for new SaaS products** AWS Marketplace is introducing support for Concurrent Agreements, enabling multiple purchases of the same product on a single AWS account during the same agreement period. Starting June 1, 2026, all new SaaS products will be required to support updated integration requirements. [Review the new integration for Concurrent Agreements](https://catalog.workshops.aws/mpseller/en-US/saas/integration-for-concurrent-agreements). Integrating your product with AWS Marketplace is one step in [Creating a SaaS product in AWS Marketplace](saas-create-product.md). To integrate your software as a service (SaaS) contract product with AWS Marketplace, you must write code and demonstrate that it can respond successfully to several customer scenarios. The following sections describe these scenarios, explain how to respond to them, and provide an overview of testing your integration. **Note** This guide is for *contract-based* SaaS products only. If you are implementing a *Pay-As-You-Go (PAYG)* SaaS product, use [Integrating your SaaS subscription or Pay-As-You-Go product with AWS Marketplace](saas-integrate-subscription.md) instead. PAYG products do not use entitlement SNS topics or the GetEntitlements API. Before you begin, make sure you've chosen the right pricing model for your software as a service (SaaS) product in AWS Marketplace. For more information, see [Planning your SaaS product](saas-prepare.md). **Topics** + [ ## Scenario: Your service validates new customers ](#saas-contract-with-pay-validate-customer) + [ ## Scenario: Your service handles customer requests ](#saas-contract-with-pay-customer-requests) + [ ## Scenario: Meter usage ](#saas-contract-with-pay-meter-usage) + [ ## Scenario: Monitor changes to user entitlements ](#saas-contract-with-pay-monitor-changes) + [ ## Testing your SaaS contract with pay-as-you-go integration ](#saas-contract-consumption-integration-testing) ## Scenario: Your service validates new customers When a customer subscribes to your product, they are redirected to your registration URL, which is an HTTP POST request with a temporary `x-amzn-marketplace-token` token. Respond to this request in the following ways: 1. Exchange the token for a `CustomerIdentifier`, `CustomerAWSAccountId`, `LicenseArn`, and `ProductCode` by calling the `[ ResolveCustomer](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_ResolveCustomer.html)` API operation in the AWS Marketplace Metering Service. 1. Verify the subscription and quantity (if applicable) the customer has access to by calling the `[ GetEntitlements](https://docs.aws.amazon.com/marketplaceentitlement/latest/APIReference/API_GetEntitlements.html)` action in the AWS Marketplace Entitlement Service. 1. Persist the `CustomerIdentifier`, `CustomerAWSAccountId`, `LicenseArn`, and `ProductCode` in your system for future calls. Store whether the customer has a valid subscription, along with whatever information you need about the customer. 1. As a response to the request, you must show your user's first use experience (as applicable for your service). ## Scenario: Your service handles customer requests When a customer makes a request to your service, you must respond to the following scenarios with appropriate actions or messaging: + They don't have a customer ID in your system. This means that they have not yet subscribed. You should give them messaging describing how to subscribe. + They have a customer ID, and the `GetEntitlements` API operation returns an appropriate entitlement. In this scenario, you should fulfill the request. + They do have a customer ID, but the `GetEntitlements` API operation returns no entitlement, or not enough quantity to fulfill the request. In this scenario, you must determine how to handle access and manage their experience. ## Scenario: Meter usage When the customer starts to use your service, you must send metering records hourly. For details on how to meter, see [Configuring metering for usage with SaaS subscriptions](metering-for-usage.md). We recommend that you use AWS CloudTrail to monitor activity to ensure that billing information is being sent to AWS. Keep the following in mind when sending metering records: + Metering requests are de-duplicated on the hour. + Records sent every hour are cumulative. + We strongly recommend as a best practice that, even if there were no records in the last hour, you send metering records every hour, with usage of 0. ## Scenario: Monitor changes to user entitlements Set up an Amazon Simple Queue Service (Amazon SQS) queue, and subscribe to your product's Amazon SNS topics—there are two SNS topics, one for entitlement changes and one for subscription changes. Your topic information was included in the email message that you received from the AWS Marketplace Seller Operations team when you created your product. For more information, see [Creating a SaaS product in AWS Marketplace](saas-create-product.md). By subscribing to your SNS topics, you receive notifications about changes to customer subscriptions, including providing or revoking access for specific customers. **Note** An SNS topic Amazon Resource Name (ARN) for a subscription change looks like `arn:aws:sns:us-east-1::aws-mp-subscription-notification-`. An SNS topic ARN for entitlement changes looks like `arn:aws:sns:us-east-1::aws-mp-entitlement-notification-`. The notifications that you must respond to are as follows: + `entitlement-updated` (in the entitlement SNS topic)– The customer entitlement has changed, and you must call the `GetEntitlements` API operation to see the new status. Update your customer store, and, if applicable (for example, the customer's contract has lapsed), follow your practices for shutting down customer resources, adhering to your retention policies. + `subscribe-success` (in the subscription SNS topic) – The customer is subscribed, and you can successfully meter against their customer ID. + `unsubscribe-pending` (in the subscription SNS topic) – The customer is in the process of unsubscribing. You should send any last metering records. + `unsubscribe-success` (in the subscription SNS topic) – The customer has unsubscribed. Metering records for the customer will no longer be accepted. Follow your practices for shutting down customer resources, adhering to your retention policies. + `subscribe-fail` (in the subscription SNS topic) – The customer subscription failed. You should not meter against their customer ID or enable resources on behalf of the customer. **Note** For additional information, see [Checking entitlements using the AWS Marketplace Entitlement Service](checking-entitlements.md). ## Testing your SaaS contract with pay-as-you-go integration After you've integrated your contract with pay-as-you-go product with AWS Marketplace, you must conduct in-depth testing to ensure that the integration is successful. The following procedure outlines the steps to verify your product integration. **Note** Use your own accounts to subscribe to your product and test that the integration is successful. Prices can be temporarily reduced so that you can test the purchase flow without incurring high charges in those accounts. For more information about temporarily reducing the prices or allowing additional test accounts to access your product, contact the [AWS Marketplace Seller Operations](https://aws.amazon.com/marketplace/management/contact-us/) team. After your product is launched, the service must continue to respond to these scenarios for new customers. 1. Use an allowed account to test the customer experience by getting a contract for your product. 1. After the account has the contract, ensure that the account is redirected to the registration URL, and that the redirect is a POST request that includes a temporary token. Make sure that your application persists the customer ID for future calls and correctly handles the entitlement the customer has. This tests part of [Scenario: Your service validates new customers](#saas-contract-with-pay-validate-customer). 1. After verifying the test account in the previous step, onboard the account into your application. For example, you can have the test customer fill out a form to create a new user. Or, provide them with other next steps to get access to your SaaS application. This tests part of [Scenario: Your service validates new customers](#saas-contract-with-pay-validate-customer). 1. If no entitlement is returned from the `GetEntitlements` API operation, either during onboarding or in your ongoing verification passes, your application must correctly manage access and the experience for users who are not entitled. This tests [Scenario: Your service handles customer requests](#saas-contract-with-pay-customer-requests). 1. After the test customer is onboarded, make requests that will send metering records to AWS for billing purposes by using the `BatchMeterUsage` API operation in the AWS Marketplace Metering Service. This tests [Scenario: Meter usage](#saas-contract-with-pay-meter-usage). 1. Test for subscription changes. Verify that your application correctly handles unsubscribes, successful subscription, and failed subscription scenarios. This tests [Scenario: Monitor changes to user entitlements](#saas-contract-with-pay-monitor-changes). 1. After you have completed all the integration requirements and tested the solution, notify the AWS Marketplace Seller Operations team. They will then test the solution by verifying that you have successfully called the `GetEntitlements` API operation and sufficiently onboarded new customers. They will also verify that you have successfully sent metered records with the `BatchMeterUsage` API operation. After your integration and testing is complete, you can perform a final review and list your product on the public AWS Marketplace. For more information, see [Creating a SaaS product in AWS Marketplace](saas-create-product.md). # Deploying a serverless SaaS integration When you have a SaaS solution that you want to integrate with AWS Marketplace, you can use various architectural approaches for the integration. To help you understand SaaS integration concepts, AWS provides a reference lab that demonstrates one approach using serverless architecture. Access the reference lab: [Integrate your SaaS with the Serverless SaaS Integration reference](https://aws.amazon.com/quickstart/architecture/aws-marketplace-saas/) **Note** This reference implementation is provided for learning and demonstration purposes only. It is not production-ready and should not be used as-is in production environments. Before implementing a similar solution in production, ensure you address security, scalability, monitoring, and compliance requirements specific to your use case. # Planning your SaaS product Before you add your software as a service (SaaS) product to AWS Marketplace, you must first do some planning. This step is critical to the success of your product. A lack of planning can result in billing issues or you might have to re-create your product in AWS Marketplace. The following sections show you how to plan for SaaS product, **Important** Most of your product's settings can’t be changed after you've configured them. If you need to change them after the product is created in AWS Marketplace, you probably need to create a new product with the correct settings. **Topics** + [ ## Plan your pricing ](#plan-pricing) + [ ## Plan your billing integration ](#saas-plan-integration) + [ ## Plan your Amazon SNS integration ](#saas-plan-sns) + [ ## Plan how customers will access your product ](#saas-plan-customer-access) ## Plan your pricing There are three pricing models for SaaS products on AWS Marketplace. Choosing the right pricing model for your product is the most important decision you'll make as you plan your product. Choosing the wrong pricing model can set you back by weeks. The pricing model determines the payment options for your customers and the billing integration code that you need to write, test, and deploy. For information about the different types of pricing models, see [SaaS product pricing](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-pricing-models.html). **Note** All SaaS pricing models support free trials. For more information, see [SaaS free trials](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-free-trials.html). ## Plan your billing integration One of the benefits of having a SaaS product on AWS Marketplace is consolidating billing. In order to take advantage of this benefit, you must integrate with the AWS Marketplace Metering Service or the AWS Marketplace Entitlement Service, depending on your chosen pricing model. These two services help you ensure that your billing and usage reporting is accurate. After you plan your integration, you must test the integration with your product before it goes live. For more information about integration and testing, see [Accessing the AWS Marketplace Metering and Entitlement Service APIs](saas-integration-metering-and-entitlement-apis.md). ## Plan your Amazon SNS integration There are two Amazon Simple Notification Service (Amazon SNS) topics that you can subscribe to for your SaaS product. For more information, see [SaaS notifications](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-notification.html). These messages can help you programmatically handle changes to subscriptions and contracts initiated by AWS or by your customers. Amazon SNS notifications can be programmatic triggers enabling customers to register for a new account on your product registration website. They can also deny customers with expired subscriptions from accessing your product. You have options for how your customers receive notifications depending on how you program the handling of these notifications. ## Plan how customers will access your product This section describes how to make your product accessible to buyers. ### Plan your SaaS product registration website Customers who buy your SaaS product need access to it. You must plan and implement how you want your customers to access the product. SaaS products support the following access options: + Quick Launch + AWS PrivateLink + Your own product website To validate AWS Marketplace customers using your registration website, see [SaaS customer onboarding](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-product-customer-setup.html). #### Using Quick Launch for customers to access your product Use the Quick Launch deployment option to reduce the time and resources that are required for buyers to configure, deploy, and launch your products. Quick Launch reduces the number of sites that buyers must visit during the process. For more information, see [Configure Quick Launch](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-product-settings.html#saas-quick-launch). #### Using AWS PrivateLink for customers to access your SaaS product You can use [Delivering your products through a Amazon VPC using AWS PrivateLink](privatelink.md) to configure your service as an Amazon Virtual Private Cloud (Amazon VPC) endpoint service. Your customers can create a VPC endpoint and access your software across the AWS Cloud virtual network. Alternatively, you can provide access to your software product through a website you own and maintain, with customers creating a connection across the internet. #### Using your own website Your SaaS product is hosted in your environment and it must be accessed over the internet through a public endpoint that you manage and maintain, like a website. Typically, you have a website that customers use to register for your product, sign in to use the product, and access support for your product. # SaaS product guidelines for AWS Marketplace SaaS product guidelines AWS Marketplace maintains the following guidelines for all software as a service (SaaS) products and offerings on AWS Marketplace to promote a safe, secure, and trustworthy platform for our customers. The following sections provide guidelines for SaaS products on AWS Marketplace. All products and their related metadata are reviewed when submitted to ensure that they meet or exceed current AWS Marketplace guidelines. These guidelines are reviewed and adjusted to meet our evolving security requirements. In addition, AWS Marketplace continuously reviews products to verify that they meet any changes to these guidelines. If products fall out of compliance, we might require that you update your product and in some cases your product might temporarily be unavailable to new subscribers until issues are resolved. **Topics** + [ ## Product setup guidelines ](#saas-guidelines-setup) + [ ## Customer information requirements ](#saas-customer-information) + [ ## Product usage guidelines ](#saas-product-usage) + [ ## Architecture guidelines ](#saas-architecture) ## Product setup guidelines All SaaS products must adhere to the following product setup guidelines: + Pricing dimensions cannot be limited to private offers only. Buyers should be able to subscribe to any of the pricing dimensions on public products. + Pricing dimensions must meet the following requirements: + For products using the Free pricing model, all pricing dimensions must be set to \$10.00. + For products using other pricing models (contract, usage, or contract with consumption), at least one pricing dimension must have a price greater than \$10.00. If all dimensions are set to \$10.00, the product will automatically convert to the Free pricing model. + All pricing dimensions must relate to actual software and cannot include any other products or services unrelated to the software. + SaaS products offered exclusively in the AWS GovCloud (US) Regions must include `GovCloud` somewhere in the product title. ## Customer information requirements All SaaS products must adhere to the following customer information requirements: + SaaS products must be billed entirely through the listed dimensions on AWS Marketplace. + You cannot collect customer payment information for your SaaS product at any time, including credit card and bank account information. + The SaaS registration page must include an input field for the buyer's email address. You can include additional fields such as: + Name + ZIP code + Phone number + Company information + Product setup preferences If you plan to use multiple languages, you must provide an English-language view of the registration page. ## Product usage guidelines All SaaS products must adhere to the following product usage guidelines: + After subscribing to the product in AWS Marketplace, customers should be able to create an account within your SaaS application and gain access to a web console. If the customer cannot gain access to the application immediately, you must provide a message with specific instructions on when they will gain access. When an account has been created, the customer must be sent a notification confirming that their account has been created along with clear next steps. + If a customer already has an account in the SaaS application, they must have the ability to log in from the fulfillment landing page. + Customers must be able to see the status of their subscription within the SaaS application, including any relevant contract or subscription usage information. + Customers must be able to easily get help with issues such as: using the application, troubleshooting, and requesting refunds (if applicable). Support contact options must be specified on the fulfillment landing page. + Product software and metadata must not contain language that redirects users to other cloud platforms, additional products, upsell services, or free trial offers that aren't available on AWS Marketplace. For information about free trials for SaaS products, see [Creating a SaaS free trial offer in AWS Marketplace](saas-free-trials.md). + If your product is an add-on to another product or another ISV’s product, your product description must indicate that it extends the functionality of the other product and that without it, your product has very limited utility. For example, *This product extends the functionality of and without it, this product has very limited utility. Please note that might require its own license for full functionality with this listing.* ## Architecture guidelines The following topics list and describe the architecture guidelines for SaaS products. **Topics** + [ ### Guidelines ](#march-saas-guidelines) + [ ### Creating architecture diagrams ](#arch-diagram) ### Guidelines **Note** The following guidelines are effective as of May 1, 2025. + You can publish all SaaS architectures. + Products that are deployed on AWS receive a special designation in the AWS Marketplace search results and their product details pages. For AWS Marketplace to consider your product as "deployed on AWS," your product must run entirely on AWS. This includes the application and control planes. The *application plane* can run in the seller's AWS account, the buyer's AWS account, or both. For more information, refer to the [Control plane vs. application plane](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/control-plane-vs.-application-plane.html) whitepaper. Third-party services used by the product to transmit, store, or process application data—except content delivery networks (CDNs), domain name systems (DNSs), and corporate identity providers (IdPs)—must also run entirely on AWS. **Note** *Application data* is data that belongs to or is generated for the buyer. Agents or gateways used by the product for security, monitoring, data replication, or migration can run on buyer-owned environments outside AWS, including on premises, but must send data only to AWS for storage and analysis. You must include an architecture diagram for review. You cannot make the diagrams public. For more information, see [Creating architecture diagrams](#arch-diagram) in the next section. + Sellers can publish products that do not entirely run on AWS. + Applications that require resources in the buyer's infrastructure must follow these guidelines: + To be considered a SaaS product and not a managed service, your control plane—as defined in the [SaaS Architecture Fundamentals](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/saas-architecture-fundamentals.html) AWS whitepaper—must reside in infrastructure that you manage. For more information, refer to the [SaaS vs. Managed Service Provider](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/saas-vs.-managed-service-provider-msp.html) whitepaper. + In the product description, you must notify customers that if they incur AWS infrastructure charges separate from their AWS Marketplace transaction, they must pay those charges. + You must provision resources in a secure way, such as using the AWS Security Token Service (AWS STS) or AWS Identity and Access Management (IAM). + You must follow the [principle of least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/LeastPrivilege.html) when creating usage instructions or deployment templates that grant permissions to your application. + You must provide additional documentation that describes all provisioned AWS services, IAM policy statements, and how an IAM role or user is deployed and used in the customer's account. + You must provide instructions or deployment templates that enable buyers to deploy the required resources in their AWS accounts. + If you provide CloudFormation templates (CFTs) for deploying resources to the buyer's AWS account, they must comply with [AWS Marketplace policies for CFTs](https://docs.aws.amazon.com/marketplace/latest/userguide/cloudformation.html#aws-cloudformation-template-preparation). You must publish those CFTs as part of your SaaS listing by following the method provided when you enable the [SaaS Quick Launch deployment option](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-product-settings.html#saas-quick-launch) for your buyers. SaaS Quick Launch makes it easier for your buyers to configure your SaaS solution. + If an Amazon Machine Image (AMI) is deployed into the buyer's AWS account, it must comply with the [AMI-based product requirements for AWS Marketplace](product-and-ami-policies.md). You must publish the AMI as a separate AMI-based product in AWS Marketplace and indicate that it's an add-on product as required in the [Product usage policies](product-and-ami-policies.md#product-usage). You can price your AMI-based product as BYOL because it's an extension of your SaaS offering. AWS Marketplace scans AMI-based products for unpatched common vulnerabilities and exposures (CVEs) and security requirements. Your buyers must also subscribe to your AMI-based product before deploying it. + If a container image is deployed into a buyer's AWS account, it must comply with the [Container-based product requirements for AWS Marketplace](container-product-policies.md). You must publish the container image as a separate container-based product in AWS Marketplace and indicate that it's an add-on product as required in the [Product usage requirements](container-product-policies.md#container-usage-requirements). You can price your container-based product as BYOL because it's an extension of your SaaS offering. AWS Marketplace scans container-based products for unpatched common vulnerabilities and exposures (CVEs) and security requirements. Your buyers must also subscribe to your container-based product before deploying it. + Successfully call the AWS Marketplace APIs from the AWS account that registered as a provider and submitted the SaaS publishing request. The SaaS pricing model determines which APIs should be called: + SaaS contracts – [GetEntitlements](https://docs.aws.amazon.com/marketplaceentitlement/latest/APIReference/API_GetEntitlements.html) in the AWS Marketplace Entitlement Service. + SaaS contracts with consumption – [GetEntitlements](https://docs.aws.amazon.com/marketplaceentitlement/latest/APIReference/API_GetEntitlements.html) in the AWS Marketplace Entitlement Service and [BatchMeterUsage](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_BatchMeterUsage.html) in the AWS Marketplace Metering Service. + SaaS subscriptions – [BatchMeterUsage](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_BatchMeterUsage.html) in the AWS Marketplace Metering Service. + SaaS products offered exclusively in the AWS GovCloud (US) Regions must explain the architectural boundaries between other AWS Regions and the AWS GovCloud (US) Regions, use cases for the product, and the workloads not recommended for the product. For more information on SaaS architectures, refer to the [SaaS Architecture Fundamentals](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/saas-architecture-fundamentals.html) AWS whitepaper. ### Creating architecture diagrams To receive the special designation that your product is deployed on AWS, [update your product's architecture details](saas-product-settings.md#updating-architecture-details) in the AWS Marketplace Management Portal. Select a hosting pattern that is deployed on AWS and upload an architecture diagram that AWS reviews. For hosting patterns that AWS Marketplace considers deployed on AWS, see [Guidelines](#march-saas-guidelines) in the previous section. If your hosting pattern changes, you must update your product's architecture details. **Note** You cannot make your diagrams public. You can publish products that don't run entirely on AWS. Use the following criteria when creating a diagram: + Group and label components as part of the [application plane or control plane](https://docs.aws.amazon.com/whitepapers/latest/saas-architecture-fundamentals/control-plane-vs.-application-plane.html). + For any components outside of AWS that are part of the core business logic of your product, group them with the application plane. + Components can represent low-level details (for example, compute instances and network subnets), or high-level services (for example, a data analytics platform). + Components don’t need to identify the name of the AWS services or non-AWS services used. + Place components where they logically run. For example, in the seller's AWS account, the buyer's AWS account, the seller’s non-AWS environment, or another environment. + For data replication or workload migration products, include all supported source and target environments. **Note** The architecture diagram that you use to update the architecture details of your SaaS product is not published and not publicly available to buyers. #### Level of detail You can create a high-level diagram that shows main system components, includes basic data flows, and focuses on the application plane and control plane services. Or, you can create a low-level, detailed diagram that breaks down each component, shows specific connections, and includes technical specifications with different levels of detail. The following diagrams show the architecture of a hypothetical video-analysis SaaS application. Each shows a different level of detail. Both are acceptable. Use them as examples for the level of detail to include in your own diagrams. The following is an example of a high-level diagram. ![\[An architecture diagram of a hypothetical video-analysis SaaS application with high-level services. The services include machine-learning, storage, web, and billing services grouped and labeled as part of the control plane and application plane.\]](http://docs.aws.amazon.com/marketplace/latest/userguide/images/example-architecture-diagram-with-high-level-services.png) The following is an example of a low-level, detailed diagram. ![\[An architecture diagram of a hypothetical video-analysis SaaS application with low level details. The details include AWS services icons for AWS Fargate, virtual private cloud (VPC), and Amazon SageMaker AI that are grouped and labeled as part of the control plane and application plane.\]](http://docs.aws.amazon.com/marketplace/latest/userguide/images/example-architecture-diagram-with-low-level-details.png) For more information, see [What is Architecture Diagramming?](https://aws.amazon.com/what-is/architecture-diagramming/). After creating a diagram, update your architecture details in the AWS Marketplace Management Portal (AMMP). For more information, see [Update architecture details](saas-product-settings.md#updating-architecture-details). # SaaS product pricing in AWS Marketplace SaaS product pricing After a buyer purchases your software as a service (SaaS) product on AWS Marketplace, AWS Marketplace provides you with their billing identifier. You use the billing identifier to call the AWS Marketplace Entitlement Service and the AWS Marketplace Metering Service. Then, customers access the product in your AWS environment or through a virtual private cloud (VPC) endpoint connection that you create. This topic provides a list of SaaS pricing models for AWS Marketplace. **Note** All SaaS pricing models support free trials. For more information, see [SaaS free trials](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-free-trials.html). **SaaS pricing models** | Pricing model | Description | | --- | --- | | SaaS subscriptions | A pay-as-you-go model where we bill buyers for their hourly usage of your SaaS product. For more information, see [Pricing for SaaS subscriptions](saas-subscriptions.md). | | SaaS contracts | Buyers are either billed in advance for the use of your software, or you can offer them a flexible payment schedule. Customers can also pay for additional usage above their contract. For more information, see [Pricing for SaaS contracts](saas-contracts.md). | | SaaS contracts with pay-as-you-go | Buyers are either billed in advance for the use of your software, or you can offer them a flexible payment schedule. Buyers are also billed an additional metered rate for usage on top of the contract price. For more information, see [Pricing for SaaS contracts](saas-contracts.md). | | SaaS free | A free pricing model where customers can use your SaaS product at no cost. All pricing dimensions must be set to \$10.00. | **Note** Once you create your listing and publish it to limited, you can't change the pricing model. To make your SaaS product available on AWS Marketplace, decide whether you want to offer the [SaaS subscriptions pricing model](saas-subscriptions.md) or the [SaaS contracts pricing model](saas-contracts.md). # Pricing for SaaS subscriptions For software as a service (SaaS) subscriptions, AWS Marketplace bills your customers based on the metering records that you send to us. All charges must be measured and reported every hour from the software deployed in the customer's account. All usage is then calculated monthly and billed monthly using the same mechanism as AMI based AWS Marketplace offerings. Our ability to bill customers for usage of your product is dependent upon receiving metering records from you. You are responsible for ensuring that your product’s metering records are successfully transmitted and received. Before you can publish a SaaS product with subscription pricing, you must do the following: 1. Create a new SaaS product in the AWS Marketplace Management Portal, choose **New SaaS Subscription**. 1. Complete the fields in the **General** tab with the necessary information. Make a note of the product code. 1. On the **Pricing** tab, under **Set Pricing**, select the **Category** that describes your product’s pricing most accurately. The pricing category appears to customers on the AWS Marketplace website. You can choose from **Bandwidth** (GBps, MBps), **Data** (GB, MB, TB), **Hosts** (hours), **Requests**, or **Users** (hours). If none of the predefined categories fit your needs, you can choose the more generic **Units** category. Next, define your Pricing Dimensions. Each Pricing Dimension represents a feature or service that you can set a per-unit price for. Examples of dimensions include users, hosts scanned, and GB of logs ingested. You can define a maximum of 200 dimensions. For each dimension you define, you must add the following information: + **Dimension API Name** – The API name used when sending metering records to the [AWS Marketplace Metering Service](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/Welcome.html). This name indicates which dimension your customer used. This name is visible in billing reports. The name doesn't need to be reader-friendly because you're the only one with access to your reports. After you set the name, you can't change it. + **Dimension Description** – The customer-facing statement that describes the dimension for the product. The description can be no more than 70 characters and should be user-friendly. Examples of descriptions are Administrators per hour, and Per Mbps bandwidth provisioned. After the product is published, you can change this description. + **Dimension Rate** – The software charge per FCP unit for this product, in USD. This field supports eight decimal places. ## When a SaaS subscription ends **Important** SNS notifications for AWS Marketplace SaaS products are being replaced with Amazon EventBridge notifications. If you have existing SaaS products integrated with SNS, they will continue to function. New listings will eventually transition to using Amazon EventBridge instead of SNS. For more information, see [Managing SaaS subscription events with Amazon EventBridge](saas-eventbridge-integration.md). A customer can unsubscribe from your SaaS subscription product through the AWS Management Console. Key points of the SaaS subscription ending process include the following: 1. Your default Amazon EventBridge bus will receive a purchase agreement ended event for that customer. 1. You have one hour to meter any remaining usage for the customer. 1. After this hour, you receive a license deprovisioned - manufacturer event. At this point, you can no longer send metering records for this customer. It’s up to you to decide how you want to disable functionality in your SaaS product for unsubscribed customers. For example, your product might complete the customer's existing work but prevent them from creating work. You might want to display a message to the customer that their usage has been disabled. Customers can resubscribe to your product through AWS Marketplace. ## When a SaaS subscription is cancelled Key points of the SaaS subscription cancellation process include the following: 1. A customer can cancel their subscription to your SaaS subscription product the **Your Marketplace Software** page of the AWS Marketplace website. Your default Amazon EventBridge bus will receive a purchase agreement ended event for that customer. 1. You have one hour to meter any remaining usage for the customer. 1. You notify the customer from your product that the cancellation is in progress. If a customer indicates that they want to cancel through your product, direct the customer to AWS Marketplace. To guarantee that there will be no future charges, customers should confirm the cancellation with AWS Marketplace. # Pricing for SaaS contracts SaaS contracts allow customers to purchase your software through an upfront agreement. Under the agreement, customers are entitled to a specified quantity of use of your SaaS product. You define the usage categories, dimensions, and the length of the contract. AWS Marketplace bills your customers upfront or by the payment schedule that you define. For additional usage above their contract, your software reports the usage through the AWS Marketplace Metering Service (AWS Marketplace Metering Service). When using the SaaS Contract pricing model, your application never sends metering records. Instead, it verifies entitlement by calling the AWS Marketplace Entitlement Service (AWS Marketplace Entitlement Service). AWS Marketplace communicates these entitlements to your SaaS application. ## Creating a SaaS contract product Before you can publish a SaaS product with contract pricing, you must do the following: 1. Create a new SaaS product in the AWS Marketplace Management Portal, and choose **New SaaS contract**. 1. Complete the fields in the **General** tab with the necessary information. Make a note of the product code. 1. On the **Pricing** tab: 1. For **Set pricing**, choose the **Contract duration** you want to offer customers. You can enter different prices for each contract duration. You can select one or more of the following options: **Monthly**, **1 year**, **2 years**, and **3 years**. If you are creating a private offer, you can choose a custom duration in months (up to 60 months). 1. For **Choose the contract type you want to offer**, choose how you want customers to be able to purchase your product from the following options: + **Buyer can choose one or more options offered** – Customers can select a quantity for each pricing dimension you offer. + **Buyer can choose one tier from multiple tiers offered** – Customers choose a tier from options that include different sets of features, services, and usage amounts. 1. Choose the usage unit category that describes your product’s pricing most accurately. The pricing category appears to customers on the AWS Marketplace website. You can choose from **Bandwidth** (GBps, MBps), **Data** (GB, MB, TB), **Hosts** (hours), **Requests**, or **Users** (hours). If none of the predefined categories fit your needs, you can choose the more generic **Units** category. 1. Define your pricing dimensions. Each dimension represents a feature or service that you want to price separately. For detailed information about pricing dimensions and the required fields, see [Understanding SaaS contract pricing dimensions](#understanding-saas-contract-pricing-dimensions). ## Understanding SaaS contract pricing dimensions Each pricing dimension represents a feature or service that you can set a per unit price for. Examples of dimensions are users, hosts scanned, and GB of logs ingested. For each dimension you define, you add a name, a description, a price, and an API name. The name, price, and description are displayed to customers. You use the API name for tracking and reporting with AWS Marketplace as follows: + Calling the [AWS Marketplace Entitlement Service](https://docs.aws.amazon.com/marketplaceentitlement/latest/APIReference/Welcome.html) to retrieve the dimensions your customers have purchased. + Calling the [AWS Marketplace Metering Service](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/Welcome.html) to indicate which dimensions customers used. For each pricing dimension in your contract, you can choose to let customers pay as they go for additional usage of that dimension above their contract. You can also add additional dimensions without contract prices that customers only consume by paying as they go. When using the wizard to create the contracts for your SaaS product, you must define the following fields for your pricing dimensions: **Dimension API name** The name used when calling the Entitlements API. This name is visible in billing reports and reports that aren't external-facing. The maximum length for the API name is 15 characters. After you set the name, it can't be changed. **Dimension display name** The customer-facing name of a dimension. This name should help the customer understand the dimension for the product. The name should be user-friendly, and its maximum length is 24 characters. This value can be changed. **Dimension description** The customer-facing description of a dimension that provides additional information about the dimension for the product. The maximum length for the description is 70 characters. **Dimension - monthly price** The software charge per unit for the 1-month option for this dimension. This field supports three decimal places. **Dimension - 1-year price** The software charge per unit for the 12-month option for this dimension. This field supports three decimal places. It's not a monthly charge. The price must reflect the 12-month one-time charge price. **Dimension - 2-year price** The software charge per unit for the 24-month option for this dimension. This field supports three decimal places. **Dimension - 3-year price** The software charge per unit for the 36-month option for this dimension. This field supports three decimal places. **Example: Data storage application** | | Monthly price | 12-month price | 24-month price | Pay-as-you-go price for additional usage | | --- | --- | --- | --- | --- | | Unencrypted data (GB) | \$11.50/GB | \$116.00/GB | \$130.00/GB | \$10.1/GB per hour | | Encrypted data (GB) | \$11.55/GB | \$116.60/GB | \$131.20/GB | \$10.11/GB per hour | **Example: Log monitoring product** | | Monthly price | 12-month price | Pay-as-you-go price for additional usage | | --- | --- | --- | --- | | Basic (10 hosts monitored, 5 containers monitored) | \$1100 | \$11000 | | | Standard (20 hosts monitored, 10 containers monitored) | \$1200 | \$12000 | | | Pro (40 hosts monitored, 20 containers monitored) | \$1400 | \$14000 | | | Additional hosts monitored per hour | | | \$10.1 | | Additional containers monitored per hour | | | \$10.2 | **Note** The prices can be for the following durations: 1 month, 12 months, 24 months, or 36 months. You can choose to offer one or more of these options for your product. The durations must be the same across each dimension. For example, assume that you have `ReadOnlyUsers` and `AdminUsers` dimensions. If you offer a yearly price for `ReadOnlyUsers`, you must offer a yearly price for `AdminUsers`, too. ## SaaS contract upgrades Customers can upgrade a contract to one of a higher value except for longer durations. For example, they can upgrade to higher quantities or higher-value entitlements. Customers are given a prorated credit for their existing contract. Customers can't decrease the size of their existing contract. They can only decrease the size at renewal, or cancel their renewal. Entitlements are verified by your SaaS product, which makes calls to the AWS Marketplace Entitlement Service. ## Automatic renewals When a customer purchases your product through AWS Marketplace using SaaS contracts, they can agree to automatic renewal of the contract terms. The customer continues to pay for the entitlements every month or for 1, 2, or 3 years. The customer always has the option to modify the renewal settings. They can cancel the renewal or renew the contract for different quantities and durations. ## When a SaaS contract ends A SaaS contract product has a contract expiry. When a contract ends, the following events occur: 1. Your SaaS product receives an `entitlement-updated` notification indicating the buyer's entitlement has changed. The AWS Marketplace Entitlement Service returns an empty response. 1. You have 1 hour to meter any remaining usage for the customer. After this time has elapsed, you can no longer send metering records for this customer. ## When a SaaS contract is canceled Key points of the SaaS contract cancellation process include the following: 1. Customers can request a cancellation and refund for SaaS contract products though AWS Support. Customers must request refunds within 48 hours through AWS Support. The full or prorated refund is typically granted in 3–5 business days. 1. Your SaaS product receives notification through Amazon EventBridge events for that customer. 1. You have one hour to send a final metering record for the customer for any additional usage charges. 1. You notify the customer from your product that the cancellation is in progress. If a customer indicates that they want to cancel through your product, direct the customer to AWS Marketplace. To guarantee that there will be no future charges, customers should confirm the cancellation with AWS Marketplace. # Creating a SaaS free trial offer in AWS Marketplace Creating a SaaS free trial As an AWS Marketplace seller, you can create software as a service (SaaS) free trial offers in the AWS Marketplace Management Portal (AMMP). Customers can evaluate software products before making large purchase decisions by using the SaaS free trial option. After a customer subscribes to your product, your product performs entitlement checks the same way it does for paid customers. Each AWS account can only use a free trial for a SaaS product once. The free usage amount granted during a free trial is not shared across linked accounts in an AWS organization. Different linked accounts within a single main payer account can create their own individual free trials. **Note** If you use the Seller Data Delivery Service (SDDS), you receive an [Agreement details trial report](https://docs.aws.amazon.com/marketplace/latest/userguide/supplementary-reports.html) in your Amazon Simple Storage Service bucket. The report includes agreement details such as the subscriber name and ID, offer ID, and agreement start and end dates. Sellers also receive [Amazon Simple Notification Service (Amazon SNS) notifications](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-notification.html) when new subscriptions are created. Amazon SNS notifications include an `isFreeTrialTermPresent` flag to identify free trial agreements. Also, customers who subscribe to your free trial are redirected to your registration URL with an additional token, `x-amzn-marketplace-offer-type=free-trial`. You can use the token to create a unique registration experience for the customers who use your free trials. ## Creating a SaaS free trial offer Sellers can create SaaS free trial offers in the AWS Marketplace Management Portal (AMMP). **To create a SaaS free trial offer** 1. Sign in to the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management). 1. On the AWS Marketplace Management Portal, choose either: + **Create or manage offers** + The **Offers** tab 1. On the **Offers** page, choose the **Public free trials** tab to review all SaaS free trials. 1. Choose **Create free trial offer**. Sellers can create one SaaS free trial offer per each public SaaS product. 1. For **Offer fundamentals**, select your **Product** and then choose **Next**. 1. In **Free trial settings**: 1. Enter the number of days for your **Free trial length (days)**. The duration of free trials range from 7–90 days. 1. View the **Product dimensions** from your existing public offer. You can't change the product dimensions for SaaS subscription free trials. You can set the quantity limits per each dimension for SaaS contract free trials, and **Remove** or **Add dimensions**. 1. View the **Service agreement**. For the EULA version, you can select either **Standard contract for AWS Marketplace** or **Custom EULA**, and then choose **Review offer**. 1. Verify and review all information for the offer, and then choose **Create offer**. ## Cancelling a SaaS free trial offer Sellers can cancel free trial offers at any time from the AWS Marketplace Management Portal. To cancel a SaaS free trial offer 1. Sign in to the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management). 1. On the AWS Marketplace Management Portal, choose either: + **Create or manage offers** + The **Offers** tab 1. On the **Offers** page, select the offer. 1. Choose **View offer**. 1. Choose **Cancel offer**. After an offer is canceled, active agreements for this offer are active until expiration. New agreements for a canceled offer can't be created. # Onboarding customers to your SaaS product through AWS Marketplace Customer onboarding With software as a service (SaaS) subscriptions and SaaS contracts, your customers subscribe to your products through AWS Marketplace but access the product in your AWS environment. After subscribing to the product, your customer is directed to a website you create and manage as a part of your SaaS product to register their account and configure the product. When creating your SaaS product listing, you provide a URL to your registration landing page. We use that URL to redirect customers to your registration landing page after they subscribe. On your software's registration landing page, you collect the information that is required to create an account for the customer. We recommend collecting your customer’s email addresses if you plan to contact them through email for usage notifications. The registration landing page must be able to identify and accept the `x-amzn-marketplace-token` token in the form data from AWS Marketplace with the customer’s identifier for billing. It should then pass that token value to the AWS Marketplace Metering Service to resolve for the unique customer AWS account ID, customer identifier (For new implementations or when updating your integration, use the customer AWS account ID instead), and corresponding product code. For a code example, see [`ResolveCustomer` code example](saas-code-examples.md#saas-resolvecustomer-example). **Note** The registration token resolves to a specific subscribed customer and each generated token has an expiration window of 4 hours. As long as the caller is calling the API with the same token, it will keep returning the same response values until the token expires. ## Configuring your SaaS product to accept new buyers You're responsible for correctly configuring your SaaS software to accept new customers and meter them appropriately. The following process outlines one recommended way of identifying, implementing, and metering a new customer's access to your software: 1. When a customer visits your product page on the AWS Marketplace website, they choose to subscribe to your product. 1. The customer’s AWS account is subscribed to your product. This means subscription and metering records sent from your product become part of the customer’s AWS bill. 1. A registration token is generated for the customer that contains their AWS account ID, customer identifier, and your product code. 1. The customer is redirected to your software's registration landing page. This page must be able to accept the token with the customer’s identifier. 1. The customer’s browser sends a `POST` request to your software's registration landing page URL. The request contains one `POST` parameter, `x-amzn-marketplace-token`, containing the customer’s registration token. From the perspective of your registration website, the customer has submitted a form with this parameter. The registration token is an opaque string. If the offer type is a free trial, a second parameter, `x-amzn-marketplace-offer-type` with the value `free-trial`, will be added to the request. 1. To redeem this registration token for a customer AWS account ID, customer identifier, and product code, your website must call [ResolveCustomer](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_ResolveCustomer.html) on the AWS Marketplace Metering Service. For an example of a `ResolveCustomer` call, see [`ResolveCustomer` code example](saas-code-examples.md#saas-resolvecustomer-example). The customer identifier isn't the customer’s AWS account ID, but it's universal between products and should be saved to an internal source as part of your customer records. The product code is a unique string for your SaaS product that AWS provides to you. Each AWS product has one unique product code, which is assigned to you during registration. 1. The customer is instructed to either create an account in your product or sign in to an existing account. **Note** If setting up or linking to an existing customer account in your product requires a manual process by your team, you can use a contact-us form to collect the customer's contact information. After collecting their contact information and resolving their AWS account ID and unique customer identifier (as obtained in step 6), display a notification message for the customer. In the notification, state that their account is being set up and request that they wait for you to contact them. Provide the customer with the expected turnaround time and your contact information. Also send an email message to the customer with the same details. 1. The customer is now signed in to your website using credentials specific to that SaaS product. In your accounts database, you can have an entry for each customer. Your accounts database must have a column for the AWS account ID. Verify that no other accounts in your system share the AWS account ID. 1. **Important** SNS notifications for AWS Marketplace SaaS products are being replaced with Amazon EventBridge notifications. If you have existing SaaS products integrated with SNS, they will continue to function. New listings will eventually transition to using Amazon EventBridge instead of SNS. For more information, see [Managing SaaS subscription events with Amazon EventBridge](saas-eventbridge-integration.md). During your seller registration process, you configure Amazon EventBridge rules to receive events that notify you when customers subscribe or unsubscribe to your product. These are Amazon EventBridge events in JSON format that inform you of customer actions: + Entitlement notification – For products with pricing models that include a contract, you are notified when buyers create a new contract, upgrade it, renew it, or it expires. Your accounts database must have an extra column for the subscription state. For more information, see [Managing SaaS subscription events with Amazon EventBridge](saas-eventbridge-integration.md). + Subscription notification – For products with any pricing model, including contracts and subscriptions, you are notified when a buyer subscribes or unsubscribes to a product. For more information, see [Managing SaaS subscription events with Amazon EventBridge](saas-eventbridge-integration.md). We recommend that you use Amazon Simple Queue Service (Amazon SQS) as a target for your EventBridge rules to capture these events. After you receive a subscription notification with `subscribe-success`, the customer account is ready for metering. Records that you send before this event aren't metered. For information about how to set up EventBridge rules with SQS targets, see [Amazon SQS targets](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-targets.html#eb-targets-sqs) in the *Amazon EventBridge User Guide*. **Note** Do not activate a product subscription unless you receive a `subscribe-success` notification. 1. Use the AWS account ID stored in your database to meter for usage through the AWS Marketplace Metering Service or check for entitlements through the AWS Marketplace Entitlement Service. ## Security and ordering As a seller, it’s your responsibility to trust only AWS account IDs that are immediately returned from AWS or those that your system has signed. We recommend that you resolve the registration token immediately because it may expire after approximately one hour. After you resolve the registration token, store the AWS account ID as a signed attribute on the customer’s browser session until the registration is complete. # Amazon SNS notifications for SaaS products **Important** SNS notifications for AWS Marketplace SaaS products are being replaced with Amazon EventBridge notifications. If you have existing SaaS products integrated with SNS, they will continue to function. New listings will eventually transition to using Amazon EventBridge instead of SNS. For more information, see [Managing SaaS subscription events with Amazon EventBridge](saas-eventbridge-integration.md). To receive notifications, you subscribe to the Amazon Simple Notification Service (Amazon SNS) topics for AWS Marketplace provided to you during product creation. The topics provide notifications about changes to customers’ subscriptions and contract entitlements for your products. This enables you to know when to provide and revoke access for specific customers. **Note** During the product creation process, you'll receive the actual Amazon Resource Name (ARN) to the SNS topic. For example: `arn:aws:sns:us-east-1:123456789012:aws-mp-subscription-notification-PRODUCTCODE` The following Amazon SNS topics are available to software as a service (SaaS) products: + [Amazon SNS topic: `aws-mp-entitlement-notification`](#saas-sns-message-body) – This topic notifies you when buyers create a new contract, upgrade it, renew it, or it expires. This is only available for products with pricing models that include a contract (also known as **SaaS Contracts** and **SaaS Contracts with Consumption (Overages)**). + [Amazon SNS topic: `aws-mp-subscription-notification`](#saas-sns-subscription-message-body) – This topic notifies you when a buyer subscribes to or unsubscribes from a product and includes the `offer-identifier` for private offers and a free trials flag for SaaS free trials. This is available for all pricing models, including contracts and subscriptions (also known as **SaaS Subscriptions**, **SaaS Contracts**, and **SaaS Contracts with Consumption (Overages)**. To learn more about the scenarios in which you respond to these notifications, see the following topics: + [Integrating your SaaS subscription or Pay-As-You-Go product with AWS Marketplace](saas-integrate-subscription.md) + [Integrating your SaaS contract product with AWS Marketplace](saas-integrate-contract.md) + [Integrating your SaaS contract-based product with AWS Marketplace](saas-integrate-contract-with-pay.md) ## Amazon SNS topic: `aws-mp-entitlement-notification` Each message in the `aws-mp-entitlement-notification` topic has the following format. ``` { "action": "", "customer-identifier": " X01EXAMPLEX", "product-code": "n0123EXAMPLEXXXXXXXXXXXX", } ``` The ** will always be ` entitlement-updated`. **Note** For entitlement messages, regardless of the action (new, upgrade, renewal, or expired), the message is the same. A subsequent call to `GetEntitlement` is required to discover the content of the update. For **SaaS Contract with Consumption (Overages)**, sellers are provided with the [`aws-mp-subscription-notification` SNS topic](#saas-sns-subscription-message-body). This is an extra notification that a seller receives when they add on overage pricing. When a seller acquires new customers, instead of only getting `entitlement-updated` (which may refer to any kind of action), the seller receives a subscribe message indicating that this is a new customer. For future dated agreements (FDAs), this topic is initiated on the agreement start date (and not agreement sign date). It's also initiated when subsequent changes occur in the entitlement, such as cancellation, replacement, renewal, or expiration of the agreement. Products with contract pricing (including contracts with pay-as-you-go) must respond to these messages. For more information about how to respond, see [Scenario: Monitor changes to user subscriptions](saas-integrate-contract.md#saas-contract-monitor-changes). ## Amazon SNS topic: `aws-mp-subscription-notification` Each message in the `aws-mp-subscription-notification` topic has the following format. ``` { "action": "", "customer-identifier": " X01EXAMPLEX", "product-code": "n0123EXAMPLEXXXXXXXXXXXX", "offer-identifier": "offer-abcexample123", "isFreeTrialTermPresent":"true" } ``` The `offer-identifier` is included in the notification only when the action is `subscribe-success` or `subscribe-fail`. It isn't included in notifications when the action is `unsubscribe-pending` or `unsubscribe-success`. For offers created before January 2024, this identifier is included in the notification only for private offers. For offers created in January 2024 and later, this identifier is included in notifications for all offers, including both private offers and public offers. For information on offer types, see the response from [DescribeEntity API](https://docs.aws.amazon.com//marketplace/latest/APIReference/work-with-private-offers.html#describe-entity) or the offer visibility of an agreement in the [Agreements renewals dashboard](https://docs.aws.amazon.com//marketplace/latest/userguide/agreements-renewals-dashboard.html). **Note** For [DescribeEntity API](https://docs.aws.amazon.com//marketplace/latest/APIReference/work-with-private-offers.html#describe-entity), if you find an AWS account in the account targeting facet of targeting rule for that offer, it is a private offer. If there is not an AWS account in the account targeting facet of targeting rule for that offer, it is a public offer. The `isFreeTrialTermPresent` property indicates if the buyer's subscription is a free trial. The JSON value of this property is not a *boolean* datatype. Instead, the value is converted to a *string* datatype. For more information, see [ SaaS free trials.](https://docs.aws.amazon.com/marketplace/latest/userguide/saas-free-trials.html) The ** will vary depending on the notification. Possible actions are: + `subscribe-success` – The `subscribe-success` message signals when the seller can begin sending metering records. If an [agreement-based offer](https://docs.aws.amazon.com/marketplace/latest/userguide/private-offers-upgrades-and-renewals.html#private-offers-upgrades-and-renewals-process) is accepted by the buyer, this message is sent again with the new `offer-identifier`. + `subscribe-fail` – If the `subscribe-fail` message is generated, payment might have failed even though the buyer has already transitioned from the AWS Marketplace to the seller's SaaS landing page. The seller should wait for the `subscribe-success` message before allowing consumption of the product. + `unsubscribe-pending` – When a buyer unsubscribes, an `unsubscribe-pending` message is sent first. This indicates that the seller has a limited time (about one hour) to get final metering records sent before the buyer is cancelled completely. + `unsubscribe-success` – The `unsubscribe-success` message signals the completion of cancellation, after which no further metering records will be accepted. **Note** If a buyer unsubscribes and then immediately successfully re-subscribes before the final `unsubscribe-success` message is sent, the final `unsubscribe-success` message will not be sent and a `subscribe-success` message will be sent instead. For future dated agreements (FDAs), the `subscribe-success` action is initiated on the agreement start date (and not agreement sign date). Products with subscription pricing (including contracts with pay-as-you-go) must respond to these messages. For more information about how to respond, see the following topics: + [Integrating your SaaS subscription or Pay-As-You-Go product with AWS Marketplace](saas-integrate-subscription.md) + [Integrating your SaaS contract-based product with AWS Marketplace](saas-integrate-contract-with-pay.md) ## Subscribing an SQS queue to the SNS topic We recommend subscribing an Amazon SQS queue to the provided SNS topics. For detailed instructions on creating an SQS queue and subscribing the queue to a topic, see [ Subscribing an Amazon SQS queue to an Amazon SNS topic](https://docs.aws.amazon.com/sns/latest/dg/subscribe-sqs-queue-to-sns-topic.html) in the *Amazon Simple Notification Service Developer Guide*. **Note** You can only subscribe to AWS Marketplace SNS topics from the AWS account used to sell the products. However, you can forward the messages to a different account. For more information, see [Sending Amazon SNS messages to an Amazon SQS queue in a different account](https://docs.aws.amazon.com/sns/latest/dg/sns-send-message-to-sqs-cross-account.html) in the *Amazon Simple Notification Service Developer Guide*. ### Polling the SQS queue for notifications After you subscribe your SQS queue to an SNS topic, the messages are stored in SQS. You must define a service that continually polls the queue, looks for messages, and handles them accordingly. # Managing SaaS subscription events with Amazon EventBridge Managing SaaS subscription events You can use Amazon EventBridge to integrate and manage SaaS products with AWS Marketplace. Events are sent for changes to customers' subscriptions and contract entitlements for your products. You receive notifications when customers subscribe, when their entitlements change, and when they cancel, so you know exactly when to grant or revoke access. These events serve two primary roles: + **Manufacturer** – This is the original product manufacturer of the listing in AWS Marketplace, also known as the Independent Solution Vendor (ISV). + **Proposer** – This is the original proposer of a purchase agreement for the product listed in AWS Marketplace. This can be either the ISV or a Channel Partner authorized to resell the product. Two distinct selling patterns determine whether you, as the ISV, act as a manufacturer or proposer. Your role determines which notifications you receive through EventBridge. | Selling pattern | Description | ISV's role | | --- | --- | --- | | AWS Marketplace public or private offer | You extend an offer or agreement directly to the buyer. | Both manufacturer and proposer | | Channel partner private offer | A channel partner authorized to resell your product extends an offer or agreement to the buyer. | Manufacturer | ## EventBridge events for SaaS products When a AWS Marketplace transaction occurs, EventBridge sends events to your default event bus. Your role as either a manufacturer or proposer determines which events you receive. | Event name | Initiated by | Response | Recipient | | --- | --- | --- | --- | | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/marketplace/latest/userguide/saas-eventbridge-integration.html) | A new agreement is created, an existing agreement is replaced, or an existing agreement is renewed. | Purchase agreement is recorded and post-sale actions taken. DescribeAgreement API is used to determine if the new agreement is a free trial. | Manufacturer and proposer | | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/marketplace/latest/userguide/saas-eventbridge-integration.html) | An existing agreement is amended. | Purchase agreement record is amended. | Manufacturer and proposer | | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/marketplace/latest/userguide/saas-eventbridge-integration.html) | An agreement has expired, is canceled, is terminated. | Purchase agreement closure is recorded and post agreement cancelation actions happen. ISV begins revoking customer entitlements. | Manufacturer and proposer | | License Updated - Manufacturer | The buyer's entitlement to a product has changed. | Customer entitlements are checked using the GetEntitlements API and services are provisioned accordingly. | Manufacturer only | | License Deprovisioned - Manufacturer | The buyer's entitlement to a product has ended. | For usage-based products, this event marks the start of a 1-hour final reporting window. Sellers should collect and report any unreported usage using the BatchMeterUsage API. After this window closes, customer entitlements are fully revoked and usage reporting is no longer accepted. | Manufacturer only | **Note** Purchase agreement event types for manufacturer and proposer are nearly identical, except for the presence of a resaleAuthorization ID. To avoid redundant messages, only the proposer purchase agreement event is sent when you are both the manufacturer and proposer. For the full list of event types and their detailed schemas, see [Amazon EventBridge events](notifications-eventbridge.md) in the Seller Guide. ## Final usage reporting window for usage-based products For products with a usage-based billing component, AWS Marketplace gives sellers one hour to submit final usage records for customers whose entitlements have ended. After this period, the `BatchMeterUsage` API rejects reported usage and you cannot bill the customer. AWS Marketplace sends the License Deprovisioned - Manufacturer event to signal the start of the final reporting window. Sellers have one hour after receiving this event to collect any unreported usage for the customer and report it using the `BatchMeterUsage` API. After the one-hour window closes, AWS Marketplace fully revokes the customer's entitlements and no longer accepts usage reporting. ## Integrate EventBridge with your SaaS product Use EventBridge to integrate your tenant provisioning operations with your SaaS listing in AWS Marketplace. + Event rules define how to react to an event. These rules can react immediately or on a set schedule. + Event patterns are defined in the event rules and let you filter for specific event types sent to your default event bus. Patterns templates for each event type are available in the EventBridge console. In the Event pattern configuration step, select AWS services as the event source and AWS Marketplace Agreements and Licenses as the AWS service. + All AWS Marketplace Agreements and Licenses event types use the following structure. ``` { "detail-type": ["e.g. Purchase Agreement Ended - Manufacturer"], "source": ["aws.agreement-marketplace"] } ``` + Targets are resources that receive events when they match the event pattern defined for a rule. Many AWS services integrate with EventBridge and can serve as targets, including Lambda functions, Step Functions, and API Gateway. For more information about setting up EventBridge rules, see [Getting started: Create an Amazon EventBridge event bus rule](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-get-started.html). # Accessing the AWS Marketplace Metering and Entitlement Service APIs This section outlines the process of integrating with the AWS Marketplace Metering Service or AWS Marketplace Entitlement Service, used to ensure that your billing and reporting for customer usage of your software as a service (SaaS) products is accurate. It's assumed that you've submitted a SaaS subscriptions product or a SaaS contracts product that has been published to a limited state. In a limited state, you can use your test accounts to verify proper configuration and function but your product is not available publicly. **Note** If your SaaS product is integrated with another AWS managed service that handles metering in a different way (such as Amazon SageMaker Ground Truth, or AWS WAF), then you do not need to integrate with AWS Marketplace metering service. Metering for your product should only happen in one system to avoid double billing your customer. **Topics** + [ # Configuring metering for usage with SaaS subscriptions ](metering-for-usage.md) + [ # Checking entitlements using the AWS Marketplace Entitlement Service ](checking-entitlements.md) + [ # SaaS product integration checklist ](aws-marketplace-integration-checklist.md) For information about setting up the AWS CLI, along with credentials, see [Configuring the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html) in the *AWS Command Line Interface User Guide*. If you're new to the AWS Python SDK, see the Boto 3 [Quickstart](https://boto3.readthedocs.io/en/latest/guide/quickstart.html). # Configuring metering for usage with SaaS subscriptions Metering for usage For software as a service (SaaS) subscriptions, you meter for all usage, and then customers are billed by AWS based on the metering records that you provide. For SaaS contracts, you only meter for usage beyond a customer’s contract entitlements. The following sections provide information about how to configure metering for usage with SaaS products. When your application meters usage for a customer, your application is providing AWS with a quantity of usage accrued. Your application meters for the pricing dimensions that you defined when you created your product, such as gigabytes transferred or hosts scanned in a given hour. For example, if you charge based on the amount of data sent into your application, you can measure the amount of data and send a corresponding metering record once an hour. AWS calculates a customer’s bill using the metering data along with the prices that you provided when you created your product. For products that support Concurrent Agreements, metering operates at the license level rather than the product level. Each usage record must include a `LicenseArn` to identify which specific agreement the usage applies to. The `LicenseArn` is obtained from the `ResolveCustomer` API response during SaaS registration. This enables buyers to maintain multiple active agreements for the same product, with usage tracked and billed separately per agreement. **Note** Optionally, you can split the usage across properties that you track. These properties are exposed to the buyer as tags. These tags allow the buyer to view their costs split into usage by the tag values. For example, if you charge by the user, and users have a `Department` property, you could create a usage allocations with tags that have a key of `Department`, and one allocation per value. This doesn't change the price, dimensions, or the total usage that you report, but allows your customer to view their costs by categories appropriate to your product. For more information, see [Vendor-metered tagging (Optional)](#saas-vendor-metered-tagging). **Topics** + [ ## Meter on an hourly basis ](#metering-hourly) + [ ## Configure your product to meter usage ](#configure-application-for-meter-usage) + [ ## Vendor-metered tagging (Optional) ](#saas-vendor-metered-tagging) ## Meter on an hourly basis We recommend that you report usage to AWS on an hourly basis for all your customers in batches of up to 25 at a time. This gives customers as much granular visibility into their usage and costs as possible. If you aggregate usage in time periods greater than an hour (for example, one day), note the following considerations. + AWS can only bill customers for usage of your product upon receiving metering records from you. You're responsible for ensuring that your product’s metering records are successfully transmitted and received. You can use AWS CloudTrail to verify the record or records that you send are accurate. You can also use the information to perform audits over time. For more information, see [Logging AWS Marketplace API calls with AWS CloudTrail](cloudtrail-logging.md). + If this is a SaaS with the pricing model "Subscription" (not pricing models "Contract" or "Contract with Consumption"), then the buyer can unsubscribe at any time. When the buyer initiates this unsubscribe action, the seller will receive an `unsubscribe-pending` [notification](saas-notification.md#saas-sns-subscription-message-body) and have 1 hour to send in all unreported usage before the final `unsubscribe-success` notification. Anything after the second notification will not be honored. The other two pricing models have a set duration based on the time of subscription and the buyer cannot unsubscribe during it. They can only turn off autorenewal. The same notification is sent at the end of that duration if not autorenewing. + For products with Concurrent Agreements: The unsubscribe notification and 1-hour window applies per individual agreement, not per product. If a buyer cancels one of multiple active agreements, you can continue metering against the remaining active licenses. Only usage for the canceled agreement must be submitted within the 1-hour window after receiving the `unsubscribe-pending` notification for that specific license. + If you don't send metering records hourly and there is an application or network outage, your records will be further behind. This may result in unreported usage if the application or network outage is restored after the subscription expires. + Even if there is no usage to report, you can continue sending metering records every hour and record a quantity of 0 if there is no usage to report for that hour. Note that after you report a buyer's usage of a dimension, 0 or more, you cannot amend the record. Thus it is best practice to report usage for the previous hour. Usage reported is visible in the buyer's [AWS Billing and Cost Management](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-what-is.html) console throughout the billing cycle. The console shows each dimension of your product in a separate line item with the total number of units consumed and the total cost for that line item consumed for that billing cycle or thus far, even if the dimension price is \$10 per unit. If enabled, the [AWS Cost and Usage Report (CUR)](https://docs.aws.amazon.com/cur/latest/userguide/what-is-data-exports.html) shows this detail including the per unit rate. These reports are not updated in real time. + During publishing, the AWS Marketplace Operations team will test that the SaaS application sends the metering record successfully before allowing the product to be published. Typically, the team will perform a mock sign up of the SaaS and confirm that a metering record is received. **Note** If your SaaS product is integrated with another AWS managed service that handles metering in a different way (such as Amazon SageMaker Ground Truth, or AWS WAF), then you do not need to integrate with AWS Marketplace metering service. Metering for your product should only happen in one system to avoid double billing your customer. Note that AWS Marketplace isn't publishing new AWS WAF products at this time. ## Configure your product to meter usage You use the `BatchMeterUsage` operation in the AWS Marketplace Metering Service to deliver metering records to AWS. Keep the following in mind: + We require sellers to use batching by using the `BatchMeterUsage` operation. + We deduplicate metering requests on the hour. + For non-Concurrent Agreements products: Requests are deduplicated per product/customer/hour/dimension. For Concurrent Agreements products: Requests are deduplicated per license/customer/hour/dimension. + You can always retry any request, but if you meter for a different quantity, the original quantity is billed. For Concurrent Agreements products: retrying with the same `LicenseArn` is safe and follows standard deduplication rules. However, switching between `ProductCode` and `LicenseArn` for the same usage window will cause duplicate billing. + If you send multiple requests for the same customer/dimension/hour, the records are not aggregated. + Sellers can send metering records with a timestamp up to 6 hours in the past if the customer is subscribed to your product. If the customer unsubscribes, sellers have to send the metering records within 1 hour of the customer unsubscribing. + `BatchMeterUsage` payloads must not exceed 1MB. Choose the number of usage records to send in a `BatchMeterUsage` request so that you don't exceed the size of the payload. + The AWS Marketplace Metering Service is available in the AWS Regions listed in [AWS Marketplace endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/aws-marketplace.html) in the *AWS General Reference*. By default, the US East (N. Virginia) Region is enabled for SaaS metering products when you request your product. If you intend to use other Regions, contact the [https://aws.amazon.com/marketplace/management/contact-us/](https://aws.amazon.com/marketplace/management/contact-us/) team. For more information, see [BatchMeterUsage](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_BatchMeterUsage.html). + Concurrent agreements: A single customer may have multiple active agreements for your product. Each agreement has a unique `LicenseArn` and usage is tracked separately per license. Review the new integration for Concurrent Agreements [here](https://catalog.workshops.aws/mpseller/en-US/saas/integration-for-concurrent-agreements). For new implementations, each `UsageRecord` must include a `LicenseArn` field to identify which agreement the usage applies to. The `LicenseArn` is obtained from the `ResolveCustomer` API response. **Note** For existing implementations: When you are migrating from product-based metering to license-based metering, don't send metering records with both `LicenseArn` and `ProductCode` for the same customer within the same hour. This will result in duplicate billing. Do not include `ProductCode` at the request level. The `LicenseArn` in each `UsageRecord` identifies both the product and the specific agreement. For code examples, see [Code examples for SaaS product integration](saas-code-examples.md). ### Example: Host scanning Your product analyzes computing hardware for known security vulnerabilities. Customers manually initiate or schedule these scans of their Amazon Elastic Compute Cloud (Amazon EC2) instances. As your product performs these scans, it tallies the number of unique hosts scanned every hour. In this example, your product uses the **Hosts** category. You can declare multiple dimensions for the types of hosts scanned. For example, you can charge different prices for small, medium, and large hosts. ### Example: Log analysis Your SaaS product digests logs that are generated by customer products, reporting trends, and anomalies. As customers upload logs to your product, you measure the quantity of data received in megabytes, gigabytes, or terabytes. On the tenth minute of every hour, a cron job reads this usage for each customer for the previous hour. The job builds a batch report and uses the `BatchMeterUsage` operation to send it to AWS. In this example, your product uses the **Data** category. Your product can also meter for the amount of log data stored for any given hour. In this case, your product can meter along two dimensions: data received in the hour and total data stored in the hour. You can continue to meter for data stored until the customer deletes this data or it expires. ## Vendor-metered tagging (Optional) Vendor-metered tagging helps Independent Software Vendors (ISVs) give the buyer more granular insight into their software usage and can help them perform cost allocation. There are many ways to tag a buyer's software usage. One way is to first ask your buyers what they want to see in their cost allocation. Then you can split the usage across properties that you track for the buyer’s account. Examples of properties include `Account ID`, `Business Unit`, `Cost Centers`, and other relevant metadata for your product. These properties are exposed to the buyer as tags. Using tags, buyers can view their costs split into usage by the tag values in their AWS Billing Console ([https://console.aws.amazon.com/costmanagement/](https://console.aws.amazon.com/costmanagement/)). Vendor-metered tagging doesn't change the price, dimensions, or the total usage that you report. It allows your customer to view their costs by categories appropriate to your product. **Note** Concurrent Agreements license-level metering is not currently supported for vendor-metered tagging (VMT) products. If your product uses VMT, continue using standard `ProductCode`-based metering. In a common use case, a buyer subscribes to your product with one AWS account. The buyer also has numerous users associated with the same product subscription. You can create usage allocations with tags that have a key of `Account ID`, and then allocate usage to each user. In this case, buyers can activate the `Account ID` tag in their Billing and Cost Management console and analyze individual user usage. ### Seller experience Sellers can aggregate the metering records for resources with the same set of tags instead of aggregating usage for all resources. For example, sellers can construct the metering record that includes different buckets of `UsageAllocations`. Each bucket represents `UsageQuantity` for a set of tags, such as `AccountId` and `BusinessUnit`. In the following diagram, **Resource 1** has a unique set of `AccountId` and `BusinessUnit` tags, and appears in the **Metering Record** as a single entry. **Resource 2** and **Resource 3** both have the same `AccountId` tag, `2222`, and the same `BusinessUnit` tag, `Operations`. As a result, they're combined into a single `UsageAllocations` entry in the **Metering Record**. ![\[Diagram showing how vendor metering tags combine usage data. Three resources (Resource 1, 2, and 3) with different AccountIds and BusinessUnits are consolidated into a single Metering Record with UsageAllocations grouped by AccountId and BusinessUnit before being sent to the AWS Marketplace Metering Service.\]](http://docs.aws.amazon.com/marketplace/latest/userguide/images/seller-vendor-meter-tag.png) Sellers can also combine resources without tags into a single `UsageAllocation` and send it as one of the entries in `UsageAllocations`. Limits include: + Number of tags – 5 + Size of `UsageAllocations` (cardinality) – 2,500 + Maximum request size – 1 MB Validations include: + Characters allowed for the tag key and value – a-zA-Z0-9\$1 -=.\$1:\$1/@ + Maximum tags across `UsageAllocation` list – 5 + Two `UsageAllocations` can't have the same tags (that is, the same combination of tag keys and values). If that's the case, they must use the same `UsageAllocation`. + The sum of `AllocatedUsageQuantity` of `UsageAllocation` must equal the `UsageQuantity`, which is the aggregate usage. + The maximum payload size can't be more than 1 MB. This includes input attribute keys (for example, `UsageRecords`, `AllocatedUsageQuantity`, tags). **Note** To make sure that you aren't breaching the payload limit, create a sample request object with a maximum size based on the business requirement, convert the object into a JSON string, and obtain the size in bytes. Make sure that a single API call won't breach the 1 MB limit. For example. if a request with 1 `UsageRecord` has a maximum size of 200 KB, don't send more than 5 `UsageRecords` as part of the request (200KB \$1 5 = 1MB). ### Buyer experience The following table shows an example of the buyer experience after a buyer activates the `AccountId` and `BusinessUnit` vendor tags. In this example, the buyer can see allocated usage in their **Cost Usage Report**. The vendor-metered tags use the prefix `“aws:marketplace:isv”`. Buyers can activate them in the Billing and Cost Management, under **Cost Allocation Tags**, **AWS-generated cost allocation tags**. The first and last rows of the **Cost Usage Report** are relevant to what the Seller sends to the Metering Service (as shown in the [Seller experience](container-metering-meterusage.md#container-vendor-metered-tag-seller) example). **Cost Usage Report (Simplified)** | ProductCode | Buyer | UsageDimension | UsageQuantity | `aws:marketplace:isv:AccountId ` | `aws:marketplace:isv:BusinessUnit` | | --- | --- | --- | --- | --- | --- | | xyz | 111122223333 | Network: per (GB) inspected | 70 | 2222 | Operations | | xyz | 111122223333 | Network: per (GB) inspected | 30 | 3333 | Finance | | xyz | 111122223333 | Network: per (GB) inspected | 20 | 4444 | IT | | xyz | 111122223333 | Network: per (GB) inspected | 20 | 5555 | Marketing | | xyz | 111122223333 | Network: per (GB) inspected | 30 | 1111 | Marketing | For a code example, see [`BatchMeterUsage` with usage allocation tagging code example (Optional)](saas-code-examples.md#saas-batchmeterusage-tagging). # Checking entitlements using the AWS Marketplace Entitlement Service Checking entitlements If your product is a SaaS contracts product, your product calls the AWS Marketplace Entitlement Service to retrieve the customer’s entitlement using the [GetEntitlements](https://docs.aws.amazon.com/marketplaceentitlement/latest/APIReference/API_GetEntitlements.html) API. Your product should verify subsequent usage on that account against the AWS Marketplace Entitlement Service. For example, if the customer provisions 10 users on the account, your product should check the AWS Marketplace Entitlement Service for entitlement to that capacity. To verify a customer's entitlement to your product, use the `GetEntitlements` operation in the AWS Marketplace Entitlement Service. The AWS Marketplace Entitlement Service is available only in the US East (N. Virginia) Region, accessible through `entitlement.marketplace.us-east-1.amazonaws.com` or `entitlement-marketplace.us-east-1.api.aws`. `GetEntitlements` accepts a customer AWS account ID, customer identifier, license ARN, and dimension as filters. `ProductCode` is a required parameter. The operation returns a paginated list of entitlements. The result has an `ExpirationDate` field that shows the minimum period of time that the entitlement is valid for. If the customer has set up automatic renewal, the date in the ExpirationDate field is the renewal date. For code examples, see [Code examples for SaaS product integration](saas-code-examples.md). ## Retrieving entitlement on user actions The following examples can help you better understand the process for retrieving entitlement on user actions. ### Example: User-based product You offer a product that allows a number of accounts to exist for a given customer. The customer can visit a dashboard to provision new users (for example, to assign credentials). When the customer provisions a new user, your product calls `GetEntitlements` to verify that the capacity exists. If it does not, you can call the AWS Marketplace Metering Service to bill for additional users. ### Example: Data storage product You offer a product that enables customers to store a certain amount of data in encrypted or unencrypted form. The customer can view a dashboard that displays the amount of data existing and allocated in your product. Your dashboard retrieves the allocation amount through `GetEntitlements`. # SaaS product integration checklist Before your software as a service (SaaS) product goes live, you must verify that you have completed the required configuration. You can use the following SaaS integration checklist to verify that you have completed the required configurations. | **Category** | **Requirements** | | --- | --- | | Access | Submitted a seller registration form with the desired AWS account for AWS Marketplace usage. | | Access | Completed the seller registration, including terms and conditions, bank account, and W8 or W9 tax form. | | Access | Configured cross-account roles for the registered AWS Marketplace account. | | Product | Completed the product request form in the AWS Marketplace Management Portal. | | Product | Provided AWS account IDs for testing in the Notes tab of the Create product wizard in the AMMP. | | Product | Provided a URL of the EULA in .txt format in the Products tab. | | Product | Received your product code and Amazon SNS topic information from AWS Marketplace. | | Product | Subscribed to the Amazon SNS topic and created an Amazon SQS queue to subscribe to the Amazon SNS topic. | | Billing Solution | Validated you can send metering records to the BatchMeterUsage operation each hour for licenses across each customer for SaaS subscriptions products. Can send metering records for additional usage by each customer for SaaS contracts products. | | Billing Solution | Validated you can verify customer entitlements from the AWS Marketplace Entitlement Service for SaaS contracts products. | | Billing Solution | Validated that the costs appear as expected on bills generated for test accounts. | | Billing Solution | Tested for situations such as invalid customer IDs and canceled subscriptions. | | Product | Submitted the product request back to AWS Marketplace for publishing. | | Registration | Implemented an HTTPS registration page that can accept HTTP POST requests. | | Registration | Validated you can accept new customer registrations. | | Registration | Validated you are not storing the registration token in a cookie. | | Registration | Validated you are using ResolveCustomer to obtain the ProductCode, CustomerAWSAccountId, and LicenseArn from the AWS token. | | Registration | Validated you can resolve the registration token received from AWS with no delays. | | Registration | Tested that you aren't blocked from registering with email services addresses such as Gmail. | | Registration | Tested that you can accept incomplete registrations and multiple registration attempts. | | Subscription | Test that you can handle unsubscribe-pending and unsubscribe-success messages. | | Subscription | Validated that you send final metering records within an hour of receiving an `unsubscribe-pending` message. | | Security | Validated the AWS root account doesn't have API keys, has a strong password, and is associated with a hardware multi-factor authentication (MFA) device. All administrative access is through identities created with AWS Identity and Access Management (IAM). No shared accounts. | | Security | Validated that IAM roles are used for all programmatic Amazon Elastic Compute Cloud (Amazon EC2) access. Credentials aren't hard-coded into scripts, headers, or source code. | | Security | Validated you maintain comprehensive logging and log consolidation. | | Security | Verified you have well-defined public and private subnet boundaries that isolate application services and access to database and file systems. Distinct data class definitions that demarcate sensitive data and segregate public and private data. | | Security | Verified you have private data encryption in transit and at rest with scheduled key rotation. | | Security | Validated you have security incident tools and access in place and routinely scheduled incident response exercises that accommodate timely investigation and recovery. | | Reliability | Verified the system adapts to changes in demand, scaling up and down as required, and employs load balancing to ensure high performance. The system also provides edge-based caching as required. | | Reliability | Validated recovery time and point objectives are specified, and disaster recovery is scheduled at regular intervals. Component failure is self-healing via automated triggers and notifications. | # Reporting for SaaS products on AWS Marketplace Reporting AWS Marketplace produces reports for your software as a service (SaaS) products that include data on subscribers, financials, usage, and taxes. The following table provides information about the available reports. You can use reports to gain more insight into your customer base and better understand your financials, including sales and taxes. The following table summarizes how financials for SaaS products are reported. | Report | SaaS content | | --- | --- | | Daily business report | Upfront contract charges appear in the **Fees** section. Metered usage charges appear in the **Usage** section. | | Monthly revenue report | Upfront contract charges appear in the **Annual subscriptions** section. Metered usage charges appear in the **Billing and revenue data** section. | | Sales compensation report | Upfront contract charges and monthly additional usage charges appear as separate line items. | | Customer subscriber report | New SaaS contracts appear in the **Annual subscriptions** section. New SaaS subscriptions appear in the **Hourly/monthly subscriptions** section. | # Code examples for SaaS product integration SaaS code examples You can use the following code examples to integrate your software as a service (SaaS) product with the AWS Marketplace APIs that are required for publishing and maintaining your product. For more information, see the following sections. **Topics** + [ ## `ResolveCustomer` code example ](#saas-resolvecustomer-example) + [ ## `GetEntitlement` code example ](#saas-getentitlement-example) + [ ## `BatchMeterUsage` code example ](#saas-batchmeterusage-example) + [ ## `BatchMeterUsage` code example: With License ARN ](#saas-batchmeterusage-licensearn-example) + [ ## `BatchMeterUsage` with usage allocation tagging code example (Optional) ](#saas-batchmeterusage-tagging) ## `ResolveCustomer` code example The following code example is relevant for all pricing models. The Python example exchanges a `x-amzn-marketplace-token` token for a `CustomerIdentifier`, `ProductCode`, `LicenseArn`, and `CustomerAWSAccountId`. The `CustomerAWSAccountId` is the AWS account ID associated with the subscription, and `LicenseArn` is a unique identifier for a specific granted license. These are used for software purchased through AWS Marketplace. This code runs in an application on your registration website, when you are redirected there from the AWS Marketplace Management Portal. The redirect is a POST request that includes the token. For more information about `ResolveCustomer`, see [ResolveCustomer](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_ResolveCustomer.html) in the *AWS Marketplace Metering Service API Reference*. **Note** For new implementation or when updating your integration, use the CustomerAWSAccountId instead of CustomerIdentifier. ``` # Import AWS Python SDK and urllib.parse import boto3 import urllib.parse as urlparse # Resolving Customer Registration Token formFields = urlparse.parse_qs(postBody) regToken = formFields['x-amzn-marketplace-token'][0] # If regToken present in POST request, exchange for customerID if (regToken): marketplaceClient = boto3.client('meteringmarketplace') customerData = marketplaceClient.resolve_customer(RegistrationToken=regToken) productCode = customerData['ProductCode'] customerID = customerData['CustomerIdentifier'] customerAWSAccountId = customerData['CustomerAWSAccountId'] licenseARN = customerData['LicenseArn'] # TODO: Store customer information # TODO: Validate no other accounts share the same customerID ``` ### Example response ``` { 'CustomerIdentifier': 'string', 'CustomerAWSAccountId':'string', 'ProductCode': 'string', 'LicenseArn' : 'string' } ``` ## `GetEntitlement` code example The following code example is relevant for SaaS products with the contract and SaaS contract with consumption pricing model. The Python example verifies that a customer has an active entitlement. For more information about `GetEntitlement`, see [GetEntitlement](https://docs.aws.amazon.com/marketplaceentitlement/latest/APIReference/API_GetEntitlements.html) in the *AWS Marketplace Entitlement Service API Reference*. ``` # Import AWS Python SDK import boto3 marketplaceClient = boto3.client('marketplace-entitlement', region_name='us-east-1') # Filter entitlements for a specific customerID # # productCode is supplied after the AWS Marketplace Ops team has published # the product to limited # # customerID is obtained from the ResolveCustomer response entitlement = marketplaceClient.get_entitlements({ 'ProductCode': 'productCode', 'Filter' : { # Option 1: Using CustomerIdentifier (for new or updated integrations, use the customer AWS account ID) 'CUSTOMER_IDENTIFIER': [ 'customerID', ] # Option 2: Using CustomerAWSAccountId (preferred) # 'CUSTOMER_AWS_ACCOUNT_ID': [ # 'awsAccountId', # ] # Option 3: Using LICENSE_ARN (to get entitlements for the license) # 'LICENSE_ARN': [ # 'licenseARN', # ] }, 'NextToken' : 'string', 'MaxResults': 123 }) # TODO: Verify the dimension a customer is subscribed to and the quantity, # if applicable ``` ### Example response The returned value corresponds to the dimensions created when you created the product in the AWS Marketplace Management Portal. ``` { "Entitlements": [ { "CustomerIdentifier": "string", "CustomerAWSAccountId": "string", "Dimension": "string", "ExpirationDate": number, "ProductCode": "string", "LicenseArn": "string", "Value": { "BooleanValue": boolean, "DoubleValue": number, "IntegerValue": number, "StringValue": "string" } } ], "NextToken": "string" } ``` ## `BatchMeterUsage` code example The following code example is relevant for SaaS subscription and contract with consumption pricing models, but not for SaaS contract products without consumption. The Python example sends a metering record to AWS Marketplace to charge your customers for pay-as-you-go fees. ``` # NOTE: Your application will need to aggregate usage for the # customer for the hour and set the quantity as seen below. # AWS Marketplace can only accept records for up to an hour in the past. # # productCode is supplied after the AWS Marketplace Ops team has # published the product to limited # # You can use either: # - customerID from the ResolveCustomer response # - AWS account ID of the buyer # Import AWS Python SDK import boto3 from datetime import datetime # Option 1: Using CustomerIdentifier (for new or updated integrations, use the customer AWS account ID) usageRecord = [ { 'Timestamp': datetime(2015, 1, 1), 'CustomerIdentifier': 'customerID', 'Dimension': 'string', 'Quantity': 123 } ] # Option 2: Using CustomerAWSAccountId (preferred) # usageRecord = [ # { # 'Timestamp': datetime(2015, 1, 1), # 'CustomerAWSAccountId': 'awsAccountId', # 'Dimension': 'string', # 'Quantity': 123 # } # ] marketplaceClient = boto3.client('meteringmarketplace') response = marketplaceClient.batch_meter_usage( UsageRecords=usageRecord, ProductCode='productCode' ) ``` For more information about `BatchMeterUsage`, see [BatchMeterUsage](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_BatchMeterUsage.html) in the *AWS Marketplace Metering Service API Reference*. ### Example response ``` { 'Results': [ { 'UsageRecord': { 'Timestamp': datetime(2015, 1, 1), 'CustomerIdentifier': 'string', 'CustomerAWSAccountId': 'string', 'Dimension': 'string', 'Quantity': 123 }, 'MeteringRecordId': 'string', 'Status': 'Success' | 'CustomerNotSubscribed' | 'DuplicateRecord' }, ], 'UnprocessedRecords': [ { 'Timestamp': datetime(2015, 1, 1), 'CustomerIdentifier': 'string', 'CustomerAWSAccountId': 'string', 'Dimension': 'string', 'Quantity': 123 } ] } ``` ## `BatchMeterUsage` code example: With License ARN The following code example is relevant for SaaS products that support Concurrent Agreements. The `LicenseArn` and `CustomerAWSAccountId` are returned by the `ResolveCustomer` API when a buyer registers to your product. ``` # NOTE: Your application will need to aggregate usage for the # customer for the hour and set the quantity as seen below. # AWS Marketplace can only accept records for up to an hour in the past. # # LicenseArn and CustomerAWSAccountId are returned by the ResolveCustomer # API when a buyer registers to your product # Import AWS Python SDK import boto3 from datetime import datetime usageRecord = [{ 'LicenseArn' : 'licenseArn', 'Timestamp': datetime(2015, 1, 1), 'CustomerAWSAccountId': 'awsAccountId', 'Dimension': 'string', 'Quantity': 123 }] marketplaceClient = boto3.client('meteringmarketplace') response = marketplaceClient.batch_meter_usage( UsageRecords = usageRecord ) ``` ### Example response ``` { 'Results': [ { 'UsageRecord': { 'Timestamp': datetime(2015, 1, 1), 'CustomerIdentifier': 'string', 'CustomerAWSAccountId': 'string', 'Dimension': 'string', 'Quantity': 123, 'LicenseArn': 'string' }, 'MeteringRecordId': 'string', 'Status': 'Success' | 'CustomerNotSubscribed' | 'DuplicateRecord' }, ], 'UnprocessedRecords': [ { 'Timestamp': datetime(2015, 1, 1), 'CustomerIdentifier': 'string', 'CustomerAWSAccountId': 'string', 'Dimension': 'string', 'Quantity': 123, 'LicenseArn': 'string' } ] } ``` ## `BatchMeterUsage` with usage allocation tagging code example (Optional) The following code example is relevant for SaaS subscriptions and contracts with usage pricing models, but not for SaaS contract products without usage. The Python example sends a metering record with appropriate usage allocation tags to AWS Marketplace to charge your customers for pay-as-you-go fees. ``` # NOTE: Your application will need to aggregate usage for the # customer for the hour and set the quantity as seen below. # AWS Marketplace can only accept records for up to an hour in the past. # # productCode is supplied after the AWS Marketplace Ops team has # published the product to limited # # You can use either: # - customerID from the ResolveCustomer response # - AWS account ID of the buyer # Import AWS Python SDK import boto3 import time # Option 1: Using CustomerIdentifier (for new or updated integrations, use the customer AWS account ID) usageRecords = [ { "Timestamp": int(time.time()), "CustomerIdentifier": "customerID", "Dimension": "Dimension1", "Quantity": 3, "UsageAllocations": [ { "AllocatedUsageQuantity": 2, "Tags": [ { "Key": "BusinessUnit", "Value": "IT" }, { "Key": "AccountId", "Value": "*********" }, ] }, { "AllocatedUsageQuantity": 1, "Tags": [ { "Key": "BusinessUnit", "Value": "Finance" }, { "Key": "AccountId", "Value": "*********" }, ] }, ] } ] # Option 2: Using CustomerAWSAccountId (preferred) # usageRecords = [ # { # "Timestamp": int(time.time()), # "CustomerAWSAccountId": "awsAccountId", # "Dimension": "Dimension1", # "Quantity": 3, # "UsageAllocations": [ # { # "AllocatedUsageQuantity": 2, # "Tags": [ # { "Key": "BusinessUnit", "Value": "IT" }, # { "Key": "AccountId", "Value": "*********" }, # ] # }, # { # "AllocatedUsageQuantity": 1, # "Tags": [ # { "Key": "BusinessUnit", "Value": "Finance" }, # { "Key": "AccountId", "Value": "*********" }, # ] # }, # ] # } # ] marketplaceClient = boto3.client('meteringmarketplace') response = marketplaceClient.batch_meter_usage( UsageRecords=usageRecords, ProductCode="testProduct" ) ``` For more information about `BatchMeterUsage`, see [BatchMeterUsage](https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_BatchMeterUsage.html) in the *AWS Marketplace Metering Service API Reference*. ### Example response ``` { "Results": [ { "Timestamp": "1634691015", "CustomerIdentifier": "customerId", "CustomerAWSAccountId": "awsAccountId", "Dimension": "Dimension1", "Quantity": 3, "UsageAllocations": [ { "AllocatedUsageQuantity": 2, "Tags": [ { "Key": "BusinessUnit", "Value": "IT" }, { "Key": "AccountId", "Value": "*********" } ] }, { "AllocatedUsageQuantity": 1, "Tags": [ { "Key": "BusinessUnit", "Value": "Finance" }, { "Key": "AccountId", "Value": "*********" } ] } ], "MeteringRecordId": "8fjef98ejf", "Status": "Success" } ], "UnprocessedRecords": [ { "Timestamp": "1634691015", "CustomerIdentifier": "customerId", "CustomerAWSAccountId": "awsAccountId", "Dimension": "Dimension1", "Quantity": 3, "UsageAllocations": [] } ] } ``` # Delivering your products through a Amazon VPC using AWS PrivateLink Using AWS PrivateLink AWS Marketplace supports AWS PrivateLink, an AWS service that allows you to use the Amazon network to provide buyers with access to products you sell through AWS Marketplace. The following sections outline the process for configuring and delivering your products through an Amazon Virtual Private Cloud (VPC) endpoint using AWS PrivateLink technology. This topic assumes that you have working knowledge of several AWS services and the AWS Marketplace environment. **Topics** + [ ## Introduction ](#introduction) + [ ## Configuring your product ](#configuring-your-product) + [ ## Submitting your product to AWS Marketplace ](#submitting-your-product-to-aws-marketplace) + [ ## Buyer access to VPC endpoints ](#customer-access-to-vpc-endpoints) + [ ## Appendix: Checklists ](#appendix-checklists) ## Introduction As an AWS Marketplace seller, you can provide buyers access to your service through an Amazon VPC endpoint. This approach provides buyers with access to your service across the Amazon network using [AWS PrivateLink](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Introduction.html#what-is-privatelink) technology. If you use AWS Marketplace to create and deliver this offering, buyers can discover your service in AWS Marketplace. Your buyers can also find your product in the list of available services for creating a VPC endpoint. ![\[Diagram showing AWS PrivateLink connectivity between buyer and seller VPCs. The diagram illustrates how a buyer application in one VPC connects to seller services in another VPC through private endpoints, bypassing the public internet. Blue arrows show the connection flow through interface endpoints to multiple service instances.\]](http://docs.aws.amazon.com/marketplace/latest/userguide/images/private-endpoint-diagram.png) A [VPC endpoint](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints.html) is a virtual device that enables AWS customers to create a private connection between their VPC and another AWS service without requiring access over the internet, through a NAT device, a VPN connection, or Direct Connect. You can create an endpoint service through AWS Marketplace that makes it possible for buyers to use this technology to connect to your service. This connection method is more secure for your buyers because they access your service through the Amazon private network rather than through the Internet. For each region where you want to offer your service, you create or use existing resources to configure a VPC, set up your service instances, set up a network load balancer, and register your services with the network load balancer by creating a service endpoint. After you complete those steps and test your offering, you provide your configuration information to the the [AWS Marketplace Seller Operations](https://aws.amazon.com/marketplace/management/contact-us/) team. AWS recommends that you provide a private DNS name that your buyers can use when they create VPC endpoints. When buyers create their VPC endpoints, they have the option to enable a private DNS name. By choosing this option, the buyer’s VPC service configures a [private hosted zone](http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html). If you provide the private DNS name, buyers can use it when configuring VPC endpoints to connect to your service. In the buyer’s private hosted zone, the private DNS name (api.example.com) will point to the randomly generated DNS name(s) (vpce-11111111111111111-yyyyyyyy.api.vpce.example.com) created for your endpoint service(s). The buyer's EC2 instances call the same unified DNS name (api.example.com) across different VPCs. Also, if public and private DNS names are same, the buyer can use the same public name when accessing your service from within or outside of the VPC. For assistance with making your service available through AWS Marketplace, you can contact the [AWS Marketplace Seller Operations](https://aws.amazon.com/marketplace/management/contact-us/) team. When an AWS Marketplace buyer subscribes to your service and creates a VPC endpoint, your service is shown under **Your AWS Marketplace Services**. The AWS Marketplace Seller Operations team uses the user-friendly DNS name for ease of discovery of your service when creating the VPC endpoint. Your product is created as a software as a service (SaaS) product. Metering and billing is the same as with other AWS Marketplace SaaS products. ## Configuring your product To configure your product to be available through an Amazon VPC endpoint: 1. Create or use an existing [Amazon VPC](https://aws.amazon.com/documentation/vpc/). 1. Create (or use existing) [Amazon EC2](https://aws.amazon.com/documentation/ec2/) instance(s) for your product. 1. Create a [network load balancer](http://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancer-getting-started.html) in each of the regions where you offer your product. AWS recommends that you include all [Availability Zones](http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-disable-az.html) (AZs) for a region. 1. Use the Amazon VPC console, the CLI, or supported SDKs to create a VPC endpoint service. 1. Verify that you can access the service through the network load balancer. 1. [Request a certificate from AWS Certificate Manager (ACM)](http://docs.aws.amazon.com/acm/latest/userguide/gs-acm-request.html) for your user-friendly DNS name. Before ACM issues a certificate, it validates that you own or control the domain names in your certificate request. 1. Delegate the subdomain of your user-friendly DNS name, such as api.vpce.example.com, to the name servers provided to you by the AWS Marketplace Seller Operations team. In your DNS system, you must create a name server (NS) resource record to point this subdomain to the Amazon Route 53 name servers provided by the AWS Marketplace Seller Operations team so that DNS names (such as vpce-0ac6c347a78c90f8.api.vpce.example.com) are publicly resolvable. 1. Allow access to your buyers' AWS accounts. **Note**: You can use a supported SDK or this CLI command to automate access to accounts: aws vpcev2 modify-vpc-endpoint-service-permissions --service-id vpce-svc-0123456789abcdef1 --add-allowed-principals arn:aws:iam::111111111111:root arn:aws:iam::222222222222:root. ## Submitting your product to AWS Marketplace During the process of publishing your service to AWS Marketplace, you work with the AWS Marketplace Seller Operations team. To submit your PrivateLink-enabled product: 1. Email the following information to the [AWS Marketplace Seller Operations](https://aws.amazon.com/marketplace/management/contact-us/) team: 1. The endpoint and the AWS account used to create the endpoint. The endpoint is similar to this: com.amazonaws.vpce.us-east-1.vpce-svc-0daa010345a21646 1. The user-friendly DNS name for your service. This is the DNS name that AWS Marketplace buyers use to access your product. 1. The AWS account that you used to request certificates and the private DNS name buyers use to access the VPC endpoint. The AWS Marketplace Seller Operations team verifies your company’s identity and the DNS name to use for the service you are registering (such as api.vpce.example.com). After verification, the DNS name overrides the default base endpoint DNS name. ## Buyer access to VPC endpoints AWS Marketplace buyers who are creating a VPC endpoint can discover your service in these situations: + You followed the seller processes described earlier on this page to create or use an existing product. + The buyer subscribes to your service. + You added the buyer's AWS account to your list of allowed accounts. When the buyer creates the VPC endpoint, they have the option to associate a private hosted zone with their VPC. The hosted zone contains a record set for the default private DNS name for the service that resolves to the private IP address of the endpoint network interfaces in their VPC. Any buyer-hosted endpoint, including AWS Marketplace services, can provide permissions to all accounts (the "\$1" permission). However, when you use this approach, the services aren't included in the **Describe** calls or console unless you search by the service name. To display the services in the **Describe** calls, the buyer's AWS account must be explicitly added to the allow list by the service. To access your service, buyers do the following: 1. Discover and subscribe to your service on AWS Marketplace. 1. Use the AWS Command Line Interface (AWS CLI), API, or the Amazon VPC console to discover your service and then establish a VPC endpoint to connect to your service in the subnets and AZs they use. The endpoints are shown as elastic network interfaces in the subnets. Local IP addresses and region and zonal DNS names are assigned to the endpoints. | **Client-side DNS name** | **Name** | | --- | --- | | Regional | Vpce<0dc9a211a78c90f8>.api.vpce.example.com | | IAD2 (1a ) | **us-east-1a**-Vpce<0dc9a211a78c90f8>.api.vpce.example.com | | IAD2 (1b ) | **us-east-1b**-Vpce<0dc9a211a78c90f8>.api.vpce.example.com | If you provided a default private DNS name and the buyer chooses **Enable Private DNS Name** (associated a private hosted zone) when creating a VPC endpoint, the buyer sees the regional default private DNS name to connect to your service. | **Name** | **Alias** | **Alias hosted zone ID** | **(Notes)** | | --- | --- | --- | --- | | api.example.com | vpce<0dc9a211a78c90f8>. api.vpce.example.com | Z00AABBCCDD | IAD1 IAD2 | ## Appendix: Checklists Use the following checklists to ensure that you configure and test your product before you submit it to the AWS Marketplace Seller Operations team. ### Product creation checklist + Create (or use an existing) VPC and then configure it. + Create and configure a network load balancer within the VPC. + Register your service with your network load balancer by creating a VPC endpoint service. + Provide the AWS account ID you used to configure the VPC endpoint to the AWS Marketplace Seller Operations team. + Provide the default endpoint service name (for example, com.amazonaws.vpce.us-east-1.vpce-svc-0bbb070044a2164) to the AWS Marketplace Seller Operations team. + Provide a user-friendly service DNS name (required) to override the randomly generated service DNS name. Request SSL certificates from ACM for the subdomain used for your user-friendly service DNS name. Provide these certificates and the AWS account ID you used to request them to the AWS Marketplace Seller Operations team. + Recommended: Provide a private DNS name. + Create a process to inform and allow your AWS Marketplace buyers the option to connect to your service using AWS PrivateLink technology. Add AWS account IDs for your buyers to your allowed list of accounts. ### Product testing + Verify that your service is configured and discoverable. + Verify that your service is discoverable over the network load balancer. + Verify that a buyer can create a VPC endpoint and access your service. Use an AWS account you own that is not the account you used to set up your service. # Troubleshooting SaaS products The following topics explain how to troubleshoot common SaaS product issues and error messages in AWS Marketplace. ## Common SaaS error messages The following table lists the most common SaaS error messages and their solutions. | Error Message | Solution | | --- | --- | | Agreement creation failed due to seller compliance issues or an unsupported offer currency in your region. Contact the seller to ensure the correct offer is extended to you. | By design, AWS Marketplace prevents sellers from buying their own products. Please use a different account and allow list that account to your product for testing purposes. For more information, see [Configuring SaaS product settings in AWS Marketplace](saas-product-settings.md). | | UsageBasedPricingTerm can't be updated until xxx-xx-xxT00:00:00Z because you have requested a price increase in the past 120 days. | Your product might have active subscriptions. Due to these active subscriptions, you need to wait for the effective change date to pass before modifying your listing. This is a standard procedure to ensure service continuity for your current subscribers. If you have questions or need further assistance, contact the [AWS Marketplace seller operations](https://aws.amazon.com/marketplace/management/contact-us/) team. | | INVALID\$1FULFILLMENT\$1URL Provide the correct format for the fulfillment URL. Begin with 'https://' | Ensure URL starts with `https://` or `http://` Validate URL format and accessibility Test fulfillment endpoint before submission Correct format: [https://your-saas-app.com/fulfillment](https://your-saas-app.com/fulfillment) For more information, refer to [Configuring SaaS product settings in AWS Marketplace](saas-product-settings.md). | | You do not have sufficient permissions to access this page. | If you encounter an error when choosing the **Offers** tab in the AWS Marketplace Management Portal, ensure that you meet the prerequisites at For more information, refer to *How can a seller resolve errors when access the Offers tab* in the [Private offer FAQ](private-offer-faq.md), earlier in this guide. | | INVALID\$1MEDIA\$1LOCATION | Ensure Amazon S3 URLs are accessible and properly formatted https://s3.amazonaws.com/your-bucket/your-logo.png Logo requirements: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/marketplace/latest/userguide/troubleshoot-saas.html) | | Remove unsupported characters | `¦`, `§`, `'`, `—`, `–`, `•` Use standard ASCII characters in product descriptions For more information, see [Providing metadata for AWS Marketplace products](categories-and-metadata.md) earlier in this guide. | | DUPLICATE\$1SELLER\$1ENTITY A seller entity already exists for this account. | Check existing seller registration status Use `UpdateSeller` instead of `CreateSeller` for modifications Contact AWS Marketplace support if duplicate registration persists For more information, refer to [Registration process](registration-process.md) earlier in this guide. | | SELLER\$1ENTITLEMENT\$1EXISTS This principal already has entitlements to be a seller in AWS Marketplace. | Verify current seller status in the AWS Marketplace Management Portal Use appropriate update operations instead of creation Review IAM permissions and roles For more information, refer to [Registration process](registration-process.md) earlier in this guide. | | UNSUPPORTED\$1DELIVERY\$1OPTION The existing default URL-based SaaS products cannot be updated to use API delivery options. | Create new product for API-based delivery Cannot convert between URL-based and API-based SaaS products Plan product architecture before initial creation | | INCOMPATIBLE\$1DELIVERY\$1OPTION\$1TYPES You provided an `ApiDeliveryOption` for a product that already contains `SaaSUrlDeliveryOptions`. | Create separate products for different delivery types Choose either API or URL-based delivery at product creation Review product requirements before setup |