# Getting started
**Note**
To complete the steps listed in this section, you must first complete the [integration prerequisites](crm-integration-setting-up.md).
The steps in the following topics explain how to set up a CRM integration. Each set of steps requires specific user permissions, and the topics list those permissions. You must complete both sets of steps.
**Topics**
+ [Linking your AWS Partner Central and AWS Marketplace accounts](link-pc-mkt-accounts.md)
+ [Creating the IAM user in your AWS Marketplace seller account](create-iam-user-seller-account.md)
+ [Maintaining an integration](crm-integration-ongoing-maintenance.md)
+ [Troubleshooting an integration](troubleshooting.md)
# Linking your AWS Partner Central and AWS Marketplace accounts
The following steps explain how to link your AWS Partner Central and AWS Marketplace seller accounts. You must be have Salesforce alliance lead permissions to complete these steps. You must link the accounts before you can create any type of CRM integration.
**To link the accounts**
1. Do the following:
+ Sign in to your AWS Partner Central account as an alliance lead or cloud administrator.
+ Sign in to your AWS Marketplace seller account.
1. On the Partner Central home page, in the In the upper-right corner, choose **Link accounts**.
The **Account linking prerequisites** dialog box appears.
1. Choose **Continue to account linking**, then choose **Initiate account linking**.
That takes you to the AWS Console and your AWS Marketplace seller account.
1. Do the following:
1. Ensure the correct value appears under **AWS account ID**.
1. In the **Legal business name** box, enter the legal name of your business.
1. Choose **Next**.
That returns you to Partner Central and the **Standard IAM roles** page.
1. Select the following checkboxes:
+ Under **Cloud admin IAM role**, choose **Assign PartnerCentralRoleForCloudAdmin-\$1\$1\$1 role to the AWS Partner Central alliance lead and all active cloud admin users**.
+ Under **Alliance team IAM role**, choose **Assign PartnerCentralRoleForAlliance-\$1\$1\$1 role to all active AWS Partner Central alliance team users**.
+ Under **ACE IAM role**, choose **Assign PartnerCentralRoleForAce-\$1\$1\$1 role to the AWS Partner Central ACE managers and users.**.
1. Choose **Next**, then choose **Link accounts**.
Success messages appear when the linking process finishes.
# Creating the IAM user in your AWS Marketplace seller account
The steps in the following sections explain how to create the IAM user that enables Salesforce to connect to your AWS Marketplace seller account. You create the user, then you assign permissions that enable the user to connect to an Amazon S3 bucket and generate pre-signed URLs.
You create the user in your AWS Marketplace seller account, and you must have AWS administrator permissions to complete these steps.
**Topics**
+ [Creating the IAM user](create-user-steps.md)
+ [Setting Amazon S3 permissions for the IAM user](s3-iam-perms.md)
# Creating the IAM user
Follow these steps to create the IAM user in your AWS Marketplace seller account.
1. In the AWS Marketplace portal, sign in to your seller account.
1. In the navigation pane, choose **Users**, then **Create user**.
1. In the **User name** box, enter **apn-ace-***CompanyName***-AccessUser-prod**, where *CompanyName* is the name of your company, then choose **Next**.
1. On the **Set permissions** page, choose **Attach policies directly**, then choose **Next**.
The **Permissions policies** section appears.
1. Search for **AWSPartnerCentralOpportunityManagement**.
The policy appears in the search results.
1. Select the checkbox next to the policy, then choose **Next**.
**Important**
Do not add other policies or permissions.
1. On the **Review and create** page, choose **Create user**.
# Setting Amazon S3 permissions for the IAM user
The IAM user created for an AWS Marketplace configuration must have permissions to interact with Amazon S3. The Amazon S3 policy shown below grants the IAM user permission to view a bucket, list its contents, upload objects to the bucket, and generate pre-signed URLs for objects in the bucket. The connector requires these permissions because it must upload a custom EULA to an Amazon S3 bucket and generate a pre-signed URL to pass to the AWS Marketplace Catalog API.
The following policy uses the \$1\$1amzn-s3-demo-bucket\$1 fictitious name. Replace it with the name of the your bucket, then attach the policy to your IAM user.
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "S3ListBucket",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::${amzn-s3-demo-bucket}"
]
},
{
"Sid": "AllowS3PutObject",
"Effect": "Allow",
"Action": [
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::${amzn-s3-demo-bucket}/"
]
},
{
"Sid": "AllowCreatePresignedUrl",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:PutObjectAcl",
"s3:GetObject",
"s3:GetObjectAcl"
],
"Resource": [
"arn:aws:s3:::${amzn-s3-demo-bucket}/"
]
}
]
}
```
------
# Maintaining an integration
AWS Partner CRM integrations have the following routine maintenance requirements:
+ **Monitoring AWS updates** – Stay current with AWS updates to processes and data models that may affect the CRM integration.
+ **Adopting new features** – Embrace new features and enhancements released by AWS to ensure your CRM integration remains contemporary and efficient.
## Release cadence
AWS Partner Central doesn't have a fixed release cadence, but updates typically roll out two to four times a year. The updates provide new features, adjustments to data models, or alterations in AWS processes that in turn require modifications to your CRM Integration.
## Expectations for partners
You must allocate resources for regular maintenance and upgrades to your CRM Integration. We recommend that every quarter, you designate two to four weeks of developer and sales operations time to upgrades and maintenance. The investment helps ensure that your integration works properly and uses the latest features provided by AWS.
AWS usually informs Partner Alliance Leads about updates and associated timelines. Ensure open communication channels to receive updates in a timely manner.
# Troubleshooting an integration
The following topics explain how to create a support case and troubleshoot common onboarding and integration errors.
**Topics**
+ [Raising support cases](#raising-support-cases)
+ [Onboarding error messages](#troubleshooting-during-crm-integration-onboarding)
## Raising support cases
If you still have difficulties integrating your CRM with AWS, follow these steps to raise a support case.
1. Sign in to the [AWS Partner Central](https://partnercentral.awspartner.com) with your AWS Partner Network credentials.
1. On the [Support Center for Partner Central](https://partnercentral.awspartner.com/support), choose **Open New Case** and complete the following fields:
+ **Type of Support Case** – AWS Partner Central.
+ **Question regarding** – Partner Central Tools or ACE leads and opportunities.
+ **Get Specific** – Select the most appropriate CRM integration case type.
+ **Subject** – Include a brief description of the request.
+ **Description** – Provide a detailed description of issues, questions, errors, and troubleshooting steps.
+ **Attachments** – Sync logs and screenshots, where applicable.
## Onboarding error messages
The following table lists and describes some common error messages and their resolutions.
| Error message | Error condition | Resolution steps |
| --- | --- | --- |
| Only Alliance Lead contact can make this request. | When anyone other than an Alliance Lead (ACE eligible) tries to: update request status, access request details, abandon request, create new request. | For internal users: Verify that the partner account is ACE eligible. |
| Failed to mark implementation as complete. Please try again. | When you try to mark a request as implementation complete but there an error occurred during the update. | Contact the support team. |
| No Request received. | When you try to abandon a request and there are no requests to abandon. | |
| Your request could not be taken at this time because of an internal error. Check again after some time. | Occurs when internal errors occur when abandoning a request, or during request processing. | Contact the support team. |
| Please provide ARN Details for the IAM User/Role to provision bucket for … | Occurs when you don't provide an ARN for the beta or production IAM user. | IAM details cannot be empty. |
| Duplicate Request: Bucket ARN details already created and provisioned for this IAM User/Role. | Occurs when another request is created for the same partner with the same IAM details and the request is not abandoned. | Abandon the existing request. |
| Please update the IAM ARN details in the existing request. | Occurs when the system tried to process the request and the request failed due to an error. | Update the IAM ARN details and resubmit. |
| Your request could not be taken at this time because of an internal error. Check again after some time. | After a request is submitted and something during the processing failed. | Contact the support team. |