Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Marketplace Catalog

AWS Marketplace Catalog (service prefix: aws-marketplace) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Marketplace Catalog
Actions defined by AWS Marketplace Catalog
Resource types defined by AWS Marketplace Catalog
Condition keys for AWS Marketplace Catalog

API operations defined by AWS Marketplace Catalog

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
BatchDescribeEntities	aws-marketplace:DescribeEntity			Read
CancelChangeSet	aws-marketplace:CancelChangeSet			Write
DeleteResourcePolicy	aws-marketplace:DeleteResourcePolicy			Permissions management, Write
DescribeChangeSet	aws-marketplace:DescribeChangeSet			Read
DescribeEntity	aws-marketplace:DescribeEntity			Read
GetResourcePolicy	aws-marketplace:GetResourcePolicy			Read
ListChangeSets	aws-marketplace:ListChangeSets			List
ListEntities	aws-marketplace:DescribeEntity			Read
ListEntities	aws-marketplace:ListEntities			List
ListTagsForResource	aws-marketplace:ListTagsForResource			Read
PutResourcePolicy	aws-marketplace:PutResourcePolicy			Permissions management, Write
StartChangeSet	aws-marketplace:DescribeAgreement			Read
	aws-marketplace:DescribeChangeSet			Read
	aws-marketplace:DescribeEntity			Read
	aws-marketplace:GetAgreementTerms			List
	aws-marketplace:StartChangeSet			Write
	aws-marketplace:TagResource			Tagging, Write
	dataexchange:PublishDataSet			Write
	iam:PassRole	iam:PassedToService	assets.marketplace.amazonaws.com	Write
TagResource	aws-marketplace:TagResource			Tagging, Write
UntagResource	aws-marketplace:UntagResource			Tagging, Write

Actions defined by AWS Marketplace Catalog

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CancelChangeSet	Grants permission to cancel a running change set	ChangeSet*	aws:ResourceTag/${TagKey} catalog:ChangeType	Write
CreateVerificationEvidence	Grants permission to create a new verification evidence resource for BusinessVerification	VerificationEvidence*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteResourcePolicy	Grants permission to delete the resource policy of an existing entity	Entity*	aws:ResourceTag/${TagKey} catalog:ChangeType	Permissions management, Write
DescribeAssessment	Grants permission to return the details of an existing assessment	Assessment		Read
DescribeChangeSet	Grants permission to return the details of an existing change set	ChangeSet*	aws:ResourceTag/${TagKey} catalog:ChangeType	Read
DescribeEntity	Grants permission to return the details of an existing entity	Entity*	aws:ResourceTag/${TagKey} catalog:ChangeType	Read
GetInvoiceSubmissionTask	Grants permission to retrieve details of an existing invoice submission task	InvoiceSubmissionTask*	aws:ResourceTag/${TagKey}	Read
GetIssuedTaxInvoice	Grants permission to retrieve details of a specific tax invoice issued by AWS on behalf of a seller	IssuedTaxInvoice*	aws:ResourceTag/${TagKey}	Read
GetResourcePolicy	Grants permission to get the resource policy of an existing entity	Entity*	aws:ResourceTag/${TagKey} catalog:ChangeType	Read
GetVerification	Grants permission to retrieve the detailed status of a specific verification process, including PSP validation results		aws-marketplace:VerificationType	Read
GetVerificationEvidence	Grants permission to retrieve the complete content of a specific verification evidence resource	VerificationEvidence*	aws:ResourceTag/${TagKey}	Read
ListAssessments	Grants permission to list existing assessments			List
ListChangeSets	Grants permission to list existing change sets			List
ListEntities	Grants permission to list existing entities			List
ListInvoiceSubmissionTasks	Grants permission to list existing invoice submission tasks			List
ListIssuedTaxInvoices	Grants permission to list tax invoices issued by AWS on behalf of a seller			List
ListPayables	Grants permission to list payables of the specified payable provenance			List
ListTagsForResource	Grants permission to list tags on an existing entity, change set, invoice submission task, or issued tax invoice	ChangeSet	aws:ResourceTag/${TagKey} catalog:ChangeType	Read
		Entity	aws:ResourceTag/${TagKey} catalog:ChangeType
		InvoiceSubmissionTask	aws:ResourceTag/${TagKey}
		IssuedTaxInvoice	aws:ResourceTag/${TagKey}
		VerificationEvidence	aws:ResourceTag/${TagKey}
ListVerificationEvidence	Grants permission to list verification evidence resources with summary metadata			List
ListVerifications	Grants permission to list all verification statuses across jurisdictions and verification types		aws-marketplace:VerificationType	List
PutResourcePolicy	Grants permission to attach a resource policy to an existing entity	Entity*	aws:ResourceTag/${TagKey} catalog:ChangeType	Permissions management, Write
StartChangeSet	Grants permission to request a new change set (Note: resource-level permissions for this action and condition context keys for this action are only supported when used with Catalog API and are not supported when used with AWS Marketplace Management Portal)	Entity*	aws-marketplace:Intent aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys catalog:ChangeType	Write
StartInvoiceSubmissionTask	Grants permission to initiate tasks that submit invoices for processing in AWS Marketplace	InvoiceSubmissionTask*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartVerification	Grants permission to submit verification evidence to a Payment Service Provider and enable data sharing for a specified jurisdiction	VerificationEvidence*	aws-marketplace:VerificationType aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add new tags to a resource. Supported resource: Entity, ChangeSet, InvoiceSubmissionTask, IssuedTaxInvoice	ChangeSet	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys catalog:ChangeType	Tagging, Write
		Entity	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys catalog:ChangeType
		InvoiceSubmissionTask	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		IssuedTaxInvoice	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		VerificationEvidence	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a resource. Supported resource: Entity, ChangeSet, InvoiceSubmissionTask, IssuedTaxInvoice	ChangeSet	aws:ResourceTag/${TagKey} aws:TagKeys catalog:ChangeType	Tagging, Write
		Entity	aws:ResourceTag/${TagKey} aws:TagKeys catalog:ChangeType
		InvoiceSubmissionTask	aws:ResourceTag/${TagKey} aws:TagKeys
		IssuedTaxInvoice	aws:ResourceTag/${TagKey} aws:TagKeys
		VerificationEvidence	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateVerificationEvidence	Grants permission to update an existing verification evidence resource using full replacement semantics	VerificationEvidence*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Marketplace Catalog

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Assessment	arn:${Partition}:aws-marketplace:${Region}::${Catalog}/Assessment/${ResourceId}
ChangeSet	arn:${Partition}:aws-marketplace:${Region}:${Account}:${Catalog}/ChangeSet/${ResourceId}	aws:ResourceTag/${TagKey} catalog:ChangeType
Entity	arn:${Partition}:aws-marketplace:${Region}:${Account}:${Catalog}/${EntityType}/${ResourceId}	aws:ResourceTag/${TagKey} catalog:ChangeType
InvoiceSubmissionTask	arn:${Partition}:aws-marketplace:${Region}:${Account}:catalog/${Catalog}/invoice-submission-task/${ResourceId}	aws:ResourceTag/${TagKey}
IssuedTaxInvoice	arn:${Partition}:aws-marketplace:${Region}:${Account}:catalog/${Catalog}/issued-tax-invoice/${ResourceId}	aws:ResourceTag/${TagKey}
VerificationEvidence	arn:${Partition}:aws-marketplace:${Region}:${Account}:verification-type/${VerificationType}/verification-evidence/${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Marketplace Catalog

AWS Marketplace Catalog defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws-marketplace:Intent	Filters access by the Intent parameter in the StartChangeSet request	String
aws-marketplace:VerificationType	Filters access by the verification type for verification process operations (StartVerification, GetVerification, ListVerifications). Valid values: BusinessVerification	String
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
catalog:ChangeType	Filters access by the change type in the StartChangeSet request	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Marketplace (aws-marketplace)

AWS Marketplace Commerce Analytics Service (marketplacecommerceanalytics)