This article describes the different AWS roles we currently have and use on Labra for Co-sell.
Labra for Co-sell enables the sync between ACE and your CRM. To make this possible, some setup with AWS Resources is required.
Notice it has 2 sections:
- ACE API
- ACE Legacy S3 Bucket
ACE API
This is a new set of APIs released by AWS, and they only allow to sync Opportunities at the time.
Overview
Following is an overview of what resources are getting created via the CTF:
- Creates two IAM roles for cross-account access (production and staging)
- Configures EventBridge rules to capture AWS Partner Central events
- Sets up an SNS topic for event notifications
- Establishes an SNS subscription to forward events to OppSync SQS queue
CFT Detailed Explanation
IAM Roles
We are creating two IAM Roles OppSyncCrossaccountRole and OppSyncCrossaccountRoleSTG which are used to perform Opportunity management operations. These two roles also have permissions to send and receive events to SNS and perform subscription operations.
SNS Resources
LabraOppSyncEventBridgeSNSTopic: Creates an SNS topic for event notifications
LabraOppSyncSNSTopicPolicy: Allows EventBridge to publish to the SNS topic.
EventBridge Configuration
LabraOppSyncAceAPIEventBridgeRule: Creates a rule that:
- Monitors the default event bus
- Captures events that are sent from AWS Partner Central
- Sends matching events to the SNS topic
SNS Subscription
LabraOppSyncAceAPIEventBridgeSubscription: Forwards all messages from the SNS topic to an SQS queue in our account.
Outputs
Returns the ARNs of both IAM roles for reference
Workflow
- When an create/update event occurs on an opportunity/engagement in AWS Partner Central it is forwarded to EventBridge (us-east-1) of the account to which Partner Central is connected.
- The event is sent to the SNS topic
- SNS forwards the event to our SQS queue
- Oppsync can assume the IAM roles (with appropriate credentials) to perform operations related to Opportunity Management in this account.
Permission details
| Action | Description |
| partnercentral:CreateOpportunity | allows creating opportunities |
| partnercentral:UpdateOpportunity | allows updating opportunities |
| partnercentral:ListOpportunities | allows listing opportunities |
| partnercentral:GetOpportunity | allows retrieving opportunity details |
| partnercentral:ListSolutions | allows listing solutions |
| partnercentral:AssociateOpportunity | allows associating opportunities with other entities |
| partnercentral:DisassociateOpportunity | allows disassociating opportunities from other entities |
| partnercentral:AcceptEngagementInvitation | allows accepting engagement invitations |
| partnercentral:RejectEngagementInvitation | allows rejecting engagement invitations |
| partnercentral:GetEngagementInvitation | allows retrieving engagement invitation details |
| partnercentral:ListEngagementInvitations | allows listing engagement invitations |
| partnercentral:SubmitOpportunity | allows submitting opportunities |
| partnercentral:GetAwsOpportunitySummary | allows retrieving AWS opportunity summary |
| aws-marketplace:ListEntities | allows listing AWS Marketplace entities |
| aws-marketplace:DescribeEntity | allows describing AWS Marketplace entities |
| aws-marketplace:SearchAgreements | allows searching agreements in AWS Marketplace |
| aws-marketplace:DescribeAgreement | allows describing agreements in AWS Marketplace |
| sns:ConfirmSubscription | Validates a subscription request (used with HTTP/email endpoints) |
| sns:ListSubscriptions | Lists all active subscriptions |
| sns:ListTopics | Lists all available SNS topics |
| sns:Subscribe | Creates new subscriptions to topics |
| sns:Unsubscribe | Removes existing subscriptions |
| sns:Publish | Sends messages to an SNS topic |
AWS Resources
- S3 bucket
- KMS key
- IAM Role
Introducing some context:
ACE AWS Account: account owned by ACE to which Labra/Customer does not have access.
Customer's AWS Account: any account that is owned by the customer.
Labra's AWS Account: This is the production account where Labra servers run.
Fig. 1
ACE Setup for Legacy S3 Bucket Integration
This Legacy S3 bucket integration is still required only for syncing `Leads` and it is only available for partners that are ACE Eligible
S3 Buckets
Once the 3rd party integration is enabled on ACE, two S3 buckets are created; these are owned and managed by ACE and live on ACE's AWS account. One bucket is for production, and the other one is for staging (a.k.a beta)
The S3 buckets are used for the integration because it has outbound and inbound folders where leads and opportunities flow through. Now, to access folders, we need to have special permissions:
Fig. 2
An IAM Role will be required, one that will be live on Customer's AWS Account with a Trusted Relationship that includes the Account ID of Labra's AWS Account so Labra can assume the role and access the S3 bucket for the ACE integration on the customer's behalf.
To create this IAM Role, the customer is asked to use this CloudFormation template (see contents here). The parameters will change based on the customer and whether it is for staging or production. For extra security, the IAM Role can only be assumed with an External ID, which is provided by Labra.
ACE AWS Policy
ACE will provide an AWS Policy that will need to be attached to the IAM Role mentioned before.
📒 Note: only the customer can do this since that account is owned by them.
An example of the AWS Policy is:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:DescribeKey",
"s3:ListBucket",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Resource": [
"arn:aws:s3:::ace-apn-33333-prod-us-west-2",
"arn:aws:kms:us-west-2:123456789012:key/df216356-609b-4c47-9af9-bd487ec"
]
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"s3:DeleteObjectTagging",
"s3:PutObject",
"s3:GetObject",
"s3:GetObjectTagging",
"s3:PutObjectTagging",
"s3:DeleteObject",
"s3:PutObjectAcl"
],
"Resource": "arn:aws:s3:::ace-apn-33333-prod-us-west-2/*"
}
]
}
While the policy states that the actions PutObject , GetObject , DeleteObject , etc. can be executed, they can only be done in certain folders of that bucket. ACE has some restrictions, like for example only ACE can upload files into the outbound folder, which means an opportunity or lead has been created/updated on ACE.
KMS
A KSM ARN is provided in the previous policy and is used to encrypt and decrypt the contents of the S3 bucket. This is a standard practice by ACE.