Overview
This document explains the access and permissions provisioned by the CloudFormation Template (CFT) used to integrate your AWS account with the Labra Platform. It is intended to provide complete transparency into:
- The AWS services and permissions requested
- The IAM roles and policies created
- The AWS resources provisioned
- The purpose of each permission and resource
📦 Resources Created by the Template
1. IAM Role: flyout-role-[your-org-name]
An IAM role is created to allow the Labra Platform to securely access specific AWS Marketplace services within your AWS account.
Who Can Assume This Role?
Only the following Labra-managed IAM user can assume this role:
arn:aws:iam::719025730838:user/labra-platform-cmsc-user
Additionally, the role requires a unique External ID supplied by Labra during role assumption.
The External ID provides an additional security layer by preventing unauthorized cross-account role assumption (Confused Deputy protection).
Permissions Granted
| Service | Action Scope | Justification |
| aws-marketplace:* | Full access | Required for programmatic access to AWS Marketplace APIs and listings. |
| aws-marketplace-management:* | Full access | Enables Labra to manage Marketplace listings and configurations. |
| marketplacecommerceanalytics:* | Full access | Allows retrieval of Marketplace usage, sales, and metering reports. |
| support:CreateCase | Create support cases | Used to create Marketplace-related AWS Support cases when required. |
| aws-marketplace-management:viewSupport | Read-only | Allows viewing Marketplace support information. |
| aws-marketplace-management:viewSettings | Read-only | Allows viewing Marketplace configuration settings. |
| SNS permissions | Publish and manage subscriptions | Required to receive AWS Marketplace Catalog API and Agreement lifecycle events. |
| Amazon S3 | s3:ListBucket, s3:GetObject, s3:PutObject, s3:PutObjectAcl, s3:GetObjectAcl, s3:GetBucketAcl, s3:GetEncryptionConfiguration | Enables secure delivery and retrieval of Marketplace Data Feed files. |
| AWS KMS | kms:Encrypt, kms:Decrypt, kms:DescribeKey, kms:GenerateDataKey | Used for encryption and decryption of Marketplace Data Feed files stored in S3. |
Table 1
SNS Permissions are Scoped
SNS permissions are restricted to the following resources:
- AWS Marketplace managed SNS topics
arn:aws:sns:us-east-1:287250355862:aws-mp-*
- Catalog API Events SNS Topic
flyout-capi-events-topic-[your-org-name]
- Concurrent Agreements Events SNS Topic
flyout-concurrent-agreements-events-topic-[your-org-name]
The IAM role is granted only the following SNS actions:
- sns:Publish
- sns:Subscribe
- sns:Unsubscribe
- sns:ConfirmSubscription
- sns:ListSubscriptions
- sns:ListTopics
2. Catalog API Events Pipeline
SNS Topic
flyout-capi-events-topic-[your-org-name]
This SNS topic receives AWS Marketplace Catalog API events from Amazon EventBridge.
EventBridge Rule
flyout-capi-event-bridge-rule-[your-org-name]
The rule listens for AWS Marketplace Catalog API events originating from:
aws.marketplacecatalog
These events include Marketplace catalog change events such as listing updates and product changes.
The events are published to the Catalog API SNS topic and forwarded securely to Labra for processing.
SNS Subscription
The Catalog API SNS topic forwards events to the following Labra-managed Amazon SQS queue:
arn:aws:sqs:us-west-2:719025730838:prd-flyout-marketplace_service-aws_change_set_data-sqs
3. Concurrent Agreements Events Pipeline
SNS Topic
flyout-concurrent-agreements-events-topic-[your-org-name]
This SNS topic is used to process AWS Marketplace Agreement lifecycle events.
EventBridge Rule
flyout-concurrent-agreements-event-bridge-rule-[your-org-name]
The rule listens for Marketplace Agreement events originating from:
aws.agreement-marketplace
This includes events such as:
- Purchase Agreement Created
- Purchase Agreement Amended
- Purchase Agreement Ended
- License Updated
- License Deprovisioned
These events are forwarded to Labra to keep Marketplace agreement information synchronized.
SNS Subscription
The Concurrent Agreements SNS topic forwards events to the following Labra-managed SQS queue:
arn:aws:sqs:us-west-2:719025730838:prd-marketplace-eventbridge-notifications-queue
4. Marketplace Data Feeds Infrastructure
To enable automated Marketplace Data Feed ingestion, the template provisions secure storage, encryption, and notification resources.
AWS KMS Key
A customer-owned AWS KMS key is created to encrypt Marketplace Data Feed files stored in Amazon S3.
Permissions Granted
The following permissions are granted where required:
- kms:Encrypt
- kms:Decrypt
- kms:DescribeKey
- kms:GenerateDataKey
These permissions are used by:
- AWS Marketplace Reports Service
- Labra Platform
- AWS Glue
- Customer AWS Account
Amazon S3 Bucket
labra-data-feeds-[your-org-name]
A dedicated Amazon S3 bucket is created to store AWS Marketplace Data Feed reports.
S3 Permissions
The template grants the following permissions on this bucket:
- s3:ListBucket
- s3:GetObject
- s3:PutObject
- s3:PutObjectAcl
- s3:GetObjectAcl
- s3:GetBucketAcl
- s3:GetEncryptionConfiguration
These permissions enable secure delivery and retrieval of Marketplace Data Feed files.
Data Feeds SNS Topic
labra-data-feeds-notifications-[your-org-name]
AWS Marketplace publishes notifications to this topic whenever new Marketplace Data Feed reports become available.
SNS Subscription
The Data Feeds SNS topic forwards notifications to the following Labra-managed SQS queue:
arn:aws:sqs:us-west-2:719025730838:prd-flyout-marketplace-data-feeds-notification
This enables Labra to automatically detect and process newly available Marketplace Data Feed reports.
✅ Security Considerations
The latest CloudFormation Template follows AWS security best practices:
- Scoped Access: Permissions are limited to AWS Marketplace services and resources required for the integration.
- Principle of Least Privilege: Only the minimum permissions required are granted.
- External ID Protection: Cross-account role assumption requires both the Labra IAM user and a unique External ID.
- Resource-Level Scoping: SNS permissions are restricted to specific Marketplace and Labra-managed topics.
- Encryption at Rest: Marketplace Data Feed files are encrypted using a customer-owned AWS KMS key.
- Secure Storage: Marketplace reports are stored in a dedicated encrypted Amazon S3 bucket.
- Event-Driven Architecture: EventBridge delivers Marketplace Catalog API and Agreement lifecycle events through dedicated SNS topics and SQS queues.
- Controlled Data Feed Processing: Marketplace Data Feed notifications are delivered only through secure SNS and SQS resources provisioned by the template.
🤝 Your Control
You retain full control over:
- Whether to deploy the CloudFormation template.
- Whether to delete or disable the IAM role.
- Whether to remove the EventBridge rules.
- Whether to delete the SNS topics or subscriptions.
- Whether to delete the Marketplace Data Feeds infrastructure (Amazon S3 bucket, AWS KMS key, and SNS topic).
- Auditing all Labra role activity through AWS CloudTrail.