Labra for Co-sell AWS Resources Policy

ACE API Integration

AWS recently introduced a new set of ACE API capabilities for AWS Partner Central that enable opportunity synchronization. At this time, these APIs support synchronization of opportunities only. As AWS continues to expand the capabilities of the ACE APIs, additional functionality may become available in future releases.

The OppSync integration leverages these APIs to securely synchronize opportunity-related information between AWS Partner Central and your AWS account.

Overview

When deploying the CloudFormation Template (CFT), the following AWS resources are created to enable secure communication between your AWS account and Labra's OppSync platform:

• Two IAM roles for secure cross-account access (Production and Staging environments)
• Amazon EventBridge rules to capture relevant AWS Partner Central events
• An Amazon SNS topic for event notifications
• An SNS subscription that securely forwards events to Labra's OppSync event processing queue

These resources work together to provide secure, event-driven synchronization of opportunity-related data.

CloudFormation Template Resources

IAM Roles

The CloudFormation Template creates the following IAM roles:

• OppSyncCrossaccountRole
• OppSyncCrossaccountRoleSTG

These roles allow OppSync to securely perform opportunity management operations within your AWS account. They also provide the permissions required to send and receive event notifications and manage SNS subscriptions as part of the integration.

SNS Resources

The following SNS resources are created:

• LabraOppSyncEventBridgeSNSTopic – Creates an SNS topic used for AWS Partner Central event notifications.
• LabraOppSyncSNSTopicPolicy – Allows Amazon EventBridge to publish events to the SNS topic.

EventBridge Configuration

The LabraOppSyncAceAPIEventBridgeRule resource creates an EventBridge rule that:

• Monitors the default EventBridge bus.
• Captures relevant events originating from AWS Partner Central.
• Sends matching events to the SNS topic for processing.

SNS Subscription

The LabraOppSyncAceAPIEventBridgeSubscription resource creates an SNS subscription that securely forwards event notifications from the SNS topic to Labra's OppSync processing queue.

Outputs

Upon successful deployment, the CloudFormation Template returns the Amazon Resource Names (ARNs) for both IAM roles for reference and configuration purposes.

Integration Workflow

1. An opportunity or engagement is created or updated within AWS Partner Central.
    
2. AWS sends the corresponding event to Amazon EventBridge (us-east-1) for the AWS account connected to Partner Central.
    
3. EventBridge forwards the event to the SNS topic created by the CloudFormation Template.
    
4. SNS securely delivers the event to Labra's OppSync processing queue.
    
5. OppSync assumes the appropriate IAM role to perform opportunity management operations within the customer's AWS account.

This event-driven architecture enables near real-time synchronization while maintaining secure, cross-account access controls.

Permissions Used by the Integration

Why Does the Integration Use AWSPartnerCentralFullAccess?

AWS frequently introduces enhancements to AWS Partner Central, including new APIs, functionality, and permission requirements. Using the AWS-managed AWSPartnerCentralFullAccess policy provides several benefits:

• Ensures continued compatibility as AWS evolves the Partner Central APIs and permission model.
• Reduces the need for customers to update IAM policies or redeploy the CloudFormation Template when AWS introduces changes.
• Allows customers to take advantage of new AWS Partner Central capabilities as they become available.
• Minimizes operational overhead while maintaining alignment with AWS-managed best practices.