AWSPartnerCentralFullAccess
Last Modified
Oct 17, 2026
October 17, 2026 at 12:03 PM UTC
Version
v15
Total Versions
9
Created
Oct 17, 2026
Actions
34
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can take over other users or roles
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- sts:AssumeRole: on arn:aws:iam::*:role/PartnerCentralChannelBillingTransferManagement, arn:aws:iam::*:role/PartnerCentralChannelBillingTransferReadOnly
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PassAWSPartnerCentralRole",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": "arn:aws:iam::*:role/PartnerCentralRoleFor*",
"Condition": {
"StringEquals": {
"iam:PassedToService": "partnercentral-account-management.amazonaws.com"
}
}
},
{
"Sid": "PartnerUserRoleAssociation",
"Effect": "Allow",
"Action": [
"iam:ListRoles",
"Partnercentral-account-management:AssociatePartnerUser",
"Partnercentral-account-management:DisassociatePartnerUser"
],
"Resource": "*"
},
{
"Sid": "AWSPartnerCentralAccess",
"Effect": "Allow",
"Action": [
"partnercentral:*"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"partnercentral:Catalog": [
"AWS",
"Sandbox"
]
}
}
},
{
"Sid": "VerificationAccess",
"Effect": "Allow",
"Action": [
"partnercentral:StartVerification",
"partnercentral:GetVerification"
],
"Resource": "*"
},
{
"Sid": "PassAWSPartnerCentralSnapshotJobRole",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "resource-snapshot-job.partnercentral-selling.amazonaws.com"
}
}
},
{
"Sid": "LegacyPartnerCentralAccess",
"Effect": "Allow",
"Action": [
"partnercentral-account-management:AccessLegacyPartnerCentral"
],
"Resource": "*"
},
{
"Sid": "PartnerCentralMarketingAccess",
"Effect": "Allow",
"Action": [
"partnercentral-account-management:AccessMarketingCentral"
],
"Resource": "*"
},
{
"Sid": "ChannelBillingTransferRoleAccess",
"Effect": "Allow",
"Action": [
"sts:AssumeRole"
],
"Resource": [
"arn:aws:iam::*:role/PartnerCentralChannelBillingTransferManagement",
"arn:aws:iam::*:role/PartnerCentralChannelBillingTransferReadOnly"
]
},
{
"Sid": "PartnerCentralEphemeralWriteS3Access",
"Effect": "Allow",
"Action": [
"s3:PutObject"
],
"Resource": "arn:aws:s3:::aws-partner-central-marketplace-ephemeral-writeonly-files/${aws:PrincipalAccount}/*"
},
{
"Sid": "SupportAccess",
"Effect": "Allow",
"Action": [
"support:CreateCase",
"support:DescribeCases",
"support:AddCommunicationToCase",
"support:ResolveCase",
"support:AddAttachmentsToSet",
"support:DescribeCommunications"
],
"Resource": "*"
},
{
"Sid": "ListEntitiesAccess",
"Effect": "Allow",
"Action": [
"aws-marketplace:ListEntities"
],
"Resource": "*"
},
{
"Sid": "DescribeEntityAccess",
"Effect": "Allow",
"Action": [
"aws-marketplace:DescribeEntity"
],
"Resource": [
"arn:aws:aws-marketplace:*:*:AWSMarketplace*/Solution/*",
"arn:aws:aws-marketplace:*:*:AWSMarketplace*/OfferSet/*",
"arn:aws:aws-marketplace:*:*:AWSMarketplace*/Offer/*",
"arn:aws:aws-marketplace:*:*:AWSMarketplace*/CaseStudy/*"
]
},
{
"Sid": "AWSMarketplaceAgreementsReadAccess",
"Effect": "Allow",
"Action": [
"aws-marketplace:SearchAgreements",
"aws-marketplace:DescribeAgreement"
],
"Resource": "*",
"Condition": {
"ForAllValues:StringEquals": {
"aws-marketplace:AgreementType": [
"PurchaseAgreement"
]
}
}
},
{
"Sid": "AmazonQPartnerAssistantAccess",
"Effect": "Allow",
"Action": [
"q:StartConversation",
"q:SendMessage",
"q:GetConversation",
"q:ListConversations",
"q:PassRequest"
],
"Resource": "*"
},
{
"Sid": "PartnerCentralAgentsSessionAccess",
"Effect": "Allow",
"Action": [
"partnercentral:UseSession"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"partnercentral:Catalog": [
"AWS",
"Sandbox"
]
},
"Bool": {
"aws:IsMcpServiceAction": "true"
}
}
},
{
"Sid": "CaseStudyStartChangeSet",
"Effect": "Allow",
"Action": [
"aws-marketplace:StartChangeSet"
],
"Resource": [
"arn:aws:aws-marketplace:*:*:AWSMarketplace*/CaseStudy/*",
"arn:aws:aws-marketplace:*:*:AWSMarketplace*/ChangeSet/*"
],
"Condition": {
"StringEquals": {
"catalog:ChangeType": [
"CreateCaseStudy",
"UpdateInformation",
"ReleaseCaseStudy",
"RestrictCaseStudy",
"UpdateVisibility"
]
}
}
},
{
"Sid": "CaseStudyDescribeChangeSet",
"Effect": "Allow",
"Action": [
"aws-marketplace:DescribeChangeSet"
],
"Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace*/ChangeSet/*"
},
{
"Sid": "CaseStudyListChangeSets",
"Effect": "Allow",
"Action": [
"aws-marketplace:ListChangeSets"
],
"Resource": "*"
},
{
"Sid": "CaseStudyEntityTagAccess",
"Effect": "Allow",
"Action": [
"aws-marketplace:ListTagsForResource",
"aws-marketplace:TagResource",
"aws-marketplace:UntagResource"
],
"Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace*/CaseStudy/*"
}
]
},
"VersionId": "v15",
"IsDefaultVersion": true,
"CreateDate": "2026-10-17T11:37:08+00:00"
}
}Version History (12 recorded)
Raw history6 actions added
AWSPartnerCentralFullAccess - Policy Version v14
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
193c1baAWSPartnerCentralFullAccess - Policy Version v13
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
e3fc8deAWSPartnerCentralFullAccess - Policy Version v9
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
ec88edbAWSPartnerCentralFullAccess - Policy Version v5
No recorded action delta - this version predates the change index. View the raw diff.
Feb 5, 2026
260c9fcAWSPartnerCentralFullAccess - Policy Version v4
No recorded action delta - this version predates the change index. View the raw diff.
Feb 5, 2026
4c3794eAWSPartnerCentralFullAccess - Policy Version v4
No recorded action delta - this version predates the change index. View the raw diff.
Dec 1, 2025
d268850AWSPartnerCentralFullAccess - Policy Version v3
No recorded action delta - this version predates the change index. View the raw diff.
Dec 1, 2025
23fffe4AWSPartnerCentralFullAccess - Policy Version v3
No recorded action delta - this version predates the change index. View the raw diff.
Nov 19, 2025
e471255AWSPartnerCentralFullAccess - Policy Version v2
No recorded action delta - this version predates the change index. View the raw diff.
Nov 19, 2025
c459c6eUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 10, 2024
17395b9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 19, 2024
4320705