AWSPartnerCentralFullAccess

Last Modified

Oct 17, 2026

October 17, 2026 at 12:03 PM UTC

Version

v15

Total Versions

9

Created

Oct 17, 2026

Actions

34

Risk

Medium

The same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

  • Medium

    Can take over other users or roles

    Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.

    • sts-001sts:AssumeRolescoped
      • sts:AssumeRole: on arn:aws:iam::*:role/PartnerCentralChannelBillingTransferManagement, arn:aws:iam::*:role/PartnerCentralChannelBillingTransferReadOnly

    Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.

Policy Document

View on GitHub
{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "PassAWSPartnerCentralRole",
          "Effect": "Allow",
          "Action": [
            "iam:PassRole"
          ],
          "Resource": "arn:aws:iam::*:role/PartnerCentralRoleFor*",
          "Condition": {
            "StringEquals": {
              "iam:PassedToService": "partnercentral-account-management.amazonaws.com"
            }
          }
        },
        {
          "Sid": "PartnerUserRoleAssociation",
          "Effect": "Allow",
          "Action": [
            "iam:ListRoles",
            "Partnercentral-account-management:AssociatePartnerUser",
            "Partnercentral-account-management:DisassociatePartnerUser"
          ],
          "Resource": "*"
        },
        {
          "Sid": "AWSPartnerCentralAccess",
          "Effect": "Allow",
          "Action": [
            "partnercentral:*"
          ],
          "Resource": "*",
          "Condition": {
            "StringEquals": {
              "partnercentral:Catalog": [
                "AWS",
                "Sandbox"
              ]
            }
          }
        },
        {
          "Sid": "VerificationAccess",
          "Effect": "Allow",
          "Action": [
            "partnercentral:StartVerification",
            "partnercentral:GetVerification"
          ],
          "Resource": "*"
        },
        {
          "Sid": "PassAWSPartnerCentralSnapshotJobRole",
          "Effect": "Allow",
          "Action": [
            "iam:PassRole"
          ],
          "Resource": [
            "arn:aws:iam::*:role/*"
          ],
          "Condition": {
            "StringEquals": {
              "iam:PassedToService": "resource-snapshot-job.partnercentral-selling.amazonaws.com"
            }
          }
        },
        {
          "Sid": "LegacyPartnerCentralAccess",
          "Effect": "Allow",
          "Action": [
            "partnercentral-account-management:AccessLegacyPartnerCentral"
          ],
          "Resource": "*"
        },
        {
          "Sid": "PartnerCentralMarketingAccess",
          "Effect": "Allow",
          "Action": [
            "partnercentral-account-management:AccessMarketingCentral"
          ],
          "Resource": "*"
        },
        {
          "Sid": "ChannelBillingTransferRoleAccess",
          "Effect": "Allow",
          "Action": [
            "sts:AssumeRole"
          ],
          "Resource": [
            "arn:aws:iam::*:role/PartnerCentralChannelBillingTransferManagement",
            "arn:aws:iam::*:role/PartnerCentralChannelBillingTransferReadOnly"
          ]
        },
        {
          "Sid": "PartnerCentralEphemeralWriteS3Access",
          "Effect": "Allow",
          "Action": [
            "s3:PutObject"
          ],
          "Resource": "arn:aws:s3:::aws-partner-central-marketplace-ephemeral-writeonly-files/${aws:PrincipalAccount}/*"
        },
        {
          "Sid": "SupportAccess",
          "Effect": "Allow",
          "Action": [
            "support:CreateCase",
            "support:DescribeCases",
            "support:AddCommunicationToCase",
            "support:ResolveCase",
            "support:AddAttachmentsToSet",
            "support:DescribeCommunications"
          ],
          "Resource": "*"
        },
        {
          "Sid": "ListEntitiesAccess",
          "Effect": "Allow",
          "Action": [
            "aws-marketplace:ListEntities"
          ],
          "Resource": "*"
        },
        {
          "Sid": "DescribeEntityAccess",
          "Effect": "Allow",
          "Action": [
            "aws-marketplace:DescribeEntity"
          ],
          "Resource": [
            "arn:aws:aws-marketplace:*:*:AWSMarketplace*/Solution/*",
            "arn:aws:aws-marketplace:*:*:AWSMarketplace*/OfferSet/*",
            "arn:aws:aws-marketplace:*:*:AWSMarketplace*/Offer/*",
            "arn:aws:aws-marketplace:*:*:AWSMarketplace*/CaseStudy/*"
          ]
        },
        {
          "Sid": "AWSMarketplaceAgreementsReadAccess",
          "Effect": "Allow",
          "Action": [
            "aws-marketplace:SearchAgreements",
            "aws-marketplace:DescribeAgreement"
          ],
          "Resource": "*",
          "Condition": {
            "ForAllValues:StringEquals": {
              "aws-marketplace:AgreementType": [
                "PurchaseAgreement"
              ]
            }
          }
        },
        {
          "Sid": "AmazonQPartnerAssistantAccess",
          "Effect": "Allow",
          "Action": [
            "q:StartConversation",
            "q:SendMessage",
            "q:GetConversation",
            "q:ListConversations",
            "q:PassRequest"
          ],
          "Resource": "*"
        },
        {
          "Sid": "PartnerCentralAgentsSessionAccess",
          "Effect": "Allow",
          "Action": [
            "partnercentral:UseSession"
          ],
          "Resource": "*",
          "Condition": {
            "StringEquals": {
              "partnercentral:Catalog": [
                "AWS",
                "Sandbox"
              ]
            },
            "Bool": {
              "aws:IsMcpServiceAction": "true"
            }
          }
        },
        {
          "Sid": "CaseStudyStartChangeSet",
          "Effect": "Allow",
          "Action": [
            "aws-marketplace:StartChangeSet"
          ],
          "Resource": [
            "arn:aws:aws-marketplace:*:*:AWSMarketplace*/CaseStudy/*",
            "arn:aws:aws-marketplace:*:*:AWSMarketplace*/ChangeSet/*"
          ],
          "Condition": {
            "StringEquals": {
              "catalog:ChangeType": [
                "CreateCaseStudy",
                "UpdateInformation",
                "ReleaseCaseStudy",
                "RestrictCaseStudy",
                "UpdateVisibility"
              ]
            }
          }
        },
        {
          "Sid": "CaseStudyDescribeChangeSet",
          "Effect": "Allow",
          "Action": [
            "aws-marketplace:DescribeChangeSet"
          ],
          "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace*/ChangeSet/*"
        },
        {
          "Sid": "CaseStudyListChangeSets",
          "Effect": "Allow",
          "Action": [
            "aws-marketplace:ListChangeSets"
          ],
          "Resource": "*"
        },
        {
          "Sid": "CaseStudyEntityTagAccess",
          "Effect": "Allow",
          "Action": [
            "aws-marketplace:ListTagsForResource",
            "aws-marketplace:TagResource",
            "aws-marketplace:UntagResource"
          ],
          "Resource": "arn:aws:aws-marketplace:*:*:AWSMarketplace*/CaseStudy/*"
        }
      ]
    },
    "VersionId": "v15",
    "IsDefaultVersion": true,
    "CreateDate": "2026-10-17T11:37:08+00:00"
  }
}

Version History (12 recorded)

Raw history
v15updated

6 actions added

1eabc19

AWSPartnerCentralFullAccess - Policy Version v14

No recorded action delta - this version predates the change index. View the raw diff.

Mar 12, 2026

193c1ba

AWSPartnerCentralFullAccess - Policy Version v13

No recorded action delta - this version predates the change index. View the raw diff.

Feb 12, 2026

e3fc8de

AWSPartnerCentralFullAccess - Policy Version v9

No recorded action delta - this version predates the change index. View the raw diff.

Feb 12, 2026

ec88edb

AWSPartnerCentralFullAccess - Policy Version v5

No recorded action delta - this version predates the change index. View the raw diff.

Feb 5, 2026

260c9fc

AWSPartnerCentralFullAccess - Policy Version v4

No recorded action delta - this version predates the change index. View the raw diff.

Feb 5, 2026

4c3794e

AWSPartnerCentralFullAccess - Policy Version v4

No recorded action delta - this version predates the change index. View the raw diff.

Dec 1, 2025

d268850

AWSPartnerCentralFullAccess - Policy Version v3

No recorded action delta - this version predates the change index. View the raw diff.

Dec 1, 2025

23fffe4

AWSPartnerCentralFullAccess - Policy Version v3

No recorded action delta - this version predates the change index. View the raw diff.

Nov 19, 2025

e471255

AWSPartnerCentralFullAccess - Policy Version v2

No recorded action delta - this version predates the change index. View the raw diff.

Nov 19, 2025

c459c6e

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Dec 10, 2024

17395b9

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Nov 19, 2024

4320705