I tried to organize the differences between restricting AWS Marketplace buyers with SCPs and Private Marketplace
This page has been translated by machine translation. View original
Introduction
Previously, I introduced a method to restrict users who can purchase AWS Marketplace products using AWS Organizations Service Control Policies (SCPs).
With this method, aws-marketplace:Subscribe executed from regular IAM roles is denied by SCP, and only IAM roles created from a purchasing permission set are excluded from the Deny targets.
On the other hand, AWS Marketplace has Private Marketplace, which manages products that can be purchased within an organization as an approved catalog.
Both can be used to restrict AWS Marketplace purchases, but they primarily differ in what they control.
- Method of restricting purchasers with SCP
- Which IAM principals can perform purchase operations
- Private Marketplace
- Which AWS Marketplace products can be purchased
This article organizes the differences between these two methods in terms of what they control, their scope of application, and use cases.
Note that for clarity, this article uses the term "purchase," but SCP primarily controls the aws-marketplace:Subscribe action.
Conclusion
The differences between the two methods are as follows.
| Comparison Item | Method of Restricting Purchasers with SCP | Private Marketplace |
|---|---|---|
| Application Unit | Root, OU, AWS Account | Organization, OU, AWS Account |
| Control Axis | Exclude purchasing role from Deny targets using aws:PrincipalArn |
Products approved by Experience |
| Granting temporary purchase permissions to specific users | Well-suited | Not well-suited on its own |
| Approval per product | Not possible | Possible |
| Approving different products per OU or AWS Account | Not possible | Possible |
| Application to Organizations management account | Cannot be restricted with SCP | Governance targeting the entire organization is possible |
| Restricting use of existing subscriptions | Not directly restricted | Not restricted |
| Restricting EC2 launches from subscribed AMIs | Not directly restricted | Not restricted |
The decision axis is the target you want to control.
- Control who can perform purchase operations: SCP and IAM permissions
- Control what can be purchased: Private Marketplace
- Control both: Combine the two
What Each Method Controls
SCP Limits the Roles That Can Perform Purchase Operations
With the method of restricting purchasers using SCP, you limit the IAM roles that can execute aws-marketplace:Subscribe.
For example, you can prevent regular IAM roles from making purchases, and exclude only the IAM roles created from a purchasing permission set from the SCP Deny targets.
-
Regular IAM roles
- aws-marketplace:Subscribe is denied
-
IAM roles created from the purchasing permission set
- Excluded from SCP Deny targets
When a purchase is needed, assign the purchasing permission set to the target user and target AWS account.
User submits a purchase request
↓
Administrator assigns the purchasing permission set
↓
User logs in with the purchasing permission set
↓
Purchases an AWS Marketplace product
↓
Administrator removes the permission set assignment
What this method controls is not the product being purchased, but the IAM principal performing the purchase operation.
IAM roles created from the purchasing permission set are excluded from the SCP Deny targets. If aws-marketplace:Subscribe is permitted in the IAM policy on the permission set side, AWS Marketplace products can be subscribed to.
SCP is not a policy that grants permissions. It defines the upper limit of permissions available to IAM users and IAM roles in Organizations member accounts. Simply excluding from the SCP Deny targets does not allow purchases; purchase operations must also be permitted in IAM policies or permission sets.
aws-marketplace:Subscribe includes not only subscribing to AWS Marketplace products, but also sending requests for products that require subscription validation, and enabling auto-renewal of existing subscriptions.
Note that SCP does not apply to the Organizations management account. Purchase operations by IAM users or IAM roles within the management account cannot be restricted with this method.
Private Marketplace Limits the Products That Can Be Purchased
Private Marketplace is a feature that creates a catalog of approved AWS Marketplace products and controls which products users within an organization can purchase.
In Private Marketplace, you create a Private Marketplace Experience (hereafter, Experience) and configure primarily the following.
- AWS Marketplace products approved for purchase
- Audience to which the Experience applies
- Status of the Experience
The following can be specified for Audience.
- The entire AWS Organizations organization
- Organizational Unit (OU)
- AWS Account
When an Experience is set to Live, users within the Audience can only purchase products approved in that Experience.
By associating different Experiences with each OU or AWS account, you can differentiate which products can be purchased.
For example, the following kind of management is possible.
Development OU Experience
├ Product A
├ Product B
└ Product C
Production OU Experience
├ Product A
└ Product B
In this case, users in the Development OU can treat Products A, B, and C as purchasable, while users in the Production OU can treat Products A and B as purchasable.
However, Private Marketplace is not a feature that grants IAM permissions for aws-marketplace:Subscribe.
Even if a product is approved in an Experience, it cannot be purchased if the IAM principal being used does not have subscribe permissions.
As an AWS managed policy for managing AWS Marketplace subscriptions, AWSMarketplaceManageSubscriptions is provided. This policy includes permissions for subscribing to and unsubscribing from AWS Marketplace products.
The roles of Private Marketplace and IAM permissions are divided as follows.
-
Private Marketplace
- Whether the organization approves that product for purchase
-
IAM policies or permission sets
- Whether that IAM principal is permitted to perform the purchase operation
Under Private Marketplace governance, a product can be purchased when it is approved in an Experience and the IAM principal being used has subscribe permissions.
The Unit of Product Approval Is the Audience, Not the User
Private Marketplace Audience is specified in units of organization, OU, or AWS account.
It is not a feature that directly specifies specific IAM Identity Center users or groups as Audience.
For example, consider associating an Experience with AWS account 111111111111.
AWS Account 111111111111
├ User A
├ User B
└ User C
Private Marketplace
→ Product X approved
In this case, Users A, B, and C are governed by the same Experience, and Product X is commonly approved in Private Marketplace.
Whether each user can actually purchase Product X also depends on the permissions of the IAM role or permission set they use.
User A
├ Product X is approved
└ aws-marketplace:Subscribe is permitted
→ Can purchase
User B
├ Product X is approved
└ aws-marketplace:Subscribe is not permitted
→ Cannot purchase
In Private Marketplace, users can also submit product purchase requests for unapproved products.
When an administrator approves a request, the target product is approved not only for the user who submitted the request, but for all users associated with that Experience.
Therefore, for requirements like the following, the method of restricting purchasers with SCP is more suitable than Private Marketplace alone.
- Want only the requesting user to be able to make the purchase
- Want to make the purchasing role unavailable once the purchase operation is complete
- Do not want other users using the same AWS account to make purchases
Conversely, if you want products that have been approved to remain continuously purchasable within the same OU or AWS account, Private Marketplace is more suitable.
Existing Subscription Usage Is Not Restricted
Both methods primarily restrict new subscriptions.
The SCP in this case denies aws-marketplace:Subscribe, but does not directly restrict the use of subscribed products or the launch of EC2 instances from their AMIs.
Private Marketplace also does not block the use of existing subscriptions or launching new instances from existing subscriptions.
If you want to restrict even EC2 instance launches from subscribed AMIs, separate permission controls on ec2:RunInstances are required.
How to Choose Based on Requirements
| Requirement | Suitable Method |
|---|---|
| Want to limit users who can perform purchase operations | SCP and IAM Identity Center permission sets |
| Want to allow purchasing only organization-approved products | Private Marketplace |
| Want to vary purchasable products per OU or AWS account | Private Marketplace |
| Want to limit both purchasable products and users who can purchase | Combine Private Marketplace and SCP |
| Want to also restrict EC2 launches from purchased AMIs | Separately consider controlling ec2:RunInstances |
The decision axis is simple.
- To control who can purchase, use SCP and IAM permissions
- To control what can be purchased, use Private Marketplace
- To govern both, combine the two
Summary
The method of combining SCP and IAM Identity Center permission sets is suitable when you want to limit the IAM roles that can perform purchase operations in AWS Marketplace.
Private Marketplace is suitable when you want to manage approved products per organization, OU, or AWS account. If you want to govern both purchasers and purchasable products, combine the two.
