AWS Marketplace ResolveCustomer API Integration

Deterministic Token Handshake & Entitlement Resolution

Automated SaaS Fulfillment & Cross-Account Trust Matrix

Step 01

Subscribe & Redirect

Customer subscribes via AWS Marketplace. AWS executes an HTTP POST to the registered SaaS Fulfillment URL containing a temporary, cryptographically signed x-amzn-marketplace-token.

Step 02

Hub Ingestion

The SaaS Provider Control Plane Hub (workshop_control_tower) captures the RegistrationToken and initiates the automated entitlement validation sequence.

Step 03

ResolveCustomer API

The Hub calls the AWS Marketplace Metering API via ResolveCustomer, securely resolving the permanent CustomerIdentifier and CustomerAWSAccountId without human intervention.

Step 04

IAM Trust Handshake

Resolved customer metadata triggers deterministic IaC pipelines, anchoring the Cross-Account IAM Trust Matrix directly to the customer's BYOA security boundary[cite: 1, 2, 3].

Enterprise Procurement & Security Assurance

Zero Long-Term Secret Exposure: Eliminates static API keys and shared credentials by using ephemeral AWS Marketplace tokens and native IAM assume-role policies.
Seamless EDP Drawdown: Enterprise buyers can procure immediately using existing AWS Enterprise Discount Program (EDP) commitments with zero onboarding friction.
Deterministic Substrate Link: Connects marketplace billing verification directly to the customer's isolated Spoke account (appseed) within seconds[cite: 3, 4].

1-Click AWS Marketplace Procurement & Fulfillment

Establishing the deterministic Cross-Account IAM Trust Matrix to seamlessly bridge the SaaS AI Platform BYOA to your sovereign Data Plane—with zero agent installation.