Deterministic Token Handshake & Entitlement Resolution
Automated SaaS Fulfillment & Cross-Account Trust Matrix
Step 01
Subscribe & Redirect
Customer subscribes via AWS Marketplace. AWS executes an HTTP POST to the registered SaaS Fulfillment URL containing a temporary, cryptographically signed x-amzn-marketplace-token.
Step 02
Hub Ingestion
The SaaS Provider Control Plane Hub (workshop_control_tower) captures the RegistrationToken and initiates the automated entitlement validation sequence.
Step 03
ResolveCustomer API
The Hub calls the AWS Marketplace Metering API via ResolveCustomer, securely resolving the permanent CustomerIdentifier and CustomerAWSAccountId without human intervention.
Step 04
IAM Trust Handshake
Resolved customer metadata triggers deterministic IaC pipelines, anchoring the Cross-Account IAM Trust Matrix directly to the customer's BYOA security boundary[cite: 1, 2, 3].
Enterprise Procurement & Security Assurance
- Zero Long-Term Secret Exposure: Eliminates static API keys and shared credentials by using ephemeral AWS Marketplace tokens and native IAM assume-role policies.
- Seamless EDP Drawdown: Enterprise buyers can procure immediately using existing AWS Enterprise Discount Program (EDP) commitments with zero onboarding friction.
- Deterministic Substrate Link: Connects marketplace billing verification directly to the customer's isolated Spoke account (
appseed) within seconds[cite: 3, 4].
