CoSell docs Open CoSell

Connect your AWS account

CoSell calls the AWS Partner Central API as an IAM role that you create in your AWS account: the one linked to your Partner Central organisation. You can see and remove that role at any time.

Deploy the access role

  1. Go to Settings → AWS accounts and choose Download template (step 1). It is a CloudFormation template made for your workspace, and it carries your workspace's external ID.
  2. In the AWS console of the account linked to Partner Central, open CloudFormation in us-east-1 (N. Virginia). Create a stack from the template and acknowledge that it creates IAM resources.
  3. When the stack is complete, copy the role ARN from its Outputs tab.
  4. Back in CoSell, under Step 2 · Register the role, enter a label, the 12-digit account ID, the role ARN and the catalog, then choose Link and verify:
    • AWS: real opportunities.
    • Sandbox: test opportunities that AWS never reviews.

CoSell verifies the link straight away by listing your Partner Central solutions. The link shows verified, or the exact error AWS returned.

What the role allows

The template creates two things:

  • The access role CoSellPlatformAccess-us-east-1. Only HabileLabs' platform role can assume it, and only with your external ID. It allows the Partner Central Selling actions CoSell needs: create, update, submit and read opportunities; list solutions; answer engagement invitations; and the engagement tasks those actions run. It also has read-only Get*/List* access to Partner Central and read access to your AWS Marketplace agreements and entities, used by Ask Partner Central. Since October 2026 it may also create and update benefit (funding) applications. The Partner Central agent uses that only for a change a person approved in CoSell, and only in workspaces that allow agent changes.
  • Multi-partner opportunities (October 2026): the role may set your organisation's snapshot job role, and pass only the one this template creates (CoSellResourceSnapshotJob-us-east-1, with AWS's managed policy for snapshot jobs). See Partners on an opportunity.
  • Private offers (October 2026): the role may draft a private offer (the Catalog API's CreateOffer, UpdateInformation and UpdateTargeting changes only), never release one. It may also read change sets and agreements. See Private offers.
  • An EventBridge rule that forwards Partner Central events (opportunity changes, new invitations) from your account's default event bus to CoSell, so updates arrive in seconds instead of on the 15-minute reconciliation.

The role gets no other AWS permissions. See Security and data.

Keep the role up to date

When CoSell adds a capability that needs a new permission, download the template again and update the existing stack with it: same stack, same external ID. If a page says AWS refused … the IAM role created by your onboarding template does not allow it, that is the fix.

Several AWS accounts

Organisations with more than one Partner Central account (SPMS) can link each of them. One link is the default. To send different deals to different accounts, add routing rules under Mapping → Which AWS account gets each deal. An AWS account cannot be removed while a routing rule or a live opportunity still uses it.