Overview

By integrating with programs such as APN Customer Engagement (ACE) and ISV Accelerate, ISV/Sellers can scale their co-sell programs more effectively. The integration streamlines the process of managing information about leads and opportunities, reducing manual efforts and eliminating the need to maintain data in two separate systems, such as the Salesforce CRM and AWS Partner Central.

Through the integration, ISV/Sellers can easily manage new opportunities and leads. They can accept new opportunities and leads, receive updates on them from AWS, and send new opportunities and updates on their leads and opportunities to AWS. All of these actions are supported by an AWS-managed S3 bucket, which acts as an intermediary in the bi-directional exchange of files.

Before Integration

Several resources need to be prepared before creating the integration with APN Customer Engagement (ACE).

1. Create AWS IAM User/Role
   Create two IAM users or IAM roles, one for sandbox/test environment, and the other for production environment. Their names shall be like below. Select Programmatic access for the type of access this set of users will have. This creates an access key for each new user.
   • apn-ace-{partnerName}-AccessUser-beta
   • apn-ace-{partnerName}-AccessUser-prod
   
   
2. Request for Provisioning an S3 Bucket
   Email your Partner Development Manager (PDM) with partner-crm-integration@amazon.com in CC with the following details.
   • ARN of the Sandbox IAM User / Role
   • ARN of the Production IAM User / Role
   
   Once AWS receives the ARN details, the engineering team will provision the S3 bucket for Sandbox, create a policy that will allow partner to access the S3 bucket and share the following details with Partner.
   • SPMS ID (Partner ID)
   • Bucket Name
   • IAM Policy File
   
   
3. Attach IAM Policy to IAM User
   Copy the policy contents from the email you received from AWS PDM, and create a new IAM policy named as below. Then attach it with the IAM user/role created in the step 1.
   • ACE-CRM-Integration-S3-Bucket-Access

Create Integration

There are two authentication methods available for creating the AWS ACE integration in the Sugar console. The first method involves providing credentials for the IAM User. The second and recommended method is to set up an IAM role with a policy that allows the Sugar service to assume the role. The latter option is preferable as it eliminates the need to pass and store secrets, making it a more secure approach.

IAM User with Credentials

1. Create the Access Key (including Access Key ID and Secret Access Key) for the IAM user apn-ace-{partnerName}-AccessUser-prod in the AWS IAM console.
2. Visit the integration page of Suger console, click the button 'Connect' in the AWS ACE integration card. There are five fields to input. Select IAM User with Credentials.
   • AWS Partner ID
   • AWS S3 Bucket Region: The AWS region of the S3 bucket provisioned by AWS ACE team.
   • AWS S3 Bucket Name: The Name of the S3 bucket provisioned by AWS ACE team.
   • AWS IAM User ARN: It is apn-ace-{partnerName}-AccessUser-prod created before.
   • AWS IAM User Access Key Id
   • AWS IAM User Secret Access Key
3. After the connection is created, click the button Verify to finish the verification of the AWS ACE integration. Then all set.

IAM Role with AssumeRole

1. Attach the trust policy below to the IAM role apn-ace-{partnerName}-AccessUser-prod in the AWS IAM console. Ask support@suger.io to get the suger-aws-account-id.

   {     "Version": "2012-10-17",     "Statement": [          {               "Effect": "Allow",               "Principal": {                    "AWS": "arn:aws:iam::{suger-aws-account-id}:root"               },               "Action": "sts:AssumeRole"          }     ]}

2. Visit the integration page of Suger console, click the button 'Connect' in the AWS ACE integration card. There are five fields to input. Select IAM Role with AssumeRole.
   • AWS Partner ID
   • AWS S3 Bucket Region: The AWS region of the S3 bucket provisioned by AWS ACE team.
   • AWS S3 Bucket Name: The Name of the S3 bucket provisioned by AWS ACE team.
   • AWS IAM Role ARN: It is apn-ace-{partnerName}-AccessUser-prod created before.
3. After the connection is created, click the button Verify to finish the verification of the AWS ACE integration. Then all set.

Delete Integration

If you need to delete the AWS Partner Network integration, you can do so like any other integration. Once the deletion is triggered, all integration information, including the access token, will be immediately and permanently deleted from Suger. Please note that there is no time window or any means of recovering the deleted data.