AWS Partner Central

Step 1 — Get connection parameters from Cotillion

1. Sign in to your Cotillion workspace at cotillion.indyrct.com .
2. Open Vendor portals in the sidebar → pick AWS → switch to the Connection Information tab.
3. The screen gives you everything for the next step:
   • Role name — create your role with exactly this name (CotillionPartnerCentralAccess). The name is not free-form: Cotillion builds the role ARN from your account id + this fixed name, so a differently-named role will not be found.
   • Trust policy — a ready-to-paste JSON block with Cotillion’s account id and your organization’s ExternalId already filled in. Copy the whole block; you don’t assemble it by hand.
   • AWS Partner Central catalog (Sandbox or AWS; just informational — tells you which Partner Central directory this Cotillion environment is wired against).

Copy the trust policy; you’ll paste it in the next step.

Step 2 — Create the IAM role in your AWS account

In your AWS Console, switch to the account that owns your AWS Partner Central registration and open IAM → Roles → Create role.

1. Choose Custom trust policy and paste the trust policy from Step 1 — Cotillion already filled in its account id and your ExternalId, so you copy it as-is. It looks like this:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": { "AWS": "arn:aws:iam::COTILLION_ACCOUNT_ID:root" },
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": { "sts:ExternalId": "EXTERNAL_ID_FROM_COTILLION" }
         }
       }
     ]
   }

2. Attach the AWS managed policies Cotillion needs. In the role’s permissions step, search for and attach:

   • AWSPartnerCentralOpportunityManagement — required. Grants the Partner Central Selling API surface Cotillion uses (ListOpportunities, GetOpportunity, CreateOpportunity, UpdateOpportunity, AssociateOpportunity, SubmitOpportunity, StartEngagementFromOpportunityTask, …).
   • AWSMcpServiceActionsFullAccess — required. Grants partnercentral:UseSession, which lets Cotillion’s in-product AI assistant talk to AWS’s hosted Partner Central agent on your behalf (read-only Q&A about funding eligibility, programs, AWS-side status).
   • PartnerCentralIncentiveBenefitManagement — optional. Required only if you intend to register opportunities for AWS incentive / funding benefit programs through Cotillion. Safe to attach proactively.

   We recommend AWS managed policies (above) over an inline policy with a hand-curated action list because AWS extends the managed policies as the Partner Central Selling API surface evolves — your role keeps working when new actions are added, with no IAM edits on your side.

3. Name the role exactly CotillionPartnerCentralAccess and finish. This name is required — Cotillion builds the role ARN from your account id and this fixed name, so a renamed or differently-named role will not be found.

4. Note your 12-digit AWS Account ID (the account you just created the role in) — that is the only value Cotillion needs from you.

Step 3 — Provide your AWS Account ID to Cotillion

1. Return to the Cotillion AWS Partner Central setup screen → Connect tab.
2. Enter your 12-digit AWS Account ID (the account you created the role in) into the AWS Account ID field. That’s all — you do not paste a role ARN. Cotillion builds it for you as arn:aws:iam::<your-account-id>:role/CotillionPartnerCentralAccess.
3. Click Test & Connect. The region is fixed to us-east-1 — AWS Partner Central is single-region, there is no region selector. The catalog (Sandbox or AWS) is set by Cotillion per environment and shown in the Connection Information tab — it is not a choice on the Connect form.

What happens automatically:

• ✅ Cotillion builds the role ARN from your account id + the fixed role name and calls sts:AssumeRole with it and your ExternalId.
• ✅ Calls ListOpportunities(MaxResults=1) to confirm the role’s partnercentral-selling permissions are correct.
• ✅ Stores only the derived role ARN, KMS-encrypted at rest. The ExternalId stays server-side (resolved per tenant on every call) and is never persisted on the integration row. No AWS access keys are ever held.