Amazon Seller SP-API Trust policy

Thank you for your question, Leon. I understand you're new to this topic and developing a custom app that needs to access the Amazon Selling Partner API (SP-API).

You're on the right track, but there are a few important points to clarify:

1. The IAM role you need to create should be in your own AWS account, not in an Amazon-owned account. This role will allow Amazon's SP-API service to assume the role and access your resources on your behalf.

2. The error you're seeing ("Invalid principal in policy") is likely because the Principal in your trust policy is not correctly formatted. For the Amazon SP-API, you need to use a specific service principal, not an AWS account number.

3. The correct trust policy for the Amazon SP-API should look like this:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "sellingpartnerapi.amazon.com" }, "Action": "sts:AssumeRole" } ] }

This policy allows the Amazon Selling Partner API service to assume the role.

4. After creating the role with this trust policy, you'll need to attach the necessary permissions policies to the role to define what actions it can perform.

5. Once you've created and configured the role, you'll need to provide the ARN (Amazon Resource Name) of this role to Amazon when setting up your SP-API application.

Remember, you're creating this role in your own AWS account to allow Amazon's service to access your resources in a controlled manner. You're not creating anything in Amazon's account.

I hope this helps clarify the process for you, Leon. If you have any more questions as you proceed with setting up your SP-API access, don't hesitate to ask.
Sources
Update a role trust policy - AWS Identity and Access Management
Access to AWS accounts owned by third parties - AWS Identity and Access Management

Hello,

Thank you for your reply.

I proceeded as follows:

1. IAM --> Roles --> Create role
2. AWS service --> EC2 (only as placeholder) --> Next
3. add authorizations (is not needed?!) --> Next
4. assign role name --> click on edit at “Step 1: Selection of trusted entities”
5. select user-defined trust policy
6. insert this code* there --> Next
7. click on Create role
8. this error appears: Invalid principal in policy: “SERVICE”: “sellingpartnerap*.amazon.com”

Code: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "sellingpartnerap*.amazon.com" }, "Action": "sts:AssumeRole" } ] }

I have read that not all AWS regions/accounts support this service principal?

Regards, Leon