Error User is not authorized to call ResolveCustomer for this product.

Question

related: https://stackoverflow.com/questions/66212804/aws-marketplace-integration-net-core-amazonawsmarketplacemeteringclient-res

we get this error

```
Error User is not authorized to call ResolveCustomer for this product
```

when trying to make a call to ResolveCustomer. the linked answer says The API needs to called from the seller account id used to publish the SaaS application to successfully resolve the token. but this is a huge security risk for us. that account is tied to an individual (the owner with root privileges over our organization) and we cannot run the application under an individual's credentials. we want to use a service account to run the application. how can we fix this?

Leo K · Answer

You should associate the compute platform where you run your code with an AWS IAM role. For example, if you're running your code on an EC2 instance, associate the IAM role with an EC2 instance profile, and attach the instance profile to your EC2 instance. If your code is running in a Lambda function, as another example, configure the IAM role as the Lambda function's execution role.

Configured this way, when you run code on your EC2 instance or in your Lambda function, without specifying any credentials, and call ResolveCustomer or any other AWS API, the underlying AWS SDK for .NET library will automatically discover that it's running on top of an AWS compute platform. It will then transparently obtain temporary credentials from the AWS-provided platform and execute the API call with temporary credentials belonging to the IAM role.

In this case, the IAM role and the compute platform must reside in the seller account, and the IAM permissions policies that you attach to the role must allow the appropriate permissions, including `aws-marketplace:ResolveCustomer` from your question. An example policy statement is in this documentation section: https://docs.aws.amazon.com/marketplace/latest/userguide/iam-user-policy-for-aws-marketplace-actions.html#iam-user-policy-for-saas-products

The IAM role is not tied to a person, and it only has the permissions that it's explicitly granted by applicable permissions policies. The word "account" refers to the AWS account where your resources reside, not to the credentials under which certain code runs. This is different from Microsoft Active Directory Domain Services (AD DS), for example, where "account" is typically used to refer to the credentials used to authenticate as a user, computer, or service. The credentials associated with an AWS IAM role are always temporary and randomly generated by the AWS platform (STS or Auth Runtime Service), not statically specified in the style of a service account password in classical Microsoft AD DS.

Error User is not authorized to call ResolveCustomer for this product.

Add your answer

Relevant content