CoSell docs Open CoSell

Connect your AWS account

CoSell calls the AWS Partner Central API as an IAM role that you create in your AWS account: the one linked to your Partner Central organisation. You can see and remove that role at any time.

Deploy the access role

  1. Go to Settings → AWS accounts and choose Download template (step 1). It is a CloudFormation template made for your workspace, and it carries your workspace's external ID.
  2. In the AWS console of the account linked to Partner Central, open CloudFormation in us-east-1 (N. Virginia). Create a stack from the template and acknowledge that it creates IAM resources.
  3. When the stack is complete, copy the role ARN from its Outputs tab.
  4. Back in CoSell, under Step 2 · Register the role, enter a label, the 12-digit account ID, the role ARN and the catalog, then choose Link and verify:
    • AWS: real opportunities.
    • Sandbox: test opportunities that AWS never reviews.

CoSell verifies the link straight away by listing your Partner Central solutions. The link shows verified, or the exact error AWS returned.

What the role allows

The template creates two things:

  • The access role CoSellPlatformAccess-us-east-1. Only HabileLabs' platform role can assume it, and only with your external ID. It allows the Partner Central Selling actions CoSell needs: create, update, submit and read opportunities; list solutions; answer engagement invitations; and the engagement tasks those actions run. It also has read-only Get*/List* access to Partner Central, used by Ask Partner Central.
  • An EventBridge rule that forwards Partner Central events (opportunity changes, new invitations) from your account's default event bus to CoSell, so updates arrive in seconds instead of on the 15-minute reconciliation.

The role gets no other AWS permissions. See Security and data.

Keep the role up to date

When CoSell adds a capability that needs a new permission, download the template again and update the existing stack with it: same stack, same external ID. If a page says AWS refused … the IAM role created by your onboarding template does not allow it, that is the fix.

Several AWS accounts

Organisations with more than one Partner Central account (SPMS) can link each of them. One link is the default. To send different deals to different accounts, add routing rules under Mapping → Which AWS account gets each deal. An AWS account cannot be removed while a routing rule or a live opportunity still uses it.