AWS Marketplace

Using AWS Private Marketplace to govern access to AWS Marketplace products in AWS GovCloud (US) Regions

Customers in AWS GovCloud (US) Regions often need to control subscriptions and manage access to products available in AWS Marketplace. AWS Private Marketplace enables organizations to build and manage catalogs of approved products in AWS Marketplace that comply with internal policies and requirements in terms of security and compliance. AWS Private Marketplace also provides centralized management of custom catalogs of approved products that can be inherited by AWS GovCloud (US) Region accounts. This gives organizations selection, speed, and agility for simplified purchase and deployment for public sector, government, education, and other regulated customers.

In this post, I show you how to create a Private Marketplace experience in an AWS account in a standard AWS Region. A Private Marketplace experience includes your curated list of approved AWS Marketplace products as well as branding elements, including title, description, color and logo customization. Once you create a Private Marketplace experience, you can use it to govern access to AWS Marketplace products in the associated AWS GovCloud (US) Region account. I will also demonstrate how to deploy approved products from the AWS GovCloud (US) Region account and show how non-approved products will fail.

Solution walkthrough: Using AWS Private Marketplace to govern access to AWS Marketplace products in AWS GovCloud (US) Regions

This solution walks through the following steps:

  1. Create a Private Marketplace experience in an account in a standard Region.
  2. Find and add a product available for the AWS GovCloud (US) Regions.
  3. Customize and enable the Private Marketplace experience.
  4. Deploy an approved product from the associated AWS GovCloud (US) Region account.
  5. Deploy a non-approved product from the associated AWS GovCloud (US) Region account.

Prerequisites

For this walkthrough, you need the following prerequisites:

Every account in the AWS GovCloud (US) Region has an associated account in the standard Region where billing occurs for both accounts. The marketplace restrictions placed on this standard AWS region account will be enforced on the associated AWS GovCloud (US) region account.

Step 1: Create a Private Marketplace experience

To create a Private Marketplace experience, you must log in to an account in a standard AWS Region. This account must be associated with the AWS GovCloud (US) Region account that you want to govern access to AWS Marketplace products. If your account is part of an AWS Organizations account structure, you must create the first Private Marketplace experience from the management account. You do not have to enable this Private Marketplace experience; you must only create it.

A. Create the Private Marketplace experience

To create your Private Marketplace experience, do the following:

  1. Log in to the account in the standard Region with a Private Marketplace administrator role.
  2. Navigate to Private Marketplace administrator’s page.
  3. In the navigation pane, choose Experiences.
  4. On the Experiences page, choose Create experience.
  5. Enter a title and description for the experience.
  6. Choose Create experience. The following screenshot shows the Experiences page with a new Experience called Private Marketplace Experience.

Screenshot of Private Marketplace experience page

B. Create an account group for the Private Marketplace experience

To create an account group for your new Private Marketplace experience, do the following:

  1. In the navigation pane, choose Account groups.
  2. On the Account groups page, choose Create account group.
  3. Enter a title and description for the account group.
  4. Under Associate AWS account, enter the account number for the account in the standard Region (in Prerequisites) and choose Add.
  5. Under Associate experience, use the search bar to select the experience that you just created.
  6. Choose Create account group.

Step 2: Find and add the product available for the AWS GovCloud (US) Regions

To add products to your Private Marketplace experience, you must search for and add AWS Marketplace products available in AWS GovCloud (US) Regions. This enables users in the specified account group to subscribe to and deploy those products.

A. Find a product

  1. In the navigation pane, choose Experiences.
  2. On the Experiences page, choose the experience that you created in step 1A.
  3. On the experience details page, choose Products and then choose All AWS Marketplace products.
  4. Search for a product of interest. For example, in the search bar, enter CentOS 7 (x86_64) – with Updates HVM By Centos.org. The following screenshot shows six products that result from this search.

Screenshot of Private Marketplace products catalog with search bar

  1. Choose the product. This opens the product overview page in a new browser window or tab.

B. Verify the product’s availability in AWS GovCloud (US) Regions and add it to the experience

To verify the product’s availability in Aws GovCloud (US) Regions and add it to your experience, do the following:

  1. In the new browser window or tab, under Pricing, select the Region radio button. It should list AWS GovCloud (US) East, AWS GovCloud (US) West, or both.
  2. In the original browser window or tab, choose the product.
  3. Choose Add.

Screenshot of marketplace pricing information for product

To verify that the product was added to the experience, on the experience details page, choose Approved products. The added product is listed there.

Step 3: Customize and enable the Private Marketplace experience

You can configure the Private Marketplace’s branding settings such as your organization logo, title, and color scheme. Then you can enable the Private Marketplace experience to go live.

A. Customize the experience

  1. In the navigation pane, choose Experiences.
  2. On the Experiences page, choose the experience that you created.
  3. On the experience details page, choose Settings.
  4. Under Profile settings, configure Logo, Name and Description, and Theme Color.
  5. Choose Update and wait until the customization completes. The status appears at the top of the page.

B. Enable the experience

  1. Under Status and requests, toggle the slider to enable or disable Software requests. This setting allows users in to create requests for software.
  2. Once all customization is complete, toggle the Experience status to Live (enabled). This might take a minute to complete.
  3. To disable the Private Marketplace, toggle the status to Not Live.

The following screenshot shows the Settings page of my sample experience, with my logo file uploaded, my name and description entered, and my theme color selected. I’ve also toggled Experience status to Live and Software requests to Requests on.

Screenshot of Private Marketplace experience settings. Includes ability to modify logo, name, an description of the Private Marketplace

Step 4: Launch the approved product from the associated AWS GovCloud (US) Region account

Now you can test deployment of the approved CentOS 7 (x86_64) – with Updates HVM product. To do this, do the following:

  1. Log in to the associated AWS GovCloud (US) Region account as an end user.
  2. Open the Amazon EC2 console.
  3. Choose Launch instance.
  4. Under Choose an Amazon Machine Image (AMI), select AWS Marketplace.
  5. For Search AWS Marketplace Products, enter CentOS 7 (x86_64) – with Updates HVM By Centos.org.
  6. Select the product and choose Continue.
  7. Choose Review and Launch.

This subscribes the product and deploys it. This might take a minute to complete. After the product is deployed, you can confirm the subscription in the account in the standard Region under Manage Subscriptions.

Step 5: Verify that a product not listed in the Private Marketplace doesn’t deploy

To verify that a product not listed in the Private Marketplace experience fails to deploy, do the following:

  1. On the Amazon EC2 console, choose Launch instance.
  2. Under Choose an Amazon Machine Image (AMI), select AWS Marketplace.
  3. For Search AWS Marketplace Products, enter Kali Linux.
  4. Select the product and choose Continue.
  5. Choose Review and Launch. You should receive the Launch Failed message This product isn’t currently available for Private Marketplace. Refer to the following screenshot.

Screenshot of Error message: Launch Failed. This product isn’t currently available for your Private Marketplace

Cleaning up

To avoid incurring future charges, delete the resources that you created in this walkthrough.

A. Terminate the approved product’s EC2 instance

  1. Navigate to the Amazon EC2 console.
  2. Choose the Running Instance ID that is associated with CentOS 7 (x86_64) – with Updates HVM By Centos.org.
  3. Choose Instance state and then choose Terminate instance.

B. Remove the approved product from the AWS Marketplace subscriptions

  1. Log in to the account in the standard Region with an administrator role.
  2. Navigate to AWS Marketplace Subscriptions page.
  3. In the navigation pane, choose Manage Subscriptions.
  4. Choose Manage CentOS 7 (x86_64) – with Updates HVM By Centos.org.
  5. Choose Actions and then choose Cancel subscription.
  6. Select the I understand that I will continue to be charged for all running instances even after canceling my subscription.
  7. Choose Yes, cancel subscription.

C.  Disable the Private Marketplace experience

  1. Navigate to Private Marketplace administrator’s page.
  2. In the navigation pane, choose Experiences.
  3. On the Experiences page, choose the experience that you created.
  4. On the experience details page, choose Settings.
  5. Under Status and requests, toggle the Experience status to Not Live (enabled). This might take a minute to complete.

Conclusion

In this post, I showed you how to use AWS Private Marketplace to create a catalog of approved products in an account in a standard Region. I showed how to use this Private Marketplace to govern access to AWS Marketplace products in the associated AWS GovCloud (US) Region account. Then I demonstrated how to deploy the approved products and how non-approved products fail during the deployment process. To learn more about Private Marketplace, visit the Private Marketplace documentation here.

About the authors

Ji Jung is a Solutions Architect whose areas of expertise include AWS Marketplace. He’s passionate about cloud technologies and building innovative solutions to help customers. When not working, he enjoys spending time with his family and playing sports.

 

 

Adam Hesch is a Solutions Architect on the Amazon Web Services Federal Systems Integrator team. He works with AWS customers to provide guidance on architecture and best practices for operating Federal information systems in the cloud. When he’s not working with customers, he enjoys spending time with this family and working on his house.