AWSMarketplaceFullAccess

Summary

Provides the ability to subscribe and unsubscribe to AWS Marketplace software, allows users to manage Marketplace software instances from the Marketplace 'Your Software' page, and provides administrative access to EC2. The AWS Marketplace Buyer Guide says it grants administrative permissions for full access to AWS Marketplace and related services, including creating and managing a private marketplace and access to Amazon EC2, CloudFormation and Amazon EC2 Systems Manager.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AWSMarketplaceFullAccessCopy ARN

Default version

v8

Created

2015-02-11

Last edited

2026-09-11

Services

aws-marketplace, cloudformation, ec2, iam, license-manager, payments, signin, sns, ssm

Control-plane actions (165)

By access level: 67 List, 2 Permissions management, 40 Read, 5 Tagging, 51 Write.

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants at least 80% of the write and permissions-management actions of: aws-marketplace (38 of 38).
• Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Related policies

Same service

• AdministratorAccess-AWSElasticBeanstalk
• AIDevOpsOrganizationsAccessPolicy
• AIDevOpsReleaseManagementVPCPolicy
• AmazonAppStreamServiceAccess
• AmazonBioDiscoveryServiceLinkedRolePolicy
• AmazonDataZoneEnvironmentRolePermissionsBoundary
• AmazonDataZoneProjectDeploymentPermissionsBoundary
• AmazonDataZoneProjectRolePermissionsBoundary

Same domain

• AlexaForBusinessDeviceSetup
• AlexaForBusinessFullAccess
• AlexaForBusinessGatewayExecution
• AlexaForBusinessLifesizeDelegatedAccessPolicy
• AlexaForBusinessPolyDelegatedAccessPolicy
• AlexaForBusinessReadOnlyAccess
• AmazonChimeFullAccess
• AmazonChimeReadOnly

Frequently asked questions

When should I attach AWSMarketplaceFullAccess?

The AWS Marketplace Buyer Guide says it grants administrative permissions for full access to AWS Marketplace and related services, including subscribing and unsubscribing to software, managing software instances, creating and managing a private marketplace, and access to Amazon EC2, CloudFormation and Systems Manager. Attach it only where that scope is intended.

What does AWSMarketplaceFullAccess grant?

It allows aws-marketplace:* on all resources, CloudFormation stack creation and reads, EC2 actions including launching, starting, stopping and terminating instances and managing security groups and images, SSM, SNS and IAM read and topic-creation actions, license-manager:ListReceivedLicenses, and iam:PassRole to Amazon EC2.

What are the security risks of AWSMarketplaceFullAccess?

aws-marketplace:* is allowed on all resources, and the policy allows launching and terminating EC2 instances, deregistering images and deleting snapshots on all resources, as well as iam:PassRole to Amazon EC2. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. It was last edited on September 11, 2026.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-marketplace:*",
        "cloudformation:CreateStack",
        "cloudformation:DescribeStackResource",
        "cloudformation:DescribeStackResources",
        "cloudformation:DescribeStacks",
        "cloudformation:List*",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:CreateSecurityGroup",
        "ec2:CreateTags",
        "ec2:DescribeAddresses",
        "ec2:DeleteSecurityGroup",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeImages",
        "ec2:DescribeInstances",
        "ec2:DescribeKeyPairs",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeTags",
        "ec2:DescribeVpcs",
        "ec2:RunInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:TerminateInstances",
        "license-manager:ListReceivedLicenses",
        "payments:ListPaymentProgramStatus"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CopyImage",
        "ec2:DeregisterImage",
        "ec2:DescribeSnapshots",
        "ec2:DeleteSnapshot",
        "ec2:CreateImage",
        "ec2:DescribeInstanceStatus",
        "ssm:GetAutomationExecution",
        "ssm:ListDocuments",
        "ssm:DescribeDocument",
        "sns:ListTopics",
        "sns:GetTopicAttributes",
        "sns:CreateTopic",
        "iam:GetRole",
        "iam:GetInstanceProfile",
        "iam:ListRoles",
        "iam:ListInstanceProfiles"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:TagResource",
        "cloudformation:UntagResource"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "cloudformation:CreateAction": [
            "CreateStack"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "signin:CreateOAuth2Token",
      "Resource": "arn:aws:signin:*:*:service-principal/marketplace-mcp.amazonaws.com",
      "Condition": {
        "StringEquals": {
          "signin:OAuthGrantType": "client_credentials"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringLike": {
          "iam:PassedToService": [
            "ec2.amazonaws.com"
          ]
        }
      }
    }
  ]
}

Version history

Current version v8, edited by AWS on 2026-09-11. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSMarketplaceFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSMarketplaceFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSMarketplaceFullAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSMarketplaceFullAccess

resource "aws_iam_role_policy_attachment" "awsmarketplacefullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSMarketplaceFullAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSMarketplaceFullAccess"),
);

Sources

• AWSMarketplaceFullAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for AWS Marketplace buyers (AWS Marketplace Buyer Guide) (retrieved 2026-11-13; supports summary, useCases, bestPractices, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)

• Official AWS reference for AWSMarketplaceFullAccess
• AWS service guide
• Report a data issue