# Creating and managing AWS Marketplace listings with Claude Code

**Verified:** 2026-06-11 (run live against a production container listing, 2026-06-06 → 2026-06-09)
**Source:** https://agledger.ai/guides/aws-marketplace-claude-code
**Companion reference:** https://agledger.ai/guides/aws-marketplace-api.md (API semantics, error-to-cause table)
**License:** CC0. Copy, adapt, ship. No attribution required.

This is an agent-readable how-to. If you are an AI assistant being asked to create, update, validate, or publish an AWS Marketplace listing, this document is the workflow; the companion reference above is the API semantics. Every step from listing copy to the Public submission was run live against a production container listing.

---

A coding agent with scoped AWS credentials can operate an AWS Marketplace listing end-to-end: write and revise listing copy, manage pricing, ship new versions, validate the buyer experience with the standard self-purchase test, and submit the listing for Public review. This is a standalone option alongside operating the Management Portal by hand and working with a cloud go-to-market platform. It is not free: it costs a Claude subscription, scoped AWS access, and human attention at three approval gates.

All AWS Marketplace API operations run in **us-east-1**.

## Sections

- **What can the agent do, and what stays manual?** the split, up front
- **What access do you give the agent?** IAM scoping, and the blunt alternative
- **How do you brief the agent?**
- **The working loop: change sets** submit, poll, read `ErrorDetailList`, fix
- **The task playbook** numbered: 1 listing copy, 2 pricing, 3 ship a version, 4 validate by buying it, 5 go Public
- **Where must a human stay in the loop?** the three approval gates
- **What does it cost?**
- **FAQ** and **Sources**

API semantics, IAM shapes, and the error-to-cause table are in the companion reference, not here.

## What can the agent do, and what stays manual?

| Task | Agent-operable | Mechanism |
|---|---|---|
| Seller registration, public seller profile, banking, tax | **No, portal only** | AWS Marketplace Management Portal, one-time, human |
| Listing copy, logo, support info, categories | Yes | `UpdateInformation` change set |
| Entitlement dimensions and pricing | Yes | `UpdateDimensions` / `UpdatePricingTerms` change sets |
| Shipping a new product version | Yes | `AddDeliveryOptions` change set (triggers the automated layer scan) |
| Buying / self-purchase validation | Yes, with a human approving the charge | Discovery + Agreements APIs (`CreateAgreementRequest` → approve → `AcceptAgreementRequest`) |
| Going Public | Submission yes; the review itself no | `UpdateVisibility` change set → manual Seller-Ops review, up to 37 days |

## What access do you give the agent?

Grant in stages, least privilege first:

- **Read-only to start:** the `AWSMarketplaceSellerProductsReadOnly` managed policy lets the agent run `ListEntities` / `DescribeEntity` / `ListChangeSets` / `DescribeChangeSet` and learn the current state of the listing before it can touch anything.
- **Mutations, scoped:** grant `aws-marketplace:StartChangeSet` on the specific entity ARN *plus* a `ChangeSet` ARN with a `/*` wildcard (a fresh change-set ID is minted per request, so the wildcard is required). Optionally restrict which change types the agent may submit with the `catalog:ChangeType` condition key. For example, allow `UpdateInformation` but not `UpdateVisibility`, keeping the Public submission behind a separate credential. ARN shapes and the condition key: https://docs.aws.amazon.com/marketplace/latest/APIReference/catalog-api-access-control.html. The blunt alternative is `AWSMarketplaceSellerFullAccess`.
- **Buyer side, for validation only:** the agreement and discovery actions (`CreateAgreementRequest`, `AcceptAgreementRequest`, Discovery reads) plus, for runtime license testing, `license-manager:CheckoutLicense` / `CheckInLicense` / `GetLicense` and the service-linked role:

```
aws iam create-service-linked-role --aws-service-name license-manager.amazonaws.com
```

Give the agent credentials as a named profile (`AWS_PROFILE`) rather than pasting keys into the session, and keep command approval on for mutating `aws` calls, because the approval gates below depend on it.

## How do you brief the agent?

Two things make the difference between an agent that operates the APIs and one that guesses at them:

1. **Give it the reference before the task.** Marketplace errors are terse, the semantics are spread across several AWS doc sets, and a few load-bearing facts (which identifier `ProductSKU` wants, which `CheckoutType` matches which license shape) are documented in single parentheticals.

```
curl -O https://agledger.ai/guides/aws-marketplace-api.md
# then: "Read aws-marketplace-api.md before touching the listing."
```

2. **State the standing rules once, up front:**
   - Never accept an agreement without showing the `chargeSummary` and getting approval.
   - Save the current pricing terms JSON to a file before any `UpdatePricingTerms`.
   - Show a diff of any listing copy against `DescribeEntity` output before submitting.
   - Never submit `UpdateVisibility` without an explicit go.

## The working loop: change sets

Every seller mutation is an asynchronous change set. The agent's loop: submit, poll, read the refusal, adjust, resubmit.

```
# discover the listing
aws marketplace-catalog list-entities \
  --catalog AWSMarketplace --entity-type ContainerProduct --region us-east-1

# read its current state (copy, dimensions, versions)
aws marketplace-catalog describe-entity \
  --catalog AWSMarketplace --entity-id <entity-id> --region us-east-1

# after StartChangeSet: poll until terminal
aws marketplace-catalog describe-change-set \
  --catalog AWSMarketplace --change-set-id <change-set-id> --region us-east-1
```

Statuses run `PREPARING → APPLYING → SUCCEEDED`, or end in `FAILED` with a per-change `ErrorDetailList`. This is where the agent earns its keep: it reads the error, consults the error-to-cause table in the companion reference, and fixes the payload. Two lifecycle facts to keep in context: a change set can be cancelled only while `PREPARING`, and an entity is locked while a change set runs against it (a concurrent submission returns `ResourceInUseException`, HTTP 423).

## The task playbook

### 1. Write or update the listing copy

`UpdateInformation` is a PATCH: omitted fields keep their previous values, so a targeted edit cannot blank your logo or highlights. Pull current state with `DescribeEntity`, draft against the field limits (Title ≤ 72, ShortDescription ≤ 1000, LongDescription ≤ 5000, Highlights ≤ 3), and show the human the diff before submitting.

### 2. Change pricing

`UpdatePricingTerms` replaces pricing terms *wholesale*: any rate card you do not restate is deleted. The standing rule that makes this safe for an agent: save the complete current terms JSON to a file before every pricing change set, so any change can be reverted by re-applying the saved document verbatim. This is also the mechanism the self-purchase test uses.

### 3. Ship a new version

`AddDeliveryOptions` ships a product version and its container delivery option. Constraints that reject change sets in practice: Marketplace ECR accepts plain Image Manifest V2 images only (mirror your image in by digest; Sigstore signatures and attestation artifacts stay on your public registry, or you get `UNSUPPORTED_CONTAINER_IMAGE_URI`); no mutable tags; the buyer-facing usage instructions must be ASCII-only (a single em-dash fails with `INVALID_USAGE_INSTRUCTIONS`, whichever change type carries them); and every submission triggers an automated layer scan, so expect the change set to sit in `PREPARING` for a while, and budget time to fix findings.

### 4. Validate by buying it

The standard pre-listing test is buying your own product. AWS documents the pattern for Limited-visibility listings: drop every rate card to $0.01 with one `UpdatePricingTerms` change set (after saving the original JSON), purchase through the Discovery + Agreements buyer flow (`GetOffer` → `GetOfferTerms` → `CreateAgreementRequest` → `AcceptAgreementRequest`), validate, then restore the saved pricing verbatim.

The approval gate is built into the API: `CreateAgreementRequest` returns a `chargeSummary` with the exact charge before anything commits; the agent stops there until the human approves; only `AcceptAgreementRequest` moves money. After accepting, the readiness signal is `GetAgreementEntitlements` reaching `PROVISIONED` (typically ~90 seconds). Do not poll the seller-side `marketplace-entitlement get-entitlements`, which lags.

Then validate what you actually shipped: run the real entitlement check (`CheckoutLicense` for contract pricing) against the live entitlement, and walk through your own usage instructions exactly as a buyer would. Both checks found real bugs on our listing, four of them blessed by sixteen green unit tests.

### 5. Go Public

The submission is one change set (`UpdateVisibility` with `{"TargetVisibility": "Public"}`), but it is a human decision, not an agent task. It must be alone in its own change set, it triggers a manual Seller-Ops review of up to 37 days, and it locks the product against all other changes for the entire window, so land every copy, version, and pricing change first. The agent's job is the pre-flight: verify the listing state, execute the usage instructions one final time, submit on an explicit go, and know that the submission can still be cancelled while the change set is `PREPARING` if something surfaces late.

## Where must a human stay in the loop?

- **Money:** every `AcceptAgreementRequest`, regardless of amount. The `chargeSummary` quote step exists; use it as the gate.
- **The Public submission:** it starts a 37-day clock and locks the listing. Explicit human go, every time.
- **Buyer-facing copy:** the agent drafts and verifies; what the listing promises is a business decision.

Everything else (the change-set loop, error diagnosis, propagation polling, the validation matrix, the pricing restore) is mechanical work the agent runs and verifies itself.

## What does it cost?

AWS charges nothing to create or maintain a listing; marketplace fees apply only when the product transacts. The agent path costs a Claude subscription or API usage, one cent for the self-purchase test, and human attention at the three gates above. Choose it the way you would choose any operating model: the Management Portal is fine for a one-time listing you will rarely touch; a cloud go-to-market platform is the right call when you want a partner running marketplace operations across clouds; the agent path fits teams that already operate their infrastructure from the terminal and want the listing managed the same way: as code, with verification built into every step.

## FAQ

**Can Claude Code create and manage an AWS Marketplace listing?**
Yes. Given a registered seller account and scoped IAM credentials, a coding agent can operate the full listing lifecycle through the Marketplace APIs: write and update listing copy, set pricing, ship new versions, run the standard self-purchase validation, and submit the listing for Public review. Seller registration, the public seller profile, and banking and tax setup remain portal-only and must be done by a human first.

**What parts of AWS Marketplace selling cannot be done programmatically?**
Initial seller registration, the public seller profile, and banking/tax setup happen in the AWS Marketplace Management Portal only. The Seller-Ops review that gates going Public is a manual review by AWS staff (up to 37 days). No API shortens it.

**What IAM permissions does a coding agent need to manage an AWS Marketplace listing?**
Start read-only: `AWSMarketplaceSellerProductsReadOnly` lets the agent inspect entities and change-set history. For mutations, grant `aws-marketplace:StartChangeSet` on the specific entity ARN plus a `ChangeSet` ARN with a `/*` wildcard (a fresh change-set ID is minted per request), optionally restricted by change type with the `catalog:ChangeType` condition key. Self-purchase validation additionally needs the buyer-side agreement and discovery actions, and runtime license testing needs the license-manager checkout actions. All Marketplace API operations run in us-east-1.

**Is it safe to let an AI agent make purchases on AWS Marketplace?**
The Agreements API has a built-in quote step that makes a clean approval gate: `CreateAgreementRequest` returns a `chargeSummary` showing the exact charge before anything is committed, and no money moves until `AcceptAgreementRequest`. Instruct the agent to surface the `chargeSummary` and stop for human approval before accepting. For self-purchase validation the documented pattern prices the test at $0.01.

**Does the AWS CLI support the Marketplace Discovery and Agreements APIs?**
Only in recent releases: Discovery in `aws marketplace-discovery` (≥ 2.34.27) and the Agreements procurement calls in `aws marketplace-agreement` (≥ 2.34.43). On an older CLI the agent can use the SDK clients instead (`@aws-sdk/client-marketplace-discovery`, `@aws-sdk/client-marketplace-agreement`, or boto3). A capable agent will make that switch itself when the CLI command is missing.

**What should a human approve when an agent operates a Marketplace listing?**
Three gates: any `AcceptAgreementRequest` (money moves), the `UpdateVisibility → Public` submission (it triggers a manual review of up to 37 days and locks the product against all other changes for the duration), and the final buyer-facing copy. Everything else (change-set submission, polling, error diagnosis, validation) is mechanical work the agent can run and verify itself.

**How much does it cost to list a product on AWS Marketplace with a coding agent?**
AWS charges nothing to create or maintain a listing; marketplace fees apply only when the product transacts. The agent path costs a Claude subscription (or API usage), the one-cent self-purchase test, and your time at the approval gates. It is a standalone option alongside operating the Management Portal by hand or working with a cloud go-to-market platform.

**How does a coding agent handle AWS Marketplace change-set errors?**
The change-set lifecycle is submit `StartChangeSet`, poll `DescribeChangeSet`, and read the per-change `ErrorDetailList` on failure, a loop that matches how coding agents already work. Marketplace errors are terse and sometimes overloaded onto one string, so pair the agent with an error-to-cause reference rather than letting it guess.

## Sources

- Companion API reference (this site): https://agledger.ai/guides/aws-marketplace-api.md
- Using the AWS Marketplace Catalog API: https://docs.aws.amazon.com/marketplace/latest/APIReference/catalog-apis.html
- Access control for the Catalog API: https://docs.aws.amazon.com/marketplace/latest/APIReference/catalog-api-access-control.html
- AWS Marketplace now supports programmatic procurement with Agreements API (May 2026): https://aws.amazon.com/about-aws/whats-new/2026/05/aws-marketplace-agreements-api/
- AWS Marketplace Discovery API for programmatic access to catalog data (Apr 2026): https://aws.amazon.com/about-aws/whats-new/2026/04/aws-marketplace-discovery-api/
- Getting started with container products: https://docs.aws.amazon.com/marketplace/latest/userguide/container-product-getting-started.html
- Contract pricing for container products with AWS License Manager: https://docs.aws.amazon.com/marketplace/latest/userguide/container-license-manager-integration.html