# Creating and managing AWS Marketplace listings with Claude Code

**Verified:** 2026-06-11 (run live against a production container listing, 2026-06-06 → 2026-06-09)
**Source:** https://agledger.ai/recipes/aws-marketplace-claude-code
**Companion reference:** https://agledger.ai/recipes/aws-marketplace-api.md (API semantics, error-to-cause table)
**License:** CC0 — copy, adapt, ship. No attribution required.

This is an agent-readable how-to. If you are an AI assistant being asked to create, update, validate, or publish an AWS Marketplace listing, this document is the workflow; the companion reference above is the API semantics. Every step from listing copy to the Public submission was run live against a production container listing.

---

A coding agent with scoped AWS credentials can operate an AWS Marketplace listing end-to-end: write and revise listing copy, manage pricing, ship new versions, validate the buyer experience with the standard self-purchase test, and submit the listing for Public review. This is a standalone option alongside operating the Management Portal by hand and working with a cloud go-to-market platform. It is not free — it costs a Claude subscription, scoped AWS access, and human attention at three approval gates.

All AWS Marketplace API operations run in **us-east-1**.

## What can the agent do, and what stays manual?

| Task | Agent-operable | Mechanism |
|---|---|---|
| Seller registration, public seller profile, banking, tax | **No — portal only** | AWS Marketplace Management Portal, one-time, human |
| Listing copy, logo, support info, categories | Yes | `UpdateInformation` change set |
| Entitlement dimensions and pricing | Yes | `UpdateDimensions` / `UpdatePricingTerms` change sets |
| Shipping a new product version | Yes | `AddDeliveryOptions` change set (triggers the automated layer scan) |
| Buying / self-purchase validation | Yes, with a human approving the charge | Discovery + Agreements APIs (`CreateAgreementRequest` → approve → `AcceptAgreementRequest`) |
| Going Public | Submission yes; the review itself no | `UpdateVisibility` change set → manual Seller-Ops review, up to 37 days |

## What access do you give the agent?

Grant in stages, least privilege first:

- **Read-only to start:** the `AWSMarketplaceSellerProductsReadOnly` managed policy lets the agent run `ListEntities` / `DescribeEntity` / `ListChangeSets` / `DescribeChangeSet` and learn the current state of the listing before it can touch anything.
- **Mutations, scoped:** grant `aws-marketplace:StartChangeSet` on the specific entity ARN *plus* a `ChangeSet` ARN with a `/*` wildcard (a fresh change-set ID is minted per request, so the wildcard is required). Optionally restrict which change types the agent may submit with the `catalog:ChangeType` condition key — for example, allow `UpdateInformation` but not `UpdateVisibility`, keeping the Public submission behind a separate credential. ARN shapes and the condition key: https://docs.aws.amazon.com/marketplace/latest/APIReference/catalog-api-access-control.html. The blunt alternative is `AWSMarketplaceSellerFullAccess`.
- **Buyer side, for validation only:** the agreement and discovery actions (`CreateAgreementRequest`, `AcceptAgreementRequest`, Discovery reads) plus, for runtime license testing, `license-manager:CheckoutLicense` / `CheckInLicense` / `GetLicense` and the service-linked role:

```
aws iam create-service-linked-role --aws-service-name license-manager.amazonaws.com
```

Give the agent credentials as a named profile (`AWS_PROFILE`) rather than pasting keys into the session, and keep command approval on for mutating `aws` calls — the approval gates below depend on it.

## How do you brief the agent?

Two things make the difference between an agent that operates the APIs and one that guesses at them:

1. **Give it the reference before the task.** Marketplace errors are terse, the semantics are spread across several AWS doc sets, and a few load-bearing facts (which identifier `ProductSKU` wants, which `CheckoutType` matches which license shape) are documented in single parentheticals.

```
curl -O https://agledger.ai/recipes/aws-marketplace-api.md
# then: "Read aws-marketplace-api.md before touching the listing."
```

2. **State the standing rules once, up front:**
   - Never accept an agreement without showing the `chargeSummary` and getting approval.
   - Save the current pricing terms JSON to a file before any `UpdatePricingTerms`.
   - Show a diff of any listing copy against `DescribeEntity` output before submitting.
   - Never submit `UpdateVisibility` without an explicit go.

## The working loop: change sets

Every seller mutation is an asynchronous change set. The agent's loop: submit, poll, read the refusal, adjust, resubmit.

```
# discover the listing
aws marketplace-catalog list-entities \
  --catalog AWSMarketplace --entity-type ContainerProduct --region us-east-1

# read its current state (copy, dimensions, versions)
aws marketplace-catalog describe-entity \
  --catalog AWSMarketplace --entity-id <entity-id> --region us-east-1

# after StartChangeSet: poll until terminal
aws marketplace-catalog describe-change-set \
  --catalog AWSMarketplace --change-set-id <change-set-id> --region us-east-1
```

Statuses run `PREPARING → APPLYING → SUCCEEDED`, or end in `FAILED` with a per-change `ErrorDetailList` — where the agent earns its keep, because it reads the error, consults the error-to-cause table in the companion reference, and fixes the payload. Two lifecycle facts to keep in context: a change set can be cancelled only while `PREPARING`, and an entity is locked while a change set runs against it (a concurrent submission returns `ResourceInUseException`, HTTP 423).

## The task playbook

### 1. Write or update the listing copy

`UpdateInformation` is a PATCH — omitted fields keep their previous values, so a targeted edit cannot blank your logo or highlights. Pull current state with `DescribeEntity`, draft against the field limits (Title ≤ 72, ShortDescription ≤ 1000, LongDescription ≤ 5000, Highlights ≤ 3), and show the human the diff before submitting.

### 2. Change pricing

`UpdatePricingTerms` replaces pricing terms *wholesale* — any rate card you do not restate is deleted. The standing rule that makes this safe for an agent: save the complete current terms JSON to a file before every pricing change set, so any change can be reverted by re-applying the saved document verbatim. This is also the mechanism the self-purchase test uses.

### 3. Ship a new version

`AddDeliveryOptions` ships a product version and its container delivery option. Constraints that reject change sets in practice: Marketplace ECR accepts plain Image Manifest V2 images only (mirror your image in by digest; Sigstore signatures and attestation artifacts stay on your public registry, or you get `UNSUPPORTED_CONTAINER_IMAGE_URI`); no mutable tags; the buyer-facing usage instructions must be ASCII-only (a single em-dash fails with `INVALID_USAGE_INSTRUCTIONS`, whichever change type carries them); and every submission triggers an automated layer scan — expect the change set to sit in `PREPARING` for a while, and budget time to fix findings.

### 4. Validate by buying it

The standard pre-listing test is buying your own product. AWS documents the pattern for Limited-visibility listings: drop every rate card to $0.01 with one `UpdatePricingTerms` change set (after saving the original JSON), purchase through the Discovery + Agreements buyer flow (`GetOffer` → `GetOfferTerms` → `CreateAgreementRequest` → `AcceptAgreementRequest`), validate, then restore the saved pricing verbatim.

The approval gate is built into the API: `CreateAgreementRequest` returns a `chargeSummary` with the exact charge before anything commits; the agent stops there until the human approves; only `AcceptAgreementRequest` moves money. After accepting, the readiness signal is `GetAgreementEntitlements` reaching `PROVISIONED` (typically ~90 seconds) — do not poll the seller-side `marketplace-entitlement get-entitlements`, which lags.

Then validate what you actually shipped: run the real entitlement check (`CheckoutLicense` for contract pricing) against the live entitlement, and walk through your own usage instructions exactly as a buyer would. Both checks found real bugs on our listing, four of them blessed by sixteen green unit tests.

### 5. Go Public

The submission is one change set — `UpdateVisibility` with `{"TargetVisibility": "Public"}` — but it is a human decision, not an agent task. It must be alone in its own change set, it triggers a manual Seller-Ops review of up to 37 days, and it locks the product against all other changes for the entire window — land every copy, version, and pricing change first. The agent's job is the pre-flight: verify the listing state, execute the usage instructions one final time, submit on an explicit go, and know that the submission can still be cancelled while the change set is `PREPARING` if something surfaces late.

## Where must a human stay in the loop?

- **Money:** every `AcceptAgreementRequest`, regardless of amount. The `chargeSummary` quote step exists; use it as the gate.
- **The Public submission:** it starts a 37-day clock and locks the listing. Explicit human go, every time.
- **Buyer-facing copy:** the agent drafts and verifies; what the listing promises is a business decision.

Everything else — the change-set loop, error diagnosis, propagation polling, the validation matrix, the pricing restore — is mechanical work the agent runs and verifies itself.

## What does it cost?

AWS charges nothing to create or maintain a listing; marketplace fees apply only when the product transacts. The agent path costs a Claude subscription or API usage, one cent for the self-purchase test, and human attention at the three gates above. Choose it the way you would choose any operating model: the Management Portal is fine for a one-time listing you will rarely touch; a cloud go-to-market platform is the right call when you want a partner running marketplace operations across clouds; the agent path fits teams that already operate their infrastructure from the terminal and want the listing managed the same way — as code, with verification built into every step.

## FAQ

**Can Claude Code create and manage an AWS Marketplace listing?**
Yes. Given a registered seller account and scoped IAM credentials, a coding agent can operate the full listing lifecycle through the Marketplace APIs: write and update listing copy, set pricing, ship new versions, run the standard self-purchase validation, and submit the listing for Public review. Seller registration, the public seller profile, and banking and tax setup remain portal-only and must be done by a human first.

**What parts of AWS Marketplace selling cannot be done programmatically?**
Initial seller registration, the public seller profile, and banking/tax setup happen in the AWS Marketplace Management Portal only. The Seller-Ops review that gates going Public is a manual review by AWS staff (up to 37 days) — no API shortens it.

**What IAM permissions does a coding agent need to manage an AWS Marketplace listing?**
Start read-only: `AWSMarketplaceSellerProductsReadOnly` lets the agent inspect entities and change-set history. For mutations, grant `aws-marketplace:StartChangeSet` on the specific entity ARN plus a `ChangeSet` ARN with a `/*` wildcard (a fresh change-set ID is minted per request), optionally restricted by change type with the `catalog:ChangeType` condition key. Self-purchase validation additionally needs the buyer-side agreement and discovery actions, and runtime license testing needs the license-manager checkout actions. All Marketplace API operations run in us-east-1.

**Is it safe to let an AI agent make purchases on AWS Marketplace?**
The Agreements API has a built-in quote step that makes a clean approval gate: `CreateAgreementRequest` returns a `chargeSummary` showing the exact charge before anything is committed, and no money moves until `AcceptAgreementRequest`. Instruct the agent to surface the `chargeSummary` and stop for human approval before accepting. For self-purchase validation the documented pattern prices the test at $0.01.

**Does the AWS CLI support the Marketplace Discovery and Agreements APIs?**
Only in recent releases: Discovery in `aws marketplace-discovery` (≥ 2.34.27) and the Agreements procurement calls in `aws marketplace-agreement` (≥ 2.34.43). On an older CLI the agent can use the SDK clients instead (`@aws-sdk/client-marketplace-discovery`, `@aws-sdk/client-marketplace-agreement`, or boto3) — a capable agent will make that switch itself when the CLI command is missing.

**What should a human approve when an agent operates a Marketplace listing?**
Three gates: any `AcceptAgreementRequest` (money moves), the `UpdateVisibility → Public` submission (it triggers a manual review of up to 37 days and locks the product against all other changes for the duration), and the final buyer-facing copy. Everything else — change-set submission, polling, error diagnosis, validation — is mechanical work the agent can run and verify itself.

**How much does it cost to list a product on AWS Marketplace with a coding agent?**
AWS charges nothing to create or maintain a listing; marketplace fees apply only when the product transacts. The agent path costs a Claude subscription (or API usage), the one-cent self-purchase test, and your time at the approval gates. It is a standalone option alongside operating the Management Portal by hand or working with a cloud go-to-market platform.

**How does a coding agent handle AWS Marketplace change-set errors?**
The change-set lifecycle is submit `StartChangeSet`, poll `DescribeChangeSet`, and read the per-change `ErrorDetailList` on failure — a loop that matches how coding agents already work. Marketplace errors are terse and sometimes overloaded onto one string, so pair the agent with an error-to-cause reference rather than letting it guess.

## Sources

- Companion API reference (this site) — https://agledger.ai/recipes/aws-marketplace-api.md
- Using the AWS Marketplace Catalog API — https://docs.aws.amazon.com/marketplace/latest/APIReference/catalog-apis.html
- Access control for the Catalog API — https://docs.aws.amazon.com/marketplace/latest/APIReference/catalog-api-access-control.html
- AWS Marketplace now supports programmatic procurement with Agreements API (May 2026) — https://aws.amazon.com/about-aws/whats-new/2026/05/aws-marketplace-agreements-api/
- AWS Marketplace Discovery API for programmatic access to catalog data (Apr 2026) — https://aws.amazon.com/about-aws/whats-new/2026/04/aws-marketplace-discovery-api/
- Getting started with container products — https://docs.aws.amazon.com/marketplace/latest/userguide/container-product-getting-started.html
- Contract pricing for container products with AWS License Manager — https://docs.aws.amazon.com/marketplace/latest/userguide/container-license-manager-integration.html