AWS Selling Authorizations: How CPPO Deals Run

An AWS selling authorization is the agreement an ISV publishes in AWS Partner Central to let one channel partner resell a product through Channel Partner Private Offers (CPPOs). It sets the partner’s wholesale price, its currency, the legal terms and how many offers the partner may create, and once it’s published it can’t be modified. AWS’s Catalog API calls the same object a resale authorization.

---

Acme’s channel team has a reseller deal on AWS Marketplace. Globex, an AWS Marketplace Channel Partner, will quote Initech, and Acme’s deal desk has to give Globex the right to do it. The questions arrive in order. Which availability should the authorization use? What has to be right before it’s published? If Acme deactivates it next quarter, what happens to the offer Globex already sent? And when Initech asks for a change, who makes it?

AWS answers each one across its Seller Guide and its Catalog API reference, and the answers share a theme: the authorization is fixed the moment you publish it, and the offer that comes out of it belongs to the partner. This post sets out the lifecycle in AWS’s own words, a checklist for the last screen before you publish, and how Fours handles each step. How CPPO compares with Microsoft’s multiparty private offers and Google Cloud’s reseller plans is covered in CPPO vs MPO, the cross-cloud resale map.

What is an AWS selling authorization?

An AWS selling authorization is the agreement an ISV extends to one channel partner, setting the terms on which that partner may resell a product through private offers. In AWS’s words, “The AWS Marketplace Channel Partner and ISV establish an agreement called a selling authorization to resell one or more of the ISV’s products. The Channel Partner then extends a private offer to the buyer for that product.”

Three things to know about it:

• It has two names. The Seller Guide and AWS Partner Central’s Selling authorizations tab say selling authorization. The Catalog API’s entity is ResaleAuthorization, “also known as an opportunity,” and pages such as AWS’s net payment terms guide still say resale authorization. They’re the same object.
• It targets one reseller. The Catalog API’s PartnerTargetingRule “Specifies the single reseller that the Resale Authorization is accessible to, and that reseller’s role.” The role is ChannelPartner or Distributor, and AWS says the Distributor value “is currently available only for Brazil 2P,” which the AWS Brazil 2P distribution program covers. This post is about channel partners.
• Both sides need a service-linked role first. If the ISV and the reseller don’t each create one, “AWS can’t share the authorization resource from the ISV to the reseller.”

AWS supports selling authorizations on AMI, container, SaaS and professional services products.

How does a CPPO deal run, from authorization to payment?

A CPPO deal runs from your selling authorization to the partner’s private offer, then to the buyer’s acceptance and AWS’s payout, and the authorization ends when it runs out or you deactivate it. The table follows one authorization through each stage, with AWS’s rule at each.

Stage	Who acts	What AWS says
Create	ISV	The reseller’s 12-digit AWS account ID; optional buyer account IDs; a Renewal flag; a pricing model (contract with an installment plan, contract with upfront payments, or usage); a currency; a duration; an availability type; and a EULA (the Public EULA, the Standard Contract for AWS Marketplace or a custom EULA), with an optional Reseller Contract for AWS Marketplace (RCMP) or custom contract
Publish	ISV	”Once a selling authorization is published, it cannot be modified.” Through the API, a draft is “not visible to resellers” until you release it, and release will “validate the entire Resale Authorization”
Track	ISV	Six console statuses, from Draft to Deactivated, which “is called ‘Restricted’ in the API”
Offer	Channel partner	The partner starts “from a wholesale cost set by the ISV” and marks it up “to create the buyer’s offer price,” and “must use the currency that the ISV defines in the selling authorization”
Change	ISV, then partner	”You cannot extend the expiry dates or modify any other details.” You can Clone the authorization into a new one, and on a SaaS contract the partner can replace a live CPPO agreement with a new offer from an active authorization
Stop	ISV	Deactivate: “new offers cannot be created using that selling authorization. Any offers already created are unaffected.”
Pay	AWS	Funds go to the partner and the ISV “based on the agreed-to pricing.” The “Listing fee is calculated based on the discounted price offered by ISV to Channel Partner,” carries a 0.5% CPPO uplift, and is deducted from the ISV’s disbursement

The wholesale cost comes in two shapes. A recurring discount lets the partner “continue reselling the product without further price negotiation with the ISV,” until a set date or “indefinitely, until ended by either the ISV or the Channel Partner.” A non-recurring discount is “a one-time discount intended to be used only with a specific buyer.” In practice, the two line up with the availability types below.

Which availability type fits the deal?

Use Single Use for one deal with one buyer, Specific Time Duration for a partner who will quote several buyers before a deadline, and No Set Time Duration for a standing reseller arrangement you’ll end yourself. AWS defines all three:

Availability	AWS’s definition	Fits
Single Use	”Allows for a single offer to be created by reseller until the specified end date”	One negotiated deal, usually with the buyer’s account ID set
Specific Time Duration	”Allows for multiple offers to be created by reseller until the specified end date”	A partner quoting several buyers this quarter at one wholesale price
No Set Time Duration	”Allows for multiple offers to be created by reseller until the selling authorization is manually deactivated”	A standing wholesale price for a long-term reseller

Two Catalog API rules narrow the choice when the deal has an installment plan:

• An installment plan means Single Use. The API requires a one-offer limit and an end date whenever the authorization carries a payment schedule: “OffersMaxQuantity and AvailabilityEndDate must be present with ResalePaymentScheduleTerm.” The only value OffersMaxQuantity accepts is 1.
• The end date comes before every installment. “Provide an AvailabilityEndDate that is before all the ChargeDate in ResalePaymentScheduleTerms.”

What does each selling authorization status mean?

AWS Partner Central shows six statuses for a selling authorization, while the Catalog API’s status filter takes three: Draft, Active and Restricted. Here is the console’s list, in AWS’s words:

Console status	What AWS says it means
Draft	”Has been created but not yet activated”
Authorized	”Is active and can be used to create Channel Partner Private Offers (CPPOs). No CPPOs have been created yet”
Authorized (reusable)	“Has been used to create at least one CPPO and can be used to create additional CPPOs,” common on authorizations with a specific or no set time duration
Authorized (consumed)	“Has been fully utilized and cannot be used to create additional CPPOs,” which typically happens to a single-use authorization once the reseller has created its offer
Expired	”The selling authorization’s availability end date has passed. It can no longer be used to create CPPOs”
Deactivated	The ISV “has manually deactivated the authorization.” AWS adds: “This status is called ‘Restricted’ in the API”

The six labels are a console view. AWS says “the system determines the status based on several factors, including the selling authorization’s inner status, availability end date, and offer extended status.” If you report on authorizations from the API, read the availability end date and the offers created alongside the status.

What can you change after you publish?

Nothing on the authorization itself. AWS says “Once a selling authorization is published, it cannot be modified,” and that “you cannot extend the expiry dates or modify any other details.” The Catalog API holds the same line, rejecting a change with “[x] request can’t be performed after the resale authorization is released.”

Three moves remain:

• Clone it. Clone “prepopulates values into all the fields and allows for editing,” so a longer term or a new price is a new authorization. If the clone replaces one that’s still active, deactivate the old one so the partner can’t keep quoting the old terms.
• Deactivate it. The next section covers what that does.
• Replace the live deal, through the partner. On SaaS contracts and SaaS contracts with consumption, AWS lets channel partners amend agreements. The partner creates the replacement offer from an authorization that is active and “for the same product that is associated with the agreement,” and “must use the currency defined in the selling authorization when creating amendments.” An amendment can’t move the deal to a different seller: “You can’t amend an agreement to specify a seller of record that’s different from the seller of record from the original agreement.”

What happens to live offers when you deactivate?

Nothing happens to them: deactivation stops the partner creating new offers, and “Any offers already created are unaffected.” That cuts both ways. Deactivating is safe when a partner relationship ends with deals in flight, and it can’t pull back a quote the partner has already sent.

In the Catalog API, deactivating is the RestrictResaleAuthorization change, and AWS’s reference adds two rules:

• It can’t be undone. “This is a non-reversible operation. After the Resale Authorization is marked as Restricted, it can’t be in an Active state again.” To resume with the same partner, clone it into a new authorization.
• An expired authorization can’t be deactivated. “Expired ResaleAuthorization can’t be marked as Restricted.” It has already stopped working.

Who owns the CPPO once the partner creates it?

The channel partner owns it. AWS has the partner extend the private offer to the buyer, and when a partner replaces a CPPO agreement through the Catalog API, one of AWS’s validation rules reads “Provided agreement must be owned by Channel Partner.” Your part of the deal is the wholesale price and the terms on the authorization; the partner sets its markup on top.

The money follows the same split: “after the buyer pays for the private offer, AWS Marketplace uses the standard process to distribute the funds to the AWS Marketplace Channel Partner and the ISV based on the agreed-to pricing.” Your listing fee is set on your price to the partner: “Listing fee is calculated based on the discounted price offered by ISV to Channel Partner,” and “CPPO products have a 0.5% uplift on the listing fee, regardless of the offer type or deployment method.” On a SaaS private offer under $1M in total contract value, that makes the fee 3.5%, deducted from your disbursement.

So when Initech asks for a change, Acme’s move is a new authorization and a request to Globex.

What should you check before you publish?

Check every field on the Review and create page, because it’s the last point at which anything on the authorization can change. The checklist:

1. The reseller’s account and legal name. Enter the partner’s 12-digit AWS account ID, then confirm who it is: “You can validate the Channel Partner’s (reseller) legal entity name in Step 4 (Review and create) of the selling authorization.”
2. A name and description you’d show the partner. Both “will be visible to Channel Partners in their seller reports,” so keep internal notes out of them.
3. The currency the partner will quote in. “Channel Partners must use the currency that the ISV defines in the selling authorization.” A CPPO in another currency needs a new authorization, and non-USD currencies are available for contract, contract with consumption and pay-as-you-go pricing.
4. The buyer, and the Renewal flag. Buyer account IDs are optional; set them and the selling authorization “is only for those buyers.” Mark Renewal when it’s “intended to renew an existing paid subscription with an existing customer for the same product.”
5. Availability that matches the deal. Single Use if it carries an installment plan, with an end date before the first charge date.
6. The latest service start date. For a future-dated CPPO you can set a maximum allowed service start date. “If the manufacturer doesn’t specify a maximum date, the AWS Marketplace Channel Partner can specify any future service date up to 3 years in the future.”
7. The longest net payment term. You can cap “the maximum net payment terms that the channel partner can extend to end customers.” With Net 60 set, the partner “can offer Net 15, Net 30, Net 45, or Net 60 to the buyer, but not Net 90 or Net 120.”
8. Dimensions you’re willing to keep. “Custom dimensions added to the product cannot be removed,” and a product holds up to 200 contract and 200 usage dimensions.
9. The legal terms. The Public EULA, the Standard Contract for AWS Marketplace or a custom EULA (“Only custom EULAs are supported for professional services sellers”), plus the RCMP or your own reseller contract if you use one.

How does Fours handle selling authorizations?

Fours creates the authorization, notifies the partner, tracks it through its own statuses, and refuses the actions on a CPPO that only the partner can take. This is Fours behaviour, as Fours’ CPPO and resale authorization documentation describes it:

Step	In Fours
Create	Offer → Resale, then + New Resale Authorization in the Fours Console, or the Fours Salesforce app. Buyer(s) is required for a renewal, and Fours refuses an authorization whose buyers include the reseller’s own account
Hand off	More actions → Notify Contact emails the reseller a direct link to the active authorization
Track	Fours’ own statuses: Pending Create while AWS processes it, then Active, Create Failed, Used, Expired or Restricted. These are Fours’ labels, not AWS’s console list. The partner’s offer appears as a CPPO offer, and the buyer’s acceptance creates a CPPO entitlement
Stop	Cancel deactivates the authorization: the status is Pending_Cancel while AWS processes the request, then Canceled (or Restricted). “Existing private offers remain active and valid”
Change	Clone copies an authorization into a new draft to edit, and Clone Offer resubmits an expired one
The partner’s offer	”Fours shows no Cancel or Extend Expiry Date action” on a CPPO private offer, and the Fours API refuses to cancel it, extend its expiry date or update its pricing

Frequently asked questions

What is an AWS selling authorization?

An agreement an ISV publishes in AWS Partner Central that lets one channel partner resell a product through Channel Partner Private Offers. It sets the partner’s wholesale price, currency, legal terms and how many offers it may create, and it can’t be modified once published.

Is a selling authorization the same as a resale authorization?

Yes. AWS’s Seller Guide and Partner Central’s Selling authorizations tab say selling authorization, while the Catalog API’s entity is ResaleAuthorization and some AWS pages still say resale authorization. Both name the agreement a channel partner uses to create a CPPO.

Can you extend an AWS selling authorization?

No. AWS says that after a selling authorization is created, “you cannot extend the expiry dates or modify any other details.” To give a partner more time or new terms, clone it into a new authorization, and deactivate the old one if it’s still active.

What happens to existing CPPOs when you deactivate a selling authorization?

Nothing. Deactivation stops the partner creating new offers from it, and AWS says “Any offers already created are unaffected.” It can’t be reversed: once restricted, an authorization can’t return to active, so starting again takes a new one.

Which availability type should a selling authorization use?

Single Use for one deal, and for any authorization with an installment plan. Specific Time Duration when the partner will quote several buyers before an end date. No Set Time Duration for a standing wholesale price that lasts until you deactivate it.

Who owns a CPPO offer?

The channel partner. It extends the private offer to the buyer from your authorization, and AWS’s API treats the resulting agreement as owned by the channel partner. To change a live deal, issue a new authorization and ask the partner to replace its offer.

Takeaways

• An AWS selling authorization, a resale authorization in the API, is fixed when you publish it: no edits and no extensions. Review and create is your last check.
• Pick availability by deal: Single Use for one buyer or an installment plan, and a multi-use type for a partner quoting several buyers.
• Deactivating stops new offers only. Offers already created are unaffected, and it can’t be undone.
• The CPPO belongs to the partner. A change to a live deal takes a new authorization and the partner’s replacement offer.
• Your listing fee is calculated on your discounted price to the partner, plus the 0.5% CPPO uplift.

Fours creates AWS selling authorizations from the console or Salesforce, notifies the partner, and tracks each one through to the CPPO entitlement, and manages Azure and Google Cloud resale authorizations the same way. See how in Fours’ private offer and resale management.