Skip to Content
IntegrationsAPNPrerequisites

APN Sync — Prerequisites

Before you can enable APN sync in FlowState, the following must be in place.

1. AWS Partner Central account with alliance-lead access

Your organization must be registered in the AWS Partner Network and have access to Partner Central. The IAM role that FlowState assumes must be in an AWS account that is linked to your Partner Central account — this is distinct from your general AWS account.

Within Partner Central, the partner user linked to the AWS account must have the Alliance Lead role (or equivalent). Without this role, the AssociateOpportunity API call fails with a validation error and sync cannot complete opportunity submission. See Troubleshooting for the specific error and resolution.

To verify: sign in to Partner Central and confirm you can access the Opportunities section and the Co-sell workspace.

2. HubSpot integration connected

APN sync depends on the HubSpot integration for both reading deal data outbound and writing APN status properties back inbound. Connect HubSpot first:

3. An AWS account linked to your Partner Central account

You need an AWS account where you can create IAM roles. This account must be the same one that is associated with your Partner Central membership.

If you are unsure which AWS account is linked to your Partner Central account, sign in to Partner Central and check Settings → AWS account associations. The account ID listed there is where you create the FlowState connector role.

4. IAM role creation capability

You need the ability to create IAM roles in the linked AWS account. Specifically, you need:

  • iam:CreateRole
  • iam:AttachRolePolicy
  • Permission to create a trust policy that allows cross-account sts:AssumeRole

If you do not have these permissions, ask an IAM administrator in your organization to create the role using one of the three paths in the onboarding wizard (OpenTofu, CloudFormation, or Manual).

5. The AWSPartnerCentralOpportunityManagement managed policy

This AWS managed policy must be available in your linked AWS account. It grants the exact Partner Central API permissions that FlowState uses. Because this is an AWS-managed policy, it is available in all AWS accounts by default.

To confirm: in the IAM console of your linked account, search for AWSPartnerCentralOpportunityManagement under Policies. If it does not appear, your account may have a Service Control Policy (SCP) blocking access to this policy — check with your AWS organization administrator.

Summary checklist

  • AWS Partner Network account registered.
  • Partner Central access confirmed with Alliance Lead role.
  • AWS account ID that is linked to Partner Central (noted for the wizard).
  • IAM role creation capability in that account (or IAM admin available).
  • AWSPartnerCentralOpportunityManagement policy visible in the IAM console.
  • HubSpot integration connected and showing Connected status in FlowState.
OverviewTrust policy