Skip to Content
IntegrationsAPNTrust policy

APN Sync — Trust Policy

The trust policy on the FlowStateAPNConnector IAM role controls who can assume the role and under what conditions.

The trust policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::<FLOWSTATE_AWS_ACCOUNT>:role/flowstate-<stage>-backend",
          "arn:aws:iam::<FLOWSTATE_AWS_ACCOUNT>:role/flowstate-<stage>-apn-outbound-writer",
          "arn:aws:iam::<FLOWSTATE_AWS_ACCOUNT>:role/flowstate-<stage>-apn-inbound",
          "arn:aws:iam::<FLOWSTATE_AWS_ACCOUNT>:role/flowstate-<stage>-hubspot-out",
          "arn:aws:iam::<FLOWSTATE_AWS_ACCOUNT>:role/flowstate-<stage>-mcp-execution"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<YOUR_EXTERNAL_ID>"
        }
      }
    }
  ]
}

The actual ARNs and ExternalId are pre-filled in the onboarding wizard. The list grows as FlowState adds services — if yours is shorter than the wizard’s, see Migration — the principal ARN list grew.

Principal.AWS

Five FlowState roles need to assume this role — one per service that touches Partner Central: outbound writes, inbound events, deal materialisation, and connection verification from both the REST API and the MCP server. The wizard shows the exact ARNs for your environment (dev or prod) — paste the list it gives you rather than retyping it.

sts:ExternalId

A secret, unique to your tenant, generated by FlowState and shown in the wizard. It must match exactly what the wizard shows — no leading or trailing spaces — or the AssumeRole call is denied. It protects against the confused-deputy problem : without it, another FlowState tenant could not trick FlowState into assuming your role, because they don’t have your ExternalId.

The permissions policy

FlowState attaches the AWS-managed policy AWSPartnerCentralOpportunityManagement — there’s nothing to write or maintain here. AWS keeps it current as the Partner Central API evolves, and it’s the same policy for every FlowState tenant, so your security team can review exactly what FlowState can do from AWS’s own published documentation.

PrerequisitesGetting started