AWS Small and Medium Business (SMB) Competency

Applies to: SaaS

AWS Partners applying to this designation must complete all program prerequisite requirements, trainings and certification deemed necessary in the prerequisite section of the competency website. https://apn-checklists.s3.amazonaws.com/competency/small-and-medium-business-(smb)/technology/CQOokK8QS.html#prerequisites

Confirm the completion of all prerequisites.

EVIDENCE REQUIRED 1/Attach any required certifications specified in the prerequisite section.

Applies to: SaaS

AWS Partners must demonstrate clear alignment between their product offering and a specific SMB Solution Area. This ensures that we deliver a targeted, effective solution within the chosen solution area. For example, if your solution delivers a virtual employee powered by AI, then the solution would map under the 'AI Productivity & CX' solution area.

Describe how your solution maps onto an SMB Solution Area as defined in the AWS SMB Competency Definition.

Note: The SMB Solution Areas can be found in the introduction tab. Note: Selected solution areas will ensure the AWS competency team delivers targeted benefits maximizing partner potential.

Applies to: SaaS

AWS Partners must ensure their solutions are readily accessible to customers through AWS Marketplace where available, or through alternative self-service purchasing mechanisms in regions where Marketplace listing is not supported. This ensures easy customer access and streamlined procurement.

Specify all regions that you maintain an active PRM-compliant AWS Marketplace listing for the solutions described in FREQ-002. For regions that you support but do not yet have a Marketplace listing, describe the self-service purchasing options available to the customer for the solutions described in FREQ-002. Include in your response;

EVIDENCE REQUIRED 1/Active AWS Marketplace listing URLs 2/For non-Marketplace regions, please include self-service procurement, documentation, transaction workflow details, customer acquisition process.

Applies to: SaaS

AWS Partners must establish and maintain a comprehensive go-to-market strategy specifically tailored to the SMB customer segment. This ensures effective market positioning, customer engagement, and sustainable business growth in the SMB space.

Describe your GTM approach incorporating customer understanding, solution positioning, and execution planning. Please include in your response; 1/Customer persona definitions and market segmentation 2/Value proposition and competitive differentiation 3/Marketing and sales strategy 4/Product/service offerings and pricing model 5/Success metrics and resource planning

EVIDENCE REQUIRED: 1/Go-to-Market strategy document including customer needs analysis, brand positioning, marketing plan, sales methodology, solution catalog and pricing framework.

Applies to: SaaS

AWS Partners must maintain a public-facing digital presence that clearly demonstrates their SMB expertise, solutions, and thought leadership. This ensures market visibility and establishes credibility within the SMB segment.

Provide a public URL to one of the following SMB thought leadership assets; blog posts, press articles, videos or analyst reviews. The URL should be hosted on your organization's domain.

Applies to: SaaS

AWS Partners must demonstrate sustained success in the SMB market by maintaining an active customer base of SMB organizations using their AWS-based SaaS solutions. This ensures proven capability in serving the SMB segment.

Partners must provide a list of 20 or more active SMB customers (defined as organizations with annual revenue under $100 million) using their SaaS product on AWS.

EVIDENCE REQUIRED: 1/Launched opportunities on ACE, customer list or AWS marketplace transactions.

Applies to: SaaS

AWS Partners must demonstrate that their AI solution provides a clear, low-barrier adoption path for SMB customers who lack dedicated AI/ML expertise or data science teams. Solutions must include guided evaluation capabilities (e.g., free trials, sandbox environments, proof-of-value workflows, or sample datasets) that enable SMB customers to validate the solution's relevance to their business within 14 days. Partners must not require SMB customers to understand underlying AI/ML concepts, model architectures, or infrastructure configurations to begin realizing value. The customer experience must guide users from initial exploration to productive use through progressive disclosure — introducing complexity only as the customer's needs grow.

Describe how your solution enables SMB customers to evaluate, adopt, and begin using AI capabilities without requiring AI/ML expertise or extended implementation timelines.

EVIDENCE REQUIRED: 1/Documentation of evaluation or proof-of-value workflow available to SMB customers. 2/Evidence that productive use does not require AI/ML expertise (e.g., guided workflows, defaults, templates). 3/Customer feedback or metrics demonstrating SMB adoption success (e.g., time-to-value, trial conversion rates).

Applies to: SaaS

AWS Partners must provide pricing that allows SMB customers to predict and control AI-related costs without requiring understanding of underlying consumption mechanics (e.g., tokens, inference calls, training compute, vector storage queries). Solutions must offer at least one of: fixed-price tiers, bundled pricing inclusive of AI resource consumption, configurable spending limits, or per-user/per-unit pricing with predictable scaling. Partners must implement cost protection mechanisms (alerts, caps, or throttling) that prevent unexpected charges. The customer experience must provide clear visibility into what the customer is paying for and what they are receiving — translating technical consumption into business-relevant units.

Describe how your pricing model protects SMB customers from unpredictable AI-related costs and provides transparent value communication.

EVIDENCE REQUIRED: 1/Pricing documentation showing SMB-accessible models with predictable scaling. 2/Evidence of cost protection mechanisms (spending alerts, caps, or throttling). 3/Customer-facing cost/value visibility (e.g., usage dashboard, billing transparency features).

Applies to: SaaS

AWS Partners must implement AI governance practices that protect SMB customers without requiring them to establish their own governance frameworks, policies, or review boards. Solutions must embed governance controls appropriate to the solution's AI category — including role-based access controls on AI capabilities, audit trails of AI-driven decisions, version tracking of models or AI configurations, and change management processes for AI behavior updates. Partners must also implement responsible AI safeguards — such as output validation, data quality controls, bias monitoring, and confidence thresholds — as part of their broader governance posture. Partners must provide clear, non-technical documentation explaining what the AI does, how it is governed, its limitations, and any risks relevant to the customer's use case. The customer experience must surface AI confidence, limitations, and governance status contextually — helping customers make informed decisions without requiring them to interpret technical AI metrics or maintain separate oversight processes.

Describe how your solution implements AI governance and responsible AI practices that protect SMB customers, and how governance controls and AI limitations are communicated transparently.

EVIDENCE REQUIRED: 1/Documentation of AI governance controls (e.g., access controls, audit trails, version tracking, change management for AI behavior). 2/Documentation of responsible AI safeguards (e.g., output validation, bias monitoring, confidence thresholds) embedded within the governance framework. 3/Customer-facing materials explaining AI capabilities, governance posture, limitations, and appropriate use — including how limitations or confidence are communicated in context.

Applies to: SaaS

AWS Partners must clearly define and communicate how SMB customer data is handled across all AI-related processing — including training, inference, fine-tuning, indexing, embedding, and storage. Solutions must guarantee that customer data is not used to improve shared models or services without explicit opt-in consent. Partners must provide a plain-language data policy that an SMB business owner (not a legal team) can understand, covering: what data is processed, where it resides, how long it is retained, and how customers can access, export, or delete it. The customer experience must include self-service data management controls accessible without contacting support.

Describe how your solution handles SMB customer data transparently and provides customers control over their data across all AI processing stages.

EVIDENCE REQUIRED: 1/Plain-language data usage policy covering collection, processing, retention, and deletion. 2/Documentation of opt-in/opt-out mechanisms for data used in model improvement. 3/Self-service data management controls available to customers (export, delete, residency).

Applies to: SaaS

AWS Partners must demonstrate that their AI solution delivers measurable business outcomes appropriate to SMB scale and priorities. Solutions must provide built-in mechanisms for SMB customers to track the impact of AI on their business — such as time saved, costs reduced, revenue influenced, errors prevented, or productivity improved. Partners must not require SMB customers to build their own analytics or conduct independent ROI studies to understand AI value. The customer experience must regularly communicate realized value (e.g., monthly impact summaries, before/after comparisons, or goal tracking) so SMB leadership can justify continued investment without requesting custom reports.

Describe how your solution measures and communicates AI-driven business outcomes to SMB customers in a way that demonstrates ongoing value.

EVIDENCE REQUIRED: 1/Built-in outcome tracking or ROI measurement capabilities available to SMB customers. 2/Examples of value communication delivered to customers (e.g., impact summaries, dashboards). 3/Aggregate outcome metrics across your SMB customer base demonstrating measurable business impact.

Applies to: SaaS

AWS Partners must demonstrate that their migration or modernization solution can be used by SMB customers without requiring dedicated migration architects, cloud engineers, or database administrators. Solutions must provide guided workflows, pre-built templates, or automation that enables SMB customers to complete their category-relevant tasks (discovery, cost analysis, workload migration, or data migration) with minimal manual configuration. Partners must not require SMB customers to understand complex cloud architecture concepts, networking topologies, or migration methodologies to achieve productive outcomes. The customer experience must progressively guide users through required steps, providing contextual help and sensible defaults appropriate to SMB-scale environments (≤ 50 servers, ≤ 10 applications, or ≤ 5 databases).

Describe how your solution enables SMB customers without dedicated migration expertise to complete migration or modernization activities independently.

EVIDENCE REQUIRED: 1/Documentation of guided workflows, templates, or automation reducing complexity. 2/Evidence that SMB customers can achieve outcomes without cloud migration expertise. 3/Customer feedback or metrics demonstrating SMB self-service success.

Applies to: SaaS

AWS Partners must demonstrate that their solution delivers meaningful outcomes within timeframes appropriate to SMB project constraints. Regardless of category, solutions must enable SMB customers to complete their initial objective — whether an environment assessment, business case, workload migration, or data migration — within 30 calendar days for typical SMB environments. Partners must provide clear timelines and milestone expectations during onboarding, and the customer experience must include progress tracking that shows completion status relative to original estimates. Solutions must not require extended data collection periods, multi-phase planning cycles, or sequential dependencies that extend timelines beyond SMB tolerance.

Describe how your solution delivers outcomes within accelerated timeframes appropriate to SMB project constraints and resource availability.

EVIDENCE REQUIRED: 1/Documented timelines for typical SMB engagements in your category. 2/Evidence of SMB customer completions within 30 days (case examples or aggregate metrics). 3/Customer-facing progress tracking or milestone visibility features.

Applies to: SaaS

AWS Partners must demonstrate that their solution minimizes impact to SMB business operations during migration or modernization activities. Solutions must include safeguards appropriate to their category — such as non-invasive discovery methods, what-if analysis before changes, automated validation and rollback capabilities, or zero-downtime data synchronization. Partners must communicate risk clearly to SMB customers in business terms (e.g., expected downtime, data-at-risk window, rollback options) rather than requiring technical risk assessment expertise. The customer experience must provide confidence through pre-execution validation, progress monitoring, and clear recovery paths if issues arise.

Describe how your solution protects SMB customers from business disruption and communicates risk transparently throughout the migration or modernization process.

EVIDENCE REQUIRED: 1/Documentation of safeguards, validation, and rollback capabilities relevant to your category. 2/Evidence of how risk is communicated to customers in business terms. 3/Customer outcomes demonstrating minimal business disruption (e.g., downtime metrics, success rates).

Applies to: SaaS

AWS Partners must provide SMB customers with clear, upfront cost expectations for both the migration/modernization tool itself and the projected AWS environment costs post-completion. Solutions must include cost estimation or projection capabilities appropriate to their category — whether forecasting target-state AWS costs, estimating migration effort, or projecting ongoing operational expenses. Pricing for the partner's own solution must be predictable and accessible to SMB budgets without requiring custom scoping or enterprise sales engagement. The customer experience must ensure SMB decision-makers can build a complete financial picture — tool cost plus projected AWS cost — to secure budget approval before committing.

Describe how your solution provides SMB customers with transparent, predictable costs for both the migration tooling and projected AWS outcomes.

EVIDENCE REQUIRED: 1/Pricing documentation showing SMB-accessible models. 2/Cost estimation or projection capabilities relevant to your category. 3/Customer-facing cost visibility features enabling budget planning.

Applies to: SaaS

AWS Partners must demonstrate proven success with SMB customers and provide mechanisms for customers to validate outcomes after migration or modernization activities complete. Solutions must include built-in outcome measurement appropriate to their category — such as environment coverage metrics, realized vs. projected cost savings, migration success rates, performance improvements, or data integrity validation. Partners must provide post-completion reporting that SMB customers can use to confirm objectives were met and justify the investment to business leadership. The customer experience must clearly communicate "before and after" state, enabling SMB customers to see tangible value without requiring independent analysis.

Describe how your solution measures and communicates migration or modernization outcomes to SMB customers in a way that validates the investment.

EVIDENCE REQUIRED: 1/Built-in outcome measurement or success validation capabilities. 2/Examples of post-completion reporting delivered to SMB customers. 3/Aggregate SMB customer outcomes demonstrating measurable business value.

AWS Partners must declare which security categories their SMB solution addresses and demonstrate substantive coverage within each. Partners must select from: (1) Identity and Access Management, (2) Threat Detection and Response, (3) Infrastructure Protection, (4) Data Protection, (5) Compliance and Privacy, (6) Application Security, (7) AI Security — and identify the specific use cases covered within each selected category. Partners must demonstrate meaningful capability in at least one use case per declared category. Multi-category solutions must evidence integrated cross-domain protection. The domain declaration must align with coverage communicated to SMB customers per SEC-002 and SEC-004.

Declare which categories your SMB solution addresses and describe substantive protection delivered within each.

EVIDENCE REQUIRED: 1/Completed category declaration identifying selected categories and specific use cases addressed within each. 2/Technical documentation demonstrating capability within each declared use case. 3/Customer-facing materials showing domain scope communicated to SMB buyers. 4/For multi-category solutions: evidence of integrated cross-domain protection.

Applies to: SaaS

AWS Partners must demonstrate that their security solution can be deployed and delivering protection for SMB customers without dedicated security operations staff or extended implementation projects. Solutions must provide automated onboarding (e.g., one-click setup, guided wizards, API-based integration, or CloudFormation quick-starts) that achieves baseline protection within their security domain within 48 hours. Partners must include pre-configured policies, rules, or baselines appropriate to SMB environments rather than requiring customers to build custom configurations from scratch. The customer experience must clearly communicate what is protected and what remains exposed — providing deployment confirmation in business terms rather than requiring customers to validate technical configurations.

Describe how your solution enables SMB customers without security expertise to deploy and achieve protection within your security category quickly and independently.

EVIDENCE REQUIRED: 1/Documentation of automated deployment workflow and time-to-protection. 2/Pre-configured policies, rules, or baselines included for SMB environments. 3/Customer-facing deployment confirmation or protection status communication.

Applies to: SaaS

AWS Partners must provide security findings, alerts, or recommendations that SMB customers can understand and act upon without dedicated security analysts or SOC teams. Regardless of security category, solutions must prioritize outputs by business impact, suppress noise (false positives, informational alerts, or low-risk findings), and deliver plain-language guidance on what was detected and what action to take. Response options must include automated or one-click actions for common scenarios appropriate to the solution's domain — whether remediating access issues, blocking threats, encrypting exposed data, resolving compliance gaps, or patching vulnerabilities. The customer experience must reduce decision fatigue by presenting only items requiring attention.

Describe how your solution delivers security findings and recommendations that SMB customers can understand and act upon without security expertise.

EVIDENCE REQUIRED: 1/Examples of prioritized, plain-language security findings delivered to customers. 2/Automated or guided response actions available within your security category. 3/Evidence of noise reduction or alert suppression mechanisms (e.g., false-positive rates, alert volumes).

Applies to: SaaS

AWS Partners must provide ongoing visibility into the customer's security posture within their domain in a format accessible to SMB business leadership — not just technical practitioners. Solutions must include a summary view or periodic reporting that communicates security status using business-relevant indicators (e.g., protected/at-risk, improving/declining, compliant/non-compliant) without requiring interpretation of technical telemetry. Partners must enable SMB customers to answer the question "Are we secure?" within their solution's domain at any time, and to demonstrate security investment value to stakeholders such as insurers, auditors, or enterprise clients requesting attestation.

Describe how your solution provides SMB leadership with ongoing, business-relevant visibility into their security posture within your category.

EVIDENCE REQUIRED: 1/Customer-facing security posture summary or dashboard appropriate to your category. 2/Examples of periodic security reporting delivered in business-relevant terms. 3/Evidence that outputs can support external attestation needs (insurers, auditors, enterprise clients).

Applies to: SaaS

AWS Partners must provide pricing models accessible to SMB budgets that deliver comprehensive protection within their security domain without requiring per-asset cost calculations, enterprise license negotiations, or multi-module purchases to achieve baseline coverage. Solutions must offer at least one of: flat-rate pricing, per-user/per-account tiers, or bundled plans that scale predictably as the SMB environment grows. Partners must ensure SMB customers understand exactly what is included and any limitations of their plan without hidden costs or surprise overages. The customer experience must enable SMB decision-makers to approve security spend with confidence that coverage matches expectations.

Describe how your pricing model ensures SMB customers receive predictable, comprehensive security coverage within their budget constraints.

EVIDENCE REQUIRED: 1/Pricing documentation showing SMB-accessible tiers or models within your category. 2/Evidence that baseline protection does not require purchasing multiple add-on modules. 3/Customer-facing scope/coverage documentation showing what is included at each tier.

Applies to: SaaS

AWS Partners must demonstrate measurable security outcomes for SMB customers and provide mechanisms for customers to validate that the solution is delivering ongoing value. Solutions must include built-in metrics or reporting appropriate to their category — such as threats blocked, vulnerabilities remediated, access risks reduced, compliance posture improved, or attack surface minimized. Partners must proactively communicate security value over time (e.g., monthly summaries, trend reports, or improvement indicators) rather than requiring customers to seek out evidence of effectiveness. The customer experience must build confidence that the security investment is working and improving the customer's position over time.

Describe how your solution measures and communicates security outcomes to SMB customers, demonstrating ongoing value and improvement.

EVIDENCE REQUIRED: 1/Built-in outcome metrics or effectiveness reporting within your category. 2/Examples of proactive value communication delivered to SMB customers (e.g., monthly summaries). 3/Aggregate SMB customer outcomes demonstrating measurable security improvement over time.

Applies to: SaaS

AWS Partners must demonstrate that their operations solution is scoped and presented for SMB environments without overwhelming customers with enterprise-grade complexity. Solutions must provide a simplified onboarding experience that auto-discovers the customer's AWS environment and delivers operational value within 48 hours without requiring multi-account architectures, complex tagging strategies, or dedicated platform engineering. The customer experience must prioritize actionable recommendations over raw telemetry — surfacing the top 3–5 operational priorities rather than comprehensive dashboards requiring interpretation. Partners must demonstrate that SMB customers can self-manage their operational posture with fewer than 2 hours per week of active attention.

Describe how your solution adapts operational capabilities to SMB-scale environments and delivers value without requiring dedicated operations staff.

EVIDENCE REQUIRED: 1/Documentation of simplified onboarding and auto-discovery workflow. 2/Examples of prioritized, actionable recommendations delivered to SMB customers. 3/Evidence of low operational overhead (e.g., time-to-manage metrics, customer feedback).

Applies to: SaaS

AWS Partners must provide automated remediation capabilities that resolve common operational issues without requiring manual intervention or deep AWS expertise. Solutions must support at least three automated responses to common SMB operational events (e.g., disk full, instance unhealthy, certificate expiring, cost spike, security group misconfiguration). Automated actions must include safeguards (rollback capability, approval workflows for high-risk changes) and clear customer communication explaining what was detected, what action was taken, and what the outcome was. The customer experience must build trust through transparency — customers should always understand what the system did on their behalf.

Describe how your solution automatically detects and resolves operational issues for SMB customers while maintaining transparency and control.

EVIDENCE REQUIRED: 1/List of supported automated remediation actions with trigger conditions. 2/Documentation of safeguards, rollback capability, and approval workflows. 3/Examples of customer-facing notifications explaining automated actions taken.

Applies to: SaaS

AWS Partners must provide SMB customers a single-pane view of their operational health that correlates infrastructure metrics with business impact. Solutions must not require customers to configure separate monitoring, cost, and compliance dashboards. Operational alerts and recommendations must be prioritized by business impact (e.g., revenue-affecting issues surfaced before optimization suggestions) and presented in plain language accessible to non-technical business owners. The customer experience must reduce alert fatigue — solutions must suppress noise, deduplicate events, and present only items requiring attention.

Describe how your solution provides SMB customers with a unified, business-contextualized operational view that minimizes alert fatigue.

EVIDENCE REQUIRED: 1/Screenshots or documentation of unified operational dashboard. 2/Evidence of alert suppression, deduplication, or noise reduction mechanisms. 3/Customer evidence demonstrating reduced operational alert volume or improved response times.

Applies to: SaaS

AWS Partners must provide proactive cost optimization that identifies savings opportunities and guides SMB customers through implementation without requiring FinOps expertise. Solutions must automatically detect at least three categories of waste or savings opportunity (e.g., idle resources, oversized instances, missing reservations/savings plans, unattached storage, unused Elastic IPs). Recommendations must include projected savings, one-click or guided implementation, and risk assessment for each action. The customer experience must translate technical recommendations into business terms (e.g., "You can save $340/month by resizing these 3 instances — no downtime required").

Describe how your solution identifies and guides SMB customers through cost optimization without requiring cloud financial management expertise.

EVIDENCE REQUIRED: 1/Supported categories of cost optimization with detection methodology. 2/Examples of customer-facing savings recommendations with projected impact. 3/Evidence of realized savings at SMB customer accounts.

Applies to: SaaS

AWS Partners must provide proactive monitoring that alerts SMB customers to emerging risks before they become incidents, and regularly communicates operational health in a format appropriate for SMB leadership. Solutions must include at least two of: predictive alerts (e.g., capacity trending toward limits, cost trajectory anomalies), periodic health summary reports (weekly/monthly), or proactive recommendations for improving resilience. Communications must be delivered through channels SMBs already use (email, Slack, Teams) without requiring customers to log into a dashboard. Partners must demonstrate measurable improvement in operational outcomes (fewer incidents, less downtime, or reduced cost) for SMB customers over time.

Describe how your solution proactively communicates operational health and emerging risks to SMB customers through their preferred channels.

EVIDENCE REQUIRED: 1/Documentation of proactive alerting and predictive monitoring capabilities. 2/Sample health summary report or proactive communication delivered to an SMB customer. 3/Metrics demonstrating operational improvement at SMB accounts over time (e.g., reduced incidents, uptime improvement).

Applies to: SaaS | Customer Deployed

AWS Support provides a mix of tools and technology, people, and programs designed to proactively help you optimize performance, lower costs, and innovate faster. AWS Business Support provides additional benefits including access to AWS Trusted Advisor and AWS Personal Health Dashboard and faster response times.

For SaaS solutions, subscribing to AWS Business Support or greater (including AWS Partner-Led Support) for all production accounts is a requirement to successfully complete the validation for Competency Program. For customer deployed solutions invoking Partner-operated services, the Partner must subscribe those service-hosting accounts to an AWS Support plan.

Applies to: SaaS | Customer Deployed

AWS Partner offers product support via web chat, phone, or email support to customers.

Evidence must be in the form of description of support offered to customers for their product or solution.

Applies to: SaaS | Customer Deployed

AWS Partner must submit architectural diagrams depicting the overall design and deployment of the solution on AWS as well as any other relevant details of the solution.

The provided diagrams are intended to provide context to the AWS Solutions Architect conducting the technical validation. These diagrams will be referenced during the validation call. It is critical to provide clear diagrams with an appropriate level of detail in order to enable an efficient conversation about the product architecture with respect to the other technical requirements described in this document.

Each architecture diagram must show:

• The major elements of the architecture, and how they combine to provide the AWS Partner Solution to customers
• All of the AWS services used, using the appropriate AWS service icons.
• How the AWS services are deployed, including, VPCs, Availability Zones (AZs), subnets, and connections to systems outside of AWS.
• Includes elements deployed outside of AWS, e.g. on-premises components, or hardware devices.

Applies to: Customer Deployed

The deployment guide must provide best practices for deploying the AWS Partner Solution on AWS, and include all of the sections outlined in the AWS Foundational Technical Review Guide

Applies to: SaaS | Customer Deployed

All customer facing documentation and artifacts to deploy, operate and maintain the solution must meet the following standards:

• All references to AWS services must use the correct product names. (Please reference the official AWS product landing pages for the correct spelling and styling of product names)
• Documentation must be generally free of typos and grammatical errors.

Evidence: Provide a link to, or attach a copy of, your customer facing documentation.

Applies to: SaaS | Customer Deployed

AWS Partner has field-ready documentation and a seller toolkit that enable their field sellers to articulate a clear product value proposition to AWS customers.

Evidence must be in the form of sales collateral including a customer presentation, one-pager, and customer success stories.

Applies to: SaaS | Customer Deployed

If the solution is available via AWS Marketplace, AWS Partner must provide a link to the AWS Marketplace listing in their application.

An AWS Marketplace listing is not mandatory to achieve the AWS Competency.

Applies to: SaaS | Customer Deployed

AWS Partners must be Partner Revenue Measurement (PRM) compliant to enable automated measurement and attribution of AWS consumption. PRM provides transparent, data-driven recognition of the revenue impact partners create and is required for all Software competency partners.

Partner must provide the AWS Marketplace product name associated with PRM enablement.

Note: As of June 16,2026, Partner Revenue Measurement (PRM) compliance is required for Foundational Technical Review (FTR) approval. For complete onboarding and submission requirements, refer to Getting Started with PRM and Request Foundational Technical Review.

Applies to: SaaS | Customer Deployed

Static AWS Access Keys are not used, except in the following cases:

1. Used by humans to access AWS services and stored securely on a device controlled by that human.
2. Used by a service to access AWS services, but only in cases where all of the following are true:
   • It is not feasible to use an Amazon EC2 instance role, ECS Task role or similar mechanism
   • The AWS Access Keys are rotated at least weekly
   • Associated IAM Policies are tightly scoped such that it only allows access to specific actions and resources.
   • An IAM policy is in place that denies access to all actions except when requests originate from an IP address owned by the AWS Partner (see Example IAM Identity-Based Policies).

This requirement is applicable to internal processes running in the AWS Partner's AWS accounts as well as any components of the solution running in the customer's account. Customers must never be required to create IAM users in order to use any feature or capability of the solution. Partner-hosted or SaaS solutions must use cross-account IAM roles with external IDs to gain access to the customer's account. Customer deployed solutions must natively support using IAM roles associated with AWS compute resources.

Applies to: SaaS

All events from AWS Health with the service type "RISK" are handled within defined SLAs. APN Partner must implement all of the following:

• Define an SLA for security operations staff to evaluate and mitigate AWS Health RISK events.
• Implement automated integration with the primary internal issue tracking system such that a new issue is created for all events published by the AWS Health service with detail type "AWS Health Event" and service equal to "RISK". These events include "AWS_RISK_CREDENTIALS_COMPROMISED" and "AWS_RISK_CREDENTIALS_EXPOSED".
• Implement alerting and notification to security operations staff for both new issues created and SLA breeches.

Applies to: SaaS

All SaaS solutions must authenticate paid API or UI requests. The solution has specific technologies and mechanisms in place to mitigate the attacks described in the OWASP Top 10 Web Application Security Attacks

Applies to: SaaS

A hardened configuration based on CIS or equivalent benchmark has been defined for operating systems and containers used to host the solution. There are automated mechanisms in place to ensure this hardened configuration is applied to all compute resources (e.g., persisting the configuration to an immutable Amazon Machine Image [AMI]).

Applies to: SaaS

Protect your compute resources (e.g., instances, containers, functions, etc.) from unauthorized activity. This may include detecting any changes to the OS or application files and storing these changes in a durable location to allow for future forensic investigation. The mechanism employed for this purpose must at least:

• Detect any changes to the OS or application files in the compute resources used in the solution.
• Store data recording these changes in a durable location, external to the compute resources.

Applies to: SaaS | Customer Deployed

All cryptographic keys are encrypted at rest and in transit, and access to use the keys is controlled using an AWS solution such as AWS Key Management Service (AWS KMS) or an AWS Partner solution such as HashiCorp Vault.

Applies to: SaaS | Customer Deployed

A purpose-built ticketing system or similar tool is used by the security team to manage and track the ownership and resolution of any reported or detected security issues with the solution. This system should at a minimum track externally or internally reported security concerns about the solution. Additionally, for partner hosted/SaaS solutions, this system should track security operations tasks such as host patching as well as the analysis and remediation of any alerts raised by other detective measures.

This can be the same system used to fulfill OPE-005.

Applies to: SaaS

AWS CloudTrail logs are actively monitored using automated tools (e.g. Amazon GuardDuty) to detect suspicious or anomalous behavior, and alerting is configured to notify security operations staff in the event such behaviors are detected. Alerting must be integrated with the security ticketing system referenced in SECOPS-006.

Applies to: SaaS

Network activity for production VPCs is actively monitored using automated tools (e.g. Amazon GuardDuty) to detect suspicious or anomalous behavior, and alerting is configured to notify security operations staff in the event such behaviors are detected. Alerting must be integrated with the security ticketing system referenced in SECOPS-006.

Applies to: SaaS

The AWS Partner has defined a set of configuration policies for their AWS infrastructure (e.g. all Amazon Elastic Block Store (EBS) volumes must be encrypted), and these policies are enforced or monitored using automated tooling such as AWS Config or other comparable tools. This does not require automated remediation of policy violations, but detected violations must be automatically logged in a centralized ticketing system to ensure they are properly resolved by human operators.

Applies to: SaaS

Automated mechanisms are in place to prevent certificates from expiring unexpectedly.

Applies to: SaaS

Any components that are deployed to infrastructure shared across multiple tenants must model tenant identity in the software layer. The code for the component implements controls to ensure that tenants are isolated from one another and data is not leaked across tenant boundaries.

Applies to: SaaS

Any components which are not explicitly designed to isolate multiple tenants at the software layer are deployed to tenant-specific compute resources in tenant-specific VPCs. (In this context "tenant" refers to tenants of the AWS Partner solution.)

Supporting existing, legacy customers who may already be deployed to shared VPCs is acceptable as long as this model is completely deprecated and all new customers are deployed using a VPC-per-tenant model. There must be multiple active customers in production using the VPC-per-tenant model.

Applies to: SaaS

All single-tenant components must use dedicated IAM roles per tenant. These roles must limit access to only that tenant's resources using Resource and Condition statements within the attached policies.

Evidence must be provided in the form of a description of the roles used per tenant and an example of the IAM policies attached to those roles which provide explicit resource isolation.

Applies to: SaaS | Customer Deployed

The solution uses an official AWS SDK for all calls made to AWS API endpoints, or alternatively the solution implements retries with exponential backoff and jitter for all AWS API calls.

Applies to: SaaS | Customer Deployed

Measures are in place to rate limit calls to AWS APIs in the customer's account in order to prevent API throttling.

Applies to: SaaS | Customer Deployed

The solution uses methods such as ingesting AWS CloudTrail logs, consuming Amazon EventBridge events, or integrating with AWS Config to avoid polling AWS APIs wherever possible.

AWS Partner must describe what AWS resources state the solution tracks (if any), and how that resource state is discovered. In cases where there is no alternative to polling, AWS Partner must provide a detailed description of how they avoid causing API throttling issues.

Applies to: Customer Deployed

All components of the solution that are hosted in the customer's account support the ability for the customer to disable Instance Metadata Service Version 1 (IMDSv1). The solution must support the use of IAM roles associated with Amazon EC2 instances in conjunction with IMDSv2 for getting credentials to make calls to AWS APIs. Legacy support for static IAM access keys must be clearly deprecated.

AWS Partner must provide the specific version of the official AWS SDK used by the latest generally available version of the solution. The version of the AWS SDK in use must have been released after November 20th, 2019.

If the solution accesses AWS APIs without using an official AWS SDK, AWS Partner must describe the steps taken to ensure IMDSv2 is supported.

Applies to: SaaS | Customer Deployed

If the solution includes client software that runs on infrastructure managed by the customer and accesses the customer’s AWS account, the software must have an option to support the default credential provider chain used by the AWS SDKs. This ensures the customer has the option to configure access using temporary credentials with IAM roles (e.g., EC2 instance profiles, AWS IAM Identity Center, and IAM Roles Anywhere), and is not forced to create and use long-term IAM user access keys. The default credential provider functionality must be present, but does not need to be the default. The documentation for the software must inform the customer how to configure the software to use the default credentials provider chain.

Applies to: SaaS

Network connectivity to the solution must be highly available. If using VPN or Direct Connect to connect to customer networks, the solution must support redundant connections, even if the customers do not always implement this.

Applies to: SaaS

Logs and metrics for each component of the system are actively monitored. Critical metrics and thresholds are defined for each component and alarms are configured to notify operators in the event those thresholds are breached.

Evidence must be provided in the form of a list of the metrics and thresholds defined for each system component and a description of the tools used to surface alarms to operators.

Applies to: SaaS

All log information from the application, and from the AWS infrastructure, must be consolidated into a single system.

Applies to: SaaS

The application and the AWS infrastructure must be monitored centrally, with alarms generated and sent to the appropriate operations staff.

Applies to: SaaS

The solution must use an automated tool such as AWS CloudFormation or Terraform to provision and manage the AWS infrastructure. The AWS Management Console must not be used to make routine changes to the production AWS infrastructure.

Applies to: SaaS | Customer Deployed

Key Performance Indicators (KPIs) that indicate whether the product is performing as expected from the perspective of the customer have been defined. The definition of these KPIs must include how to measure the indicator as well as the acceptable threshold.

For example, p99 roundtrip response latency for API methods X, Y, and Z must be less than 200ms as measured by the TargetResponseTime AWS CloudWatch metric.

Partner must provide a list of KPIs and the defined acceptable thresholds as evidence.

Applies to: SaaS | Customer Deployed

Performance test suites (either automated or manual) are run before major releases or production deployments in order to ensure new versions meet defined performance targets.

Applies to: SaaS

The solution must use an automated method of deploying code and configuration to the AWS infrastructure. Interactive SSH or RDP sessions must not be used to deploy updates in the AWS infrastructure.

Applies to: SaaS

Runbooks must be developed to define the standard procedures used in response to different application and AWS events. An escalation process must be defined to deal with alerts and alarms generated by the system, and to respond to customer-reported incidents. The escalation process must also include escalating to AWS Support where appropriate.

Applies to: SaaS | Customer Deployed

Code is peer reviewed before being released or deployed to production.

Applies to: SaaS | Customer Deployed

Automated functional test suites exist and are automatically run before software is released or deployed to production.

Applies to: SaaS | Customer Deployed

A purpose-built issue tracking tool or set of tools is used to manage product backlogs, feature requests, defects and identified operational issues.

Applies to: SaaS | Customer Deployed

A process is established to track and remediate all customer reported product bugs as well as operational incidents that cause customer impact.

Applies to: SaaS | Customer Deployed

If the solution incorporates agentic AI capabilities—autonomous agents that plan, reason, invoke tools, or execute multi-step actions—the partner must demonstrate governance controls ensuring safe, observable, auditable agent operations in production.

The partner must demonstrate:

• Scope and Boundary Definition — Agent operational boundaries explicitly defined (permitted actions, accessible resources, escalation thresholds) and enforced through deterministic controls (IAM policies, allowlists) and/or probabilistic controls (content filters, behavioral evaluation).
• Human-in-the-Loop Controls — Mechanism for human review/approval of high-impact or irreversible agent actions before execution, with defined trigger criteria and escalation path.
• Observability and Audit Trail — All agent decisions, tool invocations, and actions logged in durable, centralized system. Logs include: timestamp, agent identity, action taken, input context, output/result, and approval status.
• Guardrails and Safety Controls — Input/output validation prevents agents from generating harmful, biased, or out-of-scope responses/actions (e.g., Amazon Bedrock Guardrails or equivalent).

Please include in your response:

• Architecture diagram supplement showing governance controls, guardrails, and logging integration in agent execution flow
• Written description on scope/boundary enforcement, human-in-the-loop trigger criteria, logging implementation with sample log entry, guardrail implementation
• Screenshot from observability/logging system demonstrating agent action audit trail

Applies to: SaaS | Customer Deployed

Providing details about who the customer is, their situation and business allow us to establish credibility by providing a degree of authenticity. In addition, this information also allows AWS to verify proper customer alignment to the designation as designations can be aligned with an industry and/or a customer segment.

Provide some background information about the customer; name, industry, size, market segment (Enterprise/SMB/ISV/Startup)?

Note:

• If a public URL for the case study is available, please provide along with your response.
• For anonymous case studies, the customer name can be omitted.

Applies to: SaaS | Customer Deployed

The partner must articulate the customer's critical business challenge that aligns with the specific AWS specialization program's focus area, whether it addresses industry-specific needs, targeted use cases, or specialized workloads. Their documentation must identify both immediate and long-term business risks the customer faced without intervention, supported by quantifiable metrics or concrete business impacts.

The description should establish a clear connection between the customer's challenge and the specialization program's core objectives, demonstrating why this particular case study exemplifies the program's intended scope.

What is the key business challenge for the customer and the risk of not addressing this challenge?

Applies to: SaaS | Customer Deployed

Working backwards from our goals/objectives allows us to formulate an optimal implementation strategy as well as identify the technical solution best suited to meet those goals/objectives. Partners are required to work with the customer to identify what those targets are, but business and technical.

Describe some of the customer's goals and objectives as part of their engagement with your organization.

Applies to: SaaS | Customer Deployed

Each AWS specialization program defines the coverage scope of a domain through definition, distinct categories and/or solution areas. The partner must explicitly articulate how the provided case study meets the definition, category and/or solution area defined by the program by providing substantive evidence demonstrating alignment.

If categories are defined, the case study submission must include a clear mapping between the implemented solution and the chosen specialization category, supported by concrete elements, implementation approaches, and outcomes that validate their solution's fit within the selected category requirements.

Describe how the provided customer reference meets the definitional scope outlined by this competency. If categories are defined, then specify which category corresponds to this customer reference and describe why this reference is a good fit for that category.

Note: The competency definition can be found in the introduction tab.

Applies to: Customer Deployed

An architecture diagram illustrates the complete solution design and demonstrates how key components interact. For each case study, the architecture diagrams must comprehensively document several critical elements of your implementation.

The diagram should clearly represent your infrastructure / service layout, with specific emphasis to the designation being applied to. Include all connections to external systems and any non-AWS components, such as on-premises systems or hardware devices.

Provide an architecture diagram for the overall design and deployment of the solution on AWS. The diagram must include the following components.

Please include the following in your response (required for all provided customer examples):

1. Explanation of how the major solutions elements will keep running in case of failure.
2. Description of how the major solutions elements handles scalability through mechanisms such as auto-scaling.
3. Description of your high-availability strategy, including multi-AZ or multi-region deployment approaches.

Applies to: SaaS | Customer Deployed

The partner must demonstrate comprehensive technical expertise in their chosen specialization domain through detailed solution documentation that contains an in-depth analysis of service selection decisions, including rationale for choosing specific AWS services over available alternatives. Their technical solution description should directly reference the architecture diagram and explain each component's role in the overall system, establishing clear connections between customer requirements and technical decisions.

Describe the technical solution implemented. Reference the architecture diagram in the explanation.

Please include the following in your response:

1. Justify each service relevant to the designation domain, outlining the analysis of the alternatives considered and rejected.
2. Describe the integration points between different system components

Applies to: SaaS | Customer Deployed

Every business challenge has multiple solutions. AWS prioritizes customer needs, requiring partners to implement solutions that maximize business value while minimizing cost and complexity.

Describe how your solution optimally solves the customer's business challenge and why it was selected amongst the alternatives?

Please include in your response:

1. Description of the alternatives/approaches/options that were considered before arriving at this solution.

Applies to: SaaS | Customer Deployed

Partner solutions implemented for customers must be production grade and live. We measure this by confirming the AWS Annual Recurring Revenue (ARR) that the solution is driving. Proof-of-concepts are not acceptable customer references.

What is the estimated AWS ARR and confirm whether it meets the designation revenue requirements (if any)?

Note: Any designation specific revenue prerequisites can be found on the designation checklist website.

Applies to: SaaS | Customer Deployed

AWS Partners are required to understand AWS customer opportunity registration and tracking mechanisms implemented through ACE. The data found through these mechanisms enables AWS to expedite the validation of the customer reference.

If available, Please provide the ACE opportunity ID and AWS account ID

Note: Not providing the ACE opportunity ID and/or AWS account ID may introduce delays in the application processing time or lead to requests for more information from the validation team.

Applies to: SaaS | Customer Deployed

The partner must demonstrate solution success through quantifiable metrics that align with the case study documentation.

Their submission must identify and detail at least two specific Key Performance Indicators that directly measure business impact and improvement.

Each KPI must include baseline measurements, improvement targets, actual results, and clear methodology for measurement, providing concrete evidence of how the solution enhanced customer operations.

What two (2) specific KPIs were measured to help improve the customer business?

Applies to: SaaS | Customer Deployed

The partner must candidly identify any challenges that were observed during the implementation providing a thorough analysis of the lessons learned from these shortfalls, and specific actions taken or planned to address these gaps in future implementations.

This transparency demonstrates the partner's commitment to continuous improvement and ability to adapt solutions based on real-world implementation experiences.

What were some of the challenges observed during this engagement and what is being done to ensure these challenges are mitigated for future customers?