You need an Amazon Web Services (AWS) account to use Amazon Notifications. The Amazon Selling Partner API requires it: Amazon delivers notification events into infrastructure that lives in your AWS account, and Openbridge processes those events and loads them to your configured data destination.

While using AWS may seem daunting, don't worry. We have simplified and automated the entire process with a CloudFormation template. These steps can be completed in about 5 minutes.

If you configured Notifications previously, the setup has changed. Read this section before you begin.

You run one template, one time, per AWS account. The V1 process required a brand new CloudFormation stack for every subscription. V2 does not. The template creates reusable IAM roles, and those same roles are used for every Notifications subscription you activate in that AWS account and region.

You supply IAM role ARNs, not queue ARNs. V1 asked you for SQSQueueArn and S3NotificationsQueueArn. V2 asks for two IAM role ARNs.

Openbridge provisions the rest for you. Using the role you grant, Openbridge creates and manages the per-subscription S3 bucket, SQS queues, Firehose delivery stream, EventBridge rules, and EventBridge Pipe inside your account. You no longer create or name those resources yourself.
​

You also select an AWS Region in Openbridge. It must match the region you created the stack in.
​

If you do not have an AWS account, go to https://aws.amazon.com/ and create one. If you have an account, log in.

Choose the AWS region you want to run Notifications in, and make sure it is selected in the AWS console region picker (top right). The stack, the roles, and the resources Openbridge creates all live in this region, and you will select this same region in Openbridge later.

Note the Openbridge Amazon Notifications API prerequisites CloudFormation template URL:

https://openbridge-customer-templates-production.s3.amazonaws.com/amazon-notifications-api/notifications-api-prereq.yaml
​

This template automates the configuration of your AWS account. It creates three IAM roles:

Management role (openbridge-spapi-cf-manager) — grants Openbridge scoped permission to provision and run the Notifications delivery resources in your account. This is the Notifications Role ARN you will paste into Openbridge.

EventBridge to Firehose role (openbridge-eventbridge-to-firehose-role) — allows Amazon EventBridge to deliver notification events into Firehose. This is the EventBridge to Firehose Role ARN you will paste into Openbridge.

Firehose delivery role (openbridge-spapi-firehose-role) — allows Firehose to write records to the notifications S3 bucket. This one is discovered and used internally; you do not need to copy it.

We want you to know exactly what you are agreeing to before you run this, so nothing here catches you off-guard.

The management role is a cross-account IAM role. It lets the Openbridge API assume that role in your account and create and manage the AWS resources needed to run your Notifications pipelines. Specifically:

No IAM user is created, and no access keys are issued. Access is granted by role assumption only. The role's trust policy names the Openbridge service account (arn:aws:iam::791778434480:role/customer-cloudformation-production) as the only principal allowed to assume it.
​

Permissions are scoped to Notifications resources only. Every statement is restricted to resources named ob-sp-notifications-* in your account and selected region — an S3 bucket, SQS queues, a Firehose delivery stream, EventBridge rules and Pipes, the matching CloudWatch log groups, and the IAM roles those services require.

The role cannot reach the rest of your account. It has no broad administrative permissions, and no access to resources outside those name patterns.

You control it. Deleting the CloudFormation stack removes the roles and revokes Openbridge's access.

The template is a plain, readable YAML file, and we encourage you to review it — or hand it to your cloud or security team — before you run it. Every permission is listed explicitly:

https://openbridge-customer-templates-production.s3.amazonaws.com/amazon-notifications-api/notifications-api-prereq.yaml
​

Go to "CloudFormation" in your AWS account and create a stack with new resources (standard).

Select "Choose an existing template"
​

Select "Amazon S3 URL" and enter this URL:

https://openbridge-customer-templates-production.s3.amazonaws.com/amazon-notifications-api/notifications-api-prereq.yaml
​

Select "Next"
​

Provide a Stack Name. Because this stack is created once per AWS account, a simple, descriptive name works well, for example:

Stack Name: openbridge-notifications-prereq

The template also exposes two parameters with defaults already filled in:

Leave both parameters at their default values unless Openbridge support tells you otherwise. Changing them does not break anything, but the ARNs you copy later will reflect the names you chose.

Once you have entered the details, select "Next" to proceed.

One stack per AWS account and region

Unlike the previous version of this setup, you do not create a new stack for each subscription.

Reuse the same two role ARNs for every Notifications subscription you create.

One stack also covers multiple identities. Each identity is its own Seller Central or Vendor Central account, and they all share the same two role ARNs. You do not need a separate AWS account or a separate stack per Seller or Vendor account.
​

Openbridge creates the per-subscription resources for you automatically each time you activate a new subscription, and keeps each subscription's data separated.

The IAM roles are created with fixed names, so attempting to run the template a second time in the same account and region will fail with a name conflict. That is expected — if the stack already exists, just reuse its outputs.

💡 One stack per AWS account. Reuse the role ARNs for every subscription and every identity.

You can skip this page. Leave everything default. Select "Next".

The last step is to review and run your stack. At the bottom of the page you must check the acknowledgement box:

"I acknowledge that AWS CloudFormation might create IAM resources with custom names."

This is required because the template creates named IAM roles. Check the box, then select "Submit".

Review configuration, acknowledge IAM capabilities, and submit
​

After submission, the workflow runs automatically and completes several steps. When the status shows CREATE_COMPLETE, everything is ready.

Select the "Outputs" tab of the created stack.

Copy the ManagementRoleArn and EventBridgeToFirehoseRoleArn values and store them somewhere safe on your computer. The ARNs will look like the following examples:

You will also see FirehoseDeliveryRoleArn. You do not need to copy it — Openbridge discovers it automatically.
​

These two ARNs are what Openbridge needs to automate the configuration of the remaining Amazon Notifications API resources in your account.

You are all set. Log into your Openbridge account with your two role ARNs in hand and continue the Amazon Notifications activation. In the AWS setup step of the wizard you will provide:

AWS Region — must match the region where you created the CloudFormation stack.

Notifications Role ARN — paste the ManagementRoleArn value.

EventBridge to Firehose Role ARN — paste the EventBridgeToFirehoseRoleArn value.

The two ARNs must be different from one another. If you paste the same value into both fields, Openbridge will reject the form.
​
​

Adding more identities and subscriptions later

Both roles are stored on your subscription. That means you can add or change datasets — including EventBridge-delivered datasets — later without re-running the CloudFormation template.

To connect another identity — another Seller Central or Vendor Central account — run through the Openbridge wizard again, authorize that account, and supply the same AWS Region and the same two role ARNs from your existing stack. There is nothing new to do in AWS.

Stack fails with "already exists" — a stack from a previous run already created the roles. Open that stack's Outputs tab and reuse the ARNs instead of creating a new stack.

"A valid Notifications Role ARN is required" — the value must be a full IAM role ARN, for example arn:aws:iam::123456789101:role/openbridge-spapi-cf-manager. Copy it exactly from the Outputs tab, with no leading or trailing spaces.

Both ARN fields rejected — the Notifications Role ARN and the EventBridge to Firehose Role ARN cannot be the same value.
​

Provisioning errors after submitting — confirm the AWS Region selected in Openbridge matches the region the stack was created in. Resources are region-specific.