# AWS Support Cases Open AWS support cases and follow up on AWS's replies from the Suger Console, without switching to the AWS Support Center. --- ## Overview Once you connect the AWS Support integration, Suger can talk to the AWS Support API on your behalf. From the Suger Console you can: - **Open a case** with AWS — pick the service and category, set a severity, and write the subject and description. - **Open a case in context** — start a pre-filled case directly from an AWS offer, entitlement, or product. - **Attach files** — add up to 3 files, 5 MB each, to a new case or to a reply. - **CC colleagues** — copy up to 10 email addresses on the case correspondence. - **Read the correspondence** — the messages AWS and your team have exchanged on the case. - **Reply to AWS** — add a message to an existing case. :::info What this page is not about The **Support Tickets** tab on the same page is Suger's own ticketing system for reaching the Suger team, and it is a different feature with different capabilities (comments, attachments, close and reopen). This page covers only the **AWS Support** tab, which talks to AWS. ::: ### What the console does not do yet | Not available in Suger | Where to do it instead | | ---------------------- | ---------------------- | | Resolving, closing, or reopening a case | [AWS Support Center](https://console.aws.amazon.com/support/home) | Cases you open through Suger are ordinary AWS support cases, so they are also visible and fully manageable in the AWS Support Center under the same AWS account. --- ## Prerequisites ### An eligible AWS Support plan The AWS Support API is only available on **Business**, **Enterprise On-Ramp**, and **Enterprise** Support plans. On a Basic or Developer plan the integration cannot be verified, and Suger reports: > AWS account does not have a Business, Enterprise On-Ramp, or Enterprise Support plan required to use the AWS Support API ### Suger permissions | Suger role | Connect or edit the integration | Read cases | Open a case | Reply to a case | | ---------- | ------------------------------- | ---------- | ----------- | --------------- | | Admin | Yes | Yes | Yes | Yes | | Editor | No | Yes | Yes | Yes | | Viewer | No | Yes | No | No | Cases are visible to your whole organization, not only to the person who opened them — anyone with read access sees the same list and the same correspondence. ### Connect the AWS Support integration The integration is separate from your AWS Marketplace integration — connecting AWS Marketplace does not grant Suger access to the AWS Support API. You grant that access with an IAM role that Suger assumes. Connecting it requires the Suger **Admin** role. 1. In the [Suger Console](https://console.suger.io/settings?tab=integrations), go to **Settings** → **Integrations** and find the **AWS Support** card. 2. Click **Connect**. The **Connect to AWS Support** dialog shows everything you need to create the role: your **External ID**, a **Permissions policy**, and a **Trust relationship**. ![Connect to AWS Support dialog in Suger, showing the external ID and the permissions policy to copy](images/aws-support-cases-1.png) 3. In the AWS IAM console, create a role in the AWS account that holds your Support plan. Any role name works; the dialog's example uses `SugerAwsSupportAccess`. Paste the **Permissions policy** as an inline policy and the **Trust relationship** as the role's trust policy, copying both from the dialog. The permissions policy grants exactly the AWS Support API actions Suger uses, and nothing more: | Action | Used for | | ------ | -------- | | `support:DescribeServices` | The service and category pickers on the create form | | `support:DescribeSeverityLevels` | The severity picker, and the integration's Verify check | | `support:CreateCase` | Opening a case | | `support:DescribeCases` | Refreshing a case's status | | `support:DescribeCommunications` | Reading the correspondence on a case | | `support:AddCommunicationToCase` | Replying to a case | | `support:AddAttachmentsToSet` | Uploading file attachments on a case or a reply | :::warning Already connected? Re-apply the policy for attachments `support:AddAttachmentsToSet` was added to the policy when attachment support shipped. A role created before then does not have it, and attachment uploads are denied until you re-apply the policy — everything else on the integration keeps working, so the gap only shows up the first time someone attaches a file. Copy the current **Permissions policy** from the **AWS Support** integration card and paste it over the role's inline policy. If the role or its trust policy also changed, reconnect the integration instead. ::: :::info Copy the trust policy from the dialog The trust policy names the Suger AWS account that assumes the role and pins the **External ID** to your organization. Both values differ per Suger environment, so always copy the block shown in your dialog rather than reusing one from elsewhere. ::: 4. Copy the new role's ARN, paste it into **IAM Role ARN**, and click **Create**. The ARN must be a commercial-partition IAM role ARN in the form `arn:aws:iam:::role/`; AWS China (`aws-cn`) and GovCloud (`aws-us-gov`) ARNs are rejected. 5. Suger verifies the connection by assuming the role and calling the Support API. Once the card shows the integration as verified, the **AWS Support** tab is ready. ![AWS Support integration card in Settings, showing a verified connection](images/aws-support-cases-2.png) :::warning One integration per organization An organization can have a single AWS Support integration. You can update its **IAM Role ARN** later from the card's **⋯** menu → **Edit**, but the ARN must stay in the same AWS account — to point Suger at a different AWS account, delete the integration and connect again. Cases opened under the previous account stay in the list but can no longer be opened or replied to. ::: --- ## Open a support case 1. In the [Suger Console](https://console.suger.io/support), click the **help** icon in the top bar to reach the Support page, then select the **AWS Support** tab. 2. Click **Open AWS Support Case**. ![AWS Support tab with the Open AWS Support Case button](images/aws-support-cases-3.png) 3. Fill in the case. The first five fields are required; **Attachments** and **CC** are optional: - **Subject** — a short summary, up to 300 characters. - **Service** — the AWS service the case is about. The list is read live from your AWS account, so it matches what the AWS Support Center offers. Suger preselects **AWS Marketplace**, because that is what most cases opened through Suger are about — change it if your case is about something else. - **Category** — the case category. The options depend on the service, so pick the service first. - **Severity** — the severity levels your Support plan entitles you to, shown as name and code. Suger preselects the first level in the list. - **Description** — the details AWS needs, up to 8,000 characters. - **Attachments** — up to **3 files**, **5 MB each**. Click **Attach files** to pick them; files beyond either limit are dropped with a message saying why. - **CC** — up to **10 email addresses** to copy on the case correspondence. Over the limit, the field reports "At most 10 cc addresses are allowed." ![Open AWS Support Case dialog with all fields filled in](images/aws-support-cases-4.png) 4. Click **Open Case**. Suger creates the case in AWS and it appears in the list with its AWS **Case ID**. Both limits are enforced by Suger's API as well as by the form, so a case created through the Suger API is held to the same 3 files, 5 MB each, and 10 CC addresses. ### Find a service quickly The service list is long, so the **Service** picker has a search box. The search is case-insensitive and matches on both the service name and its service code: - Type any fragment that appears in the name or the code — `ec2` finds every Elastic Compute Cloud entry. - Type several words in any order and each one has to appear somewhere — `linux ec2` narrows to the Linux-specific EC2 entry. - Clear the box to get the full list back. ![Service picker with a search term entered and matching services listed](images/aws-support-cases-5.png) ### Open a case from an offer, entitlement, or product When a case is about a specific record, start it from that record so the case is linked and pre-filled: 1. Open an AWS offer, entitlement, or product detail page. 2. In the **⋯** menu, click **Create AWS Support Case**. 3. The dialog opens with the record's identifiers already in the subject and description, and a banner naming the linked record. Adjust the text, pick the service, category, and severity, then click **Open Case**. From an offer, the subject arrives as `AWS Support — Offer `. AWS caps a case subject at 300 bytes, so a long offer name is truncated to fit rather than being rejected on submit. You can edit the prefilled subject before you send it. The menu item appears only on AWS records, only once the AWS Support integration is verified, and only for users who can open cases — Viewers don't see it. --- ## Track and reply to a case The **AWS Support** tab lists every case your organization has opened through Suger, newest first, with its **Case ID**, **Subject**, **Status**, **Opened** date, and **Last Update**. Click a **Case ID** to open the case. Suger fetches the current status and the correspondence from AWS, then shows the messages oldest-first, each with its author and timestamp. ![AWS support case detail, showing the correspondence thread and the reply box](images/aws-support-cases-6.png) To respond, type in the reply box and click **Send Reply** — up to 8,000 characters. A reply takes the same **Attachments** (up to 3 files, 5 MB each) and **CC** (up to 10 addresses) as a new case. AWS adds your message to the case correspondence, exactly as if you had replied in the AWS Support Center. Admins and Editors can reply; Viewers can only read. ### Who sent each message Every message in the thread is labeled with its sender: | Message | Shown as | | ------- | -------- | | Sent from Suger | The email address of the person who sent it | | Sent from Suger before per-user attribution shipped | `Suger` | | Sent by an AWS support agent | Whatever AWS reports, unchanged | Because AWS records the case against the IAM role Suger assumes, older messages cannot be attributed to an individual after the fact — they keep the generic `Suger` label. New messages carry the sender's email from the moment they are posted. :::info Statuses refresh when you open a case **Status** comes from AWS, and Suger refreshes it when you open the case — not on a timer. If AWS has worked the case since you last opened it, the list keeps showing the older status until you open the case again. The correspondence itself is always fetched live, so opening a case shows you the current thread. ::: --- ## FAQ - #### The AWS Support tab says the integration is not connected. What now? The tab needs a *verified* AWS Support integration, which is separate from your AWS Marketplace integration. Follow [Connect the AWS Support integration](#connect-the-aws-support-integration). If you just created it and verification failed, confirm the AWS account has a Business, Enterprise On-Ramp, or Enterprise Support plan. - #### The service dropdown is empty or shows an error. Suger reads the service catalog live from AWS through the assumed role. If it can't, check that the IAM role still exists, that its trust policy is unchanged, and that the permissions policy includes `support:DescribeServices`. Suger tells you when it can no longer assume the role — reconnect the integration in that case. - #### Why can't I see all the severity levels AWS documents? The list is read from your AWS account, so it shows exactly the levels your Support plan entitles you to — higher plans include more levels. - #### Can I attach a file or CC a colleague? Yes, on both a new case and a reply. Attachments are limited to **3 files of 5 MB each**, and **CC** takes up to **10 email addresses** — AWS's own limits, which Suger enforces before calling AWS so you get a clear message instead of a raw AWS validation error. - #### My attachment upload was denied. Why? The IAM role Suger assumes needs `support:AddAttachmentsToSet`, which was added to the permissions policy when attachments shipped. A role created before then lacks it. Re-apply the current **Permissions policy** from the **AWS Support** integration card to the role — see [Connect the AWS Support integration](#connect-the-aws-support-integration). - #### How do I resolve or close a case? Close it in the AWS Support Center. Suger shows the resolved status the next time you open the case. - #### Why doesn't my case appear right after I click Open Case? A case shows up once AWS has accepted it and returned a case ID. If it doesn't appear, check the error message on the dialog — AWS rejects requests that exceed its case-creation limit or fail its own validation, and Suger passes that message through. - #### Is this the same as a Suger support ticket? No. The **Support Tickets** tab reaches the Suger team; the **AWS Support** tab reaches AWS. For questions about Suger itself, use Support Tickets or email [Suger Support](mailto:support@suger.io). --- ## Related Documentation - [AWS Marketplace Integration](/aws-marketplace/integration/) - [Refunds and Cancellations](/aws-marketplace/refunds-cancellations/) - [AWS Support Center](https://console.aws.amazon.com/support/home) — the AWS-side view of the same cases - [AWS Support API reference](https://docs.aws.amazon.com/awssupport/latest/APIReference/Welcome.html)