- The FTR is a self-service review that checks your software against a subset of the AWS Well-Architected Framework — security, reliability, and operational excellence. It costs nothing and, since 2025, is valid for three years (AWS, 2025).
- It is not required to list on AWS Marketplace, but it is a prerequisite for ISV Accelerate co-sell, funding benefits, and the “Reviewed by AWS” badge (AWS FTR Guide, 2025).
- Two 2025 changes make it far easier: a WAFR waiver (an AWS-led Well-Architected review in the last 12 months with zero high-risk issues can replace most of the FTR) and Amazon Bedrock-accelerated automated review that returns results in minutes (AWS Partner Network, 2025).
- You submit through AWS Partner Central — a completed validation checklist plus a CIS AWS Foundations Benchmark security report, or a SOC 2 Type II / WAFR report to take the waiver path (AWS Partner Central, 2025).
Here is the sentence that reframes the whole exercise: the AWS Foundational Technical Review is not required to publish a listing on AWS Marketplace — but the moment you want to co-sell, draw down committed spend, or wear a “Reviewed by AWS” badge in front of a security-conscious buyer, it becomes the gate you cannot route around (AWS FTR Guide, 2025). Most ISVs meet the FTR as a surprise requirement halfway through an ISV Accelerate application. This guide treats it as what it actually is: a defined, passable technical checklist that rewards preparation and punishes improvisation.
What the FTR actually is
The AWS Foundational Technical Review is a self-service review that helps AWS Partners identify and remediate risks in their software or solution against a subset of the AWS Well-Architected Framework. Per AWS, it provides specific guidelines to adopt best practices that reduce risk around security, reliability, and operational excellence, it is valid for three years from the date of approval, and you can conduct it at no cost (AWS Foundational Technical Review, 2025).
The Well-Architected Framework itself spans six pillars — operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability (AWS Partner Central, 2025). The FTR does not grade all six. It concentrates on the three that most directly protect a customer running your software in production, which is why teams that treat the FTR as “a security audit plus some paperwork” consistently misjudge the operational-excellence half of it.
Do you actually need it? The honest answer
The single most repeated FTR myth is that you must pass it to sell on AWS Marketplace. You do not. AWS is explicit that an FTR is not required to list a partner solution in AWS Marketplace (AWS FTR Guide, 2025). What the FTR unlocks is everything around the listing that turns it from a storefront into a growth channel.
On approval, your offering is listed in the AWS Partner Solutions Finder, you gain the right to use “Reviewed by AWS” badging, and you unlock funding benefits and eligibility for further AWS Partner programs — including the AWS Competency Program and the ISV Accelerate co-sell program. The FTR is also a prerequisite for many other APN programs such as AWS Competency and AWS Service Ready (AWS FTR Guide, 2025; AWS Partner Network, 2025).
So the decision rule is simple. If your AWS Marketplace listing is a passive catalog entry, the FTR is optional. If you want AWS field teams co-selling your product, if you want to draw on a buyer’s committed spend at scale, or if an enterprise security team is going to ask “is this reviewed by AWS?” — then the FTR stops being optional in practice, whatever the letter of the rule says. That matters because marketplace economics are increasingly where enterprise software gets bought: Omdia projects enterprise software sales through the hyperscaler marketplaces will grow to roughly $163B by 2030, and Forrester’s 2025 Total Economic Impact study of AWS Marketplace (commissioned by AWS) found buyers cut procurement time by around 60% when purchasing through it. The FTR is the technical toll you pay to sit inside that motion with AWS’s endorsement.
The FTR is not a gate on your listing. It is a gate on your credibility with AWS’s own sales teams — and that is the more valuable door.
The 2025 changes that made this cheaper to pass
If your mental model of the FTR is from 2023 — a multi-week, back-and-forth slog with a reviewer — it is out of date. In 2025 AWS streamlined the process as part of its partner-experience transformation, and three of the changes are worth building your plan around (AWS Partner Network, “Updates to the AWS Foundational Technical Review,” 2025).
Renewal extended from two years to three
Partners on the Software Path and Services Path must submit FTR renewal requests before the due date to keep their Validated stage. The renewal window moving from two to three years cuts a full review cycle out of a multi-year partnership (AWS Partner Network, 2025).
A Well-Architected Review can waive most of the FTR
Partners on the Software Path who completed an AWS-led Well-Architected Framework Review (WAFR) within the last 12 months, with no high-risk issues in the Security, Operational Excellence, and Reliability pillars, can use that review to obtain FTR approval — completing a short self-assessment instead of the full control set. If you have already done the WAFR work, you may not need to do the FTR twice (AWS Partner Network, 2025).
Amazon Bedrock made the automated review fast
The FTR process now uses Amazon Bedrock to speed up reviews and response time. In AWS Partner Central, each submission is reviewed automatically and returns results within minutes — so a complete, compliant submission gets feedback in one sitting rather than over weeks (AWS Partner Network, 2025; AWS Partner Central, 2025).
If your organization has completed a SOC 2 Type II audit, or an AWS-led WAFR in the past 12 months with zero high-risk issues in Security, Operational Excellence, and Reliability, check the alternative validation checklist first. Submitting an existing SOC 2 Type II report can satisfy FTR requirements outright, and the WAFR path sets your renewal date 36 months out (AWS Partner Central, 2025). The cheapest FTR is the one you have already substantially done.
What the review checks — and where teams fail it
The FTR evaluates what is actually deployed and operating, not a slide describing your intended architecture. The requirements map to a defined validation checklist across the three in-scope pillars. Security receives the heaviest scrutiny.
Security
IAM hygiene — no root account for daily operations, least-privilege policies, MFA on privileged accounts — plus data protection and secrets management, evidenced against the CIS AWS Foundations Benchmark (AWS FTR Guide, 2025).
Reliability
Failover and recovery, backups, and resilient multi-AZ architecture appropriate to the workload — the review looks for designs that survive a component failure, not single points of failure.
Operational Excellence
Documented runbooks, monitoring and observability coverage, and automated, repeatable deployments — evidence you can operate the product reliably rather than heroically.
Evidence, not intent
A security report from an automated tool plus a completed self-assessment, scoped to every AWS account and Region where you process customer data (AWS FTR Guide, 2025).
Where do submissions stall? Independent FTR practitioners report three recurring failure categories: security-hygiene gaps (IAM sprawl, missing MFA), operational immaturity (absent runbooks, monitoring gaps, manual deploys that drift), and architecture anti-patterns (single-AZ deployments for workloads that should be multi-AZ, missing circuit breakers for external dependencies) — and they note the FTR requires genuine architectural alignment, not just compliant-looking documentation (Eficens, 2025).
The FTR reviews the state of your live environment. A polished architecture diagram that describes multi-AZ resilience will not pass a workload that is actually running single-AZ. Run your workload through the AWS Well-Architected Tool first, remediate the high-risk issues it surfaces, and only then submit — because the checklist is validating reality, not aspiration.
The two paths to approval
There is a standard path and a waiver path. Choosing the right one before you start is the difference between an afternoon and a fortnight.
- Run your AWS accounts against the CIS AWS Foundations Benchmark using AWS Security Hub or any compatible tool
- Complete the FTR validation checklist (self-assessment), scoped to all accounts and Regions that process customer data
- Upload the security report and self-assessment in Partner Central; the automated review returns results in minutes
- If you cannot provide a CIS report, submit the self-assessment alone — this triggers a live review call with an AWS Partner Solutions Architect (AWS FTR Guide, 2025)
- Submit a SOC 2 Type II report from an accredited auditor covering your AWS-hosted workload
- Or submit an AWS-led WAFR completed in the last 12 months with zero high-risk issues in Security, Operational Excellence, and Reliability
- Complete a short self-assessment affirming compliance with the remaining required controls
- Fewer duplicative controls; the WAFR waiver sets your renewal 36 months out (AWS Partner Central, 2025)
The path from zero to Validated
Sequenced correctly, the FTR is a linear checklist. The order matters because Partner Central runs its prerequisite checks in sequence — later checks stay blocked until earlier ones pass (AWS Partner Central, 2025).
Register with the AWS Partner Network and join the Software Partner Path, then prepare your Partner Central profile and solution listing (AWS Partner Central, 2025).
Work the FTR validation checklist across architecture, security controls, data handling, and operational processes — for every AWS account and Region where you process customer data.
Evaluate your accounts against the CIS AWS Foundations Benchmark using AWS Security Hub or an equivalent tool, and remediate the high-risk findings before you submit.
In Build → Solutions, select the solution, choose Request Validation, and attach the FTR checklist and security-tool report. The request button stays disabled until your uploads are complete (AWS Partner Central, 2025).
Each submission is reviewed automatically and returns results within minutes. If issues are flagged, address them and resubmit as many times as needed; a Partner Solutions Architect handles the live-review path for edge cases (AWS Partner Central, 2025).
On approval you earn the badge and program eligibility, and set a review cadence so your next renewal (three years out) is a refresh, not a rebuild (AWS, 2025).
Consider a hypothetical composite to make the sequencing concrete — a 30-person data-tooling ISV, AWS-hosted SaaS, applying for ISV Accelerate for the first time. The mistake that would cost them a fortnight is submitting the checklist against their production account as-is, then cycling through remediation as each high-risk issue is flagged. The order that works: run the workload through the AWS Well-Architected Tool, clear the high-risk issues in Security, Operational Excellence, and Reliability, generate the CIS Benchmark report, and only then request validation — so the automated review comes back clean the first time. (This example is illustrative, not a specific Automatum customer.)
- Decide your path first — standard (CIS Benchmark) or waiver (SOC 2 Type II / AWS-led WAFR)
- Run the workload through the AWS Well-Architected Tool and clear high-risk issues in Security, Reliability, and Operational Excellence
- Remove root-account daily use, enforce MFA on privileged accounts, and apply least-privilege IAM
- Confirm reliability posture — backups, recovery, and multi-AZ where the workload warrants it
- Produce runbooks, monitoring coverage, and automated deployments — evidence, not intent
- Scope the security report and self-assessment to every account and Region that processes customer data
- Submit in Partner Central, read the automated feedback, remediate, and resubmit until Validated
The FTR clears your architecture. Automatum clears the path to revenue.
Passing the FTR proves your product is production-ready; it does not build the listing, pricing, metering, and disbursement that turn AWS approval into marketplace revenue. Automatum runs that operational layer for ISVs across AWS, Azure, and GCP — see how it fits on the platform overview, or gauge where you stand with the marketplace readiness assessment.
See Automatum in Action →Frequently Asked Questions
Common questions about the AWS Foundational Technical Review for ISVs.
Is the FTR required to list on AWS Marketplace?
No. AWS is explicit that an FTR is not required to list a partner solution in AWS Marketplace. However, it is a prerequisite for the full set of partner benefits — ISV Accelerate co-sell, funding, the AWS Partner Solutions Finder listing, the “Reviewed by AWS” badge, and other APN programs such as AWS Competency and AWS Service Ready (AWS FTR Guide, 2025).
What does the FTR actually evaluate?
A subset of the AWS Well-Architected Framework focused on three pillars: security, reliability, and operational excellence. You evidence it with a completed validation checklist plus an automated security report (typically against the CIS AWS Foundations Benchmark), scoped to every AWS account and Region where you process customer data. It reviews what is actually deployed, not a description of intended architecture (AWS FTR Guide, 2025).
How long does the FTR take now?
Faster than it used to. Since 2025 the process uses Amazon Bedrock to accelerate reviews, and in AWS Partner Central each submission is reviewed automatically and returns results within minutes. A complete, compliant submission can clear in a single sitting; incomplete ones cycle through remediation and resubmission (AWS Partner Network, 2025; AWS Partner Central, 2025).
Can I skip the FTR if I already have SOC 2 or a Well-Architected Review?
Largely, yes. You can submit a SOC 2 Type II report to satisfy FTR requirements, or use an AWS-led Well-Architected Framework Review completed in the last 12 months with zero high-risk issues in Security, Operational Excellence, and Reliability to waive most of the FTR via a short self-assessment. The WAFR waiver sets your renewal date 36 months out (AWS Partner Central, 2025).
From technical review to live listing
The FTR is one gate. Here is where it sits in the wider AWS Marketplace path.
