ECZ-ID · Reciprocal Trust Infrastructure for the Machine Economy
ECZ-ID AWS Marketplace Acquisition and Activation Guide
The shared path from a $0 AWS Marketplace Passport subscription to the correct ECZ-ID account, Parent, Passport, Dashboard and Resolver proof.
Release 2026.10 · 16 October 2026
Shared Foundation documents
In this document
- Why the Passport listing is free
- Subscribe and Set up your account are acquisition steps
- The AWS registration token is sensitive operational input
- ResolveCustomer and TrustOps reconcile acquisition to canonical identity
- ProductCode maps the subscription to the correct Passport family
- Dashboard is control; Resolver is proof
- Concurrent Agreements must not create duplicate identity
- Troubleshooting AWS activation
- Shared AWS activation checklist
About this document
- Primary reader
- AWS Marketplace buyer, AWS cloud administrator, procurement and technical administrator
- Secondary reader
- Security teams, platform engineers, support and customer administrators
- When to read this
- You found an ECZ-ID Passport on AWS Marketplace and want to understand what Subscribe and Set up your account do before the Passport becomes usable.
- Release
- 2026.10 · 16 October 2026
- What you will know after reading
- You understand the shared AWS acquisition path, identity reuse, ProductCode family mapping, Dashboard/Resolver handoff, Concurrent Agreements handling and secret safety.
- What this document does not establish
- AWS subscription/account identity does not become the ECZ-ID canonical identity, grant blanket authority, or justify duplicate Passports merely because multiple agreements exist.
AWS ACQUISITION IN ONE VIEW
Why the Passport listing is free
The seven Passport identity primitives are permanently free. AWS Marketplace is an acquisition/provider surface that hands the buyer into ECZ-ID activation.
What you subscribe to
The relevant free Passport listing for Agent, MCP, API, IoT, SDK, Plugin or Service & Workload. There is no ECZ-ID software charge for the Passport itself.
What AWS is doing
AWS supplies marketplace acquisition context and the registration handoff. The resulting ECZ-ID identity remains canonical inside ECZ-ID, not AWS.
Step 1: Subscribe at $0
Accept the free Marketplace listing.
Step 2: Set up your account
Continue from AWS to ECZ-ID.
Step 3: Resolve customer
The AWS-native adapter resolves the Marketplace customer.
Step 4: TrustOps activation
Reuse or create the supported account and Parent, map ProductCode, then issue or reuse the Passport.
Step 5: Dashboard + Resolver
Operate in Dashboard and independently re-check public proof in Resolver.
BUYER JOURNEY
Subscribe and Set up your account are acquisition steps
The AWS experience should move a buyer from discovery to the correct ECZ-ID activation path without making AWS the identity authority.
Subscribe at $0
Confirms the Marketplace subscription to the permanently free Passport listing.
Set up your account
Starts the ECZ-ID account/activation handoff. Do not close the journey before the supported registration path completes.
No paid-trial semantics
The Passport is not a time-limited Free Trial. The identity primitive remains free.
Family-specific detail: after this shared path, use the Passport family’s own AWS Getting Started and Technical Guide for the object-specific first verification and troubleshooting steps.
REGISTRATION TOKEN
The AWS registration token is sensitive operational input
AWS passes a Marketplace registration token to the ECZ-ID fulfilment path so the customer can be resolved and acquisition can continue.
Fulfilment endpoint
https://trustops.ecocitizenz.com/aws/marketplace/fulfillThe AWS-native adapter uses the appropriate Marketplace integration to resolve the customer and hand acquisition into TrustOps.
Secret handling
- Do not copy the registration token into tickets.
- Do not include it in screenshots, chat logs or public documentation.
- Do not expose credentials or certificates while troubleshooting.
CANONICAL ACQUISITION
ResolveCustomer and TrustOps reconcile acquisition to canonical identity
The target outcome is the correct existing or new supported identity - not a duplicate created for every marketplace action.
ResolveCustomer
Establish the AWS Marketplace customer context used for the acquisition flow.
Existing account / Parent
Reuse the supported EcoCitizenz account and Parent where the intended canonical relationship already exists.
New account / Parent
Create only when a legitimate supported identity relationship does not already exist.
Duplicate prevention: an AWS subscription, sign-in problem or provider change is not, by itself, a reason to mint another Parent or Passport.
FAMILY MAPPING
ProductCode maps the subscription to the correct Passport family
The AWS ProductCode is acquisition metadata used to determine which Passport family should be issued or reused.
Family mapping
Agent, MCP, API, IoT, SDK, Plugin or Service & Workload is selected from the configured ProductCode → family mapping.
Issue or reuse
TrustOps should issue a new Passport when the legitimate object needs one, or reuse the canonical Passport where that identity already exists.
One canonical identity - not a new Passport for every subscription click.
HANDOFF
Dashboard is control; Resolver is proof
Successful acquisition should end with a usable customer control path and independently re-checkable public proof.
Dashboard
- Authenticated customer control plane
- Locate the acquired Passport
- Perform permitted estate actions
- Use account/organisation controls
Resolver
- Public, read-only proof
- Confirm the ECZ-ID / Passport family
- Inspect current bounded context
- Re-check later when freshness matters
Machine-readable Resolver route:
GET https://api.ecocitizenz.com/api/p/{ecz_id}.jsonMULTIPLE AWS AGREEMENTS
Concurrent Agreements must not create duplicate identity
A buyer may encounter more than one AWS Marketplace agreement or subscription context. Agreement multiplicity is not the same thing as identity multiplicity.
What may vary
Agreement/subscription context, AWS account context and acquisition events can differ.
What should remain canonical
The supported EcoCitizenz account/Parent and Passport should be reconciled to the legitimate existing identity where appropriate.
Do not: automatically mint another Parent or Passport merely because another AWS agreement exists.
FAILURE HANDLING
Troubleshooting AWS activation
Identify the failed stage, preserve secrets, and avoid “fixing” account problems by creating duplicate identity.
| Symptom | First safe action |
|---|---|
| Subscribe unavailable | Confirm the AWS account can see the listing (Limited during testing or Public after launch) and that Marketplace access is available. |
| Set up your account fails | Record the visible error/time. Do not expose the registration token. |
| ResolveCustomer / acquisition fails | Contact support with AWS account context and the failed stage. Do not repeatedly create identities. |
| Existing EcoCitizenz customer | Use the supported existing-account path rather than intentionally creating a duplicate. |
| Passport missing in Resolver | Confirm acquisition completed, confirm the ECZ-ID, then distinguish issuance delay/failure from copied-identifier error. |
Download and support
This page is the HTML edition of AWS Marketplace Acquisition and Activation Guide, release 2026.10. The PDF is the designed offline copy.
Permanent route: https://developers.ecocitizenz.com/guides/aws-marketplace-activation/