ECZ-ID · Reciprocal Trust Infrastructure for the Machine Economy
ECZ-ID IoT Passport AWS Marketplace Getting Started and Technical Guide
From a $0 AWS Marketplace subscription to a working IoT Passport, Dashboard control and Resolver proof.
Release 2026.10 · 16 October 2026
IoT Passport documents
In this document
- From AWS Marketplace to canonical IoT identity
- The Passport is permanently free
- Continue into the ECZ-ID fulfillment path
- Turn provider acquisition into supported ECZ-ID activation
- Avoid duplicate identity
- Map the acquisition to the IoT family
- Operate the estate in the authenticated control plane
- Prove the acquisition produced the intended public identity
- Diagnose the failed stage - do not create duplicates as a workaround
- You are done when these conditions are true
About this document
- Primary reader
- AWS subscriber, cloud administrator, IoT administrator, developer.
- Secondary reader
- Security architect, platform engineer, procurement and support teams.
- When to read this
- You have found or subscribed to the IoT Passport listing and want to activate it correctly.
- Release
- 2026.10 · 16 October 2026
- What you will know after reading
- You can move from Subscribe to Set up your account, TrustOps activation, Passport issue or reuse, Dashboard and Resolver verification.
- What this document does not establish
- AWS acquisition does not become the ECZ-ID authority root; the registration token is not a customer credential to retain or share.
NextAfter activation, read the Technical Reference for integration and proof semantics.
JOURNEY OVERVIEW
From AWS Marketplace to canonical IoT identity
The acquisition path is deliberately separate from the canonical identity/proof system.
AWS MARKETPLACE ACQUISITION
Activate an IoT Passport through AWS Marketplace
Provider acquisition is separated from canonical ECZ-ID identity, control and proof.
AWS Marketplace
provider acquisition layer
- then
ECZ-ID canonical system
acquisition → activation → control → proof
Step 1: Subscribe at $0
IoT Passport permanently free
Step 2: Set up your account
continue to ECZ-ID
Step 3: Registration token
sensitive handoff never share
Step 4: AWS-native adapter
ResolveCustomer AWS customer
Step 5: TrustOps
acquisition + activation
Step 6: Account + Parent
reuse where appropriate
Step 7: ProductCode mapping
maps to IoT family
Step 8: Issue / reuse IoT Passport
canonical identity
Dashboard
authenticated control
Resolver
public read-only proof
OUTCOME You finish with an issued or reused canonical IoT Passport, customer Dashboard access and a public Resolver record that can be independently re-checked.
AWS ROLE
Acquisition/provider context and registration-token handoff.
ECZ-ID ROLE
Canonical identity, activation, customer control and read-only proof.
1. FIND AND SUBSCRIBE
The Passport is permanently free
Open the ECZ-ID IoT Passport listing and choose Subscribe at $0. This is not a time-limited Free Trial.
WHAT SUBSCRIBE DOES
Creates the AWS Marketplace subscription/agreement context needed for the ECZ-ID fulfillment path.
WHAT IT DOES NOT DO
It does not make AWS the canonical identity store, and it does not by itself issue a new device identity every time.
PRICING There is no ECZ-ID software charge for the free IoT Passport.
EXISTING CUSTOMER
Continue through Set up your account so the supported existing-account/Parent path can be reused where appropriate.
NEW CUSTOMER
TrustOps can follow the canonical supported account/Parent acquisition flow.
2. SET UP YOUR ACCOUNT
Continue into the ECZ-ID fulfillment path
After subscription, AWS exposes Set up your account. Use that path rather than manually creating duplicate identities elsewhere.
EXPECTED HANDOFF
AWS passes a Marketplace registration token to the configured ECZ-ID fulfillment endpoint.
SENSITIVE INPUT
The registration token is operational input. Do not paste it into tickets, screenshots, chat or documentation.
FULFILLMENT ENDPOINT
https://trustops.ecocitizenz.com/aws/marketplace/fulfillIF SETUP FAILS
Record the visible error and time, but do not expose the token.
IF IT SUCCEEDS
The AWS-native adapter resolves the Marketplace customer and hands acquisition into TrustOps.
3. RESOLVECUSTOMER AND TRUSTOPS
Turn provider acquisition into supported ECZ-ID activation
The AWS-native adapter resolves the Marketplace customer; TrustOps orchestrates account/Parent reuse or creation and Passport issue or reuse.
AWS MARKETPLACE ACQUISITION
Activate an IoT Passport through AWS Marketplace
Provider acquisition is separated from canonical ECZ-ID identity, control and proof.
AWS Marketplace
provider acquisition layer
- then
ECZ-ID canonical system
acquisition → activation → control → proof
Step 1: Subscribe at $0
IoT Passport permanently free
Step 2: Set up your account
continue to ECZ-ID
Step 3: Registration token
sensitive handoff never share
Step 4: AWS-native adapter
ResolveCustomer AWS customer
Step 5: TrustOps
acquisition + activation
Step 6: Account + Parent
reuse where appropriate
Step 7: ProductCode mapping
maps to IoT family
Step 8: Issue / reuse IoT Passport
canonical identity
Dashboard
authenticated control
Resolver
public read-only proof
RESOLVECUSTOMER
Resolves the AWS Marketplace customer context through the provider integration.
TRUSTOPS
Applies acquisition/activation logic and hands off into the canonical ECZ-ID lifecycle.
BOUNDARY Provider-native customer/device identifiers can become bindings/context. They do not replace ECZ-ID as the canonical identity authority.
4. ACCOUNT AND PARENT REUSE
Avoid duplicate identity
If the buyer already has the relevant EcoCitizenz account or Parent relationship, the intended architecture reuses it rather than creating a duplicate.
REUSE WHEN APPROPRIATE
Use the supported existing-account path and existing Parent where the intended organisation relationship already exists.
CREATE ONLY WHEN REQUIRED
A new account or Parent is created only through the canonical supported acquisition flow when genuinely needed.
DUPLICATE PREVENTION Do not treat a new AWS subscription, sign-in problem, provider migration or fleet change as automatic evidence that a new Parent or Passport is required.
CUSTOMER BENEFIT
One coherent estate instead of fragmented identities per channel.
OPERATIONAL BENEFIT
Device bindings can change while the canonical ECZ-ID remains stable where appropriate.
5. PRODUCTCODE MAPPING AND PASSPORT ISSUE OR REUSE
Map the acquisition to the IoT family
The AWS ProductCode identifies the intended Passport family for the shared fulfillment factory.
FAMILY MAPPING
The ProductCode maps acquisition to the IoT Passport family; it is not the device identity itself.
ISSUE OR REUSE
TrustOps issues a new IoT Passport when the object legitimately needs one or reuses the canonical Passport when the intended identity already exists.
TARGET OUTCOME One canonical device identity for the intended object - not a fresh Passport for every subscription click or provider context.
SAME DEVICE/OBJECT
Reuse identity; update supported context.
DIFFERENT LEGITIMATE OBJECT
Issue a distinct Passport where the identity boundary genuinely differs.
6. DASHBOARD HANDOFF
Operate the estate in the authenticated control plane
After acquisition and activation, the customer is handed into the EcoCitizenz Dashboard for permitted estate actions.
DASHBOARD IS FOR CONTROL
View/manage permitted Passport, identity, lifecycle, evidence, binding and sharing actions according to the current implementation.
RESOLVER IS FOR PROOF
Resolver is public and read-only. It is not the place to mutate canonical identity.
FIRST DASHBOARD CHECK Confirm the intended IoT Passport exists under the correct organisation/Parent and is not a duplicate created by the acquisition journey.
THEN INSPECT
Current state, relevant bindings/relationships and evidence where present.
THEN VERIFY PUBLICLY
Open Resolver and confirm the same ECZ-ID is independently re-checkable.
7. FIRST RESOLVER VERIFICATION
Prove the acquisition produced the intended public identity
After activation, independently re-check the IoT Passport through Resolver.
RESOLVER RE-CHECK
Turn a presented device ECZ-ID into a bounded decision input
Resolve the current public record, inspect only what is present, and fail safely when required proof is missing.
Consumer
receives or discovers a device ECZ-ID
- then
ECZ-ID Resolver
public · read-only · re-checkable GET /api/p/{ecz_id}.json
Identity + family
Is this the device/object expected?
Responsibility
Who claims responsibility or operation?
Bindings
Fleet / network / service refs
State
Lifecycle / assignment / software context
Evidence
What source, scope and freshness?
Assurance boundary
What is actually supported for this decision?
If required proof is present and fresh → evaluate policy / proceed
If absent, stale or mismatched → challenge, deny, isolate or re-resolve
HUMAN VERIFICATION
Confirm IoT family/object, Parent/organisation context, current published state, relevant bindings and evidence where present.
MACHINE VERIFICATION
GET https://api.ecocitizenz.com/api/p/{ecz_id}.json and fail safely when required proof is absent.
DO NOT OVER-INFER A successful resolution does not prove hardware attestation, safety, firmware integrity or permission to control the device.
TROUBLESHOOTING
Diagnose the failed stage - do not create duplicates as a workaround
Keep acquisition, account access, Passport issue or reuse, Dashboard and Resolver failures separate.
SUBSCRIBE UNAVAILABLE
Confirm the AWS account can see the Limited product during testing or that the listing is Public.
SET UP ACCOUNT FAILS
Record visible error/time; never expose the registration token.
RESOLVECUSTOMER FAILS
Capture AWS account context and failed stage for support.
ACCOUNT/PARENT MISMATCH
Use supported existing-account/recovery path rather than creating a duplicate.
PASSPORT MISSING
Confirm acquisition completed and distinguish issuance/reuse failure from wrong identifier.
RESOLVER MISMATCH
Confirm ECZ-ID, state and bindings; treat missing proof as missing, not implied.
SUPPORT support@ecocitizenz.com — send bounded context only; never credentials, API keys, tokens, certificates or private keys.
60-SECOND COMPLETION CHECK
You are done when these conditions are true
Use this as the final acquisition acceptance check.
SUBSCRIPTION
AWS Marketplace subscription is active at $0.
ACCOUNT
Correct EcoCitizenz account / Parent is reused or created.
PASSPORT
Canonical IoT Passport is issued or reused - no unintended duplicate.
DASHBOARD
Customer can see the intended Passport in the authenticated control plane.
RESOLVER
The same ECZ-ID resolves publicly with the expected family/object and current context.
SECRETS
No registration token or credential has been copied into tickets, logs or documentation.
NEXT Continue to the IoT Passport Technical Reference for device-object semantics, bindings, machine verification and integration patterns.
Download and support
This page is the HTML edition of ECZ-ID IoT Passport - AWS Marketplace Getting Started and Technical Guide, release 2026.10. The PDF is the designed offline copy.
Permanent route: https://developers.ecocitizenz.com/passports/iot/aws-getting-started/