ECZ-ID Service & Workload Passport AWS Marketplace Getting Started and Technical Guide

• CUSTOMER OUTCOME

  A working Service & Workload Passport linked to the relevant account/Parent and available for public Resolver verification.

• NOT THE OUTCOME

  A new AWS identity authority or a duplicate Service/workload identity for every subscription.

• WHAT SUBSCRIBE DOES

  Creates the AWS Marketplace acquisition/subscription relationship for the free Service & Workload Passport listing.

• WHAT IT DOES NOT DO

  It does not by itself issue the Passport or turn AWS account identity into the canonical Service/workload identity.

• USE INTENDED AWS ACCOUNT

  Subscribe from the AWS account intended for this acquisition context.

• NO FREE TRIAL

  The product is already free.

• NO PRIVATE OFFER REQUIRED

  This free Passport does not require a private offer.

• CONTINUE

  Choose Set up your account after subscription.

• REGISTRATION TOKEN

  A sensitive, short-lived acquisition handoff used by the AWS Marketplace integration.

• CUSTOMER SECRET?

  No. Do not provider, share, paste into tickets, screenshots or documentation.

FULFILLMENT

https://trustops.ecocitizenz.com/aws/marketplace/fulfill

• BROWSER REDIRECT

  The user is redirected into the supported ECZ-ID acquisition path.

• DO NOT COPY TOKEN

  Let the integration process the registration token.

• EXISTING CUSTOMER

  Use the supported sign-in/reuse path when you already have an account.

• FAILURE

  Record the visible error and time - never the token.

• AWS-NATIVE ADAPTER

  Uses the appropriate Marketplace integration to resolve the AWS customer/acquisition context.

• TRUSTOPS

  Owns acquisition, entitlement/activation and lifecycle handoff - not canonical identity truth.

• ON SUCCESS

  Continue into supported account or Parent reuse or creation and Service & Workload Passport issue or reuse.

• ON FAILURE

  Do not repeatedly retry by creating new accounts or workload identities as a workaround.

• REUSE WHEN APPROPRIATE

  Existing supported account/Parent context should be preferred where it represents the same customer/organisation.

• CREATE WHEN REQUIRED

  A new supported account/Parent may be created only when the canonical acquisition flow genuinely requires one.

• SAME ORGANISATION

  Reuse supported organisation/Parent context.

• SAME WORKLOAD OBJECT

  Issue or reuse the canonical Service & Workload Passport according to supported mapping.

• DIFFERENT OBJECT

  Use a distinct Passport only when the service/workload/runtime object boundary genuinely differs.

• RECOVERY PROBLEM

  Recover access first; do not mint replacements to bypass sign-in issues.

• FAMILY MAPPING

  ProductCode → Service & Workload Passport family.

• IDENTITY RESULT

  Issue a new Service & Workload Passport where the object legitimately needs one, or reuse the canonical Passport where the intended service/workload identity already exists.

• OBJECT

  Service / workload / runtime identity.

• PARENT

  Relevant organisation/Parent where applicable.

• DASHBOARD

  Authenticated customer control after activation.

• RESOLVER

  Public, independent proof re-check after issuance/reuse.

• DASHBOARD IS

  Authenticated customer control: view/manage permitted Passport, binding, evidence and lifecycle actions.

• DASHBOARD IS NOT

  The public Resolver and not the canonical Core itself.

• CHECK IDENTITY

  Confirm the Service & Workload ECZ-ID / family.

• CHECK RELATIONSHIP

  Confirm organisation/Parent context.

• CHECK CURRENT STATE

  Confirm published lifecycle/runtime/environment context where supported.

• CONTINUE

  Open Resolver and independently re-check the same ECZ-ID.

• If absent, stale or mismatched:

  challenge, deny, pin or re-resolve

• If required proof is present and fresh:

  evaluate local workload/runtime policy and proceed

MACHINE ROUTE

GET https://api.ecocitizenz.com/api/p/{ecz_id}.json

• VERIFY

  Family/object · organisation/Parent · state · provider/runtime/deployment/service bindings · evidence where present.

• DO NOT INFER

  Runtime or image integrity, vulnerability-free or correctly configured status, deployment approval, workload authentication or execution authority unless separately established.

• SUBSCRIBE UNAVAILABLE

  Confirm you can see the Limited/Public listing and are using the intended AWS account.

• SET UP ACCOUNT FAILS

  Record visible error/time; never expose the registration token.

• RESOLVECUSTOMER FAILS

  Contact support with AWS context and failed stage.

• WRONG/DUPLICATE IDENTITY

  Stop; recover or reuse the canonical account/Parent/Passport where supported.

• RESOLVER MISSING

  Confirm acquisition/issuance completed and the ECZ-ID is correct.

• WORKLOAD RUNTIME / POLICY ISSUE

  Diagnose provider/runtime access, workload authentication, IAM/authorization, vulnerability/configuration or runtime/orchestration problems separately.

• SUBSCRIPTION

  AWS Marketplace subscription is active at $0.

• ACCOUNT

  Supported EcoCitizenz account/Parent was reused or created as appropriate.

• FAMILY MAPPING

  ProductCode mapped to Service & Workload Passport.

• PASSPORT

  The intended Service & Workload Passport was issued or reused without duplicate identity.

• DASHBOARD

  The Passport is visible under the correct customer context.

• RESOLVER

  The same ECZ-ID resolves publicly and can be re-checked.