Plans and Entitlements

What a plan controls

Three things, and it is worth being exact about which:

• Framework breadth. The free plan serves CIS v6.0. Trial, paid, and enterprise plans serve every framework compliance.tf publishes. This is enforced by the registry when it serves a request, not by the app when you author a posture.
• A daily registry request budget. Free, trial, and grace each get a per-day allowance; paid and enterprise have none.
• Team collaboration and organization-wide rules. Inviting a member, and changing the organization's operational-rules configuration or rules state, require a trial, paid, or enterprise plan. On the free plan those actions are refused with 403 and an upgrade message.

And what a plan does not control:

• Who may do what. Projects, environments, configs, snapshots, bindings, promotion, waivers, and registry tokens carry no plan check at all. They are governed by organization membership and named permissions — see access control.
• How many people are in your organization. Seat figures are reported, not enforced. Nothing refuses the next member.
• Whether an environment stays bound. A plan change never unbinds anything. It can, however, change whether the registry will serve what a binding resolves to; see below.

The tiers

Enterprise resolves exactly like paid for every entitlement check described on this page. What differs is the agreement, not the gate.

Prices, the published trial term, and what each commercial plan includes live on the pricing page — the figures belong there rather than here, so they cannot drift apart.

The trial

A trial is created for you when your account is created. There is no card to enter and no AWS account to connect; the Marketplace path exists for buying, not for evaluating.

It covers every framework, so the thing you are evaluating is the real product rather than a sample of it.

Three properties to plan around:

• One per account. Asking to start a trial again returns your existing status unchanged. There is no restart and no extension, and an account already recorded as expired is sent to upgrade instead.
• Expiry is a date, not a job. The end date is written when the trial starts, and every entitlement check compares it against the current time. No sweep has to run for a lapse to take effect.
• An invited account starts without one. If your first login came from an organization invitation, you are a member of somebody else's organization and your own trial is deferred rather than spent. It starts if you later leave every shared organization you belong to, or you can start it yourself once you are in none.

When the trial ends

Grace is a deliberate soft landing, not a second trial. Framework access is unchanged, the organization tools stay unlocked, and the only thing that tightens is the daily request budget.

When grace ends too, the account is on the free plan. What changes at that moment:

• The registry serves CIS v6.0 only. A request for another framework is refused with a 403 carrying the code FRAMEWORK_NOT_ENTITLED and a remediation hint.
• Enabling or disabling a control outside CIS v6.0 is refused, with the code CONTROL_NOT_ENTITLED.
• Inviting a member is refused, and so is writing organization rules or changing the rules state.

What does not change: every module stays available, your registry tokens keep working, your projects and bindings are untouched, and existing members stay members with the roles they had. Reading the organization's rules configuration is not plan-gated either.

Buying

Purchase is through AWS Marketplace, and only through AWS Marketplace. The procurement links are on the pricing page; subscription and invoicing sit inside the AWS agreement you already have, which is usually the point.

The sequence is worth understanding because it is not a checkout that returns instantly:

1. You subscribe on the Marketplace listing.
2. Marketplace redirects you back to compliance.tf with a short-lived registration token, and you confirm linking that AWS account to your compliance.tf login. This link is what attaches the purchase to the right account.
3. Marketplace notifies compliance.tf separately that the subscription is confirmed and that an entitlement is active. Those notifications arrive independently of each other and of your registration, in either order.
4. Once the entitlement is active, the account resolves as paid.

Because step 3 is event-driven, a purchase is not always paid the instant you finish clicking. Notifications that arrive before your account exists are parked and applied as soon as the link in step 2 is written, so ordering is tolerated rather than fatal.

Step 2 is the one worth preparing for. The resolved Marketplace identity is held for a short window only, and the registration token behind it can be resolved exactly once — so a link you leave sitting while you set up SSO or go and find a password cannot be picked up again afterwards. Have your login ready before you click through. If the session does expire, re-open the subscription from the AWS Marketplace console; AWS issues a fresh token each time, and that is the only supported recovery.

Manage or cancel the subscription in the AWS console rather than in compliance.tf. Be precise about what cancelling does: it stops the renewal, it does not cut access off at the moment you click. Entitlement follows the Marketplace entitlement, so access runs to the end of the term you paid for, and the account resolves back to the free plan when that entitlement expires.

The daily registry request budget

Free, trial, and grace accounts are metered per day. Two things spend that allowance faster than you would expect:

• Both the module download and the version listing count. A single terraform init therefore spends several requests, not one.
• The window is a UTC calendar day, not a rolling window from your first request.

Exceeding the budget returns 429 with a Retry-After header giving the seconds until the counter resets, plus the code RATE_LIMITED. Automation should honour the header rather than retrying immediately.

The figure itself is a deployment setting rather than a published number — ask us if you need to plan capacity against it. Paid and enterprise accounts are not metered.

Recognising a plan refusal

The last row matters when you are debugging: two different systems answer 403, and only one of them is about your plan.

Operating the plan gate

The rest of this page is the operator's half: the account-tier to organization-tier mapping, which surface reads which of the two, what an unknown or missing tier resolves to, where the stored copy of a plan can lag reality, and the places where a plan lapse changes more — or less — than people expect.

Related

• Organizations and members — membership, invitations, and what an organization owns
• Access control — roles and permissions, which are independent of plan
• Registry tokens — how a request is authenticated before it is entitled
• Promotion and gates — bindings, waivers, and the effective posture the registry checks against your plan