Deploying via AWS Marketplace

This guide covers the end-to-end flow for customers who purchase Surface Security through the AWS Marketplace.

How It Works

Surface Security is listed on AWS Marketplace as a BYOL (Bring Your Own License) product with contract-based pricing. When you subscribe, the following happens:

1. You subscribe to Surface Security on the AWS Marketplace listing
2. You accept the pricing terms and EULA
3. AWS redirects you to the Surface Security portal
4. The portal validates your AWS subscription and generates a license key
5. You deploy Surface Security in your own AWS environment using the license key

Your license key is tied to your AWS Marketplace subscription. Tier changes, renewals, and cancellations are all managed through the AWS Marketplace console, and the portal automatically updates your license accordingly.

Step 1: Subscribe on AWS Marketplace

1. Navigate to the Surface Security listing on AWS Marketplace
2. Review the available pricing tiers:

Tier	Max Endpoints	Description
Starter	25	Small teams, evaluation
Team	100	Growing organizations
Business	500	Mid-size deployments
Enterprise	5,000	Large-scale enterprise

3. Select your desired tier and accept the End User License Agreement (EULA)
4. Complete the subscription through the AWS Marketplace checkout

Step 2: Receive Your License Key

After subscribing, AWS redirects you to the Surface Security portal:

1. The portal automatically validates your AWS Marketplace subscription
2. A license key is generated based on your purchased tier and entitlements
3. The license key is displayed on-screen -- copy it and store it securely
4. A copy is also sent to the email address associated with your AWS account

The license key is an Ed25519-signed token that encodes your tier, maximum endpoint count, and expiration date. It is verified offline by the deployed product -- no network connectivity to the portal is required after initial setup.

Step 3: Deploy to AWS (Recommended -- One-Click)

After receiving your license key, the portal status page displays a "Deploy to AWS" button:

1. Select your preferred AWS region from the dropdown
2. Click "Deploy to AWS" -- this opens the AWS CloudFormation console in your AWS account
3. Review the pre-filled parameters:
   • License Key -- automatically filled from your subscription
   • Deployment Tier -- matches your purchased tier
   • Domain -- enter the domain name where you want to access Surface Security (e.g., security.yourcompany.com)
   • Admin Email -- automatically filled from your AWS account email
4. Acknowledge the IAM capabilities checkbox (the template creates IAM roles for the deployment)
5. Click "Create Stack"

The deployment takes approximately 25-35 minutes. You can monitor progress in the CloudFormation console under the "Events" tab.

Once the stack status shows CREATE_COMPLETE:

1. Navigate to https://your-configured-domain
2. Complete the setup wizard (your license key is pre-populated)
3. Create your admin account
4. Follow the onboarding steps (TLS certificate, CA configuration, etc.)

What Gets Created

The CloudFormation stack creates the following resources in your AWS account:

Resource	Description
VPC	Isolated network with public and private subnets across 3 availability zones
EKS Cluster	Managed Kubernetes cluster sized to your tier
RDS PostgreSQL	Managed database with encryption at rest and automated backups
S3 Bucket	Object storage for backups and screenshots
Secrets Manager	Secure storage for all application secrets
IAM Roles	Least-privilege roles for each component

Updates

• Security patches and minor updates are applied automatically with zero downtime
• Major version updates are applied by updating your CloudFormation stack (you will receive an email notification when a major update is available)

Step 3 (Alternative): Manual Deployment

If you prefer to manage your own infrastructure, you can deploy Surface Security manually using one of these guides:

• AWS EKS Deployment -- Recommended for production Kubernetes deployments
• Kubernetes Deployment -- Generic Kubernetes guide (works on EKS, self-managed, or other providers)
• Docker Compose Deployment -- Single-node deployments for small teams (Starter or Team)

During the setup wizard, select the Enter License Key tab and paste your license key. Alternatively, provide it via Helm values:

# values-override.yaml
api:
  env:
    SURFACE_LICENSE_KEY: "eyJhbGciOiJFZDI1NTE5Ii..."

Or as a Kubernetes secret:

kubectl create secret generic surfacesec-license \
  --namespace surfacesec \
  --from-literal=license-key="eyJhbGciOiJFZDI1NTE5Ii..."

Managing Your Subscription

Viewing Subscription Status

Your current license tier and expiration are visible in the Surface Security admin dashboard under Settings > License.

You can also check your subscription status in the AWS Marketplace console.

Upgrading or Downgrading Tiers

1. Go to the AWS Marketplace console
2. Find your Surface Security subscription
3. Modify the contract to select a new tier
4. The Surface Security portal receives the change notification automatically
5. A new license key reflecting your updated tier is generated
6. Update the license key in your deployment (via the admin dashboard or Helm values)

Renewal

Contract renewals are handled through AWS Marketplace. Before your contract expires:

1. AWS sends renewal notifications to your account email
2. If auto-renewal is configured, the subscription renews automatically
3. The portal issues an updated license key with the new expiration date
4. Update the license key in your deployment

License keys include a 7-day grace period after expiration. During the grace period, the product continues to function but displays a warning in the admin dashboard. After the grace period, the product enters read-only mode until a valid license is applied.

Cancellation

1. Cancel your subscription through the AWS Marketplace console
2. Your license remains active until the end of the current billing period
3. After the billing period ends, the license key is revoked
4. Export any data you need before the license expires

Troubleshooting

I did not receive a license key after subscribing

• Check the email associated with your AWS account (including spam/junk folders)
• Verify your subscription is active in the AWS Marketplace console
• Try navigating to the Surface Security portal fulfillment URL again from the AWS Marketplace subscription page (click "Set up your account")
• Contact support@surface-security.com with your AWS account ID

My license key is not accepted

• Ensure you copied the entire license key (it starts with eyJ and is typically 500-800 characters)
• Check that there are no extra whitespace or newline characters
• Verify the license has not expired by decoding it in the admin dashboard

My tier does not match what I purchased

• Allow up to 15 minutes for entitlement changes to propagate
• Check that your contract modification completed in the AWS Marketplace console
• If the issue persists, contact support@surface-security.com

I need to move my deployment to a different cluster

License keys are not bound to a specific cluster or instance. You can use the same license key across multiple environments (e.g., staging and production) as long as the total monitored endpoint count stays within your tier limit.

Cost Overview

With the AWS Marketplace BYOL model, your costs consist of:

1. Surface Security license -- Billed through your AWS bill based on your selected tier
2. AWS infrastructure -- EKS cluster, RDS, EC2 instances, networking, storage (see cost estimates in the EKS guide)

The infrastructure cost depends on your deployment size. See the Hardware Sizing Guide for detailed breakdowns by tier.