Skip to content

fix(aws-marketplace): check the container license with CheckoutLicense so AWS's standard buyer policy works - #9981

Merged
waleedlatif1 merged 3 commits into
stagingfrom
fix/aws-marketplace-container-checkout
Nov 13, 2026
Merged

fix(aws-marketplace): check the container license with CheckoutLicense so AWS's standard buyer policy works#9981
waleedlatif1 merged 3 commits into
stagingfrom
fix/aws-marketplace-container-checkout

Conversation

@waleedlatif1

@waleedlatif1 waleedlatif1 commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • The Marketplace container license check called only ListReceivedLicenses. AWS's generated Helm/EKS launch steps for paid container products give the ServiceAccount the managed AWSLicenseManagerConsumptionPolicy, which doesn't allow that action, so a buyer following them got AccessDenied and Sim silently stayed on the open-source core.
  • The check now does a provisional CheckoutLicense of the enterprise_license entitlement and returns the unit at once with CheckInLicense, the integration AWS documents for contract-priced containers. Both actions are in the managed policy.
  • License Manager reports a unit held by another replica, or one a crashed replica never returned (it reclaims those after an hour), with the same NoEntitlementsAllowedException as a missing entitlement. Startup retries that answer with jitter. A running Enterprise deployment restarts without Enterprise only after it has held for longer than an unreturned unit can last (an hour plus one re-check), so contention can never switch Enterprise off. Re-checks are jittered so replicas don't meet on the unit.
  • Permission, throttling, network and server errors stay "unknown": community mode at startup with a log naming the two required actions, and never a restart for a running deployment.
  • The prerequisites CloudFormation role and the values file now grant and document license-manager:CheckoutLicense and license-manager:CheckInLicense instead of ListReceivedLicenses.

Type of Change

  • Bug fix

Testing

  • New container-license.test.ts (10 tests, the AWS SDK mocked at the client the way the other Marketplace tests do): active license turns Enterprise on and returns the unit; a failed check-in keeps the verdict; a busy unit at startup is retried; no unit at startup and a denied permission both run without Enterprise; a unit held for up to an hour keeps Enterprise on; no entitlement past the window restarts; a permission failure never restarts a running deployment; a license that becomes active restarts into Enterprise.
  • Red→green: removing the check-in, the startup retry, the confirmation window, the permission classification, or the check-in error handling each turns its test red.
  • bun run lint, check:test-patterns, check:comment-hygiene.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing (new tests pass the test-audit authoring gate)
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

@vercel

vercel Bot commented Nov 13, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs Ready Ready Preview Nov 13, 2026 5:18am UTC

Request Review

@greptile-apps

greptile-apps Bot commented Nov 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

RetriggerView in GreptileConfidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable new issues were established.

Summary

Replaces the container license lookup with CheckoutLicense using the enterprise_license entitlement and unit None.

  • Marketplace installs check the Enterprise license with a provisional checkout.

Diagram

 
%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Marketplace SKU configured?] -->|No| B[Leave flags unchanged]
  A -->|Yes| C[CheckoutLicense]
  C --> D[Set Enterprise flags before server starts]
  D --> E[Wait 15–17 minutes]
  E --> F[CheckoutLicense again]
  F -->|Unknown or unchanged| E
  F -->|License state changed| G[Restart after a random delay]
Loading

Reviews (3) · Last reviewed commit: "fix(aws-marketplace): check the containe..." · Reviewed by Greptile

greptile-apps[bot]
greptile-apps Bot reviewed Nov 13, 2026
View reviewed changes
Comment thread apps/sim/lib/billing/aws-marketplace/container-license.ts Resolved
Comment thread apps/sim/lib/billing/aws-marketplace/container-license.test.ts Resolved
Comment thread apps/sim/lib/billing/aws-marketplace/container-license.test.ts Resolved
cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Nov 13, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 4 files

Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic

Comment thread apps/sim/lib/billing/aws-marketplace/container-license.ts Resolved
Comment thread apps/sim/lib/billing/aws-marketplace/container-license.ts Resolved
@waleedlatif1

waleedlatif1 commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@waleedlatif1

waleedlatif1 commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Nov 13, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 5 files

Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic

Comment thread apps/sim/lib/billing/aws-marketplace/container-license.ts Resolved
Comment thread apps/sim/lib/billing/aws-marketplace/container-license.ts Resolved
@waleedlatif1
fix(aws-marketplace): check the container license with CheckoutLicens…
e5da163 
…e so AWS's standard buyer policy works

A buyer who follows AWS's generated launch steps gets the managed
AWSLicenseManagerConsumptionPolicy, which does not allow
ListReceivedLicenses, so the check failed and Sim stayed on the open-source
core. Check out a provisional unit of the entitlement and return it at once,
the integration AWS documents for contract-priced containers.

License Manager answers a unit held by another replica, or one a crashed
replica never returned, the same way as a missing entitlement. Startup retries
that answer, and a running Enterprise deployment only restarts without
Enterprise once it has held longer than an unreturned unit can last.
@waleedlatif1
fix(aws-marketplace): count only an unbroken run of no-entitlement an…
a0b6763 
…swers, assert the checkout request, bump the chart
@waleedlatif1
fix(aws-marketplace): check the container license as an uncounted tie…
e518dd0 
…r entitlement

AWS documents a contract that unlocks a tier of features, rather than metering
a quantity, as a provisional CheckoutLicense with unit None and no value. That
checkout is not counted against the contract, so replicas never compete for a
unit, and the check-in, startup retry, and one-hour confirmation window that
guarded against a held unit go away. A definite answer that differs from the
boot mode restarts; a failed check keeps the current mode.
@waleedlatif1
waleedlatif1 force-pushed the fix/aws-marketplace-container-checkout branch from 9e13682 to e518dd0 Compare November 13, 2026 05:12
@waleedlatif1

waleedlatif1 commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@waleedlatif1

waleedlatif1 commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Nov 13, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 5 files

Confidence score: 5/5

  • Automated review surfaced no issues in the provided summaries.
  • No files require special attention.

Turn on auto-fix | Re-trigger cubic

@waleedlatif1
waleedlatif1 merged commit 187e196 into staging Nov 13, 2026
87 checks passed
@waleedlatif1
waleedlatif1 deleted the fix/aws-marketplace-container-checkout branch November 13, 2026 05:20
@waleedlatif1 waleedlatif1 mentioned this pull request Nov 13, 2026
Merged

This branch was successfully deployed

1 active deployment
Preview — e518dd0d Deployed Nov 13, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
@cubic-dev-ai cubic-dev-ai[bot] cubic-dev-ai[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@waleedlatif1