Licensing

Search for AWS runs out of the box with no license key on a free tier for one person. A paid license is priced per user: it covers your team and unlocks the multi-account and multi-user features.

Free tier

With no license key configured, the app provides:

• One user.
• One registered account, with static keys or, on a self-managed EC2 search head, the instance role.
• A single, standalone search head.
• The shared credential model: every search uses the account’s credential.

The first person to run a search becomes the free tier’s user; an administrator can set or change the user on the License tab. The free tier never expires. It is enough to evaluate the app and to run it for one person, one account and one search head.

Paid

A paid license unlocks:

• Every user holding run_aws_search, up to the number of users in your license.
• Any number of accounts.
• Search head clustering - running the app across SHC members.
• Cross-account assume-role credentials (see Accounts).
• Per-user credentials (see Access control).

Licensed users

A license covers a number of users: the Splunk users holding the run_aws_search capability, directly or through a role that imports a role holding it - the app’s aws_search_user and aws_search_admin roles both do. The app counts the users Splunk lists under Settings - Users, LDAP and SAML users it knows included. Splunk administrators - users holding admin_all_objects, such as admin, or sc_admin on Splunk Cloud - can run every search without the capability and are not counted, and neither is splunk-system-user, which runs scheduled searches owned by nobody.

Licenses are sold per user per year; see Pricing.

The health check counts the users every 5 minutes on each search head, and the License tab shows the users your license covers beside the users holding run_aws_search. Going over is never an outage: searches keep running for everyone while the License tab and a bulletin message name both numbers until you extend the license or take the capability from users who no longer need it.

What happens at the limits

Enforcement is designed to be predictable and never to lose your configuration:

• More users than your license covers is a warning, never a refusal - see Licensed users.
• A second user on the free tier is refused when they run a search, with a message naming the free tier’s user. The License tab shows who it is.
• Registering a second account on the free tier is refused with a clear message, and the Add account button says why. The account you already have keeps working. A paid license has no account limit.
• Choosing assume role for an account on the free tier is refused the same way.
• Running in a search head cluster without a paid license blocks the search commands with a message naming the reason; your registrations stay stored.
• An expired paid license keeps working through a 14-day grace period, with a warning on the License tab. After grace, the search commands stop with a message asking you to renew; nothing is deleted, and everything resumes the moment a valid key is entered.
• An invalid or mistyped key counts as no key: the app warns and runs as the free tier until you replace it.
• Falling back to the free tier with a paid setup still in place - a removed key, or a mistyped one - does not grandfather that setup. While more accounts are registered than the tier allows, every search stops with a message that names both numbers; an account that uses assume role is refused on its own, and the others keep working. Remove the extra accounts or switch the credential on the Setup page, or enter a valid key. Nothing is deleted for you.
• The bell says so. Roles holding edit_aws_search_accounts or admin_all_objects see a Splunk bulletin message while the key is invalid, expires within 30 days, is in its grace period, or has run past it, another while the free tier runs in a search head cluster or more accounts are registered than it allows, and a warning while more users hold run_aws_search than the license covers. Each links to the Setup tab that fixes it and clears once the problem ends; see Troubleshooting.

Enter a license key

Open the Setup page and go to License. Press Add license, paste the key, and save. Line breaks and spaces an email client wrapped into the key are dropped on save. The tab then shows the current status: the license id, the users it covers beside the users holding run_aws_search and when they were counted, the installations it allows, and the expiration date. On the free tier it shows the free tier’s user, with Set free-tier user or Change free-tier user to pick another. A key you enter or remove applies from the very next search; a key that expires is noticed within 30 seconds.

To clear a license and return to the free tier, press Remove license. The key is stored in aws_search.conf, is readable only by full Splunk administrators, and is never displayed again after saving. In a search head cluster it replicates to every member; the cluster counts as one installation.

Evaluate

To try the paid features - your whole team, more accounts, search head clustering, per-user credentials, and cross-account assume-role - contact sales@outcoldsolutions.com to request an evaluation license. The key arrives by email; paste it into the License tab as above.