End User License Agreement
Contents
Important: This Agreement is supplemental to the AWS Marketplace Standard Contract for AWS Marketplace (SCMP) or any applicable AWS Private Offer contract. In the event of conflict, the AWS Marketplace contract takes precedence except where this Agreement provides additional specificity regarding the EKS Manager agent deployment.
1Definitions
"EKS Manager" means the managed Kubernetes orchestration platform operated by GitOps Manager, S.L., including the control plane, management interface, and associated services.
"Agent" means the EKS Manager agent software component deployed in your AWS account using Terraform, which runs on a virtual machine (EC2 instance) in your infrastructure.
"Installation" means one deployment of the EKS Manager server operated for you by GitOps Manager, S.L., together with the Agent or Agents connected to it.
"Managed Cluster" means an Amazon EKS cluster configured in an Installation, whether EKS Manager created it or it was added to the Installation afterwards.
"Customer," "you," or "your" means the entity that has subscribed to EKS Manager through AWS Marketplace.
"GitOps Manager, S.L." means the provider of EKS Manager, registered in Spain.
"Your AWS Account" means the AWS account or accounts in which you deploy the Agent.
2Service Description
EKS Manager is a managed Kubernetes orchestration platform that delivers a complete, revision-controlled EKS cluster — including internal DNS, TLS, ingress, monitoring, secrets management, and GitOps delivery — pre-integrated and consistent across all environments.
The EKS Manager control plane operates exclusively in infrastructure managed by GitOps Manager, S.L. The Agent is a lightweight connector component that runs in your AWS account and enables communication between your EKS clusters and the EKS Manager control plane.
EKS Manager is classified as a Software as a Service (SaaS) product with an agent component, in accordance with AWS Marketplace SaaS guidelines.
3Agent Deployment
The EKS Manager Agent is deployed into your AWS account by you, using Terraform that you review and run as an administrator in your own AWS account. Subscribing does not deploy anything. By running that Terraform you authorise the deployment of the Agent and the creation of the IAM role described in Section 4.
The Terraform configuration:
- Is published in a publicly readable repository for your review prior to execution
- Creates an IAM role with the permissions described in Section 4
- Deploys the Agent on an EC2 instance within your chosen VPC and subnet
- Does not transmit your AWS credentials to any external system
- Produces a full audit trail in AWS CloudTrail in your account
You retain full control over the Agent at all times. You may stop, modify, or remove the Agent at any time, using the same Terraform configuration that deployed it. Removal is described in Section 10.
4IAM Role and Permissions
The Agent operates using an IAM Instance Profile attached to the Agent EC2 instance. It does not hold AWS AdministratorAccess. Its own permissions are an explicit allow list, scoped to named resources: reading the EKS Manager configuration and log buckets, reading and writing secrets under the EKS Manager namespace, using the EKS Manager KMS key, reading its own configuration parameters (parameter writes are denied), reading AWS Organizations metadata, and writing its own CloudWatch logs. The only AWS managed policy attached to it is AmazonSSMManagedInstanceCore.
Work in the accounts you have enrolled is performed by assuming EKSManagerAdminRole, which a CloudFormation StackSet deploys into each of those accounts. That role also holds no AdministratorAccess. It carries permissions scoped per service for the resources EKS Manager operates — EKS, EC2, VPC, Route 53, ACM, Secrets Manager, KMS, ECR, Auto Scaling and Elastic Load Balancing — together with explicit deny statements that apply regardless of what else is granted.
EKSManagerAdminRole — enforced restrictions
- Deleting EKS clusters
- Destructive EC2 actions
- Creating IAM roles without the required permissions boundary, and any tampering with that boundary
- Creating or modifying IAM resources outside the EKS Manager naming prefix
- Attaching AWS managed policies outside an approved list
- Creating persistent credentials — IAM users and long-lived access keys
- Reading or writing secrets outside the EKS Manager namespace
- Destructive KMS actions, including key deletion and scheduled deletion
- Destructive ECR actions
- Removing the resource tags EKS Manager relies on
- Any action outside the AWS regions you have allowed
Both policies are published, and they are the files the installation deploys rather than a copy that can drift: the Agent's policy at aws/modules/shared_services/agent-role-policy.json and EKSManagerAdminRole at aws/modules/stackset/eksmanager-enable-account-stackset.yaml, in github.com/gitopsmanager/eksmanager-bootstrap. What you review before installing is what runs. GitOps Manager, S.L. commits to keeping both policies published, and to giving at least 30 days notice of any change that broadens the permissions either role holds.
Permissions are granted per service and per resource rather than as a broad base with exclusions. The deny statements apply on top of those grants, so a permission added in error cannot re-enable a denied action, and the permissions boundary applies the same limits to any role the Agent creates on your behalf.
5Infrastructure Charges
You are responsible for all AWS infrastructure charges incurred in your AWS account. These charges are separate from and in addition to your AWS Marketplace subscription fee for EKS Manager.
Infrastructure charges may include but are not limited to:
- EC2 instance charges for the Agent VM and EKS worker nodes
- EKS cluster management fees
- Data transfer and networking charges
- Storage charges for EBS volumes, S3, and ECR
- KMS key usage charges
- Secrets Manager charges
- Route 53 hosted zone and query charges
- ACM certificate charges where applicable
GitOps Manager, S.L. has no visibility into or control over the infrastructure charges incurred in your AWS account and accepts no liability for those charges.
6Licensing and Subscription Quantities
Your AWS Marketplace subscription sets a quantity for each of the following. Each Installation requires:
- Server: one unit for the Installation.
- Managed EKS Cluster: one unit for each cluster that requires a licence under this Section.
- Production Support (optional): one unit, which covers up to five licensed clusters, and one Production Support - additional clusters unit for each licensed cluster beyond five.
Which clusters require a licence
A licence is required for each Managed Cluster configured in the Installation, and for each Managed Cluster removed from the Installation within the preceding 120 days. A removed cluster stops requiring a licence 120 days after its removal. Re-adding a removed cluster does not require a second licence for it.
Your current licence requirement is displayed in the software at all times, on the Settings page under Licences, together with each recently removed cluster and the date it stops counting.
The licence period is not the billing period
AWS Marketplace bills your subscription monthly in advance, and allows you to reduce subscribed quantities when your agreement renews. Your licence requirement is measured continuously as described above and does not reset at renewal. Reducing a subscribed quantity below your licence requirement is not permitted, even where AWS Marketplace allows the change.
When usage exceeds your subscription
If your licence requirement exceeds your subscribed quantity, you must increase the subscribed quantity to cover it within 14 days. If you do, no additional amount is owed for the period before the increase. Quantities are increased in the AWS Marketplace console; AWS Marketplace offers mid-term increases only while automatic renewal is enabled on your agreement.
If the subscribed quantity is not increased within 14 days, GitOps Manager, S.L. may suspend access to the EKS Manager platform for the Installation until it is. Suspension does not delete or modify your clusters, workloads or data, which remain in your own AWS account.
GitOps Manager, S.L. keeps a daily record of each Installation's licence requirement and subscribed quantities, and will provide it on request.
7Data and Communications
The Agent communicates exclusively outbound to the EKS Manager control plane at gitopsmanager.io over HTTPS on port 443. No inbound connections to your AWS account are required or initiated by EKS Manager.
Agent Communication Policy
- Outbound HTTPS (port 443) only — no inbound connections
- All traffic encrypted in transit via TLS
- No AWS credentials transmitted outside your account
- Cluster configuration and metadata only — no customer data payloads
- Communication logged in CloudTrail in your account
GitOps Manager, S.L. processes data in accordance with its Privacy Policy at gitopsmanager.io/gitops_privacy.html and applicable data protection regulations including GDPR.
8Security and Audit
All actions performed by the Agent are recorded in AWS CloudTrail in your account. You have full visibility into all Agent activity through your own CloudTrail logs, CloudWatch, and AWS Security Hub.
You are responsible for:
- Maintaining CloudTrail logging in your AWS account
- Monitoring Agent activity via your preferred security tooling
- Keeping the Agent EC2 instance updated with OS-level security patches
- Controlling network access to the Agent VM via security groups
GitOps Manager, S.L. is responsible for:
- Maintaining the deny policy and publishing updates
- Keeping the Agent software updated and patched, with core stack releases three times a year
- Operating the control plane in accordance with security best practices
- Notifying customers of security-relevant changes
9Intellectual Property
The EKS Manager platform, Agent software, and all associated intellectual property remain the exclusive property of GitOps Manager, S.L. Your subscription grants you a non-exclusive, non-transferable right to use EKS Manager during your active subscription period.
Your data, cluster configurations, and workloads remain your exclusive property. GitOps Manager, S.L. claims no ownership over data processed through EKS Manager.
EKS Manager incorporates open-source software components. A full list of open-source components and their licenses is available on request.
10Removal and Termination
Upon termination of your subscription you must remove the Agent from your AWS account.
Removal is performed by the same Terraform that deployed the Agent, in two steps. Both run in your own AWS account and neither requires access by GitOps Manager, S.L.:
- Set DESTROY_MODE=true on the eksmanager-bootstrap CodeBuild project and start a build. This removes the Agent EC2 instance, its IAM role (EKSManagerAgentRole) and instance profile, the container registry, the configuration bucket, the Secrets Manager secrets and SSM parameters, the CloudFormation StackSet and every role it deployed, and the AWS Organizations delegated administrator registration.
- Run setup-pipeline.sh --destroy (or setup-pipeline.ps1 -Destroy) to remove the deployment pipeline itself: the CodeBuild project, its IAM roles and the bootstrap S3 bucket.
The two steps have separate Terraform state and neither performs the other, so both are required for a complete removal. Removing resources by hand instead is not recommended: the StackSet deploys a role into every account in the organizational units you targeted, and those roles are not removed by deleting the Agent instance.
Before you remove the pipeline, note what stops with it. The second step also removes the certificate automation. Where EKS Manager has been issuing Let's Encrypt wildcard certificates for your hosted zones, the scheduled job that renews them is removed with it, and those certificates will not be renewed again. The certificates themselves are held in AWS Secrets Manager in your own account and are not deleted by either step, so they remain available to you and stay valid until they expire — Let's Encrypt certificates are typically valid for ninety days from issue. If you intend to keep serving traffic from the clusters after removal, arrange your own certificate issuance and renewal before the current certificates expire. Removal also ends the other automation the pipeline provides, including management of the load balancer source prefix lists.
GitOps Manager, S.L. will disable the Agent's access to the control plane within 24 hours of subscription termination.
Data retention after termination
Your Kubernetes clusters, workloads and data remain in your own AWS account and are unaffected by termination. GitOps Manager, S.L. does not hold copies of them.
The EKS Manager installation operated on your behalf maintains a daily backup of its own database, which records your cluster inventory, configuration, audit trail and the email addresses of users you have invited. These backups are retained for 90 days and then deleted automatically. They are kept so that questions about configuration or activity can be answered after termination, and for no other purpose.
If you require earlier deletion, or a copy of this data, contact us at info@eksmanager.io.
11Limitation of Liability
GitOps Manager, S.L. provides EKS Manager on an "as is" basis. To the maximum extent permitted by applicable law, GitOps Manager, S.L. shall not be liable for:
- AWS infrastructure charges incurred in your account
- Data loss resulting from actions you authorise within your AWS account
- Service interruptions caused by AWS infrastructure or networking issues
- Issues arising from modifications you make to the Agent IAM role or EC2 instance
This limitation does not affect any rights you may have under the AWS Marketplace Standard Contract or applicable consumer protection laws.
12Support
Support is provided in accordance with the support tier selected at subscription:
- Community Support — included with every subscription. Best-efforts email support via support@eksmanager.io.
- Production Support — target response within 4 business hours for P1 and 1 business day for P2, Monday to Friday 09:00–18:00 CET. Response times are targets for acknowledgement, not resolution. One Production Support unit covers up to five licensed clusters; each licensed cluster beyond five requires one Production Support - additional clusters unit, as described in Section 6.
Production Support applies to clusters running the current or the immediately previous EKS Manager core stack release. Clusters on an older release receive Community Support until they are upgraded.
Support covers the EKS Manager platform and Agent. AWS infrastructure support is provided by AWS under your existing AWS Support plan.
13Governing Law
This Agreement is governed by the laws of Spain. Any disputes shall be subject to the exclusive jurisdiction of the courts of Spain, except where the AWS Marketplace Standard Contract specifies otherwise.
For questions about this Agreement contact: support@eksmanager.io