Viewing Supply Chain Security License Usage for IAC and Repository Scanning

Overview

Aqua Supply Chain Security licensing is measured at the repository level. Features such as SAST, Infrastructure as Code (IAC) scanning, and pipeline scanning do not consume separate license units — each onboarded repository counts as one license regardless of how many scan types run against it.

This article explains how to determine used and available Supply Chain licenses, since the Aqua console does not currently display used/available counts directly for Supply Chain Security.

Understanding Supply Chain License Model

License Unit

• One repository = one license
• SAST, IAC, pipeline, and SCM scan results linked to a repository share the same license
• License consumption is tracked by the number of repositories onboarded in the Supply Chain Security (SCM) module

What Is Not Licensed Separately

Viewing License Usage

Step 1: Check Total Licenses

1. 1. Navigate to Account Management (or the license page in the Aqua console)
2. 2. Locate the Supply Chain Security license count
3. 3. Note the total number of licenses allocated (e.g., 22,500)

Step 2: Count Onboarded Repositories

1. 1. Navigate to the Supply Chain Security module
2. 2. Review the repository count (number of repositories currently onboarded and scanned)
3. 3. Example: 142 repositories onboarded

Step 3: Calculate Remaining Licenses

Remaining licenses = Total Supply Chain licenses − Onboarded repository count

Example:

Current UI Limitation

The Aqua console does not currently display used and available Supply Chain license counts in a single view. The calculation above is the supported method to determine utilization.

A UI enhancement to display used/available counts directly is under consideration for a future release.

Verification

1. 1. Confirm the total license count on the Account Management page matches your entitlement
2. 2. Cross-check the SCM repository count against repositories visible in the Supply Chain module
3. 3. After onboarding a new repository, verify the repository count increments by one
4. 4. Plan capacity using the remaining license calculation before large-scale repository onboarding

Best Practices

• Track repository count periodically if approaching license limits
• Remove decommissioned repositories from SCM to free license capacity
• Remember that enabling multiple scan types (SAST + IAC + pipeline) on one repository still consumes only one license
• Coordinate with your account team if additional Supply Chain licenses are needed

Platform Coverage

• Platform: Aqua SaaS and self-hosted
• Component: License / Supply Chain Security
• Versions: All current SaaS releases

Summary

Related Resources

• Aqua Supply Chain Security Documentation
• Aqua Account Management