Ansible Automation Platform cost vs self-hosted AWX

Ansible Automation Platform cost vs self-hosted AWX or Semaphore UI: where the difference sits

When an Ansible Automation Platform renewal arrives, the question is rarely whether the license is expensive in isolation. The question is what the organization pays for, and what it would have to build itself if it stopped paying. AAP is sold as a quoted subscription that carries either Standard or Premium support, and the price depends on the support tier, the number of managed nodes and the contract term in the quote you hold. AWX and Semaphore UI Community carry no license fee. That does not make them free to run. The cost moves from the vendor invoice to your own hosting, Kubernetes, upgrades, backups, security patching and the engineers who carry them. The split is easiest to see by component. AAP's subscription buys enterprise support, with Red Hat stating that it adds at least 18 months of support per release, plus certified content collections, event-driven automation and a private automation hub. AWX is Apache 2.0 licensed and Red Hat states it does not provide any paid support for it, so support time comes from your own staff or a partner you contract separately. Semaphore UI Community is MIT licensed and listed at $0, while Pro starts at $20 per month or $199 per year for the starting configuration. Pro adds OIDC and LDAP single sign-on and project runners, and Enterprise, priced by quote, adds high availability and Kubernetes execution. Confirm current prices on the Semaphore UI pricing page before you model them.

The comparison depends on two inputs you must bring to the table: your own AAP quote and your staffing. Ask the vendor to itemize the subscription by support tier, node count, term and any add-ons you would not use, and ask what changes at renewal. On the self-hosted side, list the hosting for the controller and its database, the Kubernetes cluster if you run AWX through the AWX Operator, the backup and restore routine, and the hours needed for each AWX or Semaphore release, since AWX's releases are paused during refactoring and its latest release is 24.6.1. Put a value on the time your team spends on those tasks and on the support you would need in an incident. A decision that holds up usually compares the quote, the staffing and the risk of an unsupported platform side by side, rather than the license line alone.

Which cost components change between AAP and self-hosted options

This table sets each cost component of Ansible Automation Platform against the same component when you run AWX or Semaphore UI yourself. Read the one-time and recurring column first, because it shows which costs you keep paying every year and which you pay once during setup and migration.

Cost component	Commercial side (AAP and Red Hat support)	Self-hosted side (AWX or Semaphore UI)
Subscription or license	Quoted AAP subscription, priced by Red Hat through your agreement, recurring. Ask for the quote by support tier and managed node count.	AWX is Apache 2.0 and Semaphore UI Community is MIT, so there is no license fee. Semaphore Pro is a separate paid licence, listed from $20 per month or $199 per year on the Semaphore UI pricing page.
Support	Red Hat Standard or Premium support, recurring, included in the subscription. Red Hat's FAQ says it provides no paid support for AWX.	AWX support is community only. Community support for Semaphore UI is included in the free edition. Business-hours support SLA is a Semaphore Pro feature, so confirm its terms before you rely on it.
Semaphore Pro (separate row)	Not applicable. AAP already includes enterprise support and certified content.	Pro adds OIDC SSO, LDAP and Active Directory, and project runners. One Pro licence caps at 500 nodes, 5,000 resources, 25 users, 25 runners and 3 instances. Recurring, per the pricing page.
Semaphore Enterprise (separate row)	Not applicable.	Priced by quote. Adds high availability, Kubernetes execution, role mapping from identity provider groups, custom roles and air-gapped licensing. Ask for the quote in writing with the features you need.
Infrastructure (VMs, Kubernetes, database, storage)	Platform hosting for automation controller, hub and event-driven components, sized by Red Hat's deployment guidance. Recurring.	You pay for the VMs or Kubernetes cluster, PostgreSQL database and storage yourself. AWX runs through the AWX Operator, while Semaphore UI can run on Docker or a single VM. Recurring, and it scales with run volume.
Implementation	Red Hat or partner-led setup, usually one-time, sized to your environment. Confirm what the quote covers.	One-time engineering effort to install, integrate identity, configure credentials and hardening. DeployOpen plans this work under a fixed-scope written agreement, and the quote follows from that scope.
Migration	Export of job templates, inventories and credentials from automation controller. Usually one-time and effort-based.	One-time effort to recreate projects, inventories, key stores and task templates, and to replace certified collections and automation hub content. Plan parallel runs during cutover.
Upgrades, backup and monitoring	Covered by the subscription for supported releases, plus your own backup and monitoring tooling. Recurring.	Recurring internal effort for upgrades, database backup, restore testing and monitoring. AWX releases have been paused since 24.6.1, so plan upgrades without a published release schedule.
Internal skills	Lower in-house effort for support tickets and upgrades, but staff still need Ansible and AAP administration skills. Recurring.	Recurring need for Kubernetes or Docker operations, PostgreSQL administration and Ansible or OpenTofu expertise. Budget the time of the people who will own the platform, and confirm the skill gap with your team.

How the three options differ on cost and support

Red Hat Ansible Automation Platform is sold as a paid subscription that covers automation controller, Event-Driven Ansible, private automation hub and Red Hat support. The support level, Standard or Premium, is set by the subscription you buy, so the tier, the basis for counting managed nodes or cores, and the term should all appear in the written quote. You still run the controller, its database and execution infrastructure in your own environment, so hosting and staff time continue alongside the subscription.

What is paid: the subscription itself, which bundles the supported platform components and Red Hat's support. Ask for the pricing unit in writing.
What is free: the upstream projects remain open source, but the supported, hardened product comes only with the subscription.
Support model: Red Hat states that it provides at least 18 months of enterprise support per release, along with certified content collections.
Recurring costs: the subscription renews on its term, and infrastructure, backups and administration recur as well.
Growth exposure: cost usually rises with the number of managed nodes or cores, so model your fleet's growth before signing.

Confirm with Red Hat the support hours, severity response times, certified content coverage for your collections, and what happens to pricing at renewal.

What moves the comparison up or down

The cost gap between Ansible Automation Platform and a self-hosted option depends less on the license line than on a few operating conditions. User and node counts, the editions needed for identity integration and high availability, support hours, uptime requirements, data residency and internal skills each shift the total in one direction or the other. Check these before you compare quotes.

User and node counts

A single Semaphore UI Pro license caps at 500 nodes, 5,000 resources, 25 users, 25 runners and 3 instances. If your estimated counts stay under those limits, Pro may be the only paid line item you need. If you exceed any one of them, you move to Enterprise, which is priced by quote. Count managed hosts, users who run jobs and the runners you need for isolated networks, then ask Semaphore for the quote that matches those numbers.

Editions needed for SSO and LDAP

Semaphore UI Community does not include OIDC or LDAP integration. Pro adds SSO through providers such as Okta, Entra ID, Keycloak and Google, plus LDAP and Active Directory. Role mapping from identity provider groups is listed only in Enterprise. AWX provides the same identity integrations through its own configuration, but you run and secure that setup yourself. Confirm which group-based access rules your auditors expect before choosing an edition.

High availability requirements

Semaphore UI's Community edition does not include high availability, and the pricing page lists it only in Enterprise. AWX can be deployed on Kubernetes with the AWX Operator, where you design redundancy with your own cluster, database and storage. Decide whether a single-instance control plane meets your recovery objectives. If it does not, the high availability option and its quote become a central line in the comparison.

Support hours and who answers

Red Hat states that Ansible Automation Platform includes at least 18 months of enterprise support per release. Red Hat also states that AWX is supported by the community and that it provides no paid support for AWX. Semaphore Pro includes a business-hours support SLA, while Community relies on community support. Write down the incident response hours your operations team needs, then ask each vendor which hours and severity levels its support covers.

Data residency and air-gapped operation

If automation runs in an air-gapped network or must keep inventories, credentials and job logs in a specific jurisdiction, the deployment model matters. Semaphore Enterprise includes air-gapped licensing, and self-hosting either tool keeps data inside your environment. Confirm with the vendor whether the license check or any update path needs outside connectivity, and plan how you will pull container images and collections into the isolated network.

Internal Ansible and Kubernetes skills

Staff costs often outweigh license costs. AWX installed through the AWX Operator requires working knowledge of Kubernetes, storage, backups and upgrades. Semaphore UI on Docker or a VM needs less platform work but still requires someone who can patch the host, manage secrets and back up the database. Count the hours your team can spare for upgrades, and ask a DeployOpen-style implementation partner or the vendor to quote the setup and handover work separately from the license.

How to build the comparison with your own numbers

This sequence turns a vendor quote and your own environment into a like-for-like three- to five-year total, so you can see which costs are fixed, which scale with hosts and users, and which only appear once you migrate.

Request written AAP quotes by support level
Ask Red Hat or your reseller for a written quote for automation controller, Event-Driven Ansible and private automation hub if you use them, stating the support level (Standard or Premium), the subscription term, the managed node count and any renewal uplift. Compare this with list prices only as a sanity check, because discounts and bundling change the total. You are done when you hold a signed-off quote with every line item named and the term written out.
Inventory every managed host and user
Export the managed node count from automation controller, separate production, non-production and disaster recovery hosts, and list active users, teams and automation service accounts. Confirm with the quote how each unit is counted, since subscription terms often bill by managed node. Record which hosts and users are included in the quote so that the self-hosted scenario covers the same scope. You are done when the inventory matches the subscription basis line by line.
Price the hosting and Kubernetes you already run
Identify the clusters, virtual machines, storage, backup and load balancers that AWX or Semaphore UI would use, and whether they are already paid for under an existing platform agreement or are new spend. Include database and storage for run history and logs, and note any Kubernetes distribution or support contract you would need. Ask your cloud or infrastructure team for the internal chargeback rate, so the number reflects your own cost of capacity. You are done when each hosting item has a cost source and a recurring or one-time label.
Estimate staff hours for install and upgrades
Estimate the hours your platform team needs to install the platform, configure authentication, set up backups, and run each upgrade, using your own time units such as hours per quarter. For AWX, include operator-based installation and the fact that its releases are paused, so upgrade effort depends on what you choose to track. For Semaphore UI, include the Community or Pro edition you select. You are done when the install and upgrade estimates are recorded per year with a named owner.
Estimate on-call and support cost
Count the hours your team would spend on incidents, security patching, and vendor-free troubleshooting, because the open-source options carry no paid vendor support on the AWX side and only a business-hours SLA on Semaphore Pro. Compare that with the support level in the AAP quote, which includes Red Hat's enterprise support. Note who would be on call and what escalation path you would need. You are done when support hours and escalation ownership are written next to the AAP support entitlement.
Add migration effort from the matching page
Use the migration guide that matches your target, either AWX or Semaphore UI, and estimate effort for moving job templates, inventories, credentials, schedules, surveys and collection replacements. Add time for running both platforms in parallel during cutover and for retiring the AAP subscription at renewal. Mark these as one-time costs so they do not repeat in later years. You are done when the migration estimate is a single one-time figure with its assumptions listed.
Compare three- to five-year totals
Build a table with one row per cost component, with one-time costs in year one and recurring costs in each following year, and total each scenario over three and then five years. Keep the AAP renewal, hosting, staff and support lines separate so you can see which assumption drives the result. Run a second version with a higher staff estimate to test sensitivity. You are done when both scenarios total on the same basis and the assumptions behind each line are documented for review.

What a migration adds to the first year

The one-time migration work is the part of the first year that a subscription comparison hides. Moving off Ansible Automation Platform means exporting job templates, inventories, credentials and schedules from automation controller, then rebuilding them on the target. Credentials need the most care: the secret values usually cannot be read back out of the controller, so each one must be re-entered or re-sourced from your secrets store, and someone has to confirm which job templates depended on which credential. Plan a pass that maps every template to its inventory, credential and schedule before any object is recreated.

Access control and survey forms are the next items to rebuild by hand. Organization, team and user roles in controller do not carry over automatically to either AWX or Semaphore UI, so audit who can launch, edit and approve each template and recreate that model on the new platform. Surveys, the prompts that collect variables at launch, need to be re-expressed in the target's own form of input. Certified collections and private automation hub content also need a replacement plan: identify which collections your playbooks import, pin the versions you tested, and decide where they will be sourced from. Ask Red Hat and your collection publishers which license terms apply to content you mirror outside AAP.

Most teams run both platforms in parallel during cutover, which is a cost in its own right. Keep the subscription active until a representative set of jobs has run on the new platform, scheduled jobs have fired at least once, and rollback has been rehearsed. Both platforms need hosts, network paths and monitoring during that window. The detailed procedures are in the AWX migration guide topic and the Semaphore UI migration topic on this site. Before you set a cutover date, confirm the expiry and renewal terms of your AAP subscription with Red Hat so the overlap is priced in, not forced.

Costs teams forget on each side

The quoted subscription is only part of what Ansible Automation Platform costs, and the free alternatives carry their own operating work. Each card below names one item that often appears after the decision is made, along with what to confirm before comparing totals.

Renewal uplifts and term changes

A subscription quote is usually valid for one term, and the renewal price can differ from the first year. Ask Red Hat or your reseller to state in writing how the next renewal will be priced, whether support is included at the same level, and what happens to your node count if your inventory grows. Compare the three-year total, not the first invoice, against the self-hosted option. A renewal can change the total more than the initial purchase does.

Support tiers and their gaps

Subscription support is sold in tiers, and the tier that covers your hours, severity levels and time zones is often more expensive than the base quote. Confirm which tier you need for production incidents, whether it includes the components you actually run, and what response times are written into the contract. On the self-hosted side, AWX has no paid support from Red Hat, so the equivalent cost is an internal rota or a third-party contract that you must price yourself.

Content and components outside the base quote

Certified collections, private automation hub and Event-Driven Ansible are features that Red Hat presents as part of the platform, so confirm whether each is included in your subscription or sold as an add-on. Teams that rely on certified content for cloud or network modules should list every collection they use and check whether the self-hosted replacement can pull the same content from public sources. Missing items often surface during migration, not during procurement.

Backups and restore testing

The controller database holds job history, credentials and inventories, and a self-hosted installation needs its own backup schedule, retention rules and restore tests. Plan who runs the backups, where they are stored and how often a restore is rehearsed. The cost is mostly staff time and storage, and it recurs every month. Ask whether your team already has an enterprise backup product that can cover the database and secret material, or whether a new tool is needed.

TLS certificates and identity integration

Every web endpoint for AWX or Semaphore UI needs a certificate, and certificates expire on a schedule that someone must own. Identity integration with LDAP, Active Directory or OIDC also needs configuration and periodic review. For Semaphore UI, LDAP, OIDC and role mapping sit in the Pro and Enterprise tiers, so confirm which features your access model requires before choosing a tier. Those features carry their own licensing cost.

Security patching and release gaps

Self-hosting moves patching of the operating system, container runtime, database and the automation platform itself to your team. AWX has published no release since 24.6.1 while its refactoring is paused, so you may need to track upstream fixes and backport them or accept the exposure. Semaphore UI releases are current, but each upgrade still needs testing against your playbooks. Ask your security team what patch window and vulnerability response time they require before comparing costs.

Runners for isolated networks

Semaphore UI can run tasks on project runners in isolated infrastructure, which is a Pro feature, and Enterprise adds Kubernetes execution. If your target systems sit in segregated networks, you need a runner placed inside each one, with its own host, patching and access path. Count those hosts and their operators in the self-hosted total. Confirm the runner count your Pro license covers and whether your network design needs Enterprise features.

Who answers the pager when AWX has no paid support

Red Hat offers no paid support for AWX. Its FAQ says AWX is supported by the community and that Red Hat takes selected AWX releases and hardens them into Ansible Automation Platform, where the enterprise support and certified content live. The support line you pay for on AAP does not carry over to AWX. If you move, the failed job at 2 a.m., the broken controller upgrade and the credential store that stops decrypting are your problems to diagnose, and the only documented help is the community. Ask your AAP account team and your own legal team to confirm in writing what, if anything, they would still cover during a transition, because that answer changes the risk you are accepting.

Plan the ownership before cutover. Name an on-call rotation for the AWX control plane, its Kubernetes namespace, the AWX Operator, the database and the execution environments, and write runbooks for the failures you expect: stuck jobs, failed project syncs, credential or secret key problems, and certificate expiry. Because AWX releases are paused while the project is refactored, you also own the decision of when to upgrade, how to test the Operator and image changes in a staging instance, and how to back up and restore the database before each change. Confirm who signs off on running a version that has no published release newer than 24.6.1 from July 2, 2024.

A retainer can fill the gaps without making you a vendor's customer. A DeployOpen retainer covers ongoing support, upgrades and continuous testing, and it can be scoped to the runbooks, the Operator upgrade path and the regression tests your playbooks depend on. Ask any provider, DeployOpen included, for the written scope, response expectations, what is out of scope, and how incidents and handover to your team are handled. Pricing follows from that scope, so compare the retainer with the internal engineer hours it would replace. The same questions apply to Semaphore UI, where Pro adds business-hours support, so ask what the support SLA covers before you choose.

Questions buyers ask before comparing AAP with self-hosted options

What does an Ansible Automation Platform subscription include and what should I confirm in the quote?

An AAP subscription is a paid entitlement that bundles automation controller, Event-Driven Ansible, private automation hub and Red Hat support for the platform. Red Hat states that it adds at least 18 months of enterprise support per release, certified content collections and integrated tooling on top of the community projects. Ask the quote to list each component by name, the support tier (Standard or Premium), the unit the subscription counts, the term length, and whether the price covers non-production environments and disaster recovery. Also confirm renewal terms and whether the subscription works in an air-gapped network.

Is Semaphore UI Community edition free to use?

Yes, Semaphore UI Community edition is free under the MIT license, and its pricing page lists it at $0 with global runners and community support. The license cost is zero, but you still pay for the servers or virtual machines that run it, the staff time to operate it, and any outside support you buy. Community support carries no response commitment, so teams that need a business-hours support SLA should compare Pro. Community also lacks high availability, which the pricing page lists only in Enterprise, so a single instance is a single point of failure that needs backups and a tested rebuild procedure.

How much does Semaphore UI Pro cost at the starting configuration?

Semaphore UI Pro starts at $20 per month or $199 per year for the starting configuration, according to the Semaphore UI pricing page. Pro adds SSO through OIDC providers such as Okta, Entra ID, Keycloak and Google, LDAP and Active Directory, project runners for isolated infrastructure and a business-hours support SLA. A single Pro license caps at 500 nodes, 5,000 resources, 25 users, 25 runners and 3 instances. Confirm the current price and check your environment against those caps before buying, because growth past them requires a different tier. Enterprise is priced by quote and adds high availability, Kubernetes execution and air-gapped licensing.

How long does a migration from AAP take and what drives the timeline?

No supplied figure gives a migration duration, so the timeline depends on the volume and complexity of your existing automation. The main drivers are the number of job templates, inventories, credentials, surveys and schedules, how many workflows must be rebuilt rather than retired, and whether you rely on Red Hat certified collections that need community replacements. Identity integrations, parallel running during cutover and your change control process also add time. Ask any implementer for a written scope with deliverables and a timeline before work starts. DeployOpen plans most engagements as fixed scope, agreed in writing before work begins.

Can my team run self-hosted automation without outside help?

Many teams can run it in house if they already operate Linux or Kubernetes and have Ansible experience, but the real question is whether they can carry the ongoing load. Someone must patch the platform, back up its database, manage credentials, track upstream changes and respond to failed scheduled jobs. With the AAP subscription, Red Hat carries the support obligation for the platform, while with AWX or Semaphore UI Community that work falls on your staff. DeployOpen implements, hardens, backs up, upgrades, documents and supports self-hosted platforms in your infrastructure, and offers ongoing support as a retainer. Decide which tasks your team owns, then scope the retainer to cover the rest.

What skills does my team need to run AWX or Semaphore UI?

The core skills are Ansible content authoring, Linux administration, database backup and restore, and identity integration. For AWX, add Kubernetes and the AWX Operator, which AWX's install guide names as the preferred install method since version 18.0. Docker-based AWX is only recommended for development and test. For Semaphore UI, Docker is the recommended install path, so container operations, TLS termination and reverse proxy configuration matter more. Also plan for credential handling, change control over playbook repositories and on-call coverage for scheduled runs. Check each skill against your staff before choosing a platform.

Do AWX's paused releases change the cost case?

Yes, they shift the case toward risk and support cost. The AWX repository states that releases are paused during a large scale refactoring, and the latest release on the releases page is 24.6.1, published July 2, 2024. Red Hat's FAQ states that it does not provide any paid support for AWX, which is supported by the community. Running AWX therefore means accepting an unmaintained release line or funding your own patching and vulnerability response. Compare that cost against an AAP subscription, Semaphore UI Pro, or a staged move to Semaphore UI. Ask any provider for a written maintenance plan for AWX before you commit.

When staying on AAP is the lower-risk cost decision

Staying on Ansible Automation Platform is the lower-risk decision when the license buys things your organization cannot easily build or evidence itself. The clearest cases are certified content collections, enterprise support with a defined lifecycle, and the compliance evidence that auditors ask for when automation changes production systems. Red Hat states that AAP adds at least 18 months of enterprise support per release, and that it takes selected AWX releases and hardens them for long-term supportability. AWX has no paid support path from Red Hat and, according to the AWX GitHub repository, its releases are paused during a large scale refactoring. If a regulator or internal audit expects a named vendor to answer for patches and defects in the controller that runs privileged jobs, that accountability is worth pricing into the comparison. Ask Red Hat for the support dates for your specific subscription tier, and confirm which of Standard or Premium support covers your hours and severity needs.

A small estate often reverses the calculation. The subscription is usually a smaller line item than the people who keep a self-hosted controller patched, backed up, upgraded and documented. Running AWX means installing it with the AWX Operator on a Kubernetes cluster that your team must also operate, and that work recurs with every AWX upgrade. Semaphore UI Community is MIT licensed at $0, but a single team still needs someone to own its database, runners, access rules and backups. Before deciding, estimate the hours your platform engineers spend on the controller each month, and compare that figure with the subscription quote for your node count. Illustrative example: a team with a few dozen managed hosts that already runs a Kubernetes cluster may find that the marginal operations cost of AWX is low, while a team with no cluster may find the opposite.

Treat the decision as reversible only if you plan the exit. Keep your playbooks, roles and collections in Git so that the controller is a replaceable layer, and export job templates, inventories and credentials on a schedule so that you can rebuild them elsewhere. Write down the controls the auditor expects from automation, such as change approval, access logs and credential handling, and confirm which of them AAP provides out of the box and which you would have to build. Revisit the choice when AWX resumes releases or when your estate grows past the point where a single operator can hold the platform in their head.

How DeployOpen scopes a fixed-scope implementation and what it hands over

DeployOpen plans and implements self-hosted open-source automation platforms inside your own infrastructure, so the choice between AWX, Semaphore UI and staying on Ansible Automation Platform is made on a written scope rather than a guess. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.

How we scope

Inventory the current AAP subscriptions, support levels and the job templates, credentials and schedules in use
Agree in writing which platform is in scope: AWX, Semaphore UI Community, Semaphore UI Pro or Enterprise
Confirm the target hosting, Kubernetes or VM footprint, identity provider and any air-gapped requirement before quoting

How we build

Install the chosen platform in your cloud account, data center or air-gapped network, with the AWX Operator where AWX is selected
Recreate projects, inventories, credentials and schedules, and integrate SSO, LDAP or role mapping where your scope requires it
Test playbook runs in parallel with existing AAP jobs before any cutover, and record the results

How we hand over

Deliver the runbooks, configuration records, access model and backup and restore procedure for the platform
Document what was not migrated, such as certified collections, Event-Driven Ansible or private automation hub content, and the replacement chosen
Provide evidence for compliance readiness, which independent auditors or certification bodies then assess

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the build
Agree in the retainer who tracks upstream releases and security advisories, since AWX releases are currently paused
Decide with your team who owns patching, backups and on-call response once the fixed-scope work closes

Ansible Automation Platform cost vs self-hosted AWX or Semaphore UI