Suger

Bedrock Managed Entitlements

Set up managed entitlements so contracted pricing from a Bedrock private offer applies across every account in your AWS Organization, not just the payer account.

Overview

When a buyer accepts a Marketplace private offer for a third-party Amazon Bedrock model (for example, Anthropic Claude), the contracted pricing applies only to the payer account. If member accounts across the AWS Organization also use the model, they’re billed at list price unless managed entitlements is enabled.

Managed entitlements uses AWS License Manager to distribute the license from the payer account to member accounts, so contracted pricing applies everywhere the model is used.

Without managed entitlementsWith managed entitlements
Private offer on the payer account, usage on member accounts, member accounts billed at list pricePrivate offer on the payer account, license distributed to member accounts via grants, contracted pricing applies to all usage

Before You Begin

Make sure you have:

  • An AWS Organization with all features enabled
  • Access to the management account (or a delegated admin account)
  • At least one third-party Bedrock model subscription via AWS Marketplace
  • Service-linked roles for License Manager and Marketplace (created during setup below)

Step 1: Determine If You Need a Delegated Administrator

  1. If you’ll manage licenses directly from the management account, skip to Step 2.
  2. If your management account is restricted (common in large enterprises and banks), designate a delegated administrator:
    1. Sign in to your management account.
    2. Open the AWS License Manager console.
    3. In the navigation pane, choose Settings.
    4. Under Delegated administrator, enter the AWS account ID of the member account you want to designate.
    5. Choose Save changes.

Once designated, the delegated admin completes Steps 2 and 3 from their own account.

Step 2: Enable Service-Linked Roles and Trusted Access

Enable trusted access and create service-linked roles for both License Manager and Marketplace.

Set up AWS License Manager

  1. Sign in to your management account.
  2. Open the AWS License Manager console.
  3. Confirm you’re in the us-east-1 (N. Virginia) region.
  4. When the console first loads, a popup asks you to create a service-linked role — choose Create service-linked role.
  5. In the navigation pane, choose Settings.
  6. Under Account management, choose Link AWS Organization accounts.
  7. Confirm the status shows Linked.

Set up AWS Marketplace

  1. While still signed in to your management account, open the AWS Marketplace console.
  2. In the navigation pane, choose Settings.
  3. Under AWS License Manager Integration, choose View setting details.
  4. Select both checkboxes:
    • Enable trusted access across your organization
    • AWS Marketplace license management service-linked role for this account
  5. Choose Create integration.
  6. Confirm the settings show Successfully created for both Service-linked role and Trusted access.

Step 3: Distribute Licenses (Create Grants)

  1. Sign in to your management account (or delegated admin account).
  2. Open the AWS License Manager console.
  3. Confirm you’re in us-east-1.
  4. In the navigation pane, choose Granted Licenses.
  5. Select the license you want to share.
  6. Choose Create grant.
  7. Enter a descriptive grant name.
  8. To grant access to the whole organization, enter the Organization ID (starts with o-).
  9. Choose Create grant.

Step 4: Activate Grants

The activation workflow depends on your AWS Organizations configuration.

  1. Sign in to the management account (or delegated administrator account).
  2. Open the AWS License Manager console.
  3. In the navigation pane, choose Granted Licenses.
  4. Select the grant to activate — for organization-wide grants, select the parent grant.
  5. Choose Activate.
  6. Confirm the activation.

This activates the grant for all recipient accounts at once. Verify individual account statuses on the grant details page under Grants.

If your organization uses consolidated billing only

Grants appear in a Pending Acceptance state in each recipient account, and each recipient must accept and activate individually:

  1. Sign in to the recipient member account.
  2. Open the AWS License Manager console in us-east-1.
  3. In the navigation pane, choose Granted Licenses.
  4. Select the grant.
  5. Choose Accept & Activate.

After activation, contracted pricing applies to all Bedrock model usage in those accounts.

Troubleshooting

IssuePossible causeResolution
Member account still billed at list priceGrant hasn’t been created or activated for that accountCheck the grant’s status under Granted Licenses. Create and activate the grant if it doesn’t exist.
Grant stuck in “Pending Acceptance”Organization uses consolidated billing only, which requires manual acceptance per accountSign in to the recipient account and choose Accept & Activate from Granted Licenses.
Can’t find license resources in your working regionLicense resources are only managed in us-east-1Switch to the us-east-1 (N. Virginia) region in the console.
Delegated admin can’t complete setupDelegated admin wasn’t designated before starting Step 2Complete Step 1 (designate a delegated admin in the management account) before proceeding.

FAQ

  • Is this a one-time setup?

    Yes — setup is a one-time process per organization.

  • Do new accounts joining the organization need manual setup?

    No. New accounts automatically receive org-wide grants.

  • Can a grant be revoked later?

    Yes. Grants can be deactivated or deleted at any time through License Manager.

  • Which region should I use for all of this?

    us-east-1 (N. Virginia) — all license resources are managed there regardless of where usage occurs.