# Bedrock Managed Entitlements

Set up managed entitlements so contracted pricing from a Bedrock private offer applies across every account in your AWS Organization, not just the payer account.

---

## Overview

When a buyer accepts a Marketplace private offer for a third-party Amazon Bedrock model (for example, Anthropic Claude), the contracted pricing applies only to the **payer account**. If member accounts across the AWS Organization also use the model, they're billed at **list price** unless managed entitlements is enabled.

Managed entitlements uses **AWS License Manager** to distribute the license from the payer account to member accounts, so contracted pricing applies everywhere the model is used.

| Without managed entitlements | With managed entitlements |
| --- | --- |
| Private offer on the payer account, usage on member accounts, member accounts billed at list price | Private offer on the payer account, license distributed to member accounts via grants, contracted pricing applies to all usage |

:::info
All license resources are managed in **us-east-1 (N. Virginia)**, regardless of where usage actually occurs. Switch your console to us-east-1 for every step below.
:::

## Before You Begin

Make sure you have:

- An **AWS Organization** with all features enabled
- Access to the **management account** (or a delegated admin account)
- At least one third-party Bedrock model subscription via AWS Marketplace
- Service-linked roles for License Manager and Marketplace (created during setup below)

## Step 1: Determine If You Need a Delegated Administrator

1. If you'll manage licenses directly from the management account, skip to Step 2.
2. If your management account is restricted (common in large enterprises and banks), designate a delegated administrator:
   1. Sign in to your management account.
   2. Open the **AWS License Manager** console.
   3. In the navigation pane, choose **Settings**.
   4. Under **Delegated administrator**, enter the AWS account ID of the member account you want to designate.
   5. Choose **Save changes**.

Once designated, the delegated admin completes Steps 2 and 3 from their own account.

## Step 2: Enable Service-Linked Roles and Trusted Access

Enable trusted access and create service-linked roles for both License Manager and Marketplace.

### Set up AWS License Manager

1. Sign in to your management account.
2. Open the **AWS License Manager** console.
3. Confirm you're in the **us-east-1 (N. Virginia)** region.
4. When the console first loads, a popup asks you to create a service-linked role — choose **Create service-linked role**.
5. In the navigation pane, choose **Settings**.
6. Under **Account management**, choose **Link AWS Organization accounts**.
7. Confirm the status shows **Linked**.

### Set up AWS Marketplace

1. While still signed in to your management account, open the **AWS Marketplace** console.
2. In the navigation pane, choose **Settings**.
3. Under **AWS License Manager Integration**, choose **View setting details**.
4. Select both checkboxes:
   - **Enable trusted access across your organization**
   - **AWS Marketplace license management service-linked role for this account**
5. Choose **Create integration**.
6. Confirm the settings show **Successfully created** for both **Service-linked role** and **Trusted access**.

:::warning
Enabling trusted access from the management account automatically creates service-linked roles for **all** member accounts in your organization.
:::

## Step 3: Distribute Licenses (Create Grants)

1. Sign in to your management account (or delegated admin account).
2. Open the **AWS License Manager** console.
3. Confirm you're in **us-east-1**.
4. In the navigation pane, choose **Granted Licenses**.
5. Select the license you want to share.
6. Choose **Create grant**.
7. Enter a descriptive grant name.
8. To grant access to the whole organization, enter the **Organization ID** (starts with `o-`).
9. Choose **Create grant**.

:::tip
For organizations with all features enabled, grants are auto-accepted and appear in a **Disabled** state — no manual acceptance required.
:::

## Step 4: Activate Grants

The activation workflow depends on your AWS Organizations configuration.

### If your organization has all features enabled (recommended)

1. Sign in to the management account (or delegated administrator account).
2. Open the **AWS License Manager** console.
3. In the navigation pane, choose **Granted Licenses**.
4. Select the grant to activate — for organization-wide grants, select the **parent grant**.
5. Choose **Activate**.
6. Confirm the activation.

This activates the grant for all recipient accounts at once. Verify individual account statuses on the grant details page under **Grants**.

### If your organization uses consolidated billing only

Grants appear in a **Pending Acceptance** state in each recipient account, and each recipient must accept and activate individually:

1. Sign in to the recipient member account.
2. Open the **AWS License Manager** console in **us-east-1**.
3. In the navigation pane, choose **Granted Licenses**.
4. Select the grant.
5. Choose **Accept & Activate**.

After activation, contracted pricing applies to all Bedrock model usage in those accounts.

## Troubleshooting

| Issue | Possible cause | Resolution |
| --- | --- | --- |
| Member account still billed at list price | Grant hasn't been created or activated for that account | Check the grant's status under **Granted Licenses**. Create and activate the grant if it doesn't exist. |
| Grant stuck in "Pending Acceptance" | Organization uses consolidated billing only, which requires manual acceptance per account | Sign in to the recipient account and choose **Accept & Activate** from **Granted Licenses**. |
| Can't find license resources in your working region | License resources are only managed in us-east-1 | Switch to the **us-east-1 (N. Virginia)** region in the console. |
| Delegated admin can't complete setup | Delegated admin wasn't designated before starting Step 2 | Complete Step 1 (designate a delegated admin in the management account) before proceeding. |

## FAQ

- #### Is this a one-time setup?
    Yes — setup is a one-time process per organization.

- #### Do new accounts joining the organization need manual setup?
    No. New accounts automatically receive org-wide grants.

- #### Can a grant be revoked later?
    Yes. Grants can be deactivated or deleted at any time through License Manager.

- #### Which region should I use for all of this?
    **us-east-1 (N. Virginia)** — all license resources are managed there regardless of where usage occurs.

## Related Resources

- AWS documentation: [Amazon Bedrock managed entitlements overview](https://docs.aws.amazon.com/bedrock/latest/userguide/managed-entitlements.html)