Amazon Bedrock now supports managed entitlements that let a single AWS Organizations management account subscribe to a private pricing offer and propagate the grant to downstream accounts. Engineers care because the previous manual activation step blocked negotiated rates and added repetitive console work.
Why Managed Entitlements Matter
When a private pricing agreement is accepted, AWS Marketplace creates a license in License Manager, but the organization‑wide grant stays disabled until an operator activates it. Until activation, workloads pay on‑demand rates, defeating the purpose of the negotiated discount. Automating this step ensures the discount is applied consistently across all accounts that need the model.
One‑Time Activation with the Lightweight Script
The script path is intended for environments that need a quick, no‑infrastructure fix. It performs three actions:
- Enumerates every received license in the management account and prints a dry‑run plan.
- When re‑executed with
--apply --confirm-account-id ACCOUNT_ID, it creates and activates organization‑wide grants. - Leaves the seller verification step out of the flow, so it should only be used when the management account trusts all incoming licenses.
After activation, practitioners should confirm the discount appears in Cost Explorer and can reuse the provided scripts/bedrock_discount_check.py utility, adjusting the ISV partner identifier as needed.
Continuous Activation via CDK Automation
The CDK path deploys an event‑driven pipeline that keeps grant activation in sync with new private offers. The stack consists of three components:
- EventBridge rule: Listens in
us-east-1for events wheresource = aws.agreement-marketplaceanddetail-type = Purchase Agreement Created - Acceptor. Matching events invoke a Lambda function. - Lambda function: Receives the agreement payload, checks a configurable seller allow‑list, discovers the associated license, creates a distributed grant, and calls
CreateGrantVersion(Status=ACTIVE). It logs success or failure to CloudWatch for auditability. - License Manager grant: Targets the organization, selected OUs, or individual accounts. The negotiated pricing becomes effective once the grant reaches
ACTIVEorWORKFLOW_COMPLETED.
Deploying the stack gives ongoing, hands‑off processing of new offers while preserving a verification boundary via the allow‑list. Operators should monitor the Lambda’s CloudWatch log group for retry events and activation failures.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
Choose the lightweight script if you need an immediate, one‑off activation and you already trust every incoming license. Opt for the CDK automation when you expect multiple offers over time, need a repeatable audit trail, or must enforce a seller allow‑list. In either case, validate the discount in Cost Explorer after activation and keep the allow‑list current to avoid unintentionally granting discounts to unauthorized sellers. Monitoring CloudWatch logs and licensing reports should become part of the regular operational checklist to ensure that private pricing remains effective and visible across the organization.
