Manage private pricing offers for Amazon Bedrock with managed entitlements

Managing AI model access across dozens or hundreds of AWS accounts creates operational friction when each workload account must subscribe and accept AWS Marketplace Private Pricing Offers (MPPOs) individually. Amazon Bedrock with managed entitlements simplifies multi-account access to third-party AI models so you can subscribe once from a central account and distribute access across your organization.

In this post, we show you two ways to activate AWS Marketplace Private Pricing Offer (MPPO) entitlements in AWS License Manager. Use the lightweight script when you want a one-time, no-infrastructure fix for received licenses you already trust. Use the CDK automation when you want ongoing event-driven processing that verifies sellers, creates and activates distributed grants.

Why automate grant activation

With AWS Marketplace Private Pricing Offers, you can negotiate custom rates for third-party models on Amazon Bedrock. After an eligible private offer is accepted, AWS Marketplace creates a license in AWS License Manager. In AWS Organizations with all features enabled, organization-level grants are auto-accepted but remain Disabled until you activate them.

Teams often manage this by checking the AWS License Manager console and activating grants manually. Manual checks work, but they add effort and are easy to miss. Until someone activates the grant, negotiated pricing does not apply. The same effort appears as teams adopt new models or renew terms.

Solution overview

The sample repository provides two paths:

• Path 1 – The lightweight path is a standalone script that lists received licenses and prints a dry-run plan. It only creates and activates organization-wide grants when you re-run it with --apply --confirm-account-id. It has no seller allow-list, so use it only when you trust every received license in the management account.
• Path 2 – The event-driven path uses AWS Cloud Development Kit (AWS CDK) to deploy ongoing automation in your AWS management account.

Choose one of the following implementation paths. Use Path 1 for one-time activation without CDK. Use Path 2 for ongoing event-driven automation.

Path 1: Lightweight script (one-time activation)

Use this path when you need one-time activation without deploying CDK. The script lists every received license in the management account, so use the dry run as your review gate before applying changes.

1. Clone the sample repository locally and move into the project directory.

   git clone https://github.com/aws-samples/sample-bedrock-managed-entitlements.git
   cd sample-bedrock-managed-entitlements

2. Run the lightweight script in dry-run mode.

   python3 lightweight/distribute_licenses.py

3. Review every listed license and confirm that the ISV Partner issuer and account scope match the private offer you expect.
4. Apply the reviewed plan from the same AWS Organizations management account.

   python3 lightweight/distribute_licenses.py --apply --confirm-account-id ACCOUNT_ID

5. After the grant is active, validate the billing path before you rely on the private offer in production. Billing data in AWS Cost Explorer can lag, so use it to compare the effective charge for covered Amazon Bedrock usage after charges appear. For a repeatable check, adapt the sample scripts/bedrock_discount_check.py utility to match your ISV Partner issuer and confirm the expected discount path.

Path 2: CDK automation (ongoing activation)

Use this path when you want new private pricing agreements handled automatically. The CDK stack listens for eligible AWS Marketplace agreement events, checks your seller allowlist, creates distributed grants, and retries activation when License Manager needs more time. The solution contains three components:

• Amazon EventBridge rule: The stack listens for AWS Marketplace agreement events on the default event bus in us-east-1. The rule matches source aws.agreement-marketplace and detail type Purchase Agreement Created - Acceptor, then invokes the AWS Lambda function.
• AWS Lambda function: The function receives the AWS Marketplace agreement event, verifies the seller allow-list, discovers the license, creates the distributed grant, and requests activation with CreateGrantVersion(Status=ACTIVE). The function logs the outcome to Amazon CloudWatch Logs for auditability.
• AWS License Manager entitlements: The grant targets your organization, selected organizational units (OUs), or specific accounts. Negotiated pricing applies only after the grant is activated and reaches ACTIVE or WORKFLOW_COMPLETED.

The following diagram shows the event-driven flow.

Figure 1: Sequence diagram showing AWS Marketplace sending a Purchase Agreement Created – Acceptor event to Amazon EventBridge, which invokes an AWS Lambda function. The function verifies the seller, discovers the received license, creates a distributed grant, requests activation with CreateGrantVersion(Status=ACTIVE), and writes the outcome to Amazon CloudWatch Logs.

Key benefits of this approach:

• Faster time to negotiated pricing. The negotiated rate applies after the distributed grant reaches ACTIVE or WORKFLOW_COMPLETED, without waiting for a manual console check.
• Consistent handling across accounts. The same AWS Lambda function and Amazon EventBridge rule pattern can be deployed for each organization that receives third-party model grants, so activation logic doesn’t vary by operator.
• Built-in audit trail. Every activation attempt or skip decision is logged to CloudWatch Logs, giving you a record of when each grant was activated, deferred, or ignored.

Prerequisites

Before you deploy this path, confirm these prerequisites:

• Use the AWS Organizations management account in us-east-1 with Python 3.12+, AWS Command Line Interface (AWS CLI), and AWS CDK v2 configured.
• Confirm that AWS Organizations uses all features and that the private offer is for a License Manager-backed Bedrock model. Software as a service (SaaS) products are out of scope for this automation.

Implementation steps

1. Clone the sample repository locally and move into the project directory.

   git clone https://github.com/aws-samples/sample-bedrock-managed-entitlements.git
   cd sample-bedrock-managed-entitlements

2. Verify or enable organization prerequisites.

   python3 scripts/bootstrap_prereqs.py --check --region us-east-1

   Review any APPLY or MANUAL items before making changes. The bootstrap script can enable License Manager organization integration, License Manager trusted access, AWS Marketplace license-management trusted access, and required service-linked roles.

   python3 scripts/bootstrap_prereqs.py --apply --region us-east-1 --confirm-account-id ACCOUNT_ID

3. Configure deployment inputs.

   python3 scripts/setup_config.py

   Review config/sellers.json. Configure your Organization ID, seller allow-list, notifications, and optional grant targets. By default, grants target the full organization. Use grantTargets to scope grants to selected OUs or AWS accounts.

4. Deploy the CDK stack.

   cd cdk
   pip install -r requirements.txt
   cdk bootstrap aws://ACCOUNT_ID/us-east-1
   cdk deploy

5. Seed the Amazon DynamoDB seller allow-list from config/sellers.json.

   cd ..
   python scripts/seed_sellers.py --config config/sellers.json

   Treat the seller allow-list as a security boundary. Verify each seller account ID against your accepted AWS Marketplace private offer or received License Manager license before seeding the table. Don’t add broad or unverified seller entries, because matching sellers can trigger grant creation and activation across your configured grant targets.

   After deployment and seller seeding, the stack is ready to process eligible AWS Marketplace agreement events. Grant creation and activation happen only for verified sellers in the allowlist, and activation may be deferred until License Manager finishes processing the grant workflow.

6. Validate the deployed automation.

   python scripts/e2e_validate.py --org-id o-xxxxxxxxxx --seller-account SELLER_ACCOUNT_ID --simulate

7. Verify grant activation after an eligible AWS Marketplace agreement event.

   aws logs tail /aws/lambda/mppo-grants-handler --follow --region us-east-1
   python scripts/bedrock_discount_check.py --issuer "ISV Partner"

   Activation and billing visibility can take hours or days. After the event-driven workflow accepts and activates the grants, confirm the grant state in AWS License Manager, then validate covered Amazon Bedrock usage in AWS Cost Explorer after billing data appears. For a repeatable check, adapt the sample scripts/bedrock_discount_check.py utility to match your ISV Partner issuer and target linked account.

Clean up

If you deployed this stack for testing, remove it to avoid the small ongoing Lambda and Amazon EventBridge charges:

cdk destroy

Voice of customer

“As an AI Care Partner supporting millions of clinician consults every week, Heidi Health relies on third-party foundation models at real scale. Private pricing on AWS Marketplace gives us a cost-effective and efficient way to manage that growth: we can granularly attribute usage and pricing across AWS accounts and organizational units, and automate grant management as we adopt new models. That lets our platform team scale cost governance without scaling manual work.”

— Marcus Lau, Head of Platform Engineering, Heidi Health

Conclusion

This post showed two ways to activate managed entitlements for Amazon Bedrock private pricing offers. Use the lightweight script for one-time activation of trusted received licenses, or deploy the CDK automation when you need ongoing event-driven processing for new AWS Marketplace agreements. Both approaches reduce manual effort and help negotiated pricing apply after distributed grants are activated.

To get started, try the code sample in your AWS management account to automate model subscriptions.