Manage private pricing offers for Amazon Bedrock with managed entitlements
Amazon Web Services Daniel Wirjo
AWS has a new way to manage Bedrock private pricing across accounts without manual grant clicking. It can save teams from missing the switch that makes negotiated rates actually apply.
Based on reporting by Amazon Web Services, Daniel Wirjo — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
AWS is pushing a cleaner way to handle private pricing for third-party models in Amazon Bedrock when those models are spread across a lot of accounts. The problem is simple enough: one workload account at a time is tedious, and if the grant stays disabled, the negotiated price just sits there doing nothing.
The company’s answer is managed entitlements in AWS License Manager, with two paths depending on how much automation you want. One is a lightweight script for a one-time cleanup job. The other is CDK-based automation that watches for new Marketplace agreement events, checks a seller allow-list, and activates grants as they arrive.
The script path is blunt but useful. It lists received licenses in the management account, shows a dry run, and only applies changes when run again with --apply and --confirm-account-id. AWS is clear that this one is for trusted licenses only, because there’s no seller allow-list in the script itself.
The CDK path is the more interesting part. It uses an Amazon EventBridge rule on the default event bus in us-east-1, listening for aws.agreement-marketplace events with the Purchase Agreement Created - Acceptor detail type. That fires a Lambda function that verifies the seller, finds the license, creates the distributed grant, and calls CreateGrantVersion with Status=ACTIVE. The grant can target the whole organization, selected OUs, or specific accounts.
AWS also bakes in some guardrails. The seller allow-list lives in a DynamoDB table and is treated as a security boundary. The post warns not to add broad or unverified seller entries, because a match can trigger grant creation and activation across whatever targets you configured. And because billing data in Cost Explorer can lag, AWS tells you to check the grant state first and only then compare usage charges after they show up.
It’s a very AWS solution: lots of moving parts, but each one has a job. That will appeal to teams already living in Organizations, License Manager, and CDK. Everyone else will probably notice the same thing they always do with cloud automation: the real product is not the script, it’s the quiet removal of one more human who had to remember to click the button.
My take — AI-written commentary, not fact-checked reporting
This is the kind of cloud automation that actually earns its keep: boring, specific, and aimed at stopping people from paying the wrong rate because someone forgot a console step. The allow-list is the right kind of annoying, too; if a pricing trigger can fan out across accounts, it should be gated like a security control, not a vibe. AWS keeps finding ways to turn operational drift into code, which is fine by anyone who has ever babysat a license screen.
Read more about this at: Amazon Web Services