AI News
官方更新 AWS ML Blog Tue, 13 Oct 2026 正文 ok 1549 words

通过托管授权管理 Amazon Bedrock 私有定价优惠

英文标题：Manage private pricing offers for Amazon Bedrock with managed entitlements

在拥有数十乃至数百个 AWS 账户的组织中，逐一接受 AWS Marketplace Private Pricing Offers（MPPO）会给 Amazon Bedrock 第三方模型的访问管理带来明显运维负担。本文介绍两种在 AWS License Manager 中激活 MPPO 授权的方法：适用于一次性处理的轻量级脚本，以及面向持续事件驱动处理的 AWS CDK 自动化方案。CDK 方案会监听 AWS Marketplace 协议事件、校验卖家允许列表、创建分布式授权并尝试激活，以使协商价格在授权达到 `ACTIVE` 或 `WORKFLOW_COMPLETED` 后生效。该方案可减少人工控制台操作，并为多账户模型订阅和成本治理提供一致的审计能力。
打开原文相关 1.8 · 机会 4
media1.3 MB media1.3 MB media2.4 KB media345.0 KB media141.2 KB media346.5 KB media113.9 KB media18.2 KB media15.7 KB media28.5 KB media21.1 KB media176.3 KB

中文

当每个工作负载账户都必须分别订阅并接受 AWS Marketplace Private Pricing Offers（MPPO）时，跨数十或数百个 AWS 账户管理 AI 模型访问会产生运维摩擦。采用托管授权的 Amazon Bedrock可简化对第三方 AI 模型的多账户访问：您可以从一个中央账户订阅一次，再将访问权限分发至整个组织。

本文展示两种在 AWS License Manager 中激活 AWS Marketplace Private Pricing Offer（MPPO）授权的方法。当您需要针对已经信任的已接收许可证进行一次性、无需基础设施的处理时，可使用轻量级脚本；当您需要持续进行事件驱动处理，并验证卖家、创建和激活分布式授权时，可使用 CDK 自动化。

为什么要自动化授权激活

借助 AWS Marketplace Private Pricing Offers，您可以为 Amazon Bedrock 上的第三方模型协商自定义费率。在符合条件的私有优惠被接受后，AWS Marketplace 会在 AWS License Manager 中创建许可证。在已启用全部功能的 AWS Organizations 中，组织级授权会被自动接受，但在您激活之前仍处于 Disabled 状态。

团队通常通过检查 AWS License Manager 控制台并手动激活授权来管理此流程。手动检查虽然可行，但会增加工作量，也很容易被遗漏。在有人激活授权之前，协商价格不会生效。随着团队采用新模型或续订条款，同样的工作会不断重复出现。

解决方案概览

示例存储库提供两种路径：

  • 路径 1：轻量级路径是一个独立脚本，用于列出已接收许可证并输出试运行计划。只有在使用 --apply --confirm-account-id 重新运行时，它才会创建并激活组织范围内的授权。该脚本没有卖家允许列表，因此仅应在您信任管理账户中每一个已接收许可证时使用。
  • 路径 2：事件驱动路径使用 AWS Cloud Development Kit（AWS CDK），在您的 AWS 管理账户中部署持续运行的自动化。

请选择以下其中一种实现路径。若无需 CDK 的一次性激活，请使用路径 1；若需持续的事件驱动自动化，请使用路径 2。

路径 1：轻量级脚本（一次性激活）

当您需要一次性激活且不想部署 CDK 时，请使用此路径。该脚本会列出管理账户中的每一份已接收许可证，因此请将试运行结果作为应用变更前的审核关卡。

  1. 在本地克隆示例存储库，并进入项目目录。

    git clone https://github.com/aws-samples/sample-bedrock-managed-entitlements.git
cd sample-bedrock-managed-entitlements

  2. 以试运行模式运行轻量级脚本。

    python3 lightweight/distribute_licenses.py

  3. 审核列出的每一份许可证，并确认 ISV Partner 发行方和账户范围与您预期的私有优惠一致。

  4. 从同一个 AWS Organizations 管理账户应用已审核的计划。

    python3 lightweight/distribute_licenses.py --apply --confirm-account-id ACCOUNT_ID

  5. 授权激活后，在生产环境依赖私有优惠前，请验证计费路径。AWS Cost Explorer 中的计费数据可能存在延迟，因此请在费用出现后，用它比较所涵盖 Amazon Bedrock 使用量的实际收费。若要进行可重复的检查，可调整示例 scripts/bedrock_discount_check.py 工具，使其与您的 ISV Partner 发行方匹配，并确认预期的折扣路径。

路径 2：CDK 自动化（持续激活）

当您希望自动处理新的私有定价协议时，请使用此路径。CDK 堆栈会监听符合条件的 AWS Marketplace 协议事件，检查您的卖家允许列表，创建分布式授权，并在 License Manager 需要更多处理时间时重试激活。该解决方案包含三个组件：

  • Amazon EventBridge 规则：该堆栈会在 us-east-1 区域的默认事件总线上监听 AWS Marketplace 协议事件。该规则匹配来源 aws.agreement-marketplace 和详细类型 Purchase Agreement Created - Acceptor，随后调用 AWS Lambda 函数。
  • AWS Lambda 函数：该函数接收 AWS Marketplace 协议事件，验证卖家允许列表，发现许可证，创建分布式授权，并通过 CreateGrantVersion(Status=ACTIVE) 请求激活。该函数会将结果记录到 Amazon CloudWatch Logs，以便审计。
  • AWS License Manager 授权：授权可面向您的组织、选定的组织单位（OU）或特定账户。只有在授权被激活并达到 ACTIVE 或 WORKFLOW_COMPLETED 后，协商价格才会生效。

下图展示了事件驱动流程。

时序图：AWS Marketplace 向 Amazon EventBridge 发送 Purchase Agreement Created - Acceptor 事件，后者调用 AWS Lambda 函数。该函数验证卖家、发现已接收许可证、创建分布式授权、通过 CreateGrantVersion(Status=ACTIVE) 请求激活，并将结果写入 Amazon CloudWatch Logs。

图 1：时序图：AWS Marketplace 向 Amazon EventBridge 发送 Purchase Agreement Created – Acceptor 事件，后者调用 AWS Lambda 函数。该函数验证卖家、发现已接收许可证、创建分布式授权、通过 CreateGrantVersion(Status=ACTIVE) 请求激活，并将结果写入 Amazon CloudWatch Logs。

此方法的主要优势包括：

  • 更快享受协商价格。 分布式授权达到 ACTIVE 或 WORKFLOW_COMPLETED 后，协商费率即可生效，无需等待人工检查控制台。
  • 跨账户处理一致。 可为每个接收第三方模型授权的组织部署相同的 AWS Lambda 函数和 Amazon EventBridge 规则模式，使激活逻辑不因操作人员而异。
  • 内置审计追踪。 每一次激活尝试或跳过决策都会记录到 CloudWatch Logs，使您能够查看每项授权何时被激活、延后或忽略。

前提条件

部署此路径之前，请确认以下前提条件：

  • 使用位于 us-east-1 的 AWS Organizations 管理账户，并已配置 Python 3.12+、AWS Command Line Interface（AWS CLI）和 AWS CDK v2。
  • 确认 AWS Organizations 已启用全部功能，且私有优惠面向由 License Manager 支持的 Bedrock 模型。软件即服务（SaaS）产品不在此自动化方案的范围内。

实施步骤

  1. 在本地克隆示例存储库，并进入项目目录。

    git clone https://github.com/aws-samples/sample-bedrock-managed-entitlements.git
cd sample-bedrock-managed-entitlements

  2. 验证或启用组织前提条件。

    python3 scripts/bootstrap_prereqs.py --check --region us-east-1

审核所有 APPLY 或 MANUAL 项目后，再进行变更。引导脚本可以启用 License Manager 组织集成、License Manager 受信任访问、AWS Marketplace 许可证管理受信任访问以及所需的服务关联角色。

     python3 scripts/bootstrap_prereqs.py --apply --region us-east-1 --confirm-account-id ACCOUNT_ID

  1. 配置部署输入。

    python3 scripts/setup_config.py

审核 config/sellers.json。配置您的组织 ID、卖家允许列表、通知和可选的授权目标。默认情况下，授权面向整个组织。使用 grantTargets 可将授权范围限定为选定的 OU 或 AWS 账户。

  1. 部署 CDK 堆栈。

    cd cdk
pip install -r requirements.txt
cdk bootstrap aws://ACCOUNT_ID/us-east-1
cdk deploy

  2. 从 config/sellers.json 初始化 Amazon DynamoDB 卖家允许列表。

    cd ..
python scripts/seed_sellers.py --config config/sellers.json

请将卖家允许列表视为一道安全边界。在向表中写入数据之前，请根据您已接受的 AWS Marketplace 私有优惠或已接收的 License Manager 许可证，验证每个卖家账户 ID。不要添加范围过宽或未经验证的卖家条目，因为匹配的卖家可能会触发在您配置的授权目标范围内创建和激活授权。

部署并初始化卖家信息后，该堆栈即可处理符合条件的 AWS Marketplace 协议事件。只有允许列表中已验证卖家的事件才会触发授权创建和激活；在 License Manager 完成授权工作流处理之前，激活可能会被延后。

  1. 验证已部署的自动化。

    python scripts/e2e_validate.py --org-id o-xxxxxxxxxx --seller-account SELLER_ACCOUNT_ID --simulate

  2. 在符合条件的 AWS Marketplace 协议事件发生后，验证授权激活状态。

    aws logs tail /aws/lambda/mppo-grants-handler --follow --region us-east-1
python scripts/bedrock_discount_check.py --issuer "ISV Partner"

激活和计费可见性可能需要数小时或数天。事件驱动工作流接受并激活授权后，请先在 AWS License Manager 中确认授权状态，然后在计费数据出现后，于 AWS Cost Explorer 中验证所涵盖的 Amazon Bedrock 使用量。若要进行可重复的检查，可调整示例 scripts/bedrock_discount_check.py 工具，使其与您的 ISV Partner 发行方和目标关联账户匹配。

清理

如果您为测试部署了此堆栈，请将其删除，以避免持续产生少量 AWS Lambda 和 Amazon EventBridge 费用：

客户心声

“作为每周支持数百万次临床医生咨询的 AI Care Partner，Heidi Health 大规模依赖第三方基础模型。AWS Marketplace 上的私有定价为我们提供了一种经济高效的方式来管理这种增长：我们可以在 AWS 账户和组织单位之间精细化归因使用量和定价，并在采用新模型时自动化授权管理。这使我们的平台团队能够在不增加人工工作的情况下扩展成本治理能力。”

— Marcus Lau，Heidi Health 平台工程负责人

结论

本文介绍了两种激活 Amazon Bedrock 私有定价优惠托管授权的方法。对于可信的已接收许可证，可使用轻量级脚本进行一次性激活；如果需要持续处理新的 AWS Marketplace 协议，则可部署 CDK 自动化。两种方法均可减少人工工作，并帮助协商价格在分布式授权激活后生效。

要开始使用，请在您的 AWS 管理账户中试用代码示例，以自动化模型订阅。

资源

作者介绍

Daniel Wirjo

Daniel 是 AWS 的解决方案架构师，专注于 AI 和 SaaS 初创企业。作为一名前初创公司 CTO，他热衷于与创始人和工程领导者合作，推动在 AWS 上实现增长与创新。工作之余，Daniel 喜欢手持咖啡散步、欣赏自然风光和学习新知识。

Daniel Quang

Daniel 是 AWS Frontier AI Startups 团队的解决方案架构师，帮助全球规模最大、最具战略意义的 GenAI 初创企业在云端扩展其基础设施。他拥有加州大学欧文分校计算机科学博士学位，研究重点为机器学习和生物信息学。

Bryn Price

Bryn 是一位技术专家、滑翔伞飞行员，也是 AWS 首席解决方案架构师。他在电信、银行和软件领域拥有超过 20 年经验，近年来深入研究应用 AI，设计和构建生产环境中的多智能体 AI 产品，并帮助客户从生成式 AI 实验走向大规模生产交付。他喜欢挑战地心引力，也乐于探讨从 Agent 架构到 AI 如何重塑软件工程的一切话题。

Cai Liu

Cai 是 AWS License Manager 团队的软件开发工程师。

English / 原文

Managing AI model access across dozens or hundreds of AWS accounts creates operational friction when each workload account must subscribe and accept AWS Marketplace Private Pricing Offers (MPPOs) individually. Amazon Bedrock with managed entitlements simplifies multi-account access to third-party AI models so you can subscribe once from a central account and distribute access across your organization.

In this post, we show you two ways to activate AWS Marketplace Private Pricing Offer (MPPO) entitlements in AWS License Manager. Use the lightweight script when you want a one-time, no-infrastructure fix for received licenses you already trust. Use the CDK automation when you want ongoing event-driven processing that verifies sellers, creates and activates distributed grants.

Why automate grant activation

With AWS Marketplace Private Pricing Offers, you can negotiate custom rates for third-party models on Amazon Bedrock. After an eligible private offer is accepted, AWS Marketplace creates a license in AWS License Manager. In AWS Organizations with all features enabled, organization-level grants are auto-accepted but remain Disabled until you activate them.

Teams often manage this by checking the AWS License Manager console and activating grants manually. Manual checks work, but they add effort and are easy to miss. Until someone activates the grant, negotiated pricing does not apply. The same effort appears as teams adopt new models or renew terms.

Solution overview

The sample repository provides two paths:

  • Path 1 – The lightweight path is a standalone script that lists received licenses and prints a dry-run plan. It only creates and activates organization-wide grants when you re-run it with --apply --confirm-account-id. It has no seller allow-list, so use it only when you trust every received license in the management account.
  • Path 2 – The event-driven path uses AWS Cloud Development Kit (AWS CDK) to deploy ongoing automation in your AWS management account.

Choose one of the following implementation paths. Use Path 1 for one-time activation without CDK. Use Path 2 for ongoing event-driven automation.

Path 1: Lightweight script (one-time activation)

Use this path when you need one-time activation without deploying CDK. The script lists every received license in the management account, so use the dry run as your review gate before applying changes.

  1. Clone the sample repository locally and move into the project directory.

    git clone https://github.com/aws-samples/sample-bedrock-managed-entitlements.git
cd sample-bedrock-managed-entitlements

  2. Run the lightweight script in dry-run mode.

    python3 lightweight/distribute_licenses.py

  3. Review every listed license and confirm that the ISV Partner issuer and account scope match the private offer you expect.

  4. Apply the reviewed plan from the same AWS Organizations management account.

    python3 lightweight/distribute_licenses.py --apply --confirm-account-id ACCOUNT_ID

  5. After the grant is active, validate the billing path before you rely on the private offer in production. Billing data in AWS Cost Explorer can lag, so use it to compare the effective charge for covered Amazon Bedrock usage after charges appear. For a repeatable check, adapt the sample scripts/bedrock_discount_check.py utility to match your ISV Partner issuer and confirm the expected discount path.

Path 2: CDK automation (ongoing activation)

Use this path when you want new private pricing agreements handled automatically. The CDK stack listens for eligible AWS Marketplace agreement events, checks your seller allowlist, creates distributed grants, and retries activation when License Manager needs more time. The solution contains three components:

  • Amazon EventBridge rule : The stack listens for AWS Marketplace agreement events on the default event bus in us-east-1. The rule matches source aws.agreement-marketplace and detail type Purchase Agreement Created - Acceptor, then invokes the AWS Lambda function.
  • AWS Lambda function : The function receives the AWS Marketplace agreement event, verifies the seller allow-list, discovers the license, creates the distributed grant, and requests activation with CreateGrantVersion(Status=ACTIVE). The function logs the outcome to Amazon CloudWatch Logs for auditability.
  • AWS License Manager entitlements : The grant targets your organization, selected organizational units (OUs), or specific accounts. Negotiated pricing applies only after the grant is activated and reaches ACTIVE or WORKFLOW_COMPLETED.

The following diagram shows the event-driven flow.

Sequence diagram showing AWS Marketplace sending a Purchase Agreement Created - Acceptor event to Amazon EventBridge, which invokes an AWS Lambda function. The function verifies the seller, discovers the received license, creates a distributed grant, requests activation with CreateGrantVersion(Status=ACTIVE), and writes the outcome to Amazon CloudWatch Logs.

Figure 1: Sequence diagram showing AWS Marketplace sending a Purchase Agreement Created – Acceptor event to Amazon EventBridge, which invokes an AWS Lambda function. The function verifies the seller, discovers the received license, creates a distributed grant, requests activation with CreateGrantVersion(Status=ACTIVE), and writes the outcome to Amazon CloudWatch Logs.

Key benefits of this approach:

  • Faster time to negotiated pricing. The negotiated rate applies after the distributed grant reaches ACTIVE or WORKFLOW_COMPLETED, without waiting for a manual console check.
  • Consistent handling across accounts. The same AWS Lambda function and Amazon EventBridge rule pattern can be deployed for each organization that receives third-party model grants, so activation logic doesn’t vary by operator.
  • Built-in audit trail. Every activation attempt or skip decision is logged to CloudWatch Logs, giving you a record of when each grant was activated, deferred, or ignored.

Prerequisites

Before you deploy this path, confirm these prerequisites:

  • Use the AWS Organizations management account in us-east-1 with Python 3.12+, AWS Command Line Interface (AWS CLI), and AWS CDK v2 configured.
  • Confirm that AWS Organizations uses all features and that the private offer is for a License Manager-backed Bedrock model. Software as a service (SaaS) products are out of scope for this automation.

Implementation steps

  1. Clone the sample repository locally and move into the project directory.

    git clone https://github.com/aws-samples/sample-bedrock-managed-entitlements.git
cd sample-bedrock-managed-entitlements

  2. Verify or enable organization prerequisites.

    python3 scripts/bootstrap_prereqs.py --check --region us-east-1

Review any APPLY or MANUAL items before making changes. The bootstrap script can enable License Manager organization integration, License Manager trusted access, AWS Marketplace license-management trusted access, and required service-linked roles.

     python3 scripts/bootstrap_prereqs.py --apply --region us-east-1 --confirm-account-id ACCOUNT_ID

  1. Configure deployment inputs.

    python3 scripts/setup_config.py

Review config/sellers.json. Configure your Organization ID, seller allow-list, notifications, and optional grant targets. By default, grants target the full organization. Use grantTargets to scope grants to selected OUs or AWS accounts.

  1. Deploy the CDK stack.

    cd cdk
pip install -r requirements.txt
cdk bootstrap aws://ACCOUNT_ID/us-east-1
cdk deploy

  2. Seed the Amazon DynamoDB seller allow-list from config/sellers.json.

    cd ..
python scripts/seed_sellers.py --config config/sellers.json

Treat the seller allow-list as a security boundary. Verify each seller account ID against your accepted AWS Marketplace private offer or received License Manager license before seeding the table. Don’t add broad or unverified seller entries, because matching sellers can trigger grant creation and activation across your configured grant targets.

After deployment and seller seeding, the stack is ready to process eligible AWS Marketplace agreement events. Grant creation and activation happen only for verified sellers in the allowlist, and activation may be deferred until License Manager finishes processing the grant workflow.

  1. Validate the deployed automation.

    python scripts/e2e_validate.py --org-id o-xxxxxxxxxx --seller-account SELLER_ACCOUNT_ID --simulate

  2. Verify grant activation after an eligible AWS Marketplace agreement event.

    aws logs tail /aws/lambda/mppo-grants-handler --follow --region us-east-1
python scripts/bedrock_discount_check.py --issuer "ISV Partner"

Activation and billing visibility can take hours or days. After the event-driven workflow accepts and activates the grants, confirm the grant state in AWS License Manager, then validate covered Amazon Bedrock usage in AWS Cost Explorer after billing data appears. For a repeatable check, adapt the sample scripts/bedrock_discount_check.py utility to match your ISV Partner issuer and target linked account.

Clean up

If you deployed this stack for testing, remove it to avoid the small ongoing Lambda and Amazon EventBridge charges:

Voice of customer

“As an AI Care Partner supporting millions of clinician consults every week, Heidi Health relies on third-party foundation models at real scale. Private pricing on AWS Marketplace gives us a cost-effective and efficient way to manage that growth: we can granularly attribute usage and pricing across AWS accounts and organizational units, and automate grant management as we adopt new models. That lets our platform team scale cost governance without scaling manual work.”

— Marcus Lau, Head of Platform Engineering, Heidi Health

Conclusion

This post showed two ways to activate managed entitlements for Amazon Bedrock private pricing offers. Use the lightweight script for one-time activation of trusted received licenses, or deploy the CDK automation when you need ongoing event-driven processing for new AWS Marketplace agreements. Both approaches reduce manual effort and help negotiated pricing apply after distributed grants are activated.

To get started, try the code sample in your AWS management account to automate model subscriptions.

Resources

About the authors

Daniel Wirjo

Daniel is a Solutions Architect at AWS, focused on AI and SaaS startups. As a former startup CTO, he enjoys collaborating with founders and engineering leaders to drive growth and innovation on AWS. Outside of work, Daniel enjoys taking walks with a coffee in hand, appreciating nature, and learning new ideas.

Daniel Quang

Daniel is a Solutions Architect on the Frontier AI Startups team at AWS, where he helps the world’s largest and most strategic GenAI startups scale their infrastructure on the cloud. He holds a PhD in Computer Science from the University of California, Irvine, with a research focus on machine learning and bioinformatics.

Bryn Price

Bryn is a technologist, paragliding pilot, and Principal Solutions Architect at AWS. With more than 20 years of experience across telecommunications, banking, and software, he’s spent recent years deep in Applied AI, designing and building multi-agent AI products in production, and helping customers move from experimenting with generative AI to shipping it at scale. He loves defying gravity and talking through anything from agent architectures to how AI is reshaping software engineering itself.

Cai Liu

Cai is a Software Development Engineer on the AWS License Manager team.