AWS launches managed entitlements for Bedrock to distribute third-party model access across multi-account organizations

AWS has introduced managed entitlements for Amazon Bedrock, enabling organizations to subscribe once to third-party models from a central account and distribute access across member accounts without granting AWS Marketplace permissions to each account.

The feature addresses a specific operational challenge: organizations running AI workloads across dozens or hundreds of AWS accounts must either grant AWS Marketplace permissions broadly, creating governance risks, or manually enable model subscriptions in each individual account. Managed entitlements eliminates this overhead for third-party models distributed through AWS Marketplace.

Which models require managed entitlements

The feature applies only to third-party AWS Marketplace models including Anthropic Claude, Cohere, Stability AI, and AI21 Labs. Amazon's own models (Amazon Nova) and partner models sold directly by Amazon (Meta Llama, Mistral, DeepSeek) are available immediately with Amazon Bedrock permissions and do not require AWS Marketplace subscriptions.

How it works

The managed entitlements workflow operates in four steps:

1. Subscribe: The management account subscribes to a third-party Bedrock model through AWS Marketplace, either via console or by accepting a private offer
2. License creation: AWS License Manager automatically creates a license representing the organization's entitlement to use the model
3. Create grants: Using AWS License Manager, administrators create grants to share the license with specific member accounts, organizational units, or the entire organization
4. Activate and use: Member accounts receive notification of grants, activate them, and immediately begin invoking the model without AWS Marketplace permissions

One license can have multiple grants, allowing a single subscription to serve many accounts. Member accounts can still invoke models without activated grants, but will be billed at public pricing rather than any negotiated private offer rates.

Private offer distribution

For organizations with negotiated custom pricing, managed entitlements ensures consistent rates across all accounts. Model providers extend private offers to the management account, which accepts the offer. The resulting license reflects the negotiated terms, and usage across member accounts flows through this agreement.

Prerequisites

Implementing managed entitlements requires AWS Organizations with all features enabled, management account access with permissions for both AWS Marketplace and AWS License Manager, and service-linked roles for both License Manager and Marketplace.

AWS notes that organizations operating in a single account, using only Amazon-sold models, or with account teams managing their own subscriptions independently do not need this feature.

What this means

Managed entitlements reduces operational overhead for multi-account AWS organizations using third-party Bedrock models, particularly those with 50+ accounts or negotiated pricing agreements. The feature maintains centralized governance while enabling distributed access, addressing a friction point that likely slowed AI adoption in regulated industries with strict IAM policies. Organizations standardizing on models like Claude can now deploy access org-wide in a single step rather than through manual per-account configuration.