Granted licenses in License Manager

Granted licenses are licenses for products that your organization purchased from AWS Marketplace, AWS Data Exchange, or directly from a seller who integrated their software with managed entitlements. License administrators can use AWS License Manager to govern the use of these licenses and to distribute rights of use, known as entitlements, to specific AWS accounts.

Data licenses distributed to AWS Data Exchange products are available to the AWS account through AWS Data Exchange. Before you can distribute licenses from AWS Marketplace, you must enable subscription sharing. For more information, see Sharing subscriptions in an organization.

After a license administrator distributes an entitlement from an AWS Marketplace license to an AWS account, and the recipient accepts and activates the granted license, the subscription is available to the AWS account through AWS Marketplace. The account also has access to the product. For example, if a license administrator purchases an Amazon Machine Image (AMI) from AWS Marketplace and distributes an entitlement to your AWS account, you can launch Amazon EC2 instances from the AMI using AWS Marketplace and Amazon EC2.

View your granted licenses

License Manager displays tabs to view and manage your granted licenses based on the permissions you are authenticated with. The granted license page can display the following tabs:

My licenses

This tab is available for any user that has access to view the granted licenses in License Manager. The tab has a My granted licenses section which includes information about each license such as the License ID and Product name. From this page you can view additional information about each license.

License summary (for organization administrators)

This tab is available only for organization administrators. The tab has a Totals section which lists the total amount of products and granted licenses across all accounts in your organization. It also shows a Products section which includes a table detailing the properties of each product, such as the Product name and Number of granted licenses.

Aggregated licenses (for organization administrators)

This tab is available only for organization administrators. This tab has a section detailing Granted licenses for my organization which includes information about each license such as the License ID and Product name. From this page you can view additional information about each license.

Manage your granted licenses

Licenses that have been granted to you will appear in the License Manager console. Recipients must accept and activate granted licenses before they can use the product. How you accept and activate a license depends on whether the license is from AWS Marketplace, if your account is member account in an organization for AWS Organizations, and whether all features is enabled for your organization.

Granted licenses require cross-Region replication of license metadata. License Manager automatically replicates each granted license and its associated information to other AWS Regions. This enables you to have a centralized view across all Regions where licenses are granted to you.

Licenses from AWS Marketplace and AWS Data Exchange

• Licenses for subscriptions that you purchase are automatically accepted and activated.

• If the management account for an organization with all features enabled purchases a subscription and distributes licenses to member accounts, the licenses are automatically accepted in the member accounts. Either the management account or the member accounts can later activate the license.

• If the management account for an organization with only consolidated billing features enabled purchases a subscription and distributes licenses to member accounts, each member account must accept and activate the license.

Licenses from a seller

• You must accept and activate licenses for products that use License Manager to distribute licenses.

• If the management account for an organization with all features enabled purchases a product and distributes licenses to member accounts, the licenses are automatically accepted in the member accounts. Either the management account or the member accounts can later activate the license.

• If the management account for an organization with only consolidated billing features enabled purchases a product and distributes licenses to member accounts, each member account must accept and activate the license.

Console (My licenses)

You can view and manage granted licenses for a single AWS account.

To manage granted licenses in your account

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.

2. In the navigation pane, choose Granted licenses.

3. Choose the My licenses tab if it is not the current selection.

4. (Optional) Use the filter options, such as the following, to scope the list of licenses that are displayed.

   • Product SKU – The product identifier for this license, as defined by the license issuer when creating the license. The same product SKU might exist across multiple ISVs.

   • Recipient – The ARN of the license recipient.

   • Status – The status of the license. For example, Available.

5. To view additional information about the license, choose the license ID to open the License overview page.

6. If the license issuer is an entity other than AWS Marketplace, the initial grant status is Pending acceptance. Do one of the following:

   • Choose Accept & activate license. The resulting grant status is Active.

   • Choose Accept license. The resulting grant status is Disabled. When you are ready to use the license, choose Activate license.

   • Choose Reject license. The resulting grant status is Rejected. After you reject a license, you cannot activate it.

If you don't want to continue using a license that was activated, you can return to the License overview page and choose Deactivate license. If you want to continue using a license that was deactivated, return to the License overview page and choose Activate license.

Console (Aggregated licenses)

You can view your granted licenses that have been aggregated from all accounts in your organization.

Important

In order to use the organization wide view for your granted licenses, you must first link AWS Organizations using the AWS License Manager console settings. For more information, see Settings in AWS License Manager.

To manage granted licenses across your accounts in AWS Organizations

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.

2. In the navigation pane, choose Granted licenses.

3. Choose the Aggregated licenses tab if it is not the current selection.

4. (Optional) Use the filter options, such as the following, to scope the list of licenses that are displayed.

   • Product SKU – The product identifier for this license, as defined by the license issuer when creating the license. The same product SKU might exist across multiple ISVs.

   • Beneficiary – The account in your organization that the license is granted to.

5. To view additional information about the license, choose the license ID to open the license detail page.

6. If the license issuer is an entity other than AWS Marketplace, do one of the following:

   • Choose Activate license. The resulting grant status is Active.

   • Choose Deactivate license. The resulting grant status is Deactivated.

If you don't want to continue using a license that was activated, you can return to the License overview page and choose Deactivate license. If you want to continue using a license that was deactivated, return to the License overview page and choose Activate license.

AWS CLI

You can use the AWS CLI to work with your granted licenses.

To manage your granted licenses using the AWS CLI:

• accept-grant

• create-grant-version

• get-grant

• list-licenses

• list-received-grants

• list-received-grants-for-organization

• list-received-licenses

• list-received-licenses-for-organization

• reject-grant

Distribute entitlements

If you are a license administrator operating in the management account of your organization with all features enabled, you can distribute entitlements to your organization from your granted licenses by creating a grant. For more information about AWS Organizations, see AWS Organizations terminology and concepts.

You can specify the recipient of the grant as one of the following:

• An AWS account, which includes only the specified account.

• An organization root, which will include all accounts across your organization.

• An organizational unit (OU) (that is not nested), which includes all accounts in the specified OU and in nested OUs under the specified OU.

Note

You can create up to 2,000 grants per license.

You can use either the AWS License Manager console or the AWS CLI to distribute your entitlements. You can specify the organization ID or the organization ARN when creating a grant in the console, but the ARN format must be used with the AWS CLI. For example, the ARNs will resemble the following:

Organization ID ARN

arn:aws:organizations::<account-id-of-management-account>:organization/o-<organization-id>

Organization OU ARN

arn:aws:organizations::<account-id-of-management-account>:ou/o-<organization-id>/ou-<organizational-unit-id>

Console

To create a grant (Console)

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.

2. In the navigation pane, choose Granted licenses.

3. Choose a license ID to open the License overview page.

4. From the Grants section, choose Create grant.

5. On the Grant details panel, do the following:

   1. Enter a name for the grant to help you identify the purpose or recipient of the grant.

   2. Enter the AWS account ID, AWS Organizations OU ID or ARN, or AWS Organizations ID or ARN of the grant recipient.

   3. Choose Create grant.

6. On the License overview page, you'll see an entry for the grant in the Grants panel. The initial status of the grant is Pending acceptance. The status changes to Active when the recipient accepts the grant or Rejected when the recipient rejects the grant.

AWS CLI

You can use the AWS CLI to distribute an entitlement. You must use specify an organization ID or OU in ARN format when using the AWS License Manager API.

To create and list your grants using the AWS CLI:

• create-grant

• list-distributed-grants

The grant details page displays the list of accounts that you have granted access to the entitlement. After distributing a license to your organization, you can deactivate or activate the licenses individually on each account.

Grant acceptance and activation

When a grant is created for a granted license, it is distributed to the recipient. A granted license must be accepted and activated before it can be used by the grant recipient. The grant activation process can include additional options for granted licenses sourced from the AWS Marketplace.

By default, the Grant overview page for a granted license has a status of Pending Acceptance. You can choose to Accept, Accept and Activate, or Reject the grant. Grants that are accepted but not yet activated have a status of Disabled. Accepted and activated grants have a status of Active.

A granted license must be accepted and activated before it can be used by the grant recipient. By default, the grant details page for a granted license has a status of Pending acceptance. You can choose to Accept, Accept and Activate, or Reject the license. Grants that are accepted but not yet activated have a status of Disabled. Accepted and activated grants have a status of Active.

Tip

You can automatically accept grants that come from the management account of your organization. To enable grant auto-acceptance, link your organization accounts on the settings page in the AWS License Manager console from the management account.

You can't activate two licenses for the same product from AWS Marketplace at the same time. If you have two subscriptions (for example, the public offer for a product and a private offer, or a subscribed license for a product and a granted license for the same product), you can take one of the following actions:

1. Disable the existing grant for the same product and then activate the new grant.

2. Activate the new grant and specify that you want to disable and replace the existing active grant with the new grant. You can use the License Manager console or the AWS CLI:

   1. Using the License Manager console, activate the new grant while selecting Yes that you want to replace active grants.

   2. Using the CreateGrantVersion API, activate the new grant by specifying ALL_GRANTS_PERMITTED_BY_ISSUER for the ActivationOverrideBehavior with a Status of Active.

Console

You can use the License Manager console to activate a grant. When you activate a grant sourced from the AWS Marketplace, you might be presented with the option whether to replace active grants:

• As a license administrator, you must specify if you want to replace active grants when activating a grant.

• As a grantor, you can optionally specify if you want to replace active grants when you activate a grant for another account in your organization.

• As a grantee, if the grantor creating the distributed grant didn't specify whether to replace active grants, you must make a selection when activating the grant.

To activate a grant (Console)

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.

2. In the navigation pane, choose Granted licenses.

3. Choose a license ID to open the License overview page.

4. Choose a grant name to open the Grant overview page.

5. If presented, select an activation option for whether you want to replace active grants:

   1. No – This option will activate the grant without replacing any existing active grants for the recipient (grantee).

   2. Yes – This option will disable grants for the same product and activate a new grant for the defined recipient (grantee):

      1. A specified AWS account.

      2. Member accounts of the specified organization OU.

      3. All member accounts of the organization.

6. (Optional) Provide a reason for activating the grant.

7. Enter activate into the input box, and choose Activate.

AWS CLI

You can use the AWS CLI to work with your granted licenses.

To work with distributed grants using the AWS CLI:

• accept-grant

• create-grant-version

• list-received-grants

• list-received-grants-for-organization

• reject-grant

License status

Licenses have two statuses: The License status, which shows the overall availability and sharability of the license, and the Grant status, which shows the ability to use the license.

The follow table shows the various statuses for a granted license:

Status	Description
AVAILABLE	The license is available to use and share.
PENDING_AVAILABLE	The license is not available to use as it is still processing.
DEACTIVATED	The license is not available to use because it has been deactivated by the license issuer.
SUSPENDED	The license is not available to use as it is suspended.
EXPIRED	The license is not available to use because it has reached the end of term.
PENDING_DELETE	The license is not available to use as it is in the process of being deleted.
DELETED	The license is not available to use because the license agreement has been canceled.

The following table shows the various statuses for a grant:

Status	Description
PENDING_WORKFLOW	The grant is in the process of being distributed.
PENDING_ACCEPT	The grant has been created and the grant recipient has not yet accepted it.
REJECTED	The grant has been rejected by the grant recipient.
ACTIVE	The grant has been accepted and activated for use by the grant recipient. The licensed resource can be used.
FAILED_WORKFLOW	The grant failed to distribute.
DELETED	The grant has been deleted by the grantor.
PENDING_DELETE	The grant that was distributed is in the process of being deleted.
DISABLED	The grant has been accepted by the grant recipient, but has not been activated for use.
WORKFLOW_COMPLETE	The grant to an organization has been distributed or recalled. The grant details show the status of sub-grants to each account in the organization.

Metrics for buyer accounts

When a grant for a seller issued license is configured with allow submission of usage records selected, License Manager emits a CloudWatch metric to the seller account, root buyer account, and the account against which the usage is being recorded. Buyer accounts are the AWS accounts who have purchased or been granted a seller issued license. For more information, see Granting licenses to customers.

Usage dashboard

When a seller or independent software vendor (ISV) application records usage against a license for a buyer account, the account in which usage is being recorded and the root buyer account see a CloudWatch widget with usage records on the Usage dashboard page in the License Manager console. Buyers can also see metrics for accounts that they have distributed licenses to in AWS Organizations. The graphs on the Usage dashboard page are available for every license for which usage records have been sent.

The following image is an example of the usage dashboard: