AWS License Manager€¦ · AWS License Manager User Guide If you are responsible for managing licenses in your organization, you can use License Manager to set up licensing rules,

AWS License ManagerUser Guide

AWS License Manager User Guide

AWS License Manager: User GuideCopyright © 2020 Amazon Web Services, Inc. and/or its affiliates. All rights reserved.

Amazon's trademarks and trade dress may not be used in connection with any product or service that is notAmazon's, in any manner that is likely to cause confusion among customers, or in any manner that disparages ordiscredits Amazon. All other trademarks not owned by Amazon are the property of their respective owners, who mayor may not be affiliated with, connected to, or sponsored by Amazon.


Table of ContentsWhat Is AWS License Manager? .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Related Services .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1How License Manager Works .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2Getting Started .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4Working with License Manager .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Settings .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6License Configurations .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Parameters and Rules .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Build Rules from Vendor Licenses .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8Create a License Configuration .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Share a License Configuration .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Modify a License Configuration .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Delete a License Configuration .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

License Rules .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Manually Associating License Configurations with AMIs .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Host Resource Groups .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Create a Host Resource Group .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Share a Host Resource Group .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Launch an Instance in a Host Resource Group .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Modify a Host Resource Group .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Delete a Host Resource Group .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Resource Inventory .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15Discover Resource Inventory .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15Automated Discovery of Resource Inventory .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Dashboard .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Security ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Data Protection .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Encryption at Rest ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Identity and Access Management .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20Policy Structure .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20Example Policies for License Manager .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Service-Linked Roles .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21Core Role .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Master Account Role .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Member Account Role .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Compliance Validation .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29Resilience .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29Infrastructure Security ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29VPC Endpoints (AWS PrivateLink) ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Create an Interface VPC Endpoint for License Manager .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30Create a VPC Endpoint Policy for License Manager .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Troubleshooting .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Cross-Account Discovery Error ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Master Account Cannot Disassociate Resources from a License Configuration .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Systems Manager Inventory Is Out of Date .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Apparent Persistence of De-Registered AMI .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32New Child Account Instances Slow to Appear in Master Resource Inventory .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33After Enabling Cross-Account Mode, Child Account Instances Slow to Appear .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33Cross-Account Discovery Cannot Be Disabled .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33Child Account User Cannot Associate Shared License Configuration with an Instance .... . . . . . . . . . . . . . . . . . . . . . 33Linking AWS Organizations Accounts Fails ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

CloudTrail .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34License Manager Information in CloudTrail .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34Understanding License Manager Log File Entries ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

iii


Document History .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

iv

AWS License Manager User GuideRelated Services

What Is AWS License Manager?AWS License Manager makes it easier to manage your software licenses from software vendors (forexample, Microsoft, SAP, Oracle, and IBM) centrally across AWS and on-premises environments. Thisgives you better control and visibility into the usage of your licenses, enabling you to limit licensingoverages and reduce the risk of non-compliance and misreporting.

As you build out your cloud infrastructure on AWS, you can save costs by using bring-your-own-license(BYOL) opportunities. That is, you can repurpose your existing license inventory for use with your cloudresources.

License Manager reduces the risk of licensing overages and penalties with inventory tracking that is tieddirectly into AWS services. With rule-based controls on the consumption of licenses, administrators canset hard or soft limits on new and existing cloud deployments, stopping non-compliant server usagebefore it happens. A reporting dashboard provides ongoing visibility into license usage and assists withvendor audits.

License Manager supports tracking any software that is licensed based on virtual cores (vCPUs), physicalcores, sockets, or number of machines. This includes a variety of software products from Microsoft, IBM,SAP, Oracle, and other vendors.

Related ServicesLicense Manager integrates with Amazon EC2, allowing you to track licenses for the following resources:

• EC2 instances• Dedicated Instances• Dedicated Hosts• Spot Instances and Spot Fleet• Systems Manager Managed Instances

License Manager integrates with Amazon RDS, allowing you to monitor your Oracle license usage onAmazon RDS. For more information, see Oracle Licensing in the Amazon RDS User Guide.

Using License Manager along with AWS Systems Manager, you can manage licenses on physical or virtualservers hosted outside of AWS.

You can use License Manager to track BYOL software obtained from the AWS Marketplace.

You can use License Manager with AWS Organizations to manage all of your organizational accountscentrally.

1

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-instance.html

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-hosts-overview.html

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html

https://docs.aws.amazon.com/systems-manager/latest/userguide/

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Oracle.html#Oracle.Concepts.Licensing

https://aws.amazon.com/marketplace/


How License Manager WorksEffective software license management relies on the following:

• An expert understanding of language in enterprise licensing agreements• Appropriately restricted access to operations that consume licenses• Accurate tracking of license inventory

Enterprises are likely to have dedicated persons or teams responsible for each of these domains.It then becomes a problem of effective communication, particularly between license experts andsystem administrators. License Manager provides a way of pooling knowledge from various domains.Crucially, it also integrates natively with AWS services—for example, with the Amazon EC2 control planewhere instances are created and deleted. This means that License Manager rules and limits capturebusiness and operational knowledge, and also translate to automated controls on instance creation andapplication deployment.

The following diagram illustrates the distinct but coordinated duties of license administrators, whomanage permissions and configure License Manager, and users, who create, manage, and deleteresources through the Amazon EC2 console.

2


If you are responsible for managing licenses in your organization, you can use License Manager to set uplicensing rules, attach them to your launches, and keep track of usage. The users in your organization canthen add and remove license-consuming resources without additional work.

A licensing expert manages licenses across the entire organization, determining resource inventoryneeds, supervising license procurement, and driving compliant license usage. In an enterprise usingLicense Manager, this work is consolidated through the License Manager console. As shown inthe diagram, this involves setting service permissions, creating rule-based license configurations,taking inventory of computing resources both on-premises and in the cloud, and associating licenseconfigurations with discovered resources. In practice, this could mean associating a license configurationwith an approved Amazon Machine Image (AMI) that IT uses as a template for all Amazon EC2 instancedeployments.

License Manager saves costs that would otherwise be lost to license violations. While internal auditsreveal violations only after the fact, when it is too late to avoid penalties for non-compliance, LicenseManager prevents expensive incidents from ever occurring. License Manager simplifies reporting withbuilt-in dashboards showing license consumption and resources tracked.

3


Getting Started with AWS LicenseManager

To begin using AWS License Manager, log into the License Manager console.

To get started with License Manager

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/. You areprompted to configure permissions for License Manager and its supporting services. Follow thedirections.

2. Create a license configuration and attach it to your AMIs and instances.3. Launch instances and track license usage using the built-in dashboards.

4

https://console.aws.amazon.com/license-manager/


Working with AWS License ManagerLicense Manager can be applied to standard scenarios for enterprises with a mixed infrastructure ofAWS resources and on-premises resources. You can create license configurations, take inventory of yourlicense-consuming resources, associate licenses with resources, and track inventory and compliance.

Licensing for AWS Marketplace products

Using License Manager, you can now associate licensing rules to AWS Marketplace BYOL AMI productsvia Amazon EC2 launch templates, AWS CloudFormation templates, or AWS Service Catalog products. Ineach case, you benefit from centralized license-tracking and compliance enforcement.

NoteLicense Manager does not change how you obtain and activate your BYOL AMIs fromMarketplace. After launching, you must provide a license key obtained directly from the seller toactivate any third-party software.

Tracking licenses for resources in on-premises data centers

With License Manager, you can discover applications running outside of AWS with the Systems Managerinventory, and then attach licensing rules to them. After licensing rules are attached, you can track on-premises servers along with AWS resources in the License Manager console.

Differentiate between license included and BYOL

With License Manager, you can identify which resources have a license that is included with the productand which use a license that you own. This enables you to accurately report how you are using BYOLlicenses. This filter requires SSM version 2.3.722.0 or later.

License Manager Across Your AWS Accounts

License Manager enables you to manage licenses across your AWS accounts. You can create licenseconfigurations once in your AWS Organizations master account and share them across your accountsusing AWS Resource Access Manager or by linking AWS Organizations accounts using License Managersettings. This also enables you to perform cross-account discovery to search inventory across your AWSaccounts. However, the following Regions do not support license management across AWS accounts:

• US West (N. California)• Africa (Cape Town)• Asia Pacific (Hong Kong)• Europe (Milan)• Europe (Paris)• Europe (Stockholm)• Middle East (Bahrain)• South America (São Paulo)• AWS GovCloud (US-East)• AWS GovCloud (US-West)• China (Beijing)• China (Ningxia)

Contents• Settings in License Manager (p. 6)• License Configurations in License Manager (p. 6)

5

http://aws.amazon.com/systems-manager/faq/


AWS License Manager User GuideSettings

• License Rules in License Manager (p. 11)• Host Resource Groups in AWS License Manager (p. 13)• Resource Inventory in License Manager (p. 15)• Dashboard in License Manager (p. 18)

Settings in License ManagerThe Settings section of the License Manager console display settings for the logged-in account in LicenseManager. You can also edit those settings. You must configure settings to enable cross-account inventorydiscovery.

The settings for License Manager include the following:

• Account type• S3 bucket ARN• Link AWS Organizations account• SNS topic ARN• Cross-account resource discovery

To edit License Manager settings

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.2. In the left navigation pane, choose Settings, Edit.3. Select Link AWS Organizations accounts to configure a single master account (your AWS

Organizations account) to perform license configuration attachments on instances in child accounts.License Manager associates your AWS Organizations account with your License Manager account.

To enable this option, you must be signed into your master account and have all features enabled inAWS Organizations. For more information, see Enabling All Features in Your Organization in the AWSOrganizations User Guide.

Linking your AWS Organizations account also creates an AWS Resource Access Manager resourceshare in your master account and associates your account with it. This enables you to seamlesslyshare license configurations. For more information, see the AWS RAM User Guide.

4. Select Cross-account inventory search to configure permissions for the services and locations thatLicense Manager uses to perform cross-account inventory search.

License Manager uses Systems Manager inventory to discover software usage. Ensure that youhave configured Systems Manager inventory on all of your resources. Querying Systems Managerinventory requires a Resource Data Sync to store inventory in an Amazon S3 bucket, Amazon Athenato aggregate inventory data from organizational accounts, and AWS Glue to provide a fast queryexperience.

5. (Optional) For Simple Notification Service (SNS), you can modify the Amazon SNS topic ARN.The ARN must have the following format: arn:aws:sns:region:account_id:aws-license-manager-service-*.

6. Choose Apply.

License Configurations in License ManagerLicense configurations are the core of License Manager. They contain licensing rules based on the termsof your enterprise agreements. The rules that you create determine how AWS processes commands that

6


https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html

https://docs.aws.amazon.com/ram/latest/userguide/

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-inventory.html

AWS License Manager User GuideParameters and Rules

consume licenses. While creating license configurations, work closely with your organization's complianceteam to review your enterprise agreements.

Limits

• Number of license configurations per resource: 10• Total number of license configurations: 25• Systems Manager managed instances must be associated with vCPU and instance type license

configurations.

Contents• License Configuration Parameters and Rules (p. 7)• Build License Manager Rules from Vendor Licenses (p. 8)• Create a License Configuration (p. 9)• Share a License Configuration (p. 10)• Modify a License Configuration (p. 10)• Delete a License Configuration (p. 11)

License Configuration Parameters and RulesA license configuration consists of basic parameters and rules that vary according to the parametervalues. You can also add tags to your license configurations. After you create a license configuration, anadministrator can modify the number of licenses and the usage limit to reflect changing resource needs.

Available parameters and rules include the following:

• Name — The name of the license configuration.• Description — A description of the license configuration.• License counting type — The metric used to count licenses. Supported values are physical core, vCPU,

socket, and instance.• (Optional) License count — The number of licenses managed by this configuration.• (Optional) License count hard limit — The kind of limit represented by the license count. A hard limit

blocks the launch of an out-of-compliance instance. A soft limit permits out-of-compliance launchesbut sends an alert when one occurs.

• Number of licenses consumed - The number of licenses used by a resource.• Status — Indicates whether the configuration is active.• Product information — The names and versions of the products for automated discovery (p. 17).

The supported products are Windows Server, SQL Server, and Oracle Database.• (Optional) Rules - These include the following. Available rules vary by counting type.

• Maximum cores — Maximum count cores for a resource.• Maximum sockets — Maximum count sockets for a resource.• Maximum vCPUs — Maximum count vCPUs for a resource.• Minimum cores — Minimum count cores for a resource.• Minimum sockets — Minimum count sockets for a resource.• Minimum vCPUs — Minimum count vCPUs for a resource.• Tenancy — Restricts license usage to the specified EC2 tenancy. Dedicated Hosts are required if the

counting type is Cores or Sockets. Shared tenancy, Dedicated Hosts, and Dedicated Instances aresupported if the counting type is Instances or vCPUs. The console (and API) names are as follows:• Shared (EC2-Default)

7

AWS License Manager User GuideBuild Rules from Vendor Licenses

• Dedicated Instance (EC2-DedicatedInstance)• Dedicated Host (EC2-DedicatedHost)

• vCPU Optimization — License Manager integrates with CPU optimization support in Amazon EC2,which enables you to customize the number of vCPUs on an instance. If this rule is set to True,License Manager counts vCPUs based on the customized core and thread count. Otherwise, LicenseManager counts the default number of vCPUs for the instance type.

The following table describes which license rules are available for each counting type.

Console name API name Cores Instances Sockets vCPUs

Maximum cores maximumCores ♦ ♦

Maximum sockets maximumSockets ♦ ♦

Maximum vCPUs maximumVcpus ♦ ♦

Minimum cores minimumCores ♦ ♦

Minimum sockets minimumSockets ♦ ♦

Minimum vCPUs minimumVcpus ♦ ♦

Tenancy allowedTenancy ♦ ♦ ♦ ♦

vCPU Optimization honorVcpuOptimization ♦

Build License Manager Rules from Vendor LicensesYou can create License Manager rule sets based on the language of software vendor licenses. Theexamples that follow are not intended as blueprints for actual use cases. In any real-world application ofa license agreement, you choose among competing options depending on the architecture and licensinghistory of your particular on-premises server environment. Your options also depend on the details ofyour planned migration of resources to AWS.

As much as possible, these examples are meant to be vendor-neutral, focusing instead on generallyapplicable questions of hardware and software allocation. Vendor licensing provisions interact as wellwith AWS requirements and limits. The number of licenses required for an application varies according tothe instance type chosen and other factors.

ImportantAWS does not participate in the audit process with software vendors. Customers are responsiblefor compliance and assume the responsibility of carefully understanding and capturing rulesinto License Manager based on their licensing agreements.

Example: Implementing an Operating System LicenseThis example involves a license for a server operating system. The licensing language imposes constraintson the type of CPU core, tenancy, and minimum number of licenses per server.

In this example, the licensing terms include the following stipulations:

• Physical processor cores determine the license count.• The number of licenses must equal the number of cores.• A server must run a minimum of eight cores.

8

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html

AWS License Manager User GuideCreate a License Configuration

• The operating system must run on a non-virtualized host.

In addition, the customer has made the following decisions:

• Licenses for 96 cores have been purchased.

• A hard limit is imposed to restrict license consumption to the quantity purchased.

• Each server needs a maximum of 16 cores.

The following table associates the License Manager rule-making parameters with the vendor licensingrequirements that they capture and automate. The example values are for illustration purposes only; youwould specify the values that you need in your own license configurations.

License Manager Rule Settings

License counting type License Type is set to Cores.

License count Number of cores is set to 96.

Minimum / Maximum vCPUs or cores Minimum cores is set to 8.

Maximum cores is set to 16.

License count hard limit Enforce license limit is selected.

Allowed tenancy Tenancy is set to Dedicated Host.

Create a License ConfigurationA license configuration represents the licensing terms in the agreement with your software vendor. Yourlicense configuration specifies how your licenses should be counted (for example, by vCPUs or numberof instances). It also specifies limits on your usage, so that you can prevent usage from going over thenumber of allocated licenses. Additionally, it can also specify other constraints on your licenses, such asthe tenancy type.

Requirements for Oracle Database Products

When you add product information to configure automated discovery of Oracle Database products, thefollowing requirements apply:

• The supported license counting type is vCPU.

• Rules are not supported.

• Hard license limits are not supported.

• You can track one product version per license configuration.

• You cannot track Oracle products and other products using the same license configuration.

To create a license configuration using the console

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.

2. In the left navigation pane, choose License configurations.

3. Choose Create license configuration.

4. In the Configuration details panel, provide the following information:

9


AWS License Manager User GuideShare a License Configuration

• Name — A name for the license configuration.• Description — An optional description of the license configuration.• License type — The counting model for this license (vCPUs, Cores, Sockets, or Instances).• Number of <option> — The option displayed depends on the license type. When the license limit

is exceeded, License Manager notifies you (soft limit) or prevents a resource from deploying (hardlimit).

• Enforce license limit — If selected, the license limit is a hard limit.5. Expand Rules. You can create one or more rules. For each rule, select a rule type, provide a rule

value, and choose Add rule. The rule types displayed depend on the license type. For example,minimum values, maximum values, and tenancy. If you do not specify a tenancy type, all areaccepted.

6. (Optional) In the Production information panel, add products to your license configuration. Formore information, see Automated Discovery of Resource Inventory (p. 17).

7. (Optional) Expand the Tags pane to add one or more tags to your license configuration. Tags arekey/value pairs. Provide the following information and then choose Add tag:

• Key — The searchable name of the key.• Value — The value for the key.

8. Choose Create. The console returns you to the License configurations page, which lists anddescribes your license configurations.

To create a license configuration using the command line

• create-license-configuration (AWS CLI)• New-LICMLicenseConfiguration (Tools for Windows PowerShell)

Share a License ConfigurationYou can use AWS Resource Access Manager to shared your license configurations with any AWS accountor through AWS Organizations. For more information, see the AWS RAM User Guide.

Modify a License ConfigurationYou can edit values for the following fields in a license configuration:

• Name• Description• License count• License count hard limit

To edit a license configuration

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.2. In the left navigation pane, choose License configurations.3. Choose Action, Edit.4. Edit the fields as needed and then choose Save.

When you deactivate a license configuration, existing resources using the license are unaffected and AMIsusing the license can still be launched. However, license consumption is no longer tracked.

10

https://docs.aws.amazon.com/cli/latest/reference/license-manager/create-license-configuration.html

https://docs.aws.amazon.com/powershell/latest/reference/items/New-LICMLicenseConfiguration.html



AWS License Manager User GuideDelete a License Configuration

To deactivate a license configuration

When a license configuration is deactivated, it must not be attached to any running instance. Afterdeactivation, launches cannot be performed with the license configuration.



3. Choose Action, Deactivate, Deactivate.

To modify a license configuration using the command line

• update-license-configuration (AWS CLI)

• Update-LICMLicenseConfiguration (Tools for Windows PowerShell)

Delete a License ConfigurationBefore you can delete a license configuration, you must disassociate any resources. You can delete alicense configuration if you need to start over with new licensing rules. If the licensing terms from yoursoftware vendors change, you can disassociate existing resources, delete the license configuration, createa new license configuration to reflect the updated terms and associate it with the existing resources.

To delete a license configuration using the console



3. For License configurations, select the one to delete and choose Details.

4. For Resources, select each of the resources (individually or in bulk) and choose Disassociate. Repeatuntil the list is empty.

5. Choose Action, Delete, Delete.

To delete a license configuration using the command line

• delete-license-configuration (AWS CLI)

• Remove-LICMLicenseConfiguration (Tools for Windows PowerShell)

License Rules in License ManagerAfter license configuration rules are in place, they can be attached to the relevant launch mechanisms,where they can directly prevent the deployment of new resources that are non-compliant. Users in yourorganization can seamlessly launch EC2 instances from designated AMIs, and administrators can tracklicense inventory through the built-in License Manager dashboard. Launch controls and dashboard alertsallow easier compliance enforcement.

ImportantAWS does not participate in the audit process with software vendors. Customers are responsiblefor compliance and assume the responsibility of carefully understanding and capturing rulesinto License Manager based on their licensing agreements.

License tracking works from the time rules are attached to an instance until its termination. You defineyour usage limits and licensing rules, and License Manager tracks deployments while also alerting

11


https://docs.aws.amazon.com/cli/latest/reference/license-manager/update-license-configuration.html

https://docs.aws.amazon.com/powershell/latest/reference/items/Update-LICMLicenseConfiguration.html


https://docs.aws.amazon.com/cli/latest/reference/license-manager/delete-license-configuration.html

https://docs.aws.amazon.com/powershell/latest/reference/items/Remove-LICMLicenseConfiguration.html

AWS License Manager User GuideManually Associating License Configurations with AMIs

you to rule violations. If you have configured hard limits, License Manager can prevent resources fromlaunching.

When a tracked server is stopped or terminated, its license is released and returned to the pool ofavailable licenses.

NoteAWS treats license-tracking data as sensitive customer data accessible only through the AWSaccount that owns it. AWS does not have access to your license-tracking data. You control yourlicense-tracking data and you can delete it at any time.

Because organizations have differing approaches to operations and compliance, License Managersupports multiple launch mechanisms:

• Manual association of license configurations with AMIs — For tracking licenses for operating systemor other software, you can attach licensing rules to AMIs before publishing them for broader use inyour organization. Any deployments from these AMIs are then automatically tracked with LicenseManager without requiring any additional actions by users. You can also attach licensing rules to yourcurrent AMI building mechanisms such as Systems Manager Automation, VM Import/Export, andPacker.

• Amazon EC2 launch templates and AWS CloudFormation — If attaching licensing rules to AMIs isnot a preferred option, you can specify them as optional parameters in EC2 launch templates or AWSCloudFormation templates. Deployments using these templates are tracked using License Manager.You can enforce rules on EC2 launch templates or AWS CloudFormation templates by specifying one ormore license configuration IDs in the License Configurations field.

Manually Associating License Configurations withAMIsThe following procedure demonstrates how to associate and disassociate license configurations fromAMIs using the License Manager console. The procedures assume that you have at least one existinglicense configuration already configured. You can associate license configurations with any AMI that youhave access to, whether owned or shared.

To associate a license configuration with an AMI

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.2. In the left navigation pane, choose License configurations.3. For License configurations, choose the license configuration with which to work.4. Choose Actions, Associate AMI. The Associated Amazon Machine Images list displays the AMIs

already associated with the license configuration (if any).5. Choose Associate a new AMI.6. For Available AMIs, select one or more AMIs and choose Associate AMI, OK. Any new AMIs that you

associated now appear in the Associated Amazon Machine Images list.

To disassociate a license configuration from an AMI

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.2. In the left navigation pane, choose License configurations.3. For License configurations, select the license configuration with which to work.4. Choose Associated AMIs.5. For Associated Amazon Machine Images, select the AMI to disassociate and choose Disassociate

AMI, Disassociate.

12

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html

https://docs.aws.amazon.com/vm-import/latest/userguide/

https://www.packer.io/docs/builders/amazon.html

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/



AWS License Manager User GuideHost Resource Groups

Host Resource Groups in AWS License ManagerA Dedicated Host is a physical server with EC2 instance capacity fully dedicated to your use. A hostresource group is a collection of Dedicated Hosts that you can manage as a single entity. As you launchinstances, License Manager allocates the hosts and launches instances on them based on the settingsthat you configured. You cannot add existing Dedicated Hosts to a host resource group.

You can use host resource groups to separate hosts by purpose (for example, dev/test versus production),organizational unit, or license constraint. After you add a Dedicated Host to a host resource group, youcannot launch instances directly on the Dedicated Host, you must launch them using the host resourcegroup.

Settings

You can configure the following settings for a host resource group:

• Allocate hosts automatically–Indicates whether Amazon EC2 can allocate new hosts on your behalf iflaunching an instance in this host resource group would exceed its available capacity.

• Release hosts automatically–Indicates whether Amazon EC2 can release unused hosts on your behalf.An unused host has no running instances.

• Recover hosts automatically–Indicates whether Amazon EC2 can move instances from a host that hasfailed unexpectedly to a new host.

• Associated license configurations–The license configurations that can be used to launch instances inthis host resource group.

• Instance families–The types of instances that you can launch. By default, you can launch any instancetypes that are supported on a Dedicated Host. If you launch Nitro-based instances, then you canlaunch instances with different instance types in the same host resource group. Otherwise, you mustlaunch only instances with the same instance type in the same host resource group.

Contents• Create a Host Resource Group (p. 13)• Share a Host Resource Group (p. 14)• Launch an Instance in a Host Resource Group (p. 14)• Modify a Host Resource Group (p. 14)• Delete a Host Resource Group (p. 14)

Create a Host Resource GroupConfigure a host resource group to enable License Manager to manage your Dedicated Hosts. To bestutilize your most expensive licenses, you can associate one or more core- or socket-based licenseconfigurations with your host resource group. To best optimize host utilization, you can allow all core- orsocket-based license configurations with your host resource group.

To create a host resource group

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.2. In the left navigation pane, choose Host resource groups.3. Choose Create host resource group.4. For Host resource group details, specify a name and description for the host resource group.5. For EC2 Dedicated Host management settings, enable or disable the following settings as needed:

• Allocate hosts automatically

13

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-hosts-overview

url-ec2-user;instance-types.html#ec2-nitro-instances


AWS License Manager User GuideShare a Host Resource Group

• Release hosts automatically• Recover hosts automatically

6. (Optional) For Additional settings, select the instance families that you can launch in the hostresource group.

7. For License configurations, select one or more core- or socket-based license configurations.8. (Optional) For Tags, add one or more tags.9. Choose Create.

Share a Host Resource GroupYou can use AWS Resource Access Manager to shared your host resource groups through AWSOrganizations. After you share a host resource group and license configuration, member accounts canlaunch instances into the shared host resource group. The new hosts are allocated in the account thatowns the host resource group. The member account owns the instances. For more information, see theAWS RAM User Guide.

Launch an Instance in a Host Resource GroupWhen you launch an instance, you can specify a host resource group. For example, you can use thefollowing run-instances command. You must associate a core- or socket-based license configuration withthe AMI.

aws ec2 run-instances --min-count 2 --max-count 2 \--instance-type c5.2xlarge --image-id ami-0abcdef1234567890 \--placement="Tenancy=host,HostResourceGroupArn=arn"

You can also use the Amazon EC2 console. For more information, see Launching Instances into a HostResource Group in the Amazon EC2 User Guide.

Modify a Host Resource GroupYou can modify the settings for a host resource group at any time. You cannot set the host limit lowerthan the number of existing hosts in the host resource group. You cannot remove an instance type ifthere's an instance of that type running in the host resource group.

To modify a host resource group

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.2. In the left navigation pane, choose Host resource groups.3. Select the host resource group and choose Actions, Edit.4. Modify the settings as needed.5. Choose Save changes.

Delete a Host Resource GroupYou can delete a host resource group if it has no hosts.

To delete a host resource group


14


https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/how-dedicated-hosts-work.html#launching-hrg-instances

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/how-dedicated-hosts-work.html#launching-hrg-instances



AWS License Manager User GuideResource Inventory

2. In the left navigation pane, choose Host resource groups.

3. Select the host resource group and choose Actions, Delete.

4. When prompted for confirmation, choose Delete.

Resource Inventory in License ManagerLicense Manager allows you to discover on-premises applications using Systems Manager inventory, andthen to attach licensing rules to them. After licensing rules are attached to these servers, you can trackthem along with your AWS servers in the License Manager dashboard.

License Manager cannot, however, validate licensing rules for these servers at launch or terminationtime. To keep information about non-AWS servers up-to-date, you must periodically refresh theinventory information using the Search inventory section of the License Manager console.

Systems Manager stores data in its Inventory data for 30 days. During this period, License Managercounts a managed instance as active even if it is not pingable. After inventory data has been purged fromSystems Manager, License Manager marks the instance as inactive and updates local inventory data. Tokeep managed instance counts accurate, we recommend manually deregistering instances in SystemsManager so that License Manager can run cleanup operations.

Querying Systems Manager inventory requires a Resource Data Sync to store inventory in an AmazonS3 bucket, Amazon Athena to aggregate inventory data from organizational accounts, and AWS Glue toprovide a fast query experience. For more information, see Using Service-Linked Roles for AWS LicenseManager (p. 21).

Resource inventory tracking is also useful if your organization does not restrict AWS users from creatingAMI-derived instances or installing additional software on running instances. License Manager providesyou with a mechanism to easily discover these instances and applications using inventory search. Youcan attach rules to these discovered resources and track and validate them the same as instances createdfrom managed AMIs.

Contents

• Discover Resource Inventory (p. 15)

• Automated Discovery of Resource Inventory (p. 17)

Discover Resource InventoryLicense Manager uses Systems Manager inventory to discover software usage on premises. Afteryou associate a license configuration with on-premises servers, License Manager periodically collectssoftware inventory, updates licensing information, and refreshes its dashboards to report usage.

Tasks

• Setting Up for Inventory Search (p. 15)

• Using Inventory Search (p. 16)

• Associating a License Configuration with Discovered Inventory (p. 16)

• Disassociating a License Configuration and a Resource (p. 17)

Setting Up for Inventory SearchComplete the following requirements before using resource inventory search:

15



AWS License Manager User GuideDiscover Resource Inventory

• Enable cross-account inventory discovery by integrating License Manager with your AWS Organizationsaccount. For more information, see Settings in License Manager (p. 6).

• Create license configurations for the servers and applications to manage. For example, create a licenseconfiguration that reflects the terms of your licensing agreement with Microsoft for SQL ServerEnterprise.

Using Inventory SearchComplete the following steps to search your resource inventory. You can search for applications byname (for example, names that begin with "SQL Server") and the type of license included (for example, alicense that is not for "SQL Server Web").

To search your resource inventory

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.2. In the navigation pane, choose Search inventory.3. Use the filter options to scope the list of displayed resources.

The following filters and logical operators are supported for Amazon EC2 resources:

• Resource ID – The ID of the resource. Logical operators are Equals and Not equals.• Account ID – The ID of the AWS account that owns the resource. Logical operators are Equals and

Not equals.• Platform – The platform of the resource. Logical operators are Equals, Not equals, Begins with,

and Contains.• Application name – The name of the application. Logical operators are Equals and Begins with.• License included – The type of license included. Logical operators are Equals and Not equals.

Possible values are SQL Server Enterprise, SQL Server Standard, SQL Server Web, and WindowsServer Datacenter.

The following filters and logical operators are supported for Amazon RDS resources:

• Engine Edition– The edition of the database engine. Logical operator is Equals. Possible valuesare: Standard Edition, Standard Edition One, Standard Edition Two, and Enterprise Edition.

• License Pack– The license pack. Logical operator is Equals. Possible values are: Spatial andGraph, Active Data Guard, Label Security, Oracle On-Line Analytical Processing (OLAP), andDiagnostic Pack and Tuning Pack.

For more information, see Oracle Licensing in the Amazon RDS User Guide.4. Press Enter.

Associating a License Configuration with Discovered InventoryAfter you have identified the unmanaged resources that you need to manage, associate them with alicense configuration.

To associate a license configuration with a resource

1. From the Search inventory page, select one or more inventory items from the result of usinginventory search.

2. Choose Associate license configuration.3. (Optional) Select Share license configuration with all my member accounts.

16


https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Oracle.html#Oracle.Concepts.Licensing

AWS License Manager User GuideAutomated Discovery of Resource Inventory

4. Choose the appropriate license configuration and then choose Associate.

Disassociating a License Configuration and a ResourceIf the licensing terms from your software vendors change, you can disassociate existing resources andthen delete the license configuration.

To disassociate a license configuration and a resource


2. In the left navigation pane, choose License configuration.

3. Choose the name of the license configuration.

4. Choose Associated resources.

5. Select each of the resources to disassociate from the license configuration and then chooseDisassociate resource.

Automated Discovery of Resource InventoryLicense Manager uses Systems Manager inventory to discover software usage on Amazon EC2 instancesand on-premises instances. You can add product information to your license configuration and LicenseManager will track the instances that have those products installed.

Using Automated DiscoveryTo use automated discovery, you must add product information to your license configuration. You can doso either when you create the license configuration or when you associate the license configuration toresources using search inventory.

You cannot disassociate instances tracked by automated discovery. You could remove the productinformation from the license configuration and handle discovery yourself. However, we recommend thatyou enable License Manager to perform automated discovery on your behalf.

Prerequisites

• Enable cross-account inventory discovery by integrating License Manager with your AWS Organizationsaccount. For more information, see Settings in License Manager (p. 6).

• Install Systems Manager inventory on your instances.

To get started with automated discovery

1. Create license configurations for the servers and applications to manage. You can optionallyselect the products listed under Product information. For more information, see Create a LicenseConfiguration (p. 9).

2. (Optional) To track bring your own license (BYOL) software for products that were not listed in theprevious step, do the following:

a. Open the Search inventory page.

b. Select the resource and choose Associate license configuration. Select a license configuration.

c. Under Add product information, select the product.

d. Choose Associate.

3. Track usage through the License Manager dashboard.

17



AWS License Manager User GuideDashboard

Dashboard in License ManagerThe Dashboard section of the AWS License Manager console provides graphs to track the licenseconsumption associate with each license configuration. The dashboard also displays alerts resulting fromlicense rule violations.

The following information is available in the graph for a license configuration:

• License configuration name• License type• Licenses consumed• Number of licenses remaining• Whether the rules are enforced• Number of hosts for each tenancy type

18

AWS License Manager User GuideData Protection

Security in AWS License ManagerCloud security at AWS is the highest priority. As an AWS customer, you benefit from a data center andnetwork architecture that is built to meet the requirements of the most security-sensitive organizations.

Security is a shared responsibility between AWS and you. The shared responsibility model describes thisas security of the cloud and security in the cloud:

• Security of the cloud – AWS is responsible for protecting the infrastructure that runs AWS services inthe AWS Cloud. AWS also provides you with services that you can use securely. Third-party auditorsregularly test and verify the effectiveness of our security as part of the AWS Compliance Programs.To learn about the compliance programs that apply to License Manager, see AWS Services in Scope byCompliance Program.

• Security in the cloud – Your responsibility is determined by the AWS service that you use. You are alsoresponsible for other factors including the sensitivity of your data, your company’s requirements, andapplicable laws and regulations

This documentation helps you understand how to apply the shared responsibility model when usingLicense Manager. It shows you how to configure License Manager to meet your security and complianceobjectives. You also learn how to use other AWS services that help you to monitor and secure yourLicense Manager resources.

Contents• Data Protection in AWS License Manager (p. 19)• Identity and Access Management for AWS License Manager (p. 20)• Using Service-Linked Roles for AWS License Manager (p. 21)• Compliance Validation for AWS License Manager (p. 29)• Resilience in AWS License Manager (p. 29)• Infrastructure Security in AWS License Manager (p. 29)• AWS License Manager and Interface VPC Endpoints (AWS PrivateLink) (p. 30)

Data Protection in AWS License ManagerAWS License Manager conforms to the AWS shared responsibility model, which includes regulationsand guidelines for data protection. AWS is responsible for protecting the global infrastructure thatruns all the AWS services. AWS maintains control over data hosted on this infrastructure, including thesecurity configuration controls for handling customer content and personal data. AWS customers andAPN partners, acting either as data controllers or data processors, are responsible for any personal datathat they put in the AWS Cloud.

For data protection purposes, we recommend that you protect AWS account credentials and set upindividual user accounts with AWS Identity and Access Management (IAM), so that each user is given onlythe permissions necessary to fulfill their job duties. We also recommend that you secure your data in thefollowing ways:

• Use multi-factor authentication (MFA) with each account.• Use TLS to communicate with AWS resources.• Set up API and user activity logging with AWS CloudTrail.• Use AWS encryption solutions, along with all default security controls within AWS services.• Use advanced managed security services such as Amazon Macie, which assists in discovering and

securing personal data that is stored in Amazon S3.

19

http://aws.amazon.com/compliance/shared-responsibility-model/

http://aws.amazon.com/compliance/programs/

http://aws.amazon.com/compliance/services-in-scope/


http://aws.amazon.com/compliance/shared-responsibility-model/

AWS License Manager User GuideEncryption at Rest

We strongly recommend that you never put sensitive identifying information, such as your customers'account numbers, into free-form fields or metadata, such as function names and tags. Any data that youenter into metadata might get picked up for inclusion in diagnostic logs. When you provide a URL to anexternal server, don't include credentials information in the URL to validate your request to that server.

For more information about data protection, see the AWS Shared Responsibility Model and GDPR blogpost on the AWS Security Blog.

Encryption at RestLicense Manager stores data in an S3 bucket in the master account. The bucket is configured usingAmazon S3-managed encryption keys (SSE-S3).

Identity and Access Management for AWS LicenseManager

AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securelycontrol access to AWS resources. IAM administrators control who can be authenticated (signed in) andauthorized (have permissions) to use AWS resources. IAM enables you to create users and groups underyour AWS account. You control the permissions that users have to perform tasks using AWS resources.You can use IAM for no additional charge.

By default, IAM users don't have permissions for License Manager resources and operations. To allow IAMusers to manage License Manager resources, you must create an IAM policy that explicitly grants thempermissions, and attach the policy to the IAM users or groups that require those permissions.

When you attach a policy to a user or group of users, it allows or denies the users permission to performthe specified tasks on the specified resources. For more information, see Policies and Permissions in theIAM User Guide guide.

Policy StructureAn IAM policy is a JSON document that consists of one or more statements. Each statement is structuredas follows.

{ "Statement":[{ "Effect":"effect", "Action":"action", "Resource":"arn", "Condition":{ "condition":{ "key":"value" } } } ]}

There are various elements that make up a statement:

• Effect: The effect can be Allow or Deny. By default, IAM users don't have permission to use resourcesand API actions, so all requests are denied. An explicit allow overrides the default. An explicit denyoverrides any allows.

• Action: The action is the specific API action for which you are granting or denying permission.

20

http://aws.amazon.com/blogs/security/the-aws-shared-responsibility-model-and-gdpr/

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html

AWS License Manager User GuideExample Policies for License Manager

• Resource: The resource that's affected by the action. Some License Manager API actions allow you toinclude specific resources in your policy that can be created or modified by the action. To specify aresource in the statement, you need to use its Amazon Resource Name (ARN). For more information,see Actions Defined by AWS License Manager.

• Condition: Conditions are optional. They can be used to control when your policy is in effect. For moreinformation, see Condition Keys for AWS License Manager.

Example Policies for License ManagerIn an IAM policy statement, you can specify any API action from any service that supports IAM. ForLicense Manager, use the following prefix with the name of the API action: license-manager:. Forexample:

• license-manager:CreateLicenseConfiguration

• license-manager:ListLicenseConfigurations

To specify multiple actions in a single statement, separate them with commas as follows:

"Action": ["license-manager:action1", "license-manager:action2"]

You can also specify multiple actions using wildcards. For example, you can specify all License ManagerAPI actions whose name begins with the word "List" as follows:

"Action": "license-manager:List*"

To specify all License Manager API actions, use the * wildcard as follows:

"Action": "license-manager:*"

Using Service-Linked Roles for AWS LicenseManager

AWS License Manager uses AWS Identity and Access Management (IAM) service-linked roles. A service-linked role is a unique type of IAM role that is linked directly to License Manager. Service-linked rolesare predefined by License Manager and include all the permissions that the service requires to call otherAWS services on your behalf.

A service-linked role makes setting up License Manager easier because you don’t have to manually addthe necessary permissions. License Manager defines the permissions of its service-linked roles, and unlessdefined otherwise, only License Manager can assume its roles. The defined permissions include the trustpolicy and the permissions policy, and that permissions policy cannot be attached to any other IAMentity.

You can delete a service-linked role only after first deleting the related resources. This protects yourLicense Manager resources because you can't inadvertently remove permissions to access the resources.

License Manager operations depend on three service-linked roles, as described in the following sections.

Contents• License Manager–Core Role (p. 22)• License Manager–Master Account Role (p. 24)

21

https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awslicensemanager.html#awslicensemanager-actions-as-permissions

https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awslicensemanager.html#awslicensemanager-policy-keys

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role

AWS License Manager User GuideCore Role

• License Manager–Member Account Role (p. 27)

License Manager–Core RoleLicense Manager requires a service-linked role to manage licenses on your behalf.

Permissions for the Core License Manager RoleLicense Manager uses the service-linked role named AWSServiceRoleForAWSLicenseManagerRole. Thisallows License Manager access to AWS resources to manage licenses on your behalf.

The AWSServiceRoleForAWSLicenseManagerRole service-linked role trusts the license-manager.amazonaws.com service to assume the role.

The role permissions policy allows License Manager to complete the following actions on the specifiedresources.

Action Resource ARN

s3:GetBucketLocation arn:aws:s3:::aws-license-manager-service-*

s3:ListBucket arn:aws:s3:::aws-license-manager-service-*

s3:PutObject arn:aws:s3:::aws-license-manager-service-*

sns:Publish arn:aws::sns:*:*:aws-license-manager-service-*

sns:ListTopics *

ec2:DescribeInstances *

ec2:DescribeImages *

ec2:DescribeHosts *

ssm:ListInventoryEntries *

ssm:GetInventory *

ssm:CreateAssociation *

organizations:ListAWSServiceAccessForOrganization*

organizations:DescribeOrganization *

You must configure permissions to allow an IAM entity (such as a user, group, or role) to create, edit, ordelete a service-linked role. For more information, see Service-Linked Role Permissions in the IAM UserGuide.

Creating a Service-Linked Role for License ManagerYou don't need to manually create a service-linked role. When you complete the License Manager first-run experience form the first time that you visit the License Manager console, the service-linked role isautomatically created for you.

22

https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions

AWS License Manager User GuideCore Role

You can also use the IAM console, AWS CLI, or IAM API to create a service-linked role manually. For moreinformation, see Creating a Service-Linked Role in the IAM User Guide.

ImportantThis service-linked role can appear in your account if you completed an action in another servicethat uses the features supported by this role. If you were using License Manager before January1, 2017, when it began supporting service-linked roles, then License Manager created theAWSServiceRoleForAWSLicenseManagerRole role in your account. For more information, see ANew Role Appeared in My IAM Account.

Creating a Service-Linked Role in License Manager

You can use the License Manager console to create a service-linked role.

To create a service-linked role

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.2. Choose Start using License Manager.3. In the IAM Permissions (one-time-setup) form, select I grant AWS License Manager the required

permissions, then choose Continue.

You can also use the IAM console to create a service-linked role with the License Manager usecase. In the AWS CLI or the AWS API, use IAM to create a service-linked role with the license-manager.amazonaws.com service name. For more information, see Creating a Service-Linked Role inthe IAM User Guide.

If you delete this service-linked role, you can use the same IAM process to create the role again.

Editing a Service-Linked Role for License ManagerLicense Manager does not allow you to edit the AWSServiceRoleForAWSLicenseManagerRole service-linked role. After you create a service-linked role, you cannot change the name of the role becausevarious entities might reference the role. However, you can edit the description of the role using IAM. Formore information, see Editing a Service-Linked Role in the IAM User Guide.

Deleting a Service-Linked Role for License ManagerIf you no longer need to use a feature or service that requires a service-linked role, we recommendthat you delete that role. That way, you only have entities that are actively monitored or maintained.However, you must clean up your service-linked role before you can manually delete it.

Cleaning Up a Service-Linked Role

Before you can use IAM to delete a service-linked role, you must first delete all resources used by therole. This means disassociating any license configurations from associated instances and AMIs, and thendeleting the license configurations.

NoteIf License Manager is using the role when you try to delete the resources, then the deletionmight fail. If that happens, wait for a few minutes and try the operation again.

To delete License Manager resources used by AWSServiceRoleForAWSLicenseManagerRole

1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.2. In the navigation pane, choose License configuration.3. For a specific license configuration for which you are the owner, disassociate all associated AMIs and

resources.4. While still on the license configuration page, delete the license configuration.

23

https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role

https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_roles.html#troubleshoot_roles_new-role-appeared




https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role


AWS License Manager User GuideMaster Account Role

5. Repeat steps 2 and 3 until all license configurations have been deleted.

Manually Delete the Service-Linked Role

Use the IAM console, the AWS CLI, or the AWS API to delete theAWSServiceRoleForAWSLicenseManagerRole service-linked role. If youare also using AWSLicenseManagerMasterAccountRole (p. 24) andAWSLicenseManagerMemberAccountRole (p. 27), delete those roles first. For more information, seeDeleting a Service-Linked Role in the IAM User Guide.

License Manager–Master Account RoleLicense Manager requires a service-linked role to perform license management.

Permissions for License Manager–Master Account RoleLicense Manager–Master Account uses the service-linked role namedAWSServiceRoleForAWSLicenseManagerMasterAccountRole. The role allows License Manager access toAWS resources to manage license management operations for a central master account on your behalf.

The AWSServiceRoleForAWSLicenseManagerMasterAccountRole service-linked role trusts thelicense-manager.master-account.amazonaws.com service to assume the role.


Action Resource ARN

s3:GetBucketLocation arn:aws:s3:::aws-license-manager-service-*

s3:ListBucket arn:aws:s3:::aws-license-manager-service-*

s3:GetLifecycleConfiguration arn:aws:s3:::aws-license-manager-service-*

s3:PutLifecycleConfiguration arn:aws:s3:::aws-license-manager-service-*

s3:GetBucketPolicy arn:aws:s3:::aws-license-manager-service-*

s3:PutBucketPolicy arn:aws:s3:::aws-license-manager-service-*

s3:AbortMultipartUpload arn:aws:s3:::aws-license-manager-service-*

s3:PutObject arn:aws:s3:::aws-license-manager-service-*

s3:GetObject arn:aws:s3:::aws-license-manager-service-*

s3:ListBucketMultipartUploads arn:aws:s3:::aws-license-manager-service-*

24

https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role


Action Resource ARN

s3:ListMultipartUploadParts arn:aws:s3:::aws-license-manager-service-*

s3:DeleteObject arn:aws:s3:::aws-license-manager-service-*/resource-sync/*

athena:GetQueryExecution *

athena:GetQueryResults *

athena:StartQueryExecution *

glue:GetTable *

glue:GetPartition *

glue:GetPartitions *

organizations:DescribeOrganization *

organizations:ListAccounts *

organizations:DescribeAccount *

organizations:ListChildren *

organizations:ListParents *

organizations:ListAccountsForParent *

organizations:ListRoots *

organizations:ListAWSServiceAccessForOrganization*

ram:GetResourceShares *

ram:GetResourceShareAssociations *

ram:TagResource *

ram:CreateResourceShare *

ram:AssociateResourceShare *

ram:DisassociateResourceShare *

ram:UpdateResourceShare *

ram:DeleteResourceShare *


Creating a License Manager–Master Account Service-Linked RoleYou don't need to manually create this service-linked role. When you configure cross-account licensemanagement in the AWS Management Console, License Manager creates the service-linked role for you.

25



NoteTo make use of cross-account support in License Manager, you must be using AWSOrganizations.

If you delete this service-linked role and then need to create it again, you can use the same process to re-create the role in your account.


ImportantThis service-linked role can appear in your account if you completed an action in anotherservice that uses the features supported by this role. If you were using License Manager beforeJanuary 1, 2017, when it began supporting service-linked roles, then License Manager createdAWSServiceRoleForAWSLicenseManagerMasterAccountRole in your account. For moreinformation, see A New Role Appeared in My IAM Account.

Creating a License Manager–Master Account Service-Linked Role

You can use the License Manager console to create this service-linked role.


1. Open the License Manager console at https://console.aws.amazon.com/license-manager/.2. Choose Settings, Edit.3. Choose Link AWS Organization accounts.4. Choose Apply.

You can also use the IAM console to create a service-linked role with the License Manager–MasterAccount use case. In the AWS CLI or the AWS API, use IAM to create a service-linked role with thelicense-manager.master-account.amazonaws.com service name. For more information, seeCreating a Service-Linked Role in the IAM User Guide.


Editing a Service-Linked Role for License ManagerLicense Manager does not allow you to edit theAWSServiceRoleForAWSLicenseManagerMasterAccountRole service-linked role. After you create aservice-linked role, you cannot change the name of the role because various entities might reference therole. However, you can edit the description of the role using IAM. For more information, see Editing aService-Linked Role in the IAM User Guide.

Deleting a Service-Linked Role for License ManagerYou don't need to manually delete the AWSServiceRoleForAWSLicenseManagerMasterAccountRolerole. When you CompleteThisDeleteActionInThisService-2 in the AWS Management Console, the AWSCLI, or the AWS API, License Manager cleans up the resources and deletes the service-linked role for you.

If you no longer need to use a feature or service that requires a service-linked role, we recommendthat you delete that role. That way, you only have entities that are actively monitored or maintained.However, you must clean up your service-linked role before you can manually delete it.


Use the IAM console, AWS CLI, or AWS API to delete theAWSServiceRoleForAWSLicenseManagerMasterAccountRole service-linked role. For more information,see Deleting a Service-Linked Role in the IAM User Guide.

26








AWS License Manager User GuideMember Account Role

License Manager–Member Account RoleLicense Manager requires a service-linked role that allows the master account to manage licenses.

Permissions for License Manager–Member Account RoleLicense Manager–Member Account uses the service-linked role namedAWSServiceRoleForAWSLicenseManagerMemberAccountRole. This role allows License Manager toaccess AWS resources for license management operations from a configured master account on yourbehalf.

The AWSServiceRoleForAWSLicenseManagerMemberAccountRole service-linked role trusts thelicense-manager.member-account.amazonaws.com service to assume the role.


Action Resource ARN

license-manager:UpdateLicenseSpecificationsForResource

*

ssm:ListInventoryEntries *

ssm:GetInventory *

ssm:CreateAssociation *

ssm:CreateResourceDataSync *

ssm:DeleteResourceDataSync *

ssm:ListResourceDataSync *

ssm:ListAssociations *

ram:AcceptResourceShareInvitation *

ram:GetResourceShareInvitations *


Creating a Service-Linked Role for License Manager–MemberAccountYou don't need to manually create a service-linked role. When you enable integration with AWSOrganizations from the master account in the License Manager console on the Settings page, the AWSCLI using update-service-settings, or the AWS API using UpdateServiceSettings, LicenseManager creates the service-linked role for you in the Organizations member accounts.

If you delete this service-linked role and then need to create it again, you can use the same process to re-create the role in your account.


27



AWS License Manager User GuideMember Account Role

ImportantThis service-linked role can appear in your account if you completed an action in another servicethat uses the features supported by this role. If you were using the License Manager servicebefore January 1, 2017, when it began supporting service-linked roles, then License Managercreated the AWSServiceRoleForAWSLicenseManagerMemberAccountRole role in your account.For more information, see A New Role Appeared in My IAM Account.

Creating a Service-Linked Role in License Manager

You can use License Manager commands from the AWS Command Line Interface to create a service-linked role.


1. Log into your AWS Organizations master account.


3. In the left navigation pane, choose Settings, Edit.

4. Choose Link AWS Organization accounts.

5. Choose Apply. This creates the roles AWSServiceRoleForAWSLicenseManagerRole (p. 22) andAWSServiceRoleForAWSLicenseManagerMemberAccountRole (p. 27) in all child accounts.

You can also use the IAM console to create a service-linked role with the License Manager - MemberAccount use case. In the AWS CLI or AWS API, create a service-linked role with the license-manager.member-account.amazonaws.com service name. For more information, see Creating aService-Linked Role in the IAM User Guide.


Editing a Service-Linked Role for License Manager

License Manager does not allow you to edit theAWSServiceRoleForAWSLicenseManagerMemberAccountRole service-linked role. After you create aservice-linked role, you cannot change the name of the role because various entities might reference therole. However, you can edit the description of the role using IAM. For more information, see Editing aService-Linked Role in the IAM User Guide.

Deleting a Service-Linked Role for License Manager

You don't need to manually delete the AWSServiceRoleForAWSLicenseManagerMemberAccountRolerole. When you CompleteThisDeleteActionInThisService-3 in the AWS Management Console, AWS CLI, orAWS API, License Manager cleans up the resources and deletes the service-linked role for you.

If you no longer need to use a feature or service that requires a service-linked role, we recommendthat you delete that role. That way, you only have entities that are actively monitored or maintained.However, you must clean up your service-linked role before you can manually delete it.


Use the IAM console, AWS CLI, or AWS API to delete theAWSServiceRoleForAWSLicenseManagerMemberAccountRole service-linked role. For moreinformation, see Deleting a Service-Linked Role in the IAM User Guide.

28








AWS License Manager User GuideCompliance Validation

Compliance Validation for AWS License ManagerThird-party auditors assess the security and compliance of AWS License Manager as part of multiple AWScompliance programs. These include SOC, PCI, FedRAMP, HIPAA, and others.

For a list of AWS services in scope of specific compliance programs, see AWS Services in Scope byCompliance Program. For general information, see AWS Compliance Programs.

You can download third-party audit reports using AWS Artifact. For more information, see DownloadingReports in AWS Artifact.

Your compliance responsibility when using License Manager is determined by the sensitivity of your data,your company's compliance objectives, and applicable laws and regulations. AWS provides the followingresources to help with compliance:

• Security and Compliance Quick Start Guides – These deployment guides discuss architecturalconsiderations and provide steps for deploying security- and compliance-focused baselineenvironments on AWS.

• Architecting for HIPAA Security and Compliance Whitepaper – This whitepaper describes howcompanies can use AWS to create HIPAA-compliant applications.

• AWS Compliance Resources – This collection of workbooks and guides might apply to your industryand location.

• Evaluating Resources with Rules in the AWS Config Developer Guide – AWS Config; assesses how wellyour resource configurations comply with internal practices, industry guidelines, and regulations.

• AWS Security Hub – This AWS service provides a comprehensive view of your security state within AWSthat helps you check your compliance with security industry standards and best practices.

Resilience in AWS License ManagerThe AWS global infrastructure is built around AWS Regions and Availability Zones. Regions providemultiple physically separated and isolated Availability Zones, which are connected through low-latency,high-throughput, and highly redundant networking. With Availability Zones, you can design and operateapplications and databases that automatically fail over between zones without interruption. AvailabilityZones are more highly available, fault tolerant, and scalable than traditional single or multiple datacenter infrastructures.

For more information about AWS Regions and Availability Zones, see AWS Global Infrastructure.

Infrastructure Security in AWS License ManagerAs a managed service, AWS License Manager is protected by the AWS global network security proceduresthat are described in the Amazon Web Services: Overview of Security Processes whitepaper.

You use AWS published API calls to access License Manager through the network. Clients must supportTransport Layer Security (TLS) 1.0 or later. We recommend TLS 1.2 or later. Clients must also supportcipher suites with perfect forward secrecy (PFS) such as Ephemeral Diffie-Hellman (DHE) or Elliptic CurveEphemeral Diffie-Hellman (ECDHE). Most modern systems such as Java 7 and later support these modes.

Additionally, requests must be signed using an access key ID and a secret access key that is associatedwith an IAM principal. Or you can use the AWS Security Token Service (AWS STS) to generate temporarysecurity credentials to sign requests.

29



http://aws.amazon.com/compliance/programs/

https://docs.aws.amazon.com/artifact/latest/ug/downloading-documents.html

https://docs.aws.amazon.com/artifact/latest/ug/downloading-documents.html

http://aws.amazon.com/quickstart/?awsf.quickstart-homepage-filter=categories%23security-identity-compliance

https://d0.awsstatic.com/whitepapers/compliance/AWS_HIPAA_Compliance_Whitepaper.pdf

http://aws.amazon.com/compliance/resources/

https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html

https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html

http://aws.amazon.com/about-aws/global-infrastructure/

https://d0.awsstatic.com/whitepapers/Security/AWS_Security_Whitepaper.pdf

https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html

AWS License Manager User GuideVPC Endpoints (AWS PrivateLink)

AWS License Manager and Interface VPC Endpoints(AWS PrivateLink)

You can establish a private connection between your virtual private cloud (VPC) and AWS LicenseManager by creating an interface VPC endpoint. Interface endpoints are powered by AWS PrivateLink, atechnology that enables you to privately access the License Manager API without an internet gateway,NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC don't need publicIP addresses to communicate with License Manager. Traffic between your VPC and License Manager doesnot leave the Amazon network.

Each interface endpoint is represented by one or more Elastic Network Interfaces in your subnets.

For more information, see Interface VPC endpoints (AWS PrivateLink) in the Amazon VPC User Guide.

Create an Interface VPC Endpoint for LicenseManagerCreate an interface endpoint for License Manager using one of the following service names:

• com.amazonaws.region.license-manager

• com.amazonaws.region.license-manager-fips

If you enable private DNS for the endpoint, you can make API requests to License Manager using itsdefault DNS name for the Region. For example, license-manager.region.amazonaws.com.

For more information, see Creating an Interface Endpoint in the Amazon VPC User Guide.

Create a VPC Endpoint Policy for License ManagerYou can attach a policy to your VPC endpoint to control access to License Manager. The policy specifiesthe following information:

• The principal that can perform actions.

• The actions that can be performed.

• The resource on which the actions can be performed.

The following is an example of an endpoint policy for License Manager. When attached to an endpoint,this policy grants access to the specified License Manager actions for all principals on all resources.

{ "Statement": [ { "Principal": "*", "Effect": "Allow", "Action": [ "license-manager:*" ], "Resource": "*" } ]}

30

http://aws.amazon.com/privatelink

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html

https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint

AWS License Manager User GuideCreate a VPC Endpoint Policy for License Manager

For more information, see Controlling access to services using VPC endpoints in the Amazon VPC UserGuide.

31

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html

AWS License Manager User GuideCross-Account Discovery Error

Troubleshooting AWS LicenseManager

The following information can help you troubleshoot issues when using AWS License Manager. Beforeyou start, confirm that your License Manager setup meets the requirements stated in Settings in LicenseManager (p. 6).

Cross-Account Discovery ErrorWhile setting up cross-account discovery, you may encounter the following error message on the SearchInventory page:

Athena Exception: Athena Query failed because - Insufficient permissions to execute the query. Pleasemigrate your Catalog to enable access to this database.

This can occur if your Athena service uses the Athena-managed data catalog rather than the AWS GlueData Catalog. For upgrade instructions, see Upgrading to the AWS Glue Data Catalog Step-by-Step.

Master Account Cannot Disassociate Resourcesfrom a License Configuration

If a member account of an Organization deletes theAWSServiceRoleForAWSLicenseManagerMemberAccountRole Service Linked Role (SLR) in itsaccount, and there are member-owned resources associated with a license configuration, the masteraccount is prevented from disassociating licenses from those member-account resources. This meansthat the member account resources will continue to consume licenses from the master account pool. Toallow the master account to disassociate resources, restore the SLR.

This behavior accounts for cases when a customer prefers not to allow the master account to performsome actions affecting member-account resources.

Systems Manager Inventory Is Out of DateSSM stores data in its Inventory data for 30 days. During this period, License Manager counts a managedinstance as active even if it is not pingable. Once inventory data has been purged from SSM, LicenseManager marks the instance as inactive and updates local inventory data. To keep managed instancecounts accurate, we recommend manually deregistering instances in SSM so that License Manager canrun cleanup operations.

Apparent Persistence of De-Registered AMILicense Manager purges stale associations between resources and license configurations once every fewhours. If an AMI associated with a license configuration is deregistered through Amazon EC2, The AMImay briefly continue to appear in the License Manager resource inventory before being purged.

32

https://docs.aws.amazon.com/athena/latest/ug/glue-upgrade.html

AWS License Manager User GuideNew Child Account Instances Slow toAppear in Master Resource Inventory

New Child Account Instances Slow to Appear inMaster Resource Inventory

When cross-account support is enabled, License Manager updates customer accounts at 1 PM dailyby default. Instances added later in the day show up in the master account resource inventory onthe following day. You can change the frequency at which the update script runs by editing theLicenseManagerResourceSynDataProcessJobTrigger in the AWS Glue console for the masteraccount.

After Enabling Cross-Account Mode, Child AccountInstances Slow to Appear

When you enable cross-account mode in License Manager, instances in child accounts may take anywherefrom a few minutes to a few hours to appear in the resource inventory. The time depends on the numberof child accounts and the number of instances in each child account.

Cross-Account Discovery Cannot Be DisabledOnce an account is configured for cross-account discovery, it is impossible to revert to single-accountdiscovery.

Child Account User Cannot Associate SharedLicense Configuration with an Instance

When this occurs and cross-account discovery has been enabled, check for the following:

• The child account has been removed from the organization.• The child account has been removed from the resource share created in the master account.• The license configuration has been removed from the resource share.

Linking AWS Organizations Accounts FailsIf the Settings page reports this error, it means that an account is not a member of an organization forthe following reasons:

• A child account was removed from the organization.• A customer turned off access to License Manager from organization console of the master account.

33

AWS License Manager User GuideLicense Manager Information in CloudTrail

Logging AWS License Manager APICalls with AWS CloudTrail

AWS License Manager is integrated with AWS CloudTrail, a service that provides a record of actionstaken by a user, role, or an AWS service in License Manager. CloudTrail captures all API calls for LicenseManager as events. The calls captured include calls from the License Manager console and code callsto the License Manager API operations. If you create a trail, you can enable continuous delivery ofCloudTrail events to an Amazon S3 bucket, including events for License Manager. If you don't configurea trail, you can still view the most recent events in the CloudTrail console in Event history. Using theinformation collected by CloudTrail, you can determine the request that was made to License Manager,the IP address from which the request was made, who made the request, when it was made, andadditional details.

To learn more about CloudTrail, see the AWS CloudTrail User Guide.

License Manager Information in CloudTrailCloudTrail is enabled on your AWS account when you create the account. When activity occurs in LicenseManager, that activity is recorded in a CloudTrail event along with other AWS service events in Eventhistory. You can view, search, and download recent events in your AWS account. For more information,see Viewing Events with CloudTrail Event History.

For an ongoing record of events in your AWS account, including events for License Manager, create atrail. A trail enables CloudTrail to deliver log files to an Amazon S3 bucket. By default, when you createa trail in the console, the trail applies to all AWS Regions. The trail logs events from all Regions in theAWS partition and delivers the log files to the Amazon S3 bucket that you specify. Additionally, you canconfigure other AWS services to further analyze and act upon the event data collected in CloudTrail logs.For more information, see the following:

• Overview for Creating a Trail• CloudTrail Supported Services and Integrations• Configuring Amazon SNS Notifications for CloudTrail• Receiving CloudTrail Log Files from Multiple Regions and Receiving CloudTrail Log Files from Multiple

Accounts

All License Manager actions are logged by CloudTrail and are documented in the AWS License ManagerAPI Reference. For example, calls to the CreateLicenseConfiguration, ListResourceInventoryand DeleteLicenseConfiguration actions generate entries in the CloudTrail log files.

Every event or log entry contains information about who generated the request. The identityinformation helps you determine the following:

• Whether the request was made with root or AWS Identity and Access Management (IAM) usercredentials.

• Whether the request was made with temporary security credentials for a role or federated user.• Whether the request was made by another AWS service.

For more information, see the CloudTrail userIdentity Element.

34

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-aws-service-specific-topics.html#cloudtrail-aws-service-specific-topics-integrations

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/getting_notifications_top_level.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html

https://docs.aws.amazon.com/license-manager/latest/APIReference/

https://docs.aws.amazon.com/license-manager/latest/APIReference/

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html

AWS License Manager User GuideUnderstanding License Manager Log File Entries

Understanding License Manager Log File EntriesA trail is a configuration that enables delivery of events as log files to an Amazon S3 bucket that youspecify. CloudTrail log files contain one or more log entries. An event represents a single request fromany source and includes information about the requested action, the date and time of the action, requestparameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so theydon't appear in any specific order.

The following example shows a CloudTrail log entry that demonstrates theDeleteLicenseConfiguration action.

{ "eventVersion":"1.05", "userIdentity":{ "type":"IAMUser", "principalId":"AIDAIF2U5EXAMPLEH5AP6", "arn":"arn:aws:iam::O12345678901:user/Administrator", "accountId":"O12345678901", "accessKeyId":"AKIDEXAMPLE", "userName":"Administrator" }, "eventTime":"2019-02-15T06:48:37Z", "eventSource":"license-manager.amazonaws.com", "eventName":"DeleteLicenseConfiguration", "awsRegion":"us-east-1", "sourceIPAddress":"203.0.113.83", "userAgent":"Coral/Netty4", "requestParameters":{ "licenseConfigurationArn":"arn:aws:license-manager:us-east-1:O12345678901:license-configuration:lic-9ab477f4bEXAMPLE55f3ec08a5423f77" }, "responseElements":null, "requestID":"3366df5f-4166-415f-9437-c38EXAMPLE48", "eventID":"6c2c949b-1a81-406a-a0d7-52EXAMPLE5bd", "eventType":"AwsApiCall", "recipientAccountId":"O12345678901"}

35


Document History for AWS LicenseManager

The following table describes the releases of AWS License Manager.

Feature Description Date

Track Oracle deployments onAmazon RDS

Track license usage for Oracledatabase engine editions andlicensing packs on Amazon RDS.

March 23, 2020

Host resource groups Configure a host resource groupto enable License Manager tomanage your Dedicated Hosts.

December 1, 2019

Automated software discovery Configure License Managerto search for newly installedoperating systems orapplications and attachthe corresponding licenseconfigurations to the instances.

December 1, 2019

Differentiate between licenseincluded and bring your ownlicense

Filter your search results basedon whether you are usinglicenses provided by Amazon oryour own licenses.

November 8, 2019

Attach licenses to on-premisesresources

After you attach licenses to anon-premises instance, LicenseManager periodically collectssoftware inventory, updateslicensing information, andreports usage.

March 8, 2019

AWS License Manager initialrelease

Initial service launch November 28, 2018

36

Documents

AWS License Manager€¦ · AWS License Manager User Guide If you are responsible for managing licenses in your organization, you can use License Manager to set up licensing rules,