Enterprise customers with multiple AWS accounts want to subscribe once to an AWS Marketplace product and have all accounts in the organization deploy AWS Marketplace solutions without needing each account to subscribe first.

AWS Control Tower helps customers create accounts and manage many account configurations and best practices. AWS Service Catalog helps customers deploy AWS resources using a repeatable process that follows best practice for standardization, compliance, and security considerations.

Managing AWS Marketplace licenses across accounts can be complex. Customers want to automate this as part of their normal solution process. In this blog post, we will show you how to use AWS Control Tower and AWS Service Catalog to grant AWS Marketplace licenses to accounts managed by Control Tower, enabling you to easily use AWS Marketplace products in your solutions and services.

This solution uses the following AWS services:

Most of the resources are set up for you with an AWS CloudFormation stack.

Terminology

For information about AWS Service Catalog concepts and terminology used in this post, see Overview of AWS Service Catalog.

Solution overview

The following diagram shows the solution architecture for deploying AWS Marketplace licenses to accounts managed by AWS Control Tower.The administrator deploys the CloudFormation template to configure the environment. The AWS Marketplace administrator uses AWS Service Catalog to deploy license grants to recipient accounts. The end users use AWS Service Catalog to deploy the AWS Marketplace product.

Figure 1: Solution architecture diagram

Administrator process

A. The administrator deploys an AWS CloudFormation template that creates resources in the management account, gets the AWS Marketplace license information, and then creates an AWS Service Catalog product that can be used to deploy licenses to other accounts.

B. The administrator uses the AWS Service Catalog product to deploy an AWS Marketplace license to a managed account and creates an AWS Service Catalog product in the managed account for the AWS Marketplace product. This step can also be used to update the AWS Service Catalog product with new accounts and AWS Marketplace licenses.

End-user process

C.   An end user in the managed account uses AWS Service Catalog to deploy and use the AWS Marketplace solution.

Prerequisites

  • Deploy AWS Control Tower.
  • Create an organizational unit (OU).
  • Create two accounts in the OU.
  • Subscribe to an AWS Marketplace AMI solution.

Configure an environment

Download the content

  1. Download the content
  2. Extract the zipped file “mgtentitlement.zip” that was downloaded
  3. The following artifacts below are located in the extracted folder named “content/mgtentitlement“:
    • l_manage_entitlements.zip
    • mgtentitlement_role_setup.json
    • mgtentitlement_role_setup_blank.json
    • sc_mgtentitlement_ec2_product.json
    • sc_mgtentitlement_sc_product.json
    • sc_mgtentitlement_setup.json

    Follow these steps to upload content and use your own bucket:

    1. Create an S3 bucket. Make a note of the bucket name (mgtent-your-awsaccountID).
    2. Upload the content folder from the previous step to the bucket.
    3. Open the content/mgtentitlement folder and navigate the setup file, sc_mgtentitlement_setup.json.
    4. Under Object URL, copy the link for sc_mgtentitlement_setup.json.

    Follow these steps to deploy the CloudFormation template:

    1. Sign in to your AWS account as an administrator with permission to create resources.
    2. Open the AWS CloudFormation console
    3. Choose Create Stack, with new resources (standard).
    4. Choose Amazon S3 URL, paste the link you copied into Amazon S3 URL, and then choose Next.
    5. In Specify stack details, for Stack name, enter mgtentitlementsetup.
    6. Under Parameters:
      • HoldingBucket, enter the S3 bucket name you created
      • SCenduser, enter the user, group, or role that will have access to AWS Service Catalog portfolio
      • Choose Next.
    7. On the Configure stack options page, choose Next.
    8. On the Review page, select the I acknowledge that AWS CloudFormation might create IAM resources and I acknowledge that AWS CloudFormation might require the following capability: CAPABILITY_AUTO_EXPAND check boxes.
    9. Choose Create stack, and then wait for the status to change to CREATE_COMPLETE

    Deploy an AWS Marketplace license to a managed account

    1. In the CloudFormation console, choose the Output tab.
    2. Right-click and open in a new browser tab the URL next to MgtentitlementLicManagment.
    3. Choose Launch product.
    4. In Parameters:
      • Enter a provisioned product name if one is not generated automatically.
      • For ImageId, enter the AMI for the AWS Region.
      • For License, choose the license you want to deploy.
      • For OrganizationlUnits, choose the target OU.
      • For RecipientAccount, choose the account you want to deploy the license to.
    5. Choose Launch product and then wait for the status to change to Available

     

    The Parameters section displays fields described in the blog post. The page also includes optional sections for managing tags and enabling event notifications.

    Figure 2: Parameters

    A license will be granted to the recipient account and an AWS Service Catalog product will be created in the recipient account for the AWS Marketplace product

    Reports

    After the status has changed to Available, you can view a report that shows the grants that have been deployed. Scroll down and select the Reports URL.

    A sample report shows distributed licenses organized by name, AWS account, Region, and status.

    Figure 3: Sample report

     

     

    To validate, sign in to the managed account that received the license. View the license in the AWS License Manager console and view the product in the AWS Service Catalog console.

    Congratulations! You have successfully deployed an AWS Marketplace license to a managed account.

    Update the AWS Service Catalog product

    You can add new AWS Marketplace subscriptions or accounts at any time. Follow these steps to update the AWS Service Catalog product with new AWS Marketplace subscriptions or accounts.

    1. In the left navigation pane of the AWS Service Catalog console, choose Products.
    2. Choose the AWS MP License Management -ManageEntitlements product, and then choose Launch product.
    3. In Parameters:
      • For Provisioned product name, enter a name or select the Generate name check box.
      • For ImageId, use the default.
      • For License, choose any license.
      • For RecipientAccount, choose 01-Update_Accounts-And-Subscriptions.
    4. Choose Launch product and then wait for the status to change to Available.

    The AWS Service Catalog product will now be updated with the latest AWS Marketplace subscriptions and organization accounts. You can repeat this process at any time

    Cleanup

    To avoid ongoing charges in your account, delete the resources you created.

    Use the AWS Service Catalog console to delete the AWS Service Catalog product. Choose Provisioned products, and from Actions, choose Terminate.

    Conclusion

    In this post, we showed you an easy way that enterprises can use AWS Service Catalog to subscribe to AWS Marketplace products and quickly distribute them to multiple accounts in their organizations. A process that includes AWS Service Catalog can efficiently address a business objective like license management that follows repeatable, compliant steps.

    About the authors

    Kenenth Walsh

    Kenneth Walsh

    Kenneth Walsh is a Solutions Architect whose area of expertise is AWS Marketplace. Kenneth is passionate about cloud computing and loves being a trusted advisor to his customers.

    Oscar Carrasquero

    Oscar Carrasquero

    Oscar Carrasquero is a Specialist Solution Architect based in Germany. He is passionate about technology and enjoys the mixture of business and technology to create solutions that address real needs.