AWS License Manager: License Tracking and Enforcement – SAP-C02 Study Guide

Purpose of This Lesson

AWS License Manager helps organizations centrally manage software licenses purchased from vendors such as Microsoft, Oracle, SAP, or IBM. It can track license consumption across AWS and on-premises resources, distribute licenses across accounts, and enforce licensing limits.

For the exam, focus on the distinction between AWS Marketplace licenses and self-managed licenses, the supported license-counting models, and the ability to prevent new resource launches when an entitlement limit would be exceeded.

Key Concepts

Centralized license management

License Manager provides a central view of software license usage for resources running in AWS and, in supported scenarios, on-premises environments. It can help organizations:

• Track purchased software entitlements and current usage.
• Manage licenses across AWS accounts and an organization.
• Distribute or activate licenses for use by different accounts.
• Apply license limits across multiple AWS Regions.
• Discover resources that use particular software products.
• Generate notifications when usage approaches or reaches configured limits.

Granted licenses and self-managed licenses

License Manager distinguishes between two broad categories of licenses:

• Granted licenses: Licenses obtained through AWS Marketplace or another AWS-managed entitlement flow. License Manager can display and track the granted license usage.
• Self-managed licenses: Licenses purchased directly from a software vendor and entered into License Manager by the customer. For example, an organization might register Microsoft Windows Server licenses purchased under an existing agreement.

License counting models

A self-managed license can define the unit used to measure consumption. Common options include:

• Cores
• vCPUs
• Sockets
• Instances or machines

The counting model must match the licensing terms of the software vendor. Selecting the wrong metric can produce inaccurate compliance results.

Enforcing license limits

When creating a self-managed license, administrators can specify an entitlement quantity and choose whether License Manager should enforce the limit.

With enforcement enabled, an operation that would exceed the configured allowance—such as launching another EC2 instance—can be blocked. This is different from merely reporting usage: enforcement actively prevents additional consumption beyond the licensed amount.

License Manager can also send Amazon SNS notifications when usage reaches configured thresholds or limits, allowing operations teams to respond before or when a violation occurs.

License rules and resource attributes

License rules can restrict which resources are eligible to consume a license. Examples include:

• A minimum vCPU requirement.
• Shared tenancy versus dedicated tenancy.
• Dedicated instances or dedicated hosts.

Multiple rules can be combined. These constraints are useful when a vendor license applies only to certain instance configurations or host-placement models.

Automated discovery

Automated discovery rules allow License Manager to identify resources running selected products and versions. For example, an administrator can configure discovery for a particular Windows Server edition and version, then associate the discovered resources with the applicable license configuration.

This reduces reliance on manual inventory and helps keep license usage records aligned with the actual environment.

Dedicated hosts and host resource groups

License Manager includes capabilities for organizing and managing dedicated hosts through host resource groups. This is relevant when licensing requirements depend on dedicated host placement or when an organization uses bring-your-own-license models tied to physical host capacity.

The key exam point is that License Manager can account for license restrictions involving dedicated hosts and other tenancy attributes; it is not limited to simple instance counts.

Exam-Relevant Takeaways

• Use AWS License Manager to centrally track and manage third-party software licenses across AWS and on-premises resources.
• Granted licenses generally represent entitlements acquired through AWS Marketplace or an AWS-managed licensing flow.
• Self-managed licenses represent licenses purchased directly from a software vendor and registered by the customer.
• License usage can be measured by cores, vCPUs, sockets, or instances.
• License Manager can apply controls across multiple AWS accounts, Regions, and an organization.
• Enforcing a license limit can cause a new resource launch to fail when the launch would exceed the available entitlement.
• Use SNS notifications to alert teams when usage reaches configured license thresholds or limits.
• Automated discovery can identify resources running specified software products and versions.
• License rules can use attributes such as minimum vCPU count and instance or host tenancy.

Architecture Decision Guide

Requirement	License Manager capability	Important consideration
Track licenses purchased through AWS Marketplace	Granted license tracking	Monitor the entitlements and usage associated with the AWS-managed purchase
Track licenses purchased directly from a vendor	Self-managed license	Enter the licensing model and entitlement quantity accurately
Measure Windows or database licenses by compute capacity	Core, vCPU, or socket-based licensing	Match the measurement unit to the vendor agreement
Prevent unlicensed resource growth	License limit enforcement	A launch that would exceed the allowance can be blocked
Notify administrators about consumption	SNS notifications	Configure operational responses for threshold or limit alerts
Find instances running licensed software	Automated discovery rules	Specify the product, edition, version, and resource type
Restrict licenses to certain placement models	License rules	Use tenancy, minimum vCPU, dedicated instance, or dedicated host conditions
Coordinate licensing across an organization	Cross-account and multi-Region management	Centralize governance while accounting for regional resource usage

Common Exam Traps

• Confusing license tracking with license enforcement: Reporting usage does not necessarily prevent new resources from being launched. Enforcement must be configured.
• Assuming License Manager is only for AWS Marketplace: It also manages self-managed licenses purchased directly from vendors.
• Ignoring the license metric: A license may be based on vCPUs, cores, sockets, or instances. The correct answer depends on the vendor’s licensing model.
• Treating an alert as a hard limit: SNS notifications inform operators; enforcement is the feature that can block an operation exceeding the entitlement.
• Overlooking tenancy requirements: A license may be valid only for shared instances, dedicated instances, or dedicated hosts.
• Assuming manual inventory is always required: Automated discovery can identify resources running selected products and versions.
• Using License Manager as a general software deployment service: Its primary role here is license inventory, tracking, governance, and enforcement—not application deployment.

Real-World Engineer Notes

• Record the vendor agreement and entitlement basis before creating a self-managed license. The configuration should reflect the legal licensing terms, not simply the EC2 instance size.
• Use enforcement carefully in production. An unexpected launch failure can affect scaling or recovery workflows if the organization has not planned sufficient license capacity.
• Combine SNS notifications with operational procedures so teams can investigate consumption before a limit blocks an autoscaling or recovery action.
• Standardize product and version discovery rules to improve inventory accuracy across accounts and Regions.
• Include dedicated-host and tenancy requirements in architecture reviews when using bring-your-own-license arrangements.
• Treat license data as a governance concern. Centralized visibility is especially valuable when independent teams can create resources in multiple accounts.

Quick Reference Summary

• Service: AWS License Manager
• Primary purpose: Manage, track, and govern third-party software licenses.
• Coverage: AWS resources, supported on-premises resources, multiple accounts, and multiple Regions.
• License sources: AWS Marketplace/granted licenses and customer-registered self-managed licenses.
• Usage units: Cores, vCPUs, sockets, or instances.
• Controls: Automated discovery, resource rules, SNS notifications, and optional enforcement.
• Enforcement result: A resource launch that exceeds the configured license allowance can fail.
• Placement considerations: Shared tenancy, dedicated instances, and dedicated hosts may be relevant to licensing rules.

Flashcards

1. Q: What is the primary purpose of AWS License Manager?

A: To centrally track, manage, distribute, and enforce software licenses across AWS and supported on-premises resources.

1. Q: What is a granted license?

A: A license entitlement obtained through AWS Marketplace or another AWS-managed licensing flow.

1. Q: What is a self-managed license?

A: A license purchased directly from a software vendor and registered by the customer in License Manager.

1. Q: Which license-counting units can License Manager support?

A: Cores, vCPUs, sockets, and instances or machines.

1. Q: What happens when enforcement is enabled and a launch would exceed the license limit?

A: The launch can be blocked and fail.

1. Q: What is the role of SNS notifications in License Manager?

A: They notify administrators when license usage reaches configured thresholds or limits.

1. Q: What can automated discovery identify?

A: Resources running configured software products, editions, and versions.

1. Q: Which resource attributes can license rules evaluate?

A: Attributes such as minimum vCPU count and shared, dedicated-instance, or dedicated-host tenancy.

1. Q: Why is multi-account and multi-Region support important?

A: It allows organizations to centrally govern and track license consumption across distributed AWS environments.

1. Q: Is License Manager limited to licenses purchased from AWS Marketplace?

A: No. It also supports self-managed licenses purchased directly from vendors.

Practice Questions

Question 1

A company purchased Windows Server licenses directly from a vendor. It runs EC2 instances in several AWS accounts and Regions and needs centralized tracking based on vCPU consumption. The company also wants new instances to be blocked if the purchased entitlement is exceeded. Which solution best meets these requirements?

A. Create a self-managed license in AWS License Manager with vCPU tracking and enforcement enabled.
B. Purchase an AWS Marketplace AMI and use AWS Budgets to track its cost.
C. Store the license count in AWS Systems Manager Parameter Store and use CloudWatch alarms.
D. Use AWS Organizations SCPs to limit the number of EC2 instances in each account.

Correct answer: A

Explanation: Self-managed licenses are appropriate for licenses purchased directly from a vendor. License Manager supports vCPU-based tracking and can enforce the entitlement limit, potentially blocking launches that would exceed it. The other options do not provide software-license accounting and enforcement.

Question 2

An organization wants to receive an alert when usage of a registered software license reaches its configured allowance, but it does not want to block resource launches automatically. Which License Manager capability should it use?

A. Host resource groups
B. SNS notifications
C. Dedicated tenancy rules
D. Automated product discovery

Correct answer: B

Explanation: SNS notifications provide alerts about license usage. Enforcement is the separate capability that can block launches when the limit is exceeded.

Question 3

A vendor licenses software by socket and permits its use only on dedicated hosts. Which License Manager configuration is most appropriate?

A. A self-managed license measured by instances with shared tenancy
B. A granted license measured by vCPUs with shared tenancy
C. A self-managed license measured by sockets with a dedicated-host rule
D. An AWS Budget based on EC2 instance hours

Correct answer: C

Explanation: The license configuration should match both the vendor’s measurement model and placement restriction. License Manager supports socket-based tracking and rules involving dedicated hosts.

Question 4

A company wants to identify EC2 resources running a specific edition and version of a licensed operating system so that usage can be associated with the correct entitlement. Which feature should it configure?

A. Automated discovery rules
B. AWS CloudTrail event selectors
C. VPC flow logs
D. Reserved Instances

Correct answer: A

Explanation: Automated discovery rules can identify resources running selected products and versions, improving the accuracy of license inventory and usage tracking.

Question 5

A business unit claims that licenses purchased from a software vendor cannot be managed in AWS License Manager because they were not obtained through AWS Marketplace. How should this be corrected?

A. Use self-managed licenses to register and track the vendor-purchased entitlements.
B. Convert the licenses into Reserved Instances.
C. Attach the licenses to an IAM role.
D. Use AWS Marketplace private offers exclusively.

Correct answer: A

Explanation: License Manager supports self-managed licenses. These are designed for software entitlements purchased directly from vendors such as Microsoft, Oracle, SAP, or IBM.