All cheat sheets
Operational Efficiencycheat sheet

AWS License Manager

Windows EC2 costs ~2× Linux; SQL Server Enterprise adds $4–5/hour on top. If you already own those licenses under Software Assurance, BYOL removes the AWS markup — and License Manager is the free tracking layer that makes it audit-safe.

Last reviewed: July 11, 2026

Prefer step by step? Take the guided AWS License Manager walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: AWS bakes a license fee into every Windows and SQL Server instance-hour — Windows roughly doubles the Linux rate; SQL Server Enterprise adds ~$4–5/hour, often more than the compute itself. If your org owns those licenses with Software Assurance, BYOL removes the markup entirely, and the free License Manager service is what keeps the entitlement count audit-proof (Microsoft true-ups against untracked cloud BYOL are routinely six figures). The one dividing line: SA acquired before October 2019 can BYOL on ordinary shared tenancy; after, it needs Dedicated Hosts.

The numbers

  • t3.xlarge: ~$0.166/hr Linux vs ~$0.36/hr Windows — the delta is pure license fee
  • SQL Server Enterprise License Included ≈ $43k/year per r5.4xlarge in license fees alone
  • Field examples: a 220-instance Windows fleet went from $40k to $19k/month by BYOL-ing against an already-paid EA; a SaaS moved 8 SQL Server Enterprise instances to BYOL against shelved licenses — ~$340k/year recovered
  • License Manager itself: free — AWS wants BYOL tracked properly

Do this

  1. Map the estate: describe-instances grouped by platform/usage-operation shows exactly which instances carry License Included billing codes, and RDS LicenseModel covers the database side.

  2. Pull the entitlement facts from your Microsoft EA: what you own, with or without Software Assurance, and the acquisition dates (the pre/post-October-2019 line decides shared tenancy vs Dedicated Hosts).

  3. Declare entitlements in License Manager first, migrate second: define the license configuration (count, type, tenancy rule), associate it with AMIs/launch templates, and enable enforcement mode so a launch that would exceed the entitlement is rejected rather than silently non-compliant.

  4. Migrate steady-state production fleets in batches — stop, switch billing to BYOL, start, verify the License Manager count ticks up. Leave ephemeral/autoscaling Windows on License Included; tracking entitlements across churn isn't worth the premium saved.

  5. Keep the compliance exports (3–5 years, matching vendor audit windows) — when the auditor asks "how do you track this?", the report is the answer.

Gotchas

  • Post-2019 licenses → Dedicated Hosts, which are per-host-priced and need utilization planning; still clearly worth it for SQL Server, marginal for plain Windows. Pair with Dedicated Host Reservations if you go this route.
  • RIs cover compute, not licenses — a Windows License-Included RI is a different SKU from a Linux RI running BYOL Windows; don't mix the math.
  • Tenancy mismatches are violations License Manager flags but only blocks in enforcement mode.
  • Oracle BYOL is real but legally sharp-edged — the tracking is the easy half; get the contract interpreted by a specialist before migrating.
  • No SA at all (OEM licenses) = no BYOL — consider RDS/Aurora PostgreSQL migration instead for SQL Server workloads.

Skip this if

  • Your estate is Linux and open-source databases — there's nothing to track; skip the service entirely.
  • The Windows footprint is under ~10 ephemeral instances — the License Included premium is the price of simplicity.
  • The licenses lack Software Assurance — the lever doesn't exist; the cost play becomes engine migration, not BYOL.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account for BYOL (bring-your-own-license)
savings and license-compliance posture. Use the AWS CLI with READ-ONLY
credentials. Do not create, modify, or delete anything.

1. Estate scan: aws ec2 describe-instances — group by Platform/
   PlatformDetails (Windows, Windows with SQL Server Standard/
   Enterprise/Web, Linux) and UsageOperation (identifies License
   Included vs BYOL billing codes). Count instances, types, tenancy.
   Also aws rds describe-db-instances for LicenseModel
   (license-included vs bring-your-own-license) on SQL Server/Oracle.
2. Cost of License Included: estimate the license markup — Windows LI
   roughly doubles the Linux rate for the same type; SQL Server
   Enterprise LI adds ~$4–5/hr on large instances. Sum per month for
   the fleet.
3. License Manager state: aws license-manager
   list-license-configurations — any entitlements defined? Enforcement
   on? If BYOL instances exist WITHOUT License Manager tracking, flag
   the audit risk (vendor true-up exposure).
4. Note the questions only the user can answer (include in report):
   does the org hold Software Assurance, and were licenses acquired
   before or after October 2019? (Pre-2019 SA → BYOL on shared
   tenancy; post-2019 → Dedicated Hosts required; no SA → cannot
   BYOL.)

Report: fleet table (platform | count | est. license markup $/mo),
total BYOL opportunity under each SA scenario, current License
Manager coverage gaps, and the migration order (steady-state
production fleets first; leave ephemeral/autoscaling on License
Included). Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The AWS License Manager walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Operational Efficiency cheat sheets

AWS Config Resource Exclusion

AWS Config bills ~$0.003 per configuration item, and the 'record everything' default meters every ENI and Lambda-version change your account churns through. Excluding high-churn, zero-audit-value resource types cuts most Config bills 40–70%.

AWS Resource Explorer

Free, cross-region, cross-account search for everything in your AWS estate — the fastest way to surface the orphaned volumes, unassociated Elastic IPs, forgotten NAT Gateways, and idle SageMaker endpoints that accumulate in any account older than two years.

CloudWatch Logs Infrequent Access

The IA log class halves both ingestion (~$0.25/GB) and storage (~$0.015/GB-month) for write-and-forget log groups — but silently disables metric filters, subscription filters, and Live Tail. Know the disable list before you move anything.

CloudWatch Logs Retention Policies

Every new log group defaults to Never Expire, so logs from 2019 experiments still bill you today. One CLI line per log group (or one bulk script per region) cuts log storage 60–90% with zero application risk.