> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudcapital.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Commitment Purchasing Authorization

> How Cloud Capital is authorized to purchase AWS Savings Plans and Reserved Instances on your behalf.

Cloud Capital purchases AWS Savings Plans and Reserved Instances on your behalf using a dedicated AWS account and a cross-account IAM role. No root access to your AWS Organization is required, and your existing AWS Organization structure, account ownership, and infrastructure are not affected.

***

## How commitment purchasing works

Cloud Capital purchases commitments into a **dedicated, empty AWS account** that you create within your existing AWS Organization. This is how AWS Savings Plans and Reserved Instances are designed to work: when purchased in any account within an AWS Organization, the discount automatically applies to matching usage across **all member accounts** in the Organization — not just the account where the commitment was purchased. AWS handles this distribution automatically, with no additional configuration required on your end.

The dedicated account stays empty of workloads by design. Because AWS applies commitment discounts to wherever the matching usage occurs across your Organization, keeping the purchasing account empty ensures the full benefit flows to your actual workloads.

Cloud Capital accesses this account through an IAM role provisioned via CloudFormation. The role is scoped exclusively to purchasing and managing commitments — it has no read access to your cost data and no visibility into any of your workload accounts.

<Note>
  Root access to your AWS Organization or management account is not required at any point. All purchasing is performed through the scoped IAM role in the dedicated commitment account.
</Note>

***

## Commitment models

Cloud Capital supports two commitment purchasing models depending on your AWS relationship:

### AWS Billing Transfer customers

If you are an AWS Billing Transfer customer, Cloud Capital is your payer of record. Commitments are purchased on your behalf through the dedicated commitment account within your AWS Organization, and discounts flow across your member accounts automatically. Follow the setup steps below.

### In-Place commitment customers

If your organization has a direct AWS relationship — including a Private Pricing Agreement (PPA), Enterprise Discount Program (EDP), or if you are working with an AWS Managed Service Provider (MSP) — Cloud Capital can purchase commitments **in-place** within your existing AWS Organization.

The setup is the same: create a dedicated, empty account in your Organization and deploy the Optimization CloudFormation stack into it. Cloud Capital purchases commitments through that account, and AWS distributes the discounts across your Organization as normal. Your direct AWS relationship, PPA/EDP pricing, and MSP arrangement are all preserved.

<Info>
  In-Place commitments work identically to Billing Transfer from a technical standpoint. The difference is only in who acts as the payer of record — your existing arrangement with AWS remains unchanged.
</Info>

***

## Setting up the dedicated commitment account

### What Cloud Capital accesses

The [Optimization CloudFormation template](/cloudformation/aws-cloudformation-optimization.json) creates an IAM role scoped exclusively to purchasing and managing commitments in the dedicated account.

| Purpose                                                                | AWS Services Used                                                                                                                                                           |
| ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Purchase and manage Savings Plans                                      | `savingsplans:*`                                                                                                                                                            |
| Purchase EC2 Reserved Instances                                        | `ec2:PurchaseReservedInstancesOffering` and related EC2 RI actions                                                                                                          |
| Purchase RDS, Redshift, ElastiCache, and OpenSearch Reserved Instances | `rds:PurchaseReservedDbInstancesOffering`, `redshift:PurchaseReservedNodeOffering`, `elasticache:PurchaseReservedCacheNodesOffering`, `es:PurchaseReservedInstanceOffering` |
| Create service-linked roles required by AWS during first purchase      | `iam:CreateServiceLinkedRole`                                                                                                                                               |
| Manage service quota increases when required                           | `servicequotas:*`, `support:*`                                                                                                                                              |

<Note>
  The Optimization role has **no read access** to your cost data, billing APIs, or any of your workload accounts. It is scoped exclusively to the dedicated commitment account and can only take the purchasing actions listed above.
</Note>

### Setup

<Steps>
  <Step title="Create a dedicated commitment account">
    In your AWS Organization, create a new empty account. This account will hold all commitments Cloud Capital purchases on your behalf. It must contain no running workloads or resources — this ensures AWS distributes commitment discounts optimally across your Organization.

    See [Creating an AWS account in your organization](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html) in the AWS documentation.
  </Step>

  <Step title="Deploy the Optimization CloudFormation stack">
    In the dedicated commitment account, deploy the [Optimization CloudFormation template](/cloudformation/aws-cloudformation-optimization.json). Cloud Capital pre-populates the required parameters — no manual entry needed.

    Once the stack completes, copy the **Role ARN** from the stack Outputs tab.
  </Step>

  <Step title="Share the Role ARN with Cloud Capital">
    Provide the Role ARN to your Cloud Capital representative, or paste it into the Cloud Capital application as directed during onboarding. This completes the authorization and enables Cloud Capital to begin purchasing commitments on your behalf.
  </Step>
</Steps>

***

## What Cloud Capital can and cannot do

|                                                       | Commitment purchasing account                      | Management / payer account                        |
| ----------------------------------------------------- | -------------------------------------------------- | ------------------------------------------------- |
| Purchase Savings Plans and Reserved Instances         | Yes                                                | No                                                |
| Read cost and usage data (CUR, billing, pricing APIs) | No                                                 | Yes — via the Forecasting role                    |
| Access running workloads or resources                 | No                                                 | No                                                |
| Modify IAM policies or account settings               | No                                                 | No                                                |
| Revoke at any time                                    | Yes — delete the Optimization CloudFormation stack | Yes — delete the Forecasting CloudFormation stack |

<Note>
  All commitment customers must also have the Forecasting role deployed. Cloud Capital uses that role — installed in your management or payer account — to read cost and usage data and size commitments accurately. The two roles are separate and independently revocable.
</Note>

***

## Viewing commitments and purchase history

All active commitments, utilization, and purchase history are visible in the Cloud Capital application. During the weekly review cadence, your Cloud Capital team walks through commitment performance, upcoming renewals, and any proposed new purchases — each of which requires your approval before being executed.

For more on the review process, see [Commitment Proposal & Onboarding](/optimization/commitment-proposal-onboarding).