How to Allocate, Share, and Release an EC2 Dedicated Host?

Managing an Amazon EC2 Dedicated Host across multiple AWS accounts involves allocating a physical server in an owner account, sharing it through AWS Resource Access Manager, and releasing it once all running instances are terminated. This approach helps organizations satisfy strict software licensing requirements, maintain physical hardware isolation, and optimize compute utilization across separate AWS accounts or an entire AWS Organization.

Prerequisites and Limitations

Before allocating and sharing an Amazon EC2 Dedicated Host, verify that your AWS environment meets the following conditions:

AWS Account Structure: You need an owner account to allocate the Dedicated Host and one or more consumer accounts to launch instances onto the host. If sharing across an AWS Organization, trusted access for AWS Resource Access Manager (AWS RAM) must be enabled in the management account.
IAM Permissions: The IAM principal in the owner account requires ec2:AllocateHosts, ec2:ReleaseHosts, and ram:CreateResourceShare permissions. Consumer accounts require permissions to accept resource shares (if outside an AWS Organization) and ec2:RunInstances to deploy workloads.
Instance Configuration: Dedicated Hosts can be configured either to support a single specific instance type (such as m5.xlarge) or multiple instance types within the same instance family (such as the m5 family).
Sharing Constraints: Consumers can launch, stop, start, and terminate their own instances on a shared Dedicated Host, and they can view only the instances they own. Only the host owner account can see all instances running on the host (as opaque instance IDs for consumer-owned instances), modify host settings, or release the Dedicated Host.

Allocating an Amazon EC2 Dedicated Host

Allocating a Dedicated Host reserves a physical server in a specific Availability Zone for your account. Billing begins immediately upon allocation, regardless of whether you launch instances onto the server.

Using the AWS CLI

You can allocate a Dedicated Host configured for a specific instance family or a single instance type.

To allocate a Dedicated Host that supports multiple instance sizes within the m5 instance family:

aws ec2 allocate-hosts \
    --availability-zone us-east-1a \
    --instance-family m5 \
    --auto-placement off \
    --host-recovery on \
    --quantity 1 \
    --tag-specifications 'ResourceType=dedicated-host,Tags=[{Key=Name,Value=Shared-M5-Host}]'

To allocate a Dedicated Host locked to a single instance type (for example, c5.2xlarge):

aws ec2 allocate-hosts \
    --availability-zone us-east-1a \
    --instance-type c5.2xlarge \
    --auto-placement on \
    --host-recovery on \
    --quantity 1

Key allocation parameters include:

--auto-placement: Set to on to allow untargeted instances with host tenancy to automatically land on this host, or off to require explicit targeting by Host ID. When sharing a host, setting this to off prevents accidental placement before sharing configurations are finalized.
--host-recovery: Set to on to automatically restart your instances on a new replacement Dedicated Host if the underlying physical hardware experiences an unexpected failure.
--outpost-arn: Optional parameter if you are allocating the Dedicated Host on an AWS Outpost.

The command returns the HostIds value (for example, h-0123456789abcdef0), which you will use to share or release the host.

Calculating Host Capacity

When you allocate a host by instance family, the physical server provides a total number of vCPUs and sockets, which can be divided among different instance sizes of that family. If \(C_{\text{total}}\) represents the total available vCPU capacity on the Dedicated Host and \(n_i\) represents the number of running instances of size \(i\) requiring \(c_i\) vCPUs each, the remaining available vCPU capacity \(C_{\text{rem}}\) is determined by:

\[C_{\text{rem}} = C_{\text{total}} - \sum_{i=1}^{k} n_i c_i\]

You can inspect the current capacity and socket layout of your Dedicated Host at any time using:

aws ec2 describe-hosts --host-ids h-0123456789abcdef0

Once the Dedicated Host is allocated in the owner account, you can share it with specific AWS accounts, Organizational Units (OUs), or an entire AWS Organization using AWS Resource Access Manager.

If you are sharing the Dedicated Host with an AWS Organization or an OU rather than individual external account IDs, run the following command from your AWS Organizations management account to enable sharing:

aws ram enable-sharing-with-aws-organization

Step 2: Obtain the Dedicated Host ARN

AWS RAM requires the full Amazon Resource Name (ARN) of the Dedicated Host. Construct the ARN using your region, owner account ID, and Host ID:

arn:aws:ec2:<region>:<owner-account-id>:dedicated-host/<host-id>

From the owner account, create a resource share in AWS RAM that associates the Dedicated Host ARN with your target principals (an 12-digit AWS account ID, an Organization ARN, or an OU ARN):

aws ram create-resource-share \
    --name "Shared-EC2-Dedicated-Hosts" \
    --resource-arns arn:aws:ec2:us-east-1:111122223333:dedicated-host/h-0123456789abcdef0 \
    --principals 444455556666 \
    --allow-external-principals

If you are sharing only within your AWS Organization, set --no-allow-external-principals and pass the Organization ARN or OU ARN to --principals.

If the Dedicated Host is shared within an AWS Organization with trusted access enabled, consumer accounts gain access automatically without an invitation. If shared with an account outside your organization, the consumer account must accept the invitation.

In the consumer account (444455556666), list the pending invitations:

aws ram get-resource-share-invitations

Accept the invitation using the resourceShareInvitationArn returned from the previous command:

aws ram accept-resource-share-invitation \
    --resource-share-invitation-arn arn:aws:ram:us-east-1:111122223333:resource-share-invitation/abcd1234-5678-90ef-ghij-klmnopqrstuv

Step 5: Launch Instances in the Consumer Account

Once shared, users in the consumer account can verify visibility of the shared host:

aws ec2 describe-hosts

To launch an instance onto the shared Dedicated Host from the consumer account, specify Tenancy=host and either target the HostId directly or rely on auto-placement:

aws ec2 run-instances \
    --image-id ami-0abcdef1234567890 \
    --instance-type m5.xlarge \
    --placement Tenancy=host,HostId=h-0123456789abcdef0 \
    --subnet-id subnet-0123456789abcdef0

Note that the --subnet-id must reside in the same Availability Zone (us-east-1a in this example) where the Dedicated Host was allocated, matched by the underlying Availability Zone ID (use1-az1) across accounts.

Releasing an Amazon EC2 Dedicated Host

To stop billing for an on-demand Dedicated Host, you must explicitly release it from the owner account. AWS does not allow you to release a Dedicated Host while any instances are still running or stopped on it.

Before releasing the host, remove it from the AWS RAM resource share so consumer accounts cannot launch new instances onto it during decommissioning:

aws ram disassociate-resource-share \
    --resource-share-arn arn:aws:ram:us-east-1:111122223333:resource-share/12345678-abcd-ef12-3456-7890abcdef12 \
    --resource-arns arn:aws:ec2:us-east-1:111122223333:dedicated-host/h-0123456789abcdef0

Step 2: Terminate All Instances on the Host

Inspect the host from the owner account to verify whether any instances remain:

aws ec2 describe-hosts \
    --host-ids h-0123456789abcdef0 \
    --query 'Hosts[0].Instances'

If instances are listed, each respective account owner must terminate their instances (or change the tenancy of stopped instances from host to default or dedicated if supported by the OS and instance type):

aws ec2 terminate-instances --instance-ids i-0123456789abcdef0

Wait until all instances reach the terminated state before proceeding.

Step 3: Release the Dedicated Host

Once the Dedicated Host has zero active or stopped instances, run the release-hosts command from the owner account:

aws ec2 release-hosts --host-ids h-0123456789abcdef0

The output returns the Host ID under the Successful array:

{
    "Successful": [
        "h-0123456789abcdef0"
    ],
    "Unsuccessful": []
}

If the release fails, check the Unsuccessful response array for error codes such as InvalidHostState (indicating instances are still terminating on the host) or UnsupportedOperation (indicating an active Dedicated Host Reservation is still bound to the host).

How to Allocate, Share, and Release an EC2 Dedicated Host?

Prerequisites and Limitations

Allocating an Amazon EC2 Dedicated Host

Using the AWS CLI

Calculating Host Capacity

Sharing the Dedicated Host Using AWS RAM

Step 1: Enable Organization Sharing (Optional)

Step 2: Obtain the Dedicated Host ARN

Step 3: Create the Resource Share

Step 4: Accept the Resource Share (External Accounts Only)

Step 5: Launch Instances in the Consumer Account

Releasing an Amazon EC2 Dedicated Host

Step 1: Stop Sharing the Host (Recommended)

Step 2: Terminate All Instances on the Host

Step 3: Release the Dedicated Host