> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IAM and billing

On AWS Marketplace, FineParser Enterprise is billed per worker pod-hour at the listing's rate. Each worker registers with AWS Marketplace when it starts, and is metered until it stops. The orchestrator and ingest are not billed, so a pool scaled to zero incurs no software charges. Workers kept running by `scaling.minWorkers` are billed whether or not they have work.

Workers register with an IAM role in your account, through IAM roles for service accounts (IRSA). EKS Pod Identity, node roles, and access keys are not supported. A worker that cannot register exits without taking work.

## Create the role and service account

The role needs the AWS managed policy `AWSMarketplaceMeteringRegisterUsage`, and must trust the service account the release runs under.

> [!WARNING]
>
> `AWSMarketplaceMeteringFullAccess` does not grant `RegisterUsage`, despite its name. Workers signing with it are refused.

> [tab] Your own service account
>
> `eksctl` creates the role and an annotated service account together:
>
> ```bash theme={null}
> eksctl create iamserviceaccount \
>   --cluster <cluster> --region <region> \
>   --namespace fineparser --name fineparser \
>   --role-name FineParserMetering \
>   --attach-policy-arn arn:aws:iam::aws:policy/AWSMarketplaceMeteringRegisterUsage \
>   --approve
> ```
>
> ```yaml fineparser-values.yaml theme={null}
> serviceAccount:
>   create: false
>   name: fineparser
> ```
>
> The AWS Marketplace launch instructions may fill in `serviceAccount.name`. It must name a service account set up this way.

> [tab] Chart-created service account
>
> The chart names its service account `fineparser-orchestrator` for a release named `fineparser`. Create a role trusted by that name, then annotate the chart's account with it:
>
> ```bash theme={null}
> eksctl create iamserviceaccount \
>   --cluster <cluster> --region <region> \
>   --namespace fineparser --name fineparser-orchestrator \
>   --role-name FineParserMetering --role-only \
>   --attach-policy-arn arn:aws:iam::aws:policy/AWSMarketplaceMeteringRegisterUsage \
>   --approve
> ```
>
> ```yaml fineparser-values.yaml theme={null}
> serviceAccount:
>   annotations:
>     eks.amazonaws.com/role-arn: arn:aws:iam::<account>:role/FineParserMetering
> ```

If you create the role another way, its trust policy must allow `sts:AssumeRoleWithWebIdentity` from the cluster's OIDC provider, with `sub` set to `system:serviceaccount:<namespace>:<service-account>` and `aud` set to `sts.amazonaws.com`.

## Region

Workers register in the region the EKS pod identity webhook injects. Set `awsMarketplace.region` only if your cluster does not inject `AWS_REGION`.

## Confirming billing works

Once a job has started a worker:

```bash theme={null}
kubectl -n fineparser logs deploy/fineparser-worker | grep billing
# billing: registered with AWS Marketplace, this pod is metered hourly
```

Anything else names the problem. See [Troubleshooting](https://docs.abbyy.com/fine-parser/enterprise/reference/troubleshooting.md#workers-exit-at-startup).