Claude Platform on AWS

Claude Platform on AWS gives you the full Anthropic platform experience, including the Messages API, Agent Skills, code execution, and beta features, accessible through your AWS account. Unlike Amazon Bedrock, where AWS operates the inference stack, Anthropic operates Claude Platform on AWS. AWS provides the authentication layer (SigV4 or API key), IAM-based access control, and billing integration through AWS Marketplace.

How the platform integration works

Claude models run on Anthropic-managed infrastructure. This is a commercial integration for billing and access through AWS. Anthropic is the data processor for inference inputs and outputs; AWS processes billing and identity metadata under the marketplace model. Customers using Claude through Claude Platform on AWS are subject to Anthropic's data use terms. Anthropic continues to provide its industry-leading safety and data commitments.

Note the following operational characteristics: data may not reside in AWS; inference may route to Anthropic's primary cloud; and subservices may move under the hood without notice. Set the inference_geo parameter per request to pin inference to a specific geography.

Claude Platform on AWS follows the same data retention policy as the first-party Claude API. Zero Data Retention (ZDR) is available on request. Contact your Anthropic account representative to enable it for your organization.

Claude Platform on AWS vs Amazon Bedrock

Both offerings let you use Claude through AWS, but they differ significantly in architecture, API surface, and feature availability.

If you need AWS-operated Claude, see Claude in Amazon Bedrock. Claude Platform on AWS uses a separate capacity pool from both the first-party Claude API and Amazon Bedrock. You can run workloads on more than one platform and fail over between them.

AWS PrivateLink is supported for connecting your VPC to the Claude Platform on AWS endpoint.

When to choose Bedrock: Organizations in regulated industries that require FedRAMP High, IL4, IL5, or HIPAA-ready compliance, or that need AWS to be the sole data processor, should use Claude in Amazon Bedrock. Bedrock runs entirely on AWS-controlled infrastructure with AWS as the operating party.

Set up your account

Setting up Claude Platform on AWS happens in four phases: sign up on the AWS Console service page, complete your Anthropic organization setup, note your workspace ID, and sign in to the Claude Console.

Troubleshooting account setup

• "Sign-up failed: Failed to enable OutboundWebIdentityFederation": If you see this banner on first submit, choose Continue again. The IAM enablement can take a moment to take effect.
• No progress indicator during sign-up: Sign-up takes a few minutes. The page shows a static Sign-up in progress banner without a progress bar while AWS provisions your account.
• "Signed in as a different account" after following the setup link: Choose Log out and continue. The page reauthenticates you with the email address you entered.
• "Not found" message during sign-in: This message might appear briefly during redirect. You can dismiss it.
• Usage page shows no data after your first API call: Usage data can take a few minutes to appear in the Claude Console.

Before making API calls

Ensure you have:

1. An active AWS account with a subscription to Claude Platform on AWS (see Set up your account)
2. The AWS CLI installed and configured
3. Outbound web identity federation enabled on your AWS account (a one-time setup step; see Enable outbound web identity federation)
4. Your workspace ID (see Obtain your workspace ID)

Enable outbound web identity federation

The Claude Platform on AWS gateway calls sts:GetWebIdentityToken server-side to mint a JWT it forwards to Anthropic. This STS capability is disabled by default on every AWS account. Enable it once per account:

aws iam enable-outbound-web-identity-federation

If the response is [ERROR] (FeatureEnabled) ... already enabled, the setting is already on for your account and you can move on. Verify and retrieve your account's issuer URL:

aws iam get-outbound-web-identity-federation-info

Obtain your workspace ID

You create a workspace from the AWS Console after completing account setup (see Set up your account). Workspaces are bound to a single AWS region. You can find the workspace ID in the Claude Console under Workspaces or in the Workspaces section of the AWS Console service page.

Set the ANTHROPIC_AWS_WORKSPACE_ID and AWS_REGION environment variables so the SDK clients read them automatically:

export ANTHROPIC_AWS_WORKSPACE_ID='wrkspc_01AbCdEf23GhIj'
export AWS_REGION='us-west-2'  # Your workspace's AWS region

The region is required. The SDK client raises an error if no region is set. Pass aws_region/awsRegion to the constructor, or set AWS_REGION (or AWS_DEFAULT_REGION). All AWS commercial regions are supported.

Authentication

Claude Platform on AWS supports two authentication methods: AWS IAM with SigV4 request signing (primary) and API key authentication. Both use the same base URL and request format.

SigV4 authentication

SigV4 is the enterprise-native path and integrates with your existing AWS IAM policies, roles, and auditing. Configure AWS credentials using any method supported by the AWS default credential provider chain:

• Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
• Shared credentials file (~/.aws/credentials)
• Shared config file (~/.aws/config) including SSO and credential_process
• Web identity (AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN) for IRSA and GitHub Actions
• ECS container credentials
• EC2 instance metadata service (IMDS)

Verify that your credentials are working:

aws sts get-caller-identity

API key authentication

For simpler integration paths (local development and scripts), you can authenticate with an API key instead of SigV4. Set the ANTHROPIC_AWS_API_KEY environment variable or pass apiKey to the SDK constructor.

Generate API keys in the AWS Console under Claude Platform on AWS → API keys. Choose Generate a key, then copy the key value. Grant the aws-external-anthropic:CallWithBearerToken IAM action to the principals that should be allowed to use API key authentication.

Short-term API keys

For workloads that need to hand a credential to a separate process (such as an LLM gateway, a serverless function, or a tool that supports bearer-token authentication but not SigV4), generate a short-term API key from your AWS credentials instead of provisioning a long-lived key in the AWS Console.

AWS publishes token-generator libraries for JavaScript, Python, and Java. Each library reads your AWS credentials through the standard provider chain and returns a time-limited token that works with the x-api-key header. Token lifetime defaults to 12 hours and is capped at the lesser of your requested duration, your AWS credentials' expiry, and 12 hours. See the linked repository READMEs for installation and full configuration options.

Pass the generated token to the SDK the same way you'd pass an AWS Console-generated API key:

from token_generator_for_aws_external_anthropic import TokenGenerator
from anthropic import AnthropicAWS

token = TokenGenerator(region="us-west-2").get_token()

client = AnthropicAWS(api_key=token, aws_region="us-west-2")

If you can generate the token locally, your process already has SigV4 credentials, and SigV4 authentication is usually the simpler choice. Use short-term keys when the process making API calls is separate from the process that holds AWS credentials.

The SDK does not refresh short-term keys automatically. When a token expires, generate a new one and construct a new client. The principal that uses the token still needs the aws-external-anthropic:CallWithBearerToken IAM action.

Credential precedence

The platform-specific client resolves authentication in the following order. Argument names vary by language convention (TypeScript and PHP use camelCase as shown; Python and Ruby use snake_case; Go uses PascalCase with capitalized acronyms; C# and Java use the language's property or builder idioms).

1. apiKey constructor argument → x-api-key header
2. awsAccessKey + awsSecretAccessKey constructor arguments → AWS SigV4
3. awsProfile constructor argument → AWS SigV4 with named profile
4. ANTHROPIC_AWS_API_KEY environment variable → x-api-key header
5. Default AWS credential provider chain → AWS SigV4

Region resolution

The client reads AWS_REGION from the environment if aws_region/awsRegion is not passed to the constructor, falling back to AWS_DEFAULT_REGION for compatibility with the standard AWS SDKs. Region is required; there is no fallback default. Unlike AnthropicBedrock, which falls back to us-east-1, the AnthropicAWS/AnthropicAws client raises an error if neither the constructor argument nor the environment variable is set.

Install an SDK

Anthropic's client SDKs support Claude Platform on AWS. Each SDK provides a platform-specific client class that handles SigV4 signing, region-based base URL construction, and the anthropic-workspace-id header.

Available models

The following models are available on Claude Platform on AWS:

Model IDs are identical to the first-party Claude API. There are no Bedrock-style ARNs or anthropic. prefixes.

New models launch on Claude Platform on AWS simultaneously with the first-party Claude API.

Making requests

Claude Platform on AWS uses the Anthropic Messages API (/v1/messages), the same API surface as the first-party Claude API. The differences are the base URL, the authentication method, and a required anthropic-workspace-id header that identifies which workspace the request targets.

from anthropic import AnthropicAWS

client = AnthropicAWS()

message = client.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Hello!"}],
)
print(message)

The client reads AWS_REGION (or AWS_DEFAULT_REGION) and ANTHROPIC_AWS_WORKSPACE_ID from the environment. You can override either by passing aws_region / awsRegion or workspace_id / workspaceId to the constructor. Both region and workspace ID are required. The constructor raises an error if the workspace ID cannot be resolved; a missing region likewise raises an error.

The --aws-sigv4 value follows the format aws:amz:<region>:<service>. The SigV4 service name is aws-external-anthropic, and the region must match the region in your endpoint URL. A mismatch in either produces a generic signature-rejection error rather than a specific diagnostic.

Context window

Context-window sizes on Claude Platform on AWS are identical to the first-party Claude API. See Context windows for per-model limits.

Feature support

Claude Platform on AWS uses the Anthropic Messages API directly, which means you get full Messages API feature parity with the first-party Claude API (except where noted in the feature limitations):

• Feature access: Because Anthropic operates both platforms, most new features and beta headers become available on Claude Platform on AWS without a separate integration step. See feature limitations for exceptions.
• Beta features: Pass the standard anthropic-beta header to access beta features, just as you would with the Claude API.
• Agent Skills: Use pre-built and custom Agent Skills with the same container.skills parameter and beta headers as the Claude API. All pre-built Skills (PowerPoint, Excel, Word, PDF) work out of the box.
• Code execution: Run code in Anthropic's managed sandbox using the code execution tool.
• Tool use: Computer use and all other tool use capabilities are available.
• Extended thinking: Enable extended thinking with the same parameters as the Claude API.
• Streaming: Full SSE streaming support for real-time responses.
• Batch processing: Submit batch requests for high-throughput workloads.
• Prompt caching: Cache tools, system prompts, and message history to reduce latency and cost. All prompt caching capabilities (5-minute TTL, 1-hour TTL, and automatic caching) are available.
• Files API: Upload and reference files across requests.

See the comparison table for feature-availability differences from Amazon Bedrock.

Claude Managed Agents

Claude Managed Agents is available on Claude Platform on AWS, including agents, environments, sessions, credential vaults, and memory stores. The Claude Agent SDK is also supported.

Session behavior on Claude Platform on AWS differs from first-party Claude Managed Agents in one way:

• Autonomous-session reauthentication: A session can run autonomously, without any user events, for up to 6 hours. After 6 hours, the session requires reauthentication before it continues. To reauthenticate, send any user-role event to the session (see Events and streaming). First-party Claude Managed Agents has no autonomous-session runtime limit.

Features not currently available

The following capabilities are not currently available on Claude Platform on AWS:

• HIPAA readiness: Anthropic's HIPAA-ready program is not available. See API and data retention.

• Admin API: Workspace endpoints (create, get, list, update, and archive on /v1/organizations/workspaces) are available. Other Admin API endpoints (organization members, workspace members, invites, API keys, usage reports, cost reports, and rate limit reports) are not currently available. View usage and cost data in the Claude Console instead. AWS IAM manages organization membership.
• Workspace member management: Adding or removing users from individual workspaces is not available. AWS IAM policies on workspace ARNs control access.
• Spend limits: Not available. Rely on AWS billing controls instead.
• Claude Code workspace and Analytics API: The Claude Code workspace with automatic rate limits is not available. Claude Code usage appears in the general usage view rather than a dedicated screen.
• OAuth authentication: Not supported. Use SigV4 or API key authentication.
• Fast mode: Not available on Claude Platform on AWS.
• OpenAI-compatible API endpoints: Not available on Claude Platform on AWS.
• Workspace-level inference geography controls: allowed_inference_geos and default_inference_geo are not available. Set inference_geo on each request instead.

Data residency

Claude Platform on AWS supports the following inference geographies:

• US: Inference stays within US data centers. A 1.1x pricing multiplier applies.
• Global: Inference can route to any Anthropic-operated data center worldwide. Standard pricing applies.

Set the inference geography per request with the inference_geo parameter:

from anthropic import AnthropicAWS

client = AnthropicAWS()
message = client.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=1024,
    inference_geo="us",
    messages=[{"role": "user", "content": "Hello!"}],
)
print(message)

If you omit inference_geo, the request defaults to global.

Workspace-level inference geography controls (allowed_inference_geos and default_inference_geo) are not available on Claude Platform on AWS. Set inference_geo on each request instead.

Workspaces

Inference and resource requests on Claude Platform on AWS target a workspace. You pass the workspace's ID in the anthropic-workspace-id header on these API calls. Workspace IDs use the tagged format wrkspc_ followed by an alphanumeric identifier (for example, wrkspc_01AbCdEf23GhIj). See Obtain your workspace ID if you don't have it yet.

Workspace scoping

Workspaces are bound to a single AWS region. A workspace created in us-west-2 can only be accessed through the us-west-2 endpoint. Usage, quotas, cost, files, batches, and Skills all roll up per workspace, giving you per-region breakdowns in the Claude Console.

Workspaces also serve as the primary IAM resource for Claude Platform on AWS. You grant or deny access to specific workspaces through AWS IAM policies using the workspace ARN. The ARN's resource segment is the same wrkspc_-prefixed ID you pass in the anthropic-workspace-id header:

arn:aws:aws-external-anthropic:{region}:{account-id}:workspace/{workspace-id}

For example:

arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj

See IAM policies for policy examples.

Managing workspaces

Create additional workspaces, rename a workspace, or archive a workspace from the AWS Console Workspaces page or with the Admin API workspace endpoints. A new workspace is bound to the AWS region of the endpoint you call to create it (see Workspace scoping). The Claude Console Workspaces page is read-only.

Using the Claude Console

Claude Platform on AWS uses the standard Claude Console at platform.claude.com. When you sign in from the AWS Console, an Account managed by AWS indicator appears in the bottom-left of the Claude Console sidebar and the Console scopes to your Claude Platform on AWS organization. It provides usage analytics, cost breakdowns, rate limit visibility, workspace visibility, and pages for managing files, Agent Skills, batch jobs, and Claude Managed Agents resources (agents, sessions, environments, credential vaults, and memory stores).

Signing in

Access to the Claude Console is federated through AWS IAM. See Set up your account for the full first-time sign-in flow. In short:

1. Assume an IAM role with the aws-external-anthropic:AssumeConsole permission. See IAM actions for Claude Platform on AWS.
2. Navigate to the Claude Platform on AWS page in the AWS Console.
3. Choose Open Claude Console. The AWS Console issues a JWT and redirects you to platform.claude.com.
4. On first sign-in, you're prompted for an email address; enter your work email. The platform provisions your Claude Console user just-in-time.

Two Claude Console roles are available: Admin and Developer. The Admin role grants access to all Claude Console pages and settings available for Claude Platform on AWS. The Developer role grants read access to usage, cost, rate limit, and workspace information. Contact your Anthropic account representative to assign the Admin or Developer role to a principal.

Available pages

The Through AWS gateway column indicates whether the page reads and writes data through the AWS gateway (and is therefore governed by IAM actions). Pages marked No read organization-level metadata directly through Anthropic APIs and bypass IAM action checks.

Switching organizations

The Claude Console does not support organization switching for Claude Platform on AWS. To access a different organization, sign out and reauthenticate through the AWS Console using the IAM role for that organization's AWS account.

Rate limits and quotas

Claude Platform on AWS assigns Tier 1 rate limits on sign-up. Anthropic manages rate limits directly, not through AWS quota systems.

Unlike the first-party Claude API, automatic tier advancement does not apply. If you need higher limits, contact your Anthropic account representative. For tier details and per-model limits, see Rate limits.

Billing

Claude Platform on AWS bills through AWS Marketplace. Usage is denominated in Claude Consumption Units (CCUs), metered hourly, and invoiced monthly in arrears on your AWS bill. CCUs are not prepaid credits; there is no CCU balance or commitment.

For the CCU price, conversion mechanics, discount application, and per-model token rates, see Claude Platform on AWS pricing.

Monitoring and logging

AWS CloudTrail can capture all requests to Claude Platform on AWS. Workspace and vault operations are logged as Management events by default. Inference, batch, file, skill, model, user profile, and Claude Managed Agents operations (other than vaults) are classified as Data events and require explicit data event logging configuration, which incurs additional CloudTrail charges. See the IAM actions reference for the full event type classification and the AWS CloudTrail documentation for configuration details.

Request IDs

Each response includes two request IDs in the response headers:

• AWS request ID (x-amzn-requestid): The primary ID, indexed in CloudTrail. Use this when investigating requests through AWS tooling or when contacting AWS support.
• Anthropic request ID (request-id): The secondary ID. Use this when contacting Anthropic support.

from anthropic import AnthropicAWS

client = AnthropicAWS()

response = client.messages.with_raw_response.create(
    model="claude-sonnet-4-6",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Hello!"}],
)

print(response.headers.get("x-amzn-requestid"))  # AWS request ID
print(response.headers.get("request-id"))  # Anthropic request ID

message = response.parse()
print(message.content)

Anthropic recommends logging your activity on at least a 30-day rolling basis to understand usage patterns and investigate any potential issues.

Migrating from Amazon Bedrock

If you currently use Claude on Bedrock, migrating to Claude Platform on AWS requires changes throughout your integration. SigV4 signing remains supported, but the signing context, base URL, API format, model IDs, SDK client and package, streaming format, request headers, and region availability all change. The following table summarizes the differences.

What changes

The migration delta depends on which Bedrock integration you're coming from. The following table shows both the current Bedrock integration (Messages API at bedrock-mantle.{region}.api.aws) and the legacy InvokeModel integration.

If you're on the current Bedrock integration, the request body format is already the Anthropic Messages API; the changes are the base URL, SigV4 service name, model IDs, and adding the anthropic-workspace-id header. If you're on the legacy InvokeModel or Converse API, you'll also rewrite the request and response shapes to the Messages API format. See Claude on Amazon Bedrock (legacy) for the request-shape mapping.

What you gain

• Typically same-day access to new models and features (see feature limitations)
• Agent Skills for document generation (PowerPoint, Excel, Word, PDF)
• Code execution in Anthropic's managed sandbox
• Beta features through the anthropic-beta header (see feature limitations)
• Claude Console for quota visibility and usage analytics
• Direct Anthropic support
• API key authentication as an alternative to SigV4 (see API key authentication)

What stays the same

• AWS IAM authentication (SigV4)
• AWS as the invoicing party (the billing channel changes from native AWS service to AWS Marketplace; see Commercial considerations)
• AWS commitment retirement

Migration pitfalls

Commercial considerations

• Anthropic terms of service: Using Claude Platform on AWS requires accepting Anthropic's Commercial Terms of Service and Usage Policy. If your organization hasn't already accepted these (for example, if you've only used Claude through Bedrock), you're prompted during account setup. See Set up your account.
• Discounts and private offers: Negotiated discounts and AWS Marketplace private offers don't transfer automatically between Bedrock and Claude Platform on AWS. Work with your Anthropic account representative to set up commercial terms for Claude Platform on AWS.

IAM policies

Claude Platform on AWS integrates with AWS IAM for access control. You grant or deny access to specific API actions on specific workspaces using standard IAM policy syntax.

The SigV4 service name and IAM action namespace is aws-external-anthropic. Actions follow the pattern aws-external-anthropic:<Action> (for example, aws-external-anthropic:CreateInference).

Example: deny batch inference

The following policy allows real-time inference while blocking batch processing:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CreateInference",
        "aws-external-anthropic:CountTokens",
        "aws-external-anthropic:GetModel",
        "aws-external-anthropic:ListModels",
        "aws-external-anthropic:GetWorkspace"
      ],
      "Resource": "arn:aws:aws-external-anthropic:*:*:workspace/*"
    },
    {
      "Effect": "Allow",
      "Action": "aws-external-anthropic:ListWorkspaces",
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": [
        "aws-external-anthropic:CreateBatchInference",
        "aws-external-anthropic:GetBatchInference",
        "aws-external-anthropic:ListBatchInferences"
      ],
      "Resource": "*"
    }
  ]
}

The GetBatchInference action authorizes both the batch metadata route and the batch results route. Denying it blocks both reads. For a Deny-only policy suitable for ZDR-sensitive workloads, see Feature lockdown for a ZDR-sensitive workspace.

Managed policies

AWS provides four managed policies (AnthropicFullAccess, AnthropicReadOnlyAccess, AnthropicInferenceAccess, and AnthropicLimitedAccess) for common access patterns. For the actions each policy grants, the complete list of IAM actions, the route-to-action mapping, and additional policy examples, see IAM actions for Claude Platform on AWS.

Additional resources

• Claude Console for Claude Platform on AWS: platform.claude.com (access through the AWS Console)
• Pricing details: Pricing
• Bedrock (AWS-operated Claude): Claude in Amazon Bedrock
• AWS Marketplace: aws.amazon.com/marketplace