Configure AWS KMS for CMEK

claude "/claude-api help me configure a customer-managed encryption key with AWS KMS"

This guide walks through configuring an AWS KMS key as a customer-managed encryption key (CMEK) for your Anthropic organization.



Prerequisites

• An AWS account with permissions to create KMS keys and set key policies (kms:CreateKey and kms:PutKeyPolicy).
• An Anthropic Admin API key for your organization.
• The AWS CLI installed and authenticated.



Amazon Resource Name (ARN) for Anthropic

To have Anthropic use your encryption key, you must give Anthropic's IAM role a KMS key it can use for encrypting data. The ARN for Anthropic CMEK is:

arn:aws:iam::915198916910:role/anthropic-cmek-client-us



Encryption key setup



Register the key with Anthropic

How you register the key depends on which product you use.



Set up CMEK on Claude Platform on AWS

On Claude Platform on AWS, CMEK uses AWS KMS keys only, and setup differs from the preceding sections in these ways:

• Principal: Your key policy grants access to the AWS service principal aws-external-anthropic.amazonaws.com. Anthropic's IAM role and account ID are not used, so the ARN for Anthropic does not apply.
• Key requirements: The key must be a symmetric KMS key with encrypt and decrypt usage, single-region, and in the same AWS account and region as the workspace you attach it to. Multi-region keys (key IDs that begin with mrk-) and alias ARNs are rejected; use the key ARN.
• No separate validation step: The key is validated when you attach it to a workspace. The attach call performs an encrypt/decrypt round against the key with that workspace's compartment ID as the encryption context, so a key policy problem surfaces at attach time rather than at registration. Unlike the Claude Platform policy earlier on this page, an EncryptionContext condition therefore needs no all-zeros entry.
• Where you manage keys: Register and attach keys in the Claude Console, signed in through AWS with the Admin role. The external key endpoints are also available on Claude Platform on AWS, authorized through IAM actions; there, a key is identified by its KMS key ARN rather than an ekey_ ID.



Prerequisites

• The AWS account that hosts your Claude Platform on AWS organization, with permissions to create KMS keys and set key policies (kms:CreateKey and kms:PutKeyPolicy).
• The Admin role in the Claude Console for Claude Platform on AWS. See Using the Claude Console.
• For the IAM principal you sign in to the Claude Console with: besides aws-external-anthropic:AssumeConsole, the IAM actions for the operations you perform there, because the Encryption keys page and key attachment go through the AWS gateway. Registering a key is RegisterKey (with ListKeys and GetKey to view registrations), and attaching one is UpdateWorkspace or CreateWorkspace. The external key actions (and CreateWorkspace) are account-scoped, so grant them on Resource: "*"; a policy limited to workspace ARNs does not include them.
• For the IAM principal that attaches the key to a workspace (the identity you signed in to the Claude Console with): kms:DescribeKey, kms:Encrypt, and kms:Decrypt on the key. Your principal's access to the key is checked when you attach it, in addition to the service principal's.
• Optional, for the key picker in the Claude Console: kms:ListKeys and kms:DescribeKey for the principal you sign in with. Without them, paste the key ARN instead.



Create the KMS key

The key policy has three statements: your account's root admin statement; a statement that lets the Claude Platform on AWS service principal encrypt, decrypt, and generate data keys; and a separate statement for kms:DescribeKey. Both service-principal statements carry a recommended aws:SourceArn condition: the service calls your key on behalf of a specific workspace and passes that workspace's ARN as the source ARN, so the pattern shown limits the grant to workspaces in your own AWS account. DescribeKey is granted separately because it has no EncryptionContext parameter, so an EncryptionContext condition on that action would always deny.

If you plan to use the optional EncryptionContext condition shown here, create the workspace first (without a key) and copy its compartment ID from the Claude Console under Workspace > Security, under Encryption key (the Compartment ID field), or from the compartment_id field returned by the Get Workspace endpoint. Substitute it for <compartment-uuid>. Otherwise, delete the StringEquals entry from that statement's Condition block and keep the ArnLike entry.

export YOUR_ACCOUNT=$(aws sts get-caller-identity --query Account --output text)

aws kms create-key \
  --region <workspace-region> \
  --description "Anthropic CMEK (Claude Platform on AWS)" \
  --key-usage ENCRYPT_DECRYPT \
  --policy "{
    \"Version\": \"2012-10-17\",
    \"Statement\": [
      {
        \"Sid\": \"AccountRootAdmin\",
        \"Effect\": \"Allow\",
        \"Principal\": {\"AWS\": \"arn:aws:iam::${YOUR_ACCOUNT}:root\"},
        \"Action\": \"kms:*\",
        \"Resource\": \"*\"
      },
      {
        \"Sid\": \"AllowClaudePlatformOnAWSCrypto\",
        \"Effect\": \"Allow\",
        \"Principal\": {\"Service\": \"aws-external-anthropic.amazonaws.com\"},
        \"Action\": [\"kms:Encrypt\", \"kms:Decrypt\", \"kms:GenerateDataKey\"],
        \"Resource\": \"*\",
        \"Condition\": {
          \"ArnLike\": {
            \"aws:SourceArn\": \"arn:aws:aws-external-anthropic:*:${YOUR_ACCOUNT}:workspace/*\"
          },
          \"StringEquals\": {
            \"kms:EncryptionContext:anthropic:compartment_uuid\": [
              \"<compartment-uuid>\"
            ]
          }
        }
      },
      {
        \"Sid\": \"AllowClaudePlatformOnAWSDescribe\",
        \"Effect\": \"Allow\",
        \"Principal\": {\"Service\": \"aws-external-anthropic.amazonaws.com\"},
        \"Action\": \"kms:DescribeKey\",
        \"Resource\": \"*\",
        \"Condition\": {
          \"ArnLike\": {
            \"aws:SourceArn\": \"arn:aws:aws-external-anthropic:*:${YOUR_ACCOUNT}:workspace/*\"
          }
        }
      }
    ]
  }"

Capture KeyMetadata.Arn from the output. You need it when you register the key.

Both conditions are optional hardening, and they compose. The aws:SourceArn condition can be written before any workspace exists; to pin the key to particular workspaces instead of your whole account, list their full workspace ARNs in place of the wildcard pattern, and to start without it, delete the ArnLike entry from both service-principal statements (removing a Condition block that this leaves empty). The EncryptionContext condition is also optional. Every encrypt, decrypt, and data-key call made for a workspace, including the attach-time check, carries that workspace's compartment ID as anthropic:compartment_uuid, so the condition lists the compartment ID of each workspace you attach the key to and needs no all-zeros entry. Adding it binds the key to the workspaces you list at the IAM layer as well. Because a compartment ID exists only once its workspace exists, the order is: create the workspace, put its compartment ID in the condition (at key creation, or later with kms:PutKeyPolicy), then attach the key. Before attaching the key to each additional workspace, add that workspace's compartment ID the same way. To start without it, delete the StringEquals entry from the AllowClaudePlatformOnAWSCrypto statement's Condition block; if you add it later, include the compartment ID of every workspace the key is already attached to.

You can also create the key from the AWS Console: choose a symmetric key with the encrypt and decrypt key usage, a single-region key, and KMS key material origin, in the workspace's region. Leave key usage permissions empty in the Create-key wizard, then open the key's Key policy tab and replace the JSON with the policy shown here.



Register and attach the key



Terraform

For infrastructure-as-code deployments, the same steps map to the aws provider with the aws_kms_key and aws_kms_alias resources.