Set up CMEK on Claude Platform on AWS

This guide shows how to use an AWS KMS key as a customer-managed encryption key (CMEK) on Claude Platform on AWS. For Claude Platform or Claude Enterprise, follow Configure AWS KMS for CMEK instead.

Prerequisites

• The AWS account that hosts your Claude Platform on AWS organization, with permissions to create KMS keys and set key policies (kms:CreateKey and kms:PutKeyPolicy).

• To create the key from the command line, the AWS CLI installed and authenticated.

• The Admin role in the Claude Console for Claude Platform on AWS. See Using the Claude Console.

• These permissions for the IAM principal you sign in to the Claude Console with:

  • Sign in: aws-external-anthropic:AssumeConsole
  • Register a key: aws-external-anthropic:RegisterKey
  • View registered keys: aws-external-anthropic:ListKeys and aws-external-anthropic:GetKey
  • Attach a key: aws-external-anthropic:UpdateWorkspace or aws-external-anthropic:CreateWorkspace, plus kms:DescribeKey, kms:Encrypt, and kms:Decrypt on the key
  • Pick the key from a list (optional): kms:ListKeys and kms:DescribeKey

  aws-external-anthropic:RegisterKey, aws-external-anthropic:ListKeys, aws-external-anthropic:GetKey, and aws-external-anthropic:CreateWorkspace are account-scoped. Grant them on Resource: "*". See IAM actions.

AWS service principal for Anthropic

The key policy in this guide gives the following AWS service principal access to your key:

aws-external-anthropic.amazonaws.com

Encryption key setup

Prepare the key policy

Copy this policy into a text editor:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AccountRootAdmin",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<AWS_ACCOUNT_ID>:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "AllowClaudePlatformOnAWSCrypto",
      "Effect": "Allow",
      "Principal": {
        "Service": "aws-external-anthropic.amazonaws.com"
      },
      "Action": ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey"],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:EncryptionContext:anthropic:compartment_uuid": ["<COMPARTMENT_UUID>"]
        }
      }
    },
    {
      "Sid": "AllowClaudePlatformOnAWSDescribe",
      "Effect": "Allow",
      "Principal": {
        "Service": "aws-external-anthropic.amazonaws.com"
      },
      "Action": "kms:DescribeKey",
      "Resource": "*"
    }
  ]
}

The EncryptionContext condition is optional. It limits the key to the workspaces you list. To remove it, delete the Condition block from the AllowClaudePlatformOnAWSCrypto statement.

If you keep the condition, add each workspace's compartment ID before you attach the key to it. For a new workspace:

1. Create the workspace without the key.
2. Add its compartment ID to the policy.
3. Attach the key.

If you add the condition later, list the compartment ID of every workspace the key is already attached to.

To limit the key policy further, see the optional aws:SourceArn condition.

Replace the placeholders:

• <AWS_ACCOUNT_ID>: your AWS account ID. To print it with the AWS CLI, run aws sts get-caller-identity --query Account --output text.
• <COMPARTMENT_UUID>: the compartment ID of the workspace you attach the key to

Create the key

Create the key in the AWS account that hosts your Claude Platform on AWS organization, in the same region as the workspace.

aws kms create-key \
  --region <REGION> \
  --description "Anthropic CMEK" \
  --key-usage ENCRYPT_DECRYPT \
  --policy file://key-policy.json

Register the key with Anthropic

Sign in to the Claude Console through AWS with the Admin role.

1. 1

   Open the encryption key settings

   In the Claude Console, go to the Data retention page (platform.claude.com/settings/privacy). If you don't see Encryption keys, select Organization from the dropdown menu at the top of the page.

2. 2

   Add the key

   Under Encryption keys, click Add key. Enter a Display name.

3. 3

   Enter the key ARN

   Anthropic rejects alias ARNs and multi-Region keys.

   In KMS key ARN, paste the key ARN. If a list of keys appears instead, select your key, or click Enter ARN manually and paste the ARN. Click Add.

4. 4

   Attach the key to a workspace

   Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take up to a day to take effect.

   On the Data retention page, select the workspace from the dropdown menu at the top of the page. Under Encryption key, select the key and click Save.

5. 5

   Confirm the change

   Select the checkbox to confirm that you have read the CMEK documentation, then click Confirm.

Attaching validates the key. If it fails with a KMS access error, see Troubleshoot validation.

You can also select a key when you create a workspace in the Claude Console, if your key policy has no EncryptionContext condition.

To register and attach keys with the API instead, see IAM actions. The API identifies a key by its KMS key ARN.

Troubleshoot validation

If validation fails, common causes are:

• Key policy mismatch: Make sure the key policy matches the one in Prepare the key policy. To check the key policy, run aws kms get-key-policy --region <REGION> --key-id <KEY_ARN> --policy-name default.
• Condition mismatch: Make sure any EncryptionContext or aws:SourceArn condition includes this workspace.
• Key state or location: Confirm that the key is enabled, single-Region, and in the same AWS account and region as the workspace.
• Missing permissions: The principal you are signed in as needs kms:DescribeKey, kms:Encrypt, and kms:Decrypt on the key.
• Organization policies: Make sure no service control policy or resource control policy in your AWS organization blocks the service principal or your principal.

If attaching still fails, find the denied kms: event in CloudTrail in the key's account. It shows the calling principal and, for cryptographic calls, the encryption context. After you fix the cause, click Save again.

Terraform

To create the key with Terraform, use the aws_kms_key and aws_kms_alias resources from the aws provider.