Troubleshoot CMEK

Verify in the Claude Console, Add on claude.ai, and the Admin API's validate call all run the same check. When it fails (Connection failed in the Claude Console), see the causes for AWS KMS, Google Cloud KMS, or Azure Key Vault.

If a feature stopped working, it might be one that customer-managed encryption keys (CMEK) turn off. Check the Claude Platform list or Claude Enterprise list.

If nothing here fits, contact your Anthropic account team.

Requests fail after setup

cmek_key_disabled

Customer-managed encryption key is disabled or revoked. Re-enable the key to restore access.

This 400 error means your key management service refused Anthropic's call. Check these causes in order:

1. The key is disabled.
2. Anthropic's access to the key was removed. Your setup page shows the access Anthropic needs.
3. On AWS KMS, the key policy lists workspaces but not this one.
4. On AWS KMS, an IP condition blocks Anthropic's outbound IP addresses.

Fix the cause. Two limits apply when access returns.

cmek_key_network_blocked

The request to your key management service was blocked by its network access controls (for example, a KMS firewall or IP allowlist). Verify that your KMS network rules allow requests from Anthropic's published IP addresses, or contact Anthropic support if your configuration looks correct.

This is a 400 error. The key itself might be healthy. Allow Anthropic's published IP addresses in your key management service's network rules.

cmek_key_unreachable

The workspace's customer-managed encryption key could not be reached. Try again shortly. If this continues, check that the key is available in your key management service, or contact Anthropic support.

This 503 error means Anthropic couldn't reach your key. Retry the request.

Verification fails: AWS KMS

To print the key policy, run:

aws kms get-key-policy \
  --region <REGION> \
  --key-id <KEY_ARN> \
  --policy-name default

A key that already protects data

If you're replacing the policy on a key that already protects data, add this statement so Anthropic can still decrypt that data. In its condition, list the compartment ID of every workspace the key is or was attached to.

{
  "Sid": "AllowAnthropicCMEKDecryptExistingData",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::915198916910:role/anthropic-cmek-client-us"
  },
  "Action": "kms:Decrypt",
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "kms:EncryptionContext:anthropic:compartment_uuid": ["<COMPARTMENT_UUID>"]
    }
  }
}

Verification fails: Google Cloud KMS

To check the grant, run:

gcloud kms keys get-iam-policy <your-key-name> \
  --project=<your-project-id> \
  --location=<region> \
  --keyring=<your-keyring-name>

Verification fails: Azure Key Vault

Attaching fails on Claude Platform on AWS

Claude Platform on AWS has no Verify step, so a problem with the key shows when you attach it.

If attaching still fails, find the denied kms: event in CloudTrail in the key's account. It shows the calling principal and, for cryptographic calls, the encryption context. Fix the cause, then click Save again.

Attaching or adding a key is refused

The workspace doesn't retain data

CMEK keys can only be attached to workspaces in this organization that have inference data retention enabled.

Your organization uses zero data retention (ZDR), and a key needs a workspace that retains data. Switch the workspace to Standard data retention first.

The workspace has no Encryption key setting

Only a workspace that retains data has this setting, so select Standard data retention for the workspace first. A ZDR organization's default workspace can't be switched, so use another.

There is no Encryption keys section

In the Claude Console, select Organization from the dropdown menu at the top of the Data retention page. If the section is still missing, your role doesn't include it or CMEK isn't turned on for your organization. Your Anthropic account team turns CMEK on.

The workspace already has a key

This workspace already has a different external key attached.

A workspace's key can't be replaced, so create a new workspace for a different key.

Adding a key on claude.ai fails

The encryption key couldn’t be added.

The check on your key failed. Find the cause for AWS KMS, Google Cloud KMS, or Azure Key Vault. To retry, click Add key again. The dialog box opens with your earlier details. Select the checkbox, click Continue, then click Add.

Expected errors in CloudTrail

On Claude Platform and Claude Enterprise, Anthropic checks the key whenever you verify it, attach it to a workspace, or view it on claude.ai. Each check adds four expected access-denied errors to CloudTrail.

To filter them out, match all three values:

• requestParameters.encryptionContext.associatedData: Y21lay12YWxpZGF0aW9u
• userIdentity.accountId: 915198916910
• resources.ARN: arn:aws:kms:<REGION>:<AWS_ACCOUNT_ID>:key/<KEY_ID>

The first value alone isn't enough, because any caller can set it.