cmek-aws-kms changedmanage-claude/cmek-aws-kms
Nearest release: v2.1.305, published 2 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+85added
Lines−85removed
From line
13
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits19to this page, all time
The whole hunk
from line 13, old and new numbered
/
from line 13
1313This guide shows how to use an [AWS KMS](https://aws.amazon.com/kms/) key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) for your Anthropic organization.
1414
1515<Warning>
16 Enabling CMEK is permanent. If your KMS key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you begin.
16 Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
1717</Warning>
1818
1919<Note>
from line 120
120120 ```
121121</Warning>
122122
123<Note>
124 **Optional:** To limit the key to specific workspaces, replace the `AllowAnthropicCMEKCrypto` statement in the key policy with this one. List one compartment ID for each workspace.
125
126 ```json
127 {
128 "Sid": "AllowAnthropicCMEKCrypto",
129 "Effect": "Allow",
130 "Principal": {
131 "AWS": "arn:aws:iam::915198916910:role/anthropic-cmek-client-us"
132 },
133 "Action": ["kms:Encrypt", "kms:Decrypt"],
134 "Resource": "*",
135 "Condition": {
136 "StringEquals": {
137 "kms:EncryptionContext:anthropic:org_uuid": ["<ORGANIZATION_UUID>"]
138 },
139 "StringEqualsIfExists": {
140 "kms:EncryptionContext:anthropic:compartment_uuid": ["<COMPARTMENT_UUID>"]
141 }
142 }
143 }
144 ```
145
146 Add each workspace's compartment ID before you attach the key to it. For a new workspace:
147
148 1. Create the workspace without the key.
149 2. Add its compartment ID to the policy.
150 3. Attach the key.
151
152 **Finding your compartment ID:** In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`). Select the workspace from the dropdown menu at the top of the page. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint.
153</Note>
154
123155### Create the key
124156
125157Create the key in a [US region](https://platform.claude.com/docs/en/manage-claude/cmek#availability-and-regions). For the lowest latency, use `us-east-2`.
from line 235
203235 </Tab>
204236</Tabs>
205237
206<Note>
207 **Optional:** To limit the key to specific workspaces, replace the `AllowAnthropicCMEKCrypto` statement in the key policy with this one. List one compartment ID for each workspace.
208
209 ```json
210 {
211 "Sid": "AllowAnthropicCMEKCrypto",
212 "Effect": "Allow",
213 "Principal": {
214 "AWS": "arn:aws:iam::915198916910:role/anthropic-cmek-client-us"
215 },
216 "Action": ["kms:Encrypt", "kms:Decrypt"],
217 "Resource": "*",
218 "Condition": {
219 "StringEquals": {
220 "kms:EncryptionContext:anthropic:org_uuid": ["<ORGANIZATION_UUID>"]
221 },
222 "StringEqualsIfExists": {
223 "kms:EncryptionContext:anthropic:compartment_uuid": ["<COMPARTMENT_UUID>"]
224 }
225 }
226 }
227 ```
228
229 Add each workspace's compartment ID before you attach the key to it. For a new workspace:
230
231 1. Create the workspace without the key.
232 2. Add its compartment ID to the policy.
233 3. Attach the key.
234
235 **Finding your compartment ID:** In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`). Select the workspace from the dropdown menu at the top of the page. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint.
236</Note>
237
238238## Register the key with Anthropic
239239
240240Validating the key adds expected access-denied errors to CloudTrail. If you alert on these errors, see [Expected errors in CloudTrail](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#expected-errors-in-cloud-trail) first.
from line 681
681681If validation fails, common causes are:
682682
683683* **Wrong organization ID:** Make sure the `org_uuid` condition lists your bare organization ID, not the `org_`-prefixed ID.
684* **Encryption context mismatch:** If the policy has a `kms:EncryptionContext:anthropic:compartment_uuid` condition, make sure it lists the [compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#compartment-id) of each workspace the key is attached to. On an older key, the compartment statement might still allow `kms:Encrypt`. In that case, keep the all-zeros value (`00000000-0000-0000-0000-000000000000`) in the list too.
684* **Encryption context mismatch:** If the policy has a `kms:EncryptionContext:anthropic:compartment_uuid` condition, make sure it lists the [compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#compartment-id) of each workspace the key is attached to.
685685* **Resource control policies (RCPs):** Some RCPs deny KMS operations when `aws:PrincipalOrgID` does not match your AWS organization. An RCP like this blocks Anthropic's role. Add an exception to it for this key or for Anthropic's role ARN. Service control policies do not apply here.
686686* **Access granted through IAM instead of the key policy:** Grant Anthropic's role access in the key policy itself, not through an IAM policy in your account. To check the key policy, run `aws kms get-key-policy --region <REGION> --key-id <KEY_ARN> --policy-name default`.
687687* **Region mismatch:** Confirm that the key is in a US region.
No line in this hunk matches that.