cmek-claude-platform-on-aws changedmanage-claude/cmek-claude-platform-on-aws

Nearest release: v2.1.305, published 2 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here 20 Oct 2026 17:07 UTC

Lines+8added

Lines−8removed

From line 7 where the diff opens

First seen 16 Oct 2026 this site's first read of the page

Recorded edits2to this page, all time

The whole hunk

from line 7, old and new numbered

lines

from line 7

77This guide shows how to use an [AWS KMS](https://aws.amazon.com/kms/) key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) on [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws). For Claude Platform or Claude Enterprise, follow [Configure AWS KMS for CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms) instead.

99<Warning>

10 Enabling CMEK is permanent. If your KMS key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you begin.

10 Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.

1111</Warning>

1212

1313## Prerequisites

from line 107

107107 **Finding your compartment ID:** In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`). Select the workspace from the dropdown menu at the top of the page. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint.

108108</Note>

109109

110<Note>

111 **Optional:** To limit both service principal statements further, add an `aws:SourceArn` condition to each. The source ARN on every call is the [workspace's ARN](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#service-details), in the form `arn:aws:aws-external-anthropic:<REGION>:<AWS_ACCOUNT_ID>:workspace/<WORKSPACE_ID>`.

112

113 * **All workspaces in your AWS account:** `"ArnLike": {"aws:SourceArn": "arn:aws:aws-external-anthropic:*:<AWS_ACCOUNT_ID>:workspace/*"}`

114 * **Specific workspaces:** the same condition, with a list of full workspace ARNs instead of the wildcard

115</Note>

116

110117### Create the key

111118

112119Create the key in the AWS account that hosts your Claude Platform on AWS organization, in the same region as the workspace.

from line 196

189196 Copy `KeyMetadata.Arn` from the output. You need it to register the key.

190197 </Tab>

191198</Tabs>

192

193<Note>

194 **Optional:** To limit both service principal statements further, add an `aws:SourceArn` condition to each. The source ARN on every call is the [workspace's ARN](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#service-details), in the form `arn:aws:aws-external-anthropic:<REGION>:<AWS_ACCOUNT_ID>:workspace/<WORKSPACE_ID>`.

195

196 * **All workspaces in your AWS account:** `"ArnLike": {"aws:SourceArn": "arn:aws:aws-external-anthropic:*:<AWS_ACCOUNT_ID>:workspace/*"}`

197 * **Specific workspaces:** the same condition, with a list of full workspace ARNs instead of the wildcard

198</Note>

199199

200200## Register the key with Anthropic

201201