cmek-troubleshooting changedmanage-claude/cmek-troubleshooting
Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+19added
Lines−19removed
From line
4
where the diff opens
First seen
23 Oct 2026
this site's first read of the page
Recorded edits2to this page, all time
### The workspace doesn’t retain data ### The workspace doesn't retain data
The whole hunk
from line 4, old and new numbered
/
from line 4
44description: Find the cause and fix for a CMEK error message, a failed verification, or an unexpected log entry.
55---
66
7**Verify** in the Claude Console, **Add** on claude.ai, and the Admin API's validate call all run the same check. When it fails (**Connection failed** in the Claude Console), see the causes for [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#aws-kms), [Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#google-cloud-kms), or [Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#azure-key-vault).
7**Verify** in the Claude Console, **Add** on claude.ai, and the Admin API’s validate call all run the same check. When it fails (**Connection failed** in the Claude Console), see the causes for [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#aws-kms), [Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#google-cloud-kms), or [Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#azure-key-vault).
88
99If a feature stopped working, it might be one that customer-managed encryption keys (CMEK) turn off. Check the [Claude Platform list](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-platform#turned-off-or-changed) or [Claude Enterprise list](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
1010
from line 18
1818Customer-managed encryption key is disabled or revoked. Re-enable the key to restore access.
1919```
2020
21This 400 error means your key management service refused Anthropic's call. Check these causes in order:
21This 400 error means your key management service refused Anthropic’s call. Check these causes in order:
2222
23231. The key is disabled.
242. Anthropic's access to the key was removed. [Your setup page](https://platform.claude.com/docs/en/manage-claude/cmek#set-it-up) shows the access Anthropic needs.
242. Anthropic’s access to the key was removed. [Your setup page](https://platform.claude.com/docs/en/manage-claude/cmek#set-it-up) shows the access Anthropic needs.
25253. On AWS KMS, the key policy [lists workspaces](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces) but not this one.
264. On AWS KMS, an IP condition blocks [Anthropic's outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses).
264. On AWS KMS, an IP condition blocks [Anthropic’s outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses).
2727
2828Fix the cause. [Two limits apply](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#restore-access) when access returns.
2929
from line 33
3333The request to your key management service was blocked by its network access controls (for example, a KMS firewall or IP allowlist). Verify that your KMS network rules allow requests from Anthropic's published IP addresses, or contact Anthropic support if your configuration looks correct.
3434```
3535
36This is a 400 error. The key itself might be healthy. Allow [Anthropic's published IP addresses](https://platform.claude.com/docs/en/api/ip-addresses) in your key management service's network rules.
36This is a 400 error. The key itself might be healthy. Allow [Anthropic’s published IP addresses](https://platform.claude.com/docs/en/api/ip-addresses) in your key management service’s network rules.
3737
3838### `cmek_key_unreachable`
3939
from line 41
4141The workspace's customer-managed encryption key could not be reached. Try again shortly. If this continues, check that the key is available in your key management service, or contact Anthropic support.
4242```
4343
44This 503 error means [Anthropic couldn't reach your key](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#unreachable-key). Retry the request.
44This 503 error means [Anthropic couldn’t reach your key](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#unreachable-key). Retry the request.
4545
4646## Verification fails: AWS KMS
4747
from line 49
4949| ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
5050| Wrong organization ID | The `org_uuid` condition must list [your Anthropic organization ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#prerequisites), the UUID without the `org_` prefix. |
5151| A workspace is missing from the policy | A `compartment_uuid` condition must [list the compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces) of each workspace the key is attached to. |
52| Access granted through IAM instead of the key policy | Anthropic's role needs access in [the key policy itself](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#key-policy). |
52| Access granted through IAM instead of the key policy | Anthropic’s role needs access in [the key policy itself](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#key-policy). |
5353
5454To print the key policy, run:
5555
from line 62
6262
6363### A key that already protects data
6464
65If you're [replacing the policy on a key](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces#replace-the-key-policy) that already protects data, add this statement so Anthropic can still decrypt that data. In its condition, list the compartment ID of every workspace the key is or was attached to.
65If you’re [replacing the policy on a key](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces#replace-the-key-policy) that already protects data, add this statement so Anthropic can still decrypt that data. In its condition, list the compartment ID of every workspace the key is or was attached to.
6666
6767```json
6868{
from line 86
8686| Cause | Fix |
8787| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
8888| Wrong organization label | The key needs the [organization label](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#organization-label), with your Anthropic organization ID in lowercase. |
89| Domain restricted sharing | This organization policy blocks the grant to Anthropic's service account. [Add an exception](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#prerequisites). |
90| Disabled or destroyed key version | The key's primary version must be enabled. |
89| Domain restricted sharing | This organization policy blocks the grant to Anthropic’s service account. [Add an exception](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#prerequisites). |
90| Disabled or destroyed key version | The key’s primary version must be enabled. |
9191
9292To check the grant, run:
9393
from line 102
102102
103103| Cause | Fix |
104104| ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
105| Wrong organization tag | The key's current version needs the [organization tag](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#organization-tag). |
105| Wrong organization tag | The key’s current version needs the [organization tag](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#organization-tag). |
106106| Role assignment not yet in effect | A new role assignment can take a few minutes. Wait, then try again. |
107| The vault's network rules block Anthropic | Check the rules against the [vault settings Anthropic needs](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#check-your-vault-configuration). |
107| The vault’s network rules block Anthropic | Check the rules against the [vault settings Anthropic needs](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#check-your-vault-configuration). |
108108
109109## Attaching fails on Claude Platform on AWS
110110
from line 115
115115| Key policy mismatch | Print the key policy with the [`get-key-policy` command](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#aws-kms) and compare it with the [policy on the setup page](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws#prepare-the-key-policy). |
116116| Condition mismatch | Any `EncryptionContext` or `aws:SourceArn` condition must include this workspace. |
117117| Key state or location | The key must be enabled, single-Region, and in the same AWS account and region as the workspace. |
118| Missing permissions | The principal you're signed in as needs `kms:DescribeKey`, `kms:Encrypt`, and `kms:Decrypt` on the key. |
118| Missing permissions | The principal you’re signed in as needs `kms:DescribeKey`, `kms:Encrypt`, and `kms:Decrypt` on the key. |
119119
120If attaching still fails, find the denied `kms:` event in CloudTrail in the key's account. It shows the calling principal and, for cryptographic calls, the encryption context. Fix the cause, then click **Save** again.
120If attaching still fails, find the denied `kms:` event in CloudTrail in the key’s account. It shows the calling principal and, for cryptographic calls, the encryption context. Fix the cause, then click **Save** again.
121121
122122## Attaching or adding a key is refused
123123
124### The workspace doesn't retain data
124### The workspace doesn’t retain data
125125
126126```text wrap
127127CMEK keys can only be attached to workspaces in this organization that have inference data retention enabled.
from line 131
131131
132132### The workspace has no Encryption key setting
133133
134Only [a workspace that retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention) has this setting, so select **Standard data retention** for the workspace first. A ZDR organization's default workspace can't be switched, so use another.
134Only [a workspace that retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention) has this setting, so select **Standard data retention** for the workspace first. A ZDR organization’s default workspace can’t be switched, so use another.
135135
136136### There is no Encryption keys section
137137
138In the Claude Console, select **Organization** from the dropdown menu at the top of the Data retention page. If the section is still missing, your role doesn't include it or CMEK isn't turned on for your organization. Your Anthropic account team turns CMEK on.
138In the Claude Console, select **Organization** from the dropdown menu at the top of the Data retention page. If the section is still missing, your role doesn’t include it or CMEK isn’t turned on for your organization. Your Anthropic account team turns CMEK on.
139139
140140### The workspace already has a key
141141
from line 143
143143This workspace already has a different external key attached.
144144```
145145
146A workspace's key can't be replaced, so [create a new workspace](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#change-keys) for a different key.
146A workspace’s key can’t be replaced, so [create a new workspace](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#change-keys) for a different key.
147147
148148### Adding a key on claude.ai fails
149149
from line 163
163163* `userIdentity.accountId`: `915198916910`
164164* `resources.ARN`: `arn:aws:kms:<REGION>:<AWS_ACCOUNT_ID>:key/<KEY_ID>`
165165
166The first value alone isn't enough, because any caller can set it.
166The first value alone isn’t enough, because any caller can set it.
167167
No line in this hunk matches that.