claude-platform-on-aws changedbuild-with-claude/claude-platform-on-aws
Nearest release: v2.1.318, published 4 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+69added
Lines−27removed
From line
39
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits61to this page, all time
### Connect through AWS PrivateLink
The whole hunk
from line 39, old and new numbered
/
from line 39
3939
4040If you need AWS-operated Claude, see [Claude in Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock). Claude Platform on AWS uses a separate capacity pool from both the first-party Claude API and Amazon Bedrock. You can run workloads on more than one platform and fail over between them.
4141
42[AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) is supported for connecting your VPC to the Claude Platform on AWS endpoint.
42[AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) is supported for connecting your VPC to the Claude Platform on AWS endpoint (see [Connect through AWS PrivateLink](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#connect-through-aws-privatelink)).
4343
4444**When to choose Bedrock:** Organizations in regulated industries that require FedRAMP High, IL4, IL5, or HIPAA-ready compliance, or that need AWS to be the sole data processor, should use [Claude in Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock). Bedrock runs entirely on AWS-controlled infrastructure with AWS as the operating party.
4545
from line 130
130130* **“Not found” message during sign-in:** This message might appear briefly during redirect. You can dismiss it.
131131* **Usage page shows no data after your first API call:** Usage data can take a few minutes to appear in the Claude Console.
132132* **“Outbound web identity federation is disabled” on your first API call:** Enable federation once per account. See [Enable outbound web identity federation](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#enable-outbound-web-identity-federation).
133* **403 `permission_error` that names `sts:GetWebIdentityToken` or `sts:TagGetWebIdentityToken`:** Grant both actions to the IAM principal that the error message names. See [IAM policies](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#iam-policies).
133134
134135## Before making API calls
135136
from line 140
1391402. The [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html) installed and configured
1401413. **Outbound web identity federation enabled** on your AWS account, a one-time setup step (see [Enable outbound web identity federation](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#enable-outbound-web-identity-federation))
1411424. Your workspace ID (see [Obtain your workspace ID](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#obtain-your-workspace-id))
1425. IAM permission to call the API: the `aws-external-anthropic:CreateInference` action on your workspace, plus `aws-external-anthropic:CallWithBearerToken` if you authenticate with an API key (see [IAM policies](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#iam-policies))
1435. IAM permission to call the API: the `aws-external-anthropic:CreateInference` action on your workspace, plus the `sts:GetWebIdentityToken` and `sts:TagGetWebIdentityToken` actions (see [IAM policies](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#iam-policies))
1446. IAM permission for the `aws-external-anthropic:CallWithBearerToken` action if you authenticate with an API key (see [API key authentication](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#api-key-authentication))
143145
144146### Enable outbound web identity federation
145147
from line 199
197199
198200For simpler integration paths (local development and scripts), you can authenticate with an API key instead of SigV4. Set the `ANTHROPIC_AWS_API_KEY` environment variable or pass `api_key` (typescript, php: `apiKey`; go: `APIKey`; java: `.apiKey()`; csharp: `AwsClientOptions.ApiKey`) when you create the client.
199201
200Generate API keys in the **AWS Console** under **Claude Platform on AWS → API keys**. Click **Generate a key**, then copy the key value. Grant the `aws-external-anthropic:CallWithBearerToken` IAM action to the principals that should be allowed to use API key authentication.
202Generate API keys in the **AWS Console** under **Claude Platform on AWS → API keys**. Click **Generate a key**, then copy the key value. Principals that use API keys need the same IAM permissions as principals that sign requests with SigV4, including two STS actions (see [IAM policies](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#iam-policies)). Also grant the `aws-external-anthropic:CallWithBearerToken` IAM action to the principals that should be allowed to use API key authentication.
201203
202204<Note>
203205 API keys for Claude Platform on AWS are managed in the AWS Console, not the Claude Console. Keys created in the standard Claude Console at [platform.claude.com](https://platform.claude.com/) (for first-party API access) don’t work with the Claude Platform on AWS endpoint.
from line 259
257259
258260If you can generate the token locally, your process already has SigV4 credentials, and SigV4 authentication is usually the simpler choice. Use short-term keys when the process making API calls is separate from the process that holds AWS credentials.
259261
260The SDK does not refresh short-term keys automatically. When a token expires, generate a new one and construct a new client. The principal that uses the token still needs the `aws-external-anthropic:CallWithBearerToken` IAM action.
262The SDK does not refresh short-term keys automatically. When a token expires, generate a new one and construct a new client. The principal whose AWS credentials you use to generate the token needs the permissions described in [API key authentication](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#api-key-authentication).
261263
262264### Credential precedence
263265
from line 391
389391 -u "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
390392 -H "x-amz-security-token: $AWS_SESSION_TOKEN" \
391393 -H "content-type: application/json" \
392 -H "anthropic-version: 2023-06-01" \
394 -H "anthropic-version: 2026-10-21" \
393395 -H "anthropic-workspace-id: $ANTHROPIC_AWS_WORKSPACE_ID" \
394396 -d '{
395397 "model": "claude-sonnet-5-5",
from line 445
443445 ```csharp C#
444446 using Anthropic;
445447 using Anthropic.Aws;
448 using Anthropic.Models.Messages;
446449
447450 var client = new AnthropicAwsClient();
448451
from line 545
542545
543546Context-window sizes on Claude Platform on AWS are identical to the first-party Claude API. See [Context windows](https://platform.claude.com/docs/en/build-with-claude/context-windows) for per-model limits.
544547
548### Connect through AWS PrivateLink
549
550To connect your VPC to the Claude Platform on AWS endpoint through AWS PrivateLink, create an interface VPC endpoint in your workspace’s AWS region. For the procedure, see [Access an AWS service using an interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html) in the AWS documentation.
551
552The endpoint service name follows this format:
553
554```text wrap
555com.amazonaws.{region}.aws-external-anthropic
556```
557
558For example:
559
560```text wrap
561com.amazonaws.us-east-2.aws-external-anthropic
562```
563
564The endpoint service name is a different string from the hostname in the base URL, `aws-external-anthropic.{region}.api.aws`. That hostname is the service’s private DNS name. With private DNS enabled on the interface endpoint, it resolves to that endpoint inside your VPC. The SDK client and cURL requests keep the same base URL.
565
545566## Feature support
546567
547568Claude Platform on AWS uses Claude API endpoints directly, which means you get full feature parity with the first-party Claude API (except where noted in the [feature limitations](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#features-not-supported)):
from line 597
576597The following capabilities are not currently available on Claude Platform on AWS:
577598
578599* **HIPAA readiness:** Anthropic’s HIPAA-ready program is not available. See [API and data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention).
600* **Admin API:** Workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`), external key endpoints (register, get, list, update, and delete on `/v1/organizations/external_keys`, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek); keys are validated when attached to a workspace rather than through a validate endpoint), the [telemetry destination endpoints](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#telemetry-destinations), and the [Usage and Cost Analytics API](https://platform.claude.com/docs/en/manage-claude/usage-cost-analytics-api) endpoints are available. Other Admin API endpoints (organization members, workspace members, invites, API keys, the legacy [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), and rate limit reports) are not available. AWS IAM manages organization membership.
601* **Workspace member management:** Adding or removing users from individual workspaces is not available. AWS IAM policies on workspace ARNs control access.
602* **Claude Code workspace and Claude Code Analytics API:** The Claude Code workspace with automatic rate limits is not available. Claude Code usage appears in the general usage view rather than a dedicated screen.
603* **OAuth authentication:** Not supported. Use SigV4 or API key authentication.
604* **Fast mode:** Not available on Claude Platform on AWS.
605* **OpenAI-compatible API endpoints:** Not available on Claude Platform on AWS.
606* **MCP tunnels:** Only MCP servers exposed over the public internet are supported.
579607
580- **Admin API:** Workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`), external key endpoints (register, get, list, update, and delete on `/v1/organizations/external_keys`, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek); keys are validated when attached to a workspace rather than through a validate endpoint), the [telemetry destination endpoints](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#telemetry-destinations), and the [Usage and Cost Analytics API](https://platform.claude.com/docs/en/manage-claude/usage-cost-analytics-api) endpoints are available. Other Admin API endpoints (organization members, workspace members, invites, API keys, the legacy [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), and rate limit reports) are not available. AWS IAM manages organization membership.
581- **Workspace member management:** Adding or removing users from individual workspaces is not available. AWS IAM policies on workspace ARNs control access.
582- **Claude Code workspace and Analytics API:** The Claude Code workspace with automatic rate limits is not available. Claude Code usage appears in the general usage view rather than a dedicated screen.
583- **OAuth authentication:** Not supported. Use SigV4 or API key authentication.
584- **Fast mode:** Not available on Claude Platform on AWS.
585- **OpenAI-compatible API endpoints:** Not available on Claude Platform on AWS.
586- **MCP tunnels:** Only MCP servers exposed over the public internet are supported.
587
588608## Data residency
589609
590610Claude Platform on AWS supports the following inference geographies:
from line 631
611631 -u "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
612632 -H "x-amz-security-token: $AWS_SESSION_TOKEN" \
613633 -H "content-type: application/json" \
614 -H "anthropic-version: 2023-06-01" \
634 -H "anthropic-version: 2026-10-21" \
615635 -H "anthropic-workspace-id: $ANTHROPIC_AWS_WORKSPACE_ID" \
616636 -d '{
617637 "model": "claude-sonnet-5-5",
from line 686
666686 ```csharp C#
667687 using Anthropic;
668688 using Anthropic.Aws;
689 using Anthropic.Models.Messages;
669690
670691 var client = new AnthropicAwsClient();
671692
from line 908
887908 -u "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
888909 -H "x-amz-security-token: $AWS_SESSION_TOKEN" \
889910 -H "content-type: application/json" \
890 -H "anthropic-version: 2023-06-01" \
911 -H "anthropic-version: 2026-10-21" \
891912 -H "anthropic-workspace-id: $ANTHROPIC_AWS_WORKSPACE_ID" \
892913 -d '{
893914 "model": "claude-sonnet-5-5",
from line 974
953974 ```csharp C#
954975 using Anthropic;
955976 using Anthropic.Aws;
977 using Anthropic.Models.Messages;
956978
957979 var client = new AnthropicAwsClient();
958980
959 var response = await client.WithRawResponse.Messages.Create(new()
981 using var response = await client.WithRawResponse.Messages.Create(new()
960982 {
961983 Model = Model.ClaudeSonnet5_5,
962984 MaxTokens = 1024,
from line 985
963985 Messages = [new UserMessageParam { Content = "Hello!" }]
964986 });
965987
966 Console.WriteLine(response.Headers.GetValues("x-amzn-requestid").First()); // AWS request ID
967 Console.WriteLine(response.Headers.GetValues("request-id").First()); // Anthropic request ID
968 Console.WriteLine(response.Value.Content);
988 Console.WriteLine(response.GetHeaderValues("x-amzn-requestid").First()); // AWS request ID
989 Console.WriteLine(response.RequestID); // Anthropic request ID
990 Console.WriteLine(await response.Deserialize());
969991 ```
970992
971993 ```go Go
from line 1050
10281050
10291051 $client = new Client();
10301052
1031 $response = $client->messages->raw->create(
1032 model: 'claude-sonnet-5-5',
1033 maxTokens: 1024,
1034 messages: [['role' => 'user', 'content' => 'Hello!']],
1035 );
1053 $response = $client->messages->raw->create([
1054 'model' => 'claude-sonnet-5-5',
1055 'maxTokens' => 1024,
1056 'messages' => [['role' => 'user', 'content' => 'Hello!']],
1057 ]);
10361058
10371059 echo $response->getHeaderLine('x-amzn-requestid') . "\n"; // AWS request ID
10381060 echo $response->getHeaderLine('request-id') . "\n"; // Anthropic request ID
1039 echo $response->parse()->content;
1061 echo $response->parse();
10401062 ```
10411063
10421064 ```ruby Ruby
from line 1157
11351157
11361158The SigV4 service name and IAM action namespace is `aws-external-anthropic`. Actions follow the pattern `aws-external-anthropic:<Action>` (for example, `aws-external-anthropic:CreateInference`).
11371159
1160Every principal that calls the API, with SigV4 or an API key, also needs permission for two AWS STS actions: `sts:GetWebIdentityToken` and `sts:TagGetWebIdentityToken`. The Claude Platform on AWS gateway calls STS as that principal to get a JWT it forwards to Anthropic (see [Enable outbound web identity federation](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#enable-outbound-web-identity-federation)). If either permission is missing, requests fail with a 403 `permission_error` whose message names the denied action, even when the `aws-external-anthropic` actions are granted.
1161
1162If the principal has the `AnthropicFullAccess`, `AnthropicLimitedAccess`, or `AnthropicReadOnlyAccess` AWS managed policy, or administrator access, it already has both actions. A custom policy must grant them, as the following example does. The example allows `sts:GetWebIdentityToken` only when the gateway makes the call and names one of Anthropic’s two audiences, as those managed policies do.
1163
11381164### Example: deny batch inference
11391165
11401166The following policy allows real-time inference while blocking batch processing:
from line 1182
11561182 },
11571183 {
11581184 "Effect": "Allow",
1159 "Action": "aws-external-anthropic:ListWorkspaces",
1185 "Action": ["aws-external-anthropic:ListWorkspaces", "sts:TagGetWebIdentityToken"],
11601186 "Resource": "*"
11611187 },
11621188 {
1189 "Effect": "Allow",
1190 "Action": "sts:GetWebIdentityToken",
1191 "Resource": "*",
1192 "Condition": {
1193 "ForAnyValue:StringEquals": {
1194 "sts:IdentityTokenAudience": [
1195 "https://api.anthropic.com",
1196 "https://platform.claude.com"
1197 ]
1198 },
1199 "StringEquals": {
1200 "aws:CalledViaLast": "aws-external-anthropic.amazonaws.com"
1201 }
1202 }
1203 },
1204 {
11631205 "Effect": "Deny",
11641206 "Action": [
11651207 "aws-external-anthropic:CreateBatchInference",
from line 1219
11771219<Note>
11781220 `ListWorkspaces` is account-scoped, so it appears in a separate Allow statement with `"Resource": "*"`. Specifying a workspace ARN on an account-scoped action has no effect (see [Provisioning automation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#provisioning-automation)).
11791221
1180 This policy assumes AWS SigV4 authentication. If the principal authenticates with an API key, also add `aws-external-anthropic:CallWithBearerToken` to the `"Resource": "*"` Allow statement. `CallWithBearerToken` is a route-less authentication-layer action that does not bind to a workspace ARN. See [Per-customer workspace isolation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#per-customer-workspace-isolation) for the two-statement pattern.
1222 This policy assumes AWS SigV4 authentication. If the principal authenticates with an API key, also add `aws-external-anthropic:CallWithBearerToken` to the `"Resource": "*"` Allow statement that holds `ListWorkspaces`. `CallWithBearerToken` is a route-less authentication-layer action that does not bind to a workspace ARN. See [Per-customer workspace isolation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#per-customer-workspace-isolation) for a policy that grants it.
11811223</Note>
11821224
11831225### Managed policies
No line in this hunk matches that.