Home Docs Claude Developer Platform 5 Nov 2026

One change · api

claude-platform-on-aws changedbuild-with-claude/claude-platform-on-aws

Nearest release: v2.1.319, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here 5 Nov 2026 23:07 UTC

Lines+27added

Lines−23removed

From line 7 where the diff opens

First seen 14 Aug 2026 this site's first read of the page

Recorded edits63to this page, all time

The whole hunk

from line 7, old and new numbered

lines

from line 7

77Claude Platform on AWS gives you the full Anthropic platform experience, including the Messages API, Agent Skills, code execution, and beta features, accessible through your AWS account. Unlike [Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock), where AWS operates the inference stack, Anthropic operates Claude Platform on AWS. AWS provides the authentication layer (SigV4 or API key), IAM-based access control, and billing integration through AWS Marketplace.

99<Note>

10 The Anthropic SDKs support Claude Platform on AWS.

10 The SDK supports Claude Platform on AWS.

1111</Note>

1212

1313## How the platform integration works

from line 27

2727| **Who operates the stack** | Anthropic | AWS | AWS |

2828| **API surface** | Claude API (`/v1/{endpoint}`) | Messages API at `/anthropic/v1/messages` | Bedrock Converse / InvokeModel |

2929| **Feature availability** | Typically same-day as Claude API (see [feature limitations](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#features-not-supported)) | Follows the Amazon Bedrock release schedule | Follows the Amazon Bedrock release schedule |

3130| **Beta features** | Pass through with `anthropic-beta` headers (see [feature limitations](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#features-not-supported)) | The beta features Amazon Bedrock supports, through the `anthropic-beta` header | The beta features Amazon Bedrock supports, through the `anthropic_beta` field of the InvokeModel request body |

from line 40

4140

4241[AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) is supported for connecting your VPC to the Claude Platform on AWS endpoint (see [Connect through AWS PrivateLink](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#connect-through-aws-privatelink)).

4342

44**When to choose Bedrock:** Organizations in regulated industries that require FedRAMP High, IL4, IL5, or HIPAA-ready compliance, or that need AWS to be the sole data processor, should use [Claude in Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock). Bedrock runs entirely on AWS-controlled infrastructure with AWS as the operating party.

43**When to choose Bedrock:** Organizations in regulated industries that require FedRAMP High, IL4, IL5, or HIPAA readiness, or that need AWS to be the sole data processor, should use [Claude in Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock). Bedrock runs entirely on AWS-controlled infrastructure with AWS as the operating party.

4544

4645**Which offering are you using?** Claude is available through several distinct products:

4746

from line 135

136135

137136Ensure you have:

138137

1391. An active AWS account with a subscription to Claude Platform on AWS (see [Set up your account](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#set-up-your-account))

1402. The [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html) installed and configured

1413. **Outbound web identity federation enabled** on your AWS account, a one-time setup step (see [Enable outbound web identity federation](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#enable-outbound-web-identity-federation))

1424. Your workspace ID (see [Obtain your workspace ID](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#obtain-your-workspace-id))

1435. IAM permission to call the API: the `aws-external-anthropic:CreateInference` action on your workspace, plus the `sts:GetWebIdentityToken` and `sts:TagGetWebIdentityToken` actions (see [IAM policies](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#iam-policies))

1446. IAM permission for the `aws-external-anthropic:CallWithBearerToken` action if you authenticate with an API key (see [API key authentication](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#api-key-authentication))

1381. An active AWS account with a subscription to Claude Platform on AWS (see [Set up your account](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#set-up-your-account)).

1392. The [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html) installed and configured.

1403. **Outbound web identity federation enabled** on your AWS account, a one-time setup step (see [Enable outbound web identity federation](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#enable-outbound-web-identity-federation)).

1414. Your workspace ID (see [Obtain your workspace ID](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#obtain-your-workspace-id)).

1425. IAM permission to call the API: the `aws-external-anthropic:CreateInference` action on your workspace, plus the `sts:GetWebIdentityToken` and `sts:TagGetWebIdentityToken` actions (see [IAM policies](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#iam-policies)).

1436. IAM permission for the `aws-external-anthropic:CallWithBearerToken` action if you authenticate with an API key (see [API key authentication](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#api-key-authentication)).

145144

146145### Enable outbound web identity federation

147146

from line 171

172171export AWS_REGION='us-west-2' # Your workspace's AWS region

173172```

174173

175The region is required. The SDK client raises an error if no region is set. Pass `aws_region` (typescript, php: `awsRegion`; go: `AWSRegion`; java: `.region()`; csharp: `AwsClientOptions.AwsRegion`) when you create the client, or set `AWS_REGION` (or `AWS_DEFAULT_REGION`). All AWS commercial regions are supported.

174Pass `aws_region` (typescript, php: `awsRegion`; go: `AWSRegion`; java: `.region()`; csharp: `AwsClientOptions.AwsRegion`) when you create the client, or set `AWS_REGION`. All AWS commercial regions are supported. For how the client finds a region, see [Region resolution](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#region-resolution).

176175

177176## Authentication

178177

from line 179

180179

181180### SigV4 authentication

182181

183SigV4 is the enterprise-native path and integrates with your existing AWS IAM policies, roles, and auditing. Configure AWS credentials using any method supported by the [AWS default credential provider chain](https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html):

182SigV4 is the enterprise-native path and integrates with your existing AWS IAM policies, roles, and auditing. Configure AWS credentials using a method that the SDK supports. The [AWS default credential provider chain](https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html) includes:

184183

185184* Environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`)

186185* Shared credentials file (`~/.aws/credentials`)

from line 272

273272

274273### Region resolution

275274

276The client reads `AWS_REGION` from the environment if you don’t set `aws_region` (typescript, php: `awsRegion`; go: `AWSRegion`; java: `.region()`; csharp: `AwsClientOptions.AwsRegion`), falling back to `AWS_DEFAULT_REGION` for compatibility with the standard AWS SDKs. Region is required and there is no default: `AnthropicAWS` (typescript: `AnthropicAws`; csharp: `AnthropicAwsClient`; go: `anthropicaws.NewClient()`; java: `AwsBackend`; php: `Anthropic\Aws\Client`; ruby: `Anthropic::AWSClient`) raises an error if neither the constructor argument nor an environment variable is set.

275If you don’t set `aws_region` (typescript, php: `awsRegion`; go: `AWSRegion`; java: `.region()`; csharp: `AwsClientOptions.AwsRegion`), the client reads `AWS_REGION` from the environment. The Python, TypeScript, C#, Go, PHP, and Ruby SDKs then try `AWS_DEFAULT_REGION`. The TypeScript SDK then checks your AWS config file. The Java SDK reads the environment only when you call `AwsBackend.fromEnv()`, which uses the [default AWS Region provider chain](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/region-selection.html). That chain also checks your AWS config file and EC2 instance metadata.

277276

277The client needs a region to sign requests with SigV4 and to build the base URL. There is no default, so `AnthropicAWS` (typescript: `AnthropicAws`; csharp: `AnthropicAwsClient`; go: `anthropicaws.NewClient()`; java: `AwsBackend`; php: `Anthropic\Aws\Client`; ruby: `Anthropic::AWSClient`) fails with an error if it needs a region and can’t find one. With an API key and a base URL in the `ANTHROPIC_AWS_BASE_URL` environment variable, it doesn’t need a region.

278

278279## Install an SDK

279280

280Anthropic’s [client SDKs](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) support Claude Platform on AWS. Your SDK provides `AnthropicAWS` (typescript: `AnthropicAws`; csharp: `AnthropicAwsClient`; go: `anthropicaws.NewClient()`; java: `AwsBackend`; php: `Anthropic\Aws\Client`; ruby: `Anthropic::AWSClient`), which handles SigV4 signing, region-based base URL construction, and the `anthropic-workspace-id` header.

281The [client SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) supports Claude Platform on AWS and provides `AnthropicAWS` (typescript: `AnthropicAws`; csharp: `AnthropicAwsClient`; go: `anthropicaws.NewClient()`; java: `AwsBackend`; php: `Anthropic\Aws\Client`; ruby: `Anthropic::AWSClient`), which handles SigV4 signing, region-based base URL construction, and the `anthropic-workspace-id` header.

281282

282283<Tabs>

283284 <Tab title="Python">

from line 513

512513

513514 ```php PHP

514515 use Anthropic\Aws\Client;

516 use Anthropic\Messages\Model;

515517

516518 $client = new Client();

517519

518520 $message = $client->messages->create(

519 model: 'claude-sonnet-5-5',

521 model: Model::CLAUDE_SONNET_5_5,

520522 maxTokens: 1024,

521523 messages: [['role' => 'user', 'content' => 'Hello!']],

522524 );

from line 532

530532 client = Anthropic::AWSClient.new

531533

532534 message = client.messages.create(

533 model: "claude-sonnet-5-5",

535 model: Anthropic::Model::CLAUDE_SONNET_5_5,

534536 max_tokens: 1024,

535537 messages: [{ role: "user", content: "Hello!" }]

536538 )

from line 541

539541 ```

540542</CodeGroup>

541543

542The client reads `AWS_REGION` (or `AWS_DEFAULT_REGION`) and `ANTHROPIC_AWS_WORKSPACE_ID` from the environment. You can override either by passing `aws_region` (typescript, php: `awsRegion`; go: `AWSRegion`; java: `.region()`; csharp: `AwsClientOptions.AwsRegion`) or `workspace_id` (typescript, php: `workspaceId`; go: `WorkspaceID`; java: `.workspaceId()`; csharp: `AwsClientOptions.WorkspaceId`) when you create the client. Both region and workspace ID are required. The constructor raises an error if either cannot be resolved.

544The client reads `AWS_REGION` and `ANTHROPIC_AWS_WORKSPACE_ID` from the environment. You can override either by passing `aws_region` (typescript, php: `awsRegion`; go: `AWSRegion`; java: `.region()`; csharp: `AwsClientOptions.AwsRegion`) or `workspace_id` (typescript, php: `workspaceId`; go: `WorkspaceID`; java: `.workspaceId()`; csharp: `AwsClientOptions.WorkspaceId`) when you create the client. The client fails with an error if it can’t find the workspace ID, or if it needs a region and can’t find one.

543545

544546<Note>

545547 The `x-amz-security-token` header (cURL) is only required for temporary credentials such as IAM roles, SSO, or STS. Omit it when using long-term IAM user credentials. The SDK clients handle this automatically based on the credential source.

from line 596

594596

595597Sessions and self-hosted workers on Claude Platform on AWS differ from first-party Claude Managed Agents in three ways:

596598

597* **Autonomous-session reauthentication:** A session can run autonomously, without any [user events](https://platform.claude.com/docs/en/managed-agents/reference#event-types), for up to 6 hours. After 6 hours, the session requires reauthentication before it continues. To reauthenticate, send any user-role event to the session (see [Events and streaming](https://platform.claude.com/docs/en/managed-agents/events-and-streaming)). First-party Claude Managed Agents has no autonomous-session runtime limit.

598* **[Memory stores on self-hosted environments](https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes-memory):** A session that runs on a self-hosted environment cannot attach memory stores; a session that includes one is rejected at creation. Sessions on cloud environments attach memory stores as usual. On first-party Claude Managed Agents, sessions on both cloud and self-hosted environments can attach memory stores.

599* **Autonomous-session reauthentication:** A session can run autonomously, without any [user events](https://platform.claude.com/docs/en/managed-agents/reference#event-types), for up to 6 hours. After 6 hours, the session requires reauthentication before it continues. To reauthenticate, send any user-role event to the session (see [Session event stream](https://platform.claude.com/docs/en/managed-agents/events-and-streaming)). First-party Claude Managed Agents has no autonomous-session runtime limit.

600* **[Memory stores in self-hosted sandboxes](https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes-memory):** A session that runs on a self-hosted environment cannot attach memory stores; a session that includes one is rejected at creation. Sessions on cloud environments attach memory stores as usual. On first-party Claude Managed Agents, sessions on both cloud and self-hosted environments can attach memory stores.

599601* **[Worker authentication on self-hosted environments](https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes#prerequisites):** A worker authenticates with AWS IAM (SigV4) or an [API key generated in the AWS Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#api-key-authentication), not an environment key. Environment keys generated in the Claude Console don’t work with the Claude Platform on AWS endpoint.

600602

601603### Features not supported

from line 758

756758

757759 ```php PHP

758760 use Anthropic\Aws\Client;

761 use Anthropic\Messages\Model;

759762

760763 $client = new Client();

761764

762765 $message = $client->messages->create(

763 model: 'claude-sonnet-5-5',

766 model: Model::CLAUDE_SONNET_5_5,

764767 maxTokens: 1024,

765768 inferenceGeo: 'us',

766769 messages: [['role' => 'user', 'content' => 'Hello!']],

from line 778

775778 client = Anthropic::AWSClient.new

776779

777780 message = client.messages.create(

778 model: "claude-sonnet-5-5",

781 model: Anthropic::Model::CLAUDE_SONNET_5_5,

779782 max_tokens: 1024,

780783 inference_geo: "us",

781784 messages: [{ role: "user", content: "Hello!" }]

from line 873

870873

871874* The models you need raised

872875* Peak input tokens per minute and output tokens per minute for each model (not daily totals)

873* The approximate share of your input that is cached or repeated context (cache reads don’t count toward input-token limits for most models; see [cache-aware ITPM](https://platform.claude.com/docs/en/api/rate-limits#cache-aware-itpm))

876* The approximate share of your input that is cached or repeated context (cache reads don’t count toward input-token limits; see [Cache-aware ITPM](https://platform.claude.com/docs/en/api/rate-limits#cache-aware-itpm))

874877

875878Usage tiers are fixed steps: each tier pairs rate limits with a [monthly spend cap](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#spend-limits), and moving to a higher tier raises both. For tier details and per-model limits, see [Rate limits](https://platform.claude.com/docs/en/api/rate-limits).

876879

from line 1056

10531056

10541057 ```php PHP

10551058 use Anthropic\Aws\Client;

1059 use Anthropic\Messages\Model;

10561060

10571061 $client = new Client();

10581062

10591063 $response = $client->messages->raw->create([

1060 'model' => 'claude-sonnet-5-5',

1064 'model' => Model::CLAUDE_SONNET_5_5,

10611065 'maxTokens' => 1024,

10621066 'messages' => [['role' => 'user', 'content' => 'Hello!']],

10631067 ]);

from line 1089

10851089 end

10861090

10871091 message = client.messages.create(

1088 model: "claude-sonnet-5-5",

1092 model: Anthropic::Model::CLAUDE_SONNET_5_5,

10891093 max_tokens: 1024,

10901094 messages: [{ role: "user", content: "Hello!" }],

10911095 request_options: { middleware: [read_request_ids] }

This page’s history 63 edits

5 Nov 2026 +27 −23 · this one
5 Nov 2026 +4 −4
4 Nov 2026 +4 −4
4 Nov 2026 +37 −31
4 Nov 2026 +69 −27
3 Nov 2026 +1 −2

The page’s own history →

Where it came from

The captureapi
Upstream pageplatform.claude.com

Around it

Every changethe ledger
That day5 Nov 2026