AI Tools
Tutorial17 minMay 12, 2026By AIGCDev

How to Use Claude Platform on AWS with Claude Code and the Anthropic API (2026)

Quick Answer

As of 2026-05-12, Claude Platform on AWS is the Anthropic-operated Claude API, Claude Console, Claude Code path, and platform feature set reached through an AWS account. Use it when you want native Anthropic features with AWS Marketplace billing, IAM access control, CloudTrail visibility, and AWS commitment retirement. Use Amazon Bedrock when your review requires AWS to operate the inference stack and act as the data processor.

The shortest safe setup path is:

  1. Subscribe to Claude Platform on AWS in the AWS Console.
  2. Finish the AWS-linked Anthropic organization setup.
  3. Create a workspace and save its wrkspc_... ID.
  4. Enable outbound web identity federation once in the AWS account.
  5. Test the Anthropic Messages API with an AWS gateway SDK helper or a workspace API key.
  6. Point Claude Code at the same workspace with CLAUDE_CODE_USE_ANTHROPIC_AWS=1, ANTHROPIC_AWS_WORKSPACE_ID, and AWS_REGION.
  7. Turn on CloudTrail data events if inference-level audit logs are required.

Do not treat this as Bedrock with a different URL. Claude Platform on AWS uses Anthropic-managed infrastructure. AWS handles authentication, IAM, Marketplace billing, and CloudTrail integration; Anthropic processes inference inputs and outputs.

What Changed On 2026-05-11

AWS and Anthropic announced general availability for Claude Platform on AWS on 2026-05-11. It creates a third practical path for teams building on Claude:

Path Who operates inference Main API surface Billing path Best fit
Claude first-party API Anthropic Anthropic Messages API Anthropic Direct Anthropic relationship and fastest native API setup
Claude Platform on AWS Anthropic Anthropic Messages API via aws-external-anthropic.{region}.api.aws AWS Marketplace Native Anthropic platform with AWS IAM, CloudTrail, and Marketplace billing
Claude in Amazon Bedrock AWS Bedrock APIs or Bedrock's Anthropic Messages endpoint AWS native service AWS-operated inference, AWS data processor boundary, and Bedrock-native controls

This matters because teams no longer have to choose only between Anthropic's first-party API and Bedrock. Claude Platform on AWS keeps the native Anthropic feature surface, including Messages API, Agent Skills, code execution, web search, web fetch, MCP connector, Files API, batch processing, prompt caching, and Claude Managed Agents. The tradeoff is that the inference boundary is Anthropic, not AWS.

When This Setup Is Worth Using

Use Claude Platform on AWS when most of these are true:

  • you want same-schedule access to native Claude API models and beta headers
  • Claude Code, Claude Cowork, Agent Skills, code execution, Files API, or Managed Agents are part of the plan
  • procurement wants AWS Marketplace billing or AWS commitment retirement
  • IAM policies and workspace ARNs are the access-control system your team already reviews
  • CloudTrail events and AWS Cost Explorer need to show the adoption path
  • your security review accepts Anthropic as the inference data processor

Use Claude in Amazon Bedrock instead when these are the requirements:

  • AWS must operate inference and be the data processor
  • strict regional data residency is more important than native Anthropic feature timing
  • your architecture depends on Bedrock-native controls, model routing, Guardrails, Knowledge Bases, or existing Bedrock governance
  • your commercial terms, limits, and operational dashboards are already standardized around Bedrock

Decision Table

Question Better answer Why
Need native Claude API features through AWS billing? Claude Platform on AWS It exposes the Anthropic Messages API and native platform features through AWS Marketplace.
Need Claude Code tied to an AWS-governed workspace? Claude Platform on AWS Claude Code has a dedicated provider path with CLAUDE_CODE_USE_ANTHROPIC_AWS=1.
Need AWS-operated inference or AWS as sole processor? Claude in Amazon Bedrock Bedrock keeps AWS as the operating party and data processor.
Need per-request US inference geography in the Anthropic API? Claude Platform on AWS, with inference_geo="us" The workspace region alone does not pin inference geography; the request parameter does.
Need Bedrock-native APIs and controls? Claude in Amazon Bedrock Bedrock uses different service endpoints, model IDs, IAM actions, and operational controls.
Need long-lived enterprise access for developers? Prefer SigV4 / temporary AWS credentials Workspace API keys work, but they are long-lived secrets and override SigV4 when set.

What You Need Before You Start

Have these items ready before you touch production tooling:

Item What to check Why it matters
AWS account The account can subscribe to AWS Marketplace services Claude Platform on AWS is activated through AWS Marketplace.
Private offer status Existing Bedrock or Anthropic private offers are confirmed before first request Discounts do not apply retroactively to usage incurred before the right private offer is accepted.
Workspace plan Team, environment, or app boundaries are mapped to workspaces Workspace IDs are used in client routing, IAM resource scoping, usage, cost, files, batches, and Skills.
AWS region The workspace region is chosen intentionally The region selects the gateway endpoint and AWS-side scope; it does not by itself pin model inference geography.
Auth path API key for pilot, SigV4 for shared production paths The implementation and risk profile differ.
IAM policy aws-external-anthropic:* permissions are scoped to the workspace ARN where possible Workspaces are the primary IAM resource.
Claude Code plan CLI, Agent SDK, model pins, SSO refresh, and usage reporting are decided before rollout Claude Code uses its own ANTHROPIC_AWS_* configuration path, and usage reporting differs from first-party Claude Code.
Network path Public endpoint or AWS PrivateLink is selected before production traffic AWS PrivateLink is supported when a VPC needs private connectivity to the Claude Platform on AWS endpoint.
Logging plan CloudTrail management events plus data event logging if inference audit is required Inference events are data events and are not captured by default management-event logging.
Cost tags team, environment, application, and cost-center are decided upfront AWS Cost Explorer shows aggregate CCU cost; tags help allocate spend later.

Step 1: Subscribe And Create A Workspace

Start from the Claude Platform on AWS service page in the AWS Console.

  1. Choose Sign up and accept the AWS and Anthropic terms shown during setup.
  2. Complete the redirected Anthropic organization setup.
  3. Create a workspace when the AWS Console prompts you.
  4. Record the workspace ID, which uses a wrkspc_... format.
  5. Record the AWS region for that workspace.

The AWS Marketplace subscription creates a new Anthropic organization tied to the AWS account. It is separate from any first-party Claude Console organization your company already has. Existing first-party API keys, workspaces, and console settings do not carry over.

Private-offer timing is worth checking before the first real request. Anthropic's docs say existing Bedrock private offers do not automatically transfer to Claude Platform on AWS, and discounts cannot be applied retroactively to usage incurred before the private offer is accepted.

Before production traffic, use this procurement checklist:

  • confirm whether the account is using the public Marketplace subscription or a Claude Platform on AWS private offer
  • confirm that any Bedrock private offer is not being treated as a Claude Platform on AWS discount
  • confirm whether an existing Anthropic direct private offer applies, and get the effective date in writing
  • confirm that AWS commitment retirement is expected for this Marketplace product
  • record who reviews CCU usage in AWS Cost Explorer during the first billing cycle

Step 2: Enable The AWS Account Prerequisite

Anthropic documents one account-level prerequisite before API traffic works. Enable outbound web identity federation once per AWS account:

aws iam enable-outbound-web-identity-federation

Then verify it:

aws iam get-outbound-web-identity-federation-info

If this is skipped, requests can fail with an Outbound web identity federation is disabled for your account error. Fix that before debugging SDK code, model IDs, or Claude Code settings.

Step 3: Choose API Key Or SigV4 For The First API Test

Claude Platform on AWS supports two auth paths:

Auth path Use it for Main risk
Workspace API key Local validation, demos, one-off scripts, tools that cannot sign SigV4 It is a long-lived secret, and it overrides SigV4 when present.
IAM / SigV4 CI, shared services, internal gateways, production developer tooling The IAM role must have the right aws-external-anthropic actions and region.
Short-term API key Passing a temporary x-api-key token to a process that cannot hold AWS credentials The token is not auto-refreshed by the SDK.

For SDKs that expose an AWS gateway helper, prefer that helper for shared tools because it owns the base URL, workspace header, and SigV4 behavior. Anthropic's current docs show the Python platform-specific client like this:

export ANTHROPIC_AWS_WORKSPACE_ID="wrkspc_01AbCdEf23GhIj"
export AWS_REGION="us-west-2"

from anthropic import AnthropicAWS

client = AnthropicAWS()

message = client.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=256,
    messages=[{"role": "user", "content": "Reply with the word ready."}],
)

print(message)

The platform-specific client reads ANTHROPIC_AWS_WORKSPACE_ID and AWS_REGION from the environment by default, computes https://aws-external-anthropic.<region>.api.aws, signs with SigV4 from the AWS credential chain when no API key is present, and sends the required anthropic-workspace-id header. Anthropic labels these Claude Platform on AWS SDK clients as beta, so pin SDK versions in production tools.

For an API key pilot, generate the key in the AWS Console under Claude Platform on AWS -> API keys and set:

export ANTHROPIC_AWS_API_KEY="sk-ant-xxxxx"

The same AnthropicAWS() example works with that API key because ANTHROPIC_AWS_API_KEY takes precedence over the default AWS credential chain. A quick API-key smoke test can also use the generic Anthropic client from AWS's launch post:

export ANTHROPIC_API_KEY="&#x3C;your-workspace-api-key>"
export ANTHROPIC_BASE_URL="https://aws-external-anthropic.&#x3C;your-region>.api.aws"
export ANTHROPIC_WORKSPACE_ID="&#x3C;your-workspace-id>"

from anthropic import Anthropic
import os

client = Anthropic(
    default_headers={
        "anthropic-workspace-id": os.environ["ANTHROPIC_WORKSPACE_ID"]
    }
)

message = client.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=256,
    messages=[{"role": "user", "content": "Reply with the word ready."}],
)

print(message.content)

Use that as a smoke test, not the final team pattern. For production, prefer an AWS gateway SDK helper plus temporary AWS credentials or IAM roles.

Step 4: Give IAM The Right Shape

For SigV4, start by confirming which AWS identity your process will use:

aws sts get-caller-identity

The SigV4 service name and IAM action namespace are both aws-external-anthropic. For real-time inference with model lookup and token counting, a tight starter policy needs actions like:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CreateInference",
        "aws-external-anthropic:CountTokens",
        "aws-external-anthropic:GetModel",
        "aws-external-anthropic:ListModels",
        "aws-external-anthropic:GetWorkspace"
      ],
      "Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    },
    {
      "Effect": "Allow",
      "Action": "aws-external-anthropic:ListWorkspaces",
      "Resource": "*"
    }
  ]
}

If the same principal is allowed to use workspace API keys, add aws-external-anthropic:CallWithBearerToken on Resource: "*". Anthropic documents that this action is an authentication-layer action, not a workspace-ARN-scoped route action.

The credential precedence is easy to miss. Platform-specific clients resolve auth in this order: constructor API key, constructor AWS access key pair, constructor AWS profile, ANTHROPIC_AWS_API_KEY, then the default AWS credential chain. If an old ANTHROPIC_AWS_API_KEY is still in the shell, the SDK will ignore valid SigV4 credentials and send the stale API key instead.

Step 5: Point Claude Code At The Same Workspace

Do not rely only on ANTHROPIC_BASE_URL and ANTHROPIC_CUSTOM_HEADERS for Claude Code. Claude Code has a dedicated Claude Platform on AWS provider path.

For SigV4 with an SSO profile:

aws sso login --profile my-profile
export AWS_PROFILE="my-profile"
export AWS_REGION="us-west-2"
export CLAUDE_CODE_USE_ANTHROPIC_AWS=1
export ANTHROPIC_AWS_WORKSPACE_ID="wrkspc_01AbCdEf23GhIj"

For a workspace API key:

export CLAUDE_CODE_USE_ANTHROPIC_AWS=1
export ANTHROPIC_AWS_WORKSPACE_ID="wrkspc_01AbCdEf23GhIj"
export AWS_REGION="us-west-2"
export ANTHROPIC_AWS_API_KEY="sk-ant-xxxxx"

Then open Claude Code and run:

/status

The status output should show the resolved provider, workspace ID, region, base URL override if any, and auth-skip setting. If requests still go to api.anthropic.com, CLAUDE_CODE_USE_ANTHROPIC_AWS is missing or not truthy. If CLAUDE_CODE_USE_BEDROCK or CLAUDE_CODE_USE_FOUNDRY is also set, unset it because Bedrock and Foundry take precedence over Claude Platform on AWS in Claude Code provider routing.

For teams, pin model aliases before rollout so a new model release does not move everyone at once:

export ANTHROPIC_DEFAULT_OPUS_MODEL="claude-opus-4-7"
export ANTHROPIC_DEFAULT_SONNET_MODEL="claude-sonnet-4-6"
export ANTHROPIC_DEFAULT_HAIKU_MODEL="claude-haiku-4-5"

Do not use Claude Code usage reporting as if it were identical to first-party Claude Code. Anthropic's current Claude Platform on AWS docs say the Claude Code workspace and Analytics API are not available, the workspace with automatic rate limits is not available, and Claude Code usage appears in the general usage view rather than a dedicated screen.

If developers use AWS SSO and credentials expire during a long Claude Code session, add an awsAuthRefresh command in Claude Code settings so the CLI can rerun the login flow instead of failing mid-task.

Step 6: Test Data Residency Before You Promise It

A workspace is bound to one AWS region, and that region controls the gateway endpoint and AWS-side scope for IAM, CloudTrail, billing, usage, quotas, files, batches, and Skills. It does not automatically pin where model inference runs.

Claude Platform on AWS supports two inference geographies as of 2026-05-12:

inference_geo What it does Cost note
global Inference can route to Anthropic-operated data centers worldwide Standard pricing; this is the default when omitted.
us Inference stays within US data centers A 1.1x pricing multiplier applies.

Set inference geography per request when it matters:

from anthropic import AnthropicAWS

client = AnthropicAWS()

message = client.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=256,
    inference_geo="us",
    messages=[{"role": "user", "content": "Reply with the word ready."}],
)

print(message)

Model support is part of the contract. Anthropic's docs say inference_geo is supported on Claude Opus 4.6, Claude Sonnet 4.6, and later models. Requests with inference_geo on Claude Opus 4.5, Claude Sonnet 4.5, or Claude Haiku 4.5 return a 400 error. If a workflow requires US-only inference, do not pin Claude Code or API clients to claude-haiku-4-5 for that workflow.

Do not turn this into a blanket compliance statement. Anthropic says workspace-level inference geography controls are not available on Claude Platform on AWS; set inference_geo on each request. Anthropic also says Zero Data Retention follows the first-party Claude API model and is available on request through an Anthropic account representative. Confirm ZDR enrollment before migrating workloads that depend on data-retention guarantees.

Step 7: Turn On The Logging You Actually Need

CloudTrail coverage is useful only if you configure the right event class.

AWS and Anthropic document two separate logging layers:

  • workspace and vault operations are management events and appear by default
  • inference, batch, file, skill, model, user profile, and Claude Managed Agents operations are data events and require explicit CloudTrail data event logging

That distinction matters in reviews. A successful API call plus a quiet CloudTrail management-event trail does not mean inference logging is broken; it usually means data events are not enabled.

Capture both request IDs when debugging:

  • x-amzn-requestid for AWS-side investigation and CloudTrail lookup
  • request-id for Anthropic support

A useful internal acceptance test is:

  1. Run one SDK request through the AWS gateway helper or a SigV4-signed client.
  2. Run one Claude Code prompt after /status confirms the AWS provider.
  3. Confirm both appear in Claude Console usage after the expected delay.
  4. Confirm the API request lands in CloudTrail after data event logging is enabled.
  5. Confirm cost appears as a Claude Consumption Unit line item in AWS Cost Explorer.

Step 8: Tag Workspaces Before Spend Sprawls

Claude Platform on AWS usage is billed through AWS Marketplace in Claude Consumption Units (CCUs). Anthropic documents CCUs as metered hourly and invoiced monthly in arrears. CCUs are not prepaid credits or a balance.

Use a small mandatory tag set from day one:

  • team
  • environment
  • application
  • cost-center

Also decide who owns rate-limit increases. Claude Platform on AWS starts with Anthropic-managed Tier 1 limits, not AWS Service Quotas, and automatic tier advancement does not apply in the same way as the first-party Claude API. If a workspace is moving from pilot to production, assign someone to request higher limits before the first launch week.

Where Teams Usually Get It Wrong

Assuming This Is Bedrock With A New Name

It is not. Claude Platform on AWS uses the Anthropic Messages API, Anthropic model IDs such as claude-sonnet-4-6, and the aws-external-anthropic endpoint and IAM namespace. Bedrock has different endpoints, model IDs, service names, control planes, and release timing.

Using The Workspace Region As A Data Residency Promise

The workspace region controls the AWS gateway endpoint and AWS-side resources. It does not pin inference geography. If US-only inference is required, pass inference_geo="us" per request and budget for the 1.1x multiplier.

Letting A Stale API Key Override SigV4

ANTHROPIC_AWS_API_KEY takes precedence over the default AWS credential chain. If a developer says an IAM fix did nothing, check whether an old workspace API key is still exported.

Forgetting Claude Code's Provider Switch

Claude Code does not automatically use Claude Platform on AWS just because AWS credentials exist. Set CLAUDE_CODE_USE_ANTHROPIC_AWS=1, unset Bedrock or Foundry provider flags if present, and verify with /status.

Expecting Every Anthropic API Feature To Be Available

Most Messages API features match the first-party Claude API, but there are current gaps. As of 2026-05-12, Anthropic lists HIPAA readiness, most Admin API endpoints beyond workspace endpoints, workspace member management, spend limits, OAuth authentication, Fast mode, OpenAI-compatible endpoints, workspace-level inference geography controls, and Claude Code workspace / Analytics APIs as not available on Claude Platform on AWS.

A Good First Use Case

The cleanest first use case is an internal coding workflow for one platform or security team.

A practical pilot looks like this:

  1. Create one workspace named for the pilot team and environment.
  2. Enable outbound web identity federation in the AWS account.
  3. Give a small IAM role CreateInference, model read, workspace read, and ListWorkspaces access.
  4. Run one AnthropicAWS() smoke test from a developer machine or CI runner.
  5. Configure Claude Code with CLAUDE_CODE_USE_ANTHROPIC_AWS=1, ANTHROPIC_AWS_WORKSPACE_ID, and AWS_REGION.
  6. Run /status before the first real coding task.
  7. Turn on CloudTrail data event logging if the pilot must prove inference auditability.
  8. Review Claude Console usage and AWS Cost Explorer before adding a second team.

That pilot proves the service boundary, IAM path, Claude Code configuration, logging path, and cost allocation pattern in one pass. If the pilot also uses Claude Managed Agents, account for one extra limit: on Claude Platform on AWS, an autonomous session can run without user events for up to 6 hours before it needs reauthentication.

FAQ

Do I need a separate Anthropic account to use Claude Platform on AWS?

No for billing activation, but the AWS Marketplace subscription creates a separate AWS-linked Anthropic organization. Use workspace IDs and API keys from that AWS-linked organization, not from an existing first-party Claude Console organization.

Is Claude Platform on AWS the same as Claude in Amazon Bedrock?

No. Claude Platform on AWS is Anthropic-operated and exposes the native Anthropic platform through AWS authentication and Marketplace billing. Claude in Amazon Bedrock is AWS-operated and is the better fit when AWS must be the data processor.

Can I use Claude Code with Claude Platform on AWS?

Yes. Use Claude Code's dedicated provider variables: CLAUDE_CODE_USE_ANTHROPIC_AWS=1, ANTHROPIC_AWS_WORKSPACE_ID, and AWS_REGION, plus either AWS credentials for SigV4 or ANTHROPIC_AWS_API_KEY for a workspace API key. Run /status to verify the resolved provider.

Should I start with IAM or an API key?

For most teams, use a workspace API key only for one quick validation test. Move shared tools, CI, and production developer workflows to temporary AWS credentials or IAM roles with SigV4.

Does the AWS region guarantee where inference runs?

No. The workspace region selects the gateway endpoint and AWS-side resources. If inference geography matters, set inference_geo per request. Omitting it defaults to global; inference_geo="us" keeps inference in US data centers and has a 1.1x pricing multiplier. Use it only with Claude Opus 4.6, Claude Sonnet 4.6, or later models.

What should I check before migrating from Bedrock?

Check the data processor requirement, private offer and discount path, model ID changes, SigV4 service name, required workspace header, CloudTrail data-event logging, ZDR enrollment, and feature gaps such as spend limits and Fast mode.

Verification Note

Verified on 2026-05-12 using these official sources:

anthropicamazoncloudai-codingai-agentsenterprise-ai

Related Tools

Claude
Anthropic's AI assistant, skilled in writing, analysis, and programming, with a focus on safety and reliability.
Claude Code
Claude Code is Anthropic's coding agent for terminal, desktop, web, Slack, and supported IDEs, designed to inspect codebases, edit files, run tools, and help ship changes faster.

Related Articles

Tutorial
10 minMay 12, 2026

How to Build a Web Search Agent with Strands and Exa (2026)

A practical Strands and Exa tutorial for teams that need a source-grounded web search agent: what the stack is good at, how to wire it up, which search mode to pick, and where the limits still are.

ai-agentsai-searchai-coding+2
Tutorial
11 minMay 19, 2026

Amazon Nova 2 Lite Content Moderation on Bedrock: Prompt, Guardrails, and Eval Checklist (2026)

A practical Amazon Nova 2 Lite content moderation tutorial: when prompt-based moderation is enough, how to structure policy prompts, when to add Bedrock Guardrails, and what to verify before production.

amazoncontent-moderationai-safety+2
Tutorial
12 minMay 14, 2026

How to Use Claude for Small Business Marketing Workflows (2026)

A practical tutorial for small teams using Claude for Small Business to plan promotions, check data and approval settings, and stage reviewable HubSpot and Canva assets as of 2026-05-14.

anthropicai-agentsenterprise-ai