Claude Platform on AWS: What It Is, Sign-Up and Login, Pricing in CCUs, the $500 Start-Tier Cap, Python and Claude Code Setup, and How It Differs From Amazon Bedrock

Claude Platform on AWS is Anthropic's own Claude API, the same one at platform.claude.com, that you sign up for, sign in to and pay for through your AWS account. AWS handles the login (IAM, SigV4 signing or an API key), access control and billing (it appears on your AWS bill through AWS Marketplace); Anthropic runs the models, the API and the data processing. That is the key difference from Amazon Bedrock, where AWS runs the inference stack: on Claude Platform on AWS you get the full Claude API (Agent Skills, code execution, beta features, new models typically on the same day), while Bedrock offers what AWS has integrated so far. Prices per token are the standard Claude API rates, billed in Claude Consumption Units at $0.01 each. The two facts that catch almost everyone on day one: every request fails until you run one command to enable "outbound web identity federation" on your AWS account, and every new organization starts on the Start tier, whose monthly spend cap is $500; reach it and your API calls stop with HTTP 429 until the first day of the next month, and raising the tier goes through an Anthropic account representative, not a button. This page covers what the platform is, how it compares with Bedrock, sign-up and login, your first request in Python, pricing with worked examples, limits, Claude Code, IAM, data handling and migrating from Bedrock.

Jake's repair shop wanted an assistant on its website that could answer "is my phone ready?" and book repairs, and his developer friend Ethan already ran the shop's website on AWS. Paying for the AI on the same AWS bill sounded tidy, so Ethan subscribed to Claude Platform on AWS, created a workspace and sent his first request. It failed with "Outbound web identity federation is disabled for your account". One command later it worked, and two weeks into the festival rush it stopped again, this time with a message about the organization's monthly usage threshold. "We paid the bill," Jake said. "We hit the starter ceiling," Ethan said. "Nobody raises it for you automatically on day one." This page is everything they set up, in the order that avoids both surprises.

New to the AWS side of this? Amazon Bedrock is AWS's own service for using AI models, and IAM is how AWS decides who may do what. You need an AWS account with permission to subscribe to AWS Marketplace products and to create IAM roles and policies.

What Claude Platform on AWS is, and what it is not

Think of it as Anthropic's API, sold and secured through AWS. The models run on infrastructure Anthropic manages; the requests go to Anthropic's API endpoints (the same /v1/messages and other paths as the first-party API); Anthropic is the data processor for your prompts and outputs. AWS contributes three things: authentication (your requests are signed with AWS credentials, or carry an API key generated in the AWS Console), access control (IAM policies decide which people and roles may call which workspaces) and billing (usage arrives on your AWS bill through AWS Marketplace, and counts toward AWS spend commitments).

Anthropic sells Claude through four different products, and the names are close enough that people mix them up:

So "Claude for Enterprise on AWS" usually means the third row (people chatting with Claude at work), while Claude Platform on AWS is for developers building with the API. And "is Claude part of AWS?" has a precise answer: AWS hosts Claude in Bedrock and sells Anthropic's own platform through Marketplace, but Anthropic, a separate company, makes the models and runs this platform.

Does Claude use AWS? The relationship in plain English

People search this in several forms ("does Claude use AWS", "is Claude part of AWS", "what is AWS Claude"), and the answer has three parts. Claude is made by Anthropic, an AI company separate from Amazon; Amazon is one of Anthropic's major investors, but the models are Anthropic's. AWS offers Claude in Amazon Bedrock, where AWS runs the models inside its own service and is the data processor. And Claude Platform on AWS is Anthropic's own API, run by Anthropic on AWS infrastructure (for workspaces created after September 18, 2026), reached through AWS login and billed through AWS Marketplace.

So if your question is "can my company use Claude while keeping everything on the AWS bill and under IAM", the answer is yes, in two ways, and the rest of this page is about choosing between them. If your question is "is the chat app at claude.ai an AWS product", the answer is no: that is Anthropic's app, which companies can also buy as Claude Enterprise through AWS Marketplace.

Claude Platform on AWS vs Amazon Bedrock

Both let you use Claude with AWS credentials and pay AWS. Underneath, they are different services:

Choose Bedrock when compliance decides: organizations that need FedRAMP High, IL4, IL5 or HIPAA-ready setups, or that need AWS to be the only data processor, belong on Bedrock, which runs entirely on AWS-controlled infrastructure. Bedrock also fits teams already invested in Bedrock features such as knowledge bases and guardrails. Choose Claude Platform on AWS when you want the newest models and API features as soon as Anthropic ships them, Agent Skills (PowerPoint, Excel, Word and PDF generation), code execution in Anthropic's sandbox, Claude Managed Agents, or simply the exact Claude API your code already speaks, with AWS billing. The two use separate capacity pools, so you can run on both and fail over between them. AWS PrivateLink is supported for reaching the Claude Platform on AWS endpoint from your VPC.

For Bedrock specifics, our guides to Claude Opus 5.5 on Bedrock and Claude Sonnet 5.5 on Bedrock cover model IDs and setup there.

Claude Platform on AWS vs Claude Enterprise on AWS Marketplace

Both are bought through AWS Marketplace, which is why they get confused. They are different products for different people:

Many companies use both: Enterprise for staff who chat with Claude, and the platform for the applications developers build. The two are separate organizations with separate settings; nothing set in one appears in the other.

Sign up for Claude Platform on AWS, step by step

Setup has four phases. Plan on about 15 minutes, most of it waiting for AWS Marketplace.

1. Subscribe in the AWS Console. Open the Claude Platform on AWS service page in the AWS Console, choose Sign up, read the terms (Anthropic's end user license agreement, the AWS Privacy Notice and the AWS Customer Agreement), tick the agreement box and choose Continue. A "Sign-up in progress" banner appears without a progress bar; stay on the page for a few minutes while AWS completes the Marketplace subscription. If your company has a private offer from Anthropic, you are prompted to accept it here.
2. Create your Anthropic organization. You are sent to platform.claude.com/partner-signup. Enter the email address of your organization's owner, follow the setup link from that inbox, and complete the form (organization name, entity type, country, intended use). This accepts Anthropic's Commercial Terms of Service and Usage Policy.
3. Create a workspace. The AWS Console prompts you to create one. Note its ID, which looks like wrkspc_01AbCdEf23GhIj. A workspace belongs to one AWS Region.
4. Open the Claude Console from the service page (next section).

Two things to know before you click. Sign-up always creates a new Anthropic organization tied to your AWS account; API keys, workspaces and settings from an existing Anthropic account do not carry over, and an existing organization cannot be converted. And if you already have a Bedrock private offer with discounts, talk to your Anthropic or AWS representative before signing up: discounts start from when an offer is accepted and are never applied backwards.

How to log in to Claude Platform on AWS (the Claude Console)

There is no separate username and password: access to the Claude Console is federated through IAM. To log in:

1. Sign in to the AWS Console with a role that has the aws-external-anthropic:AssumeConsole permission.
2. Open the Claude Platform on AWS service page and choose Open Claude Console. AWS issues a token and sends you to platform.claude.com.
3. The first time, enter your work email; your Console user is created on the spot. An "Account managed by AWS" label appears at the bottom left of the Console.

The Console has two roles. Admin can use every page available for the platform; Developer can read usage, cost, request logs, rate limits and workspaces. Ask your Anthropic account representative to assign them. Some familiar Console pages work differently here: API keys are created in the AWS Console (under Claude Platform on AWS, API keys), members are managed by IAM, the Billing page only sets spend limits (AWS Marketplace does the invoicing), and switching organizations means signing out and coming back through the AWS Console with the other account's role.

Before your first API call: the federation switch, workspace ID and Region

Here is the step that trips nearly everyone. The Claude Platform on AWS gateway calls AWS STS on your behalf to mint a signed identity token that it passes to Anthropic, and that STS feature is disabled by default on every AWS account. Until you turn it on, every request returns "Outbound web identity federation is disabled for your account". Enable it once per account:

aws iam enable-outbound-web-identity-federation
aws iam get-outbound-web-identity-federation-info   # check it, and see your account's issuer URL

If the first command answers that the feature is already enabled, you are done. Then tell your tools which workspace and Region to use. The SDKs read two environment variables:

# Kali Linux, macOS
export ANTHROPIC_AWS_WORKSPACE_ID='wrkspc_01AbCdEf23GhIj'
export AWS_REGION='us-west-2'

# Windows PowerShell
$env:ANTHROPIC_AWS_WORKSPACE_ID = 'wrkspc_01AbCdEf23GhIj'
$env:AWS_REGION = 'us-west-2'

The Region is required and has no default; the client refuses to start without it. It must be the Region your workspace was created in, because a workspace is reachable only through its own Region's endpoint. All AWS commercial Regions are supported.

Finally, the calling identity needs IAM permission: aws-external-anthropic:CreateInference on your workspace, plus aws-external-anthropic:CallWithBearerToken if you will authenticate with an API key.

Authentication: SigV4, API keys and short-term keys

You have two ways to authenticate, using the same base URL and request format:

• SigV4 (recommended for anything serious). Requests are signed with ordinary AWS credentials from the standard chain: environment variables, ~/.aws/credentials, an SSO profile in ~/.aws/config, web identity (IRSA on EKS, GitHub Actions), ECS task roles or EC2 instance roles. Access is then governed by IAM and recorded by CloudTrail. If you use IAM Identity Center, our guide to setting up an SSO profile gets your laptop ready.
• API key (simpler for scripts and local testing). Generate one in the AWS Console under Claude Platform on AWS, API keys, and set it as ANTHROPIC_AWS_API_KEY. The caller still needs the CallWithBearerToken IAM action. Keys from the regular Claude Console do not work with this endpoint.

For a process that cannot sign requests itself (an LLM gateway, a tool that only supports bearer tokens), AWS publishes token-generator libraries for Python, JavaScript and Java that turn your AWS credentials into a short-term key lasting up to 12 hours (never longer than the credentials behind it). The SDK does not refresh these; when one expires, generate a new one and create a new client.

When several credentials are present, the platform client uses the first it finds in this order: an api_key you pass in code; an access key and secret you pass in code; a named aws_profile you pass in code; the ANTHROPIC_AWS_API_KEY environment variable; and finally the default AWS credential chain. A leftover ANTHROPIC_AWS_API_KEY in your shell therefore wins over your carefully configured IAM role, which is worth remembering when access rules do not seem to apply. Long-lived keys deserve the same care as AWS access keys; our leaked key guide covers what to do if one escapes.

Your first request: Python, TypeScript and curl

Anthropic's SDKs include a platform client (AnthropicAWS in Python) that signs requests, builds the Regional base URL and adds the required anthropic-workspace-id header. The platform client is in beta. Install it inside a virtual environment (Kali, recent Debian and Homebrew Python refuse system-wide pip installs):

python3 -m venv .venv && source .venv/bin/activate     # Windows: py -m venv .venv; .\.venv\Scripts\Activate.ps1
pip install -U "anthropic[aws]"

from anthropic import AnthropicAWS

client = AnthropicAWS()   # reads AWS credentials, AWS_REGION and ANTHROPIC_AWS_WORKSPACE_ID

message = client.messages.create(
    model="claude-sonnet-5-5",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Write a two-line greeting for a phone repair shop."}],
)
print(message.content[0].text)

In TypeScript the package is @anthropic-ai/aws-sdk (npm install @anthropic-ai/aws-sdk) and the client is AnthropicAws; C#, Go, Java, PHP and Ruby have equivalents. To see the raw request, curl can sign it for you:

curl "https://aws-external-anthropic.us-west-2.api.aws/v1/messages" \
  --aws-sigv4 "aws:amz:us-west-2:aws-external-anthropic" \
  --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
  -H "x-amz-security-token: $AWS_SESSION_TOKEN" \
  -H "content-type: application/json" \
  -H "anthropic-version: 2023-06-01" \
  -H "anthropic-workspace-id: $ANTHROPIC_AWS_WORKSPACE_ID" \
  -d '{"model": "claude-sonnet-5-5", "max_tokens": 1024,
       "messages": [{"role": "user", "content": "Hello!"}]}'

Replace us-west-2 in both places with your workspace's Region, and drop the security-token header if you use long-term IAM user keys. The request and response bodies are exactly the Claude API's, so existing code for the first-party API needs only a new client, not new parsing.

Available models and model IDs

Model IDs are identical to the first-party Claude API, with no Bedrock-style prefixes or ARNs, and new models typically arrive on the same day. As of October 22, 2026:

Context windows are the same as on the first-party API for each model. If you are moving code from Bedrock, this is one of the changes: anthropic.claude-haiku-4-5 on Bedrock becomes claude-haiku-4-5 here.

Claude Platform on AWS pricing, with worked examples

Token prices are the standard Claude API rates; what changes is how they are billed. Anthropic rates your usage in US dollars at the normal per-model prices, applies any negotiated discount, and converts the result into Claude Consumption Units (CCUs) at $0.01 each. CCUs are metered hourly and invoiced monthly in arrears on your AWS bill; there is no prepaid balance and no commitment. In AWS Cost Explorer you see one aggregated CCU line; the Claude Console's Cost page breaks it down by model and workspace. Current prices per million tokens for the main models:

Two adjustments can apply. Requests pinned to US-only inference cost 1.1 times the standard price; the default, global routing, costs the standard price. And prompt caching cuts the price of repeated context to the cache-hit rate in the table.

Worked example, Jake's assistant: about 3,000 conversations a month on Sonnet 5.5, each with roughly 2,000 input tokens (instructions, shop details and the customer's question) and 400 output tokens. That is 6 million input tokens ($12) and 1.2 million output tokens ($12): $24 a month, or 2,400 CCUs on the AWS bill. Caching the unchanging instructions, about 1,500 of the 2,000 input tokens, would bill most of that input at the cache-hit rate instead. The same traffic on Haiku 5.5 would cost about $1.20; on Opus 5.5, about $48. For a support assistant answering routine questions, Ethan picked Sonnet for quality and kept Haiku for a cheaper "is my phone ready?" lookup.

Rate limits, the Start tier and the $500 monthly cap

Limits on Claude Platform on AWS are Anthropic's usage tiers, not AWS service quotas, and every new organization begins on the Start tier. Each tier pairs rate limits with a monthly spend cap:

When a month's usage reaches the tier's cap, requests fail with HTTP 429 and an error whose message reads "You have reached your API usage limits: your organization has crossed its monthly API usage threshold, set based on your organization's API tier", with the code enforced_spend_limit_reached, until 00:00 UTC on the first day of the next month. Organizations move up tiers automatically as they build a history of paid AWS Marketplace invoices, but the self-service "Request tier increase" button is not available on this platform: to go faster, contact your Anthropic account representative or Anthropic support with the models you need, your peak input and output tokens per minute per model, and roughly how much of your input is cached.

You can, and should, also set your own limits below the cap: an organization limit under Settings, Billing in the Claude Console, and per-workspace limits on the Workspaces page (add at least one email recipient on the Billing page first). Requests over your own limit fail with HTTP 400 until the next month or until you raise it. Spend is calculated at list prices and can lag by about two hours, so usage can run past a cap before requests stop, and the overshoot is billed.

Jake's shop hit the Start cap during the festival rush, not because the assistant was expensive but because a test script had looped all weekend. Ethan added a $150 workspace limit for the test workspace the same day. "So the cap saved us," Jake said. "The cap stopped us," Ethan said. "Our own limit would have stopped only the test."

Using Claude Code with Claude Platform on AWS

Claude Code can use the platform instead of a Claude subscription or the first-party API. Three environment variables do it:

export CLAUDE_CODE_USE_ANTHROPIC_AWS=1
export ANTHROPIC_AWS_WORKSPACE_ID=wrkspc_01AbCdEf23GhIj
export AWS_REGION=us-west-2
# then sign in to AWS as usual, for example:
aws sso login --profile my-profile
export AWS_PROFILE=my-profile

Claude Code builds the base URL from the Region and signs requests with your AWS credentials, or sends a workspace API key if ANTHROPIC_AWS_API_KEY is set (which then takes precedence over SigV4). The platform is opt-in even when AWS credentials exist, and Bedrock settings win in provider routing, so unset CLAUDE_CODE_USE_BEDROCK if you had it. For SSO users, an awsAuthRefresh setting such as "aws sso login --profile my-profile" lets Claude Code re-run your login when credentials expire mid-session. A few client-side features are off on this provider, Claude Code usage appears in the Console's general usage view, and the /login command does not sign you in to a claude.ai subscription here. If you already use Claude Code with Bedrock, our Bedrock setup guide shows the equivalent settings there.

Complete Claude Code setup on AWS: settings file, CI, gateways and checks

Exporting variables in a terminal works for a quick test; for daily use, put them in Claude Code's user settings file, whose env block applies every time Claude Code starts, so you do not have to remember them or export a key globally:

{
  "env": {
    "CLAUDE_CODE_USE_ANTHROPIC_AWS": "1",
    "ANTHROPIC_AWS_WORKSPACE_ID": "wrkspc_01AbCdEf23GhIj",
    "AWS_REGION": "us-west-2",
    "AWS_PROFILE": "my-profile"
  },
  "awsAuthRefresh": "aws sso login --profile my-profile"
}

Then start Claude Code. The startup banner names Claude Platform on AWS when the provider is active, and the /status command shows the API provider, your workspace ID, Region and any overrides: it is the fastest way to confirm you are not accidentally on Bedrock or the first-party API. Editors that run Claude Code, such as the VS Code extension, use the same settings.

In CI and automation, give the runner an IAM role allowed to call your workspace and set AWS_REGION and the workspace ID; the credential chain picks the role up, with no keys stored. Programs built with the Agent SDK read the same environment variables, so setting CLAUDE_CODE_USE_ANTHROPIC_AWS and the workspace ID in that process is enough.

Behind a corporate proxy or LLM gateway, set ANTHROPIC_AWS_BASE_URL to the gateway's address; Claude Code sends the same workspace and authentication headers there. If the gateway signs requests itself, also set CLAUDE_CODE_SKIP_ANTHROPIC_AWS_AUTH=1 so Claude Code sends them unsigned, and put any token the gateway needs in ANTHROPIC_AUTH_TOKEN.

Two errors cover most Claude Code problems here. A 403 or AccessDenied on every request means the IAM principal Claude Code resolved lacks the aws-external-anthropic permissions, or a stale ANTHROPIC_AWS_API_KEY is overriding your AWS credentials (it always wins); regenerate or unset it. A missing-workspace error means ANTHROPIC_AWS_WORKSPACE_ID is empty; it is never implied by your AWS credentials.

Which provider for Claude Code, Bedrock or this platform? Choose the platform when you want new models and Claude Code features on day one and Anthropic's prompt-caching behavior; choose Bedrock when your organization has standardized on Bedrock's compliance and quota model. Both keep usage on the AWS bill.

What works, and what does not

Because requests go straight to the Claude API, most features work exactly as on the first-party API: streaming, tool use, adaptive and extended thinking with the effort parameter, prompt caching (5-minute and 1-hour TTLs and automatic caching), the Batch API, the Files API, Agent Skills including the pre-built PowerPoint, Excel, Word and PDF skills, code execution in Anthropic's sandbox, beta features through the anthropic-beta header, customer-managed encryption keys with AWS KMS keys, the Compliance API, and Claude Managed Agents (with an autonomous-session reauthentication requirement after 6 hours).

Not available as of October 2026: Anthropic's HIPAA-ready program; the newest computer-use and browser-use toolsets (earlier computer-use tool versions remain for the models that support them); fast mode; OpenAI-compatible endpoints; OAuth authentication; most of the Admin API beyond workspaces, external keys and telemetry destinations; per-workspace member management (IAM controls access instead); and MCP tunnels (only MCP servers reachable over the public internet work).

Organizing workspaces: teams, environments and Regions

Every request names one workspace, and workspaces are where usage, costs, files, batches and Skills roll up, so a sensible layout saves trouble later. Three rules of thumb:

• One workspace per environment. Separate production from development and testing, each with its own spend limit, so a runaway test cannot eat production's budget. That is exactly what would have saved Jake's shop its festival weekend.
• One workspace per team that owns a budget. IAM policies can then allow each team's roles on their own workspace ARN only, and the Console's Cost page shows each team's spend.
• One workspace per Region you serve from. A workspace is bound to the Region it was created in and reachable only through that Region's endpoint; create one per Region if your applications run in several.

Create, rename and archive workspaces from the AWS Console's Workspaces page, or with the Admin API workspace endpoints (which do not need the workspace header). Workspace member management does not exist on this platform; IAM decides who can use which workspace.

IAM policies and workspace ARNs

The IAM namespace and SigV4 service name are both aws-external-anthropic, and workspaces are the main resource. A workspace ARN looks like arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj. A policy that allows real-time inference on every workspace while blocking batch jobs:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow",
      "Action": ["aws-external-anthropic:CreateInference", "aws-external-anthropic:CountTokens",
                 "aws-external-anthropic:GetModel", "aws-external-anthropic:ListModels",
                 "aws-external-anthropic:GetWorkspace"],
      "Resource": "arn:aws:aws-external-anthropic:*:*:workspace/*" },
    { "Effect": "Allow", "Action": "aws-external-anthropic:ListWorkspaces", "Resource": "*" },
    { "Effect": "Deny",
      "Action": ["aws-external-anthropic:CreateBatchInference", "aws-external-anthropic:GetBatchInference",
                 "aws-external-anthropic:ListBatchInferences"],
      "Resource": "*" }
  ]
}

Scope the Resource to one workspace ARN to give a team access to its own workspace only; add CallWithBearerToken for principals that use API keys and AssumeConsole for people who open the Claude Console. CloudTrail records workspace and other management operations by default; inference, batch, file and most agent operations are data events, which you must enable explicitly if you want them logged.

Monitoring: CloudTrail, request IDs and usage

Every response carries two request IDs in its headers: x-amzn-requestid, the AWS request ID, which is indexed in CloudTrail and is what AWS support asks for; and request-id, Anthropic's ID, for Anthropic support. Log both with every error and you will never have to reproduce a failure before asking for help.

CloudTrail records management operations (workspaces, external keys, telemetry destinations, compliance, vaults, webhooks) by default. Inference, batch, file, Skill, model and most Managed Agents operations are data events, which CloudTrail logs only if you turn on data event logging for the service, and which cost extra in CloudTrail. In the Claude Console, the Usage page shows tokens by model and workspace (a few minutes behind), Cost shows spend (up to about two hours behind), Logs shows per-request metadata without prompt contents, and Rate limits shows your tier's current limits.

Data, Regions and retention

Anthropic is the data processor for prompts and outputs and stores workspace content (prompts, outputs, files, Skills, batches) on AWS infrastructure for workspaces created after September 18, 2026; for earlier workspaces it may process and store data outside AWS. The workspace's AWS Region controls which endpoint you call and where AWS-side resources such as IAM, CloudTrail and billing live, but it does not pin where inference runs. To keep inference in the US, set inference_geo on each request (or a workspace default) to the US geography, at 1.1 times the standard price; the global default may route to any Anthropic-operated data center. Retention follows the first-party API policy, and Zero Data Retention is available on request through your account representative. Request logs in the Console show metadata (time, model, workspace, tokens, status), never prompts or responses.

Migrating from Amazon Bedrock to Claude Platform on AWS

Moving is a code change plus a new organization, not a switch. What changes, depending on where you start:

• From Claude in Amazon Bedrock (Messages API at bedrock-mantle): the base URL, the SigV4 service name (bedrock-mantle becomes aws-external-anthropic), the model IDs (drop the anthropic. prefix), the SDK client, and a new anthropic-workspace-id header. Request bodies stay the same.
• From the older Bedrock InvokeModel or Converse integration: all of the above, plus rewriting requests and responses to the Messages API format and handling SSE streaming instead of AWS EventStream.

What you gain: same-day models and features, Agent Skills, code execution, beta features Bedrock lacks, the Claude Console, direct Anthropic support and API-key authentication. What stays: SigV4, AWS as the invoicing party and spend counted toward AWS commitments. Two pitfalls: enable outbound web identity federation first, and confirm Zero Data Retention before moving data-sensitive workloads, because on Bedrock AWS is the processor while here Anthropic is. Negotiated discounts and private offers do not transfer automatically between the two. You can run both side by side and shift traffic gradually; our Bedrock Converse guide is a good reference for what your current code does.

Claude Platform on AWS not working? Troubleshooting by symptom

"Outbound web identity federation is disabled for your account"

Run aws iam enable-outbound-web-identity-federation once in the account, then retry. It is off by default on every AWS account and is the most common setup error.

"Sign-up failed: Failed to enable OutboundWebIdentityFederation"

Shown during sign-up on the first submit; choose Continue again. The IAM change can take a moment to take effect.

The client says no Region is set

Set AWS_REGION (or pass the Region in code) to your workspace's Region. There is no default, and a workspace is only reachable through its own Region's endpoint.

403 or AccessDenied on a request

The calling identity lacks aws-external-anthropic:CreateInference on that workspace ARN, or CallWithBearerToken when using an API key. Check the policy and the workspace ID in the request header.

An API key from the Claude Console does not work

Keys for this platform are generated in the AWS Console under Claude Platform on AWS, API keys. Keys from a first-party Claude Console organization belong to a different organization.

HTTP 429 "crossed its monthly API usage threshold"

Your organization reached its tier's monthly spend cap ($500 on the Start tier). Requests resume on the first day of next month; contact your Anthropic account representative for a higher tier sooner.

HTTP 400 after reaching a spend limit you set

Your own organization or workspace limit stopped the request. Raise or remove it under Settings, Billing or on the workspace's Spend limits panel.

The Usage page shows nothing after the first call

Usage data takes a few minutes to appear in the Claude Console. Cost spend can lag by about two hours.

Claude Code still uses Bedrock or the first-party API

Set CLAUDE_CODE_USE_ANTHROPIC_AWS=1 and unset CLAUDE_CODE_USE_BEDROCK, which takes precedence. Make sure ANTHROPIC_AWS_WORKSPACE_ID is set.

Requests fail with a missing-workspace error

Inference and resource requests must carry the anthropic-workspace-id header; the SDK adds it from ANTHROPIC_AWS_WORKSPACE_ID. Set the variable (or pass the ID in code) and check it belongs to the same Region as your endpoint.

Claude Platform on AWS: frequently asked questions

The shop's assistant now answers "is my phone ready?" around the clock, costs about the price of a box of screen protectors a month, and arrives on the same AWS bill as the website. The test workspace has its own small limit, and the federation command lives in Ethan's setup notes with a star next to it. "Two lines nobody tells you," Jake said, reading them. "Now somebody has," Ethan said.

Revision note. Written October 22, 2026, from Anthropic's Claude Platform on AWS documentation, pricing and rate-limit pages as of that date. "An ounce of prevention is worth a pound of cure," the proverb says; one federation command and one spend limit are the ounce.