Implementing Multi-Environment Access for Claude Platform on AWS

AWS Machine Learning is laying out a full path for running Claude Platform on AWS across three very different places: production workloads in AWS, developer laptops, and outside services such as on-prem CI/CD or other cloud providers. The pitch is simple enough. One subscription, multiple authentication paths, and workspace-level separation so production and development traffic don’t get mixed together.

The guide centers on a dedicated AI Services account inside AWS Organizations. That account owns the Claude Platform on AWS subscription, the workspaces, the API keys, and the cross-account roles. Workload accounts do not call the subscription directly. They assume roles into the AI Services account instead. AWS describes the resulting setup as a payer or management account for billing and governance, an AI Services account for Claude, and one or more workload accounts that consume inference through cross-account access.

For AWS workloads, the path is SigV4 and role assumption. The example uses an EKS pod in a workload account, which assumes a role called CrossAccount-ClaudePlatform-Prod in the AI Services account and then calls inference on the production workspace. That role is explicitly locked to the production workspace ARN, so it cannot reach the development workspace or any others. The example policy also includes access to GetAccountStatus and the web identity token actions.

Developers get a different route. They use a long-lived API key tied to the development workspace, then call Claude from a laptop with the standard Anthropic SDK. AWS says the default key-backed IAM user starts with the AnthropicLimitedAccess managed policy, which has to be replaced with an inline policy that limits CreateInference and CountTokens to the development workspace only. The key can then be stored in Secrets Manager or another secret store, and the laptop client sends the workspace ID in a header when it makes the request.

External environments use OIDC federation and short-term keys. AWS says that path gives outside workloads temporary credentials, a short-lived token, and no persistent secrets. The setup also has some sharp edges: workspace Region determines the API endpoint, while inference geography is controlled separately in the Claude Console, and short-term keys are only valid against the same Regional endpoint where they were created. So this is not just “one key, everywhere.” It’s a controlled maze, which is exactly the point.