Claude Platform on AWS authenticates with AWS SigV4 request signing, and the platform SDKs resolve credentials through the standard AWS default credential provider chain — environment variables, shared config files, web identity, ECS container credentials, and EC2 instance metadata. Inside Lambda, that chain picks up the temporary credentials of the function's execution role automatically. The result: your function calls Claude with the same identity mechanism it uses for every other AWS service, and no secret ever appears in code, environment variables, or a secrets store.
One-time account prerequisite
Before any request from your account can succeed, outbound web identity federation must be enabled once per AWS account: aws iam enable-outbound-web-identity-federation. The gateway calls sts:GetWebIdentityToken server-side to mint a token it forwards to Anthropic. If this is missing, every request fails with "Outbound web identity federation is disabled for your account" — the single most common setup error. You can verify the state with aws iam get-outbound-web-identity-federation-info.
Grant the execution role the right IAM actions
The service's IAM namespace is aws-external-anthropic, and the workspace is the resource you scope to. A minimal inference policy for a Lambda that only calls the Messages API allows CreateInference, CountTokens, GetModel, ListModels, and GetWorkspace on the workspace ARN, which looks like arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj. If you prefer a managed policy, AnthropicInferenceAccess is the narrowest one that covers inference — but note its Get*/List* wildcards also grant read access to all workspace content, so a custom scoped policy is tighter.
Configure the two required values
The AnthropicAWS client requires two values with no default fallback: an AWS region and a workspace ID. Set ANTHROPIC_AWS_WORKSPACE_ID as a Lambda environment variable (workspace IDs use the wrkspc_ format and are shown in the AWS Console under Claude Platform on AWS → Workspaces). For the region, be careful: a workspace is bound to a single AWS region, and the SigV4 signing region must match the region in the endpoint URL. If your function runs in a different region than your workspace, pass the workspace's region explicitly rather than relying on the runtime's own region variables — a mismatch produces a generic signature-rejection error, not a helpful diagnostic. The client raises an error at construction, before any request is sent, if either value cannot be resolved.
import os
from anthropic import AnthropicAWS
# Reads ANTHROPIC_AWS_WORKSPACE_ID from the environment;
# region pinned to the workspace's region, not the function's.
client = AnthropicAWS(aws_region="us-west-2")
def handler(event, context):
message = client.messages.create(
model="claude-sonnet-5",
max_tokens=1024,
messages=[{"role": "user", "content": event["prompt"]}],
)
return {"text": message.content[0].text}Install the dependency with pip install -U "anthropic[aws]" and package it with your function. The SDK handles SigV4 signing, builds the region-based endpoint (https://aws-external-anthropic.{region}.api.aws/v1/...), sets the anthropic-workspace-id header, and attaches the x-amz-security-token header that temporary role credentials require.
Size the timeout for generation, not for a web request
Model responses take longer than typical service calls — seconds to minutes depending on the model and output length. Leave your function's timeout at its short default and you will see clean-looking failures that are really just truncated invocations. Set the timeout generously above your worst observed generation time. Streaming helps here: Claude Platform on AWS streams with standard server-sent events (SSE), exactly like the first-party Claude API, so client.messages.stream(...) lets you process tokens as they arrive instead of holding the full response in memory until the end. Remember that whatever consumes your function's output must also support incremental delivery for streaming to reach the end user.
x-amzn-requestid for AWS support and request-id for Anthropic support. Log both.Where to go next
For the equivalent pattern on containers, see ECS Fargate task roles. If you are setting up from zero, your first API call on Claude Platform on AWS and the quickstart cover the account-level steps.