Claude Platform on AWS is Anthropic-operated — the models run on Anthropic-managed infrastructure — while AWS provides authentication, IAM-based access control, and billing through AWS Marketplace. That split shapes the onboarding: you subscribe on the AWS side, then complete organization setup on the Anthropic side, and the two are linked from then on. Here is the flow end to end.
Phase 1: Subscribe from the AWS Console
Setup begins on the "Claude Platform on AWS" service page in the AWS Console. Signing up there is where AWS handles the Marketplace subscription for you, including acceptance of the vendor terms — you are agreeing to a Marketplace product, which is what routes the charges onto your consolidated AWS invoice. Billing is denominated in Claude Consumption Units, metered hourly and invoiced monthly in arrears; there is nothing to prepay (details in how billing works).
Phase 2: Anthropic organization setup
Next you complete organization setup at platform.claude.com/partner-signup. Signing up provisions a new Anthropic organization tied to your AWS account. This surprises teams that already have a first-party Anthropic account: API keys, workspaces, and Console settings from an existing Anthropic organization do not carry over. Your first-party sk-ant-api... keys will not work against the Claude Platform on AWS endpoint either — this is a fresh organization whose identity and billing run through AWS.
Phase 3: Create a workspace and note its ID
Create your first workspace from the AWS Console's Workspaces page (the Claude Console's Workspaces view is read-only). Two things to record:
The workspace ID — a tagged identifier like wrkspc_01AbCdEf23GhIj. Every API request must carry it (SDK clients send it from the ANTHROPIC_AWS_WORKSPACE_ID environment variable), and it is also the resource segment of the workspace's IAM ARN.
The region binding — a workspace is bound to the AWS region of the endpoint you used to create it, permanently. A workspace created in us-west-2 can only be accessed through the us-west-2 endpoint. Pick the region deliberately; note it controls the gateway endpoint and where AWS-side resources like IAM scoping and CloudTrail live, not where model inference runs (that is governed separately by inference_geo).
Phase 4: Sign in to the Claude Console
Console access is federated through AWS IAM: a user assumes a role that has the aws-external-anthropic:AssumeConsole action, clicks "Open Claude Console" in the AWS Console, and AWS issues a token that signs them into platform.claude.com. Users are provisioned just-in-time on first sign-in, and an "Account managed by AWS" indicator appears in the Console sidebar — a handy way to confirm you are in the AWS-linked organization rather than a personal one.
The step everyone forgets: enable outbound federation
Before API calls will succeed, there is a one-time per-account prerequisite: enabling outbound web identity federation.
aws iam enable-outbound-web-identity-federation
# verify:
aws iam get-outbound-web-identity-federation-infoBehind the scenes, the platform's gateway uses this to mint a token on the AWS side that is forwarded to Anthropic. Without it, every request fails with "Outbound web identity federation is disabled for your account" — the single most common setup error on this platform. Run it once per AWS account and move on.
Confirming everything works
Your checklist for "subscription is live": the service page shows you as signed up; the partner-signup flow completed and "Open Claude Console" works; a workspace exists with its ID recorded; the federation command has been run; and a test request via an SDK returns a model response (see the Python SDK setup for a verified test call). Once the first hourly meter reports, the charge appears among your AWS Marketplace items — confirming consolidated billing is active.
Where to go next
Set up a client with Python, TypeScript, or Java, then lock down access with IAM policy templates.