A workspace is the basic organizational unit of Claude Platform on AWS. Usage, quotas, cost, files, batches, and Skills all roll up per workspace, and the workspace is also the primary IAM resource: the ARN you write in an AWS IAM policy ends in the same wrkspc_... identifier your application passes in every request. That dual role — billing bucket and security boundary — is why the create/rename/retire lifecycle deserves a few minutes of deliberate thought rather than a default click-through.
Creating a workspace
Workspaces are created from the AWS Console's Claude Platform on AWS Workspaces page, or programmatically through the Admin API workspace endpoints (POST /v1/organizations/workspaces). One detail catches people out: the Claude Console also has a Workspaces page, but for Claude Platform on AWS it is read-only. You can view workspaces there, but creation, renaming, and archiving happen on the AWS side.
Two properties are fixed at creation time:
Region. A new workspace is bound to the AWS region of the endpoint you call to create it, and it stays bound: a workspace created in us-west-2 can only be accessed through the us-west-2 endpoint. If your application will run in a particular region, create the workspace there.
ID. Every workspace gets a tagged identifier in the format wrkspc_ plus an alphanumeric string, for example wrkspc_01AbCdEf23GhIj. You'll find it in the AWS Console (Claude Platform on AWS → Workspaces) or in the Claude Console. This ID goes three places: the ANTHROPIC_AWS_WORKSPACE_ID environment variable your SDK client reads, the anthropic-workspace-id header the SDK sets on every request, and the resource segment of the IAM ARN:
arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIjIf you automate provisioning from CI/CD, note that the CreateWorkspace and ListWorkspaces IAM actions are account-scoped — attaching a workspace ARN to them has no effect, so grant them on Resource: "*". A sensible provisioning-role pattern from the official IAM reference grants CreateWorkspace, GetWorkspace, ListWorkspaces, UpdateWorkspace, and ArchiveWorkspace with no inference permissions at all.
Renaming a workspace
Display names are cosmetic and safe to change at any time — via the AWS Console Workspaces page or the UpdateWorkspace action on the Admin API. Renaming does not change the wrkspc_ ID, so nothing in your IAM policies, environment variables, or application code needs to move. Use names that encode what the ID can't: application and environment (for example invoicing-prod, invoicing-staging) rather than team nicknames that go stale.
"Deleting" is actually archiving
There is no hard delete for workspaces. The IAM action set includes CreateWorkspace, GetWorkspace, ListWorkspaces, UpdateWorkspace, and ArchiveWorkspace — archive only. That's a feature for finance and audit teams: because a retired workspace is archived rather than destroyed, its historical usage remains a queryable record (the Admin API's workspace list endpoint has an include_archived parameter), and your month-end reconciliation doesn't develop holes when a project winds down.
Archiving is still a serious action. Per Anthropic's workspace documentation, archiving a workspace immediately revokes all API keys in that workspace and cannot be undone. Before archiving, confirm nothing is still calling in — on Claude Platform on AWS there are no per-workspace spend limits to trip, so a forgotten consumer surfaces as errors, not as a budget alert. A safe retirement sequence: rename the workspace to flag it (for example a retired- prefix), remove or tighten the IAM policies that reference its ARN, watch for residual traffic, then archive.
Also note the organization-level constraints documented for workspaces generally: an organization can have at most 100 workspaces (archived ones don't count against the cap), and every organization has a Default Workspace that cannot be renamed, archived, or deleted. Both facts push in the same direction — workspaces are meant to be deliberately provisioned per application, not spun up ad hoc per experiment.
One more setup fact worth knowing
Signing up for Claude Platform on AWS provisions a new Anthropic organization tied to your AWS account. Workspaces, API keys, and Console settings from an existing first-party Anthropic organization do not carry over, so plan your workspace layout fresh rather than assuming you can mirror what you have on the first-party API.
Where to go next
For how to split workspaces across dev, staging, and production, read Multi-Workspace Strategy. For scoping IAM permissions to a workspace ARN, see Copy-Paste IAM Policies, and for the basics of finding your ID, the workspace ID explainer.