Claude Platform on AWS is Anthropic-operated but authenticated through AWS: requests are SigV4-signed (AWS's request-signing scheme) against endpoints shaped like https://aws-external-anthropic.{region}.api.aws/v1/..., with IAM controlling access and AWS Marketplace handling billing. That split — Anthropic serves, AWS authenticates — is exactly where the two classic setup failures live.
Failure 1: the outbound WIF switch was never flipped
Before any request from an AWS account can succeed, someone must run a one-time, per-account command:
aws iam enable-outbound-web-identity-federationOutbound web identity federation (WIF) is the mechanism by which the AWS gateway calls sts:GetWebIdentityToken server-side to mint a JWT that is forwarded to Anthropic — it's how your AWS identity is proven to the Anthropic side of the platform. Until it's enabled, every request fails with the message "Outbound web identity federation is disabled for your account." Anthropic's docs call this the most common setup error. The good news: it's the friendly failure. The error text names the problem, the fix is one CLI command, and you can verify state (and the issuer URL) with aws iam get-outbound-web-identity-federation-info.
Failure 2: the region mismatch that says almost nothing
The unfriendly failure is SigV4 region agreement. A SigV4 signature embeds the region and service name (aws-external-anthropic), and the region in your signature must match the region in the endpoint URL you're calling. When either side disagrees, you get a generic signature-rejection error — no hint about which region was expected, no pointer to the mismatch. Raw cURL users must keep --aws-sigv4 "aws:amz:<region>:aws-external-anthropic" and the URL's region literally identical.
There's a third region in play, too: workspaces on this platform are bound to a single AWS region. A workspace created in us-west-2 can only be reached through the us-west-2 endpoint. So the full checklist when you see a signature rejection is: signing region = endpoint region = the workspace's bound region. The typical setup is two environment variables that must agree with your workspace:
export AWS_REGION='us-west-2' # your workspace's region
export ANTHROPIC_AWS_WORKSPACE_ID='wrkspc_01AbCdEf23GhIj'The SDK fails fast — on purpose
The AnthropicAWS Python client (installed with pip install -U "anthropic[aws]") requires both values with no default fallback: it raises an error at construction — before any request is sent — if the region or workspace ID can't be resolved from constructor arguments or the AWS_REGION / ANTHROPIC_AWS_WORKSPACE_ID environment variables. That's a deliberate contrast with AnthropicBedrock, which quietly falls back to us-east-1. A construction-time exception is your easiest diagnostic of all: nothing left the machine, so the fix is purely local configuration. The client then handles SigV4 signing, base-URL construction, and the required anthropic-workspace-id header automatically; temporary credentials (roles, SSO, STS) get the x-amz-security-token header added for you.
Triage order for day-one failures
(1) Client throws before sending → set region and workspace ID. (2) "Outbound web identity federation is disabled" → run the enable command once per account. (3) Generic signature rejection → align the three regions. (4) 403 → verify the workspace ID is right and the IAM principal has the needed action (for example aws-external-anthropic:CreateInference on the workspace ARN; API-key users also need CallWithBearerToken). Every response carries two request IDs — x-amzn-requestid for AWS support and request-id for Anthropic support — so capture both when escalating.
Where to go next
For how signing works under the hood, see SigV4 under the hood. For workspace mechanics, read understanding the workspace ID, and for the broader failure catalog, Claude Platform on AWS error codes.