Secure multi-environment access patterns for Claude Platform on AWS

Amazon Web Services published a detailed technical guide on October 1, 2026, outlining how to implement secure, multi-environment access for the Claude Platform on AWS. The article provides infrastructure engineers with a step-by-step blueprint for connecting production workloads, developer laptops, and external services to a single subscription while maintaining strict isolation.

What happened

The guide addresses a common architectural challenge for organizations adopting large language models: managing access from three distinct environments without compromising security or billing clarity. These environments include production workloads running on AWS, developer laptops used for local iteration, and external services hosted on other cloud providers or on-premises continuous integration pipelines. Each environment has unique authentication requirements, yet they must all share a single Claude Platform on AWS subscription.

To solve this, the authors propose a dedicated AI Services account pattern within an AWS Organization. This specific linked account hosts the subscription, workspaces, API keys, and cross-account roles. Workload accounts do not interact with the subscription directly. Instead, they assume roles into the AI Services account to make inference calls. This creates a three-account topology consisting of a payer account for governance, the AI Services account for hosting resources, and one or more workload accounts that consume inference through cross-account roles.

The implementation relies on three specific access patterns configured in parallel. AWS workload accounts use cross-account Signature Version 4 signing, allowing pods on Amazon Elastic Kubernetes Service to assume a role and make signed calls without storing API keys. Developer laptops use workspace-scoped API keys locked to a development workspace. External workloads use OpenID Connect federation to obtain short-term credentials, ensuring zero persistent secrets are stored outside the AWS ecosystem.

How it works

The core mechanism depends on workspace-level isolation within the Claude Platform. Engineers create separate workspaces for production and development traffic, each with its own Amazon Resource Name. These workspaces are tied to specific AWS Regions, meaning API calls must target the matching Regional endpoint. While inference geography is controlled separately via security settings, the token generation and usage are strictly bound to the region where the workspace was created.

For AWS-native workloads, the system uses Identity and Access Management trust policies. A pod in a workload account assumes a role in the AI Services account. This role grants permission only to the specific production workspace. The pod then signs its inference requests using SigV4, eliminating the need for long-lived secrets. For external systems, the process involves an OIDC identity provider. The external workload authenticates, obtains temporary AWS credentials, and generates a short-lived token for inference. This ensures that even if an external pipeline is compromised, the credentials expire quickly and cannot be reused indefinitely.

Key details

• The architecture requires three AWS accounts: a payer account, a dedicated AI Services account, and at least one workload account.
• Two workspaces must be created in the Claude Console, typically named production and development, each with a unique ARN.
• Cross-account access for AWS workloads uses SigV4 signing, removing the need to store or rotate API keys in application code.
• Developer access is managed via long-lived API keys that are scoped specifically to the development workspace.
• External non-AWS workloads authenticate via OIDC federation to receive short-term tokens, ensuring no persistent credentials exist outside AWS.
• Cost allocation is achieved by tagging each workspace, such as team:payments or environment:prod, and activating these tags in the AWS Billing Console.

Why it matters

For software teams building with generative AI, security and cost visibility are primary concerns. Storing long-lived API keys in code repositories or CI/CD pipelines creates significant risk. If a key is leaked, an attacker can exhaust quotas or access sensitive data. By moving to role-based access for AWS workloads and short-lived tokens for external systems, organizations reduce their attack surface. The separation of production and development workspaces also prevents accidental resource contention, ensuring that experimental code does not impact critical production services.

Furthermore, this structure solves the operational headache of attributing costs. In many early AI deployments, billing is a black box. By tagging workspaces and enabling cost allocation tags, engineering leads can filter AWS Cost Explorer by team or project. This allows for precise chargebacks and budget monitoring. The guide notes that after activating tags, it takes 24 to 48 hours for data to appear in Cost Explorer, but once active, it provides granular visibility into spend per environment.

What you can do

• Set up a dedicated AI Services linked account within your AWS Organization to host the Claude Platform subscription.
• Create separate production and development workspaces in the Claude Console and record their ARNs for later configuration.
• Configure IAM trust policies in the AI Services account to allow specific workload accounts to assume roles for SigV4 signing.
• Generate workspace-scoped API keys for developers, ensuring they are restricted to the development workspace only.
• Implement OIDC federation for any external CI/CD pipelines or on-premises services that need to access the model.
• Tag your workspaces with team and environment identifiers, then activate these tags in the AWS Billing Console for cost tracking.