Claude Platform on AWS Setup — Authentication with IAM SigV4 using SSO

This guide covers the prerequisites for setting up Claude Platform on AWS (CP on AWS) using IAM with AWS Signature Version 4 authentication.

Natasha_S

Published Jun 22, 2026

Last modified Jun 22, 2026

This guide covers the prerequisites for setting up Claude Platform on AWS (CP on AWS) using IAM with AWS Signature Version 4 authentication, which lets you sign in through your corporate identity provider (IdP). For API key authentication, see Introducing Claude Platform on AWS . Complete each section below in order:

IAM Identity Center Setup

Prerequisites

Before you begin, make sure your AWS environment has the following:

AWS management account that handles , IAM Identity Center administration etc
Dedicated member account where Claude Platform on AWS will be deployed
The AWS CLI installed and configured.
Connect your identity provider to IAM Identity Center using SAML. For setup guides for each supported provider (Okta, Microsoft Entra ID, Google Workspace, JumpCloud, and others), see the IAM Identity Center tutorials index .

Additional Configurations

1. Create a permission set

In IAM Identity Center, create a permission set named ClaudePlatformAccess with the following general settings: Session duration: 8 hours, under Inline policy, add the following policy document:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "aws-external-anthropic:AssumeConsole",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sts:GetWebIdentityToken",
                "sts:TagGetWebIdentityToken"
            ],
            "Resource": "*"
        }
    ]
}

Note:

aws-external-anthropic:AssumeConsole lets an IAM principal federate into the Anthropic-operated Claude Console. The policy above is an example. For production workloads, scope permissions down following the principle of least privilege. For ready-to-use policy examples, see IAM policies for Claude Platform on AWS .

2. Assign the permission set

Assign the ClaudePlatformAccess permission set to the dedicated member account and to the appropriate IdP user or group. After provisioning, the permission set status should show Up to date for the assigned AWS account.

3. Enable web identity federation

The Claude Platform on AWS gateway calls sts:GetWebIdentityToken server-side to mint a JWT that it forwards to Anthropic for authentication. This capability is disabled by default on every AWS account and must be enabled once per member account before making any API calls. Run the following command using the AWS CLI:

1
aws iam enable-outbound-web-identity-federation

Warning: Without this step, every API request returns "Outbound web identity federation is disabled for your account". This is the most common setup error.

If the command returns [ERROR] (FeatureEnabled) … already enabled, the setting is already on for your account. To verify and retrieve your account's issuer URL, run:

1
aws iam get-outbound-web-identity-federation-info

For more information, see Enable outbound web identity federation .

4. Configure the AWS SSO Profile

Add or verify the following SSO profile in ~/.aws/config:

1
2
3
4
5
6
[profile cpoa-sso]
sso_start_url  = https://ssoins-xxxxxxxxxxxxxxxxx.portal.us-east-1.app.aws
sso_region     = us-east-1
sso_account_id = 123456789012
sso_role_name  = ClaudePlatformAccess
region         = us-east-1

Note: Replace sso_start_url, sso_account_id, sso_role_name, and region with the values specific to your AWS environment. You can find sso_start_url in the IAM Identity Center dashboard under Settings > Identity source.

5. Log In via AWS SSO

Authenticate with your corporate IdP credentials through AWS SSO:

1
aws sso login --profile cpoa-sso

A browser window will open for IdP authentication. After a successful login, temporary IAM credentials are cached locally and remain valid for the duration of the SSO session (8 hours by default, as configured in the permission set).

Claude Platform on AWS Setup

You can activate Claude Platform on AWS through the AWS Marketplace . For step-by-step instructions, see Set up your account .

1. Create a workspace

With a workspace, you can separate projects, environments, or teams while maintaining centralized billing and administration. It also serves as the primary AWS Identity and Access Management (IAM) resource for Claude Platform on AWS. You grant or deny access to specific workspaces through IAM policies using the workspace ARN. See IAM policies for policy examples.

Open the Claude Console from within the Claude Platform on AWS Console and create a workspace.

Post which you should be able to see your Workspace listed in AWS Console.

Claude App Setup

Install the AWS Token Generator Library

The token generator library converts your AWS IAM credentials into a short-lived bearer token accepted by Claude Platform on AWS (valid for up to 12 hours).

1
pip3 install token-generator-for-aws-external-anthropic

Verify the installation:

1
pip3 show token-generator-for-aws-external-anthropic

Create the Credential Helper Script

This script is called by Claude Desktop or Claude Code each time it needs a bearer token. It reads credentials from the SSO profile and outputs a signed token to stdout.

Create the file at /Users/<username>/cpoa-cred-helper:

1
2
3
4
5
6
7
#!/usr/bin/env python3
import boto3
from token_generator_for_aws_external_anthropic import TokenGenerator

session = boto3.Session(profile_name="cpoa-sso")
generator = TokenGenerator(session=session, region="<your-region>")
print(generator.get_token())

Make the script executable:

1
chmod +x /Users/<username>/cpoa-cred-helper

Test the script manually — it should print a long token string starting with aws-external-anthropic-api-key:

1
python3 /Users/<username>/cpoa-cred-helper

Configure Claude Desktop / Claude Code

Open Claude Desktop → Settings → Configure third-party inference and fill in the following fields:

Field	Value
Credential kind	Helper script
Gateway base URL	`https://aws-external-anthropic.<your-region>.api.aws`
Gateway auth scheme	`bearer`
Additional header (key)	`anthropic-workspace-id`
Additional header (value)	`<your-workspace-id>`
Helper script (path)	`/Users/<username>/cpoa-cred-helper`
Helper script TTL	`600 seconds`
Re-run helper for silent refresh	`ON`

Under Models specify the Anthropic-specific model ID.

Note: The Gateway base URL and Workspace ID are found in the Claude Platform console under Settings. Replace <your-region> with your AWS region (for example, eu-west-1) and <username> with your local macOS username.

Testing

Once configured, open the Claude application. If the setup is successful, a Gateway indicator will appear at the bottom of the application window, confirming that traffic is routing through your configured Claude Platform on AWS endpoint.

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.

Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article

Builder Center

Claude Platform on AWS Setup — Authentication with IAM SigV4 using SSO

Natasha_S

IAM Identity Center Setup

Prerequisites

Additional Configurations

Claude Platform on AWS Setup

Claude App Setup

Testing