Diffbrief Engineering daily

← Monday, October 5, 2026ArchitectureGuide

Claude Platform on AWS uses separate access patterns for production, developers, and CI

aws.amazon.com by Andrea Gallo 11 min read Editor score 7/10

The setup combines cross-account SigV4 for AWS workloads, workspace-scoped API keys for developers, and OIDC federation for external environments under one subscription. The pattern addresses authentication and workspace isolation across mixed deployment environments.

What
Claude Platform on AWS uses a dedicated AI Services account to host its subscription, workspaces, API keys, and cross-account roles.
How
AWS workloads assume cross-account roles and sign requests with SigV4; developers use workspace-scoped API keys, while external workloads use OIDC federation.
Why it matters
Separating access by environment supports workspace-level isolation while avoiding persistent credentials for AWS and external workloads.
assumes role inference API key authenticates temporary credentials EKS pod Developerlaptops Externalworkloads AI Servicesaccount OIDC federation CPonAWSsubscription
Three environment-specific access paths reach the subscription hosted in the AI Services account. Sketched from the article's own text.

Read on aws.amazon.com →

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.

Your note

Private to you. Stored in this browser, and synced to your account when you are signed in.