View a markdown version of this page

Workspaces - Claude Platform on AWS
Workspace scopingCreating workspacesSetting the workspace ID in your clientTagging workspaces

Workspaces

Inference and resource requests on Claude Platform on AWS target a workspace. You pass the workspace’s ID in the anthropic-workspace-id header on these API calls. Workspace IDs use the tagged format wrkspc_ followed by an alphanumeric identifier (for example, wrkspc_01AbCdEf23GhIj). See Obtain your workspace ID if you don’t have it yet.

Workspace scoping

Workspaces are bound to a single AWS region. A workspace created in us-west-2 can only be accessed through the us-west-2 endpoint. Usage, quotas, cost, files, batches, and Skills all roll up per workspace, giving you per-region breakdowns in the Claude Console.

Workspaces also serve as the primary IAM resource for Claude Platform on AWS. You grant or deny access to specific workspaces through AWS IAM policies using the workspace ARN. The ARN’s resource segment is the same wrkspc_-prefixed ID you pass in the anthropic-workspace-id header:

arn:aws:aws-external-anthropic:{region}:{account-id}:workspace/{workspace-id}

For example: arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj

See IAM policies for policy examples.

Creating workspaces

A default workspace is provisioned automatically at sign-up. Additional workspaces can be created, updated, renamed, and archived through the /v1/organizations/workspaces endpoints, authorized by the corresponding aws-external-anthropic actions (CreateWorkspace, UpdateWorkspace, ArchiveWorkspace); see IAM actions.

Setting the workspace ID in your client

Every data plane request must include the workspace ID in the anthropic-workspace-id header. When you use an Anthropic SDK’s Claude-on-AWS client, there are three ways to supply it:

  1. Environment variable — set ANTHROPIC_AWS_WORKSPACE_ID, and the client reads it automatically.

    export ANTHROPIC_AWS_WORKSPACE_ID='wrkspc_01AbCdEf23GhIj'

  2. Constructor argument — pass workspaceId / workspace_id (name follows the SDK’s language convention) when instantiating the client.

  3. Per-request override — pass the header directly on an individual request if you need to address multiple workspaces from the same client.

If you use the base Anthropic client (without the AWS backend), set the anthropic-workspace-id header explicitly on every request — see Making requests for per-language examples. For SDK-specific argument names, refer to the Anthropic Client SDKs documentation.

Tagging workspaces

Workspace tags are key-value pairs attached to a workspace. They integrate with AWS IAM for attribute-based access control, and with AWS Cost and Usage Reports for cost allocation (see Monitoring and logging for CUR details). Tagging is GA on Claude Platform on AWS.

Update tags on the existing workspace with TagResource and UntagResource in the aws-external-anthropic namespace. The same tag keys can drive IAM conditions and cost allocation without additional configuration.

Tag-based access control

You can gate aws-external-anthropic actions on workspace tag values using the aws:ResourceTag/<key> condition context key. The following policy allows inference only on workspaces tagged Environment=production:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CreateInference",
        "aws-external-anthropic:CreateBatchInference",
        "aws-external-anthropic:CountTokens"
      ],
      "Resource": "arn:aws:aws-external-anthropic:*:*:workspace/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/Environment": "production"
        }
      }
    }
  ]
}

Use aws:RequestTag/<key> and aws:TagKeys condition keys on TagResource to enforce tagging policies (for example, requiring the workspace to carry CostCenter and Owner tags). See IAM policies for more examples.