Setup Assumed Role for Claude Platform on AWS

Enterprise Self-Hosted Deployment

On the Enterprise plan? See the Helm documentation for assumed role setup in self-hosted deployments.

Enable Outbound Web Identity Federation

This is a one-time setup step for your AWS account. Without it, all Claude Platform on AWS requests fail with "Outbound web identity federation is disabled for your account".

aws iam enable-outbound-web-identity-federation

Select Assumed Role Authentication

Create a new integration on Portkey:

Go to Model Catalog → Add Provider
Select Claude Platform on AWS
Choose AWS Assumed Role as the authentication method

Create an IAM Permission Policy

Create a permission policy in your AWS account. Claude Platform on AWS uses the aws-external-anthropic IAM namespace (not bedrock).

Inference-only policy

For workloads that only need chat completions and token counting:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ClaudePlatformInference",
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CreateInference",
        "aws-external-anthropic:CountTokens"
      ],
      "Resource": "arn:aws:aws-external-anthropic:*:*:workspace/*"
    }
  ]
}

Full access policy

For workloads that also need batch processing and file management:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ClaudePlatformFullAccess",
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CreateInference",
        "aws-external-anthropic:CountTokens",
        "aws-external-anthropic:CreateBatchInference",
        "aws-external-anthropic:GetBatchInference",
        "aws-external-anthropic:ListBatchInferences",
        "aws-external-anthropic:CancelBatchInference",
        "aws-external-anthropic:DeleteBatchInference",
        "aws-external-anthropic:CreateFile",
        "aws-external-anthropic:GetFile",
        "aws-external-anthropic:ListFiles",
        "aws-external-anthropic:DeleteFile"
      ],
      "Resource": "arn:aws:aws-external-anthropic:*:*:workspace/*"
    }
  ]
}

To restrict access to a specific workspace and region, replace the Resource with:

arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj

Alternatively, attach one of the AWS-managed policies:

Managed Policy	Scope
`AnthropicFullAccess`	All `aws-external-anthropic:*` actions
`AnthropicInferenceAccess`	Inference + read-only actions
`AnthropicReadOnlyAccess`	`Get`, `List`, `CallWithBearerToken`

Create an IAM Role

Open the IAM Console and go to Roles → Create role
Choose AWS account as the trusted entity type
Optionally set an external ID — copy it for later
Attach the permission policy created above
Name the role (e.g., portkey-claude-platform-role) and create it

Configure the Trust Relationship

Open the role, navigate to the Trust relationships tab, and click Edit trust policy. Add Portkey’s AWS account as a trusted principal:

Portkey Account ARN

arn:aws:iam::299329113195:role/portkey-app

This ARN is for the hosted Portkey app. For enterprise self-hosted deployments, refer to the Helm documentation.

Trust policy without external ID

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::299329113195:role/portkey-app"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

Trust policy with external ID

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::299329113195:role/portkey-app"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<your-external-id>"
        }
      }
    }
  ]
}

Configure the Integration

Back in Portkey, enter the following in the Claude Platform on AWS integration modal:

Field	Value
Role ARN	The ARN of the role you created (e.g., `arn:aws:iam::123456789012:role/portkey-claude-platform-role`)
External ID	The external ID you set (if any)
AWS Region	The region for your workspace (e.g., `us-west-2`)
Anthropic Workspace ID	Your workspace ID (optional, format: `wrkspc_01AbCdEf23GhIj`)

Save the integration. Portkey will assume the IAM role and sign requests with SigV4 using the aws-external-anthropic service name.

Verify the Setup

Test the integration with a simple request:

cURL

curl https://api.portkey.ai/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "x-portkey-api-key: $PORTKEY_API_KEY" \
  -d '{
    "model": "@claude-platform-aws-provider/claude-sonnet-4-6",
    "messages": [{ "role": "user", "content": "Hello" }],
    "max_tokens": 100
  }'

Troubleshooting

Error	Cause	Fix
`Outbound web identity federation is disabled`	Federation not enabled on the AWS account	Run `aws iam enable-outbound-web-identity-federation`
`Access denied` / `not authorized to perform`	Missing IAM permissions	Verify the permission policy includes the required `aws-external-anthropic:*` actions
`Invalid signature`	Incorrect region or credentials	Confirm the region matches your workspace and the role ARN is correct
`Trust policy error`	Portkey ARN not in trust policy	Add `arn:aws:iam::299329113195:role/portkey-app` as a trusted principal

Last modified on May 25, 2026

Claude Platform on AWS Files

Ecosystem

LLM Integrations

Cloud Platforms

Guardrails

Plugins

Vector Databases

Agents

AI Apps

Libraries

Tracing Providers

MCP Clients

MCP Servers

Setup Assumed Role for Claude Platform on AWS

Enterprise Self-Hosted Deployment

Enable Outbound Web Identity Federation

Select Assumed Role Authentication

Create an IAM Permission Policy

Inference-only policy

Full access policy

Create an IAM Role

Configure the Trust Relationship

Trust policy without external ID

Trust policy with external ID

Configure the Integration

Verify the Setup

Troubleshooting

Enterprise Self-Hosted Deployment

​Enable Outbound Web Identity Federation

​Select Assumed Role Authentication

​Create an IAM Permission Policy

​Inference-only policy

​Full access policy

​Create an IAM Role

​Configure the Trust Relationship

​Trust policy without external ID

​Trust policy with external ID

​Configure the Integration

​Verify the Setup

​Troubleshooting

Enable Outbound Web Identity Federation

Select Assumed Role Authentication

Create an IAM Permission Policy

Inference-only policy

Full access policy

Create an IAM Role

Configure the Trust Relationship

Trust policy without external ID

Trust policy with external ID

Configure the Integration

Verify the Setup

Troubleshooting