Implementing Multi-Environment Access for Claude Platform on AWS

Overview of Multi-Environment Access

The article describes how to implement multi-environment access for the Claude Platform on AWS (CPonAWS). This setup addresses the need for CPonAWS inference from various environments, including AWS production workloads, developer laptops for local iteration, and external services or on-premises CI/CD pipelines. Each environment has distinct authentication requirements, but the goal is to share a single subscription with workspace-level isolation.

Architectural Approach

The proposed architecture involves a dedicated AI Services account within an organization's AWS setup. This account holds the CPonAWS subscription, workspaces, API keys, and cross-account roles. Workload accounts do not directly interact with the subscription; instead, they assume roles within the AI Services account to perform inference calls. This results in a three-account structure: a payer (management) account, an AI Services account, and one or more workload accounts.

Authentication Patterns

The implementation covers three specific access patterns. For AWS workload accounts, cross-account SigV4 is used, where a pod in a workload account assumes a role in the AI Services account to make SigV4-signed inference calls without storing API keys. The setup also includes generating workspace-scoped API keys for developers and configuring OIDC federation for external environments.