- AWS Claude Platform (this page): Anthropic-operated, uses the Claude API surface (
/v1/messages), model IDs likeclaude-sonnet-4-6, base URLaws-external-anthropic.{region}.api.aws, and requires a workspace ID. - AWS Bedrock: AWS-operated, uses Bedrock Converse / InvokeModel, model IDs like
anthropic.claude-sonnet-4-5-20250929-v1:0.
Prerequisites
Before adding the provider account, complete this one-time AWS setup. See Anthropic’s Claude Platform on AWS docs for the full flow.Subscribe to Claude Platform on AWS
Enable outbound web identity federation
sts:GetWebIdentityToken server-side to mint a token it forwards to Anthropic. This STS capability is disabled by default on every AWS account. Enable it once per account:already enabled, you’re good to go.Create a workspace and note its ID
wrkspc_<alphanumeric> (for example, wrkspc_01AbCdEf23GhIj). You’ll need it when adding the account.Adding Models
This section explains the steps to add AWS Claude Platform models and configure the required access controls.Navigate to AWS Claude Platform Models in AI Gateway
AI Gateway > Models and select AWS Claude Platform.
Add Account Name and Collaborators
@providername/@modelname. Add collaborators to your account — you can decide which users/teams have access to the models (User Role) and who can add/edit/remove models (Manager Role). Read more about access control here.Add Workspace ID, Region, and Authentication
- Workspace ID — the
wrkspc_...ID from the prerequisites. It is sent on every request as theanthropic-workspace-idheader. - Region — the default AWS region for requests. This must match the region your workspace is bound to, since workspaces are region-scoped.
- Authentication — how the gateway authenticates to Claude Platform on AWS. Three methods are supported: AWS Access Key / Secret, Assumed Role (both use SigV4), and API Key.

Get AWS Authentication Details (IAM policies + credentials)
Get AWS Authentication Details (IAM policies + credentials)
aws-external-anthropic (actions look like aws-external-anthropic:CreateInference). You attach a policy to the IAM principal (user or role) the gateway uses.You can choose one of two approaches for the IAM policy.Option A — Quickstart (full access)
The fastest path is to attach the AWS-managedAnthropicFullAccess policy to your principal. It grants every Claude Platform on AWS action across all workspaces and covers both SigV4 and API key authentication, so you don’t have to reason about individual actions.AWS ships five managed policies for common access patterns:| Managed policy | Use it for |
|---|---|
AnthropicFullAccess | Everything (recommended quickstart). Covers all auth modes, inference, files, and batches. |
AnthropicReadOnlyAccess | Read-only visibility (no inference). |
AnthropicInferenceAccess | Narrowest policy sufficient for inference. Does not grant file create/delete, so it will not cover the Files API on its own. |
AnthropicLimitedAccess | A constrained subset for limited workloads. |
AnthropicSelfHostedEnvironmentAccess | Self-hosted Managed Agents sandboxes. |
Option B — Least-privilege (production hardening)
For production, attach a scoped policy granting only the actions the gateway uses, restricted to your workspace ARN. The workspace ARN follows this format:| Operation | IAM action | Resource |
|---|---|---|
| Chat / Messages | CreateInference | workspace ARN |
| Count tokens | CountTokens | workspace ARN |
| List / get models | ListModels, GetModel | workspace ARN |
| Files (upload / list / get / content / delete) | CreateFile, ListFiles, GetFile, DeleteFile | workspace ARN |
| Get workspace | GetWorkspace | workspace ARN |
| List workspaces | ListWorkspaces | * (account-scoped) |
GetFile covers both file metadata and file /content. Account-scoped actions like ListWorkspaces must use "Resource": "*"; specifying a workspace ARN on them has no effect.CreateBatchInference, ListBatchInferences, GetBatchInference, CancelBatchInference, DeleteBatchInference) on the workspace ARN. GetBatchInference covers both batch metadata and results.Once you have a policy, attach it to a principal and configure credentials in TrueFoundry using one of the methods below.Using AWS Access Key and Secret (SigV4)
- Create an IAM user (or choose an existing one) following these steps.
- Attach the IAM policy (Option A or B) to this user.
- Create an access key for this user as per this doc.
- Use this access key and secret while adding the provider account.
- Create an IAM role in your AWS account and attach the IAM policy (Option A or B) to it.
- Configure the trust policy so the gateway role can assume it. Use the appropriate role ARN based on your deployment:
- Gateway role ARN:
arn:aws:iam::416964291864:role/tfy-ctl-production-ai-gateway-deps
- Your gateway role ARN will look like:
arn:aws:iam::<your-aws-account-id>:role/<account-prefix>-truefoundry-deps
- In the AWS Console, go to Claude Platform on AWS → API keys.
- Choose Generate a key and copy the key value.
- Grant the
aws-external-anthropic:CallWithBearerTokenIAM action to the principal the key is generated under (see the warning under Option B). - Use this API key while adding the provider account.
Add Models
Select All to select all the models.+ Add Model at the end of the list and entering the model ID.anthropic. prefixes. Commonly available models:| Model | Model ID |
|---|---|
| Claude Opus 4.8 | claude-opus-4-8 |
| Claude Opus 4.6 | claude-opus-4-6 |
| Claude Sonnet 4.6 | claude-sonnet-4-6 |
| Claude Opus 4.5 | claude-opus-4-5 |
| Claude Sonnet 4.5 | claude-sonnet-4-5 |
| Claude Haiku 4.5 | claude-haiku-4-5 |
| Claude Fable 5 | claude-fable-5 |
Inference
After adding the models, you can perform inference using an OpenAI-compatible or Anthropic-compatible API via the Playground or by integrating with your own application.
Supported APIs
Once your AWS Claude Platform provider account is configured, the following API surfaces are available through the gateway. The wire format is identical to the direct Anthropic API, so every Anthropic feature works unchanged. The table below summarizes each endpoint alongside platform feature support (tracing, cost tracking).- ✅ Supported by Provider and Truefoundry
- Supported by Provider, but not by Truefoundry
- Provider does not support this feature
| API | Endpoint | Tracing | Cost Tracking |
|---|---|---|---|
| Chat Completions | /chat/completions | ✅ | ✅ |
| Messages API | /messages | ✅ | ✅ |
| Files API | /files | ✅ | ✅ |
Chat Completions
Chat Completions
Streaming
Streaming
stream=True to start streaming responses and iterate over delta chunks. You may defensively check that chunk.choices is non-empty and delta.content is not None.Function calling / tools
Function calling / tools
tool_calls back as a tool role message, then request the final response. Use tool_choice to force the model to call a specific tool when you need deterministic behaviour.Vision (multimodal images)
Vision (multimodal images)
image_url content part. The URL can be a public HTTP URL or an inline data:image/...;base64,... URI.PDF document input
PDF document input
file content type with base64 encoding.Structured outputs (JSON schema)
Structured outputs (JSON schema)
response_format={"type": "json_schema", ...} to force the model to return data matching a JSON schema. Claude 4.5+ models use native JSON schema support; older models use a tool-conversion fallback.Prompt caching
Prompt caching
cache_control on content blocks you want cached (unlike OpenAI’s automatic caching). Cached tokens appear as cache_creation_input_tokens (first call) and cache_read_input_tokens (subsequent calls) in the usage response.Extended thinking (reasoning)
Extended thinking (reasoning)
reasoning_effort parameter — the gateway translates it into Anthropic’s native thinking parameter format.reasoning_effort to a thinking.budget_tokens ratio of the request’s max_tokens: none = 0%, low = 30%, medium = 60%, high = 90%.reasoning_content (plain text) and thinking_blocks (structured blocks with cryptographic signatures required for multi-turn reasoning continuity).Messages API
Messages API
/messages) is also exposed through the gateway, letting you use the official anthropic Python SDK directly.
You get the same gateway features — routing, logging, rate-limiting, budget management — as with the OpenAI-compatible interface.
Full docs: Messages API, Native SDK Support.api_key=TFY_API_KEY— SDK sends thex-api-keyheaderauth_token=TFY_API_KEY— SDK sends theAuthorization: Bearerheader
api_key is the idiomatic Anthropic SDK pattern — use it unless you have a reason to send a Bearer token.Streaming
Streaming
.messages.stream() and iterate over text_stream for incremental output.Files API
Files API
files.content) only works for files created by skills or the code execution tool. User-uploaded files cannot be downloaded back — you can only list metadata and delete them.FAQ
Requests fail with 'Outbound web identity federation is disabled for your account'
Requests fail with 'Outbound web identity federation is disabled for your account'
aws iam enable-outbound-web-identity-federation once for your AWS account (see Prerequisites). This step is specific to Claude Platform on AWS and is not required for Bedrock.Do I need CallWithBearerToken?
Do I need CallWithBearerToken?
aws-external-anthropic:CallWithBearerToken is a route-less, authentication-layer action granted on "Resource": "*". See Option B for the exact statement.My region doesn't match my workspace
My region doesn't match my workspace
us-west-2 is only reachable through the us-west-2 endpoint. The account-level region you set in TrueFoundry must match the workspace’s region.How to override the default cost of models?
How to override the default cost of models?
Private Cost Metric option.
