AWS guide: Claude Platform on AWS in 3 accounts

The post is positioned as the implementation follow-up to two earlier AWS posts, one on architecture patterns and one on authentication paths. It assumes those decisions are already made, and takes over from there with the CLI commands, console steps, and code snippets needed to stand the thing up.

The structure it lands on is a three-account split: a payer account for billing and governance, an AI Services linked account that owns the subscription, workspaces, API keys, and cross-account roles, and workload accounts that never touch the subscription directly. Each of the three access paths is aimed at a different consumer of the same subscription. AWS workloads assume a role scoped to the production workspace. Developer laptops go through a key that is by default attached to a policy granting every workspace, so the post walks through detaching that managed policy and replacing it with an inline policy naming only the development workspace. External environments authenticate through OIDC and receive a token that, for short-term keys, only works against the Regional endpoint where it was generated.

Several of the guide's sharpest warnings are about details that quietly break isolation. CallWithBearerToken has to be granted on Resource "*" or token generation fails outright, while CreateInference stays scoped to a workspace ARN so the token inherits that restriction. The stakes therefore sit less in whether the setup works at all than in whether teams follow the scoping steps exactly — the guide itself supplies the test that would reveal a mistake, and the cleanup section suggests it expects readers who are still evaluating rather than committed.