Claude Platform on AWS provider module
The Claude Platform on AWS provider is available in the @ai-sdk/anthropic-aws module.
AI SDK · Providers · all subjects
anthropic-aws/setup
33 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Claude Platform on AWS prerequisites
Before using the Claude Platform on AWS provider, your AWS account must be subscribed to Claude Platform on AWS through the AWS Marketplace, and outbound web identity federation must be enabled on the account by running 'aws iam enable-outbound-web-identity-federation'. Without this setup, every request returns 'Outbound web identity federation is disabled for your account'. You also need your workspace ID, which can be found in the Claude Console under Workspaces (accessed from the AWS Console via the Claude Platform on AWS service page).
Claude Platform on AWS authentication methods
The provider supports two authentication methods: AWS SigV4 (recommended for production, which integrates with existing AWS IAM policies, roles, and auditing using credentials from environment variables, shared credentials file, web identity, ECS container credentials, or EC2 instance metadata) and API key authentication (for simpler integration paths like local development, scripts, or migration from the first-party Claude API, using an API key provisioned by an Anthropic account representative).
Claude Platform on AWS SigV4 environment variables
For SigV4 authentication, configure these environment variables: AWS_REGION (required), ANTHROPIC_AWS_WORKSPACE_ID (required), AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN (only for temporary credentials from SSO, STS, or assumed role).
Claude Platform on AWS default provider usage
To use the default provider instance with SigV4 authentication configured via environment variables, import it with: import { anthropicAws } from '@ai-sdk/anthropic-aws';
Claude Platform on AWS explicit instantiation with SigV4
To explicitly instantiate the provider with SigV4, use: import { createAnthropicAws } from '@ai-sdk/anthropic-aws'; const anthropicAws = createAnthropicAws({ region: 'us-west-2', workspaceId: 'wrkspc_…', });
Claude Platform on AWS dynamic credentials
For dynamic credentials (e.g., assuming a role at request time), use: const anthropicAws = createAnthropicAws({ region: 'us-west-2', workspaceId: 'wrkspc_…', credentialProvider: async () => fetchCredentialsFromSTS(), });
Claude Platform on AWS API key environment variable
For API key authentication, configure the ANTHROPIC_AWS_API_KEY environment variable. When apiKey is set, it takes precedence over any SigV4 credentials in the environment.
Claude Platform on AWS API key instantiation
To instantiate the provider with API key authentication, use: import { createAnthropicAws } from '@ai-sdk/anthropic-aws'; const anthropicAws = createAnthropicAws({ region: 'us-west-2', workspaceId: 'wrkspc_…', apiKey: 'sk-…', });
Claude Platform on AWS provider settings
Provider settings for Claude Platform on AWS: region (AWS region for the endpoint, reads from AWS_REGION if omitted, required with no fallback default), workspaceId (Anthropic workspace ID sent on every request via anthropic-workspace-id header, reads from ANTHROPIC_AWS_WORKSPACE_ID if omitted), apiKey (API key for x-api-key authentication, when provided used instead of SigV4, reads from ANTHROPIC_AWS_API_KEY if omitted), accessKeyId (AWS access key ID for SigV4, reads from AWS_ACCESS_KEY_ID), secretAccessKey (AWS secret access key for SigV4, reads from AWS_SECRET_ACCESS_KEY), sessionToken (AWS session token for SigV4 temporary credentials only, reads from AWS_SESSION_TOKEN), baseURL (base URL override, defaults to https://aws-external-anthropic.{region}.api.aws/v1), headers (custom headers to include on every request), fetch (custom fetch implementation for testing or middleware), credentialProvider (function returning dynamic AWS credentials, overrides accessKeyId, secretAccessKey, and sessionToken).
Claude Platform on AWS IAM permissions
Three AWS managed policies are available for Claude Platform on AWS: AnthropicFullAccess (grants aws-external-anthropic:* on all resources), AnthropicInferenceAccess (grants read actions plus CreateInference, CreateBatchInference, CancelBatchInference, DeleteBatchInference, and CountTokens on all workspaces, this is the minimum for calling models), and AnthropicReadOnlyAccess (grants Get*, List*, and CallWithBearerToken on all workspaces, insufficient for inference).
Claude Platform on AWS vs Amazon Bedrock
Claude Platform on AWS differs from Amazon Bedrock in two important ways: Claude Platform on AWS uses Anthropic's Messages API directly (not Bedrock's Converse/InvokeModel), and new features are available the same day they launch on the first-party Claude API (no AWS integration delay).
Amazon Bedrock provider installation
The Amazon Bedrock provider is available in the `@ai-sdk/amazon-bedrock` module. Install it using npm or your package manager.
Bedrock model access requires IAM request
Access to Amazon Bedrock foundation models is not granted by default. An IAM user with sufficient permissions must request access to specific foundation models through the AWS console. Once access is provided to a model, it is available for all users in the account.
Bedrock authentication methods with fallback
The Amazon Bedrock provider supports two authentication methods with automatic fallback: API key authentication (recommended) and AWS SigV4 authentication using IAM credentials or the AWS SDK credentials chain. When an API key is supplied, it takes precedence over SigV4 credentials.
Bedrock API key authentication setup
Generate a Bedrock API key from the AWS console. Set it as the `AWS_BEARER_TOKEN_BEDROCK` environment variable or pass it directly to `createAmazonBedrock` using the `apiKey` option. When `apiKey` is omitted, the provider falls back to the environment variable, then to SigV4 authentication.
Bedrock IAM access key configuration
To use IAM authentication, create an AWS access key and secret key through the IAM dashboard. Attach the `AmazonBedrockFullAccess` policy to the IAM user. Configure the credentials in a `.env` file with the environment variables `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_REGION`.
Bedrock AWS SDK credentials chain setup
The AI SDK supports AWS SDK credential chains by not specifying `accessKeyId`, `secretAccessKey`, and `sessionToken` properties in provider settings. Instead, pass a `credentialProvider` property. Use the `@aws-sdk/credential-providers` package and import `fromNodeProviderChain()` to enable automatic credential detection from instance profiles, instance roles, ECS roles, and EKS Service Accounts.
Bedrock provider instance creation example
Import `createAmazonBedrock` from `@ai-sdk/amazon-bedrock` and create a provider instance with configuration. Example: `createAmazonBedrock({ region: 'us-east-1', accessKeyId: 'xxxxxxxxx', secretAccessKey: 'xxxxxxxxx', sessionToken: 'xxxxxxxxx' })`.
Bedrock default provider instance import
Import the default provider instance `amazonBedrock` from `@ai-sdk/amazon-bedrock`. This instance is preconfigured and ready to use.
Bedrock Anthropic provider instance import
Import the default Bedrock Anthropic provider instance `bedrockAnthropic` from `@ai-sdk/amazon-bedrock/anthropic`. This provider offers support for Anthropic's Claude models through Amazon Bedrock's native InvokeModel API with full feature parity with the Anthropic API.
Bedrock Anthropic provider creation
Import `createBedrockAnthropic` from `@ai-sdk/amazon-bedrock/anthropic` and create a provider instance with settings: `region` (optional), `accessKeyId` (optional), `secretAccessKey` (optional), `sessionToken` (optional).
Bedrock Anthropic provider settings
Bedrock Anthropic provider configuration options: `region` (AWS region, defaults to AWS_REGION env var), `accessKeyId` (defaults to AWS_ACCESS_KEY_ID), `secretAccessKey` (defaults to AWS_SECRET_ACCESS_KEY), `sessionToken` (for temporary credentials), `apiKey` (Bearer token, defaults to AWS_BEARER_TOKEN_BEDROCK), `baseURL` (for custom endpoints or proxy), `headers` (Resolvable<Record<string, string | undefined>>), `fetch` (custom fetch implementation), `credentialProvider` (() => PromiseLike<BedrockCredentials>).
Bedrock Mantle API endpoint format
The Bedrock Mantle provider endpoint is https://bedrock-mantle.{region}.api.aws/v1. This endpoint supports the Chat Completions API and the Responses API.
bedrockMantle default provider import
Import the default provider instance bedrockMantle from '@ai-sdk/amazon-bedrock/mantle'. No parameters are required to use the default instance.
createBedrockMantle custom provider creation
Import createBedrockMantle from '@ai-sdk/amazon-bedrock/mantle' and call it with a configuration object to create a customized provider instance.
Bedrock Mantle provider settings reference
The createBedrockMantle function accepts the following optional settings: region (string, defaults to AWS_REGION env var), accessKeyId (string, defaults to AWS_ACCESS_KEY_ID env var), secretAccessKey (string, defaults to AWS_SECRET_ACCESS_KEY env var), sessionToken (string, optional, defaults to AWS_SESSION_TOKEN env var), apiKey (string, for Bearer token auth instead of SigV4, defaults to AWS_BEARER_TOKEN_BEDROCK env var), baseURL (string, defaults to https://bedrock-mantle.{region}.api.aws/v1), headers (Record<string, string | undefined>), fetch (custom fetch implementation), and credentialProvider (function returning PromiseLike<BedrockCredentials> for dynamic AWS credentials).
Bedrock Mantle generateText example
Example using generateText with Bedrock Mantle: ```ts import { bedrockMantle } from '@ai-sdk/amazon-bedrock/mantle'; import { generateText } from 'ai'; const { text } = await generateText({ model: bedrockMantle('openai.gpt-oss-120b'), prompt: 'Invent a new holiday and describe its traditions.', }); ```
Bedrock Mantle streamText example
Example using streamText with Bedrock Mantle: ```ts import { bedrockMantle } from '@ai-sdk/amazon-bedrock/mantle'; import { streamText } from 'ai'; const result = streamText({ model: bedrockMantle('openai.gpt-oss-120b'), prompt: 'Invent a new holiday and describe its traditions.', }); for await (const textPart of result.textStream) { process.stdout.write(textPart); } ```
Bedrock Mantle providerOptions namespace
Provider options for Bedrock Mantle are passed under the 'openai' namespace in the providerOptions object, since the Mantle API is OpenAI-compatible.
Bedrock provider 2.x migration - bedrockOptions removed
In @ai-sdk/amazon-bedrock version 2.x, the bedrockOptions provider setting was removed. Instead, use the individual settings: region, accessKeyId, secretAccessKey, and sessionToken directly.
Bedrock provider 2.x dependency removal
Version 2.x of @ai-sdk/amazon-bedrock removed the dependency on @aws-sdk/client-bedrock-runtime package.
Anthropic API key environment variable
The environment variable ANTHROPIC_API_KEY must be set to authenticate with Anthropic's API.