One subscription, three ways in: AWS's access pattern for Claude

A team wants Claude Platform on AWS inference reachable from a production account, a developer's laptop, and pipelines running outside AWS altogether. AWS's published walkthrough handles that by keeping a single subscription while giving each environment its own route in. The subscription sits in a dedicated AI Services account inside the organization. AWS workloads reach it through cross-account SigV4; developers use workspace-scoped API keys; external environments are wired up with OIDC federation. The separation that does the work is at the workspace level — production and development traffic share the subscription without sharing a workspace.