Enterprises deploying Claude Code and Claude Desktop throughout growth groups want centralized management over entry, value, and coverage. At scale, that is laborious to handle: every developer wants a person credential, settings should be distributed manually, and spend is troublesome to trace or cap. With no centralized management level, governance is left to no matter tooling every staff can implement independently.
Immediately, we’re asserting the Claude apps gateway for AWS, a self-hosted management aircraft that provides organizations a single level of management over entry, value, and coverage for Claude Code and Claude Desktop. It replaces the necessity to provision a separate cloud credential per developer, push settings to each laptop computer by hand, or rise up separate tooling to trace spend. You may deploy it by Amazon Bedrock to maintain knowledge throughout the AWS safety boundary, or by Claude Platform on AWS to get the identical gateway controls with the native Claude platform expertise.
Excessive degree overview of Claude apps gateway for AWS
On this publish, we present arrange and run Claude apps gateway for AWS with Amazon Bedrock and Claude Platform on AWS.
How the Claude apps gateway works
The gateway is delivered by Anthropic inside the identical Claude Code CLI binary your builders already use. You may run it in a single stateless container in your infrastructure, backed by a PostgreSQL database that shops short-lived sign-in state and rate-limit counters. As a result of the gateway and the consumer are constructed collectively, the /login circulation is gateway-aware. The consumer applies managed settings routinely at sign-in, and coverage is enforced persistently on each request.
Onboarding and offboarding comply with your current identification workflows. To grant entry, add a developer to your identification supplier (IdP). To revoke it, take away them, and their session expires throughout the configured token lifetime (one hour by default). No long-lived secrets and techniques stay on developer machines.
Determine 1: Claude apps gateway structure for AWS
The gateway handles 5 core duties:
- Identification: The gateway connects to any standards-compliant OpenID Join (OIDC) identification supplier. After a developer indicators in by browser single sign-on (SSO), the gateway points a short-lived token that the CLI makes use of for all subsequent requests.
- Coverage: You outline managed settings as soon as on the server. Shoppers obtain coverage at sign-in, and the gateway enforces it on each request. You may modify allowed fashions, instrument permissions, and default settings centrally, scoped by IdP group.
- Telemetry: The consumer stamps a utilization metric for each request, and the gateway relays it over OpenTelemetry Protocol (OTLP) to a collector you configure, resembling Amazon CloudWatch or Amazon Managed Service for Prometheus in your personal account, or a third-party platform. You management the place telemetry goes and the way lengthy it’s retained.
- Routing: The gateway holds your upstream credential and routes inference requests to Amazon Bedrock or Claude Platform on AWS on behalf of builders, with non-obligatory failover between AWS Areas or throughout a number of accounts.
- Spend caps: Set day by day, weekly, and month-to-month spend limits per group, group, or consumer. When a developer exceeds their cap, the gateway blocks additional requests till the interval resets or an admin raises the restrict.
When Claude apps gateway is used with Amazon Bedrock, inference requests undergo Amazon Bedrock within the AWS Areas you configure, sustaining the identical knowledge dealing with and privateness controls as another Amazon Bedrock workload in your account. When Claude apps gateway is used with Claude Platform on AWS, requests are processed by Anthropic.
The configuration
The gateway reads a single YAML file at startup. Right here’s what a minimal manufacturing configuration appears like:
gateway.yaml — the complete configuration for an Amazon Bedrock deployment
The file incorporates six sections and the secrets and techniques keep in setting variables. The Bedrock upstream makes use of the container’s IAM function, so there aren’t any static credentials to handle. To route by Claude Platform on AWS as an alternative, exchange the upstreams block:
Mannequin IDs are the identical because the Anthropic API (claude-sonnet-5, claude-opus-4-8). No Amazon Bedrock ARNs or inference profiles wanted.
The gateway runs as a stateless container in your non-public community on Amazon Elastic Container Service (Amazon ECS), Amazon Elastic Kubernetes Service (Amazon EKS), or Amazon Elastic Compute Cloud (Amazon EC2). You place it behind an inner Software Load Balancer with a Transport Layer Safety (TLS) certificates from AWS Certificates Supervisor. Amazon Relational Database Service (Amazon RDS) for PostgreSQL shops short-lived sign-in state. Builders attain the gateway by your non-public community, and the gateway makes use of an IAM activity function to name the upstream supplier on their behalf.
Developer sign-in
As soon as the gateway is deployed, builders run claude /login. Directors push a managed settings file to developer machines by way of their gadget administration instrument that pre-fills the gateway URL, so builders see the Claude apps gateway display screen immediately.
The Claude apps gateway login display screen in Claude Code
They press Enter, and a browser opens together with your company SSO.
Browser SSO authentication by your identification supplier
One sign-in, and so they’re linked. The session refreshes silently within the background utilizing OIDC refresh tokens, so builders keep authenticated throughout restarts with out repeated browser logins. If a consumer is faraway from the IdP, their session expires on the subsequent refresh.
Working with Claude Code
After sign-in, builders use Claude Code precisely as they’d with another authentication methodology. They write code, run instructions, and work together with Claude usually. The distinction is invisible to them: each request is authenticated by the gateway, routed by your configured upstream, and ruled by the insurance policies you set centrally.
Claude Code responding to a immediate, routed by Amazon Bedrock by way of the gateway
The /mannequin picker exhibits solely the fashions your coverage permits. Past mannequin entry, insurance policies can management instrument permissions, resembling proscribing file writes or internet entry. They will additionally implement permission guidelines that builders can’t override domestically, and push setting variables or hooks to standardize workflows throughout groups. Utilization is attributed to every developer’s identification, and spend is tracked towards their cap. In the event that they go away the corporate, eradicating them from the IdP revokes entry throughout the configured session lifetime.
Conclusion
With the Claude apps gateway for AWS, you may broaden Claude Code and Claude Desktop adoption throughout your group whereas managing identification, coverage, and value from one place. Identification flows by your current IdP, coverage is enforced centrally, and value is attributed per consumer, with no long-lived secrets and techniques on developer machines.
As a result of the gateway is self-hosted, you may deploy it in any AWS Area and route inference to Amazon Bedrock or Claude Platform on AWS, together with cross-Area and cross-account setups. Select Amazon Bedrock when knowledge should keep throughout the AWS safety boundary, or Claude Platform on AWS for entry to Anthropic’s native platform expertise with AWS authentication and billing.
To get began, obtain the Claude Code CLI and evaluate the Claude apps gateway documentation. Ship suggestions to AWS re:Submit for Amazon Bedrock or by your normal AWS Help contacts.
Concerning the authors
