Corporations deploying Claude Code and Claude Desktop throughout improvement groups want central management over entry, prices, and insurance policies. At scale, that is tough to handle. Every developer requires particular person credentials, configurations have to be distributed manually, and spending is tough to trace and set limits. With no central level of management, governance is left to instruments that every crew can implement independently.
Right now, we’re saying the Claude App Gateway for AWS. This can be a self-hosted management airplane that means that you can centrally management entry, prices, and insurance policies for Claude Code and Claude Desktop. This eliminates the necessity to provision separate cloud credentials for every developer, manually push settings to each laptop computer, or launch separate instruments to trace spending. You’ll be able to deploy by Amazon Bedrock to maintain your information throughout the safety perimeter of AWS, or you will get the identical gateway management with a local Claude platform expertise by the Claude Platform on AWS.
Overview of Claude App Gateway for AWS
This put up exhibits you the way to arrange and run Claude App Gateway for AWS utilizing Amazon Bedrock and Claude Platform on AWS.
How Claude app gateway works
Gateway is delivered by the identical inside Anthropic Claude code CLI Binaries already utilized by builders. Can run inside a single stateless container in your infrastructure PostgreSQL A database that shops short-term sign-in standing and charge restrict counters. Gateway and consumer are constructed collectively, so /login The stream is gateway conscious. Shoppers mechanically apply administrative settings once they check in, and insurance policies are utilized persistently throughout all requests.
Onboarding and offboarding comply with present identification workflows. To grant entry, add the developer to your identification supplier (IdP). To undo this, delete them. The session will expire throughout the configured token lifetime (1 hour by default). There aren’t any long-lived secrets and techniques on the developer’s machine.
Determine 1: AWS Claude Apps gateway structure
The gateway handles 5 most important roles:
- Id: The gateway connects to a standards-compliant OpenID Join (OIDC) identification supplier. When a developer indicators in through browser single sign-on (SSO), the gateway points a short-lived token that the CLI makes use of for all subsequent requests.
- coverage: Administrative settings are outlined as soon as on the server. The consumer receives the coverage upon sign-in, and the gateway applies the coverage on every request. Centrally modify allowed fashions, instrument permissions, and default settings for every IdP group.
- telemetry: The consumer stamps utilization metrics on each request, and the gateway relays them through OpenTelemetry Protocol (OTLP) to a collector you configure (reminiscent of Amazon CloudWatch or Amazon CloudWatch in your account or Amazon Managed Service for Prometheus) or a third-party platform. Management the place telemetry is distributed and the way lengthy it’s retained.
- routing: The gateway holds upstream credentials and routes inference requests on behalf of builders to Amazon Bedrock or Claude Platform on AWS. Optionally, failover between AWS Areas or a number of accounts can also be attainable.
- Spending restrict: Set every day, weekly, and month-to-month spending limits by group, group, or person. As soon as a developer exceeds the restrict, the gateway blocks additional requests till the interval is reset or an administrator will increase the restrict.
If you use Claude App Gateway with Amazon Bedrock, your inference requests route by Amazon Bedrock within the AWS Area you configure, sustaining the identical information processing and privateness controls as different Amazon Bedrock workloads in your account. When Claude App Gateway is used with Claude Platform on AWS, requests are dealt with by Anthropic.
composition
The gateway reads a single YAML file at startup. A minimal manufacturing configuration would seem like this:
Gateway.yaml — Full configuration for Amazon Bedrock deployment
The file incorporates six sections and secrets and techniques are saved in atmosphere variables. Bedrock upstream makes use of IAM roles for containers, so there aren’t any static credentials to handle. To route by Claude Platform on AWS as an alternative, change the upstreams block.
The mannequin ID is the Anthropic API (claude-sonnet-5, claude-opus-4-8). No Amazon Bedrock ARN or inference profile is required.
The gateway runs as a stateless container in a personal community on Amazon Elastic Container Service (Amazon ECS), Amazon Elastic Kubernetes Service (Amazon EKS), or Amazon Elastic Compute Cloud (Amazon EC2). Place it behind an inside Software Load Balancer utilizing a Transport Layer Safety (TLS) certificates from AWS Certificates Supervisor. Amazon Relational Database Service (Amazon RDS) for PostgreSQL shops short-term sign-in state. Builders entry the gateway by a personal community, and the gateway makes use of IAM activity roles to name upstream suppliers on their behalf.
developer check in
As soon as the gateway is deployed, the developer runs the next command: claude /login. The administrator pushes the managed configuration file to the developer machine by a tool administration instrument that pre-populates the gateway URL, so the developer can see the gateway display straight within the cloud app.
Claude Code’s Claude App Gateway Login Display screen
Press Enter to open your browser utilizing company SSO.
Browser SSO authentication with identification supplier
You solely have to check in as soon as to be linked. Classes are refreshed silently within the background utilizing OIDC refresh tokens, permitting builders to stay authenticated throughout reboots with out having to log in to the browser repeatedly. If a person is faraway from the IdP, their session will expire on their subsequent renewal.
Working with Claude Code
After signing in, builders use the Claude code similar to every other authentication technique. They write code, run instructions, and work together with Claude as normal. They will not know the distinction. All requests are authenticated by the gateway, routed by configured upstreams, and managed by centrally configured insurance policies.
Claude code that responds to prompts is routed by Amazon Bedrock by the gateway.
of /mannequin The picker shows solely fashions which can be allowed by your coverage. Insurance policies can transcend mannequin entry to manage instrument permissions, reminiscent of limiting file writes and internet entry. It’s also possible to implement permission guidelines that builders cannot override regionally, and push atmosphere variables and hooks to standardize workflows throughout your crew. Utilization is attributed to every developer’s identification, and spending is tracked in opposition to that restrict. If a person leaves your organization, eradicating them from the IdP will revoke their entry throughout the configured session lifetime.
conclusion
Claude App Gateway for AWS means that you can scale your Claude Code and Claude Desktop deployments throughout your group whereas managing identities, insurance policies, and prices from one place. Id flows by your present IdP, insurance policies are enforced centrally, prices are allotted per person, and there aren’t any long-lived secrets and techniques on the developer’s machine.
The gateway is self-hosted, so you possibly can deploy it in any AWS Area and route inference to Amazon Bedrock or Claude Platform on AWS, together with cross-region and cross-account setups. Select Amazon Bedrock when you want your information to remain throughout the safety perimeter of AWS, or select Claude Platform on AWS to entry Anthropic’s native platform expertise with AWS authentication and billing.
To get began, Claude code CLI and please overview Claude App Gateway documentation. Please ship suggestions to AWS re:Submit on Amazon Bedrock or to your common AWS Assist contact.
Concerning the creator
