aws-solutions-library-samples/guidance-for-claude-code-with-amazon-bedrock

This Guidance demonstrates how organizations can implement secure enterprise authentication for Amazon Bedrock using industry-standard protocols and AWS services

What it solves

This project provides a reference implementation for deploying Claude Code (CLI) and Claude Cowork (Desktop) within an enterprise environment using Amazon Bedrock. It addresses the challenges of managing secure access, monitoring usage, and controlling costs across a large organization without requiring individual API keys for every user.

How it works

The solution uses a modular architecture that integrates with enterprise identity providers (OIDC or AWS IAM Identity Center) to provide federated access to Bedrock.

  • Authentication: A credential-process binary runs on the user's machine, exchanging OIDC tokens for temporary AWS credentials via AWS STS.
  • Usage Monitoring: An otel-helper binary or a bootstrap server attaches user identity to OpenTelemetry (OTLP) telemetry, which is then routed to CloudWatch dashboards for per-user cost attribution.
  • Quota Enforcement: A Lambda-based API checks current usage against policies stored in DynamoDB before issuing credentials, allowing admins to block access if token limits are exceeded.
  • Deployment: The ccwb tool automates the deployment of authentication stacks, monitoring infrastructure, and the creation of platform-specific installation packages for Windows, macOS, and Linux.

Who it’s for

Enterprise IT administrators and DevOps engineers who need to deploy Claude's developer tools to their organization while maintaining corporate compliance, SSO integration, and strict budget controls.

Highlights

  • Enterprise SSO: Supports Okta, Entra ID, Auth0, Google, Cognito, and AWS IAM Identity Center.
  • Cros-Surface Support: A single infrastructure setup powers both the Claude Code CLI and Claude Desktop.
  • Granular Cost Control: Per-user and per-team token limits with configurable warnings and block modes.
  • AWS-Native: Leverages Amazon Bedrock, CloudWatch, and S3/Athena for data residency and historical analytics.

Related

  • Project
    antibrow/antibrow

    An antidetect browser SDK that uses engine-level fingerprint spoofing to allow AI agents and automation scripts to bypass bot detection using the standard Playwright API.

  • Project
    MiaAI-Lab/Qwen3.8-27B-16gb-NVIDIA-GPUs-one-click-install

    A one-click installation kit that automates the deployment of Qwen3.8-27B on consumer NVIDIA GPUs, automatically selecting the best quantization and context size for the available VRAM.

  • Project
    deepmodeling/dpgen

    A concurrent learning platform that automates the generation of deep learning-based potential energy models and force fields for molecular simulations on HPC clusters.

  • Project
    econ-ark/HARK

    A Python toolkit for the structural modeling of economic choices of optimizing and non-optimizing heterogeneous agents, simplifying the creation of complex macroeconomic and microeconomic simulations.