Deploying Anthropic Claude apps gateway for AWS for enterprise workloads

Enterprise AI administrators require centralized controls for Claude Code and Claude Desktop applications across their workforce. These controls include authentication, model access, cost attribution, and spend enforcement, streamlining operations and ensuring consistent governance at scale. Claude apps gateway offers a self-hosted governance layer between applications and Amazon Bedrock or Claude Platform on AWS.

This article presents a production reference deployment of Claude apps gateway, detailing the end-to-end architecture, enterprise deployment patterns, cost considerations, and implementation resources. The reference deployment topology uses the same Claude Code CLI binary, with the gateway running in server mode on AWS Fargate inside a VPC. The gateway can also be deployed on Amazon EKS or Amazon EC2 if needed.

The deployment topology includes compute and state management using AWS Fargate tasks, Amazon RDS for PostgreSQL for storage, and Amazon Route 53 for private DNS resolution. VPC endpoints and a NAT gateway ensure private traffic to supported AWS services and egress, respectively. The gateway authenticates to Amazon Bedrock using an IAM role assigned to the gateway task, while Claude Platform credentials remain in AWS Secrets Manager.

The request flow begins with sign-in, where the platform team distributes managed settings to Claude Code and Claude Desktop users. Developers authenticate through their OpenID Connect (OIDC) identity provider during the /login request. After successful authentication, a short-lived bearer token is issued, valid for one hour by default. The session refreshes silently in the background.

For every inference request, the bearer token is validated by the gateway. The gateway resolves the developer's identity and group membership, applies the matching policy, evaluates the applicable spend cap, and routes the request to Amazon Bedrock or Claude Platform on AWS. Usage metrics are emitted by the client and forwarded over OpenTelemetry Protocol (OTLP) to a collector configured by the user. The metrics are attributed to the authenticated identity used for policy evaluation.

The gateway addresses five governance needs: identity, model access, cost enforcement, spend monitoring, and operational visibility. Identity is achieved through SSO authentication using OIDC providers like Okta, Microsoft Entra ID, Auth0, Keycloak, or Amazon Cognito. Model access and cost enforcement are managed through policies applied to the bearer token.

Spend monitoring is facilitated through usage metrics sent to a collector for attribution and analysis. Operational visibility is provided by the OpenTelemetry Protocol (OTLP) integration.