Anthropic and AWS Launch Enterprise Claude Apps Gateway with SSO, Spend Caps, and Model Policies
Summary
- • Claude apps gateway is a self-hosted governance layer for Claude Code and Claude Desktop deployments on AWS.
- • Five enterprise capabilities: SSO via OIDC, per-group model access policies, per-user telemetry, multi-region routing with failover, and spend caps.
- • Deploys as a stateless container on AWS Fargate; no per-seat license fee; developer data stays within your AWS account.
- • Spend caps operate at org, group, and user levels with automatic period resets and per-user HTTP 429 enforcement.
Details
Claude apps gateway provides self-hosted enterprise governance for Claude on AWS
A self-hosted governance layer between Claude Code/Claude Desktop and Amazon Bedrock or Claude Platform on AWS, shipped inside the Claude Code CLI binary.
Single sign-on delegated to existing OIDC identity providers
Gateway delegates authentication to Okta, Microsoft Entra ID, Auth0, Keycloak, or Cognito; issues 1-hour bearer tokens with silent background refresh.
YAML policies enforce per-group model access server-side
Model restrictions (e.g., contractors see Haiku only) are enforced server-side and cannot be bypassed by clients even with modified software.
Per-user spend caps with automatic period resets and HTTP 429 enforcement
Caps set at org, group, and user levels; gateway returns HTTP 429 when a developer reaches their limit; counters reset daily, weekly, or monthly.
Runs as a stateless container on AWS Fargate backed by Amazon RDS
Deploys on AWS Fargate with Amazon RDS for PostgreSQL storing session state and spend counters; EKS and EC2 are also supported.
Per-developer telemetry relayed via OpenTelemetry to observability backends
Usage metrics attributed to each developer's identity are forwarded via OTLP to Datadog, Splunk, Grafana, or Amazon CloudWatch via ADOT.
No upstream credentials are ever distributed to developer machines
All upstream credentials — Bedrock IAM role, API keys — remain in AWS Secrets Manager; developers only hold short-lived bearer tokens.
Product Launch: new capability | Tech Info: implementation detail | Infrastructure: deployment | Security Alert: security property
What This Means
The Claude apps gateway removes one of the biggest friction points blocking large-scale enterprise adoption of Claude Code and Claude Desktop: the lack of centralized access control, cost governance, and audit visibility. By building on standard AWS services and OIDC identity providers organizations already use, enterprises can enforce fine-grained access and budget controls without custom tooling. This reference architecture — with no per-seat fee and no data leaving the customer's AWS account — is likely to significantly accelerate enterprise-scale deployments of Claude-based AI development workflows.