AI
AWS Launches Claude Apps Gateway to Centralize Policy and Spending Controls for Developers
AWS joins Anthropic and Google Cloud in shipping a self-hosted control plane that consolidates identity, compliance, cost attribution, and usage limits for Claude-based development tools.
InfoQ
AWS has rolled out the Claude apps gateway for AWS, a deployable control plane designed to give enterprises unified oversight of Claude Code and Claude Desktop usage across their teams. Rather than managing credentials and policies on a per-developer basis, organizations can now run a single gateway that acts as a central coordinator for identity verification, spend limits, and access rules.
What the Gateway Does#
The gateway sits between developers and inference endpoints, handling five critical functions:
- Identity & Access: Acts as an OpenID Connect relying party, allowing developers to sign in once via browser-based single sign-on. Once authenticated, they receive short-lived tokens that automatically expire when removed from the identity provider.
- Policy Enforcement: Administrators configure rules in a single YAML file, scoped by user group, to control which models can be used, what tools are available, and which settings are locked down and cannot be overridden locally.
- Usage Tracking: Every request gets stamped with telemetry data that the gateway forwards via OpenTelemetry Protocol to monitoring systems like CloudWatch or Prometheus.
- Request Routing: The gateway holds upstream credentials and forwards API calls on behalf of developers, with optional failover across AWS regions or accounts.
- Spend Controls: Organizations can impose daily, weekly, or monthly spending caps per team, group, or individual user, with requests automatically blocked once a limit is reached.
Deployment and Architecture#
The gateway runs as a stateless container that can be deployed on Amazon ECS, EKS, or EC2 behind an Application Load Balancer. It uses Amazon RDS for PostgreSQL to store temporary login state and rate-limit counters. When integrated with Amazon Bedrock, the container's IAM task role eliminates the need for static credentials, and model identifiers work transparently without requiring Bedrock-specific ARNs.
According to Anthropic's documentation, the gateway can route requests to multiple upstreams: Amazon Bedrock, Claude Platform on AWS, Google Cloud's Agent Platform, Microsoft Foundry, and the Anthropic API itself, with automatic failover between them.
