Anthropic's Claude apps gateway centralizes access and cost for AWS teams
Replaces per-developer credentials with OIDC SSO and centralized policy control.
Anthropic launched the Claude apps gateway for AWS, a self-hosted control plane that gives organizations centralized governance over Claude Code and Claude Desktop. The gateway runs as a stateless container backed by PostgreSQL, handling five core responsibilities: identity via OIDC SSO (with short-lived 1-hour tokens), policy enforcement (allowed models, tool permissions, group-scoped rules), telemetry via OpenTelemetry (OTLP) to CloudWatch or Prometheus, routing to Amazon Bedrock or Claude Platform on AWS with optional multi-region failover, and spend caps with daily/weekly/monthly limits per user, group, or org.
Administrators define managed settings in a single YAML file at startup. The gateway reads no static AWS credentials; it uses the container's IAM role for Bedrock upstreams or the default credential chain for Claude Platform. Model IDs follow the Anthropic API (e.g., claude-sonnet-5, claude-opus-4-8). Onboarding and offboarding integrate with existing identity providers—add or remove a developer from the IdP, and sessions expire automatically within the token lifetime. This eliminates manual credential distribution and per-developer setup, replacing it with a single control point for cost, policy, and security.
- Connects to any OIDC identity provider for SSO; tokens expire in 1 hour by default, no long-lived secrets on developer machines.
- Centralized policy allows admins to adjust allowed models, tool permissions, and default settings scoped by IdP group.
- Spend caps can be set daily, weekly, or monthly per organization, group, or user; gateway blocks requests when exceeded.
Why It Matters
Simplifies enterprise AI governance for Claude deployments, reducing overhead and ensuring security compliance at scale.