What is AWS Claude Apps Gateway for Enterprises?
The self-hosted control plane lets IT teams cap spending per user and revoke access instantly through existing identity systems.
Amazon Web Services (AWS) announced the Claude apps gateway for AWS on July 8, 2026, a self-hosted control plane for managing Claude Code and Claude Desktop across organizations. The cloud computing giant said the tool gives IT administrators a single point of control over access, cost, and policy for developers using Anthropic's coding tools.
According to the company, the gateway removes the need to provision separate cloud credentials for each developer, distribute settings manually, or build custom tooling to track spend. Organizations can deploy it through Amazon Bedrock to keep data inside the AWS security boundary, or through Claude Platform on AWS for the native Claude platform experience, the company said.
How the system works
The gateway is built into the same Claude Code command-line interface (CLI) binary developers already use, AWS said. It runs as a stateless container backed by a PostgreSQL database that stores short-lived sign-in state and rate-limit counters.
Access follows an organization's existing identity provider (IdP), the company said. Administrators grant access by adding a developer to the IdP and revoke it by removing them, after which sessions expire within a configured token lifetime that defaults to one hour.
The company said the gateway manages five functions: identity through OpenID Connect (OIDC) sign-in, centrally defined policy for models and tool permissions, usage telemetry relayed through OpenTelemetry Protocol (OTLP), routing of inference requests to Amazon Bedrock or Claude Platform on AWS, and configurable spend caps by organization, group, or user.
The gateway runs on Amazon Elastic Container Service, Amazon Elastic Kubernetes Service, or Amazon Elastic Compute Cloud, according to AWS. It sits behind an internal Application Load Balancer secured with a certificate from AWS Certificate Manager, while Amazon Relational Database Service for PostgreSQL handles sign-in state.
Once deployed, developers sign in once through corporate single sign-on (SSO), and sessions refresh automatically using OIDC refresh tokens, the company said. Administrators can restrict which models appear in the tool's model picker, control file-write and web-access permissions, and push standardized environment variables across teams.
AWS said the gateway is available now for organizations to deploy in any AWS Region, with routing to Amazon Bedrock or Claude Platform on AWS, including cross-Region and cross-account configurations. The company pointed customers to the Claude Code CLI download and the Claude apps gateway documentation to begin setup, and said feedback can be submitted through AWS re:Post or standard AWS Support channels.
>
Key Takeaways
- AWS launches Claude apps gateway, enabling centralized control over access and spending for developers.
- Implement self-hosted control plane to eliminate separate cloud credentials and manual setting distribution.
- Utilize existing identity systems for instant access revocation and session management.
- Manage policies, usage telemetry, and spending caps through a single interface for enhanced efficiency.
- Deploy via Amazon Bedrock or Claude Platform to maintain data security within AWS boundaries.