Cloud Apps Gateway Mechanism and Setup Method

(Source: aws.amazon.com/blogs/machine-learning/introducing-claude-apps-gateway-for-aws/)

The Cloud Apps Gateway is a component that centralizes access control, cost management, and policy setting for development teams when deploying Claude Code and Claude Desktop. This gateway enables large-scale management by eliminating the need to issue individual authentication to each developer and manually distribute settings.

The core mechanism of the gateway consists of a PostgreSQL database as the backend and a stateless container that stores short-term sign-in states and request limit counters. The client and gateway are built with the same binary (Claude Code CLI), and the /login flow depends on the gateway. This allows settings to be applied automatically during sign-in, and policies are consistently enforced for each request.

The gateway has five main responsibilities:

  1. Managing the authentication process
  2. Implementing cost limits
  3. Enforcing policies
  4. Maintaining data security boundaries
  5. Providing logging and auditing

When operating on AWS, requests are processed through Amazon Bedrock or Claude Platform. In the case of Bedrock, data is processed according to the privacy controls set in the AWS region. In the case of Claude Platform, Anthropic’s native platform experience is maintained.

Configuration File Structure and Model ID Specification

(Source: aws.amazon.com/blogs/machine-learning/introducing-claude-apps-gateway-for-aws/)

The initial setup of the gateway is done using a YAML file that is loaded at startup. A minimal production environment setup example includes the following configuration:

upstreams:
  - provider: anthropicAws
    region: us-east-1
    workspace_id: wrkspc_...
    auth: {} # AWS default authentication chain (IAM role)

In this setup, when using Amazon Bedrock, the IAM role of the container is used directly, and static credentials are not managed. When using Claude Platform, routing can be changed by replacing the upstreams block.

Model IDs are specified in the same format as the Anthropic API. Examples include claude-sonnet-5 and claude-opus-4-8. Amazon Bedrock ARNs or inference profiles are not required.

Gateway Implementation Steps and Entry Point

(Source: aws.amazon.com/blogs/machine-learning/introducing-claude-apps-gateway-for-aws/)

The implementation of the gateway includes the following steps:

  1. Setting up Amazon Bedrock or Claude Platform in the AWS Console
  2. Building a PostgreSQL database to store the gateway’s state
  3. Creating a configuration file gateway.yaml and managing secrets with environment variables as needed
  4. Launching a stateless container and operating the gateway

For the actual entry point, refer to the steps described in the AWS blog’s official documentation.

Summary

  • Introducing the Claude apps gateway allows development teams to centralize access control and cost management for Claude Code and Claude Desktop usage
  • The architecture combining PostgreSQL database and stateless container achieves both security and scalability
  • Specifying model IDs and regions using YAML configuration files and collaborating with AWS resources to process requests
  • Refer to the AWS blog’s official documentation for gateway setup steps
  • In cloud environments, using IAM roles for authentication management is possible, enhancing security