AI 原生开放教材

外观

claude-code-docs-official官方文档·英文原文 ↗原件 ↓仓库 ↗

Deploy Claude apps gateway on AWS ​

A worked example of running Claude apps gateway on AWS: ECS Fargate or EKS, Amazon RDS for PostgreSQL, AWS Secrets Manager, and IAM-role auth to Amazon Bedrock.

This page walks through one way to run Claude apps gateway on AWS. The configuration is a working example for customer-managed infrastructure rather than a supported production deployment; use it to see how the pieces fit together before adapting it to your own environment. For the platform-agnostic requirements, see the deployment guide.

This example provisions Claude apps gateway on AWS with Amazon Bedrock as the model upstream, using either Amazon ECS on AWS Fargate or Amazon EKS for compute. Okta is the example identity provider (IdP), but any OpenID Connect (OIDC) compliant IdP works; see Identity provider setup for per-IdP details.

Bedrock isn't the only Claude upstream on AWS. The gateway also supports Claude Platform on AWS, the Anthropic-operated Claude API with AWS authentication and AWS Marketplace billing, in place of Bedrock or alongside it. Its upstream entry, credentials, and IAM permissions differ from this page's Bedrock-scoped ones; the Claude Platform on AWS upstream reference covers what changes, and the rest of this page applies unchanged.

Architecture ​

Diagram of Claude apps gateway on AWS: Claude Code clients connect over HTTPS to an internal Application Load Balancer fronting the gateway (ECS Fargate or EKS), which runs in private subnets alongside an Amazon RDS for PostgreSQL instance for session state. The gateway signs users in via OIDC against the corporate IdP, reads secrets from AWS Secrets Manager, forwards model requests to Amazon Bedrock using its IAM role, and pulls its image from Amazon ECR at deploy.

The gateway runs as a private HTTPS endpoint on your network that developers sign in to through your IdP. Their Claude Code sessions reach Claude models on Amazon Bedrock through the gateway's IAM role, so no model credentials land on developer machines. The reference configuration provisions:

  • Amazon ECS on AWS Fargate service or Amazon EKS Deployment running the gateway container
  • Amazon ECR repository for the gateway image
  • Amazon RDS for PostgreSQL instance in private subnets, not publicly accessible, for the gateway's store
  • AWS Secrets Manager secrets for the JWT signing key, the OIDC client secret, and the Postgres URL
  • IAM role with bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, and bedrock:CountTokens, attached as the ECS task role or bound via IAM Roles for Service Accounts (IRSA) on EKS
  • Internal Application Load Balancer for HTTPS

Prerequisites ​

The walkthrough creates the gateway's own resources, but it builds on network and identity infrastructure you already have. Before you start, you need: