Deploying Anthropic Claude Apps Gateway for AWS for Enterprise Workloads

The Claude apps gateway is a self-hosted governance layer for Claude Code and Claude Desktop applications, deployed between these apps and Amazon Bedrock or Claude Platform on AWS. In the reference deployment, it runs as a container on AWS Fargate inside a VPC, with stateless tasks that store short-lived auth state in Amazon RDS for PostgreSQL. An internal Application Load Balancer terminates TLS, and Route 53 private DNS resolves the gateway via private connectivity. Authentication is delegated to an OIDC identity provider, eliminating upstream credentials on developer machines. Policies defined in YAML centrally control model access and tool permissions, scoped by identity provider groups, with server-side enforcement. Telemetry on per-user usage is forwarded over OTLP to a configurable collector. Routing supports multiple upstreams with automatic failover. Spend caps are enforced at organization, group, and user levels, with per-user overrides taking precedence and HTTP 429 returned when a cap is hit. The gateway complements AWS Budgets and Cost Explorer by providing inline enforcement before inference. Deployment patterns include centralizing all Claude usage through the gateway, running Amazon Bedrock directly in dedicated accounts, or a combination of both.