Supercharge regulated workloads with Claude Code and Amazon Bedrock

來源原標題

Supercharge regulated workloads with Claude Code and Amazon Bedrock

作者

Bradley Wyman

原始標籤

Amazon Bedrock · Intermediate (200) · Technical How-to

原始連結

https://aws.amazon.com/blogs/machine-learning/supercharge-regulated-workloads-with-claude-code-and-amazon-bedrock/

摘要原文

Please note that the following post is intended for informational purposes only. The approach detailed below may not be suitable for all organizations or compliance programs. It is important to evaluate this potential solution against the compliance requirements of your organization and any applicable regulatory obligations you may have. The availability of Anthropic Claude Opus 5.5 and Claude Sonnet 5.5 in the AWS GovCloud (US) Regions introduces an on-ramp for AI-assisted development for workloads with regulatory or compliance requirements, including International Traffic in Arms Regulations (ITAR). Claude Sonnet 5 holds FedRAMP Class D (formerly High) certification and DoD Impact Level 4 and 5 (IL4/IL5) authorization, and Claude Opus 5.5 and Claude Sonnet 5.5 hold FedRAMP Class D certification on Amazon Bedrock ( verify current model certification status ). In this post, we explore how to use these models on Amazon Bedrock in AWS GovCloud (US) with Claude Code , Anthropic’s agentic coding tool. With this solution, you can run AI-assisted workflows that speed up everyday development tasks while maintaining compliance alignment. AWS GovCloud (US) Regions are designed specifically for US customers with elevated compliance needs . You can deploy generative AI workloads to sensitive environments while maintaining compliance controls. Amazon Bedrock is built with security-focused features, including: Built-in data protection where customer content isn’t stored, logged, or used to train AWS models or shared with third parties. FedRAMP Class D (formerly High) certification and DoD Cloud Service Provider (CSP) SRG IL4/IL5 authorization pathways, supporting government agencies’ compliance requirements. See the Amazon Bedrock models compliance page for current model-level certification status. Integration with existing security controls and compliance frameworks available in AWS GovCloud (US), maintaining the same high security standards as other AWS Regions while providing additional authorization pathways. Amazon Bedrock in AWS GovCloud (US) supports two endpoint surfaces, bedrock-runtime and bedrock-mantle, both powered by the same underlying Mantle inference engine with Zero Operator Access (ZOA) architecture. The bedrock-runtime endpoint uses the AWS SDK (InvokeModel and Converse APIs) and supports Amazon Bedrock Guardrails, Amazon Bedrock Knowledge Bases, Agents, and invocation logging. This makes it the recommended choice for most new applications, particularly those requiring audit trails. The bedrock-mantle endpoint supports the Anthropic Messages API natively and provides access to capabilities currently available only on that surface, such as server-side tools, background inference, and Projects . Both endpoints are available for Claude Opus 5.5, Claude Sonnet 5.5, and Claude Sonnet 5, with bedrock-runtime available in both AWS GovCloud (US) Regions (US-West and US-East) and bedrock-mantle available in AWS GovCloud (US-West). Claude Code is Anthropic’s agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools. Powered by models such as Claude Opus 5.5 and Claude Sonnet 5.5 on Amazon Bedrock in AWS GovCloud (US), it operates directly in your terminal, your preferred integrated development environments ( IDEs ) such as VS Code and JetBrains, and in the background with the Claude Agent SDK . Claude Code understands your entire codebase and can work across multiple files and tools to get things done. Claude Code can: To learn more, see Anthropic’s articles: Claude Code tutorials and Claude Code: Best practices for agentic coding . This section provides step-by-step instructions for setting up and configuring Claude Code to work with Amazon Bedrock in AWS GovCloud (US), including prerequisites, installation commands, environment configuration, and verification steps. Before you get started, make sure that you have the following in place: After configuring AWS CLI with your credentials, install Claude Code using one of the following methods: For additional installation methods, see Claude Code installation docs . At the login prompt, select 3rd-party platform , then Amazon Bedrock . Follow the wizard prompts to choose your authentication method, region (us-gov-west-1), and pin your models. The wizard saves configuration to your settings file automatically. If you have previously configured Claude Code, run /setup-bedrock to reopen the wizard and update your credentials, region, or model pins. For scripted or enterprise deployments, set the following environment variables: To use Claude Opus 5.5 as the primary model instead: To pin specific model versions for consistent team deployments: Then navigate to your project and launch Claude Code: Bedrock Mantle supports the Anthropic Messages API natively and is available in AWS GovCloud (US-West). To route Claude Code through Mantle: When both bedrock-runtime and bedrock-mantle are needed in the same session: Note: Guardrails and invocation logging are available exclusively through the bedrock-runtime endpoint. For deployments requiring these compliance features, use the bedrock-runtime endpoint (Option A or B). Verify that Claude Code is running by checking for the Welcome to Claude Code! message in your terminal. Run the /status command to confirm your model and provider. The provider line should show Amazon Bedrock or Amazon Bedrock (Mantle) depending on your configuration. To learn more about configuring Claude Code for Amazon Bedrock, see Claude Code on Amazon Bedrock . With Claude Code now generally available, the next step is deciding how to deploy it across your organization. Consider your foundational architecture for security, governance, and compliance: Use AWS IAM Identity Center to centrally govern identity and access to Claude Code. This verifies that only authorized developers have access. Additionally, using IAM Identity Center, developers can access resources with temporary, role-based credentials , alleviating the need for static access keys and helping enhance security. Prior to opening Claude Code, make sure that you configure AWS CLI to use an IAM Identity Center profile by using aws configure sso --profile <PROFILE_NAME> . Then log in using the profile you created: aws sso login --profile <PROFILE_NAME> . Consider automated configuration of default environment variables. This includes the environment variables outlined in this post, such as AWS_REGION , CLAUDE_CODE_USE_BEDROCK , ANTHROPIC_MODEL , ANTHROPIC_DEFAULT_OPUS_MODEL , and ANTHROPIC_DEFAULT_SONNET_MODEL . This will configure Claude Code to automatically connect to Amazon Bedrock, providing a consistent baseline for development across teams. Organizations can start by providing developers with self-service instructions, or use settings files to manage configuration centrally. Consider implementing Guidance for Claude Code with Amazon Bedrock for large enterprise deployments. The guidance helps organizations deploy Claude Code while maintaining strict control over AI resource access, connecting to existing identity infrastructure and providing observability for developer productivity and usage patterns. Review service quotas and set appropriate tokens per minute (TPM) and requests per minute (RPM) based on the number of active developers. Make sure that you have enough TPM and RPM quotas to support your team’s usage. For guidance, follow the rate limit recommendations . Pin model versions for consistent team deployments. Without pinning, model aliases such as sonnet and opus resolve to Claude Code’s built-in defaults, which may change between releases. Claude Code defaults to Claude Opus 5.5 as its primary model, so an unpinned deployment is billed at the Opus per-token rate. To keep teams on Claude Sonnet 5.5, set ANTHROPIC_MODEL to its full model ID. Use ANTHROPIC_DEFAULT_OPUS_MODEL and ANTHROPIC_DEFAULT_SONNET_MODEL to control when your team moves to a new model.