This guidance provides enterprise-grade authentication and deployment patterns for Claude Code CLI and Claude Cowork Desktop using Amazon Bedrock. It targets organizations needing secure, centralized access to LLM capabilities, offering benefits like unified identity management, audit trails, and simplified credential handling for end-users.

How It Works

The core mechanism employs Direct IAM OIDC federation, allowing users to authenticate via existing enterprise identity providers (Okta, Azure AD, Auth0). Upon successful authentication, temporary AWS credentials are issued, enabling secure access to Amazon Bedrock without managing long-lived API keys. An alternative path using AWS IAM Identity Center is also supported. This approach ensures robust auditability and centralized control over LLM resource access.

Quick Start & Requirements

• Primary Install/Run Command: Utilizes the ccwb command-line tool, typically invoked via poetry run ccwb deploy or similar commands after setup.
• Prerequisites: Requires an existing OIDC Identity Provider (Okta, Azure AD, Auth0, Cognito User Pools), an AWS account with CloudFormation and IAM permissions, Amazon Bedrock activated in target regions, Python 3.10+, Poetry, AWS CLI v2, and Git.
• Estimated Setup Time: 2-3 hours for initial setup, including identity provider configuration.
• Documentation: Detailed instructions available in QUICK_START.md, Architecture Guide, Deployment Guide, and CoWork 3P Guide.

Highlighted Details

• Seamless integration with enterprise IdPs (Okta, Azure AD, Auth0) and AWS IAM Identity Center.
• Eliminates API key management for end-users, providing automatic credential refresh.
• Supports multi-platform deployment (Windows, macOS, Linux) with standalone executables.
• Enables centralized access control, usage monitoring via CloudWatch, and multi-region/multi-partition (Commercial/GovCloud) configurations.
• Extends functionality to Claude Cowork Desktop with a single command.
• Offers an optional deployment path without SSO for analytics-only use cases.

Maintenance & Community

This AWS Solutions Library sample focuses on providing a deployable pattern. Specific details regarding active community contributions, sponsorships, or dedicated support channels like Discord/Slack are not detailed in the README.

Licensing & Compatibility

• License: MIT License.
• Compatibility: Permissive MIT license allows for broad integration into commercial and closed-source applications.

Limitations & Caveats

Initial setup requires significant administrative effort involving both AWS and identity provider configurations. While standalone executables simplify end-user deployment, the underlying infrastructure setup demands technical expertise. The optional SSO-less deployment path sacrifices individual user attribution for simplified setup.