Terraform project that provisions AWS infrastructure for running Claude Code with Amazon Bedrock, including comprehensive cost tracking, per-developer attribution, and budget controls.

┌─────────────────────────────────────────────────────────────────┐
│                    Dedicated AWS Account                        │
│                                                                 │
│  ┌──────────┐    ┌──────────────────┐    ┌──────────────────┐  │
│  │ IAM Roles│    │  Bedrock Models  │    │   Inference      │  │
│  │ Dev/Admin│───▶│ Claude Opus 4.6  │◀───│   Profiles       │  │
│  └──────────┘    └────────┬─────────┘    │ (per-developer)  │  │
│                           │              └──────────────────┘  │
│                    Invocation Logs                              │
│                           │                                    │
│              ┌────────────┼────────────┐                       │
│              ▼                         ▼                       │
│  ┌──────────────────┐    ┌──────────────────┐                  │
│  │  CloudWatch Logs │    │    S3 Bucket     │                  │
│  │  (real-time)     │    │  (long-term)     │                  │
│  └────────┬─────────┘    └────────┬─────────┘                  │
│           │                       │                            │
│           ▼                       ▼                            │
│  ┌──────────────────┐    ┌──────────────────┐                  │
│  │ Metric Filters   │    │ Glue + Athena    │                  │
│  │ & Alarms         │    │ (per-dev queries)│                  │
│  └────────┬─────────┘    └──────────────────┘                  │
│           │                                                    │
│           ▼                                                    │
│  ┌──────────────────┐    ┌──────────────────┐                  │
│  │   SNS Alerts     │    │  AWS Budgets     │                  │
│  │ (Slack/PagerDuty)│    │ (50/80/100%)     │                  │
│  └──────────────────┘    └──────────────────┘                  │
└─────────────────────────────────────────────────────────────────┘

• AWS account within an AWS Organization
• Terraform >= 1.5.0
• AWS CLI v2 with credentials for the target account
• (Optional) S3 backend bucket and DynamoDB table for remote state
• (Optional) Corporate IdP (Okta, Azure AD, etc.) for SSO integration

1. Clone this repository:

   git clone <repo-url>
   cd claude-code-bedrock

2. Complete the manual prerequisites in MANUAL_STEPS.md (Phase 1 section).

3. Create your variables file:

   cp environments/prod.tfvars.example environments/prod.tfvars

4. Edit environments/prod.tfvars with your account-specific values.

5. (Optional) Configure remote state by uncommenting backend.tf.

6. Deploy:

   terraform init
   terraform plan -var-file=environments/prod.tfvars
   terraform apply -var-file=environments/prod.tfvars

7. Complete post-apply manual steps in MANUAL_STEPS.md.

IAM roles (ClaudeCodeDeveloper, ClaudeCodeAdmin) and an SCP policy document for restricting the account to Bedrock and supporting services.

Bedrock model invocation logging to CloudWatch Logs and S3. Includes saved Logs Insights queries for ad-hoc cost analysis (daily usage by caller, hourly totals, top consumers, model breakdown).

Per-developer Application Inference Profiles with cost allocation tags (Team, Project, CostCenter, User). After tag activation, filtered cost data appears in AWS Cost Explorer.

IAM Identity Center (SSO) permission set for per-developer identity in logs. Athena workgroup, Glue catalog table, and named queries for per-developer cost breakdowns.

AWS Budgets (overall + per-team), SNS alerting, CloudWatch metric filters and alarms for anomaly detection (high invocation rate, token spikes, throttling). Optional Bedrock Guardrails.

See variables.tf for the full list with descriptions.

After deployment, get the developer configuration:

terraform output developer_env_config
terraform output inference_profile_arns

Each developer creates ~/.claude/settings.json:

{
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_REGION": "us-east-1",
    "ANTHROPIC_MODEL": "us.anthropic.claude-opus-4-6-v1",
    "AWS_PROFILE": "claude-code"
  }
}

For per-developer cost allocation via inference profiles, add the profile ARN:

{
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_REGION": "us-east-1",
    "ANTHROPIC_MODEL": "us.anthropic.claude-opus-4-6-v1",
    "AWS_PROFILE": "claude-code",
    "CLAUDE_CODE_BEDROCK_PROFILE_ARN": "<profile-arn-from-terraform-output>"
  }
}

Warning: Do NOT set AWS_BEARER_TOKEN_BEDROCK in your environment. This variable is not used by Claude Code and will cause authentication failures with Bedrock.

If your organization uses SSO via IAM Identity Center (e.g., Azure AD / Microsoft Entra ID), developers authenticate with their corporate identity instead of IAM access keys. This automatically provides per-developer attribution in Bedrock invocation logs.

Set up the AWS CLI SSO profile:

aws configure sso

This creates a named profile in ~/.aws/config:

[profile claude-code]
sso_session = claude-code
sso_account_id = 123456789012
sso_role_name = claude-code-developer
region = us-east-1

[sso-session claude-code]
sso_start_url = https://d-1234567890.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access

Then reference this profile in ~/.claude/settings.json as AWS_PROFILE and authenticate before using Claude Code:

aws sso login --profile claude-code

See MANUAL_STEPS.md (Phase 4) for full SSO setup instructions, including Azure AD / Entra ID configuration.

CloudWatch Logs Insights — Saved queries are created automatically. Open the CloudWatch console, go to Logs Insights, and select from the saved queries prefixed with your project name.

Athena — Named queries are available in the Athena console under the project workgroup:

• Per-developer weekly cost
• Per-developer monthly cost
• Daily cost trend

Cost Explorer — After cost allocation tags activate (~24 hours), filter by Team, Project, or CostCenter tags.

• Prompt caching: Bedrock caches repeated context. Monitor cacheReadInputTokenCount in logs.
• Batch inference: Use for non-interactive workloads (code review pipelines, bulk docs) at ~50% lower cost.
• Intelligent prompt routing: Route simple requests to lighter models automatically.
• Model selection: Choose the right model for each use case:

Some actions cannot be automated via Terraform. See MANUAL_STEPS.md for the full checklist including:

• AWS account creation and Bedrock model access
• SCP application in the management account
• Cost allocation tag activation
• IdP configuration and SSO user assignment
• SNS email subscription confirmations

MIT