Claude Apps Gateway for AWS: How to Cap AI Coding Spend Before It Eats Your Budget in Four Months

Uber rolled Claude Code out to roughly 5,000 engineers in December 2025. By April 2026, the entire 2026 AI budget was gone, consumed in four months, and the company’s chief technology officer summed it up as “I’m back to the drawing board, because the budget I thought I would need is blown away already.” That is the story TechTimes reported on 4 July 2026, and it is not a story about a badly run engineering organisation. It is a story about a new spend category that behaves nothing like the SaaS seats finance teams are used to modelling. On 8 July 2026, AWS announced the Claude apps gateway for AWS, a self-hosted control plane that puts identity, policy, and spend caps for Claude Code and Claude Desktop in one place. If you have engineers using agentic coding tools on company money and no central choke point, this is the most consequential AWS launch of the week for you.

The short answer is this. The Claude apps gateway for AWS is a single stateless container you run in your own VPC, backed by a PostgreSQL database, that sits between your developers’ Claude Code CLI and your inference provider. Developers sign in through your existing OIDC identity provider using browser SSO instead of carrying an individual cloud credential on their laptop. The gateway holds the one upstream credential, routes inference to Amazon Bedrock or Claude Platform on AWS, enforces model and tool policy centrally, emits per-user telemetry over OTLP, and applies daily, weekly, and monthly spend caps per organisation, group, or user. When someone hits their cap, the gateway blocks further requests until the period resets or an admin raises the limit. Deploy it on ECS, EKS, or EC2 behind an internal Application Load Balancer, and you go from no visibility to per-developer cost attribution and hard limits in an afternoon.

Why Agentic Coding Broke Everyone’s Cost Model

The reason Uber’s budget evaporated is arithmetic, not carelessness. A traditional AI coding assistant answers a question: one prompt in, one completion out. An agent plans, loads context, calls tools, verifies its own output, and retries. Gartner’s March 2026 analysis puts that at 5 to 30 model calls per user-initiated task. GitHub’s own May 2026 research found agentic coding tasks can consume roughly 1,000 times more tokens than a standard single-turn query. Nobody’s 2025 spreadsheet had a 1,000x multiplier in it, because until agents shipped there was nothing to multiply.

The averages look reasonable right up until they do not. Anthropic’s own enterprise figures put typical usage at around 13 dollars per developer per active day and 150 to 250 dollars per developer per month, with 90 percent of users staying below 30 dollars on any given active day. Those are numbers a founder can live with. The problem is the tail. Finout’s 2026 pricing analysis documents eight distinct spike patterns that can multiply cost by 10 to 500 times, and reports subagent fan-out incidents producing bills between 8,000 and 47,000 dollars from a single event. Subagent-heavy workflows add 200 to 500 percent overhead versus running the same task as one agent. Context grows as a session runs long, so per-turn cost at turn 200 can be around 10 times what it was at turn 1. One engineer, one bad afternoon, one recursive agent loop, and your monthly average is meaningless.

Model choice compounds it. Opus 4.7 runs at 5 dollars per million input tokens and 25 dollars per million output, Sonnet 4.6 at 3 and 15, and Haiku 4.5 at 1 and 5, according to CloudZero’s July 2026 pricing breakdown. TechTimes puts the total spread between the cheapest and most expensive models in the market at roughly 4,500x. A developer who leaves the model picker on the most capable option for routine work is not doing anything wrong. They just have no reason to care, because the bill does not arrive on their desk.

The Data: What AI Coding Actually Costs and How Few Teams Control It

Read those last three rows together and the shape of the problem is obvious. Ninety-eight percent of organisations are now managing AI costs, up from 31 percent two years ago, but only 38 percent have a central team governing AI, and 49 percent name shadow AI, meaning unauthorised agentic pipelines running on corporate cards outside any oversight, as their biggest worry. Almost everyone has the cost. Most do not have the control point. The gateway is the control point.

What You Actually Get, and What It Costs You to Run

Anthropic’s own guidance on token budgets is worth sitting with, because it tells you how spend behaves as a team grows. Anthropic’s cost documentation puts expected usage at 200,000 to 300,000 tokens per user per day for a team of 1 to 5 people, dropping to 100,000 to 150,000 for 5 to 20 users, 50,000 to 75,000 for 20 to 50, and down to 10,000 to 15,000 for teams over 500. Per-head usage falls as teams grow because adoption spreads unevenly and casual users dilute the heavy ones. That is exactly why an organisation-level average tells you nothing useful and per-user caps tell you everything.

The gateway handles five things. Identity comes from any standards-compliant OIDC provider, so Okta, Entra ID, Google Workspace, Keycloak, Dex, or PingFederate all work, and the gateway runs standard OIDC discovery and the authorisation-code flow against it. Note that SAML and LDAP are not supported, which is the first thing to check before you plan a rollout. Policy is defined once on the server, delivered to clients at sign-in, and enforced on every request, scoped by IdP group. You control allowed models, tool permissions such as restricting file writes or web access, permission rules developers cannot override locally, and environment variables or hooks that standardise workflows. Telemetry is stamped per request with the developer’s identity and relayed over OTLP to a collector you choose, so CloudWatch, Amazon Managed Service for Prometheus, or a third-party platform in your own account. Routing sends inference to Amazon Bedrock or Claude Platform on AWS with optional failover across Regions or accounts. Spend caps are set daily, weekly, and monthly per organisation, group, or user.

The operational footprint is modest. One stateless container on ECS, EKS, or EC2, an internal Application Load Balancer with an ACM certificate, and PostgreSQL 14 or later on RDS to hold short-lived sign-in state and rate-limit counters. Any managed Postgres works, including the smallest instance classes, because it is not carrying real load. The Bedrock upstream uses the container’s IAM task role, so there are no static credentials to manage anywhere in the chain. Configuration is a single YAML file with six sections, and secrets stay in environment variables. Model IDs match the Anthropic API, so claude-sonnet-5 and claude-opus-4-8 rather than Bedrock ARNs and inference profiles.

There is a version floor that will bite you if you miss it. The gateway subcommand and the gateway-aware sign-in flow ship in Claude Code v2.1.195, and both the machine running the gateway server and every developer machine need to be on that version or later. The Claude Platform on AWS upstream needs v2.1.198 or later on the gateway server. Earlier public builds simply do not have the flow. Run claude update before you start debugging anything else.

The Offboarding Story Is the Quiet Win

Cost gets the headlines, but the identity change is what will matter to you at your next security review. Today, if you have given each engineer their own Bedrock credential or API key, then offboarding means finding and revoking every one of them, and hoping nobody copied theirs into a side project. With the gateway, granting access means adding someone to your IdP and revoking it means removing them. Their session expires within the configured token lifetime, which defaults to one hour. No long-lived secrets sit on developer machines, ever. Sessions refresh silently in the background using OIDC refresh tokens, so developers stay signed in across restarts without repeated browser logins, and the whole thing is invisible to them once configured. Administrators push a managed settings file via the device management tool you already run, which pre-fills the gateway URL, so a developer types claude /login, presses Enter, and lands in corporate SSO.

That combination, meaning no static credentials, identity-stamped telemetry, and centrally enforced tool permissions, is a materially better answer to “how do you govern AI tool access?” than anything most scale-ups can say today. Consider that 49 percent of enterprises named shadow AI their top concern. The gateway does not just cap spend. It gives you an auditable answer.

A Note on What This Does Not Solve

Be clear-eyed about the boundary. The gateway caps and attributes spend. It does not make your engineers use tokens well. Finout notes that community-tested optimisation tactics reduce token usage by 40 to 85 percent, and that lever is entirely about how people work: session hygiene, avoiding unnecessary subagent fan-out, choosing Haiku for routine summarisation instead of Opus, and using the rebuilt /cost command in Claude Code v2.1.92 and later to see session cost, per-model breakdown, cache hit rate, and rate-limit utilisation. Caps stop the disaster. They do not deliver the 40 to 85 percent.

Sources also disagree on plan pricing in ways worth flagging rather than papering over. CloudZero lists Team Premium at 125 dollars per seat per month, or 100 dollars billed annually, while Finout lists it at 100 dollars per seat and warns that Team Standard at 20 dollars per seat does not include Claude Code at all. The likely explanation is monthly versus annual framing, but if you are building a business case, price it from your own Anthropic or AWS quote and not from a blog table, this one included.

What to Do About It

Start by finding out what you are actually spending, because most teams cannot answer this. If your engineers are on individual Pro or Max subscriptions expensed to the company, that spend is invisible to your AWS bill and probably invisible to your finance team. That is shadow AI, and you have it. Then decide the routing question: Amazon Bedrock if data must stay inside the AWS security boundary and you want inference to behave like every other Bedrock workload in your account, or Claude Platform on AWS if you want Anthropic’s native platform experience with AWS authentication and billing. The gateway supports both, and the choice is a data-handling decision more than a technical one.

After that, the work is small. Stand up the container, wire it to your IdP, point telemetry at CloudWatch, and set caps deliberately low at first. Use Anthropic’s per-user-per-day token guidance for your headcount band as the starting point, watch a fortnight of real telemetry, then raise the caps to fit reality rather than guessing upward from nothing. Set the caps per group, because your platform team and your frontend team will not have the same profile. The point is not to be stingy. The point is that a 47,000 dollar subagent incident should hit a wall at hour two, not appear on an invoice five weeks later.

If you are running a growing engineering team on AWS and you do not yet have a single place where AI tool access, policy, and spend are controlled, you are one recursive agent loop away from a conversation with your board that you do not want to have. HAZERCLOUD helps UK, US, and European businesses design and operate AWS platforms that stay secure and predictable as they scale, including gateway deployments, Bedrock routing, IAM and identity design, and the FinOps guardrails that keep a cloud bill from becoming a surprise. Book a free consultation and migration assessment at https://hazercloud.com/contact/ and we will look at your actual spend and your actual exposure, not a generic checklist.

Jobin Joseph

View all posts by Jobin Joseph

hazercloud.com