You get AWS Bedrock cost control by routing Claude Code through a gateway that holds your organization's Bedrock access, instead of handing each developer their own keys. The gateway sits in front of Bedrock, gives every developer one Clawgate key, and checks every request against a budget before it forwards to Bedrock. So your team gets Claude Code on Bedrock, no one holds a direct Bedrock key, and every request is tied to a person, a project, and a hard cap.
That is the whole idea. Below is why direct Bedrock access goes wrong, and how the gateway fixes it.
The problem with giving developers direct Bedrock access
If your company runs Claude models through Amazon Bedrock, the fastest way to let developers use Claude Code is to give them AWS credentials and let them point their tool at Bedrock. It works on day one. It falls apart at scale.
- No limits. A raw Bedrock key has no per person cap. One developer running long agent sessions on a big codebase can spend far more than the rest of the team combined, and nothing stops it until the AWS bill lands.
- No visibility. Bedrock usage shows up as one line on the AWS bill. You know the total, but not who spent it, on which project, or whether the priciest model was even needed.
- No model control. Every key holder can call any Bedrock model they have access to, including the most expensive ones, for routine work that a cheaper model would handle fine.
- Key sprawl. Handing out AWS credentials means rotating and revoking them by hand when someone leaves, and hoping no key ends up in a shell history or a committed
.envfile.
This is not a hypothetical failure mode. Teams that rolled Claude Code out fast have hit exactly this wall. Uber reportedly used its entire 2026 AI budget in about four months after giving Claude Code to roughly 5,000 engineers, with per engineer cost reaching $500 to $2,000 a month, and it fell back on blunt usage caps. Anthropic's own docs put a typical developer at around $13 per active day, or $150 to $250 per month. Direct keys turn that into a number you can only read after the fact.
How Clawgate sits in front of Bedrock
Clawgate is a control layer for Claude Code and Codex. You configure it with your organization's Bedrock access once, then hand out Clawgate keys instead of AWS credentials. Each developer points Claude Code at the gateway with one vsk_… key. Every request is authenticated, checked against budgets and quotas, tied to a user and a project, and then forwarded to Bedrock. Setup takes minutes and there is no local config juggling on the developer's side.
Here is what that gives you, all controlled from one dashboard.
Per user and per project budgets that hard stop
Budgets are hard stops, not alerts. You set daily and weekly caps in dollars, tokens, or sessions on each key, and a project budget as an all time spend cap. When a limit is reached the request is blocked. Clawgate returns a 403 so the developer sees the limit message, instead of a 429 that Claude Code silently retries. The project cap is checked before the per user caps, so a shared project can't blow its number even if one person's cap has room left. Because the caps block, there are no surprise Bedrock bills.
Model control across the team
A policy sets which Bedrock models a key is allowed to use. You can force a specific model for a project, and switch models from the dashboard without touching anyone's local setup. That means you can steer routine work onto a cheaper capable model for everyone at once, which often saves more than any cap.
Live cost tracking and attribution
Every key is tied to a person and a project, so per user and per project cost is tracked automatically, live and historical. Your Bedrock spend stops being one line on the AWS bill and becomes a breakdown you can read: who spent what, on which project, on which model. That is exactly what you need to bill client work back to the right client.
Alerts before the hard cap
You can set an email alert when spend crosses a threshold you choose (80% by default), so you can top up, switch to a cheaper model, or pause before the hard cap hits.
Pick global routing, not regional
One quiet lever on Bedrock cost is the routing profile you use. Global inference routing is generally cheaper than pinning requests to a single region, because it lets AWS serve the request from wherever there is capacity. It is worth checking which profile your access is set to. Clawgate can help you pick the right one for your setup so you are not overpaying for regional routing you don't need.
More than a meter
When we built Clawgate we found no single existing tool did all three of the things a team actually needs, which is why we built it. It started as an internal tool at Virstack that cut our own AI bill by 70% before it became a product. So beyond the budgets and tracking above, Clawgate also compresses tokens, cutting up to 92% of the tokens agents resend each turn on heavy workloads while accuracy holds, which lowers your Bedrock spend directly. And it catches abuse and impersonation: content fingerprint detection flags leaked or shared keys and requests whose content does not match the project they claim. Monitor and control, cut token usage, catch abuse, in one place. For the wider picture, see how to control Claude Code costs and AI spend control generally, or the specifics of a Claude Code budget.
Frequently asked questions
Can I give my team Claude Code on Bedrock without sharing AWS keys?
Yes. Put a gateway in front of your Bedrock access. The gateway holds the Bedrock credentials, and each developer gets a Clawgate key instead. Their Claude Code points at the gateway, so no one on the team ever handles a raw AWS or Bedrock key, and you can revoke a single person's key without rotating anything on AWS.
How do I set a Bedrock budget per user?
In Clawgate you set daily and weekly caps in dollars, tokens, or sessions on each key, and each key belongs to one person. When someone hits their cap the next request is blocked with a 403 so they see the limit message, instead of a 429 that coding agents silently retry. You can also set a project budget as an all time spend cap that is checked before the per user caps.
Does Bedrock cost the same as the Anthropic API?
Pricing is set by the provider and varies by model and by region, so the exact number depends on what you run and where. The point of a gateway is not to change that rate. It is to give you control and visibility over whatever you pay: hard stop budgets, per user and per project attribution, and live cost tracking, so the bill is never a surprise.
Can I control which Bedrock models the team uses?
Yes. A policy limits which models a key is allowed to use, and you can force a specific model for a project. You change models from the dashboard without touching anyone's local setup, so you can steer expensive work onto a cheaper capable model for the whole team from one place.
Written by Chathuranga K, an engineer at Virstack.
Give your team Bedrock access, keep control of the spend
Route Claude Code through a gateway that holds your Bedrock access, set a hard budget for every developer and project, and see exactly who spent what, with limits that block instead of alerts that arrive too late.