Supercharge regulated workloads with Claude Code and Amazon Bedrock

Anthropic's Claude Opus 5.5 and Claude Sonnet 5.5 are now available on Amazon Bedrock in AWS GovCloud (US) Regions, giving organizations with regulatory and compliance requirements, including ITAR, an on-ramp for AI-assisted development via Claude Code. Claude Sonnet 5 holds FedRAMP Class D (formerly High) certification and DoD Impact Level 4 and 5 authorization, while Claude Opus 5.5 and Claude Sonnet 5.5 hold FedRAMP Class D certification on Amazon Bedrock. Bedrock in GovCloud exposes two endpoints, bedrock-runtime (AWS SDK InvokeModel and Converse APIs, with Guardrails, Knowledge Bases, Agents and invocation logging) and bedrock-mantle (native Anthropic Messages API with server-side tools, background inference and Projects), both running the Mantle inference engine with Zero Operator Access.

Artificial Intelligence https://aws.amazon.com/blogs/machine-learning/ Supercharge regulated workloads with Claude Code and Amazon Bedrock Please note that the following post is intended for informational purposes only. The approach detailed below may not be suitable for all organizations or compliance programs. It is important to evaluate this potential solution against the compliance requirements of your organization and any applicable regulatory obligations you may have. The availability of Anthropic Claude Opus 5.5 and Claude Sonnet 5.5 in the AWS GovCloud US Regions introduces an on-ramp for AI-assisted development for workloads with regulatory or compliance requirements, including International Traffic in Arms Regulations ITAR . Claude Sonnet 5 holds FedRAMP Class D formerly High certification and DoD Impact Level 4 and 5 IL4/IL5 authorization, and Claude Opus 5.5 and Claude Sonnet 5.5 hold FedRAMP Class D certification on Amazon Bedrock verify current model certification status https://aws.amazon.com/compliance/services-in-scope/FedRAMP/amazon-bedrock-models/ . In this post, we explore how to use these models on Amazon Bedrock https://aws.amazon.com/bedrock in AWS GovCloud US with Claude Code https://code.claude.com , Anthropic’s agentic coding tool. With this solution, you can run AI-assisted workflows that speed up everyday development tasks while maintaining compliance alignment. Amazon Bedrock in AWS GovCloud US AWS GovCloud US Regions https://aws.amazon.com/govcloud-us/ are designed specifically for US customers with elevated compliance needs https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-compliance.html . You can deploy generative AI workloads to sensitive environments while maintaining compliance controls. Amazon Bedrock https://aws.amazon.com/bedrock/ is built with security-focused features, including: Built-in data protection https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html where customer content isn’t stored, logged, or used to train AWS models or shared with third parties. FedRAMP Class D formerly High certification and DoD Cloud Service Provider CSP SRG IL4/IL5 authorization pathways, supporting government agencies’ compliance requirements. See the Amazon Bedrock models compliance page https://aws.amazon.com/compliance/services-in-scope/FedRAMP/amazon-bedrock-models/ for current model-level certification status. Integration with existing security controls and compliance frameworks available in AWS GovCloud US , maintaining the same high security standards as other AWS Regions while providing additional authorization pathways. Amazon Bedrock in AWS GovCloud US supports two endpoint surfaces, bedrock-runtime and bedrock-mantle, both powered by the same underlying Mantle inference engine with Zero Operator Access ZOA architecture. The bedrock-runtime endpoint uses the AWS SDK InvokeModel and Converse APIs and supports Amazon Bedrock Guardrails, Amazon Bedrock Knowledge Bases, Agents, and invocation logging. This makes it the recommended choice for most new applications, particularly those requiring audit trails. The bedrock-mantle endpoint supports the Anthropic Messages API natively and provides access to capabilities currently available only on that surface, such as server-side tools, background inference, and Projects https://aws.amazon.com/blogs/machine-learning/exploring-the-zero-operator-access-design-of-mantle/ . Both endpoints are available for Claude Opus 5.5, Claude Sonnet 5.5, and Claude Sonnet 5, with bedrock-runtime available in both AWS GovCloud US Regions US-West and US-East and bedrock-mantle available in AWS GovCloud US-West . Claude Code Claude Code https://code.claude.com is Anthropic’s agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools. Powered by models such as Claude Opus 5.5 and Claude Sonnet 5.5 on Amazon Bedrock in AWS GovCloud US , it operates directly in your terminal, your preferred integrated development environments IDEs https://docs.anthropic.com/en/docs/claude-code/ide-integrations such as VS Code and JetBrains, and in the background with the Claude Agent SDK https://docs.anthropic.com/en/docs/claude-code/agent-sdk/overview . Claude Code understands your entire codebase and can work across multiple files and tools to get things done. Claude Code can: - Write code and fix bugs spanning multiple files across your codebase. - Answer questions about your code’s architecture and logic. - Execute and fix tests, linting, and other commands. - Search through Git history, resolve merge conflicts, and create commits and pull requests. - Connect to external tools and data sources with the Model Context Protocol MCP https://docs.anthropic.com/en/docs/claude-code/mcp , including the AWS Command Line Interface AWS CLI https://aws.amazon.com/cli , Terraform, and Kubernetes. - Spawn sub-agents https://docs.anthropic.com/en/docs/claude-code/sub-agents that work on different parts of a task simultaneously. - Customize behavior with CLAUDE.md https://docs.anthropic.com/en/docs/claude-code/memory memory files, skills https://docs.anthropic.com/en/docs/claude-code/skills for repeatable workflows, and hooks https://docs.anthropic.com/en/docs/claude-code/hooks for pre/post-action automation. - Automate recurring tasks and integrate with continuous integration and continuous delivery CI/CD through GitHub Actions https://docs.anthropic.com/en/docs/claude-code/github-actions or GitLab CI/CD https://docs.anthropic.com/en/docs/claude-code/gitlab-ci-cd . To learn more, see Anthropic’s articles: Claude Code tutorials https://docs.anthropic.com/en/docs/claude-code/tutorials and Claude Code: Best practices for agentic coding https://www.anthropic.com/engineering/claude-code-best-practices . Solution overview: Try Claude Code with Amazon Bedrock in AWS GovCloud US This section provides step-by-step instructions for setting up and configuring Claude Code to work with Amazon Bedrock in AWS GovCloud US , including prerequisites, installation commands, environment configuration, and verification steps. Prerequisites Before you get started, make sure that you have the following in place: - An AWS GovCloud US account https://signin.amazonaws-us-gov.com/ with access to Amazon Bedrock. - Appropriate AWS Identity and Access Management IAM https://aws.amazon.com/iam/ roles and permissions for Amazon Bedrock. At minimum, your IAM policy should include: - For bedrock-runtime: bedrock:InvokeModel , bedrock:InvokeModelWithResponseStream , bedrock:ListInferenceProfiles , and bedrock:GetInferenceProfile . - For bedrock-mantle if using the Mantle endpoint : bedrock-mantle:CreateInference , bedrock-mantle:GetProject , bedrock-mantle:ListProjects , and bedrock-mantle:ListModels . - Alternatively, attach the AmazonBedrockMantleInferenceAccess managed policy. - For bedrock-runtime: - Amazon Bedrock model access https://docs.aws.amazon.com/bedrock/latest/userguide/model-access-modify.html to Claude Opus 5.5, Claude Sonnet 5.5, and Claude Sonnet 5 enabled in your AWS GovCloud US account. - AWS CLI https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html configured with valid AWS session credentials using short-term API keys or AWS SSO login. Set up Claude Code with Amazon Bedrock in AWS GovCloud US After configuring AWS CLI with your credentials, install Claude Code using one of the following methods: macOS, Linux, WSL: Windows PowerShell: Windows CMD: Homebrew macOS/Linux : For additional installation methods, see Claude Code installation docs https://code.claude.com/docs/en/quickstart . Option A: Interactive setup wizard recommended 1. Navigate to your project: 2. Launch Claude Code: 3. Run through the login wizard: At the login prompt, select 3rd-party platform , then Amazon Bedrock . Follow the wizard prompts to choose your authentication method, region us-gov-west-1 , and pin your models. The wizard saves configuration to your settings file automatically. If you have previously configured Claude Code, run /setup-bedrock to reopen the wizard and update your credentials, region, or model pins. Option B: Manual environment variable configuration For scripted or enterprise deployments, set the following environment variables: To use Claude Opus 5.5 as the primary model instead: To pin specific model versions for consistent team deployments: Then navigate to your project and launch Claude Code: Option C: Using the Bedrock Mantle endpoint Bedrock Mantle supports the Anthropic Messages API natively and is available in AWS GovCloud US-West . To route Claude Code through Mantle: When both bedrock-runtime and bedrock-mantle are needed in the same session: Note: Guardrails and invocation logging are available exclusively through the bedrock-runtime endpoint. For deployments requiring these compliance features, use the bedrock-runtime endpoint Option A or B . Verify your configuration Verify that Claude Code is running by checking for the Welcome to Claude Code message in your terminal. Run the /status command to confirm your model and provider. The provider line should show Amazon Bedrock or Amazon Bedrock Mantle depending on your configuration. To learn more about configuring Claude Code for Amazon Bedrock, see Claude Code on Amazon Bedrock https://code.claude.com/docs/en/amazon-bedrock . Considerations when deploying Claude Code to your organization With Claude Code now generally available, the next step is deciding how to deploy it across your organization. Consider your foundational architecture for security, governance, and compliance: Use AWS IAM Identity Center https://aws.amazon.com/iam/identity-center/ to centrally govern identity and access to Claude Code. This verifies that only authorized developers have access. Additionally, using IAM Identity Center, developers can access resources with temporary, role-based credentials https://docs.aws.amazon.com/singlesignon/latest/userguide/howtogetcredentials.html , alleviating the need for static access keys and helping enhance security. Prior to opening Claude Code, make sure that you configure AWS CLI to use an IAM Identity Center profile by using aws configure sso --profile <PROFILE NAME . Then log in using the profile you created: aws sso login --profile <PROFILE NAME . Consider automated configuration of default environment variables. This includes the environment variables outlined in this post, such as AWS REGION , CLAUDE CODE USE BEDROCK , ANTHROPIC MODEL , ANTHROPIC DEFAULT OPUS MODEL , and ANTHROPIC DEFAULT SONNET MODEL . This will configure Claude Code to automatically connect to Amazon Bedrock, providing a consistent baseline for development across teams. Organizations can start by providing developers with self-service instructions, or use settings files https://docs.anthropic.com/en/docs/claude-code/settings to manage configuration centrally. Consider implementing Guidance for Claude Code with Amazon Bedrock https://aws.amazon.com/solutions/guidance/claude-code-with-amazon-bedrock/ for large enterprise deployments. The guidance helps organizations deploy Claude Code while maintaining strict control over AI resource access, connecting to existing identity infrastructure and providing observability for developer productivity and usage patterns. Review service quotas https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html and set appropriate tokens per minute TPM and requests per minute RPM based on the number of active developers. Make sure that you have enough TPM and RPM quotas to support your team’s usage. For guidance, follow the rate limit recommendations https://docs.anthropic.com/en/docs/claude-code/costs . Pin model versions for consistent team deployments. Without pinning, model aliases such as sonnet and opus resolve to Claude Code’s built-in defaults, which may change between releases. Claude Code defaults to Claude Opus 5.5 as its primary model, so an unpinned deployment is billed at the Opus per-token rate. To keep teams on Claude Sonnet 5.5, set ANTHROPIC MODEL to its full model ID. Use ANTHROPIC DEFAULT OPUS MODEL and ANTHROPIC DEFAULT SONNET MODEL to control when your team moves to a new model. In AWS GovCloud US , use the us-gov. prefix for cross-region inference profile IDs. Implement cost monitoring and per-user token guardrails. Claude Code sessions can be token-intensive, particularly with Claude Opus 5.5, which carries a higher per-token cost than Claude Sonnet 5.5. According to Anthropic, Claude Opus 5.5 completes tasks using fewer tokens than Claude Opus 5, at a lower price per token. Consider the following: - Implement per-user token guardrails https://aws.amazon.com/blogs/publicsector/implementing-per-user-token-guardrails-for-amazon-bedrock-in-government-agencies/ to enforce daily token limits per developer, with alerting at 80% and 100% thresholds. This pattern uses Amazon CloudWatch invocation logging, AWS Lambda, and Amazon DynamoDB to track and enforce limits in near real time. - Use prompt caching to reduce costs and improve response times. Both 5-minute and 1-hour TTL https://aws.amazon.com/about-aws/whats-new/2026/01/amazon-bedrock-one-hour-duration-prompt-caching/ options are available for supported models. - Consider defaulting teams to Claude Sonnet 5.5 lower cost than Claude Opus 5.5 and reserving Claude Opus 5.5 for tasks requiring deeper reasoning or longer autonomous runs. For workloads that require IL4/IL5 authorization, default to Claude Sonnet 5. See the Claude Code Monitoring Implementation guide https://github.com/aws-solutions-library-samples/guidance-for-claude-code-with-amazon-bedrock/blob/main/assets/docs/MONITORING.md for additional observability patterns. Consider permissions, memory, and MCP servers for your organization. Security teams can configure managed permissions https://docs.anthropic.com/en/docs/claude-code/security for what Claude Code is and is not allowed to do, which cannot be overwritten by local configuration. In addition, you can configure CLAUDE.md memory files https://docs.anthropic.com/en/docs/claude-code/memory across projects to auto-add common workflows, style conventions, and coding standards to align with your organization’s preferences. Deploy your CLAUDE.md file into an enterprise directory so all developers inherit the same baseline. Use hooks https://docs.anthropic.com/en/docs/claude-code/hooks to enforce pre/post-action automation such as auto-formatting or lint checks. Choose the appropriate endpoint for your compliance requirements. The bedrock-runtime endpoint supports Guardrails, invocation logging, and cross-region inference within both AWS GovCloud US Regions US-West and US-East . The bedrock-mantle endpoint supports the Anthropic Messages API natively and is available in AWS GovCloud US-West . Guardrails and invocation logging are exclusive to bedrock-runtime today, so for deployments requiring comprehensive audit trails and content filtering, bedrock-runtime is recommended. Conduct a thorough security assessment before deployment. Evaluate Claude Code’s capabilities against your organization’s security policies. Amazon Bedrock secures the inference layer, but Claude Code runs on local developer machines and requires separate evaluation and risk management. Apply controls such as managed permissions, invocation logging, and per-user token limits, as you would for other third-party software running in your environment. Conclusion The availability of Claude Opus 5.5 and Claude Sonnet 5.5 on Amazon Bedrock in AWS GovCloud US provides organizations with a compliance-aligned path to AI-assisted development for regulated workloads. Claude Sonnet 5, with FedRAMP Class D formerly High certification and DoD IL4/IL5 authorization, offers the strongest compliance coverage for sensitive environments. Claude Sonnet 5.5, with FedRAMP Class D certification, is a step up from Claude Sonnet 5 on coding and knowledge work at a lower cost per task. Claude Opus 5.5, with FedRAMP Class D certification, brings deeper reasoning and longer autonomous task capabilities for workloads where that certification level is sufficient. Combined with Claude Code, teams can adopt agentic coding workflows directly in their terminal, IDE, or CI/CD pipelines while data remains within AWS GovCloud US infrastructure. Whether you choose the bedrock-runtime endpoint for full Guardrails and logging support, or the bedrock-mantle endpoint for native Anthropic Messages API access, you can tailor the deployment to your organization’s compliance and operational requirements.