Secure AI-Assisted Development with Claude Code and Amazon Bedrock using WorkSpaces Applications

The Challenge

Organizations want their developers using AI coding assistants to accelerate delivery. The productivity gains are compelling - AI pair programming can significantly reduce time spent on routine coding tasks. But security teams have legitimate concerns:

Where does the code go? Most AI coding tools send source code to external APIs for inference. Proprietary algorithms, business logic, and trade secrets leave the corporate boundary every time a developer hits "send."

Who controls the models? When developers install AI tools locally, there's no centralized enforcement of which models are used, what data is sent, or whether usage complies with security policies.

Who manages the credentials? Individual API keys or access tokens create credential sprawl - a growing attack surface that's difficult to audit and rotate.

These aren't hypothetical risks. They're the primary reason enterprises delay or block AI tool adoption for development teams.

The Approach

What if developers could use a full AI coding assistant - with no local installation, no API keys, and no data leaving the AWS account?

This solution streams Claude Code to developers' browsers via Amazon WorkSpaces Applications (AppStream 2.0), backed by Amazon Bedrock. The developer experience is simple: open a browser, authenticate via SSO, and start coding with AI assistance. Everything else - credentials, network isolation, model governance - is handled by the platform.

How It Works

A developer opens their browser and authenticates through the organization's identity provider. They receive a streaming session with Claude Code (an AI coding assistant), a terminal, and a browser - all running on a managed fleet instance in the customer's AWS account.

Claude Code connects to Amazon Bedrock using the fleet's IAM role. No API keys exist. No credentials are distributed to developers. The fleet role has least-privilege access: it can invoke specific models and nothing else.

The fleet instances run in private subnets with no internet access. All AWS API calls - Bedrock inference, credential resolution, storage - route through VPC endpoints. Traffic never traverses the public internet.

At the platform level, WorkSpaces Applications enforces data loss prevention controls: clipboard is disabled in both directions, file upload and download are blocked, and printing is disabled. Code generated inside the environment cannot be copied out through the streaming protocol.

Architecture

Developer Browser
       │
       ▼ (HTTPS streaming protocol)
┌──────────────────────────────────────────────────────────────────┐
│  Customer's AWS Account                                          │
│                                                                  │
│  Identity Provider (SSO) ──▶ WorkSpaces Applications             │
│                               │                                  │
│                               ▼                                  │
│                          Fleet Instance (Rocky Linux 8)          │
│                          • Claude Code CLI                       │
│                          • Terminal + Browser                    │
│                          • Fleet IAM Role (auto-configured)      │
│                               │                                  │
│                               ▼ (VPC Endpoints — private)        │
│                          Amazon Bedrock                          │
│                          • Claude Sonnet 4                       │
│                          • No data training                      │
│                          • Optional: Guardrails                  │
│                                                                  │
│  Network: Private subnets, no internet egress, VPC endpoints     │
│  Storage: S3 home folders via gateway endpoint                   │
└──────────────────────────────────────────────────────────────────┘

Security Controls

Layer	Control	What It Prevents
Platform	Clipboard disabled (both directions)	Copy/paste exfiltration
Platform	File transfer disabled	Upload/download of source code
Platform	Printing disabled	Print-to-PDF extraction
Network	Fleet SG: egress to VPC CIDR only	Internet access from runtime sessions
Network	VPC endpoints for all AWS APIs	Traffic leaving the AWS backbone
Network	Separate security groups (fleet vs. image builder)	Overly permissive runtime access
Identity	Fleet IAM role (no user credentials)	Credential sprawl and key leakage
Identity	Least-privilege Bedrock access	Unauthorized model or service usage
Data	Bedrock: no customer data used for training	Model training on proprietary code
Data	S3 home folders via gateway endpoint	Storage traffic leaving the VPC
Governance	Model pinning via environment variables	Unapproved model usage
Governance	Optional Bedrock Guardrails	Harmful content, PII in prompts

Technical Deep Dive

A few implementation details that aren't obvious from the documentation:

Fleet IAM Role Authentication

WorkSpaces Applications fleet instances have two IAM identities:

1. PhotonInstance - the default instance role, managed by AWS. This role has explicit deny policies that block most AWS API calls including Bedrock.
2. appstream_machine_role - your fleet's IAM role, exposed as a named AWS CLI profile. This is NOT available via instance metadata (169.254.169.254).

Claude Code (and any AWS SDK call) must explicitly use the fleet role:

export AWS_PROFILE=appstream_machine_role

Without this, all API calls route through PhotonInstance and get denied. The session startup script handles this automatically, but it also needs to wait for the credentials to become available, there's a delay after the ENI attaches to the VPC before the profile resolves. A retry loop (up to 60 seconds) handles this gracefully.

VPC Endpoints + Locked-Down Security Group

The network design uses a pattern that's uncommon but powerful: the fleet security group allows egress only to the VPC CIDR (10.0.0.0/16) on port 443. This means fleet instances literally cannot reach the internet, not even through the NAT Gateway that exists in the VPC.

This works because VPC Interface Endpoints create ENIs inside the private subnets (within the VPC CIDR). When the fleet instance calls bedrock-runtime.us-east-2.amazonaws.com, DNS resolves to the endpoint's private IP (e.g., 10.0.10.x), and the security group allows it. Any attempt to reach an external IP is blocked.

Three interface endpoints handle all runtime needs:

• bedrock-runtime - InvokeModel and InvokeModelWithResponseStream
• bedrock - ListInferenceProfiles, GetInferenceProfile (cross-region routing)
• sts - credential resolution for the fleet role

An S3 gateway endpoint handles home folder persistence. The NAT Gateway exists solely for the Image Builder's security group, which has a separate, more permissive egress rule for package installation during image creation.

APP Mode and CLI Applications

WorkSpaces Applications can stream in two modes: DESKTOP (full desktop) or APP (individual application windows). APP mode is more secure - users only see the published applications, not a full Linux desktop.

The challenge: CLI tools like Claude Code have no GUI window. APP mode requires a window to stream. The solution is wrapping each CLI tool in an xterm terminal emulator with a launcher script that pre-loads environment variables:

exec xterm -maximized -fa "Monospace" -fs 14 -title "Claude Code" \
  -e bash -c "cd ~/workspace && claude"

This gives each CLI tool its own streamable window while maintaining the security benefits of APP mode isolation.

Persistent Memory Across Ephemeral Sessions

Streaming sessions are ephemeral by design - when a user disconnects, the instance is recycled. But developers need continuity. The solution uses S3 home folders (mounted at ~/MyFiles) combined with Claude Code's native CLAUDE.md convention:

• An Obsidian vault in ~/MyFiles/obsidian-vault/ persists project context, decisions, and session summaries
• Claude Code's .claude/ config directory (MCP servers, settings) is backed up to ~/MyFiles/.claude/ and restored on next session
• A CLAUDE.md file in the workspace gives Claude Code automatic context about the environment

This creates a "memory layer" that survives session boundaries without requiring persistent infrastructure.

Data Privacy with Amazon Bedrock

According to the Amazon Bedrock security documentation, customer inputs and outputs are not used to train or improve the base foundation models. Data processed through Bedrock is handled within the customer's AWS account boundary and is subject to standard AWS data protection practices.

Combined with VPC endpoints, the inference traffic stays within the AWS network from the fleet instance, through the VPC endpoint ENI, directly to the Bedrock service endpoint. No public internet traversal.

The Developer Experience

From the developer's perspective, the workflow is frictionless:

1. Open a browser (any OS - Windows, Mac, Linux, Chromebook)
2. Authenticate via corporate SSO
3. A streaming session launches with Claude Code ready to use
4. Start coding - Claude Code has full access to Bedrock, pre-configured
5. Work persists in S3 home folders across sessions

No VPN required. No local installation. No credential management. No "works on my machine" issues. A new developer can go from onboarding to productive AI-assisted coding in under 15 minutes.

Cost Profile

For a team of 10 developers streaming 8 hours per day:

Component	Estimated Monthly Cost
Fleet instances (stream.standard.large)	~$220
VPC endpoints (3 interface + 1 gateway)	~$43
NAT Gateway (image builds only)	~$32
S3 storage (home folders)	< $1
Bedrock tokens	Variable (usage-dependent)
Total infrastructure	~$296/month

That's approximately $1.26 per developer per day for the streaming infrastructure before Bedrock token costs. Bedrock pricing is pay-per-token with no minimum commitment.

Who This Is For

This pattern applies to any organization adopting AI coding tools at scale with security governance requirements:

• Financial services - strict data residency and IP protection
• Healthcare - HIPAA considerations for AI tool usage
• Government - FedRAMP and data sovereignty requirements
• Enterprise software - protecting proprietary algorithms and trade secrets
• Regulated industries - audit trail and centralized model governance

What's Next

The solution is fully defined in CloudFormation (three templates) and deploys in under 30 minutes. The only manual step is a one-time golden image build. A companion deployment guide with full source code is in progress.

Potential enhancements for production deployments:

• Bedrock Guardrails for content filtering and PII redaction
• Amazon S3 Files for shared team workspaces with NFS semantics
• CodeCommit via VPC endpoint for version control without internet access
• CloudWatch dashboards for usage tracking and cost visibility
• Elastic fleets for faster session start times

Resources

• Claude Code with Amazon Bedrock - Deployment Patterns
• Amazon Bedrock Security and Privacy
• WorkSpaces Applications Administration Guide
• AWS MCP Server - authenticated AWS API access for AI coding agents *Note - Remote MCP servers require opting in to internet egress