Deploy Claude apps gateway on AWS changedclaude-apps-gateway-on-aws
Nearest release: v2.1.307, published 3 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 21 Oct 2026 23:58 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 00:07 UTC.
Upstream edited
Recorded here
Lines+40added
Lines−1removed
From line
557
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits13to this page, all time
#### Let a developer choose which team to bill
The whole hunk
from line 557, old and new numbered
/
from line 557
557557
558558```yaml theme={null}
559559models:
560 # Include the served model's id, such as claude-opus-4-8, in each id so the gateway's spend meter can price it.
560561 - id: platform-claude-opus-4-8
561562 upstream_model:
562563 bedrock: arn:aws:bedrock:us-east-1:123456789012:application-inference-profile/abc123
from line 578
577578
578579The gateway enforces `availableModels` on every request, not only in the model picker, and AWS billing groups the spend by the tag you activated. Without the `match: {}` catch-all, a developer who matches no policy gets every model in the catalog and can bill either team's profile.
579580
580The costs: the config grows with teams times models, and the role that signs this upstream's Bedrock requests must also be allowed to invoke the `application-inference-profile/*` ARNs. That role is the gateway's principal, or with `assume_role` the role it assumes. See [`pricing`](/docs/en/claude-apps-gateway-config#pricing) for how the gateway's own spend meter prices these ids.
581The costs:
582
583* The config grows with teams times models
584* The role that signs this upstream's Bedrock requests must also be allowed to invoke the `application-inference-profile/*` ARNs. That role is the gateway's principal, or with `assume_role` the role it assumes.
585
586See [How requests are priced](/docs/en/claude-apps-gateway-spend-limits#how-requests-are-priced) for how the gateway's own spend meter prices these ids.
587
588#### Let a developer choose which team to bill
589
590To let a developer who works for two teams choose which team each session bills, give that pair of teams an IdP group and a policy of its own.
591
592**1. Add a group for the pair**
593
594In your IdP, add the developer to a new group, such as `team-platform-and-data`. If they're already signed in, have them run `/login` again, or wait for the next [silent refresh](/docs/en/claude-apps-gateway-config#managed), so the gateway sees the new group.
595
596**2. List its policy first**
597
598Put the group's policy above the single-team policies and allow both teams' ids in it. Copy in any other settings the two team policies set.
599
600```yaml theme={null}
601managed:
602 policies:
603 - match: {groups: [team-platform-and-data]}
604 cli: {availableModels: [platform-claude-opus-4-8, data-claude-opus-4-8], enforceAvailableModels: true}
605 - match: {groups: [team-platform]}
606 cli: {availableModels: [platform-claude-opus-4-8], enforceAvailableModels: true}
607 - match: {groups: [team-data]}
608 cli: {availableModels: [data-claude-opus-4-8], enforceAvailableModels: true}
609 - match: {}
610 cli: {availableModels: [claude-opus-4-8, claude-sonnet-4-6], enforceAvailableModels: true}
611```
612
613**3. Start each session on a team's id**
614
615Have the developer pass the id of the team the work is for, such as `claude --model data-claude-opus-4-8`.
616
617The gateway applies the [first policy that matches](/docs/en/claude-apps-gateway-config#managed), so a developer in only the two team groups gets the `team-platform` policy. Their sessions on the data team's id fail with `is not in your role's availableModels allowlist`, naming Claude Code's default model and not the id they typed. If you list both team groups in one policy's `groups` instead, everyone in either team can bill either team's profile.
618
619In the gateway's own [spend limits](/docs/en/claude-apps-gateway-spend-limits#set-a-cap), the developer has one total and one cap per period, by default the lowest of their groups' caps, whichever id a session uses. To keep one team's lower cap from stopping work for the other, set a per-user cap for the developer.
581620
582621## Next steps
583622
No line in this hunk matches that.