mirror of
https://github.com/anthropics/claude-code.git
synced 2026-08-13 02:12:26 -06:00
Roy Arsan
843297f6b1
Reference artifacts accompanying the Gateway-on-AWS walkthrough (https://code.claude.com/docs/en/claude-apps-gateway-on-aws), sibling to the existing examples/gateway/gcp assets: - setup.sh: scripts the walkthrough end to end via the aws CLI (security groups, IAM roles, ECR image build/push with gateway.yaml baked in, private-subnet RDS for PostgreSQL, Secrets Manager secrets, ECS Fargate service behind an internal ALB) - Dockerfile: distroless runtime image for the gateway; the Claude Code release binary is verified against an operator-supplied sha256 - gateway.yaml.example: config template (Bedrock upstream, Okta IdP) - terraform/: module provisioning the same architecture (ECS track) Provided as a working example to adapt, not a supported production deployment.
28 lines
1.3 KiB
Plaintext
28 lines
1.3 KiB
Plaintext
# Copy to terraform.tfvars and edit. terraform.tfvars is gitignored (see .gitignore).
|
|
|
|
region = "us-east-1" # a region where Bedrock serves the Claude models you need
|
|
|
|
# Prerequisite networking (NOT created by this module): the VPC and two+ private
|
|
# subnets in different AZs with outbound internet via a NAT gateway.
|
|
vpc_id = "vpc-..."
|
|
private_subnet_ids = ["subnet-...a", "subnet-...b"]
|
|
|
|
# The only source the ALB admits on 443. Must not overlap the private subnets
|
|
# above — hosts in the ALB subnets are trusted_proxies (gateway.yaml) and could
|
|
# spoof client IPs via X-Forwarded-For.
|
|
corporate_cidr = "10.0.0.0/8"
|
|
|
|
# ACM certificate for your internal gateway hostname (the host in gateway.yaml's
|
|
# public_url), imported or issued by AWS Private CA.
|
|
acm_certificate_arn = "arn:aws:acm:..."
|
|
|
|
image_tag = "<version>" # REQUIRED — the tag you build and push as linux/amd64 with
|
|
# gateway.yaml baked in (setup.sh tags <version>-cfg<sha8>;
|
|
# see README Deploy)
|
|
|
|
# Okta OIDC client secret: REQUIRED — uncomment and set it (Terraform creates the
|
|
# secret version; the ECS tasks inject `gateway-oidc-client-secret` at start, so
|
|
# without a version they fail with ResourceInitializationError). Leave empty only
|
|
# if you add the secret version out-of-band.
|
|
# oidc_client_secret = "..."
|