Amazon Web Services published technical guidance on October 5, 2026, detailing how public sector entities and defense contractors can deploy Anthropic's agentic development tool, Claude Code, on Amazon Bedrock in AWS GovCloud (US) regions. The framework addresses strict compliance standards, including International Traffic in Arms Regulations, and supports Claude Opus 5.5, Claude Sonnet 5.5, and Claude Sonnet 5 across regulated environments.
Dual Endpoint Options
Amazon Bedrock in AWS GovCloud (US) relies on the Mantle inference engine with a Zero Operator Access architecture, supporting two separate endpoint surfaces for Claude Code integrations. The bedrock-runtime surface, available in both the US-West and US-East GovCloud regions, works via the AWS SDK and supports invocation logging, Amazon Bedrock Guardrails, and Agents. AWS recommends bedrock-runtime for enterprise implementations that require extensive audit trails and content filtering.
In contrast, the bedrock-mantle endpoint is available exclusively in AWS GovCloud (US-West). It supports the Anthropic Messages API natively, allowing development teams to utilize exclusive features such as Projects, background inference, and server-side tools.
Compliance and Security Architecture
The supported model versions hold specific federal compliance authorizations on Bedrock. Claude Opus 5.5 and Claude Sonnet 5.5 maintain FedRAMP Class D authorization, while Claude Sonnet 5 carries FedRAMP Class D along with Department of Defense Impact Level 4 and 5 (IL4/IL5) authorizations.
AWS reported that Claude Opus 5.5 was added to GovCloud on September 22, 2026, with zero data retention enabled by default and regional data residency. The built-in data protection across Bedrock in GovCloud ensures customer code and operational context are not logged, stored, used for AWS model training, or disclosed to third parties.
Governance and Cost Controls
Because Claude Code defaults to Claude Opus 5.5 when unconfigured, AWS advises organizations to explicitly pin model versions in environment variables or configuration files to prevent unintended token expenditure at Opus rates. AWS recommends setting Claude Sonnet 5.5 as the default choice for standard engineering tasks, saving Claude Opus 5.5 for heavy reasoning, and assigning Claude Sonnet 5 to workloads mandating IL4/IL5 authorization.
For enterprise access control, AWS recommends governing developer identity via AWS IAM Identity Center with temporary role credentials. Administrators can further manage usage by implementing CloudWatch-driven per-user token guardrails with notification thresholds, alongside prompt caching with five-minute or one-hour time-to-live settings for compatible models.
AI-generated editorial illustration; not a documentary photograph.
Source: AWS Details Claude Code Deployment on Amazon Bedrock in GovCloud (US)
SIGNAL TITANS
Leave a Reply