devopsy.kinsta.cloud

Tag: single sign-on

Anthropic Adds Enterprise Gateway to Simplify Claude Code Access on AWS and Google Cloud

Anthropic introduced a self-hosted gateway this week that lets enterprises run Claude Code on Amazon Bedrock and Google Cloud without the credential sprawl and manual setup that have typically come with deploying AI coding tools at scale.

The Claude apps gateway is a single, stateless container that organizations deploy on their own infrastructure and back with a PostgreSQL database. It centralizes identity, policy enforcement, usage tracking, and spend management for Claude Code, addressing a problem that will sound familiar to anyone who has tried to roll out a developer tool across a large engineering org: Every new hire needs a cloud credential, every laptop needs the right settings pushed to it, and finance needs a way to see who’s spending what.

Before the gateway, none of that was centralized. IT teams provisioned a credential per developer, manually distributed configuration, and stitched together separate tooling just to get visibility into spend. That’s a lot of overhead for something that should be straightforward.

What the Gateway Actually Does

The gateway sits between developers and the underlying model infrastructure, handling five things:

Identity. The gateway acts as an OpenID Connect relying party, working with Google Workspace, Microsoft Entra ID, Okta, or any standards-compliant OIDC provider. It issues short-lived sessions instead of long-lived secrets stored on developer machines — a meaningful security improvement in its own right. Onboarding a new developer means adding them to the identity provider. Offboarding means removing them. No credential cleanup, no orphaned API keys floating around.

Policy. Admins define managed settings once, on the server. Clients pick up that policy automatically at sign-in, and the gateway enforces it on every request. Allowed models and default settings can be adjusted centrally, rather than chasing down individual machine configurations.

Telemetry. Every request is stamped with a usage metric, which the gateway relays via OTLP to a collector controlled by the organization. That data remains on the company’s own infrastructure and is subject to its retention schedule.

Routing. The gateway holds the upstream credential and routes inference traffic to the Claude API, Amazon Bedrock, or Google Cloud, with optional failover between providers.

Spend caps. Organizations can set daily, weekly, and monthly limits that apply at the org, group, or individual level.

Anthropic built the gateway into the same Claude binary developers already installed, so the /login flow is gateway-aware out of the box. Settings apply automatically at sign-in, and policy gets enforced consistently without extra configuration on the client side.

Worth noting what the gateway doesn’t do: it doesn’t send inference traffic or usage data to Anthropic unless an organization specifically configures it to use the Claude API. For Bedrock or Google Cloud deployments, that data stays put. Anthropic is also publishing the protocol that the gateway uses, enabling other gateway developers to build compatible implementations.

Why This Matters for Engineering Teams

For platform and DevOps teams, the appeal here is less about any single feature and more about consolidation. Identity, policy, telemetry, routing, and cost control have typically required separate tooling, separate dashboards, and separate processes to keep in sync. Folding all of that into a single container that an organization already controls significantly reduces the operational surface area.

It also addresses a real friction point in AI tool rollouts: the gap between what security and finance teams need (visibility, control, audit trails) and what developers want (a tool that just works without jumping through credential hoops). The gateway’s SSO-based onboarding and offboarding model handles both at once.

Mitch Ashley, VP and practice lead for software lifecycle engineering and AI-native software engineering at The Futurum Group, sees this as a significant shift in who controls the control layer. “Enterprise identity, policy, cost attribution, and spend caps now ship as first-party infrastructure for Claude Code,” he said. “The model provider is claiming the access and cost layer that third-party gateways and in-house tooling used to hold.”

Ashley also flagged the bigger question platform teams need to ask. “For platform teams, the real question is whether per-vendor gateways or a neutral control point govern a multi-model estate,” he said. “This makes one coding tool manageable at scale. It does not govern what agents do, and that is the control problem that still decides enterprise autonomy.”

Getting Started

Deployment involves downloading the Claude Code CLI binary and pointing a gateway.yaml configuration file at the organization’s OIDC issuer and upstream credential, and registering one OIDC app with the identity provider. Rolling it out to client machines means setting the forceLoginMethod and forceLoginGatewayUrl parameters in managed-settings.json. Clients connect to the gateway automatically on first boot.

The gateway is available now, with full documentation on Anthropic’s developer site.

For organizations already running Claude Code through Bedrock or Google Cloud — or considering it — this is the kind of infrastructure update that doesn’t change what the tool does, but changes how manageable it is to run at scale. That’s often the difference between a pilot program and something engineering leadership is willing to stand behind.

July 1, 2026
strongDM Extends Access Management as Code Efforts

strongDM today announced it has added an application programming interface (API) and software development kits for Go, Java, Python, Ruby and other programming languages for involving the single sign-on (SSO) capabilities of its infrastructure access management platform, in addition to adding support for command-line interfaces (CLIs) exposed by cloud service providers.

At the same time, strongDM has integrated its namesake platform with third-party secrets management tools such as Vault from HashiCorp as well as platforms such as PagerDuty’s incident management platform and Slack messaging tools.

The access management platform can now also support any internal web applications and database platforms including DB2i, CitusDB, Oracle 11g, 12c, and 19c, Sybase ASE and IQ.

Finally, the company has made enhancements to existing protocols including Mongo Atlas, SSH certificate-based authentication and SSH port forwarding, and added support for Windows remote desktop protocol (RDP) network-level authentication (NLA) and integration with other SSO tools such as Auth0 and VMware Identity One.

Company CEO Elizabeth Zalman said strongDM, unlike other SSOs, is designed from the ground up to be incorporated within a developer’s workflow. The goal is to enable developers to manage access as code in the same way they manage infrastructure as code, she said.

In general, access management is usually the last stage of automation to be addressed by DevOps teams. However, with most DevOps teams now working from home to help combat the spread of the COVID-19 pandemic, there has been a sharp rise in the number of organizations seeking to automate access management as an alternative to managing virtual private networking (VPN) software, said Zalman.

Historically, many IT organizations have relied on Microsoft Active Directory (AD) or the Lightweight Directory Access Protocol (LDAP) to manage access. As an alternative, strongDM has been making a case for its platform since 2015. The company recently raised an additional $17 million in funding and claims to have more than 100 customers using its platform in production environments, including Peloton, SoFi and Betterment.

It’s unclear whether DevOps teams are extending their existing workflows to include access management. However, as DevOps teams grow weary of using custom scripts to extend those workflows, Zalman said eventually they’ll look for a more consistent approach to automating access management. A major factor in that decision is the fact that most employees won’t be coming back to the office in the same numbers they did prior to the pandemic, even after a vaccine is discovered and distributed.

At the same time, more DevOps teams are moving to embrace best DevSecOps practices, which inevitably will encompass access management. In fact, as part of that transition, it’s probable most DevOps teams will conclude the way access is currently managed is simply too antiquated to continue.

November 16, 2020
The Accelerating Cloud Wars

Enterprises have embraced cloud computing at a phenomenal clip, according to newly-released report, A for Adoption, from cloud access security broker provider Bitglass.

Over the past five years, the report found cloud penetration grew from 24% (in 2014) to 86% of organizations today. Last year, that adoption rate was 81%. Yet, while cloud has helped enterprises to reduce IT capital expenditures and become more agile in meeting business demands, these organizations need to be cognizant of the impact the shift to the cloud has on securing user access—something the report hints as an area where organizations lack.

For instance, the Bitglass report found, of the 86% of organizations that adopted cloud, only 34% of those have implemented single sign-on (SSO). In addition to tracking SSO usage, Bitglass uncovered adoption rates for a host of different cloud-based tools, including Microsoft Office 365, Google’s G Suite, Amazon Web Services (AWS), Slack, Salesforce, Box and ServiceNow.

The annual report highlighted the rapid increase in the adoption of a number of services, such as Salesforce and Slack, which respectively increased by 55% and 44%.

The survey also found that Google’s G Suite, with a 33% adoption rate, is still struggling to regain headway on Microsoft Office 365 and that productivity suite’s 79% adoption rate. At 82%, financial services organizations are the fourth largest adopters of Office 365, while 79% of healthcare organizations have done so.

Those enterprises that have deployed AWS increased by 43% in one year, reaching 20% adoption across all industries this year. Not surprisingly, the technology industry is the leading implementer of AWS at a 32% rate and is also the leading industry using Slack at 79%.

One of the greatest challenges when it comes to effectively managing and securing access to the cloud is access management. Interestingly, only 34% of enterprises have implemented SSO for cloud access. However, the amount of SSO adoption varies significantly from industry to industry.

For instance, the adoption of SSO in financial services grew nearly 41% year over year, while in healthcare that growth reached 30%. However, the technology industry hasn’t embraced SSO much more, having reached a 33% adoption rate. Interestingly, education led SSO adoption at 61%, with the government firmly in second with 46%.

The adoption of SSO also varied by organizational size. As it turned out, larger organizations are the leading adopters of SSO. In fact, 64% of large firms said they utilize SSO, which is nearly 50% more than what medium-sized organizations reported. That’s more than twice the adoption of small organizations.

The Bitglass report is based on the company’s scanned analysis of cloud to identify which cloud services were in use across a sample of more than 138,000 companies. According to the company, the analysis included productivity suites such as Office 365, G Suite and messaging apps such as Slack, as well as file-sharing apps such as Box.

— George V. Hulme

November 11, 2019