Claude Code Helper with Amazon Bedrock

Prerequisite: Understand Claude Code on Amazon Bedrock.

A comprehensive CLI tool that simplifies Amazon Bedrock setup and configuration for Claude Code. This utility streamlines the process of creating IAM users, managing API keys, and configuring inference profiles for Claude models, all while maintaining proper tagging for cost allocation and resource management.

In addition, with cost allocation tags, we may improve cost visibility and monitoring. More details on AWS Cost Allocation Tags.

Overview

The Claude Code Helper with Amazon Bedrock provides a streamlined workflow for:

1. Creating tagged IAM users with appropriate permissions for Amazon Bedrock and AWS user-defined tags

• The tags will be used to associated to the related Application Inference Profiles.
• Refer to create-user command.

2. Setting up Application Inference Profiles for Claude models with and AWS user-defined tags

• The tags must be matched with the related IAM user.
• Refer to create-profile command.
• To view the user & application inference detail, please refer to list-user-and-profile command.

3. Configuring Claude Code client with the correct API keys and settings

• To create an example Claude Code setting file (e.g. ~/.claude/example.settings.json) with generating 'API Key for Amazon Bedrock' from the related IAM user, and the application inference profile ARN (by tag mapping.)
• Please override the settings.json so as to enable the configuration, e.g.

mv ~/.claude/example.settings.json ~/.claude/settings.json 

4. Using Claude Code through configuration ~/.claude/settings.json with 'API key for Amazon Bedrock' and 'application inference profile', etc.

• Run claude to start AI coding, or open plugin in your IDE.

This solution enables developer teams to quickly configure and use Claude Code through Amazon Bedrock with proper access controls and cost management.

Architecture:

(1). IAM Users creation with specific tags, e.g.

• Team: The team name
• DeveloperId: The developer's identifier

(2) Application Inference Profiles creation with specific Claude global/cross-region inference profile and tags. Tags must be matched with the related IAM user.:

• Team: Matching the IAM user's team
• DeveloperId: Matching the IAM user's identifier

(3) Client Setup creates a example.settings.json file with necessary Claude Code settings, such as application inference profile ARN, API key for Amazon Bedrock. Once the example settings file is generated, user may review and override the formal one - ~/.claude/settings.json.

API Key Rotation: If an API key exists under the IAM user, 'Client Setup' process may delete it before creating a new one. Otherwise, just create one. Each key has a 90-day expiry date.

(4) Using Claude Code once overriding ~/.claude/settings.json.

• Permissions for Admin / Developer

For 'admin' commands, please ensure that your IAM User/Role may have below permissions:

{
            "Sid": "iamUserAccess",
            "Effect": "Allow",
            "Action": [
                "iam:CreateUser",
                "iam:PutUserPolicy",
                "iam:TagUser",
                "iam:ListUsers",
                "iam:ListUserTags",
                "iam:CreateServiceSpecificCredential",
                "iam:ListServiceSpecificCredentials",
                "iam:UpdateServiceSpecificCredential",
                "iam:DeleteServiceSpecificCredential",
                "iam:ResetServiceSpecificCredential"
            ],
            "Resource": "*"
        },
        {
            "Sid": "bedrockProfileAccess",
            "Effect": "Allow",
            "Action": [
                "bedrock:ListInferenceProfiles",
                "bedrock:CreateInferenceProfile",
                "bedrock:DeleteInferenceProfile",
                "bedrock:GetInferenceProfile",
                "bedrock:ListTagsForResource",
                "bedrock:TagResource"
            ],
            "Resource": "*"
        }
        ...

For 'client' commands, you may use the 'admin' permissions to run claude-code-helper client setup ... command, or, please configure with AWS credentials with the related IAM user access & secret keys.

Installation

# Clone the repository
git clone https://github.com/yourusername/claude-code-helper-with-amazon-bedrock.git
cd claude-code-helper-with-amazon-bedrock

# Install uv if not already installed (https://docs.astral.sh/uv/getting-started/installation/)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Sync dependencies from pyproject.toml
uv sync

# Install the package in development mode
uv pip install -e .

Usage

This CLI tool provides two main command groups:

• admin: Commands for administrators to set up IAM users and inference profiles
• client: Commands for developers to configure Claude Code with the correct settings

Getting Help

# Show general help
claude-code-helper --help

# Show help for specific commands
claude-code-helper admin --help
claude-code-helper client --help

Admin Commands

The admin commands are designed for administrators to set up the necessary AWS resources.

Create IAM User

Creates an IAM user with the necessary permissions to use Amazon Bedrock for Claude Code.

claude-code-helper admin create-user --username <username> --tags '{"Team": "DevTeam", "DeveloperId": "dev123"}'

Example:

This command:

1. Creates an IAM user with the specified username
2. Tags the user with the provided tags (lateron, the key of the tags can be activated on Cost Allocation Tags)
3. Creates and attaches an IAM policy with necessary Bedrock permissions
4. Displays the user information in a formatted table

Create Application Inference Profile

Creates an application inference profile for Amazon Bedrock that can be used with Claude Code.

claude-code-helper admin create-profile --name <profile-name> --tags '{"Team": "DevTeam", "DeveloperId": "dev123"}'

Example:

This command:

1. Lists available Claude foundation models (3.7 and above)
2. Prompts you to select a foundation model
3. Creates an application inference profile using the selected model
4. Tags the profile with all the provided tags (must be larger / equal than the tags on create-user.)
5. Displays the profile information in a formatted table

List Users and Profiles

Lists IAM users and application inference profiles that match specified tags.

# List all resources
claude-code-helper admin list-user-and-profile

# Filter by tags (using JSON format)
claude-code-helper admin list-user-and-profile --tags '{"Team": "DevTeam", "DeveloperId": "dev123"}'

# You can filter by any combination of tags
claude-code-helper admin list-user-and-profile --tags '{"Team": "DevTeam"}'
claude-code-helper admin list-user-and-profile --tags '{"Environment": "Production"}'

Example:

This command:

1. Finds IAM users with matching tags
2. Finds application inference profiles with matching tags
3. Displays them in a table with their relationships
4. Allows selection of a row to view detailed information

Client Commands

The client commands are designed for developers to configure Claude Code with the correct settings.

Setup Client

Sets up Claude Code client with the correct application inference profile and API key.

claude-code-helper client setup --username <username>

# Short form option
claude-code-helper client setup -u <username>

Example:

This command:

1. Finds the tags for the specified IAM user
2. Finds application inference profiles matching those tags
3. Displays available profiles and allows selection
4. Prompts for AWS region (defaults to us-east-1)
5. Creates or resets an API key for Amazon Bedrock
6. Configures the Claude Code settings file (~/.claude/settings.json)

Development

Setup Development Environment

# Clone the repository
git clone https://github.com/yourusername/claude-code-helper-with-amazon-bedrock.git
cd claude-code-helper-with-amazon-bedrock

# Install uv if not already installed
# pip install uv

# Create virtual environment and install dependencies using uv
uv venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# Sync dependencies from pyproject.toml including development dependencies
uv sync --all

# Install the package in development mode
uv pip install -e .

Running Tests

# Run all tests
pytest

# Run tests with verbose output
pytest -v

# Run tests with detailed output and print statements
pytest -xvs

# Run specific test files
pytest tests/test_cli.py
pytest tests/commands/test_admin_app.py
pytest tests/commands/test_client_app.py

# Run a specific test class
pytest tests/commands/test_client_app.py::TestClientSetup

# Run a specific test function
pytest tests/commands/test_client_app.py::TestClientSetup::test_client_setup_success

# Run tests with coverage report
pytest --cov=claude_code_helper

# Generate HTML coverage report
pytest --cov=claude_code_helper --cov-report=html

Reference

AWS Cost Allocation Tags

User-defined cost allocation tags are custom labels that you create and apply to your AWS resources to organize and track costs according to your business needs. Unlike AWS-generated tags, you have complete control over the tag keys and values. Reference AWS blog - Track, allocate, and manage your generative AI cost and usage with Amazon Bedrock

Official AWS Documentation: Using User-Defined Cost Allocation Tags

Activate Cost Allocation Tags

Step 1: Create IAM user and Application Inference Profile for Claude Code usage

1. Follow Installation and Admin Commands
2. Follow Setup Client and start using Claude Code with the created credentials
3. Wait for the user-defined tags populating on AWS Cost Allocation Tags (likely within 24hrs), then you can move on to next.

Step 2: Activating AWS-generated tags cost allocation tags

Follow up the guidance on Activating AWS-generated tags cost allocation tags to enable cost allocation tags. In my testing, it may take a couple of days until cost allocation tags being populated to cost data, across Cost Explorer, Cost and Usage Report, etc.

Step 3: Cost visibility & monitoring

Creates reports on Cost Explorer with grouping by related tags with daily view. Or, create specific AWS Cost Categories, then use them on AWS Budgets for cost monitoring.