Bedrock 経由の Claude Code の使用に SSO 認証をかける

git clone https://github.com/aws-solutions-library-samples/guidance-for-claude-code-with-amazon-bedrock.git

aws cloudformation deploy \
  --template-file deployment/infrastructure/cognito-user-pool-setup.yaml \
  --stack-name claude-code-user-pool \
  --capabilities CAPABILITY_IAM \
  --parameter-overrides \
    UserPoolName=<UserPool名> \
    DomainPrefix=<DomainPrefix> \
    CallbackURLs=http://localhost:8400/callback

cd source
poetry install
poetry run ccwb init

Profile Name
Choose a descriptive name for this deployment profile.
Suggested format: {project}-{environment}-{region}
Examples: acme-prod-us-east-1, internal-dev-us-west-2

? Profile name: ccwb0-dev-ap-northeast1

SSO Authentication
Enable Single Sign-On authentication via identity providers
(Okta, Auth0, Azure AD, AWS Cognito)

When disabled:
  • Uses AWS IAM roles for access control
  • Metrics will use anonymous tracking based on IAM identity
  • No user authentication required

? Enable SSO authentication? Yes

? Enter your OIDC provider domain:  (e.g., company.okta.com, company.auth0.com, login.microsoftonline.com/{tenant-id}/v2
.0, my-app.auth.us-east-1.amazoncognito.com, or my-app.auth-fips.us-gov-west-1.amazoncognito.com for GovCloud) https://<Domain Prefix>.auth.ap-northeast-1.amazoncognito.com
? Enter your Cognito User Pool ID for ap-northeast-1:  (case-sensitive) ap-northeast-1_******
? Enter your OIDC Client ID: <クライアント ID>

Credential Storage Method
Choose how to store AWS credentials locally:
  • Keyring: Uses OS secure storage (may prompt for password)
  • Session Files: Temporary files (deleted on logout)

? Select credential storage method: Keyring (Secure OS storage)

Federation Type Selection
Direct STS.
Cognito Identity Pool.

? Choose federation type: Direct STS

? Select AWS Region for infrastructure deployment (Cognito, IAM, monitoring): ap-northeast-1
? Stack base name (for CloudFormation): claude-code-auth

Monitoring and Usage Dashboards
Track Claude Code usage and performance metrics in CloudWatch
? Enable monitoring? Yes

VPC Configuration for Monitoring
The monitoring stack requires a VPC for the OpenTelemetry collector.

Searching for existing VPCs...
? Select VPC for monitoring infrastructure: Create new VPC

Optional: Configure HTTPS for secure telemetry
? Enable HTTPS with custom domain? No

Analytics Pipeline
Advanced user metrics and reporting through AWS Athena (~$5/month)
? Enable analytics? Yes
✓ Analytics pipeline will be deployed with your monitoring stack

Monthly Limit
? Monthly token limit per user (in millions): 225
  → Monthly limit: 225,000,000 tokens
  → Warning at 80%: 180,000,000 tokens
  → Critical at 90%: 202,500,000 tokens

Daily Limit (Bill Shock Protection)
Prevent runaway usage by setting a daily limit with a burst buffer.

Base daily limit (monthly ÷ 30): 7,500,000 tokens

Burst buffer allows daily variation above the average:
  • 5%  (strict)   → 7,875,000/day
  • 10% (default)  → 8,250,000/day
  • 25% (flexible) → 9,375,000/day
? Burst buffer percentage (5-25%): 10
  → Calculated daily limit: 8,250,000 tokens
? Custom daily limit (Enter to accept 8,250,000):

? Daily limit enforcement: alert (warn only)
? Monthly limit enforcement: block (deny access)

Quota Re-Check Interval
How often to re-check quota with cached credentials:
  • 0 = check every request (strictest, ~200ms latency)
  • 30 = every 30 minutes (default, recommended)
  • 60 = every hour (minimal impact)
? Quota check interval (minutes): 30

Windows Build Support
Build Windows binaries using AWS CodeBuild
? Enable Windows builds? Yes

Claude Cowork (Desktop) Support
Generate MDM configuration for Claude Cowork with third-party platforms
Enables Claude Desktop to use the same credential helper for Amazon Bedrock
? Generate CoWork 3P MDM configuration during packaging? Yes

Package Distribution
Choose how to distribute Claude Code packages to end users:
  • Presigned S3 URLs: Simple, no authentication (good for < 20 users)
  • Landing Page: IdP authentication with web UI (good for 20-100 users)
? Distribution method: Presigned S3 URLs (simple, no authentication)

? Select Claude model: Claude Sonnet 4.5 (Global, US)

? Select cross-region inference profile: JP Cross-Region - Japan CRIS - Asia Pacific (Tokyo), Asia Pacific (Osaka)

? Select source region for AWS configuration: ap-northeast-1

Provide an inference profile ARN for each model tier (press Enter to skip).
?   Opus inference profile ARN:
?   Sonnet inference profile ARN:
?   Haiku inference profile ARN:

Tags are applied to all deployed CloudFormation stacks.
? Would you like to add resource tags? No

poetry run ccwb deploy

poetry run ccwb package

sudo ln -s $(which podman) /usr/local/bin/docker

poetry run ccwb distribute

✓ Distribution package created successfully!

Distribution URL (expires in 48 hours):

https://claude-code-auth-distribution-<AccountId>.s3.amazonaws.com/packages/20260520-164850/claude-code-package-2026052
0-164850.zip?AWSAccessKeyId=<AccessKey>&Signature=th9z0...&Expires=1779436132

Package Details:
  Filename: claude-code-package-20260520-164850.zip
  SHA256: 55a66e539dcc58f69f3c97980ecb24d382a4f32028d48b7092c25a27b6aaf9ff
  Expires: 2026-05-22 16:48:52
  Size: 57.7 MB

Share this URL with developers to download the package.

Download and Installation Instructions:

For macOS/Linux:
1. Download (copy entire line):
   curl -L -o "claude-code-package-20260520-164850.zip" "https://claude-code-auth-distribution-<AccountId>.s3.amazonaws.com/packages/20260520-164850/claude-code-package-20260520-164850.zip?AWSAccessKeyId=<AccessKey>&Signature=th9z0...&Expires=1779436132"
2. Extract and install:
   unzip claude-code-package-20260520-164850.zip && cd claude-code-package && ./install.sh

For Windows PowerShell:
1. Download (copy entire line):
   Invoke-WebRequest -Uri "https://claude-code-auth-distribution-<AccountId>.s3.amazonaws.com/packages/20260520-164850/claude-code-package-20260520-164850.zip?AWSAccessKeyId=<AccessKey>&Signature=th9z0...&Expires=1779436132" -OutFile "claude-code-package-20260520-164850.zip"
2. Extract and install:
   Expand-Archive -Path "claude-code-package-20260520-164850.zip" -DestinationPath "."
   cd claude-code-package
   .\install.bat

poetry run ccwb destroy

⚠ Manual cleanup required for the following resources:

S3 Buckets (must be emptied first):
  • claude-code-auth-s3bucket-cfnartifactsbucket-qadplodmubgf
    aws s3 rm s3://claude-code-auth-s3bucket-cfnartifactsbucket-qadplodmubgf --recursive
    aws s3 rb s3://claude-code-auth-s3bucket-cfnartifactsbucket-qadplodmubgf

Other Resources:
  • AthenaWorkgroup (AWS::Athena::WorkGroup): claude-code-auth-analytics-workgroup
    Reason: Resource handler returned message: "Invalid request provided: WorkGroup claude-code-auth-analytics-workgroup
is not empty (Service: Athena, Status Code: 400, Request ID: c0869358-dfa2-42d9-91ba-594d71aab19d) (SDK Attempt Count: 
1)" (RequestToken: b36f8e9c-8863-efdf-3f16-d483973fdabc, HandlerErrorCode: InvalidRequest)

After manual cleanup, delete the failed stacks:
  aws cloudformation delete-stack --stack-name claude-code-auth-analytics --region ap-northeast-1
  aws cloudformation delete-stack --stack-name claude-code-auth-s3bucket --region ap-northeast-1