Claude Code for 120+ engineers, with per-team cost control on Amazon Bedrock

Omar El Hachimi designed and built the AWS platform that lets AXA engineers use Claude Code through Amazon Bedrock: company sign-in, usage tracked per person, a budget per team with a hard cap, and costs charged back to cost centres. 120+ engineers in 9 teams use it, and the platform's figures match the AWS bill within 0.3%.

Role Technical lead, AWS platform

120+engineers in 9 teams (Oct 2026)

340,000+requests tracked (Sep 2026)

0.3%gap between tracked costs and the AWS bill

1 entryin a configuration file to add a team

Context

AXA's engineers wanted Claude Code. Three groups had to say yes before a pilot could start.

Security required company sign-in, data kept in an EU region and an allow-list of MCP servers. Finance required every euro to be traceable to a person and a team, with a hard limit per team. Engineering wanted the tool without friction.

How it works

Sign inThe engineer logs in with the company account.
Use ClaudeRequests go to Claude on Amazon Bedrock, in an EU region.
TrackEach request is priced and recorded for the person and the team.
ControlAlerts near the budget; access blocked at the cap.
ReportCosts are charged back; each team sees its spend.

What I built

Sign-in and access. A laptop launcher exchanges the company SAML login for temporary AWS credentials. Each team gets its own IAM role and cost-tagged inference profiles per model tier, in an EU region.
Metering. Bedrock invocation logs stream through CloudWatch and Kinesis to a Lambda function that prices every request by token type and attributes it to a user and a team.
Quotas. Spend and limits live in DynamoDB. Alerts fire as a team approaches its budget, access is blocked at the cap, and if a limit cannot be read, access is denied. Budgets reset each month.
Chargeback and self-service. Costs are charged back to the right cost centre. A command-line tool and dashboards let each user and team see their own spend.
Team factory. One entry in a configuration file creates a team's roles, inference profiles, budget and dashboard with CloudFormation. Managed settings and the MCP allow-list reach laptops through device management.
The pilot itself. Onboarding, support, power-user sessions and a comparison of access models, then the technical review and the go/no-go brief for the programme sponsors.

Design choices

Start with the people who have to say yes

Security and finance decide whether a pilot starts. Identity, EU residency and per-team budgets were built before anything else, so the pilot could start with their agreement.

Fail closed

If a limit cannot be read, access is denied. A quota system that fails open is a bill nobody approved.

Check the numbers against something real

Tracked costs are reconciled with the AWS bill. That is what lets finance charge costs back to cost centres with confidence.

Stack

Amazon Bedrock · Claude Code · AWS Lambda (Python) · Kinesis · DynamoDB · CloudWatch · SNS · EventBridge · IAM, STS, SAML · CloudFormation · GitHub Actions

Questions

How do you control Claude Code costs on Amazon Bedrock?

Give each team its own IAM role and cost-tagged inference profiles, stream Bedrock invocation logs to a function that prices every request by token type (including cache reads and writes), store spend and limits per team and per user, alert before the limit, block access at the cap, and charge costs back to cost centres. Omar El Hachimi built this for AXA's Claude Code pilot; its figures match the AWS bill within 0.3%.

How can engineers use Claude Code with company sign-in?

A launcher on the laptop exchanges the company SAML login for temporary AWS credentials and points Claude Code at Amazon Bedrock, so there are no personal API keys and every request is tied to a person and a team.