---
type: "post"
id: "extend-claude-code-to-remote-sessions-on-amazon-e116a2"
slug: "extend-claude-code-to-remote-sessions-on-amazon-e116a2"
title: "Extend Claude Code to remote sessions on Amazon Bedrock AgentCore with security controls"
description: "AWS describes a sample that runs Claude Code tasks in isolated Amazon Bedrock AgentCore sessions and returns GitHub pull requests for human review."
retrieval_nugget: "AWS describes a sample that runs Claude Code tasks in isolated Amazon Bedrock AgentCore sessions and returns GitHub pull requests for human review. For teams experimenting with delegated coding work, the design makes the security boundary and the handoff visible: separate task environments, scoped credentials and a person deciding what ships."
published_at: "2026-11-07"
updated_at: "2026-11-07"
record_date: "2026-11-07"
date_kind: "published_at"
topics: ["claude","claude-code","github"]
entities: ["Amazon Web Services","Claude Code","Amazon Bedrock AgentCore","Amazon Bedrock Guardrails","AgentCore Identity","AgentCore Memory","Claude Opus","Claude Sonnet"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "AWS describes running Claude Code in remote Amazon Bedrock AgentCore sessions with security controls."
prior_refs: ["https://newruntime.com/posts/add-secure-web-search-to-claude-desktop-with-d272d0/"]
source_url: "https://aws.amazon.com/blogs/machine-learning/extend-claude-code-to-remote-sessions-on-amazon-bedrock-agentcore-with-security-controls"
source_urls: ["https://aws.amazon.com/blogs/machine-learning/extend-claude-code-to-remote-sessions-on-amazon-bedrock-agentcore-with-security-controls"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:extend-claude-code-to-remote-sessions-on-amazon-e116a2"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/extend-claude-code-to-remote-sessions-on-amazon-e116a2/","markdown":"https://newruntime.com/posts/extend-claude-code-to-remote-sessions-on-amazon-e116a2.md","json":"https://newruntime.com/posts/extend-claude-code-to-remote-sessions-on-amazon-e116a2.json"}
markdown_url: "https://newruntime.com/posts/extend-claude-code-to-remote-sessions-on-amazon-e116a2.md"
---

# Extend Claude Code to remote sessions on Amazon Bedrock AgentCore with security controls

## Retrieval answer

AWS describes a sample that runs Claude Code tasks in isolated Amazon Bedrock AgentCore sessions and returns GitHub pull requests for human review. For teams experimenting with delegated coding work, the design makes the security boundary and the handoff visible: separate task environments, scoped credentials and a person deciding what ships.

## Summary
AWS describes a sample that runs Claude Code tasks in isolated Amazon Bedrock AgentCore sessions and returns GitHub pull requests for human review. For teams experimenting with delegated coding work, the design makes the security boundary and the handoff visible: separate task environments, scoped credentials and a person deciding what ships.

## What happened
AWS’s post, “Extend Claude Code to remote sessions on Amazon Bedrock AgentCore with security controls,” presents the `sample-remote-coding-agent` implementation. Instead of leaving a coding task running on a developer’s laptop, the sample dispatches it to an AgentCore runtime session in the team’s AWS account. A task can be submitted from a web console or from Claude Code through a local Model Context Protocol server. AWS says the deployment takes 15–25 minutes and registering a repository takes another 8–12 minutes.

The flow queues a prompt after screening it with Amazon Bedrock Guardrails, stores task state in DynamoDB, and starts a runtime session for the registered repository. Each session runs in a microVM with isolated CPU, memory and filesystem. The container includes Claude Code CLI, the Claude Agent SDK, Git and Make. The agent gets a GitHub access token through AgentCore Identity, clones the repository, consults AgentCore memory for lessons from earlier tasks, and plans with Claude Opus on Amazon Bedrock. It writes code with Claude Sonnet, runs the repository’s own `setup` and `test` commands, and reviews its result with Claude Opus. The loop permits up to three attempts.

If it completes, the agent pushes a task branch and opens a pull request recording the verification command, exit code and number of attempts. A pull request remains a draft unless verification passes; the agent never merges. AWS recommends branch protection so a person reviews every change. Repository setup expects a root Makefile with `setup` and `test` targets or a package.json with corresponding scripts. The post frames scoped features, bug fixes and tests in trusted repositories as good fits; the sample stops after three attempts and is not intended for untrusted code.

AWS says model calls from the remote task use Amazon Bedrock as the sole provider and travel through a private endpoint, signed with the runtime IAM role. The runtime is in private VPC subnets and uses service endpoints for AWS dependencies. A NAT gateway provides access to GitHub and package registries, while outbound HTTPS is allowed by the security group. The sample’s DNS firewall blocks model-vendor domains, but AWS cautions that this denylist does not block other HTTPS traffic and suggests considering a domain allowlist for production. The prompt guardrail checks what a user submits, not prompt injection in repository files or command output. GitHub tokens expire after eight hours and are refreshed automatically; access is scoped to installed repositories and the authorizing user’s permissions.

## What the archive adds
New Runtime’s earlier coverage showed how Claude Desktop can use secure web search through Amazon Bedrock AgentCore ([October 2, 2026 note](https://newruntime.com/posts/add-secure-web-search-to-claude-desktop-with-d272d0/)). This is a new event on the same AWS agent platform: the earlier note concerned tool access, while this sample moves coding work into remote, isolated sessions and returns reviewable changes.

## Trend signal
This supports the pattern that agent security is moving toward runtime boundaries: [agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). AWS’s design relies on per-task microVMs, scoped IAM permissions, short-lived GitHub tokens and a human merge gate rather than treating prompt instructions as the main safeguard. The source also names a remaining gap: input screening does not inspect repository content or command output.

## Why now
AWS positions remote coding agents as a way to hand off tasks, run several in parallel and return to pull requests rather than keep work tied to one laptop. Its sample makes that workflow available as an account-deployed implementation, while keeping model calls on Bedrock and task execution within the customer’s AWS environment.

## Why it matters
The useful idea is not simply “run Claude Code in the cloud.” It is to make delegation a controlled transaction: a task gets a fresh execution environment, constrained credentials, bounded retries and a pull request that a person can inspect. Teams can adapt that shape even if they do not adopt this particular stack.

There are practical costs and trade-offs. AWS says the deployment continues to incur charges while idle for components such as NAT, interface endpoints, WAF, DNS Firewall, images and logs. The default $200 monthly Bedrock budget sends email alerts but does not cap spending. Less steering during execution and setup work also remain part of the pattern. Teams should therefore estimate infrastructure costs, constrain task scope and verify tests and diffs before merging, rather than equating a completed agent run with a safe change.

## Limits and uncertainty
AWS presents a sample implementation, not measured evidence that remote execution improves coding quality, throughput or cost. The post does not establish how often the three-attempt loop succeeds across repositories or how much human review each pull request requires. Its guardrail screens submitted prompts but does not inspect repository files or command output, and the DNS firewall is a denylist rather than a complete outbound traffic policy. Teams should validate isolation, permissions, network controls and operating costs against their own threat model before using the design in production.

## Skill to build now
Take one low-risk maintenance task in a trusted repository and write down its acceptance test before handing it to an agent: the exact `setup` and `test` commands, files it may change, and what a reviewer must see in the pull request. That exercise makes the task contract explicit and exposes whether your repository’s existing scripts are reliable enough for remote execution.

## Reader takeaway
AWS’s sample offers a concrete pattern for remote coding-agent work: isolate each task, limit credentials and authority, run repository checks, and make the pull request—not the agent’s claim of completion—the handoff. Its own limitations underline that runtime controls reduce some risks but do not replace code review or a deliberate network policy.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Claude Code](https://newruntime.com/topics/claude-code.md): Explore the claude-code topic hub.
- topic hub: [Github](https://newruntime.com/topics/github.md): Explore the github topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)