GS Neotek's Adoption of Claude Code on Amazon Bedrock: Lightweight User Control Without an LLM Gateway

As an AWS Premier Partner, GS Neotek supports numerous customers with cloud modernization and generative AI adoption. As organizations scale, per-user cost control and security management have become essential requirements when deploying coding assistants.

Traditionally, an LLM Gateway was introduced to meet these requirements, but this entails development effort, maintenance burden, ongoing infrastructure costs, and vulnerability risks associated with open-source solutions. In particular, open-source gateways such as LiteLLM have reported serious security issues, including authentication bypasses and SQL injection, requiring caution.

GS Neotek proposes a lightweight cost control architecture as an alternative to an LLM Gateway. Instead of intercepting requests in real time via a proxy, this approach periodically aggregates Amazon Bedrock model invocation logs to block users who exceed their budget in near real time.

Key components are as follows:

• Cost Calculation: Extract identity.arn and token usage (inputTokenCount, outputTokenCount, etc.) from logs stored in S3 or CloudWatch Logs via Bedrock Model Invocation Logging to calculate per-user costs.
• Blocking Logic: Identify users whose aggregated costs exceed the budget and restrict their access.
• Constraints: This architecture does not support pre-request enforcement, and due to log ingestion and batch intervals, there is a delay of several minutes before blocking takes effect. Additionally, all calls must go through the bedrock-runtime path; direct calls to the Anthropic API, for example, are not logged and thus excluded from control.

This approach is suitable for mid-sized organizations of around 200 people or those seeking a pilot deployment before fully implementing a gateway. It offers an alternative that allows for the rapid adoption of coding assistants and management of cost risks without building complex infrastructure.