Extend Claude Code to remote sessions on Amazon Bedrock AgentCore

Amazon Web Services introduced an architecture and sample implementation to run Claude Code as an autonomous remote agent hosted on Amazon Bedrock AgentCore inside a customer's AWS account. As detailed in AWS Machine Learning Blog's report, the approach shifts developer execution from individual laptops to isolated cloud sandboxes where coding tasks execute asynchronously and conclude by opening a GitHub pull request.

This analysis breaks down the technical architecture, security guardrails, execution limits, and multi-model pipeline that AWS built for enterprise software teams looking to offload long-running development loops. The implementation targets developers and platform engineers managing private source repositories who need strict IAM boundaries, enterprise audit trails, and zero operator access while automating routine code creation and maintenance.

What shipped in Extend Claude Code to remote sessions

AWS released the sample-remote-coding-agent sample alongside an MCP plugin named sample-rca, enabling developers to dispatch tasks directly from Claude Code or a companion web console fronted by Amazon CloudFront and Amazon Cognito. When submitted, an AWS Lambda function screens the task description through Amazon Bedrock Guardrails using the ApplyGuardrail API on the Standard tier before writing the record to Amazon DynamoDB and enqueuing it in Amazon Simple Queue Service. A dispatcher Lambda function then triggers an AgentCore runtime session assigned specifically to the targeted repository.

Each session executes within a container image stored in Amazon Elastic Container Registry containing the Claude Code CLI, the Claude Agent SDK, git, and make. The execution environment runs inside a dedicated microVM provisioned with isolated CPU, memory, and filesystem boundaries located within the customer's Amazon Virtual Private Cloud. To interact with source control, the microVM obtains a short-lived user-to-server token from AgentCore Identity that expires after eight hours, ensuring credentials never persist across tasks.

What improved in Extend Claude Code to remote sessions

The remote model replaces local terminal execution with an asynchronous pipeline that frees local machine resources and prevents long-running coding loops from failing when a developer shuts their laptop. Tasks split cognitive steps across models on Amazon Bedrock: planning and final code reviews run on Claude Opus, while implementation code generation executes on Claude Sonnet. If code tests or reviews fail during verification, the agent loops back to planning for up to three attempts before delivering the branch.

Cross-session context is preserved through AgentCore memory, which catalogs past build idiosyncrasies, undocumented prerequisites, and repository patterns for subsequent sessions. When code generation passes the repository's native test commands, the agent pushes an agent branch and opens a GitHub pull request recording the exact verification command, exit code, and attempt count. If the commands do not exit cleanly, the agent marks the pull request as a draft, leaving final merge control to human engineers.

What you gain from Extend Claude Code to remote sessions

Organizations gain complete data boundary isolation by anchoring all generative calls inside Amazon Bedrock with AWS Identity and Access Management execution roles. Network paths remain confined to private VPC endpoints and AWS PrivateLink, preventing prompt completions or code fragments from routing across the public internet. Bedrock enforces compliance boundaries covering SOC, ISO, FedRAMP Moderate, and HIPAA eligibility while adhering to GDPR rules without third-party model training on customer inputs.

Operational security is strengthened by Bedrock's Mantle inference engine, which enforces zero operator access so AWS personnel cannot view prompts or model outputs. Engineering leads can activate zero data retention to stop ephemeral inference data from landing in durable AWS storage or reaching model providers. The sandbox confines all git write operations through a scoped GitHub App limited to Contents and Pull requests, authoring commits exclusively under the app's dedicated bot identity.

How to get Extend Claude Code to remote sessions

Developers manage their underlying Claude Code installation and model targeting directly through standard package management and CLI commands. Updating the local client requires invoking the vendor update or package manager:

claude update

npm install -g @anthropic-ai/claude-code

To switch models dynamically during an interactive session or select specific models for local experimentation, users supply the model command inside the Claude prompt:

/model claude-fable-5-1

/model fable

To run tasks pinned to a specific model from the shell prompt without entering interactive reconfiguration, developers supply the model flag during launch:

claude --model fable

To configure a default model across standard runs on the system, set the preferred model identifier in the environment configuration:

export CLAUDE_MODEL=fable

What to watch after Extend Claude Code to remote sessions

The sample-remote-coding-agent architecture is explicitly optimized for scoped feature tasks, bug fixes, and unit test generation on trusted repositories that define deterministic setup and test commands. Teams must not dispatch untrusted repositories into the runtime because the microVM executes the repository's own embedded shell commands, which the agent cannot sanitize. If a repository carries malicious or destructive scripts, the commands will execute inside the private VPC environment.

Cost forecasting presents an operational challenge because multi-step reasoning cycles across Claude Opus and Claude Sonnet consume dynamic token volumes. Furthermore, open-ended tasks without clear termination criteria will exhaust their three allowed execution cycles without completing the required feature work. Engineering teams must also monitor the eight-hour token expiration window and ensure internal build environments declare all dependencies cleanly in their repository configuration files.