What happened
AWS has introduced a new architectural pattern and sample implementation, 'sample-remote-coding-agent,' that allows developers to run Claude Code as a remote agent using Amazon Bedrock AgentCore. This setup enables users to delegate coding tasks to isolated, disposable microVM environments within their own AWS VPCs. Once a task is assigned, the agent executes the work independently, allowing the developer to close their local machine. The process concludes with the agent submitting a GitHub pull request for human review. The system integrates with Amazon Bedrock for model inference, ensuring that all model calls inherit existing AWS security controls, such as audit logging via CloudTrail and geographic inference profiles.
The solution utilizes Amazon Bedrock AgentCore to create dedicated, isolated runtime sessions for each coding task. These sessions are ephemeral, with memory sanitized upon completion, preventing cross-task data leakage.
Authentication is handled via a GitHub App registered with AgentCore Identity, which issues short-lived (8-hour) user-to-server tokens. This eliminates the need for developers to store long-lived GitHub credentials on their local machines or within the agent environment.
The architecture includes a pre-execution screening layer using Amazon Bedrock . This layer is configured to block common attempts, malware requests, and the exposure of AWS access keys before a task is queued.
Network security is enforced by running the AgentCore runtime in private subnets with VPC endpoints. Internet access is restricted to a NAT gateway, and DNS traffic is filtered to prevent unauthorized model vendor access, ensuring that sensitive data does not traverse the public internet.
Source details: aws.amazon.com
Why it matters
This development is significant because it addresses the operational and security trade-offs inherent in running autonomous coding agents. By moving execution from a local laptop to an isolated, cloud-based runtime, developers can run multiple tasks concurrently without consuming local resources or exposing long-lived credentials on their personal machines. The architecture enforces security through short-lived GitHub tokens, VPC-based network isolation, and mandatory Amazon Bedrock that screen prompts for potential threats like jailbreak attempts or secret leakage. This 'hand-off' model promotes a more scalable and secure workflow for enterprise teams, ensuring that all AI-generated code changes remain subject to human oversight via mandatory pull request reviews. It effectively bridges the gap between local developer convenience and enterprise-grade infrastructure security.
By offloading tasks to the cloud, teams can parallelize development work, allowing multiple agents to operate simultaneously on different features or bug fixes without competing for local compute power.
The integration with Amazon Bedrock ensures that organizations can maintain compliance and auditability, as all model interactions are logged through standard AWS services like CloudTrail.
The requirement for human review via pull requests acts as a critical safety gate, mitigating the risk of autonomous agents introducing breaking changes or security vulnerabilities into a codebase.
The architecture provides a template for 'agentic' workflows that can be adapted for other coding agents, standardizing how enterprises manage, secure, and monitor AI-driven development tools.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').An agent must create a draft calendar event for Tuesday at 2 p.m. Which evidence would establish the requested result?
What to watch next
Users should monitor the cost implications of this architecture, as the deployment incurs charges for idle resources, including NAT gateways, interface endpoints, and AWS WAF, even when no coding tasks are active. Additionally, while the provided sample includes basic security , organizations must evaluate the 'whatToWatchDetails' regarding the limitations of these filters—specifically that they screen initial prompts but do not monitor the agent's ongoing interactions with repository files or command outputs. Future iterations or custom implementations will need to address these visibility gaps to ensure comprehensive security in production environments.
The deployment process is manual and requires specific AWS CDK bootstrapping, particularly in the us-east-1 region, regardless of the primary deployment region.
The current implementation does not include a hard spending cap; while it sets a default $200 budget alert, users are responsible for monitoring and manually cleaning up resources to avoid unexpected costs.
The security are limited to the initial prompt; they do not inspect the content of repository files or the output of commands executed by the agent, which remains a potential vector for indirect .
The system is currently provided as a sample implementation; organizations should conduct thorough security reviews and consider implementing more restrictive network policies, such as AWS Network Firewall domain allowlists, before deploying to production environments.