Updated October 25, 2026
· ~3 min read
In 2026 the question for an engineering team is no longer whether to use a coding agent but which, how to pay for it, and how to keep code and credentials under control. The five most teams evaluate have converged on similar capabilities (agents that read a repository, plan, edit many files, run tests and open pull requests) and diverged on where they live and how they bill.
Two developments matter especially for AWS shops. Claude Code runs against Amazon Bedrock with a single setting, using your IAM, your inference profiles and your guardrails. And since June 2026 OpenAI's Codex is available through Bedrock too, billed per token with no seat licences. That makes "run the agent through our own AWS account" a real option rather than an exception.
When Claude Code or Codex runs against Bedrock, prompts and code go to a model endpoint inside your AWS account rather than a separate vendor account, and every control you already have applies: IAM decides who can call which models, CloudTrail records it, Bedrock Guardrails can filter content, and application inference profiles let you attribute spend per team or per developer. Claude Code's documentation recommends a dedicated AWS account for it, pinning model versions with ANTHROPIC_DEFAULT_OPUS_MODEL and its siblings so a whole team moves to a new model when you decide, and optionally the 1-hour prompt cache. Billing is per token, which is cheaper than seats for occasional users and more expensive for heavy ones — measure for a month before deciding.
Pick two tools, three repositories that represent your work (a service, a frontend, an infrastructure repo) and ten real tickets each. Have the same engineers do half the tickets with each tool and record time to a mergeable pull request, review comments, and anything the agent did that you would not allow — touching files outside the task, running commands you would not run. Two weeks of this tells you more than any public benchmark, and it surfaces the permission and sandboxing policy you need whichever tool wins.
Question 1 of 2
Must code and prompts stay within your AWS account and controls?
For teams on AWS that care where code and prompts go, run Claude Code or Codex through Bedrock: per-token billing on your AWS bill, IAM and SSO instead of new accounts, model pinning, guardrails and per-team cost tracking with application inference profiles. Choose Cursor if your developers want an AI-first editor and you are comfortable with a SaaS subscription. Choose GitHub Copilot if you live in GitHub and want completions, chat and a cloud agent bundled with the platform you already pay for. Evaluate Kiro if you want an AWS-built agentic IDE with spec-driven development and IAM Identity Center for administration. Whatever you choose, trial two on your own repositories for two weeks — results on your code beat any leaderboard.
AI Coding Agents, Run Through Your AWS Account
Give your engineers Claude Code or Codex running against Amazon Bedrock in your own AWS account (SSO, pinned models, guardrails, per-team cost tracking and a usage policy) so adoption is fast and nobody's code goes somewhere it shouldn't.
Secure LLM Gateway on AWS
One governed way for every team to call AI models: keys held centrally, budgets and rate limits per team, fallbacks between providers, and hardening that assumes the gateway is a target.
Amazon Bedrock Enterprise AI Platform
A production AI platform on Amazon Bedrock: RAG pipelines, agent orchestration, guardrails, multi-tenant cost tracking, and the observability needed to run AI in production.
We work with startups and growing companies on AWS architecture decisions. Tell us about your situation and we will recommend the right approach.
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.