New serverless pattern - lambda-microvms-claude-code-agent by avladi · Pull Request #3180 · aws-samples/serverless-patterns

avladi · 2026-06-22T20:14:34Z

Summary

New pattern: AWS Lambda MicroVM Claude Code Agent — Deploy an AWS Lambda MicroVM with the Claude Code CLI, powered by Amazon Bedrock and reachable through an interactive shell.

Pattern details

Language: Python
Framework: AWS CLI + CloudFormation
Level: 200

Checklist

README.md follows _pattern-model format
example-pattern.json included
template.yaml (CloudFormation)
Architecture diagram (PNG)
deploy.sh automation script
connect.sh / connect.bat for shell access

bfreiberg · 2026-06-22T20:47:24Z

@@ -0,0 +1,113 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: AWS Lambda MicroVM with Claude Code CLI and AWS API MCP server


Suggested change

Description: AWS Lambda MicroVM with Claude Code CLI and AWS API MCP server

Description: Claude Code CLI and AWS API MCP server on AWS Lambda MicroVMs

bfreiberg · 2026-06-22T20:47:33Z

@@ -0,0 +1,243 @@
+# AWS Lambda MicroVM Claude Code Agent


Suggested change

# AWS Lambda MicroVM Claude Code Agent

# Claude Code Agent on AWS Lambda MicroVMs

bfreiberg · 2026-06-22T20:50:02Z

@@ -0,0 +1,243 @@
+# AWS Lambda MicroVM Claude Code Agent
+
+This pattern deploys a long-running Lambda MicroVM with the [Claude Code](https://code.claude.com) CLI baked into the image. The MicroVM is launched with the `SHELL_INGRESS` network connector, so you connect via an interactive shell and run `claude` directly inside the isolated Firecracker VM. Claude Code is preconfigured to use [Amazon Bedrock](https://aws.amazon.com/bedrock/) with Claude Haiku 4.5 — credentials are supplied at runtime by the MicroVM execution role, so no API key is ever stored in the image.


Suggested change

This pattern deploys a long-running Lambda MicroVM with the [Claude Code](https://code.claude.com) CLI baked into the image. The MicroVM is launched with the `SHELL_INGRESS` network connector, so you connect via an interactive shell and run `claude` directly inside the isolated Firecracker VM. Claude Code is preconfigured to use [Amazon Bedrock](https://aws.amazon.com/bedrock/) with Claude Haiku 4.5 — credentials are supplied at runtime by the MicroVM execution role, so no API key is ever stored in the image.

This pattern deploys a long-running Lambda MicroVM with the [Claude Code](https://code.claude.com) CLI baked into the image. The Lambda MicroVM is launched with the `SHELL_INGRESS` network connector, so you connect via an interactive shell and run `claude` directly inside the MicroVM. Claude Code is preconfigured to use [Amazon Bedrock](https://aws.amazon.com/bedrock/) with Claude Haiku 4.5 — credentials are supplied at runtime by the Lambda MicroVM execution role, so no API key is ever stored in the image.

Isn't Haiku 4.5 almost EOL?

bfreiberg · 2026-06-22T20:50:38Z

+![Lambda MicroVM Claude Code Agent diagram](images/lambda-microvm-claude-code-agent.png)
+
+1. **Image Build**: Lambda downloads the zip, executes the Dockerfile (installs Git, the Claude Code CLI, `uv`, and the AWS API MCP server; bakes in the Bedrock environment variables and the project-scope MCP config), waits for `/ready`, and takes a snapshot.
+2. **Run**: The MicroVM resumes rapidly from the snapshot with the execution role and the `SHELL_INGRESS` connector attached.


Suggested change

2. **Run**: The MicroVM resumes rapidly from the snapshot with the execution role and the `SHELL_INGRESS` connector attached.

2. **Run**: The Lambda MicroVM resumes rapidly from the snapshot with the execution role and the `SHELL_INGRESS` connector attached.

bfreiberg · 2026-06-22T20:51:45Z

+./connect.sh "${MICROVM_ID}"
+```
+
+## Using deploy.sh


Move to before the step by step guide

bfreiberg · 2026-06-22T20:51:53Z

+## Why the cross-region inference profile?
+
+Claude Haiku 4.5 is **not** available for in-region inference in `us-east-2`. The Dockerfile and the IAM policy therefore target the US cross-region inference profile `us.anthropic.claude-haiku-4-5-20251001-v1:0` (destination regions: us-east-1, us-east-2, us-west-2). The execution-role policy grants `bedrock:InvokeModel*` on both the inference profile and the underlying foundation model in each destination region.


bfreiberg · 2026-06-22T20:52:04Z

+
+Claude Haiku 4.5 is **not** available for in-region inference in `us-east-2`. The Dockerfile and the IAM policy therefore target the US cross-region inference profile `us.anthropic.claude-haiku-4-5-20251001-v1:0` (destination regions: us-east-1, us-east-2, us-west-2). The execution-role policy grants `bedrock:InvokeModel*` on both the inference profile and the underlying foundation model in each destination region.
+
+## Key Design Decisions


bfreiberg · 2026-06-22T20:52:27Z

+- **Shell-first**: `SHELL_INGRESS` provides an interactive shell. The port 8080 health endpoint is only for verifying the VM is up.
+- **AWS access via IAM only**: the AWS API MCP server uses the execution role's credentials through the boto3 default chain. What Claude can do in AWS is controlled entirely by the role's IAM policy (read-only by default), not by any baked-in key.
+
+## AWS API MCP server — AWS API access


bfreiberg · 2026-06-22T20:52:57Z

+**Letting Claude make changes.** To allow mutations, replace `ReadOnlyAccess` with a broader or custom policy on the execution role and remove `READ_OPERATIONS_ONLY` from `.mcp.json`, then redeploy.
+
+> **Security note**: `ReadOnlyAccess` is broad — it can read data across services (S3 object contents, DynamoDB items, etc.). For production, scope the execution role to a custom policy limited to the specific `Describe*`/`List*`/`Get*` actions and resources you actually want Claude to see. The MicroVM keeps blast radius contained, but the IAM policy is your real control plane.


- Fix ANTHROPIC_MODEL to use correct inference profile ID (us.anthropic.claude-sonnet-4-6) - Remove invalid ANTHROPIC_SMALL_FAST_MODEL env var - Update IAM policy ARNs to match actual Bedrock resource format - Rename policy/SID from Haiku to Sonnet - Update all documentation references from Sonnet 4 to Sonnet 4.6 - Add zip CLI prerequisite with Windows install instructions - Add region availability doc link to Step 1

…-agent directory

- Bump MinimumMemoryInMiB from 1024 to 4096 (2 vCPU baseline, bursts to 8) - Pre-warm MCP server at build time to compile Python bytecode

bfreiberg · 2026-06-25T09:09:06Z

@@ -0,0 +1,67 @@
+{
+  "title": "AWS Lambda MicroVM Claude Code Agent",


Suggested change

"title": "AWS Lambda MicroVM Claude Code Agent",

"title": "Claude Code Agent on AWS Lambda MicroVMs",

bfreiberg · 2026-06-25T09:09:29Z

+  },
+  "cleanup": {
+    "text": [
+      "bash cleanup.sh"


Suggested change

"bash cleanup.sh"

"<code>bash cleanup.sh</code>"

bfreiberg · 2026-06-25T09:09:39Z

@@ -0,0 +1,75 @@
+{
+    "title": "AWS Lambda MicroVM Claude Code Agent",


Suggested change

"title": "AWS Lambda MicroVM Claude Code Agent",

"title": "Claude Code Agent on AWS Lambda MicroVMs",

bfreiberg · 2026-06-25T09:10:35Z

+    "introBox": {
+        "headline": "How it works",
+        "text": [
+            "This pattern deploys a long-running Lambda MicroVM with the Claude Code CLI installed into the image. The MicroVM is launched with the SHELL_INGRESS network connector, so you connect via an interactive shell (AWS console or a WebSocket client) and run `claude` directly inside the isolated Firecracker VM.",


Suggested change

"This pattern deploys a long-running Lambda MicroVM with the Claude Code CLI installed into the image. The MicroVM is launched with the SHELL_INGRESS network connector, so you connect via an interactive shell (AWS console or a WebSocket client) and run `claude` directly inside the isolated Firecracker VM.",

"This pattern deploys a Lambda MicroVM with the Claude Code CLI installed into the image. The MicroVM is launched with the SHELL_INGRESS network connector, so you connect via an interactive shell (AWS console or a WebSocket client) and run `claude` directly inside the MicroVM.",

bfreiberg · 2026-06-25T09:11:07Z

@@ -0,0 +1,196 @@
+# Claude Code Agent on AWS Lambda MicroVMs
+
+This pattern deploys a long-running Lambda MicroVM with the [Claude Code](https://code.claude.com) CLI baked into the image. The Lambda MicroVM is launched with the `SHELL_INGRESS` network connector, so you connect via an interactive shell and run `claude` directly inside the MicroVM. Claude Code is preconfigured to use [Amazon Bedrock](https://aws.amazon.com/bedrock/) with Claude Sonnet 4.6 — credentials are supplied at runtime by the Lambda MicroVM execution role, so no API key is ever stored in the image.


Suggested change

This pattern deploys a long-running Lambda MicroVM with the [Claude Code](https://code.claude.com) CLI baked into the image. The Lambda MicroVM is launched with the `SHELL_INGRESS` network connector, so you connect via an interactive shell and run `claude` directly inside the MicroVM. Claude Code is preconfigured to use [Amazon Bedrock](https://aws.amazon.com/bedrock/) with Claude Sonnet 4.6 — credentials are supplied at runtime by the Lambda MicroVM execution role, so no API key is ever stored in the image.

This pattern deploys a Lambda MicroVM with the [Claude Code](https://code.claude.com) CLI baked into the image. The Lambda MicroVM is launched with the `SHELL_INGRESS` network connector, so you connect via an interactive shell and run `claude` directly inside the MicroVM. Claude Code is preconfigured to use [Amazon Bedrock](https://aws.amazon.com/bedrock/) with Claude Sonnet 4.6 — credentials are supplied at runtime by the Lambda MicroVM execution role, so no API key is ever stored in the image.

bfreiberg · 2026-06-25T09:11:57Z

+
+### Using a different model
+
+The model is set via the `ANTHROPIC_MODEL` environment variable in the [Dockerfile](src/Dockerfile). To use a different Claude model, change this value to another inference profile ID available in your account and update the Bedrock policy resources in `template.yaml` accordingly.


Duplicate to section below

bfreiberg · 2026-06-25T09:12:05Z

+
+   Claude calls AWS using the execution role's credentials. With the read-only default, a mutating request (e.g. "create an S3 bucket called …") is refused by `READ_OPERATIONS_ONLY` and would be denied by IAM anyway.
+
+### Using a different model


Duplicate to section above

julianwood assigned ellisms and julianwood Jun 22, 2026

bfreiberg requested changes Jun 22, 2026

View reviewed changes

New serverless pattern - lambda-microvms-claude-code-agent

bdb8afe

avladi force-pushed the avladi-feature-lambda-microvms-claude-code-agent branch from a2872f5 to bdb8afe Compare June 22, 2026 21:16

avladi and others added 6 commits June 22, 2026 21:49

Add final pattern file

3a2fa22

Delete lambda-microvms-claude-code-agent/ lambda-microvms-claude-code…

6c5f189

…-agent directory

Add final pattern file

52ff382

Update architecture diagram

54744fe

Increase MicroVM to 4GB/2vCPU and pre-warm MCP server

f2c052a

- Bump MinimumMemoryInMiB from 1024 to 4096 (2 vCPU baseline, bursts to 8) - Pre-warm MCP server at build time to compile Python bytecode

bfreiberg requested changes Jun 25, 2026

View reviewed changes

Remove duplicate model section, fix example-pattern title

d39dd1f

		@@ -0,0 +1,113 @@
		AWSTemplateFormatVersion: '2010-09-09'
		Description: AWS Lambda MicroVM with Claude Code CLI and AWS API MCP server

	Description: AWS Lambda MicroVM with Claude Code CLI and AWS API MCP server
	Description: Claude Code CLI and AWS API MCP server on AWS Lambda MicroVMs

	# AWS Lambda MicroVM Claude Code Agent
	# Claude Code Agent on AWS Lambda MicroVMs

		@@ -0,0 +1,243 @@
		# AWS Lambda MicroVM Claude Code Agent

		This pattern deploys a long-running Lambda MicroVM with the [Claude Code](https://code.claude.com) CLI baked into the image. The MicroVM is launched with the `SHELL_INGRESS` network connector, so you connect via an interactive shell and run `claude` directly inside the isolated Firecracker VM. Claude Code is preconfigured to use [Amazon Bedrock](https://aws.amazon.com/bedrock/) with Claude Haiku 4.5 — credentials are supplied at runtime by the MicroVM execution role, so no API key is ever stored in the image.

	2. Run: The MicroVM resumes rapidly from the snapshot with the execution role and the `SHELL_INGRESS` connector attached.
	2. Run: The Lambda MicroVM resumes rapidly from the snapshot with the execution role and the `SHELL_INGRESS` connector attached.

		## Why the cross-region inference profile?

		Claude Haiku 4.5 is not available for in-region inference in `us-east-2`. The Dockerfile and the IAM policy therefore target the US cross-region inference profile `us.anthropic.claude-haiku-4-5-20251001-v1:0` (destination regions: us-east-1, us-east-2, us-west-2). The execution-role policy grants `bedrock:InvokeModel*` on both the inference profile and the underlying foundation model in each destination region.


		Claude Haiku 4.5 is not available for in-region inference in `us-east-2`. The Dockerfile and the IAM policy therefore target the US cross-region inference profile `us.anthropic.claude-haiku-4-5-20251001-v1:0` (destination regions: us-east-1, us-east-2, us-west-2). The execution-role policy grants `bedrock:InvokeModel*` on both the inference profile and the underlying foundation model in each destination region.

		## Key Design Decisions

		Letting Claude make changes. To allow mutations, replace `ReadOnlyAccess` with a broader or custom policy on the execution role and remove `READ_OPERATIONS_ONLY` from `.mcp.json`, then redeploy.

		> Security note: `ReadOnlyAccess` is broad — it can read data across services (S3 object contents, DynamoDB items, etc.). For production, scope the execution role to a custom policy limited to the specific `Describe`/`List`/`Get*` actions and resources you actually want Claude to see. The MicroVM keeps blast radius contained, but the IAM policy is your real control plane.

		@@ -0,0 +1,67 @@
		{
		"title": "AWS Lambda MicroVM Claude Code Agent",

	"title": "AWS Lambda MicroVM Claude Code Agent",
	"title": "Claude Code Agent on AWS Lambda MicroVMs",

		@@ -0,0 +1,75 @@
		{
		"title": "AWS Lambda MicroVM Claude Code Agent",

	"This pattern deploys a long-running Lambda MicroVM with the Claude Code CLI installed into the image. The MicroVM is launched with the SHELL_INGRESS network connector, so you connect via an interactive shell (AWS console or a WebSocket client) and run `claude` directly inside the isolated Firecracker VM.",
	"This pattern deploys a Lambda MicroVM with the Claude Code CLI installed into the image. The MicroVM is launched with the SHELL_INGRESS network connector, so you connect via an interactive shell (AWS console or a WebSocket client) and run `claude` directly inside the MicroVM.",

		@@ -0,0 +1,196 @@
		# Claude Code Agent on AWS Lambda MicroVMs

		This pattern deploys a long-running Lambda MicroVM with the [Claude Code](https://code.claude.com) CLI baked into the image. The Lambda MicroVM is launched with the `SHELL_INGRESS` network connector, so you connect via an interactive shell and run `claude` directly inside the MicroVM. Claude Code is preconfigured to use [Amazon Bedrock](https://aws.amazon.com/bedrock/) with Claude Sonnet 4.6 — credentials are supplied at runtime by the Lambda MicroVM execution role, so no API key is ever stored in the image.


		### Using a different model

		The model is set via the `ANTHROPIC_MODEL` environment variable in the [Dockerfile](src/Dockerfile). To use a different Claude model, change this value to another inference profile ID available in your account and update the Bedrock policy resources in `template.yaml` accordingly.


		Claude calls AWS using the execution role's credentials. With the read-only default, a mutating request (e.g. "create an S3 bucket called …") is refused by `READ_OPERATIONS_ONLY` and would be denied by IAM anyway.

		### Using a different model

Uh oh!

Conversation

avladi commented Jun 22, 2026

Summary

Pattern details

Checklist

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants