Appendix on Claude Code Wiki

Build-Out Timeline -- 12-Week Implementation

Mon, 01 Jan 0001 00:00:00 +0000

Build-Out Timeline – 12-Week Implementation#

Week-by-Week Schedule#

Weeks 1–2: Discovery and Infrastructure Design#

Infrastructure Workstream

CISO alignment meeting: define “no code leaves network” (Level 1, 2, or 3)
Design AWS account structure for Bedrock isolation
Design VPC endpoint + PrivateLink architecture
Evaluate LLM gateway options (LiteLLM vs. Kong vs. Portkey)
Begin Terraform for VPC endpoint and networking

Platform Engineering Workstream

Inventory top 5 codebases by developer count
Interview 2–3 senior engineers per codebase: “What do you always tell new developers? What patterns do people consistently get wrong?”
Identify Cohort 1 candidates (25 power users)

Change Management Workstream

Cloud Foundry to Claude Code Analogy Map

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Foundry to Claude Code Analogy Map#

For consultants coming from a Cloud Foundry background, these analogies help translate platform engineering concepts into the Claude Code domain.

Core Concept Mapping#

Cloud Foundry	Claude Code	Explanation
Org/Space structure	Settings hierarchy (managed → project → user)	Multi-level configuration with inheritance and isolation between teams
Buildpacks	Skills and CLAUDE.md conventions	Opinionated frameworks that encode best practices – developers get patterns by default
Service Broker catalog	Approved MCP servers	Curated set of external integrations available to developers, centrally managed
App manifest (manifest.yml)	Project `.claude/settings.json` + `CLAUDE.md`	Declarative configuration checked into the repo that defines how the tool interacts with the project
Platform operator	Platform engineering team managing `managed-settings.json`	Central team that owns the platform layer, sets policies, and enables developer self-service
`cf push`	Developer runs `claude` with everything pre-configured	The developer experience is simple because the platform handles complexity underneath
Stemcells / base images	Devcontainers / Coder workspace templates	Standardized environment that ensures consistent tooling across all developers
Diego cells	LLM Gateway + Bedrock	The compute layer that actually runs workloads, abstracted from the developer
UAA (User Account and Authentication)	SSO + gateway authentication	Centralized identity and access management
Quota plans	Per-team token budgets via LLM gateway	Resource limits that prevent any single team from consuming disproportionate capacity
App security groups	Deny rules in managed-settings.json	Network/access restrictions that define what the workload can and cannot reach
Route services / service mesh	LLM Gateway (LiteLLM / Kong AI)	Intermediary that handles routing, auth, logging, and policy enforcement
BOSH releases	Skills packaged as plugins	Versioned, distributable packages of capability
Cloud Controller API	Claude Code CLI + MCP protocol	The interface through which developers and automation interact with the platform
Logs / Loggregator	CloudTrail + gateway logs + CloudWatch	Multi-layer observability stack for audit, debugging, and cost tracking
Ops Manager tiles	MCP server integrations	Pre-built integrations that extend the platform’s capabilities

The Core Insight#

Claude Code without platform engineering is like giving 500 developers raw cf push access with no buildpacks, service brokers, or app manifests.

Reference Configurations

Mon, 01 Jan 0001 00:00:00 +0000

Reference Configurations#

managed-settings.json (Enterprise Baseline)#

Deploy to all developer machines via Mobile Device Management (MDM).

{
 "env": {
 "CLAUDE_CODE_USE_BEDROCK": "1",
 "ANTHROPIC_BEDROCK_BASE_URL": "https://llm-gateway.internal.corp.com/bedrock",
 "CLAUDE_CODE_SKIP_BEDROCK_AUTH": "1",
 "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1"
 },
 "cleanupPeriodDays": 14,
 "permissions": {
 "disableBypassPermissionsMode": "disable",
 "deny": [
 "Read(**/.env)",
 "Read(**/.env.*)",
 "Read(**/secrets/**)",
 "Read(**/.ssh/**)",
 "Read(**/credentials*)",
 "Bash(sudo:*)",
 "Bash(su:*)",
 "Bash(curl:*)",
 "Bash(wget:*)",
 "Bash(ssh:*)",
 "Bash(rm -rf:*)"
 ]
 },
 "allowManagedPermissionRulesOnly": false,
 "allowManagedHooksOnly": false,
 "strictKnownMarketplaces": []
}

File Locations#

Platform	Path
macOS	`/Library/Application Support/ClaudeCode/managed-settings.json`
Linux	`/etc/claude-code/managed-settings.json`
Windows	`C:\Program Files\ClaudeCode\managed-settings.json`

Developer Shell Environment Variables#

# /etc/profile.d/claude-code.sh

# Bedrock routing (also set in managed-settings.json env)
export CLAUDE_CODE_USE_BEDROCK=1
export ANTHROPIC_BEDROCK_BASE_URL='https://llm-gateway.internal.corp.com/bedrock'
export CLAUDE_CODE_SKIP_BEDROCK_AUTH=1
export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1

# Corporate CA cert for proxy (if applicable)
export NODE_EXTRA_CA_CERTS='/etc/ssl/certs/corp-ca-bundle.pem'

# Optional: Model overrides
# export ANTHROPIC_MODEL='claude-sonnet-4-5-20250929'
# export ANTHROPIC_DEFAULT_HAIKU_MODEL='us.anthropic.claude-haiku-4-5-20251001-v1:0'

Terraform: VPC Endpoint for Bedrock#

resource "aws_vpc_endpoint" "bedrock_runtime" {
 vpc_id = aws_vpc.main.id
 service_name = "com.amazonaws.${var.region}.bedrock-runtime"
 vpc_endpoint_type = "Interface"
 private_dns_enabled = true

 subnet_ids = var.private_subnet_ids
 security_group_ids = [aws_security_group.bedrock_endpoint.id]

 policy = jsonencode({
 Version = "2012-10-17"
 Statement = [
 {
 Effect = "Allow"
 Principal = "*"
 Action = [
 "bedrock:InvokeModel",
 "bedrock:InvokeModelWithResponseStream"
 ]
 Resource = "*"
 }
 ]
 })
}

resource "aws_security_group" "bedrock_endpoint" {
 name_prefix = "bedrock-endpoint-"
 vpc_id = aws_vpc.main.id

 ingress {
 from_port = 443
 to_port = 443
 protocol = "tcp"
 cidr_blocks = var.developer_subnet_cidrs
 description = "Allow HTTPS from developer subnets"
 }

 egress {
 from_port = 0
 to_port = 0
 protocol = "-1"
 cidr_blocks = ["0.0.0.0/0"]
 }
}

IAM Policy for Bedrock Access#

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "bedrock:InvokeModel",
 "bedrock:InvokeModelWithResponseStream",
 "bedrock:ListInferenceProfiles"
 ],
 "Resource": "*"
 }
 ]
}

Attach to the IAM role used by the LLM gateway service, not to individual developer users.