Self-Hosted Claude Code (Amazon Bedrock)

Get your External ID

On app.antenna.dev, go to Settings > Sources > Claude Code > Connect. Find the Self-Hosted Claude Code method and copy the External ID.

Create an IAM policy

In your AWS account, create an IAM policy that grants read access to the S3 bucket where Bedrock writes invocation logs.

1. Go to IAM > Policies > Create policy.
2. Select the JSON tab and paste the following, replacing YOUR_BUCKET_NAME with the bucket where Bedrock writes invocation logs.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR_BUCKET_NAME",
        "arn:aws:s3:::YOUR_BUCKET_NAME/*"
      ]
    }
  ]
}

3. Name the policy (e.g., Antenna-Bedrock-ReadOnly) and create it.

Create an IAM role

Create an IAM role that allows Antenna to read from your S3 bucket. The trust policy below grants access to arn:aws:iam::134217665810:role/software-app-prod, which is the IAM role managed by Antenna.

1. Go to IAM > Roles > Create role.
2. Select Custom trust policy and paste the following, replacing YOUR_EXTERNAL_ID with the value from Step 1:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::134217665810:role/software-app-prod"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

3. Click Next and attach the policy you created in the previous step.
4. Name the role (e.g., Antenna-Bedrock-Role) and create it.
5. Copy the Role ARN from the role summary page.

Connect in Antenna

Back on app.antenna.dev, enter the following on the Model Invocation Logging (AWS Bedrock) setup page:

• Role ARN — the ARN of the IAM role you just created
• Region — the AWS region where Bedrock is configured (e.g. us-west-2)
• S3 Bucket Name — the bucket where Model Invocation Logging writes data
• S3 Prefix (optional) — if you configured a prefix in your Bedrock logging settings, enter it here

Click Connect to save. Antenna will begin reading invocation logs and data will appear within an hour.

Enable versioning on your source bucket

S3 Cross-Account Replication requires versioning on the source bucket.

1. Go to S3 > your source bucket > Properties.
2. Under Bucket Versioning, click Edit and select Enable.
3. Click Save changes.

Create a replication IAM role

Create an IAM role in your account that allows S3 to replicate objects to Antenna’s destination bucket.

1. Go to IAM > Roles > Create role.
2. Select Custom trust policy and paste the following:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

3. Click Next, then Create policy and paste the following inline policy. Replace YOUR_SOURCE_BUCKET with your bucket name and ANTENNA_DESTINATION_BUCKET_ARN with the ARN provided by Antenna:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetReplicationConfiguration",
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::YOUR_SOURCE_BUCKET"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObjectVersionForReplication",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersionTagging"
      ],
      "Resource": "arn:aws:s3:::YOUR_SOURCE_BUCKET/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ReplicateObject",
        "s3:ReplicateDelete",
        "s3:ReplicateTags"
      ],
      "Resource": "ANTENNA_DESTINATION_BUCKET_ARN/*"
    }
  ]
}

4. Name the role (e.g., Antenna-S3-Replication-Role) and create it.

Create a replication rule

1. Go to S3 > your source bucket > Management > Replication rules > Create replication rule.
2. Give the rule a name (e.g., Antenna-Replication).
3. Under Source bucket, scope the rule to the appropriate prefix for your data (e.g., AWSLogs/ for Bedrock invocation logs or q-developer-user-data/ for Amazon Q usage data).
4. Under Destination, select Specify a bucket in another account, and enter the Account ID and Destination Bucket ARN provided by Antenna.
5. Select the IAM role you created in the previous step.
6. Click Save.

Verify replication

After creating the rule, new objects written to your source bucket under the configured prefix will automatically replicate to Antenna’s bucket. You can verify replication status in the S3 > Management > Replication rules section of your bucket.

Backfill historical data with S3 Batch Replication (one-time, optional)

The replication rule created above only applies to new objects going forward. To replicate existing objects that were written before the rule was created, run a one-time S3 Batch Replication  job.

1. Go to S3 > your source bucket > Management > Replication rules.
2. Select the replication rule you created in the previous step, then choose Create Batch Replication job.
3. Under Batch manifest, select Generate manifest to let S3 automatically identify all eligible existing objects, or provide your own manifest using an S3 Inventory report or CSV file.
4. Under Batch replication filters, set the replication status filter to Not replicated to target only objects that have never been replicated.
5. Choose a destination for the Completion report so you can verify the results after the job finishes.
6. For the IAM role, select the same replication role you created earlier (e.g., Antenna-S3-Replication-Role).
7. Review the job details and choose Create job. The job starts in a Ready state — select the job and choose Run job to begin replication.
8. Monitor progress in S3 > Batch Operations. Once complete, review the completion report to confirm all objects replicated successfully.