This pattern deploys a Lambda MicroVM with the Claude Code CLI installed into the image. The MicroVM is launched with the SHELL_INGRESS network connector, so you connect via an interactive shell (AWS console or a WebSocket client) and run `claude` directly inside the MicroVM.

Claude Code is preconfigured to use Amazon Bedrock with Claude Sonnet 4.6. No API key is stored in the image — the Lambda MicroVM execution role supplies AWS credentials at runtime through the standard AWS SDK credential chain.

The image also bakes in the AWS API MCP server (awslabs.aws-api-mcp-server), letting Claude run live AWS API calls from inside the VM. It uses the same execution-role credentials via the boto3 default chain — no keys — and runs read-only by default (the managed ReadOnlyAccess policy plus READ_OPERATIONS_ONLY). What Claude can do in AWS is controlled entirely by the role's IAM policy.

The MicroVM image is built from a Dockerfile that Lambda executes server-side. During the build the Claude CLI, uv, and the AWS API MCP server are installed, and the application signals readiness via the /ready lifecycle hook, after which Lambda takes a snapshot for rapid resume. The VM auto-suspends when idle and resumes on demand.