caprockwaitlist ↓

Managed Headroom distribution for AWS Bedrock

Headroom that actually works on AWS Bedrock — deployed in your VPC in an hour.

A Terraform module and hardened container running on ECS Fargate inside your own AWS account. Context compression stacked with Bedrock prompt caching. Your data never leaves your VPC.

private pilot — we email you when a slot opens, nothing else

claude-code — 80×24
$ export ANTHROPIC_BEDROCK_BASE_URL=\
https://caprock.internal:4000
# the only change on the client
 
$ claude -p "why is the billing worker retrying?"
 
POST /v1/messages
├─ compress context trimmed pre-sign
├─ cachePoint injected — cache reads ~10%¹
└─ sigv4 re-signed · ECS task role
→ bedrock-runtime.us-east-1.amazonaws.com 200 OK
¹ Bedrock prompt-cache reads are billed at ~10% of input price — AWS docs

The number

The savings number goes here — once we've measured it.

This page ships with one central claim: what Caprock saves on a real Claude Code session over Bedrock — requests counted, region named, input and cache-read tokens before and after, dollar math shown. That measurement is running now.

We don't publish other people's benchmarks as ours. Headroom's own repo reports 60–95% token reduction — Headroom's own benchmark, not ours. Ours lands here when it's ours.

Upstream, today

Why stock Headroom fails on Bedrock

Not hypothetically — these are the open issues you hit in the first hour. Caprock exists because we fixed them and kept the fixes maintained.

How it works

A hard layer on top of Bedrock

your clients — Claude Code, agents, backendsone env var change
│

inside your VPC · your AWS account

internal ALB
│

caprock proxy · ECS Fargate

  • ├─ compress context
  • ├─ inject cachePoint
  • └─ re-sign SigV4 — IAM task role
│
AWS Bedrocksame account, same region

  • Your VPC, your account.

    The proxy runs on ECS Fargate behind an internal ALB. Your context never leaves; there is no Caprock SaaS in the request path.

  • IAM task role.

    Requests are re-signed with the task role — no static keys, and SSO / STS credentials just work.

  • One env var.

    Point ANTHROPIC_BEDROCK_BASE_URL at the ALB and you're done. Savings are visible in CloudWatch, monthly.

Do it yourself first

The complete guide is free

free · ungated · fortem.dev

Running Headroom on AWS Bedrock: the complete guide (2026)

Claude Code setup, STS/SSO auth, verifying cachePoint in CloudWatch, inference profiles — everything, whether you buy anything or not.

publishing — link lands here

Waitlist

Want this deployed and maintained in your VPC?

Leave your email. When the pilot opens, we reach out — no calls booked, no trial funnels, no drip campaign.