Curtis Branum

Doing DevOps in D.C.

Claude ExecJanuary 15th, 2026

Claude Exec is a CLI tool I made with two goals in mind:

  1. Run Claude Code from a local container in order to create a security boundary
  2. Bill pay-as-you-go usage to my AWS Account

Security

The basic idea of the security boundary is that we are reducing the "blast radius" by:

  1. Running Claude Code in an ephemeral environment
  2. Giving Claude its own AWS Role/Policies
  3. Only exposing local files that Claude needs to know about for the working session
  4. Only exposing the environment variables that Claude needs to know about for the working session
The finer details of how it all works can be found in the README.

Billing

This is more of a personal preference. You could certainly use the tool with a Claude subscription if you wanted to with some minor config changes. As an AWS customer, I prefer to just pay for my Claude Code usage through my regular AWS Bill.

© Curtis Branum