One read of Claude Developer Platformapi-20261015T023718Z
2 pages moved out of 779 read.
Pages moved
2
significant first
Pages read
779
in this capture
Captured
02:37 UTC
Corpus hash
46fda4e79984
corpus-hash
What this read moved
1-2 of 2api/claude-platform-on-aws-iam-actions Changed · +111 / -116 lines
from line 290
290290
291291## Route-to-action mapping
292292
293The following tables list every route on Claude Platform on AWS and the IAM action required to call it. Each IAM action also authorizes requests that use the `anthropic-beta` header; beta variants of a route do not require a separate IAM action. CloudTrail classifies each action as either a Data event (high-volume, data-plane operations) or a Management event (control-plane operations). Vault and webhook actions are classified as Management events because they hold secrets (vault credentials and webhook signing secrets) and benefit from default-on audit logging. Workspace, external key, telemetry destination, and compliance actions are also classified as Management events because they are organization-scoped control-plane operations. All other actions, including inference, batch, model, file, skill, user profile, and the remaining Claude Managed Agents actions, are classified as Data events.
293The following table lists every route on Claude Platform on AWS and the IAM action required to call it. Each IAM action also authorizes requests that use the `anthropic-beta` header; beta variants of a route do not require a separate IAM action. CloudTrail classifies each action as either a Data event (high-volume, data-plane operations) or a Management event (control-plane operations). Vault and webhook actions are classified as Management events because they hold secrets (vault credentials and webhook signing secrets) and benefit from default-on audit logging. Workspace, external key, telemetry destination, and compliance actions are also classified as Management events because they are organization-scoped control-plane operations. All other actions, including inference, batch, model, file, skill, user profile, and the remaining Claude Managed Agents actions, are classified as Data events.
294294
295| Method | Route | IAM action | CloudTrail event type |
296| -------- | ---------------------------------------------------- | -------------------------------- | --------------------- |
297| `POST` | `/v1/messages` | `CreateInference` | Data |
298| `POST` | `/v1/messages/count_tokens` | `CountTokens` | Data |
299| `POST` | `/v1/messages/batches` | `CreateBatchInference` | Data |
300| `GET` | `/v1/messages/batches` | `ListBatchInferences` | Data |
301| `GET` | `/v1/messages/batches/{id}` | `GetBatchInference` | Data |
302| `GET` | `/v1/messages/batches/{id}/results` | `GetBatchInference` | Data |
303| `POST` | `/v1/messages/batches/{id}/cancel` | `CancelBatchInference` | Data |
304| `DELETE` | `/v1/messages/batches/{id}` | `DeleteBatchInference` | Data |
305| `GET` | `/v1/models` | `ListModels` | Data |
306| `GET` | `/v1/models/{id}` | `GetModel` | Data |
307| `POST` | `/v1/files` | `CreateFile` | Data |
308| `GET` | `/v1/files` | `ListFiles` | Data |
309| `GET` | `/v1/files/{id}` | `GetFile` | Data |
310| `GET` | `/v1/files/{id}/content` | `GetFile` | Data |
311| `DELETE` | `/v1/files/{id}` | `DeleteFile` | Data |
312| `POST` | `/v1/skills` | `CreateSkill` | Data |
313| `GET` | `/v1/skills` | `ListSkills` | Data |
314| `GET` | `/v1/skills/{id}` | `GetSkill` | Data |
315| `DELETE` | `/v1/skills/{id}` | `DeleteSkill` | Data |
316| `POST` | `/v1/skills/{id}/versions` | `UpdateSkill` | Data |
317| `GET` | `/v1/skills/{id}/versions` | `GetSkill` | Data |
318| `GET` | `/v1/skills/{id}/versions/{version}` | `GetSkill` | Data |
319| `GET` | `/v1/skills/{id}/versions/{version}/content` | `GetSkill` | Data |
320| `DELETE` | `/v1/skills/{id}/versions/{version}` | `UpdateSkill` | Data |
321| `POST` | `/v1/user_profiles` | `CreateUserProfile` | Data |
322| `GET` | `/v1/user_profiles` | `ListUserProfiles` | Data |
323| `GET` | `/v1/user_profiles/{id}` | `GetUserProfile` | Data |
324| `POST` | `/v1/user_profiles/{id}` | `UpdateUserProfile` | Data |
325| `POST` | `/v1/user_profiles/{id}/enrollment_url` | `CreateUserProfileEnrollmentUrl` | Data |
326| `POST` | `/v1/organizations/workspaces` | `CreateWorkspace` | Management |
327| `GET` | `/v1/organizations/workspaces` | `ListWorkspaces` | Management |
328| `GET` | `/v1/organizations/workspaces/{id}` | `GetWorkspace` | Management |
329| `POST` | `/v1/organizations/workspaces/{id}` | `UpdateWorkspace` | Management |
330| `POST` | `/v1/organizations/workspaces/{id}/archive` | `ArchiveWorkspace` | Management |
331| `POST` | `/v1/organizations/external_keys` | `RegisterKey` | Management |
332| `GET` | `/v1/organizations/external_keys` | `ListKeys` | Management |
333| `GET` | `/v1/organizations/external_keys/{id}` | `GetKey` | Management |
334| `POST` | `/v1/organizations/external_keys/{id}` | `UpdateKey` | Management |
335| `DELETE` | `/v1/organizations/external_keys/{id}` | `DisableKey` | Management |
336| `GET` | `/v1/compliance/activities` | `ListComplianceActivities` | Management |
337| `POST` | `/v1/agents` | `CreateAgent` | Data |
338| `GET` | `/v1/agents` | `ListAgents` | Data |
339| `GET` | `/v1/agents/{id}` | `GetAgent` | Data |
340| `POST` | `/v1/agents/{id}` | `UpdateAgent` | Data |
341| `POST` | `/v1/agents/{id}/archive` | `ArchiveAgent` | Data |
342| `GET` | `/v1/agents/{id}/versions` | `GetAgent` | Data |
343| `POST` | `/v1/sessions` | `CreateSession` | Data |
344| `GET` | `/v1/sessions` | `ListSessions` | Data |
345| `GET` | `/v1/sessions/{id}` | `GetSession` | Data |
346| `POST` | `/v1/sessions/{id}` | `UpdateSession` | Data |
347| `POST` | `/v1/sessions/{id}/archive` | `ArchiveSession` | Data |
348| `DELETE` | `/v1/sessions/{id}` | `DeleteSession` | Data |
349| `GET` | `/v1/sessions/{id}/events` | `GetSession` | Data |
350| `POST` | `/v1/sessions/{id}/events` | `UpdateSession` | Data |
351| `GET` | `/v1/sessions/{id}/events/stream` | `GetSession` | Data |
352| `GET` | `/v1/sessions/{id}/resources` | `GetSession` | Data |
353| `GET` | `/v1/sessions/{id}/resources/{id}` | `GetSession` | Data |
354| `POST` | `/v1/sessions/{id}/resources` | `UpdateSession` | Data |
355| `POST` | `/v1/sessions/{id}/resources/{id}` | `UpdateSession` | Data |
356| `DELETE` | `/v1/sessions/{id}/resources/{id}` | `UpdateSession` | Data |
357| `POST` | `/v1/environments` | `CreateEnvironment` | Data |
358| `GET` | `/v1/environments` | `ListEnvironments` | Data |
359| `GET` | `/v1/environments/{id}` | `GetEnvironment` | Data |
360| `POST` | `/v1/environments/{id}` | `UpdateEnvironment` | Data |
361| `POST` | `/v1/environments/{id}/archive` | `ArchiveEnvironment` | Data |
362| `DELETE` | `/v1/environments/{id}` | `DeleteEnvironment` | Data |
363| `GET` | `/v1/environments/{id}/work` | `GetEnvironment` | Data |
364| `GET` | `/v1/environments/{id}/work/poll` | `ProcessEnvironmentWork` | Data |
365| `GET` | `/v1/environments/{id}/work/{work_id}` | `GetEnvironment` | Data |
366| `GET` | `/v1/environments/{id}/work/stats` | `GetEnvironment` | Data |
367| `POST` | `/v1/environments/{id}/work/{work_id}` | `ProcessEnvironmentWork` | Data |
368| `POST` | `/v1/environments/{id}/work/{work_id}/ack` | `ProcessEnvironmentWork` | Data |
369| `POST` | `/v1/environments/{id}/work/{work_id}/heartbeat` | `ProcessEnvironmentWork` | Data |
370| `POST` | `/v1/environments/{id}/work/{work_id}/stop` | `ProcessEnvironmentWork` | Data |
371| `POST` | `/v1/vaults` | `CreateVault` | Management |
372| `GET` | `/v1/vaults` | `ListVaults` | Management |
373| `GET` | `/v1/vaults/{id}` | `GetVault` | Management |
374| `POST` | `/v1/vaults/{id}` | `UpdateVault` | Management |
375| `POST` | `/v1/vaults/{id}/archive` | `ArchiveVault` | Management |
376| `DELETE` | `/v1/vaults/{id}` | `DeleteVault` | Management |
377| `GET` | `/v1/vaults/{id}/credentials` | `GetVault` | Management |
378| `POST` | `/v1/vaults/{id}/credentials` | `UpdateVault` | Management |
379| `GET` | `/v1/vaults/{id}/credentials/{id}` | `GetVault` | Management |
380| `POST` | `/v1/vaults/{id}/credentials/{id}` | `UpdateVault` | Management |
381| `POST` | `/v1/vaults/{id}/credentials/{id}/archive` | `UpdateVault` | Management |
382| `DELETE` | `/v1/vaults/{id}/credentials/{id}` | `UpdateVault` | Management |
383| `POST` | `/v1/memory_stores` | `CreateMemoryStore` | Data |
384| `GET` | `/v1/memory_stores` | `ListMemoryStores` | Data |
385| `GET` | `/v1/memory_stores/{id}` | `GetMemoryStore` | Data |
386| `POST` | `/v1/memory_stores/{id}` | `UpdateMemoryStore` | Data |
387| `POST` | `/v1/memory_stores/{id}/archive` | `ArchiveMemoryStore` | Data |
388| `DELETE` | `/v1/memory_stores/{id}` | `DeleteMemoryStore` | Data |
389| `POST` | `/v1/memory_stores/{id}/memories` | `UpdateMemoryStore` | Data |
390| `GET` | `/v1/memory_stores/{id}/memories` | `GetMemoryStore` | Data |
391| `GET` | `/v1/memory_stores/{id}/memories/{id}` | `GetMemoryStore` | Data |
392| `POST` | `/v1/memory_stores/{id}/memories/{id}` | `UpdateMemoryStore` | Data |
393| `DELETE` | `/v1/memory_stores/{id}/memories/{id}` | `UpdateMemoryStore` | Data |
394| `GET` | `/v1/memory_stores/{id}/memory_versions` | `GetMemoryStore` | Data |
395| `GET` | `/v1/memory_stores/{id}/memory_versions/{id}` | `GetMemoryStore` | Data |
396| `POST` | `/v1/memory_stores/{id}/memory_versions/{id}/redact` | `UpdateMemoryStore` | Data |
397| `GET` | `/v1/webhooks` | `ListWebhooks` | Management |
398| `GET` | `/v1/webhooks/{id}` | `GetWebhook` | Management |
399| `POST` | `/v1/webhooks` | `CreateWebhook` | Management |
400| `POST` | `/v1/webhooks/{id}` | `UpdateWebhook` | Management |
401| `DELETE` | `/v1/webhooks/{id}` | `DeleteWebhook` | Management |
402| `POST` | `/v1/webhooks/{id}/regenerate_signing_secret` | `RotateWebhookSecret` | Management |
403
404The telemetry destination routes are also available on Claude Platform on AWS:
405
406295| Method | Route | IAM action | CloudTrail event type |
407296| -------- | ------------------------------------------------------------------------- | ------------------------------------------- | --------------------- |
297| `POST` | `/v1/messages` | `CreateInference` | Data |
298| `POST` | `/v1/messages/count_tokens` | `CountTokens` | Data |
299| `POST` | `/v1/messages/batches` | `CreateBatchInference` | Data |
300| `GET` | `/v1/messages/batches` | `ListBatchInferences` | Data |
301| `GET` | `/v1/messages/batches/{id}` | `GetBatchInference` | Data |
302| `GET` | `/v1/messages/batches/{id}/results` | `GetBatchInference` | Data |
303| `POST` | `/v1/messages/batches/{id}/cancel` | `CancelBatchInference` | Data |
304| `DELETE` | `/v1/messages/batches/{id}` | `DeleteBatchInference` | Data |
305| `GET` | `/v1/models` | `ListModels` | Data |
306| `GET` | `/v1/models/{id}` | `GetModel` | Data |
307| `POST` | `/v1/files` | `CreateFile` | Data |
308| `GET` | `/v1/files` | `ListFiles` | Data |
309| `GET` | `/v1/files/{id}` | `GetFile` | Data |
310| `GET` | `/v1/files/{id}/content` | `GetFile` | Data |
311| `DELETE` | `/v1/files/{id}` | `DeleteFile` | Data |
312| `POST` | `/v1/skills` | `CreateSkill` | Data |
313| `GET` | `/v1/skills` | `ListSkills` | Data |
314| `GET` | `/v1/skills/{id}` | `GetSkill` | Data |
315| `DELETE` | `/v1/skills/{id}` | `DeleteSkill` | Data |
316| `POST` | `/v1/skills/{id}/versions` | `UpdateSkill` | Data |
317| `GET` | `/v1/skills/{id}/versions` | `GetSkill` | Data |
318| `GET` | `/v1/skills/{id}/versions/{version}` | `GetSkill` | Data |
319| `GET` | `/v1/skills/{id}/versions/{version}/content` | `GetSkill` | Data |
320| `DELETE` | `/v1/skills/{id}/versions/{version}` | `UpdateSkill` | Data |
321| `POST` | `/v1/user_profiles` | `CreateUserProfile` | Data |
322| `GET` | `/v1/user_profiles` | `ListUserProfiles` | Data |
323| `GET` | `/v1/user_profiles/{id}` | `GetUserProfile` | Data |
324| `POST` | `/v1/user_profiles/{id}` | `UpdateUserProfile` | Data |
325| `POST` | `/v1/user_profiles/{id}/enrollment_url` | `CreateUserProfileEnrollmentUrl` | Data |
326| `POST` | `/v1/organizations/workspaces` | `CreateWorkspace` | Management |
327| `GET` | `/v1/organizations/workspaces` | `ListWorkspaces` | Management |
328| `GET` | `/v1/organizations/workspaces/{id}` | `GetWorkspace` | Management |
329| `POST` | `/v1/organizations/workspaces/{id}` | `UpdateWorkspace` | Management |
330| `POST` | `/v1/organizations/workspaces/{id}/archive` | `ArchiveWorkspace` | Management |
331| `POST` | `/v1/organizations/external_keys` | `RegisterKey` | Management |
332| `GET` | `/v1/organizations/external_keys` | `ListKeys` | Management |
333| `GET` | `/v1/organizations/external_keys/{id}` | `GetKey` | Management |
334| `POST` | `/v1/organizations/external_keys/{id}` | `UpdateKey` | Management |
335| `DELETE` | `/v1/organizations/external_keys/{id}` | `DisableKey` | Management |
408336| `POST` | `/v1/organizations/telemetry_destinations` | `CreateAccountTelemetryDestination` | Management |
409337| `GET` | `/v1/organizations/telemetry_destinations` | `ListAccountTelemetryDestinations` | Management |
410338| `GET` | `/v1/organizations/telemetry_destinations/{id}` | `GetAccountTelemetryDestination` | Management |
from line 342
414342| `GET` | `/v1/organizations/telemetry_destinations/{id}/workspaces` | `ListAccountTelemetryDestinationWorkspaces` | Management |
415343| `POST` | `/v1/organizations/telemetry_destinations/{id}/workspaces/{workspace_id}` | `AddTelemetryDestinationWorkspace` | Management |
416344| `DELETE` | `/v1/organizations/telemetry_destinations/{id}/workspaces/{workspace_id}` | `RemoveTelemetryDestinationWorkspace` | Management |
345| `GET` | `/v1/compliance/activities` | `ListComplianceActivities` | Management |
346| `POST` | `/v1/agents` | `CreateAgent` | Data |
347| `GET` | `/v1/agents` | `ListAgents` | Data |
348| `GET` | `/v1/agents/{id}` | `GetAgent` | Data |
349| `POST` | `/v1/agents/{id}` | `UpdateAgent` | Data |
350| `POST` | `/v1/agents/{id}/archive` | `ArchiveAgent` | Data |
351| `GET` | `/v1/agents/{id}/versions` | `GetAgent` | Data |
352| `POST` | `/v1/sessions` | `CreateSession` | Data |
353| `GET` | `/v1/sessions` | `ListSessions` | Data |
354| `GET` | `/v1/sessions/{id}` | `GetSession` | Data |
355| `POST` | `/v1/sessions/{id}` | `UpdateSession` | Data |
356| `POST` | `/v1/sessions/{id}/archive` | `ArchiveSession` | Data |
357| `DELETE` | `/v1/sessions/{id}` | `DeleteSession` | Data |
358| `GET` | `/v1/sessions/{id}/events` | `GetSession` | Data |
359| `POST` | `/v1/sessions/{id}/events` | `UpdateSession` | Data |
360| `GET` | `/v1/sessions/{id}/events/stream` | `GetSession` | Data |
361| `GET` | `/v1/sessions/{id}/resources` | `GetSession` | Data |
362| `GET` | `/v1/sessions/{id}/resources/{id}` | `GetSession` | Data |
363| `POST` | `/v1/sessions/{id}/resources` | `UpdateSession` | Data |
364| `POST` | `/v1/sessions/{id}/resources/{id}` | `UpdateSession` | Data |
365| `DELETE` | `/v1/sessions/{id}/resources/{id}` | `UpdateSession` | Data |
366| `POST` | `/v1/environments` | `CreateEnvironment` | Data |
367| `GET` | `/v1/environments` | `ListEnvironments` | Data |
368| `GET` | `/v1/environments/{id}` | `GetEnvironment` | Data |
369| `POST` | `/v1/environments/{id}` | `UpdateEnvironment` | Data |
370| `POST` | `/v1/environments/{id}/archive` | `ArchiveEnvironment` | Data |
371| `DELETE` | `/v1/environments/{id}` | `DeleteEnvironment` | Data |
372| `GET` | `/v1/environments/{id}/work` | `GetEnvironment` | Data |
373| `GET` | `/v1/environments/{id}/work/poll` | `ProcessEnvironmentWork` | Data |
374| `GET` | `/v1/environments/{id}/work/{work_id}` | `GetEnvironment` | Data |
375| `GET` | `/v1/environments/{id}/work/stats` | `GetEnvironment` | Data |
376| `POST` | `/v1/environments/{id}/work/{work_id}` | `ProcessEnvironmentWork` | Data |
377| `POST` | `/v1/environments/{id}/work/{work_id}/ack` | `ProcessEnvironmentWork` | Data |
378| `POST` | `/v1/environments/{id}/work/{work_id}/heartbeat` | `ProcessEnvironmentWork` | Data |
379| `POST` | `/v1/environments/{id}/work/{work_id}/stop` | `ProcessEnvironmentWork` | Data |
380| `POST` | `/v1/vaults` | `CreateVault` | Management |
381| `GET` | `/v1/vaults` | `ListVaults` | Management |
382| `GET` | `/v1/vaults/{id}` | `GetVault` | Management |
383| `POST` | `/v1/vaults/{id}` | `UpdateVault` | Management |
384| `POST` | `/v1/vaults/{id}/archive` | `ArchiveVault` | Management |
385| `DELETE` | `/v1/vaults/{id}` | `DeleteVault` | Management |
386| `GET` | `/v1/vaults/{id}/credentials` | `GetVault` | Management |
387| `POST` | `/v1/vaults/{id}/credentials` | `UpdateVault` | Management |
388| `GET` | `/v1/vaults/{id}/credentials/{id}` | `GetVault` | Management |
389| `POST` | `/v1/vaults/{id}/credentials/{id}` | `UpdateVault` | Management |
390| `POST` | `/v1/vaults/{id}/credentials/{id}/archive` | `UpdateVault` | Management |
391| `DELETE` | `/v1/vaults/{id}/credentials/{id}` | `UpdateVault` | Management |
392| `POST` | `/v1/memory_stores` | `CreateMemoryStore` | Data |
393| `GET` | `/v1/memory_stores` | `ListMemoryStores` | Data |
394| `GET` | `/v1/memory_stores/{id}` | `GetMemoryStore` | Data |
395| `POST` | `/v1/memory_stores/{id}` | `UpdateMemoryStore` | Data |
396| `POST` | `/v1/memory_stores/{id}/archive` | `ArchiveMemoryStore` | Data |
397| `DELETE` | `/v1/memory_stores/{id}` | `DeleteMemoryStore` | Data |
398| `POST` | `/v1/memory_stores/{id}/memories` | `UpdateMemoryStore` | Data |
399| `GET` | `/v1/memory_stores/{id}/memories` | `GetMemoryStore` | Data |
400| `GET` | `/v1/memory_stores/{id}/memories/{id}` | `GetMemoryStore` | Data |
401| `POST` | `/v1/memory_stores/{id}/memories/{id}` | `UpdateMemoryStore` | Data |
402| `DELETE` | `/v1/memory_stores/{id}/memories/{id}` | `UpdateMemoryStore` | Data |
403| `GET` | `/v1/memory_stores/{id}/memory_versions` | `GetMemoryStore` | Data |
404| `GET` | `/v1/memory_stores/{id}/memory_versions/{id}` | `GetMemoryStore` | Data |
405| `POST` | `/v1/memory_stores/{id}/memory_versions/{id}/redact` | `UpdateMemoryStore` | Data |
406| `GET` | `/v1/webhooks` | `ListWebhooks` | Management |
407| `GET` | `/v1/webhooks/{id}` | `GetWebhook` | Management |
408| `POST` | `/v1/webhooks` | `CreateWebhook` | Management |
409| `POST` | `/v1/webhooks/{id}` | `UpdateWebhook` | Management |
410| `DELETE` | `/v1/webhooks/{id}` | `DeleteWebhook` | Management |
411| `POST` | `/v1/webhooks/{id}/regenerate_signing_secret` | `RotateWebhookSecret` | Management |
417412
418Routes not in these tables are not available on Claude Platform on AWS. The gateway denies any route not listed here by default.
413Routes not in this table are not available on Claude Platform on AWS. The gateway denies any route not listed here by default.
419414
420415<Note>
421416 Workspace, external key, and telemetry destination routes are the only Admin API routes available on Claude Platform on AWS. You can also create, update, or archive workspaces in the AWS Console or, with the Admin role, in the Claude Console. Encryption keys can also be registered and attached in the Claude Console.
from line 431
436431`AnthropicInferenceAccess` is the narrowest managed policy sufficient to run inference. It covers both synchronous and batch inference and, through the `Get*` and `List*` wildcards, grants read access to every API resource in the namespace, including Claude Managed Agents (CMA) resources (agents, sessions, environments, vaults, memory stores, and webhooks). This includes file content download through `GetFile` (see the [Files](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#files) note), skill content download through `GetSkill` (see the [Skills](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#skills) note), and memory contents through `GetMemoryStore`. Vault credential secrets and webhook signing secrets are not exposed: those fields are write-only and are never returned by `GetVault` or `GetWebhook` (see [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults)). `AnthropicInferenceAccess` does not grant file creation or deletion, skill management, user profile management, workspace mutation, encryption key management, telemetry destination management, or any Claude Managed Agents write action (create, update, archive, delete, process, or rotate). To exclude CMA reads, replace `AnthropicInferenceAccess` with a custom policy that enumerates only the specific non-CMA actions you need.
437432
438433<Note>
439 `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` all carry the `Get*` and `List*` wildcards, which grant read access to all content in the workspace: file bytes, skill content, batch results, session conversation history, and memory contents. The wildcards also grant `GetKey` and `ListKeys`, which read the organization's registered encryption key configurations (key ARNs and metadata, never key material). They also grant the account-scoped `GetUserProfile` and `ListUserProfiles`, which read user profiles. The `List*` wildcard also grants `ListComplianceActivities`, which reads the organization's compliance [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) once the Compliance API is enabled for the organization (see [Compliance](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#compliance)). They also grant `GetAccountTelemetryDestination`, `ListAccountTelemetryDestinations`, and `ListAccountTelemetryDestinationWorkspaces`, which read the organization's telemetry destinations but never their header values. Vault credential secrets and webhook signing secrets are not exposed; those fields are write-only and are never returned by `GetVault` or `GetWebhook`. If your principal should not read existing content, use a custom policy that enumerates only the actions you need.
434 `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` all carry the `Get*` and `List*` wildcards, which grant read access to all content in the workspace: file bytes, skill content, batch results, session conversation history, and memory contents. The wildcards also grant `GetKey` and `ListKeys`, which read the organization's registered encryption key configurations (key ARNs and metadata, never key material). They also grant the account-scoped `GetUserProfile` and `ListUserProfiles`, which read user profiles. The `List*` wildcard also grants `ListComplianceActivities`, which reads the organization's compliance [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) once the Compliance API is enabled for the organization (see [Compliance](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#compliance)). The wildcards also grant `GetAccountTelemetryDestination`, `ListAccountTelemetryDestinations`, and `ListAccountTelemetryDestinationWorkspaces`, which read the organization's telemetry destinations but never their header values. Vault credential secrets and webhook signing secrets are not exposed; those fields are write-only and are never returned by `GetVault` or `GetWebhook`. If your principal should not read existing content, use a custom policy that enumerates only the actions you need.
440435</Note>
441436
442437`AnthropicLimitedAccess` includes all Claude Managed Agents actions in addition to inference actions.
from line 501
506501```
507502
508503<Note>
509 The `aws-external-anthropic:*` wildcard in the first statement includes account-scoped actions (`CreateWorkspace`, `ListWorkspaces`, `ListComplianceActivities`, the external key actions, the account-scoped telemetry destination actions, and the user profile actions) that the workspace ARN constraint silently filters out. This is consistent with the "isolation" intent (the role cannot create workspaces, enumerate workspaces, manage encryption key registrations, read the compliance Activity Feed, create, read, or change telemetry destinations, or read or manage user profiles; it can still attach an already-registered key to its own workspace through `UpdateWorkspace`, and add its own workspace to a destination, or remove it from one, given the destination's ID), but the policy contains permissions that have no effect. If the role needs user profiles, add a separate `Allow` statement for the user profile actions with `Resource: "*"`. See [Provisioning automation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#provisioning-automation) for the account-scoped pattern.
504 The `aws-external-anthropic:*` wildcard in the first statement includes account-scoped actions (`CreateWorkspace`, `ListWorkspaces`, `ListComplianceActivities`, the external key actions, the account-scoped telemetry destination actions, and the user profile actions) that the workspace ARN constraint silently filters out. This is consistent with the "isolation" intent (the role cannot create workspaces, enumerate workspaces, manage encryption key registrations, read the compliance Activity Feed, or read or manage user profiles, and it cannot create, read, or change telemetry destinations; it can still attach an already-registered key to its own workspace through `UpdateWorkspace`, and add its own workspace to a destination, or remove it from one, given the destination's ID), but the policy contains permissions that have no effect. If the role needs user profiles, add a separate `Allow` statement for the user profile actions with `Resource: "*"`. See [Provisioning automation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#provisioning-automation) for the account-scoped pattern.
510505
511506 `CallWithBearerToken` and `AssumeConsole` are route-less actions that do not bind to a workspace ARN. The second statement grants them on `Resource: "*"` so the role can authenticate with an API key and open the Claude Console. Omit this statement if the role uses SigV4 only and does not need Claude Console access.
512507</Note>
build-with-claude/claude-platform-on-aws Changed · +1 / -1 lines
from line 573
573573* **HIPAA readiness:** Anthropic's HIPAA-ready program is not available. See [API and data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention).
574574* **Computer use and browser use toolsets:** `computer_toolset_20260801` and `browser_toolset_20260801` are not currently available on Claude Platform on AWS. The beta computer use tool versions remain available for the models listed under [Earlier tool versions](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool#earlier-tool-versions).
575575
576- **Admin API:** Workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`) and external key endpoints (register, get, list, update, and delete on `/v1/organizations/external_keys`, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek); keys are validated when attached to a workspace rather than through a validate endpoint), and the [telemetry destination endpoints](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#telemetry-destinations) are available. Other Admin API endpoints (organization members, workspace members, invites, API keys, usage reports, cost reports, and rate limit reports) are not currently available. View usage and cost data in the [Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console) instead. AWS IAM manages organization membership.
576- **Admin API:** Workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`), external key endpoints (register, get, list, update, and delete on `/v1/organizations/external_keys`, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek); keys are validated when attached to a workspace rather than through a validate endpoint), and the [telemetry destination endpoints](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#telemetry-destinations) are available. Other Admin API endpoints (organization members, workspace members, invites, API keys, usage reports, cost reports, and rate limit reports) are not currently available. View usage and cost data in the [Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console) instead. AWS IAM manages organization membership.
577577- **Workspace member management:** Adding or removing users from individual workspaces is not available. AWS IAM policies on workspace ARNs control access.
578578- **Claude Code workspace and Analytics API:** The Claude Code workspace with automatic rate limits is not available. Claude Code usage appears in the general usage view rather than a dedicated screen.
579579- **OAuth authentication:** Not supported. Use SigV4 or API key authentication.