---
title: IAM actions for Claude Platform on AWS
url: https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions
description: IAM action reference for controlling access to Claude Platform on AWS through AWS policies.
---

Claude Platform on AWS uses AWS IAM for access control. Every API route maps to an IAM action in the `aws-external-anthropic` namespace. This page lists all actions, the routes each action authorizes, and the managed policies available for common access patterns. For platform setup and authentication, see [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws).

## Service details

| Attribute              | Value                    |
| ---------------------- | ------------------------ |
| **IAM service prefix** | `aws-external-anthropic` |
| **Resource types**     | `workspace`              |

Workspace ARN format:

```text wrap
arn:aws:aws-external-anthropic:{region}:{account-id}:workspace/{workspace-id}
```

The ARN region is always populated and matches the region the workspace is bound to. The resource segment is the tagged workspace ID (`wrkspc_...`), the same value you pass in the `anthropic-workspace-id` header.

## Actions

Actions follow the AWS `VerbNoun` convention and use verb discipline so that `Get*` and `List*` wildcards produce a clean read-only boundary.

### Inference

| Action            | Routes authorized                |
| ----------------- | -------------------------------- |
| `CreateInference` | `POST /v1/messages`              |
| `CountTokens`     | `POST /v1/messages/count_tokens` |

### Batch processing

| Action                 | Routes authorized                                                            |
| ---------------------- | ---------------------------------------------------------------------------- |
| `CreateBatchInference` | `POST /v1/messages/batches`                                                  |
| `GetBatchInference`    | `GET /v1/messages/batches/{id}`<br />`GET /v1/messages/batches/{id}/results` |
| `ListBatchInferences`  | `GET /v1/messages/batches`                                                   |
| `CancelBatchInference` | `POST /v1/messages/batches/{id}/cancel`                                      |
| `DeleteBatchInference` | `DELETE /v1/messages/batches/{id}`                                           |

<Note>
  `GetBatchInference` authorizes both reading batch metadata and downloading batch results. The `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` policies' `Get*` wildcards include this action.
</Note>

### Models

| Action       | Routes authorized     |
| ------------ | --------------------- |
| `GetModel`   | `GET /v1/models/{id}` |
| `ListModels` | `GET /v1/models`      |

### Files

| Action       | Routes authorized                                      |
| ------------ | ------------------------------------------------------ |
| `CreateFile` | `POST /v1/files`                                       |
| `GetFile`    | `GET /v1/files/{id}`<br />`GET /v1/files/{id}/content` |
| `ListFiles`  | `GET /v1/files`                                        |
| `DeleteFile` | `DELETE /v1/files/{id}`                                |

<Note>
  `GetFile` authorizes both metadata and content download. A principal with read-only access can download file bytes, not just list files.
</Note>

### Skills

| Action        | Routes authorized                                                                                                                                             |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `CreateSkill` | `POST /v1/skills`                                                                                                                                             |
| `GetSkill`    | `GET /v1/skills/{id}`<br />`GET /v1/skills/{id}/versions`<br />`GET /v1/skills/{id}/versions/{version}`<br />`GET /v1/skills/{id}/versions/{version}/content` |
| `ListSkills`  | `GET /v1/skills`                                                                                                                                              |
| `UpdateSkill` | `POST /v1/skills/{id}/versions`<br />`DELETE /v1/skills/{id}/versions/{version}`                                                                              |
| `DeleteSkill` | `DELETE /v1/skills/{id}`                                                                                                                                      |

<Note>
  `GetSkill` authorizes both skill metadata and skill-content download. A principal with read-only access can download skill bytes, not just list skills.
</Note>

<Note>
  Creating or deleting an individual skill version maps to `UpdateSkill`, not `CreateSkill` or `DeleteSkill`. A policy that denies `aws-external-anthropic:Delete*` still allows version deletion, and a policy that denies `aws-external-anthropic:Create*` still allows version creation. Deny `UpdateSkill` and `CreateSkill` as well if you need to prevent any skill mutation.
</Note>

### Agents

| Action         | Routes authorized                                         |
| -------------- | --------------------------------------------------------- |
| `CreateAgent`  | `POST /v1/agents`                                         |
| `GetAgent`     | `GET /v1/agents/{id}`<br />`GET /v1/agents/{id}/versions` |
| `ListAgents`   | `GET /v1/agents`                                          |
| `UpdateAgent`  | `POST /v1/agents/{id}`                                    |
| `ArchiveAgent` | `POST /v1/agents/{id}/archive`                            |

<Note>
  Agents support only archive, not hard delete. A policy that denies `aws-external-anthropic:Delete*` does not block `ArchiveAgent`. Deny `ArchiveAgent`, `UpdateAgent`, and `CreateAgent` if you need to prevent any agent mutation.
</Note>

### Sessions

| Action           | Routes authorized                                                                                                                                                                                 |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `CreateSession`  | `POST /v1/sessions`                                                                                                                                                                               |
| `GetSession`     | `GET /v1/sessions/{id}`<br />`GET /v1/sessions/{id}/events`<br />`GET /v1/sessions/{id}/events/stream`<br />`GET /v1/sessions/{id}/resources`<br />`GET /v1/sessions/{id}/resources/{id}`         |
| `ListSessions`   | `GET /v1/sessions`                                                                                                                                                                                |
| `UpdateSession`  | `POST /v1/sessions/{id}`<br />`POST /v1/sessions/{id}/events`<br />`POST /v1/sessions/{id}/resources`<br />`POST /v1/sessions/{id}/resources/{id}`<br />`DELETE /v1/sessions/{id}/resources/{id}` |
| `ArchiveSession` | `POST /v1/sessions/{id}/archive`                                                                                                                                                                  |
| `DeleteSession`  | `DELETE /v1/sessions/{id}`                                                                                                                                                                        |

<Note>
  `GetSession` authorizes reading session metadata, the full event stream (conversation history), and session resources. The `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` policies' `Get*` wildcards include this action.
</Note>

<Note>
  Creating, updating, or deleting an individual session sub-resource (events or session resources) maps to `UpdateSession`, not `CreateSession` or `DeleteSession`. A policy that denies `aws-external-anthropic:Delete*` still allows sub-resource deletion, and a policy that denies `aws-external-anthropic:Create*` still allows sub-resource creation. Deny `UpdateSession`, `CreateSession`, and `ArchiveSession` as well if you need to prevent any session mutation.
</Note>

### Environments

| Action                   | Routes authorized                                                                                                                                                                                                                                            |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `CreateEnvironment`      | `POST /v1/environments`                                                                                                                                                                                                                                      |
| `GetEnvironment`         | `GET /v1/environments/{id}`<br />`GET /v1/environments/{id}/work`<br />`GET /v1/environments/{id}/work/{work_id}`<br />`GET /v1/environments/{id}/work/stats`                                                                                                |
| `ListEnvironments`       | `GET /v1/environments`                                                                                                                                                                                                                                       |
| `UpdateEnvironment`      | `POST /v1/environments/{id}`                                                                                                                                                                                                                                 |
| `ArchiveEnvironment`     | `POST /v1/environments/{id}/archive`                                                                                                                                                                                                                         |
| `DeleteEnvironment`      | `DELETE /v1/environments/{id}`                                                                                                                                                                                                                               |
| `ProcessEnvironmentWork` | `GET /v1/environments/{id}/work/poll`<br />`POST /v1/environments/{id}/work/{work_id}`<br />`POST /v1/environments/{id}/work/{work_id}/ack`<br />`POST /v1/environments/{id}/work/{work_id}/heartbeat`<br />`POST /v1/environments/{id}/work/{work_id}/stop` |

<Note>
  A policy that denies `aws-external-anthropic:Delete*` does not block `ArchiveEnvironment`. `ProcessEnvironmentWork` is not matched by `Create*`, `Update*`, `Delete*`, or `Archive*` wildcards. Deny `ArchiveEnvironment`, `UpdateEnvironment`, `CreateEnvironment`, and `ProcessEnvironmentWork` as well if you need to prevent any environment mutation.
</Note>

<Note>
  `ProcessEnvironmentWork` authorizes a [self-hosted sandbox](https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes) worker to poll for, acknowledge, heartbeat, stop, and post results on environment work items. Grant it only to principals that run self-hosted environment workers. The `AnthropicSelfHostedEnvironmentAccess` managed policy includes this action.
</Note>

### Vaults

| Action         | Routes authorized                                                                                                                                                                                               |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `CreateVault`  | `POST /v1/vaults`                                                                                                                                                                                               |
| `GetVault`     | `GET /v1/vaults/{id}`<br />`GET /v1/vaults/{id}/credentials`<br />`GET /v1/vaults/{id}/credentials/{id}`                                                                                                        |
| `ListVaults`   | `GET /v1/vaults`                                                                                                                                                                                                |
| `UpdateVault`  | `POST /v1/vaults/{id}`<br />`POST /v1/vaults/{id}/credentials`<br />`POST /v1/vaults/{id}/credentials/{id}`<br />`POST /v1/vaults/{id}/credentials/{id}/archive`<br />`DELETE /v1/vaults/{id}/credentials/{id}` |
| `ArchiveVault` | `POST /v1/vaults/{id}/archive`                                                                                                                                                                                  |
| `DeleteVault`  | `DELETE /v1/vaults/{id}`                                                                                                                                                                                        |

<Note>
  Creating, updating, archiving, or deleting an individual vault credential maps to `UpdateVault`. Reading a credential maps to `GetVault`. Vault credential secrets are not exposed: secret fields are write-only and are never returned by `GetVault` (see [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults)). A policy that denies `aws-external-anthropic:Delete*` still allows credential deletion, and a policy that denies `aws-external-anthropic:Create*` still allows credential creation. Deny `UpdateVault`, `CreateVault`, and `ArchiveVault` as well if you need to prevent any vault mutation.
</Note>

### Memory stores

| Action               | Routes authorized                                                                                                                                                                                                                            |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `CreateMemoryStore`  | `POST /v1/memory_stores`                                                                                                                                                                                                                     |
| `GetMemoryStore`     | `GET /v1/memory_stores/{id}`<br />`GET /v1/memory_stores/{id}/memories`<br />`GET /v1/memory_stores/{id}/memories/{id}`<br />`GET /v1/memory_stores/{id}/memory_versions`<br />`GET /v1/memory_stores/{id}/memory_versions/{id}`             |
| `ListMemoryStores`   | `GET /v1/memory_stores`                                                                                                                                                                                                                      |
| `UpdateMemoryStore`  | `POST /v1/memory_stores/{id}`<br />`POST /v1/memory_stores/{id}/memories`<br />`POST /v1/memory_stores/{id}/memories/{id}`<br />`DELETE /v1/memory_stores/{id}/memories/{id}`<br />`POST /v1/memory_stores/{id}/memory_versions/{id}/redact` |
| `ArchiveMemoryStore` | `POST /v1/memory_stores/{id}/archive`                                                                                                                                                                                                        |
| `DeleteMemoryStore`  | `DELETE /v1/memory_stores/{id}`                                                                                                                                                                                                              |

<Note>
  `GetMemoryStore` authorizes reading store metadata, all memories, and memory version history. The `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` policies' `Get*` wildcards include this action.
</Note>

<Note>
  Creating, updating, or deleting an individual memory and redacting a memory version both map to `UpdateMemoryStore`, not `CreateMemoryStore` or `DeleteMemoryStore`. A policy that denies `aws-external-anthropic:Delete*` still allows individual-memory deletion and memory-version redaction, and a policy that denies `aws-external-anthropic:Create*` still allows individual-memory creation. Deny `UpdateMemoryStore`, `CreateMemoryStore`, and `ArchiveMemoryStore` as well if you need to prevent any memory-store mutation.
</Note>

### Webhooks

| Action                | Routes authorized                                  |
| --------------------- | -------------------------------------------------- |
| `CreateWebhook`       | `POST /v1/webhooks`                                |
| `GetWebhook`          | `GET /v1/webhooks/{id}`                            |
| `ListWebhooks`        | `GET /v1/webhooks`                                 |
| `UpdateWebhook`       | `POST /v1/webhooks/{id}`                           |
| `DeleteWebhook`       | `DELETE /v1/webhooks/{id}`                         |
| `RotateWebhookSecret` | `POST /v1/webhooks/{id}/regenerate_signing_secret` |

<Note>
  Webhook signing secrets are write-only. `GetWebhook` returns webhook metadata only; it does not return the signing secret.
</Note>

<Note>
  `RotateWebhookSecret` is not matched by `aws-external-anthropic:Create*`, `Update*`, or `Delete*` wildcards. A policy that denies those patterns still allows secret rotation. Deny `RotateWebhookSecret`, `UpdateWebhook`, `CreateWebhook`, and `DeleteWebhook` if you need to prevent any webhook mutation.
</Note>

### User profiles

| Action                           | Routes authorized                            |
| -------------------------------- | -------------------------------------------- |
| `CreateUserProfile`              | `POST /v1/user_profiles`                     |
| `GetUserProfile`                 | `GET /v1/user_profiles/{id}`                 |
| `ListUserProfiles`               | `GET /v1/user_profiles`                      |
| `UpdateUserProfile`              | `POST /v1/user_profiles/{id}`                |
| `CreateUserProfileEnrollmentUrl` | `POST /v1/user_profiles/{id}/enrollment_url` |

<Note>
  The user profile actions are account-scoped, like `ListWorkspaces`. A statement whose `Resource` is a workspace ARN does not grant them; use `Resource: "*"`.
</Note>

<Warning>
  IAM action matching is case-insensitive. The wildcard `aws-external-anthropic:*File` matches `CreateFile`, `GetFile`, and `DeleteFile`, but does not match `ListFiles` (which ends in "files", not "file"). It also over-matches `CreateUserProfile`, `GetUserProfile`, and `UpdateUserProfile` because "Profile" ends in "file". If you intend to grant or deny only Files API actions, enumerate them explicitly (`CreateFile`, `GetFile`, `ListFiles`, `DeleteFile`) rather than using a `*File` suffix pattern.
</Warning>

### Workspaces

| Action             | Routes authorized                                |
| ------------------ | ------------------------------------------------ |
| `CreateWorkspace`  | `POST /v1/organizations/workspaces`              |
| `GetWorkspace`     | `GET /v1/organizations/workspaces/{id}`          |
| `ListWorkspaces`   | `GET /v1/organizations/workspaces`               |
| `UpdateWorkspace`  | `POST /v1/organizations/workspaces/{id}`         |
| `ArchiveWorkspace` | `POST /v1/organizations/workspaces/{id}/archive` |

<Note>
  Workspaces support only archive, not hard delete. A policy that denies `aws-external-anthropic:Delete*` does not block `ArchiveWorkspace`. Deny `ArchiveWorkspace`, `UpdateWorkspace`, and `CreateWorkspace` if you need to prevent any workspace mutation.
</Note>

### Encryption keys

| Action        | Routes authorized                             |
| ------------- | --------------------------------------------- |
| `RegisterKey` | `POST /v1/organizations/external_keys`        |
| `GetKey`      | `GET /v1/organizations/external_keys/{id}`    |
| `ListKeys`    | `GET /v1/organizations/external_keys`         |
| `UpdateKey`   | `POST /v1/organizations/external_keys/{id}`   |
| `DisableKey`  | `DELETE /v1/organizations/external_keys/{id}` |

<Note>
  These actions manage your organization's [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws) registrations, the record of which AWS KMS key ARNs are registered. They do not create, change, or disable the keys in AWS KMS. `DisableKey` removes a registration and is rejected while any workspace still uses the key. `RegisterKey` and `DisableKey` are not matched by `Create*`, `Update*`, or `Delete*` wildcards; deny `RegisterKey`, `UpdateKey`, and `DisableKey` if you need to prevent any change to key registrations. In these routes, `{id}` is the URL-encoded KMS key ARN. Attaching a registered key to a workspace is a workspace operation, authorized by `CreateWorkspace` or `UpdateWorkspace`; the principal that attaches a key also needs `kms:DescribeKey`, `kms:Encrypt`, and `kms:Decrypt` on that key (see the [prerequisites](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws#prerequisites)). External key actions are account-scoped: specifying a workspace ARN on them has no effect; use `Resource: "*"`.
</Note>

### Compliance

| Action                     | Routes authorized               |
| -------------------------- | ------------------------------- |
| `ListComplianceActivities` | `GET /v1/compliance/activities` |

<Note>
  `ListComplianceActivities` authorizes reading the [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed), the organization-wide audit log that includes access transparency events. The route returns an error until the Compliance API is [enabled for your organization](https://platform.claude.com/docs/en/manage-claude/compliance-api-access); enablement is on request through your Anthropic account team. The `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` policies' `List*` wildcards include this action.
</Note>

<Note>
  `ListComplianceActivities` is account-scoped, like `ListWorkspaces`. Specifying a workspace ARN on this action has no effect; use `Resource: "*"`.
</Note>

### Telemetry destinations

| Action                                      | Routes authorized                                                                |
| ------------------------------------------- | -------------------------------------------------------------------------------- |
| `CreateAccountTelemetryDestination`         | `POST /v1/organizations/telemetry_destinations`                                  |
| `GetAccountTelemetryDestination`            | `GET /v1/organizations/telemetry_destinations/{id}`                              |
| `ListAccountTelemetryDestinations`          | `GET /v1/organizations/telemetry_destinations`                                   |
| `UpdateAccountTelemetryDestination`         | `POST /v1/organizations/telemetry_destinations/{id}`                             |
| `DeleteAccountTelemetryDestination`         | `DELETE /v1/organizations/telemetry_destinations/{id}`                           |
| `TestAccountTelemetryDestination`           | `POST /v1/organizations/telemetry_destinations/{id}/test`                        |
| `ListAccountTelemetryDestinationWorkspaces` | `GET /v1/organizations/telemetry_destinations/{id}/workspaces`                   |
| `AddTelemetryDestinationWorkspace`          | `POST /v1/organizations/telemetry_destinations/{id}/workspaces/{workspace_id}`   |
| `RemoveTelemetryDestinationWorkspace`       | `DELETE /v1/organizations/telemetry_destinations/{id}/workspaces/{workspace_id}` |

<Note>
  All of these actions except `AddTelemetryDestinationWorkspace` and `RemoveTelemetryDestinationWorkspace` are account-scoped, so a workspace ARN on them has no effect. Use `Resource: "*"`. A destination can export telemetry from every workspace in the organization, in every region. Grant `CreateAccountTelemetryDestination` and `UpdateAccountTelemetryDestination` only to principals you trust with all of that telemetry.
</Note>

<Note>
  `AddTelemetryDestinationWorkspace` and `RemoveTelemetryDestinationWorkspace` apply to the workspace in the route, and only on a destination whose **Workspaces** option is **Selected**. To change an **All except** list, use `UpdateAccountTelemetryDestination`. A policy that denies `aws-external-anthropic:Create*`, `Update*`, or `Delete*` still allows adding and removing workspaces. To block every change to destinations, also deny `AddTelemetryDestinationWorkspace` and `RemoveTelemetryDestinationWorkspace`.
</Note>

### Authentication

| Action                | Routes authorized |
| --------------------- | ----------------- |
| `CallWithBearerToken` | (none)            |

`CallWithBearerToken` is an authentication-layer permission that authorizes a principal to authenticate through an API key (bearer token) rather than AWS SigV4. It does not map to a route. Grant it alongside the route-mapped actions you want the API key holder to perform.

### Console access

| Action          | Routes authorized |
| --------------- | ----------------- |
| `AssumeConsole` | (none)            |

`AssumeConsole` authorizes a principal to open the Claude Console for a Claude Platform on AWS workspace through the AWS Console federation flow. It does not map to a route. Grant it to principals who should be able to click **Open Claude Console** on the Claude Platform on AWS service page in the AWS Console. The Claude Console role (Admin or Developer) is assigned separately by your Anthropic account representative; it is not derived from the principal's IAM permissions. See [Using the Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console) for the sign-in flow and role descriptions.

## Route-to-action mapping

The following table lists every route on Claude Platform on AWS and the IAM action required to call it. Each IAM action also authorizes requests that use the `anthropic-beta` header; beta variants of a route do not require a separate IAM action. CloudTrail classifies each action as either a Data event (high-volume, data-plane operations) or a Management event (control-plane operations). Vault and webhook actions are classified as Management events because they hold secrets (vault credentials and webhook signing secrets) and benefit from default-on audit logging. Workspace, external key, telemetry destination, and compliance actions are also classified as Management events because they are organization-scoped control-plane operations. All other actions, including inference, batch, model, file, skill, user profile, and the remaining Claude Managed Agents actions, are classified as Data events.

| Method   | Route                                                                     | IAM action                                  | CloudTrail event type |
| -------- | ------------------------------------------------------------------------- | ------------------------------------------- | --------------------- |
| `POST`   | `/v1/messages`                                                            | `CreateInference`                           | Data                  |
| `POST`   | `/v1/messages/count_tokens`                                               | `CountTokens`                               | Data                  |
| `POST`   | `/v1/messages/batches`                                                    | `CreateBatchInference`                      | Data                  |
| `GET`    | `/v1/messages/batches`                                                    | `ListBatchInferences`                       | Data                  |
| `GET`    | `/v1/messages/batches/{id}`                                               | `GetBatchInference`                         | Data                  |
| `GET`    | `/v1/messages/batches/{id}/results`                                       | `GetBatchInference`                         | Data                  |
| `POST`   | `/v1/messages/batches/{id}/cancel`                                        | `CancelBatchInference`                      | Data                  |
| `DELETE` | `/v1/messages/batches/{id}`                                               | `DeleteBatchInference`                      | Data                  |
| `GET`    | `/v1/models`                                                              | `ListModels`                                | Data                  |
| `GET`    | `/v1/models/{id}`                                                         | `GetModel`                                  | Data                  |
| `POST`   | `/v1/files`                                                               | `CreateFile`                                | Data                  |
| `GET`    | `/v1/files`                                                               | `ListFiles`                                 | Data                  |
| `GET`    | `/v1/files/{id}`                                                          | `GetFile`                                   | Data                  |
| `GET`    | `/v1/files/{id}/content`                                                  | `GetFile`                                   | Data                  |
| `DELETE` | `/v1/files/{id}`                                                          | `DeleteFile`                                | Data                  |
| `POST`   | `/v1/skills`                                                              | `CreateSkill`                               | Data                  |
| `GET`    | `/v1/skills`                                                              | `ListSkills`                                | Data                  |
| `GET`    | `/v1/skills/{id}`                                                         | `GetSkill`                                  | Data                  |
| `DELETE` | `/v1/skills/{id}`                                                         | `DeleteSkill`                               | Data                  |
| `POST`   | `/v1/skills/{id}/versions`                                                | `UpdateSkill`                               | Data                  |
| `GET`    | `/v1/skills/{id}/versions`                                                | `GetSkill`                                  | Data                  |
| `GET`    | `/v1/skills/{id}/versions/{version}`                                      | `GetSkill`                                  | Data                  |
| `GET`    | `/v1/skills/{id}/versions/{version}/content`                              | `GetSkill`                                  | Data                  |
| `DELETE` | `/v1/skills/{id}/versions/{version}`                                      | `UpdateSkill`                               | Data                  |
| `POST`   | `/v1/user_profiles`                                                       | `CreateUserProfile`                         | Data                  |
| `GET`    | `/v1/user_profiles`                                                       | `ListUserProfiles`                          | Data                  |
| `GET`    | `/v1/user_profiles/{id}`                                                  | `GetUserProfile`                            | Data                  |
| `POST`   | `/v1/user_profiles/{id}`                                                  | `UpdateUserProfile`                         | Data                  |
| `POST`   | `/v1/user_profiles/{id}/enrollment_url`                                   | `CreateUserProfileEnrollmentUrl`            | Data                  |
| `POST`   | `/v1/organizations/workspaces`                                            | `CreateWorkspace`                           | Management            |
| `GET`    | `/v1/organizations/workspaces`                                            | `ListWorkspaces`                            | Management            |
| `GET`    | `/v1/organizations/workspaces/{id}`                                       | `GetWorkspace`                              | Management            |
| `POST`   | `/v1/organizations/workspaces/{id}`                                       | `UpdateWorkspace`                           | Management            |
| `POST`   | `/v1/organizations/workspaces/{id}/archive`                               | `ArchiveWorkspace`                          | Management            |
| `POST`   | `/v1/organizations/external_keys`                                         | `RegisterKey`                               | Management            |
| `GET`    | `/v1/organizations/external_keys`                                         | `ListKeys`                                  | Management            |
| `GET`    | `/v1/organizations/external_keys/{id}`                                    | `GetKey`                                    | Management            |
| `POST`   | `/v1/organizations/external_keys/{id}`                                    | `UpdateKey`                                 | Management            |
| `DELETE` | `/v1/organizations/external_keys/{id}`                                    | `DisableKey`                                | Management            |
| `POST`   | `/v1/organizations/telemetry_destinations`                                | `CreateAccountTelemetryDestination`         | Management            |
| `GET`    | `/v1/organizations/telemetry_destinations`                                | `ListAccountTelemetryDestinations`          | Management            |
| `GET`    | `/v1/organizations/telemetry_destinations/{id}`                           | `GetAccountTelemetryDestination`            | Management            |
| `POST`   | `/v1/organizations/telemetry_destinations/{id}`                           | `UpdateAccountTelemetryDestination`         | Management            |
| `DELETE` | `/v1/organizations/telemetry_destinations/{id}`                           | `DeleteAccountTelemetryDestination`         | Management            |
| `POST`   | `/v1/organizations/telemetry_destinations/{id}/test`                      | `TestAccountTelemetryDestination`           | Management            |
| `GET`    | `/v1/organizations/telemetry_destinations/{id}/workspaces`                | `ListAccountTelemetryDestinationWorkspaces` | Management            |
| `POST`   | `/v1/organizations/telemetry_destinations/{id}/workspaces/{workspace_id}` | `AddTelemetryDestinationWorkspace`          | Management            |
| `DELETE` | `/v1/organizations/telemetry_destinations/{id}/workspaces/{workspace_id}` | `RemoveTelemetryDestinationWorkspace`       | Management            |
| `GET`    | `/v1/compliance/activities`                                               | `ListComplianceActivities`                  | Management            |
| `POST`   | `/v1/agents`                                                              | `CreateAgent`                               | Data                  |
| `GET`    | `/v1/agents`                                                              | `ListAgents`                                | Data                  |
| `GET`    | `/v1/agents/{id}`                                                         | `GetAgent`                                  | Data                  |
| `POST`   | `/v1/agents/{id}`                                                         | `UpdateAgent`                               | Data                  |
| `POST`   | `/v1/agents/{id}/archive`                                                 | `ArchiveAgent`                              | Data                  |
| `GET`    | `/v1/agents/{id}/versions`                                                | `GetAgent`                                  | Data                  |
| `POST`   | `/v1/sessions`                                                            | `CreateSession`                             | Data                  |
| `GET`    | `/v1/sessions`                                                            | `ListSessions`                              | Data                  |
| `GET`    | `/v1/sessions/{id}`                                                       | `GetSession`                                | Data                  |
| `POST`   | `/v1/sessions/{id}`                                                       | `UpdateSession`                             | Data                  |
| `POST`   | `/v1/sessions/{id}/archive`                                               | `ArchiveSession`                            | Data                  |
| `DELETE` | `/v1/sessions/{id}`                                                       | `DeleteSession`                             | Data                  |
| `GET`    | `/v1/sessions/{id}/events`                                                | `GetSession`                                | Data                  |
| `POST`   | `/v1/sessions/{id}/events`                                                | `UpdateSession`                             | Data                  |
| `GET`    | `/v1/sessions/{id}/events/stream`                                         | `GetSession`                                | Data                  |
| `GET`    | `/v1/sessions/{id}/resources`                                             | `GetSession`                                | Data                  |
| `GET`    | `/v1/sessions/{id}/resources/{id}`                                        | `GetSession`                                | Data                  |
| `POST`   | `/v1/sessions/{id}/resources`                                             | `UpdateSession`                             | Data                  |
| `POST`   | `/v1/sessions/{id}/resources/{id}`                                        | `UpdateSession`                             | Data                  |
| `DELETE` | `/v1/sessions/{id}/resources/{id}`                                        | `UpdateSession`                             | Data                  |
| `POST`   | `/v1/environments`                                                        | `CreateEnvironment`                         | Data                  |
| `GET`    | `/v1/environments`                                                        | `ListEnvironments`                          | Data                  |
| `GET`    | `/v1/environments/{id}`                                                   | `GetEnvironment`                            | Data                  |
| `POST`   | `/v1/environments/{id}`                                                   | `UpdateEnvironment`                         | Data                  |
| `POST`   | `/v1/environments/{id}/archive`                                           | `ArchiveEnvironment`                        | Data                  |
| `DELETE` | `/v1/environments/{id}`                                                   | `DeleteEnvironment`                         | Data                  |
| `GET`    | `/v1/environments/{id}/work`                                              | `GetEnvironment`                            | Data                  |
| `GET`    | `/v1/environments/{id}/work/poll`                                         | `ProcessEnvironmentWork`                    | Data                  |
| `GET`    | `/v1/environments/{id}/work/{work_id}`                                    | `GetEnvironment`                            | Data                  |
| `GET`    | `/v1/environments/{id}/work/stats`                                        | `GetEnvironment`                            | Data                  |
| `POST`   | `/v1/environments/{id}/work/{work_id}`                                    | `ProcessEnvironmentWork`                    | Data                  |
| `POST`   | `/v1/environments/{id}/work/{work_id}/ack`                                | `ProcessEnvironmentWork`                    | Data                  |
| `POST`   | `/v1/environments/{id}/work/{work_id}/heartbeat`                          | `ProcessEnvironmentWork`                    | Data                  |
| `POST`   | `/v1/environments/{id}/work/{work_id}/stop`                               | `ProcessEnvironmentWork`                    | Data                  |
| `POST`   | `/v1/vaults`                                                              | `CreateVault`                               | Management            |
| `GET`    | `/v1/vaults`                                                              | `ListVaults`                                | Management            |
| `GET`    | `/v1/vaults/{id}`                                                         | `GetVault`                                  | Management            |
| `POST`   | `/v1/vaults/{id}`                                                         | `UpdateVault`                               | Management            |
| `POST`   | `/v1/vaults/{id}/archive`                                                 | `ArchiveVault`                              | Management            |
| `DELETE` | `/v1/vaults/{id}`                                                         | `DeleteVault`                               | Management            |
| `GET`    | `/v1/vaults/{id}/credentials`                                             | `GetVault`                                  | Management            |
| `POST`   | `/v1/vaults/{id}/credentials`                                             | `UpdateVault`                               | Management            |
| `GET`    | `/v1/vaults/{id}/credentials/{id}`                                        | `GetVault`                                  | Management            |
| `POST`   | `/v1/vaults/{id}/credentials/{id}`                                        | `UpdateVault`                               | Management            |
| `POST`   | `/v1/vaults/{id}/credentials/{id}/archive`                                | `UpdateVault`                               | Management            |
| `DELETE` | `/v1/vaults/{id}/credentials/{id}`                                        | `UpdateVault`                               | Management            |
| `POST`   | `/v1/memory_stores`                                                       | `CreateMemoryStore`                         | Data                  |
| `GET`    | `/v1/memory_stores`                                                       | `ListMemoryStores`                          | Data                  |
| `GET`    | `/v1/memory_stores/{id}`                                                  | `GetMemoryStore`                            | Data                  |
| `POST`   | `/v1/memory_stores/{id}`                                                  | `UpdateMemoryStore`                         | Data                  |
| `POST`   | `/v1/memory_stores/{id}/archive`                                          | `ArchiveMemoryStore`                        | Data                  |
| `DELETE` | `/v1/memory_stores/{id}`                                                  | `DeleteMemoryStore`                         | Data                  |
| `POST`   | `/v1/memory_stores/{id}/memories`                                         | `UpdateMemoryStore`                         | Data                  |
| `GET`    | `/v1/memory_stores/{id}/memories`                                         | `GetMemoryStore`                            | Data                  |
| `GET`    | `/v1/memory_stores/{id}/memories/{id}`                                    | `GetMemoryStore`                            | Data                  |
| `POST`   | `/v1/memory_stores/{id}/memories/{id}`                                    | `UpdateMemoryStore`                         | Data                  |
| `DELETE` | `/v1/memory_stores/{id}/memories/{id}`                                    | `UpdateMemoryStore`                         | Data                  |
| `GET`    | `/v1/memory_stores/{id}/memory_versions`                                  | `GetMemoryStore`                            | Data                  |
| `GET`    | `/v1/memory_stores/{id}/memory_versions/{id}`                             | `GetMemoryStore`                            | Data                  |
| `POST`   | `/v1/memory_stores/{id}/memory_versions/{id}/redact`                      | `UpdateMemoryStore`                         | Data                  |
| `GET`    | `/v1/webhooks`                                                            | `ListWebhooks`                              | Management            |
| `GET`    | `/v1/webhooks/{id}`                                                       | `GetWebhook`                                | Management            |
| `POST`   | `/v1/webhooks`                                                            | `CreateWebhook`                             | Management            |
| `POST`   | `/v1/webhooks/{id}`                                                       | `UpdateWebhook`                             | Management            |
| `DELETE` | `/v1/webhooks/{id}`                                                       | `DeleteWebhook`                             | Management            |
| `POST`   | `/v1/webhooks/{id}/regenerate_signing_secret`                             | `RotateWebhookSecret`                       | Management            |

Routes not in this table are not available on Claude Platform on AWS. The gateway denies any route not listed here by default.

<Note>
  Workspace, external key, and telemetry destination routes are the only Admin API routes available on Claude Platform on AWS. You can also create, update, or archive workspaces in the AWS Console or, with the Admin role, in the Claude Console. Encryption keys can also be registered and attached in the Claude Console.
</Note>

## Managed policies

AWS provides five managed policies for Claude Platform on AWS. All managed policies apply to `Resource: "*"`.

| Policy                                 | Grants                                                                                                                                                                             |
| -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `AnthropicFullAccess`                  | `aws-external-anthropic:*`                                                                                                                                                         |
| `AnthropicReadOnlyAccess`              | `Get*`, `List*`, `CallWithBearerToken`                                                                                                                                             |
| `AnthropicInferenceAccess`             | `Get*`, `List*`, `CreateInference`, `CreateBatchInference`, `CancelBatchInference`, `DeleteBatchInference`, `CountTokens`, `CallWithBearerToken`                                   |
| `AnthropicLimitedAccess`               | All `AnthropicInferenceAccess` actions, plus all Claude Managed Agents actions (agents, sessions, environments, vaults, memory stores, webhooks, and self-hosted environment work) |
| `AnthropicSelfHostedEnvironmentAccess` | `GetEnvironment`, `ProcessEnvironmentWork`, `GetSession`, `UpdateSession`, `GetSkill`, `CallWithBearerToken`                                                                       |

`AnthropicInferenceAccess` is the narrowest managed policy sufficient to run inference. It covers both synchronous and batch inference and, through the `Get*` and `List*` wildcards, grants read access to every API resource in the namespace, including Claude Managed Agents (CMA) resources (agents, sessions, environments, vaults, memory stores, and webhooks). This includes file content download through `GetFile` (see the [Files](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#files) note), skill content download through `GetSkill` (see the [Skills](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#skills) note), and memory contents through `GetMemoryStore`. Vault credential secrets and webhook signing secrets are not exposed: those fields are write-only and are never returned by `GetVault` or `GetWebhook` (see [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults)). `AnthropicInferenceAccess` does not grant file creation or deletion, skill management, user profile management, workspace mutation, encryption key management, telemetry destination management, or any Claude Managed Agents write action (create, update, archive, delete, process, or rotate). To exclude CMA reads, replace `AnthropicInferenceAccess` with a custom policy that enumerates only the specific non-CMA actions you need.

<Note>
  `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` all carry the `Get*` and `List*` wildcards, which grant read access to all content in the workspace: file bytes, skill content, batch results, session conversation history, and memory contents. The wildcards also grant `GetKey` and `ListKeys`, which read the organization's registered encryption key configurations (key ARNs and metadata, never key material). They also grant the account-scoped `GetUserProfile` and `ListUserProfiles`, which read user profiles. The `List*` wildcard also grants `ListComplianceActivities`, which reads the organization's compliance [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) once the Compliance API is enabled for the organization (see [Compliance](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#compliance)). The wildcards also grant `GetAccountTelemetryDestination`, `ListAccountTelemetryDestinations`, and `ListAccountTelemetryDestinationWorkspaces`, which read the organization's telemetry destinations but never their header values. Vault credential secrets and webhook signing secrets are not exposed; those fields are write-only and are never returned by `GetVault` or `GetWebhook`. If your principal should not read existing content, use a custom policy that enumerates only the actions you need.
</Note>

`AnthropicLimitedAccess` includes all Claude Managed Agents actions in addition to inference actions.

`AnthropicSelfHostedEnvironmentAccess` is the narrowest managed policy sufficient to run a [self-hosted sandbox](https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes) worker. Attach it to the principal your environment worker authenticates as.

`AssumeConsole` is not included in `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, `AnthropicLimitedAccess`, or `AnthropicSelfHostedEnvironmentAccess`. Principals who need Claude Console access require either `AnthropicFullAccess` or a custom policy that grants `aws-external-anthropic:AssumeConsole`. See [Console access](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#console-access).

<Note>
  `CreateInference` and `CreateBatchInference` are separate actions. Denying one does not block the other. If you intend to prevent all model calls, deny both.
</Note>

## Example policies

### Synchronous inference on a single workspace

Grants the minimal permissions for an IAM principal that runs inference against one production workspace:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CreateInference",
        "aws-external-anthropic:CountTokens",
        "aws-external-anthropic:GetModel",
        "aws-external-anthropic:ListModels",
        "aws-external-anthropic:GetWorkspace"
      ],
      "Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    }
  ]
}
```

<Note>
  `ListWorkspaces` is account-scoped (see [Provisioning automation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#provisioning-automation)). If your service account needs to enumerate workspaces, add a separate `Allow` statement for `ListWorkspaces` with `Resource: "*"`.

  This policy assumes AWS SigV4 authentication. If the principal authenticates with an API key, add a separate `Allow` statement for `aws-external-anthropic:CallWithBearerToken` with `Resource: "*"`. `CallWithBearerToken` is a route-less action that does not bind to a workspace ARN. See [Per-customer workspace isolation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#per-customer-workspace-isolation) for the two-statement pattern.
</Note>

### Per-customer workspace isolation

Restricts a role to a single workspace:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "aws-external-anthropic:*",
      "Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    },
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CallWithBearerToken",
        "aws-external-anthropic:AssumeConsole"
      ],
      "Resource": "*"
    }
  ]
}
```

<Note>
  The `aws-external-anthropic:*` wildcard in the first statement includes account-scoped actions (`CreateWorkspace`, `ListWorkspaces`, `ListComplianceActivities`, the external key actions, the account-scoped telemetry destination actions, and the user profile actions) that the workspace ARN constraint silently filters out. This is consistent with the "isolation" intent (the role cannot create workspaces, enumerate workspaces, manage encryption key registrations, read the compliance Activity Feed, or read or manage user profiles, and it cannot create, read, or change telemetry destinations; it can still attach an already-registered key to its own workspace through `UpdateWorkspace`, and add its own workspace to a destination, or remove it from one, given the destination's ID), but the policy contains permissions that have no effect. If the role needs user profiles, add a separate `Allow` statement for the user profile actions with `Resource: "*"`. See [Provisioning automation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#provisioning-automation) for the account-scoped pattern.

  `CallWithBearerToken` and `AssumeConsole` are route-less actions that do not bind to a workspace ARN. The second statement grants them on `Resource: "*"` so the role can authenticate with an API key and open the Claude Console. Omit this statement if the role uses SigV4 only and does not need Claude Console access.
</Note>

### Feature lockdown for a ZDR-sensitive workspace

Blocks batch processing and file upload on a specific workspace while leaving synchronous inference available. Useful when a workspace handles [Zero Data Retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) data that must not persist server-side. Attach this policy alongside an Allow policy such as `AnthropicInferenceAccess` or the [single-workspace example](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#synchronous-inference-on-a-single-workspace); on its own, a Deny-only policy grants no permissions:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "aws-external-anthropic:CreateBatchInference",
        "aws-external-anthropic:CreateFile"
      ],
      "Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    }
  ]
}
```

<Note>
  This deny blocks creation only. Other file and batch actions are not denied unless you list them as well. For a complete lockdown where the workspace must never hold files or batches, also deny `aws-external-anthropic:GetFile`, `aws-external-anthropic:ListFiles`, `aws-external-anthropic:DeleteFile`, `aws-external-anthropic:GetBatchInference`, `aws-external-anthropic:ListBatchInferences`, `aws-external-anthropic:CancelBatchInference`, and `aws-external-anthropic:DeleteBatchInference`.
</Note>

### Provisioning automation

<Note>
  Besides the Admin API, you can create, update, or archive workspaces in the AWS Console or, with the Admin role, in the Claude Console.
</Note>

Grants a CI/CD role the actions needed to create and manage workspaces, without any inference permissions:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CreateWorkspace",
        "aws-external-anthropic:GetWorkspace",
        "aws-external-anthropic:ListWorkspaces",
        "aws-external-anthropic:UpdateWorkspace",
        "aws-external-anthropic:ArchiveWorkspace"
      ],
      "Resource": "*"
    }
  ]
}
```

`CreateWorkspace` and `ListWorkspaces` are account-scoped operations. Specifying a workspace ARN on these actions has no effect; use `Resource: "*"`.

## See also

* [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws) for setup, authentication, and platform overview
* [AWS IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) for IAM policy syntax and evaluation logic
* [AWS CloudTrail User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/) for audit logging configuration