Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Claude Platform di AWS menggunakan AWS IAM untuk kontrol akses. Setiap rute API dipetakan ke tindakan IAM dalam namespace aws-external-anthropic. Halaman ini mencantumkan semua tindakan, rute yang diotorisasi oleh setiap tindakan, dan kebijakan terkelola yang tersedia untuk pola akses umum. Untuk penyiapan platform dan autentikasi, lihat Claude Platform di AWS.
| Atribut | Nilai |
|---|---|
| Prefiks layanan IAM | aws-external-anthropic |
| Tipe sumber daya | workspace |
Format ARN workspace:
arn:aws:aws-external-anthropic:{region}:{account-id}:workspace/{workspace-id}Region ARN selalu terisi dan sesuai dengan region tempat workspace terikat. Segmen sumber daya adalah ID workspace yang diberi tag (wrkspc_...), nilai yang sama dengan yang Anda kirimkan dalam header anthropic-workspace-id.
Layanan ini mendefinisikan 66 tindakan. Tindakan mengikuti konvensi AWS VerbNoun dan menggunakan disiplin kata kerja sehingga wildcard Get* dan List* menghasilkan batasan read-only yang bersih.
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateInference | POST /v1/messages |
CountTokens | POST /v1/messages/count_tokens |
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateBatchInference | POST /v1/messages/batches |
GetBatchInference | GET /v1/messages/batches/{id}GET /v1/messages/batches/{id}/results |
ListBatchInferences | GET /v1/messages/batches |
CancelBatchInference | POST /v1/messages/batches/{id}/cancel |
DeleteBatchInference | DELETE /v1/messages/batches/{id} |
| Tindakan | Rute yang diotorisasi |
|---|---|
GetModel | GET /v1/models/{id} |
ListModels | GET /v1/models |
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateFile | POST /v1/files |
GetFile | GET /v1/files/{id}GET /v1/files/{id}/content |
ListFiles | GET /v1/files |
DeleteFile | DELETE /v1/files/{id} |
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateSkill | POST /v1/skills |
GetSkill | GET /v1/skills/{id}GET /v1/skills/{id}/versionsGET /v1/skills/{id}/versions/{version}GET /v1/skills/{id}/versions/{version}/content |
ListSkills | GET /v1/skills |
UpdateSkill | POST /v1/skills/{id}/versionsDELETE /v1/skills/{id}/versions/{version} |
DeleteSkill | DELETE /v1/skills/{id} |
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateAgent | POST /v1/agents |
GetAgent | GET /v1/agents/{id}GET /v1/agents/{id}/versions |
ListAgents | GET /v1/agents |
UpdateAgent | POST /v1/agents/{id} |
ArchiveAgent | POST /v1/agents/{id}/archive |
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateSession | POST /v1/sessions |
GetSession | GET /v1/sessions/{id}GET /v1/sessions/{id}/eventsGET /v1/sessions/{id}/events/streamGET /v1/sessions/{id}/resourcesGET /v1/sessions/{id}/resources/{id} |
ListSessions | GET /v1/sessions |
UpdateSession | POST /v1/sessions/{id}POST /v1/sessions/{id}/eventsPOST /v1/sessions/{id}/resourcesPOST /v1/sessions/{id}/resources/{id}DELETE /v1/sessions/{id}/resources/{id} |
ArchiveSession | POST /v1/sessions/{id}/archive |
DeleteSession | DELETE /v1/sessions/{id} |
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateEnvironment | POST /v1/environments |
GetEnvironment | GET /v1/environments/{id}GET /v1/environments/{id}/workGET /v1/environments/{id}/work/{work_id}GET /v1/environments/{id}/work/stats |
ListEnvironments | GET /v1/environments |
UpdateEnvironment | POST /v1/environments/{id} |
ArchiveEnvironment | POST /v1/environments/{id}/archive |
DeleteEnvironment | DELETE /v1/environments/{id} |
ProcessEnvironmentWork | GET /v1/environments/{id}/work/pollPOST /v1/environments/{id}/work/{work_id}POST /v1/environments/{id}/work/{work_id}/ackPOST /v1/environments/{id}/work/{work_id}/heartbeatPOST /v1/environments/{id}/work/{work_id}/stop |
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateVault | POST /v1/vaults |
GetVault | GET /v1/vaults/{id}GET /v1/vaults/{id}/credentialsGET /v1/vaults/{id}/credentials/{id} |
ListVaults | GET /v1/vaults |
UpdateVault | POST /v1/vaults/{id}POST /v1/vaults/{id}/credentialsPOST /v1/vaults/{id}/credentials/{id}POST /v1/vaults/{id}/credentials/{id}/archiveDELETE /v1/vaults/{id}/credentials/{id} |
ArchiveVault | POST /v1/vaults/{id}/archive |
DeleteVault | DELETE /v1/vaults/{id} |
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateMemoryStore | POST /v1/memory_stores |
GetMemoryStore | GET /v1/memory_stores/{id}GET /v1/memory_stores/{id}/memoriesGET /v1/memory_stores/{id}/memories/{id}GET /v1/memory_stores/{id}/memory_versionsGET /v1/memory_stores/{id}/memory_versions/{id} |
ListMemoryStores | GET /v1/memory_stores |
UpdateMemoryStore | POST /v1/memory_stores/{id}POST /v1/memory_stores/{id}/memoriesPOST /v1/memory_stores/{id}/memories/{id}DELETE /v1/memory_stores/{id}/memories/{id}POST /v1/memory_stores/{id}/memory_versions/{id}/redact |
ArchiveMemoryStore | POST /v1/memory_stores/{id}/archive |
DeleteMemoryStore | DELETE /v1/memory_stores/{id} |
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateWebhook | POST /v1/webhooks |
GetWebhook | GET /v1/webhooks/{id} |
ListWebhooks | GET /v1/webhooks |
UpdateWebhook | POST /v1/webhooks/{id} |
DeleteWebhook | DELETE /v1/webhooks/{id} |
RotateWebhookSecret | POST /v1/webhooks/{id}/regenerate_signing_secret |
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateUserProfile | POST /v1/user_profiles |
GetUserProfile | GET /v1/user_profiles/{id} |
ListUserProfiles | GET /v1/user_profiles |
UpdateUserProfile | POST /v1/user_profiles/{id} |
| Tindakan | Rute yang diotorisasi |
|---|---|
CreateWorkspace | POST /v1/organizations/workspaces |
GetWorkspace | GET /v1/organizations/workspaces/{id} |
ListWorkspaces | GET /v1/organizations/workspaces |
UpdateWorkspace | POST /v1/organizations/workspaces/{id} |
ArchiveWorkspace | POST /v1/organizations/workspaces/{id}/archive |
| Tindakan | Rute yang diotorisasi |
|---|---|
ListComplianceActivities | GET /v1/compliance/activities |
| Tindakan | Rute yang diotorisasi |
|---|---|
CallWithBearerToken | (tidak ada) |
CallWithBearerToken adalah izin lapisan autentikasi yang mengotorisasi principal untuk melakukan autentikasi melalui kunci API (bearer token) alih-alih AWS SigV4. Tindakan ini tidak dipetakan ke rute. Berikan bersama dengan tindakan yang dipetakan ke rute yang Anda inginkan agar dapat dilakukan oleh pemegang kunci API.
| Tindakan | Rute yang diotorisasi |
|---|---|
AssumeConsole | (tidak ada) |
AssumeConsole mengotorisasi principal untuk membuka Claude Console untuk workspace Claude Platform di AWS melalui alur federasi AWS Console. Tindakan ini tidak dipetakan ke rute. Berikan kepada principal yang harus dapat mengklik Open Claude Console pada halaman layanan Claude Platform di AWS dalam AWS Console. Peran Claude Console (Admin atau Developer) ditetapkan secara terpisah oleh perwakilan akun Anthropic Anda; peran tersebut tidak diturunkan dari izin IAM principal. Lihat Menggunakan Claude Console untuk alur masuk dan deskripsi peran.
Tabel berikut mencantumkan setiap rute pada Claude Platform di AWS dan tindakan IAM yang diperlukan untuk memanggilnya. Setiap tindakan IAM juga mengotorisasi permintaan yang menggunakan header anthropic-beta; varian beta dari suatu rute tidak memerlukan tindakan IAM terpisah. CloudTrail mengklasifikasikan setiap tindakan sebagai Data event (operasi data-plane bervolume tinggi) atau Management event (operasi control-plane). Tindakan vault dan webhook diklasifikasikan sebagai Management event karena menyimpan secret (kredensial vault dan signing secret webhook) dan mendapat manfaat dari audit logging yang aktif secara default. Tindakan workspace dan kepatuhan juga diklasifikasikan sebagai Management event karena merupakan operasi control-plane bercakupan organisasi. Semua tindakan lainnya, termasuk inferensi, batch, model, file, skill, profil pengguna, dan tindakan Claude Managed Agents lainnya, diklasifikasikan sebagai Data event.
| Metode | Rute | Tindakan IAM | Tipe event CloudTrail |
|---|---|---|---|
POST | /v1/messages | CreateInference | Data |
POST | /v1/messages/count_tokens | CountTokens | Data |
POST | /v1/messages/batches | CreateBatchInference | Data |
GET | /v1/messages/batches | ListBatchInferences | Data |
GET | /v1/messages/batches/{id} | GetBatchInference | Data |
GET | /v1/messages/batches/{id}/results | GetBatchInference | Data |
POST | /v1/messages/batches/{id}/cancel | CancelBatchInference | Data |
DELETE | /v1/messages/batches/{id} | DeleteBatchInference | Data |
GET | /v1/models | ListModels | Data |
GET | /v1/models/{id} | GetModel | Data |
POST | /v1/files | CreateFile | Data |
GET | /v1/files | ListFiles | Data |
GET | /v1/files/{id} | GetFile | Data |
GET | /v1/files/{id}/content | GetFile | Data |
DELETE | /v1/files/{id} | DeleteFile | Data |
POST | /v1/skills | CreateSkill | Data |
GET | /v1/skills | ListSkills | Data |
GET | /v1/skills/{id} | GetSkill | Data |
DELETE | /v1/skills/{id} | DeleteSkill | Data |
POST | /v1/skills/{id}/versions | UpdateSkill | Data |
GET | /v1/skills/{id}/versions | GetSkill | Data |
GET | /v1/skills/{id}/versions/{version} | GetSkill | Data |
GET | /v1/skills/{id}/versions/{version}/content | GetSkill | Data |
DELETE | /v1/skills/{id}/versions/{version} | UpdateSkill | Data |
POST | /v1/user_profiles | CreateUserProfile | Data |
GET | /v1/user_profiles | ListUserProfiles | Data |
GET | /v1/user_profiles/{id} | GetUserProfile | Data |
POST | /v1/user_profiles/{id} | UpdateUserProfile | Data |
POST | /v1/organizations/workspaces | CreateWorkspace | Management |
GET | /v1/organizations/workspaces | ListWorkspaces | Management |
GET | /v1/organizations/workspaces/{id} | GetWorkspace | Management |
POST | /v1/organizations/workspaces/{id} | UpdateWorkspace | Management |
POST | /v1/organizations/workspaces/{id}/archive | ArchiveWorkspace | Management |
GET | /v1/compliance/activities | ListComplianceActivities | Management |
POST | /v1/agents | CreateAgent | Data |
GET | /v1/agents | ListAgents | Data |
GET | /v1/agents/{id} | GetAgent | Data |
POST | /v1/agents/{id} | UpdateAgent | Data |
POST | /v1/agents/{id}/archive | ArchiveAgent | Data |
GET | /v1/agents/{id}/versions | GetAgent | Data |
POST | /v1/sessions | CreateSession | Data |
GET | /v1/sessions | ListSessions | Data |
GET | /v1/sessions/{id} | GetSession | Data |
POST | /v1/sessions/{id} | UpdateSession | Data |
POST | /v1/sessions/{id}/archive | ArchiveSession | Data |
DELETE | /v1/sessions/{id} | DeleteSession | Data |
GET | /v1/sessions/{id}/events | GetSession | Data |
POST | /v1/sessions/{id}/events | UpdateSession | Data |
GET | /v1/sessions/{id}/events/stream | GetSession | Data |
GET | /v1/sessions/{id}/resources | GetSession | Data |
GET | /v1/sessions/{id}/resources/{id} | GetSession | Data |
POST | /v1/sessions/{id}/resources | UpdateSession | Data |
POST | /v1/sessions/{id}/resources/{id} | UpdateSession | Data |
DELETE | /v1/sessions/{id}/resources/{id} | UpdateSession | Data |
POST | /v1/environments | CreateEnvironment | Data |
GET | /v1/environments | ListEnvironments | Data |
GET | /v1/environments/{id} | GetEnvironment | Data |
POST | /v1/environments/{id} | UpdateEnvironment | Data |
POST | /v1/environments/{id}/archive | ArchiveEnvironment | Data |
DELETE | /v1/environments/{id} | DeleteEnvironment | Data |
GET | /v1/environments/{id}/work | GetEnvironment | Data |
GET | /v1/environments/{id}/work/poll | ProcessEnvironmentWork | Data |
GET | /v1/environments/{id}/work/{work_id} | GetEnvironment | Data |
GET | /v1/environments/{id}/work/stats | GetEnvironment | Data |
POST | /v1/environments/{id}/work/{work_id} | ProcessEnvironmentWork | Data |
POST | /v1/environments/{id}/work/{work_id}/ack | ProcessEnvironmentWork | Data |
POST | /v1/environments/{id}/work/{work_id}/heartbeat | ProcessEnvironmentWork | Data |
POST | /v1/environments/{id}/work/{work_id}/stop | ProcessEnvironmentWork | Data |
POST | /v1/vaults | CreateVault | Management |
GET | /v1/vaults | ListVaults | Management |
GET | /v1/vaults/{id} | GetVault | Management |
POST | /v1/vaults/{id} | UpdateVault | Management |
POST | /v1/vaults/{id}/archive | ArchiveVault | Management |
DELETE | /v1/vaults/{id} | DeleteVault | Management |
GET | /v1/vaults/{id}/credentials | GetVault | Management |
POST | /v1/vaults/{id}/credentials | UpdateVault | Management |
GET | /v1/vaults/{id}/credentials/{id} | GetVault | Management |
POST | /v1/vaults/{id}/credentials/{id} | UpdateVault | Management |
POST | /v1/vaults/{id}/credentials/{id}/archive | UpdateVault | Management |
DELETE | /v1/vaults/{id}/credentials/{id} | UpdateVault | Management |
POST | /v1/memory_stores | CreateMemoryStore | Data |
GET | /v1/memory_stores | ListMemoryStores | Data |
GET | /v1/memory_stores/{id} | GetMemoryStore | Data |
POST | /v1/memory_stores/{id} | UpdateMemoryStore | Data |
POST | /v1/memory_stores/{id}/archive | ArchiveMemoryStore | Data |
DELETE | /v1/memory_stores/{id} | DeleteMemoryStore | Data |
POST | /v1/memory_stores/{id}/memories | UpdateMemoryStore | Data |
GET | /v1/memory_stores/{id}/memories | GetMemoryStore | Data |
GET | /v1/memory_stores/{id}/memories/{id} | GetMemoryStore | Data |
POST | /v1/memory_stores/{id}/memories/{id} | UpdateMemoryStore | Data |
DELETE | /v1/memory_stores/{id}/memories/{id} | UpdateMemoryStore | Data |
GET | /v1/memory_stores/{id}/memory_versions | GetMemoryStore | Data |
GET | /v1/memory_stores/{id}/memory_versions/{id} | GetMemoryStore | Data |
POST | /v1/memory_stores/{id}/memory_versions/{id}/redact | UpdateMemoryStore | Data |
GET | /v1/webhooks | ListWebhooks | Management |
GET | /v1/webhooks/{id} | GetWebhook | Management |
POST | /v1/webhooks | CreateWebhook | Management |
POST | /v1/webhooks/{id} | UpdateWebhook | Management |
DELETE | /v1/webhooks/{id} | DeleteWebhook | Management |
POST | /v1/webhooks/{id}/regenerate_signing_secret | RotateWebhookSecret | Management |
Rute yang tidak ada dalam tabel ini tidak tersedia di Claude Platform di AWS. Gateway menolak secara default rute apa pun yang tidak tercantum di sini.
AWS menyediakan lima kebijakan terkelola untuk Claude Platform di AWS. Semua kebijakan terkelola berlaku untuk Resource: "*".
| Kebijakan | Memberikan |
|---|---|
AnthropicFullAccess | aws-external-anthropic:* |
AnthropicReadOnlyAccess | Get*, List*, CallWithBearerToken |
AnthropicInferenceAccess | Get*, List*, CreateInference, CreateBatchInference, CancelBatchInference, DeleteBatchInference, CountTokens, CallWithBearerToken |
AnthropicLimitedAccess | Semua tindakan AnthropicInferenceAccess, ditambah semua tindakan Claude Managed Agents (agent, session, environment, vault, memory store, webhook, dan pekerjaan environment yang di-host sendiri) |
AnthropicSelfHostedEnvironmentAccess | GetEnvironment, ProcessEnvironmentWork, GetSession, UpdateSession, GetSkill, CallWithBearerToken |
AnthropicInferenceAccess adalah kebijakan terkelola paling sempit yang cukup untuk menjalankan inferensi. Kebijakan ini mencakup inferensi sinkron dan batch, dan melalui wildcard Get* dan List*, memberikan akses baca ke setiap sumber daya API dalam namespace, termasuk sumber daya Claude Managed Agents (CMA) (agent, session, environment, vault, memory store, dan webhook). Ini mencakup pengunduhan konten file melalui GetFile (lihat catatan File), pengunduhan konten skill melalui GetSkill (lihat catatan Skill), dan konten memori melalui GetMemoryStore. Secret kredensial vault dan signing secret webhook tidak diekspos: field tersebut bersifat write-only dan tidak pernah dikembalikan oleh GetVault atau GetWebhook (lihat Autentikasi dengan vault). AnthropicInferenceAccess tidak memberikan pembuatan atau penghapusan file, pengelolaan skill, pengelolaan profil pengguna, mutasi workspace, atau tindakan tulis Claude Managed Agents apa pun (create, update, archive, delete, process, atau rotate). Untuk mengecualikan pembacaan CMA, ganti AnthropicInferenceAccess dengan kebijakan kustom yang hanya menyebutkan tindakan non-CMA spesifik yang Anda butuhkan.
AnthropicLimitedAccess mencakup semua tindakan Claude Managed Agents selain tindakan inferensi.
AnthropicSelfHostedEnvironmentAccess adalah kebijakan terkelola paling sempit yang cukup untuk menjalankan worker sandbox yang di-host sendiri. Lampirkan ke principal yang digunakan worker environment Anda untuk autentikasi.
AssumeConsole tidak termasuk dalam AnthropicReadOnlyAccess, AnthropicInferenceAccess, AnthropicLimitedAccess, atau AnthropicSelfHostedEnvironmentAccess. Principal yang memerlukan akses Claude Console memerlukan AnthropicFullAccess atau kebijakan kustom yang memberikan aws-external-anthropic:AssumeConsole. Lihat Akses konsol.
Memberikan izin minimal untuk principal IAM yang menjalankan inferensi terhadap satu workspace produksi:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"aws-external-anthropic:CreateInference",
"aws-external-anthropic:CountTokens",
"aws-external-anthropic:GetModel",
"aws-external-anthropic:ListModels",
"aws-external-anthropic:GetWorkspace"
],
"Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
}
]
}Membatasi peran ke satu workspace:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "aws-external-anthropic:*",
"Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
},
{
"Effect": "Allow",
"Action": [
"aws-external-anthropic:CallWithBearerToken",
"aws-external-anthropic:AssumeConsole"
],
"Resource": "*"
}
]
}Memblokir pemrosesan batch dan unggahan file pada workspace tertentu sambil tetap menyediakan inferensi sinkron. Berguna ketika workspace menangani data Zero Data Retention (ZDR) yang tidak boleh disimpan di sisi server. Lampirkan kebijakan ini bersama dengan kebijakan Allow seperti AnthropicInferenceAccess atau contoh workspace tunggal; jika berdiri sendiri, kebijakan yang hanya berisi Deny tidak memberikan izin apa pun:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": [
"aws-external-anthropic:CreateBatchInference",
"aws-external-anthropic:CreateFile"
],
"Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
}
]
}Memberikan peran CI/CD tindakan yang diperlukan untuk membuat dan mengelola workspace, tanpa izin inferensi apa pun:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"aws-external-anthropic:CreateWorkspace",
"aws-external-anthropic:GetWorkspace",
"aws-external-anthropic:ListWorkspaces",
"aws-external-anthropic:UpdateWorkspace",
"aws-external-anthropic:ArchiveWorkspace"
],
"Resource": "*"
}
]
}CreateWorkspace dan ListWorkspaces adalah operasi bercakupan akun. Menentukan ARN workspace pada tindakan ini tidak berpengaruh; gunakan Resource: "*".
Was this page helpful?