API 參考支援與設定

Claude Platform on AWS 的 IAM 動作

透過 AWS 政策控制 Claude Platform on AWS 存取權限的 IAM 動作參考。

Claude Platform on AWS 使用 AWS IAM 進行存取控制。每個 API 路由都對應到 aws-external-anthropic 命名空間中的一個 IAM 動作。本頁面列出所有動作、每個動作授權的路由，以及適用於常見存取模式的受管政策。如需平台設定與身分驗證的相關資訊，請參閱 Claude Platform on AWS。

服務詳細資訊

屬性	值
IAM 服務前綴	`aws-external-anthropic`
資源類型	`workspace`

Workspace ARN 格式：

arn:aws:aws-external-anthropic:{region}:{account-id}:workspace/{workspace-id}

ARN 區域一律會填入，並與工作區所繫結的區域相符。資源區段是帶標籤的工作區 ID（wrkspc_...），與您在 anthropic-workspace-id 標頭中傳遞的值相同。

動作

此服務定義了 66 個動作。動作遵循 AWS 的 VerbNoun 慣例，並採用動詞規範，使 Get* 和 List* 萬用字元能產生清晰的唯讀邊界。

推論

動作	授權的路由
`CreateInference`	`POST /v1/messages`
`CountTokens`	`POST /v1/messages/count_tokens`

批次處理

動作	授權的路由
`CreateBatchInference`	`POST /v1/messages/batches`
`GetBatchInference`	`GET /v1/messages/batches/{id}` `GET /v1/messages/batches/{id}/results`
`ListBatchInferences`	`GET /v1/messages/batches`
`CancelBatchInference`	`POST /v1/messages/batches/{id}/cancel`
`DeleteBatchInference`	`DELETE /v1/messages/batches/{id}`

模型

動作	授權的路由
`GetModel`	`GET /v1/models/{id}`
`ListModels`	`GET /v1/models`

檔案

動作	授權的路由
`CreateFile`	`POST /v1/files`
`GetFile`	`GET /v1/files/{id}` `GET /v1/files/{id}/content`
`ListFiles`	`GET /v1/files`
`DeleteFile`	`DELETE /v1/files/{id}`

技能

動作	授權的路由
`CreateSkill`	`POST /v1/skills`
`GetSkill`	`GET /v1/skills/{id}` `GET /v1/skills/{id}/versions` `GET /v1/skills/{id}/versions/{version}` `GET /v1/skills/{id}/versions/{version}/content`
`ListSkills`	`GET /v1/skills`
`UpdateSkill`	`POST /v1/skills/{id}/versions` `DELETE /v1/skills/{id}/versions/{version}`
`DeleteSkill`	`DELETE /v1/skills/{id}`

代理程式

動作	授權的路由
`CreateAgent`	`POST /v1/agents`
`GetAgent`	`GET /v1/agents/{id}` `GET /v1/agents/{id}/versions`
`ListAgents`	`GET /v1/agents`
`UpdateAgent`	`POST /v1/agents/{id}`
`ArchiveAgent`	`POST /v1/agents/{id}/archive`

工作階段

動作	授權的路由
`CreateSession`	`POST /v1/sessions`
`GetSession`	`GET /v1/sessions/{id}` `GET /v1/sessions/{id}/events` `GET /v1/sessions/{id}/events/stream` `GET /v1/sessions/{id}/resources` `GET /v1/sessions/{id}/resources/{id}`
`ListSessions`	`GET /v1/sessions`
`UpdateSession`	`POST /v1/sessions/{id}` `POST /v1/sessions/{id}/events` `POST /v1/sessions/{id}/resources` `POST /v1/sessions/{id}/resources/{id}` `DELETE /v1/sessions/{id}/resources/{id}`
`ArchiveSession`	`POST /v1/sessions/{id}/archive`
`DeleteSession`	`DELETE /v1/sessions/{id}`

環境

動作	授權的路由
`CreateEnvironment`	`POST /v1/environments`
`GetEnvironment`	`GET /v1/environments/{id}` `GET /v1/environments/{id}/work` `GET /v1/environments/{id}/work/{work_id}` `GET /v1/environments/{id}/work/stats`
`ListEnvironments`	`GET /v1/environments`
`UpdateEnvironment`	`POST /v1/environments/{id}`
`ArchiveEnvironment`	`POST /v1/environments/{id}/archive`
`DeleteEnvironment`	`DELETE /v1/environments/{id}`
`ProcessEnvironmentWork`	`GET /v1/environments/{id}/work/poll` `POST /v1/environments/{id}/work/{work_id}` `POST /v1/environments/{id}/work/{work_id}/ack` `POST /v1/environments/{id}/work/{work_id}/heartbeat` `POST /v1/environments/{id}/work/{work_id}/stop`

保管庫

動作	授權的路由
`CreateVault`	`POST /v1/vaults`
`GetVault`	`GET /v1/vaults/{id}` `GET /v1/vaults/{id}/credentials` `GET /v1/vaults/{id}/credentials/{id}`
`ListVaults`	`GET /v1/vaults`
`UpdateVault`	`POST /v1/vaults/{id}` `POST /v1/vaults/{id}/credentials` `POST /v1/vaults/{id}/credentials/{id}` `POST /v1/vaults/{id}/credentials/{id}/archive` `DELETE /v1/vaults/{id}/credentials/{id}`
`ArchiveVault`	`POST /v1/vaults/{id}/archive`
`DeleteVault`	`DELETE /v1/vaults/{id}`

記憶體存放區

動作	授權的路由
`CreateMemoryStore`	`POST /v1/memory_stores`
`GetMemoryStore`	`GET /v1/memory_stores/{id}` `GET /v1/memory_stores/{id}/memories` `GET /v1/memory_stores/{id}/memories/{id}` `GET /v1/memory_stores/{id}/memory_versions` `GET /v1/memory_stores/{id}/memory_versions/{id}`
`ListMemoryStores`	`GET /v1/memory_stores`
`UpdateMemoryStore`	`POST /v1/memory_stores/{id}` `POST /v1/memory_stores/{id}/memories` `POST /v1/memory_stores/{id}/memories/{id}` `DELETE /v1/memory_stores/{id}/memories/{id}` `POST /v1/memory_stores/{id}/memory_versions/{id}/redact`
`ArchiveMemoryStore`	`POST /v1/memory_stores/{id}/archive`
`DeleteMemoryStore`	`DELETE /v1/memory_stores/{id}`

Webhook

動作	授權的路由
`CreateWebhook`	`POST /v1/webhooks`
`GetWebhook`	`GET /v1/webhooks/{id}`
`ListWebhooks`	`GET /v1/webhooks`
`UpdateWebhook`	`POST /v1/webhooks/{id}`
`DeleteWebhook`	`DELETE /v1/webhooks/{id}`
`RotateWebhookSecret`	`POST /v1/webhooks/{id}/regenerate_signing_secret`

使用者設定檔

動作	授權的路由
`CreateUserProfile`	`POST /v1/user_profiles`
`GetUserProfile`	`GET /v1/user_profiles/{id}`
`ListUserProfiles`	`GET /v1/user_profiles`
`UpdateUserProfile`	`POST /v1/user_profiles/{id}`

工作區

動作	授權的路由
`CreateWorkspace`	`POST /v1/organizations/workspaces`
`GetWorkspace`	`GET /v1/organizations/workspaces/{id}`
`ListWorkspaces`	`GET /v1/organizations/workspaces`
`UpdateWorkspace`	`POST /v1/organizations/workspaces/{id}`
`ArchiveWorkspace`	`POST /v1/organizations/workspaces/{id}/archive`

合規性

動作	授權的路由
`ListComplianceActivities`	`GET /v1/compliance/activities`

身分驗證

動作	授權的路由
`CallWithBearerToken`	（無）

CallWithBearerToken 是一個身分驗證層權限，授權主體透過 API 金鑰（bearer token）而非 AWS SigV4 進行身分驗證。它不對應到任何路由。請將其與您希望 API 金鑰持有者執行的路由對應動作一併授予。

主控台存取

動作	授權的路由
`AssumeConsole`	（無）

AssumeConsole 授權主體透過 AWS Console 聯合流程為 Claude Platform on AWS 工作區開啟 Claude Console。它不對應到任何路由。請將其授予應能在 AWS Console 的 Claude Platform on AWS 服務頁面上點選 Open Claude Console 的主體。Claude Console 角色（Admin 或 Developer）由您的 Anthropic 客戶代表另行指派；它並非從主體的 IAM 權限衍生而來。如需登入流程和角色說明，請參閱使用 Claude Console。

路由與動作對應

下表列出 Claude Platform on AWS 上的每個路由以及呼叫該路由所需的 IAM 動作。每個 IAM 動作也授權使用 anthropic-beta 標頭的請求；路由的 beta 變體不需要單獨的 IAM 動作。CloudTrail 將每個動作分類為 Data 事件（高流量的資料平面操作）或 Management 事件（控制平面操作）。保管庫和 webhook 動作被分類為 Management 事件，因為它們持有密鑰（保管庫憑證和 webhook 簽署密鑰），並受益於預設開啟的稽核日誌記錄。工作區和合規性動作也被分類為 Management 事件，因為它們是組織範圍的控制平面操作。所有其他動作，包括推論、批次、模型、檔案、技能、使用者設定檔以及其餘的 Claude Managed Agents 動作，都被分類為 Data 事件。

方法	路由	IAM 動作	CloudTrail 事件類型
`POST`	`/v1/messages`	`CreateInference`	Data
`POST`	`/v1/messages/count_tokens`	`CountTokens`	Data
`POST`	`/v1/messages/batches`	`CreateBatchInference`	Data
`GET`	`/v1/messages/batches`	`ListBatchInferences`	Data
`GET`	`/v1/messages/batches/{id}`	`GetBatchInference`	Data
`GET`	`/v1/messages/batches/{id}/results`	`GetBatchInference`	Data
`POST`	`/v1/messages/batches/{id}/cancel`	`CancelBatchInference`	Data
`DELETE`	`/v1/messages/batches/{id}`	`DeleteBatchInference`	Data
`GET`	`/v1/models`	`ListModels`	Data
`GET`	`/v1/models/{id}`	`GetModel`	Data
`POST`	`/v1/files`	`CreateFile`	Data
`GET`	`/v1/files`	`ListFiles`	Data
`GET`	`/v1/files/{id}`	`GetFile`	Data
`GET`	`/v1/files/{id}/content`	`GetFile`	Data
`DELETE`	`/v1/files/{id}`	`DeleteFile`	Data
`POST`	`/v1/skills`	`CreateSkill`	Data
`GET`	`/v1/skills`	`ListSkills`	Data
`GET`	`/v1/skills/{id}`	`GetSkill`	Data
`DELETE`	`/v1/skills/{id}`	`DeleteSkill`	Data
`POST`	`/v1/skills/{id}/versions`	`UpdateSkill`	Data
`GET`	`/v1/skills/{id}/versions`	`GetSkill`	Data
`GET`	`/v1/skills/{id}/versions/{version}`	`GetSkill`	Data
`GET`	`/v1/skills/{id}/versions/{version}/content`	`GetSkill`	Data
`DELETE`	`/v1/skills/{id}/versions/{version}`	`UpdateSkill`	Data
`POST`	`/v1/user_profiles`	`CreateUserProfile`	Data
`GET`	`/v1/user_profiles`	`ListUserProfiles`	Data
`GET`	`/v1/user_profiles/{id}`	`GetUserProfile`	Data
`POST`	`/v1/user_profiles/{id}`	`UpdateUserProfile`	Data
`POST`	`/v1/organizations/workspaces`	`CreateWorkspace`	Management
`GET`	`/v1/organizations/workspaces`	`ListWorkspaces`	Management
`GET`	`/v1/organizations/workspaces/{id}`	`GetWorkspace`	Management
`POST`	`/v1/organizations/workspaces/{id}`	`UpdateWorkspace`	Management
`POST`	`/v1/organizations/workspaces/{id}/archive`	`ArchiveWorkspace`	Management
`GET`	`/v1/compliance/activities`	`ListComplianceActivities`	Management
`POST`	`/v1/agents`	`CreateAgent`	Data
`GET`	`/v1/agents`	`ListAgents`	Data
`GET`	`/v1/agents/{id}`	`GetAgent`	Data
`POST`	`/v1/agents/{id}`	`UpdateAgent`	Data
`POST`	`/v1/agents/{id}/archive`	`ArchiveAgent`	Data
`GET`	`/v1/agents/{id}/versions`	`GetAgent`	Data
`POST`	`/v1/sessions`	`CreateSession`	Data
`GET`	`/v1/sessions`	`ListSessions`	Data
`GET`	`/v1/sessions/{id}`	`GetSession`	Data
`POST`	`/v1/sessions/{id}`	`UpdateSession`	Data
`POST`	`/v1/sessions/{id}/archive`	`ArchiveSession`	Data
`DELETE`	`/v1/sessions/{id}`	`DeleteSession`	Data
`GET`	`/v1/sessions/{id}/events`	`GetSession`	Data
`POST`	`/v1/sessions/{id}/events`	`UpdateSession`	Data
`GET`	`/v1/sessions/{id}/events/stream`	`GetSession`	Data
`GET`	`/v1/sessions/{id}/resources`	`GetSession`	Data
`GET`	`/v1/sessions/{id}/resources/{id}`	`GetSession`	Data
`POST`	`/v1/sessions/{id}/resources`	`UpdateSession`	Data
`POST`	`/v1/sessions/{id}/resources/{id}`	`UpdateSession`	Data
`DELETE`	`/v1/sessions/{id}/resources/{id}`	`UpdateSession`	Data
`POST`	`/v1/environments`	`CreateEnvironment`	Data
`GET`	`/v1/environments`	`ListEnvironments`	Data
`GET`	`/v1/environments/{id}`	`GetEnvironment`	Data
`POST`	`/v1/environments/{id}`	`UpdateEnvironment`	Data
`POST`	`/v1/environments/{id}/archive`	`ArchiveEnvironment`	Data
`DELETE`	`/v1/environments/{id}`	`DeleteEnvironment`	Data
`GET`	`/v1/environments/{id}/work`	`GetEnvironment`	Data
`GET`	`/v1/environments/{id}/work/poll`	`ProcessEnvironmentWork`	Data
`GET`	`/v1/environments/{id}/work/{work_id}`	`GetEnvironment`	Data
`GET`	`/v1/environments/{id}/work/stats`	`GetEnvironment`	Data
`POST`	`/v1/environments/{id}/work/{work_id}`	`ProcessEnvironmentWork`	Data
`POST`	`/v1/environments/{id}/work/{work_id}/ack`	`ProcessEnvironmentWork`	Data
`POST`	`/v1/environments/{id}/work/{work_id}/heartbeat`	`ProcessEnvironmentWork`	Data
`POST`	`/v1/environments/{id}/work/{work_id}/stop`	`ProcessEnvironmentWork`	Data
`POST`	`/v1/vaults`	`CreateVault`	Management
`GET`	`/v1/vaults`	`ListVaults`	Management
`GET`	`/v1/vaults/{id}`	`GetVault`	Management
`POST`	`/v1/vaults/{id}`	`UpdateVault`	Management
`POST`	`/v1/vaults/{id}/archive`	`ArchiveVault`	Management
`DELETE`	`/v1/vaults/{id}`	`DeleteVault`	Management
`GET`	`/v1/vaults/{id}/credentials`	`GetVault`	Management
`POST`	`/v1/vaults/{id}/credentials`	`UpdateVault`	Management
`GET`	`/v1/vaults/{id}/credentials/{id}`	`GetVault`	Management
`POST`	`/v1/vaults/{id}/credentials/{id}`	`UpdateVault`	Management
`POST`	`/v1/vaults/{id}/credentials/{id}/archive`	`UpdateVault`	Management
`DELETE`	`/v1/vaults/{id}/credentials/{id}`	`UpdateVault`	Management
`POST`	`/v1/memory_stores`	`CreateMemoryStore`	Data
`GET`	`/v1/memory_stores`	`ListMemoryStores`	Data
`GET`	`/v1/memory_stores/{id}`	`GetMemoryStore`	Data
`POST`	`/v1/memory_stores/{id}`	`UpdateMemoryStore`	Data
`POST`	`/v1/memory_stores/{id}/archive`	`ArchiveMemoryStore`	Data
`DELETE`	`/v1/memory_stores/{id}`	`DeleteMemoryStore`	Data
`POST`	`/v1/memory_stores/{id}/memories`	`UpdateMemoryStore`	Data
`GET`	`/v1/memory_stores/{id}/memories`	`GetMemoryStore`	Data
`GET`	`/v1/memory_stores/{id}/memories/{id}`	`GetMemoryStore`	Data
`POST`	`/v1/memory_stores/{id}/memories/{id}`	`UpdateMemoryStore`	Data
`DELETE`	`/v1/memory_stores/{id}/memories/{id}`	`UpdateMemoryStore`	Data
`GET`	`/v1/memory_stores/{id}/memory_versions`	`GetMemoryStore`	Data
`GET`	`/v1/memory_stores/{id}/memory_versions/{id}`	`GetMemoryStore`	Data
`POST`	`/v1/memory_stores/{id}/memory_versions/{id}/redact`	`UpdateMemoryStore`	Data
`GET`	`/v1/webhooks`	`ListWebhooks`	Management
`GET`	`/v1/webhooks/{id}`	`GetWebhook`	Management
`POST`	`/v1/webhooks`	`CreateWebhook`	Management
`POST`	`/v1/webhooks/{id}`	`UpdateWebhook`	Management
`DELETE`	`/v1/webhooks/{id}`	`DeleteWebhook`	Management
`POST`	`/v1/webhooks/{id}/regenerate_signing_secret`	`RotateWebhookSecret`	Management

不在此表中的路由在 Claude Platform on AWS 上不可用。閘道預設會拒絕此處未列出的任何路由。

受管政策

AWS 為 Claude Platform on AWS 提供五個受管政策。所有受管政策都適用於 Resource: "*"。

政策	授予
`AnthropicFullAccess`	`aws-external-anthropic:*`
`AnthropicReadOnlyAccess`	`Get`、`List`、`CallWithBearerToken`
`AnthropicInferenceAccess`	`Get`、`List`、`CreateInference`、`CreateBatchInference`、`CancelBatchInference`、`DeleteBatchInference`、`CountTokens`、`CallWithBearerToken`
`AnthropicLimitedAccess`	所有 `AnthropicInferenceAccess` 動作，加上所有 Claude Managed Agents 動作（代理程式、工作階段、環境、保管庫、記憶體存放區、webhook 和自行託管環境工作）
`AnthropicSelfHostedEnvironmentAccess`	`GetEnvironment`、`ProcessEnvironmentWork`、`GetSession`、`UpdateSession`、`GetSkill`、`CallWithBearerToken`

AnthropicInferenceAccess 是足以執行推論的最小受管政策。它涵蓋同步和批次推論，並透過 Get* 和 List* 萬用字元授予對命名空間中每個 API 資源的讀取存取權限，包括 Claude Managed Agents（CMA）資源（代理程式、工作階段、環境、保管庫、記憶體存放區和 webhook）。這包括透過 GetFile 下載檔案內容（請參閱檔案附註）、透過 GetSkill 下載技能內容（請參閱技能附註），以及透過 GetMemoryStore 讀取記憶體內容。保管庫憑證密鑰和 webhook 簽署密鑰不會公開：這些欄位為唯寫，且 GetVault 或 GetWebhook 永遠不會傳回這些欄位（請參閱使用保管庫進行身分驗證）。AnthropicInferenceAccess 不授予檔案建立或刪除、技能管理、使用者設定檔管理、工作區變更，或任何 Claude Managed Agents 寫入動作（建立、更新、封存、刪除、處理或輪替）。若要排除 CMA 讀取，請將 AnthropicInferenceAccess 替換為僅列舉您所需特定非 CMA 動作的自訂政策。

AnthropicLimitedAccess 除了推論動作外，還包含所有 Claude Managed Agents 動作。

AnthropicSelfHostedEnvironmentAccess 是足以執行自行託管沙箱工作程式的最小受管政策。請將其附加到您的環境工作程式用於身分驗證的主體。

AssumeConsole 不包含在 AnthropicReadOnlyAccess、AnthropicInferenceAccess、AnthropicLimitedAccess 或 AnthropicSelfHostedEnvironmentAccess 中。需要 Claude Console 存取權限的主體需要 AnthropicFullAccess 或授予 aws-external-anthropic:AssumeConsole 的自訂政策。請參閱主控台存取。

範例政策

單一工作區上的同步推論

為針對一個生產工作區執行推論的 IAM 主體授予最小權限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CreateInference",
        "aws-external-anthropic:CountTokens",
        "aws-external-anthropic:GetModel",
        "aws-external-anthropic:ListModels",
        "aws-external-anthropic:GetWorkspace"
      ],
      "Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    }
  ]
}

每個客戶的工作區隔離

將角色限制為單一工作區：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "aws-external-anthropic:*",
      "Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    },
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CallWithBearerToken",
        "aws-external-anthropic:AssumeConsole"
      ],
      "Resource": "*"
    }
  ]
}

ZDR 敏感工作區的功能鎖定

在特定工作區上封鎖批次處理和檔案上傳，同時保留同步推論可用。當工作區處理不得在伺服器端保留的零資料保留（ZDR）資料時，此設定很有用。請將此政策與 Allow 政策（例如 AnthropicInferenceAccess 或單一工作區範例）一併附加；單獨使用時，僅含 Deny 的政策不會授予任何權限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "aws-external-anthropic:CreateBatchInference",
        "aws-external-anthropic:CreateFile"
      ],
      "Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    }
  ]
}

佈建自動化

授予 CI/CD 角色建立和管理工作區所需的動作，但不包含任何推論權限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CreateWorkspace",
        "aws-external-anthropic:GetWorkspace",
        "aws-external-anthropic:ListWorkspaces",
        "aws-external-anthropic:UpdateWorkspace",
        "aws-external-anthropic:ArchiveWorkspace"
      ],
      "Resource": "*"
    }
  ]
}

CreateWorkspace 和 ListWorkspaces 是帳戶範圍的操作。在這些動作上指定工作區 ARN 沒有任何效果；請使用 Resource: "*"。

另請參閱

Claude Platform on AWS，了解設定、身分驗證和平台概觀
AWS IAM 使用者指南，了解 IAM 政策語法和評估邏輯
AWS CloudTrail 使用者指南，了解稽核日誌記錄設定

Was this page helpful?

API 參考支援與設定

Claude Platform on AWS 的 IAM 動作

透過 AWS 政策控制 Claude Platform on AWS 存取權限的 IAM 動作參考。

服務詳細資訊

屬性	值
IAM 服務前綴	`aws-external-anthropic`
資源類型	`workspace`

Workspace ARN 格式：

arn:aws:aws-external-anthropic:{region}:{account-id}:workspace/{workspace-id}

ARN 區域一律會填入，並與工作區所繫結的區域相符。資源區段是帶標籤的工作區 ID（wrkspc_...），與您在 anthropic-workspace-id 標頭中傳遞的值相同。

動作

此服務定義了 66 個動作。動作遵循 AWS 的 VerbNoun 慣例，並採用動詞規範，使 Get* 和 List* 萬用字元能產生清晰的唯讀邊界。

推論

動作	授權的路由
`CreateInference`	`POST /v1/messages`
`CountTokens`	`POST /v1/messages/count_tokens`

批次處理

動作	授權的路由
`CreateBatchInference`	`POST /v1/messages/batches`
`GetBatchInference`	`GET /v1/messages/batches/{id}` `GET /v1/messages/batches/{id}/results`
`ListBatchInferences`	`GET /v1/messages/batches`
`CancelBatchInference`	`POST /v1/messages/batches/{id}/cancel`
`DeleteBatchInference`	`DELETE /v1/messages/batches/{id}`

模型

動作	授權的路由
`GetModel`	`GET /v1/models/{id}`
`ListModels`	`GET /v1/models`

檔案

動作	授權的路由
`CreateFile`	`POST /v1/files`
`GetFile`	`GET /v1/files/{id}` `GET /v1/files/{id}/content`
`ListFiles`	`GET /v1/files`
`DeleteFile`	`DELETE /v1/files/{id}`

技能

動作	授權的路由
`CreateSkill`	`POST /v1/skills`
`GetSkill`	`GET /v1/skills/{id}` `GET /v1/skills/{id}/versions` `GET /v1/skills/{id}/versions/{version}` `GET /v1/skills/{id}/versions/{version}/content`
`ListSkills`	`GET /v1/skills`
`UpdateSkill`	`POST /v1/skills/{id}/versions` `DELETE /v1/skills/{id}/versions/{version}`
`DeleteSkill`	`DELETE /v1/skills/{id}`

代理程式

動作	授權的路由
`CreateAgent`	`POST /v1/agents`
`GetAgent`	`GET /v1/agents/{id}` `GET /v1/agents/{id}/versions`
`ListAgents`	`GET /v1/agents`
`UpdateAgent`	`POST /v1/agents/{id}`
`ArchiveAgent`	`POST /v1/agents/{id}/archive`

工作階段

動作	授權的路由
`CreateSession`	`POST /v1/sessions`
`GetSession`	`GET /v1/sessions/{id}` `GET /v1/sessions/{id}/events` `GET /v1/sessions/{id}/events/stream` `GET /v1/sessions/{id}/resources` `GET /v1/sessions/{id}/resources/{id}`
`ListSessions`	`GET /v1/sessions`
`UpdateSession`	`POST /v1/sessions/{id}` `POST /v1/sessions/{id}/events` `POST /v1/sessions/{id}/resources` `POST /v1/sessions/{id}/resources/{id}` `DELETE /v1/sessions/{id}/resources/{id}`
`ArchiveSession`	`POST /v1/sessions/{id}/archive`
`DeleteSession`	`DELETE /v1/sessions/{id}`

環境

動作	授權的路由
`CreateEnvironment`	`POST /v1/environments`
`GetEnvironment`	`GET /v1/environments/{id}` `GET /v1/environments/{id}/work` `GET /v1/environments/{id}/work/{work_id}` `GET /v1/environments/{id}/work/stats`
`ListEnvironments`	`GET /v1/environments`
`UpdateEnvironment`	`POST /v1/environments/{id}`
`ArchiveEnvironment`	`POST /v1/environments/{id}/archive`
`DeleteEnvironment`	`DELETE /v1/environments/{id}`
`ProcessEnvironmentWork`	`GET /v1/environments/{id}/work/poll` `POST /v1/environments/{id}/work/{work_id}` `POST /v1/environments/{id}/work/{work_id}/ack` `POST /v1/environments/{id}/work/{work_id}/heartbeat` `POST /v1/environments/{id}/work/{work_id}/stop`

保管庫

動作	授權的路由
`CreateVault`	`POST /v1/vaults`
`GetVault`	`GET /v1/vaults/{id}` `GET /v1/vaults/{id}/credentials` `GET /v1/vaults/{id}/credentials/{id}`
`ListVaults`	`GET /v1/vaults`
`UpdateVault`	`POST /v1/vaults/{id}` `POST /v1/vaults/{id}/credentials` `POST /v1/vaults/{id}/credentials/{id}` `POST /v1/vaults/{id}/credentials/{id}/archive` `DELETE /v1/vaults/{id}/credentials/{id}`
`ArchiveVault`	`POST /v1/vaults/{id}/archive`
`DeleteVault`	`DELETE /v1/vaults/{id}`

記憶體存放區

動作	授權的路由
`CreateMemoryStore`	`POST /v1/memory_stores`
`GetMemoryStore`	`GET /v1/memory_stores/{id}` `GET /v1/memory_stores/{id}/memories` `GET /v1/memory_stores/{id}/memories/{id}` `GET /v1/memory_stores/{id}/memory_versions` `GET /v1/memory_stores/{id}/memory_versions/{id}`
`ListMemoryStores`	`GET /v1/memory_stores`
`UpdateMemoryStore`	`POST /v1/memory_stores/{id}` `POST /v1/memory_stores/{id}/memories` `POST /v1/memory_stores/{id}/memories/{id}` `DELETE /v1/memory_stores/{id}/memories/{id}` `POST /v1/memory_stores/{id}/memory_versions/{id}/redact`
`ArchiveMemoryStore`	`POST /v1/memory_stores/{id}/archive`
`DeleteMemoryStore`	`DELETE /v1/memory_stores/{id}`

Webhook

動作	授權的路由
`CreateWebhook`	`POST /v1/webhooks`
`GetWebhook`	`GET /v1/webhooks/{id}`
`ListWebhooks`	`GET /v1/webhooks`
`UpdateWebhook`	`POST /v1/webhooks/{id}`
`DeleteWebhook`	`DELETE /v1/webhooks/{id}`
`RotateWebhookSecret`	`POST /v1/webhooks/{id}/regenerate_signing_secret`

使用者設定檔

動作	授權的路由
`CreateUserProfile`	`POST /v1/user_profiles`
`GetUserProfile`	`GET /v1/user_profiles/{id}`
`ListUserProfiles`	`GET /v1/user_profiles`
`UpdateUserProfile`	`POST /v1/user_profiles/{id}`

工作區

動作	授權的路由
`CreateWorkspace`	`POST /v1/organizations/workspaces`
`GetWorkspace`	`GET /v1/organizations/workspaces/{id}`
`ListWorkspaces`	`GET /v1/organizations/workspaces`
`UpdateWorkspace`	`POST /v1/organizations/workspaces/{id}`
`ArchiveWorkspace`	`POST /v1/organizations/workspaces/{id}/archive`

合規性

動作	授權的路由
`ListComplianceActivities`	`GET /v1/compliance/activities`

身分驗證

動作	授權的路由
`CallWithBearerToken`	（無）

主控台存取

動作	授權的路由
`AssumeConsole`	（無）

路由與動作對應

方法	路由	IAM 動作	CloudTrail 事件類型
`POST`	`/v1/messages`	`CreateInference`	Data
`POST`	`/v1/messages/count_tokens`	`CountTokens`	Data
`POST`	`/v1/messages/batches`	`CreateBatchInference`	Data
`GET`	`/v1/messages/batches`	`ListBatchInferences`	Data
`GET`	`/v1/messages/batches/{id}`	`GetBatchInference`	Data
`GET`	`/v1/messages/batches/{id}/results`	`GetBatchInference`	Data
`POST`	`/v1/messages/batches/{id}/cancel`	`CancelBatchInference`	Data
`DELETE`	`/v1/messages/batches/{id}`	`DeleteBatchInference`	Data
`GET`	`/v1/models`	`ListModels`	Data
`GET`	`/v1/models/{id}`	`GetModel`	Data
`POST`	`/v1/files`	`CreateFile`	Data
`GET`	`/v1/files`	`ListFiles`	Data
`GET`	`/v1/files/{id}`	`GetFile`	Data
`GET`	`/v1/files/{id}/content`	`GetFile`	Data
`DELETE`	`/v1/files/{id}`	`DeleteFile`	Data
`POST`	`/v1/skills`	`CreateSkill`	Data
`GET`	`/v1/skills`	`ListSkills`	Data
`GET`	`/v1/skills/{id}`	`GetSkill`	Data
`DELETE`	`/v1/skills/{id}`	`DeleteSkill`	Data
`POST`	`/v1/skills/{id}/versions`	`UpdateSkill`	Data
`GET`	`/v1/skills/{id}/versions`	`GetSkill`	Data
`GET`	`/v1/skills/{id}/versions/{version}`	`GetSkill`	Data
`GET`	`/v1/skills/{id}/versions/{version}/content`	`GetSkill`	Data
`DELETE`	`/v1/skills/{id}/versions/{version}`	`UpdateSkill`	Data
`POST`	`/v1/user_profiles`	`CreateUserProfile`	Data
`GET`	`/v1/user_profiles`	`ListUserProfiles`	Data
`GET`	`/v1/user_profiles/{id}`	`GetUserProfile`	Data
`POST`	`/v1/user_profiles/{id}`	`UpdateUserProfile`	Data
`POST`	`/v1/organizations/workspaces`	`CreateWorkspace`	Management
`GET`	`/v1/organizations/workspaces`	`ListWorkspaces`	Management
`GET`	`/v1/organizations/workspaces/{id}`	`GetWorkspace`	Management
`POST`	`/v1/organizations/workspaces/{id}`	`UpdateWorkspace`	Management
`POST`	`/v1/organizations/workspaces/{id}/archive`	`ArchiveWorkspace`	Management
`GET`	`/v1/compliance/activities`	`ListComplianceActivities`	Management
`POST`	`/v1/agents`	`CreateAgent`	Data
`GET`	`/v1/agents`	`ListAgents`	Data
`GET`	`/v1/agents/{id}`	`GetAgent`	Data
`POST`	`/v1/agents/{id}`	`UpdateAgent`	Data
`POST`	`/v1/agents/{id}/archive`	`ArchiveAgent`	Data
`GET`	`/v1/agents/{id}/versions`	`GetAgent`	Data
`POST`	`/v1/sessions`	`CreateSession`	Data
`GET`	`/v1/sessions`	`ListSessions`	Data
`GET`	`/v1/sessions/{id}`	`GetSession`	Data
`POST`	`/v1/sessions/{id}`	`UpdateSession`	Data
`POST`	`/v1/sessions/{id}/archive`	`ArchiveSession`	Data
`DELETE`	`/v1/sessions/{id}`	`DeleteSession`	Data
`GET`	`/v1/sessions/{id}/events`	`GetSession`	Data
`POST`	`/v1/sessions/{id}/events`	`UpdateSession`	Data
`GET`	`/v1/sessions/{id}/events/stream`	`GetSession`	Data
`GET`	`/v1/sessions/{id}/resources`	`GetSession`	Data
`GET`	`/v1/sessions/{id}/resources/{id}`	`GetSession`	Data
`POST`	`/v1/sessions/{id}/resources`	`UpdateSession`	Data
`POST`	`/v1/sessions/{id}/resources/{id}`	`UpdateSession`	Data
`DELETE`	`/v1/sessions/{id}/resources/{id}`	`UpdateSession`	Data
`POST`	`/v1/environments`	`CreateEnvironment`	Data
`GET`	`/v1/environments`	`ListEnvironments`	Data
`GET`	`/v1/environments/{id}`	`GetEnvironment`	Data
`POST`	`/v1/environments/{id}`	`UpdateEnvironment`	Data
`POST`	`/v1/environments/{id}/archive`	`ArchiveEnvironment`	Data
`DELETE`	`/v1/environments/{id}`	`DeleteEnvironment`	Data
`GET`	`/v1/environments/{id}/work`	`GetEnvironment`	Data
`GET`	`/v1/environments/{id}/work/poll`	`ProcessEnvironmentWork`	Data
`GET`	`/v1/environments/{id}/work/{work_id}`	`GetEnvironment`	Data
`GET`	`/v1/environments/{id}/work/stats`	`GetEnvironment`	Data
`POST`	`/v1/environments/{id}/work/{work_id}`	`ProcessEnvironmentWork`	Data
`POST`	`/v1/environments/{id}/work/{work_id}/ack`	`ProcessEnvironmentWork`	Data
`POST`	`/v1/environments/{id}/work/{work_id}/heartbeat`	`ProcessEnvironmentWork`	Data
`POST`	`/v1/environments/{id}/work/{work_id}/stop`	`ProcessEnvironmentWork`	Data
`POST`	`/v1/vaults`	`CreateVault`	Management
`GET`	`/v1/vaults`	`ListVaults`	Management
`GET`	`/v1/vaults/{id}`	`GetVault`	Management
`POST`	`/v1/vaults/{id}`	`UpdateVault`	Management
`POST`	`/v1/vaults/{id}/archive`	`ArchiveVault`	Management
`DELETE`	`/v1/vaults/{id}`	`DeleteVault`	Management
`GET`	`/v1/vaults/{id}/credentials`	`GetVault`	Management
`POST`	`/v1/vaults/{id}/credentials`	`UpdateVault`	Management
`GET`	`/v1/vaults/{id}/credentials/{id}`	`GetVault`	Management
`POST`	`/v1/vaults/{id}/credentials/{id}`	`UpdateVault`	Management
`POST`	`/v1/vaults/{id}/credentials/{id}/archive`	`UpdateVault`	Management
`DELETE`	`/v1/vaults/{id}/credentials/{id}`	`UpdateVault`	Management
`POST`	`/v1/memory_stores`	`CreateMemoryStore`	Data
`GET`	`/v1/memory_stores`	`ListMemoryStores`	Data
`GET`	`/v1/memory_stores/{id}`	`GetMemoryStore`	Data
`POST`	`/v1/memory_stores/{id}`	`UpdateMemoryStore`	Data
`POST`	`/v1/memory_stores/{id}/archive`	`ArchiveMemoryStore`	Data
`DELETE`	`/v1/memory_stores/{id}`	`DeleteMemoryStore`	Data
`POST`	`/v1/memory_stores/{id}/memories`	`UpdateMemoryStore`	Data
`GET`	`/v1/memory_stores/{id}/memories`	`GetMemoryStore`	Data
`GET`	`/v1/memory_stores/{id}/memories/{id}`	`GetMemoryStore`	Data
`POST`	`/v1/memory_stores/{id}/memories/{id}`	`UpdateMemoryStore`	Data
`DELETE`	`/v1/memory_stores/{id}/memories/{id}`	`UpdateMemoryStore`	Data
`GET`	`/v1/memory_stores/{id}/memory_versions`	`GetMemoryStore`	Data
`GET`	`/v1/memory_stores/{id}/memory_versions/{id}`	`GetMemoryStore`	Data
`POST`	`/v1/memory_stores/{id}/memory_versions/{id}/redact`	`UpdateMemoryStore`	Data
`GET`	`/v1/webhooks`	`ListWebhooks`	Management
`GET`	`/v1/webhooks/{id}`	`GetWebhook`	Management
`POST`	`/v1/webhooks`	`CreateWebhook`	Management
`POST`	`/v1/webhooks/{id}`	`UpdateWebhook`	Management
`DELETE`	`/v1/webhooks/{id}`	`DeleteWebhook`	Management
`POST`	`/v1/webhooks/{id}/regenerate_signing_secret`	`RotateWebhookSecret`	Management

不在此表中的路由在 Claude Platform on AWS 上不可用。閘道預設會拒絕此處未列出的任何路由。

受管政策

AWS 為 Claude Platform on AWS 提供五個受管政策。所有受管政策都適用於 Resource: "*"。

政策	授予
`AnthropicFullAccess`	`aws-external-anthropic:*`
`AnthropicReadOnlyAccess`	`Get`、`List`、`CallWithBearerToken`
`AnthropicInferenceAccess`	`Get`、`List`、`CreateInference`、`CreateBatchInference`、`CancelBatchInference`、`DeleteBatchInference`、`CountTokens`、`CallWithBearerToken`
`AnthropicLimitedAccess`	所有 `AnthropicInferenceAccess` 動作，加上所有 Claude Managed Agents 動作（代理程式、工作階段、環境、保管庫、記憶體存放區、webhook 和自行託管環境工作）
`AnthropicSelfHostedEnvironmentAccess`	`GetEnvironment`、`ProcessEnvironmentWork`、`GetSession`、`UpdateSession`、`GetSkill`、`CallWithBearerToken`

AnthropicLimitedAccess 除了推論動作外，還包含所有 Claude Managed Agents 動作。

AnthropicSelfHostedEnvironmentAccess 是足以執行自行託管沙箱工作程式的最小受管政策。請將其附加到您的環境工作程式用於身分驗證的主體。

範例政策

單一工作區上的同步推論

為針對一個生產工作區執行推論的 IAM 主體授予最小權限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CreateInference",
        "aws-external-anthropic:CountTokens",
        "aws-external-anthropic:GetModel",
        "aws-external-anthropic:ListModels",
        "aws-external-anthropic:GetWorkspace"
      ],
      "Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    }
  ]
}

每個客戶的工作區隔離

將角色限制為單一工作區：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "aws-external-anthropic:*",
      "Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    },
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CallWithBearerToken",
        "aws-external-anthropic:AssumeConsole"
      ],
      "Resource": "*"
    }
  ]
}

ZDR 敏感工作區的功能鎖定

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "aws-external-anthropic:CreateBatchInference",
        "aws-external-anthropic:CreateFile"
      ],
      "Resource": "arn:aws:aws-external-anthropic:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    }
  ]
}

佈建自動化

授予 CI/CD 角色建立和管理工作區所需的動作，但不包含任何推論權限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-anthropic:CreateWorkspace",
        "aws-external-anthropic:GetWorkspace",
        "aws-external-anthropic:ListWorkspaces",
        "aws-external-anthropic:UpdateWorkspace",
        "aws-external-anthropic:ArchiveWorkspace"
      ],
      "Resource": "*"
    }
  ]
}

CreateWorkspace 和 ListWorkspaces 是帳戶範圍的操作。在這些動作上指定工作區 ARN 沒有任何效果；請使用 Resource: "*"。

另請參閱

Claude Platform on AWS，了解設定、身分驗證和平台概觀
AWS IAM 使用者指南，了解 IAM 政策語法和評估邏輯
AWS CloudTrail 使用者指南，了解稽核日誌記錄設定

Was this page helpful?

服務詳細資訊

動作

推論

批次處理

模型

檔案

技能

代理程式

工作階段

環境

保管庫

記憶體存放區

Webhook

使用者設定檔

工作區

合規性

身分驗證

主控台存取

路由與動作對應

受管政策

範例政策

單一工作區上的同步推論

每個客戶的工作區隔離

ZDR 敏感工作區的功能鎖定

佈建自動化

另請參閱

服務詳細資訊

動作

推論

批次處理

模型

檔案

技能

代理程式

工作階段

環境

保管庫

記憶體存放區

Webhook

使用者設定檔

工作區

合規性

身分驗證

主控台存取

路由與動作對應

受管政策

範例政策

單一工作區上的同步推論

每個客戶的工作區隔離

ZDR 敏感工作區的功能鎖定

佈建自動化

另請參閱

服務詳細資訊

動作

推論

批次處理

模型

檔案

技能

代理程式

工作階段

環境

保管庫

記憶體存放區

Webhook

使用者設定檔

工作區

合規性

身分驗證

主控台存取

路由與動作對應

受管政策

範例政策

單一工作區上的同步推論

每個客戶的工作區隔離

ZDR 敏感工作區的功能鎖定

佈建自動化

另請參閱

服務詳細資訊

動作

推論

批次處理

模型

檔案

技能

代理程式

工作階段

環境

保管庫

記憶體存放區

Webhook

使用者設定檔

工作區

合規性

身分驗證

主控台存取

路由與動作對應

受管政策

範例政策

單一工作區上的同步推論

每個客戶的工作區隔離

ZDR 敏感工作區的功能鎖定

佈建自動化

另請參閱