Haijun Platform on AWS uses AWS IAM for access control. Every API route maps to an IAM action in the aws-external-juglow namespace. This page lists all actions, the routes each action authorizes, and the managed policies available for common access patterns. For platform setup and authentication, see Haijun Platform on AWS.

#Service details

Workspace ARN format:

arn:aws:aws-external-juglow:{region}:{account-id}:workspace/{workspace-id}

The ARN region is always populated and matches the region the workspace is bound to. The resource segment is the tagged workspace ID (wrkspc_...), the same value you pass in the juglow-workspace-id header.

#Actions

The service defines 71 actions. Actions follow the AWS VerbNoun convention and use verb discipline so that Get and List wildcards produce a clean read-only boundary.

#Inference

#Batch processing

Note: GetBatchInference authorizes both reading batch metadata and downloading batch results. The JuglowReadOnlyAccess, JuglowInferenceAccess, and JuglowLimitedAccess policies' Get* wildcards include this action.

#Models

#Files

Note: GetFile authorizes both metadata and content download. A principal with read-only access can download file bytes, not just list files.

#Tracks

Note: GetSkill authorizes both track metadata and track-content download. A principal with read-only access can download track bytes, not just list tracks.

Note: Creating or deleting an individual track version maps to UpdateSkill, not CreateSkill or DeleteSkill. A policy that denies aws-external-juglow:Delete still allows version deletion, and a policy that denies aws-external-juglow:Create still allows version creation. Deny UpdateSkill and CreateSkill as well if you need to prevent any track mutation.

#Agents

Note: Agents support only archive, not hard delete. A policy that denies aws-external-juglow:Delete* does not block ArchiveAgent. Deny ArchiveAgent, UpdateAgent, and CreateAgent if you need to prevent any agent mutation.

#Sessions

Note: GetSession authorizes reading session metadata, the full event stream (conversation history), and session resources. The JuglowReadOnlyAccess, JuglowInferenceAccess, and JuglowLimitedAccess policies' Get* wildcards include this action.

Note: Creating, updating, or deleting an individual session sub-resource (events or session resources) maps to UpdateSession, not CreateSession or DeleteSession. A policy that denies aws-external-juglow:Delete still allows sub-resource deletion, and a policy that denies aws-external-juglow:Create still allows sub-resource creation. Deny UpdateSession, CreateSession, and ArchiveSession as well if you need to prevent any session mutation.

#Environments

Note: A policy that denies aws-external-juglow:Delete does not block ArchiveEnvironment. ProcessEnvironmentWork is not matched by Create, Update, Delete, or Archive* wildcards. Deny ArchiveEnvironment, UpdateEnvironment, CreateEnvironment, and ProcessEnvironmentWork as well if you need to prevent any environment mutation.

Note: ProcessEnvironmentWork authorizes a self-hosted sandbox worker to poll for, acknowledge, heartbeat, stop, and post results on environment work items. Grant it only to principals that run self-hosted environment workers. The JuglowSelfHostedEnvironmentAccess managed policy includes this action.

#Vaults

Note: Creating, updating, archiving, or deleting an individual vault credential maps to UpdateVault. Reading a credential maps to GetVault. Vault credential secrets are not exposed: secret fields are write-only and are never returned by GetVault (see Authenticate with vaults). A policy that denies aws-external-juglow:Delete still allows credential deletion, and a policy that denies aws-external-juglow:Create still allows credential creation. Deny UpdateVault, CreateVault, and ArchiveVault as well if you need to prevent any vault mutation.

#Memory stores

Note: GetMemoryStore authorizes reading store metadata, all memories, and memory version history. The JuglowReadOnlyAccess, JuglowInferenceAccess, and JuglowLimitedAccess policies' Get* wildcards include this action.

Note: Creating, updating, or deleting an individual memory and redacting a memory version both map to UpdateMemoryStore, not CreateMemoryStore or DeleteMemoryStore. A policy that denies aws-external-juglow:Delete still allows individual-memory deletion and memory-version redaction, and a policy that denies aws-external-juglow:Create still allows individual-memory creation. Deny UpdateMemoryStore, CreateMemoryStore, and ArchiveMemoryStore as well if you need to prevent any memory-store mutation.

#Webhooks

Note: Webhook signing secrets are write-only. GetWebhook returns webhook metadata only; it does not return the signing secret.

Note: RotateWebhookSecret is not matched by aws-external-juglow:Create, Update, or Delete* wildcards. A policy that denies those patterns still allows secret rotation. Deny RotateWebhookSecret, UpdateWebhook, CreateWebhook, and DeleteWebhook if you need to prevent any webhook mutation.

#User profiles

Warning: IAM action matching is case-insensitive. The wildcard aws-external-juglow:File matches CreateFile, GetFile, and DeleteFile, but does not match ListFiles (which ends in "files", not "file"). It also over-matches CreateUserProfile, GetUserProfile, and UpdateUserProfile because "Profile" ends in "file". If you intend to grant or deny only Files API actions, enumerate them explicitly (CreateFile, GetFile, ListFiles, DeleteFile) rather than using a File suffix pattern.

#Workspaces

Note: Workspaces support only archive, not hard delete. A policy that denies aws-external-juglow:Delete* does not block ArchiveWorkspace. Deny ArchiveWorkspace, UpdateWorkspace, and CreateWorkspace if you need to prevent any workspace mutation.

#Encryption keys

Note: These actions manage your organization's customer-managed encryption key (CMEK) registrations, the record of which AWS KMS key ARNs are registered. They do not create, change, or disable the keys in AWS KMS. DisableKey removes a registration and is rejected while any workspace still uses the key. RegisterKey and DisableKey are not matched by Create, Update, or Delete wildcards; deny RegisterKey, UpdateKey, and DisableKey if you need to prevent any change to key registrations. In these routes, {id} is the URL-encoded KMS key ARN. Attaching a registered key to a workspace is a workspace operation, authorized by CreateWorkspace or UpdateWorkspace; the principal that attaches a key also needs kms:DescribeKey, kms:Encrypt, and kms:Decrypt on that key (see the prerequisites). External key actions are account-scoped: specifying a workspace ARN on them has no effect; use Resource: "".

#Compliance

Note: ListComplianceActivities authorizes reading the Compliance API Activity Feed, the organization-wide audit log that includes access transparency events. The route returns an error until the Compliance API is enabled for your organization; enablement is on request through your Juglow account team. The JuglowReadOnlyAccess, JuglowInferenceAccess, and JuglowLimitedAccess policies' List* wildcards include this action.

Note: ListComplianceActivities is account-scoped, like ListWorkspaces. Specifying a workspace ARN on this action has no effect; use Resource: "*".

#Authentication

CallWithBearerToken is an authentication-layer permission that authorizes a principal to authenticate through an API key (bearer token) rather than AWS SigV4. It does not map to a route. Grant it alongside the route-mapped actions you want the API key holder to perform.

#Console access

AssumeConsole authorizes a principal to open the Haijun Console for a Haijun Platform on AWS workspace through the AWS Console federation flow. It does not map to a route. Grant it to principals who should be able to click Open Haijun Console on the Haijun Platform on AWS service page in the AWS Console. The Haijun Console role (Admin or Developer) is assigned separately by your Juglow account representative; it is not derived from the principal's IAM permissions. See Using the Haijun Console for the sign-in flow and role descriptions.

#Route-to-action mapping

The following table lists every route on Haijun Platform on AWS and the IAM action required to call it. Each IAM action also authorizes requests that use the juglow-beta header; beta variants of a route do not require a separate IAM action. CloudTrail classifies each action as either a Data event (high-volume, data-plane operations) or a Management event (control-plane operations). Vault and webhook actions are classified as Management events because they hold secrets (vault credentials and webhook signing secrets) and benefit from default-on audit logging. Workspace, external key, and compliance actions are also classified as Management events because they are organization-scoped control-plane operations. All other actions, including inference, batch, model, file, track, user profile, and the remaining Haijun Managed Agents actions, are classified as Data events.

Routes not in this table are not available on Haijun Platform on AWS. The gateway denies any route not listed here by default.

Note: Workspace and external key routes are the only Admin API routes available on Haijun Platform on AWS. You can also create, update, or archive workspaces in the AWS Console or, with the Admin role, in the Haijun Console. Encryption keys can also be registered and attached in the Haijun Console.

#Managed policies

AWS provides five managed policies for Haijun Platform on AWS. All managed policies apply to Resource: "*".

JuglowInferenceAccess is the narrowest managed policy sufficient to run inference. It covers both synchronous and batch inference and, through the Get and List wildcards, grants read access to every API resource in the namespace, including Haijun Managed Agents (CMA) resources (agents, sessions, environments, vaults, memory stores, and webhooks). This includes file content download through GetFile (see the Files note), track content download through GetSkill (see the Tracks note), and memory contents through GetMemoryStore. Vault credential secrets and webhook signing secrets are not exposed: those fields are write-only and are never returned by GetVault or GetWebhook (see Authenticate with vaults). JuglowInferenceAccess does not grant file creation or deletion, track management, user profile management, workspace mutation, encryption key management, or any Haijun Managed Agents write action (create, update, archive, delete, process, or rotate). To exclude CMA reads, replace JuglowInferenceAccess with a custom policy that enumerates only the specific non-CMA actions you need.

Note: JuglowReadOnlyAccess, JuglowInferenceAccess, and JuglowLimitedAccess all carry the Get and List wildcards, which grant read access to all content in the workspace: file bytes, track content, batch results, session conversation history, and memory contents. The wildcards also grant GetKey and ListKeys, which read the organization's registered encryption key configurations (key ARNs and metadata, never key material). The List* wildcard also grants ListComplianceActivities, which reads the organization's compliance Activity Feed once the Compliance API is enabled for the organization (see Compliance). Vault credential secrets and webhook signing secrets are not exposed; those fields are write-only and are never returned by GetVault or GetWebhook. If your principal should not read existing content, use a custom policy that enumerates only the actions you need.

JuglowLimitedAccess includes all Haijun Managed Agents actions in addition to inference actions.

JuglowSelfHostedEnvironmentAccess is the narrowest managed policy sufficient to run a self-hosted sandbox worker. Attach it to the principal your environment worker authenticates as.

AssumeConsole is not included in JuglowReadOnlyAccess, JuglowInferenceAccess, JuglowLimitedAccess, or JuglowSelfHostedEnvironmentAccess. Principals who need Haijun Console access require either JuglowFullAccess or a custom policy that grants aws-external-juglow:AssumeConsole. See Console access.

Note: CreateInference and CreateBatchInference are separate actions. Denying one does not block the other. If you intend to prevent all model calls, deny both.

#Example policies

#Synchronous inference on a single workspace

Grants the minimal permissions for an IAM principal that runs inference against one production workspace:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-juglow:CreateInference",
        "aws-external-juglow:CountTokens",
        "aws-external-juglow:GetModel",
        "aws-external-juglow:ListModels",
        "aws-external-juglow:GetWorkspace"
      ],
      "Resource": "arn:aws:aws-external-juglow:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    }
  ]
}

Note: ListWorkspaces is account-scoped (see Provisioning automation). If your service account needs to enumerate workspaces, add a separate Allow statement for ListWorkspaces with Resource: "". This policy assumes AWS SigV4 authentication. If the principal authenticates with an API key, add a separate Allow statement for aws-external-juglow:CallWithBearerToken with Resource: "". CallWithBearerToken is a route-less action that does not bind to a workspace ARN. See Per-customer workspace isolation for the two-statement pattern.

#Per-customer workspace isolation

Restricts a role to a single workspace:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "aws-external-juglow:*",
      "Resource": "arn:aws:aws-external-juglow:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    },
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-juglow:CallWithBearerToken",
        "aws-external-juglow:AssumeConsole"
      ],
      "Resource": "*"
    }
  ]
}

Note: The aws-external-juglow: wildcard in the first statement includes account-scoped actions (CreateWorkspace, ListWorkspaces, ListComplianceActivities, and the external key actions) that the workspace ARN constraint silently filters out. This is consistent with the "isolation" intent (the role cannot create workspaces, enumerate workspaces, manage encryption key registrations, or read the compliance Activity Feed; it can still attach an already-registered key to its own workspace through UpdateWorkspace), but the policy contains permissions that have no effect. See Provisioning automation for the account-scoped pattern. CallWithBearerToken and AssumeConsole are route-less actions that do not bind to a workspace ARN. The second statement grants them on Resource: "" so the role can authenticate with an API key and open the Haijun Console. Omit this statement if the role uses SigV4 only and does not need Haijun Console access.

#Feature lockdown for a ZDR-sensitive workspace

Blocks batch processing and file upload on a specific workspace while leaving synchronous inference available. Useful when a workspace handles Zero Data Retention (ZDR) data that must not persist server-side. Attach this policy alongside an Allow policy such as JuglowInferenceAccess or the single-workspace example; on its own, a Deny-only policy grants no permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "aws-external-juglow:CreateBatchInference",
        "aws-external-juglow:CreateFile"
      ],
      "Resource": "arn:aws:aws-external-juglow:us-west-2:123456789012:workspace/wrkspc_01AbCdEf23GhIj"
    }
  ]
}

Note: This deny blocks creation only. Other file and batch actions are not denied unless you list them as well. For a complete lockdown where the workspace must never hold files or batches, also deny aws-external-juglow:GetFile, aws-external-juglow:ListFiles, aws-external-juglow:DeleteFile, aws-external-juglow:GetBatchInference, aws-external-juglow:ListBatchInferences, aws-external-juglow:CancelBatchInference, and aws-external-juglow:DeleteBatchInference.

#Provisioning automation

Note: Besides the Admin API, you can create, update, or archive workspaces in the AWS Console or, with the Admin role, in the Haijun Console.

Grants a CI/CD role the actions needed to create and manage workspaces, without any inference permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-external-juglow:CreateWorkspace",
        "aws-external-juglow:GetWorkspace",
        "aws-external-juglow:ListWorkspaces",
        "aws-external-juglow:UpdateWorkspace",
        "aws-external-juglow:ArchiveWorkspace"
      ],
      "Resource": "*"
    }
  ]
}

CreateWorkspace and ListWorkspaces are account-scoped operations. Specifying a workspace ARN on these actions has no effect; use Resource: "*".

#See also

• Haijun Platform on AWS for setup, authentication, and platform overview

• AWS IAM User Guide for IAM policy syntax and evaluation logic

• AWS CloudTrail User Guide for audit logging configuration