# Security in AWS Clean Rooms
Cloud security at AWS is the highest priority. As an AWS customer, you benefit from a data center and network architecture that is built to meet the requirements of the most security-sensitive organizations.
Security is a shared responsibility between AWS and you. The [shared responsibility model](https://aws.amazon.com/compliance/shared-responsibility-model/) describes this as security of the cloud and security in the cloud:
+ **Security of the cloud** – AWS is responsible for protecting the infrastructure that runs AWS services in the AWS Cloud. AWS also provides you with services that you can use securely. Third-party auditors regularly test and verify the effectiveness of our security as part of the [AWS Compliance Programs](https://aws.amazon.com/compliance/programs/). To learn about the compliance programs that apply to AWS Clean Rooms, see [AWS Services in Scope by Compliance Program](https://aws.amazon.com/compliance/services-in-scope/).
+ **Security in the cloud** – Your responsibility is determined by the AWS service that you use. You are also responsible for other factors including the sensitivity of your data, your company’s requirements, and applicable laws and regulations
This documentation helps you understand how to apply the shared responsibility model when using AWS Clean Rooms. It shows you how to configure AWS Clean Rooms to meet your security and compliance objectives. You also learn how to use other AWS services that help you to monitor and secure your AWS Clean Rooms resources.
**Topics**
+ [Data protection](data-protection.md)
+ [Using service-linked roles](using-service-linked-roles.md)
+ [Data retention](data-retention.md)
+ [Best practices](best-practices.md)
+ [Identity and Access Management](security-iam.md)
+ [Compliance validation](SERVICE-compliance.md)
+ [Resilience](disaster-recovery-resiliency.md)
+ [Infrastructure security](infrastructure-security.md)
+ [AWS PrivateLink](vpc-interface-endpoints.md)
# Data protection in AWS Clean Rooms
The AWS [shared responsibility model](https://aws.amazon.com/compliance/shared-responsibility-model/) applies to data protection in AWS Clean Rooms. As described in this model, AWS is responsible for protecting the global infrastructure that runs all of the AWS Cloud. You are responsible for maintaining control over your content that is hosted on this infrastructure. You are also responsible for the security configuration and management tasks for the AWS services that you use. For more information about data privacy, see the [Data Privacy FAQ](https://aws.amazon.com/compliance/data-privacy-faq/). For information about data protection in Europe, see the [AWS Shared Responsibility Model and GDPR](https://aws.amazon.com/blogs/security/the-aws-shared-responsibility-model-and-gdpr/) blog post on the *AWS Security Blog*.
For data protection purposes, we recommend that you protect AWS account credentials and set up individual users with AWS IAM Identity Center or AWS Identity and Access Management (IAM). That way, each user is given only the permissions necessary to fulfill their job duties. We also recommend that you secure your data in the following ways:
+ Use multi-factor authentication (MFA) with each account.
+ Use SSL/TLS to communicate with AWS resources. We require TLS 1.2 and recommend TLS 1.3.
+ Set up API and user activity logging with AWS CloudTrail. For information about using CloudTrail trails to capture AWS activities, see [Working with CloudTrail trails](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-trails.html) in the *AWS CloudTrail User Guide*.
+ Use AWS encryption solutions, along with all default security controls within AWS services.
+ Use advanced managed security services such as Amazon Macie, which assists in discovering and securing sensitive data that is stored in Amazon S3.
+ If you require FIPS 140-3 validated cryptographic modules when accessing AWS through a command line interface or an API, use a FIPS endpoint. For more information about the available FIPS endpoints, see [Federal Information Processing Standard (FIPS) 140-3](https://aws.amazon.com/compliance/fips/).
We strongly recommend that you never put confidential or sensitive information, such as your customers' email addresses, into tags or free-form text fields such as a **Name** field. This includes when you work with AWS Clean Rooms or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into tags or free-form text fields used for names may be used for billing or diagnostic logs. If you provide a URL to an external server, we strongly recommend that you do not include credentials information in the URL to validate your request to that server.
## Encryption at rest
AWS Clean Rooms always encrypts all service metadata at rest without requiring any additional configuration. This encryption is automatic when you use AWS Clean Rooms.
Clean Rooms ML encrypts all data stored within the service at rest with AWS KMS. If you choose to provide your own KMS key, the contents of your lookalike models and lookalike segment generation jobs are encrypted at rest with your KMS key.
When using AWS Clean Rooms custom ML models, the service encrypts all data stored at rest with AWS KMS. AWS Clean Rooms supports the use of symmetric customer managed keys that you create, own, and manage to encrypt data at rest. If customer managed keys are not specified, AWS owned keys are used by default.
AWS Clean Rooms uses grants and key policies to access customer managed keys. You can revoke access to the grant, or remove the service's access to the customer managed key at any time. If you do, AWS Clean Rooms won't be able to access any of the data encrypted by the customer managed key, which affects operations that are dependent on that data. For example, if you attempt to create a trained model from an encrypted ML input channel that AWS Clean Rooms can't access, then the operation would return a `ValidationException` error.
**Note**
You can use the encryption options in Amazon S3 to protect your data at rest.
For more information, see [Specifying Amazon S3 encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/specifying-s3-encryption.html) in the *Amazon S3 User Guide*.
When using an ID mapping table within AWS Clean Rooms, the service encrypts all data stored at rest with AWS KMS. If you choose to provide your own KMS key, the contents of your ID mapping table are encrypted at rest with your KMS key via AWS Entity Resolution. For more details about the required permissions for working with encryptions with an ID mapping workflow, see [Create a workflow job role for AWS Entity Resolution](https://docs.aws.amazon.com/entityresolution/latest/userguide/create-workflow-job-role.html) in the *AWS Entity Resolution User Guide*.
## Encryption in transit
AWS Clean Rooms uses Transport Layer Security (TLS) for encryption in transit. Communication with AWS Clean Rooms is always done over HTTPS so your data is always encrypted in transit, regardless of whether it's stored in Amazon S3, Amazon Athena, or Snowflake. This includes all data in transit when using Clean Rooms ML.
## Encrypting underlying data
For more information about how to encrypt your underlying data, see [Cryptographic Computing for Clean Rooms](crypto-computing.md).
## Key policy
Key policies control access to your customer managed key. Every customer managed key must have exactly one key policy, which contains statements that determine who can use the key and how they can use it. When you create your customer managed key, you can specify a key policy. For more information, see Managing access to customer managed keys in the AWS Key Management Service Developer Guide.
To use your customer managed key with your AWS Clean Rooms Custom ML models, the following API operations must be permitted in the key policy:
+ `kms:DescribeKey` – Provides the customer managed key details to allow AWS Clean Rooms to validate the key.
+ `kms:Decrypt` – Provides access to AWS Clean Rooms to decrypt the encrypted data and use it in related jobs.
+ `kms:CreateGrant` - Clean Rooms ML encrypts training and inference images at rest in Amazon ECR by creating grants for Amazon ECR. To learn more, see [Encryption at Rest in Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/encryption-at-rest.html). Clean Rooms ML also uses Amazon SageMaker AI to run training and inference jobs, and creates grants for SageMaker AI to encrypt the Amazon EBS volumes attached to the instances as well as the output data in Amazon S3. To learn more, see [Protect Data at Rest Using Encryption in Amazon SageMaker AI](https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-at-rest.html).
+ `kms:GenerateDataKey` - Clean Rooms ML encrypts data at rest stored in Amazon S3 using server-side encryption with AWS KMS keys. To learn more, see [Using server-side encryption with AWS KMS keys (SSE-KMS) in Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html).
The following are policy statement examples you can add for AWS Clean Rooms for the following resources:
**ML input channel with synthetic data**
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "Allow access to principals authorized to use AWS Clean Rooms ML",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::666666666666:role/ExampleRole"
},
"Action": [
"kms:GenerateDataKey",
"kms:CreateGrant",
"kms:Decrypt"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:ViaService": "cleanrooms-ml.us-east-1.amazonaws.com"
},
"ForAllValues:StringEquals": {
"kms:GrantOperations": [
"Decrypt",
"Encrypt",
"GenerateDataKeyWithoutPlaintext",
"ReEncryptFrom",
"ReEncryptTo",
"CreateGrant",
"DescribeKey",
"RetireGrant",
"GenerateDataKey"
]
},
"BoolIfExists": {
"kms:GrantIsForAWSResource": true
}
}
},
{
"Sid": "Allow describe key for principals authorized to use AWS Clean Rooms ML",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::444455556666:role/ExampleRole"
},
"Action": [
"kms:DescribeKey"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:ViaService": "cleanrooms-ml.us-east-1.amazonaws.com"
}
}
},
{
"Sid": "Allow grant operations for AWS Clean Rooms ML service principal",
"Effect": "Allow",
"Principal": {
"Service": "cleanrooms-ml.amazonaws.com"
},
"Action": [
"kms:GenerateDataKey",
"kms:CreateGrant",
"kms:Decrypt"
],
"Resource": "*",
"Condition": {
"ForAllValues:StringEquals": {
"kms:GrantOperations": [
"Decrypt",
"Encrypt",
"GenerateDataKeyWithoutPlaintext",
"ReEncryptFrom",
"ReEncryptTo",
"CreateGrant",
"DescribeKey",
"RetireGrant",
"GenerateDataKey"
]
}
}
},
{
"Sid": "Allow describe key for AWS Clean Rooms ML service principal",
"Effect": "Allow",
"Principal": {
"Service": "cleanrooms-ml.amazonaws.com"
},
"Action": [
"kms:DescribeKey"
],
"Resource": "*"
}
]
}
```
**ML input channel without synthetic data**
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "Allow access to principals authorized to use AWS Clean Rooms ML",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::666666666666:role/ExampleRole"
},
"Action": [
"kms:DescribeKey",
"kms:GenerateDataKey",
"kms:Decrypt"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:ViaService": "cleanrooms-ml.us-east-1.amazonaws.com"
}
}
},
{
"Sid": "Allow access to AWS Clean Rooms ML service principal",
"Effect": "Allow",
"Principal": {
"Service": "cleanrooms-ml.amazonaws.com"
},
"Action": [
"kms:DescribeKey",
"kms:GenerateDataKey",
"kms:Decrypt"
],
"Resource": "*"
}
]
}
```
------
**Trained model job or Trained model inference job**
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "Allow grant operations for principals authorized to use AWS Clean Rooms ML",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::666666666666:role/ExampleRole"
},
"Action": [
"kms:GenerateDataKey",
"kms:CreateGrant",
"kms:Decrypt"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:ViaService": "cleanrooms-ml.us-east-1.amazonaws.com"
},
"ForAllValues:StringEquals": {
"kms:GrantOperations": [
"Decrypt",
"Encrypt",
"GenerateDataKeyWithoutPlaintext",
"ReEncryptFrom",
"ReEncryptTo",
"CreateGrant",
"DescribeKey",
"RetireGrant",
"GenerateDataKey"
]
},
"BoolIfExists": {
"kms:GrantIsForAWSResource": true
}
}
},
{
"Sid": "Allow describe key for principals authorized to use AWS Clean Rooms ML",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::444455556666:role/ExampleRole"
},
"Action": [
"kms:DescribeKey"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:ViaService": "cleanrooms-ml.us-east-1.amazonaws.com"
}
}
},
{
"Sid": "Allow grant operations for AWS Clean Rooms ML service principal",
"Effect": "Allow",
"Principal": {
"Service": "cleanrooms-ml.amazonaws.com"
},
"Action": [
"kms:GenerateDataKey",
"kms:CreateGrant",
"kms:Decrypt"
],
"Resource": "*",
"Condition": {
"ForAllValues:StringEquals": {
"kms:GrantOperations": [
"Decrypt",
"Encrypt",
"GenerateDataKeyWithoutPlaintext",
"ReEncryptFrom",
"ReEncryptTo",
"CreateGrant",
"DescribeKey",
"RetireGrant",
"GenerateDataKey"
]
}
}
},
{
"Sid": "Allow describe key for AWS Clean Rooms ML service principal",
"Effect": "Allow",
"Principal": {
"Service": "cleanrooms-ml.amazonaws.com"
},
"Action": [
"kms:DescribeKey"
],
"Resource": "*"
}
]
}
```
------
Clean Rooms ML does not support specifying service encryption context or source context in customer managed key policies. Encryption context used by the service internally is visible to customers in CloudTrail.
# Using service-linked roles for AWS Clean Rooms
AWS Clean Rooms uses AWS Identity and Access Management (IAM) [service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role). A service-linked role is a unique type of IAM role that is linked directly to AWS Clean Rooms. Service-linked roles are predefined by AWS Clean Rooms and include all the permissions that the service requires to call other AWS services on your behalf.
A service-linked role makes setting up AWS Clean Rooms easier because you don’t have to manually add the necessary permissions. AWS Clean Rooms defines the permissions of its service-linked roles, and unless defined otherwise, only AWS Clean Rooms can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity.
You can delete a service-linked role only after first deleting their related resources. This protects your AWS Clean Rooms resources because you can't inadvertently remove permission to access the resources.
For information about other services that support service-linked roles, see [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) and look for the services that have **Yes** in the **Service-linked roles** column. Choose a **Yes** with a link to view the service-linked role documentation for that service.
## Service-linked role permissions for AWS Clean Rooms
AWS Clean Rooms uses the service-linked role named **AWSServiceRoleForAWSCleanRooms** – to publish Clean Rooms-related CloudWatch metrics to your AWS account.
The AWSServiceRoleForAWSCleanRooms service-linked role trusts the following services to assume the role:
+ `cleanrooms.amazonaws.com`
The role permissions policy named AWSCleanRoomsServiceRolePolicy allows AWS Clean Rooms to complete the following actions on the specified resources:
+ Action: `cloudwatch:PutMetricData` on `all AWS resources, restricted to the AWS Clean Rooms namespace`
You must configure permissions to allow your users, groups, or roles to create, edit, or delete a service-linked role. For more information, see [Service-linked role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions) in the *IAM User Guide*.
## Creating a service-linked role for AWS Clean Rooms
You can use the IAM console to create a service-linked role with the **AWSServiceRoleForAWSCleanRooms** use case. In the AWS CLI or the AWS API, create a service-linked role with the `cleanrooms.amazonaws.com` service name. For more information, see [Creating a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role) in the *IAM User Guide*. If you delete this service-linked role, you can use this same process to create the role again.
## Editing a service-linked role for AWS Clean Rooms
AWS Clean Rooms does not allow you to edit the AWSServiceRoleForAWSCleanRooms service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the *IAM User Guide*.
## Deleting a service-linked role for AWS Clean Rooms
If you no longer need to use a feature or service that requires a service-linked role, we recommend that you delete that role. That way you don’t have an unused entity that is not actively monitored or maintained. However, you must clean up the resources for your service-linked role before you can manually delete it.
To delete the **AWSServiceRoleForAWSCleanRooms**, you must first delete all [collaborations](https://docs.aws.amazon.com/clean-rooms/latest/userguide/delete-collaboration.html) and [memberships](https://docs.aws.amazon.com/clean-rooms/latest/userguide/leave-collab.html) in your AWS account.
**Note**
If the AWS Clean Rooms service is using the role when you try to delete the resources, then the deletion might fail. If that happens, wait for a few minutes and try the operation again.
**To manually delete the service-linked role using IAM**
Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleForAWSCleanRooms service-linked role. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the *IAM User Guide*.
## Supported Regions for AWS Clean Rooms service-linked roles
AWS Clean Rooms supports using service-linked roles in all of the Regions where the service is available. For more information, see [AWS Regions and endpoints](https://docs.aws.amazon.com/general/latest/gr/clean-rooms.html#clean-rooms_region).
# Data retention in AWS Clean Rooms
Any data that is temporarily read into an AWS Clean Rooms collaboration is deleted after the query completes.
When you create a lookalike model, Clean Rooms ML reads your training data, transforms it into a format suitable for our ML model, and stores the trained model parameters inside Clean Rooms ML. Clean Rooms ML does not retain a copy of your training data. AWS Clean Rooms SQL queries do not retain any of your data after the query has run. Clean Rooms ML then uses the trained model to summarize the behavior of all of your users. Clean Rooms ML stores a user-level data set for each user in your data for as long as your lookalike model is active.
When you start a lookalike segment generation job, Clean Rooms ML reads the seed data, reads the behavior summaries from the associated lookalike model, and creates a lookalike segment that is stored within the AWS Clean Rooms service. Clean Rooms ML does not retain a copy of your seed data. Clean Rooms ML stores the user-level output of the job as long as the job is active.
If your seed data comes from an SQL query, the output of that query is only stored in the service for the duration of the job. The results of the query are encrypted at rest and in transit.
If you want to remove your lookalike model or lookalike segment generation job data, use the API to delete it. Clean Rooms ML asynchronously deletes all data associated with the model or job. Once this process is complete, Clean Rooms ML deletes the metadata for the model or job and it is no longer visible in the API. Clean Rooms ML retains deleted data for 3 days for disaster recovery prevention. Once the job or model is no longer visible in the API and 3 days have passed, all data associated with the model or job has been permanently deleted.
# Best practices for data collaborations in AWS Clean Rooms
This topic describes the best practices for conducting data collaborations in AWS Clean Rooms.
AWS Clean Rooms follows the [AWS Shared Responsibility Model](https://aws.amazon.com/compliance/shared-responsibility-model/). AWS Clean Rooms offers [analysis rules](analysis-rules.md) that you can configure to strengthen your ability to protect sensitive data in a collaboration. The analysis rules that you configure in AWS Clean Rooms will enforce the restrictions (query controls and query output controls) that you have configured. You are responsible for determining the restrictions and configuring analysis rules accordingly.
Data collaborations might involve more than just your use of AWS Clean Rooms. To help you maximize the benefit of data collaborations, we recommend that you perform the following best practices with your use of AWS Clean Rooms and specifically with analysis rules.
**Topics**
+ [Best practices with AWS Clean Rooms](#best-practices-with-clean-rooms)
+ [Best practices for using analysis rules in AWS Clean Rooms](#best-practices-for-analysis-rules)
## Best practices with AWS Clean Rooms
You're responsible for assessing the risk of each data collaboration and comparing it to your privacy requirements such as external and internal compliance programs and policies. We recommend that you take additional actions with your use of AWS Clean Rooms. These actions might help further manage risks and help guard against third-party attempts to re-identify your data (for example, differencing attacks or side-channel attacks).
For example, consider conducting due diligence on your other collaborators and enter into legal agreements with them *before* engaging in a collaboration. To monitor the use of your data, also consider adopting other audit mechanisms with your use of AWS Clean Rooms.
## Best practices for using analysis rules in AWS Clean Rooms
Analysis rules in AWS Clean Rooms allow you to restrict the queries that can be run by setting query controls on a configured table. For example, you can set a query control for how a configured table can be joined and which columns can be selected. You can also restrict the query output through setting query result controls such as aggregation thresholds on output rows. The service rejects any query and removes rows that don’t comply with the analysis rules set by members on their configured tables in the query.
We recommend the following *10 best practices* for using analysis rules on your configured table:
+ Create separate configured tables for separate query use cases (for example, audience planning or attribution). You can create multiple configured tables with the same underlying AWS Glue table.
+ Specify columns in the analysis rule (for example, dimension columns, list columns, join columns) that are necessary for queries in a collaboration. This might help mitigate the risk of differencing attacks or enabling other members to reverse engineer your data. Use the **allowlist columns** feature to note other columns that you might want to make queryable in the future. To customize the columns that can be used for a certain collaboration, create additional configured tables with the same underlying AWS Glue table.
+ Specify the functions in the analysis rule that are necessary for analysis in the collaboration. This can help mitigate risk from rare function errors that can present information on an individual data point. To customize the functions that can be used for a certain collaboration, create additional configured tables with the same underlying AWS Glue table.
+ Add aggregation constraints on any columns whose values at a row-level are sensitive. This includes columns in your configured table that also exist in other collaboration members’ tables and analysis rules as an aggregation constraint. This also includes columns in your configured table that aren't queryable, that is, columns that are in your configured table but are not in the analysis rule. Aggregation constraints can help mitigate risk from correlating query results with data outside the collaboration.
+ Create test collaborations and analysis rules to test restrictions created with specified analysis rules.
+ Review collaborator configured tables and members’ analysis rules on configured tables to check that they match what was agreed upon for the collaboration. This can help mitigate risk from other members engineering their own data to run queries that weren't agreed upon.
+ Review the example query provided (console only) that is enabled on your configured table after you set up the analysis rule.
**Note**
In addition to the provided example query, other queries are possible based on the analysis rule and other collaboration member tables and analysis rules.
+ You can add or update an analysis rule for a configured table in a collaboration. When you do, review all the collaborations where the configured table is associated and its resulting impact. This helps make sure that no collaborations use obsolete analysis rules.
+ Review the queries run in the collaboration to check that the queries match the use cases or queries that were agreed upon for the collaboration. (The queries are available in the query logs when the **Query logging** feature is turned on.) This can help mitigate risk from members running analysis that was not agreed upon and potential attacks such as side channel attacks.
+ Review the configured table columns used in collaboration members’ analysis rules and in queries to check that they match what was agreed upon in the collaboration. (The queries are available in the query logs when that feature is turned on.) This can help mitigate risk from other members engineering their own data to do queries that weren't agreed upon.
# Identity and Access Management for AWS Clean Rooms
AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be *authenticated* (signed in) and *authorized* (have permissions) to use AWS Clean Rooms resources. IAM is an AWS service that you can use with no additional charge.
**Topics**
+ [Audience](#security-iam-audience)
+ [Authenticating with identities](#security-iam-auth-with-identities)
+ [Managing access using policies](#security-iam-managing-access)
+ [How AWS Clean Rooms works with IAM](security_iam_service-with-iam.md)
+ [Identity-based policy examples for AWS Clean Rooms](security_iam_id-based-policy-examples.md)
+ [AWS managed policies for AWS Clean Rooms](security-iam-awsmanpol.md)
+ [Troubleshooting AWS Clean Rooms identity and access](security_iam_troubleshoot.md)
+ [Cross-service confused deputy prevention](cross-service-confused-deputy-prevention.md)
+ [IAM behaviors for AWS Clean Rooms ML](ml-behaviors.md)
+ [IAM behaviors for Clean Rooms ML Custom Models](ml-behaviors-byom.md)
## Audience
How you use AWS Identity and Access Management (IAM) differs based on your role:
+ **Service user** - request permissions from your administrator if you cannot access features (see [Troubleshooting AWS Clean Rooms identity and access](security_iam_troubleshoot.md))
+ **Service administrator** - determine user access and submit permission requests (see [How AWS Clean Rooms works with IAM](security_iam_service-with-iam.md))
+ **IAM administrator** - write policies to manage access (see [Identity-based policy examples for AWS Clean Rooms](security_iam_id-based-policy-examples.md))
## Authenticating with identities
Authentication is how you sign in to AWS using your identity credentials. You must be *authenticated* (signed in to AWS) as the AWS account root user, as an IAM user, or by assuming an IAM role.
You can sign in to AWS as a federated identity by using credentials provided through an identity source. AWS IAM Identity Center (IAM Identity Center) users or your company's single sign-on authentication are examples of federated identities. When you sign in as a federated identity, your administrator previously set up identity federation using IAM roles. When you access AWS by using federation, you are indirectly assuming a role.
Depending on the type of user you are, you can sign in to the AWS Management Console or the AWS access portal. For more information about signing in to AWS, see [How to sign in to your AWS account](https://docs.aws.amazon.com/signin/latest/userguide/how-to-sign-in.html) in the *AWS Sign-In User Guide*.
If you access AWS programmatically, AWS provides a software development kit (SDK) and a command line interface (CLI) to cryptographically sign your requests using your credentials. If you don't use AWS tools, you must sign requests yourself. For more information about using the recommended method to sign requests yourself, see [Signature Version 4 signing process](https://docs.aws.amazon.com//general/latest/gr/signature-version-4.html) in the *AWS General Reference*.
Regardless of the authentication method that you use, you might be required to provide additional security information. For example, AWS recommends that you use multi-factor authentication (MFA) to increase the security of your account. To learn more, see [Multi-factor authentication](https://docs.aws.amazon.com//singlesignon/latest/userguide/enable-mfa.html) in the *AWS IAM Identity Center User Guide* and [Using multi-factor authentication (MFA) in AWS](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_credentials_mfa.html) in the *IAM User Guide*.
### AWS account root user
When you create an AWS account, you begin with one sign-in identity that has complete access to all AWS services and resources in the account. This identity is called the AWS account *root user* and is accessed by signing in with the email address and password that you used to create the account. We strongly recommend that you do not use the root user for your everyday tasks. Safeguard your root user credentials and use them to perform the tasks that only the root user can perform. For the complete list of tasks that require you to sign in as the root user, see [AWS account root user credentials and IAM identities](https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root) in the *AWS General Reference*.
### Federated identity
As a best practice, require human users to use federation with an identity provider to access AWS services using temporary credentials.
A *federated identity* is a user from your enterprise directory, web identity provider, or Directory Service that accesses AWS services using credentials from an identity source. Federated identities assume roles that provide temporary credentials.
For centralized access management, we recommend AWS IAM Identity Center. For more information, see [What is IAM Identity Center?](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html) in the *AWS IAM Identity Center User Guide*.
### IAM users and groups
An *[IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html)* is an identity with specific permissions for a single person or application. We recommend using temporary credentials instead of IAM users with long-term credentials. For more information, see [Require human users to use federation with an identity provider to access AWS using temporary credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-users-federation-idp) in the *IAM User Guide*.
An [https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html) specifies a collection of IAM users and makes permissions easier to manage for large sets of users. For more information, see [Use cases for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/gs-identities-iam-users.html) in the *IAM User Guide*.
### IAM roles
An *[IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)* is an identity with specific permissions that provides temporary credentials. You can assume a role by [switching from a user to an IAM role (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html) or by calling an AWS CLI or AWS API operation. For more information, see [Methods to assume a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage-assume.html) in the *IAM User Guide*.
IAM roles are useful for federated user access, temporary IAM user permissions, cross-account access, cross-service access, and applications running on Amazon EC2. For more information, see [Cross account resource access in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the *IAM User Guide*.
## Managing access using policies
You control access in AWS by creating policies and attaching them to AWS identities or resources. A policy is an object in AWS that, when associated with an identity or resource, defines their permissions. AWS evaluates these policies when a principal (user, root user, or role session) makes a request. Permissions in the policies determine whether the request is allowed or denied. Most policies are stored in AWS as JSON documents. For more information about the structure and contents of JSON policy documents, see [Overview of JSON policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json) in the *IAM User Guide*.
Administrators can use AWS JSON policies to specify who has access to what. That is, which **principal** can perform **actions** on what **resources**, and under what **conditions**.
Every IAM entity (user or role) starts with no permissions. By default, users can do nothing, not even change their own password. To give a user permission to do something, an administrator must attach a permissions policy to a user. Or the administrator can add the user to a group that has the intended permissions. When an administrator gives permissions to a group, all users in that group are granted those permissions.
IAM policies define permissions for an action regardless of the method that you use to perform the operation. For example, suppose that you have a policy that allows the `iam:GetRole` action. A user with that policy can get role information from the AWS Management Console, the AWS CLI, or the AWS API.
### Identity-based policies
Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as an IAM user, group of users, or role. These policies control what actions users and roles can perform, on which resources, and under what conditions. To learn how to create an identity-based policy, see [Define custom IAM permissions with customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the *IAM User Guide*.
Identity-based policies can be further categorized as *inline policies* or *managed policies*. Inline policies are embedded directly into a single user, group, or role. Managed policies are standalone policies that you can attach to multiple users, groups, and roles in your AWS account. Managed policies include AWS managed policies and customer managed policies. To learn how to choose between a managed policy or an inline policy, see [Choosing between managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#choosing-managed-or-inline) in the *IAM User Guide*.
### Resource-based policies
Resource-based policies are JSON policy documents that you attach to a resource. Examples of resource-based policies are IAM *role trust policies* and Amazon S3 *bucket policies*. In services that support resource-based policies, service administrators can use them to control access to a specific resource. For the resource where the policy is attached, the policy defines what actions a specified principal can perform on that resource and under what conditions. You must [specify a principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) in a resource-based policy. Principals can include accounts, users, roles, federated users, or AWS services.
Resource-based policies are inline policies that are located in that service. You can't use AWS managed policies from IAM in a resource-based policy.
### Other policy types
AWS supports additional, less-common policy types. These policy types can set the maximum permissions granted to you by the more common policy types.
+ **Permissions boundaries** – A permissions boundary is an advanced feature in which you set the maximum permissions that an identity-based policy can grant to an IAM entity (IAM user or role). You can set a permissions boundary for an entity. The resulting permissions are the intersection of entity's identity-based policies and its permissions boundaries. Resource-based policies that specify the user or role in the `Principal` field are not limited by the permissions boundary. An explicit deny in any of these policies overrides the allow. For more information about permissions boundaries, see [Permissions boundaries for IAM entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) in the *IAM User Guide*.
+ **Service control policies (SCPs)** – SCPs are JSON policies that specify the maximum permissions for an organization or organizational unit (OU) in AWS Organizations. AWS Organizations is a service for grouping and centrally managing multiple AWS accounts that your business owns. If you enable all features in an organization, then you can apply service control policies (SCPs) to any or all of your accounts. The SCP limits permissions for entities in member accounts, including each AWS account root user. For more information about Organizations and SCPs, see [How SCPs work](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_about-scps.html) in the *AWS Organizations User Guide*.
+ **Session policies** – Session policies are advanced policies that you pass as a parameter when you programmatically create a temporary session for a role or federated user. The resulting session's permissions are the intersection of the user or role's identity-based policies and the session policies. Permissions can also come from a resource-based policy. An explicit deny in any of these policies overrides the allow. For more information, see [Session policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) in the *IAM User Guide*.
### Multiple policy types
When multiple types of policies apply to a request, the resulting permissions are more complicated to understand. To learn how AWS determines whether to allow a request when multiple policy types are involved, see [Policy evaluation logic](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html) in the *IAM User Guide*.
# How AWS Clean Rooms works with IAM
Before you use IAM to manage access to AWS Clean Rooms, learn what IAM features are available to use with AWS Clean Rooms.
**IAM features you can use with AWS Clean Rooms**
| IAM feature | AWS Clean Rooms support |
| --- | --- |
| [Identity-based policies](#security_iam_service-with-iam-id-based-policies) | Yes |
| [Resource-based policies](#security_iam_service-with-iam-resource-based-policies) | Partial |
| [Policy actions](#security_iam_service-with-iam-id-based-policies-actions) | Yes |
| [Policy resources](#security_iam_service-with-iam-id-based-policies-resources) | Yes |
| [Policy condition keys (service-specific)](#security_iam_service-with-iam-id-based-policies-conditionkeys) | Partial |
| [ACLs](#security_iam_service-with-iam-acls) | No |
| [ABAC (tags in policies)](#security_iam_service-with-iam-tags) | Yes |
| [Temporary credentials](#security_iam_service-with-iam-roles-tempcreds) | Yes |
| [Forward access sessions (FAS)](#security_iam_service-with-iam-principal-permissions) | Yes |
| [Service roles](#security_iam_service-with-iam-roles-service) | Yes |
| [Service-linked roles](#security_iam_service-with-iam-roles-service-linked) | No |
To get a high-level view of how AWS Clean Rooms and other AWS services work with most IAM features, see [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) in the *IAM User Guide*.
## Identity-based policies for AWS Clean Rooms
**Supports identity-based policies:** Yes
Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as an IAM user, group of users, or role. These policies control what actions users and roles can perform, on which resources, and under what conditions. To learn how to create an identity-based policy, see [Define custom IAM permissions with customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the *IAM User Guide*.
With IAM identity-based policies, you can specify allowed or denied actions and resources as well as the conditions under which actions are allowed or denied. To learn about all of the elements that you can use in a JSON policy, see [IAM JSON policy elements reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html) in the *IAM User Guide*.
### Identity-based policy examples for AWS Clean Rooms
To view examples of AWS Clean Rooms identity-based policies, see [Identity-based policy examples for AWS Clean Rooms](security_iam_id-based-policy-examples.md).
## Resource-based policies within AWS Clean Rooms
**Supports resource-based policies:** Partial
Resource-based policies are JSON policy documents that you attach to a resource. Examples of resource-based policies are IAM *role trust policies* and Amazon S3 *bucket policies*. In services that support resource-based policies, service administrators can use them to control access to a specific resource. For the resource where the policy is attached, the policy defines what actions a specified principal can perform on that resource and under what conditions. You must [specify a principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) in a resource-based policy. Principals can include accounts, users, roles, federated users, or AWS services.
To enable cross-account access, you can specify an entire account or IAM entities in another account as the principal in a resource-based policy. For more information, see [Cross account resource access in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the *IAM User Guide*.
The AWS Clean Rooms service supports only one type of resource-based policy called a *configured lookalike model managed resource policy*, which is attached to a configured lookalike model. This policy defines which principals can perform actions on the configured lookalike model.
To learn how to attach a resource-based policy to a configured lookalike model, see **[IAM behaviors for AWS Clean Rooms ML](ml-behaviors.md)**.
## Policy actions for AWS Clean Rooms
**Supports policy actions:** Yes
Administrators can use AWS JSON policies to specify who has access to what. That is, which **principal** can perform **actions** on what **resources**, and under what **conditions**.
The `Action` element of a JSON policy describes the actions that you can use to allow or deny access in a policy. Include actions in a policy to grant permissions to perform the associated operation.
To see a list of AWS Clean Rooms actions, see [Actions defined by AWS Clean Rooms](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscleanrooms.html) in the *Service Authorization Reference*.
Policy actions in AWS Clean Rooms use the following prefix before the action.
```
cleanrooms
```
To specify multiple actions in a single statement, separate them with commas.
```
"Action": [
"cleanrooms:action1",
"cleanrooms:action2"
]
```
To view examples of AWS Clean Rooms identity-based policies, see [Identity-based policy examples for AWS Clean Rooms](security_iam_id-based-policy-examples.md).
## Policy resources for AWS Clean Rooms
**Supports policy resources:** Yes
Administrators can use AWS JSON policies to specify who has access to what. That is, which **principal** can perform **actions** on what **resources**, and under what **conditions**.
The `Resource` JSON policy element specifies the object or objects to which the action applies. As a best practice, specify a resource using its [Amazon Resource Name (ARN)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html). For actions that don't support resource-level permissions, use a wildcard (\$1) to indicate that the statement applies to all resources.
```
"Resource": "*"
```
To see a list of AWS Clean Rooms resource types and their ARNs, see [Resources defined by AWS Clean Rooms](https://docs.aws.amazon.com/service-authorization/latest/reference/list_your_service.html#your_service-resources-for-iam-policies) in the *Service Authorization Reference*. To learn with which actions you can specify the ARN of each resource, see [Actions defined by AWS Clean Rooms](https://docs.aws.amazon.com/service-authorization/latest/reference/list_your_service.html#your_service-actions-as-permissions).
To view examples of AWS Clean Rooms identity-based policies, see [Identity-based policy examples for AWS Clean Rooms](security_iam_id-based-policy-examples.md).
## Policy condition keys for AWS Clean Rooms
**Supports service-specific policy condition keys:** Partial
Administrators can use AWS JSON policies to specify who has access to what. That is, which **principal** can perform **actions** on what **resources**, and under what **conditions**.
The `Condition` element specifies when statements execute based on defined criteria. You can create conditional expressions that use [condition operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html), such as equals or less than, to match the condition in the policy with values in the request. To see all AWS global condition keys, see [AWS global condition context keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) in the *IAM User Guide*.
To learn how AWS Clean Rooms ML uses policy condition keys, see **[IAM behaviors for AWS Clean Rooms ML](ml-behaviors.md)**.
## ACLs in AWS Clean Rooms
**Supports ACLs:** No
Access control lists (ACLs) control which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format.
## ABAC with AWS Clean Rooms
**Supports ABAC (tags in policies):** Yes
Attribute-based access control (ABAC) is an authorization strategy that defines permissions based on attributes called tags. You can attach tags to IAM entities and AWS resources, then design ABAC policies to allow operations when the principal's tag matches the tag on the resource.
To control access based on tags, you provide tag information in the [condition element](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) of a policy using the `aws:ResourceTag/key-name`, `aws:RequestTag/key-name`, or `aws:TagKeys` condition keys.
If a service supports all three condition keys for every resource type, then the value is **Yes** for the service. If a service supports all three condition keys for only some resource types, then the value is **Partial**.
For more information about ABAC, see [Define permissions with ABAC authorization](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html) in the *IAM User Guide*. To view a tutorial with steps for setting up ABAC, see [Use attribute-based access control (ABAC)](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html) in the *IAM User Guide*.
## Using temporary credentials with AWS Clean Rooms
**Supports temporary credentials:** Yes
Temporary credentials provide short-term access to AWS resources and are automatically created when you use federation or switch roles. AWS recommends that you dynamically generate temporary credentials instead of using long-term access keys. For more information, see [Temporary security credentials in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) and [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) in the *IAM User Guide*.
## Forward access sessions for AWS Clean Rooms
**Supports forward access sessions (FAS):** Yes
Forward access sessions (FAS) use the permissions of the principal calling an AWS service, combined with the requesting AWS service to make requests to downstream services. For policy details when making FAS requests, see [Forward access sessions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_forward_access_sessions.html).
## Service roles for AWS Clean Rooms
**Supports service roles:** Yes
A service role is an [IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) that a service assumes to perform actions on your behalf. An IAM administrator can create, modify, and delete a service role from within IAM. For more information, see [Create a role to delegate permissions to an AWS service](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html) in the *IAM User Guide*.
**Warning**
Changing the permissions for a service role might break AWS Clean Rooms functionality. Edit service roles only when AWS Clean Rooms provides guidance to do so.
## Service-linked roles for AWS Clean Rooms
**Supports service-linked roles:** No
A service-linked role is a type of service role that is linked to an AWS service. The service can assume the role to perform an action on your behalf. Service-linked roles appear in your AWS account and are owned by the service. An IAM administrator can view, but not edit the permissions for service-linked roles.
For details about creating or managing service-linked roles, see [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html). Find a service in the table that includes a `Yes` in the **Service-linked role** column. Choose the **Yes** link to view the service-linked role documentation for that service.
# Identity-based policy examples for AWS Clean Rooms
By default, users and roles don't have permission to create or modify AWS Clean Rooms resources. To grant users permission to perform actions on the resources that they need, an IAM administrator can create IAM policies.
To learn how to create an IAM identity-based policy by using these example JSON policy documents, see [Create IAM policies (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) in the *IAM User Guide*.
For details about actions and resource types defined by AWS Clean Rooms, including the format of the ARNs for each of the resource types, see [Actions, resources, and condition keys for AWS Clean Rooms](https://docs.aws.amazon.com/service-authorization/latest/reference/list_your_service.html) in the *Service Authorization Reference*.
**Topics**
+ [Policy best practices](#security_iam_service-with-iam-policy-best-practices)
+ [Using the AWS Clean Rooms console](#security_iam_id-based-policy-examples-console)
+ [Allow users to view their own permissions](#security_iam_id-based-policy-examples-view-own-permissions)
## Policy best practices
Identity-based policies determine whether someone can create, access, or delete AWS Clean Rooms resources in your account. These actions can incur costs for your AWS account. When you create or edit identity-based policies, follow these guidelines and recommendations:
+ **Get started with AWS managed policies and move toward least-privilege permissions** – To get started granting permissions to your users and workloads, use the *AWS managed policies* that grant permissions for many common use cases. They are available in your AWS account. We recommend that you reduce permissions further by defining AWS customer managed policies that are specific to your use cases. For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) or [AWS managed policies for job functions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html) in the *IAM User Guide*.
+ **Apply least-privilege permissions** – When you set permissions with IAM policies, grant only the permissions required to perform a task. You do this by defining the actions that can be taken on specific resources under specific conditions, also known as *least-privilege permissions*. For more information about using IAM to apply permissions, see [ Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *IAM User Guide*.
+ **Use conditions in IAM policies to further restrict access** – You can add a condition to your policies to limit access to actions and resources. For example, you can write a policy condition to specify that all requests must be sent using SSL. You can also use conditions to grant access to service actions if they are used through a specific AWS service, such as CloudFormation. For more information, see [ IAM JSON policy elements: Condition](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) in the *IAM User Guide*.
+ **Use IAM Access Analyzer to validate your IAM policies to ensure secure and functional permissions** – IAM Access Analyzer validates new and existing policies so that the policies adhere to the IAM policy language (JSON) and IAM best practices. IAM Access Analyzer provides more than 100 policy checks and actionable recommendations to help you author secure and functional policies. For more information, see [Validate policies with IAM Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-validation.html) in the *IAM User Guide*.
+ **Require multi-factor authentication (MFA)** – If you have a scenario that requires IAM users or a root user in your AWS account, turn on MFA for additional security. To require MFA when API operations are called, add MFA conditions to your policies. For more information, see [ Secure API access with MFA](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html) in the *IAM User Guide*.
For more information about best practices in IAM, see [Security best practices in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) in the *IAM User Guide*.
## Using the AWS Clean Rooms console
To access the AWS Clean Rooms console, you must have a minimum set of permissions. These permissions must allow you to list and view details about the AWS Clean Rooms resources in your AWS account. If you create an identity-based policy that is more restrictive than the minimum required permissions, the console won't function as intended for entities (users or roles) with that policy.
You don't need to allow minimum console permissions for users that are making calls only to the AWS CLI or the AWS API. Instead, allow access to only the actions that match the API operation that they're trying to perform.
To ensure that users and roles can still use the AWS Clean Rooms console, also attach the AWS Clean Rooms `FullAccess` or `ReadOnly` AWS managed policy to the entities. For more information, see [Adding permissions to a user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html#users_change_permissions-add-console) in the *IAM User Guide*.
## Allow users to view their own permissions
This example shows how you might create a policy that allows IAM users to view the inline and managed policies that are attached to their user identity. This policy includes permissions to complete this action on the console or programmatically using the AWS CLI or AWS API.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ViewOwnUserInfo",
"Effect": "Allow",
"Action": [
"iam:GetUserPolicy",
"iam:ListGroupsForUser",
"iam:ListAttachedUserPolicies",
"iam:ListUserPolicies",
"iam:GetUser"
],
"Resource": ["arn:aws:iam::*:user/${aws:username}"]
},
{
"Sid": "NavigateInConsole",
"Effect": "Allow",
"Action": [
"iam:GetGroupPolicy",
"iam:GetPolicyVersion",
"iam:GetPolicy",
"iam:ListAttachedGroupPolicies",
"iam:ListGroupPolicies",
"iam:ListPolicyVersions",
"iam:ListPolicies",
"iam:ListUsers"
],
"Resource": "*"
}
]
}
```
# AWS managed policies for AWS Clean Rooms
An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.
Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining [ customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#customer-managed-policies) that are specific to your use cases.
You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services.
For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) in the *IAM User Guide*.
## AWS managed policy: `AWSCleanRoomsReadOnlyAccess`
You can attach `AWSCleanRoomsReadOnlyAccess` to your IAM principals.
This policy grants read-only permissions to resources and metadata in an `AWSCleanRoomsReadOnlyAccess` collaboration.
**Permissions details**
This policy includes the following permissions:
+ `CleanRoomsRead` – Allows principals read-only access to the service.
+ `ConsoleDisplayTables` – Allows principals read-only access to the AWS Glue metadata needed to show data about the underlying AWS Glue tables on the console.
+ `ConsoleLogSummaryQueryLogs` – Allows principals to see the query logs.
+ `ConsoleLogSummaryObtainLogs` – Allows principals to retrieve the log results.
For a JSON listing of the policy details, see [AWSCleanRoomsReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCleanRoomsReadOnlyAccess.html) in the *AWS Managed Policy Reference Guide*.
## AWS managed policy: `AWSCleanRoomsFullAccess`
You can attach `AWSCleanRoomsFullAccess` to your IAM principals.
This policy grants administrative permissions that allow full access (read, write, and update) to resources and metadata in an AWS Clean Rooms collaboration. This policy includes access to perform queries.
**Permissions details**
This policy includes the following permissions:
+ `CleanRoomsAccess` – Grants full access to all actions on all resources for AWS Clean Rooms.
+ `PassServiceRole` – Grants access to pass a service role to only the service (`PassedToService` condition) that has "cleanrooms" in its name.
+ `ListRolesToPickServiceRole` – Allows principals to list all their roles in order to choose a service role when using AWS Clean Rooms.
+ `GetRoleAndListRolePoliciesToInspectServiceRole` – Allows principals to see the service role and corresponding policy in IAM.
+ `ListPoliciesToInspectServiceRolePolicy` – Allows principals to see the service role and corresponding policy in IAM.
+ `GetPolicyToInspectServiceRolePolicy` – Allows principals to see the service role and corresponding policy in IAM.
+ `ConsoleDisplayTables` – Allows principals read-only access to the AWS Glue metadata needed to show data about the underlying AWS Glue tables on the console.
+ `ConsolePickQueryResultsBucketListAll` – Allows principals to choose an Amazon S3 bucket from a list of all available S3 buckets into which their query results are written.
+ `SetQueryResultsBucket` – Allows principals to choose an S3 bucket into which their query results are written.
+ `ConsoleDisplayQueryResults` – Allows principals to show the query results to the customer, read from the S3 bucket.
+ `WriteQueryResults` – Allows principals to write the query results into a customer-owned S3 bucket.
+ `EstablishLogDeliveries` – Allows principals to deliver query logs to a customer's Amazon CloudWatch Logs log group.
+ `SetupLogGroupsDescribe` – Allows principals to use the Amazon CloudWatch Logs log group creation process.
+ `SetupLogGroupsCreate` – Allows principals to create an Amazon CloudWatch Logs log group.
+ `SetupLogGroupsResourcePolicy` – Allows principals to set up a resource policy on the Amazon CloudWatch Logs log group.
+ `ConsoleLogSummaryQueryLogs` – Allows principals to see the query logs.
+ `ConsoleLogSummaryObtainLogs` – Allows principals to retrieve the log results.
For a JSON listing of the policy details, see [AWSCleanRoomsFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCleanRoomsFullAccess.html) in the *AWS Managed Policy Reference Guide*.
## AWS managed policy: `AWSCleanRoomsFullAccessNoQuerying`
You can attach `AWSCleanRoomsFullAccessNoQuerying` to your IAM principals.
This policy grants administrative permissions that allow full access (read, write, and update) to resources and metadata in an AWS Clean Rooms collaboration. This policy excludes access to perform queries.
**Permissions details**
This policy includes the following permissions:
+ `CleanRoomsAccess` – Grants full access to all actions on all resources for AWS Clean Rooms, except for querying in collaborations.
+ `CleanRoomsNoQuerying` – Explicitly denies `StartProtectedQuery` and `UpdateProtectedQuery` to prevent querying.
+ `PassServiceRole` – Grants access to pass a service role to only the service (`PassedToService` condition) that has "cleanrooms" in its name.
+ `ListRolesToPickServiceRole` – Allows principals to list all their roles in order to choose a service role when using AWS Clean Rooms.
+ `GetRoleAndListRolePoliciesToInspectServiceRole` – Allows principals to see the service role and corresponding policy in IAM.
+ `ListPoliciesToInspectServiceRolePolicy` – Allows principals to see the service role and corresponding policy in IAM.
+ `GetPolicyToInspectServiceRolePolicy` – Allows principals to see the service role and corresponding policy in IAM.
+ `ConsoleDisplayTables` – Allows principals read-only access to the AWS Glue metadata needed to show data about the underlying AWS Glue tables on the console.
+ `EstablishLogDeliveries` – Allows principals to deliver query logs to a customer's Amazon CloudWatch Logs log group.
+ `SetupLogGroupsDescribe` – Allows principals to use the Amazon CloudWatch Logs log group creation process.
+ `SetupLogGroupsCreate` – Allows principals to create an Amazon CloudWatch Logs log group.
+ `SetupLogGroupsResourcePolicy` – Allows principals to set up a resource policy on the Amazon CloudWatch Logs log group.
+ `ConsoleLogSummaryQueryLogs` – Allows principals to see the query logs.
+ `ConsoleLogSummaryObtainLogs` – Allows principals to retrieve the log results.
+ `cleanrooms` – Manage collaborations, analysis templates, configured tables, memberships, and associated resources within the AWS Clean Rooms service. Perform various operations such as creating, updating, deleting, listing, and retrieving information about these resources.
+ `iam` – Pass service roles with names containing "`cleanrooms`" to the AWS Clean Rooms service. List roles, policies, and inspect service roles and policies related to the AWS Clean Rooms service.
+ `glue` – Retrieve information about databases, tables, partitions, and schemas from AWS Glue. This is required for the AWS Clean Rooms service to display and interact with the underlying data sources.
+ `logs` – Manage log deliveries, log groups, and resource policies for CloudWatch Logs. Query and retrieve logs related to the AWS Clean Rooms service. These permissions are necessary for monitoring, auditing, and troubleshooting purposes within the service.
The policy also explicitly denies the actions `cleanrooms:StartProtectedQuery` and `cleanrooms:UpdateProtectedQuery` to prevent users from directly executing or updating protected queries, which should be done through the AWS Clean Rooms controlled mechanisms.
For a JSON listing of the policy details, see [AWSCleanRoomsFullAccessNoQuerying](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCleanRoomsFullAccessNoQuerying.html) in the *AWS Managed Policy Reference Guide*.
## AWS managed policy: `AWSCleanRoomsMLReadOnlyAccess`
You can attach `AWSCleanRoomsMLReadOnlyAccess` to your IAM principals.
This policy grants read-only permissions to resources and metadata in an `AWSCleanRoomsMLReadOnlyAccess` collaboration.
This policy includes the following permissions:
+ `CleanRoomsConsoleNavigation` – Grants access to view the screens of the AWS Clean Rooms console.
+ `CleanRoomsMLRead` – Allows principals read-only access to the Clean Rooms ML service.
+ `PassCleanRoomsResources` – Grants access to pass specified AWS Clean Rooms resources.
For a JSON listing of the policy details, see [AWSCleanRoomsMLReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCleanRoomsMLReadOnlyAccess.html) in the *AWS Managed Policy Reference Guide*.
## AWS managed policy: `AWSCleanRoomsMLFullAccess`
You can attach `AWSCleanRoomsMLFullAcces` to your IAM principals. This policy grants administrative permissions that allow full access (read, write, and update) to resources and metadata needed by Clean Rooms ML.
**Permissions details**
This policy includes the following permissions:
+ `CleanRoomsMLFullAccess` – Grants access to all Clean Rooms ML actions.
+ `PassServiceRole` – Grants access to pass a service role to only the service (`PassedToService` condition) that has "cleanrooms-ml" in its name.
+ `CleanRoomsConsoleNavigation` – Grants access to view the screens of the AWS Clean Rooms console.
+ `CollaborationMembershipCheck` – When you start an audience generation (lookalike segment) job within a collaboration, the Clean Rooms ML service calls `ListMembers` to check that the collaboration is valid, the caller is an active member, and the configured audience model owner is an active member. This permission is always required; the console navigation SID is only required for console users.
+ `PassCleanRoomsResources` – Grants access to pass specified AWS Clean Rooms resources.
+ `AssociateModels` – Allows principals to associate a Clean Rooms ML model with your collaboration.
+ `TagAssociations` – Allows principals to add tags to the association between a lookalike model and a collaboration.
+ `ListRolesToPickServiceRole` – Allows principals to list all their roles in order to choose a service role when using AWS Clean Rooms.
+ `GetRoleAndListRolePoliciesToInspectServiceRole` – Allows principals to see the service role and corresponding policy in IAM.
+ `ListPoliciesToInspectServiceRolePolicy` – Allows principals to see the service role and corresponding policy in IAM.
+ `GetPolicyToInspectServiceRolePolicy` – Allows principals to see the service role and corresponding policy in IAM.
+ `ConsoleDisplayTables` – Allows principals read-only access to the AWS Glue metadata needed to show data about the underlying AWS Glue tables on the console.
+ `ConsolePickOutputBucket` – Allows principals to select Amazon S3 buckets for configured audience model outputs.
+ `ConsolePickS3Location` – Allows principals to select the location within a bucket for configured audience model outputs.
+ `ConsoleDescribeECRRepositories` – Allows principals to describe Amazon ECR repositories and images.
For a JSON listing of the policy details, see [AWSCleanRoomsMLFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCleanRoomsMLFullAccess.html) in the *AWS Managed Policy Reference Guide*.
## AWS Clean Rooms updates to AWS managed policies
View details about updates to AWS managed policies for AWS Clean Rooms since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the AWS Clean Rooms Document history page.
| Change | Description | Date |
| --- | --- | --- |
| [AWSCleanRoomsFullAccessNoQuerying](#security-iam-awsmanpol-fullaccess-noquery)– Update to existing policy | Added cleanrooms:UpdateConfiguredTableAllowedColumns and cleanrooms:UpdateConfiguredTableReference to CleanRoomsAccess. | July 29, 2025 |
| [AWSCleanRoomsMLReadOnlyAccess](#ml-read-only) – Update to existing policy | Added PassCleanRoomsResources to AWSCleanRoomsMLReadOnlyAccess. Added PassCleanRoomsResources and ConsoleDescribeECRRepositories to AWSCleanRoomsMLFullAccess. | January 10, 2025 |
| [AWSCleanRoomsFullAccessNoQuerying](#security-iam-awsmanpol-fullaccess-noquery) – Update to existing policy | Added cleanrooms:BatchGetSchemaAnalysisRule to CleanRoomsAccess. | May 13, 2024 |
| [AWSCleanRoomsFullAccess](#security-iam-awsmanpol-fullaccess) – Update to existing policy | Updated the Statement ID in AWSCleanRoomsFullAccess from ConsolePickQueryResultsBucket to SetQueryResultsBucket in this policy to better represent the permissions since the permissions are needed for setting the query results bucket both with and without the console. | March 21, 2024 |
| [AWSCleanRoomsMLReadOnlyAccess](#ml-read-only) – New policy [AWSCleanRoomsMLFullAccess](#ml-full-access) – New policy | Added AWSCleanRoomsMLReadOnlyAccess and AWSCleanRoomsMLFullAccess to support AWS Clean Rooms ML. | November 29, 2023 |
| [AWSCleanRoomsFullAccessNoQuerying](#security-iam-awsmanpol-fullaccess-noquery) – Update to existing policy | Added cleanrooms:CreateAnalysisTemplate, cleanrooms:GetAnalysisTemplate, cleanrooms:UpdateAnalysisTemplate, cleanrooms:DeleteAnalysisTemplate, cleanrooms:ListAnalysisTemplates, cleanrooms:GetCollaborationAnalysisTemplate, cleanrooms:BatchGetCollaborationAnalysisTemplate, and cleanrooms:ListCollaborationAnalysisTemplates to CleanRoomsAccess to enable the new analysis templates feature. | July 31, 2023 |
| [AWSCleanRoomsFullAccessNoQuerying](#security-iam-awsmanpol-fullaccess-noquery) – Update to existing policy | Added cleanrooms:ListTagsForResource, cleanrooms:UntagResource, and cleanrooms:TagResource to CleanRoomsAccess to enable resource tagging. | March 21, 2023 |
| AWS Clean Rooms started tracking changes | AWS Clean Rooms started tracking changes for its AWS managed policies. | January 12, 2023 |
# Troubleshooting AWS Clean Rooms identity and access
Use the following information to help you diagnose and fix common issues that you might encounter when working with AWS Clean Rooms and IAM.
**Topics**
+ [I am not authorized to perform an action in AWS Clean Rooms](#security_iam_troubleshoot-no-permissions)
+ [I am not authorized to perform iam:PassRole](#security_iam_troubleshoot-passrole)
+ [I want to allow people outside of my AWS account to access my AWS Clean Rooms resources](#security_iam_troubleshoot-cross-account-access)
## I am not authorized to perform an action in AWS Clean Rooms
If you receive an error that you're not authorized to perform an action, your policies must be updated to allow you to perform the action.
The following example error occurs when the `mateojackson` IAM user tries to use the console to view details about a fictional `my-example-widget` resource but does not have the fictional `cleanrooms:GetWidget` permissions.
```
User: arn:aws:iam::123456789012:user/mateojackson is not authorized to perform: cleanrooms:GetWidget on resource: my-example-widget
```
In this case, Mateo's policy must be updated to allow him to access the `my-example-widget` resource using the `cleanrooms:GetWidget` action.
If you need help, contact your AWS administrator. Your administrator is the person who provided you with your sign-in credentials.
## I am not authorized to perform iam:PassRole
If you receive an error that you're not authorized to perform the `iam:PassRole` action, your policies must be updated to allow you to pass a role to AWS Clean Rooms.
Some AWS services allow you to pass an existing role to that service instead of creating a new service role or service-linked role. To do this, you must have permissions to pass the role to the service.
The following example error occurs when an IAM user named `marymajor` tries to use the console to perform an action in AWS Clean Rooms. However, the action requires the service to have permissions that are granted by a service role. Mary does not have permissions to pass the role to the service.
```
User: arn:aws:iam::123456789012:user/marymajor is not authorized to perform: iam:PassRole
```
In this case, Mary's policies must be updated to allow her to perform the `iam:PassRole` action.
If you need help, contact your AWS administrator. Your administrator is the person who provided you with your sign-in credentials.
## I want to allow people outside of my AWS account to access my AWS Clean Rooms resources
You can create a role that users in other accounts or people outside of your organization can use to access your resources. You can specify who is trusted to assume the role.
To learn more, consult the following:
+ To learn whether AWS Clean Rooms supports these features, see [How AWS Clean Rooms works with IAM](security_iam_service-with-iam.md).
+ To learn how to provide access to your resources across AWS accounts that you own, see [Providing access to an IAM user in another AWS account that you own](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.html) in the *IAM User Guide*.
+ To learn how to provide access to your resources to third-party AWS accounts, see [Providing access to AWS accounts owned by third parties](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html) in the *IAM User Guide*.
+ To learn how to provide access through identity federation, see [Providing access to externally authenticated users (identity federation)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html) in the *IAM User Guide*.
+ To learn the difference between using roles and resource-based policies for cross-account access, see [How IAM roles differ from resource-based policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_compare-resource-policies.html) in the *IAM User Guide*.
# Cross-service confused deputy prevention
The confused deputy problem is a security issue where an entity that doesn't have permission to perform an action can coerce a more-privileged entity to perform the action. In AWS, cross-service impersonation can result in the confused deputy problem. Cross-service impersonation can occur when one service (the *calling service*) calls another service (the *called service*). The calling service can be manipulated to use its permissions to act on another customer's resources in a way it should not otherwise have permission to access. To prevent this, AWS provides tools that help you protect your data for all services with service principals that have been given access to resources in your account.
We recommend using the [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcearn](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcearn) global condition context keys in resource policies to limit the permissions that AWS Clean Rooms gives another service to the resource. Use `aws:SourceArn` if you want only one resource to be associated with the cross-service access.
The most effective way to protect against the confused deputy problem is to use the `aws:SourceArn` global condition context key with the full ARN of the resource. In AWS Clean Rooms, you also have to compare against the `sts:ExternalId` condition key.
The value of `aws:SourceArn` must be set to the ARN of the membership of the assumed role.
The following example shows how you can use the `aws:SourceArn` global condition context key in AWS Clean Rooms to prevent the confused deputy problem.
**Note**
The example policy applies to the trust policy of the service role that AWS Clean Rooms uses to access data and metadata for a configured table.
The value for ** needs to be set to the membership ID of the query runner.
All members of the collaboration can view the configured table metadata so each membership ARN must be included in the list of membership ARNs.
**Note**
When a service role is created through the AWS Clean Rooms console, all current members of the collaboration are included in the confused deputy condition by default.
If you are adding new members to a collaboration that already has configured tables associated to it, make sure that you update your service role's confused deputy condition with the new member's membership ARN.
If you do not update your service role's confused deputy condition after adding a new member, that new member will not be able to access information in AWS Clean Rooms that is retrieved using that role.
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AllowIfExternalIdMatches",
"Effect": "Allow",
"Principal": {
"Service": "cleanrooms.amazonaws.com"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringLike": {
"sts:ExternalId": "arn:aws:*:us-east-1:*:dbuser:*/*"
}
}
},
{
"Sid": "AllowIfSourceArnMatches",
"Effect": "Allow",
"Principal": {
"Service": "cleanrooms.amazonaws.com"
},
"Action": "sts:AssumeRole",
"Condition": {
"ForAnyValue:ArnEquals": {
"aws:SourceArn": [
"arn:aws:cleanrooms:us-east-1:111122223333:membership/",
"arn:aws:cleanrooms:us-east-1:444455556666:membership/"
]
}
}
}
]
}
```
------
# IAM behaviors for AWS Clean Rooms ML
## Cross-account jobs
Clean Rooms ML allows certain resources created by one AWS account to be securely accessed in their account by another AWS account. When a client in AWS account A calls `StartAudienceGenerationJob` on a `ConfiguredAudienceModel` resource owned by AWS account B, Clean Rooms ML creates two ARNs for the job. One ARN in AWS account A and another in AWS account B. The ARNs are identical except for their AWS account.
Clean Rooms ML creates two ARNs for the job to ensure that both accounts can apply their own IAM policies to the jobs. For example, both accounts can use tag-based access control and apply policies from their AWS organization. The job processes data from both accounts, so both accounts can delete the job and its associated data. Neither account can block the other account from deleting the job.
There is only one job execution and both accounts can see the job when they call `ListAudienceGenerationJobs`. Both accounts can call the `Get`, `Delete`, and `Export` APIs on the job using the ARN with their own AWS account ID.
Neither AWS account can access the job when using an ARN with the other AWS account ID.
The name of the job must be unique within an AWS account. The name in AWS account B is *\$1accountA-\$1name*. The name chosen by AWS account A is prefixed with AWS account A when the job is viewed in AWS account B.
In order for a cross-account `StartAudienceGenerationJob` to succeed, AWS account B must allow that action on both the new job in AWS account B and the `ConfiguredAudienceModel` in AWS account B using a resource policy similar to the following example:
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "Clean-Rooms-CAMA-ID",
"Effect": "Allow",
"Principal": {
"AWS": [
"111122223333"
]
},
"Action": [
"cleanrooms-ml:StartAudienceGenerationJob"
],
"Resource": [
"arn:aws:cleanrooms-ml:us-east-1:444455556666:configured-audience-model/id",
"arn:aws:cleanrooms-ml:us-east-1:444455556666:audience-generation-job/*"
],
"Condition":{"StringEquals":{"cleanrooms-ml:CollaborationId":"UUID"}}
}
]
}
```
------
**Note**
This AWS Clean Rooms ML resource policy references two different AWS account IDs to support cross-account audience generation:
**111122223333** - This is the account that contains the principal (user, role, or service) authorized to start audience generation jobs. This account initiates the ML processing workflow.
**444455556666** - This is the account that owns the AWS Clean Rooms ML resources (the configured audience model and audience generation jobs). This account hosts the ML models and manages the job execution.
**Additional Configuration Notes:**
**Statement ID (Sid)**: Replace `CAMA-ID` with your actual AWS Clean Rooms Audience Model Application (CAMA) identifier to make the policy statement easily identifiable.
**Resource IDs**: Replace *id* with the actual ID of your configured audience model, and *UUID* with your specific collaboration ID.
**Condition**: The `cleanrooms-ml:CollaborationId` condition ensures that audience generation jobs can only be started within the context of the specified AWS Clean Rooms collaboration, providing an additional security boundary.
This cross-account configuration enables scenarios where one organization manages the ML models and infrastructure while allowing authorized partners to initiate audience generation processes within the bounds of their collaboration agreement.
If you use the [AWS Clean Rooms ML API](https://docs.aws.amazon.com/cleanrooms-ml/latest/APIReference/Welcome.html) to create a configured lookalike model with `manageResourcePolicies` set to true, AWS Clean Rooms creates this policy for you.
Additionally, the identity policy of the caller in AWS account A needs `StartAudienceGenerationJob` permission on `arn:aws:cleanrooms-ml:us-west-1:AccountA:audience-generation-job/*`. So there are three IAM Resources for Action `StartAudienceGenerationJob`: the AWS account A job, the AWS account B job, and the AWS account B `ConfiguredAudienceModel`.
**Warning**
The AWS account that started the job receives an AWS CloudTrail audit log event about the job. The AWS account that owns the `ConfiguredAudienceModel` does not receive a AWS CloudTrail audit log event.
## Tagging jobs
When you set the `childResourceTagOnCreatePolicy=FROM_PARENT_RESOURCE` parameter of `CreateConfiguredAudienceModel`, all lookalike segment generation jobs within your account that are created from that configured lookalike model default to having the same tags as the configured lookalike model. The configured lookalike model is the parent and the lookalike segment generation job is the child.
If you are creating a job within your own account, the request tags of the job override the parent tags. Jobs created by other accounts never create tags in your account. If you set `childResourceTagOnCreatePolicy=FROM_PARENT_RESOURCE` and another account creates a job, there are two copies of the job. The copy in your account has the parent resource tags and the copy in the job submitter’s account has tags from the request.
## Validating collaborators
When granting permissions to other members of an AWS Clean Rooms collaboration, the resource policy should include the condition key `cleanrooms-ml:CollaborationId`. This enforces that the `collaborationId` parameter is included in the [StartAudienceGenerationJob](https://docs.aws.amazon.com/cleanrooms-ml/latest/APIReference/API_StartAudienceGenerationJob.html) request. When the `collaborationId` parameter is included in the request, Clean Rooms ML validates that the collaboration exists, the job submitter is an active member of the collaboration, and the configured lookalike model owner is an active member of the collaboration.
When AWS Clean Rooms manages your configured lookalike model resource policy (the `manageResourcePolicies` parameter is `TRUE` in [CreateConfiguredAudienceModelAssociation request](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateConfiguredAudienceModelAssociation.html)), this condition key will be set in the resource policy. Therefore, you must specify the `collaborationId` in [StartAudienceGenerationJob](https://docs.aws.amazon.com/cleanrooms-ml/latest/APIReference/API_StartAudienceGenerationJob.html).
## Cross-account access
Only `StartAudienceGenerationJob` can be called across accounts. All other Clean Rooms ML APIs can only be used with resources in your own account. This ensures that your training data, lookalike model configuration, and other information stays private.
Clean Rooms ML never reveals Amazon S3 or AWS Glue locations across accounts. The training data location, configured lookalike model output location, and lookalike segment generation job seed location are never visible across accounts. Unless query logging is enabled in the collaboration, whether the seed data comes from an SQL query and the query itself are not visible across accounts. If you `Get` an audience generation job that another account submitted, the service does not show the seed location.
# IAM behaviors for Clean Rooms ML Custom Models
## Cross-account jobs
Clean Rooms ML allows certain resources associated with a collaboration created by one AWS account to be securely accessed in their account by another AWS account. A client in AWS account A with the member ability to run queries can call `CreateTrainedModel`, `CreateMLInputChannel`, or `StartTrainedModelInferenceJob` on a `ConfiguredModelAlgorithmAssociation` resource owned by another member in the collaboration, provided the `ConfiguredModelAlgorithmAssociation` is allowed by the custom analysis rule created with `CreateConfiguredTableAnalysisRule`.
Additionally, any active member of a collaboration can delete data associated with a trained model or ML input channel via the `DeleteTrainedModelOutput` and `DeleteMLInputChannelData` APIs.
## Cross-account access
Clean Rooms ML allows users to retrieve metadata about resources created by other accounts via the `GetCollaboration` and `ListCollaboration` APIs. Clean Rooms ML does not reveal KMS key ARNs, tags, environment variables, or hyperparameters (for the `TrainedModel` action) to other accounts.
## Membership and collaboration access
When accessing membership and collaboration resources in context of Clean Rooms ML custom models, a user’s identity policy needs permissions to the actions `cleanrooms:PassMembership`, `cleanrooms:PassCollaboration`, or both. All APIs that accept `membershipId` need the `cleanrooms:PassMembership` permission, and all APIs that accept `collaborationId` need the `cleanrooms:PassCollaboration` permission. A sample identity policy for a role that can call `createTrainedModel` in the context of a membership ID that can call `GetCollaborationTrainedModel` in the context of a collaboration ID are provided.
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AllowCleanroomsMLActions",
"Effect": "Allow",
"Action": [
"cleanrooms:PassCollaboration",
"cleanrooms:PassMembership"
],
"Resource": [
"*"
]
},
{
"Sid": "AllowMembershipAccess",
"Effect": "Allow",
"Action": [
"cleanrooms:GetMembership"
],
"Resource": [
"arn:aws:cleanrooms:us-east-1:111122223333:membership/memberId"
]
},
{
"Sid": "AllowCollaborationAccess",
"Effect": "Allow",
"Action": [
"cleanrooms:GetCollaboration"
],
"Resource": [
"arn:aws:cleanrooms:us-east-1:111122223333:collaboration/collaborationId"
]
}
]
}
```
------
# Compliance validation for AWS Clean Rooms
To learn whether an AWS service is within the scope of specific compliance programs, see [AWS services in Scope by Compliance Program](https://aws.amazon.com/compliance/services-in-scope/) and choose the compliance program that you are interested in. For general information, see [AWS Compliance Programs](https://aws.amazon.com/compliance/programs/).
You can download third-party audit reports using AWS Artifact. For more information, see [Downloading Reports in AWS Artifact](https://docs.aws.amazon.com/artifact/latest/ug/downloading-documents.html).
Your compliance responsibility when using AWS services is determined by the sensitivity of your data, your company's compliance objectives, and applicable laws and regulations. For more information about your compliance responsibility when using AWS services, see [AWS Security Documentation](https://docs.aws.amazon.com/security/).
# Resilience in AWS Clean Rooms
The AWS global infrastructure is built around AWS Regions and Availability Zones. Regions provide multiple physically separated and isolated Availability Zones, which are connected through low-latency, high-throughput, and highly redundant networking. With Availability Zones, you can design and operate applications and databases that automatically fail over between zones without interruption. Availability Zones are more highly available, fault tolerant, and scalable than traditional single or multiple data center infrastructures.
For more information about AWS Regions and Availability Zones, see [AWS Global Infrastructure](https://aws.amazon.com/about-aws/global-infrastructure/).
# Infrastructure security in AWS Clean Rooms
As a managed service, AWS Clean Rooms is protected by AWS global network security. For information about AWS security services and how AWS protects infrastructure, see [AWS Cloud Security](https://aws.amazon.com/security/). To design your AWS environment using the best practices for infrastructure security, see [Infrastructure Protection](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/infrastructure-protection.html) in *Security Pillar AWS Well‐Architected Framework*.
You use AWS published API calls to access AWS Clean Rooms through the network. Clients must support the following:
+ Transport Layer Security (TLS). We require TLS 1.2 and recommend TLS 1.3.
+ Cipher suites with perfect forward secrecy (PFS) such as DHE (Ephemeral Diffie-Hellman) or ECDHE (Elliptic Curve Ephemeral Diffie-Hellman). Most modern systems such as Java 7 and later support these modes.
## Network security
When AWS Clean Rooms reads from your S3 bucket during query execution, the traffic between AWS Clean Rooms and Amazon S3 is securely routed through the AWS private network. In-flight traffic is signed using Amazon Signature Version 4 protocol (SIGv4) and encrypted using HTTPS. This traffic is authorized based on the IAM service role which you have set up for your configured table.
You can connect programmatically to AWS Clean Rooms through an endpoint. For a list of service endpoints, see [AWS Clean Rooms endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/clean-rooms.html#clean-rooms_region) in the *AWS General Reference*.
All service endpoints are HTTPS-only. You can use Amazon Virtual Private Cloud (VPC) endpoints in case you want to connect to AWS Clean Rooms from your VPC and do not want to have internet connectivity. For more information, see [Access AWS services through AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html) in the *AWS PrivateLink Guide*.
You can assign IAM policies to your IAM principals which make use of the [aws:SourceVpce context keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpce) to restrict your IAM principal to only be able to make calls to AWS Clean Rooms through a VPC endpoint and not over the internet.
# Access AWS Clean Rooms or AWS Clean Rooms ML using an interface endpoint (AWS PrivateLink)
You can use AWS PrivateLink to create a private connection between your virtual private cloud (VPC) and AWS Clean Rooms or AWS Clean Rooms ML. You can access AWS Clean Rooms or AWS Clean Rooms ML as if it were in your VPC, without the use of an internet gateway, NAT device, VPN connection, or Direct Connect connection. Instances in your VPC don't need public IP addresses to access AWS Clean Rooms.
You establish this private connection by creating an *interface endpoint*, powered by AWS PrivateLink. We create an endpoint network interface in each subnet that you enable for the interface endpoint. These are requester-managed network interfaces that serve as the entry point for traffic destined for AWS Clean Rooms.
For more information, see [Access AWS services through AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html) in the *AWS PrivateLink Guide*.
## Considerations for AWS Clean Rooms
Before you set up an interface endpoint for AWS Clean Rooms, review [Considerations](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#considerations-interface-endpoints) in the *AWS PrivateLink Guide*.
AWS Clean Rooms and AWS Clean Rooms ML support making calls to all of their API actions through the interface endpoint.
VPC endpoint policies are not supported for AWS Clean Rooms or AWS Clean Rooms ML. By default, full access to AWS Clean Rooms and AWS Clean Rooms ML is allowed through the interface endpoint. Alternatively, you can associate a security group with the endpoint network interfaces to control traffic to AWS Clean Rooms or AWS Clean Rooms ML through the interface endpoint.
## Create an interface endpoint for AWS Clean Rooms
You can create an interface endpoint for AWS Clean Rooms or AWS Clean Rooms ML using either the Amazon VPC console or the AWS Command Line Interface (AWS CLI). For more information, see [Create an interface endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint-aws) in the *AWS PrivateLink Guide*.
Create an interface endpoint for AWS Clean Rooms using the following service name.
```
com.amazonaws.region.cleanrooms
```
Create an interface endpoint for AWS Clean Rooms ML using the following service name.
```
com.amazonaws.region.cleanrooms-ml
```
If you enable private DNS for the interface endpoint, you can make API requests to AWS Clean Rooms using its default Regional DNS name. For example, `cleanrooms-ml.us-east-1.amazonaws.com`.