# Collaborations and memberships in AWS Clean Rooms Collaborations and memberships A *collaboration* is a secure logical boundary in AWS Clean Rooms in which members can perform analysis on configured tables. Any member in AWS Clean Rooms can create a collaboration. The collaboration creator can designate a single member to analyze configured tables and receive results. However, the collaboration creator might want to prevent the member who can run the analysis from having access to the query results. In that case, the collaboration creator can designate one [member to who can query](glossary.md#glossary-member-who-can-query) or [one member who can run queries and jobs](glossary.md#glossary-member-who-can-run-queries-jobs) and another [member who can receive results](glossary.md#glossary-member-who-can-receive-results). In most cases, the member who can query or the member who can query and run jobs is also the [member paying for compute costs](glossary.md#glossary-member-paying-for-query-compute). However, the collaboration creator can configure a different member to be responsible for paying for the query compute costs. For information about how to create a collaboration using the AWS SDKs, see the [https://docs.aws.amazon.com/clean-rooms/latest/apireference/Welcome.html](https://docs.aws.amazon.com/clean-rooms/latest/apireference/Welcome.html). **Topics** + [ # Creating a collaboration ](create-collaboration.md) + [ # Creating a membership and joining a collaboration ](create-membership.md) + [ # Editing collaborations ](edit-collaboration.md) + [ # Change requests in AWS Clean Rooms ](change-requests.md) + [ # Deleting collaborations ](delete-collaboration.md) + [ # Viewing collaborations ](review-collab-console.md) + [ # Inviting members to a collaboration ](invite-members.md) + [ # Monitoring members ](monitor-status.md) + [ # Adding members to a collaboration ](add-member.md) + [ # Removing members from a collaboration ](remove-member.md) + [ # Leaving a collaboration ](leave-collab.md) # Creating a collaboration There are three ways to create a collaboration in AWS Clean Rooms. The most basic form is the [collaboration for queries](create-collab-queries.md). This collaboration focuses on SQL query analysis and maintains a simple structure with two main roles: one member who can run queries and another who can receive results. This basic collaboration setup works well for simple data analysis tasks. The second form, [collaboration for queries and jobs](create-collab-queries-and-jobs.md), extends functionality by incorporating both SQL queries and PySpark jobs. This collaboration setup maintains the same basic role structure but expands permissions to include job execution. A notable requirement is that the member who creates PySpark analysis templates must also be the one receiving results, ensuring clear accountability in the analysis process. The third form, [collaboration for ML modeling](create-collab-ml-modeling.md), is built for machine learning workflows. This collaboration setup adds two more roles: one for users who need the results from trained models, and another for users who need the results from using those models to make predictions. This collaboration setup helps collaboration members work together on complex data projects while keeping everyone's roles and permissions clear. The following topics explain how to create collaborations for queries, jobs, and ML modeling. **Topics** + [ # Creating a collaboration for queries ](create-collab-queries.md) + [ # Creating a collaboration for queries and jobs ](create-collab-queries-and-jobs.md) + [ # Creating a collaboration for ML modeling ](create-collab-ml-modeling.md) # Creating a collaboration for queries In this procedure, you as the [collaboration creator](glossary.md#glossary-collaboration-creator) perform the following tasks: + [Create a collaboration](create-collaboration.md). + Invite one or more [members](glossary.md#glossary-member) to the [collaboration](glossary.md#glossary-collaboration). + Assign abilities to members, such as the [member who can query](glossary.md#glossary-member-who-can-query) and the [member who can receive results](glossary.md#glossary-member-who-can-receive-results). If the collaboration creator is also the member who can receive results, they specify the results destination and format. They also provide a service role Amazon Resource Name (ARN) to write the results to the results destination. + Configure which [member is responsible for paying for compute costs in the collaboration](glossary.md#glossary-member-paying-for-query-compute). Before you begin, make sure that you have completed the following prerequisites: + You have the name and AWS account ID for each member that you want to invite to the collaboration. + You have permission to share the name and AWS account ID for each member with all members of the collaboration. **Note** You can’t add more members after you create the collaboration. For information about how to create a collaboration using the AWS SDKs, see the *[AWS Clean Rooms API Reference](https://docs.aws.amazon.com/clean-rooms/latest/apireference/Welcome.html)*. **To create a collaboration for queries** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with the AWS account that will function as the collaboration creator. 1. In the left navigation pane, choose **Collaborations**. 1. In the upper right corner, choose **Create collaboration**. 1. For **Step 1: Define collaboration**, do the following: 1. For **Details**, enter the **Name** and **Description** of the collaboration. This information will be visible to collaboration members who are invited to participate in the collaboration. The **Name** and **Description** helps them understand what the collaboration is in reference to. 1. For **Members**: 1. For **Member 1: You**, enter your **Member display name** as you want it to appear for the collaboration. **Note** Your AWS account ID is included automatically for **Member AWS account ID**. 1. For **Member 2**, enter the **Member display name** and **Member AWS account ID** for the member that you want to invite to the collaboration. The **Member display name** and **Member AWS account ID** will be visible to everyone invited to the collaboration. After you enter and save the values for these fields, you can't edit them. **Note** You must inform the collaboration member that their **Member AWS account ID** and **Member display name** will be visible to all invited and active collaborators in the collaboration. 1. If you want to add another member, choose **Add another member**. Then enter the **Member display name** and **Member AWS account ID** for each member who can contribute data that you want to invite to the collaboration. 1. If you want to enable **Analysis logging**, select the **Enable analysis logging** checkbox. 1. Choose the **Logs from queries** checkbox under the **Supported log types**. You will receive logs generated from SQL queries in your Amazon CloudWatch Logs account. 1. If you want to enable **Detailed monitoring**, select the **Enable detailed monitoring** checkbox. The analysis runner and configured payor can choose to enable detailed metrics when they create their membership. When enabled, detailed monitoring metrics will be published to CloudWatch for operational monitoring of collaborations, including query performance and resource utilization. These metrics will be available to the analysis runner and configured payor in their respective AWS accounts. For more information about CloudWatch pricing, see [CloudWatch Pricing](https://aws.amazon.com/cloudwatch/pricing/). 1. Under **Allowed query results regions**, select one or more AWS Regions where you want to send query results. By default, only the current Region (such as N. Virginia us-east-1) is selected. **Important** When you enable cross-Region query results delivery, your results may be processed and stored outside the source Region. For more information about Regions, see [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the *AWS General Reference*. 1. (Optional) Manage access to your data with **Automatic change request approval** by configuring which settings can be changed automatically without manual approvals for a change request. By default, some settings can only be changed by submitting a change request which must be approved by all members before it can take effect. + **Grant member abilities** – Choose the abilities that can be granted to collaboration members without manual approval. Members can always contribute data. + Choose abilities: + Contribute data *(always enabled)* + Receive results + **Auto-approve new members with these abilities** – If allowed, any members added with the abilities selected above will instantly join the collaboration. Members added with other abilities will still require manual approval to join. + **Abilities that can be automatically revoked** - Choose the abilities that can be revoked without manual approval. Members can always contribute data. + Choose abilities: + Contribute data *(always enabled)* + Receive results If you choose this option, you can track all collaboration configuration modifications through the **Change requests history**, located on the **Details** tab of the collaboration details page. 1. (Optional) If you want to enable the **Cryptographic computing** capability, select the **Enable cryptographic computing** checkbox. 1. Choose the following **Cryptographic coverage parameters**: + **Allow plaintext columns** Choose **No** if you require fully encrypted tables. Choose **Yes** if you want cleartext columns allowed in the encrypted table. To run SUM or AVG on certain columns, the columns must be in cleartext. + **Preserve NULL values** Choose **No** if you don't want to preserve NULL values. NULL values won't appear as NULL in an encrypted table. Choose **Yes** if you want to preserve NULL values. NULL values will appear as NULL in an encrypted table. 1. Choose the following **Fingerprinting parameters**: + **Allow duplicates** Choose **No** if you don't want duplicate entries allowed in a fingerprint column. Choose **Yes** if you want duplicate entries allowed in a fingerprint column. + **Allow JOIN of columns with different names** Choose **No** if you don't want to join fingerprint columns with different names. Choose **Yes** if you want to join fingerprint columns with different names. For more information about **Cryptographic computing parameters**, see [Cryptographic computing parameters](crypto-computing-parameters.md). For more information about how to encrypt your data for use in AWS Clean Rooms, see [Preparing encrypted data tables with Cryptographic Computing for Clean Rooms](prepare-encrypted-data.md). **Note** Verify these configurations carefully before completing the next step. After you create the collaboration, you can only edit the collaboration name, description, and whether the logs are stored in Amazon CloudWatch Logs. 1. If you want to enable **Tags** for the collaboration resource, choose **Add new tag** and then enter the **Key** and **Value** pair. 1. Choose **Next**. 1. For **Step 2: Specify member abilities**, for **Analysis using queries and jobs**, under the **Supported analysis types** leave the **Queries** checkbox selected and take the recommended action, based on your goal. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/clean-rooms/latest/userguide/create-collab-queries.html) 1. If you are using Clean Rooms ML, for **ML modeling using purpose-built workflows**, 1. (Optional) Select the member who can **Receive output from trained models** from the dropdown list. 1. (Optional) Select the member who can **Receive output from model inference** from the dropdown list. 1. View the member abilities under **ID resolution using AWS Entity Resolution**. 1. Choose **Next**. 1. For **Step 3: Configure payment**, for **Analysis using queries**, take one of the following actions based on your goal. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/clean-rooms/latest/userguide/create-collab-queries.html) For **ML modeling using purpose-built workflows**, the **Creator of the configured lookalike model** is the member who will **Pay for lookalike modeling**. For **ID resolution with AWS Entity Resolution**, the **Creator of the ID mapping table** is the member who will **Pay for ID mapping table**. 1. For **Step 4: Configure membership**, choose one of the following options: ------ #### [ Yes, join by creating membership now ] 1. For **Results settings defaults**, for **Query results settings**, if you are the member who can **Receive results**, 1. For the **Results destination in Amazon S3**, enter the Amazon S3 destination or choose **Browse S3** to select an S3 bucket. 1. For the query **Result format**, choose either **CSV** or **PARQUET**. 1. (Spark only) For the **Result files**, choose either **Multiple** or **Single**. 1. (Optional) For **Service access**, if you want to deliver queries that take up to 24 hours to your S3 destination, select the **Add a service role to support queries that take up to 24 hours to complete** checkbox. Large queries that take up to 24 hours to complete will be delivered to your S3 destination. If you don't select the checkbox, only queries that complete within 12 hours will be delivered to your S3 location. 1. Specify the **Service access** permissions by selecting either **Create and use a new service role** or **Use an existing service role**. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/clean-rooms/latest/userguide/create-collab-queries.html) **Note** AWS Clean Rooms requires permissions to query according to the analysis rules. For more information about permissions for AWS Clean Rooms, see [AWS managed policies for AWS Clean Rooms](security-iam-awsmanpol.md). If the role doesn’t have sufficient permissions for AWS Clean Rooms, you receive an error message stating that the role doesn't have sufficient permissions for AWS Clean Rooms. The role policy must be added before proceeding. If you can’t modify the role policy, you receive an error message stating that AWS Clean Rooms couldn't find the policy for the service role. 1. For **Logs settings**, choose one of the following options for **Log storage in Amazon CloudWatch Logs**: **Note** The **Logs settings** section appears if you chose to enable **Query logging**. 1. Choose **Turn on** and the query logs relevant to you will be stored in your Amazon CloudWatch Logs account. Each member can receive only logs for queries that they initiated or that contain their data. The member who can receive results also receives logs for all queries run in a collaboration, even if their data isn't accessed in a query. Under **Supported log types**, the **Query logs** checkbox is turned on by default. **Note** After you turn on **Query logging**, it can take a few minutes for log storage to be set up and start receiving logs in Amazon CloudWatch Logs. During this brief period, the member who can query might run queries that don’t actually send logs. 1. Choose **Turn off** and the query logs relevant to you won't be stored in your Amazon CloudWatch Logs account. 1. If you want to enable **Tags** for the membership resource, choose **Add new tag** and then enter the **Key** and **Value** pair. 1. If you are the member who is paying for **Query compute**, indicate your acceptance by selecting the **I agree to pay for the compute costs in this collaboration** checkbox. **Note** You must select this checkbox to proceed. For more information about how pricing is calculated, see [Pricing for AWS Clean Rooms](what-is.md#pricing). If you are the [member paying for query compute costs](glossary.md#glossary-member-paying-for-query-compute) but not the [member who can query](glossary.md#glossary-member-who-can-query), it is recommended that you use AWS Budgets to configure a budget for AWS Clean Rooms and receive notifications once the maximum budget has been reached. For more information about setting up a budget, see [Managing your costs with AWS Budgets](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html) in the *AWS Cost Management User Guide*. For more information about setting up notifications, see [Creating an Amazon SNS topic for budget notifications](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-sns-policy.html) in the *AWS Cost Management User Guide*. If the maximum budget has been reached, you can contact the member who can run queries or [leave the collaboration](leave-collab.md). If you leave the collaboration, no more queries will be allowed to run, and therefore you will no longer be billed for query compute costs. 1. Choose **Next**. Both the collaboration and your membership are created. Your status in the collaboration is active. ------ #### [ No, I will create a membership later ] 1. Choose **Next**. Only the collaboration is created. Your status in the collaboration is inactive. ------ 1. For **Step 5: Review and create**, do the following: 1. Review the selections that you made for the previous steps and edit if necessary. 1. Choose one of the options. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/clean-rooms/latest/userguide/create-collab-queries.html) After your collaboration has been created successfully, you can see the collaboration details page under **Collaborations**. You are now ready to: + [Prepare your data table to be analyzed in AWS Clean Rooms](prepare-data.md). (Optional if you want to analyze your own event data or if you want to query identity data.) + [Associate the configured table to your collaboration](associate-configured-table.md). (Optional if you want to analyze your own event data.) + [Add an analysis rule for the configured table](add-analysis-rule.md). (Optional if you want to analyze your own event data.) + [Create a membership and join a collaboration](create-membership.md). (Optional if you've already created a membership.) + [Invite members to join the collaboration](invite-members.md). # Creating a collaboration for queries and jobs In this procedure, you as the [collaboration creator](glossary.md#glossary-collaboration-creator) perform the following tasks: + [Create a collaboration](create-collaboration.md). + Invite one or more [members](glossary.md#glossary-member) to the [collaboration](glossary.md#glossary-collaboration). + Assign abilities to members, such as the [member who can run queries and jobs](glossary.md#glossary-member-who-can-run-queries-jobs) and the [member who can receive results](glossary.md#glossary-member-who-can-receive-results). If the collaboration creator is also the member who can receive results, they specify the results destination and format. They also provide a service role Amazon Resource Name (ARN) to write the results to the results destination. + Configure which [member is responsible for paying for query and job compute costs in the collaboration](glossary.md#glossary-member-paying-for-query-job-compute). Before you begin, make sure that you have completed the following prerequisites: + You have the name and AWS account ID for each member that you want to invite to the collaboration. + You have permission to share the name and AWS account ID for each member with all members of the collaboration. **Note** You can’t add more members after you create the collaboration. For information about how to create a collaboration using the AWS SDKs, see the *[AWS Clean Rooms API Reference](https://docs.aws.amazon.com/clean-rooms/latest/apireference/Welcome.html)*. **To create a collaboration for queries and jobs** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with the AWS account that will function as the collaboration creator. 1. In the left navigation pane, choose **Collaborations**. 1. In the upper right corner, choose **Create collaboration**. 1. For **Step 1: Define collaboration**, do the following: 1. For **Details**, enter the **Name** and **Description** of the collaboration. This information will be visible to collaboration members who are invited to participate in the collaboration. The **Name** and **Description** helps them understand what the collaboration is in reference to. 1. For **Members**: 1. For **Member 1: You**, enter your **Member display name** as you want it to appear for the collaboration. **Note** Your AWS account ID is included automatically for **Member AWS account ID**. 1. For **Member 2**, enter the **Member display name** and **Member AWS account ID** for the member that you want to invite to the collaboration. The **Member display name** and **Member AWS account ID** will be visible to everyone invited to the collaboration. After you enter and save the values for these fields, you can't edit them. **Note** You must inform the collaboration member that their **Member AWS account ID** and **Member display name** will be visible to all invited and active collaborators in the collaboration. 1. If you want to add another member, choose **Add another member**. Then enter the **Member display name** and **Member AWS account ID** for each member who can contribute data that you want to invite to the collaboration. 1. If you want to enable **Analysis logging**, select the **Enable analysis logging** checkbox, and then choose the **Supported log types**. + If you want to receive logs generated from SQL queries, choose the **Logs from queries** checkbox. + If you want to receive logs generated from jobs using PySpark, choose the **Logs from jobs** checkbox. 1. If you want to enable **Detailed monitoring**, select the **Enable detailed monitoring** checkbox. The analysis runner and configured payor can choose to enable detailed metrics when they create their membership. When enabled, detailed monitoring metrics will be published to CloudWatch for operational monitoring of collaborations, including query performance and resource utilization. These metrics will be available to the analysis runner and configured payor in their respective AWS accounts. For more information about CloudWatch pricing, see [CloudWatch Pricing](https://aws.amazon.com/cloudwatch/pricing/). 1. Under **Allowed query results regions**, select one or more AWS Regions where you want to send query results. By default, only the current Region (such as N. Virginia us-east-1) is selected. **Important** When you enable cross-Region query results delivery, your results may be processed and stored outside the source Region. For more information about Regions, see [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the *AWS General Reference*. 1. (Optional) Manage access to your data with **Automatic change request approval** by configuring which settings can be changed automatically without manual approvals for a change request. By default, some settings can only be changed by submitting a change request which must be approved by all members before it can take effect. + **Grant member abilities** – Choose the abilities that can be granted to collaboration members without manual approval. Members can always contribute data. + Choose abilities: + Contribute data *(always enabled)* + Receive results + **Auto-approve new members with these abilities** – If allowed, any members added with the abilities selected above will instantly join the collaboration. Members added with other abilities will still require manual approval to join. + **Abilities that can be automatically revoked** - Choose the abilities that can be revoked without manual approval. Members can always contribute data. + Choose abilities: + Contribute data *(always enabled)* + Receive results If you choose this option, you can track all collaboration configuration modifications through the **Change requests history**, located on the **Details** tab of the collaboration details page. 1. (Optional) If you want to enable the **Cryptographic computing** capability, select the **Enable cryptographic computing** checkbox. 1. Choose the following **Cryptographic coverage parameters**: + **Allow plaintext columns** Choose **No** if you require fully encrypted tables. Choose **Yes** if you want cleartext columns allowed in the encrypted table. To run SUM or AVG on certain columns, the columns must be in cleartext. + **Preserve NULL values** Choose **No** if you don't want to preserve NULL values. NULL values won't appear as NULL in an encrypted table. Choose **Yes** if you want to preserve NULL values. NULL values will appear as NULL in an encrypted table. 1. Choose the following **Fingerprinting parameters**: + **Allow duplicates** Choose **No** if you don't want duplicate entries allowed in a fingerprint column. Choose **Yes** if you want duplicate entries allowed in a fingerprint column. + **Allow JOIN of columns with different names** Choose **No** if you don't want to join fingerprint columns with different names. Choose **Yes** if you want to join fingerprint columns with different names. For more information about **Cryptographic computing parameters**, see [Cryptographic computing parameters](crypto-computing-parameters.md). For more information about how to encrypt your data for use in AWS Clean Rooms, see [Preparing encrypted data tables with Cryptographic Computing for Clean Rooms](prepare-encrypted-data.md). **Note** Verify these configurations carefully before completing the next step. After you create the collaboration, you can only edit the collaboration name, description, and whether the logs are stored in Amazon CloudWatch Logs. 1. If you want to enable **Tags** for the collaboration resource, choose **Add new tag** and then enter the **Key** and **Value** pair. 1. Choose **Next**. 1. For **Step 2: Specify member abilities**, do the following: 1. For **Analysis using queries and jobs**, under **Supported analysis types**, choose the **Jobs** checkbox. The **Queries** checkbox is selected by default. 1. Select the member who can **Run queries and jobs** from the dropdown list. 1. Select the member who can **Receive results from analyses** from the dropdown list. **Note** The member who creates the PySpark analysis template must also be the member who receives results. 1. If you are using Clean Rooms ML, for **ML modeling using purpose-built workflows**, 1. (Optional) Select the member who can **Receive output from trained models** from the dropdown list. 1. (Optional) Select the member who can **Receive output from model inference** from the dropdown list. 1. View the member abilities under **ID resolution using AWS Entity Resolution**. 1. Choose **Next**. 1. For **Step 3: Configure payment**, 1. For **Analysis using queries and jobs**, choose the member who will **Pay for queries and jobs**. You can assign the member who can **Run queries and jobs** to be the member who pays for the queries and jobs compute costs. You can assign a different member to pay for the queries and jobs compute costs. 1. For **ML modeling using purpose-built workflows**, the **Creator of the configured lookalike model** is the member who will **Pay for lookalike modeling**. 1. For **ID resolution with AWS Entity Resolution**, the **Creator of the ID mapping table** is the member who will **Pay for ID mapping table**. 1. Choose **Next**. 1. For **Step 4: Configure membership**, choose one of the following options: ------ #### [ Yes, join by creating membership now ] 1. For **Results settings defaults**, for **Query results settings**, if you are the member who can **Receive results**, 1. Choose the **Set default settings for queries** checkbox. For the **Results destination in Amazon S3**, enter the Amazon S3 destination or choose **Browse S3** to select an S3 bucket. 1. For the query **Result format**, choose either **CSV** or **PARQUET**. 1. (Spark only) For the **Result files**, choose either **Multiple** or **Single**. 1. (Optional) For **Service access**, if you want to deliver queries that take up to 24 hours to your S3 destination, select the **Add a service role to support queries that take up to 24 hours to complete** checkbox. Large queries that take up to 24 hours to complete will be delivered to your S3 destination. If you don't select the checkbox, only queries that complete within 12 hours will be delivered to your S3 location. 1. Specify the **Service access** permissions by selecting either **Create and use a new service role** or **Use an existing service role**. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/clean-rooms/latest/userguide/create-collab-queries-and-jobs.html) **Note** AWS Clean Rooms requires permissions to query according to the analysis rules. For more information about permissions for AWS Clean Rooms, see [AWS managed policies for AWS Clean Rooms](security-iam-awsmanpol.md). If the role doesn’t have sufficient permissions for AWS Clean Rooms, you receive an error message stating that the role doesn't have sufficient permissions for AWS Clean Rooms. The role policy must be added before proceeding. If you can’t modify the role policy, you receive an error message stating that AWS Clean Rooms couldn't find the policy for the service role. 1. For **Job results**, **Example** For example: **s3://bucket/prefix** 1. Choose the **Set default settings for jobs** checkbox, and then specify the **Results destination in Amazon S3** by entering the S3 destination or choose **Browse S3** to select from a list of available S3 buckets. 1. Specify the **Service access** permissions by choosing an **Existing service role name** from the dropdown list. 1. For **Logs settings**, choose one of the following options for **Log storage in Amazon CloudWatch Logs**: **Note** The **Logs settings** section appears if you chose to enable **Query logging**. 1. Choose **Turn on** and the query logs relevant to you will be stored in your Amazon CloudWatch Logs account. Each member can receive only logs for queries that they initiated or that contain their data. The member who can receive results also receives logs for all queries run in a collaboration, even if their data isn't accessed in a query. Under **Supported log types**, choose from the log types the collaboration creator has chosen to support: Under **Supported log types**, the **Query logs** and **Job logs** checkboxes are turned on by default. **Note** After you turn on **Analysis logging**, it can take a few minutes for log storage to be set up and start receiving logs in Amazon CloudWatch Logs. During this brief period, the member who can query might run queries that don’t actually send logs. 1. Choose **Turn off** and the query logs relevant to you won't be stored in your Amazon CloudWatch Logs account. 1. If you want to enable **Membership tags** for the membership resource, choose **Add new tag** and then enter the **Key** and **Value** pair. 1. If you are the member who is paying for **Query compute**, or **Job compute**, or both, indicate your acceptance by selecting the **I agree to pay for the compute costs in this collaboration** checkbox. **Note** You must select this checkbox to proceed. For more information about how pricing is calculated, see [Pricing for AWS Clean Rooms](what-is.md#pricing). If you are the [member paying for query compute costs](glossary.md#glossary-member-paying-for-query-compute) but not the [member who can query](glossary.md#glossary-member-who-can-run-queries-jobs), it is recommended that you use AWS Budgets to configure a budget for AWS Clean Rooms and receive notifications once the maximum budget has been reached. For more information about setting up a budget, see [Managing your costs with AWS Budgets](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html) in the *AWS Cost Management User Guide*. For more information about setting up notifications, see [Creating an Amazon SNS topic for budget notifications](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-sns-policy.html) in the *AWS Cost Management User Guide*. If the maximum budget has been reached, you can contact the member who can run queries or [leave the collaboration](leave-collab.md). If you leave the collaboration, no more queries will be allowed to run, and therefore you will no longer be billed for query compute costs. 1. Choose **Next**. Both the collaboration and your membership are created. Your status in the collaboration is active. ------ #### [ No, I will create a membership later ] 1. Choose **Next**. Only the collaboration is created. Your status in the collaboration is inactive. ------ 1. For **Step 5: Review and create**, do the following: 1. Review the selections that you made for the previous steps and edit if necessary. 1. Choose one of the options. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/clean-rooms/latest/userguide/create-collab-queries-and-jobs.html) After your collaboration has been created successfully, you can see the collaboration details page under **Collaborations**. You are now ready to: + [Prepare your data table to be analyzed in AWS Clean Rooms](prepare-data.md). (Optional if you want to analyze your own event data or if you want to query identity data.) + [Associate the configured table to your collaboration](associate-configured-table.md). (Optional if you want to analyze your own event data.) + [Add an analysis rule for the configured table](add-analysis-rule.md). (Optional if you want to analyze your own event data.) + [Create a membership and join a collaboration](create-membership.md). (Optional if you've already created a membership.) + [Invite members to join the collaboration](invite-members.md). # Creating a collaboration for ML modeling In this procedure, you as the [collaboration creator](glossary.md#glossary-collaboration-creator) perform the following tasks: + [Create a collaboration](create-collaboration.md). + Invite one or more [members](glossary.md#glossary-member) to the [collaboration](glossary.md#glossary-collaboration). + Assign abilities to members, such as the + [Member who can query](glossary.md#glossary-member-who-can-query) + [Member who can receive results](glossary.md#glossary-member-who-can-receive-results) + Member who can receive output from trained models + Member who can output from model inference If the collaboration creator is also the member who can receive results, they specify the results destination and format. They also provide a service role Amazon Resource Name (ARN) to write the results to the results destination. + Configure which [member is responsible for paying for compute costs, model training, and model inference costs in the collaboration](glossary.md#glossary-member-paying-for-query-compute). Before you begin, make sure that you have completed the following prerequisites: + You have the name and AWS account ID for each member that you want to invite to the collaboration. + You have permission to share the name and AWS account ID for each member with all members of the collaboration. **Note** You can’t add more members after you create the collaboration. For information about how to create a collaboration using the AWS SDKs, see the *[AWS Clean Rooms API Reference](https://docs.aws.amazon.com/clean-rooms/latest/apireference/Welcome.html)*. **To create a collaboration for ML modeling** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with the AWS account that will function as the collaboration creator. 1. In the left navigation pane, choose **Collaborations**. 1. In the upper right corner, choose **Create collaboration**. 1. For **Step 1: Define collaboration**, do the following: 1. For **Details**, enter the **Name** and **Description** of the collaboration. This information will be visible to collaboration members who are invited to participate in the collaboration. The **Name** and **Description** helps them understand what the collaboration is in reference to. 1. For **Members**: 1. For **Member 1: You**, enter your **Member display name** as you want it to appear for the collaboration. **Note** Your AWS account ID is included automatically for **Member AWS account ID**. 1. For **Member 2**, enter the **Member display name** and **Member AWS account ID** for the member that you want to invite to the collaboration. The **Member display name** and **Member AWS account ID** will be visible to everyone invited to the collaboration. After you enter and save the values for these fields, you can't edit them. **Note** You must inform the collaboration member that their **Member AWS account ID** and **Member display name** will be visible to all invited and active collaborators in the collaboration. 1. If you want to add another member, choose **Add another member**. Then enter the **Member display name** and **Member AWS account ID** for each member who can contribute data that you want to invite to the collaboration. 1. If you want to enable **Analysis logging**, select the **Enable analysis logging** checkbox, and then under **Supported log types**, choose **Logs from queries**. 1. If you want to enable **Detailed monitoring**, select the **Enable detailed monitoring** checkbox. The analysis runner and configured payor can choose to enable detailed metrics when they create their membership. When enabled, detailed monitoring metrics will be published to CloudWatch for operational monitoring of collaborations, including query performance and resource utilization. These metrics will be available to the analysis runner and configured payor in their respective AWS accounts. For more information about CloudWatch pricing, see [CloudWatch Pricing](https://aws.amazon.com/cloudwatch/pricing/). 1. Under **Allowed query results regions**, select one or more AWS Regions where you want to send query results. By default, only the current Region (such as N. Virginia us-east-1) is selected. **Important** When you enable cross-Region query results delivery, your results may be processed and stored outside the source Region. For more information about Regions, see [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the *AWS General Reference*. 1. (Optional) Manage access to your data with **Automatic change request approval** by configuring which settings can be changed automatically without manual approvals for a change request. By default, some settings can only be changed by submitting a change request which must be approved by all members before it can take effect. + **Grant member abilities** – Choose the abilities that can be granted to collaboration members without manual approval. Members can always contribute data. + Choose abilities: + Contribute data *(always enabled)* + Receive results + **Auto-approve new members with these abilities** – If allowed, any members added with the abilities selected above will instantly join the collaboration. Members added with other abilities will still require manual approval to join. + **Abilities that can be automatically revoked** - Choose the abilities that can be revoked without manual approval. Members can always contribute data. + Choose abilities: + Contribute data *(always enabled)* + Receive results If you choose this option, you can track all collaboration configuration modifications through the **Change requests history**, located on the **Details** tab of the collaboration details page. 1. (Optional) If you want to enable the **Cryptographic computing** capability, select the **Enable cryptographic computing** checkbox. 1. Choose the following **Cryptographic coverage parameters**: + **Allow plaintext columns** Choose **No** if you require fully encrypted tables. Choose **Yes** if you want cleartext columns allowed in the encrypted table. To run SUM or AVG on certain columns, the columns must be in cleartext. + **Preserve NULL values** Choose **No** if you don't want to preserve NULL values. NULL values won't appear as NULL in an encrypted table. Choose **Yes** if you want to preserve NULL values. NULL values will appear as NULL in an encrypted table. 1. Choose the following **Fingerprinting parameters**: + **Allow duplicates** Choose **No** if you don't want duplicate entries allowed in a fingerprint column. Choose **Yes** if you want duplicate entries allowed in a fingerprint column. + **Allow JOIN of columns with different names** Choose **No** if you don't want to join fingerprint columns with different names. Choose **Yes** if you want to join fingerprint columns with different names. For more information about **Cryptographic computing parameters**, see [Cryptographic computing parameters](crypto-computing-parameters.md). For more information about how to encrypt your data for use in AWS Clean Rooms, see [Preparing encrypted data tables with Cryptographic Computing for Clean Rooms](prepare-encrypted-data.md). **Note** Verify these configurations carefully before completing the next step. After you create the collaboration, you can only edit the collaboration name, description, and whether the logs are stored in Amazon CloudWatch Logs. 1. If you want to enable **Tags** for the collaboration resource, choose **Add new tag** and then enter the **Key** and **Value** pair. 1. Choose **Next**. 1. For **Step 2: Specify member abilities**, 1. For **Analysis using queries and jobs**, under the **Supported analysis types**, leave the **Queries** checkbox selected. 1. For **Run queries**, choose the member who will initiate the model training 1. For **Receive results from analyses**, choose one or more members who will receive the query results. 1. For **ML modeling using purpose-built workflows**, 1. For **Receive output from trained models**, choose the member who will receive trained model results, including model artifacts and metrics. 1. For **Receive output from model inference**, choose the member who will receive the model inference results. 1. View the member abilities under **ID resolution using AWS Entity Resolution**. 1. For **Step 3: Configure payment**, 1. Under **Analysis using queries**, for **Pay for queries**, do one of the following actions: + To have the same member pay for and run queries, select the same member you chose for **Run queries**. + To have a different member pay for query costs, select your member account. 1. For **ML modeling using purpose-built workflows**, 1. Choose the member who will **Pay for model training**. 1. Choose the member who will **Pay for inference job**. 1. For **Pay for lookalike modeling**, no action is needed. The **Creator of the configured lookalike model** is the member who will pay for lookalike modeling. 1. (Optional) Choose the member who will **Pay for Synthetic data generation**. 1. For **ID resolution with AWS Entity Resolution**, no action is needed. The **Creator of the ID mapping table** is the member who will **Pay for ID mapping table**. 1. Choose **Next**. 1. For **Step 4: Configure membership**, under **Collaboration membership**, choose one of the following options: ------ #### [ Yes, join by creating membership now ] 1. For **Results settings defaults**, for **Query results settings**, if you are the member who can **Receive results**, 1. Select the **Set default settings for queries** checkbox. 1. For the **Results destination in Amazon S3**, enter the Amazon S3 destination or choose **Browse S3** to select an S3 bucket. 1. For the query **Result format**, choose either **CSV** or **PARQUET**. 1. (Spark only) For the **Result files**, choose either **Multiple** or **Single**. 1. (Optional) If you want to deliver queries that take up to 24 hours to your S3 destination, select the **Add a service role to support queries that take up to 24 hours to complete** checkbox. Large queries that take up to 24 hours to complete will be delivered to your S3 destination. If you don't select the checkbox, only queries that complete within 12 hours will be delivered to your S3 location. 1. Specify the **Service access** permissions by selecting either **Create and use a new service role** or **Use an existing service role**. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/clean-rooms/latest/userguide/create-collab-ml-modeling.html) **Note** AWS Clean Rooms requires permissions to query according to the analysis rules. For more information about permissions for AWS Clean Rooms, see [AWS managed policies for AWS Clean Rooms](security-iam-awsmanpol.md). If the role doesn’t have sufficient permissions for AWS Clean Rooms, you receive an error message stating that the role doesn't have sufficient permissions for AWS Clean Rooms. The role policy must be added before proceeding. If you can’t modify the role policy, you receive an error message stating that AWS Clean Rooms couldn't find the policy for the service role. 1. For **ML configuration**, 1. Choose the **Create ML configuration** checkbox, and then specify the **Model output destination on Amazon S3** by entering the S3 destination or choose **Browse S3** to select from a list of available S3 buckets. 1. Specify the **Service access** permissions by choosing to either **Create and use a new service role** or **Use an existing service role**. 1. If the S3 bucket is encrypted, select the **The destination bucket is encrypted with a KMS key** checkbox and then enter the **AWS KMS key** or select **Create an AWS KMS key** to create a new KMS key. 1. If you want to enable **Membership tags** for the membership resource, choose **Add new tag** and then enter the **Key** and **Value** pair. 1. If you are the member who is paying for **Query compute**, indicate your acceptance by selecting the **I agree to pay for the compute costs in this collaboration** checkbox. **Note** You must select this checkbox to proceed. For more information about how pricing is calculated, see [Pricing for AWS Clean Rooms](what-is.md#pricing). If you are the [member paying for query compute costs](glossary.md#glossary-member-paying-for-query-compute) but not the [member who can query](glossary.md#glossary-member-who-can-run-queries-jobs), it is recommended that you use AWS Budgets to configure a budget for AWS Clean Rooms and receive notifications once the maximum budget has been reached. For more information about setting up a budget, see [Managing your costs with AWS Budgets](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html) in the *AWS Cost Management User Guide*. For more information about setting up notifications, see [Creating an Amazon SNS topic for budget notifications](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-sns-policy.html) in the *AWS Cost Management User Guide*. If the maximum budget has been reached, you can contact the member who can run queries or [leave the collaboration](leave-collab.md). If you leave the collaboration, no more queries will be allowed to run, and therefore you will no longer be billed for query compute costs. 1. Choose **Next**. Both the collaboration and your membership are created. Your status in the collaboration is active. ------ #### [ No, I will create a membership later ] 1. Choose **Next**. Only the collaboration is created. Your status in the collaboration is inactive. ------ 1. For **Step 5: Review and create**, do the following: 1. Review the selections that you made for the previous steps and edit if necessary. 1. Choose one of the options. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/clean-rooms/latest/userguide/create-collab-ml-modeling.html) # Creating a membership and joining a collaboration Creating a membership and joining a collaboration A *membership* is a resource that's created when a member joins a collaboration in AWS Clean Rooms. You can join a collaboration as a + [member who can query](glossary.md#glossary-member-who-can-query) + [member who can run queries and jobs](glossary.md#glossary-member-who-can-run-queries-jobs) + [member who can receive results](glossary.md#glossary-member-who-can-receive-results) of a query or a job + [member paying for query compute costs](glossary.md#glossary-member-paying-for-query-compute) + [member paying for queries and jobs](glossary.md#glossary-member-paying-for-query-job-compute) All members can contribute data. For information about how to create a membership and join a collaboration using the AWS SDKs, see the *[AWS Clean Rooms API Reference](https://docs.aws.amazon.com/clean-rooms/latest/apireference/Welcome.html)*. In this procedure, the invited member [joins the collaboration by creating a membership resource](#create-membership). If the invited member is the member who can receive results, they specify the results destination and format. They also provide a service role ARN to write to the results destination. If the invited member is the member who is responsible to pay for compute costs, they accept their payment responsibilities before joining the collaboration. **To create a membership and join a collaboration** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your member AWS account. 1. In the left navigation pane, choose **Collaborations**. 1. On the **Available to join** tab, for **Collaborations available to join**, choose the **Name** of the collaboration. 1. On the collaboration details page, in the **Overview** section, view the collaboration details, including **Your member details** and a list of the other members. Verify that the AWS account IDs for each member of the collaboration are the ones with whom you intend to enter in to the collaboration. 1. Choose **Create membership**. 1. On the **Create membership** page, in the **Overview**, view the **Collaboration name**, **Collaboration description**, AWS account ID of the **Collaboration creator**, **Your member details**, and the AWS account ID of the member who will **Pay for queries**. 1. If the collaboration creator has chosen to enable **Analysis logging**, choose one of the following options for **Log storage in Amazon CloudWatch Logs**: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/clean-rooms/latest/userguide/create-membership.html) **Note** After you turn on **Analysis logging**, it can take a few minutes for log storage to be set up and start receiving logs in Amazon CloudWatch Logs. During this brief period, the member who can query might run queries that don’t actually send logs. 1. If the collaboration creator enabled **Detailed monitoring** for this collaboration, choose whether you want to receive detailed observability metrics in your CloudWatch account. For **Detailed monitoring**: **Detailed monitoring options** [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/clean-rooms/latest/userguide/create-membership.html) **Note** Detailed monitoring metrics are only available to members who can run queries (analysis runners) and members who are configured as payors for the collaboration. 1. If **Your member abilities** includes **Receive results**, for **Results settings defaults**: 1. For **Query results**, choose the **Set default settings for queries** checkbox, and then specify the **Results destination in Amazon S3** by entering the S3 destination or choose **Browse S3** to select from a list of available S3 buckets. **Example** For example: **s3://bucket/prefix** 1. For the **Result format**, choose either **CSV** or **PARQUET**. 1. (Spark only) For the **Result files**, choose either **Multiple** or **Single**. 1. (Optional) For **Service access**, if you want to deliver queries that take up to 24 hours to your S3 destination, select the **Add a service role to support queries that take up to 24 hours to complete** check box. Large queries that take up to 24 hours to complete will be delivered to your S3 destination. If you don't select the check box, only queries that complete within 12 hours will be delivered to your S3 location. **Note** You must either select an existing service role or have permissions to create a new one. For more information, see [Create a service role to receive results](setting-up-roles.md#create-role-write-results). 1. Specify the **Service access** permissions by selecting either **Create and use a new service role** or **Use an existing service role**. ------ #### [ Create and use a new service role ] + AWS Clean Rooms creates a service role with the required policy for this table. + The default **Service role name** is `cleanrooms-result-receiver-` + You must have permissions to create roles and attach policies. ------ #### [ Use an existing service role ] 1. Choose an **Existing service role name** from the dropdown list. The list of roles are displayed if you have permissions to list roles. If you don't have permissions to list roles, you can enter the Amazon Resource Name (ARN) of the role that you want to use. 1. View the service role by choosing the **View in IAM** external link. If there are no existing service roles, the option to **Use an existing service role** is unavailable. By default, AWS Clean Rooms doesn't attempt to update the existing role policy to add necessary permissions. ------ **Note** AWS Clean Rooms requires permissions to query according to the analysis rules. For more information about permissions for AWS Clean Rooms, see [AWS managed policies for AWS Clean Rooms](security-iam-awsmanpol.md). If the role doesn’t have sufficient permissions for AWS Clean Rooms, you receive an error message stating that the role doesn't have sufficient permissions for AWS Clean Rooms. The role policy must be added before proceeding. If you can’t modify the role policy, you receive an error message stating that AWS Clean Rooms couldn't find the policy for the service role. 1. For **Job results**, choose the **Set default settings for jobs** checkbox, and then specify the **Results destination in Amazon S3** by entering the S3 destination or choose **Browse S3** to select from a list of available S3 buckets. **Example** For example: **s3://bucket/prefix** 1. Specify the **Service access** permissions by choosing an **Existing service role name** from the dropdown list. 1. If you want to enable **Tags** for the membership resource, choose **Add new tag** and then enter the **Key** and **Value** pair. 1. If the collaboration creator has designated you as the member who will **Pay for queries** or **Pay for queries and jobs**, indicate your acceptance by selecting the **I agree to pay for the compute costs in this collaboration** checkbox. **Note** You must select this checkbox to proceed. For more information about how pricing is calculated, see [Pricing for AWS Clean Rooms](what-is.md#pricing). If you are the [member paying for query compute costs](glossary.md#glossary-member-paying-for-query-compute) or the [member paying for queries and job compute costs](glossary.md#glossary-member-paying-for-query-job-compute) but not the [member who can query](glossary.md#glossary-member-who-can-query), it is recommended that you use AWS Budgets to configure a budget for AWS Clean Rooms and receive notifications once the maximum budget has been reached. For more information about setting up a budget, see [Managing your costs with AWS Budgets](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html) in the *AWS Cost Management User Guide*. For more information about setting up notifications, see [Creating an Amazon SNS topic for budget notifications](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-sns-policy.html) in the *AWS Cost Management User Guide*. If the maximum budget has been reached, you can contact the member who can run queries and jobs or [leave the collaboration](leave-collab.md). If you leave the collaboration, no more queries will be allowed to run, and therefore you will no longer be billed for query compute costs. 1. If you are sure that you want to create a membership and join the collaboration, choose **Create membership**. You are given read access to the collaboration metadata. This includes information such as the display name and description of the collaboration, in addition to all the names and AWS account IDs of other members. You are now ready to: + [Prepare your data table to be queried in AWS Clean Rooms](prepare-data.md). (Optional if you want to query your own event data or if you want to query identity data.) + [Associate the configured table to your collaboration](associate-configured-table.md) – if you want to query event data. + [Add an analysis rule for the configured table](add-analysis-rule.md) – if you want to query event data. + [Create and associate a new ID namespace](create-new-id-namespace.md) – if you want to create an ID mapping table to query identity data. For information about how to leave a collaboration, see [Leaving a collaboration](leave-collab.md). # Editing collaborations As a collaboration creator, you can edit the different parts of a collaboration. For information about how to edit a collaboration using the AWS SDKs, see the *[AWS Clean Rooms API Reference](https://docs.aws.amazon.com/clean-rooms/latest/apireference/Welcome.html)*. **Topics** + [ ## Edit collaboration name and description ](#edit-name-descrip) + [ ## Update collaboration analytics engine ](#change-collab-analytics-engine) + [ ## Turn off log storage ](#turn-off-log-storage) + [ ## Edit collaboration logs settings ](#edit-logs-settings) + [ ## Edit collaboration tags ](#edit-collab-tags) + [ ## Edit membership tags ](#edit-membership-tags) + [ ## Add a new member ](#add-new-member) + [ ## Edit existing member abilities ](#edit-member-abilities) + [ ## Edit collaboration auto-approval settings ](#edit-auto-approval) + [ ## Edit associated table tags ](#edit-associated-table-tags) + [ ## Edit analysis template tags ](#edit-analysis-template-tags) + [ ## Edit differential privacy policy tags ](#edit-dp-policy-tags) ## Edit collaboration name and description After you create the collaboration, you can only edit the collaboration name and description. **To edit the collaboration name and description** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that you created. 1. On the collaboration detail page, choose **Actions**, and then choose **Edit collaboration**. 1. On the **Edit collaboration** page, for **Details**, edit the **Name** and **Description** of the collaboration. 1. Choose **Save changes**. ## Update collaboration analytics engine After you create the collaboration, you can change the analytics engine from AWS Clean Rooms SQL to Spark. **Note** Changing the analytics engine from AWS Clean Rooms SQL to Spark might break existing workflows. **To update the collaboration analytics engine** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your AWS account (if you haven't yet done so). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that you created. 1. On the collaboration detail page, choose **Actions**, and then choose **Edit collaboration**. 1. Choose **Save changes**. ## Turn off log storage If you have enabled **Analysis logging**, you can edit whether the analysis logs are stored in your Amazon CloudWatch Logs account. **To turn off log storage** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your AWS account (if you haven't yet done so). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that has analysis logging turned on. 1. On the collaboration detail page, choose **Actions**, and then choose **Turn off log storage**. **Note** A warning appears, indicating the following: New queries will no longer be logged to your CloudWatch account. Existing logs will be preserved according to your current retention settings. If you reactivate logging in the future, it will only apply to queries made after reactivation. This change affects only your logs - other team members' logging settings remain unchanged. 1. Choose **Turn off**. ## Edit collaboration logs settings If you have enabled **Query logging**, you can edit whether the query logs are stored in your Amazon CloudWatch Logs account. **To edit collaboration logs settings** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your AWS account (if you haven't yet done so). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that you created. 1. On the collaboration detail page, do one of the following: + Choose **Actions**, and then choose **Edit logs settings**. + On the **Logs** tab, choose **Edit logs settings**. 1. On the **Edit logs settings modal**, for **Log storage in Amazon CloudWatch Logs**: + If you don't want logs relevant to you to be stored in your Amazon CloudWatch Logs account, choose **Turn off**. + If you do want logs relevant to you to be stored in your Amazon CloudWatch Logs account, choose **Turn on**. You can only receive logs for queries that you initiated or that contain you data. The member who can receive results also receives logs for all queries run in a collaboration, even if their data isn't accessed in a query. 1. Under **Supported log types**, choose from the log types the collaboration creator has chosen to support: + If you want to receive logs generated from SQL queries, choose the **Logs from queries** checkbox. + If you want to receive logs generated from jobs using PySpark, choose the **Logs from jobs** checkbox. 1. Choose **Save changes**. **Note** After you turn on logging, it can take a few minutes for log storage to be set up and start receiving logs in Amazon CloudWatch Logs. During this brief period, the member who can query might run queries that don’t actually send logs. ## Edit collaboration tags As a collaboration creator, after you have created a collaboration, you can manage the tags on the collaboration resource. **To edit the collaboration tags** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your AWS account (if you haven't yet done so). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that you created. 1. Choose one of the following: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/clean-rooms/latest/userguide/edit-collaboration.html) 1. For **Collaboration details**, choose **Manage tags**. 1. On the **Manage tags** page, you can do the following: + To remove a tag, choose **Remove**. + To add a tag, choose **Add new tag**. + To save your changes, choose **Save changes** ## Edit membership tags As a collaboration creator, after you have created a collaboration, you can manage the tags on the membership resource. **To edit the membership tags** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your AWS account (if you haven't yet done so). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that you created. 1. Choose the **Details** tab. 1. For **Membership details**, choose **Manage tags**. 1. On the **Manage membership tags** page, you can do the following: + To remove a tag, choose **Remove**. + To add a tag, choose **Add new tag**. + To save your changes, choose **Save changes**. ## Add a new member For more information, see [Add a new member to a collaboration](change-requests.md#add-new-member-change-request). ## Edit existing member abilities For more information, see [Update existing member abilities](change-requests.md#update-member-abilities-change-request). ## Edit collaboration auto-approval settings For more information, see [Edit collaboration auto-approval settings](change-requests.md#edit-auto-approval-settings). ## Edit associated table tags As a collaboration creator, after you associate tables to a collaboration, you can manage the tags on the associated table resource. **To edit the associated table tags** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your AWS account (if you haven't yet done so). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that you created. 1. Choose the **Tables** tab. 1. For **Tables associated by you**, choose a table. 1. On the configured table detail page, for **Tags**, choose **Manage tags**. On the **Manage tags** page, you can do the following: + To remove a tag, choose **Remove**. + To add a tag, choose **Add new tag**. + To save your changes, choose **Save changes**. ## Edit analysis template tags As a collaboration creator, after you have created a collaboration, you can manage the tags on the analysis template resource. **To edit the membership tags** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your AWS account (if you haven't yet done so). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that you created. 1. Choose the **Templates** tab. 1. On the **Analysis templates created by you** section, choose the analysis template. 1. On the analysis template table detail page, scroll down to the **Tags** section. 1. Choose **Manage tags**. 1. On the **Manage tags** page, you can do the following: + To remove a tag, choose **Remove**. + To add a tag, choose **Add new tag**. + To save your changes, choose **Save changes**. ## Edit differential privacy policy tags As a collaboration creator, after you have created a collaboration, you can manage the tags on the analysis template resource. **To edit the membership tags** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your AWS account (if you haven't yet done so). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that contains the differential privacy policy you want to edit. 1. Choose the **Tables** tab. 1. On the **Tables** tab, choose the **Manage tags**. 1. On the **Manage tags** page, you can do the following: + To remove a tag, choose **Remove**. + To add a tag, choose **Add new tag**. + To save your changes, choose **Save changes**. # Change requests in AWS Clean Rooms Change requests Change requests allow you to propose changes to existing collaboration settings for approval by other collaboration members. With change requests, you can submit a request to add new members, update existing member abilities, and modify collaboration auto-approval settings. All collaboration members must approve change requests for the proposed changes to take effect. Change requests are collaboration-specific and can be submitted by the collaboration creator. You can submit a change request in the following ways: + Add a new member to a collaboration + Update existing member abilities + Edit collaboration auto-approval settings **Note** You must be the collaboration creator to submit a change request. ## Add a new member to a collaboration To add a new member to a collaboration, you must be the collaboration creator. Adding a new member to a collaboration requires manual approval from existing collaboration members, and will submit a change request. You can add new members to a collaboration by following these steps: **To add a new member to a collaboration** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your member AWS account. 1. In the left navigation pane, choose **Collaborations**. 1. Select your collaboration to navigate to your collaboration details. 1. On the collaboration page, navigate to the **Members** tab. 1. In the Members table, select **Edit members**. 1. Choose **Add another member**. 1. Input the new member information: + Member display name + Member AWS account ID + Specify whether the member can receive results. Check the box to grant this member ability. 1. Choose **Save changes**. 1. Confirm your change request submission. In the confirmation modal, confirm the changes and select **Submit change request**. **Note** If auto-approved change types are supported in your collaboration, manual approval of change requests may not be required. You can review which change types do not require a change request in the "Overview" section of the collaboration. For more information, see [Edit collaboration auto-approval settings](#edit-auto-approval-settings). ## Update existing member abilities To update existing collaboration member abilities, you must be the collaboration creator. Updating abilities for existing collaboration members requires manual approval from existing members, and will submit a change request. The member abilities that can be updated are: + Can receive results You can update the member abilities for existing collaboration members by following these steps: **To update existing member abilities** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your member AWS account. 1. In the left navigation pane, choose **Collaborations**. 1. Select your collaboration to navigate to your collaboration details. 1. On the collaboration page, navigate to the **Members** tab. 1. In the Members table, select **Edit members**. 1. Specify the member ability to change. 1. Choose **Save changes**. 1. Confirm your change request submission. In the confirmation modal, confirm the changes and select **Submit change request**. **Note** If auto-approved change types are supported in your collaboration, manual approval of change requests may not be required. You can review which change types do not require a change request in the "Overview" section of the collaboration. For more information, see [Edit collaboration auto-approval settings](#edit-auto-approval-settings). ## Edit collaboration auto-approval settings To edit the collaboration settings for auto-approvals, you must be the collaboration creator and submit a change request for approval by other collaboration members. You can edit the auto-approval settings for a collaboration by following these steps: **To edit collaboration auto-approval settings** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home) with your member AWS account. 1. In the left navigation pane, choose **Collaborations**. 1. Select your collaboration to navigate to your collaboration details. 1. On the collaboration page, choose the **Actions** button and select **Edit auto approvals**. 1. **To grant member abilities to existing members without manually approving a change request:** 1. Navigate to the **Grant member abilities** section. 1. Specify which member abilities can be automatically granted. **Note** By default, all collaboration members can "Contribute data". 1. (Optional) To allow new members to instantly join a collaboration with the specified abilities without manually approving change requests, select **Auto-approve new members with these abilities**. 1. **To allow removal of abilities from existing members without a change request:** 1. Navigate to the **Abilities that can be automatically revoked** section. 1. Specify which member abilities can be automatically removed. 1. Choose **Save changes**. 1. Confirm your change request submission. In the confirmation modal, confirm the changes and select **Submit change request**. # Deleting collaborations As a collaboration creator, you can delete a collaboration that you created. **Note** When you delete a collaboration, you and all members can't run queries, receive results, or contribute data. Each collaboration member continues to have access to their own data as part of their membership. **To delete a collaboration** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that you want to delete. 1. Under **Actions**, choose **Delete collaboration**. 1. Confirm the deletion and then choose **Delete**. # Viewing collaborations As a collaboration creator, you can view all of the collaborations that you created. **To view collaborations** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home). 1. In the left navigation pane, choose **Collaborations**. 1. On the **Collaborations** page, under **Last used**, view the last 5 collaborations used. 1. On the **With active membership** tab, view the list of **Collaborations with active membership**. You can sort by **Name**, the **Membership created date**, and **Your member details**. You can use the **Search** bar to search for a collaboration. 1. On the **Available to join** tab, view the list of **Collaborations available to join**. 1. On the **No longer available** tab, view the list of deleted collaborations and **Memberships for collaborations that are no longer available** (removed memberships). # Inviting members to a collaboration Inviting members As a collaboration creator, after you have created a collaboration, you can send an invitation link to the members listed on the **Members** tab. **To invite members to a collaboration** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that you created. 1. Choose the **Members** tab. 1. In the **Members** table, choose the **Copy invitation link** button. The invitation link is copied. 1. Paste the invitation link in the secure communication method of your choice and send it to each member of the collaboration. # Monitoring members As a collaboration creator, after you have created a collaboration, you can monitor the status of all members on the **Members** tab. This helps ensure proper access control and cost management across your collaboration. **To monitor the status of a member** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home). 1. In the left navigation pane, choose **Collaborations**. 1. Choose the collaboration that you created. 1. Choose the **Members** tab. 1. In the **Members** table, review the **Status** of each member. 1. In the **Member abilities** table, review which members can query, receive results, contribute data, and perform other tasks. 1. In the **Payment configuration** table, review which members are paying for queries, ID mapping tables, and ML modeling. # Adding members to a collaboration Adding members **Prerequisites** + An AWS account with permissions to manage collaborations + The AWS account IDs of members you want to add **To add a member to a collaboration** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home). 1. In the left navigation pane, choose **Collaborations**. 1. Select the collaboration you want to add members to. 1. Choose the **Members** tab. 1. Choose **Edit members**. 1. Choose **Add another member** and enter the following information: + **Member display name** + **Member AWS account ID** + Specify whether they **can receive results** 1. Choose **Save changes**. 1. In the confirmation modal, verify that the information is correct, and choose **Submit change request**. + If the change request requires other members' approval, all existing members must approve the change request before the new member is added. For more information on change requests, see [Change requests in AWS Clean Rooms](change-requests.md). + If auto-approval change types are supported for new members with the specified abilities, then this change will take effect immediately. For more information, see [Edit collaboration auto-approval settings](change-requests.md#edit-auto-approval-settings). 1. On the collaboration detail page, under the **Members** tab, verify that the **Member status** of the added member(s) displays as **Invited**. After completing these steps, the invited members can join the collaboration. For more information about joining a collaboration, see [Creating a membership and joining a collaboration](create-membership.md) # Removing members from a collaboration Removing members **Note** Before you begin, note that removing a member: Removes all of their associated datasets from the collaboration If the [member pays for query compute costs](glossary.md#glossary-member-paying-for-query-compute), this action stops all query execution in the collaboration. Removing a member also removes all of their associated datasets from the collaboration. **Prerequisites** + You must be a collaboration creator + You can't remove your own account **To remove a member from a collaboration** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home). 1. In the left navigation pane, choose **Collaborations**. 1. Select the collaboration you want to modify. 1. Choose the **Members** tab. 1. Select the option button next to the member you want to remove. 1. Choose **Remove**. 1. In the confirmation dialog box, type **confirm** to verify the removal. **Note** After you remove a member, all datasets associated with their account are also removed from the collaboration. **Important** If you remove the member who pays for query compute costs, no further queries can run in the collaboration until you designate a new paying member. # Leaving a collaboration As a collaboration member, you can leave a collaboration by deleting your membership. If you are the collaboration creator, you can only leave a collaboration by [deleting the collaboration](delete-collaboration.md). **Note** When you delete your membership, you leave the collaboration and can't re-join it. If you are the [member paying for query compute costs](glossary.md#glossary-member-paying-for-query-compute) and you delete your membership, no more queries are allowed to run. **To leave a collaboration** 1. Sign in to the AWS Management Console and open the [AWS Clean Rooms console](https://console.aws.amazon.com/cleanrooms/home). 1. In the left navigation pane, choose **Collaborations**. 1. For **With active membership**, choose the collaboration of which you are a member. 1. Choose **Actions**. 1. Choose **Delete membership**. 1. In the dialog box, confirm the decision to leave the collaboration by typing **confirm** in the text input field, and then choose **Empty and delete membership**. You see a message on the console indicating that the membership was deleted. The collaboration creator sees the **Member status** as **Left**.