View a markdown version of this page

Actions, resources, and condition keys for AWS Clean Rooms ML - Service Authorization Reference

Actions, resources, and condition keys for AWS Clean Rooms ML

AWS Clean Rooms ML (service prefix: cleanrooms-ml) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

API operations defined by AWS Clean Rooms ML

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation IAM action Condition key Possible value(s) Access level

CancelTrainedModel

cleanrooms-ml:CancelTrainedModel

Write

CancelTrainedModelInferenceJob

cleanrooms-ml:CancelTrainedModelInferenceJob

Write

CreateAudienceModel

cleanrooms-ml:CreateAudienceModel

Write

cleanrooms-ml:TagResource

Tagging, Write

CreateConfiguredAudienceModel

cleanrooms-ml:CreateConfiguredAudienceModel

Write

cleanrooms-ml:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

cleanrooms-ml.amazonaws.com

Write

CreateConfiguredModelAlgorithm

cleanrooms-ml:CreateConfiguredModelAlgorithm

Write

cleanrooms-ml:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

cleanrooms-ml.amazonaws.com

Write

CreateConfiguredModelAlgorithmAssociation

cleanrooms-ml:CreateConfiguredModelAlgorithmAssociation

Write

cleanrooms-ml:TagResource

Tagging, Write

CreateMLInputChannel

cleanrooms-ml:CreateMLInputChannel

Write

cleanrooms-ml:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

cleanrooms-ml.amazonaws.com

Write

CreateTrainedModel

cleanrooms-ml:CreateTrainedModel

Write

cleanrooms-ml:TagResource

Tagging, Write

CreateTrainingDataset

cleanrooms-ml:CreateTrainingDataset

Write

cleanrooms-ml:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

cleanrooms-ml.amazonaws.com

Write

DeleteAudienceGenerationJob

cleanrooms-ml:DeleteAudienceGenerationJob

Write

DeleteAudienceModel

cleanrooms-ml:DeleteAudienceModel

Write

DeleteConfiguredAudienceModel

cleanrooms-ml:DeleteConfiguredAudienceModel

Write

DeleteConfiguredAudienceModelPolicy

cleanrooms-ml:DeleteConfiguredAudienceModelPolicy

Write

DeleteConfiguredModelAlgorithm

cleanrooms-ml:DeleteConfiguredModelAlgorithm

Write

DeleteConfiguredModelAlgorithmAssociation

cleanrooms-ml:DeleteConfiguredModelAlgorithmAssociation

Write

DeleteMLConfiguration

cleanrooms-ml:DeleteMLConfiguration

Write

DeleteMLInputChannelData

cleanrooms-ml:DeleteMLInputChannelData

Write

DeleteTrainedModelOutput

cleanrooms-ml:DeleteTrainedModelOutput

Write

DeleteTrainingDataset

cleanrooms-ml:DeleteTrainingDataset

Write

GetAudienceGenerationJob

cleanrooms-ml:GetAudienceGenerationJob

Read

GetAudienceModel

cleanrooms-ml:GetAudienceModel

Read

GetCollaborationConfiguredModelAlgorithmAssociation

cleanrooms-ml:GetCollaborationConfiguredModelAlgorithmAssociation

Read

GetCollaborationMLInputChannel

cleanrooms-ml:GetCollaborationMLInputChannel

Read

GetCollaborationTrainedModel

cleanrooms-ml:GetCollaborationTrainedModel

Read

GetConfiguredAudienceModel

cleanrooms-ml:GetConfiguredAudienceModel

Read

GetConfiguredAudienceModelPolicy

cleanrooms-ml:GetConfiguredAudienceModelPolicy

Read

GetConfiguredModelAlgorithm

cleanrooms-ml:GetConfiguredModelAlgorithm

Read

GetConfiguredModelAlgorithmAssociation

cleanrooms-ml:GetConfiguredModelAlgorithmAssociation

Read

GetMLConfiguration

cleanrooms-ml:GetMLConfiguration

Read

GetMLInputChannel

cleanrooms-ml:GetMLInputChannel

Read

GetTrainedModel

cleanrooms-ml:GetTrainedModel

Read

GetTrainedModelInferenceJob

cleanrooms-ml:GetTrainedModelInferenceJob

Read

GetTrainingDataset

cleanrooms-ml:GetTrainingDataset

Read

ListAudienceExportJobs

cleanrooms-ml:ListAudienceExportJobs

List

ListAudienceGenerationJobs

cleanrooms-ml:ListAudienceGenerationJobs

List

ListAudienceModels

cleanrooms-ml:ListAudienceModels

List

ListCollaborationConfiguredModelAlgorithmAssociations

cleanrooms-ml:ListCollaborationConfiguredModelAlgorithmAssociations

List

ListCollaborationMLInputChannels

cleanrooms-ml:ListCollaborationMLInputChannels

List

ListCollaborationTrainedModelExportJobs

cleanrooms-ml:ListCollaborationTrainedModelExportJobs

List

ListCollaborationTrainedModelInferenceJobs

cleanrooms-ml:ListCollaborationTrainedModelInferenceJobs

List

ListCollaborationTrainedModels

cleanrooms-ml:ListCollaborationTrainedModels

List

ListConfiguredAudienceModels

cleanrooms-ml:ListConfiguredAudienceModels

List

ListConfiguredModelAlgorithmAssociations

cleanrooms-ml:ListConfiguredModelAlgorithmAssociations

List

ListConfiguredModelAlgorithms

cleanrooms-ml:ListConfiguredModelAlgorithms

List

ListMLInputChannels

cleanrooms-ml:ListMLInputChannels

List

ListTagsForResource

cleanrooms-ml:ListTagsForResource

List

ListTrainedModelInferenceJobs

cleanrooms-ml:ListTrainedModelInferenceJobs

List

ListTrainedModelVersions

cleanrooms-ml:ListTrainedModelVersions

List

ListTrainedModels

cleanrooms-ml:ListTrainedModels

List

ListTrainingDatasets

cleanrooms-ml:ListTrainingDatasets

List

PutConfiguredAudienceModelPolicy

cleanrooms-ml:PutConfiguredAudienceModelPolicy

Permissions management, Write

PutMLConfiguration

cleanrooms-ml:PutMLConfiguration

Write

iam:PassRole

iam:PassedToService

cleanrooms-ml.amazonaws.com

Write

StartAudienceExportJob

cleanrooms-ml:StartAudienceExportJob

Write

StartAudienceGenerationJob

cleanrooms-ml:StartAudienceGenerationJob

Write

cleanrooms-ml:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

cleanrooms-ml.amazonaws.com

Write

StartTrainedModelExportJob

cleanrooms-ml:StartTrainedModelExportJob

Write

StartTrainedModelInferenceJob

cleanrooms-ml:StartTrainedModelInferenceJob

Write

cleanrooms-ml:TagResource

Tagging, Write

TagResource

cleanrooms-ml:TagResource

Tagging, Write

UntagResource

cleanrooms-ml:UnTagResource

Tagging, Write

UpdateConfiguredAudienceModel

cleanrooms-ml:UpdateConfiguredAudienceModel

Write

iam:PassRole

iam:PassedToService

cleanrooms-ml.amazonaws.com

Write

Actions defined by AWS Clean Rooms ML

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions Description Resource types (*required) Condition keys Access level

CancelTrainedModel

Grants permission to cancel a trained model

TrainedModel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CancelTrainedModelInferenceJob

Grants permission to cancel a trained model inference job

TrainedModelInferenceJob*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateAudienceModel

Grants permission to create an audience model

trainingdataset*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateConfiguredAudienceModel

Grants permission to create a configured audience model

audiencemodel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateConfiguredModelAlgorithm

Grants permission to create a configured model algorithm

aws:RequestTag/${TagKey}

aws:TagKeys

Write

CreateConfiguredModelAlgorithmAssociation

Grants permission to create a configured model algorithm association

ConfiguredModelAlgorithm*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateMLInputChannel

Grants permission to create an ML input channel

ConfiguredModelAlgorithmAssociation*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateTrainedModel

Grants permission to create a trained model

ConfiguredModelAlgorithmAssociation*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateTrainingDataset

Grants permission to create a training dataset, or seed audience. In Clean Rooms ML, the TrainingDataset is metadata that points to a Glue table, which is read only during AudienceModel creation

aws:RequestTag/${TagKey}

aws:TagKeys

Write

DeleteAudienceGenerationJob

Grants permission to delete the specified audience generation job, and removes all data associated with the job

audiencegenerationjob*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

DeleteAudienceModel

Grants permission to delete the specified audience generation job, and removes all data associated with the job

audiencemodel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

DeleteConfiguredAudienceModel

Grants permission to delete the specified configured audience model

configuredaudiencemodel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

DeleteConfiguredAudienceModelPolicy

Grants permission to delete the specified configured audience model policy

configuredaudiencemodel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

DeleteConfiguredModelAlgorithm

Grants permission to delete a configured model algorithm

ConfiguredModelAlgorithm*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

DeleteConfiguredModelAlgorithmAssociation

Grants permission to delete a configured model algorithm association

ConfiguredModelAlgorithmAssociation*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

DeleteMLConfiguration

Grants permission to delete an ML configuration

aws:RequestTag/${TagKey}

aws:TagKeys

Write

DeleteMLInputChannelData

Grants permission to delete all data associated with the ML input channel

MLInputChannel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

DeleteTrainedModelOutput

Grants permission to delete all output associated with the trained model

TrainedModel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

DeleteTrainingDataset

Grants permission to delete a training dataset

trainingdataset*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

GetAudienceGenerationJob

Grants permission to return information about an audience generation job

audiencegenerationjob*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Read

GetAudienceModel

Grants permission to return information about an audience model

audiencemodel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Read

GetCollaborationConfiguredModelAlgorithmAssociation

Grants permission to return information about a configured model algorithm association created by any member in the collaboration

ConfiguredModelAlgorithmAssociation*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

cleanrooms-ml:CollaborationId

Read

GetCollaborationMLInputChannel

Grants permission to return information about an ML input channel created by any member in the collaboration

MLInputChannel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

cleanrooms-ml:CollaborationId

Read

GetCollaborationTrainedModel

Grants permission to return information about a trained model created by any member in the collaboration

TrainedModel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

cleanrooms-ml:CollaborationId

Read

GetConfiguredAudienceModel

Grants permission to return information about a configured audience model

configuredaudiencemodel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Read

GetConfiguredAudienceModelPolicy

Grants permission to return information about a configured audience model policy

configuredaudiencemodel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Read

GetConfiguredModelAlgorithm

Grants permission to return information about a configured model algorithm

ConfiguredModelAlgorithm*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Read

GetConfiguredModelAlgorithmAssociation

Grants permission to return information about a configured model algorithm association

ConfiguredModelAlgorithmAssociation*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Read

GetMLConfiguration

Grants permission to return information about an ML configuration

aws:RequestTag/${TagKey}

aws:TagKeys

Read

GetMLInputChannel

Grants permission to return information about an ML input channel

MLInputChannel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Read

GetTrainedModel

Grants permission to return information about a trained model

TrainedModel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Read

GetTrainedModelInferenceJob

Grants permission to return information about a trained model inference job

TrainedModelInferenceJob*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Read

GetTrainingDataset

Grants permission to return information about a training dataset

trainingdataset*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Read

ListAudienceExportJobs

Grants permission to return a list of the audience export jobs

audiencegenerationjob

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

List

ListAudienceGenerationJobs

Grants permission to return a list of audience generation jobs

configuredaudiencemodel

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

List

ListAudienceModels

Grants permission to return a list of audience models

List

ListCollaborationConfiguredModelAlgorithmAssociations

Grants permission to return a list of configured model algorithms created by any member in the collaboration

aws:RequestTag/${TagKey}

aws:TagKeys

cleanrooms-ml:CollaborationId

List

ListCollaborationMLInputChannels

Grants permission to return a list of ML input channels created by any member in the collaboration

aws:RequestTag/${TagKey}

aws:TagKeys

cleanrooms-ml:CollaborationId

List

ListCollaborationTrainedModelExportJobs

Grants permission to return a list of trained model export jobs started by any member in the collaboration

TrainedModel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

cleanrooms-ml:CollaborationId

List

ListCollaborationTrainedModelInferenceJobs

Grants permission to return a list of trained model inference jobs started by any member in the collaboration

aws:RequestTag/${TagKey}

aws:TagKeys

cleanrooms-ml:CollaborationId

List

ListCollaborationTrainedModels

Grants permission to return a list of trained models created by any member in the collaboration

aws:RequestTag/${TagKey}

aws:TagKeys

cleanrooms-ml:CollaborationId

List

ListConfiguredAudienceModels

Grants permission to return a list of configured audience models

List

ListConfiguredModelAlgorithmAssociations

Grants permission to return a list of configured model algorithm associations

aws:RequestTag/${TagKey}

aws:TagKeys

List

ListConfiguredModelAlgorithms

Grants permission to return a list of configured model algorithms

aws:RequestTag/${TagKey}

aws:TagKeys

List

ListMLInputChannels

Grants permission to return a list of ML input channels

aws:RequestTag/${TagKey}

aws:TagKeys

List

ListTagsForResource

Grants permission to return a list of tags for a provided resource

audiencegenerationjob

aws:ResourceTag/${TagKey}

aws:TagKeys

List

audiencemodel

aws:ResourceTag/${TagKey}

aws:TagKeys

configuredaudiencemodel

aws:ResourceTag/${TagKey}

aws:TagKeys

trainingdataset

aws:ResourceTag/${TagKey}

aws:TagKeys

ListTrainedModelInferenceJobs

Grants permission to return a list of trained model inference jobs

aws:RequestTag/${TagKey}

aws:TagKeys

List

ListTrainedModelVersions

Grants permission to return a list of trained model versions

aws:RequestTag/${TagKey}

aws:TagKeys

List

ListTrainedModels

Grants permission to return a list of trained models

aws:RequestTag/${TagKey}

aws:TagKeys

List

ListTrainingDatasets

Grants permission to return a list of training datasets

List

PutConfiguredAudienceModelPolicy

Grants permission to create or update the resource policy for a configured audience model

configuredaudiencemodel*

aws:ResourceTag/${TagKey}

Permissions management, Write

PutMLConfiguration

Grants permission to put an ML configuration

aws:RequestTag/${TagKey}

aws:TagKeys

Write

StartAudienceExportJob

Grants permission to export an audience of a specified size after you have generated an audience

audiencegenerationjob*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

StartAudienceGenerationJob

Grants permission to start the audience generation job

configuredaudiencemodel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

cleanrooms-ml:CollaborationId

Write

StartTrainedModelExportJob

Grants permission to start a trained model export job

TrainedModel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

StartTrainedModelInferenceJob

Grants permission to start a trained model inference job

ConfiguredModelAlgorithmAssociation*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

MLInputChannel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

TrainedModel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

TagResource

Grants permission to tag a specific resource

ConfiguredModelAlgorithm

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Tagging, Write

ConfiguredModelAlgorithmAssociation

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

MLInputChannel

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

TrainedModel

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

TrainedModelInferenceJob

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

audiencegenerationjob

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

audiencemodel

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

configuredaudiencemodel

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

trainingdataset

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

UnTagResource

Grants permission to untag a specific resource

ConfiguredModelAlgorithm

aws:ResourceTag/${TagKey}

aws:TagKeys

Tagging, Write

ConfiguredModelAlgorithmAssociation

aws:ResourceTag/${TagKey}

aws:TagKeys

MLInputChannel

aws:ResourceTag/${TagKey}

aws:TagKeys

TrainedModel

aws:ResourceTag/${TagKey}

aws:TagKeys

TrainedModelInferenceJob

aws:ResourceTag/${TagKey}

aws:TagKeys

audiencegenerationjob

aws:ResourceTag/${TagKey}

aws:TagKeys

audiencemodel

aws:ResourceTag/${TagKey}

aws:TagKeys

configuredaudiencemodel

aws:ResourceTag/${TagKey}

aws:TagKeys

trainingdataset

aws:ResourceTag/${TagKey}

aws:TagKeys

UpdateConfiguredAudienceModel

Grants permission to update a configured audience model.

audiencemodel

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

configuredaudiencemodel*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Resource types defined by AWS Clean Rooms ML

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types ARN Condition keys

ConfiguredModelAlgorithm

arn:${Partition}:cleanrooms-ml:${Region}:${Account}:configured-model-algorithm/${ResourceId}

aws:ResourceTag/${TagKey}

ConfiguredModelAlgorithmAssociation

arn:${Partition}:cleanrooms-ml:${Region}:${Account}:membership/${MembershipId}/configured-model-algorithm-association/${ResourceId}

aws:ResourceTag/${TagKey}

MLInputChannel

arn:${Partition}:cleanrooms-ml:${Region}:${Account}:membership/${MembershipId}/ml-input-channel/${ResourceId}

aws:ResourceTag/${TagKey}

TrainedModel

arn:${Partition}:cleanrooms-ml:${Region}:${Account}:membership/${MembershipId}/trained-model/${ResourceId}

aws:ResourceTag/${TagKey}

TrainedModelInferenceJob

arn:${Partition}:cleanrooms-ml:${Region}:${Account}:membership/${MembershipId}/trained-model-inference-job/${ResourceId}

aws:ResourceTag/${TagKey}

audiencegenerationjob

arn:${Partition}:cleanrooms-ml:${Region}:${Account}:audience-generation-job/${ResourceId}

aws:ResourceTag/${TagKey}

audiencemodel

arn:${Partition}:cleanrooms-ml:${Region}:${Account}:audience-model/${ResourceId}

aws:ResourceTag/${TagKey}

configuredaudiencemodel

arn:${Partition}:cleanrooms-ml:${Region}:${Account}:configured-audience-model/${ResourceId}

aws:ResourceTag/${TagKey}

trainingdataset

arn:${Partition}:cleanrooms-ml:${Region}:${Account}:training-dataset/${ResourceId}

aws:ResourceTag/${TagKey}

Condition keys for AWS Clean Rooms ML

AWS Clean Rooms ML defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys Description Type

aws:RequestTag/${TagKey}

Filters access by the presence of tag key-value pairs in the request

String

aws:ResourceTag/${TagKey}

Filters access by tag key-value pairs attached to the resource

String

aws:TagKeys

Filters access by the presence of tag keys in the request

ArrayOfString

cleanrooms-ml:CollaborationId

Filters access by Clean rooms collaboration id

String