Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Clean Rooms

AWS Clean Rooms (service prefix: cleanrooms) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Clean Rooms
Actions defined by AWS Clean Rooms
Permission-only actions for AWS Clean Rooms
Resource types defined by AWS Clean Rooms
Condition keys for AWS Clean Rooms

API operations defined by AWS Clean Rooms

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
BatchGetCollaborationAnalysisTemplate	cleanrooms:BatchGetCollaborationAnalysisTemplate			Read
BatchGetSchema	cleanrooms:BatchGetSchema			Read
BatchGetSchemaAnalysisRule	cleanrooms:BatchGetSchemaAnalysisRule			Read
CreateAnalysisTemplate	cleanrooms:CreateAnalysisTemplate			Write
	cleanrooms:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cleanrooms.amazonaws.com	Write
CreateCollaboration	cleanrooms:CreateCollaboration			Write
CreateCollaboration	cleanrooms:TagResource			Tagging, Write
CreateCollaborationChangeRequest	cleanrooms:CreateCollaborationChangeRequest			Write
CreateConfiguredAudienceModelAssociation	cleanrooms:CreateConfiguredAudienceModelAssociation			Write
CreateConfiguredAudienceModelAssociation	cleanrooms:TagResource			Tagging, Write
CreateConfiguredTable	cleanrooms:CreateConfiguredTable			Write
CreateConfiguredTable	cleanrooms:TagResource			Tagging, Write
CreateConfiguredTableAnalysisRule	cleanrooms:CreateConfiguredTableAnalysisRule			Write
CreateConfiguredTableAssociation	cleanrooms:CreateConfiguredTableAssociation			Write
	cleanrooms:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cleanrooms.amazonaws.com	Write
CreateConfiguredTableAssociationAnalysisRule	cleanrooms:CreateConfiguredTableAssociationAnalysisRule			Write
CreateIdMappingTable	cleanrooms:CreateIdMappingTable			Write
CreateIdMappingTable	cleanrooms:TagResource			Tagging, Write
CreateIdNamespaceAssociation	cleanrooms:CreateIdNamespaceAssociation			Write
CreateIdNamespaceAssociation	cleanrooms:TagResource			Tagging, Write
CreateIntermediateTable	cleanrooms:CreateIntermediateTable			Write
CreateIntermediateTable	cleanrooms:TagResource			Tagging, Write
CreateIntermediateTableAnalysisRule	cleanrooms:CreateIntermediateTableAnalysisRule			Write
CreateMembership	cleanrooms:CreateMembership			Write
	cleanrooms:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cleanrooms.amazonaws.com	Write
CreatePrivacyBudgetTemplate	cleanrooms:CreatePrivacyBudgetTemplate			Write
CreatePrivacyBudgetTemplate	cleanrooms:TagResource			Tagging, Write
DeleteAnalysisTemplate	cleanrooms:DeleteAnalysisTemplate			Write
DeleteCollaboration	cleanrooms:DeleteCollaboration			Write
DeleteConfiguredAudienceModelAssociation	cleanrooms:DeleteConfiguredAudienceModelAssociation			Write
DeleteConfiguredTable	cleanrooms:DeleteConfiguredTable			Write
DeleteConfiguredTableAnalysisRule	cleanrooms:DeleteConfiguredTableAnalysisRule			Write
DeleteConfiguredTableAssociation	cleanrooms:DeleteConfiguredTableAssociation			Write
DeleteConfiguredTableAssociationAnalysisRule	cleanrooms:DeleteConfiguredTableAssociationAnalysisRule			Write
DeleteIdMappingTable	cleanrooms:DeleteIdMappingTable			Write
DeleteIdNamespaceAssociation	cleanrooms:DeleteIdNamespaceAssociation			Write
DeleteIntermediateTable	cleanrooms:DeleteIntermediateTable			Write
DeleteMember	cleanrooms:DeleteMember			Write
DeleteMembership	cleanrooms:DeleteMembership			Write
DeletePrivacyBudgetTemplate	cleanrooms:DeletePrivacyBudgetTemplate			Write
GetAnalysisTemplate	cleanrooms:GetAnalysisTemplate			Read
GetCollaboration	cleanrooms:GetCollaboration			Read
GetCollaborationAnalysisTemplate	cleanrooms:GetCollaborationAnalysisTemplate			Read
GetCollaborationChangeRequest	cleanrooms:GetCollaborationChangeRequest			Read
GetCollaborationConfiguredAudienceModelAssociation	cleanrooms:GetCollaborationConfiguredAudienceModelAssociation			Read
GetCollaborationIdNamespaceAssociation	cleanrooms:GetCollaborationIdNamespaceAssociation			Read
GetCollaborationPrivacyBudgetTemplate	cleanrooms:GetCollaborationPrivacyBudgetTemplate			Read
GetConfiguredAudienceModelAssociation	cleanrooms:GetConfiguredAudienceModelAssociation			Read
GetConfiguredTable	cleanrooms:GetConfiguredTable			Read
GetConfiguredTableAnalysisRule	cleanrooms:GetConfiguredTableAnalysisRule			Read
GetConfiguredTableAssociation	cleanrooms:GetConfiguredTableAssociation			Read
GetConfiguredTableAssociationAnalysisRule	cleanrooms:GetConfiguredTableAssociationAnalysisRule			Read
GetIdMappingTable	cleanrooms:GetIdMappingTable			Read
GetIdNamespaceAssociation	cleanrooms:GetIdNamespaceAssociation			Read
GetIntermediateTable	cleanrooms:GetIntermediateTable			Read
GetIntermediateTableAnalysisRule	cleanrooms:GetIntermediateTableAnalysisRule			Read
GetMembership	cleanrooms:GetMembership			Read
GetPrivacyBudgetTemplate	cleanrooms:GetPrivacyBudgetTemplate			Read
GetProtectedJob	cleanrooms:GetProtectedJob			Read
GetProtectedQuery	cleanrooms:GetProtectedQuery			Read
GetSchema	cleanrooms:GetSchema			Read
GetSchemaAnalysisRule	cleanrooms:GetSchemaAnalysisRule			Read
ListAnalysisTemplates	cleanrooms:ListAnalysisTemplates			List
ListCollaborationAnalysisTemplates	cleanrooms:ListCollaborationAnalysisTemplates			List
ListCollaborationChangeRequests	cleanrooms:ListCollaborationChangeRequests			List
ListCollaborationConfiguredAudienceModelAssociations	cleanrooms:ListCollaborationConfiguredAudienceModelAssociations			List
ListCollaborationIdNamespaceAssociations	cleanrooms:ListCollaborationIdNamespaceAssociations			List
ListCollaborationPrivacyBudgetTemplates	cleanrooms:ListCollaborationPrivacyBudgetTemplates			List
ListCollaborationPrivacyBudgets	cleanrooms:ListCollaborationPrivacyBudgets			List
ListCollaborations	cleanrooms:ListCollaborations			List
ListConfiguredAudienceModelAssociations	cleanrooms:ListConfiguredAudienceModelAssociations			List
ListConfiguredTableAssociations	cleanrooms:ListConfiguredTableAssociations			List
ListConfiguredTables	cleanrooms:ListConfiguredTables			List
ListIdMappingTables	cleanrooms:ListIdMappingTables			List
ListIdNamespaceAssociations	cleanrooms:ListIdNamespaceAssociations			List
ListIntermediateTableVersions	cleanrooms:ListIntermediateTableVersions			List
ListIntermediateTables	cleanrooms:ListIntermediateTables			List
ListMembers	cleanrooms:ListMembers			List
ListMemberships	cleanrooms:ListMemberships			List
ListPrivacyBudgetTemplates	cleanrooms:ListPrivacyBudgetTemplates			List
ListPrivacyBudgets	cleanrooms:ListPrivacyBudgets			List
ListProtectedJobs	cleanrooms:ListProtectedJobs			List
ListProtectedQueries	cleanrooms:ListProtectedQueries			List
ListSchemas	cleanrooms:ListSchemas			List
ListTagsForResource	cleanrooms:ListTagsForResource			List
PopulateIdMappingTable	cleanrooms:PopulateIdMappingTable			Write
PopulateIntermediateTable	cleanrooms:PopulateIntermediateTable			Write
PreviewPrivacyImpact	cleanrooms:PreviewPrivacyImpact			Read
StartProtectedJob	cleanrooms:StartProtectedJob			Write
StartProtectedQuery	cleanrooms:StartProtectedQuery			Write
TagResource	cleanrooms:TagResource			Tagging, Write
UntagResource	cleanrooms:UntagResource			Tagging, Write
UpdateAnalysisTemplate	cleanrooms:UpdateAnalysisTemplate			Write
UpdateCollaboration	cleanrooms:UpdateCollaboration			Write
UpdateCollaborationChangeRequest	cleanrooms:UpdateCollaborationChangeRequest			Write
UpdateConfiguredAudienceModelAssociation	cleanrooms:UpdateConfiguredAudienceModelAssociation			Write
UpdateConfiguredTable	cleanrooms:UpdateConfiguredTable			Write
	cleanrooms:UpdateConfiguredTableAllowedColumns			Write
	cleanrooms:UpdateConfiguredTableReference			Write
UpdateConfiguredTableAnalysisRule	cleanrooms:UpdateConfiguredTableAnalysisRule			Write
UpdateConfiguredTableAssociation	cleanrooms:UpdateConfiguredTableAssociation			Write
UpdateConfiguredTableAssociation	iam:PassRole	iam:PassedToService	cleanrooms.amazonaws.com	Write
UpdateConfiguredTableAssociationAnalysisRule	cleanrooms:UpdateConfiguredTableAssociationAnalysisRule			Write
UpdateIdMappingTable	cleanrooms:UpdateIdMappingTable			Write
UpdateIdNamespaceAssociation	cleanrooms:UpdateIdNamespaceAssociation			Write
UpdateIntermediateTable	cleanrooms:UpdateIntermediateTable			Write
UpdateMembership	cleanrooms:UpdateMembership			Write
UpdateMembership	iam:PassRole	iam:PassedToService	cleanrooms.amazonaws.com	Write
UpdatePrivacyBudgetTemplate	cleanrooms:UpdatePrivacyBudgetTemplate			Write
UpdateProtectedJob	cleanrooms:UpdateProtectedJob			Write
UpdateProtectedQuery	cleanrooms:UpdateProtectedQuery			Write

Actions defined by AWS Clean Rooms

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchGetCollaborationAnalysisTemplate	Grants permission to view details of analysisTemplates associated to the collaboration	analysistemplate*	aws:ResourceTag/${TagKey}	Read
BatchGetCollaborationAnalysisTemplate		collaboration*	aws:ResourceTag/${TagKey}	Read
BatchGetSchema	Grants permission to view details for schemas	collaboration*	aws:ResourceTag/${TagKey}	Read
		configuredtableassociation	aws:ResourceTag/${TagKey}
		idmappingtable	aws:ResourceTag/${TagKey}
		intermediatetable	aws:ResourceTag/${TagKey}
BatchGetSchemaAnalysisRule	Grants permission to view analysis rules associated with schemas	collaboration*	aws:ResourceTag/${TagKey}	Read
		configuredtableassociation	aws:ResourceTag/${TagKey}
		idmappingtable	aws:ResourceTag/${TagKey}
		intermediatetable	aws:ResourceTag/${TagKey}
CreateAnalysisTemplate	Grants permission to create a new analysis template	analysistemplate*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAnalysisTemplate	Grants permission to create a new analysis template	membership*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCollaboration	Grants permission to create a new collaboration, a shared data collaboration environment	collaboration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCollaborationChangeRequest	Grants permission to create a change request in a collaboration	collaboration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConfiguredAudienceModelAssociation	Grants permission to link a Cleanrooms ML configured audience model with a collaboration by creating a new association	configuredaudiencemodelassociation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConfiguredAudienceModelAssociation		membership*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConfiguredTable	Grants permission to create a new configured table	configuredtable*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConfiguredTableAnalysisRule	Grants permission to create a analysis rule for a configured table	configuredtable*	aws:ResourceTag/${TagKey}	Write
CreateConfiguredTableAssociation	Grants permission to link a configured table with a collaboration by creating a new association	configuredtable*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		configuredtableassociation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		membership*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateConfiguredTableAssociationAnalysisRule	Grants permission to create an analysis rule for a configured table association	configuredtableassociation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIdMappingTable	Grants permission to link an id mapping workflow with a collaboration by creating a new id mapping table	idmappingtable*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIdMappingTable		membership*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIdNamespaceAssociation	Grants permission to link an AWS Entity Resolution Id Namespace with a collaboration by creating a new association	idnamespaceassociation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIdNamespaceAssociation		membership*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIntermediateTable	Grants permission to create a new intermediate table in a membership	analysistemplate	aws:ResourceTag/${TagKey}	Write
		intermediatetable*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		membership*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateIntermediateTableAnalysisRule	Grants permission to create an analysis rule for an intermediate table	intermediatetable*	aws:ResourceTag/${TagKey}	Write
CreateMembership	Grants permission to join collaborations by creating a membership	collaboration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateMembership		membership*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePrivacyBudgetTemplate	Grants permission to create a new privacy budget template	membership*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePrivacyBudgetTemplate	Grants permission to create a new privacy budget template	privacybudgettemplate*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAnalysisTemplate	Grants permission to delete an existing analysis template	analysistemplate*	aws:ResourceTag/${TagKey}	Write
DeleteCollaboration	Grants permission to delete an existing collaboration	collaboration*	aws:ResourceTag/${TagKey}	Write
DeleteConfiguredAudienceModelAssociation	Grants permission to delete an existing configured audience model association	configuredaudiencemodelassociation*	aws:ResourceTag/${TagKey}	Write
DeleteConfiguredTable	Grants permission to delete a configured table	configuredtable*	aws:ResourceTag/${TagKey}	Write
DeleteConfiguredTableAnalysisRule	Grants permission to delete an existing analysis rule	configuredtable*	aws:ResourceTag/${TagKey}	Write
DeleteConfiguredTableAssociation	Grants permission to remove a configured table association from a collaboration	configuredtableassociation*	aws:ResourceTag/${TagKey}	Write
DeleteConfiguredTableAssociationAnalysisRule	Grants permission to delete an existing configured table association analysis rule	configuredtableassociation*	aws:ResourceTag/${TagKey}	Write
DeleteIdMappingTable	Grants permission to remove an id mapping table from a collaboration	idmappingtable*	aws:ResourceTag/${TagKey}	Write
DeleteIdMappingTable		membership*	aws:ResourceTag/${TagKey}	Write
DeleteIdNamespaceAssociation	Grants permission to remove an Id Namespace Association from a collaboration	idnamespaceassociation*	aws:ResourceTag/${TagKey}	Write
DeleteIdNamespaceAssociation		membership*	aws:ResourceTag/${TagKey}	Write
DeleteIntermediateTable	Grants permission to remove an intermediate table from a collaboration	intermediatetable*	aws:ResourceTag/${TagKey}	Write
DeleteIntermediateTable		membership*	aws:ResourceTag/${TagKey}	Write
DeleteIntermediateTableAnalysisRule	Grants permission to delete an existing analysis rule for an intermediate table	intermediatetable*	aws:ResourceTag/${TagKey}	Write
DeleteMember	Grants permission to delete members from a collaboration	collaboration*	aws:ResourceTag/${TagKey}	Write
DeleteMembership	Grants permission to leave collaborations by deleting a membership	membership*	aws:ResourceTag/${TagKey}	Write
DeletePrivacyBudgetTemplate	Grants permission to delete an existing privacy budget template	privacybudgettemplate*	aws:ResourceTag/${TagKey}	Write
DisallowIntermediateTable	Grants permission to invalidate an intermediate table	membership*	aws:ResourceTag/${TagKey}	Write
GetAnalysisTemplate	Grants permission to view details for an analysis template	analysistemplate*	aws:ResourceTag/${TagKey}	Read
GetCollaboration	Grants permission to view details for a collaboration	collaboration*	aws:ResourceTag/${TagKey}	Read
GetCollaborationAnalysisTemplate	Grants permission to view details for an analysis template within a collaboration	analysistemplate*	aws:ResourceTag/${TagKey}	Read
GetCollaborationAnalysisTemplate		collaboration*	aws:ResourceTag/${TagKey}	Read
GetCollaborationChangeRequest	Grants permission to get a change request in a collaboration	collaboration*	aws:ResourceTag/${TagKey}	Read
GetCollaborationConfiguredAudienceModelAssociation	Grants permission to view details for a configured audience model association within a collaboration	collaboration*	aws:ResourceTag/${TagKey}	Read
GetCollaborationConfiguredAudienceModelAssociation		configuredaudiencemodelassociation*	aws:ResourceTag/${TagKey}	Read
GetCollaborationIdNamespaceAssociation	Grants permission to get id namespace association within a collaboration	collaboration*	aws:ResourceTag/${TagKey}	Read
GetCollaborationIdNamespaceAssociation		idnamespaceassociation*	aws:ResourceTag/${TagKey}	Read
GetCollaborationPrivacyBudgetTemplate	Grants permission to view details for a privacy budget template within a collaboration	collaboration*	aws:ResourceTag/${TagKey}	Read
GetCollaborationPrivacyBudgetTemplate		privacybudgettemplate*	aws:ResourceTag/${TagKey}	Read
GetConfiguredAudienceModelAssociation	Grants permission to view details for a configured audience model association	configuredaudiencemodelassociation*	aws:ResourceTag/${TagKey}	Read
GetConfiguredTable	Grants permission to view details for a configured table	configuredtable*	aws:ResourceTag/${TagKey}	Read
GetConfiguredTableAnalysisRule	Grants permission to view analysis rules for a configured table	configuredtable*	aws:ResourceTag/${TagKey}	Read
GetConfiguredTableAssociation	Grants permission to view details for a configured table association	configuredtableassociation*	aws:ResourceTag/${TagKey}	Read
GetConfiguredTableAssociationAnalysisRule	Grants permission to view analysis rules for a configured table association	configuredtableassociation*	aws:ResourceTag/${TagKey}	Read
GetIdMappingTable	Grants permission to view details of an id mapping table	idmappingtable*	aws:ResourceTag/${TagKey}	Read
GetIdMappingTable	Grants permission to view details of an id mapping table	membership*	aws:ResourceTag/${TagKey}	Read
GetIdNamespaceAssociation	Grants permission to view details of an id namespace association	idnamespaceassociation*	aws:ResourceTag/${TagKey}	Read
GetIdNamespaceAssociation		membership*	aws:ResourceTag/${TagKey}	Read
GetIntermediateTable	Grants permission to view details of an intermediate table	intermediatetable*	aws:ResourceTag/${TagKey}	Read
GetIntermediateTable	Grants permission to view details of an intermediate table	membership*	aws:ResourceTag/${TagKey}	Read
GetIntermediateTableAnalysisRule	Grants permission to view analysis rules for an intermediate table	intermediatetable*	aws:ResourceTag/${TagKey}	Read
GetMembership	Grants permission to view details about a membership	membership*	aws:ResourceTag/${TagKey}	Read
GetPrivacyBudgetTemplate	Grants permission to view details for a privacy budget template	privacybudgettemplate*	aws:ResourceTag/${TagKey}	Read
GetProtectedJob	Grants permission to view a protected job	membership*	aws:ResourceTag/${TagKey}	Read
GetProtectedQuery	Grants permission to view a protected query	membership*	aws:ResourceTag/${TagKey}	Read
GetSchema	Grants permission to view details for a schema	collaboration*	aws:ResourceTag/${TagKey}	Read
GetSchema	Grants permission to view details for a schema	configuredtableassociation*	aws:ResourceTag/${TagKey}	Read
GetSchemaAnalysisRule	Grants permission to view analysis rules associated with a schema	collaboration*	aws:ResourceTag/${TagKey}	Read
GetSchemaAnalysisRule		configuredtableassociation*	aws:ResourceTag/${TagKey}	Read
ListAnalysisTemplates	Grants permission to list available analysis templates	analysistemplate*	aws:ResourceTag/${TagKey}	List
ListAnalysisTemplates	Grants permission to list available analysis templates	membership*	aws:ResourceTag/${TagKey}	List
ListCollaborationAnalysisTemplates	Grants permission to list available analysis templates within a collaboration	collaboration*	aws:ResourceTag/${TagKey}	List
ListCollaborationChangeRequests	Grants permission to list change requests in a collaboration	collaboration*	aws:ResourceTag/${TagKey}	List
ListCollaborationConfiguredAudienceModelAssociations	Grants permission to list available configured audience model association within a collaboration	collaboration*	aws:ResourceTag/${TagKey}	List
ListCollaborationIdNamespaceAssociations	Grants permission to list id namespace within a collaboration	collaboration*	aws:ResourceTag/${TagKey}	List
ListCollaborationPrivacyBudgetTemplates	Grants permission to list available privacy budget templates within a collaboration	collaboration*	aws:ResourceTag/${TagKey}	List
ListCollaborationPrivacyBudgets	Grants permission to list privacy budgets within a collaboration	collaboration*	aws:ResourceTag/${TagKey}	List
ListCollaborations	Grants permission to list available collaborations			List
ListConfiguredAudienceModelAssociations	Grants permission to list available configured audience model associations for a membership	configuredaudiencemodelassociation*	aws:ResourceTag/${TagKey}	List
ListConfiguredAudienceModelAssociations		membership*	aws:ResourceTag/${TagKey}	List
ListConfiguredTableAssociations	Grants permission to list available configured table associations for a membership	configuredtableassociation*	aws:ResourceTag/${TagKey}	List
ListConfiguredTableAssociations		membership*	aws:ResourceTag/${TagKey}	List
ListConfiguredTables	Grants permission to list available configured tables			List
ListIdMappingTables	Grants permission to list available id mapping tables for a membership	idmappingtable*	aws:ResourceTag/${TagKey}	List
ListIdMappingTables		membership*	aws:ResourceTag/${TagKey}	List
ListIdNamespaceAssociations	Grants permission to list entity resolution data associations for a membership	idnamespaceassociation*	aws:ResourceTag/${TagKey}	List
ListIdNamespaceAssociations		membership*	aws:ResourceTag/${TagKey}	List
ListIntermediateTableVersions	Grants permission to list versions of an intermediate table	intermediatetable*	aws:ResourceTag/${TagKey}	List
ListIntermediateTableVersions	Grants permission to list versions of an intermediate table	membership*	aws:ResourceTag/${TagKey}	List
ListIntermediateTables	Grants permission to list intermediate tables for a membership	intermediatetable*	aws:ResourceTag/${TagKey}	List
ListIntermediateTables		membership*	aws:ResourceTag/${TagKey}	List
ListMembers	Grants permission to list the members of a collaboration	collaboration*	aws:ResourceTag/${TagKey}	List
ListMemberships	Grants permission to list available memberships			List
ListPrivacyBudgetTemplates	Grants permission to list available privacy budget templates	membership*	aws:ResourceTag/${TagKey}	List
ListPrivacyBudgetTemplates		privacybudgettemplate*	aws:ResourceTag/${TagKey}	List
ListPrivacyBudgets	Grants permission to list available privacy budgets	membership*	aws:ResourceTag/${TagKey}	List
ListProtectedJobs	Grants permission to list protected jobs	membership*	aws:ResourceTag/${TagKey}	List
ListProtectedQueries	Grants permission to list protected queries	membership*	aws:ResourceTag/${TagKey}	List
ListSchemas	Grants permission to view available schemas for a collaboration	collaboration*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for a resource	analysistemplate	aws:ResourceTag/${TagKey}	List
		collaboration	aws:ResourceTag/${TagKey}
		configuredaudiencemodelassociation	aws:ResourceTag/${TagKey}
		configuredtable	aws:ResourceTag/${TagKey}
		configuredtableassociation	aws:ResourceTag/${TagKey}
		intermediatetable	aws:ResourceTag/${TagKey}
		membership	aws:ResourceTag/${TagKey}
		privacybudgettemplate	aws:ResourceTag/${TagKey}
PopulateIdMappingTable	Grants permission to start an Id Mapping Job in AWS Entity Resolution to generate id mapping results in cleanrooms collaboration.	idmappingtable*	aws:ResourceTag/${TagKey}	Write
PopulateIdMappingTable		membership*	aws:ResourceTag/${TagKey}	Write
PopulateIntermediateTable	Grants permission to populate an intermediate table by executing its stored analysis	configuredtableassociation	aws:ResourceTag/${TagKey}	Write
		idmappingtable	aws:ResourceTag/${TagKey}
		intermediatetable*	aws:ResourceTag/${TagKey}
		membership*	aws:ResourceTag/${TagKey}
PreviewPrivacyImpact	Grants permission to preview privacy budget template settings	membership*	aws:ResourceTag/${TagKey}	Read
StartProtectedJob	Grants permission to start protected jobs	analysistemplate	aws:ResourceTag/${TagKey}	Write
		configuredtableassociation	aws:ResourceTag/${TagKey}
		intermediatetable	aws:ResourceTag/${TagKey}
		membership*	aws:ResourceTag/${TagKey}
StartProtectedQuery	Grants permission to start protected queries	analysistemplate	aws:ResourceTag/${TagKey}	Write
		configuredtableassociation	aws:ResourceTag/${TagKey}
		idmappingtable	aws:ResourceTag/${TagKey}
		intermediatetable	aws:ResourceTag/${TagKey}
		membership*	aws:ResourceTag/${TagKey}
TagResource	Grants permission to tag a resource	analysistemplate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		collaboration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		configuredaudiencemodelassociation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		configuredtable	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		configuredtableassociation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		idmappingtable	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		idnamespaceassociation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		intermediatetable	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		membership	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		privacybudgettemplate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a resource	analysistemplate	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		collaboration	aws:ResourceTag/${TagKey} aws:TagKeys
		configuredaudiencemodelassociation	aws:ResourceTag/${TagKey} aws:TagKeys
		configuredtable	aws:ResourceTag/${TagKey} aws:TagKeys
		configuredtableassociation	aws:ResourceTag/${TagKey} aws:TagKeys
		idmappingtable	aws:ResourceTag/${TagKey} aws:TagKeys
		idnamespaceassociation	aws:ResourceTag/${TagKey} aws:TagKeys
		intermediatetable	aws:ResourceTag/${TagKey} aws:TagKeys
		membership	aws:ResourceTag/${TagKey} aws:TagKeys
		privacybudgettemplate	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAnalysisTemplate	Grants permission to update details of the analysis template	analysistemplate*	aws:ResourceTag/${TagKey}	Write
UpdateCollaboration	Grants permission to update details of the collaboration	collaboration*	aws:ResourceTag/${TagKey}	Write
UpdateCollaborationChangeRequest	Grants permission to update a change request in a collaboration	collaboration*	aws:ResourceTag/${TagKey}	Write
UpdateConfiguredAudienceModelAssociation	Grants permission to update a configured audience model association	configuredaudiencemodelassociation*	aws:ResourceTag/${TagKey}	Write
UpdateConfiguredTable	Grants permission to update an existing configured table	configuredtable*	aws:ResourceTag/${TagKey}	Write
UpdateConfiguredTableAnalysisRule	Grants permission to update analysis rules for a configured table	configuredtable*	aws:ResourceTag/${TagKey}	Write
UpdateConfiguredTableAssociation	Grants permission to update a configured table association	configuredtableassociation*	aws:ResourceTag/${TagKey}	Write
UpdateConfiguredTableAssociationAnalysisRule	Grants permission to update analysis rules for a configured table association	configuredtableassociation*	aws:ResourceTag/${TagKey}	Write
UpdateIdMappingTable	Grants permission to update an id mapping table	idmappingtable*	aws:ResourceTag/${TagKey}	Write
UpdateIdMappingTable	Grants permission to update an id mapping table	membership*	aws:ResourceTag/${TagKey}	Write
UpdateIdNamespaceAssociation	Grants permission to update a entity resolution input association	idnamespaceassociation*	aws:ResourceTag/${TagKey}	Write
UpdateIdNamespaceAssociation		membership*	aws:ResourceTag/${TagKey}	Write
UpdateIntermediateTable	Grants permission to update an intermediate table	intermediatetable*	aws:ResourceTag/${TagKey}	Write
UpdateIntermediateTable	Grants permission to update an intermediate table	membership*	aws:ResourceTag/${TagKey}	Write
UpdateIntermediateTableAnalysisRule	Grants permission to update an analysis rule for an intermediate table	intermediatetable*	aws:ResourceTag/${TagKey}	Write
UpdateMembership	Grants permission to update details of a membership	membership*	aws:ResourceTag/${TagKey}	Write
UpdatePrivacyBudgetTemplate	Grants permission to update details of the privacy budget template	privacybudgettemplate*	aws:ResourceTag/${TagKey}	Write
UpdateProtectedJob	Grants permission to update protected jobs	membership*	aws:ResourceTag/${TagKey}	Write
UpdateProtectedQuery	Grants permission to update protected queries	membership*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS Clean Rooms

The following actions are defined by AWS Clean Rooms but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
PassCollaboration	Grants permission to access a collaboration in the context of Clean Rooms ML custom models	collaboration*	aws:ResourceTag/${TagKey}	Read
PassMembership	Grants permission to access a membership in the context of Clean Rooms ML custom models	membership*	aws:ResourceTag/${TagKey}	Read
UpdateConfiguredTableAllowedColumns	Grants permission to update the allowed columns of an existing configured table	configuredtable*	aws:ResourceTag/${TagKey}	Write
UpdateConfiguredTableReference	Grants permission to update the table reference of an existing configured table	configuredtable*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Clean Rooms

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
analysistemplate	arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}/analysistemplate/${AnalysisTemplateId}	aws:ResourceTag/${TagKey}
collaboration	arn:${Partition}:cleanrooms:${Region}:${Account}:collaboration/${CollaborationId}	aws:ResourceTag/${TagKey}
configuredaudiencemodelassociation	arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}/configuredaudiencemodelassociation/${ConfiguredAudienceModelAssociationId}	aws:ResourceTag/${TagKey}
configuredtable	arn:${Partition}:cleanrooms:${Region}:${Account}:configuredtable/${ConfiguredTableId}	aws:ResourceTag/${TagKey}
configuredtableassociation	arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}/configuredtableassociation/${ConfiguredTableAssociationId}	aws:ResourceTag/${TagKey}
idmappingtable	arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}/idmappingtable/${IdMappingTableId}	aws:ResourceTag/${TagKey}
idnamespaceassociation	arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}/idnamespaceassociation/${IdNamespaceAssociationId}	aws:ResourceTag/${TagKey}
intermediatetable	arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}/intermediatetable/${IntermediateTableId}	aws:ResourceTag/${TagKey}
membership	arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}	aws:ResourceTag/${TagKey}
privacybudgettemplate	arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}/privacybudgettemplate/${PrivacyBudgetTemplateId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Clean Rooms

AWS Clean Rooms defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Chatbot (chatbot)

AWS Clean Rooms ML (cleanrooms-ml)