AWS clean-rooms documentation change
Summary
Simplified member role descriptions, removed job-related references, updated logging terminology from 'Analysis logging' to 'Query logging', streamlined results settings configuration, and removed Spark/job-specific options
Security assessment
Changes focus on simplifying documentation and removing deprecated job-related functionality. No evidence of addressing security vulnerabilities or adding new security features. Service role references remain part of existing access control patterns.
Diff
diff --git a/clean-rooms/latest/userguide/create-membership.md b/clean-rooms/latest/userguide/create-membership.md index cdadd5484..d5667def4 100644 --- a/clean-rooms/latest/userguide/create-membership.md +++ b/clean-rooms/latest/userguide/create-membership.md @@ -9,16 +9 @@ A _membership_ is a resource that's created when a member joins a collaboration -You can join a collaboration as a - - * [member who can query](./glossary.html#glossary-member-who-can-query) - - * [member who can run queries and jobs](./glossary.html#glossary-member-who-can-run-queries-jobs) - - * [member who can receive results](./glossary.html#glossary-member-who-can-receive-results) of a query or a job - - * [member paying for query compute costs](./glossary.html#glossary-member-paying-for-query-compute) - - * [member paying for queries and jobs](./glossary.html#glossary-member-paying-for-query-job-compute) - - - - -All members can contribute data. +You can join a collaboration as a [member who can query](./glossary.html#glossary-member-who-can-query) data, [member who can receive results](./glossary.html#glossary-member-who-can-receive-results) of a query, or both. You can also join a collaboration as a [member paying for query compute costs](./glossary.html#glossary-member-paying-for-query-compute). All members can contribute data. @@ -30 +15 @@ In this procedure, the invited member [joins the collaboration by creating a mem -If the invited member is the member who can receive results, they specify the results destination and format. They also provide a service role ARN to write to the results destination. +If the invited member is the member who can receive results, they specify the query results destination and format. They also provide a service role ARN to write to the query results destination. @@ -32 +17 @@ If the invited member is the member who can receive results, they specify the re -If the invited member is the member who is responsible to pay for compute costs, they accept their payment responsibilities before joining the collaboration. +If the invited member is the member who is responsible to pay for query compute costs, they accept their payment responsibilities before joining the collaboration. @@ -42 +27 @@ If the invited member is the member who is responsible to pay for compute costs, - 4. On the collaboration details page, in the **Overview** section, view the collaboration details, including **Your member details** and a list of the other members. + 4. On the collaboration details page, view the collaboration details, including your member details and a list of the other members. @@ -48 +33 @@ Verify that the AWS account IDs for each member of the collaboration are the one - 6. On the **Create membership** page, in the **Overview** , view the **Collaboration name** , **Collaboration description** , AWS account ID of the **Collaboration creator** , **Your member details** , and the AWS account ID of the member who will **Pay for queries**. + 6. On the **Create membership** page, in the **Overview** , view the **Collaboration name** , **Collaboration description** , AWS account ID of the **Collaboration creator** , **Your member abilities** , and the AWS account ID of the member who will **Pay for queries**. @@ -50 +35 @@ Verify that the AWS account IDs for each member of the collaboration are the one - 7. If the collaboration creator has chosen to enable **Analysis logging** , choose one of the following options for **Log storage in Amazon CloudWatch Logs** : + 7. If the collaboration creator has chosen to enable **Query logging** , choose one of the following options for **Log storage in Amazon CloudWatch Logs** : @@ -54,3 +39 @@ If you choose... | Then ... -**Turn on** | The logs relevant to you are stored in Amazon CloudWatch Logs.Each member can receive only logs for queries that they initiated or that contain their data.The member who can receive results also receives logs for all analyses run in a collaboration, even if their data isn't accessed in an analysis.Under **Supported log types** , choose from the log types the collaboration creator has chosen to support: - 1. If you want to receive logs generated from SQL queries, choose the **Logs from queries** checkbox. - 2. If you want to receive logs generated from jobs using PySpark, choose the **Logs from jobs** checkbox. +**Turn on** | The query logs relevant to you are stored in Amazon CloudWatch Logs.Each member can receive only logs for queries that they initiated or that contain their data.The member who can receive results also receives logs for all queries run in a collaboration, even if their data isn't accessed in a query. @@ -61 +44 @@ If you choose... | Then ... -After you turn on **Analysis logging** , it can take a few minutes for log storage to be set up and start receiving logs in Amazon CloudWatch Logs. During this brief period, the member who can query might run queries that don’t actually send logs. +After you turn on **Query logging** , it can take a few minutes for log storage to be set up and start receiving logs in Amazon CloudWatch Logs. During this brief period, the member who can query might run queries that don’t actually send logs. @@ -63 +46 @@ After you turn on **Analysis logging** , it can take a few minutes for log stora - 8. If **Your member abilities** includes **Receive results** , for **Results settings defaults** : + 8. If **Your member abilities** includes **Receive results** : @@ -65 +48 @@ After you turn on **Analysis logging** , it can take a few minutes for log stora - 1. For **Query results** , choose the **Set default settings for queries** checkbox, and then specify the **Results destination in Amazon S3** by entering the S3 destination or choose **Browse S3** to select from a list of available S3 buckets. + 1. For **Query results settings** , @@ -67,5 +50 @@ After you turn on **Analysis logging** , it can take a few minutes for log stora -For example: `s3://bucket/prefix` - - 1. For the **Result format** , choose either **CSV** or **PARQUET**. - - 2. (Spark only) For the **Result files** , choose either **Multiple** or **Single**. + 1. Specify the **Results destination in Amazon S3** by entering the S3 destination or choose **Browse S3** to select from a list of available S3 buckets. @@ -73 +52 @@ For example: `s3://bucket/prefix` - 3. (Optional) For **Service access** , if you want to deliver queries that take up to 24 hours to your S3 destination, select the **Add a service role to support queries that take up to 24 hours to complete** check box. +For example: `s3://bucket/prefix` @@ -75 +54 @@ For example: `s3://bucket/prefix` -Large queries that take up to 24 hours to complete will be delivered to your S3 destination. + 2. Choose the **Result format** (either **CSV** or **PARQUET**). @@ -77 +56 @@ Large queries that take up to 24 hours to complete will be delivered to your S3 -If you don't select the check box, only queries that complete within 12 hours will be delivered to your S3 location. + 2. For **Service access** , choose to either **Create and use a new service role** or **Use an existing service role**. @@ -83,40 +61,0 @@ You must either select an existing service role or have permissions to create a - 4. Specify the **Service access** permissions by selecting either **Create and use a new service role** or **Use an existing service role**. - -Create and use a new service role - - - * AWS Clean Rooms creates a service role with the required policy for this table. - - * The default **Service role name** is `cleanrooms-result-receiver-<timestamp>` - - * You must have permissions to create roles and attach policies. - -Use an existing service role - - - 1. Choose an **Existing service role name** from the dropdown list. - -The list of roles are displayed if you have permissions to list roles. - -If you don't have permissions to list roles, you can enter the Amazon Resource Name (ARN) of the role that you want to use. - - 2. View the service role by choosing the **View in IAM** external link. - -If there are no existing service roles, the option to **Use an existing service role** is unavailable. - -By default, AWS Clean Rooms doesn't attempt to update the existing role policy to add necessary permissions. - -###### Note - - * AWS Clean Rooms requires permissions to query according to the analysis rules. For more information about permissions for AWS Clean Rooms, see [AWS managed policies for AWS Clean Rooms](./security-iam-awsmanpol.html). - - * If the role doesn’t have sufficient permissions for AWS Clean Rooms, you receive an error message stating that the role doesn't have sufficient permissions for AWS Clean Rooms. The role policy must be added before proceeding. - - * If you can’t modify the role policy, you receive an error message stating that AWS Clean Rooms couldn't find the policy for the service role. - - 2. For **Job results** , choose the **Set default settings for jobs** checkbox, and then specify the **Results destination in Amazon S3** by entering the S3 destination or choose **Browse S3** to select from a list of available S3 buckets. - -For example: `s3://bucket/prefix` - - 1. Specify the **Service access** permissions by choosing an **Existing service role name** from the dropdown list. - @@ -125 +64 @@ For example: `s3://bucket/prefix` - 10. If the collaboration creator has designated you as the member who will **Pay for queries** or **Pay for queries and jobs** , indicate your acceptance by selecting the **I agree to pay for the compute costs in this collaboration** checkbox. + 10. If the collaboration creator has designated you as the member who will **Pay for queries** , indicate your acceptance by selecting the **I agree to pay for the query compute costs in this collaboration** check box. @@ -133 +72 @@ For more information about how pricing is calculated, see [Pricing for AWS Clean -If you are the [member paying for query compute costs](./glossary.html#glossary-member-paying-for-query-compute) or the [member paying for queries and job compute costs](./glossary.html#glossary-member-paying-for-query-job-compute) but not the [member who can query](./glossary.html#glossary-member-who-can-query), it is recommended that you use AWS Budgets to configure a budget for AWS Clean Rooms and receive notifications once the maximum budget has been reached. For more information about setting up a budget, see [Managing your costs with AWS Budgets](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html) in the _AWS Cost Management User Guide_. For more information about setting up notifications, see [Creating an Amazon SNS topic for budget notifications](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-sns-policy.html) in the _AWS Cost Management User Guide_. If the maximum budget has been reached, you can contact the member who can run queries and jobs or [leave the collaboration](./leave-collab.html). If you leave the collaboration, no more queries will be allowed to run, and therefore you will no longer be billed for query compute costs. +If you are the [member paying for query compute costs](./glossary.html#glossary-member-paying-for-query-compute) but not the [member who can query](./glossary.html#glossary-member-who-can-query), it is recommended that you use AWS Budgets to configure a budget for AWS Clean Rooms and receive notifications once the maximum budget has been reached. For more information about setting up a budget, see [Managing your costs with AWS Budgets](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html) in the _AWS Cost Management User Guide_. For more information about setting up notifications, see [Creating an Amazon SNS topic for budget notifications](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-sns-policy.html) in the _AWS Cost Management User Guide_. If the maximum budget has been reached, you can contact the member who can run queries or [leave the collaboration](./leave-collab.html). If you leave the collaboration, no more queries will be allowed to run, and therefore you will no longer be billed for query compute costs. @@ -150 +89 @@ You are now ready to: - * [Create and associate a new ID namespace](./create-new-id-namespace.html) – if you want to create an ID mapping table to query identity data. + * [Create and associate a new ID namespace](./create-new-id-namespace.html) – if you want to create an ID mapping table to query identity data, @@ -163 +102 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Creating a collaboration for ML modeling +Creating a collaboration