AWS clean-rooms documentation change
Summary
Updated UI references from 'Analysis' to 'Queries' tab, simplified authorization configuration for S3 results delivery, removed detailed service role creation instructions, and consolidated documentation about query results handling.
Security assessment
Changes focus on authorization methods for writing query results to S3, which relates to security controls. However, there's no evidence of addressing a specific vulnerability - this appears to be a documentation restructuring rather than a security fix. The update continues to document security-related configurations for data access.
Diff
diff --git a/clean-rooms/latest/userguide/edit-query-results-settings.md b/clean-rooms/latest/userguide/edit-query-results-settings.md index df04b79c9..c0b508bcd 100644 --- a/clean-rooms/latest/userguide/edit-query-results-settings.md +++ b/clean-rooms/latest/userguide/edit-query-results-settings.md @@ -21 +21 @@ As a member who can receive results, you can edit the default values for query r - 4. On the **Analysis** tab, under **Results settings defaults** , choose **Edit**. + 4. On the **Queries** tab, under **Query results settings** , choose **Edit**. @@ -23 +23 @@ As a member who can receive results, you can edit the default values for query r - 5. On the **Edit results settings defaults** page, modify any of the following, as needed: + 5. On the **Edit query results settings defaults** page, modify any of the following, as needed: @@ -25 +25 @@ As a member who can receive results, you can edit the default values for query r - 1. Under **Query results** , modify the **Results destination in Amazon S3** , the **Result format** , or the **Result files**. + 1. Under **Query results settings** , modify the **Results destination in Amazon S3** or the **Result format**. @@ -27 +27 @@ As a member who can receive results, you can edit the default values for query r - 2. (Optional) For **Service access** , if you want to deliver queries that take up to 24 hours to your S3 destination, select the **Add a service role to support queries that take up to 24 hours to complete** checkbox. + 2. Under **Service access** , modify the **Method to authorize AWS Clean Rooms** to write to the Amazon S3 bucket and format that you’ve specified. @@ -29,41 +29 @@ As a member who can receive results, you can edit the default values for query r -Large queries that take up to 24 hours to complete will be delivered to your S3 destination. - -If you don't select the checkbox, only queries that complete within 12 hours will be delivered to your S3 location. - - 1. Specify the **Service access** permissions by selecting either **Create and use a new service role** or **Use an existing service role**. - -Create and use a new service role - - - * AWS Clean Rooms creates a service role with the required policy for this table. - - * The default **Service role name** is `cleanrooms-query-receiver-<timestamp>` - - * You must have permissions to create roles and attach policies. - -Use an existing service role - - - 1. Choose an **Existing service role name** from the dropdown list. - -The list of roles are displayed if you have permissions to list roles. - -If you don't have permissions to list roles, you can enter the Amazon Resource Name (ARN) of the role that you want to use. - - 2. View the service role by choosing the **View in IAM** external link. - -If there are no existing service roles, the option to **Use an existing service role** is unavailable. - -By default, AWS Clean Rooms doesn't attempt to update the existing role policy to add necessary permissions. - -###### Note - - * AWS Clean Rooms requires permissions to query according to the analysis rules. For more information about permissions for AWS Clean Rooms, see [AWS managed policies for AWS Clean Rooms](./security-iam-awsmanpol.html). - - * If the role doesn’t have sufficient permissions for AWS Clean Rooms, you receive an error message stating that the role doesn't have sufficient permissions for AWS Clean Rooms. The role policy must be added before proceeding. - - * If you can’t modify the role policy, you receive an error message stating that AWS Clean Rooms couldn't find the policy for the service role. - - 6. Choose **Save changes**. - - 7. The updated **Query results settings** appear on the collaboration detail page. +The updated **Query results settings** appear on the collaboration detail page. @@ -80 +40 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Receiving job results +Receiving query results @@ -82 +42 @@ Receiving job results -Editing default values for job results settings +Using query output in other AWS services