AWS clean-rooms medium security documentation change

Service: clean-rooms · 2025-04-14 · Security-related medium

File: clean-rooms/latest/userguide/ml-roles.md

Summary

Updated IAM policy examples with expanded permissions, added conditions for S3 resource account validation, KMS encryption context constraints, and CloudWatch namespace restrictions. Added API documentation links.

Security assessment

Added IAM policy conditions enforcing account ownership (s3:ResourceAccount), encryption context validation (kms:EncryptionContext), and namespace restrictions (cloudwatch:namespace). These changes implement granular access controls and resource isolation.

Diff

diff --git a/clean-rooms/latest/userguide/ml-roles.md b/clean-rooms/latest/userguide/ml-roles.md
index aabcc7569..857886b8a 100644
--- a//clean-rooms/latest/userguide/ml-roles.md
+++ b//clean-rooms/latest/userguide/ml-roles.md
@@ -590 +590 @@ AWS Clean Rooms uses a service role to control who can create a custom ML config
-This role allows you to use the CreateMLConfiguration action. 
+This role allows you to use the [PutMLConfiguration](https://docs.aws.amazon.com/cleanrooms-ml/latest/APIReference/API_PutMLConfiguration.html) action. 
@@ -614 +614,3 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c
-                "Action": ["s3:PutObject"],
+                "Action": [
+                    "s3:PutObject"
+                ],
@@ -616,0 +619,5 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c
+                ],
+                "Condition": {
+                    "StringEquals": {
+                        "s3:ResourceAccount": [
+                            "accountId"
@@ -617,0 +625,2 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c
+                    }
+                }
@@ -624 +633 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c
-                    "kms:GenerateDataKey*",
+                    "kms:GenerateDataKey*"
@@ -628 +637,6 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c
-                ]
+                ],
+                "Condition": {
+                    "StringLike": {
+                        "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::bucket*"
+                    },
+                }
@@ -633 +646,0 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c
-                "Resource": "arn:aws:cloudwatch:region:accountId:namespace/aws/cleanroomsml/*",
@@ -635 +648,6 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c
-                "Effect": "Allow"
+                "Effect": "Allow",
+                "Condition": {
+                    "StringLike": {
+                        "cloudwatch:namespace": "/aws/cleanroomsml/*"
+                    }
+                }
@@ -645 +663,4 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c
-                ]
+                ],
+                "Resource": [
+                    "arn:aws:logs:region:account-id:log-group:/aws/cleanroomsml/*"
+                ],
@@ -728 +750 @@ AWS Clean Rooms uses a service role to control who can create a custom ML model
-This role allows you to use the CreateConfiguredModelAlgorithm action. 
+This role allows you to use the [CreateConfiguredModelAlgorithm](https://docs.aws.amazon.com/cleanrooms-ml/latest/APIReference/API_CreateConfiguredModelAlgorithm.html) action. 
@@ -830 +852 @@ AWS Clean Rooms uses a service role to control who can query a dataset that will
-This role allows you to use the CreateMLInputChannel action. 
+This role allows you to use the [CreateMLInputChannel](https://docs.aws.amazon.com/cleanrooms-ml/latest/APIReference/API_CreateMLInputChannel.html) action. 
@@ -858 +880 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c
-                "Sid": "AllowCleanRoomsGetSchemaForMLInputChannel",
+                "Sid": "AllowCleanroomsGetSchemaAndGetAnalysisTemplateForMLInputChannel",
@@ -860 +882,4 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c
-                "Action": "cleanrooms:GetSchema",
+                "Action": [
+                    "cleanrooms:GetSchema",
+                    "cleanrooms:GetCollaborationAnalysisTemplate"
+                ],