AWS clean-rooms documentation change
Summary
Updated documentation for creating and joining AWS Clean Rooms ML collaborations with expanded instructions for member abilities, payment responsibilities, ML configurations, and collaboration joining procedures.
Security assessment
The changes emphasize role assignments (service access roles), payment responsibility acceptance, and S3 bucket configuration for model artifacts. While these relate to security best practices (access control and cost governance), there's no evidence of addressing a specific vulnerability or security incident. The documentation improvements focus on proper configuration rather than patching security flaws.
Diff
diff --git a/clean-rooms/latest/userguide/create-custom-ml-collaboration.md b/clean-rooms/latest/userguide/create-custom-ml-collaboration.md index 9eaffb740..b989c94e1 100644 --- a//clean-rooms/latest/userguide/create-custom-ml-collaboration.md +++ b//clean-rooms/latest/userguide/create-custom-ml-collaboration.md @@ -5 +5 @@ -# Creating the collaboration +Creating a collaboration for machine learningJoining a collaboration @@ -7 +7,7 @@ -The collaboration creator is responsible for creating the collaboration, inviting members, and assigning their roles: +# Creating and joining the collaboration in AWS Clean Rooms ML + +The collaboration creator is responsible for creating the collaboration, inviting members, and assigning their roles. The invited members join the collaboration and specify results settings, trained model artifacts destination settings and accept payment responsibilities, depending on how the collaboration is set up. + +## Creating a collaboration for machine learning + +The following procedure shows how to create a collaboration for machine learning, invite one or more members, and assign members that can start model training, receive results, receive trained model results, including model artifacts and metrics, and receive model inference results. The collaboration creator also assigns a member who will pay for query compute, model training, and model inference costs. @@ -11,0 +18,2 @@ Console +###### To create a collaboration for machine learning using the console + @@ -14 +22 @@ Console - 2. Assign the following **Member abilities** for **Analysis using queries** : + 2. Assign the following **Member abilities** for **Analysis using queries and jobs** : @@ -16 +24 @@ Console - * **Run queries** – assigned to the member who will initiate model training. + * Assign **Run queries** to the member who will start model training. @@ -18 +26 @@ Console - * **Receive results from queries** – assigned to the members who will receive query results. + * Assign **Receive results from analysis** to the members who will receive query results. @@ -20 +28 @@ Console -Assign the following **Member abilities** for **ML modeling using purpose-built workflows** : + 3. Assign the following **Member abilities** for **ML modeling using purpose-built workflows** : @@ -22 +30 @@ Assign the following **Member abilities** for **ML modeling using purpose-built - * **Receive output from trained models** – assigned to the member who will receive trained model results, including model artifacts and metrics. + * Assign **Receive output from trained models** to the member who will receive trained model results, including model artifacts and metrics. @@ -24 +32 @@ Assign the following **Member abilities** for **ML modeling using purpose-built - * **Receive output from model inference** – assigned to the member who will receive the model inference results. + * Assign **Receive output from model inference** to the member who will receive the model inference results. @@ -26 +34 @@ Assign the following **Member abilities** for **ML modeling using purpose-built -If the collaboration creator is also the results receiver, they must also specify the query results destination and format during collaboration creation. + 4. 1. For **Configure payment** , specify the members who will pay for query compute, model training, and model inference costs. Each of these costs can be assigned to the same or different members. If an invited member is the member who is responsible to pay for payment costs, they must accept their payment responsibilities before joining the collaboration. @@ -28 +36,3 @@ If the collaboration creator is also the results receiver, they must also specif - 3. Specify the members who will pay for query compute, model training, and model inference costs. Each of these costs can be assigned to the same or different members. If an invited member is the member who is responsible to pay for payment costs, they must accept their payment responsibilities before joining the collaboration. + 5. For **Configure membership** , the collaboration creator can decide to join the membership now or create a membership later. The collaboration creator must then set up the ML configuration. + + 1. If the collaboration creator is also the results receiver, they must also specify the query results destination and format in the **Results settings defaults**. @@ -30 +40 @@ If the collaboration creator is also the results receiver, they must also specif - 4. The collaboration creator must then set up the ML configuration. The ML configuration provides a role for Clean Rooms ML to publish metrics to an AWS account. If the collaboration creator is also receiving trained model artifacts, they can specify the Amazon S3 bucket used to receive results. + 2. The ML configuration provides a role for Clean Rooms ML to publish metrics to an AWS account. If the collaboration creator is also receiving trained model artifacts, they can specify the Amazon S3 bucket used to receive results. @@ -32 +42,3 @@ If the collaboration creator is also the results receiver, they must also specif -In the **ML configurations** section, specify the **Model output destination on Amazon S3** and the **Service access role** needed to access this location. + 3. In the **ML configurations** section, select **Create ML configuration** and then specify the **Model output destination on Amazon S3** and the **Service access role** needed to access this location. + + 4. If the collaboration creator is the member who is responsible to pay for payment costs, they must accept their payment responsibilities before creating the collaboration. @@ -44 +56 @@ API - * `CAN_QUERY` \- assigned to the member who will initiate model training and inference. + * `CAN_QUERY` \- assigned to the member who will start model training and inference. @@ -50 +62 @@ API -If the collaboration creator is also the results receiver, they must also specify the query results destination and format during collaboration creation. They also provide a service role Amazon Resource Name (ARN) to write the results to the query results destination. +If the collaboration creator is also the results receiver, they must also specify the query results destination and format during collaboration creation. They also give a service role Amazon Resource Name (ARN) to write the results to the query results destination. @@ -130,0 +143,2 @@ If the collaboration creator is also the results receiver, they must also specif +## Joining a collaboration + @@ -136 +150 @@ Console - 1. If the invited member is the member who can receive results, they specify the query results destination and format. They also provide a service role ARN that allows the service to write to the query results destination +###### To create a membership and join a collaboration using the console @@ -138 +152,3 @@ Console -If the invited member is the member who is responsible to pay, including query compute, model training, and model inference costs, they must accept their payment responsibilities before joining the collaboration. + 1. The invited member [creates a membership and joins the collaboration](./create-membership.html). + + 2. If the invited member is the member who is responsible to pay, including query compute, model training, and model inference costs, they must accept their payment responsibilities before joining the collaboration. @@ -140 +156 @@ If the invited member is the member who is responsible to pay, including query c - 2. The invited member sets up the ML configuration, which provides a role for Clean Rooms ML to publish model metrics to an AWS account. If they are also the member receiving trained model artifacts, they must provide an Amazon S3 bucket where trained model artifacts are stored. + 3. The invited member sets up the ML configuration, which provides a role for Clean Rooms ML to publish model metrics to an AWS account. If they're also the member receiving trained model artifacts, they must give an Amazon S3 bucket where trained model artifacts are stored. @@ -162 +178 @@ If the invited member is the member who is responsible to pay for model training - 2. The invited member sets up the ML configuration, which provides a role for Clean Rooms ML to publish model metrics to an AWS account. If they are also the member receiving trained model artifacts, they must provide an Amazon S3 bucket where trained model artifacts are stored. + 2. The invited member sets up the ML configuration, which provides a role for Clean Rooms ML to publish model metrics to an AWS account. If they're also the member receiving trained model artifacts, they must provide an Amazon S3 bucket where trained model artifacts are stored.