AWS clean-rooms high security documentation change
Summary
Updated confused deputy prevention policy examples to clarify membership ID requirements and expand source ARN validation for multiple collaboration members
Security assessment
The changes explicitly address authorization controls by requiring membership ARNs for all collaborators to access configured table metadata. This prevents unauthorized access through service role trust policies, directly mitigating confused deputy risks by enforcing granular source ARN validation.
Diff
diff --git a/clean-rooms/latest/userguide/cross-service-confused-deputy-prevention.md b/clean-rooms/latest/userguide/cross-service-confused-deputy-prevention.md index c3174ed99..580e5a270 100644 --- a//clean-rooms/latest/userguide/cross-service-confused-deputy-prevention.md +++ b//clean-rooms/latest/userguide/cross-service-confused-deputy-prevention.md @@ -19 +19 @@ The following example shows how you can use the `aws:SourceArn` global condition -The example policy applies to the trust policy of the service role that AWS Clean Rooms uses to access customer data. +The example policy applies to the trust policy of the service role that AWS Clean Rooms uses to access data and metadata for a configured table. @@ -21 +21,3 @@ The example policy applies to the trust policy of the service role that AWS Clea -The value of `membershipID` is your AWS Clean Rooms membership ID in the collaboration. +The value for `<query-runner-membership-id>` needs to be set to the membership ID of the query runner. + +All members of the collaboration can view the configured table matadata so each membership ARN must be included in the list of membership ARNs. @@ -36 +38 @@ The value of `membershipID` is your AWS Clean Rooms membership ID in the collabo - "sts:ExternalId": "arn:aws:*:aws-region:*:dbuser:*/membershipID*" + "sts:ExternalId": "arn:aws:*:<aws-region>:*:dbuser:*/<query-runner-membership-id>*" @@ -49 +51,5 @@ The value of `membershipID` is your AWS Clean Rooms membership ID in the collabo - "aws:SourceArn": "arn:aws:cleanrooms:aws-region:123456789012:membership/membershipID" + "aws:SourceArn": [ + "arn:aws:cleanrooms:<aws-region>:<member-1-account-id>:membership/<member-1-membership-id>", + "arn:aws:cleanrooms:<aws-region>:<member-2-account-id>:membership/<member-2-membership-id>", + ..... + ]