AWS clean-rooms high security documentation change
Summary
Added explicit JOIN operation constraints for ID mapping tables to prevent exposure of unmapped records. Updated SQL examples to enforce ID mapping table placement on 'inner' side of JOINs.
Security assessment
The change explicitly restricts JOIN operations to prevent exposing mapping records without corresponding dataset matches, directly addressing potential data leakage risks. The documentation states that invalid JOIN operations 'could potentially reveal sensitive information about other collaboration members' data mappings', indicating a security control implementation.
Diff
diff --git a/clean-rooms/latest/userguide/analysis-rules-id-mapping-table.md b/clean-rooms/latest/userguide/analysis-rules-id-mapping-table.md index 4680a5606..747ecec70 100644 --- a//clean-rooms/latest/userguide/analysis-rules-id-mapping-table.md +++ b//clean-rooms/latest/userguide/analysis-rules-id-mapping-table.md @@ -17 +17,15 @@ With the ID mapping table analysis rule, AWS Clean Rooms enforces an overlap on -AWS Clean Rooms allows an INNER, LEFT, or RIGHT join on the ID mapping table if it respects the overlap. +AWS Clean Rooms allows an INNER, LEFT, or RIGHT join on the ID mapping table if it respects the overlap. To protect sensitive mapping information, the ID mapping table must always be on the "inner" side of any JOIN operation. For example, the following JOIN operations are valid: + + * table LEFT JOIN id_mapping_table + + * id_mapping_table RIGHT JOIN table + + * table INNER JOIN id_mapping_table + +The following JOIN operations are invalid: + + * id_mapping_table LEFT JOIN table + + * table RIGHT JOIN id_mapping_table + +This prevents exposure of mapping records that don't have corresponding matches in your dataset. Allowing such operations could potentially reveal sensitive information about other collaboration members' data mappings. @@ -109,2 +123 @@ The following examples show valid locations for the ID mapping table joins: - [ select_items ] - FROM + [ select_items ]FROM @@ -112,2 +125,2 @@ The following examples show valid locations for the ID mapping table joins: - [ INNER | LEFT | RIGHT ] JOIN cr_identity_mapping_table idmt ON idmt.cr_drivers_license_id = cr_dl.id - [ INNER | LEFT | RIGHT ] JOIN cr_insurance cr_in ON idmt.cr_insurance_id = cr_in.id + [ INNER | LEFT ] JOIN cr_identity_mapping_table idmt ON idmt.cr_drivers_license_id = cr_dl.id + [ INNER | RIGHT ] JOIN cr_insurance cr_in ON idmt.cr_insurance_id = cr_in.id @@ -118,2 +130 @@ The following examples show valid locations for the ID mapping table joins: - [ select_items ] - FROM ( + [ select_items ]FROM ( @@ -124,2 +135,2 @@ The following examples show valid locations for the ID mapping table joins: - [ INNER | LEFT | RIGHT ] JOIN cr_identity_mapping_table idmt ON idmt.cr_drivers_license_id = cr_dl.id - [ INNER | LEFT | RIGHT ] JOIN cr_insurance cr_in ON idmt.cr_insurance_id = cr_in.id + [ INNER | LEFT ] JOIN cr_identity_mapping_table idmt ON idmt.cr_drivers_license_id = cr_dl.id + [ INNER | RIGHT ] JOIN cr_insurance cr_in ON idmt.cr_insurance_id = cr_in.id @@ -136,6 +146,4 @@ The following examples show valid locations for the ID mapping table joins: - [ INNER | LEFT | RIGHT ] JOIN cr_identity_mapping_table idmt ON idmt.cr_drivers_license_id = cr_dl.id - [ INNER | LEFT | RIGHT ] JOIN cr_insurance cr_in ON idmt.cr_insurance_id = cr_in.id - ) - SELECT - [ select_items ] - FROM + [ INNER | LEFT ] JOIN cr_identity_mapping_table idmt ON idmt.cr_drivers_license_id = cr_dl.id + [ INNER | RIGHT ] JOIN cr_insurance cr_in ON idmt.cr_insurance_id = cr_in.id + )SELECT + [ select_items ]FROM