AWS clean-rooms documentation change
Summary
Expanded prerequisites and restructured console instructions for creating ML input channels. Added details about KMS encryption, service roles, worker configurations, data retention, and post-creation limitations.
Security assessment
The change adds documentation about using custom KMS keys for encryption and emphasizes permissions requirements, which are security features. However, there is no evidence this addresses a specific security vulnerability - rather it enhances documentation of existing security controls.
Diff
diff --git a/clean-rooms/latest/userguide/create-ml-input-channel.md b/clean-rooms/latest/userguide/create-ml-input-channel.md index 0266ab034..9edd3031b 100644 --- a//clean-rooms/latest/userguide/create-ml-input-channel.md +++ b//clean-rooms/latest/userguide/create-ml-input-channel.md @@ -7 +7,24 @@ -An ML input channel is a data stream that is created from a specific data query. Members with the ability to query data can prepare their data for training and inference by creating an ML input channel. Creating an ML input channel allows that data to be used in different training models within the same collaboration. You should create separate ML input channels for training and inference. +Prerequisites: + + * An AWS account with access to AWS Clean Rooms + + * A collaboration set up in AWS Clean Rooms where you want to create the ML input channel + + * Permissions to query data and create ML input channels in the collaboration. + + * (Optional) An existing model algorithm to associate with the ML input channel, or permissions to create a new one + + * (Optional) Tables with analysis rules that can be run for your specified model. + + * (Optional) An existing SQL query or analysis template to use for generating the dataset + + * (Optional) An existing service role with appropriate permissions, or permissions to create a new service role + + * (Optional) A custom AWS KMS key if you want to use your own encryption key + + * Appropriate permissions to create and manage ML models in the collaboration + + + + +An _ML input channel_ is a dataset that is created from a specific data query. Members with the ability to query data can prepare their data for training and inference by creating an ML input channel. Creating an ML input channel allows that data to be used in different training models within the same collaboration. You should create separate ML input channels for training and inference. @@ -14 +37 @@ Console -###### To create an ML input channel in AWS Clean Rooms +###### To create an ML input channel (console) @@ -20 +43,7 @@ Console - 3. On the **Collaborations** page, choose the collaboration that you want to create an ML input channel in. + 3. On the **Collaborations** page, choose the collaboration where you want to create an ML input channel. + + 4. After the collaboration opens, choose the **ML models** tab.. + + 5. Under **Custom ML models** , in the **ML input channels** section, choose **Create ML input channel**. + + 6. On the **Create ML input channel** page, for **ML input channel details** , do the following: @@ -22 +51 @@ Console - 4. After the collaboration opens, choose the **ML models** tab, then choose **Create ML input channel**. + 1. For **Name** , enter a unique name for your channel. @@ -24 +53 @@ Console - 5. For **Create ML input channel** , for **ML input channel details** , enter a **Name** , an optional **Description** , and the **Associated model algorithm** to use. + 2. (Optional) For **Description** , enter a description of your channel. @@ -26 +55 @@ Console - 6. For **Dataset** , choose **Analysis template** to use the results of an analysis template as the training dataset or **SQL query** to use the results of an SQL query as the training dataset. If you chose **Analysis template** , specify the analysis template that you want. If you chose **SQL query** , enter your query in the **SQL query** field. + 3. For **Associated model algorithm** , select the algorithm to use. @@ -28 +57 @@ Console - 7. Choose the **Worker type** and **Number of workers** to use when creating this data channel. +Choose **Associate model algorithm** to add a new one. @@ -30 +59 @@ Console - 8. For **Data retention in days** , specify how long the data will be kept. + 7. For **Dataset** , choose a method to generate the training dataset: @@ -32 +61 @@ Console - 9. For **Service access** , choose the **Existing service role name** that will be used to access this table or choose **Create and use a new service role**. + * Choose **SQL query** to use the results of a SQL query as the training dataset. @@ -34 +63 @@ Console - 10. For **Encryption** , choose the **Customize encryption settings** to specify your own KMS key and related information. Otherwise, Clean Rooms ML will manage the encryption. +If you chose **SQL query** , enter your query in the **SQL query** field. @@ -36 +65 @@ Console - 11. Choose **Create ML input channel**. +(Optional) To import a query you've used recently, choose **Import from recent queries**. @@ -37,0 +67 @@ Console + * Choose **Analysis template** to use the results of an analysis template as the training dataset. @@ -38,0 +69 @@ Console +If you chose **Analysis template** , specify the analysis template that you want. @@ -39,0 +71,24 @@ Console + 1. If no tables are associated, choose **Associate table** to add tables with an analysis rule that can be run for the specified model. + + 2. For **Worker type** , choose the type of worker to use. The default is **CR.1X**. + + 3. For **Number of workers** choose the number of workers to use when creating this data channel. The default is **16**. + + 4. For **Data retention in days** , enter the number of days to keep the data. + + 5. For **Result format,** choose either **CSV** or **Parquet** as the data format the ML input channel should use. + + 8. For **Service access** , choose the **Existing service role name** that will be used to access this table or choose **Create and use a new service role**. + + 9. For **Encryption** , choose the **Encrypt secret with a custom KMS key** to specify your own KMS key and related information. Otherwise, Clean Rooms ML will manage the encryption. + + 10. Choose **Create ML input channel**. + +It will take a few minutes to create the ML input channel. You can see a list of ML input channels on the **ML input** tab. + + + + +###### Note + +After the ML input channel is created, you can't edit it. @@ -44 +99,3 @@ API -To create an ML input channel, run the following code: +To create an ML input channel (API) + +Run the following code with your specific parameters: @@ -59,0 +117,7 @@ To create an ML input channel, run the following code: + "computeConfiguration": { + "worker": { + "type": "CR.1X", + "number": 16 + } + }, + "resultFormat": "PARQUET"