AWS clean-rooms medium security documentation change
Summary
Expanded documentation for contributing training data with support for multiple data sources (S3/Athena/Snowflake), added detailed configuration steps for analysis rules, and restructured console/API instructions.
Security assessment
Added explicit security controls including: 1) Snowflake credential management via secrets (security best practice), 2) Column exclusion from outputs to prevent data leakage, 3) Analysis rules restricting query access to specific collaborators, 4) Differential privacy configuration, and 5) Mandatory review of analysis results. These changes document granular access controls and data protection mechanisms critical for secure multi-party collaborations.
Diff
diff --git a/clean-rooms/latest/userguide/custom-model-training-data.md b/clean-rooms/latest/userguide/custom-model-training-data.md index 38189b2bf..6f9988c04 100644 --- a//clean-rooms/latest/userguide/custom-model-training-data.md +++ b//clean-rooms/latest/userguide/custom-model-training-data.md @@ -9,4 +8,0 @@ After the collaboration creator has created the collaboration and invited member -The following image shows creating the container training image as the first step before you configure a model algorithm and then associate it with the collaboration. - - - @@ -16 +12 @@ Console -###### To contribute training data in AWS Clean Rooms +###### To contribute training data (console) @@ -24,3 +20 @@ Console - 4. For **Configure new table** , for **Data source,** choose **Amazon S3**. - -For **Amazon S3** , choose a **Database** from the dropdown list. Next, select the **Table** from the database. + 4. For **Configure new table** , for **Data source,** choose **Amazon S3** , **Amazon Athena** , or **Snowflake** and complete the following steps, based on your data source: @@ -28 +22,19 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 5. For **Columns allowed in collaborations** , choose either **All columns** or **Custom list**. +If you're using | Then +---|--- +**Amazon S3** | + 1. Choose a **Database** from the dropdown list, and then select the **Table** from the database. + 2. For **Columns allowed in collaborations** , choose either **All columns** or **Custom list**. + 3. For **Configured table details** , provide the **Name** and an optional **Description** for this table. + 4. If you want to report model metrics, enter the **Name** of the metrics and the **Regex** statement that will search the output logs to find the metric. + 5. If you want to enable **Tags** for the configured table resource, choose **Add new tag** and then enter the **Key** and **Value** pair. +**Amazon Athena** | + 1. Choose a **Database** from the dropdown list, and then select the **Table** from the database. + 2. For **Columns allowed in collaborations** , choose either **All columns** or **Custom list**. + 3. For **Configured table details** , provide the **Name** and an optional **Description** for this table. + 4. If you want to report model metrics, enter the **Name** of the metrics and the **Regex** statement that will search the output logs to find the metric. + 5. If you want to enable **Tags** for the configured table resource, choose **Add new tag** and then enter the **Key** and **Value** pair. +**Snowflake** | + 1. Specify the **Snowflake credentials** using an existing secret ARN or storing a new secret for this table. + 2. For **Snowflake table and schema details** , enter the details manually or automatically import the details. + 3. For the **Schema** , enter the **Column name** and choose the **Data type** from the dropdown list. + 4. If you want to enable **Tags** for the configured table resource, choose **Add new tag** and then enter the **Key** and **Value** pair. @@ -30 +42 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 6. For **Configured table details** , provide the **Name** and an optional **Description** for this table. + 5. Choose **Configure new table**. @@ -32 +44 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 7. If you want to report model metrics, enter the **Name** of the metrics and the **Regex** statement that will search the output logs to find the metric. + 6. On the table details page, choose **Configure analysis rule** to configure a custom analysis rule for this table. A custom analysis rule limits access to your data. You can either allow a specific set of pre-authorized queries on your data or allow a specific set of accounts to query your data. @@ -34 +46 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 8. Choose **Configure new table**. + 1. For **Analysis rule type** , choose **Custom** and for **Creation method** , choose **Guided flow**. @@ -36 +48 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 9. On the table details page, choose **Configure analysis rule** to configure a custom analysis rule for this table. A custom analysis rule limits access to your data. You can either allow a specific set of pre-authorized queries on your data or allow a specific set of accounts to query your data. + 2. Choose **Next**. @@ -38 +50 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 10. For **Analysis rule type** , choose **Custom** and for **Creation method** , choose **Guided flow**. + 3. For **Specify analysis controls** , choose between **Review each new analysis** and **Allow any analysis by specific collaborators**. @@ -40 +52 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 11. Choose **Next**. + 4. Choose **Next**. @@ -42 +54 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 12. For **Specify analysis controls** , choose between **Review each new analysis** and **Allow any analysis by specific collaborators**. + 5. (Optional) For **Specify analysis results controls** , for **Columns not allowed in output** specify whether you want to exclude any columns from the output. If you choose **None** , no columns are excluded from the output. If you choose **Custom list** , you can specify certain columns that will be removed from the output. @@ -44 +56 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 13. (Optional) For **Specify analysis results controls** , for **Columns not allowed in output** specify whether you want to exclude any columns from the output. If you choose **None** , no columns are excluded from the output. If you choose **Custom list** , you can specify certain columns that will be removed from the output. + 6. For **Additional analyses applied to output** specify whether you want to allow, deny, or require an additional analysis before results are generated. @@ -46 +58 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 14. For **Additional analyses applied to output** specify whether you want to allow, deny, or require an additional analysis before results are generated. + 7. Choose **Next**. @@ -48 +60 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 15. Choose **Next**. + 8. (Optional) For **Set differential privacy** , choose **Turn off**. @@ -50 +62 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 16. (Optional) For **Set differential privacy** , choose **Turn off**. + 9. Choose **Next**. @@ -52 +64 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 17. Choose **Next**. + 10. Review the information on the **Review and configure** page, then choose **Configure analysis rule**. @@ -54 +66 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 18. Review the information on the **Review and configure** page, then choose **Configure analysis rule**. + 7. From the table details page, choose **Associate to collaboration**. @@ -56 +68 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 19. From the table details page, choose **Associate to collaboration**. + 8. In the **Associate table** dialog box, select the collaboration that you want to associate this table to and choose **Choose collaboration**. @@ -58 +70 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 20. In the **Associate table** dialog box, select the collaboration that you want to associate this table to and choose **Choose collaboration**. + 9. On the **Associate table** page, review and verify the information in **Table association details** , **Service access** , and **Tags**. Choose **Associate table**. @@ -60 +72 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 21. On the **Associate table** page, review and verify the information in **Table association details** , **Service access** , and **Tags**. Choose **Associate table**. + 10. In the **Tables associated by you** table, select the radio button next to the table that you just associated. From the **Actions** menu, choose **Configure** in the **Collaboration analysis rule** group. @@ -62,3 +74 @@ For **Amazon S3** , choose a **Database** from the dropdown list. Next, select t - 22. In the **Tables associated by you** table, select the radio button next to the table that you just associated. From the **Actions** menu, choose **Configure** in the **Collaboration analysis rule** group. - - 23. On the **Configure collaboration analysis rule** page, for **Allowed additional analyses** , choose whether any collaboration members or specific collaboration members can perform additional analyses. + 11. On the **Configure collaboration analysis rule** page, for **Allowed additional analyses** , choose whether any collaboration members or specific collaboration members can perform additional analyses. @@ -68 +78 @@ For **Results delivery** , choose which members are allowed to receive results f - 24. Choose **Configure analysis rule**. + 12. Choose **Configure analysis rule**. @@ -75,0 +86,2 @@ API +To contribute training data (API) + @@ -77,0 +90,2 @@ API +Run the following code with your specific parameters. + @@ -94,0 +109,2 @@ API +Run the following code with your specific parameters. + @@ -115,0 +132,2 @@ In this example, a specific account is allowed to run any query on the data and +Run the following code with your specific parameters. + @@ -131,0 +150,2 @@ This service role has permissions to the tables. The service role is assumable o +Run the following code with your specific parameters. +