AWS Security ChangesHomeSearch

AWS clean-rooms documentation change

Service: clean-rooms · 2025-07-18 · Documentation low

File: clean-rooms/latest/userguide/dp-sql-capabilities.md

Summary

Expanded documentation of supported SQL functions and clauses, including cryptographic functions (AES_ENCRYPT, MD5, SHA), and restructured comparison between Spark and AWS Clean Rooms SQL engines.

Security assessment

The changes add documentation for security-related cryptographic functions (AES_ENCRYPT, AES_DECRYPT, MD5, SHA) and hash operations, which are security features. However, there is no explicit evidence of addressing a specific security vulnerability or incident in the diff. The CTE condition about userIdentifierColumn was pre-existing and not modified in a security context.

Diff

diff --git a/clean-rooms/latest/userguide/dp-sql-capabilities.md b/clean-rooms/latest/userguide/dp-sql-capabilities.md
index df535f05a..e7a69aaf9 100644
--- a//clean-rooms/latest/userguide/dp-sql-capabilities.md
+++ b//clean-rooms/latest/userguide/dp-sql-capabilities.md
@@ -11,2 +11,2 @@ AWS Clean Rooms Differential Privacy uses a general-purpose query structure to s
-Short name | SQL constructs | Common table expressions (CTEs) | Final SELECT clause  
----|---|---|---  
+Category | SQL constructs supported in the Spark analytics engine | SQL constructs supported in the AWS Clean Rooms SQL analytics engine | Common table expressions (CTEs) | Final SELECT clause  
+---|---|---|---|---  
@@ -14,0 +15,14 @@ Aggregate functions |
+  * ANY_VALUE function
+  * APPROXIMATE PERCENTILE_DISC function
+  * AVG function
+  * COUNT and COUNT DISTINCT functions
+  * MAX function
+  * MEDIAN function
+  * MIN function
+  * PERCENTILE_CONT function
+  * STDDEV_SAMP and STDDEV_POP functions
+  * SUM and SUM DISTINCT functions
+  * VAR_SAMP and VAR_POP functions
+
+| 
+
@@ -29 +43 @@ Aggregate functions |
-CTEs | WITH clause, WITH clause subquery | Supported with the condition that CTEs using differential privacy protected tables must result in data with user-level records. You should write the SELECT expression in those CTEs using ``SELECT userIdentifierColumn...'` format. | N/A  
+CTEs | WITH clause, WITH clause subquery | WITH clause, WITH clause subquery | Supported with the condition that CTEs using differential privacy protected tables must result in data with user-level records. You should write the SELECT expression in those CTEs using ``SELECT userIdentifierColumn...'` format. | N/A  
@@ -38,0 +53,9 @@ Subqueries |
+| 
+
+  * SELECT
+  * HAVING
+  * JOIN
+  * JOIN condition
+  * FROM
+  * WHERE
+
@@ -41,0 +65,11 @@ Join clauses |
+  * INNER JOIN
+  * LEFT JOIN
+  * LEFT SEMI JOIN
+  * LEFT ANTI JOIN
+  * RIGHT JOIN
+  * FULL JOIN
+  * [JOIN] OR operator
+  * CROSS JOIN
+
+| 
+
@@ -50 +84 @@ Join clauses |
-Set operators | UNION, UNION ALL, INTERSECT, EXCEPT | MINUS (these are synonyms) | All are supported | Not supported  
+Set operators | UNION, UNION ALL, INTERSECT, EXCEPT | MINUS (these are synonyms) | UNION, UNION ALL, INTERSECT, EXCEPT | MINUS (these are synonyms) | All are supported | Not supported  
@@ -52,0 +87,26 @@ Window functions |  Aggregate functions
+  * AVG window function
+  * COUNT window function
+  * CUME_DIST window function
+  * DENSE_RANK window function
+  * FIRST_VALUE window function
+  * LAG window function
+  * LAST_VALUE window function
+  * LEAD window function
+  * MAX window functions
+  * MEDIAN window functions
+  * MIN window functions
+  * NTH_VALUE window function
+  * STDDEV_SAMP and STDDEV_POP window function (STDDEV_SAMP and STDDEV are synonyms)
+  * SUM window functions
+  * VAR_SAMP and VAR_POP window functions (VAR_SAMP and VARIANCE are synonyms)
+
+Ranking functions
+
+  * DENSE_RANK window function
+  * NTILE window function
+  * PERCENT_RANK window function
+  * RANK window function
+  * ROW_NUMBER window function
+
+|  Aggregate functions
+
@@ -87,0 +148,9 @@ Conditional expressions |
+| 
+
+  * CASE condition expression
+  * COALESCE expression
+  * GREATEST and LEAST functions
+  * NVL and COALESCE functions
+  * NVL2 function
+  * NULLIF function
+
@@ -97 +166,9 @@ Conditions |
-| `EXISTS` and `IN` cannot be used because they require subqueries. All others are supported. | All are supported  
+| 
+
+  * Comparison condition
+  * Logical conditions
+  * Pattern-matching conditions
+  * BETWEEN range conditions
+  * Null condition
+
+| `EXISTS` and `IN` can't be used because they require subqueries. All others are supported. | All are supported  
@@ -99,0 +177,15 @@ Date-time functions |
+  * Date and time functions in transactions
+  * Concatenation operator
+  * ADD_MONTHS functions
+  * CONVERT_TIMEZONE function
+  * CURRENT_DATE function
+  * DATEADD function
+  * DATEDIFF function
+  * DATE_PART functions
+  * DATE_TRUNC function
+  * EXTRACT function
+  * TO_TIMESTAMP function
+  * Date parts for date or timestamp functions
+
+| 
+
@@ -122 +214,28 @@ String functions |
-  * CHARINDEX function
+  * CONCAT function
+  * LEFT and RIGHT functions
+  * LEN function
+  * LENGTH function
+  * LOWER function
+  * LPAD and RPAD functions
+  * LTRIM function
+  * POSITION functions
+  * REGEXP_COUNT function
+  * REGEXP_INSTR function
+  * REGEXP_REPLACE function
+  * REGEXP_SUBSTR function
+  * REPEAT function
+  * REPLACE function
+  * REVERSE function
+  * RTRIM function
+  * SPLIT_PART function
+  * SUBSTRING function
+  * TRANSLATE function
+  * TRIM functions
+  * UPPER function
+
+| 
+
+  * || (concatenation) operator
+  * BTRIM function
+  * CHAR_LENGTH function
+  * CHARACTER_LENGTH function
@@ -158,0 +278,9 @@ Data type formatting functions |
+| 
+
+  * CAST function
+  * TO_CHAR
+  * TO_DATE function
+  * TO_NUMBER
+  * Datetime format strings
+  * Numeric format strings
+
@@ -161,0 +290,11 @@ Hash functions |
+  * AES_ENCRYPT
+  * AES_DECRYPT
+  * ENCODE
+  * DECODE
+  * MD5 function
+  * SHA1 function
+  * SHA2 function
+  * XX_HASH64
+
+| 
+
@@ -169 +308 @@ Hash functions |
-Mathematical operator symbols | +, -, *, /, %, and @ | All are supported | All are supported  
+Mathematical operator symbols | +, -, *, /, %, and @ | +, -, *, /, %, and @ | All are supported | All are supported  
@@ -171,0 +311,28 @@ Math functions |
+  * ABS function
+  * ACOS function
+  * ASIN function
+  * ATAN function
+  * ATAN2 function
+  * CBRT function
+  * CEILING (or CEIL) function
+  * COS function
+  * COT function
+  * DEGREES function
+  * LTRIM function
+  * EXP function
+  * FLOOR function
+  * LN function
+  * LOG function
+  * MOD function
+  * PI function
+  * POWER function
+  * RADIANS function
+  * RANDOM function
+  * ROUND function
+  * SIGN function
+  * SIN function
+  * SQRT functions
+  * TRUNC function
+
+| 
+