AWS clean-rooms medium security documentation change
Summary
Modified IAM role trust policy service principal from 'cleanrooms.amazonaws.com' to '.amazonaws.com' and added JSON section dividers
Security assessment
Changing the service principal to a wildcard (.amazonaws.com) expands trust to all AWS services rather than just Clean Rooms. This weakens the security boundary unless properly constrained by other conditions. However, the context shows these changes are paired with conditional statements about restricting role usage, indicating an attempt to balance flexibility with security controls.
Diff
diff --git a/clean-rooms/latest/userguide/setting-up-roles.md b/clean-rooms/latest/userguide/setting-up-roles.md index d449ff049..581d99fca 100644 --- a//clean-rooms/latest/userguide/setting-up-roles.md +++ b//clean-rooms/latest/userguide/setting-up-roles.md @@ -98,0 +99,6 @@ If you want to help ensure that the role is used only in the context of a certai +JSON + + +**** + + @@ -107 +113 @@ If you want to help ensure that the role is used only in the context of a certai - "Service": "cleanrooms.amazonaws.com" + "Service": ".amazonaws.com" @@ -121,0 +129,6 @@ Your AWS Glue resources and underlying Amazon S3 resources must be in the same A +JSON + + +**** + + @@ -212,0 +227,6 @@ If you want to help ensure that the role is used only in the context of a certai +JSON + + +**** + + @@ -221 +241 @@ If you want to help ensure that the role is used only in the context of a certai - "Service": "cleanrooms.amazonaws.com" + "Service": ".amazonaws.com" @@ -235,0 +257,6 @@ Your AWS Glue resources and underlying Athena resources must be in the same AWS +JSON + + +**** + + @@ -348,0 +377,6 @@ If you want to help ensure that the role is used only in the context of a certai +JSON + + +**** + + @@ -374,0 +410,6 @@ If you want to help ensure that the role is used only in the context of a certai +JSON + + +**** + + @@ -399,0 +442,6 @@ If you want to help ensure that the role is used only in the context of a certai +JSON + + +**** + + @@ -427,0 +477,6 @@ AWS Clean Rooms uses a service role to read code from a collaboration member's s +JSON + + +**** + + @@ -456,0 +513,6 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c +JSON + + +**** + + @@ -508,0 +572,6 @@ AWS Clean Rooms uses a service role to write the results of a PySpark job to a s +JSON + + +**** + + @@ -537,0 +608,6 @@ Your Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms c +JSON + + +**** + + @@ -628,0 +706,6 @@ You or your IAM administrator should follow this procedure only if you don't hav +JSON + + +**** + + @@ -671,0 +756,6 @@ Your AWS Glue resources and underlying Amazon S3 resources must be in the same A +JSON + + +**** + +