AWS clean-rooms documentation change

Service: clean-rooms · 2025-08-10 · Documentation medium

File: clean-rooms/latest/userguide/data-protection.md

Summary

Updated KMS policy examples with specific service references, account IDs, and added DescribeKey permissions

Security assessment

Enhanced IAM policy examples with service principal details and explicit KMS permissions. While improving security documentation clarity, no evidence of addressing a specific vulnerability.

Diff

diff --git a/clean-rooms/latest/userguide/data-protection.md b/clean-rooms/latest/userguide/data-protection.md
index 4e422b2ab..d159d065b 100644
--- a//clean-rooms/latest/userguide/data-protection.md
+++ b//clean-rooms/latest/userguide/data-protection.md
@@ -88 +88 @@ JSON
-            "Sid": "Allow access to principals authorized to use ",
+            "Sid": "Allow access to principals authorized to use AWS Clean Rooms ML",
@@ -91 +91 @@ JSON
-                "AWS": "arn:aws:iam::444455556666:role/ExampleRole" 
+                "AWS": "arn:aws:iam::666666666666:role/ExampleRole" 
@@ -101 +101 @@ JSON
-                    "kms:ViaService": "cleanrooms-ml.region.amazonaws.com"
+                    "kms:ViaService": "cleanrooms-ml.us-east-1.amazonaws.com"
@@ -106 +106 @@ JSON
-            "Sid": "Allow access to  service principal",
+            "Sid": "Allow access to AWS Clean Rooms ML service principal",
@@ -135 +135 @@ JSON
-                "Sid": "Allow access to principals authorized to use ",
+                "Sid": "Allow grant operations for principals authorized to use AWS Clean Rooms ML",
@@ -138 +138 @@ JSON
-                    "AWS": "arn:aws:iam::444455556666:role/ExampleRole"
+                    "AWS": "arn:aws:iam::666666666666:role/ExampleRole"
@@ -142 +141,0 @@ JSON
-                    "kms:DescribeKey",
@@ -149 +148 @@ JSON
-                        "kms:ViaService": "cleanrooms-ml.region.amazonaws.com"
+                        "kms:ViaService": "cleanrooms-ml.us-east-1.amazonaws.com"
@@ -170 +169,17 @@ JSON
-                "Sid": "Allow access to  service principal",
+                "Sid": "Allow describe key for principals authorized to use AWS Clean Rooms ML",
+                "Effect": "Allow",
+                "Principal": {
+                    "AWS": "arn:aws:iam::444455556666:role/ExampleRole"
+                },
+                "Action": [
+                    "kms:DescribeKey"
+                ],
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "kms:ViaService": "cleanrooms-ml.us-east-1.amazonaws.com"
+                    }
+                }
+            },
+            {
+                "Sid": "Allow grant operations for AWS Clean Rooms ML service principal",
@@ -177 +191,0 @@ JSON
-                    "kms:DescribeKey",
@@ -196,0 +211,11 @@ JSON
+            },
+            {
+                "Sid": "Allow describe key for AWS Clean Rooms ML service principal",
+                "Effect": "Allow",
+                "Principal": {
+                    "Service": "cleanrooms-ml.amazonaws.com"
+                },
+                "Action": [
+                    "kms:DescribeKey"
+                ],
+                "Resource": "*"