AWS clean-rooms documentation change
Summary
Updated resource ARNs with concrete account IDs and regions, modified IAM condition keys
Security assessment
Replaced placeholder values with specific account IDs and regions in IAM policies, and changed StringLikeIfExists to ArnLikeIfExists conditions. Improves security posture through precise resource restrictions but doesn't address a known vulnerability.
Diff
diff --git a/clean-rooms/latest/userguide/ml-roles.md b/clean-rooms/latest/userguide/ml-roles.md index 66f75158e..981a100e2 100644 --- a//clean-rooms/latest/userguide/ml-roles.md +++ b//clean-rooms/latest/userguide/ml-roles.md @@ -75,4 +75,4 @@ JSON - "arn:aws:glue:us-east-1:accountId:database/databases", - "arn:aws:glue:us-east-1:accountId:table/databases/tables", - "arn:aws:glue:us-east-1:accountId:catalog", - "arn:aws:glue:us-east-1:accountId:database/default" + "arn:aws:glue:us-east-1:111122223333:database/databases", + "arn:aws:glue:us-east-1:111122223333:table/databases/tables", + "arn:aws:glue:us-east-1:111122223333:catalog", + "arn:aws:glue:us-east-1:111122223333:database/default" @@ -87 +87 @@ JSON - "arn:aws:glue:us-east-1:accountId:database/default" + "arn:aws:glue:us-east-1:111122223333:database/default" @@ -102 +102 @@ JSON - "accountId" + "111122223333" @@ -118 +118 @@ JSON - "accountId" + "111122223333" @@ -195 +195 @@ JSON - "aws:SourceAccount": ["accountId"] + "aws:SourceAccount": ["111122223333"] @@ -197,2 +197,2 @@ JSON - "StringLikeIfExists": { - "aws:SourceArn": "arn:aws:cleanrooms-ml:region:accountId:training-dataset/*" + "ArnLikeIfExists": { + "aws:SourceArn": "arn:aws:cleanrooms-ml:us-east-1:111122223333:training-dataset/*" @@ -369 +369 @@ JSON - "aws:SourceAccount": ["accountId"] + "aws:SourceAccount": ["111122223333"] @@ -372,2 +372,2 @@ JSON - "StringLikeIfExists": { - "aws:SourceArn": "arn:aws:cleanrooms-ml:region:accountId:configured-audience-model/*" + "ArnLikeIfExists": { + "aws:SourceArn": "arn:aws:cleanrooms-ml:us-east-1:111122223333:configured-audience-model/*" @@ -503 +503 @@ JSON - "arn:aws:cleanrooms:us-east-1:queryRunnerAccountId:membership/queryRunnerMembershipId" + "arn:aws:cleanrooms:us-east-1:111122223333:membership/queryRunnerMembershipId" @@ -582 +582 @@ JSON - "aws:SourceAccount": ["accountId"] + "aws:SourceAccount": ["111122223333"] @@ -585,2 +585,2 @@ JSON - "StringLikeIfExists": { - "aws:SourceArn": "arn:aws:cleanrooms-ml:region:accountId:audience-generation-job/*" + "ArnLikeIfExists": { + "aws:SourceArn": "arn:aws:cleanrooms-ml:us-east-1:111122223333:audience-generation-job/*" @@ -678 +678 @@ JSON - "accountId" + "111122223333" @@ -691 +691 @@ JSON - "arn:aws:kms:us-east-1:accountId:key/keyId" + "arn:aws:kms:us-east-1:111122223333:key/keyId" @@ -720 +720 @@ JSON - "arn:aws:logs:us-east-1:account-id:log-group:/aws/cleanroomsml/*" + "arn:aws:logs:us-east-1:111122223333:log-group:/aws/cleanroomsml/*" @@ -772 +772 @@ JSON - "aws:SourceAccount": "accountId" + "aws:SourceAccount": "111122223333" @@ -775 +775 @@ JSON - "aws:SourceArn": "arn:aws:cleanrooms:us-east-1:accountId:membership/membershipID" + "aws:SourceArn": "arn:aws:cleanrooms:us-east-1:111122223333:membership/membershipID" @@ -847 +847 @@ JSON - "Resource": "arn:aws:ecr:us-east-1:accountID:repository/repoName" + "Resource": "arn:aws:ecr:us-east-1:111122223333:repository/repoName" @@ -978 +978 @@ JSON - "arn:aws:cleanrooms:us-east-1:queryRunnerAccountId:membership/queryRunnerMembershipId" + "arn:aws:cleanrooms:us-east-1:111122223333:membership/queryRunnerMembershipId" @@ -1092 +1092 @@ JSON - "Resource": "KMS key used to encrypt the S3 data", + "Resource": "arn:aws:kms:us-east-1:111122223333:key/KMS-key-ID", @@ -1100 +1100 @@ JSON - "Resource": "S3 bucket of Glue table", + "Resource": "arn:aws:s3:::bucket-name", @@ -1105 +1105 @@ JSON - "Resource": "S3 bucket of Glue table/*", + "Resource": "arn:aws:s3:::bucket-name/*", @@ -1119,3 +1119,3 @@ JSON - "arn:aws:glue:us-east-1:accountID:catalog", - "arn:aws:glue:us-east-1:accountID:database/Glue database name", - "arn:aws:glue:us-east-1:accountID:table/Glue database name/Glue table name" + "arn:aws:glue:us-east-1:111122223333:catalog", + "arn:aws:glue:us-east-1:111122223333:database/Glue database name", + "arn:aws:glue:us-east-1:111122223333:table/Glue database name/Glue table name"