AWS clean-rooms documentation change
Summary
Updated IAM policy examples with specific account IDs and service principal names
Security assessment
Changes replace placeholder values with concrete examples but do not address security vulnerabilities. Improves documentation clarity for proper IAM configuration, which is a security best practice but not a direct response to a security issue.
Diff
diff --git a/clean-rooms/latest/userguide/setting-up-roles.md b/clean-rooms/latest/userguide/setting-up-roles.md index ccf80582f..221eaa795 100644 --- a//clean-rooms/latest/userguide/setting-up-roles.md +++ b//clean-rooms/latest/userguide/setting-up-roles.md @@ -113 +113 @@ JSON - "Service": ".amazonaws.com" + "Service": "cleanrooms.amazonaws.com" @@ -151,3 +151,3 @@ JSON - "arn:aws:glue:aws-region:accountId:database/databaseName", - "arn:aws:glue:aws-region:accountId:table/databaseName/tableName", - "arn:aws:glue:aws-region:accountId:catalog" + "arn:aws:glue:us-east-1:111122223333:database/databaseName", + "arn:aws:glue:us-east-1:111122223333:table/databaseName/tableName", + "arn:aws:glue:us-east-1:111122223333:catalog" @@ -179 +179 @@ JSON - "s3BucketOwnerAccountId" + "444455556666" @@ -196 +196 @@ JSON - "s3BucketOwnerAccountId" + "444455556666" @@ -240 +240 @@ JSON - "Service": ".amazonaws.com" + "Service": "cleanrooms.amazonaws.com" @@ -276,2 +276,2 @@ JSON - "arn:aws:athena:us-east-1:accountId:workgroup/workgroup", - "arn:aws:athena:us-east-1:accountId:datacatalog/AwsDataCatalog" + "arn:aws:athena:us-east-1:111122223333:workgroup/workgroup", + "arn:aws:athena:us-east-1:111122223333:datacatalog/AwsDataCatalog" @@ -288,3 +288,3 @@ JSON - "arn:aws:glue:us-east-1:accountId:catalog", - "arn:aws:glue:us-east-1:accountId:database/database name", - "arn:aws:glue:us-east-1:accountId:table/database name/table name" + "arn:aws:glue:us-east-1:111122223333:catalog", + "arn:aws:glue:us-east-1:111122223333:database/database name", + "arn:aws:glue:us-east-1:111122223333:table/database name/table name" @@ -319 +319 @@ JSON - "Resource": "arn:aws:kms:us-east-1:accountId:key/*" + "Resource": "arn:aws:kms:us-east-1:111122223333:key/*" @@ -395,2 +395,2 @@ JSON - "arn:aws:cleanrooms:us-east-1:accountId:membership/membershipId", - "arn:aws:cleanrooms:us-east-1:queryRunnerAccountId:membership/queryRunnerMembershipId" + "arn:aws:cleanrooms:us-east-1:111122223333:membership/membershipId", + "arn:aws:cleanrooms:us-east-1:444455556666:membership/queryRunnerMembershipId" @@ -420 +420 @@ JSON - "Resource": "arn:aws:secretsmanager:us-east-1:secretAccountId:secret:secretIdentifier", + "Resource": "arn:aws:secretsmanager:us-east-1:111122223333:secret:secretIdentifier", @@ -426 +426 @@ JSON - "Resource": "arn:aws:kms:us-east-1:keyOwnerAccountId:key/keyIdentifier", + "Resource": "arn:aws:kms:us-east-1:444455556666:key/keyIdentifier", @@ -431 +431 @@ JSON - "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:region:secretAccountId:secret:secretIdentifier" + "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:us-east-1:111122223333:secret:secretIdentifier" @@ -452 +452 @@ JSON - "Resource": "arn:aws:secretsmanager:us-east-1:accountId:secret:secretIdentifier", + "Resource": "arn:aws:secretsmanager:us-east-1:111122223333:secret:secretIdentifier", @@ -494,2 +494,2 @@ JSON - "arn:aws:cleanrooms:us-east-1:jobRunnerAccountId:membership/jobRunnerMembershipId", - "arn:aws:cleanrooms:us-east-1:analysisTemplateAccountId:membership/analysisTemplateOwnerMembershipId" + "arn:aws:cleanrooms:us-east-1:111122223333:membership/jobRunnerMembershipId", + "arn:aws:cleanrooms:us-east-1:444455556666:membership/analysisTemplateOwnerMembershipId" @@ -589,2 +589,2 @@ JSON - "arn:aws:cleanrooms:us-east-1:jobRunnerAccountId:membership/jobRunnerMembershipId", - "arn:aws:cleanrooms:us-east-1:rrAccountId:membership/rrMembershipId" + "arn:aws:cleanrooms:us-east-1:111122223333:membership/jobRunnerMembershipId", + "arn:aws:cleanrooms:us-east-1:444455556666:membership/rrMembershipId"