AWS clean-rooms medium security documentation change

Service: clean-rooms · 2025-08-16 · Security-related medium

File: clean-rooms/latest/userguide/ml-behaviors.md

Summary

Added cross-account configuration notes for AWS Clean Rooms ML resource policies

Security assessment

Added explicit guidance about account separation, collaboration ID conditions, and resource ownership to enforce security boundaries in ML workflows. Includes security-focused configuration requirements for access control.

Diff

diff --git a/clean-rooms/latest/userguide/ml-behaviors.md b/clean-rooms/latest/userguide/ml-behaviors.md
index 63269b72b..62d284c3b 100644
--- a//clean-rooms/latest/userguide/ml-behaviors.md
+++ b//clean-rooms/latest/userguide/ml-behaviors.md
@@ -53,0 +54,24 @@ JSON
+###### Note
+
+This AWS Clean Rooms ML resource policy references two different AWS account IDs to support cross-account audience generation:
+
+  * **111122223333** \- This is the account that contains the principal (user, role, or service) authorized to start audience generation jobs. This account initiates the ML processing workflow.
+
+  * **444455556666** \- This is the account that owns the AWS Clean Rooms ML resources (the configured audience model and audience generation jobs). This account hosts the ML models and manages the job execution.
+
+
+
+
+**Additional Configuration Notes:**
+
+  * **Statement ID (Sid)** : Replace `CAMA-ID` with your actual AWS Clean Rooms Audience Model Application (CAMA) identifier to make the policy statement easily identifiable.
+
+  * **Resource IDs** : Replace `id` with the actual ID of your configured audience model, and `UUID` with your specific collaboration ID.
+
+  * **Condition** : The `cleanrooms-ml:CollaborationId` condition ensures that audience generation jobs can only be started within the context of the specified AWS Clean Rooms collaboration, providing an additional security boundary.
+
+
+
+
+This cross-account configuration enables scenarios where one organization manages the ML models and infrastructure while allowing authorized partners to initiate audience generation processes within the bounds of their collaboration agreement.
+