AWS clean-rooms medium security documentation change
Summary
Added placeholder replacement instructions for KMS keys and resource ARNs in IAM policies
Security assessment
Emphasizes proper configuration of encryption (KMS) and resource isolation to prevent accidental exposure. Highlights security requirements for Glue catalog alignment and encryption key ownership.
Diff
diff --git a/clean-rooms/latest/userguide/ml-roles.md b/clean-rooms/latest/userguide/ml-roles.md index 981a100e2..ab88fa361 100644 --- a//clean-rooms/latest/userguide/ml-roles.md +++ b//clean-rooms/latest/userguide/ml-roles.md @@ -1136,0 +1137,16 @@ JSON +###### Replace Placeholder Resource ARNs + +When using this policy, you must replace the placeholder resource identifiers with the actual ARNs of your resources: + + * **AWS KMS Key Resource** : Replace `KMS-key-ID` with the actual AWS KMS key ID that encrypts your Amazon S3 data. The key must be in the same account (111122223333) that owns the AWS Glue catalog resources. + + * **Amazon S3 Bucket Resources** : Replace `bucket-name` with the actual name of the Amazon S3 bucket that contains your AWS Glue table data. Note that Amazon S3 bucket ARNs don't include account IDs since bucket names are globally unique. + + * **AWS Glue Resources** : Replace the following placeholders with your actual resource names: + + * `Glue database name` \- The name of your AWS Glue database + + * `Glue table name` \- The name of your AWS Glue table + +All AWS Glue resources (catalog, database, and table) must be in the same AWS account (111122223333) to ensure consistent access permissions. This account should be the same one that owns the AWS KMS key used for data encryption, creating a unified security boundary for your AWS Clean Rooms data resources. +