AWS clean-rooms medium security documentation change

Service: clean-rooms · 2026-02-19 · Security-related medium

File: clean-rooms/latest/userguide/setting-up-roles.md

Summary

Updated IAM policy examples to support federated catalogs, added S3 resource account condition, and removed KMS permissions

Security assessment

The added 'aws:ResourceAccount' condition for S3 access prevents cross-account access, improving security. Removal of KMS permissions may impact encryption controls.

Diff

diff --git a/clean-rooms/latest/userguide/setting-up-roles.md b/clean-rooms/latest/userguide/setting-up-roles.md
index 75958deb1..afb138998 100644
--- a//clean-rooms/latest/userguide/setting-up-roles.md
+++ b//clean-rooms/latest/userguide/setting-up-roles.md
@@ -264,8 +263,0 @@ The following example policy supports the permissions needed to read AWS Glue me
-Your AWS Glue resources and underlying Athena resources must be in the same AWS Region as the AWS Clean Rooms collaboration.
-
-JSON
-    
-
-****
-    
-    
@@ -278 +269,0 @@ JSON
-                    "athena:GetDataCatalog",
@@ -280,0 +272,2 @@ JSON
+                    "athena:GetDataCatalog",
+                    "athena:StartQueryExecution",
@@ -282,2 +275 @@ JSON
-                    "athena:GetQueryResults",
-                    "athena:StartQueryExecution"
+                    "athena:GetQueryResults"
@@ -286,2 +278,2 @@ JSON
-                    "arn:aws:athena:us-east-1:111122223333:workgroup/workgroup",
-                    "arn:aws:athena:us-east-1:111122223333:datacatalog/AwsDataCatalog"
+                    "arn:aws:athena:region:accountId:workgroup/workgroup",
+                    "arn:aws:athena:region:accountId:datacatalog/federatedCatalogName"
@@ -295 +287 @@ JSON
-                    "glue:GetPartitions"
+                    "glue:GetCatalog"
@@ -298,3 +290,4 @@ JSON
-                    "arn:aws:glue:us-east-1:111122223333:catalog",
-                    "arn:aws:glue:us-east-1:111122223333:database/database name",
-                    "arn:aws:glue:us-east-1:111122223333:table/database name/table name"
+                    "arn:aws:glue:region:accountId:catalog",
+                    "arn:aws:glue:region:accountId:catalog/federatedCatalogName",
+                    "arn:aws:glue:region:accountId:database/federatedCatalogName/databaseName",
+                    "arn:aws:glue:region:accountId:table/federatedCatalogName/databaseName/tableName"
@@ -314,3 +307,8 @@ JSON
-                    "arn:aws:s3:::bucket",
-                    "arn:aws:s3:::bucket/*"
-                ]
+                    "arn:aws:s3:::athenaResultsBucket",
+                    "arn:aws:s3:::athenaResultsBucket/*"
+                ],
+                "Condition": {
+                    "StringEquals": {
+                        "aws:ResourceAccount": "accountId"
+                    }
+                }
@@ -322,8 +319,0 @@ JSON
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "kms:GenerateDataKey",
-                    "kms:Decrypt"
-                ],
-                "Resource": "arn:aws:kms:us-east-1:111122223333:key/*"
@@ -344 +333 @@ JSON
-If you query resources protected with Lake Formation permissions, the service role must have **Select** and **Describe** access permissions on the table/view and **Describe** permissions on the AWS Glue database the view is stored in. 
+If you query resources protected with Lake Formation permissions, the service role must have **Select** and **Describe** access permissions on the table/view/catalog and **Describe** permissions on the AWS Glue database.