Actions, resources, and condition keys for AWS Clean Rooms - Service Authorization Reference

Actions, resources, and condition keys for AWS Clean Rooms

AWS Clean Rooms (service prefix: cleanrooms ) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions defined by AWS Clean Rooms

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see Actions table .

Actions Description Access level Resource types (*required) Condition keys Dependent actions
BatchGetSchema Grants permission to view details for schemas Read

Collaboration*

cleanrooms:GetSchema

ConfiguredTableAssociation*

CreateCollaboration Grants permission to create a new collaboration, a shared data collaboration environment Write
CreateConfiguredTable Grants permission to create a new configured table Write

glue:BatchGetPartition

glue:GetDatabase

glue:GetDatabases

glue:GetPartition

glue:GetPartitions

glue:GetSchemaVersion

glue:GetTable

glue:GetTables

CreateConfiguredTableAnalysisRule Grants permission to create a analysis rule for a configured table Write

ConfiguredTable*

CreateConfiguredTableAssociation Grants permission to link a configured table with a collaboration by creating a new association Write

ConfiguredTable*

iam:PassRole

Membership*

CreateMembership Grants permission to join collaborations by creating a membership Write

Collaboration*

logs:CreateLogDelivery

logs:CreateLogGroup

logs:DeleteLogDelivery

logs:DescribeLogGroups

logs:DescribeResourcePolicies

logs:GetLogDelivery

logs:ListLogDeliveries

logs:PutResourcePolicy

logs:UpdateLogDelivery

DeleteCollaboration Grants permission to delete an existing collaboration Write

Collaboration*

DeleteConfiguredTable Grants permission to delete a configured table Write

ConfiguredTable*

DeleteConfiguredTableAnalysisRule Grants permission to delete an existing analysis rule Write

ConfiguredTable*

DeleteConfiguredTableAssociation Grants permission to remove a configured table association from a collaboration Write

ConfiguredTableAssociation*

DeleteMember Grants permission to delete members from a collaboration Write

Collaboration*

DeleteMembership Grants permission to leave collaborations by deleting a membership Write

Membership*

GetCollaboration Grants permission to view details for a collaboration Read

Collaboration*

GetConfiguredTable Grants permission to view details for a configured table Read

ConfiguredTable*

GetConfiguredTableAnalysisRule Grants permission to view analysis rules for a configured table Read

ConfiguredTable*

GetConfiguredTableAssociation Grants permission to view details for a configured table association Read

ConfiguredTableAssociation*

GetMembership Grants permission to view details about a membership Read

Membership*

GetProtectedQuery Grants permission to view a protected query Read

Membership*

GetSchema Grants permission to view details for a schema Read

Collaboration*

ConfiguredTableAssociation*

GetSchemaAnalysisRule Grants permission to view analysis rules associated with a schema Read

Collaboration*

ListCollaborations Grants permission to list available collaborations List
ListConfiguredTableAssociations Grants permission to list available configured table associations for a membership List

Membership*

ListConfiguredTables Grants permission to list available configured tables List
ListMembers Grants permission to list the members of a collaboration List

Collaboration*

ListMemberships Grants permission to list available memberships List
ListProtectedQueries Grants permission to list protected queries List

Membership*

ListSchemas Grants permission to view available schemas for a collaboration List

Collaboration*

StartProtectedQuery Grants permission to start protected queries Write

Membership*

cleanrooms:GetSchema

s3:GetBucketLocation

s3:ListBucket

s3:PutObject

UpdateCollaboration Grants permission to update details of the collaboration Write

Collaboration*

UpdateConfiguredTable Grants permission to update an existing configured table Write

ConfiguredTable*

UpdateConfiguredTableAnalysisRule Grants permission to update analysis rules for a configured table Write

ConfiguredTable*

UpdateConfiguredTableAssociation Grants permission to update a configured table association Write

ConfiguredTableAssociation*

iam:PassRole

UpdateMembership Grants permission to update details of a membership Write

Membership*

logs:CreateLogDelivery

logs:CreateLogGroup

logs:DeleteLogDelivery

logs:DescribeLogGroups

logs:DescribeResourcePolicies

logs:GetLogDelivery

logs:ListLogDeliveries

logs:PutResourcePolicy

logs:UpdateLogDelivery

UpdateProtectedQuery Grants permission to update protected queries Write

Membership*

Resource types defined by AWS Clean Rooms

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see Resource types table .

Resource types ARN Condition keys
Collaboration arn:$ { Partition}:cleanrooms:$ { Region}:$ { Account}:collaboration/$ { CollaborationId}
ConfiguredTable arn:$ { Partition}:cleanrooms:$ { Region}:$ { Account}:configuredtable/$ { ConfiguredTableId}
ConfiguredTableAssociation arn:$ { Partition}:cleanrooms:$ { Region}:$ { Account}:membership/$ { MembershipId}/configuredtableassociation/$ { ConfiguredTableAssociationId}
Membership arn:$ { Partition}:cleanrooms:$ { Region}:$ { Account}:membership/$ { MembershipId}

Condition keys for AWS Clean Rooms

Clean Rooms has no service-specific context keys that can be used in the Condition element of policy statements. For the list of the global context keys that are available to all services, see Available keys for conditions .