Set up service roles for lookalike modeling Set up service roles for custom modeling

Set up service roles for AWS Clean Rooms ML

The roles needed to perform lookalike modeling differ from those needed to use a custom model. The following sections describe the roles needed to perform each task.

Topics

Set up service roles for lookalike modeling
Set up service roles for custom modeling

Set up service roles for lookalike modeling

Topics

Create a service role to read training data
Create a service role to write a lookalike segment
Create a service role to read seed data

Create a service role to read training data

AWS Clean Rooms uses a service role to read training data. You can create this role using the console if you have the necessary IAM permissions. If you don't have CreateRole permissions, ask your administrator to create the service role.

To create a service role to train a dataset

Sign in to the IAM console (https://console.aws.amazon.com/iam/) with your administrator account.
Under Access management, choose Policies.
Choose Create policy.

In the Policy editor, select the JSON tab, and then copy and paste the following policy.

Note

The following example policy supports the permissions needed to read AWS Glue metadata and its corresponding Amazon S3 data. However, you might need to modify this policy depending on how you've set up your S3 data. This policy doesn't include a KMS key to decrypt data.

Your AWS Glue resources and underlying Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms collaboration.

If you need to use a KMS key to decrypt data, add this AWS KMS statement to the previous template:


{
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
            ],
            "Resource": [
                "arn:aws:kms:region:accountId:key/keyId"
            ],
            "Condition": {
                "ArnLike": {
                        "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::bucketFolders*"
                }
            }
        }
    ]
}

Replace each placeholder with your own information:
- region – The name of the AWS Region. For example, us-east-1.
- accountId – The AWS account ID in which the S3 bucket is located.
- database/databases, table/databases/tables, catalog, and database/default – The location of the training data that AWS Clean Rooms needs to access.
- bucket – The Amazon Resource Name (ARN) of the S3 bucket. The Amazon Resource Name (ARN) can be found on the Properties tab of the bucket in Amazon S3.
- bucketFolders – The name of specific folders in the S3 bucket that AWS Clean Rooms needs to access.
Choose Next.
For Review and create, enter a Policy name and Description, and review the Summary.
Choose Create policy.

You have created a policy for AWS Clean Rooms.
Under Access management, choose Roles.

With Roles, you can create short-term credentials, which is recommended for increased security. You can also choose Users to create long-term credentials.
Choose Create role.
In the Create role wizard, for Trusted entity type, choose Custom trust policy.

Copy and paste the following custom trust policy into the JSON editor.

The SourceAccount is always your AWS account. The SourceArn can be limited to a specific training dataset, but only after that dataset is created. Because you don't yet know the training dataset ARN, the wildcard is specified here.

accountId is the ID of AWS account that contains the training data.

Choose Next and under Add permissions, enter the name of the policy you just created. (You might need to reload the page.)
Select the check box next to the name of the policy you created, and then choose Next.
For Name, review, and create, enter the Role name and Description.

Note
The Role name must match the pattern in the passRole permissions granted to the member who can query and receive results and member roles.
1. Review Select trusted entities, and edit if necessary.
2. Review the permissions in Add permissions, and edit if necessary.
3. Review the Tags, and add tags if necessary.
4. Choose Create role.

You have created the service role for AWS Clean Rooms.

Create a service role to write a lookalike segment

AWS Clean Rooms uses a service role to write lookalike segments to a bucket. You can create this role using the console if you have the necessary IAM permissions. If you don't have CreateRole permissions, ask your administrator to create the service role.

To create a service role to write a lookalike segment

Sign in to the IAM console (https://console.aws.amazon.com/iam/) with your administrator account.
Under Access management, choose Policies.
Choose Create policy.

In the Policy editor, select the JSON tab, and then copy and paste the following policy.

Note

The following example policy supports the permissions needed to read AWS Glue metadata and its corresponding Amazon S3 data. However, you might need to modify this policy depending on how you've set up your Amazon S3 data. This policy doesn't include a KMS key to decrypt data.

Your AWS Glue resources and underlying Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms collaboration.

If you need to use a KMS key to encrypt data, add this AWS KMS statement to the template:


{
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:GenerateDataKey*",
                "kms:ReEncrypt*",
            ],
            "Resource": [
                "arn:aws:kms:region:accountId:key/keyId"
            ],
            "Condition": {
                "ArnLike": {
                        "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::bucketFolders*"
                }
            }
        }
  ]
}

Replace each placeholder with your own information:
- buckets – The Amazon Resource Name (ARN) of the S3 bucket. The Amazon Resource Name (ARN) can be found on the Properties tab of the bucket in Amazon S3.
- accountId – The AWS account ID in which the S3 bucket is located.
- bucketFolders – The name of specific folders in the S3 bucket that AWS Clean Rooms needs to access.
- region – The name of the AWS Region. For example, us-east-1.
- keyId – The KMS key needed to encrypt your data.
Choose Next.
For Review and create, enter a Policy name and Description, and review the Summary.
Choose Create policy.

You have created a policy for AWS Clean Rooms.
Under Access management, choose Roles.

With Roles, you can create short-term credentials, which is recommended for increased security. You can also choose Users to create long-term credentials.
Choose Create role.
In the Create role wizard, for Trusted entity type, choose Custom trust policy.

Copy and paste the following custom trust policy into the JSON editor.

Choose Next.
Select the check box next to the name of the policy you created, and then choose Next.
For Name, review, and create, enter the Role name and Description.

Note
The Role name must match the pattern in the passRole permissions granted to the member who can query and receive results and member roles.
1. Review Select trusted entities, and edit if necessary.
2. Review the permissions in Add permissions, and edit if necessary.
3. Review the Tags, and add tags if necessary.
4. Choose Create role.

You have created the service role for AWS Clean Rooms.

Create a service role to read seed data

AWS Clean Rooms uses a service role to read seed data. You can create this role using the console if you have the necessary IAM permissions. If you don't have CreateRole permissions, ask your administrator to create the service role.

To create a service role to read seed data that is stored in an S3 bucket.

Sign in to the IAM console (https://console.aws.amazon.com/iam/) with your administrator account.
Under Access management, choose Policies.
Choose Create policy.

In the Policy editor, select the JSON tab, and then copy and paste one of the following policies.

Note

The following example policy supports the permissions needed to read AWS Glue metadata and its corresponding Amazon S3 data. However, you might need to modify this policy depending on how you've set up your Amazon S3 data. This policy doesn't include a KMS key to decrypt data.

Your AWS Glue resources and underlying Amazon S3 resources must be in the same AWS Region as the AWS Clean Rooms collaboration.

Note

The following example policy supports the permissions needed to read the results of an SQL query and use that as the input data. However, you might need to modify this policy depending on how your query is structured. This policy doesn't include a KMS key to decrypt data.

If you need to use a KMS key to decrypt data, add this AWS KMS statement to the template:


{
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey"
            ],
            "Resource": [
                "arn:aws:kms:region:accountId:key/keyId"
            ],
            "Condition": {
                "ArnLike": {
                        "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::bucketFolders*"
                }
            }
        }
  ]
}

Replace each placeholder with your own information:
- buckets – The Amazon Resource Name (ARN) of the S3 bucket. The Amazon Resource Name (ARN) can be found on the Properties tab of the bucket in Amazon S3.
- accountId – The AWS account ID in which the S3 bucket is located.
- bucketFolders – The name of specific folders in the S3 bucket that AWS Clean Rooms needs to access.
- region – The name of the AWS Region. For example, us-east-1.
- queryRunnerAccountId – The AWS account ID of the account that will run queries.
- queryRunnerMembershipId – The Membership ID of the member who can query. The Membership ID can be found on the Details tab of the collaboration. This ensures that AWS Clean Rooms is assuming the role only when this member runs the analysis in this collaboration.
- keyId – The KMS key needed to encrypt your data.
Choose Next.
For Review and create, enter a Policy name and Description, and review the Summary.
Choose Create policy.

You have created a policy for AWS Clean Rooms.
Under Access management, choose Roles.