Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Clean Rooms ML

AWS Clean Rooms ML (service prefix: cleanrooms-ml) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Clean Rooms ML
Actions defined by AWS Clean Rooms ML
Resource types defined by AWS Clean Rooms ML
Condition keys for AWS Clean Rooms ML

API operations defined by AWS Clean Rooms ML

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CancelTrainedModel	cleanrooms-ml:CancelTrainedModel			Write
CancelTrainedModelInferenceJob	cleanrooms-ml:CancelTrainedModelInferenceJob			Write
CreateAudienceModel	cleanrooms-ml:CreateAudienceModel			Write
CreateAudienceModel	cleanrooms-ml:TagResource			Tagging, Write
CreateConfiguredAudienceModel	cleanrooms-ml:CreateConfiguredAudienceModel			Write
	cleanrooms-ml:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cleanrooms-ml.amazonaws.com	Write
CreateConfiguredModelAlgorithm	cleanrooms-ml:CreateConfiguredModelAlgorithm			Write
	cleanrooms-ml:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cleanrooms-ml.amazonaws.com	Write
CreateConfiguredModelAlgorithmAssociation	cleanrooms-ml:CreateConfiguredModelAlgorithmAssociation			Write
CreateConfiguredModelAlgorithmAssociation	cleanrooms-ml:TagResource			Tagging, Write
CreateMLInputChannel	cleanrooms-ml:CreateMLInputChannel			Write
	cleanrooms-ml:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cleanrooms-ml.amazonaws.com	Write
CreateTrainedModel	cleanrooms-ml:CreateTrainedModel			Write
CreateTrainedModel	cleanrooms-ml:TagResource			Tagging, Write
CreateTrainingDataset	cleanrooms-ml:CreateTrainingDataset			Write
	cleanrooms-ml:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cleanrooms-ml.amazonaws.com	Write
DeleteAudienceGenerationJob	cleanrooms-ml:DeleteAudienceGenerationJob			Write
DeleteAudienceModel	cleanrooms-ml:DeleteAudienceModel			Write
DeleteConfiguredAudienceModel	cleanrooms-ml:DeleteConfiguredAudienceModel			Write
DeleteConfiguredAudienceModelPolicy	cleanrooms-ml:DeleteConfiguredAudienceModelPolicy			Write
DeleteConfiguredModelAlgorithm	cleanrooms-ml:DeleteConfiguredModelAlgorithm			Write
DeleteConfiguredModelAlgorithmAssociation	cleanrooms-ml:DeleteConfiguredModelAlgorithmAssociation			Write
DeleteMLConfiguration	cleanrooms-ml:DeleteMLConfiguration			Write
DeleteMLInputChannelData	cleanrooms-ml:DeleteMLInputChannelData			Write
DeleteTrainedModelOutput	cleanrooms-ml:DeleteTrainedModelOutput			Write
DeleteTrainingDataset	cleanrooms-ml:DeleteTrainingDataset			Write
GetAudienceGenerationJob	cleanrooms-ml:GetAudienceGenerationJob			Read
GetAudienceModel	cleanrooms-ml:GetAudienceModel			Read
GetCollaborationConfiguredModelAlgorithmAssociation	cleanrooms-ml:GetCollaborationConfiguredModelAlgorithmAssociation			Read
GetCollaborationMLInputChannel	cleanrooms-ml:GetCollaborationMLInputChannel			Read
GetCollaborationTrainedModel	cleanrooms-ml:GetCollaborationTrainedModel			Read
GetConfiguredAudienceModel	cleanrooms-ml:GetConfiguredAudienceModel			Read
GetConfiguredAudienceModelPolicy	cleanrooms-ml:GetConfiguredAudienceModelPolicy			Read
GetConfiguredModelAlgorithm	cleanrooms-ml:GetConfiguredModelAlgorithm			Read
GetConfiguredModelAlgorithmAssociation	cleanrooms-ml:GetConfiguredModelAlgorithmAssociation			Read
GetMLConfiguration	cleanrooms-ml:GetMLConfiguration			Read
GetMLInputChannel	cleanrooms-ml:GetMLInputChannel			Read
GetTrainedModel	cleanrooms-ml:GetTrainedModel			Read
GetTrainedModelInferenceJob	cleanrooms-ml:GetTrainedModelInferenceJob			Read
GetTrainingDataset	cleanrooms-ml:GetTrainingDataset			Read
ListAudienceExportJobs	cleanrooms-ml:ListAudienceExportJobs			List
ListAudienceGenerationJobs	cleanrooms-ml:ListAudienceGenerationJobs			List
ListAudienceModels	cleanrooms-ml:ListAudienceModels			List
ListCollaborationConfiguredModelAlgorithmAssociations	cleanrooms-ml:ListCollaborationConfiguredModelAlgorithmAssociations			List
ListCollaborationMLInputChannels	cleanrooms-ml:ListCollaborationMLInputChannels			List
ListCollaborationTrainedModelExportJobs	cleanrooms-ml:ListCollaborationTrainedModelExportJobs			List
ListCollaborationTrainedModelInferenceJobs	cleanrooms-ml:ListCollaborationTrainedModelInferenceJobs			List
ListCollaborationTrainedModels	cleanrooms-ml:ListCollaborationTrainedModels			List
ListConfiguredAudienceModels	cleanrooms-ml:ListConfiguredAudienceModels			List
ListConfiguredModelAlgorithmAssociations	cleanrooms-ml:ListConfiguredModelAlgorithmAssociations			List
ListConfiguredModelAlgorithms	cleanrooms-ml:ListConfiguredModelAlgorithms			List
ListMLInputChannels	cleanrooms-ml:ListMLInputChannels			List
ListTagsForResource	cleanrooms-ml:ListTagsForResource			List
ListTrainedModelInferenceJobs	cleanrooms-ml:ListTrainedModelInferenceJobs			List
ListTrainedModelVersions	cleanrooms-ml:ListTrainedModelVersions			List
ListTrainedModels	cleanrooms-ml:ListTrainedModels			List
ListTrainingDatasets	cleanrooms-ml:ListTrainingDatasets			List
PutConfiguredAudienceModelPolicy	cleanrooms-ml:PutConfiguredAudienceModelPolicy			Permissions management, Write
PutMLConfiguration	cleanrooms-ml:PutMLConfiguration			Write
PutMLConfiguration	iam:PassRole	iam:PassedToService	cleanrooms-ml.amazonaws.com	Write
StartAudienceExportJob	cleanrooms-ml:StartAudienceExportJob			Write
StartAudienceGenerationJob	cleanrooms-ml:StartAudienceGenerationJob			Write
	cleanrooms-ml:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cleanrooms-ml.amazonaws.com	Write
StartTrainedModelExportJob	cleanrooms-ml:StartTrainedModelExportJob			Write
StartTrainedModelInferenceJob	cleanrooms-ml:StartTrainedModelInferenceJob			Write
StartTrainedModelInferenceJob	cleanrooms-ml:TagResource			Tagging, Write
TagResource	cleanrooms-ml:TagResource			Tagging, Write
UntagResource	cleanrooms-ml:UnTagResource			Tagging, Write
UpdateConfiguredAudienceModel	cleanrooms-ml:UpdateConfiguredAudienceModel			Write
UpdateConfiguredAudienceModel	iam:PassRole	iam:PassedToService	cleanrooms-ml.amazonaws.com	Write

Actions defined by AWS Clean Rooms ML

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CancelTrainedModel	Grants permission to cancel a trained model	TrainedModel*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CancelTrainedModelInferenceJob	Grants permission to cancel a trained model inference job	TrainedModelInferenceJob*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAudienceModel	Grants permission to create an audience model	trainingdataset*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConfiguredAudienceModel	Grants permission to create a configured audience model	audiencemodel*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConfiguredModelAlgorithm	Grants permission to create a configured model algorithm		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateConfiguredModelAlgorithmAssociation	Grants permission to create a configured model algorithm association	ConfiguredModelAlgorithm*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateMLInputChannel	Grants permission to create an ML input channel	ConfiguredModelAlgorithmAssociation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTrainedModel	Grants permission to create a trained model	ConfiguredModelAlgorithmAssociation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTrainingDataset	Grants permission to create a training dataset, or seed audience. In Clean Rooms ML, the TrainingDataset is metadata that points to a Glue table, which is read only during AudienceModel creation		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteAudienceGenerationJob	Grants permission to delete the specified audience generation job, and removes all data associated with the job	audiencegenerationjob*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAudienceModel	Grants permission to delete the specified audience generation job, and removes all data associated with the job	audiencemodel*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteConfiguredAudienceModel	Grants permission to delete the specified configured audience model	configuredaudiencemodel*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteConfiguredAudienceModelPolicy	Grants permission to delete the specified configured audience model policy