AWSCleanRoomsMLReadOnlyAccess

ReaderAWS managedActivePermissions reviewedShow on map Compare

Summary

Allows read-only access to AWS Clean Rooms ML resources and read-only access to related AWS Clean Rooms resources

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AWSCleanRoomsMLReadOnlyAccess
Default version: v4
Created: 2023-11-29
Last edited: 2026-02-12
Services: cleanrooms, cleanrooms-ml

Control-plane actions (47)

By access level: 28 List, 19 Read.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
Clean Rooms	16 of 107	11 List, 5 Read; 0 restricted, 0 conditional	cleanrooms:GetCollaboration, cleanrooms:GetConfiguredAudienceModelAssociation, cleanrooms:GetMembership, cleanrooms:ListAnalysisTemplates, cleanrooms:ListCollaborationAnalysisTemplates, cleanrooms:ListCollaborationConfiguredAudienceModelAssociations, cleanrooms:ListCollaborations, cleanrooms:ListConfiguredTableAssociations, cleanrooms:ListConfiguredTables, cleanrooms:ListMembers, cleanrooms:ListMemberships, cleanrooms:ListProtectedQueries and 4 more
Clean Rooms ML	31 of 59	17 List, 14 Read; 0 restricted, 0 conditional	cleanrooms-ml:Get, cleanrooms-ml:List

Clean Rooms: 16 actions

cleanrooms:GetCollaboration (Read)
cleanrooms:GetConfiguredAudienceModelAssociation (Read)
cleanrooms:GetMembership (Read)
cleanrooms:ListAnalysisTemplates (List)
cleanrooms:ListCollaborationAnalysisTemplates (List)
cleanrooms:ListCollaborationConfiguredAudienceModelAssociations (List)
cleanrooms:ListCollaborations (List)
cleanrooms:ListConfiguredTableAssociations (List)
cleanrooms:ListConfiguredTables (List)
cleanrooms:ListMembers (List)
cleanrooms:ListMemberships (List)
cleanrooms:ListProtectedQueries (List)
cleanrooms:ListSchemas (List)
cleanrooms:ListTagsForResource (List)
cleanrooms:PassCollaboration (Read)
cleanrooms:PassMembership (Read)

Clean Rooms ML: 31 actions

cleanrooms-ml:GetAudienceGenerationJob (Read)
cleanrooms-ml:GetAudienceModel (Read)
cleanrooms-ml:GetCollaborationConfiguredModelAlgorithmAssociation (Read)
cleanrooms-ml:GetCollaborationMLInputChannel (Read)
cleanrooms-ml:GetCollaborationTrainedModel (Read)
cleanrooms-ml:GetConfiguredAudienceModel (Read)
cleanrooms-ml:GetConfiguredAudienceModelPolicy (Read)
cleanrooms-ml:GetConfiguredModelAlgorithm (Read)
cleanrooms-ml:GetConfiguredModelAlgorithmAssociation (Read)
cleanrooms-ml:GetMLConfiguration (Read)
cleanrooms-ml:GetMLInputChannel (Read)
cleanrooms-ml:GetTrainedModel (Read)
cleanrooms-ml:GetTrainedModelInferenceJob (Read)
cleanrooms-ml:GetTrainingDataset (Read)
cleanrooms-ml:ListAudienceExportJobs (List)
cleanrooms-ml:ListAudienceGenerationJobs (List)
cleanrooms-ml:ListAudienceModels (List)
cleanrooms-ml:ListCollaborationConfiguredModelAlgorithmAssociations (List)
cleanrooms-ml:ListCollaborationMLInputChannels (List)
cleanrooms-ml:ListCollaborationTrainedModelExportJobs (List)
cleanrooms-ml:ListCollaborationTrainedModelInferenceJobs (List)
cleanrooms-ml:ListCollaborationTrainedModels (List)
cleanrooms-ml:ListConfiguredAudienceModels (List)
cleanrooms-ml:ListConfiguredModelAlgorithmAssociations (List)
cleanrooms-ml:ListConfiguredModelAlgorithms (List)
cleanrooms-ml:ListMLInputChannels (List)
cleanrooms-ml:ListTagsForResource (List)
cleanrooms-ml:ListTrainedModelInferenceJobs (List)
cleanrooms-ml:ListTrainedModelVersions (List)
cleanrooms-ml:ListTrainedModels (List)
cleanrooms-ml:ListTrainingDatasets (List)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants only List and Read actions.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CleanRoomsConsoleNavigation",
      "Effect": "Allow",
      "Action": [
        "cleanrooms:GetCollaboration",
        "cleanrooms:GetConfiguredAudienceModelAssociation",
        "cleanrooms:GetMembership",
        "cleanrooms:ListAnalysisTemplates",
        "cleanrooms:ListCollaborationAnalysisTemplates",
        "cleanrooms:ListCollaborationConfiguredAudienceModelAssociations",
        "cleanrooms:ListCollaborations",
        "cleanrooms:ListConfiguredTableAssociations",
        "cleanrooms:ListConfiguredTables",
        "cleanrooms:ListMembers",
        "cleanrooms:ListMemberships",
        "cleanrooms:ListProtectedQueries",
        "cleanrooms:ListSchemas",
        "cleanrooms:ListTagsForResource"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CleanRoomsMLRead",
      "Effect": "Allow",
      "Action": [
        "cleanrooms-ml:Get*",
        "cleanrooms-ml:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "PassCleanRoomsResources",
      "Effect": "Allow",
      "Action": [
        "cleanrooms:PassMembership",
        "cleanrooms:PassCollaboration"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v4, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSCleanRoomsMLReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSCleanRoomsMLReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSCleanRoomsMLReadOnlyAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCleanRoomsMLReadOnlyAccess

Terraform

resource "aws_iam_role_policy_attachment" "awscleanroomsmlreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSCleanRoomsMLReadOnlyAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSCleanRoomsMLReadOnlyAccess"),
);

Sources

Pending editorial review. No editorial sources are listed yet.