AWSCleanRoomsReadOnlyAccess

Summary

Allows read-only access to AWS Clean Rooms resources and read-only access to related AWS Glue and Amazon CloudWatch Logs resources. The AWS Clean Rooms User Guide says it grants read-only permissions to resources and metadata in a collaboration.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AWSCleanRoomsReadOnlyAccessCopy ARN

Default version

v1

Created

2023-01-12

Last edited

2023-01-12

Services

cleanrooms, glue, logs

Control-plane actions (61)

By access level: 24 List, 37 Read.

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants read access plus query or analysis actions that expose data.

Guidance

Related policies

Same service

• AmazonAthenaFullAccess
• AmazonDataZoneEnvironmentRolePermissionsBoundary
• AmazonDataZoneGlueManageAccessRolePolicy
• AmazonDataZonePreviewConsoleFullAccess
• AmazonDataZoneProjectRolePermissionsBoundary
• AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
• AmazonDataZoneSageMakerProvisioningRolePolicy
• AmazonGrafanaAthenaAccess

Same domain

• AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicy
• AmazonChimeSDKMessagingServiceRolePolicy
• AmazonDataZoneDomainExecutionRolePolicy
• AmazonDataZoneFullAccess
• AmazonDataZoneFullUserAccess
• AmazonDataZoneRedshiftGlueProvisioningPolicy
• AmazonDataZoneRedshiftManageAccessRolePolicy
• AmazonElasticMapReduceforAutoScalingRole

Frequently asked questions

When should I attach AWSCleanRoomsReadOnlyAccess?

The AWS Clean Rooms User Guide says you can attach AWSCleanRoomsReadOnlyAccess to your IAM principals, and that it grants read-only permissions to resources and metadata in a collaboration. Attach it where viewing AWS Clean Rooms is the intended scope.

What does AWSCleanRoomsReadOnlyAccess grant?

It allows cleanrooms:BatchGet*, cleanrooms:Get* and cleanrooms:List* on all resources, nine read-only glue actions, logs:StartQuery on log groups starting with /aws/cleanrooms and logs:GetQueryResults.

What are the security risks of AWSCleanRoomsReadOnlyAccess?

It grants no cleanrooms write actions, but its read access applies to all resources and it can run and read CloudWatch Logs queries. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CleanRoomsRead",
      "Effect": "Allow",
      "Action": [
        "cleanrooms:BatchGet*",
        "cleanrooms:Get*",
        "cleanrooms:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ConsoleDisplayTables",
      "Effect": "Allow",
      "Action": [
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:GetTable",
        "glue:GetTables",
        "glue:GetPartition",
        "glue:GetPartitions",
        "glue:GetSchema",
        "glue:GetSchemaVersion",
        "glue:BatchGetPartition"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ConsoleLogSummaryQueryLogs",
      "Effect": "Allow",
      "Action": [
        "logs:StartQuery"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/cleanrooms*"
    },
    {
      "Sid": "ConsoleLogSummaryObtainLogs",
      "Effect": "Allow",
      "Action": [
        "logs:GetQueryResults"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v1, edited by AWS on 2023-01-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSCleanRoomsReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSCleanRoomsReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSCleanRoomsReadOnlyAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCleanRoomsReadOnlyAccess

resource "aws_iam_role_policy_attachment" "awscleanroomsreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSCleanRoomsReadOnlyAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSCleanRoomsReadOnlyAccess"),
);

Sources

• AWSCleanRoomsReadOnlyAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, useCases, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for AWS Clean Rooms (AWS Clean Rooms User Guide) (retrieved 2026-11-13; supports summary, useCases, assignmentGuidance, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)

• Official AWS reference for AWSCleanRoomsReadOnlyAccess
• AWS service guide
• Report a data issue