cleanrooms:StartProtectedQuery
Write cleanrooms:StartProtectedQuery is
a Write
access-level action in the
cleanrooms
service.
Grants permission to start protected queries
Resource types
ARNs that cleanrooms:StartProtectedQuery can be scoped to in an IAM policy.
arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}
membership arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}/analysistemplate/${AnalysisTemplateId}
analysistemplate arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}/configuredtableassociation/${ConfiguredTableAssociationId}
configuredtableassociation arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}/idmappingtable/${IdMappingTableId}
idmappingtable arn:${Partition}:cleanrooms:${Region}:${Account}:membership/${MembershipId}/intermediatetable/${IntermediateTableId}
intermediatetable Condition keys
Keys you can use in the Condition block of a policy that
grants cleanrooms:StartProtectedQuery.
aws:ResourceTag/${TagKey} String
Filters access by the tags associated with the resource
Dependent actions
To use cleanrooms:StartProtectedQuery you may also need to grant:
Example IAM policy
A minimal policy that allows cleanrooms:StartProtectedQuery. Replace
"Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCleanroomsStartProtectedQuery",
"Effect": "Allow",
"Action": "cleanrooms:StartProtectedQuery",
"Resource": "*"
}
]
}