aws-cleanrooms
aws/agent-toolkit-for-aws
Troubleshoot AWS Clean Rooms permission and logging issues for collaborations and ML jobs.
What is aws-cleanrooms?
Debugs AWS Clean Rooms collaboration failures including IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions, and CloudWatch logging. Use this when customers report permission denials, access errors, or missing logs in Clean Rooms environments.
- Diagnose IAM role policy issues (inline and managed policies)
- Analyze S3 bucket policy and cross-account access problems
- Debug KMS key policy and encryption permission failures
- Troubleshoot Lake Formation permission configurations
- Verify CloudWatch logging setup for custom ML model jobs
- Identify cross-account trust and confused deputy issues
How to install aws-cleanrooms
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill aws-cleanroomsHow to use aws-cleanrooms
- 1.Identify the failure type: permission error vs. missing CloudWatch logs
- 2.For permission errors, review IAM role policies, S3 bucket policies, KMS key policies, and Lake Formation permissions
- 3.For logging issues, verify Configured Model Algorithm Association privacy configuration and ML Configuration role permissions
- 4.Check CloudWatch log groups exist and have proper retention settings
- 5.Validate cross-account trust relationships if collaboration spans multiple AWS accounts
Use cases
- Customer reports 'Access Denied' error when accessing Clean Rooms collaboration data
- Custom ML model training job fails to publish logs to CloudWatch
- S3 bucket policy prevents data sharing across accounts in a collaboration
- KMS key permissions block encrypted data access in Clean Rooms
- Lake Formation permissions not properly configured for collaborative analytics
- AWS support engineers troubleshooting customer issues
- DevOps engineers configuring Clean Rooms collaborations
- Data engineers debugging permission failures in shared analytics
- ML engineers setting up custom model training in Clean Rooms
aws-cleanrooms FAQ
Start by reviewing the IAM role policies attached to the Clean Rooms service role, then check S3 bucket policies, KMS key policies, and Lake Formation permissions in order.
Verify the Configured Model Algorithm Association privacy configuration is correct, confirm the ML Configuration role has CloudWatch Logs permissions, and check that the log group exists.
It occurs when cross-account access is not properly restricted with conditions; use resource-based policies with explicit principal and condition restrictions to prevent it.
Yes, it covers cross-account trust relationships, S3 bucket policies for cross-account access, and KMS key policies needed for multi-account Clean Rooms setups.
Full instructions (SKILL.md)
Source of truth, from aws/agent-toolkit-for-aws.
name: aws-cleanrooms description: Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions, and CloudWatch logging for custom ML model training and inference jobs. Use when a customer reports permission failures, access errors, or log publishing issues in Clean Rooms. version: 1
AWS Clean Rooms
Overview
Domain expertise for troubleshooting AWS Clean Rooms collaborations and custom ML modeling. Covers permission debugging, data access issues, and CloudWatch logging configuration.
Common tasks
Debugging Clean Rooms errors
Determine the failure type:
Access denied or permission error? → See permission debugging procedure. Covers IAM role policies (inline + attached managed), S3 bucket policies, KMS key policies, Lake Formation permissions, and cross-account trust.
Missing CloudWatch logs for custom model jobs? → See custom model logging debugging procedure. Covers Configured Model Algorithm Association privacy configuration, ML Configuration role permissions, and log group verification.
Additional resources
Related skills
More from aws/agent-toolkit-for-aws and the wider catalog.
aws-cloudformation
Author, validate, and troubleshoot AWS CloudFormation templates with security defaults and diagnostics.
aws-compute
Provision, scale, and operate EC2 fleets with launch templates, Auto Scaling groups, and Systems Manager.
aws-containers
Deploy and manage containerized workloads on AWS EKS, ECS, Fargate, and ECR with expert guidance.
aws-database
Routes database tasks to the correct AWS service skill, with post-training updates and decision procedures.
aws-deployment
Configure AWS CI/CD pipelines with CodePipeline, CodeBuild, CodeDeploy, and CodeArtifact.
aws-iam
Verified IAM corrections and workflows for role management, policy generation, and edge-case handling.