Cleanrooms Diagnostics

Clean Rooms Diagnostics

When to use

Any Clean Rooms investigation where the console alone is insufficient — collaboration setup, table configuration, analysis rules, query execution, privacy controls, ML features, or access control issues.

Investigation workflow

Step 1 — Collect and triage

aws cleanrooms list-collaborations
aws cleanrooms list-memberships
aws cleanrooms get-collaboration --collaboration-identifier <id>
aws cleanrooms get-membership --membership-identifier <id>
aws cleanrooms list-configured-tables

Step 2 — Deep dive

aws cleanrooms get-configured-table --configured-table-identifier <id>
aws cleanrooms get-configured-table-analysis-rule --configured-table-identifier <id> --analysis-rule-type <AGGREGATION|LIST|CUSTOM>
aws cleanrooms list-configured-table-associations --membership-identifier <id>
aws cleanrooms list-protected-queries --membership-identifier <id>
aws cleanrooms get-protected-query --membership-identifier <id> --protected-query-identifier <query-id>
aws cleanrooms get-collaboration-privacy-budget-template --collaboration-identifier <id> --privacy-budget-template-identifier <template-id>
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=cleanrooms.amazonaws.com --max-results 20

Read references/guardrails.md before concluding on any Clean Rooms issue.

Tool quick reference

Gotchas: Clean Rooms

• Collaborations require at least two members: A collaboration must have at least two member accounts. A single account cannot create a collaboration with itself for testing — use two separate AWS accounts.
• Analysis rules restrict query capabilities: Each configured table must have an analysis rule (AGGREGATION, LIST, or CUSTOM) that defines what queries are allowed. Without an analysis rule, the table cannot be queried.
• Configured tables reference Glue Data Catalog: Tables must be registered in the Glue Data Catalog before they can be configured in Clean Rooms. Missing Glue tables cause configuration failures.
• Query results go to the member who can receive results: Only members with the CAN_RECEIVE_RESULTS ability can receive query output. The output S3 bucket must be in the same account as the receiving member.
• Differential privacy has a budget: Differential privacy uses a privacy budget that depletes with each query. Once exhausted, no more queries can run until the budget is refreshed. Monitor budget consumption.
• Cryptographic computing requires specific setup: Clean Rooms cryptographic computing requires client-side encryption of data before upload. It uses specific encryption schemas and cannot be enabled retroactively on existing tables.
• ML features are separate from core Clean Rooms: Clean Rooms ML (lookalike modeling, etc.) uses a separate API (cleanrooms-ml) and has its own permissions and configuration requirements.
• Cross-account data never leaves the owner's account: Clean Rooms processes queries without moving raw data between accounts. Only aggregated or filtered results are shared. This is a fundamental design principle.

Anti-hallucination rules

1. Always cite specific collaboration IDs, membership IDs, or API responses as evidence.
2. Collaborations need at least two members — never suggest single-account collaborations.
3. Analysis rules are required — never claim tables can be queried without them.
4. Raw data never leaves the owner's account — never suggest data is copied between accounts.
5. Differential privacy budget depletes — never claim unlimited queries with differential privacy.
6. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.

18 runbooks