> **aws-cleanrooms** — chapter 46 of 120 in [aws/agent-toolkit-for-aws](https://skillsdocs.com/aws/agent-toolkit-for-aws).
>
> Book (all chapters, one file): https://skillsdocs.com/aws/agent-toolkit-for-aws.md
> Machine manifest: https://skillsdocs.com/aws/agent-toolkit-for-aws/.well-known/agent-skills/index.json
> Install the book: `npx skills add aws/agent-toolkit-for-aws`
> Upstream: https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/analytics-skills/aws-cleanrooms/SKILL.md @ `main`
> Raw bytes, no header: https://raw.githubusercontent.com/aws/agent-toolkit-for-aws/main/skills/specialized-skills/analytics-skills/aws-cleanrooms/SKILL.md
> Base for relative paths: https://raw.githubusercontent.com/aws/agent-toolkit-for-aws/main/skills/specialized-skills/analytics-skills/aws-cleanrooms/
> Licence: Apache-2.0 — https://spdx.org/licenses/Apache-2.0.html
>
> Bundled files (2), referenced from this skill's directory:
>   - `references/custom-model-logging-debugging.md` — https://raw.githubusercontent.com/aws/agent-toolkit-for-aws/main/skills/specialized-skills/analytics-skills/aws-cleanrooms/references/custom-model-logging-debugging.md
>   - `references/permission-debugging.md` — https://raw.githubusercontent.com/aws/agent-toolkit-for-aws/main/skills/specialized-skills/analytics-skills/aws-cleanrooms/references/permission-debugging.md
>
> Content © its authors, served unmodified. Takedown: https://github.com/kyleledbetter/skillsdocs/issues/new?labels=takedown&title=Takedown+request

<!-- Verbatim upstream SKILL.md follows, YAML frontmatter included. -->

---
name: aws-cleanrooms
description: Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions, and CloudWatch logging for custom ML model training and inference jobs. Use when a customer reports permission failures, access errors, or log publishing issues in Clean Rooms.
version: 1
---
# AWS Clean Rooms

## Overview

Domain expertise for troubleshooting AWS Clean Rooms collaborations and custom ML modeling. Covers permission debugging, data access issues, and CloudWatch logging configuration.

## Common tasks

### Debugging Clean Rooms errors

Determine the failure type:

**Access denied or permission error?** → See [permission debugging procedure](references/permission-debugging.md). Covers IAM role policies (inline + attached managed), S3 bucket policies, KMS key policies, Lake Formation permissions, and cross-account trust.

**Missing CloudWatch logs for custom model jobs?** → See [custom model logging debugging procedure](references/custom-model-logging-debugging.md). Covers Configured Model Algorithm Association privacy configuration, ML Configuration role permissions, and log group verification.

## Additional resources

- [Clean Rooms Service Role Setup](https://docs.aws.amazon.com/clean-rooms/latest/userguide/setting-up-roles.html)
- [Cross-service Confused Deputy Prevention](https://docs.aws.amazon.com/clean-rooms/latest/userguide/cross-service-confused-deputy-prevention.html)
- [ML Roles Documentation](https://docs.aws.amazon.com/clean-rooms/latest/userguide/ml-roles.html)
- [Lake Formation Onboarding](https://docs.aws.amazon.com/lake-formation/latest/dg/onboarding-lf-permissions.html)