Minimum aggregation thresholds

Data aggregation is a privacy-enhancing technique that helps enforce anonymization by preventing queries from returning results about individuals or small groups. When minimum aggregation thresholds are configured on your tables, AWS Clean Rooms suppresses results that do not meet the data provider's specified minimum threshold.

Aggregation thresholds

You can configure minimum aggregation thresholds in a Custom analysis rule for your configured table. Data providers specify the identityColumns and the minimumIdentityCount, N. Supported values for minimumIdentityCount are between 2 and 100,000. The identityColumns value must be a string, varchar, or char type. Minimum aggregation thresholds ensure that each row in a SQL query result has at least N distinct data subjects contributing to it. For information about how identityColumns interacts with query filters, see Comparison controls.

The following example sets the minimum aggregation threshold to 100 with user_id as the identityColumns value:

{
  "aggregationThresholds": [
    {
      "identityColumns": [
        "user_id"
      ],
      "minimumIdentityCount": 100,
      "type": "COUNT_DISTINCT"
    }
  ]
}

Overriding the minimum aggregation threshold for specific output columns

Output columns have different sensitivity levels, and data providers can enforce different minimumIdentityCount values depending on the output column. For example, campaign_id might be a low-sensitivity column with a minimum threshold of 5 distinct data subjects, while postal_code and income_bracket get a minimum threshold of 100 because they are high-sensitivity columns.

A per-column override accepts 0, which exempts that output column from minimum aggregation, or a value between 2 and 100,000.

The following example sets a minimum aggregation threshold override for the campaign_id column:

{
  "outputColumnThresholds": [
    {
      "outputColumnName": "campaign_id",
      "minimumIdentityCount": 5
    }
  ]
}

Allowing nested expressions in aggregate functions

Allowing expressions inside aggregation functions increases the risk that data subjects can be re-identified in clean room queries. The default setting for allowedAggregateExpressionType is COLUMNS_ONLY, which is recommended as the privacy-enhanced configuration. With this setting, only columns are accepted inside an aggregation function, such as:

Alternatively, for collaborations where the query runner is a trusted partner, you can allow ANY_EXPRESSION inside an aggregation function. This setting increases the flexibility of SQL queries that can run on your data, but introduces privacy risk because query runners can isolate small groups within an aggregation function.

The following is an example of an expression in an aggregation function that is generally considered safe:

The following is an example of an expression in an aggregation function that is considered a privacy risk:

The following is a complete aggregationThresholds example:

{
  "aggregationThresholds": [
    {
      "identityColumns": [
        "user_id"
      ],
      "minimumIdentityCount": 100,
      "type": "COUNT_DISTINCT",
      "allowedAggregateExpressionType": "COLUMNS_ONLY",
      "outputColumnThresholds": [
        {
          "outputColumnName": "campaign_id",
          "minimumIdentityCount": 5
        }
      ]
    }
  ]
}

Configuring minimum aggregation thresholds in the console

You configure minimum aggregation thresholds as part of adding a custom analysis rule to a configured table, after the configured table exists. For the complete custom analysis rule guided flow, see Adding a custom analysis rule to a table (guided flow).

Considerations and limitations

Considerations and limitations apply when you use minimum aggregation thresholds. For the full list, see Considerations and limitations.