JA EN
shiichan

AWS HealthOmics can now scope down permissions per run with IAM session policies!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi, I'm Shii-chan! Today I found a small but really handy update in the genomics space, so let me walk you through it.

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New post, AWS HealthOmics now supports IAM session policies. HealthOmics is a fully managed bioinformatics workflow service for healthcare and life sciences customers, and it's a HIPAA-eligible service too.

With this update, you can now dynamically scope down permissions for each individual workflow run, without having to create and manage multiple IAM roles.

The story so far

The announcement is pretty direct about the old limitation: until now, "there was no way to dynamically scope down permissions for a single run," so you had to create a separate IAM role for each tenant or each run.

For example, if you run a multi-tenant application on top of HealthOmics, you might want runs for Tenant A to only touch Tenant A's S3 buckets, and runs for Tenant B to only touch Tenant B's buckets. Previously, the only way to enforce that was provisioning a dedicated IAM role per tenant — which gets harder to manage as your tenant count grows.

What changes

An IAM session policy is an inline policy that caps the maximum permissions of a run without modifying the underlying service role. Your effective permissions during a run are the intersection of:

  • the permissions allowed by the underlying identity-based policy (the service role's permissions), and
  • the temporary session policy you pass in for that run

In other words, a session policy can only narrow down what the role already allows — it can't grant anything beyond the role's existing permissions.

This makes it possible to do things like the following without provisioning extra roles:

  • Pass a session policy that limits a run's access to only that tenant's Amazon S3 buckets in a multi-tenant application
  • Grant temporary access to specific Amazon S3 objects for a single run
  • Isolate access to sensitive resources on a per-run basis

Beyond cutting down on role management overhead, this makes it much easier to apply least-privilege access, granting only the permissions a given run actually needs.

Supported regions

IAM session policy support is available in all AWS Regions where AWS HealthOmics is available:

  • US East (N. Virginia, Ohio)
  • US West (Oregon)
  • Europe (Frankfurt, Ireland, London)
  • Israel (Tel Aviv)
  • Asia Pacific (Tokyo, Singapore, Seoul)

Wrap-up

  • AWS HealthOmics now supports IAM session policies
  • You can scope down the service role's permissions on the fly, per run
  • Effective permissions are the intersection of the identity-based policy and the session policy
  • No need to provision a separate IAM role per tenant or per run anymore
  • Useful for multi-tenant apps, temporary per-object S3 access, and isolating sensitive resources

If you're running a multi-tenant setup on HealthOmics, or you're the security-minded person who wants tight, per-run permission boundaries, this is a small update that takes a real chunk out of your IAM role management headaches!

Related posts