AWS omics medium security documentation change

Service: omics · 2025-06-07 · Security-related medium

File: omics/latest/dev/s3-sharing.md

Summary

Updated IAM policy example to use specific resource ARNs, added conditional access based on object tags, and fixed a typo from 'propogated' to 'propagated'

Security assessment

The changes restrict S3 access to specific resources (access points) rather than wildcards, add a condition requiring 'omics:readSetStatus=ACTIVE' for object access, and split ListBucket permissions into a separate statement. These changes implement least-privilege access controls and tag-based security policies.

Diff

diff --git a/omics/latest/dev/s3-sharing.md b/omics/latest/dev/s3-sharing.md
index 59622e727..a2f91ce36 100644
--- a//omics/latest/dev/s3-sharing.md
+++ b//omics/latest/dev/s3-sharing.md
@@ -118 +117,0 @@ The following example gives a user access to a sequence store. You can fine-tune
-                "Sid": "S3DirectAccess",
@@ -120 +119,5 @@ The following example gives a user access to a sequence store. You can fine-tune
-                "Action": [
+          "Principal": {
+            "AWS": "arn:aws:iam::111111111111:root"
+          },
+          "Action": 
+          [ 
@@ -122 +124,0 @@ The following example gives a user access to a sequence store. You can fine-tune
-                    "s3:ListBucket",
@@ -125 +127 @@ The following example gives a user access to a sequence store. You can fine-tune
-                "Resource": "*",
+          "Resource": "arn:aws:s3:us-west-2:222222222222:accesspoint/111111111111-1234567890/object/111111111111/sequenceStore/1234567890/*",
@@ -127,0 +130,13 @@ The following example gives a user access to a sequence store. You can fine-tune
+              "s3:ExistingObjectTag/omics:readSetStatus": "ACTIVE"
+            }
+          }
+        },
+        {
+          "Effect": "Allow",
+          "Principal": {
+            "AWS": "arn:aws:iam::111111111111:root"
+          },
+          "Action": "s3:ListBucket",
+          "Resource": "arn:aws:s3:us-west-2:222222222222:accesspoint/111111111111-1234567890",
+          "Condition": {
+            "StringLike": {
@@ -171 +186 @@ To meet this need, the data owner sets up a sequence store and each read set rec
-Step 1. For the sequence store, ensure that the status tag is updated to be propogated. This is done by adding the “status” key into the `propogatedSetLevelTags` when calling `createSequenceStore` or `updateSequenceStore.`
+Step 1. For the sequence store, ensure that the status tag is updated to be propagated. This is done by adding the “status” key into the `propogatedSetLevelTags` when calling `createSequenceStore` or `updateSequenceStore.`