AWS omics medium security documentation change
Summary
Updated workflow creation documentation with expanded repository integration options (Git-based repos), S3 bucket ownership verification requirements, and clarified UI navigation steps.
Security assessment
Added explicit requirement to provide S3 bucket owner's AWS account ID when using a bucket not owned by the user. This addresses authorization verification for cross-account S3 access, preventing potential unauthorized resource usage. The change explicitly states security controls for third-party bucket access.
Diff
diff --git a/omics/latest/dev/create-private-workflow.md b/omics/latest/dev/create-private-workflow.md index 24c977d4c..be5fb1a1b 100644 --- a//omics/latest/dev/create-private-workflow.md +++ b//omics/latest/dev/create-private-workflow.md @@ -9 +9 @@ Creating a workflow using the consoleCreating a workflow using the CLICreating a -You can create a workflow using the HealthOmics console, AWS CLI commands, or one of the AWS SDKs. +Create a workflow using the HealthOmics console, AWS CLI commands, or one of the AWS SDKs. @@ -15 +15 @@ Don’t include any personally identifiable information (PII) in workflow names. -When you create a workflow, HealthOmics assigns a UUID to the workflow. The workflow UUID is a Globally Unique Identifier (guid) that's unique across workflows and workflow versions. For data provenance purposes, we recommend that you use the workflow UUID to uniquely identify workflows. +When you create a workflow, HealthOmics assigns a universally unique identifier (UUID) to the workflow. The workflow UUID is a Globally Unique Identifier (guid) that's unique across workflows and workflow versions. For data provenance purposes, we recommend that you use the workflow UUID to uniquely identify workflows. @@ -30 +30 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work -###### To create a workflow +###### Steps to create a workflow @@ -34 +34 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - 2. In the left navigation pane, choose **Private workflows**. + 2. Select the navigation pane (≡) in the top left, and select **Private workflows**. @@ -38 +38 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - 4. On the **Create workflow** page, provide the following information: + 4. On the **Define workflow** page, provide the following information: @@ -40 +40 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - * **Workflow name** \- A distinctive name for this workflow. + 1. **Workflow name** : A distinctive name for this workflow. We recommend setting workflow names to organize your runs in the AWS HealthOmics console and CloudWatch logs. @@ -42 +42 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - * **Description** (optional) - A description of this workflow. + 2. **Description** (optional): A description of this workflow. @@ -46 +46 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - * **Workflow language** (optional) - you can select the specification language of the workflow. Otherwise, HealthOmics determines the language from the workflow definition. + 1. **Workflow language** (optional): Select the specification language of the workflow. Otherwise, HealthOmics determines the language from the workflow definition. @@ -48 +48 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - * For **Workflow definition source** , choose whether to retrieve the definition folder from an Amazon S3 location or from a local drive. + 2. For **Workflow definition source** , choose to import the definition folder from a Git-based repository, an Amazon S3 location, or from a local drive. @@ -50 +50 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - * If you choose **Select definion folder from S3** : + 1. For **Import from a repository service** : @@ -52 +52,47 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - * Enter the Amazon S3 location that contains the zipped workflow definition folder. +###### Note + +HealthOmics supports public and private repositories for GitHub, GitLab, Bitbucket, GitHub self-managed, GitLab self-managed. + + 1. Choose a **Connection** to connect your AWS resources to the external repository. To create a connection, see [Connect with external code repositories](./setting-up-new.html#setting-up-omics-repository). + +###### Note + +Customers in the TLV region need to create a connection in the IAD (us-east-1) region to create a workflow. + + 2. In **Full repository ID** , enter your repository ID as user-name/repo-name. Verify you have access to the files in this repository. + + 3. In **Source reference** (optional), enter a repository source reference (branch, tag, or commit ID). HealthOmics uses the default branch if no source reference is specified. + + 4. In **Exclude file patterns** , enter the file patterns to exclude specific folders, files, or extensions. This helps manage data size when importing repository files. There is a max of 50 patterns, and the patters must follow the [glob pattern syntax](https://fossil-scm.org/home/doc/tip/www/globs.md). For example: + + 1. `tests/` + + 2. `*.jpeg` + + 3. `large_data.zip` + + 2. For **Select definition folder from S3** : + + 1. Enter the Amazon S3 location that contains the zipped workflow definition folder. The Amazon S3 bucket must be in the same region as the workflow. + + 2. If your account doesn't own the Amazon S3 bucket, enter the bucket owner's AWS account ID in the **S3 bucket owner's account ID**. This information is required so that HealthOmics can verify the bucket ownership. + + 3. For **Select definition folder from a local source** : + + 1. Enter the local drive location of the zipped workflow definition folder. + + 3. **Main workflow definition file path** (optional): Enter the file path from the zipped workflow definition folder or repository to the `main` file. This parameter is not required if there is only one file in the workflow definition folder, or if the main file is named "main". + + 6. In the **README file** (optional) panel, provide the following information: + + 1. Select the **Source of the README file**. + + 1. For **Import from a repository service** , in **README file path** , enter the path to the README file within the repository. + + 2. For **Select file from S3** , in **README file in S3** , enter the Amazon S3 URI for the README file. + + 3. For **Select file from a local source** : in **README file from local source** , upload a README file from a local source. + + 2. In **README file path** , enter the path to the README file in the source. + + 7. In the **Default run storage configuration** panel, provide the default run storage type and capacity for runs that use this workflow: @@ -54 +100 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - * If your account doesn't own the S3 bucket, enter the bucket owner's AWS account ID in **S3 bucket owner's account ID**. This information is required so that HealthOmics can verify the bucket ownership. + 1. **Run storage type** : Choose whether to use static or dynamic storage as the default for the temporary run storage. The default is static storage. @@ -56 +102 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - * If you choose **Select definion folder from a local source** , enter the local drive location of the zipped workflow definition folder. + 2. **Run storage capacity** (optional): For static run storage type, you can enter the default amount of run storage required for this workflow. The default value for this parameter is 1200 GiB. You can override these default values when you start a run. @@ -58 +104 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - * **Main workflow definition file path** (optional) - enter the file path from the zipped workflow definition folder to the main file. This parameter is not required if there is only one file in the workflow definition folder, or if the main file is named "main". + 8. **Tags** (optional): You can associate up to 50 tags with this workflow. @@ -60 +106 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - 6. In the **Default run storage configuration** panel, provide the default run storage type and capacity for runs that use this workflow: + 9. Choose **Next**. @@ -62 +108 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - * **Run storage type** (optional) - choose whether to use static or dynamic storage as the default for the temporary run storage. The default is static storage. + 10. On the **Add workflow parameters** (optional) page, select the **Parameter source** : @@ -64 +110 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work - * **Run storage capacity** (optional) - For static run storage type, you can enter the default amount of run storage required for this workflow. You can override this default when you start a workflow run. The default value for this parameter is 1200 GiB. + 1. For **Parse from workflow definition file** , HealthOmics will automatically parse the workflow parameters from the workflow definition file. @@ -66 +112 @@ When you create a workflow, HealthOmics assigns a UUID to the workflow. The work -You can override these default values when you start a run. + 2. For **Provide parameter template from Git repository** , use the path to the parameter template file from your repository. @@ -68 +114 @@ You can override these default values when you start a run. - 7. **Tags** (optional) - You can associate up to 50 tags with this workflow. + 3. For **Select JSON file from local source** , upload a JSON file from a local source that specifies the parameters. @@ -70 +116 @@ You can override these default values when you start a run. - 8. Choose **Next**. + 4. For **Manually enter workflow parameters** , manually enter parameter names and descriptions. @@ -72 +118 @@ You can override these default values when you start a run. - 9. On the **Add workflow parameters** page, provide the workflow parameters. You can upload a JSON file that specifies the parameters or manually enter your workflow parameters. If you are using CWL, you can choose **Add from CWL workflow definition file**. + 11. In the **Parameter preview** panel, you can review or change the parameters for this workflow version. If you restore the JSON file, you lose any local changes that you made. @@ -74 +120 @@ You can override these default values when you start a run. - 10. Choose **Next**. + 12. Choose **Next**. @@ -76 +122 @@ You can override these default values when you start a run. - 11. Review the workflow configuration, then choose **Create workflow**. + 13. Review the workflow configuration, then choose **Create workflow**. @@ -93 +139 @@ If your workflow definition file located in an Amazon S3 folder, enter the locat -You receive the following response to the `create-workflow` request. +The `create-workflow` request responds with the following: @@ -112 +158 @@ If you are including multiple workflow definition files, use the `main` paramete -If you uploaded your workflow definition file to an Amazon S3 folder, specify the location using the `definition-uri` parameter, as shown in the following example. If your account doesn't own the Amazon S3 bucket, provide the owner's AWS account ID. +If you uploaded your workflow definition file to an Amazon S3 folder, specify the location using the `definition-uri` parameter, as shown in the following example. If your account does not own the Amazon S3 bucket, provide the owner's AWS account ID.