AWS omics medium security documentation change
Summary
Revised workflow definition requirements with emphasis on IAM permissions, resource access controls, and input/output regional constraints.
Security assessment
Added explicit requirement to 'Verify that your IAM roles have the required permissions' and enforced regional constraints for data access. These changes directly address security controls by emphasizing least-privilege access and data locality requirements to prevent unintended exposure.
Diff
diff --git a/omics/latest/dev/workflow-defn-requirements.md b/omics/latest/dev/workflow-defn-requirements.md index d21e6f629..c95dc6e64 100644 --- a//omics/latest/dev/workflow-defn-requirements.md +++ b//omics/latest/dev/workflow-defn-requirements.md @@ -9 +9 @@ The HealthOmics workflow definition files must meet the following requirements: - * Declare all parameters in the workflow definition file. Parameters include input and output locations, Amazon ECR container repositories, and runtime parameters such as allocated memory or CPU. + * Tasks must define input/output parameters, Amazon ECR container repositories, and runtime specifications such as memory or CPU allocation. @@ -11 +11 @@ The HealthOmics workflow definition files must meet the following requirements: - * Your workflow tasks can't access resources using the public internet. Make sure that the workflow can access all input data from AWS resources such as S3. + * Verify that your IAM roles have the required permissions. @@ -13 +13 @@ The HealthOmics workflow definition files must meet the following requirements: - * Declare the output files in the workflow definition file. If you want to copy intermediate run files to the output location, declare them as workflow outputs. + * Your workflow has access to input data from AWS resources, such as Amazon S3. @@ -15 +15 @@ The HealthOmics workflow definition files must meet the following requirements: - * The input and output locations must be in the same Region as the workflow run. + * Your workflow has access to external repository services when needed. @@ -17 +17 @@ The HealthOmics workflow definition files must meet the following requirements: - * HealthOmics storage workflow inputs must be in `ACTIVE` status. HealthOmics won't import inputs with an `ARCHIVED` status, causing the workflow to fail. For information about Amazon S3 object inputs, see [HealthOmics run inputs](./workflows-run-inputs.html). + * Declare the output files in the workflow definition. To copy intermediate run files to the output location, declare them as workflow outputs. @@ -19 +19 @@ The HealthOmics workflow definition files must meet the following requirements: - * HealthOmics provides the following methods to specify the **main** entrypoint for the workflow: + * The input and output locations must be in the same Region as the workflow. @@ -21 +21 @@ The HealthOmics workflow definition files must meet the following requirements: - * If the workflow definition consists of one file, that file is the **main** entrypoint for the workflow + * HealthOmics storage workflow inputs must be in `ACTIVE` status. HealthOmics won't import inputs with an `ARCHIVED` status, causing the workflow to fail. For information about Amazon S3 object inputs, see [HealthOmics run inputs](./workflows-run-inputs.html). @@ -23 +23 @@ The HealthOmics workflow definition files must meet the following requirements: - * If the workflow definition consists of multiple files, you can name the entrypoint file `main.ext`, where ext is either `wdl`, `nf`, or `cwl` for WDL, Nextflow, or CWL, respectively. + * A **main** location of the workflow is optional if your ZIP archive contains either a single workflow definition or a file named 'main'. @@ -25 +25 @@ The HealthOmics workflow definition files must meet the following requirements: - * When you create the workflow, you can specify a main entrypoint that isn't named **main**. + * Example path: `workflow-definition/main-file.wdl` @@ -27 +27 @@ The HealthOmics workflow definition files must meet the following requirements: - * Before you create a workflow, create a zip archive of the workflow definition files and any dependencies, such as subworkflows. + * Before you create a workflow from Amazon S3 or your local drive, create a zip archive of the workflow definition files and any dependencies, such as subworkflows.