AWS First Steps
LanguageEnglish
New feature

AWS HealthOmics now supports IAM session policies

AWS HealthOmics now supports IAM session policies, allowing you to dynamically restrict permissions for individual runs without creating and managing multiple IAM roles.

AWS HealthOmics now supports IAM session policies, dynamically restricting permissions for each run. This simplifies management by eliminating the need for separate IAM roles per tenant or run. IAM session policies are inline policies that limit the maximum permissions of a run, where effective permissions are the intersection of the underlying identity-based policy and the temporary session policy. For example, in a multitenant application, you can pass a session policy to restrict a run's access to only that tenant's Amazon S3 bucket without provisioning a tenant-specific IAM role. You can also use IAM session policies to grant temporary access to specific Amazon S3 objects for a single run, isolating access to sensitive resources per run. IAM session policies are available in all AWS regions where AWS HealthOmics is offered. See the permissions section in the AWS HealthOmics user guide for details.

Why it matters

AWS HealthOmics is a service that helps healthcare and life sciences customers accelerate scientific breakthroughs with fully managed bioinformatics workflows. This update allows dynamic permission restriction for individual runs, reducing the overhead of managing separate IAM roles for each tenant or run.

Read the original AWS announcement

Related articles and terms

AWS IAMAn authentication and authorization service for securely controlling access to AWS resources, providing fine-grained access management through users, groups, roles, and policiesDesigning Identity and Access Management - Achieving Zero Trust Security with IAMLearn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.Detecting Excessive Access Permissions with IAM Access Analyzer - Analyzing External Access and Unused PermissionsDetect unused permissions on IAM roles based on CloudTrail and automatically generate least-privilege policies. This article explains external access detection and how to build custom policy checks into CI/CD.AWS IAM Identity CenterA single sign-on (SSO) service integrated with AWS Organizations that centrally manages access to multiple AWS accounts and business applicationsIAM Access AnalyzerA service that automatically analyzes resource policies on S3 buckets, IAM roles, and more to detect external access and unused permissions, strengthening your security posture