AWS First Steps
New feature

AWS HealthOmics now supports IAM session policies

AWS HealthOmics now supports IAM session policies, allowing you to dynamically restrict permissions for individual runs without creating and managing multiple IAM roles.

AWS HealthOmics now supports IAM session policies, enabling dynamic permission limits for individual runs. This eliminates the need for separate IAM roles per tenant or run. An IAM session policy acts as an inline policy restricting the maximum permissions of a run, where effective permissions during execution are the intersection of permissions allowed by both the underlying identity-based policy and the temporary session policy. For example, in a multitenant application, passing a session policy can restrict a run's access to only that tenant's Amazon S3 bucket without provisioning a tenant-specific IAM role. IAM session policies also allow temporary access to specific Amazon S3 objects for a single run, isolating access to sensitive resources per run. This support is available in all AWS regions where AWS HealthOmics is offered. See the permissions section in the AWS HealthOmics user guide for details.

Why it matters

AWS HealthOmics helps healthcare and life sciences customers accelerate scientific breakthroughs with fully managed bioinformatics workflows. This update allows dynamic permission restrictions for individual runs, reducing the overhead of managing separate IAM roles for each tenant or run.

Read the original AWS announcement

Related articles and terms

AWS IAMAn authentication and authorization service for securely controlling access to AWS resources, providing fine-grained access management through users, groups, roles, and policiesDesigning Identity and Access Management - Achieving Zero Trust Security with IAMLearn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.IAM Policy Evaluation Logic Explained - How Implicit Deny Loses to Explicit AllowA step-by-step explanation of how IAM evaluates requests to allow or deny them, covering the priority of implicit deny, explicit allow, and explicit deny, as well as intersection logic for SCPs, permission boundaries, and session policies.Detecting Excessive Permissions with IAM Access Analyzer - External Access and Unused Permission AnalysisDetect unused permissions on IAM roles using CloudTrail-based analysis and auto-generate least-privilege policies. This guide covers external access detection and integrating custom policy checks into your CI/CD pipeline.IAM Access AnalyzerA service that automatically analyzes resource policies on S3 buckets, IAM roles, and more to detect external access and unused permissions, strengthening your security posture