🔒 Improve AWS Cloud IAM policy security #839

kenibrewer · 2025-09-18T21:50:44Z

Summary

Restricts IAM policy permissions to follow the principle of least privilege
Scopes IAM roles and instance profiles to TowerForge* prefix instead of wildcard resources
Adds resource-level restrictions for EC2 operations based on TowerForge-* instance naming
Splits launch policy into granular statements with appropriate conditions

Test plan

Verify that AWS Cloud compute environments can still be created with the new scoped policies
Test that only resources with the TowerForge prefix can be managed
Confirm pipeline launches and Studio sessions work as expected

🤖 Generated with Claude Code

- Scope IAM roles and instance profiles to TowerForge* prefix - Add resource-level restrictions for EC2 operations - Split launch policy into granular statements with conditions - Restrict instance operations to TowerForge-* tagged resources 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

netlify · 2025-09-18T21:50:49Z

✅ Deploy Preview for seqera-docs ready!

Name	Link
🔨 Latest commit	`d57f632`
🔍 Latest deploy log	https://app.netlify.com/projects/seqera-docs/deploys/693b31df1555c10008de5b06
😎 Deploy Preview	https://deploy-preview-839--seqera-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

justinegeffen · 2025-09-22T15:43:23Z

Thanks, @kenibrewer! Adding Georgi for a dev review and then good to merge.

georgi-seqera

At a glance looks good to me, but I've not really been involved in the AWS Cloud CE work, so I'll defer to @stefanoboriero who is more familiar with the resource management of the AWS Cloud CE

kenibrewer · 2025-09-22T17:18:04Z

Do the same changes need to be made for Enterprise docs too? Or are the pages linked?

stefanoboriero

The main reason why I didn't scope them down by prefix in the docs is that the prefix is actually configurable by Enterprise users (see TOWER_FORGE_PREFIX in https://docs.seqera.io/platform-enterprise/enterprise/configuration/overview), and I wanted to be as generic as possible. If we want to add this to the docs, we should be clear that if you override the default forge prefix this permissions cannot be copy-pasted.

stefanoboriero · 2025-09-23T08:06:08Z

platform-cloud/docs/compute-envs/aws-cloud.md

+                "arn:aws:ec2:*:*:instance/*",
+                "arn:aws:ec2:*:*:volume/*",
+                "arn:aws:ec2:*:*:network-interface/*",
+                "arn:aws:ec2:*:*:subnet/*",
+                "arn:aws:ec2:*:*:security-group/*",
+                "arn:aws:ec2:*:*:key-pair/*",
+                "arn:aws:ec2:*:*:image/*"


Is this really any different than using *? Actions are anyhow not applicable to all resource types, so defining individual resource types still with a star permission doesn't seem to change much the scope of the actual permissions.

For example, with the current config I can't use ec2:RunInstances on a Kinesis stream, because the action already carries the scope of what resource type it can be taken against.

On the other hand I get this might have a placebo effect if someone reads it through without giving it much thought, it seems more scoped.

stefanoboriero · 2025-09-23T08:14:19Z

platform-cloud/docs/compute-envs/aws-cloud.md

+            "Sid": "AwsCloudLaunchInstances",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:DescribeInstances",


Did you test this? AWS Docs say that using the ec2:ResourceTag/Name condition key is not supported for action ec2:DescribeInstances. See https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html#amazonec2-actions-as-permissions.

stefanoboriero · 2025-09-23T08:16:45Z

platform-cloud/docs/compute-envs/aws-cloud.md

+            "Action": [
+                "logs:GetLogEvents"
+            ],
+            "Resource": "arn:aws:logs:*:*:log-group:*:log-stream:*"


Same comment as above, this does not seem to move the needle much in terms of actual permission scopes. However here we could be more specific, since we know the exact log group we're interested into, which is tower/nextflow-run

Great. Please implement.

platform-cloud/docs/compute-envs/aws-cloud.md

kenibrewer · 2025-09-23T13:44:05Z

I don't have the bandwidth to bring this PR to completion. Can someone else work on this and ping me for a review so I can ensure it meets pre-sales needs?

Addressing the specific feedback. It is VERY IMPORTANT in my view to scope things using the TowerForge-* prefix. It also provides the best scoping in terms of reduced permissions. The most important customer consuming these docs are prospects working through a POC. They're probably on Seqera Cloud where that customization can't occur, and if they are enterprise, most of them aren't using TOWER_FORGE_PREFIX . We need these prospects to be able to copy and paste into the AWS console with few changes.

To address the TOWER_FORGE_PREFIX scenario, we should add a note on the page that says "If you use TOWER_FORGE_PREFIX you can customize the policy with a find and replace".

stefanoboriero · 2025-09-25T12:09:48Z

Can someone else work on this and ping me for a review so I can ensure it meets pre-sales needs?

I'll pick this up and ping you for review

robnewman · 2025-10-24T17:41:10Z

@stefanoboriero @justinegeffen Can we get this re-reviewed and merged?

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

justinegeffen · 2025-12-11T21:04:58Z

@stefanoboriero, if you have bandwidth to do another review of this PR that would be super helpful. :)

robnewman · 2025-12-11T21:53:56Z

Could we please get this merged? It's been open for almost three months. Thanks!

gavinelder · 2025-12-17T16:25:16Z

@robnewman @kenibrewer I believe this is superseded by

#941
#943

bebosudo

#941 and #943 are updating the AWS Batch CE policy, this PR is updating the AWS Cloud CE policy

I agree with the comments from Stefano, many changes are just aestethic, they aren't limiting or improving the policy.

In #941 and #943 I added a copy-pasteable policy with wide-open permissions for AWS Batch CEs, and I then commented each section in it to reduce the scope of each section according to the needs of each customer. I can replicate it for AWS Cloud CEs too.

I think we should mirror these changes (with the caveat of the TOWER_FORGE_PREFIX env var) in the Enterprise docs too.

bebosudo · 2025-12-18T09:06:46Z

platform-cloud/docs/compute-envs/aws-cloud.md

 ### Platform credentials

-To create and launch pipelines or Studio sessions with this compute environment type, you must attach Seqera credentials for the cloud provider. Some permissions are mandatory for the compute environment to be created and function correctly; others are optional and used to pre-fill options in Platform.
+To create and launch pipelines or Studio sessions with this compute environment type, you must attach Seqera credentials for the cloud provider. Some permissions are mandatory for the compute environment to be created and function correctly; others are optional and used to pre-fill options in Platform. If you use `TOWER_FORGE_PREFIX` you can customize the policy with find and replace.


Suggested change

To create and launch pipelines or Studio sessions with this compute environment type, you must attach Seqera credentials for the cloud provider. Some permissions are mandatory for the compute environment to be created and function correctly; others are optional and used to pre-fill options in Platform. If you use `TOWER_FORGE_PREFIX` you can customize the policy with find and replace.

To create and launch pipelines or Studio sessions with this compute environment type, you must attach Seqera credentials for the cloud provider. Some permissions are mandatory for the compute environment to be created and function correctly; others are optional and used to pre-fill options in Platform.

Seqera Cloud users can't customize the forge prefix, Enterprise users can. On Cloud it's set to the default TowerForge-.

This comment should probably be moved to the enterprise version of the policy

bebosudo · 2025-12-18T09:09:05Z

platform-cloud/docs/compute-envs/aws-cloud.md

+                "arn:aws:iam::*:role/TowerForge*",
+                "arn:aws:iam::*:instance-profile/TowerForge*"


Suggested change

"arn:aws:iam::*:role/TowerForge*",

"arn:aws:iam::*:instance-profile/TowerForge*"

"arn:aws:iam::*:role/TowerForge-*",

"arn:aws:iam::*:instance-profile/TowerForge-*"

bebosudo · 2025-12-18T09:09:25Z

platform-cloud/docs/compute-envs/aws-cloud.md

+                "arn:aws:iam::*:role/TowerForge*",
+                "arn:aws:iam::*:instance-profile/TowerForge*"
+            ]
+        },
+        {
+            "Sid": "AwsCloudCreatePassRole",
+            "Effect": "Allow",
+            "Action": [
+                "iam:PassRole"
+            ],
+            "Resource": "arn:aws:iam::*:role/TowerForge*"


Suggested change

"arn:aws:iam::*:role/TowerForge*",

"arn:aws:iam::*:instance-profile/TowerForge*"

]

},

{

"Sid": "AwsCloudCreatePassRole",

"Effect": "Allow",

"Action": [

"iam:PassRole"

],

"Resource": "arn:aws:iam::*:role/TowerForge*"

"arn:aws:iam::*:role/TowerForge-*",

"arn:aws:iam::*:instance-profile/TowerForge-*"

]

},

{

"Sid": "AwsCloudCreatePassRole",

"Effect": "Allow",

"Action": [

"iam:PassRole"

],

"Resource": "arn:aws:iam::*:role/TowerForge-*"

justinegeffen approved these changes Sep 22, 2025

View reviewed changes

justinegeffen requested a review from georgi-seqera September 22, 2025 15:43

justinegeffen added the 1. Dev/PM/SME Needs a review by a Dev/PM/SME label Sep 22, 2025

georgi-seqera reviewed Sep 22, 2025

View reviewed changes

stefanoboriero reviewed Sep 23, 2025

View reviewed changes

justinegeffen added the additional work req. Additional work is required/comments need to be addressed before second review label Oct 31, 2025

justinegeffen added 2 commits November 27, 2025 19:12

Merge branch 'master' into docs/aws-cloud-iam-policy-security

e265312

Update aws-cloud.md

1e71015

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

justinegeffen removed the additional work req. Additional work is required/comments need to be addressed before second review label Nov 27, 2025

justinegeffen requested a review from stefanoboriero November 27, 2025 17:20

justinegeffen added 1. Editor review Needs a language review additional work req. Additional work is required/comments need to be addressed before second review and removed 1. Editor review Needs a language review labels Nov 27, 2025

Merge branch 'master' into docs/aws-cloud-iam-policy-security

d57f632

bebosudo reviewed Dec 18, 2025

View reviewed changes

	To create and launch pipelines or Studio sessions with this compute environment type, you must attach Seqera credentials for the cloud provider. Some permissions are mandatory for the compute environment to be created and function correctly; others are optional and used to pre-fill options in Platform. If you use `TOWER_FORGE_PREFIX` you can customize the policy with find and replace.
	To create and launch pipelines or Studio sessions with this compute environment type, you must attach Seqera credentials for the cloud provider. Some permissions are mandatory for the compute environment to be created and function correctly; others are optional and used to pre-fill options in Platform.

		"arn:aws:iam:::role/TowerForge",
		"arn:aws:iam:::instance-profile/TowerForge"

🔒 Improve AWS Cloud IAM policy security #839

Are you sure you want to change the base?

🔒 Improve AWS Cloud IAM policy security #839

Uh oh!

Conversation

kenibrewer commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

netlify bot commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for seqera-docs ready!

Uh oh!

justinegeffen commented Sep 22, 2025

Uh oh!

georgi-seqera left a comment

Choose a reason for hiding this comment

Uh oh!

kenibrewer commented Sep 22, 2025

Uh oh!

stefanoboriero left a comment

Choose a reason for hiding this comment

Uh oh!

stefanoboriero Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

stefanoboriero Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

stefanoboriero Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

kenibrewer Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kenibrewer commented Sep 23, 2025

Uh oh!

stefanoboriero commented Sep 25, 2025

Uh oh!

robnewman commented Oct 24, 2025

Uh oh!

justinegeffen commented Dec 11, 2025

Uh oh!

robnewman commented Dec 11, 2025

Uh oh!

gavinelder commented Dec 17, 2025

Uh oh!

bebosudo left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bebosudo Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

bebosudo Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

bebosudo Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

kenibrewer commented Sep 18, 2025 •

edited

Loading

netlify bot commented Sep 18, 2025 •

edited

Loading

bebosudo left a comment •

edited

Loading