🔒 Improve AWS Cloud IAM policy security #839

kenibrewer · 2025-09-18T21:50:44Z

Summary

Restricts IAM policy permissions to follow the principle of least privilege
Scopes IAM roles and instance profiles to TowerForge* prefix instead of wildcard resources
Adds resource-level restrictions for EC2 operations based on TowerForge-* instance naming
Splits launch policy into granular statements with appropriate conditions

Test plan

Verify that AWS Cloud compute environments can still be created with the new scoped policies
Test that only resources with the TowerForge prefix can be managed
Confirm pipeline launches and Studio sessions work as expected

🤖 Generated with Claude Code

- Scope IAM roles and instance profiles to TowerForge* prefix - Add resource-level restrictions for EC2 operations - Split launch policy into granular statements with conditions - Restrict instance operations to TowerForge-* tagged resources 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

netlify · 2025-09-18T21:50:49Z

✅ Deploy Preview for seqera-docs ready!

Name	Link
🔨 Latest commit	`136c8bd`
🔍 Latest deploy log	https://app.netlify.com/projects/seqera-docs/deploys/69775d56c1f8680007d8177d
😎 Deploy Preview	https://deploy-preview-839--seqera-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

justinegeffen · 2025-09-22T15:43:23Z

Thanks, @kenibrewer! Adding Georgi for a dev review and then good to merge.

georgi-seqera

At a glance looks good to me, but I've not really been involved in the AWS Cloud CE work, so I'll defer to @stefanoboriero who is more familiar with the resource management of the AWS Cloud CE

kenibrewer · 2025-09-22T17:18:04Z

Do the same changes need to be made for Enterprise docs too? Or are the pages linked?

stefanoboriero

The main reason why I didn't scope them down by prefix in the docs is that the prefix is actually configurable by Enterprise users (see TOWER_FORGE_PREFIX in https://docs.seqera.io/platform-enterprise/enterprise/configuration/overview), and I wanted to be as generic as possible. If we want to add this to the docs, we should be clear that if you override the default forge prefix this permissions cannot be copy-pasted.

stefanoboriero · 2025-09-23T08:06:08Z

platform-cloud/docs/compute-envs/aws-cloud.md

+                "arn:aws:ec2:*:*:instance/*",
+                "arn:aws:ec2:*:*:volume/*",
+                "arn:aws:ec2:*:*:network-interface/*",
+                "arn:aws:ec2:*:*:subnet/*",
+                "arn:aws:ec2:*:*:security-group/*",
+                "arn:aws:ec2:*:*:key-pair/*",
+                "arn:aws:ec2:*:*:image/*"


Is this really any different than using *? Actions are anyhow not applicable to all resource types, so defining individual resource types still with a star permission doesn't seem to change much the scope of the actual permissions.

For example, with the current config I can't use ec2:RunInstances on a Kinesis stream, because the action already carries the scope of what resource type it can be taken against.

On the other hand I get this might have a placebo effect if someone reads it through without giving it much thought, it seems more scoped.

Can this be addressed in a separate PR? Or is it a blocker to merging this PR?

stefanoboriero · 2025-09-23T08:14:19Z

platform-cloud/docs/compute-envs/aws-cloud.md

+            "Sid": "AwsCloudLaunchInstances",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:DescribeInstances",


Did you test this? AWS Docs say that using the ec2:ResourceTag/Name condition key is not supported for action ec2:DescribeInstances. See https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html#amazonec2-actions-as-permissions.

@kenibrewer, following up on this so we can merge this PR. :)

platform-cloud/docs/compute-envs/aws-cloud.md

kenibrewer · 2025-09-23T13:44:05Z

I don't have the bandwidth to bring this PR to completion. Can someone else work on this and ping me for a review so I can ensure it meets pre-sales needs?

Addressing the specific feedback. It is VERY IMPORTANT in my view to scope things using the TowerForge-* prefix. It also provides the best scoping in terms of reduced permissions. The most important customer consuming these docs are prospects working through a POC. They're probably on Seqera Cloud where that customization can't occur, and if they are enterprise, most of them aren't using TOWER_FORGE_PREFIX . We need these prospects to be able to copy and paste into the AWS console with few changes.

To address the TOWER_FORGE_PREFIX scenario, we should add a note on the page that says "If you use TOWER_FORGE_PREFIX you can customize the policy with a find and replace".

stefanoboriero · 2025-09-25T12:09:48Z

Can someone else work on this and ping me for a review so I can ensure it meets pre-sales needs?

I'll pick this up and ping you for review

robnewman · 2025-10-24T17:41:10Z

@stefanoboriero @justinegeffen Can we get this re-reviewed and merged?

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

justinegeffen · 2025-12-11T21:04:58Z

@stefanoboriero, if you have bandwidth to do another review of this PR that would be super helpful. :)

robnewman · 2025-12-11T21:53:56Z

Could we please get this merged? It's been open for almost three months. Thanks!

gavinelder · 2025-12-17T16:25:16Z

@robnewman @kenibrewer I believe this is superseded by

#941
#943

bebosudo

#941 and #943 are updating the AWS Batch CE policy, this PR is updating the AWS Cloud CE policy

I agree with the comments from Stefano, many changes are just aestethic, they aren't limiting or improving the policy.

In #941 and #943 I added a copy-pasteable policy with wide-open permissions for AWS Batch CEs, and I then commented each section in it to reduce the scope of each section according to the needs of each customer. I can replicate it for AWS Cloud CEs too.

I think we should mirror these changes (with the caveat of the TOWER_FORGE_PREFIX env var) in the Enterprise docs too.

platform-cloud/docs/compute-envs/aws-cloud.md

Co-authored-by: Alberto Chiusole <1922124+bebosudo@users.noreply.github.com> Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

justinegeffen · 2026-01-23T15:27:52Z

@bebosudo, @kenibrewer, @stefanoboriero:

I have followed up some outstanding comments and questions. If we can get them resolved ASAP we can merge this.
The Cloud and Enterprise docs are separate and once this work is approved I will add the update to the Enterprise docs for all versions. PLMK if there's a different approach in mind in terms of the versions that need to have this update.
If there is work that's out of scope for this PR, please raise it here and we can open a new PR once this is merged.

kenibrewer · 2026-01-23T22:18:26Z

Point taken about some of the * removals just being aesthetic rather than real improvements in security posture. I don't have the bandwidth to dig into this PR in detail right now so don't wait on me for changes and approval. I trust all ya'll's judgement

justinegeffen · 2026-01-24T07:37:58Z

Point taken about some of the * removals just being aesthetic rather than real improvements in security posture. I don't have the bandwidth to dig into this PR in detail right now so don't wait on me for changes and approval. I trust all ya'll's judgement

Thanks Ken, and thank you for this PR - it's really helpful :). I've reconsidered the "out of scope" process that I mentioned above and I will make separate issues for them, after which the team will assess and prioritize them. So, nothing more for you to do but we may ping you for review on some of the improvements. :)

justinegeffen approved these changes Sep 22, 2025

View reviewed changes

justinegeffen requested a review from georgi-seqera September 22, 2025 15:43

justinegeffen added the 1. Dev/PM/SME Needs a review by a Dev/PM/SME label Sep 22, 2025

georgi-seqera reviewed Sep 22, 2025

View reviewed changes

stefanoboriero reviewed Sep 23, 2025

View reviewed changes

justinegeffen added the additional work req. Additional work is required/comments need to be addressed before second review label Oct 31, 2025

justinegeffen added 2 commits November 27, 2025 19:12

Merge branch 'master' into docs/aws-cloud-iam-policy-security

e265312

Update aws-cloud.md

1e71015

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

justinegeffen removed the additional work req. Additional work is required/comments need to be addressed before second review label Nov 27, 2025

justinegeffen requested a review from stefanoboriero November 27, 2025 17:20

justinegeffen added 1. Editor review Needs a language review additional work req. Additional work is required/comments need to be addressed before second review and removed 1. Editor review Needs a language review labels Nov 27, 2025

Merge branch 'master' into docs/aws-cloud-iam-policy-security

d57f632

bebosudo reviewed Dec 18, 2025

View reviewed changes

platform-cloud/docs/compute-envs/aws-cloud.md Outdated Show resolved Hide resolved

platform-cloud/docs/compute-envs/aws-cloud.md Outdated Show resolved Hide resolved

platform-cloud/docs/compute-envs/aws-cloud.md Outdated Show resolved Hide resolved

justinegeffen and others added 4 commits January 23, 2026 17:21

Update platform-cloud/docs/compute-envs/aws-cloud.md

40bbee4

Co-authored-by: Alberto Chiusole <1922124+bebosudo@users.noreply.github.com> Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Update platform-cloud/docs/compute-envs/aws-cloud.md

d1f43ae

Co-authored-by: Alberto Chiusole <1922124+bebosudo@users.noreply.github.com> Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Update platform-cloud/docs/compute-envs/aws-cloud.md

c219b70

Co-authored-by: Alberto Chiusole <1922124+bebosudo@users.noreply.github.com> Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Merge branch 'master' into docs/aws-cloud-iam-policy-security

b61badf

justinegeffen removed the additional work req. Additional work is required/comments need to be addressed before second review label Jan 23, 2026

justinegeffen requested a review from bebosudo January 23, 2026 15:28

justinegeffen added 2 commits January 23, 2026 19:59

Merge branch 'master' into docs/aws-cloud-iam-policy-security

4425150

Merge branch 'master' into docs/aws-cloud-iam-policy-security

a470bb2

justinegeffen added 2 commits January 24, 2026 11:21

Merge branch 'master' into docs/aws-cloud-iam-policy-security

e57d4d4

Merge branch 'master' into docs/aws-cloud-iam-policy-security

136c8bd

justinegeffen mentioned this pull request Jan 26, 2026

We could be more specific, since we know the exact log group we're interested into, which is tower/nextflow-run #1060

Open

🔒 Improve AWS Cloud IAM policy security #839

Are you sure you want to change the base?

🔒 Improve AWS Cloud IAM policy security #839

Uh oh!

Conversation

kenibrewer commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

netlify bot commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for seqera-docs ready!

Uh oh!

justinegeffen commented Sep 22, 2025

Uh oh!

georgi-seqera left a comment

Choose a reason for hiding this comment

Uh oh!

kenibrewer commented Sep 22, 2025

Uh oh!

stefanoboriero left a comment

Choose a reason for hiding this comment

Uh oh!

stefanoboriero Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

justinegeffen Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

stefanoboriero Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

justinegeffen Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

kenibrewer commented Sep 23, 2025

Uh oh!

stefanoboriero commented Sep 25, 2025

Uh oh!

robnewman commented Oct 24, 2025

Uh oh!

justinegeffen commented Dec 11, 2025

Uh oh!

robnewman commented Dec 11, 2025

Uh oh!

gavinelder commented Dec 17, 2025

Uh oh!

bebosudo left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

justinegeffen commented Jan 23, 2026

Uh oh!

kenibrewer commented Jan 23, 2026

Uh oh!

justinegeffen commented Jan 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

kenibrewer commented Sep 18, 2025 •

edited

Loading

netlify bot commented Sep 18, 2025 •

edited

Loading

bebosudo left a comment •

edited

Loading