Setting up Amazon ECR for private workflows

Before you create a private workflow, you containerize your workflow tools and create corresponding private image repositories in Amazon Elastic Container Registry (Amazon ECR). When you run the workflow, the HealthOmics service accesses the containers that you provide.

Note

HealthOmics doesn't support ARM containers and doesn't support access to public containers.

Add task inputs to an ECR container image

Add all executables, libraries, and scripts needed to run a workflow task into the Amazon ECR image that's used to run the task.

It's best practice to avoid using scripts, binaries, and libraries that are external to a tasks container image. This is especially important when using nf-core workflows that use a bin directory as part of the workflow package. While this directory will be available to the workflow task, it's mounted as a read-only directory. Required resources in this directory should be copied into the task image and made available at runtime or when building the container image used for the task.

Configure Amazon ECR permissions

For the HealthOmics service to access your private repository, you create an IAM policy for the HealthOmics service. You add this policy to each private repository referenced by a workflow. The private repository and workflow must be in the same region.

You can set up cross-account support to allow multiple AWS accounts (in the same region as the repository) access to the same repository.

If you share a workflow that references any Amazon ECR containers, configure cross-account support for the shared workflow subscriber to access the containers.

To configure cross-account support, give permission to specific accounts by adding a policy statement similar to OmicsAccessCrossAccount in the following example.

To grant HealthOmics permission to access Amazon ECR

1. Open the private repositories page in the Amazon ECR console and select the repository you are granting access to.

2. From the side bar navigation, select Permissions.

3. Choose Edit JSON.

4. Choose Add Statement.

5. Add the following policy statement for Conditions and then select Save Policy.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "omics workflow",
               "Effect": "Allow",
               "Principal": {
                   "Service": "omics.amazonaws.com"
               },
               "Action": [
                   "ecr:GetDownloadUrlForLayer",
                   "ecr:BatchGetImage",
                   "ecr:BatchCheckLayerAvailability"
               ]
           }
       ]
   }

The resource-based policy on the registry grants HealthOmics permission to acquire a container image in the repository.

To use a cross-account container in the same region, add a permission statement similar to OmicsAccessCrossAccount in the following example.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "OmicsAccessPrincipal",
            "Effect": "Allow",
            "Principal": {
                "Service": "omics.amazonaws.com"
            },
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability"
            ]
        },
        {
            "Sid":"OmicsAccessCrossAccount",
            "Effect":"Allow",
            "Principal":{
                "AWS":"arn:aws:iam::{{AWS-account-ID}}:root"
            },
            "Action":[
            "ecr:GetDownloadUrlForLayer",
            "ecr:BatchGetImage",
            "ecr:BatchCheckLayerAvailability"
           ]
        }
   ]
}        
    ]
}