Hi All,
> > assume a role defined by a user for that user's access only > I think in Custos we want the ability for users to share resources (e.g., > a dataset in S3) with members of a collaboration group, where group sharing > policies are defined in Custos. For example, we might put an isMemberOf > claim in the id_token and set AWS S3 policies on that. Since a SciToken is > also a JWT, I wonder if we could set an AWS policy to accept a SciToken for > capability-based access. I guess a role can be defined/used by a group of users, we might be able to leverage this for resource sharing. However, the point here is that the provider implements means assuring that the role cannot be assumed by an untrusted party. I was able to use my CILogon id_token to access an AWS Role similar to what > is described in the "Cloud Bursting Galaxy" paper ( > https://doi.org/10.1101/506238). This is exciting, thanks for sharing. Best, _____________ *Vahid Jalili, *Ph.D. Postdoctoral Scholar Computational Biology Institute Oregon Health and Science University 2730 SW Moody Ave, KCRB #3103.20, OHSU-RLSB Dock 61, Portland, OR, USA 97201 Skype ID: v.jalili On Tue, Feb 26, 2019 at 2:58 PM Basney, Jim <[email protected]> wrote: > Hi all, > > Thanks to Vahid's guidance, I was able to use my CILogon id_token to > access an AWS Role similar to what is described in the "Cloud Bursting > Galaxy" paper (https://doi.org/10.1101/506238). I documented the steps > here: > > https://gist.github.com/jbasney/51cc2403a2f6ffbf4c851f38ca19c173 > > (Don't worry, I subsequently deleted the AWS Role so none of the values in > the doc are sensitive.) > > Regards, > Jim
