Setting up permissions for import jobs - AWS HealthLake

Setting up permissions for import jobs

Before you import files into a data store, you must grant HealthLake permission to access your input and output buckets in Amazon S3. To grant HealthLake access, you create an IAM service role for HealthLake, add a trust policy to the role to grant HealthLake assume role permissions, and attach a permissions policy to role that grants it to access to your Amazon S3 buckets.

When you create an import job, you specify the Amazon Resource Name (ARN) of this role for the DataAccessRoleArn. For more information about IAM roles and trust policies, see IAM Roles.

After you set up permission, you are ready to import files into your data store with an import job. For more information, see Starting an import job in HealthLake.

To set up import permissions

  1. If haven't already, create a destination Amazon S3 bucket for output log files. The Amazon S3 bucket must be in the same AWS Region as the service, and Block Public Access must be turned on for all options. To learn more, see Using Amazon S3 block public access. An Amazon-owned or customer-owned KMS key must also be used for encryption. To learn more about using KMS keys, see Amazon Key Management Service.

  2. Create a data access service role for HealthLake and give the HealthLake service permission to assume it with the following trust policy. HealthLake uses this to write the output Amazon S3 bucket. 

    {
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Principal": {
            "Service": ["healthlake.amazonaws.com"]
        },
        "Action": "sts:AssumeRole",
        "Condition": {
            "StringEquals": {
                "aws:SourceAccount": "your-account-id"
            },
            "ArnEquals": {
                "aws:SourceArn": "arn:aws:healthlake:us-west-2:account:datastore/fhir/data store ID"
            }
        }
    }]
}

  3. Add a permissions policy to the data access role that allows it to access the Amazon S3 bucket. Replace amzn-s3-demo-bucket with your bucket's name.

    {
    "Version": "2012-10-17",
    "Statement": [{
        "Action": [
            "s3:ListBucket",
            "s3:GetBucketPublicAccessBlock",
            "s3:GetEncryptionConfiguration"
        ],
        "Resource": [
            "arn:aws:s3:::amzn-s3-demo-bucket"
        ],
        "Effect": "Allow"
    },
    {
        "Action": [
            "s3:PutObject"
        ],
        "Resource": [
            "arn:aws:s3:::amzn-s3-demo-bucket/*"
        ],
        "Effect": "Allow"
    },
    {
        "Action": [
            "kms:DescribeKey",
            "kms:GenerateDataKey*"
        ],
        "Resource": [
            "arn:aws:kms:us-east-1:012345678910:key/d330e7fc-b56c-4216-a250-f4c43ef46e83"
        ],
        "Effect": "Allow"
    }]
}

  1. To give HealthLake permission to assume the role, add the following trust relationship:

    
{
"Version": "2012-10-17",
    "Statement": [
        {"Effect": "Allow",
         "Principal":
            {"Service":
                [ "healthlake.amazonaws.com" ]
            },
         "Action": "sts:AssumeRole"
         "Condition": {
            "StringEquals": {
                "aws:SourceAccount": "(accountId)"
                },
            "ArnEquals": {
                "aws:SourceArn": "arn:aws:healthlake:(region):(accountId):datastore/fhir/(datastoreId)"
                }
            }
        }
    ]
}

  2. To grant the role access to your intput and output Amazon S3 buckets, attach the following IAM policy to the role. 

    
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetEncryptionConfiguration"
            ],
            "Resource": [
                "arn:aws:s3:::inputS3Bucket",
                "arn:aws:s3:::outputS3Bucket"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::inputS3Bucket/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::outputS3Bucket/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:DescribeKey",
                "kms:GenerateDataKey*"
            ],
            "Resource": [
                "arn:aws:kms:us-east-1:012345678910:key/d330e7fc-b56c-4216-a250-f4c43ef46e83"
            ],
            "Effect": "Allow"
        }
    ]
}