Here describes how to make default settings more secure, e.g. hotsub default security groups.

[aws] S3 encryption

To encrypt your sample data, you might need enable encryption for your S3 bucket, like this

[aws] Security Groups

By default, of course, only who executed hotsub run command can SSH and send Docker command to computing instances because only she/he has certification files locally.

But for more requirements about network restriction, there is one thing you can do.

To restrict inbound access to computing instances, you might change inbound IP address range to add your workspace IP address to the Security Group generated by hotsub automatically, like this

References

• TCGA Data Use Certification Agreement