[25.2] Studios Connect changelog

platform-cloud/docs/compute-envs/aws-cloud.md

@@ -1,7 +1,8 @@
 ---
 title: "AWS Cloud"
 description: "Instructions to set up an AWS Cloud CE in Seqera Platform"
-date: "15 May 2025"
+date created: "2025-05-15"
+last updated: "2025-07-09"
 tags: [cloud, vm, amazon, compute environment]
 ---
 
@@ -54,7 +55,7 @@ To create and launch pipelines or Studio sessions with this compute environment
 
 #### Compute environment creation
 
-The following permissions are required to provision resources in the AWS account. Only IAM roles that will be assumed by the EC2 instance need to be provisioned:
+The following permissions are required to provision resources in the AWS account. Only IAM roles that will be assumed by the EC2 instance must be provisioned:
 
 ```json
 {
@@ -184,7 +185,7 @@ The following permissions enable Seqera to populate values for dropdown fields.
 
 The AWS Cloud compute environment uses an AMI maintained by Seqera, and the pipeline launch procedure assumes that some basic tooling is already present in the image itself. If you want to provide your own AMI, it must include at least the following:
 
-- Docker engine, configured to be running at startup.
+- Docker engine, configured to run at startup.
 - CloudWatch agent.
 - The ability to shut down with the `shutdown` command. If this is missing, EC2 instances will keep running and accumulate additional costs.
 
@@ -198,5 +199,4 @@ The AWS Cloud compute environment uses an AMI maintained by Seqera, and the pipe
 - **Subnets**: The list of VPC subnets where the EC2 instance will run. If unspecified, all the subnets of the VPC will be used.
 - **Security groups**: The security groups the EC2 instance will be a part of. If unspecified, no security groups will be used.
 - **Instance Profile**: The ARN of the `InstanceProfile` used by the EC2 instance to assume a role while running. If unspecified, Seqera will provision one with enough permissions to run.
-- **Boot disk size**: The size of the EBS boot disk for the EC2 instance. If undefined, a default 50 GB gp3 volume will be used.
-
+- **Boot disk size**: The size of the EBS boot disk for the EC2 instance. If undefined, a default 50 GB `gp3` volume will be used.

platform-cloud/docs/monitoring/configtables/log_events.yml

@@ -12,6 +12,10 @@
   Events logged:       'Add, edit, delete, access'
   Note:                'Log entry includes the credential ID. A log entry is also created each time the credentials are accessed by the application.'
 - 
+  Resource:            'Datasets'
+  Events logged:       'Add, edit, delete, upload, download'
+  Note:                'Log entry includes the dataset version'
+-
   Resource:            'Data Explorer cloud buckets'
   Events logged:       'Add, edit, remove, hide, show'
   Note:                'Events for public and private buckets are logged.'

platform-cloud/docs/monitoring/dashboard.md

@@ -1,8 +1,9 @@
 ---
 title: "Dashboard"
 description: "View pipeline run status overview in Seqera Platform."
-date: "21 Apr 2023"
-tags: [dashboard, pipeline runs, monitoring]
+date created: "2023-04-21"
+last updated: "2025-07-17"
+tags: [dashboard, pipeline runs, fusion, monitoring]
 ---
 
 The Seqera Platform **Dashboard** is accessed from the user menu and provides an overview of:

platform-enterprise_versioned_docs/version-23.3/enterprise/advanced-topics/db-docker-to-RDS.md

@@ -9,7 +9,7 @@ While [Docker Compose](../docker-compose) is a fast and convenient way to deploy
 
 ## Points to consider before database migration
 
-- **Target database:** You have options when selecting your new MySQL-compliant database. While the process is mostly the same, some of the commands will differ (example: [MariaDB on RDS](../configuration/overview#seqera-and-redis-databases)).
+- **Target database:** You have options when selecting your new MySQL-compliant database. While the process is mostly the same, some of the commands will differ (example: [MariaDB on RDS](../configuration/overview.mdx#seqera-and-redis-databases)).
 
 - **Database size:** The data in your database must be exported from the MySQL container and imported to the new instance. Depending on the amount of data in your database and the remaining EC2 EBS capacity, you can save your data directly to the instance, or use a service with more capacity (such as AWS S3).
 
@@ -23,7 +23,7 @@ While [Docker Compose](../docker-compose) is a fast and convenient way to deploy
 
 Before starting your migration:
 
-1. Create an RDS MySQL-compliant instance and populate it with a [Seqera user and database](../configuration/overview#seqera-and-redis-databases).
+1. Create an RDS MySQL-compliant instance and populate it with a [Seqera user and database](../configuration/overview.mdx#seqera-and-redis-databases).
 
 2. Ensure both your database and EC2 instances' Security Group(s) have been configured to allow MySQL traffic (default: Port 3306).
 
@@ -120,7 +120,7 @@ These migration instructions assume:
 11. Modify the `tower.env` config file in the Seqera Docker folder:
 
     1. Comment out the existing `TOWER_DB-*` variables.
-    2. Add new entries [relevant to your database](../configuration/overview#seqera-and-redis-databases).
+    2. Add new entries [relevant to your database](../configuration/overview.mdx#seqera-and-redis-databases).
     3. Save and exit.
 
 12. Restart the application:

platform-enterprise_versioned_docs/version-23.3/enterprise/kubernetes.mdx

@@ -99,7 +99,7 @@ Seqera supports managed Redis services such as [Amazon ElastiCache][aws-elastica
 
 - Use a single-node cluster, as multi-node clusters are not supported
 - Use an instance with at least 6GB capacity ([cache.m4.large][aws-cache-instances] or greater)
-- Specify your private ElastiCache instance in the Seqera [environment variables](./configuration/overview#database-and-redis-manual-configuration):
+- Specify your private ElastiCache instance in the Seqera [environment variables](./configuration/overview.mdx#database-and-redis-manual-configuration):
 
   ```bash
   TOWER_REDIS_URL=redis://<redis private IP>:6379
@@ -110,7 +110,7 @@ Seqera supports managed Redis services such as [Amazon ElastiCache][aws-elastica
 
 - Use a single-node cluster, as multi-node clusters are not supported
 - Use an instance with at least 6GB capacity ([C3][azure-cache-instances] or greater)
-- Specify your private Azure Cache for Redis instance in the Seqera [environment variables](./configuration/overview#database-and-redis-manual-configuration):
+- Specify your private Azure Cache for Redis instance in the Seqera [environment variables](./configuration/overview.mdx#database-and-redis-manual-configuration):
 
   ```bash
   TOWER_REDIS_URL=redis://<redis private IP>:6379
@@ -121,7 +121,7 @@ Seqera supports managed Redis services such as [Amazon ElastiCache][aws-elastica
 
 - Use a single-node cluster, as multi-node clusters are not supported
 - Use an instance with at least 6GB capacity ([M2][google-cache-instances] or greater)
-- Specify your private Memorystore instance in the Seqera [environment variables](./configuration/overview#database-and-redis-manual-configuration):
+- Specify your private Memorystore instance in the Seqera [environment variables](./configuration/overview.mdx#database-and-redis-manual-configuration):
 
   ```bash
   TOWER_REDIS_URL=redis://<redis private IP>:6379

platform-enterprise_versioned_docs/version-23.3/enterprise/prerequisites/aws.mdx

@@ -101,7 +101,7 @@ External databases for Seqera Enterprise deployments require:
 
 - A **MySQL8 Community** DB instance
 - At least 2 vCPUs, 8 GB memory, and 30 GB SSD storage
-- Manual MySQL user and database schema creation. See [Database configuration](../configuration/overview#seqera-and-redis-databases) for more details.
+- Manual MySQL user and database schema creation. See [Database configuration](../configuration/overview.mdx#seqera-and-redis-databases) for more details.
 
 :::caution
 Recommended instance class and storage requirements depend on the number of parallel pipelines you expect to run.
@@ -135,7 +135,7 @@ aws rds create-db-instance \
 After your database is created:
 
 - Update the inbound rules for the underlying EC2 instance to allow MySQL connections.
-- Update your Seqera [configuration](../configuration/overview#seqera-and-redis-databases) with the database hostname, username, and password.
+- Update your Seqera [configuration](../configuration/overview.mdx#seqera-and-redis-databases) with the database hostname, username, and password.
 
 ### Amazon EC2
 

platform-enterprise_versioned_docs/version-23.3/enterprise/prerequisites/azure.md

@@ -104,7 +104,7 @@ Create a storage account:
 External databases for Seqera Enterprise deployments require:
 - A **MySQL8 Community** DB instance.
 - At least **2 vCPUs**, **8 GB memory**, and **30 GB** SSD storage.
-- Manual MySQL user and database schema creation. See [Database configuration](../configuration/overview#seqera-and-redis-databases) for more details.
+- Manual MySQL user and database schema creation. See [Database configuration](../configuration/overview.mdx#seqera-and-redis-databases) for more details.
 
 :::caution 
 Recommended instance performance and storage requirements depend on the number of parallel pipelines you expect to run. 
@@ -157,7 +157,7 @@ Create an Azure MySQL DB instance:
 
 </details>
 
-After your database is created, update your Seqera [configuration](../configuration/overview#seqera-and-redis-databases) with the database hostname, Admin username, and password.
+After your database is created, update your Seqera [configuration](../configuration/overview.mdx#seqera-and-redis-databases) with the database hostname, Admin username, and password.
 
 :::note
 When creating a MySQL user, use the `USER@HOSTNAME` format for the `TOWER_DB_USER` environment variable. For Azure managed MySQL, it's [recommended][azure-db-config] to pass an explicit `serverTimezone` to the `TOWER_DB_URL` environment variable, which (depending on your configuration) may be `UTC`. The DB connection string should be similar to `jdbc:mysql://towerdbserver.mysql.database.azure.com/towerdb?serverTimezone=UTC`.

platform-enterprise_versioned_docs/version-23.3/enterprise/prerequisites/on-prem.md

@@ -23,7 +23,7 @@ You must satisfy the requirements for your installation:
 
   If you don't have your own database service, use an external service from a cloud provider. Visit the provider's corresponding **Prerequisites** page for more information and consult your IT team to select the most suitable solution for your organization.
 
-  To use an external database, you must create a MySQL user and database manually. See [Configuration](../configuration/overview#seqera-and-redis-databases) for more details.
+  To use an external database, you must create a MySQL user and database manually. See [Configuration](../configuration/overview.mdx#seqera-and-redis-databases) for more details.
 
 - **(Optional) SSL certificate**: An SSL certificate is required for your Seqera instance to handle HTTPS traffic.
 

platform-enterprise_versioned_docs/version-23.3/git/overview.md

@@ -197,4 +197,4 @@ To connect to a private AWS CodeCommit repository, see the [AWS documentation](h
 
 ### Self-hosted Git
 
-Seqera Platform Enterprise supports Git server endpoints. For more information, see [Git configuration](../enterprise/configuration/overview#git-integration) in the Enterprise installation guide.
+Seqera Platform Enterprise supports Git server endpoints. For more information, see [Git configuration](../enterprise/configuration/overview.mdx#git-integration) in the Enterprise installation guide.

platform-enterprise_versioned_docs/version-23.4/administration/overview.md

@@ -8,7 +8,7 @@ tags: [administration, user, workspace, organization]
 As a root user, you can access a comprehensive overview of the organizations, workspaces, users, and teams in your Seqera Platform account from the **Admin panel**. It also includes tabs for application event audit logs, administrative statistics, and system configuration options. The root user system role should only be assigned to a system administrator as it provides high-level visibility and configuration access to your account.
 
 :::tip
-See [Basic configuration](../enterprise/configuration/overview#basic-configuration) to learn how to add root users to your Platform Enterprise account with the `TOWER_ROOT_USERS` environment variable.
+See [Basic configuration](../enterprise/configuration/overview.mdx#basic-configuration) to learn how to add root users to your Platform Enterprise account with the `TOWER_ROOT_USERS` environment variable.
 :::
 
 ## Manage organizations

platform-enterprise_versioned_docs/version-23.4/faqs.md

@@ -76,7 +76,7 @@ Try the following:
 
 **_Row was updated or deleted by another transaction (or unsaved-value mapping was incorrect)_ error**
 
-This error can occur if incorrect configuration values are assigned to the `backend` and `cron` containers' [`MICRONAUT_ENVIRONMENTS`](./enterprise/configuration/overview#compute-environments) environment variable. You may see other unexpected system behavior, like two exact copies of the same Nextflow job submitted to the executor for scheduling.
+This error can occur if incorrect configuration values are assigned to the `backend` and `cron` containers' [`MICRONAUT_ENVIRONMENTS`](./enterprise/configuration/overview.mdx#compute-environments) environment variable. You may see other unexpected system behavior, like two exact copies of the same Nextflow job submitted to the executor for scheduling.
 
 Please verify the following:
 

platform-enterprise_versioned_docs/version-25.2/_templates/aws-batch/forge-policy.json

@@ -0,0 +1,62 @@
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "TowerForge0",
+            "Effect": "Allow",
+            "Action": [
+                "ssm:GetParameters",
+                "iam:CreateInstanceProfile",
+                "iam:DeleteInstanceProfile",
+                "iam:GetRole",
+                "iam:RemoveRoleFromInstanceProfile",
+                "iam:CreateRole",
+                "iam:DeleteRole",
+                "iam:AttachRolePolicy",
+                "iam:PutRolePolicy",
+                "iam:AddRoleToInstanceProfile",
+                "iam:PassRole",
+                "iam:DetachRolePolicy",
+                "iam:ListAttachedRolePolicies",
+                "iam:DeleteRolePolicy",
+                "iam:ListRolePolicies",
+                "iam:TagRole",
+                "iam:TagInstanceProfile",
+                "batch:CreateComputeEnvironment",
+                "batch:DescribeComputeEnvironments",
+                "batch:CreateJobQueue",
+                "batch:DescribeJobQueues",
+                "batch:UpdateComputeEnvironment",
+                "batch:DeleteComputeEnvironment",
+                "batch:UpdateJobQueue",
+                "batch:DeleteJobQueue",
+                "batch:TagResource",
+                "fsx:DeleteFileSystem",
+                "fsx:DescribeFileSystems",
+                "fsx:CreateFileSystem",
+                "fsx:TagResource",
+                "ec2:DescribeSecurityGroups",
+                "ec2:DescribeAccountAttributes",
+                "ec2:DescribeSubnets",
+                "ec2:DescribeLaunchTemplates",
+                "ec2:DescribeLaunchTemplateVersions", 
+                "ec2:CreateLaunchTemplate",
+                "ec2:DeleteLaunchTemplate",
+                "ec2:DescribeKeyPairs",
+                "ec2:DescribeVpcs",
+                "ec2:DescribeInstanceTypeOfferings",
+                "ec2:GetEbsEncryptionByDefault",
+                "elasticfilesystem:DescribeMountTargets",
+                "elasticfilesystem:CreateMountTarget",
+                "elasticfilesystem:CreateFileSystem",
+                "elasticfilesystem:DescribeFileSystems",
+                "elasticfilesystem:DeleteMountTarget",
+                "elasticfilesystem:DeleteFileSystem",
+                "elasticfilesystem:UpdateFileSystem",
+                "elasticfilesystem:PutLifecycleConfiguration",
+                "elasticfilesystem:TagResource"
+            ],
+            "Resource": "*"
+        }
+    ]
+}

platform-enterprise_versioned_docs/version-25.2/_templates/aws-batch/launch-policy.json

@@ -0,0 +1,36 @@
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "TowerLaunch0",
+            "Effect": "Allow",
+            "Action": [
+                "batch:DescribeJobQueues",
+                "batch:CancelJob",
+                "batch:SubmitJob",
+                "batch:ListJobs",
+                "batch:TagResource",
+                "batch:DescribeComputeEnvironments",
+                "batch:TerminateJob",
+                "batch:DescribeJobs",
+                "batch:RegisterJobDefinition",
+                "batch:DescribeJobDefinitions",
+                "ecs:DescribeTasks",
+                "ec2:DescribeInstances",
+                "ec2:DescribeInstanceTypes",
+                "ec2:DescribeInstanceAttribute",
+                "ecs:DescribeContainerInstances",
+                "ec2:DescribeInstanceStatus",
+                "logs:Describe*",
+                "logs:Get*",
+                "logs:List*",
+                "logs:StartQuery",
+                "logs:StopQuery",
+                "logs:TestMetricFilter",
+                "logs:FilterLogEvents",
+                "secretsmanager:ListSecrets"
+            ],
+            "Resource": "*"
+        }
+    ]
+}

platform-enterprise_versioned_docs/version-25.2/_templates/aws-batch/s3-bucket-write-policy.json

@@ -0,0 +1,26 @@
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "s3:ListBucket"
+            ],
+            "Resource": [
+                "arn:aws:s3:::YOUR-BUCKET-NAME"
+            ]
+        },
+        {
+            "Action": [
+                "s3:GetObject",
+                "s3:PutObject",
+                "s3:PutObjectTagging",
+                "s3:DeleteObject"
+            ],
+            "Resource": [
+                "arn:aws:s3:::YOUR-BUCKET-NAME/*"
+            ],
+            "Effect": "Allow"
+        }
+    ]
+}

platform-enterprise_versioned_docs/version-25.2/_templates/eks/eks-iam-policy.json

@@ -0,0 +1,14 @@
+{
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Sid": "TowerEks0",
+        "Effect": "Allow",
+        "Action": [
+          "eks:ListClusters",
+          "eks:DescribeCluster"
+        ],
+        "Resource": "*"
+      }
+    ]
+  }

platform-enterprise_versioned_docs/version-25.2/_templates/k8s/tower-launcher.yml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tower-nf
+
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tower-launcher-sa
+  namespace: tower-nf
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: tower-launcher-role
+  namespace: tower-nf
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "pods/status", "pods/log", "pods/exec", "persistentvolumeclaims", "configmaps"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+  - apiGroups: ["batch"]
+    resources: ["jobs", "jobs/status", "jobs/log"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: tower-launcher-rolebind
+  namespace: tower-nf
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: tower-launcher-role
+subjects:
+  - kind: ServiceAccount
+    name: tower-launcher-sa
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: tower-launcher-userbind
+  namespace: tower-nf
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: tower-launcher-role
+subjects:
+  - kind: User
+    name: tower-launcher-user