In the Clouds ...

In the last post I built a locked-down RStudio workstation for the biobank of CJD Foundation Israel : a custom Graviton AMI, no internet, one machine per study. It ended with "researcher sign-in is the next piece of work". This post is that piece, tested live today, and it comes with a correction to the last post that I'd rather make myself than have someone find. Cognito identity in the data's AWS region Training gate a Lambda drops expired study groups One app per study Cloudflare Access enforces the study Tested live 7 checks, then destroyed What we wanted A researcher on an approved study opens a web address, signs in, and lands in RStudio on their study's workstation. Nothing more, and in particular: No VPN, no SSH, no public IP on the workstation. One study per address. Being a member of study A must not open study B's door. Access ends by itself when the person's ethics and data-protection training expires, or when the study's appro...

Researchers want R and a browser. Data protection wants the data to stay put. For the past few weeks I have been building a small research platform for the biobank of CJD Foundation Israel , a families' foundation working on Creutzfeldt-Jakob disease, and the piece that made both sides happy is a custom machine image: an Ubuntu workstation that has everything a study needs baked in, and no way to talk to the internet once it runs. Packer + OIDC built from GitHub Actions, no AWS keys Graviton Ubuntu 24.04 arm64, KMS-encrypted No internet S3 and AWS endpoints only Idle stop after 60 quiet minutes This post walks through how it is built: Packer, run from GitHub Actions through OIDC, producing an encrypted Graviton AMI with a locked-down RStudio Server, and a Terraform module that turns it into one workstation per study. The problem Each approved study gets a slice of (pseudonymised) data. Its researchers need a place to analyse it, and the platform needs to be sure of three thin...

New chapter · Volunteer work Gilles · 19 October 2026 This blog has been quiet for a while and for obvious reasons. I'm bringing it back with the best reason I could ask for: I've taken on a volunteer role as remote Technical Lead at the Creutzfeldt-Jacob Foundation Israel , building the data platform behind a rare-disease research biobank. The data we're organising is, at its core, this: genomes, and everything that surrounds them. The foundation The CJD Foundation Israel is a non-profit patient-advocacy organisation, founded in 2008 by Alice Anane after she and her family learned they carry the mutation for genetic Creutzfeldt-Jakob disease (gCJD), a rare and fatal prion disease. Israel has a distinctively high prevalence of the genetic form, particularly among North African families. The foundation supports affected families, raises awareness, and pushes research, early diagnosis and treatment forward. It also co-founded and leads Israel's na...