Synapse Team and IT Team Activity Report

In IT, two Vanta remediations (intrusion detection notifications and VPC flow logs) are closed. Provisioning Service Catalog access for an external collaborator is still blocked/monitoring. In PLFM, resolved the Synapse build IAM role exceeding the AWS size limit, flexible DocuSign tab types, a 500 error when voiding an eDUC in the Cancelled state, and deletion of specific GENIE file handles in the prod S3 bucket. Notifications for eDUC envelope terminal states and an AWS SES enforcement-probation health event are in progress. eDUC for renewals and revised submissions, plus six SEC scan findings (five dependency, one SAST), are not started.

Completed

• IT-5336 — [Vanta] Remediate "Intrusion detection system notifications configured (AWS)"

• IT-5382 — [Vanta] Remediate "VPC Flow Logs enabled"

• PLFM-10003 — Fix 500 error when voiding eDUC in 'Cancelled' state

• PLFM-9825 — Ensure deletion of specific filehandles for GENIE within the synapse prod S3 bucket

• PLFM-9898 — Flexible Docusign tab types

• PLFM-9994 — Synapse build IAM role definition exceeds AWS limit

In progress

• PLFM-10022 — Health Event: AWS SES ENFORCEMENT PROBATION in us-east-1 on account 325565585839.

• PLFM-9930 — Send notifications for eDUC signature envelope terminal states

Blocked

• IT-5388 — Provision Service Catalog access for external collaborator to analyze Synapse-hosted data

Not started

• PLFM-9659 — eDUC for Renewal DAR and for revising a rejected submission

• SEC-547 — Sage-Bionetworks-IT/agora-infra-v3 — Critical/High dependency vulnerabilities (scan 2026-10-01)

• SEC-548 — Sage-Bionetworks-IT/cfn-cr-alb-rule — Critical/High dependency vulnerabilities (scan 2026-10-01)

• SEC-549 — Sage-Bionetworks-IT/cfn-cr-sc-bucket-policy — Critical/High dependency vulnerabilities (scan 2026-10-01)

• SEC-550 — Sage-Bionetworks-IT/lambda-ebs-cleanup — Critical/High dependency vulnerabilities (scan 2026-10-01)

• SEC-551 — Sage-Bionetworks-IT/lambda-ec2-terminator — Critical/High dependency vulnerabilities (scan 2026-10-01)

• SEC-556 — mc2-center/data-models — High Python SAST findings (Bandit) (scan 2026-10-01)

In PLFM, worked on table query and Cohort Builder 2.0. Resolved: the row-returning aggregate query mode with cell-level k-anonymity, the column provenance subsystem for defining-SQL objects, and routing table-query preflight authorization through the as-built IndexAuthorizationSnapshot. The RAPID data processing design proposal is awaiting review. Making index snapshot builds fail on a dependency that has no snapshot is in progress. Three bugs about protected counts in aggregate-only row queries (COUNT(*), ORDER BY alias/position, and request-supplied sort) are awaiting dev triage.

Completed

• PLFM-9939 — Cohort Builder 2.0: Row-returning aggregate query mode with cell-level k-anonymity (QID-protected)

• PLFM-9976 — Column Provenance subsystem for defining-SQL objects

• PLFM-9998 — Route table-query preflight authorization + translation through the as-built IndexAuthorizationSnapshot

In progress

• PLFM-10006 — Design proposal for RAPID data processing

• PLFM-10023 — Index snapshot build must fail on a dependency without a snapshot instead of falling back to live state

Not started

• PLFM-10024 — count(*) and other COUNTs are not protected participant counts in aggregate-only row queries

• PLFM-10025 — ORDER BY the alias or position of a protected count leaks the true counts

• PLFM-10026 — Request-supplied Query.sort bypasses QID and protected-count validation

In PLFM, on schema-based data access, saving and resuming request progress is resolved. Bootstrapping the Access Requirement base JSON schema and ACT schema organization, and enforcing it in FormTemplate validation, is in progress. The submission service is ready for the team.

Completed

• PLFM-9668 — Save and resume schema-based data access request progress

In progress

• PLFM-10011 — Bootstrap Access Requirement base JSON schema and ACT schema organization; enforce base schema in FormTemplate validation

Not started

• PLFM-9667 — Schema-based data access submission service

In PLFM, resolved enabling rotation for customer-created CMKs and tagging instance keys to suppress a SecurityHub finding. In progress: four Vanta remediations covering database/queue monitoring and RDS SSL/TLS enforcement (one awaiting review), five SEC dependency and secret-scan remediations across Synapse-related repos, RDS reservation renewal, and the help-site migration to Scroll Sites. RDS cost savings, migrating Service Catalog service accounts, and an S3 Block Public Access finding are open.

Completed

• PLFM-8761 — 325565585839 3.8 Ensure rotation for customer created CMKs is enabled

• PLFM-9946 — Tag instance keys to suppress finding in SecurityHub

In progress

• IT-4754 — Help sites migration from Scroll Viewports to Scroll Sites

• IT-5297 — Renew RDS reservations

• PLFM-9950 — [Vanta] Remediate "SQL database freeable memory monitored (AWS)"

• PLFM-9952 — [Vanta] Remediate "Database IO monitored (AWS)"

• PLFM-9953 — [Vanta] Remediate "Messaging queue message age monitored"

• PLFM-9959 — [Vanta] Remediate "RDS instances have SSL/TLS connections enforced (AWS)"

• SEC-243 — [Sage-Bionetworks/nbconvert-webapp] Remediate 19 critical/high dependency vulnerabilities

• SEC-262 — [Sage-Bionetworks/Synapse-Migration-Utility] Remediate 17 critical/high dependency vulnerabilities

• SEC-353 — [Sage-Bionetworks/synapse-status-lambda] Remediate 1 critical/high dependency vulnerabilities

• SEC-377 — [Sage-Bionetworks/synapse-markdown-it-lambda] Remediate 3 critical/high dependency vulnerabilities

• SEC-46 — Secret scan remediation: Sage-Bionetworks/covidrecoverycorps - 3 findings

Not started

• IT-4334 — 2025 Cost Savings: RDS

• IT-4890 — migrate service accounts created for Service Catalog to dedicated team

• PLFM-8757 — 325565585839 2.1.5.2 S3 Block Public Access setting should be enabled at the bucket-level

In IT, resolved replacing the py-orca CI/CD in Seqera with nf-canary and seqerakit. In SEC, resolved dependency remediations in nextflow-infra and sage-kb-chatbot. In progress: deploying self-hosted Cirro for RAPID, exploring declarative DBCM for Snowflake, and a Slack bot that pulls data from the Sage internal website. An SSM Quick Setup org-wide patch policy is not started.

Completed

• IT-4719 — Replace current py-orca CI/CD in Seqera platform with nf-canary + seqerakit

• SEC-307 — [Sage-Bionetworks-Workflows/nextflow-infra] Remediate 9 critical/high dependency vulnerabilities

• SEC-318 — [Sage-Bionetworks-IT/sage-kb-chatbot] Remediate 8 critical/high dependency vulnerabilities

In progress

• IT-5132 — Explore declarative DBCM solutions for Snowflake

• IT-5363 — Deploy Cirro (self-hosted) in a Sage AWS account for RAPID

• IT-5379 — slack bot gets data from Sage internal website

Not started