Purpose and Features¶

The solution enables the transfer of operational laboratory files between on-premises systems and external partners, including:

Sample sheets generated from lab instruments (e.g. sequencers, liquid handlers, QC systems)
Run sheets and instrument output files
Supporting metadata required for downstream processing

These files can flow into downstream laboratory processing systems in a standardized, automated way, reducing manual handling and the risk of error or delay that comes with ad hoc file transfer methods.

Data Classification¶

The files and associated metadata handled by this solution are classified as non-sensitive operational laboratory data — they do not contain regulated, confidential, patient-identifiable, or personal data. This classification allows the solution to rely on standard cloud security controls (encryption in transit and at rest, role-based access control) rather than requiring additional regulatory-specific handling.

Key Features¶

Lab users and instruments interact with a normal file share SMB — no special client software, custom integration, or workflow change is required. Files written to the share are transparently synchronized to cloud storage.

Managed SFTP endpoint for external partners¶

External partners connect using a standard SFTP client and key-based authentication. There's no dedicated external file server to patch, secure, or maintain — the endpoint is a fully managed service.

Strict isolation between users¶

Each lab is restricted to its own upload/download directories, enforced by directory-level (Active Directory group-based) permissions.
Each external partner is isolated to their own designated directories, enforced by session-scoped access policies.
No user — internal or external — can see or affect another lab's or partner's data.

Asymmetric, least-privilege partner access¶

External partners are granted:

Read-only access to the directory where the lab publishes files for them.
Read/write access to the directory where they submit files back.

This ensures a partner can consume what's shared with them and deposit new files, but cannot modify, delete, or exfiltrate anything outside their designated exchange directories.

Near real-time synchronization¶

Files submitted by external partners typically bypass the on-premises file gateway (they land directly in cloud storage).

Rather than waiting for a periodic scheduled refresh (which defaults to a minimum interval of 5 minutes), an event-driven pipeline detects new files and triggers an immediate, targeted refresh of just the affected folder — so on-premises users see externally submitted files with minimal delay.

Logging, auditing and alerting¶

Activity across the solution is logged and auditable at each layer: Appliance-level logs (via Amazon CloudWatch) capture gateway health, cache status, and synchronization activity, supporting traceback if a file transfer needs to be investigated.

SMB share access logs record on-premises file share activity, providing an audit trail of which lab users accessed or modified files, and when.

SFTP session logs (via AWS Transfer Family and CloudTrail) record external partner connection and file-transfer activity, supporting audit and traceability for externally submitted or retrieved files.

Alerting can be configured via CloudWatch Alarms against these logs (e.g. failed synchronization events, unusual access patterns, or appliance health degradation) so issues are surfaced proactively rather than discovered after the fact.

Reliable, auditable delivery¶

Any failure in the synchronization pipeline is captured (not silently dropped), so it can be investigated and reprocessed without data loss or a full manual resynchronization.

Encryption throughout¶

All service-to-service traffic is encrypted in transit, and data at rest in cloud storage is encrypted using standard server-side encryption.