Skip to main content

Intelligent Compute

Preview

Seqera Intelligent Compute is in preview. Seqera must enable it on a per-workspace basis before you can use it. Contact your account manager to request access for one or more workspaces.

caution

Intelligent Compute may assign different CPU and memory values to tasks than your pipeline's process directives specify. The scheduler picks the most cost-effective instance shape that meets each task's resource request.

Intelligent Compute is a scheduling service that runs Nextflow pipelines on a Seqera-managed Amazon ECS cluster. It allocates compute resources based on what each task needs rather than what the pipeline requests. This reduces cost and improves utilization across a run. Intelligent Compute is available only on AWS Cloud compute environments.

The standard AWS Cloud compute environment runs each pipeline on a single EC2 instance with a local executor. Intelligent Compute runs pipelines on multi-node ECS clusters that scale beyond a single instance.

When you enable Intelligent Compute on an AWS Cloud compute environment, Seqera provisions and manages the following resources in your AWS account on first use:

  • An Amazon ECS cluster per compute environment configuration
  • ECS capacity providers (Managed Instances or Auto Scaling Groups)
  • ECS task definitions per container image and resource shape
  • IAM roles for ECS task execution, EC2 instance profiles, and infrastructure management
  • CloudWatch log groups under /seqera (for example, /seqera/platform)

All managed resources use the seqera-sched- prefix. Seqera creates them on first use and removes them automatically when no longer needed.

IAM permissions​

Intelligent Compute requires two IAM policies attached to the same IAM user or role that Seqera uses to access your AWS account:

  1. AWS Cloud policy — required for all AWS Cloud compute environments. If you have already set up an AWS Cloud compute environment, this policy is already in place.
  2. Intelligent Compute policy — additional permissions required specifically for Intelligent Compute.
AWS Cloud policy
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AwsCloudCreate",
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole",
        "iam:AddRoleToInstanceProfile",
        "iam:CreateInstanceProfile",
        "iam:AttachRolePolicy",
        "iam:PutRolePolicy",
        "iam:TagRole",
        "iam:TagInstanceProfile"
      ],
      "Resource": [
        "arn:aws:iam::*:role/TowerForge-*",
        "arn:aws:iam::*:instance-profile/TowerForge-*"
      ]
    },
    {
      "Sid": "AwsCloudCreatePassRole",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam::*:role/TowerForge-*"
    },
    {
      "Sid": "AwsCloudLaunchEC2",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags",
        "ec2:DeleteTags",
        "ec2:DescribeInstances",
        "ec2:RunInstances",
        "ec2:TerminateInstances"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AwsCloudLaunchLogs",
      "Effect": "Allow",
      "Action": [
        "logs:GetLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:*:log-stream:*"
    },
    {
      "Sid": "AwsCloudLaunchS3",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AwsCloudDelete",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies",
        "iam:DeleteRole",
        "iam:DeleteInstanceProfile",
        "iam:RemoveRoleFromInstanceProfile",
        "iam:DetachRolePolicy",
        "iam:DeleteRolePolicy"
      ],
      "Resource": [
        "arn:aws:iam::*:role/TowerForge-*",
        "arn:aws:iam::*:instance-profile/TowerForge-*"
      ]
    },
    {
      "Sid": "AwsCloudRead",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstanceTypes",
        "ec2:DescribeKeyPairs",
        "ec2:DescribeVpcs",
        "ec2:DescribeImages",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AwsCloudUserdataCheck",
      "Effect": "Allow",
      "Action": [
        "ec2:GetConsoleOutput"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OptionalLineageIntegrationSQSAndS3",
      "Effect": "Allow",
      "Action": [
        "sqs:CreateQueue",
        "sqs:GetQueueAttributes",
        "sqs:SetQueueAttributes",
        "sqs:GetQueueUrl",
        "sqs:ReceiveMessage",
        "sqs:DeleteMessage",
        "s3:CreateBucket",
        "s3:GetBucketNotification",
        "s3:PutBucketNotification",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:sqs:*:*:seqera-lineage-*",
        "arn:aws:s3:::seqera-lineage-*"
      ]
    }
  ]
}

Download aws-cloud-full-policy.json

Intelligent Compute policy
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ECSScopedOperations",
      "Effect": "Allow",
      "Action": [
        "ecs:CreateCluster",
        "ecs:DeleteCluster",
        "ecs:DescribeClusters",
        "ecs:PutClusterCapacityProviders",
        "ecs:CreateCapacityProvider",
        "ecs:DeleteCapacityProvider",
        "ecs:DescribeCapacityProviders",
        "ecs:RunTask",
        "ecs:StopTask",
        "ecs:DescribeTasks",
        "ecs:DescribeContainerInstances",
        "ecs:UpdateContainerInstancesState",
        "ecs:TagResource"
      ],
      "Resource": "arn:aws:ecs:*:*:*/seqera-sched-*"
    },
    {
      "Sid": "ECSUnscopedOperations",
      "Effect": "Allow",
      "Action": [
        "ecs:RegisterTaskDefinition",
        "ecs:DeregisterTaskDefinition",
        "ecs:DescribeTaskDefinition",
        "ecs:ListTaskDefinitions",
        "ecs:ListTaskDefinitionFamilies",
        "ecs:ListTasks"
      ],
      "Resource": "*"
    },
    {
      "Sid": "IAMRoleManagement",
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole",
        "iam:GetRole",
        "iam:DeleteRole",
        "iam:PutRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:ListRolePolicies",
        "iam:AttachRolePolicy",
        "iam:DetachRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:CreateInstanceProfile",
        "iam:GetInstanceProfile",
        "iam:AddRoleToInstanceProfile",
        "iam:ListInstanceProfilesForRole",
        "iam:RemoveRoleFromInstanceProfile",
        "iam:DeleteInstanceProfile"
      ],
      "Resource": [
        "arn:aws:iam::*:role/seqera-sched-*",
        "arn:aws:iam::*:instance-profile/seqera-sched-*"
      ]
    },
    {
      "Sid": "PassRoleToECS",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::*:role/seqera-sched-*",
        "arn:aws:iam::*:role/TowerForge-*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": [
            "ecs-tasks.amazonaws.com",
            "ecs.amazonaws.com",
            "ec2.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "ServiceLinkedRoles",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": [
            "ecs.amazonaws.com",
            "ecs-compute.amazonaws.com",
            "autoscaling.amazonaws.com",
            "spot.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "CloudWatchLogs",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:DeleteLogGroup",
        "logs:PutRetentionPolicy",
        "logs:DescribeLogStreams",
        "logs:GetLogEvents",
        "logs:TagResource"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/seqera/*"
    },
    {
      "Sid": "EC2NetworkDiscovery",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeImages",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeRouteTables",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeInstances",
        "ec2:CreateSecurityGroup",
        "ec2:CreateVpcEndpoint",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:CreateTags"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ECRAccess",
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage"
      ],
      "Resource": "*"
    },
    {
      "Sid": "S3Access",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ASGEC2Operations",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstanceTypes",
        "ec2:CreateLaunchTemplate",
        "ec2:DeleteLaunchTemplate",
        "ec2:RunInstances"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ASGManagement",
      "Effect": "Allow",
      "Action": [
        "autoscaling:CreateAutoScalingGroup",
        "autoscaling:UpdateAutoScalingGroup",
        "autoscaling:DeleteAutoScalingGroup",
        "autoscaling:CreateOrUpdateTags"
      ],
      "Resource": "arn:aws:autoscaling:*:*:*/seqera-sched-*"
    },
    {
      "Sid": "ASGDescribe",
      "Effect": "Allow",
      "Action": "autoscaling:DescribeAutoScalingGroups",
      "Resource": "*"
    },
    {
      "Sid": "SSMECSOptimizedAmi",
      "Effect": "Allow",
      "Action": "ssm:GetParameter",
      "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs/optimized-ami/*"
    },
    {
      "Sid": "CostExplorer",
      "Effect": "Allow",
      "Action": "ce:GetCostAndUsage",
      "Resource": "*"
    }
  ]
}

Download aws-cloud-intelligent-compute-policy.json

Permission groups​

GroupPurpose
ECSScopedOperationsCreate, delete, describe, and tag ECS clusters, capacity providers, and tasks, and drain a faulty container instance so it stops receiving tasks. Scoped to seqera-sched-* resources.
ECSUnscopedOperationsRegister, deregister, list, and describe ECS task definitions. ECS task definition APIs do not support resource-level permissions.
IAMRoleManagementCreate, update, and delete IAM roles and instance profiles scoped to seqera-sched-*. Seqera creates four role types on first use: execution role, infrastructure role, per-cluster instance role, and per-cluster task role.
PassRoleToECSPass seqera-sched-* and TowerForge-* roles to ECS, ECS tasks, and EC2. Required to attach roles to ECS infrastructure and task definitions.
ServiceLinkedRolesCreate service-linked roles for ECS, autoscaling, and Spot. Required only if these roles do not already exist in your account.
CloudWatchLogsCreate and manage log groups under /seqera (for example, /seqera/platform), and read log events. Task stdout and stderr are written to CloudWatch.
EC2NetworkDiscoveryDescribe VPCs, subnets, security groups, and route tables. Create security groups and VPC endpoints. Used for VPC auto-discovery and network setup.
ECRAccessAuthorize ECR and pull container images. ECS tasks pull images from ECR.
S3AccessRead objects and list buckets. Used to read Fusion trace files and pipeline work directory content.
ASGEC2OperationsDescribe instance types and create or delete EC2 launch templates. Required only for Auto Scaling Group-backed clusters.
ASGManagementCreate, update, and delete Auto Scaling Groups scoped to seqera-sched-*. Required only for Auto Scaling Group-backed clusters.
ASGDescribeDescribe Auto Scaling Groups. Required only for Auto Scaling Group-backed clusters.
SSMECSOptimizedAmiRead the ECS-optimized AMI ID from SSM Parameter Store. Used to look up the latest Amazon Linux 2023 ECS-optimized AMI.
CostExplorerQuery ce:GetCostAndUsage. Used to display cost post pipeline launch, after receiving data from AWS Cost Explorer with a 24-48 delay. If this permission is absent, cost predictions do not appear.

Conditional statements:

  • ASGEC2Operations, ASGManagement, and ASGDescribe are required only if Auto Scaling Group-backed clusters are enabled. You can omit them for Managed Instances deployments.
  • ServiceLinkedRoles is required only if the listed service-linked roles do not already exist in your AWS account.
  • CostExplorer is required only if you want cost predictions at pipeline launch.

Create and attach the IAM policies​

Both policies must be attached to the IAM user or role that Seqera uses to access your AWS account before you create the compute environment. Create each policy as follows:

  1. Open the AWS IAM console.
  2. Select Policies under Access management, then select Create policy.
  3. Select the JSON tab, paste the policy JSON, then select Next.
  4. Enter a name (for example, SeqeraAwsCloudPolicy), then select Create policy.
  5. Repeat steps 2–4 for the Intelligent Compute policy (for example, SeqeraIntelligentComputePolicy).
  6. Attach both policies to the IAM user or role that Seqera uses to access your AWS account.

Set up an AWS Cloud compute environment with Intelligent Compute​

Prerequisites

You need the following:

  • Intelligent Compute enabled for your workspace by Seqera. Contact your account manager to request access.
  • AWS credentials with both the standard AWS Cloud permissions and the Intelligent Compute permissions attached.
  1. In your Seqera workspace, select Compute Environments, then select Add compute environment.
  2. Enter a name and select AWS Cloud as the platform.
  3. Select your AWS credentials.
  4. Select the Region where Seqera provisions the ECS cluster.
  5. Enter a Work directory (S3 URI, for example s3://my-bucket/work).
  6. Under Compute Mode, enable the Seqera Intelligent Compute toggle.
  7. Configure the Intelligent Compute options as needed.
  8. Select Add.

Seqera validates credentials and configuration on save. On first use, it provisions the required IAM roles and ECS cluster in your account. Clusters and associated resources are removed automatically when no longer needed.

S3 bucket access​

Intelligent Compute mints a dedicated IAM role per cluster in your AWS account and attaches it to the ECS tasks and EC2 instances that run your pipeline. The role's S3 permissions are derived from the compute environment's Allow buckets list:

  • Empty list (default): the role grants S3 access account-wide ("Resource": "*"). Every bucket in the account is reachable.
  • Populated list: the role grants access to the listed buckets only, plus the compute environment work directory and the work directory of the run being launched, which are added automatically.

Declaring buckets is opt-in least privilege: a compute environment that lists no buckets keeps account-wide access.

On each in-scope bucket the role grants:

ActionsResource
s3:GetObject, s3:PutObject, s3:DeleteObject, s3:GetObjectTagging, s3:PutObjectTaggingarn:aws:s3:::<BUCKET_NAME>/*
s3:ListBucket, s3:GetBucketLocationarn:aws:s3:::<BUCKET_NAME>
caution

A populated Allow buckets list is the complete allow-list. A pipeline that reads or writes a bucket missing from the list fails with AccessDenied at task runtime — not at compute environment validation or pipeline launch. List every bucket your pipelines touch: reference or public data (for example, s3://ngi-igenomes), inputs staged from elsewhere, and the outdir. The compute environment and run work directories are added for you.

How entries are interpreted:

  • An entry can be an s3:// URI or a bare bucket name. Entries for other storage providers (gs://, az://) and local paths are ignored.
  • A key prefix is discarded. s3://shared-bucket/team-a grants access to all of shared-bucket, not just the team-a prefix.
  • An entry that is not a valid S3 bucket name is dropped.

Access buckets in another AWS account​

Cross-account S3 access requires a grant on both sides: an identity policy in the compute account and a bucket policy in the account that owns the bucket. Adding the bucket to Allow buckets covers the first half only — the bucket owner must grant access to your compute account for the second.

For example, to read a reference dataset in s3://reference-data-shared, owned by account 444455556666, from a compute environment running in account 111122223333:

  1. Add s3://reference-data-shared to Allow buckets on the compute environment.

  2. Ask the owner of account 444455556666 to attach this bucket policy to reference-data-shared:

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "SeqeraComputeAccount",
          "Effect": "Allow",
          "Principal": { "AWS": "arn:aws:iam::111122223333:root" },
          "Action": [
            "s3:GetObject",
            "s3:PutObject",
            "s3:DeleteObject",
            "s3:GetObjectTagging",
            "s3:PutObjectTagging",
            "s3:ListBucket",
            "s3:GetBucketLocation"
          ],
          "Resource": [
            "arn:aws:s3:::reference-data-shared",
            "arn:aws:s3:::reference-data-shared/*"
          ]
        }
      ]
    }

    For read-only data, drop s3:PutObject, s3:DeleteObject, and s3:PutObjectTagging.

The policy above delegates the decision to your account's IAM. If the bucket owner would rather name the specific principals, use "Principal": "*" with a condition on the role names Intelligent Compute creates:

"Condition": {
  "ArnLike": {
    "aws:PrincipalArn": [
      "arn:aws:iam::111122223333:role/seqera-sched-task-role-clu-*",
      "arn:aws:iam::111122223333:role/seqera-sched-instance-v2-clu-*",
      "arn:aws:iam::111122223333:role/seqera-sched-vm-instance-clu-*"
    ]
  }
}

Each cluster gets its own role and the cluster identifier varies per cluster, but the prefixes are stable:

RoleName patternUsed by
ECS task roleseqera-sched-task-role-clu-*Task containers and Fusion
ECS instance roleseqera-sched-instance-v2-clu-*EC2 hosts of an ECS-backed cluster
EC2 instance roleseqera-sched-vm-instance-clu-*EC2 hosts when Backend strategy is EC2

Limitations​

  • Buckets encrypted with a customer-managed KMS key (SSE-KMS) are not supported. The minted role carries no kms permissions for S3, and no bucket policy can supply them — KMS access must be granted on the identity side. Unencrypted buckets and buckets using SSE-S3 (AES256) work. The KMS for S3 policy documented for a custom instance profile does not apply here: Intelligent Compute always uses the role it mints and ignores a custom Instance Profile ARN.
  • Interrupted multipart uploads are not cleaned up. Uploads succeed, but the role cannot call s3:AbortMultipartUpload, so a failed or retried upload can leave incomplete parts that still incur storage cost. Add an S3 lifecycle rule to the bucket to expire incomplete multipart uploads.
  • Specific object versions are not readable. The role does not grant s3:GetObjectVersion, so on a versioned bucket only the current version of an object is accessible.
  • Buckets with ACLs enabled may reject cross-account writes. The role does not grant s3:PutObjectAcl, so a bucket that requires bucket-owner-full-control on writes from another account cannot be written to. Set the bucket's object ownership to bucket-owner-enforced, which disables ACLs and is the default for buckets created after April 2023.
  • Access is granted per bucket, not per prefix. Key prefixes in Allow buckets entries are ignored, so a compute environment cannot be restricted to part of a bucket.

Resource metrics​

The Metrics tab for a run on Intelligent Compute shows three resource values for CPU and memory: Requested, Allocated, and Used.

MetricSourceWhat it represents
RequestedPipeline process directivesThe CPU and memory your pipeline asked for, as written in your process directives (for example, cpus = 4, memory = 8 GB).
AllocatedScheduler decisionThe CPU and memory the scheduler assigned to the task container. May differ from Requested when the scheduler picks a more cost-effective instance shape that still meets the task's requirements.
UsedNextflow trace dataThe CPU and memory the task consumed, measured from the Nextflow trace metrics (pcpu × realtime for CPU, peakRss for memory). Absent for tasks that did not produce trace data.

How to read the numbers:

  • If Requested is much higher than Allocated, the scheduler found a more efficient instance shape than your directives implied.
  • If Allocated is much higher than Used, the task ran with idle headroom.
  • If Used is close to Allocated, resource utilization is near-optimal for that task.
  • If Allocated matches Requested, confirm whether Seqera Intelligent Compute has been set up with a prediction model.

Configuration options​

OptionValuesDefaultDescription
Seqera Intelligent ComputeEnabled / DisabledDisabledEnables the Intelligent Compute scheduler for this compute environment. This option only appears if Intelligent Compute is enabled for your workspace.
Provisioning modelspotFirst, spot, ondemandspotFirstInstance procurement strategy. spotFirst uses Spot instances and falls back to On-Demand if Spot capacity is unavailable. spot uses Spot instances only. ondemand uses On-Demand instances only.
Instance typesComma-separated EC2 instance type identifiers (for example, m5.xlarge, c5.2xlarge)EmptyRestricts which instance types the scheduler can select. When empty, the scheduler picks the most cost-effective type for each task.
Prediction modelnone, qr/v1, qr/v2noneFor private preview, use qr/v2.
Backend strategyECS, EC2ECSTask execution backend. Use ECS (default). EC2 is reserved for future use.
Fusion snapshotsEnabled / DisabledDisabledWhen enabled, interrupted tasks (for example, after a Spot reclaim) resume from a Fusion snapshot instead of restarting from scratch.
Use NVMe instance storageEnabled / DisabledDisabledRestrict Intelligent Compute to instance types that provide local SSD (NVMe) storage for faster I/O.
Enable warm poolEnabled / DisabledDisabledKeep a pool of idle VMs available to reduce task start latency. Only available when Backend strategy is EC2.
Desired warm VMsInteger—Target number of idle VMs to keep warm. Must be greater than zero. Only visible when Enable warm pool is enabled.
Scale-to-zero timeoutSeconds—Seconds of inactivity after which the warm pool scales to zero. Set to 0 to never scale to zero. Only visible when Enable warm pool is enabled.
On this Page