Techniques for credential generation

#Modern computing networks provide access to a wide variety of computing resources such as data archives, search engines, data processing, data management, communications, electronic marketplaces, as well as media and entertainment services. As the number and size of such computing resources, and their user communities, have grown and become more sophisticated, a need has arisen to establish increasingly sophisticated usage policies. For example, such policies may include policies that address security, privacy, access, regulatory, and cost concerns.

#Often, policy enforcement in connection with computing resources involves devices of the computing resources authenticating themselves to access other computing resources. A device may provide credentials to another device that are verified to determine actions that may be taken by the device according to any policies applicable to the device. However, modern computer networks often involve the control and administration of multiple devices, including multiple virtual devices. In addition, devices in computing networks are often subject to various attempts at unauthorized access. If an attempt at unauthorized access is successful, a possibility may exist that credentials used by a compromised device could be used for additional unauthorized access, which potentially could have harmful effects. As a result of the complexities of modern computing networks and the risks to which devices in the networks are subjected, effective management of credentials can be a difficult endeavor.

#Various embodiments in accordance with the present disclosure will be described with reference to the drawings, in which:

#FIG. 1 is a schematic diagram illustrating an example environment for implementing aspects in accordance with at least one embodiment;

#FIG. 2 is a schematic diagram depicting aspects of an example virtual computing resources architecture in accordance with at least one embodiment;

#Same numbers are used throughout the disclosure and FIGS. to reference like components and features, but such repetition of numbers is for purposes of simplicity of explanation and understanding, and should not be viewed as a limitation on the various embodiments.

#In the following description, various embodiments will be described. For purposes of explanation, specific configurations and details are set forth in order to provide a thorough understanding of the embodiments. However, it will also be apparent to one skilled in the art that the embodiments may be practiced without the specific details. Furthermore, well-known features may be omitted or simplified in order not to obscure the embodiment being described.

#Techniques described and suggested herein include systems and methods for managing credentials. The credentials may be used to allow computing resources requesting access to other computing resources of a computing network to access such resources. In particular, the credentials may be used as information useful in verifying that a computing resource requesting access to another computing resource is allowed the requested access. As an example, one or more virtual machine instances may provide credentials to access another computing resource, such as a data storage computing resource and/or to control, manage, and/or otherwise operate other virtual machine instances. Credentials may be provided in connection with every request to access computing resources or in other ways, such as to establish a connection with a resource to allow access for a period of time. In an embodiment, various resources are accessible through application programming interfaces (APIs) and credentials may be used by one or more virtual machine instances in connection with making the API calls to access other computing resources. One or more policies may specify actions, such as particular API calls, which are permitted or forbidden. One or more policies may condition one or more actions on possession of particular credentials.