US 10,257,263 B1Granted

Secure remote execution of infrastructure management

AssigneeAmazon Technologies, Inc.

InventorRichard Wagner

Life of this patent

Estimating the term…

Loading patent…

Abstract

Embodiments provide for the management of resources for an isolated sub-network without use of gateways or other such access mechanisms. A common executor sub-network logically sits between the isolated sub-network and resource provisioning infrastructure, enabling provisioning commands to be executed on behalf of a client in the isolated sub-network. A virtual endpoint enables request objects to be passed to an operations object store of the common executor sub-network. The request object can include information such as a command to be executed and a credential for authorizing the command. An executor service performs the necessary validations and authorizations, and causes the command to be executed on behalf of the client. Upon completion, a response object is provided that includes a result of the execution. The response object includes a limited amount of information, with a full response object being stored by the executor sub-network for auditing or other such purposes.

Claims20

Dependent claims

A computer-implemented method, comprising:

receiving, from a client resource and through a virtual endpoint, a request object to an operations object store, the client resource executing in an isolated customer sub-network of a resource provider environment, the operations object store allocated as part of an executor sub-network of the resource provider environment;
determining, from the request object, a provisioning operation to be performed with respect to the isolated customer sub-network;
validating the provisioning operation using a client credential received with the request object;
causing, by an executor resource of the executor sub-network, the provisioning operation to be executed by one or more provisioning resources in the resource provider environment, the one or more provisioning resources being external to the isolated customer sub-network and the executor sub-network, the one or more provisioning resources being not directly accessible to the isolated customer sub-network, the provisioning operation being performed using a remote credential received with the request object;
receiving, to the executor sub-network, result information for the provisioning operation;
generating an audit response object containing the result information accessible by the executor sub-network;
generating a customer response object including a subset of the result information included in the audit response object;
and
storing the customer response object to the operations object store, wherein the client resource is enabled to retrieve the customer response object from the operations object store through the virtual endpoint.

6 more elements

A computer-implemented method, comprising:

receiving a request object to an operations object store of an executor sub-network of a resource provider environment, the request object including a request to perform a modification of resources in an isolated sub-network of the resource provider environment, the request object received via a virtual endpoint of the isolated sub-network;
causing, by the executor sub-network, the modification to be executed by one or more services of the resource provider environment, the one or more services being external to the isolated sub-network and the executor sub-network, the one or more services being not directly accessible to the isolated customer sub-network;
generating a response object including result information permissible according to at least one security restriction for the isolated sub-network;
and
placing the response object in the operations object store for retrieval through the virtual endpoint to the isolated sub-network.

2 more elements

A system, comprising:

at least one processor;
and
memory including instructions that, when executed by the at least one processor, cause the system to:
receive a request object to an operations object store of an executor sub-network of a resource provider environment, the request object including a request to perform a modification of resources in an isolated sub-network of the resource provider environment, the request object received via a virtual endpoint of the isolated sub-network;
cause, by the executor sub-network, the modification to be executed by one or more services of the resource provider environment, the one or more services being external to the isolated sub-network and the executor sub-network, the one or more services being not directly accessible to the isolated customer sub-network, the modification being performed using a remote credential received with the request object;
generate a response object including result information permissible according to at least one security restriction for the isolated sub-network;
and
placing the response object in the operations object store for retrieval through the virtual endpoint to the isolated sub-network.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/383,585Filed 19 Dec 2016
Granted: 9 Apr 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04L 12/66
Data switching networks: arrangements for connecting between networks having differing types of switching systems, e.g. gateways
G06F 9/00
Arrangements for program control
G06F 21/45
Authentication, i.e. establishing the identity or authorisation of security principals: structures or tools for the administration of authentication
H04L 63/0209
For separating internal from external traffic, e.g. firewalls: architectural arrangements, e.g. perimeter networks or demilitarized zones