Virtual firewalls for multi-tenant distributed services

A computer-implemented method, comprising:

• a resource server computer configured to at least:
• maintain, in a supervisory layer of a multi-tenant distributed service, an authorization service configured to update a plurality of resource policy sets associated with a plurality of customer accounts of the multi-tenant distributed service;
• and
• maintain, by a service, a plurality of provisioned resources of the multi-tenant distributed service, the plurality of provisioned resources provisioned on behalf of an individual customer account of the multi-tenant distributed service that is enabled to delegate authority to a plurality of users in the individual customer account to establish one or more resource policy sets with respect to the plurality of provisioned resources that are provisioned on behalf of the individual customer account, wherein a decision engine is configured to evaluate access requests for the service;
• the decision engine configured to, at least:
• receive, from the authorization service, a particular policy of the plurality of resource policy sets;
• receive a request with respect to a provisioned resource of the plurality of provisioned resources;
• identify an individual policy in a local policy cache, the local policy cache updated utilizing the particular policy and associated with the request;
• determine a decision data set from a decision data cache associated with the decision engine based at least in part on the identified individual policy, the decision data set including at least one of authentication data that indicates an authenticity of a resource policy included in the plurality of resource policy sets, resource name resolution data that maps resource names to a particular multi-tenant distributed service of the multi-tenant distributed service, or geographic location mapping data that indicates mappings of submitted requests to geographic locations referenced by one or more policies in the local policy cache;
• evaluate the request based at least in part on the individual policy and the determined decision data set, the individual policy identifying conditions to be fulfilled before a set of actions are permitted with respect to the provisioned resource;
• and
• allow or deny the request based at least in part on evaluating the request.

A computer-implemented method for a multi-tenant distributed service, comprising:

• a resource server computer configured to at least:
• maintain, in a supervisory layer of a multi-tenant distributed service, an authorization service configured to update a plurality of resource policy sets associated with a plurality of customer accounts of the multi-tenant distributed service;
• and
• maintain, by a service, a resource policy set of the plurality of resource policy sets comprising at least a policy that identifies a condition to be fulfilled before an action is permitted with respect to a plurality of provisioned resources maintained by the multi-tenant distributed service and provisioned on behalf of an individual customer account of the multi-tenant distributed service, the resource policy set being associated with the plurality of provisioned resources and established by a user authorized by the individual customer account, wherein a decision engine is configured to evaluate access requests for the service;
• the decision engine configured to, at least:
• receive, from the authorization service, a particular policy of the plurality of resource policy sets;
• receive a request for a provisioned resource of the plurality of provisioned resources;
• update a local policy cache utilizing the particular policy, the local policy cache associated with the request;
• determine a decision data set from a decision data cache associated with the decision engine based at least in part on the particular policy, the decision data set including at least one of authentication data that indicates an authenticity of a resource policy included in the plurality of resource policy sets, resource name resolution data that maps resource names to a particular multi-tenant distributed service of the multi-tenant distributed service, or geographic location mapping data that indicates mappings of submitted requests to geographic locations referenced by one or more policies in the local policy cache;
• evaluate the request based at least in part on identifying an individual policy in the updated local policy cache and the determined decision data set, the individual policy indicating one or more conditions associated required to be fulfilled to permit one or more actions associated with the request;
• and
• allow or deny the request based at least in part on evaluating the request.