# US 10,320,624 B1 · Access control policy simulation and testing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,624 B1 - Document ID: US10320624B1 - Status: Granted - Kind: B1 - Application number: 14/042,277 - Filed: 2013-09-30 - Granted: 2019-06-11 - Earliest claimed: 2013-09-30 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Gregory Branchek Roth; Daniel Stephen Popick; Derek Avery Lyon; John Michael Morkel; Graeme David Baer; Ajith Harshana Ranabahu; Khaled Salah Sedky - Web page: https://patentgrep.com/patent/US10320624B1 ## CPC - G06F 21/33: using certificates - G06F 16/93: Document management systems - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 43/55: Testing of service level quality, e.g. simulating service usage - H04L 63/101: {Access control lists [ACL]} - H04L 63/102: {Entity profiles} - H04L 63/164: {at the network layer} - G06F 3/0601: {Interfaces specially adapted for storage systems} - G06F 21/125: {by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code} - G06F 21/31: User authentication - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and apparatus for testing and simulating an access control policy are disclosed. Evaluating an access control policy may be performed by utilizing a deny statement that causes the access request to be rejected despite actions indicated in the access request being authorized. Further, an independent simulation environment may be utilized for testing access control policy evaluation. ## Claims ### Claim 1 A computer-implemented method, comprising: identifying a computing resource associated with a first access request; identifying an access control policy associated with the computing resource and the first access request; generating a second access request that simulates access to the computing resource; evaluating the second access request to determine whether one or more actions indicated by the first access request are granted per the access control policy; generating debugging information regarding the evaluation of the second access request; and providing the debugging information in response to the first access request, wherein the second access request includes an indication that the one or more actions indicated by the first access request are not to be performed. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the debugging information is encrypted so as to be accessible using a cryptographic key. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein: the second access request is evaluated by an access control enforcement service of a computing resource service provider; and the access control policy is an active access control policy that specifies actions associated with one or more computing resources that are hosted by the computing resource service provider. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the method further comprises storing the debugging information in a log file accessible to a customer. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the access request is implemented using security privileges provided by a substitute user interface. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein: the one or more actions include multiple actions; and evaluating the second access request includes evaluating each action of the multiple actions irrespective of whether the one or more access control policies prohibit performance of one of the multiple actions. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: on a condition that evaluation of the second access request indicates that one or more of the one or more actions indicated by the first access request are denied per the access control policy, providing one or more remediation options for the access control policy that each specify a manner of changing the access control policy to cause fulfillment of the first access request to be in compliance with the access control policy. ### Claim 8 One or more non-transitory computer-readable storage media having collectively stored thereon instructions that, if executed by one or more processors of a system, cause the system to: identify a computing resource associated with a first access request; identify an access control policy associated with the computing resource and the first access request; generate a second access request that simulates access to the computing resource; process a result of the second access request and the access control policy to generate information associated with the access control policy; and provide the information in response to the first access request, wherein the information associated with the access control policy is debugging information associated with evaluating the request, and wherein the second access request includes an indication that one or more actions indicated by the first access request are not to be performed. ### Claim 9 (depends on 8) The one or more non-transitory computer-readable storage media of claim 8, wherein: the debugging information is usable for obtaining detailed information regarding the evaluation of the first access request. ### Claim 10 (depends on 9) The one or more non-transitory computer-readable storage media of claim 9, wherein the debugging information is encoded in a token or stored in a log file. ### Claim 11 (depends on 8) The one or more non-transitory computer-readable storage media of claim 8, wherein the instructions further cause the system to receive context information and utilize the received context information in evaluating the second access request. ### Claim 12 (depends on 11) The one or more non-transitory computer-readable storage media of claim 11, wherein the context information indicates that the second access request is to be evaluated in accordance with at least one of: the request being received from a different network address than a network address from which the access determination request was received, or the request being received at a different time than a time when the access determination request was received. ### Claim 13 (depends on 11) The one or more non-transitory computer-readable storage media of claim 11, wherein the received context information conflicts with actual context information associated with the first access request. ### Claim 14 (depends on 13) The one or more non-transitory computer-readable storage media of claim 13, wherein: the second access request is evaluated by a policy testing service of a computing resource service provider; and the policy testing service provides policy evaluation for policies that do not govern access to computing resources hosted by the computing resource service provider. ### Claim 15 (depends on 8) The one or more non-transitory computer-readable storage media of claim 8, wherein the instructions further cause the system to, on a condition that the first access request is denied per the access control policy, provide remediation options for the access control policy. ### Claim 16 (depends on 8) The one or more non-transitory computer-readable storage media of claim 8, wherein the identified access control policy does not govern access to the computing resource. ### Claim 17 (depends on 8) The one or more non-transitory computer-readable storage media of claim 8, wherein: the second access request is evaluated by an access control enforcement engine. ### Claim 18 A system, comprising: one or more processors; and memory including instructions that, if executed by the one or more processors, cause the system to: identify a computing resource associated with a first access request; identify one or more access control policies associated with the computing resource and the first access request; generate a second access request that simulates access to the computing resource; evaluate a result of the second access request and the one or more access control policies; and generate information usable for debugging the evaluation of the first access request, the information indicating whether the first access request is authorized or denied and on a condition that the access request is denied, the information specifying one or more reasons the first access request is denied per the one or more access control policies, wherein the second access request includes an indication that one or more actions indicated by the first access request are not to be performed. ### Claim 19 (depends on 18) The system of claim 18, wherein: the system further comprises a policy remediation service configured to generate one or more remediation options for the one or more access control policies; and the one or more remediation options, when used as an access control policy, cause the first access request to be authorized. ### Claim 20 (depends on 18) The system of claim 18, wherein: the first access request comprises a parameter, the parameter specifying the first access request to be evaluated in a simulation mode. ### Claim 21 (depends on 20) The system of claim 20, wherein the first access request is implemented using security privileges provided by an interface that allows users to access the computing resource with the security privileges of another user. ### Claim 22 (depends on 18) The system of claim 18, wherein the memory further includes instructions that, if executed by the one or more processors, cause the system to receive overriding context information associated with the first access request and utilize the overriding context information in evaluating the second access request in place of actual context information of the first access request. ### Claim 23 (depends on 18) The system of claim 18, wherein: the memory further includes instructions that, if executed by the one or more processors, cause the system to store the information in a log file; and the log file is accessible by a customer or a policy remediation service. ### Claim 24 (depends on 18) The system of claim 18, wherein: the one or more actions indicated by the first access request are associated with one or more computing resources provisioned by a computing resource service provider. ### Claim 25 (depends on 18) The system of claim 18, wherein: the system is operated by a computing resource service provider; the information usable for debugging the evaluation of the first access request is provided to a customer of the computing resource service provider; and one or more reasons that the first access request is denied are specified to the customer.