# US 10,320,790 B1 · Temporarily providing a software product access to a resource

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,790 B1
- Document ID: US10320790B1
- Status: Granted
- Kind: B1
- Application number: 14/475,306
- Filed: 2014-09-02
- Granted: 2019-06-11
- Earliest claimed: 2014-09-02
- Assignees: Amazon Technologies, Inc.
- Applicants: Amazon Technologies, Inc.
- Inventors: Gregory Branchek Roth; Graeme David Baer; Jacques Daniel Thomas; Nicholas Andrew Gochenaur
- Web page: https://patentgrep.com/patent/US10320790B1

## CPC

- H04L 63/10: {for controlling access to devices or network resources}
- G06Q 30/0601: Electronic shopping [e-shopping]
- G06Q 40/12: Accounting
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 2463/103: applying security measure for protecting copyright
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Functionality is disclosed herein for providing temporary access to a resource. A software product that is executing in response to a request from a customer may access one or more resources of a software provider. The resources that may be accessed by a software product may be identified within an access policy. The customer is prevented from accessing the resource when the software product is not executing.

## Claims

### Claim 1

A system, comprising:
one or more computing devices operative to:
receive a first request, from a first computing device associated with a first customer of a service provider network, to execute a software product;
execute an instance of the software product within the service provider network on behalf of the first customer;
receive a second request, from the instance of the software product, to access a resource of the service provider network, wherein the first customer is not authorized to access the resource;
determine that a configuration provided by a second customer of the service provider network permits the instance of the software product to access the resource;
provide credentials to the instance of the software product to access the resource, wherein the credentials are used by the instance of the software product to access the resource, and
at least partly in response to a request from the first customer to access the resource, prevent the first customer access to the resource during a time the software product is not executing within the service provider network on behalf of the first customer.

### Claim 2 (depends on 1)

The system of claim 1, wherein the configuration provided by the second customer is a role that is associated with an access policy that authorizes the software product to access the resource.

### Claim 3 (depends on 1)

The system of claim 1, wherein the instance of the software product executes in a first service provided by the service provider network and the resource is available from a second service of the service provider network.

### Claim 4 (depends on 1)

The system of claim 1, wherein the credentials usable to sign requests correspond to a role.

### Claim 5 (depends on 1)

The system of claim 1, wherein the one or more computing devices are further operative to generate a third request to a second service provided by the service provider network to access the resource.

### Claim 6 (depends on 1)

The system of claim 1, wherein the credentials provided to the instance of the software product expire when the instance of the software product stops executing in the service provider network.

### Claim 7 (depends on 1)

The system of claim 1, wherein the second customer is a third-party software provider that provides the software product to the service provider network.

### Claim 8 (depends on 1)

The system of claim 1, wherein the software product is available for purchase from an electronic marketplace that is associated with the service provider network.

### Claim 9 (depends on 1)

The system of claim 1, wherein the one or more computing devices are operative to generate an accounting record for at least one of the first customer or the second customer for use of the resource.

### Claim 10

A computer-implemented method to provide access to a resource during execution of a software product, the method comprising:
executing the software product on a first computing device in a service provider network on behalf of a customer of the service provider network;
receiving, at a second computing device operating in the service provider network, a second request from the software product to access a resource that is made available to the software product when executing in the service provider network, wherein access to the resource is based at least in part on a configuration of a third party, wherein the customer is not authorized to access the resource;
determining, by the second computing device, that the software product is authorized to access the resource;
providing to the software product, by the second computing device, credentials, usable to sign requests, to access to the resource;
providing, by one or more computing devices, the software product access to the resource while the software product is executing in the service provider network at least partly in response to receiving the credentials from the software product; and
at least partly in response to receiving a request from the first customer to access the resource, preventing the customer access to the resource during a time the software product is not executing in the service provider network on behalf of the customer.

### Claim 11 (depends on 10)

The computer-implemented method of claim 10,
further comprising preventing the software product from accessing the resource in response to detecting that the software product is not executing in the service provider network.

### Claim 12 (depends on 10)

The computer-implemented method of claim 10, wherein determining that the software product is authorized to access the resource comprises checking one or more of an access policy or a role specified by the third party to identify the resource that the software product is authorized to access.

### Claim 13 (depends on 10)

The computer-implemented method of claim 10, wherein the resource is as least one of: another software product; a service provided by the service provider network; or data available in the service provider network.

### Claim 14 (depends on 10)

The computer-implemented method of claim 10, wherein the resource is a role that is assumed by the software product to access at least one of: another software product; a service provided by the service provider network; or data available in the service provider network.

### Claim 15 (depends on 10)

The computer-implemented method of claim 10, wherein executing the software product comprises executing an instance of the software product in the service provider network.