End-to-end policy enforcement in the presence of a traffic midpoint device

A non-transitory computer-readable storage medium storing instructions executable by one or more processors to perform steps for generating function-level instructions for a user managed server included in a plurality of managed servers according to a security policy that comprises a set of one or more rules, the steps comprising:

• identifying a traffic midpoint device through which the user managed server of the plurality of managed servers uses a service provided by a provider device;
• determining a relevant rule from the set of rules that specifies the service and that is applicable to communication between the user managed server and the provider device;
• generating, based on the relevant rule, a frontend rule that specifies the service and that is applicable to communication between the user managed server and the traffic midpoint device;
• generating, based on the frontend rule, a frontend function-level instruction including a reference to an actor-set authorized to communicate with the user managed server to provide the service to the user managed server, the actor-set including the traffic midpoint device;
• and
• sending the frontend function-level instruction to the user managed server to configure the user managed server to enforce the frontend rule on communication with the actor-set including the traffic midpoint device.

A system for generating function-level instructions for a user managed server included in a plurality of managed servers according to a security policy that comprises a set of one or more rules, the system comprising:

• one or more processors;
• and
• a non-transitory, computer-readable storage medium storing computer program modules executable by the one or more processors to perform steps comprising:
• identifying a traffic midpoint device through which the user managed server of the plurality of managed servers uses a service provided by a provider device;
• determining a relevant rule from the set of rules that specifies the service and that is applicable to communication between the user managed server and the provider device;
• generating, based on the relevant rule, a frontend rule that specifies the service and that is applicable to communication between the user managed server and the traffic midpoint device;
• generating, based on the frontend rule, a frontend function-level instruction including a reference to an actor-set authorized to communicate with the user managed server to provide the service to the user managed server, the actor-set including the traffic midpoint device;
• and
• sending the frontend function-level instruction to the user managed server to configure the user managed server to enforce the frontend rule on communication with the actor-set including the traffic midpoint device.