Techniques for automatic bucket access policy generation

An apparatus, comprising:

• a processor;
• and
• a memory comprising instructions that when executed by the processor cause the processor to:
• identify log data for a data bucket, the log data comprising access records for the data bucket and the data bucket comprising enterprise information;
• apply one or more filter algorithms to the log data to determine a set of entities that have accessed the data bucket, the one or more filter algorithms to remove noise from the log data or resolve permutations of accesses to the data bucket by a common entity;
• determine a set of one or more access characteristics for each entity in the set of entities based on the log data, each set of one or more access characteristics to include one or more access types to the data bucket requested by a corresponding entity;
• analyze the set of one or more access characteristics for each entity in the set of entities to determine a set of access requirements for each entity in the set of entities;
• create first and second subsets of the set of entities based on the set of access requirements for each entity in the set of entities, the first subset of the set of entities to include one or more entities that require read-only access to the data bucket and the second subset of the set of entities to include one or more entities that require read-write access to the data bucket;
• and
• generate an access policy for the data bucket based on the first and second subsets of the set of entities, the access policy to allow read-only access to the data bucket by the first subset of the set of entities, allow read-write access to the data bucket by the second subset of the set of entities, and prevent access to the data bucket by entities absent from the first and second subsets of the set of entities.

A computer-implemented method, comprising:

• identifying log data for a data bucket, the log data comprising access records for the data bucket and the data bucket comprising enterprise information;
• applying one or more filter algorithms to the log data to determine a set of entities that have accessed the data bucket, the one or more filter algorithms to remove noise from the log data or resolve permutations of accesses to the data bucket by a common entity;
• determining a set of one or more access characteristics for each entity in the set of entities based on the log data, each set of one or more access characteristics to include one or more access types to the data bucket requested by a corresponding entity;
• analyzing the set of one or more access characteristics for each entity in the set of entities to determine a set of access requirements for each entity in the set of entities;
• creating first and second subsets of the set of entities based on the set of access requirements for each entity in the set of entities, the first subset of the set of entities to include one or more entities that require read-only access to the data bucket and the second subset of the set of entities to include one or more entities that require read-write access to the data bucket;
• and
• generating an access policy for the data bucket based on the first and second subsets of the set of entities, the access policy to allow read-only access to the data bucket by the first subset of the set of entities, allow read-write access to the data bucket by the second subset of the set of entities, and prevent access to the data bucket by entities absent from the first and second subsets of the set of entities.