Back to results
US 10,652,283 B1Granted
Deriving system architecture from security group relationships
AssigneeAmazon Technologies, Inc.
InventorElaine Harvey
Life of this patent
Estimating the term…
Abstract
Techniques for deriving system architecture from security group relationships are described. One or more security group rules can be obtained for an application, the one or more security group rules controlling communication of one or more security groups. The one or more security group rules can be analyzed to determine placement data for the one or more security groups. The placement data can be provided to a placement service, and the placement service can be caused to deploy at least one virtual machine using the placement data.
Claims20
A computer-implemented method comprising:
- monitoring a security group rules data store, the security group rules data store including a plurality of security group rules corresponding to at least one security group;
- identifying a first set of security group rules defined for a first security group, the first security group corresponding to a tier of a customer application;
- comparing the first set of security group rules to a plurality of security group model rules;
- for each security group model rule, determining a score for each security group rule from the first set of security group rules;
- determining at least one matching security group model rule corresponding to at least one security group model rule having a highest score, the security group model rules corresponding to best practices rules for at least one type of tier;
- labeling the tier of the customer application with a type of tier corresponding to the at least one matching security group model rule;
- and
- sending a request to a placement service to place at least one virtual machine belonging to the tier of the customer application, the request including the type of tier corresponding to the at least one matching security group model rule and spread requirements associated with the type of tier;
- wherein the placement service identifies at least one candidate virtualization guest location based on the type of tier and the spread requirements and deploys the at least one virtual machine to the candidate virtualization guest location.
6 more elements
A system comprising:
- a placement service implemented by a first one or more electronic devices;
- and
- security group monitor implemented by a second one or more electronic devices, the security group monitor including instructions that upon execution cause the security group monitor to:
- monitor a security group rules data store, the security group rules data store including a plurality of security group rules corresponding to at least one security group;
- identify a first set of security group rules defined for a first security group, the first security group corresponding to a tier of a customer application;
- compare the first set of security group rules to a plurality of security group model rules;
- for each security group model rule, determine a score for each security group rule from the first set of security group rules;
- determine at least one matching security group model rule corresponding to at least one security group model rule having a highest score, the security group model rules corresponding to best practices rules for at least one type of tier;
- label the tier of the customer application with a type of tier corresponding to the at least one matching security group model rule;
- and
- send a request to the placement service to place at least one virtual machine belonging to the tier of the customer application, the request including the type of tier corresponding to the at least one matching security group model rule and spread requirements associated with the type of tier;
- wherein the placement service identifies at least one candidate virtualization guest location based on the type of tier and the spread requirements and deploys the at least one virtual machine to the candidate virtualization guest location.
9 more elements
A non-transitory computer readable storage medium including instructions stored thereon which, when executed by at least one processor, cause the at least one processor to:
- monitor a security group rules data store, the security group rules data store including a plurality of security group rules corresponding to at least one security group;
- identify a first set of security group rules defined for a first security group, the first security group corresponding to a tier of a customer application;
- compare the first set of security group rules to a plurality of security group model rules;
- for each security group model rule, determine a score for each security group rule from the first set of security group rules;
- determine at least one matching security group model rule corresponding to at least one security group model rule having a highest score, the security group model rules corresponding to best practices rules for at least one type of tier;
- label the tier of the customer application with a type of tier corresponding to the at least one matching security group model rule;
- and
- send a request to a placement service to place at least one virtual machine belonging to the tier of the customer application, the request including the type of tier corresponding to the at least one matching security group model rule and spread requirements associated with the type of tier;
- wherein the placement service identifies at least one candidate virtualization guest location based on the type of tier and the spread requirements and deploys the at least one virtual machine to the candidate virtualization guest location.
6 more elements
Dependencies are inferred from the claim text.