# US 11,113,096 B2 · Permissions for a cloud environment application programming interface > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,096 B2 - Document ID: US11113096B2 - Status: Granted - Kind: B2 - Application number: 16/410,274 - Filed: 2019-05-13 - Published: 2020-11-19 - Granted: 2021-09-07 - Earliest claimed: 2019-05-13 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Timothy Martin Potter - Web page: https://patentgrep.com/patent/US11113096B2 ## CPC - G06F 9/468: {Specific access rights for resources, e.g. using capability register} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 9/5072: {Grid computing} - G06F 11/3688: {for test execution, e.g. scheduling of test suites} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/0281: {Proxies} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/105: {Multiple levels of security} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In some examples, a system tests a program that includes code to invoke calls of an application programming interface (API) for managing resources of a cloud environment. As part of the testing of the program, the system determines permissions for the invoked calls of the API, creates a collection of the determined permissions, and associates the collection of the determined permissions with an access policy of the cloud environment, the access policy to control use of the API for managing resources of the cloud environment. ## Claims ### Claim 1 A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to: test a program that comprises code to invoke calls of an application programming interface (API) for managing resources of a cloud environment; as part of the testing of the program, determine permissions for the invoked calls of the API; create a collection of the determined permissions; and associate the collection of the determined permissions with an access policy of the cloud environment, the access policy to control use of the API for managing resources of the cloud environment. ### Claim 2 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the testing is performed by a test code. ### Claim 3 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the calls of the API comprise a call selected from among a call to create a resource in the cloud environment, a call to modify a resource in the cloud environment, or a call to remove a resource in the cloud environment. ### Claim 4 (depends on 3) The non-transitory machine-readable storage medium of claim 3, wherein the resources comprise a virtual resource. ### Claim 5 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the instructions that upon execution cause the system to: as part of the testing: receive, at a proxy, the calls of the API, and determine, by the proxy, a permission associated with each of the calls. ### Claim 6 (depends on 5) The non-transitory machine-readable storage medium of claim 5, wherein the determining of the permission associated with each of the calls comprises accessing a library that maps permissions to respective API calls. ### Claim 7 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the instructions that upon execution cause the system to: responsive to a change in the program: test the changed program by invoking calls of the API included in code of the changed program, create an updated collection of permissions for the invoked calls of the API included in the code of the changed program; associate the updated collection of permissions with the access policy of the cloud environment. ### Claim 8 (depends on 7) The non-transitory machine-readable storage medium of claim 7, wherein creating the updated collection of permissions comprises: determining permissions for the invoked calls of the API included in the code of the changed program; comparing the permissions for the invoked calls of the API included in the code of the changed program with the permissions for the invoked calls of the API included in the code of the program before the changing of the program. ### Claim 9 (depends on 8) The non-transitory machine-readable storage medium of claim 8, wherein creating the updated collection of permissions comprises: based on the comparing, identifying a first permission not included in the collection of the determined permissions and that is to be used for the changed program, and identifying a second permission included in the collection of the determined permissions and that is not used for the changed code, and including the first permission in the updated collection of permissions, and excluding the second permission from the updated collection of permissions. ### Claim 10 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein testing the program comprises testing a portion of the program, the portion comprising the code to invoke calls of the API. ### Claim 11 (depends on 10) The non-transitory machine-readable storage medium of claim 10, wherein testing the portion of the program comprises testing a selected portion of a plurality of different portions of the program, the different portions managing different types of resources of the cloud environment. ### Claim 12 A system comprising: a processor; and a non-transitory storage medium storing proxy instructions executable on the processor to: receive, from a test engine, calls of an application programming interface (API) included in code of a target program that manages resources of a cloud environment; determine a collection of permissions associated with the calls of the API; and associate the collection of the permissions with an access policy of the cloud environment, the access policy to control use of the API for managing the resources of the cloud environment. ### Claim 13 (depends on 12) The system of claim 12, wherein associating the collection of the permissions with the access policy comprises including the collection of the permissions in the access policy. ### Claim 14 (depends on 12) The system of claim 12, wherein the access policy determines whether the target program is able to invoke calls to the API. ### Claim 15 (depends on 12) The system of claim 12, wherein the calls of the API comprise a call selected from among a call to create a virtual resource in the cloud environment, a call to modify a virtual resource in the cloud environment, or a call to remove a virtual resource in the cloud environment. ### Claim 16 (depends on 12) The system of claim 12, wherein the determining of the collection of permissions associated with the calls of the API comprises accessing a library that maps permissions to respective API calls, the library maintained by a provider of the cloud environment. ### Claim 17 (depends on 12) The system of claim 12, wherein the proxy instructions are executable on the processor to: responsive to a change in the target program: test the changed target program by invoking calls of the API included in code of the changed target program, create an updated collection of permissions for the invoked calls of the API included in the code of the changed target program; associate the updated collection of permissions with the access policy of the cloud environment. ### Claim 18 (depends on 17) The system of claim 17, wherein the creating of the updated collection of permissions comprises: determining permissions for the invoked calls of the API included in the code of the changed target program; comparing the permissions for the invoked calls of the API included in the code of the changed target program with the permissions for the invoked calls of the API included in the code of the target program before the changing of the target program. ### Claim 19 A method performed by a system comprising a hardware processor, comprising: testing a program that comprises code to invoke calls of an application programming interface (API) for accessing resources of a cloud environment; as part of the testing of the program, creating a collection of permissions for the invoked calls of the API; associating the collection of permissions with an access policy of the cloud environment, the access policy to control use of the API for managing resources of the cloud environment; and in response to a change of the program, testing the changed program by invoking calls of the API included in code of the changed program, creating an updated collection of permissions for the invoked calls of the API included in the code of the changed program, and associating the updated collection of permissions with the access policy of the cloud environment. ### Claim 20 (depends on 19) The method of claim 19, wherein the calls of the API comprise a call selected from among a call to create a resource in the cloud environment, a call to modify a resource in the cloud environment, or a call to remove a resource in the cloud environment.