Distributed governance of computing resources
AssigneeAmazon Technologies, Inc.
InventorBhushan Nene
Life of this patent
Estimating the term…
Abstract
Technology is described for a distributed ledger service within a service provider environment. The distributed ledger service may implement a distributed ledger formed from immutable append-only data structure and used for governance of computing resources. A policy governing a computing resource may be created and published to the distributed ledger on behalf of an account. The policy may be retrieved from the distributed ledger to govern access to the computing resource by the account.
Claims20
A system, comprising:
- a processor;
- and
- a memory storing instructions which when executed cause the processor to:
- receive metadata defining a policy that governs account access to a computing resource hosted by a service provider environment;
- receive, from an account of the service provider environment, a digital signature approving the policy;
- publish, by a distributed ledger service of the service provider environment, a policy record that includes the metadata and the digital signature to a distributed ledger having a set of policy records that is replicated across a set of accounts for different users of the service provider environment;
- initiate, by the distributed ledger service, a search of the distributed ledger for policy records having policies applicable to the computing resource in response to an access of the computing resource by the account;
- receive a policy record from the distributed ledger that includes the policy that governs account access to the computing resource;
- and
- apply, for the account, the policy defined by the metadata in the policy record to the computing resource.
A method, comprising:
- receiving an indication of an access of a computing resource associated with an account of a service provider environment;
- identifying, for the account, a distributed ledger having a set of policy records that is replicated across a set of accounts for different users of the service provider environment that includes the account;
- receiving, from the distributed ledger, a policy record having a policy applicable to the access of the computing resource associated with the account;
- and
- applying, for the account, the policy to the access of the computing resource.
A non-transitory computer readable medium comprising instructions which when executed by one or more processors of a computer system cause the one or more processors to:
- receive, at a distributed ledger service of a service provider environment, information identifying an access of a computing service hosted by the service provider environment by an account of the service provider environment;
- determine, for the account, a distributed ledger having a set of policy records that is replicated across a network to a set of accounts for different users of the service provider environment;
- receive, from the distributed ledger determined for the account, a policy record having a policy applicable to the access of the computing service by the account;
- and
- send the policy to the computing service to apply the policy to the access of the computing service by the account.
Dependencies are inferred from the claim text.