# US 11,308,126 B2 · Different hierarchies of resource data objects for managing system resources > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,126 B2 - Document ID: US11308126B2 - Status: Granted - Kind: B2 - Application number: 16/692,073 - Filed: 2019-11-22 - Published: 2020-03-26 - Granted: 2022-04-19 - Earliest claimed: 2016-09-26 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Brian Collins; Zachary Mohamed Shalla; Marvin Michael Theimer; John Petry; Michael Hart; Serge Hairanian; Anders Samuelsson; Salvador Salazar Sepulveda; Ji Luo - Web page: https://patentgrep.com/patent/US11308126B2 ## CPC - G06F 16/282: {Hierarchical databases, e.g. IMS, LDAP data stores or Lotus Notes} - G06F 9/5061: {Partitioning or combining of resources} - G06F 16/2365: {Ensuring data consistency and integrity} - G06F 9/546: {Message passing systems or structures, e.g. queues} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Resource data objects describing resources in a system may be maintained in multiple different hierarchies for applying policies to manage the resources. Lookup requests may access the different hierarchies to determine which policies are applicable to a given resource based on the policies identified in each of the hierarchies. Modifications to hierarchies may be performed in isolation so that the application of policies in other hierarchies is unchanged by modifications to a different hierarchy. Access restrictions may be enforced with respect to hierarchies so that different users may be permitted access to different hierarchies for system resource management. ## Claims ### Claim 1 A system, comprising at least one processor; and a memory, storing program instructions that when executed by the at least one processor cause the at least one processor to implement a hierarchical data store, the hierarchical data store configured to: receive a policy lookup request for a resource data object at the hierarchical data store, wherein the resource data object is one of a plurality of resource data objects that are stored in the hierarchical data store as part of a plurality of different hierarchies, wherein the plurality of different hierarchies of the resource data objects identify policies applicable to the behavior of resources corresponding to the resource data objects in a system; responsive to the policy lookup request: identify one or more of the different hierarchies linked to the resource data object; determine different policies identified by the one or more of the different hierarchies, wherein the different policies are applicable to the resource data object; detect a conflict between the different policies applicable to the resource data object; and return a resolved version of the different policies applicable to the resource data object. ### Claim 2 (depends on 1) The system of claim 1, wherein to detect the conflict between the different policies applicable to the resource data object, the hierarchical data store is configured to determine that respective policy types for the different policies match. ### Claim 3 (depends on 1) The system of claim 1, wherein to determine the different policies applicable to the resource data object, the hierarchical data store is configured to traverse respective paths of the identified hierarchies that include the resource data object to respective root nodes of the identified hierarchies. ### Claim 4 (depends on 1) The system of claim 1, wherein the resolved version of the different policies applicable to the resource data object is determined based, at least in part, on one or more precedence rules for resolving policy conflicts. ### Claim 5 (depends on 1) The system of claim 1, wherein the resolved version of the different policies applicable to the resource data object is determined based, at least in part, on respective nodes in paths of the resource data object in the identified hierarchies to which the different policies are applicable. ### Claim 6 (depends on 1) The system of claim 1, wherein the system that implements the resources is implemented as a network-based service offered by a provider network. ### Claim 7 (depends on 1) The system of claim 1, wherein the hierarchical data store is further configured to: receive a second policy lookup request for a second resource data object at the hierarchical data store; responsive to the second policy lookup request: identify one or more of the different hierarchies linked to the second resource data object; detect no conflict between different policies applicable to the second resource data object; and return the different policies applicable to the second resource data object. ### Claim 8 A method, comprising: receiving a policy lookup request for a resource data object at a data store, wherein the resource data object is one of a plurality of resource data objects that are stored in the data store as part of a plurality of different hierarchies, wherein the plurality of different hierarchies of the resource data objects identify policies applicable to the behavior of resources corresponding to the resource data objects in a system; responsive to the policy lookup request: identifying one or more of the different hierarchies linked to the resource data object; determining different policies identified by the one or more of the different hierarchies, wherein the different policies are applicable to the resource data object; detecting a conflict between the different policies applicable to the resource data object; and returning a resolved version of the different policies applicable to the resource data object. ### Claim 9 (depends on 8) The method of claim 8, wherein detecting the conflict between the different policies applicable to the resource data object comprises determining that respective policy types of the different policies match. ### Claim 10 (depends on 8) The method of claim 8, wherein the different policies applicable to the resource data object are determined based on traversing respective paths of the identified hierarchies that include the resource data object to respective root nodes of the identified hierarchies. ### Claim 11 (depends on 8) The method of claim 8, wherein the resolved version of the different policies applicable to the resource data object is determined based, at least in part, on one or more precedence rules for resolving policy conflicts. ### Claim 12 (depends on 8) The method of claim 8, wherein the resolved version of the different policies applicable to the resource data object is determined based, at least in part, on respective nodes in paths of the resource data object in the identified hierarchies to which the different policies are applicable. ### Claim 13 (depends on 8) The method of claim 8, wherein the system that implements the resources is implemented as a network-based service offered by a provider network. ### Claim 14 (depends on 8) The method of claim 8, further comprising: receiving a second policy lookup request for a second resource data object at the hierarchical data store; responsive to the second policy lookup request: identifying one or more of the different hierarchies linked to the second resource data object; detecting no conflict between different policies applicable to the second resource data object; and returning the different policies applicable to the second resource data object. ### Claim 15 One or more non-transitory, computer-readable storage media, storing program instructions that when executed on or across one or more computing devices cause the one or more computing devices to implement: receiving a policy lookup request for a resource data object at a data store, wherein the resource data object is one of a plurality of resource data objects that are stored in the data store as part of a plurality of different hierarchies, wherein the plurality of different hierarchies of the resource data objects identify policies applicable to the behavior of resources corresponding to the resource data objects in a system; responsive to the policy lookup request: identifying one or more of the different hierarchies linked to the resource data object; determining different policies identified by the one or more of the different hierarchies, wherein the different policies are applicable to the resource data object; detecting a conflict between the different policies applicable to the resource data object; and returning a resolved version of the different policies applicable to the resource data object. ### Claim 16 (depends on 15) The one or more non-transitory, computer-readable storage media of claim 15, wherein, in detecting the conflict between the different policies applicable to the resource data object, the program instructions cause the one or more computing devices to further implement determining that respective policy types of the different policies match. ### Claim 17 (depends on 15) The one or more non-transitory, computer-readable storage media of claim 15, wherein the different policies applicable to the resource data object are determined based on traversing respective paths of the identified hierarchies that include the resource data object to respective root nodes of the identified hierarchies. ### Claim 18 (depends on 15) The one or more non-transitory, computer-readable storage media of claim 15, wherein the resolved version of the different policies applicable to the resource data object is determined based, at least in part, on one or more precedence rules for resolving policy conflicts. ### Claim 19 (depends on 15) The one or more non-transitory, computer-readable storage media of claim 15, wherein the resolved version of the different policies applicable to the resource data object is determined based, at least in part, on respective nodes in paths of the resource data object in the identified hierarchies to which the different policies are applicable. ### Claim 20 (depends on 15) The one or more non-transitory, computer-readable storage media of claim 15, wherein the system that implements the resources is implemented as a network-based service offered by a provider network.