Compartments
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Anders Samuelsson, Bradley Jeffery Behm
Life of this patent
Estimating the term…
Abstract
Customers of a service provider are able to provision compartments of the accounts. The both the accounts and the compartments, in some embodiments, may have associated computing resources and identities. One or more identities of the account may be authorized to perform administrative operations in the compartment. Identities of the compartment may lack the ability to perform any administrative actions outside of the compartment but inside of the account.
Claims20
A system, comprising:
- at least one processor;
- and
- at least one memory comprising instructions that, in response to execution by the at least one processor, cause the system to:
- provide, to one or more identities in a sub-account of an account, access to a subset of computing resources of a plurality of computing resources, wherein information stored in one or more data stores indicates that the one or more identities have permissions to access the subset of computing resources, wherein the permissions are insufficient to access one or more of the plurality of computing resources outside of the subset of computing resources;
- wherein the subset of computing resources is indicated as provisioned to the sub-account in the information stored in the one or more data stores;
- wherein the sub-account is indicated to have authorization to perform administrative operations on the subset of computing resources, the administrative operations comprising operations to permit the one or more identities to access the subset of computing resources;
- and
- wherein authorization to perform the administrative operations on the subset of computing resources is based, at least in part, on access privileges assigned from the account to the sub-account.
A computer-implemented method, comprising:
- hosting, at a computer system, a plurality of computing resources on behalf of an account;
- and
- using at least one processor of the computer system to execute instructions stored in at least one memory of the computer system, the instructions causing the at least one processor to provide access, to one or more identities associated with a sub-account of the account, to a subset of computing resources of the plurality of computing resources, wherein the one or more identities have permission to access the subset of computing resources, wherein the permission is insufficient to access one or more of the plurality of computing resources not included in the subset of computing resources;
- wherein the subset of computing resources is provisioned to the sub-account;
- wherein the sub-account is authorized to perform administrative operations on the subset of computing resources;
- and
- wherein authorization to perform the administrative operations on the subset of computing resources is based, at least in part, on privileges assigned from the account to the sub-account.
At least one non-transitory computer-readable storage medium comprising executable instructions that, as a result of execution by one or more processors of at least one computer system, cause the at least one computer system to:
- provide, to one or more identities associated with a sub-account of an account, access to a subset of computing resources of a plurality of computing resources, wherein the one or more identities have permissions to access the subset of computing resources but insufficient permissions to access one or more of the plurality of computing resources outside of the subset of computing resources;
- wherein the subset of computing resources is provisioned to the sub-account;
- wherein the sub-account is authorized to perform administrative operations on the subset of computing resources;
- and
- wherein authorization to perform the administrative operations on the subset of computing resources is based, at least in part, on privileges assigned from the account to the sub-account.
Dependencies are inferred from the claim text.