Gatekeeper resource to protect cloud resources against rogue insider attacks

A method, comprising:

• creating a cloud resource in a different security domain of a cloud computing system than a secure security domain where a virtual gatekeeper resource resides, wherein the virtual gatekeeper resource prevents a list of privileged operations from occurring without prior approval and the secure security domain is separate from the security domain of the cloud resource;
• establishing a virtual gatekeeper resource link between the cloud resource and the virtual gatekeeper resource to secure the cloud resource using the virtual gatekeeper resource, wherein the virtual gatekeeper resource enforces secure access control to the cloud resource for the list of privileged operations;
• receiving a request to perform a privileged operation of the list of privileged operations on the cloud resource, wherein the request includes an identification of the virtual gatekeeper resource linked with the cloud resource and an identification of a user sending the request;
• performing an authorization validation on the request to authorize the user to access the cloud resource;
• performing a link validation to verify that the identification of the virtual gatekeeper resource linked to the cloud resource is a correct virtual gatekeeper resource;
• and
• providing the user just-in-time access to the virtual gatekeeper resource in response to the authorization validation and the link validation to perform the privileged operation.

A method, comprising:

• creating a cloud resource in a security domain of a cloud computing system;
• linking the cloud resource to a virtual gatekeeper resource in a secure security domain in the cloud computing system, wherein the virtual gatekeeper resource enforces secure access control to the cloud resource for a list of privileged operations associated with the virtual gatekeeper resource and the secure security domain is separate from the security domain of the cloud resource;
• sending a privileged operation request to perform one or more privileged operations of the list of privileged operations on the cloud resource;
• receiving just-in-time access to the virtual gatekeeper resource linked to the cloud resource for an allotted time period in response to approval of the privileged operation request;
• and
• performing the one or more privileged operations on the cloud resource using the just-in-time access to the virtual gatekeeper resource during the allotted time period.