# US 12,192,245 B2 · Control of cloud infrastructure configuration > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,245 B2 - Document ID: US12192245B2 - Status: Granted - Kind: B2 - Application number: 18/100,172 - Filed: 2023-01-23 - Published: 2024-07-25 - Granted: 2025-01-07 - Earliest claimed: 2023-01-23 - Assignees: ServiceNow, Inc. - Applicants: ServiceNow, Inc. - Inventors: Ganesh Parameshwar Bhat; Ramkumar Devanathan; Meenakshi Parameswaran - Web page: https://patentgrep.com/patent/US12192245B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An example embodiment may involve determining, based on a predefined policy, one or more configuration settings, wherein the predefined policy specifies a permitted value of a key within the configuration settings; obtaining, from a cloud-based service provider, an actual value of the key; determining, by applying the predefined policy, that the actual value of the key does not match the permitted value of the key; identifying a remediation for the key that includes determining an updated value of the key, wherein the updated value of the key satisfies the predefined policy; and causing the updated value to be applied to the key in the cloud-based service provider. ## Claims ### Claim 1 A method comprising: determining, based on a predefined policy, one or more configuration settings, wherein the predefined policy specifies a permitted value of a key within the configuration settings; obtaining, from a cloud-based service provider, an actual value of the key, wherein a collector application contains one or more collector routines that are configured to be able to obtain values of specific keys from the cloud-based service provider, and wherein obtaining the actual value of the key comprises: determining, based on the configuration settings, a collector routine configured to request and receive the actual value of the key from the cloud-based service provider; and storing a name of the key and the actual value of the key in a database; identifying, after obtaining the actual value of the key, that the cloud-based service provider is no longer accessible; determining, by applying the predefined policy, while the cloud-based service provider is no longer accessible, that the actual value of the key does not match the permitted value of the key, wherein a policy engine application is configured to apply the predefined policy to stored keys, and wherein determining that the actual value of the key does not match the permitted value of the key comprises: loading, by the policy engine application, the predefined policy; reading, by the policy engine application, the actual value of the key from the database; comparing, by the policy engine application, the actual value of the key to the permitted value of the key; and generating, by the policy engine application, a report indicating that the actual value of the key does not match the permitted value of the key; identifying a remediation for the key that includes determining an updated value of the key, wherein the updated value of the key satisfies the predefined policy; and causing the updated value to be applied to the key in the cloud-based service provider after the cloud-based service provider become accessible again. ### Claim 2 (depends on 1) The method of claim 1, wherein the predefined policy specifies a second permitted value of a second key within the configuration settings, the method further comprising: obtaining, from the cloud-based service provider, a second actual value of the second key; determining, by applying the predefined policy, that the second actual value of the second key does not match the second permitted value of the second key; identifying a second remediation for the second key that includes determining a second updated value of the second key, wherein the second updated value of the second key satisfies the predefined policy; and causing the second updated value to be applied to the second key in the cloud-based service provider. ### Claim 3 (depends on 1) The method of claim 1, wherein the predefined policy specifies a second permitted value of a second key within the configuration settings, the method further comprising: obtaining, from a second cloud-based service provider, a second actual value of the second key; determining, by applying the predefined policy, that the second actual value of the second key does not match the second permitted value of the second key; identifying a second remediation for the second key that includes determining a second updated value of the second key, wherein the second updated value of the second key satisfies the predefined policy; and causing the second updated value to be applied to the second key in the second cloud-based service provider. ### Claim 4 (depends on 1) The method of claim 1, wherein the one or more configuration settings relate to allocation or use of computing resources within the cloud-based service provider. ### Claim 5 (depends on 1) The method of claim 1, wherein the predefined policy contains define logical or algebraic conditions or tests and were specified at least in part by way of menu selections from a graphical user interface. ### Claim 6 (depends on 1) The method of claim 1, wherein the predefined policy is specified by an executable script that was generated at least in part by request of a user. ### Claim 7 (depends on 1) The method of claim 1, wherein a remediation engine application is configured to determine remediations for keys with values violating the predefined policy, and wherein identifying the remediation for the key comprises: identifying, by the remediation engine application and based on the report, the key; looking up, by the remediation engine application and based on the key, the remediation in a predefined set of remediations; and determining, by the remediation engine application and from the remediation, the updated value. ### Claim 8 (depends on 7) The method of claim 7, wherein causing the updated value to be applied to the key in the cloud-based service provider comprises: executing, by the remediation engine application, program code or logic specified in the remediation that is configured apply the updated value to the key in the cloud-based service provider. ### Claim 9 (depends on 7) The method of claim 7, wherein causing the updated value to be applied to the key in the cloud-based service provider comprises: executing, by the remediation engine application, program code or logic specified in the remediation to notify a human user of a violation of the predefined policy relating to the key. ### Claim 10 (depends on 1) The method of claim 1, wherein the predefined policy is associated with a schedule or frequency at which the actual value of the key is to be obtained from the cloud-based service provider and the predefined policy is to be applied to the actual value of the key. ### Claim 11 A non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a computing system, cause the computing system to perform operations comprising: determining, based on a predefined policy, one or more configuration settings, wherein the predefined policy specifies a permitted value of a key within the configuration settings; obtaining, from a cloud-based service provider, an actual value of the key, wherein a collector application contains one or more collector routines that are configured to be able to obtain values of specific keys from the cloud-based service provider, and wherein obtaining the actual value of the key comprises: determining, based on the configuration settings, a collector routine configured to request and receive the actual value of the key from the cloud-based service provider; and storing a name of the key and the actual value of the key in a database; identifying, after obtaining the actual value of the key, that the cloud-based service provider is no longer accessible; determining, by applying the predefined policy, while the cloud-based service provider is no longer accessible, that the actual value of the key does not match the permitted value of the key, wherein a policy engine application is configured to apply the predefined policy to stored keys, and wherein determining that the actual value of the key does not match the permitted value of the key comprises: loading, by the policy engine application, the predefined policy; reading, by the policy engine application, the actual value of the key from the database; comparing, by the policy engine application, the actual value of the key to the permitted value of the key; and generating, by the policy engine application, a report indicating that the actual value of the key does not match the permitted value of the key; identifying a remediation for the key that includes determining an updated value of the key, wherein the updated value of the key satisfies the predefined policy; and causing the updated value to be applied to the key in the cloud-based service provider after the cloud-based service provider become accessible again. ### Claim 12 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the one or more configuration settings relate to allocation or use of computing resources within the cloud-based service provider. ### Claim 13 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the predefined policy contains define logical or algebraic conditions or tests and were specified at least in part by way of menu selections from a graphical user interface. ### Claim 14 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the predefined policy is specified by an executable script that was generated at least in part by request of a user. ### Claim 15 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein a remediation engine application is configured to determine remediations for keys with values violating the predefined policy, and wherein identifying the remediation for the key comprises: identifying, by the remediation engine application and based on the report, the key; looking up, by the remediation engine application and based on the key, the remediation in a predefined set of remediations; and determining, by the remediation engine application and from the remediation, the updated value. ### Claim 16 A system comprising: one or more processors; and memory, containing program instructions that, upon execution by the one or more processors, cause the system to perform operations comprising: determining, based on a predefined policy, one or more configuration settings, wherein the predefined policy specifies a permitted value of a key within the configuration settings; obtaining, from a cloud-based service provider, an actual value of the key, wherein a collector application contains one or more collector routines that are configured to be able to obtain values of specific keys from the cloud-based service provider, and wherein obtaining the actual value of the key comprises: determining, based on the configuration settings, a collector routine configured to request and receive the actual value of the key from the cloud-based service provider; and storing a name of the key and the actual value of the key in a database; identifying, after obtaining the actual value of the key, that the cloud-based service provider is no longer accessible; determining, by applying the predefined policy, while the cloud-based service provider is no longer accessible, that the actual value of the key does not match the permitted value of the key, wherein a policy engine application is configured to apply the predefined policy to stored keys, and wherein determining that the actual value of the key does not match the permitted value of the key comprises: loading, by the policy engine application, the predefined policy; reading, by the policy engine application, the actual value of the key from the database; comparing, by the policy engine application, the actual value of the key to the permitted value of the key; and generating, by the policy engine application, a report indicating that the actual value of the key does not match the permitted value of the key; identifying a remediation for the key that includes determining an updated value of the key, wherein the updated value of the key satisfies the predefined policy; and causing the updated value to be applied to the key in the cloud-based service provider after the cloud-based service provider become accessible again.