Identity token for accessing computing resources

A computer implemented method, comprising:

• receiving, from a device that is registered in a first computing region, a request to access a computing resource in the first computing region;
• authenticating the device associated with the request at the first computing region using authentication credentials for the device;
• determining that the computing resource is unavailable in the first computing region but is available in a plurality of computing regions;
• identifying a second computing region from the plurality of computing regions based at least in part on a device policy received from the device and proximity of the device to the second computing region compared to the proximity to the plurality of computing regions, wherein the device policy includes a permission that permits the device to request access despite being unregistered in the second computing region;
• and
• as a result of identifying the second computing region:
• generating an identity token signed using an encryption key, wherein the identity token indicates permission for the device to access the second computing region;
• and
• providing the identity token and instructions to access the second computing region to the device, wherein the device presents the identity token to the second computing region.

A system comprising:

• at least one hardware processor;
• and
• memory including instructions that, as a result of being executed by the one or more processors, cause the system to:
• receive, from a device, a request to access a computing resource in a first computing region, wherein the device is registered in the first computer region;
• authenticate the device associated with the request at the first computing region using authentication credentials for the device;
• determine that the computing resource is unavailable in the first computing region but is available in a group of computing regions;
• selecting a second computing region among the group of computing regions based at least in part on a location of the device and a device policy received from the device, wherein the device policy indicates that the device is unregistered in the second computing region yet able to request access to the second computing region, the location of the device indicating that the second computing region is in closer proximity to the device than another computing region of the group of computing regions;
• and
• as a result of selecting the second computing region:
• generate an identity token signed using an encryption key, wherein the identity token indicates permission for the device to access the second computing region;
• and
• provide the identity token and instructions to access the second computing region to the device, wherein the device presents the identity token to the second computing region.