Separate authorization for managing stages in a data pipeline
AssigneeAmazon Technologies, Inc.
InventorsMohamed Emad El Din Fathalla, Akshat Vig, Jeffrey Alan Duffy, Joseph Robert Idziorek
Life of this patent
Estimating the term…
Abstract
A resource-based authorization control may be added to a data processing service. A control-plane action requested by an account or entity creates a resource-based authorization policy. The resource-based authorization policy pertaining to respective resources allows recurrent data-plane actions to maintain a data flow in a data pipeline to be authorized independent of a separate authorization service.
Claims20
A system, comprising:
- at least one processor;
- and
- a memory, storing program instructions that when executed by the at least one processor, cause the at least one processor to implement a view management system, the view management system configured to:
- receive, via an interface of the view management system, a request to activate an internal view in a data pipeline;
- determine that the request is authorized to activate the internal view in the data pipeline according to an authorization policy associated with the request;
- responsive to a determination that the request is authorized to activate the internal view in the data pipeline:
- activate, by the view management system, the internal view in the data pipeline to generate a materialized view;
- associate, by the view management system, a resource-specific authorization policy with the internal view that grants a downstream target data store in the data pipeline permission to obtain data from the internal view to generate the materialized view in the target data store;
- and
- allow, by the view management system, the downstream target data store in the data pipeline to obtain the data from the activated internal view based on the resource-specific authorization policy.
A method, comprising:
- receiving, at a data processing system, a request to activate a stage of a data pipeline;
- determining, by the data processing system, that the request is authorized to activate the stage in the data pipeline according to authorization information associated with the request;
- responsive to determining that the request is authorized to activate the stage in the data pipeline:
- activating, by the data processing system, the stage in the data pipeline to perform one or more data processing tasks;
- associating, by the data processing system, stage-specific authorization information with the stage that grants a downstream stage in the data pipeline permission to obtain data from the stage;
- allowing, by the data processing system, the downstream stage in the data pipeline to obtain the data from the activated stage based on the stage-specific authorization information.
One or more non-transitory, computer-readable storage media, storing program instructions that when executed on or across one or more computing devices cause the one or more computing devices to implement:
- receiving, via an interface of a view management system, a request to activate an internal view in a data pipeline;
- determining that the request is authorized to activate the internal view in the data pipeline according to authorization information associated with the request;
- responsive to determining that the request is authorized to activate the internal view in the data pipeline:
- activating, by the view management system, the internal view in the data pipeline to generate a materialized view;
- associating, by the view management system, resource-specific authorization information with the internal view that grants a downstream target data store in the data pipeline permission to obtain data from the internal view;
- and
- allowing, by the view management system, the downstream target data store in the data pipeline to obtain the data from the activated internal view based on the resource-specific authorization information.
Dependencies are inferred from the claim text.