Consent-driven access management for cloud resources

A system comprising:

• one or more hardware processors;
• one or more non-transitory computer-readable media;
• and
• program instructions stored on the one or more non-transitory computer-readable media which, when executed by the one or more hardware processors, cause the system to perform operations comprising:
• receiving, from a requestor, a consent request for consent for an actor to access a target set of resources in a cloud environment;
• identifying a consent workflow that specifies at least one of a name or an attribute of a set of one or more users from which to obtain respective approvals of the consent request;
• traversing the consent workflow to obtain the respective approvals from the set of one or more users;
• determining that one or more access policies, separate from the consent workflow, permit the actor to access the target set of resources;
• granting a consent token responsive to obtaining the respective approvals;
• transmitting a first request to access the target set of resources, the first request comprising the consent token;
• wherein access by the actor to the target set of resources is conditioned on both (a) obtaining the respective approvals from the set of one or more users and (b) determining that the one or more access policies, separate from the consent workflow, permit the actor to access the target set of resources;
• wherein granting or denying the first request to access the target set of resources is conditioned, at least in part, on presence of the consent token.

One or more non-transitory computer-readable media storing instructions which, when executed by one or more hardware processors, cause performance of operations comprising:

• receiving, from a requestor, a consent request for consent for an actor to access a target set of resources in a cloud environment;
• identifying a consent workflow that specifies at least one of a name or an attribute of a set of one or more users from which to obtain respective approvals of the consent request;
• traversing the consent workflow to obtain the respective approvals from the set of one or more users;
• determining that one or more access policies, separate from the consent workflow, permit the actor to access the target set of resources;
• granting a consent token responsive to obtaining the respective approvals;
• transmitting a first request to access the target set of resources, the first request comprising the consent token;
• wherein access by the actor to the target set of resources is conditioned on both (a) obtaining the respective approvals from the set of one or more users and (b) determining that the one or more access policies, separate from the consent workflow, permit the actor to access the target set of resources;
• wherein granting or denying the first request to access the target set of resources is conditioned, at least in part, on presence of the consent token.