Access Requests at IAM System Implementing IAM Data Model

A system for provisioning access rights to physical computing resources comprising:

• a processor;
• a data store that implements an identity access management (IAM) data model and associates logical computing resource records at the data store with one or more physical computing resource records at the data store;
• an access request handler that, in operation, receives an access request, identifies a set of logical permissions using the IAM data model and based, at least in part, on the access request, and derives a set of logical entitlements using the IAM data model and based, at least in part, on the set of logical permissions;
• an entitlement translator that, in operation, translates the set of logical entitlements to a physical entitlement specification based, at least in part, on a set of physical permission specifications;
• and
• an access control manager that, in operation, initiates provisioning of access rights to at least one physical computing resource indicated in the physical entitlement specification.

A non-transitory computer-readable medium having instructions stored thereon that, when executed by a processor, cause the processor to perform steps for provisioning access rights to physical computing resources, the steps comprising:

• receiving an access request at an access request handler;
• identifying, at the access request handler, a set of logical permissions based, at least in part, on the access request;
• generating, at the access request handler, a set of logical entitlements based, at least in part, on the set of logical permissions;
• translating, at an entitlement translator, the set of logical entitlements to a physical entitlement specification based, at least in part, on a set of physical permission specifications respectively associated with the set of logical permissions;
• and
• provisioning, using an access control manager, access rights to at least one physical computing resource indicated in the physical entitlement specification.