# US 2014/0196130 A1 · Techniques for credential generation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0196130 A1 - Document ID: US20140196130A1 - Status: Published application - Kind: A1 - Application number: 14/204,124 - Filed: 2014-03-11 - Published: 2014-07-10 - Earliest claimed: 2010-12-29 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Marc J. Brooker; Mark Joseph Cavage; David Brown; Kevin Ross O'Neill; Eric Jason Brandwine; Christopher Richard Jacques de Kadt - Web page: https://patentgrep.com/patent/US20140196130A1 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F 21/44: Program or device authentication - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04L 9/3247: {involving digital signatures} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods for managing credentials distribute the credentials to subsets of a set of collectively managed computing resources. The collectively managed computing resources may include one or more virtual machine instances. The credentials distributed to the computing resources may be used by the computing resources to perform one or more actions. Actions may include performing one or more functions in connection with configuration, management, and/or operation of the one or more resources, and/or access of other computing resources. The ability to use credentials may be changed based at least in part on the occurrence of one or more events. ## Claims ### Claim 1 A computer-implemented method for managing credentials, comprising: under the control of one or more computer systems configured with executable instructions, receiving, for a set of virtual computing resources that are collectively under common control, an instruction to distribute credentials for at least a subset of the set of virtual computing resources; and making available, to the subset, corresponding credentials, the corresponding credentials usable by the subset to authenticate with one or more systems managing one or more other computing resources thereby enabling the subset to access the one or more other computing resources, the corresponding credentials made available to the subset being inaccessible to at least other virtual computing resources outside of the subset that are under the common control. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising generating the corresponding credentials in response to receipt of the instruction. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising generating at least one policy associated with the credentials made available, the policy identifying a set of one or more virtual computing resources to whom the corresponding credentials have been made available; and regulating, based at least in part on the policy, access to the one or more computing resources. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the virtual computing resources include virtual machine instances and wherein the subset includes a plurality of the virtual machine instances. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein making available corresponding credentials includes providing the corresponding credentials from a web server having a predetermined network location. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the corresponding credentials encode one or more policies. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the virtual computing resources are virtual machine instances. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the instruction includes granularity information specifying one or more characteristics for determining the subset. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the subset contains multiple virtual machine instances. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein: the at least the subset includes a plurality of specified subsets; and the method further comprises: detecting a change of state of a particular subset of the plurality of specified subsets; and in response to detecting the change of state, causing credentials corresponding to the particular subset to be at least temporarily unusable. ### Claim 11 One or more computer-readable storage media having collectively stored thereon instructions executable by one or more processors of a computer system that, when executed by the one or more processors, cause the computer system to at least: receive, for a set of virtual computing resources that are collectively under common control, granularity information determinative of at least one subset of the set of computing resources; and distribute, to the subset, credentials for use by the subset in authenticating with one or more systems managing access to one or more other computing resources, thereby enabling the set of virtual computing resources to access one or more other computing resources. ### Claim 12 (depends on 11) The one or more computer-readable storage media of claim 11, wherein the virtual computing resources are virtual machine instances. ### Claim 13 (depends on 12) The one or more computer-readable storage media of claim 12, wherein the subsets are the virtual machine instances. ### Claim 14 (depends on 11) The one or more computer-readable storage media of claim 11, wherein the granularity information specifies one or more characteristics for determining the subset. ### Claim 15 (depends on 14) The one or more computer-readable storage media of claim 14, wherein the instructions further cause the computer system to: detect a change of state of the subset; and in response to detecting the change of state, cause credentials corresponding to the subset to be at least temporarily unusable. ### Claim 16 A computer system for managing credentials, comprising: one or more processors; and memory, including executable instructions that, when executed by the one or more processors, cause the one or more processors to collectively at least: distribute, to each subset of a plurality of subsets of a set of computing resources that are collectively under common control, different credentials usable to authenticate with a system managing access to one or more other computing resources; detect an event in connection with at least one computing resource of a subset of the plurality of subsets, the at least one computing resource being associated with corresponding credentials of the distributed credentials, the corresponding credentials being inaccessible to at least computing resources under the common control that are outside of the subset; and in response to detection of the event, take an action that modifies an ability of the at least one computing resource to use the corresponding credentials. ### Claim 17 (depends on 16) The computer system of claim 16, wherein the event includes a security breach of the computing resource for which the event was detected. ### Claim 18 (depends on 17) The computer system of claim 17, wherein the action includes invalidating the corresponding credentials. ### Claim 19 (depends on 16) The computer system of claim 16, wherein the event includes a change to an inactive state of the computing resource for which the event was detected. ### Claim 20 (depends on 19) The computer system of claim 19, wherein the action includes causing the corresponding credentials to become at least temporarily inactive.