Use of freeform metadata for access control
AssigneeAmazon Technologies, Inc.
InventorsEric Jason Brandwine, Peter Nicholas DeSantis, Léon Thrane
Life of this patent
Estimating the term…
Abstract
Approaches are described for security and access control for computing resources. Various embodiments utilize metadata, e.g., tags that can be applied to one or more computing resources (e.g., virtual machines, host computing devices, applications, databases, etc.) to control access to these and/or other computing resources. In various embodiments, the tags and access control policies described herein can be utilized in a multitenant shared resource environment.
Claims23
A computer implemented method for using tags to control access to resources, said method comprising:
- under the control of one or more computer systems configured with executable instructions,
- providing one or more computing resources by a service provider, the one or more computing resources provided to a customer in a multitenant environment;
- associating an access control policy with a user of an account, the access control policy specifying metadata as part of a condition for controlling access to the one or more computing resources;
- receiving, from the user, an application programming interface (API) call to perform an operation on the one or more computing resources;
- evaluating, in response to the API call, the access control policy including the metadata specified in the access control policy;
- and
- authorizing the API call to perform the operation on the one or more computing resources based at least in part on the metadata specified in the access control policy.
A computer implemented method, comprising:
- under the control of one or more computer systems configured with executable instructions,
- associating a tag with a computing resource, the tag including a freeform character string specifying a key and a value;
- receiving a request to perform an operation on the computing resource;
- evaluating an access control policy, the access control policy referencing the tag as a condition for using the computing resource;
- and
- resolving the request to perform the operation based at least in part on evaluating the access control policy and determining whether the tag is associated with the computing resource.
A computing system, comprising:
- at least one processor;
- and
- memory including instructions that, when executed by the at least one processor, cause the computing system to:
- associate one or more tags with at least one computing resource, at least one of the one or more tags including a freeform character string specifying a key and a value;
- receive a request to perform an operation on the at least one computing resource;
- evaluate an access control policy, the access control policy referencing the one or more tags as at least part of a condition for performing the operation;
- and
- resolve the request to perform the operation based at least in part on evaluating the access control policy.
A non-transitory computer readable storage medium storing one or more sequences of instructions executable by one or more processors to perform a set of operations comprising:
- associating one or more tags with at least one computing resource, each of the one or more tags including a freeform character string specifying a key and a value;
- receiving a request to perform an operation on the at least one computing resource;
- evaluating an access control policy, the access control policy referencing the one or more tags as at least part of a condition for controlling access to the at least one computing resource;
- controlling access to perform the operation based at least in part on evaluating the access control policy.
Dependencies are inferred from the claim text.