Managing security groups for data instances

A computer-implemented method of cloning a data instance in a data environment using a separate control environment, comprising:

• under control of one or more computer systems configured with executable instructions,
• receiving, to the control environment, a request from a customer to update a control security group for a data instance in the data environment, the control security group being associated with a native security group for the data instance in the data environment;
• updating the control security group in response to the request, the control security group determining an access level of each member of the control security group to the data instance;
• and
• storing the updated control security group for use in determining subsequent access to the data instance by a member of the control security group,
• wherein the updating of the control security group does not change the association of the control security group to the native security group, such that the updating does not impact an availability of the data instance in the data environment.

A system for controlling a data environment using a separate control environment, comprising:

• at least one processor;
• and
• memory including instructions that, when executed by the at least one processor, cause the system to:
• receive, to the control environment, a request from a customer to update a control security group for a data instance in the data environment, the control security group being associated with a native security group for the data instance in the data environment;
• update the control security group in response to the request, the control security group determining an access level of each member of the control security group to the data instance;
• and
• storing the updated control security group for use in determining subsequent access to the data instance by a member of the control security group,
• wherein the updating of the control security group does not change the association of the control security group to the native security group, such that the updating does not impact an availability of the data instance in the data environment.

A computer program product embedded in a computer-readable medium and including instructions that, when executed by at least one computing device, cause the at least one computing device to:

• receive, to the control environment, a request from a customer to update a control security group for a data instance in the data environment, the control security group being associated with a native security group for the data instance in the data environment;
• update the control security group in response to the request, the control security group determining an access level of each member of the control security group to the data instance;
• and
• storing the updated control security group for use in determining subsequent access to the data instance by a member of the control security group, wherein the updating of the control security group does not change the association of the control security group to the native security group, such that the updating does not impact an availability of the data instance in the data environment.