Access control using impersonization
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Matthew James Wren, Brian Irl Pratt
Life of this patent
Estimating the term…
Abstract
A first service submits a request to a second service on behalf of a customer of a service provider. The request may have been triggered by a request of the customer to the first service. To process the request, the second service evaluates one or more policies to determine whether fulfillment of the request is allowed by policy associated with the customer. The one or more policies may state one or more conditions on one or more services that played a role in submission of the request. If determined that the policy allows fulfillment of the request, the second service fulfills the request.
Claims20
A system comprising:
- memory to store instructions that, if executed by one or more processors of the system, cause the system to:
- generate an authentication response by verifying an electronic signature of a first request, the authentication response includes information identifying a set of computing resource services;
- send the first request and the authentication response associated with the first request;
- utilize the authentication response, based at least in part on fulfilling the first request, to send a second request;
- process the second request according to a policy determination, the policy determination is determined by at least evaluating a set of policies applicable to the second request based at least in part on the authentication response;
- and
- send a third request, the third request being processed according to a policy of the policy determination such that processing the policy is based at least in part on a user profile associated with the authentication response that triggered the third request, including the first request and the second request.
A computer-implemented method, comprising:
- generating an authentication response by verifying an electronic signature of a first request, the authentication response includes information identifying a set of computing resource services;
- utilizing the authentication response, based at least in part on fulfilling the first request, to send a second request;
- processing the second request according to a policy determination, the policy determination is determined by at least evaluating a set of policies applicable to the second request based at least in part on the authentication response;
- and
- sending a third request, the third request being processed according to a policy of the policy determination such that processing the policy is based at least in part on a user profile associated with the authentication response that triggered the third request, including the first request and the second request.
A non-transitory computer-readable storage medium having stored thereon instructions that, if executed by one or more processors of a computer system, cause the computer system to:
- generate an authentication response by verifying an electronic signature of a first request, the authentication response includes information identifying a set of computing resource services;
- utilize the authentication response, based at least in part on fulfilling the first request, to send a second request;
- process the second request according to a policy determination, the policy determination is determined by at least evaluating a set of policies applicable to the second request based at least in part on the authentication response;
- and
- send a third request, the third request being processed according to a policy of the policy determination such that processing the policy is based at least in part on a user profile associated with the authentication response that triggered the third request, including the first request and the second request.
Dependencies are inferred from the claim text.