Virtual service authorization
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Eric Jason Brandwine, Graeme David Baer
Life of this patent
Estimating the term…
Abstract
A computing resource service provides flexible configuration of authorization rules. A set of authorization rules which define whether fulfillment of requests. The set of authorization rules are applied to a request of a first type which is mapped to a request of a second type. The request of the second type is used for fulfillment of the request of the first type when the authorization rules so allow.
Claims23
A computer-implemented method, comprising:
- under the control of one or more computer systems of a service provider, the one or more computer systems configured with executable instructions,
- receiving an application programming interface request that specifies:
- a first identifier of a resource hosted by a service of the service provider for a first customer of the service provider;
- and
- a first representation of an operation to perform with respect to the resource;
- selecting a set of request-mapping rules from a plurality of sets of mapping rules stored by the service provider for multiple customers of the service provider;
- applying the selected set of request-mapping rules to the received application programming interface request to determine:
- a second identifier of the resource;
- and
- a second representation of the operation;
- applying a set of authorization rules to at least the determined second identifier and the second representation of the operation to determine that fulfillment of the received application programming interface request is authorized;
- and
- as a result of determining that fulfillment of the received application programming interface request is authorized, performing the operation with respect to the resource.
A system, comprising at least one computing device configured to implement one or more services, the one or more services configured to:
- receive a request of a first request type, the request type mapped to a second request type and having an associated set of authorization rules applicable to the first request type;
- apply the set of authorization rules to a request of the first request type to determine whether fulfillment of the request of the first request type is authorized;
- and
- as a result of determining that fulfillment of the request of the first request type is authorized, submit a request of the second request type to a service corresponding to the second request type, the request of the second request type matching the request of the first request type by the mapping.
A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
- obtain a first representation of an operation to perform with respect to a resource;
- determine, based at least in part on application of a set of authorization rules to a first set of attributes of the first representation, whether performance of the operation is authorized;
- and
- if it is determined that performance of the operation is authorized by the authorization rules, use a second representation of the operation to cause the operation to be performed, the second representation of the operation having a second set of attributes usable for authorization that is different from the first set of attributes.
Dependencies are inferred from the claim text.