Deperimeterized access control service

A computer-implemented method comprising:

• receiving, by a controller of a deperimeterized access control service, a single packet authorization (SPA) request for a session ticket from an agent on an electronic device, wherein the agent sends the request for the session ticket in response to intercepting traffic destined for a service associated with the deperimeterized access control service and determining that the agent does not have a session ticket for the service;
• authorizing the SPA request;
• providing a session ticket to the agent based on the request;
• receiving, by a gateway of the deperimeterized access control service, a request to initiate a session with a service, the request including the session ticket;
• validating the session ticket;
• and
• providing session parameters to the agent to be used to initiate the session between the electronic device and the service.

A system comprising:

• a first one or more electronic devices to implement a service in a multi-tenant provider network;
• and
• a second one or more electronic devices to implement a deperimeterized access control service in the multi-tenant provider network, the deperimeterized access control service including instructions that upon execution cause the deperimeterized access control service to:
• receive, by a controller of a deperimeterized access control service, a single packet authorization (SPA) request for a session ticket from an agent on a client device, wherein the agent sends the request for the session ticket in response to intercepting traffic destined for a service associated with the deperimeterized access control service and determining that the agent does not have a session ticket for the service;
• authorize the SPA request;
• provide a session ticket to the agent based on the request;
• receive, by a gateway of the deperimeterized access control service, a request to initiate a session with a service, the request including the session ticket;
• validate the session ticket;
• and
• provide session parameters to the agent to be used to initiate the session between the client device and the service.