Intent-based governance
AssigneeAmazon Technologies, Inc.
InventorsNeha RUNGTA, Daniel George PEEBLES, Andrew Jude GACEK, Marvin THEIMER, Rebecca Claire WEISS, Brigid Ann JOHNSON
Life of this patent
Estimating the term…
Abstract
Techniques for intent-based access control are described. A method of intent-based access control may include receiving, via a user interface of an intent-based governance service, one or more intent statements associated with user resources in a provider network, the one or more intent statements expressing at least one type of action allowed to be performed on the user resources, compiling the one or more intent statements into at least one access control policy, and associating the at least one access control policy with the user resources.
Claims20
A computer-implemented method comprising:
- receiving, via a user interface of an intent-based governance service of a provider network, one or more intent statements written in a domain specific language from a customer expressing security intent for customer resources;
- parsing the one or more intent statements based on a provider network model;
- compiling the parsed one or more intent statements into at least one access control policy;
- associating the at least one access control policy with the customer resources based on the one or more intent statements;
- detecting a change to the provider network based on a static code analysis of one or more services of the provider network;
- updating the provider network model based on the change to the provider network;
- and
- recompiling the parsed one or more intent statements into an updated at least one access control policy, the updated at least one access control policy applying to at least the one or more services of the provider network that have changed.
A computer-implemented method comprising:
- receiving, via a user interface of an intent-based governance service, one or more intent statements associated with user resources in a provider network, the one or more intent statements expressing at least one type of action allowed to be performed on the user resources;
- compiling the one or more intent statements into at least one access control policy;
- and
- associating the at least one access control policy with the user resources.
A system comprising:
- a first one or more electronic devices to implement user resources in a multi-tenant provider network;
- and
- a second one or more electronic devices to implement an intent-based governance service in the multi-tenant provider network, the intent-based governance service including instructions that upon execution cause the intent-based governance service to:
- receive, via a user interface of the intent-based governance service, one or more intent statements associated with the user resources, the one or more intent statements expressing at least one type of action allowed to be performed on the user resources;
- compile the one or more intent statements into at least one access control policy;
- and
- associate the at least one access control policy with the user resources.
Dependencies are inferred from the claim text.