US 2024/0179182 A1Published application

Authorization policy validation

AssigneeAmazon Technologies, Inc.

InventorsMichael W. HICKS, John Holman KASTNER, Emina TORLAK, Richard Matthew MCCUTCHEN, Darin MCADAMS, Neha RUNGTA, Aaron Joseph ELINE, Joseph Wallace CUTLER, Eleftherios IOANNIDIS

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

A system and method for authorization policy validation. A validator takes as input an authorization policy to be analyzed and a schema that specifies entity types and their attributes, types of entity parents in an entity hierarchy, and which entity types can be used with which actions. The validator checks that the policy conforms to the schema. If the check passes, then the policy is guaranteed to be free of both type errors and attribute access errors for any input that conforms to the schema.

Claims20

Dependent claims

A method performed by one or more electronic devices in a provider network, the method comprising:

obtaining an authorization policy schema;
determining whether there are any inconsistencies between an authorization policy in an authorization policy language and the authorization policy schema;
wherein the authorization policy comprises:
(a) an effect;
(b) an authorization policy head that selects one or more principals, one or more actions, or one or more resources to which the authorization policy applies;
and
(c) one or more optional conditional clauses that further refine the circumstances under which the authorization policy applies;
determining there are no inconsistencies between the authorization policy and the authorization policy schema such that the authorization policy is guaranteed to be free of runtime type errors and free of runtime attribute access errors for any input that conforms to the authorization policy schema.

5 more elements

A method performed by one or more electronic devices, the method comprising:

obtaining an authorization policy schema;
determining whether there are any inconsistencies between an authorization policy in an authorization policy language and the authorization policy schema;
wherein the authorization policy comprises:
(a) an effect;
(b) an authorization policy head that selects one or more principals, one or more actions, or one or more resources to which the authorization policy applies;
and
(c) one or more optional conditional clauses that further refine the circumstances under which the authorization policy applies;
if there are one or more determined inconsistencies between the authorization policy and the authorization policy schema, then causing display of information indicating that the authorization policy is invalid with respect to the authorization policy schema;
and
wherein if there are no determined inconsistencies between the authorization policy and the authorization policy schema, then the authorization policy is guaranteed to be free of runtime type errors and free of runtime attribute access errors for any input that conforms to the authorization policy schema.

7 more elements

A system comprising:

a first set of one or more electronic devices to implement an authorization policy validation service in a provider network, the authorization policy validation service comprising instructions which when executed cause the authorization policy validation service to perform:
obtaining an authorization policy schema;
determining whether there are any inconsistencies between an authorization policy in an authorization policy language and the authorization policy schema;
wherein the authorization policy comprises:
(a) an effect;
(b) an authorization policy head that selects one or more principals, one or more actions, or one or more resources to which the authorization policy applies;
and
(c) one or more optional conditional clauses that further refine the circumstances under which the authorization policy applies;
if there are one or more determined inconsistencies between the authorization policy and the authorization policy schema, then causing display of information indicating that the authorization policy is invalid with respect to the authorization policy schema;
and
wherein if there are no determined inconsistencies between the authorization policy and the authorization policy schema, then the authorization policy is guaranteed to be free of runtime type errors and free of runtime attribute access errors for any input that conforms to the authorization policy schema.

8 more elements

Dependencies are inferred from the claim text.