# US 2026/0089152 A1 · Managed policy for internal stage network policy > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0089152 A1 - Document ID: US20260089152A1 - Status: Published application - Kind: A1 - Application number: 18/893,804 - Filed: 2024-09-23 - Published: 2026-03-26 - Earliest claimed: 2024-09-23 - Assignees: Snowflake Inc. - Applicants: Snowflake Inc. - Inventors: Zhoujia Mao; Frantisek Rolinek; Prasoon Shukla; Ramana Rao S. Turlapati - Web page: https://patentgrep.com/patent/US20260089152A1 ## CPC - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Aspects of the present disclosure relate to configuring managed policy for internal stage network policy. More specifically, a method of the present disclosure includes generating and activating a set of network policies on a control plane of a service provider. The method includes determining to convert the set of network policies activated on the control plane of the service provider into an IAM policy at the service provider. The method includes utilizing at least one of the converted IAM policies of an active network policy in response to a creation of a presigned URL. The method includes determining whether an STS token is approved based on the presigned URL and at least one of the set of network policies or the IAM policy. The method includes utilizing an approved STS token to access the service provider. ## Claims ### Claim 1 A system, comprising: a memory; and a processing device, operatively coupled to the memory, to: generate and activate a set of network policies on a control plane of a service provider; determine to convert the set of network policies activated on the control plane of the service provider into an identity and access management (IAM) policy at the service provider; utilize at least one of the converted IAM policies of an active network policy in response to a creation of a presigned uniform resource locator (URL); determine whether a security token service (STS) token is approved based on the presigned URL and at least one of the set of network policies or the IAM policy; and utilize an approved STS token to access the service provider. ### Claim 2 (depends on 1) The system of claim 1, wherein the IAM policy is mapped to the set of network policies, wherein the STS token comprises a reference to at least one of the set of network policies or the IAM policy. ### Claim 3 (depends on 1) The system of claim 1, wherein to determine to convert the set of network policies the processing device is configured to: compare a size of the set of network policies to a size threshold. ### Claim 4 (depends on 3) The system of claim 3, wherein the set of network policies is not converted to the IAM policy in response to the size of the set of network policies being less than the size threshold. ### Claim 5 (depends on 4) The system of claim 4, wherein references of the converted IAM managed policies from the active network policy are included within a session policy. ### Claim 6 (depends on 3) The system of claim 3, wherein the set of network policies is converted to the IAM policy in response to the size of the set of network policies being greater than the size threshold. ### Claim 7 (depends on 6) The system of claim 6, wherein information related to the converted IAM managed policies are stored within a metadata of the network policy, wherein the metadata includes a reference to the set of network policies. ### Claim 8 A method, comprising: generating and activating a set of network policies on a control plane of a service provider; determining to convert the set of network policies activated on the control plane of the service provider into an identity and access management (IAM) policy at the service provider; utilizing at least one of the converted IAM policies of an active network policy in response to a creation of a presigned uniform resource locator (URL); determining whether a security token service (STS) token is approved based on the presigned URL and at least one of the set of network policies or the IAM policy; and utilizing an approved STS token to access the service provider. ### Claim 9 (depends on 8) The method of claim 8, wherein the IAM policy is mapped to the set of network policies, wherein the STS token comprises a reference to at least one of the set of network policies or the IAM policy. ### Claim 10 (depends on 8) The method of claim 8, wherein the determining to convert the set of network policies further comprising: comparing a size of the set of network policies to a size threshold. ### Claim 11 (depends on 10) The method of claim 10, wherein the set of network policies is not converted to the IAM policy in response to the size of the set of network policies being less than the size threshold. ### Claim 12 (depends on 11) The method of claim 11, wherein references of the converted IAM managed policies from the active network policy are included within a session policy. ### Claim 13 (depends on 10) The method of claim 10, wherein the set of network policies is converted to the IAM policy in response to the size of the set of network policies being greater than the size threshold. ### Claim 14 (depends on 13) The method of claim 13, wherein information related to the converted IAM managed policies are stored within a metadata of the network policy, wherein the metadata includes a reference to the set of network policies. ### Claim 15 A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to: generate and activate a set of network policies on a control plane of a service provider; determine to convert the set of network policies activated on the control plane of the service provider into an identity and access management (IAM) policy at the service provider; utilize at least one of the converted IAM policies of an active network policy in response to a creation of a presigned uniform resource locator (URL); determine whether a security token service (STS) token is approved based on the presigned URL and at least one of the set of network policies or the IAM policy; and utilize an approved STS token to access the service provider. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the IAM policy is mapped to the set of network policies, wherein the STS token comprises a reference to at least one of the set of network policies or the IAM policy. ### Claim 17 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein to determining to convert the set of network policies the processing device is configured to: compare a size of the set of network policies to a size threshold. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the set of network policies is not converted to the IAM policy in response to the size of the set of network policies being less than the size threshold. ### Claim 19 (depends on 18) The non-transitory computer-readable storage medium of claim 18, wherein references of the converted IAM managed policies from the active network policy are included within a session policy. ### Claim 20 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the set of network policies is converted to the IAM policy in response to the size of the set of network policies being greater than the size threshold.