Policy approval layer
AssigneeAmazon Technologies, Inc.
InventorsWilliam Frederick Kruse, Nima Sharifi Mehr
Life of this patent
Estimating the term…
Abstract
A customer of a policy management service may use an interface with a configuration and management service to interact with policies that may be applicable to the customer's one or more resources. The customer may create and/or modify the policies and the configuration and management service may notify one or more other entities of the created and/or modified policies. The one or more other entities may be operated by user authorized to approve the created and/or modified policies. Interactions with the configuration and management service may be the same as the interactions with the policy management service.
Claims19
A computer-implemented method, comprising:
- under the control of one or more computer systems each having one or more hardware processors configured with executable instructions including,
- obtaining a current state of a policy from a policy management service, where the policy management service is operable to put the policy into effect, and the policy defines permissions for access to a set of computing resources;
- receiving a request to modify the policy, the request specifies a modification to the current state of the policy and application of the modification creates a modified policy;
- determining a description of the modification to the current state of the policy based at least in part on the specified modifications to the current state of the policy;
- transmitting a notification that includes the determined description;
- receiving an approval of the modification from an entity of a set of entities authorized to approve modifications to the policy;
- contingent of receiving a first number of approvals from a second number of entities of the set of entities authorized to approve modifications to the policy, where the first number is greater than one and less than the second number, transmitting an instruction to the policy management service to put the modified policy into effect;
- and
- detecting an error with the modified policy.
A system, comprising:
- one or more processors;
- and
- memory with instructions that, as a result of execution by the one or more processors, cause the system to:
- obtain a current state of a policy from a policy management service, where the policy management service is operable to put the policy into effect, and the policy defines permissions for access to a set of computing resources;
- receive a request to modify the policy, the request specifies a modification to the current state of the policy and application of the modification creates a modified policy;
- determine a description of the modification to the current state of the policy based at least in part on the specified modifications to the current state of the policy;
- transmit a notification that includes the description;
- receive an approval of the modification from an entity of a set of entities authorized to approve modifications to the policy;
- contingent of receiving a first number of approvals from a second number of entities of the set of entities authorized to approve modifications to the policy, where the first number is greater than one and less than the second number, transmit an instruction to the policy management service to put the modified policy into effect;
- and
- detect an error with the modified policy.
A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:
- obtain a current state of a policy from a policy management service, where the policy management service is operable to put the policy into effect, and the policy defines permissions for access to a set of computing resources;
- receive a request to modify the policy, the request specifies a modification to the current state of the policy and application of the modification creates a modified policy;
- determine a description of the modification to the current state of the policy based at least in part on the specified modifications to the current state of the policy;
- transmit a notification that includes the description;
- receive an approval of the modification from an entity of a set of entities authorized to approve modifications to the policy;
- contingent of receiving a first number of approvals from a second number of entities of the set of entities authorized to approve modifications to the policy, where the first number is greater than one and less than the second number, transmit an instruction to the policy management service to put the modified policy into effect;
- and
- detect an error with the modified policy.
Dependencies are inferred from the claim text.