Policy enforcement delays

• US 10,387,683 B2
• Filed: 09/09/2016
• Issued: 08/20/2019
• Est. Priority Date: 06/20/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory Branchek
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Murphy, J. Brant
• Application Number:
  US15/261,759
• Publication Number:
  US 20160379012A1
• Time in Patent Office: 1,075 Days
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures

Abstract

A request to cancel a change to a policy is received. Based at least in part on delay information for the change, determine that the change is currently delayed, where the delay information is associated with a condition precedent for the change to become effective under a policy change policy. A determination is made regarding whether cancellation is allowed by a set of conditions for the changes, and the proposed policy change is caused to be cancelled prior to a time indicated by the delay information.

Claims

1. A computer-implemented method, comprising:

receiving a request to cancel a change to a set of policies, the set of policies being usable by a computer to control access to a computing resource;

determining, based at least in part on delay information for the change, that the change is currently delayed, the delay information associated with a condition precedent for the change to become effective under a policy change policy;

determining, based at least in part on fulfillment of a first set of conditions that are applicable to cancellation of unimplemented policy changes, that cancellation is allowed according to the first set of conditions, the first set of conditions being different from a second set of conditions, the second set of conditions being applicable to cancellation of policies already in effect; and

causing, as a result of determining that the change is currently delayed and that cancellation is allowed, the change to the set of policies to be cancelled.

2. The computer-implemented method of claim 1, wherein the change includes an encoding of a policy document that defines a proposed policy, the policy encoded in an access control policy language, the policy document including a value from which compliance with the condition precedent is determinable.

3. The computer-implemented method of claim 1, wherein the first set of conditions is less stringent than the second set of conditions.

4. The computer-implemented method of claim 1, wherein the change is an addition of a policy to the set of policies.

5. The computer-implemented method of claim 1, wherein causing the change to the set of policies includes:

delaying, for an amount of time, cancellation of the change; and

on or after the amount of time has passed, cancelling the change.

6. The computer-implemented method of claim 1, wherein determining that cancellation is allowed by the first set of conditions includes determining that a number of principals, in accordance with a first set of quorum rules, agree to cancellation of the change, the first set of quorum rules being less stringent than a second set of quorum rules that specifies a minimum number of the principals needed to agree to be in accordance with the second set of conditions.

7. The computer-implemented method of claim 1, wherein determining that cancellation is allowed by the first set of conditions includes authenticating that a requestor of the change is a member of a first set of principals authorized to cause policy change requests to be cancelled, the first set of principals being larger than a second set of principals authorized to cause policies already in effect to be cancelled.

8. The computer-implemented method of claim 1, wherein the policy change policy further indicates one or more of:

a principal to which the set of policies apply, or

a resource to which the set of policies apply.

9. A system, comprising:

one or more processors; and

memory including instructions that, as a result of execution by the one or more processors, cause the system to;

receive a request to cancel a change to a policy, the policy usable by a computer to control access to a computing resource;

determine, based at least in part on delay information for the change, that the change is currently delayed, the delay information associated with a condition precedent for the change to become effective under a policy change policy;

make a determination whether cancellation is allowed by a set of conditions for cancelling the change, the set of conditions applicable to cancellation of policies already in effect and different from the condition precedent; and

cause the change to the policy to be cancelled prior to a time indicated by the delay information.

10. The system of claim 9, wherein the instructions further include instructions that cause the system to verify that the request is received from an entity authorized to cause the change to be cancelled.

11. The system of claim 9, wherein the delay information was received with a previous request proposing the change.

12. The system of claim 9, wherein the request is a web service request received via a hyperlink.

13. The system of claim 9, wherein the instructions that cause the change to the policy to be cancelled include instructions that cause the system to update metadata associated with the change to indicate cancellation of the change.

14. The system of claim 9, wherein the set of conditions for cancelling the change is less stringent than a set of conditions for cancelling the policy itself.

15. The system of claim 9, wherein:

the instructions that cause the change to the policy to be cancelled are executed on a determination that the cancellation is allowed; and

the instructions further include instructions that cause the system to, on the determination that the cancellation is not allowed, deny the request to cancel the change.

16. One or more non-transitory computer-readable storage media having collectively stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the system to at least:

receive a request to cancel a proposed policy change, the proposed policy change being a change to a policy already in effect, the policy usable by a computer to control access to a computing resource;

determine, based at least in part on delay information for the proposed policy change, that the proposed policy change is currently delayed, the delay information associated with a condition precedent for the proposed policy change to become effective under a policy change policy;

determine that cancellation is allowed by conditions for cancelling changes, the conditions for cancelling changes being different from conditions for cancelling the policy already in effect; and

as a result of the proposed policy change being currently delayed and cancellation being allowed, cause the proposed policy change to be cancelled.

17. The one or more non-transitory computer-readable storage media of claim 16, wherein the request is an application programming interface call.

18. The one or more non-transitory computer-readable storage media of claim 16, wherein the policy already in effect applies to a set of computing resources managed on behalf of a customer of a computing resource service provider;

and the proposed policy change and the policy already in effect are encoded in an access control policy language.

19. The one or more non-transitory computer-readable storage media of claim 16, wherein the delay information includes a value indicating a time at which the proposed policy change is to become effective.

20. The one or more non-transitory computer-readable storage media of claim 16, wherein the executable instructions that cause the proposed policy change to be cancelled include executable instructions that delete the proposed policy change from a policy repository.