Controlling user access to command execution

• US 10,397,232 B2
• Filed: 06/25/2015
• Issued: 08/27/2019
• Est. Priority Date: 06/25/2015
• Status: Expired due to Fees

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Hashmi, Omer, Chung, Katherine Yichen
• Primary Examiner(s): Tran, Ellen
• Application Number:
  US14/750,868
• Publication Number:
  US 20160381032A1
• Time in Patent Office: 1,524 Days
• CPC Class Codes: G06F 9/45512 Command shells
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/306 User profiles

Abstract

Techniques are described for providing users with access to perform commands on network-accessible computing resources. In some situations, permissions are established for user(s) to execute command(s) on computing node(s) provided by an online service, such as by maintaining various permission information externally to those provided computing nodes for use in controlling users'"'"' ability to access, use, and/or modify the provided computing nodes. An interface component may use such external permissions information to determine if a particular user is authorized to execute one or more particular commands on one or more particular computing nodes, and to initiate simultaneous and independent execution of the command(s) on the computing node(s) when authorized. The interface component may further aggregate results from each computing node that executed the command(s), prior to providing the results to the user.

Claims

1. A computer-implemented method comprising:

receiving, by a shell aggregator executing on one or more computing systems, a request from a user indicating a command to be executed by each of a plurality of computing nodes that are provided by a network-accessible service for use by the user and that are each executing one or more programs on behalf of the user, wherein execution of the command by each corresponding computing node of the plurality of computing nodes causes each corresponding computing node to gather information regarding itself;

determining, by the shell aggregator and based at least in part on permissions information stored externally to the plurality of computing nodes, that the user is authorized to have the command be executed by each of the plurality of computing nodes;

initiating, by the shell aggregator and in response to the determining, execution of the command by each of the plurality of computing nodes to gather the information, including;

executing the command by a first computing node of the plurality of computing nodes for the user; and

denying execution of the command for the user by a second computing node of the plurality of computing nodes based on additional security information stored locally on the second computing node;

receiving, by the shell aggregator, results including the gathered information from the execution of the command by each of the plurality of computing nodes;

aggregating, by the shell aggregator, the received results to generate aggregated results; and

returning the aggregated results to the user.

2. The computer-implemented method of claim 1 further comprising:

receiving, by the one or more computing systems, a second request from the user indicating a second command to be executed by the plurality of more computing nodes;

determining, by the shell aggregator and based at least in part on the stored permissions information, that the user is not authorized to have the second command executed by the plurality of computing nodes; and

in response to the determining, denying execution of the second command by the plurality of computing nodes.

3. The computer-implemented method of claim 1 wherein the determining that the user is authorized includes querying a permission broker external to the plurality of computing nodes to obtain stored permissions information specific to the user and to compare the obtained stored permissions information with the command and the plurality of computing nodes to identify a match.

4. The computer-implemented method of claim 3 wherein the comparing of the obtained stored permissions information with the command and the plurality of computing nodes includes matching the command to one or more regular expressions stored in the obtained stored permissions information.

5. The computer-implemented method of claim 3 wherein the comparing of the obtained stored permissions information with the command and the plurality of computing nodes includes matching the command to one or more access control expressions stored in the obtained stored permissions information.

6. The computer-implemented method of claim 1 wherein the command is a shell command, and wherein the method further comprises, before the initiating of the execution of the command, establishing, by the shell aggregator, secure connections via a shell transport layer to the plurality of computing nodes, and wherein the initiating of the execution of the command by the plurality of computing nodes includes providing, by the shell aggregator and to the plurality of computing nodes, the shell command via the established secure connections to cause the plurality of computing nodes to execute the shell command.

7. The computer-implemented method of claim 1 wherein the execution of the command causes current status information to be obtained from the first computing node of the plurality of computing nodes and to be included in the results received from the execution of the command by each of the first computing node of the plurality of computing nodes.

8. The computer-implemented method of claim 1 wherein the execution of the command modifies ongoing operations on the first computing node of the plurality of computing nodes.

9. The computer-implemented method of claim 1 wherein the receiving of the request includes receiving a high-level directive that corresponds to a plurality of commands, and wherein the initiating of the execution further includes identifying the plurality of commands and initiating execution of each of the plurality of commands by each of the first computing node of the plurality of computing nodes.

10. A non-transitory computer-readable medium including stored contents that cause a computing system to at least:

receive, by the computing system, information from a first user indicating a high-level directive corresponding to operations to perform on a plurality of computing-related resources provided from a network-accessible service, wherein the plurality of computing-related resources include first and second computing nodes;

determine, by the computing system and based on the high-level directive, a plurality of commands to execute for the plurality of computer-related resources by the plurality of computer-related resources;

determine, by the computing system and based at least in part on permissions information for the first user that is stored externally to the plurality of computing-related resources, that the first user is authorized to execute the plurality of commands for the plurality of computing-related resources;

initiate, by the computing system, execution of the plurality of commands for the plurality of computing-related resources by the plurality of computer-related resources, including;

perform, by the first computing node and without additional security verification, the plurality of commands for the first user;

identify, by the second computing node, that additional security information stored on the second computing node disallows performing at least one command of the plurality of commands for the first user by the second computing node; and

deny, by the second computing node and based on the identifying, performance of the at least one command for the first user by the second computing node;

receive, by the computing system, results from the execution of the plurality of commands for the plurality of computing-related resources;

aggregate, by the computing system, the received results to generate aggregated results; and

return the aggregated results to the first user.

11. The non-transitory computer-readable medium of claim 10 wherein the plurality of computing-related resources include multiple computing nodes, and wherein the stored contents include software instructions that, when executed, further cause the computing system to perform the execution of the plurality of commands by:

causing each of the multiple computing nodes to execute each of the plurality of commands and to provide current status information to a shell aggregator executing on the computing system;

aggregating, by the shell aggregator, the current status information from the multiple computing nodes; and

providing the aggregated current status information to the first user.

12. The non-transitory computer-readable medium of claim 10 wherein the execution of the plurality of commands includes altering operation of the first computing node.

13. The non-transitory computer-readable medium of claim 10 wherein the receiving of the information includes receiving an indication of a different second user that has a defined role with second stored permissions information different from first stored permissions information of the first user, and wherein the determining that the first user is authorized is based on determining to allow the first user to assume the defined role of the different second user and that executing the plurality of commands for the plurality of computing-related resources is allowed by the second stored permissions information of the defined role.

14. The non-transitory computer-readable medium of claim 10 wherein the execution of the plurality of commands for the plurality of computing-related resources is performed at a first permission level associated with the first user, wherein the received information further indicates a second command to execute for the plurality of computing-related resources, and wherein the stored contents further cause the computing system to:

determine, based at least in part on the stored permissions information, that the first user is not authorized to execute the second command for the plurality of computing-related resources at the first permission level;

identify, by the computing system, a second permission level that is higher than the first permission level and that is authorized to execute the second command for the plurality of computing-related resources; and

initiate the execution of the second command for the plurality of computing-related resources at the second permission level.

15. The non-transitory computer-readable medium of claim 10 wherein the stored contents further cause the computing system to:

receive, by the computing system, an instruction to temporarily lock permissions to prohibit execution of commands for the plurality of computing-related resources;

receive, by the computing system, further information from the first user that indicates a second command to execute for the plurality of computing-related resources; and

deny, by the computing system and based on the temporarily locked permissions, authorization to execute the second command for the plurality of computing-related resources.

16. The non-transitory computer-readable medium of claim 10 wherein the stored contents further cause the computing system to, before the determining that the first user is authorized, receive the permissions information from a second user that controls access of a group of multiple users including the first user to a group of computing-related resources including the plurality of computing-related resources, and wherein the permissions information includes one or more permissions specific to the user.

17. The non-transitory computer-readable medium of claim 16 wherein the group of computing-related resources includes multiple computing-related resources that are associated with a virtual computer network provided to the first user by the network-accessible service, includes multiple computing-related resources that share a common tag specified by one or more users, or includes multiple computing-related resources in a common geographical location.

18. A system, comprising:

one or more processors of one or more computing systems; and

one or more memories storing software instructions that, when executed by at least one of the one or more processors, cause the one or more processors to manage execution of commands by;

receiving information from a user indicating an shell command to request data from each of a plurality of computing nodes when the shell command is executed by each of the plurality of computing nodes, wherein the plurality of computing nodes are provided for use by the user and are each executing one or more programs on behalf of the user;

determining, without interacting with the plurality of computing nodes, that the user is authorized to have the shell command be executed by each of the plurality of computing nodes;

initiating, based on the determining, execution of the shell command by each of the plurality of computing nodes to request the data, including modifying ongoing operation of the executing one or more programs on each of the plurality of computing nodes, including;

initiating execution of the shell command by a first computing node of the plurality of computing nodes for the user;

determining that the user is not authorized to have the shell command executed by a second computing node of the plurality of computing nodes; and

initiating execution of the shell command by the second computing node of the plurality of computing nodes at a higher permission level that is authorized to execute the shell command;

receiving results that include the requested data from the execution of the shell command by each of the plurality of computing nodes;

aggregating the received results for the plurality of computing nodes to generate aggregated results; and

returning the aggregated results to the user.

19. The system of claim 18 wherein the one or more computing systems are part of a network-accessible service that stores permission information for the user and that uses the stored permission information for the determining, and wherein the plurality of computing nodes are provided by the network-accessible service for temporary use by the user.