POLICY ENFORCEMENT DELAYS

• US 20140380402A1
• Filed: 06/20/2013
• Published: 12/25/2014
• Est. Priority Date: 06/20/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory Branchek
• Granted Patent: US 9,443,093 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures

Abstract

Policies are used to control access to resources. Requests to change a set of policies may be fulfillable, at least in some circumstances, only if the requests are submitted such that the requested changes would become effective at a time in the future that is in compliance with a requirement for delayed enforcement. The requirement for delayed enforcement may be encoded in a policy in the set of policies.

Claims

1. A computer-implemented method for managing policy, comprising:

under the control of one or more computer systems configured with executable instructions,

storing a set of one or more policies that include a policy addition policy, the policy addition policy specifying one or more conditions that include a requirement for a delay of enforcement for proposed policies;

receiving a request to add a proposed policy, the policy addition policy being applicable to the proposed policy;

determining, based at least in part on information provided in connection with the request, whether the proposed policy complies with the requirement;

wherein, as a result of determining that the proposed policy complies with the requirement, the proposed policy becomes effective in accordance with the requirement; and

wherein, as a result of determining that the proposed policy fails to comply with the requirement, the request is denied

2. The computer-implemented method of claim 1, wherein causing the policy to become effective includes causing one or more notifications of the request to add the proposed policy to be transmitted

3. The computer-implemented method of claim 1, wherein causing the proposed policy to become effective includes providing an ability to prevent the proposed policy from becoming effective under a set of one or more requirements that is less stringent than another set of one or more requirements for removing a policy from the set of one or more policies.

4. The computer-implemented method of claim 1, wherein the information provided with the request includes an encoding of a policy document defining the proposed policy, the policy document encoding a value from which compliance with the requirement is determinable.

5. The computer-implemented method of claim 1, wherein:

the request is an application programming interface call having a set of application programming interface parameters;

the information provided with the request is a parameter from the set of application programming interface parameters.

6. The computer-implemented method of claim 1, wherein:

the set of one or more policies apply to a set of computing resources managed on behalf of a customer of a computing resource service provider; and

storing the one or more policies includes storing the set of one or more policies with other sets of one or more policies of other customers of the computing resource service provider.

7. The computer-implemented method of claim 1, wherein:

the proposed policy includes a value indicating a time when the proposed policy is to become effective; and

the method further comprises;

adding the proposed policy to the set of one or more policies;

receiving a second request to which the proposed policy applies;

determining, based at least in part on the indicated time, whether to use the proposed policy in determining whether to fulfill the request;

evaluating, consistent with said determining, whether to fulfill the second request.

8. A computer-implemented method for managing policy, comprising:

under the control of one or more computer systems configured with executable instructions,

receiving a request for a change to a set of one or more policies;

determining, based at least in part on the request, whether the requested change satisfies one or more requirements for becoming effective in the future; and

as a result of determining that the requested change satisfies the one or more requirements, enabling the change to become effective in accordance with the requirement.

9. The computer-implemented method of claim 8, wherein the change is an addition of a policy to the set of one or more policies.

10. The computer-implemented method of claim 8, wherein the requirement is a result of a policy from the set of one or more policies.

11. The computer-implemented method of claim 8, further comprising causing one or more notifications of the request to be transmitted.

12. The computer-implemented method of claim 8, further comprising:

receiving a request to cancel the change before the change becomes effective; and

disenabling the change from becoming effective as a result of receiving the request to cancel the change.

13. The computer-implemented method of claim 8, wherein determining the whether the requested change satisfies the one or more requirements includes determining whether an encoding of a proposed policy includes a parameter that indicates an enforcement delay consistent with the one or more requirements.

14. A system, comprising:

a frontend subsystem configured to receive requests to change policy;

a policy management subsystem configured to, upon receipt of a request for a change to policy by the frontend subsystem;

receive information from the frontend subsystem based at least in part on the request;

determine, based at least in part on the received information, whether the requested change is in compliance with one or more requirements for delayed effectiveness of the change;

as a result of determining that the requested change is in compliance with the one or more requirements, enabling the requested change to become effective.

15. The system of claim 14, wherein the requests are web service requests.

16. The system of claim 14, wherein the information is an encoding of a proposed policy.

17. The system of claim 14, further comprising a notification system configured to, as a result of receipt of the request, transmit one or more notifications.

18. The computer-implemented method of claim 14, wherein the policy management subsystem is further configured to, upon receipt of a second request:

select, from a set of policies, a subset of policies that encode an effective time indicative of currently being in force; and

provide a determination, based at least in part on the selected set of policies, whether to fulfill the second request.

19. The system of claim 14, wherein the requirement is a result of an existing policy enforced by the system.

20. The system of claim 14, wherein the policy management subsystem is further configured to enable cancellation of the requested change becoming effective.

21. One or more computer-readable storage media having collectively stored thereon instructions that, when executed by one or more processors of a system, cause the system to:

manage a set of policies for access to computing resource access on behalf of an entity;

receive a request for a change to the set of policies; and

process the request so that the change is cancellable, before becoming effective, for an amount of time in accordance with one or more requirements for delayed effectiveness for policy changes.

22. The one or more computer-readable storage media of claim 21, wherein the instructions further cause the system to cause transmission of one or more notifications of the change.

23. The one or more computer-readable storage media of claim 22, wherein transmission of the one or more notifications includes transmission of a notification to an identity specified as having authority to cancel the change.

24. The one or more computer-readable storage media of claim 21, wherein, before the change becomes effective, the change is cancellable pursuant to one or more requirements that are less stringent than other requirements effective after the change becomes effective.

25. The one or more computer-readable storage media of claim 21, wherein the request for the change includes an encoding of a new policy that includes information indicating a proposed delay for the new policy to become effective.

26. The one or more computer-readable storage media of claim 21, wherein processing the request includes denying the request as a result of the request lacking information indicating a delay in accordance with the one or more requirements for delayed effectiveness for policy changes.