AUTOMATIC DIRECTORY JOIN FOR VIRTUAL MACHINE INSTANCES

• US 20150160956A1
• Filed: 12/05/2013
• Published: 06/11/2015
• Est. Priority Date: 11/11/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Shah, Shon Kiran, Mehta, Gaurang Pankaj, Rizzo, Thomas Christopher, Rao, Guruprakash Bangalore
• Granted Patent: US 10,908,937 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A customer utilizes an interface provided by a virtual computer system service to provision a virtual machine instance and join this instance to a directory. The interface may have previously obtained the domain name and the Internet Protocol addresses for one or more directories available to the customer for joining the virtual machine instance. The virtual computer system service may communicate with a managed directory service to obtain a set of temporary credentials that may be used to transmit a request to the directory to allow joining of the virtual machine instance. Upon provisioning of the instance, an agent operating within the instance may be configured to obtain the domain name and Internet Protocol addresses for the directory to establish a connection with the directory. The agent may also be configured to obtain the set of temporary credentials to transmit a request to the directory for joining of the instance.

Claims

1. A computer-implemented method for fulfilling a request to provision a virtual machine instance and, once provisioned, joining the virtual machine instance to a directory, comprising:

under the control of one or more computer systems configured with executable instructions,

receiving, at a virtual computer system service, network address information associated with the directory to enable the virtual machine instance to be provisioned and joined to the directory;

provisioning the virtual machine instance;

transmitting, to a managed directory service, a request for a set of temporary credentials for joining the virtual machine instance to the directory; and

receiving the set of temporary credentials from the managed directory service;

wherein the virtual machine instance is configured to utilize the network address information to establish a connection with the directory and utilize the set of temporary credentials to join the virtual machine instance to the directory.

2. The computer-implemented method of claim 1, wherein the virtual machine instance comprises an agent configured to utilize the network address information to establish the connection with the directory and utilize the set of temporary credentials to join the virtual machine instance to the directory.

3. The computer-implemented method of claim 1, wherein the network address information comprises a fully qualified domain name and one or more domain name system Internet Protocol addresses associated with the directory.

4. The computer-implemented method of claim 1, wherein the virtual computer system service comprises a metadata service configured to:

store, as metadata, the network address information associated with the directory and the set of temporary credentials from the managed directory service; and

provide the metadata to the virtual machine instance prior to the virtual machine instance utilizing the network address information to establish the connection with the directory.

5. The computer-implemented method of claim 1, further comprising, prior to receiving, at the virtual computer system service, the network address information, transmitting, to the managed directory service, a request for network address information for each directory of a set of directories, the set of directories including at least the directory to which the virtual machine instance is to be joined.

6. The computer-implemented method of claim 1, wherein the transmission of the request to the managed directory service for the set of temporary credentials is performed by the virtual machine instance.

7. A computer system, comprising:

one or more processors; and

memory having collectively stored therein instructions that, when executed by the computer system, cause the computer system to;

receive a first request for network address information for one or more directories of a set of directories, the network address information usable to establish a connection to each of the one or more directories of the set of directories;

transmit, to a computer system instance, the network address information for each of the one or more directories of the set of directories;

receive a second request from the computer system instance for a set of credentials usable to join the computer system instance to a directory selected from the set of directories, the second request comprising identification of the selected directory; and

transmit, to the computer system instance, the set of credentials usable to join the computer system instance to the selected directory.

8. The computer system of claim 7, wherein the computer system instance is hosted by a computer system service on behalf of a customer of the computer system service, the computer system service being different than a managed directory service that maintains the directory.

9. The computer system of claim 7, wherein the network address information comprises a fully qualified domain name and one or more domain name system Internet Protocol addresses associated with the directory.

10. The computer system of claim 7, wherein the computer system instance comprises an agent configured to utilize the network address information to establish a connection with the selected directory and use the set of credentials to join the computer system instance to the selected directory.

11. The computer system of claim 7, wherein the computer system instance is configured to use the set of credentials to submit an application programming interface command, configured to cause the managed directory service to join the computer system instance to the selected directory.

12. The computer system of claim 7, wherein the computer system instance is configured to submit application programming interface commands to the computer system, the application programming interface commands configured to cause the computer system to:

transmit the network address information for each directory of the set of directories, to a computer system instance; and

transmit the set of credentials usable to join the computer system instance to the directory selected from the set of directories.

13. The computer system of claim 7, wherein each directory of the set of directories having associated a policy that enables one or more computer system instances to join the directory.

14. The computer system of claim 7, wherein the first request for network address information is included within a request to provision the computer system instance.

15. A non-transitory computer-readable storage medium having collectively stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:

receive a first web service request for network address information associated with a directory to enable a computer system instance to be provisioned and joined to the directory;

provision the computer system instance;

transmit, to a managed directory service, a second web service request for credential information for joining the computer system instance to the directory;

receive, from the managed directory service, the network address information associated with the directory and the credential information for joining the computer system instance to the directory; and

provide the network address information for the directory and the credential information for joining the computer system instance to the directory.

16. The non-transitory computer-readable storage medium of claim 15, wherein the computer system instance is hosted by a computer system service on behalf of a customer of the computer system service, the computer system service being different than the managed directory service that maintains the directory.

17. The non-transitory computer-readable storage medium of claim 15, wherein the first web service request for the network address information associated with the directory and the second web service request for credential information for joining the computer system instance to the directory is received from the computer system instance.

18. The non-transitory computer-readable storage medium of claim 17, wherein the network address information for the directory and the credential information for joining the computer system instance to the directory is provided to the computer system instance in response to the first web service request and the second web service request.

19. The non-transitory computer-readable storage medium of claim 15, wherein the instructions further cause the computer system to at least store, as metadata, the identification of the directory, network address information for the directory and credential information for joining the computer system instance to the directory.

20. The non-transitory computer-readable storage medium of claim 15, wherein the interface is hosted by a computer system service on behalf of a customer of the computer system service, the computer system service being different than the managed directory service that maintains the directory.

21. The non-transitory computer-readable storage medium of claim 15, wherein the directory has associated a policy to enable one or more computer system instances to join the directory.

22. The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions, when executed by the one or more processors, further cause the computer system to:

receive, from an interface, a third web service request to provision the computer system instance, create the directory and, once the computer system instance has been provisioned, join the computer system instance to the created directory;

transmit, to the managed directory service, a fourth web service request to create the directory; and

prior to providing to the computer system instance network address information for the created directory and credential information for joining the computer system instance to the created directory, receive, from the managed directory service, the network address information for the created directory and the credential information for joining the computer system instance to the created directory.