CUSTOM COMMUNICATION CHANNELS FOR APPLICATION DEPLOYMENT

• US 20160344798A1
• Filed: 05/19/2015
• Published: 11/24/2016
• Est. Priority Date: 05/19/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: KAPILA, DHANVI HARSHA
• Granted Patent: US 10,749,985 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

An application deployment service (ADS) component receives a request to establish a communication channel for clients to submit deployment artifacts associated with an application. A set of endpoints are created for the channel. In response to receiving a message via one of the endpoints, the ADS determines that additional security verification operations are to be performed before a deployment task indicated in the message can be performed. After the security verification operations are completed, the task is implemented.

Claims

1. A system, comprising:

one or more components of an application deployment service implemented at a plurality of computing devices of a provider network;

wherein the one or more components are configured to;

receive a first request for a communication channel to be used by one or more clients to transmit one or more deployment artifacts of a particular application to be executed at one or more execution platforms of the provider network;

transmit, to at least one destination associated with the one or more clients, an indication of a particular endpoint of a communication channel, wherein the particular endpoint is to be used for transmitting deployment artifacts associated with at least a first deployment task category of a plurality of deployment task categories associated with the particular application;

extract a payload from a message directed to the particular endpoint by a particular client of the one or more clients;

determine, based at least in part on an examination of the payload, that one or more security verification operations are to be performed prior to an implementation of a deployment task of the first deployment task category; and

in response to determining that the one or more security verification operations succeeded, implement the deployment task, wherein the deployment task comprises storing a version of a deployment artifact indicated in the payload within a repository.

2. The system as recited in claim 1, wherein the one or more components are configured to:

store a representation of a first set of one or more submitters authorized to submit messages to the particular endpoint, and a representation of a second set of one or more submitters authorized to submit messages to a different endpoint established for the communication channel.

3. The system as recited in claim 1, wherein the one or more components are configured to:

initiate an establishment of a second endpoint of the communication channel, wherein the second endpoint is to be used for transmitting deployment artifacts associated with at least a second deployment task category of the plurality of deployment task categories.

4. The system as recited in claim 1, wherein the one or more security verification operations include a use of one or more of:

(a) a multi-step authentication protocol or (b) a multi-party authentication protocol.

5. The system as recited in claim 1, wherein the plurality of deployment task categories include one or more of:

(a) updating source code, (b) deploying an executable package, (c) modifying an application configuration setting, or (d) modifying a resource set used for executing an application.

6. A method, comprising:

performing, at an application deployment service implemented at one or more computing devices of a provider network;

receiving a first request for a communication channel to be used by one or more clients to transmit one or more deployment artifacts of a particular application;

transmitting to at least one destination associated with the one or more clients, an indication of a particular endpoint of a communication channel;

determining, in response to a first message received via the particular endpoint, that one or more security verification operations are to be performed prior to an implementation of a first deployment task corresponding to the message and the particular application; and

in response to completing the one or more security verification operations, implementing the first deployment task using at least a first artifact indicated in the first message.

7. The method as recited in claim 6, wherein the indication of the particular endpoint comprises one of:

(a) an e-mail address, (b) a short message service (SMS) destination address, or (c) a file transfer destination address.

8. The method as recited in claim 6, further comprising performing, by the application deployment service:

storing a representation of a first set of one or more submitters authorized to submit messages to the particular endpoint, and a representation of a second set of one or more submitters authorized to submit messages to a different endpoint established for the communication channel.

9. The method as recited in claim 6, wherein the first deployment task belongs to a first deployment task category of a plurality of deployment task categories of the particular application, further comprising performing, by the application deployment service:

initiating an establishment of a second endpoint of the communication channel, wherein the second endpoint is to be used for transmitting deployment artifacts associated with at least a second deployment task category of the plurality of deployment task categories.

10. The method as recited in claim 9, wherein the plurality of deployment task categories include one or more of:

(a) updating source code, (b) deploying an executable package, (c) modifying an application configuration setting, or (d) modifying a resource set used for executing an application.

11. The method as recited in claim 6, wherein the one or more security verification operations include a use of one or more of:

(a) a multi-step authentication protocol or (b) a multi-party authentication protocol.

12. The method as recited in claim 6, wherein said implementing the first deployment task comprises:

determining a particular location within a source code hierarchy at which a particular source code file included in the first message is to be stored;

storing the particular source code file at the particular location;

generating, using the particular source code file, an executable version of the particular application; and

instantiating an execution of the particular application at one or more execution platforms using the executable version.

13. The method as recited in claim 6, further comprising performing, by the application deployment service:

in response to receiving a second message at the particular endpoint, determining that no additional security verification operations are to be scheduled before implementing a second deployment task indicated in the second message.

14. The method as recited in claim 6, further comprising performing, by the application deployment service:

receiving, via a programmatic interface, an indication that an authorized entity associated with the particular application has revoked rights of the one or more clients to submit deployment artifacts via the communication channel; and

in response to receiving a second message subsequent to the indication at the particular endpoint, discarding the second message.

15. The method as recited in claim 6, further comprising performing, by the application deployment service:

rejecting a second message directed to the particular endpoint based at least in part on determining that the second message violates one or more data transfer constraints associated with the particular endpoint.

16. A non-transitory computer-accessible storage medium storing program instructions that when executed on one or more processors implement one or more components of an application deployment service configured to:

receive a first request for a communication channel to be used by one or more clients to transmit one or more deployment artifacts of a particular application;

transmit to at least one destination associated with the one or more clients, an indication of a particular endpoint of a communication channel;

determine, in response to a first message received via the particular endpoint, that one or more security verification operations are to be performed prior to an implementation of a first deployment task corresponding to the message and the particular application; and

in response to completing the one or more security verification operations, implement the first deployment task using at least a first artifact indicated in the first message.

17. The non-transitory computer-accessible storage medium as recited in claim 16, wherein the indication of the particular endpoint comprises one of:

(a) an e-mail address, (b) a short message service (SMS) destination address, or (c) a file transfer destination address.

18. The non-transitory computer-accessible storage medium as recited in claim 16, wherein the one or more components of the application deployment service are further configured to:

store a representation of a first set of one or more submitters authorized to submit messages to the particular endpoint, and a representation of a second set of one or more submitters authorized to submit messages to a different endpoint established for the communication channel.

19. The non-transitory computer-accessible storage medium as recited in claim 16, wherein the first deployment task belongs to a first deployment task category of a plurality of deployment task categories of the particular application, wherein the one or more components of the application deployment service are further configured to:

initiate an establishment of a second endpoint of the communication channel, wherein the second endpoint is to be used for transmitting deployment artifacts associated with at least a second deployment task category of the plurality of deployment task categories.

20. The non-transitory computer-accessible storage medium as recited in claim 19, wherein the plurality of deployment task categories include one or more of:

(a) updating source code, (b) deploying an executable package, (c) modifying an application configuration setting, or (d) modifying a resource set used for executing an application.