Access control policies associated with freeform metadata
First Claim
Patent Images
1. A computer implemented method for using tags to control access to resources, comprising:
- associating both a first access control policy and a second access control policy with a single metadata tag, the metadata tag including a freeform character string specifying a key and a key value,wherein the first access control policy identifies principals that are allowed to assign the metadata tag to the at least one computing resource andwherein the second access control policy identifies operations that are allowed or not allowed to be performed on resources associated with the key and the key value of the metadata tag;
receiving, from a user using an application programming interface (API), a request to assign the metadata tag to the at least one computing resource;
evaluating the first access control policy based at least in part on a combination of the key and the key value of the metadata tag;
assigning the metadata tag to the at least one computing resource in response to determining that the first access control policy allows the user to assign the metadata tag;
receiving a request to perform an operation on the at least one computing resource;
evaluating, based at least in part on both of the key and the key value of the metadata tag, the second access control policy associated with the metadata tag via an identity management service that retrieves the second access control policy in addition to one or more other access control policies that are related to the request to perform the operation on the computing resource; and
authorizing the request to perform the operation on the at least one computing resource based at least in part on the evaluation of the second access control policy.
1 Assignment
0 Petitions
Accused Products
Abstract
Approaches are described for security and access control for computing resources. Various embodiments utilize metadata, e.g., tags that can be applied to one or more computing resources (e.g., virtual machines, host computing devices, applications, databases, etc.) to control access to these and/or other computing resources. In various embodiments, the tags and access control policies described herein can be utilized in a multitenant shared resource environment.
29 Citations
13 Claims
-
1. A computer implemented method for using tags to control access to resources, comprising:
-
associating both a first access control policy and a second access control policy with a single metadata tag, the metadata tag including a freeform character string specifying a key and a key value, wherein the first access control policy identifies principals that are allowed to assign the metadata tag to the at least one computing resource and wherein the second access control policy identifies operations that are allowed or not allowed to be performed on resources associated with the key and the key value of the metadata tag; receiving, from a user using an application programming interface (API), a request to assign the metadata tag to the at least one computing resource; evaluating the first access control policy based at least in part on a combination of the key and the key value of the metadata tag; assigning the metadata tag to the at least one computing resource in response to determining that the first access control policy allows the user to assign the metadata tag; receiving a request to perform an operation on the at least one computing resource; evaluating, based at least in part on both of the key and the key value of the metadata tag, the second access control policy associated with the metadata tag via an identity management service that retrieves the second access control policy in addition to one or more other access control policies that are related to the request to perform the operation on the computing resource; and authorizing the request to perform the operation on the at least one computing resource based at least in part on the evaluation of the second access control policy. - View Dependent Claims (2)
-
-
3. A computer implemented method, comprising:
-
associating both a first access control policy and a second access control policy with a single set of freeform metadata, the freeform metadata including at least one character string that specifies a key and a key value associated with a computing resource, wherein the first access control policy identifies principals are allowed to assign the freeform metadata and wherein the second access control policy identifies operations that are allowed or not allowed to be performed on resources associated with the freeform metadata; receiving a request from a first user to assign the freeform metadata to a computing resource; evaluating the first access control policy; assigning the freeform metadata to the computing resource in response to determining that the first access control policy allows the first user to assign the freeform metadata; receiving, from a second user, a request to access the computing resource, the computing resource having freeform metadata associated therewith; retrieving the second access control policy associated with the freeform metadata; evaluating the second access control policy to control access to the computing resource based at least in part on one or both of the key and the key value of the freeform metadata associated with the computing resource via an identity management service that retrieves the second access control policy in addition to one or more other access control policies that are related to the request to access the computing resource; and authorizing the request to access the computing resource based at least in part on the evaluation of the second access control policy. - View Dependent Claims (4, 5, 6, 7)
-
-
8. A computing system, comprising:
-
at least one processor; and memory including instructions that, when executed by the at least one processor, cause the computing system to; associate both a first access control policy and a second access control policy with a single set of freeform metadata, the freeform metadata including at least one character string that specifies a key and a key value associated with a computing resource, wherein the first access control policy identifies principals are allowed to assign the freeform metadata and wherein the second access control policy identifies operations that are allowed or not allowed to be performed on resources associated with the freeform metadata; receive a request from a first user to assign the freeform metadata to a computing resource; evaluate the first access control policy; assign the freeform metadata to the computing resource in response to determining that the first access control policy allows the first user to assign the freeform metadata; receive, from a second user, a request to access the computing resource, the computing resource having freeform metadata associated therewith; retrieve the second access control policy associated with the freeform metadata; evaluate the second access control policy to control access to the computing resource based at least in part on one or both of the key and the key value of the freeform metadata associated with the computing resource via an identity management service that retrieves the second access control policy in addition to one or more other access control policies that are related to the request to access the computing resource; and authorize the request to access the computing resource based at least in part on the evaluation of the second access control policy. - View Dependent Claims (9, 10)
-
-
11. A non-transitory computer readable storage medium storing one or more sequences of instructions executable by one or more processors to perform a set of operations comprising:
-
associating both a first access control policy and a second access control policy with a single set of freeform metadata, the freeform metadata including at least one character string that specifies a key and a key value associated with a computing resource, the first access control policy identifies principals are allowed to assign the freeform metadata and wherein the second access control policy identifies operations that are allowed or not allowed to be performed on resources associated with the freeform metadata; receiving a request from a first user to assign the freeform metadata to a computing resource; evaluating the first access control policy; assigning the freeform metadata to the computing resource in response to determining that the first access control policy allows the first user to assign the freeform metadata; receiving, from a second user, a request to access the computing resource, the computing resource having freeform metadata associated therewith; retrieving the second access control policy associated with the freeform metadata; evaluating the second access control policy to control access to the computing resource based at least in part on one or both of the key and the key value of the freeform metadata associated with the computing resource via an identity management service that retrieves the second access control policy in addition to one or more other access control policies that are related to the request to access the computing resource; and authorizing the request to access the computing resource based at least in part on the evaluation of the second access control policy. - View Dependent Claims (12, 13)
-
Specification