Authorization check using a web service request

• US 9,648,040 B1
• Filed: 09/19/2013
• Issued: 05/09/2017
• Est. Priority Date: 09/19/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Morkel, John Michael, Lyon, Derek Avery
• Primary Examiner(s): Pyzocha, Michael
• Application Number:
  US14/031,869
• Time in Patent Office: 1,328 Days
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An authorization check web service request is disclosed. The web service request can include a parameter controlling whether or not to perform the action associated with the web service request. The parameter can be included in the web service request itself, or it can be separated therefrom, such as being included in a customer account. Using this parameter, the requestor can perform an authorization check without actually performing the action. Thus, customers can determine the authorization result of a request without actually processing the request itself. Customers and other services can use this parameter to determine their effective permissions.

Claims

1. A method of performing an authorization check of an API request, the method comprising:

receiving the API request associated with a requestor, the API request including a parameter controlling whether or not to perform an action associated with the API request;

retrieving state information associated with one or more resources that are impacted by the action should it be performed, wherein the one or more resources include an instance running on a host server computer and wherein the state information includes one of the following;

a type of the instance, a region in which the instance is executing, or a security group associated with the instance;

retrieving policy information;

comparing the state information to the policy information to determine whether the requestor is authorized to perform the action associated with the API request; and

if the parameter indicates that the action should not be performed, then returning a result indicating whether the requestor is authorized to perform the action, but without performing the action.

2. The method of claim 1, wherein the policy information includes permissions associated with the requestor or actions allowed to be performed on the resources.

3. The method of claim 1, wherein the parameter is a Boolean operator having set and unset states.

4. The method of claim 1, wherein the API request identifies an administrator and the requestor, and the administrator transmits the API request either periodically or non-periodically to check on the permissions of the requestor for auditing or debug purposes.

5. The method of claim 1, wherein the API request is a request to modify at least one resource, and the result indicates whether the requestor has permissions to perform the action so as to modify the at least one resource.

6. The method of claim 1, wherein the API request is received from an application and wherein the application displays user options based on the authorization.

7. A computer-readable storage media having instructions thereon for performing an authorization check of a web service request, the method comprising:

receiving the web service request associated with an action to be performed in a multi-tenant environment, the web service request associated with a parameter indicating whether to return an authorization result without performing the action;

performing an authorization check, the authorization check including retrieving state information for instances executing within the multi-tenant environment and retrieving policy information associated with permissions and comparing the state information to the permissions, wherein the state information includes one or more regions in which the instances are executing, security groups associated with the instances, or costs associated with the instances;

detecting a state of the parameter; and

based on the state of the parameter, returning an authorization result indicating whether the web service request is authorized without performing the action.

8. The computer-readable storage media of claim 7, wherein performing an authorization check includes retrieving instance metadata from instances that would be impacted by the web service request should the action be completed.

9. The computer-readable storage media of claim 7, wherein the web service request is generated by an administrator that is checking a requestor'"'"'s permissions.

10. The computer-readable storage media of claim 7, further including performing an authentication of a requestor associated with the web service request.

11. The computer-readable storage media of claim 7, wherein the action is to modify one or more instances executing on one or more host server computers in the multi-tenant environment.

12. The computer-readable storage media of claim 7, wherein the policy information includes the permissions associated with a requestor or actions allowed to be performed on resources in the multi-tenant environment.

13. The computer-readable storage media of claim 7, wherein the multi-tenant environment is dynamically changing state.

14. The computer-readable storage media of claim 7, wherein the authorization result further includes an authorization failure or the authorization confirmation without performing the action.

15. The computer-readable storage media of claim 7, wherein the parameter is a Boolean operator having set and unset states and the parameter is included in the web service request or within a customer account.

16. The computer-readable storage media of claim 7, wherein the web service request is received from an application that includes credentials of the requestor, and wherein the application displays user options based on the authorization.

17. A system for performing an authorization check, comprising:

an admission control component for accessing a policy document in response to an API request from a user, the API request being a request to perform an action;

a first host server computer executing a resource manager to obtain state information associated with resources executing on host server computers that are impacted by the API request, wherein the resources include instances executing on the host server computers and the state information includes security groups associated with the instances; and

a second host server computer coupled to the first host server computer and executing an authorization check component to determine whether the user is authorized to perform the action based, at least in part, on a comparison between the policy document and the state information, and to return an authorization check response without performing the action.