公开(公告)号：US20220191253A1

公开(公告)日：2022-06-16

申请号：US17119663

申请日：2020-12-11

Applicant: Amazon Technologies, Inc.

Inventor： Neha RUNGTA ,  Daniel George PEEBLES ,  Andrew Jude GACEK ,  Marvin THEIMER ,  Rebecca Claire WEISS ,  Brigid Ann JOHNSON

IPC: H04L29/06 ,  H04L12/24

Abstract: Techniques for intent-based access control are described. A method of intent-based access control may include receiving, via a user interface of an intent-based governance service, one or more intent statements associated with user resources in a provider network, the one or more intent statements expressing at least one type of action allowed to be performed on the user resources, compiling the one or more intent statements into at least one access control policy, and associating the at least one access control policy with the user resources.

公开(公告)号：US20200314145A1

公开(公告)日：2020-10-01

申请号：US16369215

申请日：2019-03-29

Applicant: Amazon Technologies, Inc.

Inventor： Pauline Virginie BOLIGNANO ,  Tyler BRAY ,  John Byron COOK ,  Andrew Jude GACEK ,  Kasper Søe LUCKOW ,  Andrea NEDIC ,  Neha RUNGTA ,  Cole SCHLESINGER ,  Carsten VARMING

IPC: H04L29/06 ,  G06F9/54 ,  G06F8/41

Abstract: Techniques for intent-based governance are described. For example, in some instances a method of receiving an indication of a change involving of one or more of code, a policy, a network configuration, or a governance requirement rule impacting a resource in a provider network for an account that is to be analyzed using one or more governance requirement rules; determining one or more governance requirement rules to evaluate for compliance after the update; evaluating the determined one or more governance requirement rules for compliance using one or more reasoning engines according to one or more policies; and making a result of the evaluating available to a user provides such governance.

公开(公告)号：US20220094643A1

公开(公告)日：2022-03-24

申请号：US17029581

申请日：2020-09-23

Applicant: Amazon Technologies, Inc.

Inventor： John Byron COOK ,  Neha RUNGTA ,  Andrew Jude GACEK ,  Daniel George PEEBLES ,  Carsten VARMING

IPC: H04L12/911 ,  H04L12/923

Abstract: Techniques are described for using compositional reasoning techniques to perform role reachability analyses relative to collections of user accounts and roles of a cloud provider network. Delegated role-based resource management generally is a method for controlling access to resources in cloud provider networks and other distributed systems. Many cloud provider networks, for example, implement identity and access management subsystems using this approach, where the concept of “roles” is used to specify which resources can be accessed by people, software, or (recursively) by other roles. An abstraction of the role reachability analysis is provided that can be used as input to a model-checking application to reason about such role reachability questions (e.g., which roles of an organization are reachable from other roles).

公开(公告)号：US20200073739A1

公开(公告)日：2020-03-05

申请号：US16115408

申请日：2018-08-28

Applicant: Amazon Technologies, Inc.

Inventor： Neha RUNGTA ,  Temesghen KAHSAI AZENE ,  Pauline Virginie BOLIGNANO ,  Kasper Soe LUCKOW ,  Sean McLAUGHLIN ,  Catherine DODGE ,  Andrew Jude GACEK ,  Carsten VARMING ,  John Byron COOK ,  Daniel SCHWARTZ-NARBONNE ,  Juan Rodriguez HORTALA

IPC: G06F11/07 ,  G06F11/14 ,  G06F9/50 ,  G06F9/455 ,  G06F9/451 ,  G06F8/60

Abstract: A constraint solver service of a computing resource service provider performs evaluations of logic problems provided by the service provider's users and/or services by deploying a plurality of constraint solvers to concurrently evaluate the logic problem. Each deployed solver has, or is configured with, different characteristics and/or capabilities than the other solvers; thus, the solvers can have varying execution times and ways of finding a solution. The service may control execution of the solvers using virtual computing resources, such as by installing and configuring a solver to execute in a software container instance. The service receives solver results and delivers them according to a solution strategy such as “first received” to reduce latency or “check for agreement” to validate the solution. An interface allows the provider of the logic problem to select and configure solvers, issue commands and modifications during solver execution, select the solution strategy, and receive the solution.