Governance policy framework for cloud resources

Patent metadata

Field	Value
Publication number	US-10389754-B2
Application number	US-201514845756-A
Country	US
Kind code	B2
Filing date	Sep 4, 2015
Priority date	Sep 4, 2015
Publication date	Aug 20, 2019
Grant date	Aug 20, 2019

Abstract

A system, method, and computer-readable medium are disclosed for performing a cloud environment governance policy operation which provides a governance policy framework for use within cloud environments. In various embodiments, the cloud environment governance policy operation expands identify access management (IAM) systems to understand not only users but also resources. Additionally, in various embodiments, the cloud environment governance policy operation provides governance packs to abstract cloud resources and compliance/governance/regulatory regimes via a common open language.

First claim

What is claimed is:

1. A computer-implementable method, comprising:
providing, by an information handling system (IHS), a governance portion for use within a cloud environment, the governance portion enabling a cloud environment policy system to provide a set of governance policies;
providing, by a processor of the IHS, cloud resource information of the cloud environment to allow a user to define governance policy needs associated with use of the cloud environment;
generating, by the governance portion using the set of governance policies, a governance pack based upon the governance policy needs of the user, the governance pack comprising a set of pre-configured cloud environment governance policy templates that correspond to the governance policy needs of the user;
providing the governance pack to the cloud environment;
receiving an input to edit the governance pack;
modifying the governance pack according to the input to edit the governance pack to create a modified governance pack, wherein the governance pack is modified under the control of a predefined infrastructure management platform role; and
providing the modified governance pack to the cloud environment, wherein at least one cloud resource in the cloud environment is modified based on the modified governance pack.

2. The method of claim 1 , wherein:
the governance pack enables an identify access management (IAM) system to understand resources.

3. The method of claim 1 , wherein:
the governance pack abstracts cloud resources and at least one of a compliance regime, a governance regime and a regulatory regime via a common open language.

4. The method of claim 1 , wherein:
the governance pack comprises information and options regarding at least one of an extant role, a restriction limitation, a migration alert request operation, a console access limitation, a resource monitoring access limitation, a credentials requirement limitation and a configuration enforcement limitation.

5. The method of claim 4 , wherein:
the configuration enforcement limitation comprises at least one of firewall rules, blob storage resource configuration limitations, file system encryption configurations, key sizing configurations, backup regime configurations, whether to allow installation of open source security (OSSEC) type devices, whether to allow communications to be routed through an application delivery network, whether to enable installation of cloud management applications and whether to restrict which software versions can be deployed to the cloud environment.

6. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor to cause the system to perform operations comprising:
provide a governance portion for use within a cloud environment the governance portion enabling a cloud environment policy system to provide a set of governance policies;
provide cloud resource information of the cloud environment to allow a user to define governance policy needs associated with use of the cloud environment;
generate, by the governance portion using the set of governance policies, a governance pack based upon the governance policy needs of the user, the governance pack comprising a set of pre-configured cloud environment governance policy templates that correspond to the governance policy needs of the user;
provide the governance pack to the cloud environment;
receive an input to edit the governance pack;
modify the governance pack according to the input to edit the governance pack to create a modified governance pack, wherein the governance pack is modified under the control of a predefined infrastructure management platform role; and
provide the modified governance pack to the cloud environment, wherein at least one cloud resource in the cloud environment is modified based on the modified governance pack.

7. The system of claim 6 , wherein:
the governance pack enables an identify access management (IAM) system to understand resources.

8. The system of claim 6 , wherein:
the governance pack abstracts cloud resources and at least one of a compliance regime, a governance regime and a regulatory regime via a common open language.

9. The system of claim 6 , wherein:
the governance pack comprises information and options regarding at least one of an extant role, a restriction limitation, a migration alert request operation, a console access limitation, a resource monitoring access limitation, a credentials requirement limitation and a configuration enforcement limitation.

10. The system of claim 6 , wherein:
the configuration enforcement limitation comprises at least one of firewall rules, blob storage resource configuration limitations, file system encryption configurations, key sizing configurations, backup regime configurations, whether to allow installation of open source security (OSSEC) type devices, whether to allow communications to be routed through an application delivery network, whether to enable installation of cloud management applications and whether to restrict which software versions can be deployed to the cloud environment.

11. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions to cause a system to perform operations comprising configured for:
providing a governance portion for use within a cloud environment, the governance portion enabling a cloud environment policy system to provide a set of governance policies;
providing cloud resource information of the cloud environment to allow a user to define governance policy needs associated with use of the cloud environment;
generating, by the governance portion using the set of governance policies, a governance pack based upon the governance policy needs of the user, the governance pack comprising a set of pre-configured cloud environment governance policy templates that correspond to the governance policy needs of the user;
providing the governance pack to the cloud environment;
receiving an input to edit the governance pack;
modifying the governance pack according to the input to edit the governance pack to create a modified governance pack, wherein the governance pack is modified under the control of a predefined infrastructure management platform role; and
providing the modified governance pack to the cloud environment, wherein at least one cloud resource in the cloud environment is modified based on the modified governance pack.

12. The non-transitory, computer-readable storage medium of claim 11 , wherein:
the governance pack enables an identify access management (IAM) system to understand resources.

13. The non-transitory, computer-readable storage medium of claim 11 , wherein:
the governance pack provides a governance pack to abstract cloud resources and at least one of a compliance regime, a governance regime and a regulatory regime via a common open language.

14. The non-transitory, computer-readable storage medium of claim 11 , wherein:
the governance pack comprises information and options regarding at least one of an extant role, a restriction limitation, a migration alert request operation, a console access limitation, a resource monitoring access limitation, a credentials requirement limitation and a configuration enforcement limitation.

15. The non-tr

Assignees

• Quest Software Inc
• Quest Software

Inventors

• Mortman David

Classifications

• H04L41/00

  Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title