Policy approval layer

Patent metadata

Field	Value
Publication number	US-10587653-B2
Application number	US-201615091493-A
Country	US
Kind code	B2
Filing date	Apr 5, 2016
Priority date	Sep 22, 2014
Publication date	Mar 10, 2020
Grant date	Mar 10, 2020

Abstract

A customer of a policy management service may use an interface with a configuration and management service to interact with policies that may be applicable to the customer's one or more resources. The customer may create and/or modify the policies and the configuration and management service may notify one or more other entities of the created and/or modified policies. The one or more other entities may be operated by user authorized to approve the created and/or modified policies. Interactions with the configuration and management service may be the same as the interactions with the policy management service.

First claim

What is claimed is:

1. A non-transitory computer-readable storage medium comprising executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
obtain a request to interact with a policy, the request being formatted in accordance with a service associated with a second computer system;
provide a notification to a first computer system of the interaction, the notification including a description of the interaction based at least in part on a state of the policy prior to the interaction;
detect a quorum of a set of entities that approves the interaction with the policy;
simulate, in response to approval of the quorum, the interaction by at least making modifications to the policy, wherein the interaction causes one or more operations to be performed by using one or more computing resources to determine whether an error exists during simulation; and
perform the interaction based at least in part on an outcome of simulating the interaction.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the approval of the quorum includes an electronic signature attesting to an identity of an operator of the first computer system.

3. The non-transitory computer-readable storage medium of claim 1 , wherein the executable instructions further comprise instructions that, as a result of execution by the one or more processors, cause the computer system to obtain, from the second computer system, the state of the policy prior to the interaction.

4. The non-transitory computer-readable storage medium of claim 3 , wherein the executable instructions further comprise instructions that, as a result of execution by the one or more processors, cause the computer system to generate a restore point based at least in part on the state of the policy prior to the interaction.

5. The non-transitory computer-readable storage medium of claim 3 , wherein the state of the policy includes at least some encrypted data, wherein the encrypted data is encrypted using a cryptographic key maintained by the second computer system.

6. The non-transitory computer-readable storage medium of claim 1 , wherein the executable instructions further comprise instructions that, as a result of execution by the one or more processors, cause the computer system to transmit command to the second computer system to replicate the interaction.

7. The non-transitory computer-readable storage medium of claim 1 , wherein the executable instructions further comprise instructions that, as a result of execution by the one or more processors, cause the computer system to, as a result of determining that an error during simulation exists, further modifying the policy associated with the interaction prior to performing the interaction.

8. The non-transitory computer-readable storage medium of claim 1 wherein the executable instructions that cause the computer system to notify the first computer system of the interaction further include instructions that cause the computer system to include, in the notification, additional information indicating an approval rate for the interaction.

9. A computer-implemented method, comprising:
obtaining a request to interact with a policy, the request being formatted in accordance with a service associated with a second computer system;
providing a notification to a first computer system of the interaction, the notification including a description of the interaction based at least in part on a state of the policy prior to the interaction;
identifying a quorum of a set of entities that approves the interaction with the policy;
modifying the policy such that the interaction is simulated with the modified policy by using one or more computing resources to which access is controlled by the modified policy to determine whether an error exists while the interaction is simulated based at least in part on the approval of the quorum; and
performing the interaction based at least in part on an outcome of simulating the interaction.

10. The computer-implemented method of claim 9 , wherein the approval of the quorum includes an electronic signature attesting to an identity of an operator of the first computer system.

11. The computer-implemented method of claim 9 , further comprising: obtaining, from the second computer system, the state of the policy prior to the interaction.

12. The computer-implemented method of claim 11 , further comprising: generating a restore point based at least in part on the state of the policy prior to the interaction.

13. The computer-implemented method of claim 9 , wherein the state of the policy includes at least some encrypted data, wherein the encrypted data is encrypted using a cryptographic key maintained by the second computer system.

14. The computer-implemented method of claim 9 , further comprising: transmitting command to the second computer system to replicate the interaction.

15. The computer-implemented method of claim 9 , further comprising obtaining an error during simulation and further modifying the policy associated with the interaction prior to performing the interaction.

16. The computer-implemented method of claim 9 , further comprising additional information in the notification indicating an approval rate for the interaction.

17. A system, comprising:
memory to store instructions, as a result of being executed by one or more processors, cause the system to at least:
obtain a request to interact with a policy, the request being formatted in accordance with a service associated with a second computer system;
provide a notification to a first computer system of the interaction, the notification including a description of the interaction based at least in part on a state of the policy prior to the interaction;
detect a quorum of a set of entities that approves the interaction with the policy;
apply modifications to the policy and simulate the interaction with the modifications to the policy by at least performing one or more operations using one or more computing resources to determine whether an error exists during simulation based at least in part on information provided by the modifications to the policy and the approval of the quorum; and
perform the interaction based at least in part on an outcome of simulating the interaction.

18. The system of claim 17 , wherein the approval of the quorum includes an electronic signature attesting to an identity of an operator of the first computer system.

19. The system of claim 17 , further comprising: generate a restore point based at least in part on the state of the policy prior to the interaction.

20. The system of claim 17 , further comprising: as a result of identifying an error during simulation, modifying the policy associated with the interaction prior to performing the interaction.

Assignees

• Amazon Tech Inc
• Amazon Tech

Inventors

• Kruse William Frederick
• Sharifi Mehr Nima

Classifications

• G06Q10/10

  Office automation; Time management · CPC title

• G06F2201/00

  Indexing scheme relating to error detection, to error correction, and to monitoring · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F11/004

  Error avoidance (G06F11/07 and subgroups take precedence) · CPC title

• G06F11/1446

  Point-in-time backing up or restoration of persistent data · CPC title