Delegated administrator with defined permission boundaries in a permission boundary policy attachment for web services and resources

Patent metadata

Field	Value
Publication number	US-11032287-B1
Application number	US-201816122192-A
Country	US
Kind code	B1
Filing date	Sep 5, 2018
Priority date	Jul 2, 2018
Publication date	Jun 8, 2021
Grant date	Jun 8, 2021

Abstract

A method and system for generating permissions policies and permission boundary policies are described. The system receives a first request from a central administrator to create a delegated administrator, the first request specifying with one or more access permissions. The system generates a permission boundary policy that specifies the one or more access permissions and a first permissions policy that grants permissions to the delegated administrator to at least one of create an IAM principal with the permission boundary policy or attach a second permissions policy to the IAM principal. An effective permission given to the IAM principal is an intersection of access permissions specified in the first permissions policy and the one or more access permissions in the permission boundary policy. The system attaches the first permissions policy and the permission boundary policy to the delegated administrator.

First claim

What is claimed is:

1. A method comprising:
receiving, by an identity and access management (IAM) service executed by one or more computing devices and manages access to web services and resources, a first request from a central administrator to create a delegated administrator, the first request specifying a permission boundary policy with one or more access permissions to allow and deny access to the web services and resources;
in response to the first request:
generating a permission boundary policy attachment that specifies the permission boundary policy;
generating a permissions policy attachment that grants permissions to the delegated administrator to create a new IAM user with the permission boundary policy attachment and that grants permissions to the delegated administrator to attach a permissions policy to the new IAM user, wherein an effective permission on the new IAM user is an intersection of access permissions specified in the permissions policy attachment and the one or more access permissions in the permission boundary policy attachment; and
attaching the permissions policy attachment and the permission boundary policy attachment to the delegated administrator;

receiving, by the IAM service, a second request from a IAM user created by the delegated administrator, the second request specifying at least one of an action or access to a web service or a resource;
determining, by the IAM service, that the action or access for the IAM user is within the intersection of access permissions specified in the permissions policy attachment and the one or more access permissions in the permission boundary policy attachment; and
allowing or denying the action or access in view of the determining.

2. The method of claim 1 , further comprising:
receiving, by the IAM service, a third request from the delegated administrator to create the IAM user with the permission boundary policy attachment; and
in response to the third request, creating the IAM user and attach the permissions boundary policy attachment to the IAM user.

3. A method comprising:
receiving, by an identity and access management (IAM) service executed by one or more computing devices and manages access to at least one of web services or resources, a first request from a central administrator to create a delegated administrator, the first request specifying with one or more access permissions;
generating a permission boundary policy that specifies the one or more access permissions;
generating a first permissions policy that grants permissions to the delegated administrator to at least one of create an IAM principal with the permission boundary policy or associate a second permissions policy to the IAM principal, wherein an effective permission given to the IAM principal is an intersection of access permissions specified in the first permissions policy and the one or more access permissions in the permission boundary policy;
associating the first permissions policy and the permission boundary policy to the delegated administrator;
receiving, by the IAM service, a second request from the delegated administrator to create a new IAM principal and associate the second permissions policy to the new IAM principal, wherein access permissions specified in the second permissions policy are different than the one or more access permissions specified in the permission boundary policy; and
in response to the second request, creating the new IAM principal and associate the second permissions policy to the new IAM principal, wherein an effective permission given to the new IAM principal is an intersection of the access permissions specified in the second permissions policy and the one or more access permissions specified in the permission boundary policy.

4. The method of claim 3 , further comprising:
receiving, by the IAM service, a third request from the delegated administrator to create a new IAM principal with the permission boundary policy; and
in response to the third request, creating the new IAM principal with the permission boundary policy.

5. The method of claim 3 ,
wherein the access permissions specified in the second permissions policy are greater than the one or more access permissions specified in the permission boundary policy.

6. The method of claim 3 , wherein the IAM principal is at least one of an IAM user, an IAM role, or a group of IAM users.

7. The method of claim 3 , wherein the first permissions policy grants permissions to the delegated administrator to create a new IAM user or a new IAM role for the IAM principal and at least one of associate a user policy to the new IAM user, detach a user policy from an existing IAM user, associate a role policy to the new IAM role, or detach a role policy from an existing IAM role.

8. The method of claim 3 , further comprising setting a flag for the IAM principal, the flag indicating that the permission boundary policy is associated with the IAM principal.

9. The method of claim 3 , further comprising:
receiving, by the IAM service, a third request from the delegated administrator to associate an administrator access policy to an existing IAM user; and
in response to the third request, associate the administrator access policy to the existing IAM user, wherein an effective permission given to the existing IAM user is limited to the one or more access permissions specified in the permission boundary policy.

10. The method of claim 3 , further comprising:
receiving, by the IAM service, a third request to create a second delegated administrator, the third request specifying a second set of one or more access permissions that are less than the one or more access permissions in the permission boundary policy; and
in response to the third request:
generating a second permission boundary policy; and
sending a fourth request to the central administrator to update the permissions to the delegated administrator to use the second permission boundary policy.

11. The method of claim 10 , further comprising:
receiving, by the IAM service, a fifth request from the central administrator to update the permissions to the delegated administrator in the first permission policy to use the second permission boundary policy; and
in response to the fifth request, update the permissions to the delegated administrator in the first permission policy to use the second permission boundary policy.

12. The method of claim 11 , further comprising:
receiving, by the IAM service, a sixth request from the second delegated administrator to create a second new IAM principal with the second permission boundary policy and associate a third permissions policy to the second new IAM principal; and
in response to the sixth request, create the second new IAM principal and associate the third permissions policy to the second new IAM principal, wherein an effective permission given to the second new IAM principal is an intersection of the access permissions specified in the third permissions policy and the access permissions specified in the second permission boundary policy.

13. The method of claim 11 , further comprising:
receiving, by the IAM service, a sixth request from the delegated administrator to modify the second permission boundary policy for the second delegated administrator;
in response to the sixth request, send a seventh request to the central administrator to modify the second permission boundary policy for the second delegated administrator;
receiving, by the IAM service, a eighth request from the central administrator to modify the second permission boundary policy for the second delegated administrator; and
in response to the

Assignees

• Amazon Tech Inc

Inventors

• Wang Mingkun
• Chhabra Jasmeet
• Li Hang
• Yin Chenguang
• Popick Dan
• Acheson Alazel
• Awasthi Apurv
• Johnson Brigid Ann
• Cahill Conor P

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title