Policy approval layer

Patent metadata

Field	Value
Publication number	US-11588855-B2
Application number	US-202016810331-A
Country	US
Kind code	B2
Filing date	Mar 5, 2020
Priority date	Sep 22, 2014
Publication date	Feb 21, 2023
Grant date	Feb 21, 2023

Abstract

A customer of a policy management service may use an interface with a configuration and management service to interact with policies that may be applicable to the customer's one or more resources. The customer may create and/or modify the policies and the configuration and management service may notify one or more other entities of the created and/or modified policies. The one or more other entities may be operated by user authorized to approve the created and/or modified policies. Interactions with the configuration and management service may be the same as the interactions with the policy management service.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
obtaining a request to modify a policy, wherein the request comprises a modification to a current state of the policy and further comprises a description of the modification to the current state of the policy;
obtaining a first number of approvals from a second number of entities of a set of entities authorized to approve modifications to the policy, wherein the first number of approvals is obtained as a result of at least one notification and wherein the policy and the description are included in the at least one notification that is provided to the second number of entities of the set of entities for approval; and
transmitting an instruction to a policy management service to process the request as a result of obtaining the first number of approvals to implement the modified policy.

2. The computer-implemented method of claim 1 , wherein transmitting the instruction to the policy management service is contingent on obtaining the first number of approvals from the second number of entities authorized to approve modifications to the policy, wherein the first number is less than the second number.

3. The computer-implemented method of claim 1 , wherein the set of entities authorized to approve modifications to the policy is different from a second entity responsible for the modification to the policy.

4. The computer-implemented method of claim 1 , wherein each approval of the first number of approvals is obtained from a different entity of the set of entities.

5. The computer-implemented method of claim 1 , wherein the description comprises a set of application programming interface calls to modify the policy.

6. A system, comprising:
one or more processors; and
memory with instructions that, as a result of being executed by the one or more processors, cause the system to:
in response to a request to modify a policy, determine, from the request, a description indicating a modification to a current state of the policy;
obtain a first number of approvals from a second number of entities of a set of entities authorized to approve modifications to the policy, wherein the first number of approvals is obtained as a result of at least one notification and wherein the policy and the description are included in the at least one notification that is provided to the second number of entities of the set of entities for approval; and
transmit an instruction to a policy management service to process the request as a result of obtaining the first number of approvals to implement the modified policy.

7. The system of claim 6 , wherein the memory further includes instructions that, as a result of being executed by the one or more processors, cause the system to store, in a repository, a current state of the policy prior to the modification to the policy.

8. The system of claim 6 , wherein transmitting the instruction to the policy management service is contingent on obtaining the first number of approvals from the second number of entities authorized to approve modifications to the policy, wherein the first number is less than the second number.

9. The system of claim 6 , wherein the instruction is an application programming interface call configured to cause a policy management service to enforce the modification.

10. The system of claim 9 , wherein the memory further includes instructions that, when executed by the one or more processors, cause the system to serialize the modification into a structured format suitable for enforcement by the policy management service.

11. The system of claim 6 , wherein the memory further includes instructions that, as a result of being executed by the one or more processors, cause the system to obtain, from the second number of entities of a set of entities, feedback information corresponding to the modification.

12. The system of claim 11 , wherein the feedback information further comprises an approval, the approval contingent upon a successful simulation of the policy including the modification; and
wherein the approval is one of a plurality of approvals.

13. A non-transitory computer-readable storage medium comprising instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:
determine a description to modify a policy from a request, the description determined based at least in part on a modification to a current state of the policy indicated in the request;
obtain a first number of approvals from a second number of entities of a set of entities authorized to approve modifications to the policy, wherein the first number of approvals is obtained as a result of at least one notification and wherein the policy and the description are included in the at least one notification that is provided to the second number of entities of the set of entities for approval; and
instruct a policy management service to process the request as a result of obtaining the first number of approvals to implement the modified policy.

14. The non-transitory computer-readable storage medium of claim 13 , wherein transmitting the instruction to the policy management service is contingent on obtaining the first number of approvals from the second number of entities authorized to approve modifications to the policy, wherein the first number is less than the second number.

15. The non-transitory computer-readable storage medium of claim 13 , wherein the set of entities authorized to approve modifications to the policy is different from a second entity responsible for the modification to the policy.

16. The non-transitory computer-readable storage medium of claim 13 , wherein each approval of the first number of approvals is obtained from a different entity of the set of entities.

17. The non-transitory computer-readable storage medium of claim 13 , wherein the description comprises a set of application programming interface calls to modify the policy.

18. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, as a result of execution by the one or more processors, cause the computer system to obtain, from the second number of entities of a set of entities, feedback information corresponding to the modification.

Assignees

• Amazon Tech Inc

Inventors

• Kruse William Frederick
• Sharifi Mehr Nima

Classifications

• G06F2201/00

  Indexing scheme relating to error detection, to error correction, and to monitoring · CPC title

• G06F11/004

  Error avoidance (G06F11/07 and subgroups take precedence) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F11/1446

  Point-in-time backing up or restoration of persistent data · CPC title

• G06Q10/10

  Office automation; Time management · CPC title