User-configurable request-based policies for a data storage system

Patent metadata

Field	Value
Publication number	US-12204668-B1
Application number	US-202117393813-A
Country	US
Kind code	B1
Filing date	Aug 4, 2021
Priority date	Aug 4, 2021
Publication date	Jan 21, 2025
Grant date	Jan 21, 2025

Abstract

Techniques are described for enabling users to create and configure request-based policies used by a data storage system to generate custom responses to particular types of requests for users' stored data objects. The request-based policies include rules used to identify types of requests for data objects and corresponding types of responses to be generated responsive to detecting such requests. The types of responses that can be specified in such policies include responses other than simply returning a requested data object or denying a request. For example, a rule for certain types of responses can instruct the data storage system to return a dynamically generated data object, another rule can instruct the system to return a different data object than the one requested, and so forth.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, by a data storage system, a request to create a request-based policy that is to control how the data storage system is to respond to requests involving a logical storage container managed by the data storage system based on a type of the requests, wherein the request-based policy identifies a type of request to which the request-based policy is to be applied and further identifies a type of response that the data storage system is to generate responsive to identification of a request involving the logical storage container and matching the type of request;
receiving a request originated by a client seeking to retrieve a data object of the logical storage container;
determining that the request-based policy applies to the request based on determining that a type of the request matches the type of request to which the request-based policy is to be applied;
generating a response matching the type of response specified by the request-based policy, wherein the response includes a data object that is different than the requested data object; and
transmitting the response to the client, where the response includes the data object that is different than the requested data object.

2. The computer-implemented method of claim 1 , wherein the data storage system is a data storage service of a cloud provider, wherein the request is a request to retrieve a robots exclusion standards file from the logical storage container, and wherein:
generating the response comprises generating the robots exclusion standard file, wherein the robots exclusion standard file includes at least one indexing rule; and
the generated robots exclusion standard file is returned as the data object that is part of the response.

3. The computer-implemented method of claim 1 , wherein the data storage system is a data storage service of a cloud provider, wherein the request to create the request-based policy includes a request to apply the request-based policy to a plurality of user accounts of the cloud provider, wherein the logical storage container is associated with at least one of the plurality of user accounts.

4. The computer-implemented method of claim 1 , further comprising generating, based on the request-based policy, the data object that is different than the requested data object, wherein the data object is generated responsive to receiving the request for the data object.

5. The computer-implemented method of claim 1 , wherein the data object that is different than the requested data object is obtained from the logical storage container that is different from the logical storage container identified in the request.

6. The computer-implemented method of claim 1 , wherein the data storage system is provided by a data storage service of a cloud provider, wherein the data object is assigned a Uniform Resource Locator (URL) by the data storage service, and wherein the request includes the URL.

7. The computer-implemented method of claim 1 , wherein the data storage system is a data storage service provided by a cloud provider, and wherein an identity and access management service of the cloud provider determines that the request matches the type of request to which the request-based policy is to be applied and generates the response.

8. The computer-implemented method of claim 1 , wherein determining that the request matches the type of request to which the request-based policy is to be applied includes analyzing at least one of:
whether the request is authenticated by a cloud provider providing the data storage system,
a user agent specified in the request,
an Internet Protocol (IP) address identifying a source of the request, or
a signature generated based on attributes of the request.

9. The computer-implemented method of claim 1 , wherein the data object is further associated with a resource-based policy, and wherein the resource-based policy indicates a set of users that can access the data object and a set of actions that the set of users can perform on the data object.

10. The computer-implemented method of claim 1 , wherein generating the response matching the type of response specified by the request-based policy includes causing an on-demand code execution service of a cloud provider to execute a function identified by the request-based policy, wherein the function generates at least a portion of the data included in the response.

11. The computer-implemented method of claim 1 , further comprising:
receiving a request to list the contents of the logical storage container containing the data object; and
generating, based on the request-based policy, a list of data objects that does not match the actual contents of the logical storage container, wherein the data object that is returned comprises the generated list of data objects.

12. A system comprising:
a first one or more electronic devices to implement data storage system in a cloud provider network; and
a second one or more electronic devices to implement a data storage service in the cloud provider network, the data storage service including instructions that upon execution cause the data storage service to:
receive a request to create a request-based policy that is to control how the data storage service is to respond to requests involving a logical storage container managed by the data storage system based on a type of the requests, wherein the request-based policy identifies a type of request to which a rule is to be applied and further identifies a type of response to generate responsive to identification of a request involving the logical storage container and matching the type of request;
receive a request originated by a client seeking to retrieve a data object of the logical storage container;
determine that the request-based policy applies to the request based on determining that a type of the request matches the type of request to which the request-based policy is to be applied;
generate a response matching the type of response specified by the request-based policy, wherein the response does not include a data object that is different than the requested data object; and
transmit the response to the client, where the response includes the data object that is different than the requested data object.

13. The system of claim 12 , wherein the request is a request to retrieve a robots exclusion standards file from the logical storage container, and wherein:
to generate the response, the data storage service is to generate the robots exclusion standard file, wherein the robots exclusion standard file includes at least one indexing rule; and
the robots exclusion standard file is returned as the data object as part of the response.

14. The system of claim 12 , wherein the data storage system is a data storage service of a cloud provider, wherein the request to create the request-based policy includes a request to apply the request-based policy to a plurality of user accounts of the cloud provider, wherein the logical storage container is associated with at least a user account of the plurality of user accounts, and wherein the data storage service further includes instructions that upon execution cause the data storage service to determine that the data object is associated with the user account of the plurality of user accounts.

15. The system of claim 12 , wherein the instructions upon execution further cause the data storage service to generate, based on the request-based policy, the data object that is different than the requested data object, wherein the data object is generated respon

Assignees

• Amazon Tech Inc

Inventors

• Brandwine Eric Jason
• Weiss Rebecca Claire
• Warfield Andrew Kent

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title