Delegated authorization for consumers of shared databases

Patent metadata

Field	Value
Publication number	US-12417305-B1
Application number	US-202117548283-A
Country	US
Kind code	B1
Filing date	Dec 10, 2021
Priority date	Dec 10, 2021
Publication date	Sep 16, 2025
Grant date	Sep 16, 2025

Abstract

A system for delegation of authorization management of a shared database of a database service is described. The database service includes a control plane and a producer database engine. The producer database engine receives a creation request to create a datashare for a database. The creation request delegates, to a data exchange service, authorization management to access the datashare. The control plane is configured to update permission data for the datashare to indicate that authorization to the datashare is managed by the data exchange service. The producer database engine is further configured to receive a request, from a consumer database engine, to obtain metadata used to perform a query to the database of the datashare, determine that the data exchange service authorized the consumer database engine to access the datashare based on the permission data for the datashare, and return the metadata to the consumer database engine.

First claim

What is claimed is:

1. A system, comprising:
a plurality of computing devices, respectively comprising at least one processor and a memory, that implement a database service of a cloud service provider that hosts databases created via an interface of the database service;
wherein the database service comprises a control plane and a producer database engine;
wherein the producer database engine is configured to:
receive a creation request to create a datashare for a database managed by the producer database engine, wherein the creation request delegates, to a data exchange service separate from the database service, authorization management to access the datashare;

wherein the control plane is configured to:
update permission data for the datashare to indicate that authorization to the datashare is managed by the data exchange service, wherein the permission data is accessible to the data exchange service to authorize consumer database engines to access the datashare;

wherein data of the database is stored in a storage service, separate from the database service, that is accessible to both the producer database engine and the consumer database engines to perform queries to the database;
wherein the producer database engine is further configured to:
receive a request, from a consumer database engine, to obtain metadata comprising a schema of the database that includes information used to generate a plan to perform a query to the database of the datashare;
determine that the data exchange service authorized the consumer database engine to access the datashare based on the permission data for the datashare; and
responsive to the determination that the data exchange service authorized the consumer database engine to access the datashare, return the metadata to the consumer database engine for the consumer database engine to generate the plan to perform the query to the database.

2. The system of claim 1 , wherein the control plane is further configured to:
receive, from the data exchange service, consumer change information indicating a change in the consumer database engines authorized to access the data share; and
update the permission data for the datashare according to the consumer change information.

3. The system of claim 1 , wherein the control plane is further configured to:
send, to the data exchange service, further metadata for the datashare indicating that the datashare is accessible by the consumer database engines in accordance with the data exchange service.

4. The system of claim 1 , wherein the producer database engine is configured to:
attempt to cause one or more changes to the datashare; and
wherein the database service is further configured to:
receive a change notification indicating the attempt of the one or more changes to the datashare; and
request, from the producer database engine, a confirmation to apply the one or more changes to the datashare.

5. The system of claim 4 , wherein the database service is configured to:
receive the confirmation from the producer database engine;
responsive to the confirmation,
apply the one or more changes to the datashare; and
update further metadata for the datashare based on the one or more changes to the datashare.

6. A method, comprising:
creating, by a producer database engine of a database service that hosts databases created via an interface of the database service, a datashare for a database managed by the producer database, wherein the creation delegates authorization management to access the datashare to a datashare authentication manager separate from the database service;
receiving a request, from a consumer database engine at the producer database engine, to obtain metadata comprising a schema of the database that includes information used to generate a plan to perform a query to the database of the datashare;
wherein data of the database is stored in a storage service, separate from the database service, that is accessible to both the producer database engine and the consumer database engines to perform queries to the database; and
responsive to determining that the datashare authentication manager authorized the consumer database engine to access the datashare according to permission data for the datashare that is accessible to the data exchange service, returning the metadata to the consumer database engine for the consumer database engine to generate the plan to perform the query to the database in response to the request.

7. The method of claim 6 , further comprising:
receiving, from the datashare authentication manager, consumer change information indicating a change in the consumer database engines authorized to access the datashare; and
updating the permission data for the datashare according to the consumer change information.

8. The method of claim 7 , wherein the change in the consumer database engines comprises:
adding or removing a consumer database engine from the consumer database engines authorized to access the datashare.

9. The method of claim 6 , further comprising:
sending, to the datashare authentication manager, further metadata for the datashare indicating that the datashare is accessible by the consumer database engines in accordance with the datashare authentication manager.

10. The method of claim 6 , further comprising:
receiving a change notification indicating an attempt of one or more changes to the datashare; and
requesting a confirmation to apply the one or more changes to the datashare.

11. The method of claim 10 , further comprising:
receiving the confirmation from the producer database engine;
responsive to the confirmation,
applying the one or more changes to the datashare; and
updating further metadata for the datashare based on the one or more changes to the datashare.

12. The method of claim 10 , wherein the one or more changes to the datashare comprise a destructive operation to the datashare, and wherein the confirmation is requested in response to determining that the one or more changes comprise the destructive operation.

13. The method of claim 6 , further comprising:
logging access to the datashare by the consumer database engine as being associated with the datashare authentication manager.

14. One or more computer-readable storage media storing instructions that, when executed on or across one or more processors, cause the one or more processors to:
create, by a producer database engine of a database service that hosts databases created via an interface of the database service, a datashare for a database managed by the producer database, wherein the creation delegates authorization management to access the datashare to a data exchange service separate from the database service;
responsive to a request, from a consumer database engine at the producer database engine, to obtain metadata comprising a schema of the database that includes information used to generate a plan to perform a query to the database of the datashare, determine whether the data exchange service authorized the consumer database engine to access the datashare according to permission data for the datashare that is accessible to the data exchange service;
wherein data of the database is stored in a storage service, separate from the database service, that is accessible to both the producer database engine and the consumer database engines to perform queries to the database; and
responsive to a determination that the data exchange service authorized the consumer database engine, return the metadata to the consumer database engine for the consumer database engine to generate the plan to perform

Assignees

• Amazon Tech Inc

Inventors

• Ponomarenko Vladimir
• Qing Jingyi
• Hotinger Eric Ray
• Mccreedy William Michael
• Pandis Ippokratis
• Sokolov Pavel
• Li Mengyang
• Song Weihang
• Ramamoorthy Vivek
• Rentachintala Neeraja
• Rahman Mohammad Foyzur

Classifications

• G06F21/6227

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• G06F16/245

  Query processing · CPC title

• G06F16/2358

  Change logging, detection, and notification (replication G06F16/27) · CPC title

• G06F16/252

  between a Database Management System and a front-end application · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title