Approaches for deployment approval

Patent metadata

Field	Value
Publication number	US-9438599-B1
Application number	US-201414231109-A
Country	US
Kind code	B1
Filing date	Mar 31, 2014
Priority date	Mar 31, 2014
Publication date	Sep 6, 2016
Grant date	Sep 6, 2016

Abstract

A deployment approval system receives, from a deployment tool, a deployment request for performing a deployment to a particular resource. The deployment approval system can identify at least one rule for approving or rejecting the deployment request based on one or more criteria. The deployment approval system can determine whether the deployment request satisfies the one or more criteria in the at least one rule to approve or reject the request. If the deployment request is approved, the deployment approval system sends an approval to the deployment tool to perform the deployment. The deployment tool can then perform the deployment and, once the deployment is complete, the deployment approval system can receive a confirmation of the deployment. The deployment approval system can then store data describing the deployment in an audit repository.

First claim

What is claimed is:

1. A system, comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the system to:
receive, through an application programming interface (API) and from a deployment tool, a first request for performing a first deployment to a particular resource and a second request for performing a second deployment to the particular resource, wherein each deployment includes a payload that is configured to mutate an aspect of the particular resource;
determine, based on the request, that both the first deployment request and the second deployment request are attempting to perform respective deployments on the particular resource;
identify at least one rule for approving or rejecting deployments that are directed to the particular resource, the at least one rule based at least in part upon a geographic region of the particular resource;
determine that the first deployment request satisfies the at least one rule based at least in part upon the geographic region of the particular resource;
send, to the deployment tool, an approval for performing the first deployment, the approval including a token usable to access the particular resource to perform the deployment, wherein access rights of the token are based on an entity associated with the deployment;
determine that the second deployment request does not satisfy the at least one rule; and
send, to the deployment tool, a denial for performing the second deployment, wherein, in response to the denial, the deployment tool is prevented from being able to perform the second deployment to the particular resource.

2. The system of claim 1 , wherein the instructions when executed further cause the system to:
receive, through a graphical user interface or an application programming interface (API), data describing the at least one rule for approving or rejecting deployments that are directed to the particular resource; and
store the at least one rule to a rules repository, the rules repository storing a plurality of rules.

3. The system of claim 1 , wherein the instructions when executed further cause the system to:
receive, through the application programming interface (API) and from the deployment tool, data describing a confirmation that the first deployment targeting the particular resource has completed successfully; and
store the data describing the confirmation in an audit repository, the audit repository storing audit information for a plurality of deployments.

4. The system of claim 1 , wherein the at least one rule includes criteria for approving the deployment request based on at least one of the following: the deployment occurring within an acceptable time frame, the deployment satisfying one or more dependency conditions, the deployment being requested by an authorized user, or the deployment satisfying one or more threshold system- or network-based metric thresholds.

5. A computer-implemented method, the method comprising:
receiving, through an application programming interface (API) and from a deployment tool, a deployment request for performing a deployment to a particular resource, wherein each deployment includes a payload that is configured to mutate an aspect of the particular resource;
identifying at least one rule for approving or rejecting the deployment request based on one or more criteria, the one or more criteria including a geographic region of the particular resource;
determining that the deployment request satisfies the one or more criteria in the at least one rule based at least in part upon the geographic region of the particular resource; and
sending, through the API to the deployment tool, an approval for performing the deployment, the approval including a set of credentials usable to access the particular resource to perform the deployment, wherein access rights of the set of credentials are based on an entity associated with the deployment.

6. The computer-implemented method of claim 5 , wherein the set of credentials i) authorizes the deployment tool to access the particular resource to perform the deployment or ii) authorizes a user operating the deployment tool to access the particular resource to perform the deployment.

7. The computer-implemented method of claim 5 , wherein the one or more criteria for approving or rejecting the deployment is based at least on one of the following: a name of the deployment tool requesting the deployment, a name or reference to the particular resource, a payload that is configured to mutate an aspect of the particular resource, a time period during which the deployment is to occur, a geographic region associated with the particular resource, a zone associated with the particular resource, or an access level of a deployment technician that is requesting the deployment.

8. The computer-implemented method of claim 5 , further comprising:
receiving, from the deployment tool, a second deployment request for performing a second deployment to the particular resource;
identifying a particular rule for approving or rejecting the second deployment;
determining an override for the particular rule that was received from an authorized entity; and
approving or rejecting the second deployment request without evaluating the particular rule.

9. The computer-implemented method of claim 5 , wherein the at least one rule includes instructions for restricting performing the deployment to one geographic region at a time, and wherein the particular resource is in a first geographic region, the method further comprising:
receiving, from the deployment tool, a second deployment request for performing the deployment to a second resource in a second geographic region;
identifying the at least one rule for approving or rejecting the deployment;
determining that the second deployment request to the second resource in the second geographic region does not satisfy the at least one rule; and
sending, to the deployment tool, data describing a denial for performing the second deployment to the second resource, wherein the data describing a denial includes information providing reasons for the denial including a description of the at least one rule that the second deployment request did not satisfy, and wherein, in response to the denial, the deployment tool is prevented from being able to perform the second deployment at least until the deployment to the particular resource is complete.

10. The computer-implemented method of claim 5 , wherein the at least one rule includes instructions for restricting the deployment to a particular time period, and wherein determining that the deployment request satisfies the one or more criteria in the at least one rule further comprises:
determining that the deployment is scheduled to occur within the particular time period; and
determining that the deployment satisfies the at least one rule.

11. The computer-implemented method of claim 5 , wherein the at least one rule includes instructions for approving the deployment based on at least one system- or network-based metric threshold, and wherein determining that the deployment request satisfies the one or more criteria in the at least one rule further comprises:
determining that a corresponding system- or network-based metric associated with the particular resource satisfies the at least one system- or network-based metric threshold; and
determining that the deployment satisfies the at least one rule.

12. The computer-implemented method of claim 5 , wherein the at least one rule includes instructions for approving the deployment based at least in part on a successful completion of a second deployment, an

Assignees

• Amazon Tech Inc

Inventors

• Yuhan John Sandeep
• Bauer Jean-Paul
• Brown David Everard

Classifications

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/0838

  using one-time-passwords · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title