Enforceable launch configurations

Patent metadata

Field	Value
Publication number	US-9614873-B1
Application number	US-201514683460-A
Country	US
Kind code	B1
Filing date	Apr 10, 2015
Priority date	Dec 28, 2010
Publication date	Apr 4, 2017
Grant date	Apr 4, 2017

Abstract

Users intending to launch instances or otherwise access virtual resources in a multi-tenant environment can specify a launch configuration. For each type of instance or each type of user, at least one launch configuration is created that includes parameters and values to be used in instantiating an instance of that type, the values being optimized for the current environment and type of instance. Launch configurations can be optimized for different types of users, such as to account for security credentials and access levels. Such an approach enables users to launch instances by contacting the resource provider directly without need for a proxy, which can function as a choke point under heavy load. The use of an appropriate launch configuration can be enforced for any type of user at any level, such as at the sub-net level, by modifying a request that does not specify an appropriate launch configuration.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, by a computer system from a computing device of a user, a request to launch a virtual instance, the request identifying a launch configuration for the virtual instance available from a data store;
accessing, by the computer system, the launch configuration from the data store based at least in part on the request;
determining, by the computer system, values defined by the launch configuration for parameters of the virtual instance, the values determined based at least in part on the launch configuration being accessed;
determining, by the computer system, whether a launch of the virtual instance according to the values of the launch configuration is authorized for the user; and
launching, by the computer system, the virtual instance based at least in part on whether the launch according to the values is authorized.

2. The computer-implemented method of claim 1 , wherein the launch configuration encapsulates the values for the parameters of the virtual instance.

3. The computer-implemented method of claim 1 , wherein the virtual instance is associated with an instance type, and wherein at least a portion of the values is defined by the launch configuration based at least in part on the instance type and a target environment for hosting the virtual instance.

4. The computer-implemented method of claim 1 , wherein the virtual instance is associated with an instance type, and further comprising:
determining that the launch configuration identified in the request is designated for the instance type; and
using at least a portion of the values defined by the launch configuration to launch the virtual instance based at least in part on the launch configuration being designated for the instance type.

5. The computer-implemented method of claim 1 , wherein the virtual instance is associated with an instance type, wherein determining whether the launch is authorized comprises determining that the launch configuration identified in the request is designated for a different instance type, and further comprising:
performing a remedial action to launch the virtual instance based at least in part on the launch configuration being designated for the different instance type.

6. The computer-implemented method of claim 5 , wherein the remedial action comprises prompting a submission of another request identifying a different launch configuration designated for the instance type.

7. The computer-implemented method of claim 5 , wherein the remedial action comprises augmenting or replacing one or more of the values to correspond to appropriate values of the instance type.

8. The computer-implemented method of claim 7 , wherein the remedial action further comprises notifying a requester of the virtual instance in association with augmenting or replacing the one or more of the values.

9. One or more non-transitory computer-readable media comprising instructions that, upon execution with one or more processors, cause a system to perform operations comprising:
receiving a request for a computing resource to be hosted on a network, the request associated with a user and identifying a configuration for the computing resource, the configuration available from a network location associated with the network;
accessing the configuration from the network location based at least in part on the request;
determining values defined by the configuration for parameters of the computing resource, the values determined based at least in part on the configuration being accessed from the network location;
determining whether to host the computing resource according to the values of the configuration is authorized for the user; and
hosting the computing resource on the network based at least in part on the determining of whether to host the computing resource according to the values is authorized.

10. The one or more non-transitory computer-readable media of claim 9 , wherein the request for the computing resource comprises information associated with at least one of: launching a volume, accessing a network resource, or instantiating a virtual instance.

11. The one or more non-transitory computer-readable media of claim 9 , wherein the request further specifies a type of the computing resource, and wherein determining whether to host the computing resource comprises:
determining whether the configuration is designated for the type of the computing resource;
using the values defined by the configuration if the configuration is determined to be designated for the type of the computing resource; and
performing a remedial action if the configuration is determined to be designated for a different type of the computing resource, the remedial action comprising modifying at least a portion of the values.

12. The one or more non-transitory computer-readable media of claim 11 , wherein the portion of the values is modified based at least in part on one or more of: a user type, a usage type, or an application type associated with the computing resource being hosted on the network.

13. The one or more non-transitory computer-readable media of claim 9 , wherein the configuration is designated for a user type.

14. The one or more non-transitory computer-readable media of claim 13 , wherein the instructions, upon execution with the one or more processors, cause the system to perform further operations comprising:
determining a type of the user based at least in part on the request;
determining whether the configuration is available for the type of the user based at least in part on the user type to which the configuration is designated;
using the values defined by the configuration if the configuration is determined to be available for the type of the user; and
performing a remedial action if the configuration is determined to be unavailable for the type of the user, the remedial action comprising modifying at least a portion of the values.

15. The one or more non-transitory computer-readable media of claim 14 , wherein the configuration is determined to be available based at least in part on access rights or security privileges of the user.

16. The one or more non-transitory computer-readable media of claim 14 , wherein the computing resource is associated with a resource type, wherein the portion of the values is modified based at least in part on one or more rules, and wherein the one or more rules define modifications to the values based at least in part on a combination of the resource type and the type of the user.

17. A system comprising:
one or more processors; and
one or more memories comprising computer-readable instructions that, upon execution with the one or more processors, cause the system to at least:
receive a request for a virtual instance to be hosted in an environment, the request associated with a user and identifying a launch configuration of the virtual instance, the launch configuration available from storage associated with the environment;
access the launch configuration from the storage based at least in part on the request;
determine values defined by the launch configuration for parameters of the virtual instance, the values determined based at least in part on the launch configuration being accessed;
determine whether a launch of the virtual instance according to the values of the launch configuration is authorized for the user; and
launch the virtual instance in the environment based at least in part on whether the launch according to the values is authorized.

18. The system of

Assignees

• Amazon Tech Inc

Inventors

• Theimer Marvin M
• Brandwine Eric Jason
• Brooker Marc J
• Brown David Everard
• Jacques De Kadt Christopher Richard

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F9/44505 Primary

  Configuring for program initiating, e.g. using registry, configuration files · CPC title

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title