Minimal trust debugging
A data anonymization service of an application development service is configure to protect sensitive data while providing data context in the reproduction of application events. Upon detection of an execution symptom within a production application, data required to reproduce the symptom is collected as input to an anonymizer to facilitate minimal-trust analysis of the symptom. The data may first be minimized to eliminate data elements not needed to reproduce the symptom, the data elements are identified that are essential to reproduce the symptom are determined to contain sensitive data according to client-provided rules. These identified elements are then transformed to anonymize the sensitive data while preserve reproducibility of the symptom. A modified data set including the transformed data elements may then be provided to an application development service for analysis.
1 . A system, comprising:
one or more processors; and
a memory storing program instructions that, when executed on the one or more processors, implement an anonymizer configured to receive, from a client, a data set comprising a plurality of data objects for an executable application comprising an execution symptom, and responsive to receiving the data set:
model, by an application modeler, the executable application to identify a confidential data object of the plurality of data objects according to one or more sensitivity rules provided by the client, wherein the execution symptom is reproducible by the application modeler according to the received data set, and wherein the execution symptom is irreproducible by the application modeler according to a subset of the received data set excluding the confidential data object;
apply an anonymizing transformation to the confidential data object to generate an anonymized data object according to the one or more transformation rules provided by the client;
replace the confidential data object with the anonymized data object in the data set to generate an anonymized data set, wherein the execution symptom is reproducible by simulation of the executable application according to the anonymized data set;
identify one or more data objects of the plurality of data objects, wherein the execution symptom is reproducible by simulation of the executable application according to a subset of the received data set excluding the one or more data objects;
remove the one or more data objects from the anonymized data set; and
export the anonymized data set on behalf of the client.
2 . The system of claim 1 , wherein the execution symptom is:
a processor exception detected during execution of the executable application when configured according to the data set; or
a performance condition detected during execution of the executable application when configured according to the data set.
3 . The system of claim 1 , wherein to export the anonymized data set on behalf of the client, the anonymizer is configured to provide the anonymized data set to:
an application debugger on behalf of the client;
an integrated development environment on behalf of the client; or
a code profiler for the executable application on behalf of the client.
4 . The system of claim 1 , wherein the anonymizer is provided by an anonymizing service of a provider network, and wherein the anonymized data set is exported to an application development service of the provider network, wherein the executable application is executed by the client of the application provider; wherein the application provider is another client of the application development service of the provider network, and wherein the sensitivity specification identifies confidential data of one or more users of the application of the application provider, the one or more users anonymized by the anonymizing transformation.
5 . A method, comprising:
receiving, from a client, a data set comprising a plurality of data objects for a system comprising a state, and responsive to receiving the data set:
modeling, by an application modeler, the executable application to identify a sensitive data object of the plurality of data objects according to a sensitivity specification provided by the client, wherein the state is reproducible by the modeling according to the received data set, and wherein the state is irreproducible by the modeling according to a subset of the received data set excluding the sensitive data object;
applying an anonymizing transformation to the sensitive data object to generate an anonymized data object according to the sensitivity specification provided by the client;
replacing the sensitive data object with the anonymized data object in the data set to generate an anonymized data set, wherein the state is reproducible by simulation of the system according to the anonymized data set; and
exporting the anonymized data set on behalf of the client.
6 . The method of claim 5 , further comprising performing, responsive to receiving the data set:
identifying one or more data objects of the plurality of data objects, wherein the modeler reproduces the state when configured to simulate the system according to a subset of the received data set excluding the one or more data objects; and
removing the one or more data objects from the anonymized data set.
7 . The method of claim 5 , wherein the system comprises an executable application, wherein the state of the system comprises an execution symptom of the executable application, and wherein the plurality of data objects individually comprise values of respective data objects within the executable application.
8 . The method of claim 7 , wherein the execution symptom is a processor exception detected during execution of the executable application when configured according to the data set.
9 . The method of claim 7 , wherein the execution symptom is an execution latency condition detected during execution of the executable application when configured according to the data set.
10 . The method of claim 7 , wherein exporting the anonymized data set on behalf of the client comprises providing the anonymized data set to an application debugger on behalf of the client.
11 . The method of claim 5 , wherein exporting the anonymized data set on behalf of the client comprises providing the anonymized data set to a code profiler for the executable application on behalf of the client.
12 . The method of claim 5 , wherein generating the anonymized data set is performed by an anonymizing service of a provider network, and wherein the anonymized data set is exported to an application development service of the provider network.
13 . The method of claim 5 , wherein the client is a client of an application provider, wherein the system comprises an application provided by the application provider and executed by the client; wherein the application provider is another client of the application development service of the provider network, and wherein the sensitivity specification identifies confidential data of one or more users of the application of the application provider, the one or more users anonymized by the anonymizing transformation.
14 . One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more computing devices cause the one or more computing devices to implement an anonymizer to perform:
receiving, from a client, a data set comprising a plurality of data objects for a production system comprising a state, and responsive to receiving the data set:
modeling, by an application modeler, the executable application to identify a confidential data object of the plurality of data objects according to a sensitivity specification provided by the client, wherein the state is reproducible by the modeling according to the received data set, and wherein the state is irreproducible by the modeling according to a subset of the received data set excluding the confidential data object;
applying an anonymizing transformation to the confidential data object to generate an anonymized data object according to the sensitivity specification provided by the client;
replacing the confidential data object with the anonymized data object in the data set to generate an anonymized data set, wherein the state is reproducible by simulation of the production system according to the anonymized data set; and
exporting the anonymized data set on behalf of the client.
15 . The one or more non-transitory computer-accessible storage media of claim 14 , the anonymizer further performing responsive to receiving the data set:
identifying one or more data objects of the plurality of data objects, wherein the development system reproduces the state when configured to simulate the production system according to a subset of the received data set excluding the one or more data objects; and
removing the one or more data objects from the anonymized data set.
16 . The one or more non-transitory computer-accessible storage media of claim 14 , wherein the production system comprises an executable application, wherein the state comprises an execution symptom of the executable application, and wherein the plurality of data objects individually comprise values of respective data objects within the executable application.
17 . The one or more non-transitory computer-accessible storage media of claim 14 , wherein the production system comprises an executable application, wherein exporting the anonymized data set on behalf of the client comprises providing the anonymized data set to an application debugger on behalf of the client.
18 . The one or more non-transitory computer-accessible storage media of claim 14 , wherein exporting the anonymized data set on behalf of the client comprises providing the anonymized data set to a code profiler for the executable application on behalf of the client.
19 . The one or more non-transitory computer-accessible storage media of claim 14 , wherein the anonymizer is an anonymizing service of a provider network, and wherein the anonymized data set is exported to an application development service of the provider network.
20 . The one or more non-transitory computer-accessible storage media of claim 14 , wherein the client is a client of an application provider, wherein the production system comprises an application provided by the application provider and executed by the client; wherein the application provider is another client of the application development service of the provider network, and wherein the sensitivity specification identifies confidential data of one or more users of the application of the application provider, the one or more users anonymized by the anonymizing transformation.