Identifying failed statement reason in policy checks
An access management policy and security information indicative of one or more security constraints may be received, by a service, from an entity, such as a customer. The access management policy and the security information may be received in association with a request for the service to perform a policy validation check for validating the policy. The service may perform a permissions comparison that compares a permissiveness of the access management policy to the one or more security constraints to generate a permissions comparison result. The service may generate, based on the permissions comparison result, a binary policy validation check result that may be indicative of either passing or failing the policy validation check. When the access management policy fails the policy validation check, the service may determine a given allow statement within the access management policy that caused the access management policy to fail the policy validation check.
1 . A computing system comprising:
one or more processors; and
one or more memories having stored therein instructions that, upon execution by the one or more processors, cause the computing system to perform operations comprising:
receiving, by an access management service, from a customer of the access management service, a proposed access management policy and security information indicative of one or more security constraints, wherein the proposed access management policy and the security information are received in association with a customer request for the access management service to perform a policy validation check for validating the proposed access management policy based on the security information;
performing, by the access management service, a first permissions comparison that compares a permissiveness of the proposed access management policy to the one or more security constraints to generate a first permissions comparison result wherein performing the first permissions comparison comprises translating the proposed access management policy and the one or more security constraints into corresponding logical statements and evaluating the logical statements with a reasoning engine;
determining, by the access management service, based on the first permissions comparison result, that the proposed access management policy fails the policy validation check, wherein an allow statement set includes all allow statements in the proposed access management policy, and wherein a deny statement set includes all deny statements in the proposed access management policy;
determining, by the access management service, a failing allow statement of the allow statement set that caused the proposed access management policy to fail the policy validation check, wherein the determining of the failing allow statement is performed based at least in part on one or more modified access management policies each including the deny statement set and only a respective allow statement subset of the allow statement set and re-executing the first permissions comparison for each of the one or more modified access management policies; and
providing, by the access management service, an indication of the failing allow statement to the customer.
2 . The computing system of claim 1 , wherein the determining of the failing allow statement comprises:
dividing the allow statement set into a plurality of allow statement subsets; and
performing at least one first additional permissions comparison for at least one of the plurality of allow statement subsets, wherein each of the at least one first additional permissions comparison compares a permissiveness of a respective modified access management policy of the one or more modified access management policies to the one or more security constraints to generate a respective additional permissions comparison result, wherein the respective modified access management policy includes the deny statement set and only the respective allow statement subset included in the plurality of allow statement subsets.
3 . The computing system of claim 2 , wherein the determining of the failing allow statement further comprises:
determining, based on the respective additional permissions comparison result for each of the at least one first additional permissions comparison, a failing allow statement subset of the plurality of allow statement subsets that includes the failing allow statement.
4 . The computing system of claim 3 , wherein the determining of the failing allow statement further comprises:
when the failing allow statement subset has only one allow statement, selecting the only one allow statement as the failing allow statement; and
when the failing allow statement subset has more than one allow statement, subdividing the failing allow statement subset one or more times and performing at least one second additional permissions comparison for the deny statement set and a respective allow statement subset of a respective subdivision until a single allow statement is identified that causes failure of the policy validation check and selecting the single allow statement as the failing allow statement.
5 . A computer-implemented method comprising:
receiving, by an access management service, from an entity, a proposed access management policy and security information indicative of one or more security constraints, wherein the proposed access management policy and the security information are received in association with a request for the access management service to perform a policy validation check for validating the proposed access management policy based on the security information;
performing, by the access management service, a first permissions comparison that compares a permissiveness of the proposed access management policy to the one or more security constraints to generate a first permissions comparison result wherein performing the first permissions comparison comprises translating the proposed access management policy and the one or more security constraints into corresponding logical statements and evaluating the logical statements with a reasoning engine;
determining, by the access management service, based on the first permissions comparison result, that the proposed access management policy fails the policy validation check, wherein an allow statement set includes all allow statements in the proposed access management policy, and wherein a deny statement set includes all deny statements in the proposed access management policy;
determining, by the access management service, a failing allow statement of the allow statement set that caused the proposed access management policy to fail the policy validation check, wherein the determining of the failing allow statement is performed based at least in part on one or more modified access management policies each including the deny statement set and only a respective allow statement subset of the allow statement set and re-executing the first permissions comparison for each of the one or more modified access management policies; and
providing, by the access management service, an indication of the failing allow statement to the entity.
6 . The computer-implemented method of claim 5 , wherein the determining of the failing allow statement comprises:
dividing the allow statement set into a plurality of allow statement subsets; and
performing at least one first additional permissions comparison for at least one of the plurality of allow statement subsets, wherein each of the at least one first additional permissions comparison compares a permissiveness of a respective modified access management policy of the one or more modified access management policies to the one or more security constraints to generate a respective additional permissions comparison result, wherein the respective modified access management policy includes the deny statement set and only the respective allow statement subset included in the plurality of allow statement subsets.
7 . The computer-implemented method of claim 6 , wherein the determining of the failing allow statement comprises further comprises:
determining, based on the respective additional permissions comparison result for each of the at least one first additional permissions comparison, a failing allow statement subset of the plurality of allow statement subsets that includes the failing allow statement.
8 . The computer-implemented method of claim 7 , wherein the determining of the failing allow statement further comprises:
when the failing allow statement subset has only one allow statement, selecting the only one allow statement as the failing allow statement; and
when the failing allow statement subset has more than one allow statement, subdividing the failing allow statement subset one or more times and performing at least one second additional permissions comparison for the deny statement set and a respective allow statement subset of a respective subdivision until a single allow statement is identified that causes failure of the policy validation check and selecting the single allow statement as the failing allow statement.
9 . The computer-implemented method of claim 5 , wherein the entity is a customer of the access management service.
10 . The computer-implemented method of claim 6 , wherein the allow statement set is evenly divided into the plurality of allow statement subsets.
11 . The computer-implemented method of claim 6 , wherein the plurality of allow statement subsets includes only two subsets.
12 . The computer-implemented method of claim 6 , wherein the at least one first additional permissions comparison includes two or more first additional permissions comparisons that are performed at least partially concurrently with each other.
13 . One or more non-transitory computer-readable storage media having stored thereon computing instructions that, upon execution by one or more computing devices, cause the one or more computing devices to perform operations comprising:
receiving, by an access management service, from an entity, a proposed access management policy and security information indicative of one or more security constraints, wherein the proposed access management policy and the security information are received in association with a request for the access management service to perform a policy validation check for validating the proposed access management policy based on the security information;
performing, by the access management service, a first permissions comparison that compares a permissiveness of the proposed access management policy to the one or more security constraints to generate a first permissions comparison result wherein performing the first permissions comparison comprises translating the proposed access management policy and the one or more security constraints into corresponding logical statements and evaluating the logical statements with a reasoning engine;
determining, by the access management service, based on the first permissions comparison result, that the proposed access management policy fails the policy validation check, wherein an allow statement set includes all allow statements in the proposed access management policy, and wherein a deny statement set includes all deny statements in the proposed access management policy;
determining, by the access management service, a failing allow statement of the an allow statement set that caused the proposed access management policy to fail the policy validation check, wherein the determining of the failing allow statement is performed based at least in part on one or more modified access management policies each including the deny statement set and only a respective allow statement subset of the allow statement set and re-executing the first permissions comparison for each of the one or more modified access management policies; and
providing, by the access management service, an indication of the failing allow statement to the entity.
14 . The one or more non-transitory computer-readable storage media of claim 13 , wherein the determining of the failing allow statement comprises:
dividing the allow statement set into a plurality of allow statement subsets; and
performing at least one first additional permissions comparison for at least one of the plurality of allow statement subsets, wherein each of the at least one first additional permissions comparison compares a permissiveness of a respective modified access management policy of the one or more modified access management policies to the one or more security constraints to generate a respective additional permissions comparison result, wherein the respective modified access management policy includes the deny statement set and only the respective allow statement subset included in the plurality of allow statement subsets.
15 . The one or more non-transitory computer-readable storage media of claim 14 , wherein the determining of the failing allow statement comprises further comprises:
determining, based on the respective additional permissions comparison result for each of the at least one first additional permissions comparison, a failing allow statement subset of the plurality of allow statement subsets that includes the failing allow statement.
16 . The one or more non-transitory computer-readable storage media of claim 15 , wherein the determining of the failing allow statement further comprises:
when the failing allow statement subset has only one allow statement, selecting the only one allow statement as the failing allow statement; and
when the failing allow statement subset has more than one allow statement, subdividing the failing allow statement subset one or more times and performing at least one second additional permissions comparison for the deny statement set and a respective allow statement subset of a respective subdivision until a single allow statement is identified that causes failure of the policy validation check and selecting the single allow statement as the failing allow statement.
17 . The one or more non-transitory computer-readable storage media of claim 14 , wherein the entity is a customer of the access management service.
18 . The one or more non-transitory computer-readable storage media of claim 14 , wherein the allow statement set is evenly divided into the plurality of allow statement subsets.
19 . The one or more non-transitory computer-readable storage media of claim 14 , wherein the plurality of allow statement subsets includes only two subsets.
20 . The one or more non-transitory computer-readable storage media of claim 14 , wherein the at least one first additional permissions comparison includes two or more first additional permissions comparisons that are performed at least partially concurrently with each other.