Node and edge deduplication for a privilege graph
The technology disclosed herein reduces nodes and edges within a privilege graph that indicates access privileges for users to features of data environments. In a particular example, a method provides identifying two attribute nodes of a plurality of nodes in a privilege graph and determining that the two attribute nodes share the same one or more outbound edges. The method further provides combining the two attribute nodes into a combined node. The combined node represents attributes represented by the two attribute nodes. The method also provides tracing the privilege graph from a user through the combined node when determining which of the access privileges correspond to the user.
1 . A method for regulating access to computing resources using a graphing service, the method comprising:
in a computing system implementing the graphing service:
determining that two attribute nodes of a plurality of nodes in a privilege graph share the same one or more outbound edges within the privilege graph, wherein the privilege graph indicates access privileges for a plurality of users to features of a plurality of data environments;
generating a combined node;
assigning attributes represented by the two attribute nodes to the combined node; and
tracing the privilege graph from a user through the combined node when determining which of the access privileges correspond to the user.
2 . The method of claim 1 , wherein determining that the two attribute nodes share the same one or more outbound edges comprises:
determining that the attributes comprise permissions to the same resource type corresponding to the outbound edges.
3 . The method of claim 2 , comprising:
identifying a policy statement that indicates the permissions.
4 . The method of claim 1 , comprising:
moving inbound edges of the two attribute nodes to the combined node; and
moving the outbound edges to the combined node.
5 . The method of claim 4 , wherein combining the two attribute nodes comprises:
deleting the two attribute nodes from the privilege graph.
6 . The method of claim 1 , wherein generating the combined node comprises:
designating one of the two attribute nodes as the combined node.
7 . The method of claim 6 , comprising:
moving inbound edges of another of the two attribute nodes to the combined node.
8 . One or more non-transitory computer readable storage media having program instructions stored thereon for regulating access to computing resources, the program instructions, when executed by a processing system, direct the processing system to:
combine a first plurality of nodes in a privilege graph that share the same first outbound edges, wherein the privilege graph indicates access privileges for a plurality of users to features of a plurality of data environments;
insert an intermediate node between a second plurality of nodes and a plurality of outbound nodes shared by the second plurality of nodes;
identify two attribute nodes of the first plurality of nodes;
determine that the two attribute nodes share the same one or more outbound edges;
generate a combined node;
assign attributes represented by the two attribute nodes to the combined node; and
trace the privilege graph when determining which of the access privileges correspond to the user.
9 . The one or more non-transitory computer readable storage media of claim 8 , wherein the privilege graph is traced through the combined node.
10 . The one or more non-transitory computer readable storage media of claim 8 , wherein the one or more outbound edges point to resources of the same resource type.
11 . The one or more non-transitory computer readable storage media of claim 8 , wherein the first plurality of nodes represent permissions defined by a policy statement.