Method and system for identity-based authentication of virtual machines
View Patent ↗A cloud computing system configured to run virtual machine instances is disclosed. The cloud computing system assigns an identity to each virtual machine instance. When the virtual machine instance accesses initial configuration resources, it provides this identity to the resources to authenticate itself. This allows for flexible and extensible initial configuration of virtual machine instances.
1. A cloud computing system, the system comprising
a resource having configuration information;
a virtual machine instance operably coupled to the resource, wherein an immutable value denotes an identity of the virtual machine instance, and wherein the virtual machine instance uses the immutable value to authenticate to the resource during startup, and the configuration information is different from authentication credentials; and
an authentication manager that controls, based on the immutable value, access by the virtual machine instance to the resource, wherein the configuration information alters an operation of the virtual machine instance.
2. The cloud computing system of claim 1 , wherein the virtual machine instance is assigned a second identity at instantiation, and wherein the virtual machine instance provides the first and second identities as a combined value for authentication to the authentication manager.
3. The cloud computing system of claim 1 , wherein the resource includes network access to a second virtual machine.
4. The cloud computing system of claim 1 , wherein the resource includes network access to a virtual device.
5. The cloud computing system of claim 1 , wherein the resource includes access to a storage device.
6. The cloud computing system of claim 1 , wherein the immutable value is based on instructions performed by the virtual machine instance.
7. The cloud computing system of claim 6 , wherein the immutable value is a hash value computed based on the instructions performed by the virtual machine instance.
8. The cloud computing system of claim 1 , further comprising:
a compute worker that assigns the immutable value to the virtual machine instance.
9. The cloud computing system of claim 8 , wherein the immutable value is a hash value computed from a virtual machine image used to instantiate the virtual machine instance.
10. The cloud computing system of claim 9 , wherein the hash value is computed by using SHA-1, SHA-2, or SHA-3.
11. The cloud computing system of claim 9 , wherein the configuration information is stored separate from the virtual machine instance.
12. A method for controlling access to a resource, the method comprising:
receiving a request from a virtual machine instance for access to a resource, the request including an immutable value that denotes the identity of the virtual machine instance, and the resource including configuration information that alters an operation of the virtual machine instance; and
determining, based on the immutable value, whether to grant the virtual machine instance access to the resource, wherein the virtual machine instance uses the immutable value to authenticate to the resource during startup, and the configuration information is different from authentication credentials.
13. The method of claim 12 , wherein the immutable value is a hash value computed from a virtual machine image used to instantiate the virtual machine instance.
14. The method of claim 13 , wherein the hash value is computed by using SHA-1, SHA-2, or SHA-3.
15. The method of claim 13 , wherein the hash value is computed at instantiation time of the virtual machine instance.
16. The method of claim 12 , wherein the immutable value is based on instructions performed by the virtual machine instance.
17. The method of claim 16 , wherein the immutable value is a hash value computed based on the instructions performed by the virtual machine instance.
18. The method of claim 12 , wherein the resource includes network access to a second virtual machine.
19. The method of claim 12 , wherein the resource includes network access to a virtual device.
20. The method of claim 12 , further comprising:
assigning a group of identities to a role, the group of identities including the virtual machine instance, and the role being granted minimum permissions necessary to perform functions of the role; and
receiving user input from a user, wherein the user input configures the permissions for the role.