Role-based resource access control

1. A method for role-based control of access to computing resources, the method comprising:

receiving, via a communication network from a process executing on a client device, a request to perform a type of access of a computing resource;

identifying, from a data store storing process identifiers and associated access control information, access control information associated with the requesting process based on a process identifier of the requesting process;

determining, based on the access control information associated with the requesting process, using at least one hardware processor of a machine, whether the requesting process is allowed to perform the requested type of access of the computing resource;

based on the requesting process being allowed to perform the requested type of access of the computing resource, causing the request to be processed;

wherein each process identifier and its associated access control information describe a role corresponding to the process identified by the process identifier;

wherein the requesting process corresponds to more than one role;

wherein the access control information associated with the requesting process corresponds to a first role of the requesting process; and

wherein the method further comprises:

based on the requesting process not being allowed to perform the requested type of access of the computing resource in the first role, determining whether a second role is available for the requesting process that allows the requested type of access of the computing resource to be performed; and

based on a second role being available for the requesting process that allows the requested type of access of the computing resource to be performed,

assigning the second role to the requesting process, and

causing the request to be processed.

2. The method of claim 1 , wherein:

the access control information associated with the requesting process indicates one or more computing resources that the requesting process is allowed to access.

3. The method of claim 2 , wherein;

the access control information associated with the requesting process further indicates, for at least one of the indicated one or more computing resources, a type of access to the at least one of the indicated one or more computing resources allowed for the requesting process.

4. The method of claim 1 , further comprising:

receiving, via the communication network, at least one text file comprising the process identifiers and the associated access control information; and

storing the process identifiers and the associated access control information in the data store.

5. The method of claim 4 , the at least one text file comprising at least one of a JavaScript Object Notation (JSON) file and an Extensible Markup Language (XML) file.

6. The method of claim 1 , further comprising:

based on the requesting process not being allowed to perform the requested type of access of the computing resource, denying the request.

7. The method of claim 1 , further comprising:

reverting the requesting process from the second role to the first role after a predetermined event has occurred.

8. The method of claim 7 , wherein the predetermined event comprises the processing of the request.

9. The method of claim 1 , further comprising:

reverting the requesting process from the second role to the first role after a predetermined period of time has elapsed.

10. The method of claim 1 , wherein the second role corresponds to the access control information corresponding to the first role, and to additional access control information allowing the requested type of access of the computing resource.

11. The method of claim 1 , wherein the determining whether a second role is available for the requesting process depends on whether the second role is specified in a role hierarchy associated with the requesting process.

12. The method of claim 1 , further comprising:

receiving, prior to the receiving of the request, a digital certificate corresponding to the client device and the process identifier for the requesting process; and

authenticating, prior to the receiving of the request, the requesting process based on the received digital certificate and the received process identifier.

13. The method of claim 12 , further comprising:

performing a two-way authentication with the client device, the performing of the two-way authentication comprising the receiving of the digital certificate and the authenticating of the requesting process.

14. The method of claim 1 , wherein the computing resource comprises a data streaming service.

15. The method of claim 1 , wherein the computing resource comprises a messaging queue.

16. The method of claim 1 , wherein the computing resource comprises a database.

17. The method of claim 1 , wherein the computing resource comprises a web server.

18. A system comprising:

one or more hardware processors; and

a memory storing instructions that, when executed by at least one of the one or more hardware processors, cause the system to perform operations comprising:

receiving, via a communication network from a process executing on a client device, a request to perform a type of access of a computing resource;

identifying, from a data store storing process identifiers and associated access control information, access control information associated with the requesting process based on a process identifier of the requesting process;

determining, based on the access control information associated with the requesting process, whether the requesting process is allowed to perform the requested type of access of the computing resource; and

based on the requesting process being allowed to perform the requested type of access of the computing resource, causing the request to be processed;

wherein each process identifier and its associated access control information describe a role corresponding to the process identified by the process identifier;

wherein the requesting process corresponds to more than one role;

wherein the access control information associated with the requesting process corresponds to a first role of the requesting process; and

wherein the system performs further operations comprising:

based on the requesting process not being allowed to perform the requested type of access of the computing resource in the first role, determining whether a second role is available for the requesting process that allows the requested type of access of the computing resource to be performed; and

based on a second role being available for the requesting process that allows the requested type of access of the computing resource to be performed,

assigning the second role to the requesting process, and

causing the request to be processed.

19. A non-transitory computer-readable storage medium storing instructions that, when executed by at least one hardware processor of a machine, cause the machine to perform operations comprising:

receiving, via a communication network from a process executing on a client device, a request to perform a type of access of a computing resource;

identifying, from a data store storing process identifiers and associated access control information, access control information associated with the requesting process based on a process identifier of the requesting process;

determining, based on the access control information associated with the requesting process, whether the requesting process is allowed to perform the requested type of access of the computing resource; and

based on the requesting process being allowed to perform the requested type of access of the computing resource, causing the request to be processed;

wherein each process identifier and its associated access control information describe a role corresponding to the process identified by the process identifier;

wherein the requesting process corresponds to more than one role;

wherein the access control information associated with the requesting process corresponds to a first role of the requesting process; and

wherein the system performs further operations comprising:

based on the requesting process not being allowed to perform the requested type of access of the computing resource in the first role, determining whether a second role is available for the requesting process that allows the requested type of access of the computing resource to be performed; and

based on a second role being available for the requesting process that allows the requested type of access of the computing resource to be performed,

assigning the second role to the requesting process and

causing the request to be processed.