Access management to instances on the cloud

1. A method performed by a computing device comprising:

in response to a request from a user to create a support account for a target instance on a public network:

generating a key pair including a public key and a private key;

creating, in the target instance, the support account;

associating the public key with the target instance, including storing the public key in an authorized key list associated with the target instance;

providing access to the private key, wherein the key pair can facilitate a connection to the target instance through the support account;

generating temporary credentials associated with the target instance, wherein the request from the user includes permissions associated with the support account and an expiration time of the temporary credentials; and

upon expiration of the temporary credentials, removing the support account from the target instance and disassociating the public key with the target instance, resulting in termination of current connections and barring future connections to the target instance through the key pair.

2. The method according to claim 1 , wherein generating the temporary credentials includes setting a timer and the expiration of the temporary credentials is triggered by an expiration of the timer.

3. The method according to claim 1 , wherein the expiration of the temporary credentials is forced as a response to a user pre-emption request to discontinue the support account.

4. The method according to claim 1 , wherein:

disassociating the public key with the target instance includes removing the public key from the authorized key list.

5. The method according to claim 1 , further comprising retrieving, from the instance, a system log, the system log containing actions performed on the instance through the support account.

6. The method according to claim 1 , wherein the connection to the target instance is through a network using a secure socket shell (SSH) protocol.

7. The method according to claim 1 , wherein the key pair is based on a cryptographic algorithm.

8. The method according to claim 1 , further comprising repeating each process to manage access to a plurality of target instances.

9. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations, the operations comprising:

in response to a request from a user to create a support account for a target instance on a public network:

generating a key pair including a public key and a private key;

creating, in the target instance, the support account;

associating the public key with the target instance, including storing the public key in an authorized key list associated with the target instance;

providing access to the private key, wherein the key pair can facilitate a connection to the target instance through the support account;

generating temporary credentials associated with the target instance, wherein the request from the user includes permissions associated with the support account and an expiration time of the temporary credentials; and

upon expiration of the temporary credentials, removing the support account from the target instance and disassociating the public key with the target instance, resulting in termination of current connections and barring future connections to the target instance through the key pair.

10. The non-transitory machine-readable medium according to claim 9 , wherein generating the temporary credentials includes setting a timer and the expiration of the temporary credentials is triggered by an expiration of the timer.

11. The non-transitory machine-readable medium according to claim 9 , wherein the expiration of the temporary credentials is forced as a response to a user pre-emption request to discontinue the support account.

12. The non-transitory machine-readable medium according to claim 9 , wherein:

disassociating the public key with the target instance includes removing the public key from the authorized key list.

13. The non-transitory machine-readable medium according to claim 9 , wherein the operations further comprise: retrieving, from the instance, a system log, the system log containing actions performed on the instance through the support account.

14. The non-transitory machine-readable medium according to claim 9 , wherein the connection to the target instance is through a network using a secure socket shell (SSH) protocol.

15. The non-transitory machine-readable medium according to claim 9 , wherein the key pair is based on a cryptographic algorithm.

16. A system comprising:

a processing system having at least one hardware processor, the processing system coupled to a memory programmed with executable instructions that, when executed by the processing system, perform operations comprising:

in response to a request from a user to create a support account for a target instance on a public network:

generating a key pair including a public key and a private key;

creating, in the target instance, the support account;

associating the public key with the target instance, including storing the public key in an authorized key list associated with the target instance;

providing access to the private key to an administrator or technical support user, wherein the key pair can facilitate a connection to the target instance through the support account;

generating temporary credentials associated with the target instance, wherein the request from the user includes permissions associated with the support account and an expiration time of the temporary credentials; and

upon expiration of the temporary credentials, removing the support account from the target instance and disassociating the public key with the target instance, resulting in termination of current connections and barring future connections to the target instance through the key pair.