Permission management for electronic resources
Various embodiments provide for a pre-validation of various aspects of an application deployment before any resources are provisioned in a user account. Pre-validation can perform checks on aspects such as connectivity and credential-based access for instances to be provisioned in a user account. A determination can also be made as to whether a role exists in the user account that has the appropriate policies and permissions to enable these instances, if provisioned, to have access to external services and resources needed to support the application. These checks can be performed through a launch wizard or deployment service that can collect information though a single console, and can ensure that these checks succeed before the requested instances are provisioned in the user account.
1. A computer-implemented method, comprising:
receiving, through a management console of a launch wizard of a cloud computing network, selection of an application to be hosted using a plurality of resource instances of the cloud computing network that are to be provisioned in a user account;
determining a set of permissions for the plurality of resource instances to host the application;
determining that a role, having one or more policies attached that provide the set of permissions, does not exist in the customer account;
obtaining credentials associated with the user account;
creating, using the credentials, the role in the user account;
provisioning, after creating the role in the user account, the plurality of resource instances in the user account for hosting the application; and
attaching the role to the plurality of resource instances after the provisioning, wherein the plurality of instances have the determined set of permissions.
2. The computer-implemented method of claim 1 , wherein the determining of the set of permissions is initiated by a launch wizard used to receive the performance requirements through the management console and trigger the provisioning of the plurality of resource instances.
3. The computer-implemented method of claim 1 , further comprising:
returning an error message through the management console if the role is unable to be created in the user account, wherein the plurality of resources are not deployed until the role is created successfully.
4. The computer-implemented method of claim 1 , wherein a user is able to manage the plurality of resource instances once provisioned in the user account.
5. The computer-implemented method of claim 1 , wherein the plurality of resource instances are to be provisioned in a virtual private cloud (VPC) in the user account, and wherein the set of permissions enable the plurality of resource instances to access services and resources via the VPC.
6. A computer-implemented method, comprising:
receiving, through a management console, selection of an application to be hosted using a plurality of resources to be provisioned in a user account;
creating a role, in the user account, that is associated with one or more policies providing a set of permissions for hosting the application;
provisioning, after creating the role in the user account, the plurality of resources in the user account for hosting the application; and
attaching the role to the plurality of resources, wherein the plurality of resources have the determined set of permissions.
7. The computer-implemented method of claim 6 , further comprising:
determining that the role, associated with the one or more policies, does not exist in the customer account; and
obtaining credentials associated with the user account for use in creating the role.
8. The computer-implemented method of claim 6 , wherein the creating of the role is initiated by a launch wizard used to receive the set of parameter values through the management console and trigger the provisioning of the plurality of resources.
9. The computer-implemented method of claim 6 , wherein the plurality of resources are to be provisioned in a virtual private cloud (VPC) in the user account, and wherein the set of permissions enable the plurality of resources to access services and resources external to the VPC.
10. The computer-implemented method of claim 9 , wherein the plurality of resources are able to utilize the set of permissions to download code or data from the services and resources via the VPC.
11. The computer-implemented method of claim 6 , wherein a user is able to manage the plurality of resources once provisioned in the user account.
12. The computer-implemented method of claim 6 , further comprising:
providing, through the management console, a notification that the role is to be created before creating the role in the user account.
13. The computer-implemented method of claim 6 , further comprising:
calling an identity management application programming interface (API) to create the role in the user account.
14. The computer-implemented method of claim 6 , wherein the role is associated with one or more templates used to provision the plurality of resources.
15. The computer-implemented method of claim 6 , wherein the plurality of resources includes at least one compute resource, storage resource, or networking resource.
16. A system, comprising:
at least one processor; and
memory including instructions that, upon being executed by the at least one processor, cause the system to:
receive, through a management console, selection of an application to be hosted using a plurality of resources to be provisioned in a user account;
create a role, in the user account, that is associated with one or more policies providing a set of permissions for hosting the application;
provision, after creating the role in the user account, the plurality of resources in the user account for hosting the application; and
attach the role to the plurality of resources, wherein the plurality of resources have the determined set of permissions.
17. The system of claim 16 , wherein the instructions when executed further cause the system to:
determine that the role, associated with the one or more policies, does not exist in the customer account; and
obtain credentials associated with the user account for use in creating the role.
18. The system of claim 16 , wherein the creating of the role is initiated by a launch wizard used to receive the set of parameter values through the management console and trigger the provisioning of the plurality of resources.
19. The system of claim 16 , wherein the plurality of resources are to be provisioned in a virtual private cloud (VPC) in the user account, and wherein the set of permissions enable the plurality of resources to access services and resources via the VPC.
20. The system of claim 19 , wherein the plurality of resources are able to utilize the set of permissions to download code or data from the services and resources via the VPC.