System and method for tag based request context in a cloud infrastructure environment
Systems and methods described herein support tag based request context in a cloud infrastructure environment. Cloud administrators do not generally have the ability to restrict resource usage in existing clouds. Granting a user permission to create resources allows them to create and/or terminate any number of resources up to a predefined account limit. Tags are associated with requests for resources for allowing administrators to restrict a user's handling of resources to the appropriate level by allowing fine-tuned control of access to the resources based on the context of the request for the resources. Request context information of the request is compared against a required credential gate level for permitting handling of resources in a tenancy having the first privilege level classification, and the request is selectively granted based on the request context information matching the first required credential gate level.
1. A system using request context tags for control of handling of resources in an associated cloud infrastructure environment, the system comprising:
a computer comprising one or more microprocessors;
a tenancy defined in the associated cloud infrastructure environment; and
a memory device operatively coupled with the computer, the memory device storing logic executable by the computer for providing the control of handling of resources in the tenancy, the memory device storing access control data representative of a plurality of required credential gate levels for permitting handling of the resources in the tenancy,
wherein a request to handle a first resource in the tenancy is received, the request comprising request context tag data representative of request context information of the request,
wherein a first privilege level classification associated with the requested first resource is determined,
wherein the request context information of the request is compared against a first required credential gate level of the plurality of required credential gate levels for permitting handling of resources in the tenancy having the first privilege level classification,
wherein the request to handle the first resource is selectively granted based on the request context information matching the first required credential gate level; and
wherein:
the request context tag data of the request comprises user context tag data representative of user identification information of the user;
the request to handle the first resource comprises a request to handle all resources provisioned in the tenancy and associated with a second privilege level classification;
the user identification information of the request is compared against a second required credential gate level of the plurality of required credential gate levels for permitting handling of resources in the tenancy having the second privilege level classification; and
the request to handle all of the resources provisioned in the tenancy associated with the second privilege level classification is selectively granted based on the user identification information matching the second required credential gate level.
2. The system according to claim 1 , wherein:
a second request to handle the first resource in the tenancy is received, the second request comprising request context tag data representative of request context information of the second request;
the second request to handle the first resource comprises a request to provision the first resource in the tenancy; and
the first resource is selectively provisioned in the tenancy based on the request context information of the second request matching the first required credential gate level.
3. The system according to claim 2 , wherein:
the second request to provision the first resource in the tenancy comprises a request from a user of the system to provision a bare metal compute instance in the tenancy for providing control to the user of one or more physical host machines within a compute resource layer in the associated cloud infrastructure environment;
the request context tag data of the second request comprises user context tag data representative of user identification information of the user;
the access control data stored in the memory device comprises user access control data representative of a plurality of user required credential gate levels for permitting handling of the resources in the tenancy;
wherein the user identification information of the user is compared against a first user required credential gate level of the plurality of user required credential gate levels for permitting handling of the resources in the tenancy having the first privilege classification; and
wherein the bare metal compute instance is selectively provisioned to the user in the tenancy based on the user identification information of the user matching the first user required credential gate level.
4. The system according to claim 1 , wherein:
a second request to handle the first resource in the tenancy is received, the second request comprising request context tag data representative of request context information of the second request;
the second request to handle the first resource comprises a request to provision a plurality of resources in the tenancy having the first privilege level classification; and
the plurality of resources in the tenancy are selectively provisioned based on the request context information of the second request matching the first required credential gate level.
5. The system according to claim 1 , wherein:
the tenancy comprises a plurality of compartments storing the resources associated with the second privilege level classification, wherein each compartment of the plurality of compartments provides isolation of a set of the resources associated with the second privilege level classification within the compartment relative to one or more other sets of the resources associated with the second privilege level classification in the other compartments; and
wherein the request to handle all of the resources provisioned in the tenancy associated with the second privilege level classification is selectively granted spanning the plurality of compartments and based on the user identification information matching the second required credential gate level.
6. The system according to claim 1 , wherein:
a second request to handle the first resource in the tenancy is received, the second request comprising request context tag data representative of request context information of the second request;
the receiving the second request comprises receiving a request comprising context data comprising one or more of resource type data representative of a type of the resource instance being requested and/or resource group data representative of a group of the resource instance being requested.
7. A method using request context tags for control of handling of resources in an associated cloud infrastructure environment, the method comprising:
providing a tenancy in the associated cloud infrastructure environment by a computer comprising one or more processors and a memory device operatively coupled with the computer, the memory device storing logic executable by the computer for providing the control of handling of resources in the tenancy;
storing access control data representative of a plurality of required credential gate levels for permitting handling of the resources in the tenancy;
receiving a request to handle a first resource in the tenancy, the request comprising request context tag data representative of request context information of the request,
determining a first privilege level classification associated with the requested first resource;
comparing the request context information of the request against a first required credential gate level of the plurality of required credential gate levels for permitting handling of resources in the tenancy having the first privilege level classification; and
selectively granting the request to handle the first resource based on the request context information matching the first required credential gate level;
wherein:
the receiving the request comprises receiving a request comprising request context tag data of the request comprises user context tag data representative of user identification information of the user;
the receiving the request comprises receiving a request to handle all resources provisioned in the tenancy and associated with a second privilege level classification;
the comparing comprises comparing user identification information of the request against a second required credential gate level of the plurality of required credential gate levels for permitting handling of resources in the tenancy having the second privilege level classification; and
the selectively granting the request comprises selectively granting the request to handle all of the resources provisioned in the tenancy associated with the second privilege level classification granted based on the user identification information matching the second required credential gate level.
8. The method according to claim 7 , wherein:
a second request to handle the first resource in the tenancy is received, the second request comprising request context tag data representative of request context information of the second request;
the second request to handle the first resource comprises a request to provision the first resource in the tenancy; and
the first resource is selectively provisioned in the tenancy based on the request context information of the second request matching the first required credential gate level.
9. The method according to claim 8 , wherein:
the receiving the second request comprises receiving a request from a user of the system to provision a bare metal compute instance in the tenancy for providing control to the user of one or more physical host machines within a compute resource layer in the associated cloud infrastructure environment, wherein the request context tag data of the second request from the user of the system comprises user context tag data representative of user identification information of the user;
the storing the access control data in the memory device comprises storing user access control data representative of a plurality of user required credential gate levels for permitting handling of the resources in the tenancy;
the comparing comprises comparing user identification information of the user against a first user required credential gate level of the plurality of user required credential gate levels for permitting handling of the resources in the tenancy having the first privilege classification; and
the selectively provisioning the first resource in the tenancy comprises selectively provisioning the bare metal compute instance to the user in the tenancy based on the user identification information of the user matching the first user required credential gate level.
10. The method according to claim 7 , wherein:
a second request to handle the first resource in the tenancy is received, the second request comprising request context tag data representative of request context information of the second request;
the receiving the second request to handle the first resource comprises a receiving request to provision a plurality of resources in the tenancy having the first privilege level classification; and
the selectively provisioning the plurality of resources in the tenancy comprises selectively provisioning the plurality of resources based on the request context information matching the first required credential gate level.
11. The method according to claim 7 wherein:
the providing the tenancy comprises providing a tenancy comprising a plurality of compartments storing the resources associated with the second privilege level classification, wherein each compartment of the plurality of compartments provides isolation of a set of the resources associated with the second privilege level classification within the compartment relative to one or more other sets of the resources associated with the second privilege level classification in the other compartments; and
the granting the request comprises selectively granting the request to handle all of the resources provisioned in the tenancy associated with the second privilege level classification spanning the plurality of compartments and based on the user identification information matching the second required credential gate level.
12. The method according to claim 7 , wherein:
a second request to handle the first resource in the tenancy is received, the second request comprising request context tag data representative of request context information of the second request;
the receiving the second request comprises receiving a request comprising context data comprising one or more of resource type data representative of a type of the resource instance being requested and/or resource group data representative of a group of the resource instance being requested.
13. A non-transitory computer readable storage medium having instructions thereon for control of handling of resources in an associated cloud infrastructure environment using request context tags, that when read and executed by a computer cause the computer to perform steps comprising:
providing a tenancy in the associated cloud infrastructure environment by a computer comprising one or more processors and a memory device operatively coupled with the computer, the memory device storing logic executable by the computer for providing the control of handling of resources in the tenancy;
storing access control data representative of a plurality of required credential gate levels for permitting handling of the resources in the tenancy;
receiving a request to handle a first resource in the tenancy, the request comprising request context tag data representative of request context information of the request,
determining a first privilege level classification associated with the requested first resource;
comparing the request context information of the request against a first required credential gate level of the plurality of required credential gate levels for permitting handling of resources in the tenancy having the first privilege level classification; and
selectively granting the request to handle the first resource based on the request context information matching the first required credential gate level;
wherein:
the receiving the request comprises receiving a request comprising request context tag data of the request comprises user context tag data representative of user identification information of the user;
the receiving the request comprises receiving a request to handle all resources provisioned in the tenancy and associated with a second privilege level classification;
the comparing comprises comparing user identification information of the request against a second required credential gate level of the plurality of required credential gate levels for permitting handling of resources in the tenancy having the second privilege level classification; and
the selectively granting the request comprises selectively granting the request to handle all of the resources provisioned in the tenancy associated with the second privilege level classification granted based on the user identification information matching the second required credential gate level.
14. The storage medium according to claim 13 , wherein:
a second request to handle the first resource in the tenancy is received, the second request comprising request context tag data representative of request context information of the second request;
the second request to handle the first resource comprises a request to provision the first resource in the tenancy; and
the first resource is selectively provisioned in the tenancy based on the request context information of the second request matching the first required credential gate level.
15. The storage medium according to claim 14 , wherein:
the receiving the second request comprises receiving a request from a user of the system to provision a bare metal compute instance in the tenancy for providing control to the user of one or more physical host machines within a compute resource layer in the associated cloud infrastructure environment, wherein the request context tag data of the second request from the user of the system comprises user context tag data representative of user identification information of the user;
the storing the access control data in the memory device comprises storing user access control data representative of a plurality of user required credential gate levels for permitting handling of the resources in the tenancy;
the comparing comprises comparing user identification information of the user against a first user required credential gate level of the plurality of user required credential gate levels for permitting handling of the resources in the tenancy having the first privilege classification; and
the selectively provisioning the first resource in the tenancy comprises selectively provisioning the bare metal compute instance to the user in the tenancy based on the user identification information of the user matching the first user required credential gate level.
16. The storage medium according to claim 13 , wherein:
a second request to handle the first resource in the tenancy is received, the second request comprising request context tag data representative of request context information of the second request;
the receiving the second request to handle the first resource comprises a receiving request to provision a plurality of resources in the tenancy having the first privilege level classification; and
the selectively provisioning the plurality of resources in the tenancy comprises selectively provisioning the plurality of resources based on the request context information matching the first required credential gate level.
17. The storage medium according to claim 13 , wherein:
the providing the tenancy comprises providing a tenancy comprising a plurality of compartments storing the resources associated with the second privilege level classification, wherein each compartment of the plurality of compartments provides isolation of a set of the resources associated with the second privilege level classification within the compartment relative to one or more other sets of the resources associated with the second privilege level classification in the other compartments; and
the granting the request comprises selectively granting the request to handle all of the resources provisioned in the tenancy associated with the second privilege level classification spanning the plurality of compartments and based on the user identification information matching the second required credential gate level.