Access control for an ordered event stream storage system
Access control for an ordered event stream (OES) storage system is disclosed. Access to a portion of an OES can be controlled at a key-level in relation to a key space of the OES. An application instance can be identified to enable determining a correspondence to one or more keys. The correspondence can be embodied in stored data, for example, via an advanced access control list (AACL) that can be in the form of a list, a table, etc. Application instance access to the portion of the OES can be controlled by determining if an access rule is satisfied, e.g., determining if the key space the application instance wants to access comports with the one or more keys corresponding to the application instance identity. In an aspect, screening data corresponding to the AACL can enable preliminary access screening external to the OES storage system.
1. A system, comprising:
a processor; and
a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
determining an identity of an application instance;
determining an ordered event stream key corresponding to the identity of the application instance, wherein the ordered event stream key is stored in an advanced access control list;
determining that an access rule relating to ordered event stream access control is satisfied based on an access target value and on the ordered event stream key, wherein the access target value corresponds to an ordered event stream operation being attempted by the application instance; and
permitting access to an ordered event stream according to the access target value, wherein the permitting the access facilitates performing the operation being attempted by the application instance.
2. The system of claim 1 , wherein the application instance is a writer instance and the operation being attempted by the application instance is a write operation.
3. The system of claim 1 , wherein the application instance is a reader instance and the operation being attempted by the application instance is a read operation.
4. The system of claim 3 , wherein the reader instance is comprised in a reader group.
5. The system of claim 1 , wherein the operations further comprise: communicating, to the application instance, screening data corresponding to the ordered event stream key, wherein the screening data facilitates the application instance performing preliminary access screening.
6. The system of claim 1 , wherein the determining the ordered event stream key is based on access control data stored in the advanced access control list corresponding to the identity of the application instance.
7. The system of claim 6 , wherein the advanced access control list is embodied in a data structure selected from a group of data structures comprising a list, a table, a database, an ordered event stream event, and a blockchain block.
8. The system of claim 1 , wherein the determining the ordered event stream key comprises determining more than one ordered event stream key.
9. The system of claim 8 , wherein the determining more than one ordered event comprises determining a contiguous range of ordered event stream keys.
10. The system of claim 8 , wherein the determining more than one ordered event comprises determining a non-contiguous range of ordered event stream keys.
11. The system of claim 8 , wherein the determining more than one ordered event comprises use of a wildcard operator.
12. A method, comprising:
determining, by a system comprising a processor, an ordered event stream key corresponding to an identity of an application instance, wherein the ordered event stream key is stored in an advanced access control list; and
in response to determining, by the system, that an access rule relating to ordered event stream access control is satisfied based on an access target value that corresponds to an ordered event stream operation being attempted by the application instance and further based on the ordered event stream key, permitting access to an ordered event stream in accord with the access target value, wherein the permitting the access facilitates performing the operation being attempted by the application instance.
13. The method of claim 12 , wherein the application instance is a writer instance and the operation being attempted by the application instance is a write operation.
14. The method of claim 12 , wherein the application instance is a reader instance and the operation being attempted by the application instance is a read operation.
15. The method of claim 12 , wherein the determining the ordered event stream key comprises determining a range of ordered event stream keys comprising the ordered event stream key.
16. The method of claim 12 , further comprising:
communicating, by the system and to the application instance, screening data corresponding to the ordered event stream key to facilitate the application instance performing a preliminary access screening operation; and
receiving the ordered event stream operation being attempted by the application instance after the ordered event stream operation has been subjected to the preliminary access screening and before the determining that the access rule is satisfied.
17. A non-transitory machine-readable medium,
comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:
identifying an application instance, resulting in an identity of the application instance;
determining an ordered event stream key based on the identity of the application instance, wherein the ordered event stream key is stored in an advanced access control list; and
permitting access to an ordered event stream according to an access target value, wherein the access target value corresponds to an ordered event stream operation being attempted by the application instance, wherein the permitting the access facilitates performance of the operation being attempted, and wherein the permitting the access is based on determining that an access rule relating to ordered event stream access control is satisfied based on the access target value and the ordered event stream key.
18. The non-transitory machine-readable medium of claim 17 , wherein the application instance is a writer instance and the operation being attempted by the application instance is a write operation.
19. The non-transitory machine-readable medium of claim 17 , wherein the application instance is a reader instance and the operation being attempted by the application instance is a read operation.
20. The non-transitory machine-readable medium of claim 17 , wherein the operations further comprise communicating, to the application instance, screening data corresponding to the ordered event stream key, wherein the screening data facilitates the application instance performing preliminary access screening.