Cloud service account management method
A cloud service account management method identifies unauthorized or unmanaged accounts making administration console access or API access at a cloud computing service and triggers a work flow to place the accounts under management. In one embodiment, the user device is directed to a registration portal to provide access credentials of the unauthorized account. The loud service account management method uses the access credentials to retrieve a list of account users associated with the account. Once the accounts are made managed, the cloud service account management method can monitor the activities of the account, including all of the account users, and can apply compliance or security policies to the managed accounts.
1. A method of implementing cloud service account management by an enterprise, the method comprising:
receiving, using a hardware processor of a gateway, traffic associated with an access request to an administration console of a cloud service account at a cloud computing service;
generating, using the hardware processor, a request to obtain access credentials associated with an existing unmanaged account associated with the access request;
placing, using the hardware processor, the existing unmanaged account in a management mode so that the existing unmanaged account becomes a managed account;
retrieving, using the access credentials, a list of account users associated with the cloud service account; and
allowing an access request to the administration console of the cloud service account by a user in the list of account users.
2. The method of claim 1 , further comprising:
storing, using the hardware processor, an account identifier associated with the managed account, the access credentials, and the list of account users in a managed account database; and
periodically accessing, using the access credentials, the managed account to update the list of account users.
3. The method of claim 2 , further comprising determining whether the access request is made using the existing unmanaged account, wherein determining whether the access request is made using the existing unmanaged account comprises:
identifying the existing unmanaged account as being unmanaged by comparing the account identifier to a list of managed accounts in the managed account database, the existing unmanaged account being unmanaged when the account identifier is not present in the list of managed accounts.
4. The method of claim 1 , further comprising:
in response to the determining that an access request is made to an account-specific administration console of the managed account, determining whether the access request is made by an authorized user under the managed account, the authorized user being identified in the list of account users;
in response to the determining that the access request is made by an authorized user to the managed account, allowing the access request to the account-specific administration console at the cloud computing service; and
in response to the determining that the access request is made by an unauthorized user to the managed account, denying the access request to the account-specific administration console administration console at the cloud computing service and generating an alert.
5. The method of claim 1 , further comprising:
in response to the determining that an access request is made to an account-specific administration console of the managed account, determining whether the access request is made by an authorized user under the managed account, the authorized user being identified in the list of account users;
in response to the determining that the access request is made by an authorized user to the managed account, allowing the access request to the account-specific administration console at the cloud computing service; and
in response to the determining that the access request is made by an unauthorized user to the managed account, allowing the access request to the account-specific administration console administration console at the cloud computing service with an alert to the unauthorized user.
6. The method of claim 1 , wherein receiving, using the hardware processor, the traffic associated with the access request to the administration console of the cloud service account at the cloud computing service comprises:
receiving, using the hardware processor, the traffic associated with the access request using an application program interface (API) access to the administration console of the cloud service account at the cloud computing service.
7. The method of claim 1 , wherein generating, using the hardware processor, the request to obtain access credentials associated with the existing unmanaged account comprises:
generating, using the hardware processor, a request to obtain a security key associated with the existing unmanaged account.
8. The method of claim 1 , wherein generating, using the hardware processor, the request to obtain access credential associated with the existing unmanaged account comprises:
generating, using the hardware processor, a request to obtain an access token associated with the existing unmanaged account.
9. The method of claim 1 , wherein generating, using the hardware processor, the request to obtain access credentials associated with the existing unmanaged account comprises:
providing, using the hardware processor, a registration portal requesting the access credentials associated with the existing unmanaged account; and
receiving the access credentials entered onto the registration portal.
10. The method of claim 1 , further comprising monitoring, using the hardware processor, the managed account at the cloud computing service, monitoring, using the hardware processor, the managed account at the cloud computing service comprises:
using the access credentials to access the managed account at the cloud computing service; and
performing an audit of the managed account at the cloud computing service.
11. A system for implementing cloud service account management by an enterprise, the system comprising:
a hardware processor of a gateway; and
a memory coupled with the hardware processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:
receive traffic associated with an access request to an administration console of a cloud service account at a cloud computing service;
generate a request to obtain access credentials associated with an existing unmanaged account associated with the access request;
place the existing unmanaged account in a management mode so that the existing unmanaged account becomes a managed account;
retrieve, using the access credentials, a list of account users associated with the cloud service account; and
allow an access request to the administration console of the cloud service account by a user in the list of account users.
12. The system of claim 11 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:
store an account identifier associated with the managed account, the access credentials, and the list of account users in a managed account database; and
periodically access, using the access credentials, the managed account to update the list of account users.
13. The system of claim 12 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:
identify the existing unmanaged account as being unmanaged by comparing the account identifier to a list of managed accounts in the managed account database, the existing unmanaged account being unmanaged when the account identifier is not present in the list of managed accounts.
14. The system of claim 11 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:
in response to the determining that an access request is made to an account-specific administration console of the managed account, determine whether the access request is made by an authorized user under the managed account, the authorized user being identified in the list of account users;
in response to the determining that the access request is made by an authorized user to the managed account, allow the access request to the account-specific administration console at the cloud computing service; and
in response to the determining that the access request is made by an unauthorized user to the managed account, deny the access request to the account-specific administration console administration console at the cloud computing service and generate an alert.
15. The system of claim 11 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:
in response to the determining that an access request is made to an account-specific administration console of the managed account, determine whether the access request is made by an authorized user under the managed account, the authorized user being identified in the list of account users;
in response to the determining that the access request is made by an authorized user to the managed account, allow the access request to the account-specific administration console at the cloud computing service; and
in response to the determining that the access request is made by an unauthorized user to the managed account, allow the access request to the account-specific administration console administration console at the cloud computing service with an alert to the unauthorized user.
16. The system of claim 11 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:
receive the traffic associated with the access request using an application program interface (API) access to the administration console of the cloud service account at the cloud computing service.
17. The system of claim 11 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:
generate a request to obtain a security key associated with the existing unmanaged account.
18. The system of claim 11 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:
generate a request to obtain an access token associated with the existing unmanaged account.
19. The system of claim 11 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:
provide a registration portal requesting the access credentials associated with the existing unmanaged account; and
receive the access credentials entered onto the registration portal.
20. The system of claim 11 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:
use the access credentials to access the managed account at the cloud computing service; and
perform an audit of the managed account at the cloud computing service.