Techniques for automatically configuring minimal cloud service access rights for container applications

1. A method, comprising:

receiving one or more requests for access to one or more cloud services;

storing the one or more requests in a request log;

receiving one or more access rules applicable to cloud service access rights for the one or more cloud services;

aggregating the one or more requests of the request log to determine access requirements for a container, the container being configured to store one or more applications;

generating container access policies that define access rights of for containers to the one or more cloud services, the container access policies generated based at least in part on the aggregated one or more requests and the one or more access rules;

generating node access policies, the node access policies defining a combined access right for one or more containers on a node comprising a group of compute instances; and

storing the node access policies in a memory;

storing the container access policies in the memory; and

sending the container access policies to a request forwarder of a compute instance in a production environment, the request forwarder accessing the container access policies to grant the access rights for the one or more containers to the one or more cloud services.

2. The method of claim 1 , further comprising:

granting access permissions equal to combined access of the one or more containers assigned to the node.

3. The method of claim 1 , further comprising:

partitioning the compute instance into groups of nodes, each of the nodes having distinct access; and

assigning one or more containers to a node with sufficient access based at least in part on the node access policies.

4. The method of claim 1 , wherein node access is pre-determined and container access within each node is dynamically configured.

5. The method of claim 1 , further comprising:

testing access requirements for a cloud system;

detecting a failure of a specific application to access the one or more cloud services based at least in part on an entry in the request log; and

changing permissions of a compute instance to remedy the failure.

6. The method of claim 1 , further comprising:

setting the request forwarder for each container type in the production environment to a permissive mode, the permissive mode granting access of the one or more applications stored in the container to the one or more cloud services;

receiving the one or more requests from the request forwarder; and

in accordance with a number of the one or more requests exceeding a threshold requirement, switching the request forwarder to a restrictive mode, the restrictive mode granting access of the one or more applications to the one or more cloud services based in part on the container access policies.

7. A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a computer system, cause the computer system to:

receive one or more requests for access to one or more cloud services;

store the one or more requests in a request log;

receive one or more access rules applicable to cloud service access rights for the one or more cloud services;

aggregate the one or more requests of the request log to determine access requirements for a container, the container being configured to store one or more applications;

generate container access policies that define access rights for containers to the one or more cloud services, the container access policies generated based at least in part on the aggregated one or more requests and the one or more access rules;

generate node access policies, the node access policies defining a combined access right for one or more containers on a node comprising a group of compute instances; and

store the node access policies in a memory;

store the container access policies in the memory; and

send the container access policies to a request forwarder of a compute instance in a production environment, the request forwarder accessing the container access policies to grant the access rights for the one or more containers to the one or more cloud services.

8. The non-transitory computer-readable medium of claim 7 , wherein the one or more instructions further cause the computer system to:

grant access permissions equal to combined access of the one or more containers assigned to the node.

9. The non-transitory computer-readable medium of claim 7 , wherein the one or more instructions further cause the computer system to:

partition the compute instance into groups of nodes, each of the nodes having distinct access; and

assign one or more containers to a node with sufficient access based at least in part on the node access policies.

10. The non-transitory computer-readable medium of claim 7 , wherein node access is pre-determined and container access within each node is dynamically configured.

11. The non-transitory computer-readable medium of claim 7 , wherein the one or more instructions further cause the computer system to:

test access requirements for a cloud system;

detect a failure of a specific application to access the one or more cloud services based at least in part on an entry in the request log; and

change permissions of a compute instance to remedy the failure.

12. The non-transitory computer-readable medium of claim 7 , wherein the one or more instructions further cause the computer system to:

set the request forwarder for each container type in the production environment to a permissive mode, the permissive mode granting access of the one or more applications stored in the container to the one or more cloud services;

receive the one or more requests from the request forwarder; and

in accordance with a number of the one or more requests exceeding a threshold requirement, switch the request forwarder to a restrictive mode, the restrictive mode granting access of the one or more applications to the one or more cloud services based in part on the container access policies.

13. A computer system, comprising:

one or more memories; and

one or more processors, communicatively coupled to the one or more memories, configured to perform operations comprising:

receiving one or more requests for access to one or more cloud services;

storing the one or more requests in a request log;

receiving one or more access rules applicable to cloud service access rights for the one or more cloud services;

aggregating the one or more requests of the request log to determine access requirements for a container, the container being configured to store one or more applications;

generating container access policies that define access rights for containers and to the one or more cloud services, the container access policies generated based at least in part on the aggregated one or more requests and the one or more access rules;

generating node access policies, the node access policies defining a combined access right for one or more containers on a node comprising a group of compute instances; and

storing the node access policies in a memory;

storing the container access policies in the memory; and

sending the container access policies to a request forwarder of a compute instance in a production environment, the request forwarder accessing the container access policies to grant the access rights for the containers to the one or more cloud services.

14. The computer system of claim 13 , wherein the one or more processors are further configured to perform operations comprising:

granting access permissions equal to combined access of the one or more containers assigned to the node.

15. The computer system of claim 13 , wherein the one or more processors are further configured to perform operations comprising:

partitioning the compute instance into groups of nodes, each of the nodes having distinct access; and

assigning one or more containers to a node with sufficient access based at least in part on the node access policies.

16. The computer system of claim 13 , wherein node access is pre-determined and container access within each node is dynamically configured.

17. The computer system of claim 13 , wherein the one or more processors are further configured to perform operations comprising:

testing access requirements for a cloud system;

detecting a failure of a specific application to access the one or more cloud services based at least in part on an entry in the request log; and

changing permissions of a compute instance to remedy the failure.