Granted Patent B2

US 12,301,629 · App. 17/706,320 · Granted May 13, 2025

Inventor: Justin Paul Yancey (Seattle, WA)

Assignee: Amazon Technologies, Inc.

H04L63/205H04L63/0227H04L63/101H04L63/107H04L63/108H04L63/20

Abstract

Claims (54)

1. A computer-implemented method, comprising:

detecting a change in at least one endpoint that is virtual, that is for data service in a resource provider environment, and that is associated with a security policy for a resource, the security policy including an indication from an entity to automatically generate policy information based in part on the detected change in the at least one endpoint;

publishing new policy information associated with the change in the at least one endpoint; and

causing the new policy information to be applied for the security policy, wherein subsequent access request relating to the resource is enabled for the security policy that includes the new policy information.

2. The computer-implemented method of claim 1 , further comprising:

causing the new policy information to be applied for the security policy using a policy manager of a resource provider environment, the resource being at least one of a physical computing resource or a virtual computing resource provided using resources of the resource provider environment.

3. The computer-implemented method of claim 1 , further comprising:

receiving the new policy information in a customer policy manager;

generating a notification to a customer resource administrator regarding the new policy information; and

enabling the customer resource administrator to apply the new policy information for the security policy.

4. The computer-implemented method of claim 1 , further comprising:

detecting the change in at least one endpoint using a task-based resource;

generating the new policy information based at least in part on the change in the at least one endpoint; and

providing the new policy information for publication by a notification service.

5. The computer-implemented method of claim 1 , wherein the new policy information is stored to an information queue or transmitted using a data streaming service for publication.

6. The computer-implemented method of claim 1 , further comprising:

periodically polling an information queue for the new policy information wherein the new policy information includes at least one of a new policy definition or a new access control list.

7. The computer-implemented method of claim 1 , wherein the new policy information specifies the at least one endpoint for which access to the resource is to be granted or specifies at least one of second endpoint for which access is to be denied to the resource.

8. The computer-implemented method of claim 1 , wherein the new policy information is published using at least one of email messaging, instant messaging, short message service messaging, or text messaging.

9. The computer-implemented method of claim 1 , wherein the security policy is one of an access policy or a credential management policy.

10. The computer-implemented method of claim 1 , wherein the at least one endpoint correspond to one or more of an Internet Protocol (IP) address or geo-location of at least one of a sub-network or region of computing resources.

11. The computer-implemented method of claim 1 , further comprising:

validating a customer access credential, received with the subsequent access request, before granting access to the resource in response to the at least one endpoint of the subsequent access request falling within permissible endpoints specified by the new policy information.

12. A system, comprising:

at least one processor; and

memory including instructions that, when executed by the at least one processor, cause the system to:

detect a change in at least one endpoint that is virtual, that is for data service in a resource provider environment, and that is associated with a security policy for at least one resource;

automatically generate policy information associated with the at least one resource based in part on an indication in the security policy made by an entity to be associated with the at least one resource;

publish new policy information associated with the change in the at least one endpoint; and

cause the new policy information to be applied for the security policy, wherein subsequent access request relating to the resource is enabled for the security policy that includes the new policy information.

13. The system of claim 12 , wherein the instructions when executed further cause the system to:

cause the new policy information to be applied for the security policy using a policy manager of a resource provider environment, the resource being at least one of a physical computing resource or a virtual computing resource provided using resources of the resource provider environment.

14. The system of claim 12 , wherein the instructions when executed further cause the system to:

receive the new policy information in a customer policy manager;

generate a notification to a customer resource administrator regarding the new policy information; and

enable the customer resource administrator to apply the new policy information for the security policy.

15. The system of claim 12 , wherein the instructions when executed further cause the system to:

detect the change in the at least one endpoint using a task-based resource;

generate the new policy information based at least in part on the change in the at least one endpoint; and

provide the new policy information for publication by a notification service.

16. The system of claim 12 , wherein the new policy information is published using at least one of email messaging, instant messaging, short message service messaging, or text messaging.

17. The system of claim 12 , wherein the instructions when executed further cause the system to:

validate a customer access credential, received with the subsequent access request, before granting access to the resource in response to the at least one endpoint of the subsequent access request falling within permissible endpoints specified by the new policy information.

18. A non-transitory computer readable medium comprising instructions that when executed by a processor of a system causes the system to:

detect a change in at least one endpoint that is virtual, that is for data service in a resource provider environment, and that is associated with a security policy for at least one resource;

automatically generate policy information associated with the at least one resource based in part on an indication in the security policy made by an entity to be associated with the at least one resource;

publish new policy information associated with the change in the at least one endpoint; and

cause the new policy information to be applied for the security policy, wherein subsequent access request relating to the resource is enabled for the security policy that includes the new policy information.

19. The non-transitory computer readable medium of claim 18 , comprising the instructions that when executed by the processor of the system further causes the system to:

cause the new policy information to be applied for the security policy using a policy manager of a resource provider environment, the resource being at least one of a physical computing resource or a virtual computing resource provided using resources of the resource provider environment.

20. The non-transitory computer readable medium of claim 19 , further comprising:

receive the new policy information in a customer policy manager;

generate a notification to a customer resource administrator regarding the new policy information; and

enable the customer resource administrator to apply the new policy information for the security policy.

Continuity (3)

References Cited (181)