Generating customized policy decision point services for controlling access to computing resources

1. A non-transitory computer-readable medium comprising program code that is executable by a processor for causing the processor to:

select an access control policy to apply to an access request received from a client that is attempting to access a computing resource; and

in response to selecting the access control policy:

select a code block from among a plurality of code blocks based on the access control policy, wherein the code block includes first source code configured for evaluating access requests from clients against the access control policy; and

generate a customized policy decision point (PDP) service by incorporating the first source code of the code block into second source code of a PDP template, wherein the second source code is configured to provide default functionality for the customized PDP service, the customized PDP service being configured to execute the code block for applying the access control policy to the access request.

2. The non-transitory computer-readable medium of claim 1 , further comprising program code that is executable by the processor for causing the processor to:

receive the access request from the client; and

subsequent to receiving the access request from the client, deploy the customized PDP service.

3. The non-transitory computer-readable medium of claim 2 , further comprising program code that is executable by the processor for causing the processor to:

select the access control policy from among a plurality of access control policies based on the computing resource.

4. The non-transitory computer-readable medium of claim 3 , further comprising program code that is executable by the processor for causing the processor to:

retrieve the code block over a network from a repository including the plurality of code blocks, each code block in the plurality of code blocks corresponding to a respective access control policy of the plurality of access control policies.

5. The non-transitory computer-readable medium of claim 3 , further comprising program code that is executable by the processor for causing the processor to:

configure a policy enforcement point to grant or deny the access request based on an evaluation result received from the customized PDP service, the customized PDP service being configured to determine the evaluation result for the access request by executing the code block.

6. The non-transitory computer-readable medium of claim 2 , further comprising program code that is executable by the processor for causing the processor to, subsequent to deploying the customized PDP service:

detect an event associated with the customized PDP service; and

in response to detecting the event, shut down the customized PDP service.

7. A method comprising:

selecting, by a processor, an access control policy to apply to an access request received from a client that is attempting to access a computing resource; and

in response to selecting the access control policy:

selecting, by the processor, a code block from among a plurality of code blocks based on the access control policy, wherein the code block includes first source code configured for evaluating access requests from clients against the access control policy; and

generating, by the processor, a customized policy decision point (PDP) service by incorporating the first source code of the code block into second source code of a PDP template, wherein the second source code is configured to provide default functionality for the customized PDP service, the customized PDP service being configured to execute the code block for applying the access control policy to the access request.

8. The method of claim 7 , further comprising:

receiving the access request from the client; and

subsequent to receiving the access request from the client, deploying the customized PDP service.

9. The method of claim 8 , further comprising:

selecting the access control policy from among a plurality of access control policies based on the computing resource.

10. The method of claim 9 , further comprising:

retrieving the code block over a network from a repository including the plurality of code blocks, each code block in the plurality of code blocks corresponding to a respective access control policy of the plurality of access control policies.

11. The method of claim 9 , further comprising:

configuring a policy enforcement point to grant or deny the access request based on an evaluation result received from the customized PDP service, the customized PDP service being configured to determine the evaluation result for the access request by executing the code block.

12. The method of claim 8 , further comprising, subsequent to deploying the customized PDP service:

detecting an event associated with the customized PDP service; and

in response to detecting the event, shutting down the customized PDP service.

13. A system comprising:

a processor; and

a non-transitory computer-readable memory comprising instructions that are executable by the processor for causing the processor to:

select an access control policy to apply to an access request received from a client that is attempting to access a computing resource; and

in response to selecting the access control policy:

select a code block from among a plurality of code blocks based on the access control policy, wherein the code block includes first source code configured for evaluating access requests from clients against the access control policy; and

generate a customized policy decision point (PDP) service by incorporating the first source code of the code block into second source code of a PDP template, wherein the second source code is configured to provide default functionality for the customized PDP service, the customized PDP service being configured to execute the code block for applying the access control policy to the access request.

14. The system of claim 13 , further comprising instructions that are executable by the processor for causing the processor to:

receive the access request from the client; and

subsequent to receiving the access request from the client, deploy the customized PDP service.

15. The system of claim 14 , further comprising instructions that are executable by the processor for causing the processor to:

select the access control policy from among a plurality of access control policies based on the computing resource.

16. The system of claim 15 , further comprising instructions that are executable by the processor for causing the processor to:

retrieve the code block over a network from a repository including the plurality of code blocks, each code block in the plurality of code blocks corresponding to a respective access control policy of the plurality of access control policies.

17. The system of claim 15 , further comprising instructions that are executable by the processor for causing the processor to:

configure a policy enforcement point to grant or deny the access request based on an evaluation result received from the customized PDP service, the customized PDP service being configured to determine the evaluation result for the access request by executing the code block.

18. The system of claim 13 , further comprising instructions that are executable by the processor for causing the processor to, subsequent to deploying the customized PDP service:

detect an event associated with the customized PDP service; and

in response to detecting the event, shut down the customized PDP service.

19. The non-transitory computer-readable medium of claim 1 , further comprising program code that is executable by the processor for causing the processor to:

generate the customized PDP service by:

generating combined source code that includes the first source code and the second source code; and

compiling the combined source code into a file; and

deploy the customized PDP service by executing the file.

20. The method of claim 7 , further comprising:

generating the customized PDP service by:

generating combined source code that includes the first source code and the second source code; and

compiling the combined source code into a file; and

deploying the customized PDP service by executing the file.