Computing system permission administration engine
A plurality of permissions associated with the on-demand computing services environment may be identified. Each of the permissions may identify a respective one or more actions permitted to be performed within the on-demand computing services environment. Each of the permissions may be granted to a respective one or more user accounts within the on-demand computing services environment. A degree of overlap between a first group of the user accounts granted a first one of the permissions and a second group of the user accounts granted a second one of the permissions may be determined. When the degree of overlap exceeds a designated threshold, a designated permission set that includes the first permission and the second permission may be created.
1. A method implemented across multi-cloud environments, the method comprising:
granting, via an authorization system to one or more user accounts associated with a first one of the environments, one or more permissions of a plurality of permissions associated with the multi-cloud environments, each of the plurality of permissions corresponding to a respective one or more of a plurality of actions permitted to be performed on resources;
continuously monitoring use of the one or more permissions by the one or more user accounts;
detecting, based on the continuous monitoring and a machine learning procedure, one or more atypical permission usages by the one or more user accounts;
in response to detecting the atypical permission usages, creating a notification associated with the detected atypical permission usages; and providing, to an entity associated with the first environment, the notification in association with permissions management tools configurable to modify or revoke the one or more permissions for the one or more user accounts based on the alert.
2. The method of claim 1 , wherein the user accounts comprise identities and the authorization system comprises a system that grants access to the identities.
3. The method of claim 1 , further comprising:
generating, based on detecting the atypical permission usage, a forensic report detailing the atypical permission usage.
4. The method of claim 1 , further comprising:
based on prior activity log information, classifying, and determining typical behavior for the one or more user accounts.
5. The method of claim 4 , further comprising:
providing, to the entity, a selection configurable to allow the entity to choose from pre-configured alerts to be sent to the entity in response to atypical or suspicious activity in the first environment.
6. The method of claim 5 , further comprising:
notifying, based on preconfigured alerts selected by the entity, that an account has performed an unusual number of tasks.
7. The method of claim 6 , further comprising:
automatically populating new permissions associated with a new role, based on historical activity of users selected by the entity.
8. A permissions management system implemented using a server system comprising one or more hardware processors, the permissions management system configurable to cause:
granting, via an authorization system to one or more user accounts associated with a first environment of a multi-cloud environment, one or more permissions of a plurality of permissions associated with the multi-cloud environments, each of the plurality of permissions corresponding to a respective one or more of a plurality of actions permitted to be performed on resources;
continuously monitoring use of the one or more permissions by the one or more user accounts;
detecting, based on the continuous monitoring and a machine learning procedure, one or more atypical permission usages by the one or more user accounts;
in response to detecting the atypical permission usages, creating a notification associated with the detected atypical permission usages; and
providing, to an entity associated with the first environment, the notification in association with permissions management tools configurable to modify or revoke the one or more permissions for the one or more user accounts based on the alert.
9. The permissions management system of claim 8 , wherein the user accounts comprise identities and the authorization system comprises a system that grants access to the identities.
10. The permissions management system of claim 8 , the permissions management system further configurable to cause:
generating, based on detecting the atypical permission usage, a forensic report detailing the atypical permission usage.
11. The permissions management system of claim 8 , the permissions management system further configurable to cause:
based on prior activity log information, classifying, and determining typical behavior for the one or more user accounts.
12. The permissions management system of claim 11 , the permissions management system further configurable to cause:
providing, to the entity, a selection configurable to allow the entity to choose from pre-configured alerts to be sent to the entity in response to atypical or suspicious activity in the first environment.
13. The permissions management system of claim 12 , the permissions management system further configurable to cause:
notifying, based on preconfigured alerts selected by the entity, that an account has performed an unusual number of tasks.
14. The permissions management system of claim 13 , the permissions management system further configurable to cause:
automatically populating new permissions associated with a new role, based on historical activity of users selected by the entity.
15. A computer program product comprising non-transitory computer-readable program code capable of being executed by one or more processors when retrieved from a non-transitory computer-readable medium, the program code comprising instructions configurable to cause the one or more processors to perform a method comprising:
granting, via an authorization system to one or more user accounts associated with a first environment of a multi-cloud environment, one or more permissions of a plurality of permissions associated with the multi-cloud environments, each of the plurality of permissions corresponding to a respective one or more of a plurality of actions permitted to be performed on resources;
continuously monitoring use of the one or more permissions by the one or more user accounts;
detecting, based on the continuous monitoring and a machine learning procedure, one or more atypical permission usages by the one or more user accounts;
in response to detecting the atypical permission usages, creating a notification associated with the detected atypical permission usages; and
providing, to an entity associated with the first environment, the notification in association with permissions management tools configurable to modify or revoke the one or more permissions for the one or more user accounts based on the alert.
16. The computer program product of claim 15 , wherein the user accounts comprise identities and the authorization system comprises a system that grants access to the identities.
17. The computer program product of claim 15 , the method further comprising:
generating, based on detecting the atypical permission usage, a forensic report detailing the atypical permission usage.
18. The computer program product of claim 15 , the method further comprising:
based on prior activity log information, classifying, and determining typical behavior for the one or more user accounts.
19. The computer program product of claim 18 , the method further comprising:
providing, to the entity, a selection configurable to allow the entity to choose from pre-configured alerts to be sent to the entity in response to atypical or suspicious activity in the first environment.
20. The computer program product of claim 18 , the method further comprising:
notifying, based on preconfigured alerts selected by the entity, that an account has performed an unusual number of tasks.