Providing fine-grained access remote command execution for virtual machine instances in a distributed computing environment
A selection of a document that includes a command and a parameter is received, and a user is caused to be associated with a policy that grants permission to execute the document. A request is received, from a requestor, to execute the document, the request including a parameter value, and the requestor is determined to be the user associated with the policy. The user is validated to have access to a resource indicated by the parameter value, and the command is caused to be executed against the resource.
1. A computer-implemented method, comprising:
processing a command document associated with a first entity, the command document identifying a resource and commands executable by the resource, to identify a policy associated with the first entity and limiting access, by a second entity, to a subset of the commands; and
processing a request to access the resource by:
identifying, based on information in the request, the resource, the command document, the policy, and the second entity associated with the request;
authorizing the request as a result of determining that the request is associated with the second entity; and
causing, based at least in part on the policy and the command document, execution of the subset of the commands by the resource.
2. The computer-implemented method of claim 1 , further comprising verifying that the resource is capable of executing the subset of the commands.
3. The computer-implemented method of claim 2 , wherein verifying that the resource is capable of executing the subset of the commands further comprises:
verifying that the second entity is authorized to access the resource; and
verifying that the resource is responsive.
4. The computer-implemented method of claim 1 , wherein the resource is a virtual machine instance.
5. A system, comprising:
one or more processors; and
memory including instructions that, as a result of execution by the one or more processors, cause the system to:
obtain a command document associated with a first entity, the command document identifying a resource and commands executable by the resource;
identify a policy associated with the first entity and limiting access, by a second entity, to a subset of the commands; and
as a result of a request to access the resource:
process the request to identify the resource, the command document, the policy, and the second entity associated with the request;
authorize the request as a result of determining that the request is associated with the second entity; and
cause, based at least in part on the policy and the command document, execution of the subset of the commands by the resource.
6. The system of claim 5 , wherein the first entity is an administrator associated with the resource.
7. The system of claim 5 , wherein the request is obtained by the system via a programmatic interface.
8. The system of claim 5 , wherein the request includes a set of parameters usable to identify the command document.
9. The system of claim 5 , wherein the request includes a set of parameters usable to identify the resource.
10. The system of claim 5 , wherein the instructions, as a result of execution, further cause the system to:
determine that the request is associated with a different subset of the commands outside of the subset of the commands identified in the policy; and
deny the request with respect to the different subset of the commands.
11. The system of claim 5 , wherein the policy further limits access by the second entity to the resource, and
the instructions, as a result of execution, further cause the system to:
determine that the request is associated with a different resource than the resource identified in the policy; and
deny the request with respect to the different resource.
12. The system of claim 5 , wherein the policy is defined, at least in part, by the first entity.
13. The system of claim 12 , wherein the resource is a virtual machine accessible to the system.
14. A non-transitory computer-readable storage medium storing executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
obtain a document associated with a first entity, the document identifying a resource and commands executable by the resource;
identify a policy associated with the first entity and limiting access to a subset of the commands; and
as a result of a request to access the resource:
process the request to identify the resource, the document, the policy, and a second entity associated with the request;
authorize the request as a result of determining that the request is associated with the second entity; and
cause, based at least in part on the policy and the document, execution of the subset of the commands by the resource.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the executable instructions that cause the subset of the commands to be executed on the resource further cause the computer system to provide the subset of the commands to a software agent executing on the resource.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the executable instructions further cause the computer system to provide an execution status for the subset of the commands.
17. The non-transitory computer-readable storage medium of claim 14 , wherein the executable instructions further cause the computer system to, if the resource is unavailable, add the subset of the commands to a queue.
18. The non-transitory computer-readable storage medium of claim 17 , wherein the executable instructions further cause the computer system to cancel the subset of the commands as a result of the subset of the commands being queued for a predetermined length of time.
19. The non-transitory computer-readable storage medium of claim 17 , wherein the executable instructions further cause the computer system to cancel the subset of the commands as a result of a size of the queue exceeding a predetermined threshold.
20. The non-transitory computer-readable storage medium of claim 19 , wherein the predetermined threshold is selected by the computer system as a result of a characteristic of the first entity.