Access control policy warnings and suggestions
Techniques for generating access control policy warnings and suggestions are disclosed herein. An access control policy change specifying changes to one or more permissions associated with the access control policy is received and, based on a set of requests for access associated with the access control policy, an access control policy warning is produced which specifying an indication of whether or not the changes to the one or more permissions should be permitted.
1. A computer-implemented method, comprising:
obtaining, at a policy management service, a proposed access control policy change to an access control policy associated with a user of a computing resource service provider, the access control policy change specifying one or more effective permissions changes associated with one or more resources of the computing resource service provider;
obtaining information generated as a result of a plurality of previously submitted application programming interface requests that implicate the access control policy;
determining, based at least in part on the obtained information, impact information for the proposed access control policy change, the impact information indicating at least one of: the one or more permissions used in the past to be removed by the proposed access control policy change, or at least one of the one or more permissions unused in the past to be added by the proposed access control policy change;
determining an impact score for the proposed access control policy change based, at least in part, on usage of the one or more resources specified in the access control policy change, the impact score weighted based on a frequency of use of the one or more resources wherein less frequent use corresponds to a lower impact score than more frequent use;
producing a set of access control policy warnings, before the access control policy change becomes effective, based at least in part on the impact information of the proposed access control policy change, each access control policy warning of the set of access control policy warnings providing at least a subset of the impact information;
determining a set of access control policy suggestions based at least in part on the set of access control policy warnings, each access control policy suggestion of the set of access control policy suggestions indicating a respective alternate set of changes to the set of effective permissions; and
providing, based at least in part on the impact score at least meeting a threshold value, for display to the user, at least one of the set of access control policy warnings and at least one of the set of access control policy suggestions.
2. The computer-implemented method of claim 1 , wherein the method further comprises adjusting the impact score based on a user type associated with the user.
3. The computer-implemented method of claim 1 , wherein the set of changes to the set of effective permissions associated with one or more resources of the computing resource service provider comprises at least one of adding one or more missing unnecessary permissions to the set of effective permissions, the one or more missing unnecessary permissions determined based on the obtained information or removing one or more necessary permissions to the set of effective permissions, the one or more necessary permissions determined based on the obtained information.
4. The computer-implemented method of claim 1 , wherein the obtained information comprises a set of obtained information records, each obtained information record in the set of obtained information records specifying usage of a subset of the set of effective permissions, wherein determining impact information for the proposed access control policy change comprises:
parsing the obtained information to determine a subset of the set of obtained information records, the subset of the set of obtained information records selected based at least in part on the proposed access control policy change; and
comparing each change of the set of changes to the set of effective permissions to each obtained information record in the subset of the set of obtained information records to determine the impact information.
5. A system, comprising:
one or more processors; and
memory that stores computer-executable instructions that, as a result of execution, cause the one or more processors to:
obtain information indicating past usage of a set of effective permissions;
receive a set of proposed changes implicating a proposed access control policy change to an access control policy associated with a user of a computing resource service provider, the access control policy change specifying one or more effective permissions changes associated with one or more resources of the computing resource service provider;
determine, based at least in part on the obtained information, impact information for the proposed access control policy change, the impact information indicating at least one of: the one or more permissions used in the past to be removed by the proposed access control policy change, or at least one of the one or more permissions unused in the past to be added by the proposed access control policy change;
determine an impact score for the set of proposed changes based at least in part on the past usage of the one or more resources specified in the access control policy change, wherein the impact score is weighted according to frequency of the past usage;
determine a set of warnings, before the set of proposed changes are applied, based at least in part on the impact information of the proposed access control policy change, each warning of the set of warnings based at least in part on an impact of the set of proposed changes; and
provide, based at least in part on the impact score at least meeting a threshold value, at least one of the set of warnings.
6. The system of claim 5 , wherein the impact of the set of proposed changes indicates a change to a definition to a group of principals.
7. The system of claim 6 , wherein the impact of the set of proposed changes is based at least in part on comparing a timestamp associated with the obtained information to a timestamp associated with one or more proposed changes of the set of proposed changes.
8. The system of claim 6 , wherein the impact of the set of proposed changes is based at least in part on a frequency of used permissions based at least in part on the obtained information.
9. The system of claim 6 , wherein the impact of the set of proposed changes is based at least in part on a user type associated with one or more proposed changes of the set of proposed changes.
10. The system of claim 5 , wherein the computer-executable instructions include further instructions that, as a result of execution, further cause the one or more processors to provide a set of access control policy suggestions based at least in part on the set of warnings, each access control policy suggestion of the set of access control policy suggestions indicating a respective alternate set of changes to the set of permissions.
11. The system of claim 10 , wherein the computer-executable instructions include further instructions that, as a result of execution, further cause the one or more processors to issue a request for a first set of suggestion approvals from the user, each suggestion approval of the set of suggestion approvals corresponding to a respective subset of the set of access control policy suggestions.
12. The system of claim 11 , wherein the computer-executable instructions include further instructions that, as a result of execution, further cause the one or more processors to issue a notification when a second set of suggestion approvals received from the user in response to the request differs from the first set of suggestion approvals.
13. A non-transitory computer-readable storage medium comprising executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
obtain information indicating past usage of a set of permissions;
receive a set of proposed changes implicating a proposed access control policy change to an access control policy associated with a user of a computing resource service provider, the access control policy change specifying one or more effective permissions changes associated with one or more resources of the computing resource service provider;
determine, based at least in part on the obtained information, impact information for the proposed access control policy change, the impact information indicating at least one of:
the one or more permissions used in the past to be removed by the proposed access control policy change, or at least one of the one or more permissions unused in the past to be added by the proposed access control policy change;
determine an impact score based at least in part on weighing the past usage of the set of permissions indicated in the access control policy change, wherein less frequent past usage corresponds to a lower impact score than more frequent past usage;
determine a set of suggestions based at least in part on the determined impact information, each suggestion of the set of suggestions indicating a respective alternate set of changes to the set of permissions; and
provide, for display to a user of the computer system and based at least in part on the impact score at least meeting a threshold value, at least one of the set of suggestions.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to provide a set of warnings, each warning of the set of warnings corresponding to one or more changes to the set of changes.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the set of suggestions includes one or more suggestions that indicate a change to a definition to a group of principals.
16. The non-transitory computer-readable storage medium of claim 14 , wherein the set of suggestions includes one or more suggestions that alter one or more permissions specified in a group policy, the group policy applicable to any principal in a group of principals.
17. The non-transitory computer-readable storage medium of claim 13 , wherein the obtained information is generated as a result of a plurality of previously submitted application programming interface requests that implicate the set of permissions.
18. The non-transitory computer-readable storage medium of claim 13 , wherein the obtained information is obtained from a request log, the request log configured to record a plurality of request log entries, each request log entry is generated as a result of a previously submitted application programming interface request.
19. The non-transitory computer-readable storage medium of claim 13 , wherein the obtained information is obtained from a set of records, each record of the set of records generated by aggregating a plurality of previously submitted application programming interface requests that implicate the set of changes.
20. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to adjust the impact score based on a user type associated with the user.