Ownership maintenance in a multi-tenant environment
Approaches presented herein enable credentials to be revoked or otherwise modified while limiting the impact of inadvertent or unintended changes in access. In some embodiments, the revocation of a credential can occur over a period of time with the level of access being diminished over that period, in order to prevent an inadvertent denial of access while indicating to the requestor that there is an issue with the credential. When a new policy is created for a new credential, a prior policy can be retained for at least a period of time such that users with inadvertently revoked access can obtain a level of access per the previous policy. Various embodiments trace the calls for a credential throughout the system in order to determine which services, processes, or components might be affected by the revocation, such that an appropriate remedial action can be taken.
1. A computer-implemented method, comprising:
receiving a request for access to a resource in a multi-tenant resource environment, the request associated with a credential, and the access indicated by the request;
as a result of determining that the credential is not valid for access to the resource, determining that the credential was previously valid for at least a portion of the access indicated by the request;
determining an amount of the access to provide in response to the request; and
providing the determined amount of access in response to the request.
2. The computer-implemented method of claim 1 , wherein the credential is determined to have been previously valid based at least in part on a prior policy.
3. The computer-implemented method of claim 1 , wherein the credential is determined to be not valid for the access indicated by the request based at least in part on a current policy.
4. The computer-implemented method of claim 1 , further comprising:
as a result of determining that the credential is not valid for the access indicated by the request, determining that a time associated with the request is within a revocation period for the credential.
5. The computer-implemented method of claim 4 , wherein the amount of access to provide is determined based at least in part on at least one access rule for the revocation period.
6. The computer-implemented method of claim 1 , wherein the amount of access is determined based at least in part on a time associated with the request with respect to a revocation period.
7. The computer-implemented method of claim 1 , further comprising:
authenticating an identity of a source of the request prior to providing the amount of the access.
8. The computer-implemented method of claim 1 , wherein:
the request is for information of the resource; and
the amount of the access is such that a portion of the information of the request is restricted for the request.
9. The computer-implemented method of claim 1 , further comprising:
as a result of determining that the credential was previously valid for at least the portion of the access indicated by the request, determine a permission currently associated with the credential, wherein the amount of the access to provide in response to the request is determined based at least in part on the permission.
10. A system, comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the system to:
receive a request for access to a resource in a multi-tenant resource environment, the request associated with a credential, and the access indicated by the request;
as a result of a determination that the credential is not valid for access to the resource, determine that the credential was previously valid for at least a portion of the access indicated by the request;
determine an amount of the access to provide in response to the request; and
provide the determined amount of access in response to the request.
11. The system of claim 10 , wherein the credential is determined to have been previously valid based at least in part on a prior policy.
12. The system of claim 10 , wherein the credential is determined to be not valid for the access indicated by the request based at least in part on a current policy.
13. The system of claim 10 , wherein the instructions when executed further cause the system to:
as a result of determining that the credential was previously valid for at least a portion of the access indicated by the request, determine an amount of time since a revocation of the credential is within a revocation period for the credential; and
determine the level of access based at least in part upon the amount of time that has passed since a revocation of the credential, the level of access decreasing from full access to no access over the revocation period.
14. The system of claim 10 , wherein the amount of access includes at least one of a speed of access, an accessible amount of data, a number of access failures, or a number of accessible resources in the multi-tenant environment.
15. The system of claim 10 , wherein the instructions when executed further cause the system to:
consult at least one access rule to determine the level of access, the at least one access rule being user configurable.
16. A non-transitory computer-readable storage medium having stored thereon instructions that, if executed by one or more processors of a computer system, cause the computer system to at least:
obtain a request for access to a resource in a multi-tenant resource environment, the request associated with a credential, and the access indicated by the request;
as a result of a determination that the credential is not valid for access to the resource, determine that the credential was previously valid for at least a portion of the access indicated by the request;
determine an amount of the access for the request; and
cause the determined amount of access to be provided in response to the request.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the credential is determined to have been previously valid for at least the portion of the access indicated by the request based at least in part on a prior policy.
18. The non-transitory computer-readable storage medium of claim 16 , wherein the credential is determined to be not valid for the access indicated by the request based at least in part on a current policy.
19. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions, if executed by one or more processors of the computer system, further cause the computer system to at least:
as a result of determining that the credential is not valid for the access indicated by the request, determining that a time associated with the request is within a revocation period for the credential.
20. The non-transitory computer-readable storage medium of claim 16 , wherein:
the request is for information of the resource; and
the amount of the access is such that a portion of the information of the request is restricted for the request.
21. The computer-implemented method of claim 1 , wherein: the credential is determined to be not valid at a time corresponding to the request for access; and the credential is determined to be previously valid with respect to the time.