Access management tags
Tags may be used in decisions by an access management service regarding access of computing resources (“resources”) by principals (e.g., users, roles, etc.). The tags may also be used to determine cost information, for grouping resources and/or principals, and for other reasons. The tags may be assigned to principals, to resources, or both. The resource may be a virtual or physical type of computing resource. Tags may be metadata, which may include a key-value pair. Tags may include email addresses, cost centers, project identifiers, location, team name, etc. The value may be a number, letters, or a combination of both. In some embodiments, the values may be limited to certain numbers or bytes, and some numbers and/or letter combinations may be excluded for special use.
1. A method comprising:
determining a first access policy associated with a user, the first access policy being associated with a first tag, including a first key-value pair, and specifying one or more resources that the user is authorized to access;
determining a second access policy associated with a resource, the second access policy being associated with a second tag, including a second key-value pair, and specifying at least one of one or more users or one or more groups of users that are authorized to access the resource;
receiving, from a device of the user, a request to access the resource;
determining whether the user is authorized to access the resource based at least in part on at least one of the first access policy or the second access policy, the first access policy indicating one or more roles assigned to the user; and
determining whether the user is authorized to access the resource based at least in part on the one or more roles and, one or more permissions associated with the one or more roles, and a comparison of the first key-value pair and the second key-value pair.
2. The method as recited in claim 1 , wherein the first access policy is associated with the one or more roles or the one or more permissions.
3. The method as recited in claim 2 , wherein the one or more roles authorize the user to conduct a search with respect to the resource.
4. The method as recited in claim 2 , wherein the one or more roles authorize the user to associate one or more tags with the resource.
5. The method as recited in claim 1 , further comprising:
associating the first tag with the user, the first tag being associated with first metadata;
associating the second tag with the resource, the second tag being associated with second metadata; and
determining whether the user is authorized to access the resource based at least in part on at least one of the first metadata or the second metadata.
6. The method as recited in claim 5 , further comprising:
maintaining a first profile associated with the user;
maintaining a second profile associated with the resource;
associating the first tag with the first profile; and
associating the second tag with the second profile.
7. The method as recited in claim 1 , further comprising determining that the user is authorized to access the resource based at least in part on at least one of the first access policy or the second access policy indicating that the user is authorized to access the resource.
8. A method comprising:
determining at least one of a first access policy associated with a user or a first tag associated with the user, the user being associated with one or more roles and one or more permissions associated with the one or more roles;
determining at least one of a second access policy associated with a resource or a second tag associated with the resource;
receiving, from a device of the user, a request to access the resource;
denying the request by preventing the user accessing the resource, wherein denying the request is based at least in part on at least one of the first access policy, the first tag, the second access policy, or the second tag;
identifying one or more different resources associated with first data that is determined to be similar to second data associated with the resource; and
based at least in part on denying the request, causing an indication that identifies the one or more different resources to be sent to a computing device associated with the user.
9. The method as recited in claim 8 , wherein:
the first access policy specifies one or more resources that the user is authorized to access; and
the second access policy identifies at least one of one or more users or one or more groups of users that are authorized to access the resource.
10. The method as recited in claim 8 , wherein denying the request comprises at least one of determining that the first access policy does not identify the resource or determining that the second access policy does not identify the user or a group of users associated with the user.
11. The method as recited in claim 8 , further comprising:
receiving, from a second device of a second user, a second request to access the resource;
determining a third access policy associated with the second user or a third tag associated with the second user, the second user being associated with at least one of a second role or one or more second permissions; and
authorizing, based at least in part on at least one of the second access policy, the second tag, the third access policy, or the third tag, the second user to access the resource.
12. The method as recited in claim 8 , wherein the request is received by a service associated with the resource, and wherein an administrator of the service is authorized to authorize new users, create new resources, add, remove, or modify access authorizations associated with an existing user, and add, remove, or modify information associated with an existing resource.
13. The method as recited in claim 8 , wherein the one or more roles at least one of authorize the user to conduct a search with respect to the resource or authorize the user to associate one or more tags with the resource.
14. The method as recited in claim 8 , further comprising:
maintaining a first profile associated with the user;
maintaining a second profile associated with the resource;
associating the first tag with the first profile; and
associating the second tag with the second profile.
15. A method comprising:
automatically applying one or more first tags to a new resource based at least in part on one or more second tags associated with one or more existing resources that are determined to be similar to the resource;
determining one or more roles associated with a user, the one or more roles being associated with one or more permissions indicating that the user is authorized to access one or more resources;
receiving, from a device of the user, a request to access the new resource; and
determining, based at least in part on the one or more roles and the request, whether the user is authorized to access the new resource.
16. The method as recited in claim 15 , further comprising:
determining that the one or more permissions indicate that the user is authorized to access the new resource; and
authorizing, based at least in part on the one or more permissions and the request, the user to access the new resource.
17. The method as recited in claim 15 , further comprising:
determining that the one or more permissions omit a permission indicating that the user is authorized to access the new resource; and
denying, based at least in part on the one or more permissions and the request, authorization for the user to access the new resource.
18. The method as recited in claim 15 , further comprising:
determining a first access policy associated with the user, the first access policy specifying the one or more resources that the user is authorized to access;
determining a second access policy associated with the new resource, the second access policy specifying one or more users or one or more groups of users that are authorized to access the new resource; and
fulfilling or denying the request based at least in part on at least one of the first access policy or the second access policy.
19. The method as recited in claim 15 , further comprising:
authorizing, based at least in part on the one or more permissions and the request, the user to access the new resource;
receiving, from the device, a second request to access a second resource that is different than the new resource; and
denying, based at least in part on the one or more permissions, the second request by preventing the user from accessing the second resource.
20. The method as recited in claim 15 , wherein the one or more roles at least one of authorize the user to conduct a search with respect to the new resource or authorize the user to associate one or more additional tags with the new resource.