Protection for restricted actions on critical resources

1. A computer-implemented method comprising:

receiving, by a server of a service provider, a request to generate a data encryption policy (DEP) for data stored by the server of the service provider for a customer, the DEP defining how encryption and decryption is performed for the data, the request including a reference to a customer key and an availability key, the customer key and the availability key being root keys for encrypting a data encryption key, the data encryption key used to encrypt the data stored by the service provider for the customer, wherein destructive changes to the availability key require receiving an approval from an account of the service provider;

validating, by the server of the service provider, the DEP; and

storing, by the server of the service provider, the DEP based on the validation.

2. The method as recited in claim 1 , further comprising:

receiving a destructive request to purge the DEP;

tracking, by a directory service of the server, approvals from a plurality of user accounts to purge the DEP;

tracking, by the server, approval from the account of the service provider to purge the DEP; and

purging the DEP based on the approvals from the plurality of user accounts and the account of the service provider.

3. The method as recited in claim 1 , further comprising:

detecting a request for access to the customer key;

sending requests, by a directory service of the server, to a plurality of user accounts for approval of the request for access; and

approving the request for access when the plurality of user accounts approve the request for access.

4. The method as recited in claim 3 , wherein the request for access is approved for a predetermined amount of time and the approval is revoked after an expiration of the predetermined amount of time.

5. The method as recited in claim 1 , further comprising:

detecting, by the server, a request for accessing the availability key;

sending a notification to an account of the service provider for the request for accessing the availability key; and

approving the request for accessing the availability key when the account of the service provider approves the request.

6. The method as recited in claim 1 , further comprising:

encrypting the encryption key with the customer key to obtain a first encrypted encryption key;

encrypting the encryption key with the availability key to obtain a second encrypted encryption key; and

storing the first encrypted encryption key and the second encrypted encryption key under the DEP, wherein the server provides control of the customer key to the customer and provides control of the availability key to the service provider.

7. The method as recited in claim 1 , wherein the DEP includes the customer key, the availability key, and a key vault for storing the customer key and the availability key.

8. The method as recited in claim 7 , wherein validating the DEP comprises:

validating that the key vault is configured for access; and

validating that access to the customer key requires a plurality of approvals.

9. The method as recited in claim 1 , wherein the server comprises:

a policy manager for managing an approval process;

an approval tracker for tracking pending approvals; and

an approval notifier for sending requests for approval.

10. The method as recited in claim 1 , wherein destructive changes to the customer key require receiving approval from a plurality of customer accounts.

11. The method as recited in claim 1 , further comprising:

providing, by the server, a user interface for entering approvals.

12. A of a service provider, the comprising:

a memory comprising instructions; and

one or more computer processors, wherein the instructions, when executed by the one or more computer processors, cause the to perform operations comprising:

receiving a request to generate a data encryption policy (DEP) for data stored by the of the service provider for a customer, the DEP defining how encryption and decryption is performed for the data, the request including a reference to a customer key and an availability key, the customer key and the availability key being root keys for encrypting a data encryption key used to encrypt the data stored by the service provider, wherein destructive changes to the availability key require receiving an approval from an account of the service provider;

validating the DEP; and

storing the DEP based on the validation.

13. The as recited in claim 12 , wherein the instructions further cause the one or more computer processors to perform operations comprising:

receiving a destructive request to purge the DEP;

tracking, by a directory service of the system, approvals from a plurality of user accounts to purge the DEP;

tracking, by the system, approval from the account of the service provider to purge the DEP; and

purging the DEP based on the approvals from the plurality of user accounts and the account of the service provider.

14. The as recited in claim 12 , wherein the instructions further cause the one or more computer processors to perform operations comprising:

detecting a request for access to the customer key;

sending requests, by a directory service of the system, to a plurality of user accounts for approval of the request for access; and

approving the request for access when the plurality of user accounts approve the request for access.

15. The as recited in claim 14 , wherein the request for access is approved for a predetermined amount of time and the approval is revoked after an expiration of the predetermined amount of time.

16. The as recited in claim 12 , wherein the instructions further cause the one or more computer processors to perform operations comprising:

detecting, by the system, a request for accessing the availability key;

sending a notification to an account of the service provider for the request for accessing the availability key; and

approving the request for accessing the availability key when the account of the service provider approves the request.

17. The as recited in claim 12 , wherein the DEP includes the customer key, the availability key, and a key vault for storing the customer key and the availability key, wherein validating the DEP comprises:

validating that the key vault is configured for access; and

validating that access to the customer key requires a plurality of approvals.

18. A tangible machine-readable storage medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:

receiving, by a server of a service provider, a request to generate a data encryption policy (DEP) for data stored by the server of the service provider for a customer, the DEP defining how encryption and decryption is performed for the data, the request including a reference to a customer key and an availability key, the customer key and the availability key being root keys for encrypting a data encryption key used to encrypt the data stored by the service provider, wherein destructive changes to the availability key require receiving an approval from an account of the service provider;

validating, by the server of the service provider, the DEP; and

storing, by the server of the service provider, the DEP based on the validation.

19. The tangible machine-readable storage medium as recited in claim 18 , wherein the machine further performs operations comprising:

receiving a destructive request to purge the DEP;

tracking, by a directory service of the server, approvals from a plurality of user accounts to purge the DEP;

tracking, by the server, approval from the account of the service provider to purge the DEP; and

purging the DEP based on the approvals from the plurality of user accounts and the account of the service provider.

20. The tangible machine-readable storage medium as recited in claim 18 , wherein the machine further performs operations comprising:

detecting a request for access to the customer key;

sending requests, by a directory service of the server, to a plurality of user accounts for approval of the request for access; and

approving the request for access when the plurality of user accounts approve the request for access.