Controlling access to cloud resources in data using cloud-enabled data tagging and a dynamic access control policy engine

1. A computer implemented method, comprising:

receiving an access request from a workload in a multi-tenant computing system that includes a plurality of tenants, the access request being indicative of a requestor requesting access to a resource;

parsing, by a tenant-specific execution environment that is specific to a particular tenant associated with the requestor, the access request to identify a requestor attribute corresponding to the requestor and a resource attribute corresponding to the resource;

selecting, based on information in the access request, a tenant-specific data access policy from a set of data access policies, the selected tenant-specific data access policy being specific to the particular tenant;

accessing a multi-tenant policy storage system that includes a plurality of tenant-specific policy stores, wherein

each tenant-specific policy store of the plurality of tenant-specific policies stores:

corresponds to respective tenant of the plurality of tenants, and

stores a set of tenant-specific data access policies, for the respective tenant, separate from data access policies for other tenants;

obtaining the selected tenant-specific data access policy from the tenant-specific policy store corresponding to the particular tenant;

loading the selected tenant-specific data access policy into the tenant-specific execution environment;

generating, by the tenant-specific execution environment, an access decision indicative of whether the requested access is granted based on the requestor attribute, the resource attribute, and the selected tenant-specific data access policy; and

returning the access decision to the workload.

2. The computer implemented method of claim 1 wherein obtaining the selected tenant-specific data access policy comprises:

obtaining the selected tenant-specific data access policy from the multi-tenant policy storage system in encrypted form; and

decrypting the selected tenant-specific data access policy.

3. The computer implemented method of claim 1 , and further comprising:

based on determining that one or more of the requestor attribute or the resource attribute are not included with the access request, obtaining the one or more of the requestor attribute or the resource attribute that are not included with the access request.

4. The computer implemented method of claim 3 wherein obtaining one or more of the requestor attribute or the resource attribute that are not included in the access request comprises:

obtaining the requestor attribute from a multi-tenant attribute storage system that segments attributes corresponding to different tenants.

5. The computer implemented method of claim 3 wherein obtaining one or more of the requestor attribute or the resource attribute that are not included in the access request comprises:

obtaining the resource attribute from a multi-tenant attribute storage system that segments attributes corresponding to different tenants.

6. The computer implemented method of claim 1 wherein generating the access decision comprises:

obtaining an environment attribute corresponding to an environment in which the workload operates;

obtaining a device attribute corresponding to a device from which the access request was originated; and

generating the access decision based on the environment attribute and the device attribute.

7. The computer implemented method of claim 1 and further comprising:

generating a user interface with a user actuatable tag type generation input mechanism;

detecting user actuation of the tag type generation input mechanism indicative of a tag type; and

storing the tag type in a tag type store.

8. The computer implemented method of claim 1 , wherein each tenant of the plurality of tenants has a plurality of users,

the multi-tenant computing system hosts a service for the plurality of users of the plurality of tenants, and

generating the access decision comprises generating the access decision to include a set of permitted actions that are permitted for the requested access.

9. The computer implemented method of claim 5 and further comprising:

generating a user interface with a user actuatable tag mapping input mechanism;

detecting user actuation of the tag mapping input mechanism indicative of a mapping between a tag of a tag type to a resource identity, wherein the resource identity identifies one of a user, a device, an environment, or a computing system resource; and

storing the mapping in the multi-tenant attribute storage system.

10. The computer implemented method of claim 1 , wherein

obtaining the selected tenant-specific data access policy comprises accessing a set of mappings corresponding to the particular tenant, which each mapping of the set of mappings maps a tag of a tag type to a resource identity,

generating the access decision comprises generating the access decision based on the set of mapping corresponding to the particular tenant, and

the resource identity identifies one or more of a user, a device, an environment, or a computing system resource.

11. A computing system comprising:

at least one processor; and

memory that stores instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:

receive an access request from a workload in a multi-tenant computing system that includes a plurality of tenants, the access request being indicative of a requestor requesting access to a resource;

parse, by a tenant-specific execution environment that is specific to a particular tenant associated with the requestor, the access request to identify

a requestor attribute corresponding to the requestor, and

a resource attribute corresponding to the resource;

select, based on information in the access request, a tenant-specific data access policy from a set of data access policies, the selected tenant-specific data access policy being specific to the particular tenant;

access a multi-tenant policy storage system that includes a plurality of tenant-specific policy stores, wherein

each tenant-specific policy store of the plurality of tenant-specific policies stores:

corresponds to a respective tenant of the plurality of tenants, and

stores a set of tenant-specific data access policies, for the respective tenant, separate from data access policies for other tenants;

obtain the selected tenant-specific data access policy from the tenant-specific policy store corresponding to the particular tenant;

load the selected tenant-specific data access policy into the tenant-specific execution environment;

generate, by the tenant-specific execution environment, an access decision indicating that the requested access is granted based on:

the requestor attribute,

the resource attribute, and

the selected tenant-specific data access policy; and

return the access decision to the workload.

12. The computing system of claim 11 , wherein the instructions, when executed, cause the computing system to:

obtain the selected tenant-specific data access policy from the multi-tenant policy storage system in encrypted form; and

decrypt the selected tenant-specific data access policy.

13. The computing system of claim 11 , wherein the instructions, when executed, cause the computing system to:

based on a determination that one or more of the requestor attribute or the resource attribute are not included with the access request, obtain the one or more of the requestor attribute or the resource attribute that are not included with the access request.

14. The computing system of claim 13 , wherein the instructions, when executed, cause the computing system to:

obtain the requestor attribute from a multi-tenant attribute storage system that segments attributes corresponding to different tenants.

15. The computing system of claim 13 , wherein the instructions, when executed, cause the computing system to:

obtain the resource attribute from a multi-tenant attribute storage system that segments attributes corresponding to different tenants.

16. The computing system of claim 11 , wherein the instructions, when executed, cause the computing system to:

obtain an environment attribute corresponding to an environment in which the workload operates;

obtain a device attribute corresponding to a device from which the access request was originated; and

generate the access decision based on the environment attribute and the device attribute.

17. The computing system of claim 11 , wherein the instructions, when executed, cause the computing system to:

generate a user interface with a user actuatable tag type generation input mechanism;

detect user actuation of the tag type generation input mechanism indicative of a tag type; and

store the tag type in a tag type store.

18. The computing system of claim 11 , wherein each tenant of the plurality of tenants has a plurality of users,

the multi-tenant computing system hosts a service for the plurality of users of the plurality of tenants, and

the instructions, when executed, cause the computing system to generate the access decision to include a set of permitted actions that are permitted for the requested access.

19. The computing system of claim 15 , wherein the instructions, when executed, cause the computing system to:

generate a user interface with user actuatable tag mapping input mechanism;

detect user actuation of the tag mapping input mechanism indicative of a mapping between a tag of a tag type to a resource identity, the resource identity identifying one of a user, a device, an environment, or a computing system resource; and

store the mapping in the multi-tenant attribute storage system.

20. The computing system of claim 11 , wherein the instructions, when executed, cause the computing system to:

obtain the selected tenant-specific data access policy based on a set of mappings corresponding to the particular tenant, which each mapping of the set of mappings maps a tag of a tag type to a resource identity, the resource identity identifying one or more of a user, a device, an environment, or a computing system resource; and

generate the access decision based on the set of mapping corresponding to the particular tenant.