Management of service permissions
A request to modify a set of permissions (e.g., delete the permissions, replace the set of permissions with a different set of permissions) is received at a computing device. A set of services are prevented from using the set of permissions to access resources. The set of permissions are changed while the set of services are prevented from using the set of permissions to access resources.
1. A computer-implemented method, comprising:
obtaining a request to perform an operation on a set of permissions, wherein a role includes the set of permissions and the role is available to a service in multiple regions of a service provider to use the set of permissions to access resources on behalf of an entity associated with the service provider, and the operation includes deleting or modifying the role;
submitting a plurality of tasks to concurrently lock the role from being used in the multiple regions, a first task of the plurality of tasks, as a result of execution, locks the role from being used to access the resources, based at least in part on a permission of the set of permissions, within a subset of regions of the multiple regions that form a batch of regions, wherein the batch of regions includes a first region that lacks at least one hardware component with at least one other region of the multiple regions;
as a result of the plurality of tasks successfully concurrently locking the role from being used in the multiple regions within a timeout period associated with at least one of the batch of regions, performing the operation on the set of permissions while the set of permissions is prevented from being used by the service in the multiple regions; and
as a result of determining that the operation is no longer performed on the set of permissions, causing the role to be unlocked in the multiple regions.
2. The computer-implemented method of claim 1 , wherein the first task comprises:
determining an endpoint for the first region;
submitting a different request to the endpoint to lock use of the role in the first region; and
obtaining an indication that the request successfully locked use of the role in the first region.
3. The computer-implemented method of claim 1 , wherein two or more nodes of a distributed system concurrently lock use of the role in different regions of the multiple regions.
4. The computer-implemented method of claim 1 , wherein the plurality of tasks includes a second task that concurrently lock use of the role in a second subset of regions of the multiple regions that form a second batch of regions.
5. A system, comprising memory to store instructions that, as a result of execution by one or more processors, cause the system to:
obtain a request to perform an operation on a set of permissions, where the set of permissions are included in a role that is usable by one or more entities to obtain a grant of access to one or more computing resources associated with a set of services in a plurality of regions according to the set of permissions included in the role, and the operation includes deleting or modifying the role;
submit a plurality of tasks to concurrently lock the role, as a result of executing a first task of the plurality of tasks, the set of services preventing the one or more entities from using the role to access the one or more computing resources associated with the set of services by using the role to obtain the grant of access to a resource of one or more computing resources in a batch of regions that include a subset of regions of the plurality of regions, wherein the batch of regions include a first region lacks at least one hardware component with at least one other region of the plurality of regions;
as a result of execution of the plurality of tasks successfully concurrently locking, within a timeout period associated with at least one of the batch of regions, the set of services from using the role to access the one or more computing resources within the plurality of regions, perform the operation on the set of permissions while preventing the set of services from using the set of permissions to access the one or more computing resources of the plurality of regions; and
as a result of performing the operation on the set of permissions, cause the role to be unlocked in the plurality of regions.
6. The system of claim 5 , wherein the instructions to submit the plurality of tasks further include instructions that cause the system to:
make available, to the set of services, an indication to prevent access to the set of permissions to access the one or more computing resources; and
determine the set of services prevented access to the set of permissions to access the one or more computing resources.
7. The system of claim 6 , wherein the instructions to make available, to the set of services, the indication to prevent access to the set of permissions to access the one or more computing resources include instructions that cause the system to:
determine a service endpoint for a service of the set of services; and
submit a second request to the service endpoint, wherein the second request indicates to prevent access to the set of permissions to access the one or more computing resources based at least in part on the role.
8. The system of claim 7 , wherein the instructions to determine the service endpoint include instructions that cause the system to determine the service endpoint based at least in part on information obtainable from a deployment package associated with the service.
9. The system of claim 5 , wherein the instructions to perform the operation on the set of permissions while preventing the set of services from using the set of permissions to access the one or more computing resources include instructions that cause the system to perform the operation on the set of permissions within a threshold time.
10. The system of claim 9 , wherein the threshold time is calculated based at least in part on information obtainable from a deployment package associated with a service of the set of services.
11. The system of claim 5 , wherein the instructions to perform the operation on the set of permissions includes instructions to lose access to the one or more computing resources.
12. The system of claim 5 , wherein the instructions to submit the plurality of tasks utilizes an asynchronous queue.
13. A non-transitory computer-readable storage medium storing executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:
obtain a request to perform an operation on a set of permissions, wherein the set of permissions are included in a role that is usable by a service to call other services on behalf of an entity with access to a set of regional services, and the operation includes deleting or modifying the role;
submit a plurality of tasks to lock the role in a plurality of regions, a first task of the plurality of tasks, as a result of execution, prevents use of the role to access resources, by the set of regional services based at least in part on the set of permissions included in the role, in a batch of regions that include a subset of regions of the plurality of regions, wherein the batch of regions include a first region that lacks at least one hardware component with at least one other region of the plurality of regions;
as a result of the plurality of tasks successfully preventing use of the set of permissions to access the resources by the set of regional services in the plurality of regions within a timeout period associated with at least one of the batch of regions, perform the operation on the set of permissions while preventing the set of regional services from using the set of permissions to access the resources; and
cause the role to be unlocked in the plurality of regions as a result of determining that the operation is no longer performed on the set of permissions.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the role is usable by the set of regional services to fulfill one or more requests of the entity with access to the set of regional services.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the role is created in connection with use of the set of regional services by the entity.
16. The non-transitory computer-readable storage medium of claim 13 , wherein:
the instructions further cause the computer system to:
cause generation of data in a first data structure, wherein the data includes status information associated with fulfillment of the request;
cause generation of other data in a second data structure in response to preventing a first service of the set of regional services from using the set of permissions to access the resources; and
cause an update of the status information in response to performing the operation on the set of permissions; and
the instructions that cause the system to perform the operation on the set of permissions are based at least in part on using the second data structure to determine the set of regional services have been prevented from using the set of permissions to access the resources.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the first data structure and the second data structure are tables of a database.
18. The non-transitory computer-readable storage medium of claim 16 , wherein the entity lacks access to the second data structure.
19. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions to cause generation of the data include instructions that cause generation of the data to be contingent upon the first data structure lacking other data associated with fulfillment of the request.
20. The non-transitory computer-readable storage medium of claim 13 , wherein services of the set of regional services are in different regions.