Managing pre-provisioning of resources using bitemporal analysis
Embodiments disclosed are directed to ensuring resource compliance within a cloud-based environment. The embodiments include steps for performing pre-provisioning checks of resources, such as network protocols, prior to their deployment within the cloud-based environment. These steps include using bitemporal analysis to determine the impact of deploying resources within the environment through the use of multiple execution timelines where the impact of deploying a resource may be evaluated on an alternative timeline that does not change the current resource scope of the cloud-based environment.
1. A computer-implemented method for improving protocol compliance in a cloud network by performing a pre-provisioning check on a new protocol, the method comprising:
storing a current execution timeline of the cloud network, wherein the current execution timeline includes a current resource scope of the cloud network;
receiving, at a compliance system associated with the cloud network, a request to provision a new protocol in the cloud network; and
prior to provisioning the new protocol in the cloud network, initiating, by the compliance system, a pre-provisioning evaluation of the new protocol, wherein initiating the pre-provisioning evaluation comprises:
duplicating the current resource scope to an alternate resource scope in an alternate execution timeline;
providing provisioning data associated with the new protocol, wherein the provisioning data comprises information to provision the new protocol in the cloud network;
running the new protocol on the alternate resource scope in the alternate execution timeline; and
collecting a result of running the new protocol on the alternate resource scope.
2. The computer-implemented method of claim 1 , wherein the result indicates an alternate impact on the current resource scope of the cloud network.
3. The computer-implemented method of claim 2 , further comprising:
responsive to the alternate impact indicating that the new protocol is compliant with the cloud network, applying the new protocol to the current execution timeline of the cloud network; and
responsive to the alternate impact indicating that the new protocol is non-compliant with the cloud network, preventing application of the new protocol to the current execution timeline of the cloud network.
4. The computer-implemented method of claim 3 , wherein when the alternate impact identifies at least one resource that violates the current resource scope of the cloud network, the alternate impact indicates that the new protocol is non-compliant with the cloud network.
5. The computer-implemented method of claim 3 , further comprising:
responsive to the alternate impact indicating that the new protocol is non-compliant with the cloud network, returning a failure message indicating that the new protocol was prevented from being applied to the current execution timeline.
6. The computer-implemented method of claim 1 , further comprising:
receiving a query for the current execution timeline of the cloud network; and
returning, responsive to the query, the current resource scope, wherein the current resource scope indicates a plurality of policies that are provisioned in compliance with the cloud network.
7. The computer-implemented method of claim 1 , wherein the request is a hook call from a pre-provisioning interface, wherein the pre-provisioning interface is implemented separately from the compliance system.
8. A compliance system for a cloud network, the compliance system comprising:
a memory;
a processor configured to:
store a current execution timeline of the cloud network, wherein the current execution timeline includes a current resource scope of the cloud network;
receive, at the compliance system associated with the cloud network, a request to provision a new protocol in the cloud network; and
prior to provisioning the new protocol in the cloud network, initiate, by the compliance system, a pre-provisioning evaluation of the new protocol, wherein to initiate the pre-provisioning evaluation, the processor is further configured to:
duplicate the current resource scope to an alternate resource scope in an alternate execution timeline;
provide provisioning data associated with the new protocol, wherein the provisioning data comprises information to provision the new protocol in the cloud network;
run the new protocol on a hypothetical resource scope in a hypothetical execution timeline; and
collect a result of running the new protocol on the hypothetical resource scope.
9. The system of claim 8 , wherein the result indicates a hypothetical impact on the current resource scope of the cloud network.
10. The system of claim 9 , the processor is further configured to:
responsive to the hypothetical impact indicating that the new protocol is compliant with the cloud network, apply the new protocol to the current execution timeline of the cloud network; and
responsive to the hypothetical impact indicating that the new protocol is non-compliant with the cloud network, prevent application of the new protocol to the current execution timeline of the cloud network.
11. The system of claim 10 , wherein when the hypothetical impact identifies at least one resource that violates the current resource scope of the cloud network, the hypothetical impact indicates that the new protocol is non-compliant with the cloud network.
12. The system of claim 10 , the processor is further configured to:
responsive to the hypothetical impact indicating that the new protocol is non-compliant with the cloud network, return a failure message indicating that the new protocol was prevented from being applied to the current execution timeline.
13. The system of claim 8 , the processor is further configured to:
receive a query for the current execution timeline of the cloud network; and
return, responsive to the query, the current resource scope, wherein the current resource scope indicates a plurality of policies that are provisioned in compliance with the cloud network.
14. The system of claim 8 , wherein the request is a hook call from a pre-provisioning interface, wherein the pre-provisioning interface is implemented separately from the compliance system.
15. A non-transitory computer-readable medium storing instructions, the instructions, when executed by a processor in a compliance system of a cloud network, cause the processor to perform operations comprising:
storing a current execution timeline of the cloud network, wherein the current execution timeline includes a current resource scope of the cloud network;
receiving, at the compliance system associated with the cloud network, a request to provision a new protocol in the cloud network, wherein the compliance system comprises a maintenance module, a collection module, and an evaluation module;
prior to provisioning the new protocol in the cloud network, initiating, by the maintenance module, a pre-provisioning evaluation of the new protocol, wherein initiating the pre-provisioning evaluation comprises:
duplicating the current resource scope to a hypothetical resource scope in a hypothetical execution timeline;
providing provisioning data associated with the new protocol, wherein the provisioning data comprises information to provision the new protocol in the cloud network;
running the new protocol on the hypothetical resource scope in the hypothetical execution timeline; and
collecting a result of running the new protocol on the hypothetical resource scope.
16. The non-transitory computer-readable medium of claim 15 , wherein the result indicates a hypothetical impact on the current resource scope of the cloud network.
17. The non-transitory computer-readable medium of claim 16 , the operations further comprising:
responsive to the hypothetical impact indicating that the new protocol is compliant with the cloud network, applying the new protocol to the current execution timeline of the cloud network; and
responsive to the hypothetical impact indicating that the new protocol is non-compliant with the cloud network, preventing application of the new protocol to the current execution timeline of the cloud network.
18. The non-transitory computer-readable medium of claim 17 , wherein when the hypothetical impact identifies at least one resource that violates the current resource scope of the cloud network, the hypothetical impact indicates that the new protocol is non-compliant with the cloud network.
19. The non-transitory computer-readable medium of claim 17 , the operations further comprising:
responsive to the hypothetical impact indicating that the new protocol is non-compliant with the cloud network, returning a failure message indicating that the new protocol was prevented from being applied to the current execution timeline.
20. The non-transitory computer-readable medium of claim 15 , the operations further comprising:
receiving a query for the current execution timeline of the cloud network; and
returning, responsive to the query, the current resource scope, wherein the current resource scope indicates a plurality of policies that are provisioned in compliance with the cloud network.