Rules engine for selectively granting access to secured resources
Systems and methods for providing least privilege access to a resource within a secured server are disclosed. The systems and method can include receiving an access request from a client requesting access to the resource, the access request comprising a role or policy associated with the client and one or more actions associated with the resource. A rules engine can be initialized, the engine defining one or more rules usable by the system to determine whether the access request complies with a least privilege policy. The systems and method can analyze the role or policy and the access request with the rules engine to determine whether the access request complies with the least privilege policy. When the access request complies with the rules, access to the resource can be granted; when the access request does not comply with the rules, access to the resource can be denied.
1. A system for providing least privilege access to a resource within a secured server, the system comprising:
one or more processors; and
memory in communication with the one or more processors and storing instructions that, when executed by the one or more processors, are configured to cause the system to:
receive an access request from a client requesting access to the resource, the access request comprising a role or policy associated with the client and one or more actions associated with the resource;
initialize a rules engine defining one or more rules usable by the system to determine whether the access request complies with a least privilege policy;
analyze the role or policy and the access request with the rules engine to determine whether the access request complies with the least privilege policy;
when the access request complies with the least privilege policy, provision the access request within the secured server such that the client can perform the one or more actions within the secured server; and
when the access request does not comply with the least privilege policy:
deny access to the resource;
generate a report indicating to the client which rules of the one or more rules failed the least privilege policy; and
transmit the report to the client.
2. The system of claim 1 , wherein provisioning with the access request comprises providing an access level to the resource limited based on the role or policy associated with the client.
3. The system of claim 1 , wherein:
the one or more rules comprises a wildcard limiting rule configured to deny access to a resource responsive to the access request comprising a wildcard resource or a wildcard action; and
the instructions are configured to cause the system to determine that the access request does not comply with the least privilege policy when the access request comprises the wildcard resource or the wildcard action.
4. The system of claim 1 , wherein analyzing the access request with the rules engine to determine whether the access request complies with the least privilege policy comprises:
evaluating whether the one or more actions associated with the resource are permissible for the resource within the secured server.
5. The system of claim 1 , wherein:
the one or more rules comprises a negation limiting rule configured to deny access to a resource responsive to the access request comprising a negated resource or a negated action; and
the instructions are configured to cause the system to determine that the access request does not comply with the least privilege policy when the access request comprises the negated resource or the negated action.
6. The system of claim 1 , wherein the instructions are configured to cause the system to determine that the access request does not comply with the least privilege policy when a first role association associated with the role or policy is different than a second role association associated with the resource.
7. The system of claim 1 , wherein:
the system is an entity separate from the secured server; and
the secured server is associated with a cloud computing network.
8. The system of claim 1 , wherein the instructions are configured to cause the system to:
normalize the role or policy to extract an identity of the secured server, an account associated with the client, and a list of actions or resources approved for the client;
fetch actions associated with the secured server; and
fetch accounts associated with a plurality of clients and associated actions and resources mapped to the plurality of clients.
9. A method for providing least privilege access to a resource within a secured server, the method comprising:
receiving, at a transceiver associated with a rules module, an access request from a client requesting access to the resource in the secured server, the access request comprising a role or policy associated with the client and one or more actions associated with the resource;
normalizing, via a processor associated with the rules module, the role or policy to extract an identity of the secured server, an account associated with the client, and a list of actions or resources approved for the client;
fetching, via the processor, actions associated with the secured server from a database storing a plurality of actions for the secured server;
fetching, via the processor, accounts associated with a plurality of clients and associated actions and resources mapped to the plurality of clients from the database;
initializing, via the processor, a rules engine defining one or more rules usable by the rules module to determine whether the access request complies with a least privilege policy;
analyzing, via the processor, the role or policy and the access request with the rules engine to determine whether the access request complies with the least privilege policy; and
selectively granting, via the processor, access to the secured server and resource based on the analysis of the role or policy with the rules engine.
10. The method of claim 9 , wherein selectively granting access to the secured server comprises at least one of:
provisioning, via the processor and responsive to determining that the access request complies with the least privilege policy, the access request within the secured server such that the client can perform the one or more actions within the secured server; and
denying, via the processor and responsive to determining that the access request does not comply with the least privilege policy, access to the resource.
11. The method of claim 10 , further comprising:
generating, via the processor and responsive to denying access to the resource, a report indicating to the client which rules of the one or more rules failed the least privilege policy; and
transmitting, via the transceiver, the report to the client.
12. The method of claim 10 , wherein provisioning comprises providing an access level to the resource limited based on the role or policy associated with the client.
13. The method of claim 9 , wherein:
the one or more rules comprises a wildcard limiting rule configured to deny access to a resource responsive to the access request comprising a wildcard resource or a wildcard action comprising a wildcard; and
the method further comprises:
determining, via the processor, that the access request does not comply with the least privilege policy when the access request comprises the wildcard resource or the wildcard action; and
denying, via the processor and responsive to determining that the access request does not comply with the least privilege policy, access to the resource.
14. The method of claim 9 , wherein analyzing the access request with the rules engine to determine whether the access request complies with the least privilege policy comprises:
evaluating whether the one or more actions associated with the resource are permissible for the resource within the secured server.
15. The method of claim 9 , wherein:
the one or more rules comprises a negation limiting rule configured to deny access to a resource responsive to the access request comprising a negated resource or a negated action; and
the method further comprises:
determining, via the processor, that the access request does not comply with the least privilege policy when the access request comprises the negated resource or the negated action; and
denying, via the processor and responsive to determining that the access request does not comply with the least privilege policy, access to the resource.
16. The method of claim 9 , wherein:
analyzing the role or policy and the access request with the rules engine to determine whether the access request complies with the least privilege policy comprises comparing a first environmental association for the role or policy and a second environmental association for the resource; and
the method further comprises:
determining, via the processor, that the access request does not comply with the least privilege policy when first environmental association and the second environmental association are different environments; and
denying, via the processor and responsive to determining that the access request does not comply with the least privilege policy, access to the resource.
17. The method of claim 9 , wherein:
the rules module is associated with an entity separate from the secured server; and
the secured server is associated with a cloud computing network.
18. A system for providing least privilege access to a secured server, the system comprising:
one or more processors; and
memory in communication with the one or more processors and storing instructions that, when executed by the one or more processors, are configured to cause the system to:
receive an access request from a client requesting access to a resource in the secured server, the access request explicitly enumerating a role or policy associated with the client and one or more actions associated with the resource;
initialize a rules engine defining one or more rules usable by the system to determine whether the access request complies with a least privilege policy and configured to selectively permit access to the resource based on the role or policy and the one or more actions associated with the resource; and
approve or deny the one or more actions based at least in part on a comparison of the one or more actions and the one or more rules such that the instructions are configured to cause the system to:
provision the access request within the secured server such that the client can perform the one or more actions within the secured server when the access request complies with the least privilege policy; and
deny access to the resource, generate a report indicating to the client which rules of the one or more rules failed the least privilege policy, and transmit the report to the client when the access request does not comply with the least privilege policy.
19. The system of claim 18 , wherein the one or more rules comprises at least one of:
a wildcard limiting rule configured to deny access to a resource responsive to the access request comprising a wildcard resource or a wildcard action comprising a wildcard;
a first rule configured to evaluate whether the one or more actions are permissible for the resource within the secured server;
a negation limiting rule configured to deny access to a resource responsive to the access request comprising a negated resource or a negated action; and
a second rule configured to evaluate a first environmental association for the role or policy and a second environmental association for the resource.
20. The system of claim 18 , wherein determining whether the access request complies with a least privilege policy comprises evaluating whether the one or more actions associated with the resource are permissible for the resource within the secured server.