Remote cloud function invocation service
The present disclosure relates to a framework that provides execution of serverless functions in a cloud environment based on occurrence of events/notifications from services in an entirely different cloud environment. A target agent obtains a notification from a source agent, where the target agent is deployed in a target cloud environment and the source agent is deployed in a source cloud environment that is different than the target cloud environment. The target agent determines a function that is to be invoked based on the notification. Upon successfully verifying whether the target agent is permitted to invoke the function that is deployed in a target customer tenancy of the target cloud environment, the target agent invokes the function in the target customer tenancy of the target cloud environment.
1. A method comprising:
deploying, by a remote function invocation service provided by a target cloud environment, a target agent in a dataplane of a target service tenancy instantiated in the target cloud environment;
deploying, by the remote function invocation service provided by the target cloud environment, a source agent in a corresponding dataplane of a source service tenancy instantiated in a source cloud environment, wherein the target cloud environment is provided by a first cloud service provider and the source cloud environment is provided by a second cloud service provider that is different than the first cloud service provider;
obtaining, by the target agent, a notification from the source agent, wherein the source agent receives the notification from a cloud resource that is deployed in a source customer tenancy of the source cloud environment and requests to utilize a function deployed in a target customer tenancy of the target cloud environment, wherein the target agent is configured to: (i) obtain an identifier associated with the notification, and (ii) query a mapping database to obtain the function associated with the identifier, wherein the mapping database is preconfigured with a plurality of mappings, each mapping identifying a particular function that is to be invoked with respect to a particular identifier;
determining, by the target agent, the function that is to be invoked based on the notification;
verifying whether the target agent that is deployed in the target service tenancy of the target cloud environment is permitted to invoke the function that is deployed in the target customer tenancy of the target cloud environment; and
responsive to a successful verification, invoking by the target agent the function in the target customer tenancy of the target cloud environment.
2. The method of claim 1 , wherein the target agent is communicatively coupled with the source agent by a secure communication channel.
3. The method of claim 1 , wherein the source agent: (i) registers with the cloud resource deployed in the source customer tenancy of the source cloud environment or polls a queue associated with the cloud resource so as to receive the notification, and (ii) forwards the notification to the target agent upon receiving the notification from the cloud resource.
4. The method of claim 1 , wherein the step of verifying further comprising:
determining whether the target agent is permitted to access the target customer tenancy in the target cloud environment in accordance with a policy associated with the target cloud environment.
5. The method of claim 4 , further comprising:
responsive to a successful determination, obtaining by the target agent a token from an identity management service of the target cloud environment; and
forwarding the token to a serverless functions service deployed in the target cloud environment.
6. The method of claim 5 , further comprising:
causing by the serverless functions service, the function deployed in the target customer tenancy of the target cloud environment to be executed.
7. The method of claim 5 , wherein the serverless functions service communicates with the identity management service of the target cloud environment to determine a set of privileges associated with the token.
8. A non-transitory computer readable medium storing specific computer-executable instructions that, when executed by a processor, cause a computer system to perform operations comprising:
deploying, by a remote function invocation service provided by a target cloud environment, a target agent in a dataplane of a target service tenancy instantiated in the target cloud environment;
deploying, by the remote function invocation service provided by the target cloud environment, a source agent in a corresponding dataplane of a source service tenancy instantiated in a source cloud environment, wherein the target cloud environment is provided by a first cloud service provider and the source cloud environment is provided by a second cloud service provider that is different than the first cloud service provider;
obtaining, by the target agent, a notification from the source agent, wherein the source agent receives the notification from a cloud resource that is deployed in a source customer tenancy of the source cloud environment and desires to utilize a function deployed in a target customer tenancy of the target cloud environment, wherein the target agent is configured to: (i) obtain an identifier associated with the notification, and (ii) query a mapping database to obtain the function associated with the identifier, wherein the mapping database is preconfigured with a plurality of mappings, each mapping identifying a particular function that is to be invoked with respect to a particular identifier;
determining, by the target agent, the function that is to be invoked based on the notification;
verifying whether the target agent that is deployed in the target service tenancy of the target cloud environment is permitted to invoke the function that is deployed in the target customer tenancy of the target cloud environment; and
responsive to a successful verification, invoking by the target agent the function in the target customer tenancy of the target cloud environment.
9. The non-transitory computer readable medium storing specific computer-executable instructions of claim 8 , wherein the target agent being communicatively coupled with the source agent by a secure communication channel.
10. The non-transitory computer readable medium storing specific computer-executable instructions of claim 8 , wherein the source agent: (i) registers with the cloud resource deployed in the source customer tenancy of the source cloud environment or polls a queue associated with the cloud resource so as to receive the notification, and (ii) forwards the notification to the target agent upon receiving the notification from the cloud resource.
11. The non-transitory computer readable medium storing specific computer-executable instructions of claim 8 , wherein the step of verifying further comprising:
determining whether the target agent is permitted to access the target customer tenancy in the target cloud environment in accordance with a policy associated with the target cloud environment.
12. The non-transitory computer readable medium storing specific computer-executable instructions of claim 11 , further comprising:
responsive to a successful determination, obtaining by the target agent a token from an identity management service of the target cloud environment; and
forwarding the token to a serverless functions service deployed in the target cloud environment.
13. The non-transitory computer readable medium storing specific computer-executable instructions of claim 12 , further comprising:
causing by the serverless functions service, the function deployed in the target customer tenancy of the target cloud environment to be executed.
14. The non-transitory computer readable medium storing specific computer-executable instructions of claim 13 , wherein the serverless functions service communicates with the identity management service of the target cloud environment to determine a set of privileges associated with the token.
15. A system comprising:
a processor; and
a memory including instructions that, when executed with the processor, cause the system to, at least:
deploy, by a remote function invocation service provided by a target cloud environment, a target agent in a dataplane of a target service tenancy instantiated in the target cloud environment;
deploy, by the remote function invocation service provided by the target cloud environment, a source agent in a corresponding dataplane of a source service tenancy instantiated in a source cloud environment, wherein the target cloud environment is provided by a first cloud service provider and the source cloud environment is provided by a second cloud service provider that is different than the first cloud service provider;
obtain, by the target agent, a notification from the source agent, wherein the source agent receives the notification from a resource that is deployed in a source customer tenancy of the source cloud environment and requests to utilize a function deployed in a target customer tenancy of the target cloud environment, wherein the target agent is configured to: (i) obtain an identifier associated with the notification, and (ii) query a mapping database to obtain the function associated with the identifier, wherein the mapping database is preconfigured with a plurality of mappings, each mapping identifying a particular function that is to be invoked with respect to a particular identifier;
determine, by the target agent, the function that is to be invoked based on the notification;
verify whether the target agent that is deployed in the target service tenancy of the target cloud environment is permitted to invoke the function that is deployed in the target customer tenancy of the target cloud environment; and
responsive to a successful verification, invoke by the target agent the function in the target customer tenancy of the target cloud environment.