Visual exploration for efficient access analysis for cloud provider entities
An access policy analysis system may use visual exploration to efficiently perform access analysis. A request to display an effective access of an entity with respect to a resource hosted in a cloud provider may be received via a visual exploration user interface element. An analysis of a set of access policies applied by an access management system to determine an effective access of the entity with respect to the resource may be performed. One or more selectable access policy interface elements may be generated that correspond to one or more access policies of the set of access policies that are used to determine the effective access of the entity with respect to the resource. The one or more selectable access policy interface elements may be included in a display of the visual exploration user interface element along with the determined effective access of the entity with respect to the resource.
1. A system for analyzing access policies controlling access by one or more entities to one or more cloud computing resources hosted by a cloud service provider, the system comprising:
one or more hardware processors configured to:
receive, via a visual exploration graphical user interface (GUI), a request to display actions that an entity is allowed to perform with respect to a cloud computing resource; and
responsive to receiving the request:
analyze a set of access policies applied by a platform of the cloud service provider to identify, from among the set of access policies, a subset of one or more access policies applicable to the entity and the cloud computing resource;
determine, using the subset of one or more access policies, a first set of one or more actions that the entity is allowed to perform with respect to the cloud computing resource; and
generate, within the visual exploration GUI:
one or more selectable GUI elements corresponding to one or more access policies in the subset of one or more access policies, and
one or more GUI elements corresponding to one or more actions in the first set of one or more actions;
simulate, within the visual exploration GUI, updating a set of controlling policies, the simulating comprising:
receiving input, via at least one of the one or more selectable GUI elements, indicating that at least one of the one or more access policies is to be added to or removed from the set of controlling policies, and
responsive to the input, updating the visual exploration GUI to display a second set of one or more actions that the entity would be allowed to perform with respect to the cloud computing resource if the at least one or more of the one or more access policies were added to or removed from the set of controlling policies, wherein the first set of one or more actions is different from the second set of one or more actions;
configure the platform of the cloud service provider to control access to the one or more cloud computing resources in accordance with an updated set of controlling policies obtained via the addition or removal of the at least one of the one or more access policies to or from the set of controlling policies; and
cause the platform of the cloud service provider to execute one or more security services in accordance with the updated set of controlling policies.
2. The system of claim 1 , wherein the one or more hardware processors are further configured to:
update the visual exploration GUI to display one or more access levels corresponding to the second set of one or more actions.
3. The system of claim 1 , wherein the input indicating that at least one of the one or more access policies is to be added or removed from the set of controlling policies indicates that the at least one of the one or more access policies is to be removed from the set of controlling policies.
4. The system of claim 1 , wherein the one or more selectable GUI elements corresponding to one or more access policies in the subset of access policies are displayed in a policy stack that organizes access policies into one or more policy types, and wherein the one or more policy types are arranged in an order of applicable scope.
5. The system of claim 1 , wherein the cloud computing resource is selected from the group consisting of: a service resource, a system resource, an application resource, a data storage resource, a networking resource, an orchestration resource, and a metrics resource.
6. The system of claim 1 , wherein the one or more hardware processors are further configured to generate, within the visual exploration GUI: one or more actions, and one or more GUI elements corresponding to one or more access levels associated with the one or more actions in the first set of one or more actions.
7. The system of claim 1 , wherein the visual exploration GUI is implemented as part of a user interface of a cloud security service.
8. A method for analyzing access policies controlling access by one or more entities to one or more cloud computing resources hosted by a cloud service provider, the method comprising:
using one or more hardware processors to perform:
receiving, via a visual exploration graphical user interface (GUI), a request to display actions that an entity is allowed to perform with respect to a cloud computing resource; and
responsive to receiving the request:
analyzing a set of access policies applied by a platform of the cloud service provider to identify, from among the set of access policies, a subset of one or more access policies applicable to the entity and the cloud computing resource;
determining, using the subset of one or more access policies, a first set of one or more actions that the entity is allowed to perform with respect to the cloud computing resource; and
generating, within the visual exploration GUI;
one or more selectable GUI elements corresponding to one or more access policies in the subset of one or more access policies, and
one or more GUI elements corresponding to one or more actions in the first set of one or more actions;
simulating, within the visual exploration GUI, updating a set of controlling policies, the simulation comprising:
receiving input, via at least one of the one or more selectable GUI elements, indicating that at least one of the one or more access policies is to be added to or removed from the set of controlling policies, and
responsive to the input, updating the visual exploration GUI to display a second set of one or more actions that the entity would be allowed to perform with respect to the cloud computing resource if the at least one of the one or more access policies were added to or removed from the set of controlling policies, wherein the first set of one or more actions is different from the second set of one or more actions;
configuring the platform of the cloud service provider to control access to the one or more cloud computing resources in accordance with an updated set of controlling policies obtained via the addition or removal of the at least one of the one or more access policies to or from the set of controlling policies; and
causing the platform of the cloud service provider to execute one or more security services in accordance with the updated set of controlling policies.
9. The method of claim 8 , further comprising:
updating the visual exploration GUI to display one or more access levels corresponding to the second set of one or more actions.
10. The method of claim 8 , wherein the input indicating that at least one of the one or more access policies is to be added or removed from the set of controlling policies indicates that the at least one of the one or more access policies is to be removed from the set of controlling policies.
11. The method of claim 8 , wherein the one or more selectable GUI elements corresponding to one or more access policies in the subset of access policies are displayed in a policy stack that organizes access policies into one or more policy types, and wherein the one or more policy types are arranged in an order of applicable scope.
12. The method of claim 8 , wherein the subset of access policies is displayed in a policy viewer portion of the visual exploration GUI.
13. The method of claim 8 , further comprising:
generating, within the visual exploration GUI, one or more GUI elements corresponding to one or more access levels associated with the one or more actions in the first set of one or more actions.
14. The method of claim 8 , wherein the visual exploration GUI is implemented as part of a user interface of a cloud security service.
15. One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more hardware processors, cause the one or more hardware processors to perform:
receiving, via a visual exploration graphical user interface (GUI), a request to display actions that an entity is allowed to perform with respect to a cloud computing resource; and
responsive to receiving the request:
analyzing a set of access policies applied by a platform of a cloud service provider to identify, from among the set of access policies, a subset of one or more access policies applicable to the entity and the cloud computing resource;
determining, using the subset of one or more access policies, a first set of one or more actions that the entity is allowed to perform with respect to the cloud computing resource; and
generating, within the visual exploration GUI:
one or more selectable GUI elements corresponding to one or more access policies in the subset of access policies, and
one or more GUI elements corresponding to one or more actions in the first set of one or more actions;
simulating, within the visual exploration GUI, updating a set of controlling policies, the simulation comprising:
receiving input, via at least one of the one or more selectable GUI elements, indicating that at least one of the one or more access policies is to be added to or removed from the set of controlling policies, and
responsive to the input, updating the visual exploration GUI to display a second set of one or more actions that the entity would be allowed to perform with respect to the cloud computing resource if the at least one of the one or more access policies were added to or removed from the set of controlling policies, wherein the first set of one or more actions is different from the second set of one or more actions;
configuring the platform of the cloud service provider to control access to the one or more cloud computing resources in accordance with an updated set of controlling policies obtained via the addition or removal of the at least one of the one or more access policies to or from the set of controlling policies; and
causing the platform of the cloud service provider to execute one or more security services in accordance with the updated set of controlling policies.
16. The one or more non-transitory computer-accessible storage media of claim 15 , storing further program instructions that further cause the one or more hardware processors to perform:
updating the visual exploration GUI to display one or more access levels corresponding to the second set of one or more actions.
17. The one or more non-transitory computer-accessible storage media of claim 15 , wherein the input indicating that the at least one of the one or more access policies is to be added or removed from the set of controlling policies indicates that the at least one of the one or more access policies is to be removed from the set of controlling policies.
18. The one or more non-transitory computer-accessible storage media of claim 15 , wherein the one or more selectable GUI elements corresponding to the one or more access policies in the subset of one or more access policies are displayed in a policy stack that organizes access policies into one or more policy types, and wherein the one or more policy types are arranged in an order of applicable scope.
19. The one or more non-transitory computer-accessible storage media of claim 15 , wherein the subset of one or more access policies is displayed in a policy viewer portion of the visual exploration GUI.
20. The one or more non-transitory computer-accessible storage media of claim 15 , wherein the visual exploration GUI is implemented as part of a user interface of a cloud security service.