Amazon Technologies, Inc.

Bharath Mukkati Prakash

Ashish Rangole

Hardik Navin Nagda

Kunal Chadha

Chenxi Zhang

Nima Sharifi Mehr

William Frederick Hingle Kruse

Jeffrey John Wierer

Kai Zhao

Raymond Robert Ringhiser

Stephen Matlock

Dylan J Proulx

Scot A Marvin

Benjamin C Bernard

Paul Lynn Plummer

Gregory L Bowen

Brigid Ann Johnson

Ujjwal Rajkumar Pugalia

Radu Mihai Berciu

Zaher Dannawi

Jacob Andreas Kjelstrup

Anirudh Mattur Radhakrishna

Methods, systems, and computer-readable media for auto-tuning permissions using a learning mode are disclosed. A plurality of access requests to a plurality of services and resources by an application are determined during execution of the application in a learning mode in a pre-production environment. The plurality of services and resources are hosted in a multi-tenant provider network. A subset of the services and resources that were used by the application during the learning mode are determined. An access control policy is generated that permits access to the subset of the services and resources used by the application during the learning mode. The access control policy is attached to a role associated with the application to permit access to the subset of the services and resources in a production environment.

Auto-tuning permissions using a learning mode

A computing resource service receives a request to access the service and perform various actions. In response to the request, the computing resource service obtains a set of active policies that are applicable to the request. As a result of the service determining that the set of active policies fail to provide sufficient permissions for fulfillment of the request, the service determines if an enforcement policy is available that is applicable to the request. The service evaluates the request using the enforcement policy such that if the enforcement policy includes permissions sufficient for fulfillment of the request, the request is fulfilled.

Access control monitoring through policy management

A policy/resource decommissioning service determines whether a resource has been inactive for a period of time greater than at least one period of time threshold for decommissioning. If the resource has been inactive greater than a first period of time threshold, the service disables the resource such that requests to access the resource are denied. If the resource has been inactive for a period of time greater than a second threshold, longer than the first period of time threshold, the service archives the resource. The service deletes the resource if the inactivity period of the resource is greater than a third period of time threshold, where the third period of time threshold is longer than the first and the second period of time thresholds.

Automatic account resource and policy decommissioning

A customer's resources are protected from malicious or accidental deletion or termination. In some embodiments anomaly detection is used for identifying suspicious activities, which is combined with options to restore previously deleted resources. To define and detect anomalies, resource profiles are generated indicative of how resources are being used, and user profiles of how users use resources of the compute service provider. Instead of immediately deleting a resource, a temporary marker can be placed on the resource. The temporary marker blocks attempts to access the resource just as if the resource was deleted. However, the resource can easily be recovered by simply removing the marker. When a deletion event is identified as anomalous, an alert is generated to the customer. Upon receiving the alert, customers can opt to restore the resource that has been deleted, which will remove the marker.

Anamoly detection and recovery of a corrupted computing resource

Disclosed are various embodiments for a documentation system. Documentation topics for publishing in a node are received from a client. Embodiments of the disclosure determine whether the documentation topic has been assigned a topic identifier. Topic identifiers are assigned if the documentation topic has not been assigned a topic identifier and the documentation topic is assigned to at least one node in the documentation system. The documentation topics are stored in a data store and the topic identifiers are transmitted to the client. The topics are then published in at least one node of the documentation system.

Documentation system

Growing community of inventors

Bellevue, WA, United States of America

Bharath Mukkati Prakash