Intel Corporation

Amazon Technologies, Inc.

Aol Inc.

Facebook, Inc.

Google Inc.

America Online, Inc.

Aol Llc, a Delaware Limited Liability Company

Time Warner Inc.

Bright Sun Technologies

Conor Patrick Cahill

Jason Martin

Ned M Smith

Micah James Sheller

David Wexelblat

David L Biderman

David S Bill

Jasmeet Chhabra

Scott K Brown

Michael Lester Wise

Stephen E Loomis

David F Pare

Dmitry Frenkel

William Frederick Hingle Kruse

Daniel Stephen Popick

Andrew Paul Mikulski

Colin Watson

Harshad Vasant Kulkarni

Rachit Jain

Jeffrey Cicero Canton

Brandon Baker

Sanjay Bakshi

Victoria C Moore

Christopher Newell Toomey

Vinay Phegade

Brigid Ann Johnson

Praveen Akinapally

Eric Jason Brandwine

Gregory Branchek Roth

James Anthony Roskind

Hong C Li

Hang Li

Graeme David Baer

Uttam K Sengupta

Cristian Marius Ilac

Khaled Salah Sedky

Norihiro Edwin Aoki

Alazel Acheson

Manohar Ruben Castelino

Spencer Stephens

Abhilasha Bhargav-Spantzel

Craig Davis Cuttner

Richard A Forand

Ramune Nagisetty

Aleksey Sanin

Wen-Ling Huang

Dennis Tighe

Ajith Harshana Ranabahu

Chase Kernan

Melissa A Cowan

Steve Orrin

Kai Zhao

Luke Edward Kennedy

Dan Popick

Mark Ryland

Eetay Natan

Divyank Duvedi

Travis William Hickey

Brian Mead Tyler

Varun Jayant Oswal

Per Mikael Horal

Rohit Raj

Dean H Saxe

Mark D Boucher

Ritwick Dhar

Jacob Andreas Kjelstrup

Ian Leung

John E Simpson, Jr

Ankur Agarwal

Kenneth W Long

Jeromy Carriere

Sulay Shah

Lennart Christopher Leon Kats

Julian Eric Naydichev

Uma Ganesh Sadras Sudhakar

Mohammed Noman Mulla

Ahmad Kayed Kamel Aljolani

Akshay Mohan Sumant

Douglas Spencer Hewitt

Ogbeide Derrick Oigiagbe

Jonathan Robert Hurd

Mingkun Wang

Mark A Mccorkle

Chenguang Yin

Kyle A Short

Apurv Awasthi

A request to add tags (e.g., labels, key-value pairs, or metadata) to resources can be digitally signed by the entity making the request, such that the source can be verified and an authorization determination made for each tag. For a request involving multiple services (or entities) that can each add tags, any tag added by a service can be included in the request and digitally signed by that service. Each service processing the request can also digitally sign the request before forwarding, so that each service signs a version of the request, which includes elements signed by other services earlier in the request chain. When the request is received to a tagging service, the service ensures that every tag was digitally signed by the appropriate authorized entity or service, and validates the signatures to ensure that no data was modified or omitted, before adding the tags to the designated resource(s).

Contribution signatures for tagging

User identities can managed at an organization level, instead of across multiple individual resource accounts. In a resource provider environment, access to various resources and services may require users to have identities with specific resource accounts. Users can instead be associated with organization accounts, or virtual accounts that are not associated with specific resources or services. The organization accounts are attached at the appropriate location(s) in an organizational hierarchy. A user having an organization account can project the identity in any sub-account in the organization hierarchy. This can include any lower-level resource account, or can child accounts under a relevant branch of the hierarchy. A user can validate against the organization account, and receive access to the relevant service or resources using the identity projected in the corresponding resource account.

Organization level identity management

An Identity and Access Management Service implements persistent source values PSVs) for assumed identities. A source value (e.g., an original identifier of an entity) is persisted across assumed identities, facilitating identification of entities (users or applications) responsible for actions taken by the assumed (e.g., alternative) identities. The Manager receives a request to assume an identity. The request includes the entities current credentials and a PSV. The current credentials are authenticated and a persistent source value policy may be relied on to determine whether and/or how to grant the assumed identity. The PSV may be copied from credentials in the request in order to be included in the credentials for the requested identity that the Manager provides in response to the request. Use of the requested credentials, including the PSV, to access services or resources may be logged, the logs including the PSV from the request to assume the identity.

Persistent source values for assumed alternative identities

Quorum-based access control management may be implemented. Quorum controls may be created for determining whether to perform or deny access control operations to perform privileged tasks. When an access control operation is received, approval of the operation may be requested from members for the quorum control. If a policy for the quorum control is satisfied by approval responses, then approval to perform the access control operation may be provided.

Quorum-based access control management

A request to modify a set of permissions (e.g., delete the permissions, replace the set of permissions with a different set of permissions) is received at a computing device. A set of services are prevented from using the set of permissions to access resources. The set of permissions are changed while the set of services are prevented from using the set of permissions to access resources.

Management of service permissions

A system for database restoration across service regions. The system includes data storage and backup data storage in the first region. The system includes a frontend for the database service configured to receive, from a client, a request to restore a database to the first region from backups stored in another backup data storage in a second region and to receive an authentication token for the request from the client. The system also includes a backup restore manager service for the first region configured to send, to another backup restore manager service implemented in the second region, a credential request for a second region credential authorizing retrieval of the one or more other backups from the second region. The backup restore manager service sends a backup restore request to retrieve the backups from the other backup data storage and loads the backups to restore the database in the first region.

Secured database restoration across service regions

Techniques for managing permissions to cloud-based resources with session-specific attributes are described. A first request to create a first session to permit access to resources of a provider network is received under an assumed role. The first request is permitted based on an evaluation of a rule associated with the role. Session data including a user-specified attribute included with the first request is generated. A second request to perform an action with a resource hosted by the provider network is received. The user-specified attribute is obtained from the session data based at least in part on the second request. The second request is permitted based on an evaluation of another rule with the user-specified attribute.

Managing permissions to cloud-based resources with session-specific attributes

A method and system for generating permissions policies and permission boundary policies are described. The system receives a first request from a central administrator to create a delegated administrator, the first request specifying with one or more access permissions. The system generates a permission boundary policy that specifies the one or more access permissions and a first permissions policy that grants permissions to the delegated administrator to at least one of create an IAM principal with the permission boundary policy or attach a second permissions policy to the IAM principal. An effective permission given to the IAM principal is an intersection of access permissions specified in the first permissions policy and the one or more access permissions in the permission boundary policy. The system attaches the first permissions policy and the permission boundary policy to the delegated administrator.

Delegated administrator with defined permission boundaries in a permission boundary policy attachment for web services and resources

Transitive restrictions can be applied to requests received on a session. A session token can be issued for an active session, and a transitivity setting specified to indicate the types of requests for which the transitive restriction is to be enforced. This can include enforcing the restriction on requests received from outside a trusted environment, requests within a scope of enforcement, or enforcing the restriction at request authentication. Any request received from an untrusted source that fails to satisfy the transitive restriction will be denied. Requests from inside the trusted environment may not have the transitive restriction enforced, such as where a new token is issued. This enables services within the environment to make calls on behalf of the customer, while ensuring that third parties obtaining the session token cannot successfully initiate such calls.

Restriction transitivity for session credentials

A security token service receives a request for a token. The request indicates a set of access control policies that define a set of permissions for access to a resource. The security token service generates the token to comprise a set of identifiers of the set of access control policies. The security token service provides the token in response to the request to enable the token to be used to access the resource in accordance with the set of access control policies.

Policy implementation using security tokens

A system and method for generating a policy entitlement map usable to provide a visualization of policies based at least in part on a set of resources of a service of a computing resource service provider, a set of actions that can be taken with the set of resources, or one or more identities. The policy entitlement map may be generated to reflect a set of actions performable by identities of the one or more identities, a set of resources accessible by the identities, or a set of actions that may be performed on the resources.

Entitlement map for policy simulation

Growing community of inventors

Waterford, VA, United States of America

Conor Patrick Cahill