Amazon Technologies, Inc.

Daniel George Peebles

Neha Rungta

Andrew Jude Gacek

Carsten Varming

John Byron Cook

Sean McLaughlin

Homer Strong

Ujjwal Rajkumar Pugalia

Matthias Schlaipfer

Daniel Kroening

John Michael Renner

Jihong Chen

Alex Li

Erin Westfall

Alejandro Naser Pastoriza

Himanshu Gupta

Marvin Michael Theimer

Rebecca Claire Weiss

Brigid Ann Johnson

Willem Conradie Visser

Kasper Søe Luckow

Zhen Zhang

Jiasi Shen

Techniques for more precise access control policy findings, use a conditional injection of policy constraints into a findings analysis. The injection of a policy constraint of a policy being analyzed into the findings analysis is conditioned on the policy itself. In particular, the injection is conditioned on whether the policy constraint is trusted in the context of the policy (e.g., unlikely to be spoofed or manipulated in the policy context). As a result, where a policy constraint can be trusted in the context of a given policy, a more precise (e.g., more specific) findings analysis of the policy based on the policy constraint can be conducted than if the policy constraint were not included in the policy finding analysis (e.g., because the policy constraint is not trusted in other policy contexts).

Conditional access control policy finding generation

Conflicts may be detected between a generated access management policy and invoked identity and access management policies. An access management policy to be updated to provide expected results for example requests may be received. Another access management policy that would be invoked to evaluate the example access requests may be identified. A conflict between the expected results for the updates and the invoked access management policy may be determined. An indication of the conflict between the expected results of the example requests may be provided.

Detecting conflicts between a generated access management policy and invoked access management policies

Methods, systems, and computer-readable media for analysis of role reachability with transitive tags are disclosed. An access control analyzer determines a graph including nodes and edges. The nodes represent roles in a provider network hosting resources. The roles are associated with access control policies granting or denying access to individual resources. One or more of the access control policies grant or deny access based (at least in part) on key-value attributes. The access control analyzer determines, based (at least in part) on a role reachability analysis of the graph, whether a first role can assume a second role using role assumption steps for a particular state of the attributes. The attributes may include transitive attributes that persist during the role assumption steps.

Analysis of role reachability with transitive tags

Resource state validation may be performed for access management policies by an identity and access management system. An access management policy associated with an account for network-based services may be received and validated according to resource state obtained for resources associated with the account. A correction for a portion of the access management policy may be identified according to the validation and provided via an interface for the identity and access management system.

Resource state validation of access management policies

Methods, systems, and computer-readable media for analysis of role reachability using policy complements are disclosed. An access control analyzer determines two nodes in a graph that potentially have a common edge. The nodes correspond to roles in a provider network, and the roles are associated with first and second access control policies that grant or deny access to resources. The access control analyzer performs a role reachability analysis that determines whether the first role can assume the second role for a particular state of one or more key-value tags. The role reachability analysis determines a third access control policy authorizing a negation of a role assumption request for the second role. The role reachability analysis performs analysis of the third access control policy with respect to a role assumption policy for the second role for the particular state of the one or more key-value tags.

Analysis of role reachability using policy complements

Methods, systems, and computer-readable media for generating access control policies using static analysis are disclosed. An access control policy generator performs static analysis of program code of a software product. The static analysis identifies one or more calls to one or more external components in the program code. The access control policy generator determines a mapping of the one or more calls to one or more actions. The one or more actions are selected from a plurality of known actions supported by an access control policy manager. The access control policy generator generates an access control policy associated with the software product. The access control policy comprises one or more permissions with respect to the one or more external components. The access control policy permits the software product to access the plurality of external components using the access control policy manager during execution of the software product.

Generating access control policies using static analysis

Techniques for intent-based access control are described. A method of intent-based access control may include receiving, via a user interface of an intent-based governance service, one or more intent statements associated with user resources in a provider network, the one or more intent statements expressing at least one type of action allowed to be performed on the user resources, compiling the one or more intent statements into at least one access control policy, and associating the at least one access control policy with the user resources.

Intent-based governance

Techniques are described for generating a specification of security-relevant behavior associated with web services of a cloud provider network. Source code or software development artifacts associated with an implementation of a web service is obtained, where the source code of software development artifacts include an implementation of a request handler for an action of the service. The request handler includes a request authorization component, e.g., which may involve interaction with an identity and access management service of the cloud provider network to authenticate and authorize requests and may further rely upon one or more authorization contexts included in the requests received by the request handler. An interprocedural data flow analyzer is used to analyze a model representation of the bytecode to identify and generate specifications of authorization patterns associated with the request handler.

Analyzing web service frontends to extract security-relevant behavior information

Access management policies may be generated from example requests. An access management policy may be received. One or more example requests that have expected results when evaluated with respect to the access management policy may be received. Updates to the access management policy may be determined that cause the expected results to occur when a new version of the access management policy based on the updates is enforced. The new version of the access management policy may be generated based on the updates.

Generating access management policies from example requests

Techniques are described for using compositional reasoning techniques to perform role reachability analyses relative to collections of user accounts and roles of a cloud provider network. Delegated role-based resource management generally is a method for controlling access to resources in cloud provider networks and other distributed systems. Many cloud provider networks, for example, implement identity and access management subsystems using this approach, where the concept of 'roles' is used to specify which resources can be accessed by people, software, or (recursively) by other roles. An abstraction of the role reachability analysis is provided that can be used as input to a model-checking application to reason about such role reachability questions (e.g., which roles of an organization are reachable from other roles).

Growing community of inventors

Richland, WA, United States of America

Daniel George Peebles