Oracle International Corporation

Other

Amazon Technologies, Inc.

Daniel Music Vogel

Helali Bhuiyan

Girish Nagaraja

Nathaniel Martin Glass

Jonathan Jorge Nadal

Mohamed Saber Abdelfattah Hassan

Ayman Mohammed Aly Hassan Elmenshawy

Geoff Hopcraft

Yu Wu

Johannes Klein

Danne Lauren Stayskal

Venkata S Evani

Sahitya Gollapudi

A M Helali Mortuza Bhuiyan

Jyotishman Nag

Kevin Ross O'Neill

Timothy M Sehn

Matthew Rushton

Shobhank Sharma

Aaron D Son

Norka Beatriz Lucena Mogollon

Kirils Zaicenko

Vladimir Nikolayevich Krayushkin

Atul Goyal

Jason Bolla

Kolton D Andrus

Techniques for controlling resource deployments in a cloud partition of a cloud environment are disclosed. A cloud service provider (CSP) operates the cloud environment where its customers can specify two-tiered constraints on deployments to their respective partitions (i.e., regions or realms). A first deployment constraint may be a global constraint set by the CSP and a second deployment constraint may be a partition-specific deployment constraint set by a customer of the CSP. Each deployment constraint applies to the changes/updates that can be made to one or more specific partitions. A global deployment orchestrator conditions a deployment, at least in part, on whether the deployment satisfies the two-tiers of deployment constraint(s).

Deployment control over cloud resources

A policy management service receives a request for an authorization policy in a language-localized syntax. The policy management service identifies a syntax graph corresponding to the authorization policy and traverses the syntax graph to obtain at least a requestor variable value associated with the authorization policy, an action variable value associated with the authorization policy, a resource variable value associated with the authorization policy, and a location variable value associated with the authorization policy. The policy authorization service generates a reader-friendly policy statement in the language localized syntax using the requestor variable value, the action variable value, the resource variable value, and the location variable value. Responsive to the request, the policy authorization service provides the reader-friendly policy statement.

Language-localized policy statements

Techniques for managing network-accessible infrastructure metadata are provided. A method includes receiving a resource request comprising resource metadata corresponding to a network-accessible infrastructure resource, determining whether to commit the resource request based at least in part on a constraint associated with the network-accessible infrastructure resource, and, in accordance with a determination to commit the resource request: generating, by the computer system, a resource identifier describing resource metadata in accordance with the resource request, storing, by the computer system, the resource metadata in a data store in communication with the computer system, receiving, by the computer system, a data request to provide the resource metadata described by the resource identifier, and providing, by the computer system, the resource metadata described by the resource identifier in accordance with the data request.

Centralized approach for managing cross-service data of cloud resources

Techniques are described for providing a multi-cloud control plane (MCCP) in a first cloud infrastructure (included in a first cloud environment provided by a first cloud services provider) that enables services and/or resources provided in the first cloud infrastructure to be utilized by users of a second cloud environment. The first cloud infrastructure receives a request from a user associated with an account in the second cloud infrastructure. The request corresponding to using a service provided by the first cloud infrastructure. A tenancy is created for the user in the first cloud infrastructure to enable the user to utilize the service, and a link-resource object is created that includes information linking the tenancy of the user in the first cloud infrastructure to the account of the user in the second cloud infrastructure, the link-resource object enabling the user to utilize the service provided by the first cloud infrastructure.

Propagating identities across different cloud services providers

Cloud-link adaptor of a multi-cloud infrastructure

Techniques are disclosed for creating an attachment between two compute instances. An infrastructure and a generalized method is described for attaching two or more cloud resources (e.g., two compute instances) in spite of the compute resources being provisioned by two different services from different cloud tenancies. An automated process is described that is executed for wiring the compute instances. The automated process can be generally applied to attach any two compute instances providing two different services and provisioned from two different service tenancies.

Attachment and detachment of compute instances owned by different tenancies

A framework for managing authorization for performance of actions with a computing system. For example, techniques for performing authorization of users and/or clients for access to an infrastructure service provided by a cloud servicer provider (CSP) and/or for performance of actions with the infrastructure service.

Quorum-based authorization

A framework for managing credentials for access to a secured entity of an infrastructure service. For example, techniques for maintaining credentials for access to the secured entity within a trusted environment while utilizing the credentials for performance of actions within the infrastructure service.

Authorization brokering

Techniques are described for enabling resources within a cloud computing system to interact with each other. In certain embodiments, a base identifier assigned to a first resource is extended by mapping the base identifier onto a second identifier assigned to a logical resource that is built upon the first resource. This allows the first resource to have two identities, one identity indicating what the first resource is (e.g., a particular compute instance) and another identity indicating the purpose of the first resource (e.g., operating as a database for a particular tenancy). Consequently, the first resource may be provided with access privileges different from those associated with the base identifier. For example, the first resource may access another resource in the tenancy using the second identifier, but may have no access to the other resource using the base identifier.

Stacked identities for resource principals

Techniques are described for enabling resources within a cloud computing system to interact with each other. In certain embodiments, a resource is assigned a digital token that provides certain access privileges for the duration in which the digital token is valid. The digital token permits the resource to have access for a duration sufficient to perform some operation (e.g., run one-time code or the same code periodically on a scheduled basis), but without extending the level of access for significantly longer than necessary to complete the operation. Each time the resource principal is to perform the operation, the token can be reissued to the resource to provide the resource with time-limited access privileges. The use of this short-lived token avoids having to create permanent credentials for the resource.

Access control for short-lived resource principals

Techniques are described for enabling resources within a cloud computing system to interact with each other. In certain embodiments, a token renewal mechanism is provided for extending the duration in which a first resource can access another resource. The token renewal mechanism can involve the first resource periodically causing a new credential to be generated for itself and then communicating the new credential to an identity and access management (IAM) system. The new credential may be generated for compliance with a credential rotation policy specifying that credentials should be changed after a certain period of time. The IAM system may associate a digital access token with the new credential so that for subsequent requests, the IAM system will only recognize the resource principal based upon the new credential. The digital token can be invalidated if a new credential is not changed within the specified period of time.

Access control for long-lived resource principals

Techniques for generating and using reader-friendly policy statements are disclosed. In one or more embodiments, a policy management service receives a request for an authorization policy in a language-localized syntax. The policy management service identifies a syntax graph corresponding to the authorization policy and traverses the syntax graph to obtain at least a requestor variable value associated with the authorization policy, an action variable value associated with the authorization policy, a resource variable value associated with the authorization policy, and a location variable value associated with the authorization policy. The policy authorization service generates a reader-friendly policy statement in the language-localized syntax using the requestor variable value, the action variable value, the resource variable value, and the location variable value. Responsive to the request, the policy authorization service provides the reader-friendly policy statement.

Growing community of inventors

Seattle, WA, United States of America

Daniel Music Vogel