Amazon Technologies, Inc.

Homer Strong

Neha Rungta

Daniel George Peebles

Lucie Klimosova

Atiye Alaeddini

Brigid Ann Johnson

Kimberly Sue Houchens

Matthew J Bales

Nicola Preli

Michael Hodgkinson

Jiasi Shen

Ralph Giovanni Caprio

Mathangi Ramesh

Conflicts may be detected between a generated access management policy and invoked identity and access management policies. An access management policy to be updated to provide expected results for example requests may be received. Another access management policy that would be invoked to evaluate the example access requests may be identified. A conflict between the expected results for the updates and the invoked access management policy may be determined. An indication of the conflict between the expected results of the example requests may be provided.

Detecting conflicts between a generated access management policy and invoked access management policies

One or more indications may be received of a decision to deny an attempted access of a computing resource by an identity. A plurality of relevant policies may be determined whose permissions are evaluated as inputs to the decision to deny. One or more denial-related policies of the relevant policies may be determined that are associated with at least one of explicitly denying or implicitly denying the attempted access. One or more denial indications may be provided of the one or more denial-related policies. The one or more denial indications may include at least one explicit deny indication of at least one of the one or more denial-related policies that explicitly denies the attempted access. The one or more denial indications may also include at least one implicit deny indication of at least one of the one or more denial-related policies that implicitly denies the attempted access.

Troubleshooting policy-based permissions

Identity management recommendations for use of existing policies are described herein. An available policy set of existing policies that are available to an identity may be determined. Selected permissions associated with permission-usage by the identity may be determined. It may be determined whether the available policy set includes one or more matching policy subsets that cover all the selected permissions without allowing any additional permissions. When the available policy set includes the one or more matching policy subsets, a first recommendation may be provided to attach, to the identity, at least one matching policy subset of the one or more matching policy subsets. When the available policy set does not include the one or more matching policy subsets, a second recommendation may be provided to attach, to the identity, one or more alternative policies.

Identity management recommendations for use of existing policies

An identity set may be selected from an identity pool of an identity management service. The identity set may be selected based on a threshold quantity of unnecessary permissions relative to one or more existing managed policies provided by the identity management service. The identity set may be grouped into a plurality of identity subsets. The grouping may be performed based at least in part on services accessed by the identity set. A plurality of candidate policies may be generated, such as by generating, for each identity subset of the plurality of identity subsets, based at least in part on a plurality of policy generation rules, a respective candidate policy. At least one candidate policy of the plurality of candidate policies may be selected as a new managed policy that is provided by the identity management service to users.

Data-based generation of managed policies

One or more indications may be received of a decision to allow an access of a computing resource by an identity. A plurality of relevant policies may be determined whose permissions are evaluated as inputs to the decision to allow. One or more explicit allow policies of the plurality of relevant access permission policies may be determined that explicitly allow the access. At least one explicit allow indication may be provided of at least one of the one or more explicit allow policies. One or more acceptable properties of the plurality of relevant access permission policies may be determined that do not need to be modified to change the decision to allow the access. One or more acceptability indications may be provided of the one or more acceptable properties.

Policy troubleshooting for unintentional allowances

Techniques for improving packaging systems are described. In an example, a computer system receives item data from a workstation. The item data includes a description of an item. The workstation is configured to facilitate packaging of the item. Based at least in part on an input to the predictive model, the computer system generates a package decision indicating a package type associated with the packaging of the item. The input is based at least in part on the item data. The predictive model is trained based at least in part on damage data associated with packaging. The computer system sends the package decision to the workstation.

Predictive packaging system

An indication to perform a permissions policy search may be received by an interface of an identity management service. A context may be determined associated with the permissions policy search. A plurality of weights for a plurality of permissions policies may be calculated based on the context. An order for display of the plurality of permissions policies may be determined based on the plurality of weights. The plurality of permissions policies may be presented, in a display area within the interface, in the order that is based on the plurality of weights. A selection of a first permissions policy from the plurality of permissions policies may be received by the interface. The first permissions policy may be attached to a first identity based at least in part on the selection of the first permissions policy.

Contextual policy weighting for permissions searching

Context information may be obtained associated with an error corresponding to an operation. The operation may be defined in a programmatic interface, such as a command line interface. The context information may include identity information regarding an identity that operates the programmatic interface, operation information regarding the operation, and result information regarding a result of the operation. A selected resolution interface type for a resolution interface to assist in resolving the error may be selected based at least in part on the context information. The selected resolution interface type may be a permissions search interface. Scenario-based contents of the resolution interface, such as search terms, may be determined, based at least in part on the context information. The resolution interface may be automatically launched. Input for resolving the error, such as selection of an appropriate permissions policy for attachment to the identity, may be received via the resolution interface.

Permissions searching by scenario

A plurality of cross account resource accessibility instances may be identified in which a plurality of resources are accessible by a plurality of identities that are external to an account that controls the plurality of resources. A plurality of estimated occurrence probabilities of a plurality of links between the plurality of resources and the plurality of identities may be determined. A plurality of estimated removal probabilities of the plurality of cross account resource accessibility instances may be determined based at least in part on the plurality of estimated occurrence probabilities. A plurality of weights for the plurality of cross account resource accessibility instances may be generated based at least in part on the plurality of estimated removal probabilities. A prioritized display of a plurality of indications of the plurality of cross account resource accessibility instances may be provided based at least in part on the plurality of weights.

Removal probability-based weighting for resource access

A first permission allocated to a first identity may be identified. Permission usage information may be analyzed. The permission usage information may include permission usage history information and permission usage pattern data. An estimated probability of a future usage of the first permission by the first identity may be forecasted based, at least in part, on the permission usage information. A first recommendation relating to allocation of the first permission to the first identity may be determined based, at least in part, on the estimated probability. The first recommendation may be a recommendation for the first identity to retain the first permission or a recommendation to deallocate the first permission from the first identity. An indication of the first recommendation may be provided to a user.

Forecast-based permissions recommendations

Access management policies may be generated from example requests. An access management policy may be received. One or more example requests that have expected results when evaluated with respect to the access management policy may be received. Updates to the access management policy may be determined that cause the expected results to occur when a new version of the access management policy based on the updates is enforced. The new version of the access management policy may be generated based on the updates.

Growing community of inventors

Seattle, WA, United States of America

Homer Strong