Amazon Technologies, Inc.

Kai Zhao

William Frederick Hingle Kruse

Ashish Rangole

Jeffrey John Wierer

Nima Sharifi Mehr

Bharath Mukkati Prakash

Hardik Navin Nagda

Kunal Chadha

Chenxi Zhang

Conor Patrick Cahill

Khaled Salah Sedky

James E Scharf, Jr

Richard David Krog

Ajith Harshana Ranabahu

Mostafa Elhemali

Adel Gawdat

Jacob Andreas Kjelstrup

Radu Mihai Berciu

Jonathan L Meed

Saumil Ramesh Hukerikar

Dolev Ish-am

Throughput capacity may be changed to sustain throughput for accessing individual items in a database. A table hosted at storage nodes that provide access to the table in a database may be identified as allocated with a client-specified throughput capacity for accessing the table. Performance of access requests to the table at the storage nodes may be tracked. Based on the performance of the access requests, a change may be determined that modifies a throughput capacity for the table to sustain a guaranteed throughput for each access request independent of other access requests received for the table.

Changing throughput capacity to sustain throughput for accessing individual items in a database

A system and method for generating a policy entitlement map usable to provide a visualization of policies based at least in part on a set of resources of a service of a computing resource service provider, a set of actions that can be taken with the set of resources, or one or more identities. The policy entitlement map may be generated to reflect a set of actions performable by identities of the one or more identities, a set of resources accessible by the identities, or a set of actions that may be performed on the resources.

Entitlement map for policy simulation

A computing resource service receives a request to access the service and perform various actions. In response to the request, the computing resource service obtains a set of active policies that are applicable to the request. As a result of the service determining that the set of active policies fail to provide sufficient permissions for fulfillment of the request, the service determines if an enforcement policy is available that is applicable to the request. The service evaluates the request using the enforcement policy such that if the enforcement policy includes permissions sufficient for fulfillment of the request, the request is fulfilled.

Access control monitoring through policy management

A policy/resource decommissioning service determines whether a resource has been inactive for a period of time greater than at least one period of time threshold for decommissioning. If the resource has been inactive greater than a first period of time threshold, the service disables the resource such that requests to access the resource are denied. If the resource has been inactive for a period of time greater than a second threshold, longer than the first period of time threshold, the service archives the resource. The service deletes the resource if the inactivity period of the resource is greater than a third period of time threshold, where the third period of time threshold is longer than the first and the second period of time thresholds.

Automatic account resource and policy decommissioning

Techniques for self-learning access control policies are disclosed herein. A set of security policy modification recommendations is produced based on set of effective permissions and also based on a set of requests for access subject to that set of effective permission. Each policy modification recommendation is configured to alter the set of effective permissions by performing one or more actions altering one or more of the effective permissions. A selected policy modification recommendation is provided that is configured to produce a modified set of effective permissions.

Self-learning access control policies

Growing community of inventors

Seattle, WA, United States of America

Kai Zhao