Amazon Technologies, Inc.

Kasper Soe Luckow

Neha Rungta

John Byron Cook

Carsten Varming

Andrew Jude Gacek

Pauline Virginie Bolignano

Sean McLaughlin

Catherine Dodge

Temesghen Kahsai Azene

Juan Rodriguez Hortala

Cole Nathan Schlesinger

Ian Nicholas Sweet

William Joel Eiers

Liana Sorina Hadarean

Daniel Schwartz-Narbonne

A policy auditing service can be implemented, in accordance with at least one embodiment that obtains a set of parameters that indicates a snapshot of a policy configuration for an account, a query, and a security policy. The security policy may encode a security requirement or invariant. The policy auditing system may determine states that can be reached via mutative operations (e.g., role assumption) and use a policy analyzer service to determine whether assuming a role results in a grant of access that is at least as permissive as the security policy of the set of parameters.

Techniques for analyzing security in computing environments with privilege escalation

Systems and methods for quantifying permissiveness of access control policies using model counting techniques and automated policy downscaling are disclosed. A policy service receives an initial access policy and transforms the access policy into an access constraint compatible with a constraint solver. The policy service determines a degree of permissiveness of the policy based on a number of distinct solutions to the access constraint identified by the constraint solver. Using data associated with access requests precisely allowed by the initial access policy and the initial access policy, the policy service generates a modified policy by adding additional constraints to the access policy and determining that the modified policy is less permissive than the initial access policy.

Quantifying permissiveness of access control policies using model counting techniques and automated policy downscaling

A constraint solver service of a computing resource service provider performs evaluations of logic problems provided by the service provider's users and/or services by deploying a plurality of constraint solvers to concurrently evaluate the logic problem. Each deployed solver has, or is configured with, different characteristics and/or capabilities than the other solvers; thus, the solvers can have varying execution times and ways of finding a solution. The service may control execution of the solvers using virtual computing resources, such as by installing and configuring a solver to execute in a software container instance. The service receives solver results and delivers them according to a solution strategy such as 'first received' to reduce latency or 'check for agreement' to validate the solution. An interface allows the provider of the logic problem to select and configure solvers, issue commands and modifications during solver execution, select the solution strategy, and receive the solution.

Constraint solver execution service and infrastructure therefor

Growing community of inventors

Sunnyvale, CA, United States of America

Kasper Soe Luckow