Amazon Technologies, Inc.

Mohammad Foyzur Rahman

Pavel Sokolov

William Michael McCreedy

Ippokratis Pandis

Eric Ray Hotinger

Vivek Ramamoorthy

Jingyi Qing

Vladimir Ponomarenko

Dengfeng Li

Maximiliano Maccanti

Naresh Chainani

Sudipto Das

Sanuj Basu

Karsten Jancke

Purvaja Narayanaswamy

Krishnaditya Kandregula

Vinay Singh

Sachet Saurabh

Neeraja Rentachintala

Wenchuan An

Chenqin Xu

Ramy Nazier

Dmytro Lebedyev

Venkata Naga Raja Sri Harsha Kesapragada

Kostiantyn Dymov

Sharda Kishin Khubchandani

Fabian Oliver Nagel

Ewout Willem Prangsma

Sushim Mitra

John Thomas

Monish Gupta

Weihang Song

Mengyang Li

A system for delegation of authorization management of a shared database of a database service is described. The database service includes a control plane and a producer database engine. The producer database engine receives a creation request to create a datashare for a database. The creation request delegates, to a data exchange service, authorization management to access the datashare. The control plane is configured to update permission data for the datashare to indicate that authorization to the datashare is managed by the data exchange service. The producer database engine is further configured to receive a request, from a consumer database engine, to obtain metadata used to perform a query to the database of the datashare, determine that the data exchange service authorized the consumer database engine to access the datashare based on the permission data for the datashare, and return the metadata to the consumer database engine.

Delegated authorization for consumers of shared databases

Database data of a database service may be privately shared across provider network regions. A database producer can authorize an account of to access a database in another region of the provider network. The consumer of the database can associate the database in order to accept the permission to access the database. The database can then be created as an external table at a consumer database engine and metadata for the database privately shared between producer and consumer database engines that can be used to query the external table.

Privately sharing database data across provider network regions

A consumer database of a service provider network may perform writes to a producer database. To do so, the consumer database obtains metadata and a transaction context from the producer database and uses that information to perform a write from the consumer database to the producer database. A consumer database may access (read and/or write) a producer database that uses a different topology to manage data. To do so, the consumer database obtains topology metadata from the producer database and uses the topology metadata to perform a query (read or write) from the consumer database to the producer database. A consumer database may access a producer database based on a mapping of local user IDs to consumer databases at the producer database. The access may be granted to the consumer database based on permissions assigned to the local user IDs.

Performing writes from a consumer database to a producer database

A federated permission management service provides clients with customized access to a data set using customized authorization metadata. The federated permission management service may define and apply permissions that are defined at a data lake that provides access to many different data sets from many different sources, as well as those permissions that may be defined at the source of the data set, which may be provided when performing a data sharing request. By allowing for permissions to be specified at the data lake in addition to permissions specified at a source of a data set, the permission management service can provide a fine-grained access control to specific objects of the data set, such as specific columns, specific rows, or specific cells of a database to be shared, even for those data sets in the data lake having different sources.

Data sharing with federated access permissions

Authorization is divided between a control plane and a data plane for sharing database data. A producer database engine can create a shared database via a data plane interface. A producer can then authorize access to the shared database via a control plane interface to a consumer. A consumer can associate the authorization granted to the consumer with a consumer database engine via the control plane interface.

Dividing authorization between a control plane and a data plane for sharing database data

Growing community of inventors

Newark, CA, United States of America

Mohammad Foyzur Rahman