Amazon Technologies, Inc.

Praveen Akinapally

Conor Patrick Cahill

Rachit Jain

Brigid Ann Johnson

Jasmeet Chhabra

Dmitry Frenkel

Luke Edward Kennedy

Rohit Raj

Varun Jayant Oswal

Per Mikael Horal

Ian Leung

Ritwick Dhar

Ankur Agarwal

Lennart Christopher Leon Kats

Julian Eric Naydichev

Sulay Shah

Techniques for managing permissions to cloud-based resources with session-specific attributes are described. A first request to create a first session to permit access to resources of a provider network is received under an assumed role. The first request is permitted based on an evaluation of a rule associated with the role. Session data including a user-specified attribute included with the first request is generated. A second request to perform an action with a resource hosted by the provider network is received. The user-specified attribute is obtained from the session data based at least in part on the second request. The second request is permitted based on an evaluation of another rule with the user-specified attribute.

Managing permissions to cloud-based resources with session-specific attributes

Transitive restrictions can be applied to requests received on a session. A session token can be issued for an active session, and a transitivity setting specified to indicate the types of requests for which the transitive restriction is to be enforced. This can include enforcing the restriction on requests received from outside a trusted environment, requests within a scope of enforcement, or enforcing the restriction at request authentication. Any request received from an untrusted source that fails to satisfy the transitive restriction will be denied. Requests from inside the trusted environment may not have the transitive restriction enforced, such as where a new token is issued. This enables services within the environment to make calls on behalf of the customer, while ensuring that third parties obtaining the session token cannot successfully initiate such calls.

Restriction transitivity for session credentials

A security token service receives a request for a token. The request indicates a set of access control policies that define a set of permissions for access to a resource. The security token service generates the token to comprise a set of identifiers of the set of access control policies. The security token service provides the token in response to the request to enable the token to be used to access the resource in accordance with the set of access control policies.

Policy implementation using security tokens

Growing community of inventors

Seattle, WA, United States of America

Praveen Akinapally