Amazon Technologies, Inc.

Vladimir Ponomarenko

Pavel Sokolov

William Michael McCreedy

Mohammad Foyzur Rahman

Ippokratis Pandis

Eric Ray Hotinger

Karsten Jancke

Purvaja Narayanaswamy

Vivek Ramamoorthy

Jingyi Qing

Krishnaditya Kandregula

Sachet Saurabh

Neeraja Rentachintala

Vinay Singh

Venkata Naga Raja Sri Harsha Kesapragada

Kostiantyn Dymov

Sharda Kishin Khubchandani

Weihang Song

Mengyang Li

Ramy Nazier

Dmytro Lebedyev

A system for delegation of authorization management of a shared database of a database service is described. The database service includes a control plane and a producer database engine. The producer database engine receives a creation request to create a datashare for a database. The creation request delegates, to a data exchange service, authorization management to access the datashare. The control plane is configured to update permission data for the datashare to indicate that authorization to the datashare is managed by the data exchange service. The producer database engine is further configured to receive a request, from a consumer database engine, to obtain metadata used to perform a query to the database of the datashare, determine that the data exchange service authorized the consumer database engine to access the datashare based on the permission data for the datashare, and return the metadata to the consumer database engine.

Delegated authorization for consumers of shared databases

A federated permission management service provides clients with customized access to a data set using customized authorization metadata. The federated permission management service may define and apply permissions that are defined at a data lake that provides access to many different data sets from many different sources, as well as those permissions that may be defined at the source of the data set, which may be provided when performing a data sharing request. By allowing for permissions to be specified at the data lake in addition to permissions specified at a source of a data set, the permission management service can provide a fine-grained access control to specific objects of the data set, such as specific columns, specific rows, or specific cells of a database to be shared, even for those data sets in the data lake having different sources.

Data sharing with federated access permissions

Growing community of inventors

Redwood City, CA, United States of America

Vladimir Ponomarenko