Amazon Technologies, Inc.

William Frederick Kruse

Gregory Branchek Roth

Nima Sharifi Mehr

Andrew Paul Mikulski

James Leon Irving, Jr

Ryan Pickren

Guifre Ruiz Utges

Zak Aaron Edwards

Jon Arron McClintock

Bradley Jeffery Behm

Scott Gerard Carmack

Narasimha Rao Lakkakula

Sachin Purushottam Joglekar

Thibault Candebat

Alun Jones

Sunu Aby Mathew

Shailendra Batra

A customer of a policy management service may use an interface with a configuration and management service to interact with policies that may be applicable to the customer's one or more resources. The customer may create and/or modify the policies and the configuration and management service may notify one or more other entities of the created and/or modified policies. The one or more other entities may be operated by user authorized to approve the created and/or modified policies. Interactions with the configuration and management service may be the same as the interactions with the policy management service.

Policy approval layer

The disclosure herein pertains to a security vulnerability scanner. The security vulnerability scanner parses a URL into a network portion and a fragment portion. The security vulnerability scanner then runs the URL on a network-side browser to generate processed results. Advantageously, the security vulnerability scanner is able to mimic a client side browser by running various fragment portions in order to analyze security risks.

Application-based scanning

Techniques for automated detection and mitigation of subdomain takeovers are described. A method for automated detection and mitigation of subdomain takeovers comprises receiving, by a subdomain manager, a request to monitor one or more resources associated with one or more mapping records, periodically scanning each resource from the one or more resources, receiving a response from at least one resource indicating that the at least one resource does not exist or is invalid, and sending a notification indicating that the at least one resource does not exist or is invalid using a notification service.

Automated detection, alarming, and removal of subdomain takeovers

A system and method for a credentials agent that automatically rotates and stores security credentials to be used at least in part to authenticate calling applications with a computing resource service provider. Upon determining that a first set of credentials are due to be rotated, the credentials agent may obtain a second set of credentials and store the second set of credentials in a data store. The credentials agent may give notice to a calling application that the first set of credentials is due to be rotated, whereupon the calling application may obtain the second set of credentials and be authenticated to access a resource of the computing resource service provider at least in part by providing the second set of credentials. The authorization system provides visualizations and alerts to administrators of unexpected states that may be caused by misconfigured applications or malicious users.

Automatic rotation and storage of security credentials

Managed identity federation provides numerous options for authentication to access one or more services. A user authenticates with an identity verification provider and provides proof of authentication to a service of a service provider. The service of the service provider is configured to verify the user's identity using a centrally managed identity provider configuration. This configuration is distributed without intervention of the service's administrators. This centrally-managed configuration allows a variety of enterprise and third-party services to utilize the service provider's billing, security, and other administrative services.

Managed identity federation

Technology for managing an API request is described. In an example implementation, an authentication service may receive a request to access a service. The authentication service may be configured to determine a proximity of a client device from which the request originated to the service. The authentication service may be further configured to grant the request based in part on the determined proximity of the client device to the service with respect to a policy.

Authentication for an API request

Techniques are described for automatically determining application composition and application ownership of an application that may include a plurality of files deployed to a plurality of host devices. The determination of application composition may be based on analyzing various types of metadata that may provide evidence of associations between deployed files, such as metadata describing the deployment of files to host devices, metadata describing the files tracked within a source control system, or other types of metadata. The determination of application ownership may also be based on analyzing the various types of metadata that provide evidence of associations between files and individuals or groups of individuals within an organization.

Determining application composition and ownership

A credential management system is described that provides a way to disable and/or rotate credentials, such as when a credential is suspected to have been compromised, while minimizing potential impact to various systems that may depend on such credentials. The credentials may be disabled temporarily at first and the availability of various resources is monitored for changes. If no significant drop of availability in the resources has occurred, the credential may be disabled for a longer period of time. In this manner, the credentials may be disabled and re-enabled for increasingly longer time intervals until it is determined with sufficient confidence/certainty that disabling the credential will not adversely impact critical systems, at which point the credential can be rotated and/or permanently disabled. This process also enables the system to determine which systems are affected by a credential in cases where such information is not known.

Credential management

A system and method for a credentials agent that automatically rotates and stores security credentials usable at least in part to authenticate calling applications with a computing resource service provider. Upon determining that a first set of credentials are due to be rotated, the credentials agent may obtain a second set of credentials and store the second set of credentials in a data store. The credentials agent may give notice to a calling application that the first set of credentials is due to be rotated, whereupon the calling application may obtain the second set of credentials and be authenticated to access a resource of the computing resource service provider at least in part by providing the second set of credentials. The authorization system provides visualizations and alerts to administrators of unexpected states that may be caused by misconfigured applications or malicious users.

Growing community of inventors

Seattle, WA, United States of America

William Frederick Kruse