Amazon Technologies, Inc.

Zhixing Xu

Meng Li

Oksana Tkachuk

Niloofar Razavi

Qiang Zhou

Yingjun Lyu

Shengjian Guo

Michael McDougall

Saeed Nejati

Vishal Gori

Wen-Hao Chiang

Georgios Argyros

Systems and methods provide for analysis, identification, and automated repair of portions associated with configuration files or templates. The portions may be analyzed using different rules-based approaches to identify various vulnerabilities and their locations. The vulnerability and location information may be provided to a fixing service to implement different remediation workflows to identify specific areas within the portions associated with the vulnerabilities and to apply one or more patches to address the vulnerabilities. The patched files may then be validated and released for use.

Generating patches for vulnerability remediation in templates

Techniques are described for analyzing privilege escalation risks within the accounts, roles, and policies that comprise an organization's cloud provider environment. Privilege escalation refers broadly to scenarios in which a principal (e.g., a person or application) is able to gain access to resources or actions in a cloud provider environment that exceed a level intended for that principal. In the context of cloud provider environments, for example, such privilege escalation risks can result from the misconfiguration of policies and permissions attached to identities (e.g., users, groups of users, or roles) within an organization's environment. A multi-layer reasoning framework is used to build an ontology model of an organization's identities and relations among the identities, including defined access relationships, permission mutation relationships, and credential mutation relationships. The framework is further used to query the ontology model to identify particular identities associated with one or more specific types of privilege escalation risks.

Analyzing privilege escalation risks using a multi-layer reasoning framework

Techniques are described for a domain-specific language and associated framework for implementing analyses of security, operational, or functional properties involving computing resources. The specification language enables users to readily define the semantics of a set of cross-resource relations of interest using a human-readable language. For example, the language enables users to express properties over computing resources based on a user-defined set of cross-resource relations. The specification language is human-readable, allowing users to easily add new cross-resource relations or to modify existing relations and properties, thereby enabling users to readily modify existing analyses or to create new ones entirely. The specification language is also machine-readable such that a compiler and other tools can automatically generate an ontology model based on local resource configurations, augment the graph with the cross-resource relations defined in the specifications, and perform graph reachability analyses based on defined properties of interest.

Specification language for generating graph reachability-based analyses for cloud-based system resources

Growing community of inventors

Sunnyvale, CA, United States of America

Zhixing Xu