New and existing policy determination for identity sets

Abstract

A plurality of identities may be added to a new policy identity pool associated with new policy generation. Each identity of the plurality of identities may have a respective selected permission associated with permission usage of the identity. A new policy may be generated based on the new policy constraint set, the new policy corresponding to a maximum group of identities in the pool of new policy identities that satisfy the new policy constraint set. The new policy constraint set may include a first constraint that the new policy includes a respective selected permission for each identity in the group of maximum identities and a second constraint that the new policy does not exceed one or more maximum additional permission thresholds. One or more indications may be provided to the user to attach a new policy to each identity within the group of maximum identities.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Patent Application No. 17 / 708,341, filed on March 30, 2022, the entire contents of which are incorporated herein by reference. Background Art

[0003] Identity management services may allow customers to control and manage access to computing services and resources by creating identities (e.g., users, groups, roles, etc.) and defining permissions for the identities. When attempting to attach a policy to an identity, a customer may choose to attach one or more existing policies and / or create one or more new policies specifically tailored to the identity. However, creating new policies from scratch for each identity may require a significant amount of time and effort and may be error-prone. Some customers who do not want to invest such a significant amount of time and effort may prefer to use existing policies. However, since customers do not necessarily know the names of relevant policies that match their desired permission sets, customers may attach overly broad policies, which may pose a security risk. Customers may also be unsure which identities can use existing policies and which identities require the creation of new policies. For example, in some cases, even if there are existing policies that match their desired permission sets, customers may resort to creating new policies, which may involve unnecessary expenditures of time and effort. In addition, when trying to create a new policy for a group of identities (e.g., identities within a given account), customers perform unnecessary steps. For example, in some cases, customers create a separate new policy for each identity, even when a single policy can be generated to cover the security requirements of multiple identities. This is because the customer may not know which identities, if any, can be most effectively covered together by a single new policy. The customer may also not know the content of the policy required to cover the security requirements of these multiple identities. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] The following detailed description may be better understood when read in conjunction with the accompanying drawings.For illustrative purposes, example embodiments of various aspects of the present disclosure are shown in the drawings; however, the invention is not limited to the specific methods and instrumentalities disclosed.

[0005] Figure 1 is a diagram illustrating an example policy recommendation system that may be used in accordance with the present disclosure.

[0006] Figure 2 is a diagram illustrating example permission matching granularities that may be used in accordance with the present disclosure.

[0007] Figure 3 is a diagram illustrating example action categories that may be used in accordance with the present disclosure.

[0008] Figure 4is a diagram illustrating an example matching policy subset calculation formula with service level granularity that may be used in accordance with the present disclosure.

[0009] Figure 5 is a diagram illustrating example matching strategy subset calculation formulas with individual action level granularity that may be used in accordance with the present disclosure.

[0010] Figure 6 is a diagram illustrating example matching strategy subset calculation formulas with action class level granularity that may be used in accordance with the present disclosure.

[0011] Figure 7 is a diagram illustrating a first example of a policy recommendation user interface that may be used in accordance with the present disclosure.

[0012] Figure 8 is a diagram illustrating a second example of a policy recommendation user interface that may be used in accordance with the present disclosure.

[0013] Fig. 9 is a diagram illustrating a third example of a policy recommendation user interface that may be used in accordance with the present disclosure.

[0014] Fig.10 is a flow chart illustrating an example policy recommendation process that may be used in accordance with the present disclosure.

[0015] Fig.11 is a flow chart illustrating an example matching strategy subset selection process that may be used in accordance with the present disclosure.

[0016] Fig.12 is a diagram illustrating the formation of new and existing policy identity pools that may be used in accordance with the present disclosure.

[0017] Fig.13 is a diagram illustrating example existing policy constraints that may be used in accordance with the present disclosure.

[0018] Figures 14A-14C is a diagram illustrating a generation of new strategies that may be used in accordance with the present disclosure.

[0019] Fig.15 is a diagram illustrating example new policy constraints that may be used in accordance with the present disclosure.

[0020] Figures 16A-16B is a diagram illustrating example definitions and formulas related to new policy generation that may be used in accordance with the present disclosure.

[0021] Fig.17A is a flow chart illustrating an example process for forming new and existing policy identity pools that may be used in accordance with the present disclosure.

[0022] Fig. 17Bis a flow chart illustrating an example new policy generation process that may be used in accordance with the present disclosure.

[0023] Fig.18 is a diagram illustrating an example system for transmitting and providing data that may be used in accordance with the present disclosure.

[0024] Fig.19 is a diagram illustrating an example computing system that can be used in accordance with the present disclosure. DETAILED DESCRIPTION

[0025] This article describes the technology of identity management recommendation using existing policies. The described technology can be adopted by an identity management service, which allows customers to control and manage access to computing services and resources by creating identities (e.g., users, groups, roles, etc.) and defining permissions for the identities. In some examples, the identity management service can provide customers with recommendations for existing policies to be attached to the identity to help meet the security requirements of the identity. In order to make these recommendations, the identity management service can determine an available policy set, which is a set of existing policies that can be used for the identity. The available policy set may include policies generated by one or more existing services generated by the identity management service. The available policy set may also include policies generated by one or more existing customers that can be used for the identity, such as policies generated by one or more existing customers in the same customer account as the identity. The identity management service can also determine the selected permissions for the identity, which are permissions associated with the use of permissions for the identity. The selected permissions can include, for example, permissions that the identity has used in a selected previous time window (e.g., in the past 90 days). The selected permissions can also include, for example, permissions that are estimated to be greater than a threshold probability for the identity to be used in a future time period. In some examples, the selected permissions may also include other permissions, such as permissions manually selected by the customer, the union of permissions on multiple policies currently attached to the identity (if the identity currently has attached policies), etc.

[0026] An input including an available policy set and selected permissions is provided to a recommendation component, which can provide a policy recommendation for the identity to the client. The recommendation component can then evaluate the input to determine whether the available policy set includes one or more matching policy subsets, which are subsets that cover all selected permissions without allowing any additional permissions. The term additional permissions used herein refers to permissions that are not included in the selected permissions. If the available policy set includes one or more matching policy subsets, a recommendation to use at least one of the matching policy subsets can be provided to the client. For example, if the available policy set includes only a single matching policy subset, the single matching policy subset can be recommended. On the contrary, if the available policy set includes multiple matching policy subsets, one of the multiple matching policy subsets can be selected for recommendation based on various criteria. In some examples, a matching policy subset including the least number of policies can be recommended. In other examples, the recommended matching policy subset can be selected based at least in part on other criteria, such as action-level data, the name of the policy (e.g., to match the name of the identity), and other weighting techniques. In some examples, the matching policy subset can be limited to a maximum threshold number of policies. Thus, in some examples, a policy subset that may otherwise match the security requirements of the identity (ie, covering all selected permissions without allowing any additional permissions) but includes a number of policies exceeding a threshold number of policies may not be considered a matching policy subset.

[0027] On the other hand, if the available policy set does not include any matching policy subsets, an alternative recommendation may be provided to the customer. In some examples, the alternative recommendation may be a recommendation for the customer to create a new (i.e., customized) policy for the identity that matches the security requirements of the identity. In other examples, the alternative recommendation may be a recommendation for the customer to use an alternative policy subset from the available policy set. An alternative policy subset may be a subset of the available policy set that does not exactly match the security requirements of the identity, but provides a very close approximation of the security requirements of the identity. In yet other examples, the alternative recommendation may be a recommendation for the customer to use an alternative policy subset from the available policy set, or a recommendation for the customer to create a new (i.e., customized) policy (e.g., to serve as a blank filler for the alternative policy subset). For example, in some cases, the alternative policy subset may cover most of the selected permissions, but may fail to cover a small number of remaining selected permissions. In this example, the customer may generate a new policy to cover these remaining selected permissions. In addition, in some examples, the alternative policy subset may provide a small number of additional permissions that are not included in the selected permissions. In this example, the customer may generate a new policy to exclude these additional permissions from the identity.

[0028] In some examples, similar to the matching policy subset, the alternative policy subset can also be limited to the threshold policy quantity. In some examples, the alternative policy subset can be selected based on various criteria. For example, in some cases, an alternative policy subset that does not include additional permissions but covers the maximum number of selected permissions can be selected (that is, the number of selected permissions included in the alternative policy subset is equal or greater than any other available policy subset that does not include additional permissions). In other examples, an alternative policy subset that covers all selected permissions but includes the minimum number of additional permissions can be selected (that is, the number of additional permissions included in the alternative policy subset is equal or smaller than any other available policy subset that covers all selected permissions). In addition, in some examples, an alternative policy subset can be selected based on the weighting of the selected permissions and / or additional permissions. As an example, in some cases, certain types of additional permissions can be considered to bring greater security risks than other types of additional permissions. For example, write permissions can be considered to bring greater security risks than read permissions. In these cases, write permissions can be assigned a lower weight than read permissions. This means that a policy that grants write permissions (rather than read permissions) as an additional permission is less likely to be recommended than a policy that grants read permissions (rather than write permissions) as an additional permission.

[0029] In some examples, the recommendation component can be configured to perform the above-mentioned policy recommendation determination at any one or more of a plurality of granularity levels. In some examples, these multiple granularity levels can include service-level granularity, action category-level granularity, and individual action-level granularity. One reason for providing these different granularities is that they allow flexibility in the calculation speed of policy recommendations. For example, of the three granularities identified above, the service-level granularity can allow the fastest policy recommendation calculation speed, but it is also the smallest granularity (least). In contrast, the individual action-level granularity can be the largest granularity (most), but it also results in the slowest calculation speed. Service-level granularity means that in order to match the policy's permissions with the selected permissions, all types of permissions for a given service are considered to match each other. For example, consider a situation where one of the selected permissions is ServiceX-GetObject, and a given policy (Policy P) only provides ServiceX-PutObject permissions. In this example, at the service-level granularity, Policy P will be considered to cover the ServiceX-GetObject permission, even if GetObject is a different action from PutObject. Individual action-level granularity means that, for the purpose of matching a policy's permissions with the selected permissions, only permissions for the same service and the same action will be considered a match. For example, at individual action-level granularity, policy P will not be considered to cover the SeviceX-GetObject permission, because PutObject is a different action than GetObject.

[0030] Action category level granularity is the third level of granularity, where actions can be grouped into multiple categories. Action category level granularity means that in order to match the policy's permissions with the selected permissions, the permissions of the same service in the same action category are considered to match each other. In some examples, action category level granularity can be advantageous because it can achieve faster calculations than individual action level granularity, while also providing finer-grained recommendations than service level granularity. In a specific example, at least five action categories can be created, including list categories, read categories, write categories, permission management categories, and tag categories. Any number of custom user-defined action categories can also be created. In some cases, permissions such as Read, GetObject, and GetBucketLocation may be included in the read category (because they are related to read operations), while permissions such as Write, CreateBucket, DeleteBucket, and PutObject may be included in the write category (because they are related to write operations). For example, under action category level granularity, policy P may not be considered to cover SeviceX-GetObject permissions because PutObject may be located in an action category (i.e., write category) different from the GetObject category (i.e., read category). However, at the action category level granularity, policy P may be considered to cover the SeviceX-CreateBucket permission because PutObject and CreateBucket may both be included in the same category (ie, the Write category).

[0031] The policy recommendation techniques described herein may provide a number of advantages. For example, these techniques may help increase (and in some cases maximize) the use of service-generated policies. Additionally, these techniques may help customers reuse their own customer-generated policies. This may save customers from unnecessary investments of time and effort to generate new policies when existing policies that match the security requirements of an identity are available. Additionally, these techniques may discourage customers from using existing policies that are too broad, thereby reducing security risks. Additionally, these techniques may help simplify permissions by potentially identifying and recommending the minimum number of policies (and in some cases a single policy) that match the security requirements of an identity. Additionally, these techniques may help customers identify situations where no existing policies matching the security requirements of an identity are available, which may help customers better determine when it is advantageous to generate a new custom policy.

[0032] Figure 1 is a diagram illustrating an example policy recommendation system that may be used in accordance with the present disclosure. Figure 1As shown, recommendation component 110 provides policy recommendations for existing policies that can be attached to identity 100 to help meet the security requirements of identity 100. Recommendation component 110 can be provided by an identity management service, which can allow management of the security requirements of identity 100. To assist in making these recommendations, the identity management service can determine an available policy set 101, which is a set of existing policies that can be used for identity 100. Available policy set 101 can include, for example, one or more existing service-generated policies generated by the identity management service. Available policy set 101 can also include, for example, one or more existing customer-generated policies that can be used for identity 100, such as one or more existing customer-generated policies that are within the same customer account as identity 100.

[0033] The identity management service may also determine the selected permissions 102 of the identity 100. The selected permissions 102 are permissions associated with the permission usage of the identity 100. The selected permissions 102 may include, for example, permissions that the identity 100 has used within a selected previous time window (e.g., within the past 90 days). In some examples, the selected permissions 102 may also include other permissions, such as permissions manually selected by the customer, the union of permissions currently attached to multiple policies of the identity 100 (if the identity 100 currently has an attached policy), etc. In a specific example, the selected permissions 102 may also include, for example, permissions that are estimated to be greater than a threshold probability of being used by the identity 100 in a future time period. For example, in some cases, a machine learning component that employs a machine learning model may evaluate the currently attached permissions of a given identity and the previous usage of the currently attached permissions. In some examples, based at least in part on the currently attached permissions and the previous usage of the currently attached permissions, the machine learning model may be configured to identify permissions that were not used by a given identity within a previous previous time window (e.g., within the past 90 days) but may still be used in the future. To make these determinations, machine learning models may attempt to identify patterns, such as patterns of repeated use of permissions by individual identities and patterns of use of permissions by large groups of identities. For example, if a given identity uses a particular permission once every 150 days, this usage pattern may strongly suggest that the permission may be used again in the next 150-day interval, even if the permission has not been used in the past 90 days. As another example, a pattern may identify that Service X and Service Y are frequently used together by a large number of identities. Now assume that a given identity has used Service X multiple times in the past 90 days, but has never used Service Y. In this example, it can be considered that the probability of the given identity using Service Y in the future is high (because Service Y is often used together with Service X), even if the given identity has never used Service Y in the past.

[0034] like Figure 1As shown, inputs including an available policy set 101 and selected permissions 102 may be provided to a recommendation component 110, which may provide a policy recommendation for an identity 100 to a client. The recommendation component 110 may then evaluate the inputs to determine 111 whether the available policy set 101 includes one or more matching policy subsets, which are subsets that cover all of the selected permissions 102 without allowing any additional permissions. The term additional permissions as used herein refers to permissions that are not included in the selected permissions 102. The term matching policy subset as used herein refers to a subset of the available policy set 101 that includes one or more policies that cover all of the selected permissions 102 (as defined based on a selected granularity, such as one of the granularities 201-203 described below) without allowing any additional permissions (or, in some cases, additional permissions that do not exceed a threshold acceptable level).

[0035] If the available policy set 101 includes one or more matching policy subsets, the recommendation component 110 may provide a matching recommendation 120 to the client. The matching recommendation 120 is a recommendation for the client to use at least one matching policy subset. For example, if the available policy set 101 includes only a single matching policy subset, the single matching policy subset may be recommended. Conversely, if the available policy set 101 includes multiple matching policy subsets, one of the multiple matching policy subsets may be selected for recommendation based on various criteria. In some examples, the matching policy subset that includes the least number of policies may be recommended. In other examples, the recommended matching policy subset may be selected based at least in part on other criteria, such as action-level data, the name of the policy (e.g., to match the name of the identity), and other weighting techniques. As shown in note 112, the matching policy subset may be limited to a maximum threshold number of policies. Therefore, in some examples, a policy subset that may otherwise match the security requirements of the identity (i.e., cover all selected permissions 102 without allowing any additional permissions) but includes a number of policies exceeding the threshold number of policies may not be considered a matching policy subset.

[0036] On the other hand, if the available policy set 101 does not include any matching policy subsets, the recommendation component 110 can provide the client with an alternative recommendation 130. In some examples, the alternative recommendation 130 can include an alternative recommendation 130A, an alternative recommendation 130B, or an alternative recommendation 130C. Specifically, the alternative recommendation 130A is a recommendation for the client to create a new (i.e., customized) policy for the identity 100 that matches the security requirements of the identity 100. The alternative recommendation 130B is a recommendation for the client to use an alternative policy subset in the available policy set 101. The alternative policy subset can be a subset of the available policy set 101 that does not exactly match the security requirements of the identity 100, but provides a close approximation to the security requirements of the identity 100. The alternative recommendation 130C is a recommendation for the client to use an alternative policy subset in the available policy set 101, and is also a recommendation for the client to create a new (i.e., customized) policy, for example to be used as a blank filler for the alternative policy subset. For example, in some cases, the alternative policy subset may cover most of the selected permissions 102, but fail to cover a small number of the remaining selected permissions 102. In this example, the customer can generate a new policy to cover these remaining selected permissions in selected permissions 102. In addition, in some examples, the alternative policy subset can provide a small number of additional permissions that are not included in selected permissions 102. In this example, the customer can generate a new policy to exclude these additional permissions from identity 100.

[0037] In some examples, similar to the matching policy subset, the alternative policy subset can also be limited to the threshold policy quantity. In some examples, the alternative policy subset can be selected based on various criteria. For example, in some cases, an alternative policy subset that does not include additional permissions but covers the maximum number of selected permissions 102 can be selected (that is, the number of selected permissions 102 included in the alternative policy subset is equal or greater than any other subset of the available policy set 101 that does not include additional permissions). In other examples, an alternative policy subset that covers all selected permissions but includes the minimum number of additional permissions can be selected (that is, the number of additional permissions included in the alternative policy subset is equal or smaller than any other subset of the available policy set 101 that covers all selected permissions 102). In addition, in some examples, the alternative policy subset can be selected based on the weighting of the selected permissions 102 and / or additional permissions. As an example, in some cases, certain types of additional permissions can be considered to bring greater security risks than other types of additional permissions. For example, write permissions can be considered to bring greater security risks than read permissions. In these cases, write permissions can be assigned a lower weight than read permissions. This means that a policy that grants write permission (but not read permission) as an additional permission may be less likely to be recommended than a policy that grants read permission (but not write permission) as an additional permission.

[0038] like Figure 1As shown, recommendation component 110 can receive account information 103, which can include information about policies attached to other identities in the same account as identity 100. This information can be used to make account-level optimizations. For example, when creating a new custom policy, a user can choose to include and / or exclude certain permissions in the custom policy to make the custom policy more conducive to use with multiple identities in the same customer account. For example, if there is a given permission that is being used by a large number of identities in an account, the customer may choose to include this permission in the custom policy even if the permission has not yet been used by the given identity for which the custom policy was originally created. In some examples, recommendation component 110 can use account information 103 to provide users with suggestions about these and other optimizations to assist users in defining new custom policies.

[0039] The recommendation component 110 can be configured to perform the above-described policy recommendation determination at any one or more of a plurality of granularity levels. Figure 2 , some example permission matching granularities that can be employed by the recommendation component 110 will now be described in detail. Figure 2 In the example of FIG. 2 , these example granularities include service-level granularity 201, action-category-level granularity 202, and individual action-level granularity 203 (collectively referred to as permission matching granularity 200). One reason for providing these different permission matching granularities 200 is that they allow for flexibility in the speed of computing policy recommendations. For example, arrow 211 indicates that the computing speed is calculated according to Figure 2 The permission matching granularity 200 shown in FIG increases from bottom to top. This means that among the three permission matching granularities 200, the individual action level granularity 203 is calculated the slowest, while the service level granularity 201 is calculated the fastest. In contrast, arrow 212 indicates that the granularity of the calculation increases in accordance with Figure 2 The permission matching granularities 200 shown in FIG. 2 increase in order from top to bottom. This means that, among the three permission matching granularities 200 , the service level granularity 201 provides the largest granularity calculation, while the individual action level granularity 203 provides the smallest granularity calculation.

[0040] Service-level granularity 201 means that, in order to match the policy's permissions with the selected permissions 102, all types of permissions for a given service are considered to match each other. For example, consider a situation where one of the selected permissions 102 is SeviceX-GetObject, and a given policy (Policy P) only provides the ServiceX-PutObject permission. In this example, under service-level granularity, Policy P will be considered to cover the SeviceX-GetObject permission, even though GetObject is a different action from PutObject. Individual action-level granularity 203 means that, in order to match the policy's permissions with the selected permissions 102, only permissions for the same service and the same action will be considered to match each other. For example, under individual action-level granularity 203, Policy P will not be considered to cover the SeviceX-GetObject permission because PutObject is a different action from GetObject.

[0041] In action category level granularity 202, actions may be grouped into multiple categories. Action category level granularity 202 means that for the purpose of matching the policy's permissions with the selected permissions 102, permissions for the same service in the same action category are considered to match each other. In some examples, action category level granularity 202 may be advantageous because it may allow for faster computation than individual action level granularity 203 while also providing finer-grained recommendations than service level granularity 201.

[0042] Reference now Figure 3 , some example action categories that may be defined for use with the action category level granularity 202 will now be described in detail. Figure 3 In the example of FIG. 3 , these example categories include a list category 301, a read category 302, a write category 303, a rights management category 304, a tag category 305, and a custom category 306 (collectively referred to as categories 301-306). As shown, the list category 301 includes actions 301A-N, the read category 302 includes actions 302A-N, the write category 303 includes actions 303A-N, the rights management category 304 includes actions 304A-N, the tag category 305 includes actions 305A-N, and the custom category 306 includes actions 306A-N.

[0043] Specifically, the list category 301 may include the permission to list resources within the service for determining whether an object exists. The actions of the list category 301 may list objects but may not see the content of the resources. The list category 301 may include actions such as ListBucket. The read category 302 may include the permission to read but not edit the content and properties of resources in the service. The read category 302 may include actions such as GetObject and GetBucketLocation. The write category 303 may include the permission to create, delete or modify resources in the service. The write category 303 may also include actions that allow modification of resource tags. However, the tag category 305 may include actions that only allow tags to be changed. The write category 303 may include actions such as CreateBucket, DeleteBucket and PutObject. The permission management category 304 may include the permission to grant or modify resource permissions in the service. The permission management category 304 may include actions such as PutBucketPolicy and DeleteBucketPolicy. The tag category 305 may include the permission to perform actions that only change the state of resource tags. The tag category 305 may include actions such as TagRole and UntagRole. However, the CreateRole action (which allows the role resource to be tagged when the role is created) can be included in the write category 303 because the action is more than just adding a tag. Custom category 306 can be a user-defined action category that can include actions that a user (e.g., a customer) determines have characteristics associated with the category. As a specific example, a customer can create a sensitive action category that can include actions that the customer considers sensitive. As another example, a customer can create a non-sensitive action category that can include actions that the customer considers non-sensitive. It will be appreciated that any number of custom user-defined categories can be created.

[0044] Returning to the example described above, in the case of action category level granularity 202, policy P (which, as described above, only provides ServiceX-PutObject permission) may not be considered to cover SeviceX-GetObject permission because PutObject may be in a different action category (i.e., write category 303) than GetObject category (i.e., read category 302). However, in the case of action category level granularity 202, policy P may be considered to cover SeviceX-CreateBucket permission because PutObject and CreateBucket may both be included in the same category (i.e., write category 303).

[0045] In some examples, the identity management service may provide an interface that allows a user (e.g., a customer) to select which permission matching granularity 200 should be used to determine permission recommendations for a given identity and / or account. In some examples, the customer may select an option to repeat calculations at multiple different levels of granularity. For example, the customer may request that calculations be performed using both service-level granularity 201 (e.g., to provide initial results more quickly) and individual action-level granularity 203 (e.g., to provide results that are more fine-grained than service-level results at a later time). In some examples, calculations at multiple levels of granularity may be performed at least partially concurrently with each other.

[0046] In some examples, linear programming techniques may be used to perform any or all of the above policy recommendations. Figure 1 , shows that the recommendation component 110 can include a linear programming component 113, which can be employed to assist in calculations associated with any or all of the above-mentioned policy recommendations. The recommendation component 110 and / or the linear programming component 113 can be executed by one or more computing devices.

[0047] Reference now Figure 4 , an example matching policy subset calculation formula with service-level granularity (hereinafter referred to as service-level formula 400) will now be described in detail. The service-level formula 400 can be used by the recommendation component 110 to provide service-level granularity 201. As shown in definition 420, the letter (U) represents a global service pool (s), such as all services to which an identity management system manages access. As also shown in definition 420, uppercase letters (P) represent the set of available policies 101, while lowercase letters (p) represent individual policies within (P). Each individual policy (p) provides access to a corresponding subset of (U). As shown in definition 420, the symbol U-underline represents selected permissions 102, which, for the service-level formula 400, are permissions to access a global service subset (i.e., a subset of (U)). In this example, the variable x-subscript-i (x i ), whose value is 1 or 0. If the corresponding policy p-subscript-i (p i), then the value of the variable x-subscript-i is 1. Otherwise, the value of the variable x-subscript-i is 0. In the service-level formula 400, the capital letter (M) represents the maximum number of policies that can be included in the matching policy subset. In some examples, the default value of (M) can be set to 10, which means that a maximum of 10 policies can be included in the matching policy subset. The lowercase Greek letter Xi (ξ) represents the maximum number of additional permissions that the matching policy subset can provide to a given identity. In some examples, the default value of (ξ) can be set to 0 (which means that the matching policy subset may not provide any additional permissions). However, in other examples, (ξ) can be set to a number greater than 0 (which means that the matching policy subset can provide up to a specified number of additional permissions).

[0048] As shown in service-level formula 400, item 401 indicates that service-level formula 400 will select a matching policy subset with a minimum policy subset that satisfies the conditions of service-level formula 400 (i.e., satisfies constraints 402-405). The abbreviation st in service-level formula 400 (and other formulas described herein) means such that (i.e., such that constraints 402-405 are satisfied). Constraint 402 ensures that the matching policy subset is limited to no more than (M) policies. Constraint 403 ensures that for each service to which access is granted by the selected permission 102, there is at least one policy in the matching policy subset that grants the service permission. The inverted letter A means "for all instances of..." in service-level formula 400 (and other formulas described herein). Similarly, constraint 404 prevents the number of additional permissions provided by the matching policy subset to a given identity from exceeding the maximum number of additional permissions (Xi). Constraint 405 specifies that variable x-subscript-i has a value of 1 or 0. As described above, in the service level formula 400, if the corresponding policy p-subscript-i is selected for the matching policy subset, the variable x-subscript-i has a value of 1. Otherwise, the variable x-subscript-i has a value of 0.

[0049] Reference now Figure 5 , an example matching strategy subset calculation formula with individual action level granularity (hereinafter referred to as individual action level formula 500) will now be described in detail. The recommendation component 110 can use the individual action level formula 500 to provide the individual action level granularity 203. Figure 4 In the example, the letter (U) indicates the global service pool. Figure 5 In the example of , as shown in definition 520, the letter (U) represents the global service pool (s) and its associated actions (a). Also as shown in definition 420, the symbol U-overline represents the selected permission 102, which, for the individual action-level formula 500, is the permission to access a subset of global services and actions (i.e., a subset of (U)). Figure 5 The other variables in can be expressed as above. Figure 4 The same features described. As shown in the individual action level formula 500, item 501 indicates that the individual action level formula 500 will select a matching strategy subset with a minimum strategy subset that satisfies the conditions of the individual action level formula 500 (i.e., satisfies constraints 502-505). Constraint 502 ensures that the matching strategy subset is limited to no more than (M) strategies. Constraint 503 ensures that for each specific service and individual action combination for which the selected permission 102 grants access rights, there is at least one strategy in the matching strategy subset that grants the individual action. Similarly, constraint 504 prevents the number of additional permissions at the individual action level provided by the matching strategy subset to a given identity from exceeding the maximum number of additional permissions (Xi). Constraint 505 specifies that the value of variable x-subscript-i is 1 or 0. As described above, if the corresponding strategy p-subscript-i is selected for the matching strategy subset, the value of variable x-subscript-i is 1. Otherwise, the value of variable x-subscript-i is 0.

[0050] Reference now Figure 6 , an example matching strategy subset calculation formula with action category level granularity (hereinafter referred to as action category level formula 600) will now be described in detail. The action category level formula 600 can be used by the recommendation component 110 to provide the action category level granularity 202. Figure 6 In the example of , as shown in definition 620, the letter (U) represents the global service pool (s) and its associated action category (c). Also as shown in definition 620, the symbol U-overline represents the selected permission 102, which, for the action category level formula 600, is the permission to access a subset of global services and action categories (i.e., a subset of (U)). Figure 6 The other variables in can be expressed as above. Figure 4The same features described. As shown in the action category level formula 600, item 601 indicates that the action category level formula 600 will select a matching policy subset with a minimum policy subset that satisfies the conditions of the action category level formula 600 (i.e., satisfies constraints 602-605). Constraint 602 ensures that the matching policy subset is limited to no more than (M) policies. Constraint 603 ensures that for each specific service and action category combination for which the selected permission 102 grants access rights, there is at least one policy in the matching policy subset that grants the service and action category combination. Similarly, constraint 604 prevents the number of additional permissions at the action category level provided by the matching policy subset to a given identity from exceeding the maximum number of additional permissions (Xi). Constraint 605 specifies that the variable x-subscript-i has a value of 1 or 0. It is worth noting that although some examples described herein involve linear programming-based calculations, it is not required to use linear programming. In addition, in some examples, additional or alternative constraints related to policy recommendation calculations may be considered, such as resource-based constraints, tag-based constraints, etc. Including these constraints and other constraints may change the calculations and policies that can be used to make permission recommendations. Even when no additional or alternative constraints are considered, other calculations and strategies may be optionally employed. Therefore, it is not required that the recommendation component 110 must include the linear programming component 113, nor is it required that the recommendation component 110 must employ the linear programming component 113. Figure 4 Service level formula 400, Figure 5 Any one or all of the action-level formula 500 and the action-category-level formula 600 (hereinafter collectively referred to as formulas 400-600).

[0051] Now refer to Figure 7-9 Some examples of policy recommendation user interfaces are described in detail. Figure 7, interface 701 shows an example in which the recommendation component 110 is able to determine the minimum combination of existing policies that will cover all selected permissions of an example identity (i.e., the My-Example-Role identity) without providing any additional permissions. Interface 701 provides a recommendation to the user to attach this combination of existing policies, which in this example includes three policies (PolicyAAA, PolicyBBB, and PolicyCCC). It should be noted that in order to make this determination, the recommendation component 110 can perform one or more linear programming calculations, such as by adopting one of the above formulas 400-600. As shown in interface 701, the user can select (e.g., click) link 711 to help attach the recommended policy, such as by navigating the user to a console page that allows the recommended policy to be attached. It is worth noting that in order to make a recommendation to the user, the interface does not need to use or display the exact word "recommended" or any other similar word. Instead, the recommendation may only include informing the user of any combination of one or more policies that can be used to fully or partially cover the selected permissions. In addition, the recommendation may also include suggesting to the user that the user can create a new policy or use the new policy in combination with one or more existing policies.

[0052] As also described above, in some examples, there may not be an available policy combination that covers all selected permissions without adding additional permissions. For example, in some cases, this may occur when one or more of formulas 400-600 fails to return any results that satisfy constraints 402-405, 502-505, and / or 602-605, respectively. Now referring to Figure 8 , interface 801 shows an example of this scenario, where for My-Example-Role, there is no available policy combination that covers all selected permissions and does not need to add additional permissions. As shown, interface 801 includes a recommendation for the customer to create a new custom policy for My-Example-Role. Interface 801 also includes a link 811, which, when selected by the user, can provide additional information, such as informing the user of the selected permissions and helping to create a new custom policy (e.g., by navigating to a policy creation page, etc.).

[0053] Interface 802 shows another example in which, for My-Example-Role, there is no available policy combination that covers all of the selected permissions without adding additional permissions. However, in the example of interface 802, rather than simply recommending that the customer create a new custom policy, a recommendation is made to use an alternative policy subset (i.e., including PolicyGGG and PolicyHHH) that covers all of the selected permissions while including the least number of additional permissions (i.e., the number of additional permissions included is equal to or less than the number of additional permissions included by any other available policy subset that covers all of the selected permissions). In addition, interface 802 also notifies the user that a new custom policy can be created to remove the additional permissions provided by the recommended policy combination from My-Example-Role. Interface 802 includes link 812, which, when selected by the user, can provide additional information, such as informing the user of the additional permissions that the new custom policy will remove, and otherwise assisting in creating a new custom policy (e.g., by navigating to a policy creation page, etc.).

[0054] Interface 803 shows another example, where for My-Example-Role, there is no available policy combination that covers all selected permissions without adding additional permissions. In the example of interface 803, a recommendation is made to use different alternative policy subsets (i.e., including PolicyNNN and PolicyLLL). As described in interface 803, the policy combination covers all selected permissions, while also only allowing additional permissions in the same action category as other selected permissions. Therefore, interface 803 provides an example of a weighted technique that can be used to make policy selections and recommendations. Specifically, in this example, additional permissions in the same action category as the selected permissions are more highly weighted than additional permissions that are not in the same action category as the selected permissions. Therefore, based on this weighted technique, the selected policy combination may be more likely to include additional permissions in the same action category as the selected permissions than to include additional permissions that are not in the same action category as the selected permissions. The reason behind this approach is that the security risk of allowing multiple actions in the same action category can be considered lower than the security risk of allowing multiple actions in different categories. For example, if an identity already has the GetObject permission in the read category 303 as a selected permission, the risk of allowing the identity to have another additional permission in the read category 302 (e.g., GetBucketLocation) may be considered low. Conversely, if the identity currently does not have any selected permissions in the permission management category 304, the risk of allowing the identity to have additional permissions in the permission management category 304 (e.g., PutBucketPolicy) may be considered high. It should be noted that this is just one example type of weighting. Other example types of weighting, such as assigning different weights to different action categories (e.g., assigning a higher weight to the read permission than the write permission), are described in detail above and will not be repeated here.

[0055] Interface 803 also informs the user that a new custom policy can be created to remove the additional permissions provided by the recommended policy combination from My-Example-Role. Interface 803 includes a link 813 that, when selected by the user, can provide additional information, such as to inform the user of the additional permissions that the new custom policy will remove, and to otherwise assist in creating a new custom policy (e.g., by navigating to a policy creation page, etc.).

[0056] Reference now Fig. 9, interface 901 shows another example, in which, for My-Example-Role, there is no available policy combination that covers all of the selected permissions without adding additional permissions. In the example of interface 901, a recommendation is made to use an alternative policy subset (i.e., including PolicyMMM and PolicyJJJ) that does not include additional permissions while covering the maximum number of selected permissions (i.e., the number of selected permissions it includes is equal to or greater than the number of selected permissions included by any other available policy subset that does not include additional permissions). In addition, interface 901 also notifies the user that a new custom policy can be created to add the missing selected permissions not provided by the recommended policy combination to My-Example-Role. Interface 901 includes link 911, which, when selected by the user, can provide additional information, such as notifying the user of the missing selected permissions that the new custom policy will add, and otherwise assisting in creating a new custom policy (e.g., by navigating to a policy creation page, etc.).

[0057] Fig.10 1 is a flow chart illustrating an example policy recommendation process that can be used according to the present disclosure. At operation 1010, an available policy set of existing policies available to an identity is determined. The available policy set may include, for example, one or more existing service-generated policies generated by an identity management service. The available policy set may also include, for example, one or more existing customer-generated policies available to an identity, such as one or more existing customer-generated policies within a customer account that includes the identity. In some examples, the identity management service may generate an available policy set based on a list of one or more stored existing policies compiled and updated by the identity management service. For example, the identity management service may compile and update a list of stored existing service-generated policies. In addition, in some examples, the identity management service may also compile and update one or more lists of stored existing customer-generated policies. In a specific example, for each customer account, the identity management service may compile and update a corresponding list of existing customer-generated policies created and / or available by the corresponding customer account. Therefore, the existing customer-generated policies available to the identity may be determined based on a list of stored existing customer-generated policies for an account that includes the identity.

[0058] At operation 1012, the selected permissions associated with the permission usage of the identity are determined. The selected permissions can be determined by the identity management service, for example, based on the permission usage data of the identity and the permission usage data of other optional identities (e.g., other identities in the same account and / or the global identity pool) that the identity management service can compile and update. The selected permissions can include, for example, permissions used by the identity in the selected previous time window (e.g., in the past 90 days). For example, the identity management service can track the usage of permissions by the identity as part of the permission usage data. In some examples, the selected permissions can also include other permissions, such as permissions manually selected by the customer, the union of permissions currently attached to multiple policies of the identity (if the identity currently has an attached policy), etc. In a specific example, the selected permissions can also include, for example, permissions that are estimated to be used by the identity in a future time period with a probability greater than a threshold probability. For example, in some cases, a machine learning component using a machine learning model can evaluate the current attached permissions of a given identity and the previous usage of the currently attached permissions. In some examples, based at least in part on the currently attached permissions and the previous use of the currently attached permissions, the machine learning model can be configured to identify permissions that a given identity has not used in the previous time window (e.g., in the past 90 days) but may use in the future. In order to make these determinations, the machine learning model can attempt to determine patterns, such as patterns of repeated use of permissions by individual identities and patterns of use of permissions by identities in large groups. For example, if a given identity uses a particular permission once every 150 days, the usage pattern may strongly suggest that the permission may be used again in the next 150-day interval, even if the permission has not been used in the past 90 days. As another example, the pattern can identify that service X and service Y have been frequently used together by a large number of identities. Now assume that a given identity has used service X several times in the past 90 days, but has never used service Y. In this example, it can be considered that the given identity is likely to use service Y in the future (because service Y is often used with service X), even if the given identity has never used service Y in the past.

[0059] In operation 1014, it is determined whether the set of available policies includes one or more matching policy subsets that cover all of the selected permissions without allowing any additional permissions. This may include determining whether the set of available policies includes one or more matching policy subsets that cover all of the selected permissions without allowing any additional permissions, or whether the set of available policies does not include one or more matching policy subsets that cover all of the selected permissions without allowing any additional permissions. In some examples, operation 1014 may be performed by recommendation component 110, such as by using linear programming calculations, such as those performed by linear programming component 113, which may be executed on one or more computing devices. The calculations used to perform operation 1014 may include, for example Figure 4-6One or more formulas 400-600 in . In some examples, determining whether the available policy set includes one or more matching policy subsets that cover all selected permissions without allowing any additional permissions can be performed at a service-level granularity (e.g., via service-level formula 400), an individual action-level granularity (e.g., via individual action-level formula 500), and / or an action-category-level granularity (e.g., via action-category-level formula 600). In some examples, operation 1014 may include determining one or more matching policy subsets that cover all selected permissions without allowing any additional permissions and include a minimum number of policies (e.g., as specified via items 401, 501, and 601). In addition, in some examples, each of the one or more matching subsets may be limited to no more than a threshold number of policies (e.g., as specified via constraints 402, 502, and 602).

[0060] When the available policy set includes one or more matching policy subsets, a first recommendation is provided to the user to attach at least one of the one or more matching policy subsets to the identity (at operation 1016). Fig.11 Some example techniques for performing operation 1016 are described in detail. In some examples, at least one of the one or more matching strategy subsets can be selected for recommendation based on including a minimum number of strategies in the one or more matching strategy subsets (e.g., as specified via items 401, 501, and 601).

[0061] In contrast, when the set of available policies does not include one or more matching policy subsets, a second recommendation is provided to the user to attach one or more alternative policies to the identity (at operation 1018). In some examples, operation 1018 may include one of sub-operations 1018A, 1018B, or 1018C. At sub-operation 1018A, the customer is recommended to create a new policy to attach to the identity. Thus, when sub-operation 1018A is performed, the second recommendation may include a recommendation to create a new policy that covers all selected permissions without allowing any additional permissions.

[0062] At sub-operation 1018B, based on the selected criteria, a recommendation is made to attach an alternative policy subset of the available policy set to the identity. Thus, when performing sub-operation 1018B, the second recommendation may include a recommendation to adopt an alternative policy subset of the available policy set. The alternative policy subset may be a subset of the available policy set that does not exactly match the security requirements of the identity but provides a close approximation of the security requirements of the identity. Specifically, in some examples, the second recommendation may include a recommendation to attach an alternative policy subset of the available policy set to the identity, the alternative policy subset covering all selected permissions while allowing a minimum number of additional permissions (i.e., the number of additional permissions it includes is equal to or less than the number of additional permissions included by any other available policy subset that covers all selected permissions). In addition, in some examples, the second recommendation may include a recommendation to attach an alternative policy subset of the available policy set to the identity, the alternative policy subset not allowing any additional permissions while covering the maximum number of selected permissions (i.e., the number of selected permissions it includes is equal to or greater than the number of selected permissions included by any other available policy subset that does not include additional permissions). Additionally, in some examples, the second recommendation can include a recommendation to attach to the identity an alternative policy subset of the available policy set, the alternative policy subset selected based at least in part on a permission weighting (e.g., in favor of allowing additional permissions that are in the same action category as the selected permission, in favor of allowing additional permissions that are deemed to be a low security risk, etc.).

[0063] At sub-operation 1018C, it is recommended that the alternative policy subset be attached to the identity, and it is also recommended that the customer create a new policy to attach to the identity, such as to serve as a blank filler for the alternative policy subset. For example, in some cases, the alternative policy subset may cover most of the selected permissions, but may fail to cover a small number of remaining selected permissions. In this example, the customer can generate a new policy to cover these remaining selected permissions. Furthermore, in some examples, the alternative policy subset may provide a small number of additional permissions that are not included in the selected permissions. In this example, the customer can generate a new policy to exclude these additional permissions from the identity.

[0064] Fig.11 is a flow chart illustrating an example matching strategy subset selection process that can be used according to the present disclosure. In some examples, Fig.11 The process can be used to perform Fig.10 Operation 1016. Thus, in some examples, Fig.10 Operation 1016 may include Fig.11 Operations 1110-1116. Fig.11 The process starts at operation 1110, where one or more matching subsets of the available strategy set including the least number of strategies are determined. Fig.10 As described in operation 1014, the selected formula (e.g., Figure 4-6 400-600 in ) to determine one or more matching subsets of the set of available policies that include the minimum number of policies that cover all selected permissions without allowing any additional permissions (e.g., as specified via items 401, 501, and 601). Thus, in some examples, operation 1110 may include identifying a matching policy subset returned by executing the selected formula.

[0065] At operation 1112, it is determined whether there is only a single matching policy subset that includes the minimum number of policies. For example, in some cases, if the selected formula (e.g., Figure 4-6 400-600 in ) returns only a single result (i.e., a single matching policy subset), it can be determined that there is only a single matching policy subset that includes the least number of policies. In this case, no "tie-breaker" is needed because only a single result is returned. Therefore, if there is only a single matching policy subset that includes the least number of policies, then at operation 1114, the single matching policy subset that includes the least number of policies is recommended for the identity.

[0066] On the contrary, if the selected formula (for example, Figure 4-6 ) returns multiple results (i.e., multiple matching policy subsets), it can be determined that there are multiple matching policy subsets that include the least number of policies. In this case, a "tiebreaker" is required because multiple results are returned. Therefore, if there is not just a single matching policy subset that includes the least number of policies, then at operation 1116, one of the multiple matching policy subsets that includes the least number of policies is selected based on one or more criteria (e.g., action-level data, policy names, other weighting techniques). The selected matching policy subset is then recommended for the identity. For example, in some cases, the matching policy determination can be performed at a service-level granularity 201, such as using Figure 4. When the service-level formula 400 returns multiple results, the action-level data can sometimes be used as a “tiebreaker” to select one of the multiple results. For example, consider a scenario where one of the selected permissions is SeviceX-PutObject, and a given policy (Policy A) only provides the ServiceX-PutObject permission, while another given policy (Policy B) only provides the ServiceX-CreateBucket permission. In this example, at the service-level granularity, both Policy A and Policy B are considered to cover the SeviceX-PutObject permission (because both policies include permissions for ServiceX), even though PutObject is a different action from CreateBucket. However, by reviewing the action-level data, it can be determined that Policy A is actually a better match for the identity than Policy B (because the PutObject permission in Policy A exactly matches the selected permission for the identity). Therefore, in some examples, for the identity, a matching policy subset that includes Policy A can be recommended rather than a matching policy subset that includes Policy B. Similarly, in some cases, matching policy determination can be performed at the action category level granularity 202, such as using Figure 6 . When the action category-level formula 600 returns multiple results, a similar analysis can also be used as a "tiebreaker". For example, consider the same scenario, where one of the selected permissions is SeviceX-PutObject, and a given policy (Policy A) only provides ServiceX-PutObject permissions, while another given policy (Policy B) only provides ServiceX-CreateBucket permissions. In this example, using the action category-level granularity, both Policy A and Policy B are considered to cover the SeviceX-PutObject permission (because both policies include permissions to write to ServiceX in the category), even though PutObject is a different action from CreateBucket. However, by looking at the action-level data, it can be determined that Policy A actually matches the identity better than Policy B (because the PutObject permission in Policy A exactly matches the selected permissions of the identity). Therefore, in some examples, for this identity, a matching policy subset that includes Policy A can be recommended instead of a matching policy subset that includes Policy B. In yet another example, the policy name can be used as a "tiebreaker", for example by selecting a policy whose name most closely matches the name of the identity. Any combination of these other criteria can be used.

[0067] Policy determination for identity sets

[0068] The present invention also describes techniques for determining new and existing policies for sets of identities. The techniques may be employed by an identity management service that allows customers to control and manage access to computing services and resources by creating identities (e.g., users, groups, roles, etc.) and defining permissions for the identities. The identity management service may provide recommendations to customers about new and / or existing policies that can be used for sets of identities (e.g., identities within a customer account). In some examples, the identity management service may perform individual analysis on each identity in the set of identities to determine for which, if any, of these identities there is a set of one or more existing policies that satisfy an existing policy constraint set. For each identity, the existing policy constraint set may include, for example, the following constraints: a constraint that the set of one or more existing policies must include all selected permissions for the identity; a constraint that the set of one or more existing policies must not exceed a maximum additional permission threshold for the identity; a constraint that the set of one or more existing policies must not exceed a maximum policy number threshold; and / or other constraints. For each identity that satisfies the existing policy constraint set, the identity may be placed in an existing policy identity pool. The service may provide the user with a recommendation to attach the set of one or more existing policies to the identity that satisfy the existing policy constraints.

[0069] In contrast, identities that do not satisfy the existing policy constraint set can be placed into a new policy identity pool. The service can generate one or more new policies to attach to the identities in the new policy identity pool. Specifically, in some examples, the service can generate a new policy corresponding to the largest identity group in the new policy identity pool that satisfies the new policy constraint set. The new policy constraint set can include, for example, constraints that the new policy must include selected permissions for each identity in the largest identity group, constraints that the new policy must not exceed one or more maximum additional permission thresholds, constraints that the new policy must not exceed a maximum number of permissions thresholds, and / or other constraints. The service can provide a recommendation to the user to attach a new policy that satisfies the new policy constraints to each identity in the largest identity group.

[0070] In some examples, once the first new policy is generated for the corresponding identity group, the identities can be removed from the new policy identity pool. The service can then repeat the new policy generation process, such as by generating a second new policy corresponding to the largest identity group that satisfies the new policy constraint set among the remaining identities in the new policy identity pool. Once the second new policy is generated for the corresponding identity group, the identities can be removed from the new policy identity pool. In each iteration of the process, a new policy is generated that satisfies the new policy constraints for the current largest identity group in the new policy identity pool.

[0071] It is worth noting that the techniques described herein can provide a number of advantages. For example, by first determining each identity that satisfies an existing set of policy constraints, the service can recommend existing policies (rather than new policies) for these identities. This can help ensure that new policies are only generated for identities for which existing policies are not appropriate, thereby reducing the number of new policies that need to be generated and need to be managed by the customer. In addition, for scenarios where new policies are required, the techniques described herein can help reduce customer workload and frustration. For example, by creating new policies for the largest group of identities that satisfy the new policy constraints, the total amount of new policies generated on behalf of the user can be minimized, thereby also reducing the number of policies that need to be managed by the customer. In addition, the new policy constraints used to create the new policy can help ensure that the new policy meets the customer's requirements. For example, in some cases, the customer can set various constraints, such as a threshold number of additional permissions for the new policy, a maximum permission threshold for the new policy, and the like.

[0072] Fig.12 1 is a diagram illustrating the formation of an existing policy identity pool 1220 and a new policy identity pool 1230 that may be used in accordance with the present disclosure. Fig.12 As shown, identity set 1200 includes identities 1201-1207 (where any given individual identity is hereinafter referred to as identity 1201-1207 or identity 1201-1207). In some examples, identity set 1200 may correspond to an account of a customer of an identity management service, such that each identity within the account is included in identity set 1200. Fig.12 In the example of , identity set 1200 is provided to policy advisor 1210, which is a computing component that individually and separately evaluates each identity 1201-1207 within identity set 1200 to determine whether there is a set of one or more existing policies that satisfy the set of existing policy constraints for identity 1201-1207. In some examples, policy advisor 1210 may include Figure 1 The recommended component 110, whose operation is referenced above Figure 1-11 In addition, in some examples, the strategy advisor 1210 may include one or more linear programming components, such as Figure 1 The linear programming component of 113.

[0073] In some examples, the set of one or more existing policies that satisfy the existing policy constraint set may include one or more existing service-generated policies and / or one or more existing customer-generated policies. In addition, in some examples, the set of one or more existing policies that satisfy the existing policy constraint set may include Figure 1 A subset of the available policy set (APS) 101. Figure 1 The identity (for example, Figure 1 Identity 100 or Fig.12 The available policy set 101 is determined based on the identities 1201-1207 of the present invention. In this example, the available policy set 101 is an existing policy set that can be used for the identities. The available policy set 101 can include, for example, one or more existing service-generated policies generated by an identity management service. The available policy set 101 can also include, for example, one or more existing customer-generated policies that can be used for the identities, such as one or more existing customer-generated policies that are located in the same customer account as the identities 1201-1207.

[0074] Reference now Fig.13 , shows existing policy constraints 1300. Existing policy constraints 1300 are examples of existing policy constraint sets that policy advisor 1210 can employ. Fig.13 In the example of , the existing policy constraints 1300 include constraint 1301, that is, the set of one or more existing policies must include all selected permissions (SP) 102 for identities 1201-1207. The selected permissions 102 for the identities have been referred to above. Figure 1 The selected permissions 102 are associated with the identity (e.g., Figure 1 Identity 100 or Fig.12 The selected permissions 102 may include, for example, permissions that the identity has used within a selected previous time window (e.g., within the past 90 days). In some examples, the selected permissions 102 may also include other permissions, such as permissions manually selected by the customer, the union of permissions currently attached to multiple policies of the identity (if the identity currently has attached policies), etc. In a specific example, the selected permissions 102 may also include, for example, permissions that are estimated to be used by the identity in a future time period with a probability greater than a threshold probability, such as can be determined by one or more machine learning components, as described above with reference to Figure 1 Described in detail.

[0075] exist Fig.13In the example of, the existing policy constraint 1300 also includes constraint 1302, i.e., one or more existing policies of the group do not exceed the maximum additional permission (AP) threshold. In some examples, the maximum additional permission threshold can be set by the customer, service and / or any other entity. As described above, the term "additional permission" used in this article refers to permissions that are not included in the selected permissions 102 for identities 1201-1207. The maximum additional permission threshold is the upper limit of how many additional permissions can be granted by one or more existing policies of the group without violating the existing policy constraint 1300. In some examples, all identities 1201-1207 can have the same maximum additional permission threshold. In contrast, in some examples, each identity 1201-208 can have its own corresponding maximum additional permission threshold, and the maximum additional permission threshold can be optionally different for each identity in the identity 1201-1207. In some examples, the maximum additional permission threshold can be zero, which means that one or more existing policies of the group do not allow any additional permissions. On the contrary, in some examples, the maximum additional permission threshold can be higher than zero. For example, if the maximum additional permissions threshold is five, then the set of one or more existing policies may allow five or fewer additional permissions. Figure 4-6 In the example, the lowercase Greek letter Xi (ξ) is used to represent the maximum additional permission threshold. Figure 4-6 In the example, the maximum additional permission threshold can be zero or greater than zero.

[0076] exist Fig.13 In the example of , the existing policy constraints 1300 also include constraint 1303, namely that the group of one or more existing policies does not exceed a maximum policy number threshold. In some examples, the maximum policy number threshold can be set by a customer, a service, and / or any other entity. The maximum policy number threshold is an upper limit on how many policies the group of one or more existing policies can include without violating the existing policy constraints 1300. It should be noted that constraints 1301-1303 are merely examples of constraints that may be included in the existing policy constraints 1300, and any or all of constraints 1301-1303 may be modified in whole or in part or omitted from the existing policy constraints 1300. In addition, the existing policy constraints 1300 may optionally include any number of additional constraints ( Fig.13 not shown).

[0077] In some examples, to determine whether there is a set of one or more existing policies that satisfy existing policy constraints 1300 for identities 1201-1207, policy advisor 1210 may perform the above Figure 4 Service level formula 400, Figure 5The action-level formula 500 and the action-category-level formula 600 (hereinafter collectively referred to as formulas 400-600) of FIG. 4 are any or all calculations represented by the action-level formula 500 and the action-category-level formula 600 of FIG. 400-600. Specifically, as described above, each of the formulas 400-600 will select a set of one or more existing strategies (in the set of one or more existing strategies) having the minimum number of strategies that satisfy the constraints 402-405, 502-505, or 602-605 corresponding to the existing strategy constraints 1300, respectively. Figure 4-6 It should be understood that if there is no set of one or more existing policies that satisfy the existing policy constraint 1300, then formulas 400-600 will not return a valid solution. It should be noted that Fig.13 The constraint 1301 corresponds to Figure 4-6 Constraints 403, 503 and 603. It is also important to note that Fig.13 The constraint 1302 corresponds to Figure 4-6 Constraints 404, 504, and 604. Also note that Fig.13 Constraint 1303 in corresponds to Figure 4-6 As described above, the service level formula 400 is used for service level granularity. Figure 5 The action-level formula 500 in FIG. 5 is used for action-level granularity, while the action-category-level formula 600 is used for action-category-level granularity. The use of each of these different granularities has been described in detail above and will not be repeated here.

[0078] Return to reference Fig.12 , shows that the policy advisor 1210 can divide the identity set 1200 into an existing policy identity pool 1220 and a new policy identity pool 1230. The existing policy identity pool 1220 may include each identity in the identities 1201-1207 for which there is a set of one or more existing policies that satisfy the existing policy constraints 1300. Fig.12 In the example of , there is only a single identity (identity 1201) for which there is a set of one or more existing policies that satisfy existing policy constraints 1300. Fig.12 In the example of , the existing policy identity pool 1220 only includes identity 1201. Fig.12 As shown, the set of existing policies that satisfy the existing policy constraint 1300 for the identity 1201 includes the existing policy 1221 and the existing policy 1222 .

[0079] In contrast, new policy identity pool 1230 may include each of identities 1201-1207 for which there is no set of one or more existing policies that satisfy existing policy constraints 1300. Fig.12In the example of , there are six identities (identities 1202-1207) for which there is no set of one or more existing policies that satisfy existing policy constraints 1300. Fig.12 In the example of , the new policy identity pool 1230 includes identities 1202-1207. Fig.12 As shown, the new policy identity pool is provided to the policy generator 1410, and the policy generator 1410 can generate a new policy for the new policy identity pool 1230, as described below with reference to Figure 14A-1 6 described in detail.

[0080] Reference now Fig.14A , some example techniques for the policy generator 1410 to generate new policies will now be described in detail. Fig.14A As shown, a new policy identity pool 1230 including identities 1202-1207 is provided to a policy generator 1410. The policy generator 1410 is a computational component that may include one or more linear programming components, such as for solving integer linear programming problems, including, for example, the following detailed description. Fig. 16B The new policy generation formula 1630. As will now be described in detail, the policy generator 1410 generates a new policy identity pool 1230 that satisfies the new policy constraint set (e.g., Fig.15 The new policy constrains the maximum identity group (1500) Fig.14A In the example of , a new policy 1411 is generated for the identity group 1421. As shown in the figure, Fig.14A In the example of , policy generator 1410 generates new policy 1411 for identity group 1421, which includes identities 1202-1204.

[0081] Once a new policy is generated for the largest identity group, the identity group can be removed from the new policy identity pool 1230. The policy generator 1410 can then generate another new policy for the largest identity group remaining in the new policy identity pool 1230. This process of generating new policies and removing identity groups from the new policy identity pool 1230 can be repeated any number of times until the new policy identity pool 1230 is empty, meaning that there are no remaining identities in the new policy identity pool 1230. For example, now referring to Fig. 14B , shows that after generating new policies 1411 for identities 1202-1204 (as described above with reference to Fig.14A As described above), identities 1202-1204 are removed from the new policy identity pool 1230. Fig. 14B As shown, the removal of identities 1202-1204 leaves only identities 1205-1207 in the new policy identity pool 1230. Fig. 14B As shown, the policy generator 1410 then generates new policy identity pool 1230 for the remaining identity pools that satisfy the new policy constraint set (e.g., Fig.15 The new policy constrains the maximum identity group (1500) Fig. 14B In the example of , a new policy 1412 is generated for the identity group 1422. As shown in the figure, Fig. 14B In the example of , policy generator 1410 generates new policy 1412 for identity group 1422, which includes identities 1205-1206.

[0082] Reference now Fig. 14C , showing the generation of new policies 1412 for identities 1205-1206 (as described above with reference to Fig. 14B After that, identities 1205-1206 are removed from the new policy identity pool 1230. Fig. 14C As shown, the removal of identities 1205-1206 leaves only identity 1207 in the new policy identity pool 1230. Fig. 14C As shown, the policy generator 1410 then generates new policy identity pool 1230 for the remaining identity pools that satisfy the new policy constraint set (e.g., Fig.15 The new policy constrains the maximum identity group (1500) Fig. 14C In the example of , a new policy 1413 is generated for the identity group 1423. As shown in the figure, Fig. 14C In the example of , the policy generator 1410 generates a new policy 1413 for the identity group 1423, which only includes the identity 1207. After the new policy 1413 is generated for the identity 1207, the identity 1207 is removed from the new policy identity pool 1230. After the identity 1207 is removed from the new policy identity pool 1230, the new policy identity pool 1230 is emptied and the new policy generation process is completed. In some examples, at least one of the maximum identity groups formed in the new policy generation process may include more than one identity. For example, identity groups 1421 and 1422 both include more than one identity. It is worth noting that in some examples, there may be multiple maximum identity groups that meet the new policy constraint set and include the same number of identities (meaning that there is a connection between these multiple identity groups). In this case, any one of these groups can be selected as the maximum identity group, and then the process can be repeated.

[0083] Reference now Fig.15 , new policy constraints 1500 are shown. New policy constraints 1500 are examples of new policy constraint sets that policy generator 1410 may employ. Fig.15 In the example of , the new policy constraint 1500 includes constraint 1501, that is, the new policy must include all selected permissions (SP) for each identity in the largest identity group. Figure 1 The selected permissions 102 for the identity are described in detail. The selected permissions 102 are associated with the identity (e.g., Figure 1 Status 1201 or Fig.14A The selected permissions 102 may include, for example, permissions that the identity has used within a selected previous time window (e.g., within the past 90 days). In some examples, the selected permissions 102 may also include other permissions, such as permissions manually selected by the customer, the union of permissions currently attached to multiple policies of the identity (if the identity currently has attached policies), etc. In a specific example, the selected permissions 102 may also include, for example, permissions that are estimated to have a probability greater than a threshold probability of being used by the identity in a future time period, such as can be determined by one or more machine learning components, as described above with reference to Figure 1 Described in detail.

[0084] exist Fig.15 In the example of , new policy constraint 1500 includes constraint 1502, i.e., the new policy shall not exceed one or more applicable maximum additional permissions (AP) thresholds. In some examples, one or more applicable maximum additional thresholds may be set by a customer, service and / or any other entity. As described above, the term additional permissions used herein refers to permissions not included in the selected permissions 102 for identities 1202-1207. The applicable maximum additional permissions threshold is the upper limit of how many additional permissions the new policy can grant without violating the new policy constraint 1500. One or more applicable maximum additional permissions thresholds include one or more maximum additional permissions thresholds applicable to the identity in the maximum identity group. As described above, in some examples, all identities may have the same maximum additional permissions threshold. In this case, there will be only one applicable maximum additional permissions threshold used for all identities. On the contrary, in some examples, each identity (or at least some identities) may have its own corresponding maximum additional permissions threshold, which may be different from each other. In this case, there may be multiple different applicable maximum additional permissions thresholds. It is important to note that for scenarios where there are multiple different applicable maximum additional permissions thresholds, only the threshold for the identity to which each threshold applies (rather than all identities in the maximum identity group) need be met. For example, if the threshold for the first identity is five and the threshold for the second identity is ten, then the threshold of five applies only to the first identity and the threshold of ten applies only to the second identity. For example, if the new policy grants seven additional permissions to the first identity, this would violate constraint 1502 because seven exceeds the threshold of five for the first identity. Conversely, if the new policy grants seven additional permissions to the second identity, this would not violate constraint 1502 because seven does not exceed the threshold of ten for the second identity.

[0085] exist Fig.15In the example of , the new policy constraint 1500 also includes constraint 1503, namely that the new policy does not exceed a maximum permission number threshold. In some examples, the maximum permission number threshold can be set by the customer, the service and / or any other entity. The maximum permission number threshold is an upper limit on how many permissions the new policy can include without violating the new policy constraint 1500. The maximum permission number threshold can prevent the new policy from including too many permissions, which can make the new policy difficult and cumbersome to manage for the customer. It should be noted that constraints 1501-1503 are merely examples of constraints that can be included in the new policy constraint 1500, and any or all of constraints 1501-1503 can be modified in whole or in part or omitted from the new policy constraint 1500. In addition, the new policy constraint 1500 can optionally include any number of additional constraints ( Fig.15 not shown).

[0086] Reference now Figures 16A-16B , some example definitions and formulas related to generating new policies 1411-1413 will now be described in detail. Figures 16A-16B In the example of , the letter (K) represents the total number of identities currently in the new policy identity pool 1230. For example, in Fig.14A , the new policy identity pool 1230 includes six identities (identities 1202-1207), so the value of (K) is six. As another example, in Fig. 14B , after removing identities 1202-1204, the new policy identity pool 1230 includes three identities (identities 1205-1207), so the value of (K) is three. In addition, the capital letter (P) represents all permissions being considered by the policy generator 1410, which may include all permissions associated with identity management services provided by the computing service provider, for example, a combination of all services provided by the computing service provider and their associated actions. The lowercase letter (p) represents an individual permission, where P = {p1, p2, ... p N}. Therefore, the letter (N) represents the total number of permissions. As shown in definition 1601, the letter (i) represents a given identity and the letter (j) represents a given permission. The symbol (u i ) is related to the selected permissions of a given identity (i). Specifically, as shown in definition 1601, the vector (u i ) represents the selected permissions for a given identity (i), where for each permission (j) from 1 to (N), the value of the vector is either zero or one. If permission (j) is the selected permission for identity (i), then u i [j] = 1; otherwise zero. If all vectors (u i ) are stacked together, a KxN matrix is ​​generated, U T =[u1,u 2,... u K], this matrix can be called the access matrix for a given K identities. Therefore, if U ij =1, it means that identity (i) requires permission (j).

[0087] In addition, the lowercase Greek letter Pi (π) is used to represent the new policy. As shown in definition 1602, the new policy (π) has an associated vector (π) whose value is zero or one for each permission (j) from 1 to (N). Definition 1603 shows that each permission (p j ) has a value from 1 to (N). For each permission (p j ), if the policy (π) grants j ) has access rights, then π j = 1; otherwise, zero. The capital Greek letter Xi (Ξ) represents the maximum number of permissions, as shown in the above reference Fig.15 The constraint 1503 is described. Symbol (δ i ) represents the maximum additional permission threshold for a given identity (i), as mentioned above. Fig.15 As described in constraint 1502.

[0088] A new policy (π) is considered attachable to a given identity (i) if it is in the set of appropriate policies for that identity (i). If the new policy (π) is less permissive than the selected permissions of that identity, then the new policy (π) is not applicable to that identity (i). If the selected permissions of identity (i) are included in the set of permissions to which the new policy (π) grants access, then the new policy (π) is applicable to that identity (i). If the new policy (π) is applicable to identity (i) and is the only attached policy for identity (i), then there is no permission (j) such that π j =0 and U ij = 1. Therefore, for all permissions (j), if permission (j) is the selected permission for identity (i), then π j -U ij = 0, if authority (j) is not the selected authority for identity (i), then π j -U ij =1. Therefore, the number of additional permissions for a given identity is shown in formula 1604. In formula 1604, (UP i ) represents the number of additional permissions for a given identity (i). Therefore, (UP i ) is equal to π j -U ij The sum of (from j=1 to j=N). In addition, in formula 1604, number (1) is an N-dimensional vector of all 1s.

[0089] As shown in definition 1605, the variable (ζ i ). If for all permissions (j), Uij Less than or equal to π j , then the variable (ζ i ) is equal to one. Otherwise, the variable (ζ i ) is equal to zero. Therefore, if identity (i) can use the new policy, then ζ i =1, otherwise ζ i = 0. If the new policy (π) is not applicable to identity (i), then there exists a permission (j) that is the selected permission for identity (i) (which means U ij = 1), but the new policy (π) does not grant this permission (which means π j =0).

[0090] To maximize the number of identities in the current identity pool (K) that can use the new strategy (π), maximize the variable (ζ i ). This can be performed by optimization, such as Fig. 16B The new strategy generation formula is shown in 1630. Fig. 16B As shown, the new strategy generation formula 1630 includes an item 1631, which indicates that the new strategy generation formula 1630 maximizes the variables (ζ) of the generated new strategy that meet the conditions of the new strategy generation formula 1630 by satisfying constraints 1632-1634. i The abbreviation st in the new policy generation formula 1630 (and other formulas described herein) means such that (i.e., such that constraints 1632-1634 are satisfied). Constraint 1632 ensures that the new policy generated by the new policy generation formula 1630 does not exceed the maximum number of permissions threshold (Ξ), as described above with reference to Fig.15 This means that the new policy cannot grant access rights with more permissions than the maximum number of permissions specified by the threshold (Ξ). Therefore, constraint 1632 of FIG. 16 corresponds to Fig.15 Constraint 1503.

[0091] Constraint 1633 ensures that a given identity (i) is only considered a covered identity (meaning ζ i =1). When ζ i = 0, the greater than or equal to zero condition included in constraint 1633 is always true for all permissions (j). i = 1, constraint 1633 is enforced, and for all values ​​of (j), π j -U ij is greater than or equal to zero, which is the condition for the new policy to apply to identity (i). Therefore, constraint 1633 corresponds to Fig.15 Constraint 1501.

[0092] Constraint 1634 ensures that the number of additional permissions for each identity does not exceed the applicable maximum additional permissions threshold for that identity. i = 0, based on constraint 1632, the condition of constraint 1634 being less than or equal to zero will be satisfied. i = 1, in order to satisfy the less than or equal to zero condition of constraint 1634, then relation 1640 must be true. Relation 1640 satisfies the maximum additional permissions threshold for identity (i). Therefore, constraint 1634 ensures that the number of additional permissions will not become greater than the maximum additional permissions threshold for the identity that will use the new policy. Therefore, constraint 1634 corresponds to Fig.15 Constraint 1502.

[0093] The optimization problem shown in the new strategy generation formula 1630 has a linear objective function and all linear inequality constraints. However, since the optimization variables are integers, it is a non-convex problem. Non-convex problems are generally difficult to solve. However, since the objective function and all constraints 1632-1634 are linear, the new strategy generation formula 1630 can be efficiently solved. In some examples, various integer linear programming techniques and algorithms can be used to solve the new strategy generation formula 1630, and the technology described herein is not limited to any specific technology or algorithm. The new strategy generation formula 1630 has 2K+N+1 constraints. For larger K values, a large number of constraints may slow down the solution of the new strategy generation formula 1630.

[0094] In some examples, one or more simplification techniques can be employed to simplify the new policy generation formula 1630 and make it easier (e.g., faster) to solve. One example simplification technique involves reducing the number of total permissions (N) considered. In some cases, the total number of permissions (N) considered may be very large due to the large number of available services and related action permissions. Not all of these permissions are required by the identity being evaluated. In some examples, to reduce the total number of permissions (N) considered, the permissions (N) considered may be reduced to a union of selected permissions required by only the current identity (K) in the new policy identity pool 1230. For example, for Fig.14A , the permissions considered (N) can be reduced to a union of only the selected permissions required by identities 1202-1207, which are the current identities (K) of the new policy identity pool 1230. As another example, for Fig. 14B , the permissions considered (N) can be reduced to a union of only the selected permissions required by identities 1205 - 1207 , which are the current identities (K) of the new policy identity pool 1230 .

[0095] Another example simplification technique involves reducing the number of identities considered. Typically, multiple identities in a customer account often require the same set of selected permissions. To improve the efficiency (e.g., speed) of solving the new policy generation formula 1630, the current identities (K) with similar selected permissions in the new policy identity pool 1230 (e.g., Figure 4 The identities 1202-1207 in A) can be clustered into multiple clusters (e.g., sub-pools). Fig. 16B Symbol 1651 shows how the sum symbol of term 1631 appears without identity clustering. However, when the identity is clustered into multiple clusters, instead of maximizing symbol 1651, symbol 1652 is maximized by replacing symbol 1651 with symbol 1652 in term 1631. In symbol 1652, (w i ) represents the number of identities in a given cluster (i). Therefore, the efficiency (eg, speed) of solving the new policy generation formula 1630 can be improved by reducing the number of identities considered from all identities in the new policy identity pool 1230 to the identities in a given cluster.

[0096] Fig.17A is a flow chart illustrating an example process for forming new and existing policy identity pools that can be used in accordance with the present disclosure. In some examples, Fig.17A Any or all of the operations in can be performed by the identity management service. Fig.17A The process is initiated at operation 1710, where a request is received to recommend a policy for a set of identities. As described above, in some examples, the identity management service may receive the request from a customer. In some examples, the set of identities may include all identities within a given customer account. For example, in some cases, a customer may request the identity management service to recommend policies for all identities in a given customer account. In some examples, the identity management service may provide a feature that recommends existing policies that satisfy an existing policy constraint set for each identity in the set of identities and recommends new policies that do not satisfy the existing policy constraint set for the identities in the set of identities. In some examples, the request received at operation 1710 may invoke the feature.

[0097] At operation 1712, the selected permissions are determined for each identity in the identity set. Figure 1As described, the selected permissions (SP) 102 are permissions associated with the permission usage of the identity. The selected permissions 102 may include, for example, permissions that the identity has used within a selected previous time window (e.g., within the past 90 days). In some examples, the selected permissions 102 may also include other permissions, such as permissions manually selected by the customer, the union of permissions currently attached to multiple policies of the identity (if the identity currently has attached policies), etc. In a specific example, the selected permissions 102 may also include, for example, permissions that are estimated to be used by the identity in a future time period with a probability greater than a threshold probability, such as can be determined by one or more machine learning components, as described above with reference to Figure 1 Described in detail.

[0098] At operation 1713, an identity in the identity set is selected for evaluation. The following operations 1714-1720 are repeated to evaluate each identity in the identity set separately. There is no specific order in which the identities need to be evaluated, and the order in which the identities are evaluated can be determined randomly or using any desired technique. Operations 1714-1720 are first performed for the identity selected at operation 1713.

[0099] In operation 1714, it is determined whether there is a set of one or more existing policies that satisfy the existing policy constraints for the identity. Fig.13As described, the existing policy constraint 1300 may include constraint 1301, i.e., the group of one or more existing policies must include all selected permissions (SP) 102 for the identity. The existing policy constraint 1300 also includes constraint 1302, i.e., the group of one or more existing policies does not exceed the maximum additional permissions (AP) threshold. In some examples, the maximum additional permissions threshold can be set by a customer, a service, and / or any other entity. As described above, the term "additional permissions" used in this article refers to permissions that are not included in the selected permissions 102 for the identity. The maximum additional permissions threshold is the upper limit of how many additional permissions can be granted by the group of one or more existing policies without violating the existing policy constraint 1300. In some examples, all identities can have the same maximum additional permissions threshold. In contrast, in some examples, each identity can have its own corresponding maximum additional permissions threshold, which can be optionally different for each identity. In some examples, the maximum additional permissions threshold can be zero, which means that the group of one or more existing policies does not allow any additional permissions. In contrast, in some examples, the maximum additional permissions threshold can be higher than zero. For example, if the maximum additional permissions threshold is five, then the set of one or more existing policies may allow five or fewer additional permissions. Existing policy constraints 1300 also include constraint 1303 that the set of one or more existing policies does not exceed a maximum policy quantity threshold. In some examples, the maximum policy quantity threshold may be set by a customer, service, and / or any other entity. The maximum policy quantity threshold is an upper limit on how many policies the set of one or more existing policies may include without violating existing policy constraints 1300.

[0100] In some examples, to determine whether there is a set of one or more existing policies that satisfy the existing policy constraints 1300 for the identity, the policy advisor 1210 can perform one or more linear programming calculations. Some examples of calculations that can be employed are as described above. Figure 4 Service level formula 400, Figure 5 The action-level formula 500 and the action-category-level formula 600 (hereinafter collectively referred to as formulas 400-600) are represented. Specifically, as described above, each of the formulas 400-600 will select a set of one or more existing strategies (in Figure 4-6 It should be understood that if there is no set of one or more existing policies that satisfy the existing policy constraint 1300, then formulas 400-600 will not return a valid solution. It should be noted that Fig.13 The constraint 1301 corresponds to Figure 4-6 Constraints 403, 503, and 603. Note also that Fig.13 The constraint 1302 corresponds to Figure 4-6 Constraints 404, 504 and 604. It should also be noted that Fig.13 The constraint 1303 corresponds to Figure 4-6 As described above, the service level formula 400 is used for service level granularity. Figure 5 The action level formula 500 in is used for action level granularity, and the action category level formula 600 is used for action category level granularity. The use of each different granularity is described in detail above, and will not be repeated here.

[0101] At operation 1714, if it is determined that there is a set of one or more existing policies that satisfy the existing policy constraints for the identity, then at operation 1716, the identity can be added to the pool of existing policy identities and an instruction can be provided to the user to attach the set of one or more existing policies to the identity. Fig.12 As shown, it is determined that there is a set of existing policies (including existing policy 1221 and existing policy 1222) that satisfy the existing policy constraints for identity 1201. Therefore, identity 1201 is added to existing policy identity pool 1220. Instructions can be provided to the user to attach the set of existing policies (including existing policy 1221 and existing policy 1222) to identity 1201. In some cases, there may be multiple sets of one or more existing policies that satisfy the existing policy constraints for the identity. In these cases, the set of one or more existing policies that includes the least number of policies can be recommended to the customer to attach to the identity. For example, the above description of Fig.11 Operation 1116 of describes in detail some example techniques for selecting one of multiple groups of existing strategies to recommend to the client, and this description is not repeated here.

[0102] At operation 1714, if it is determined that there is not a set of one or more existing policies that satisfy the existing policy constraints for the identity, then at operation 1718, the identity can be added to the new policy identity pool and a new policy can be generated to attach to the identity (and optionally, one or more other identities in the new policy identity pool). Fig.12 As shown, it is determined that there is no set of existing policies that satisfy the existing policy constraints for any of the identities 1202-1207. Therefore, identities 1202-1207 are added to the new policy identity pool 1230. Figures 14A-16B Some example techniques for generating one or more new policies for identities in a new policy identity pool are described below. Fig. 17B Described.

[0103] At operation 1720, it is determined whether all identities in the identity set have been evaluated through operations 1714-1720. If all identities have not been evaluated, then at operation 1722, the next identity in the identity set is selected and operations 1714-1720 are repeated for the next selected identity. Conversely, if all identities in the identity set have been evaluated, the process ends at operation 1724 and optionally continues with Fig. 17B process.

[0104] Fig. 17B is a flow chart illustrating an example new policy generation process that can be used according to the present disclosure. In some examples, Fig.17A Any or all of the operations in can be performed by the identity management service. Fig.17A The process starts at operation 1810 where multiple identities are added to a new policy identity pool associated with the generation of a new policy. In some examples, Fig. 17B The process can be Fig.17A In addition, in some examples, multiple identities can be executed by executing Fig.17A Operation 1718 is added to the new policy identity pool. Therefore, for Fig. 17B The process in Fig.17A In the scenario where the process is performed after the operation 1810 is performed, the operation 1810 may be performed by Fig.17A Operation 1718 is performed and does not need to be repeated.

[0105] An example of operation 1810 is as follows Fig.12 As shown, Fig.12 Identities 1202-1207 are shown being added to a new policy identity pool 1230. In some examples, it can be determined that there is no set of one or more existing policies that satisfy an existing policy constraint set for each of the multiple identities. The identity can be added to the new policy identity pool based on the absence of a set of one or more existing policies that satisfy an existing policy constraint set for each of the multiple identities. In addition, one or more new policies can be generated for the multiple identities based on the absence of a set of one or more existing policies that satisfy an existing policy constraint set for each of the multiple identities. For example, as described above with reference to Fig.12 As described, it can be determined that there is no one or more existing policies that satisfy the existing policy constraint set for identity 1202-1207 for each of identities 1202-1207. Based on the absence of one or more existing policies that satisfy the existing policy constraint set for identity 1202-1207, each identity 1202-1207 can be added to new policy identity pool 1230.

[0106] As also described above, each of the multiple identities has a corresponding selected permission associated with the permission use of the identity. The corresponding selected permission of each of the multiple identities can be determined, for example, based on the technology described in detail above. As described above, the selected permission of the identity can be determined by the identity management service, for example, based on the permission use data of the identity and other optional identities (for example, other identities and / or global identity pools in the same account), which can be compiled and updated by the identity management service. The selected permission can include, for example, the permission used by the identity in the selected previous time window (for example, in the past 90 days). For example, the identity management service can track the use of the identity to the permission as part of the permission use data. In some examples, the selected permission can also include other permissions, such as the permission manually selected by the customer, the union of the permissions currently attached to the multiple policies of the identity (if the identity currently has the attached policy), etc. In a specific example, the selected permission can also include, for example, permissions that are estimated to be used by the identity in a future time period with a probability greater than a threshold probability.

[0107] At operation 1812, a new policy is generated based on the new policy constraint set, and the new policy corresponds to the largest identity group in the new policy identity pool that satisfies the new policy constraint set. Fig.14A As shown, a new policy 1411 is generated for identity group 1421, which is the largest identity group in the new policy identity pool 1230 that satisfies the new policy constraint set. Identity group 1421 includes identities 1202-1204. Fig.15As described, the new policy constraint set (e.g., new policy constraint 1500) may include a first constraint (e.g., constraint 1501), that is, the new policy includes the corresponding selected permissions for each identity in the maximum identity group. The new policy constraint set may also include a second constraint (e.g., constraint 1502), that is, the new policy does not exceed one or more maximum additional permissions (AP) thresholds. In some examples, one or more maximum additional permissions thresholds may include multiple maximum additional permissions thresholds, and each identity in the new policy identity pool may have a corresponding maximum additional permissions threshold in multiple maximum additional permissions thresholds. For example, as described above, one or more applicable maximum additional thresholds may be set by a customer, a service, and / or any other entity. As described above, the term "additional permissions" used herein refers to permissions that are not included in the selected permissions 102 for identities 1202-1207. The applicable maximum additional permissions threshold is the upper limit of how many additional permissions the new policy can grant without violating the new policy constraint 1500. One or more applicable maximum additional permissions thresholds include one or more maximum additional permissions thresholds applicable to the identity in the maximum identity group. As described above, in some examples, all identities may have the same maximum additional permissions threshold. In such a scenario, there will be only one applicable maximum additional permission threshold for all identities. In contrast, in some examples, each identity (or at least some identities) may have its own corresponding maximum additional permission threshold, which may be different from each other. In such a scenario, there may be multiple different applicable maximum additional permission thresholds.

[0108] The new policy constraint set may also include a third constraint (e.g., constraint 1503) that the new policy does not exceed a maximum number of permissions threshold. In some examples, the maximum number of permissions threshold may be set by the customer, the service, and / or any other entity. The maximum number of permissions threshold is an upper limit on how many permissions the new policy may include without violating new policy constraint 1500. The maximum number of permissions threshold may prevent the new policy from including too many permissions, which would make the new policy difficult and cumbersome for the customer to manage.

[0109] At operation 1814, one or more instructions are provided to the user to attach the new policy to each identity in the maximum identity group. For example, the identity management service can provide an instruction (e.g., a recommendation) to the user to attach the new policy to each identity in the maximum identity group. In some examples, the instruction can indicate the content of the new policy and can indicate the identities within the maximum identity group.

[0110] In operation 1816, the largest identity group is removed from the new policy identity pool. Fig. 14B As shown, in generating new policies 1411 for identities 1202-1204 (as described above with reference to Fig.14AAfter that, the identities 1202-1204 are removed from the new policy identity pool 1230. Fig. 14B As shown, after removing identities 1202 - 1204 , only identities 1205 - 1207 remain in the new policy identity pool 1230 .

[0111] In operation 1818, it is determined whether the new policy identity pool is empty. If the new policy identity pool is not empty, then in operation 1820, operations 1812-1818 are repeated until the new policy identity pool is empty. Additional new policies are generated in each iteration of operations 1812-1818. For example, after removing identities 1202-1204 from the new policy identity pool 1230, the policy generator 1410 then generates additional policies for the remaining identities in the new policy identity pool 1230 that satisfy the new policy constraint set (e.g., Fig.15 The new policy constrains the maximum identity group size of 1500 (in Fig. 14B In the example of , a new policy 1412 is generated for the identity group 1422). As shown in the figure, Fig. 14B In the example of , policy generator 1410 generates new policy 1412 for identity group 1422, which includes identities 1205-1206. Fig. 14C As shown in FIG. 14, in generating new policies 1412 for identities 1205-1206 (as described above with reference to Fig. 14B After that, identities 1205-1206 are removed from the new policy identity pool 1230. Fig. 14C As shown, the removal of identities 1205-1206 leaves only identity 1207 in the new policy identity pool 1230. Fig. 14C As shown, the policy generator 1410 then generates a new policy identity pool 1230 for the remaining identity pools that satisfy the new policy constraint set (e.g., Fig.15 The new policy constrains the maximum identity group size of 1500 (in Fig. 14C In the example of , a new policy 1413 is generated for the identity group 1423. As shown in the figure, Fig. 14C In the example of , policy generator 1410 generates new policy 1413 for identity group 1423 , which includes only identity 1207 .

[0112] At operation 1818, if it is determined that the new policy identity pool is empty, then at operation 1822, Fig. 17BThe process ends. For example, after generating new policy 1413 for identity 1207, identity 1207 can be removed from new policy identity pool 1230. After removing identity 1207 from new policy identity pool 1230, new policy identity pool 1230 is emptied and the new policy generation process is completed. As described above, in some examples, in order to increase the speed of the new policy generation process, the identities in the new policy identity pool can be clustered into multiple clusters (e.g., sub-pools) based on the selected permissions of each identity, so that identities with similar selected permissions can be included in the same cluster as each other. Therefore, in some examples, Fig. 17B The new policy identity pool described in may be an identity cluster among multiple identity clusters formed by clustering based on selected permissions based on a larger parent new policy identity pool.

[0113] An example system for transmitting and providing data will now be described in detail. Specifically, Fig.18 An example computing environment is shown in which embodiments described herein may be implemented. Fig.18Schematically illustrates an example of a data center 85, which can provide computing resources to users 70a and 70b (which can be referred to as users 70 in the singular or multiple users 70 in the plural) via user computers 72a and 72b (which can be referred to as computers 72 in the singular or multiple computers 72 in the plural) through a communication network 73. The data center 85 can be configured to provide computing resources for executing applications permanently or on demand. The computing resources provided by the data center 85 may include various types of resources, such as gateway resources, load balancing resources, routing resources, network resources, computing resources, volatile and non-volatile memory resources, content delivery resources, data processing resources, data storage resources, data communication resources, etc. Each type of computing resource can be used in a variety of specific configurations. For example, data processing resources can be used as virtual machine instances, which can be configured to provide various web services. In addition, resource combinations can be available through the network and can be configured as one or more web services. Instances may be configured to execute applications, including web services, such as application services, media services, database services, processing services, gateway services, storage services, routing services, security services, encryption services, load balancing services, application services, etc. These services may be configured using set or customized applications, and may be configured in size, execution, cost, latency, type, duration, accessibility, and any other dimension. These web services may be configured as available infrastructure for one or more clients, and may include one or more applications configured as software for a platform or one or more clients. These web services may be available through one or more communication protocols. These communication protocols may include, for example, hypertext transfer protocol (HTTP) or non-HTTP protocols. These communication protocols may also include, for example, more reliable transport layer protocols, such as transmission control protocol (TCP), and less reliable transport layer protocols, such as user datagram protocol (UDP). Data storage resources may include file storage devices, block storage devices, etc.

[0114] Each type or configuration of computing resources may be available in different sizes, such as large resources consisting of many processors, large amounts of memory, and / or large storage capacity and small resources consisting of fewer processors, less memory, and / or smaller storage capacity. For example, a customer may choose to allocate multiple small processing resources as web servers and / or allocate one large processing resource as a database server.

[0115] Data center 85 may include servers 76a and 76b (which may be referred to herein as server 76 in the singular or as multiple servers 76 in the plural) that provide computing resources. These resources may be available as bare metal resources or virtual machine instances 78a-b (which may be referred to herein as virtual machine instance 78 in the singular or as multiple virtual machine instances 78 in the plural). In this example, the resources also include policy determination virtual machines (PDVMs) 79a-b, which are virtual machines configured to perform any or all of the new and existing policy determination techniques for a set of identities described herein.

[0116] The availability of virtualization technology for computing hardware provides benefits for providing large-scale computing resources to customers and allowing efficient and secure sharing of computing resources between multiple customers. For example, virtualization technology can allow physical computing devices to be shared between multiple users by providing each user with one or more virtual machine instances hosted by the physical computing device. A virtual machine instance can be a software simulation of a specific physical computing system that acts as a different logical computing system. Such a virtual machine instance provides isolation between multiple operating systems that share a given physical computing resource. In addition, some virtualization technologies can provide virtual resources that span one or more physical resources, such as a single virtual machine instance with multiple virtual processors that span multiple different physical computing systems.

[0117] refer to Fig.18 , the communication network 73 may be a network of publicly accessible linked networks, for example, and may be operated by a variety of different parties (e.g., the Internet). In other embodiments, the communication network 73 may be a private network, such as a company or university network that is completely or partially inaccessible to non-privileged users. In yet other embodiments, the communication network 73 may include one or more private networks that are accessible to and / or from the Internet.

[0118] The communication network 73 may provide access to the computer 72. The user computer 72 may be a computer used by the user 70 or other customers of the data center 85. For example, the user computer 72a or 72b may be a server, a desktop or notebook personal computer, a tablet computer, a wireless phone, a personal digital assistant (PDA), an e-book reader, a game console, a set-top box, or any other computing device capable of accessing the data center 85. The user computer 72a or 72b may be directly connected to the Internet (e.g., via a cable modem or a digital subscriber line (DSL)). Although only two user computers 72a and 72b are depicted, it should be understood that multiple user computers may exist.

[0119] The user computer 72 may also be used to configure various aspects of the computing resources provided by the data center 85. In this regard, the data center 85 may provide a gateway or web interface through which various aspects of its operation may be configured using a web browser application executing on the user computer 72. Alternatively, a standalone application executing on the user computer 72 may access an application programming interface (API) exposed by the data center 85 to perform configuration operations. Other mechanisms for configuring the operation of the various web services available on the data center 85 may also be used.

[0120] Fig.18 The server 76 shown in the figure can be a server that is appropriately configured to provide the above-mentioned computing resources, and can provide computing resources for executing one or more web services and / or applications. In one embodiment, the computing resources can be virtual machine instances 78. In the example of virtual machine instances, each server 76 can be configured to execute an instance manager 80a or 80b (which can be referred to as an instance manager 80 in the singular or multiple instance managers 80 in the plural herein) that can execute virtual machine instances 78. For example, the instance manager 80 can be a virtual machine monitor (VMM) or another type of program that is configured to enable the execution of virtual machine instances 78 on the server 76. As discussed above, each virtual machine instance 78 can be configured to execute all or part of an application program.

[0121] It should be understood that although the embodiments disclosed above discuss the context of virtual machine instances, the concepts and technologies disclosed herein can be used with other types of implementations. For example, the embodiments disclosed herein can also be used with computing systems that do not use virtual machine instances.

[0122] exist Fig.18 In the example data center 85 shown, a router 71 can be used to interconnect servers 76a and 76b. The router 71 can also be connected to a gateway 74, which is connected to a communication network 73. The router 71 can be connected to one or more load balancers and can manage communications within the network in the data center 85 alone or in combination, for example, by appropriately forwarding packets or other data communications based on the characteristics of such communications (e.g., header information including source and / or destination addresses, protocol identifiers, size, processing requirements, etc.) and / or the characteristics of the private network (e.g., routing based on network topology, etc.). It should be understood that for simplicity, various aspects of the computing systems and other devices of this example are shown without showing certain conventional details. Additional computing systems and other devices can be interconnected in other embodiments and can be interconnected in different ways.

[0123] exist Fig.18In the illustrated example data center 85, the server manager 75 is also used to at least partially direct various communications to, from, and / or between servers 76a and 76b. Fig.18 A router 71 is depicted as being located between a gateway 74 and a server manager 75, but this is merely an exemplary configuration. In some cases, for example, a server manager 75 may be located between a gateway 74 and a router 71. In some cases, the server manager 75 may examine portions of incoming communications from a user computer 72 to determine one or more appropriate servers 76 to receive and / or process the incoming communications. The server manager 75 may determine appropriate servers to receive and / or process incoming communications based on factors such as the identity, location, or other attributes associated with the user computer 72, the nature of the task associated with the communication, the priority of the task associated with the communication, the duration of the task associated with the communication, the size of the task associated with the communication, and / or estimated resource usage, as well as many other factors. The server manager 75 may, for example, collect or otherwise access state information and other information associated with various tasks, in order to, for example, assist in managing communications and other operations associated with such tasks.

[0124] It should be understood that Fig.18 The network topology shown in has been greatly simplified, and more networks and network devices can be used to interconnect the various computing systems disclosed herein. These network topologies and devices should be obvious to those skilled in the art.

[0125] It should also be understood that Fig.18 The data center 85 described in the foregoing is merely illustrative, and other implementations may be used. It should also be understood that the server, gateway, or other computing device may include any combination of hardware or software capable of interacting and performing the types of functions described, including but not limited to: desktop or other computers, database servers, network storage devices and other network devices, PDAs, tablet computers, cell phones, wireless phones, pagers, electronic organizers, Internet appliances, television-based systems (e.g., using set-top boxes and / or personal / digital video recorders), and various other consumer products that include appropriate communication capabilities.

[0126] In at least some embodiments, a server implementing part or all of one or more of the techniques described herein may include a computer system that includes or is configured to access one or more computer-accessible media. Fig.19A computer system including or configured to access one or more computer-accessible media is depicted. In the illustrated embodiment, computing device 15 includes one or more processors 10a, 10b, and / or 10n (which may be referred to herein as "processor 10" in the singular or "processors 10" in the plural) coupled to system memory 20 via input / output (I / O) interface 30. Computing device 15 also includes a network interface 40 coupled to I / O interface 30.

[0127] In various embodiments, computing device 15 may be a single processor system including one processor 10, or a multiprocessor system including a plurality of processors 10 (e.g., two, four, eight, or other suitable number). Processor 10 may be any suitable processor capable of executing instructions. For example, in various embodiments, processor 10 may be an embedded processor implementing various instruction set architectures (ISAs), such as x86, PowerPC, SPARC, or MIPS ISAs, or any other suitable ISAs. In a multiprocessor system, each processor 10 may typically, but not necessarily, implement the same ISA.

[0128] The system memory 20 may be configured to store instructions and data accessible to one or more processors 10. In various embodiments, the system memory 20 may be implemented using any suitable memory technology, such as static random access memory (SRAM), synchronous dynamic RAM (SDRAM), non-volatile / In the illustrated embodiment, program instructions and data implementing one or more desired functions (e.g., the methods, techniques, and data described above) are shown as code 25 and data 26 stored within system memory 20. Additionally, in this example, system memory 20 includes policy determination instructions 27, which are instructions for executing any or all of the new and existing policy determination techniques for a set of identities described herein.

[0129] In one embodiment, the I / O interface 30 may be configured to coordinate I / O traffic between the processor 10, the system memory 20, and any peripheral devices in the device (including the network interface 40 or other peripheral device interfaces). In some embodiments, the I / O interface 30 may perform any necessary protocol, timing, or other data transformations to convert data signals from one component (e.g., the system memory 20) into a format suitable for use by another component (e.g., the processor 10). In some embodiments, the I / O interface 30 may include support for devices attached via various types of peripheral buses, such as, for example, a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard. In some embodiments, the functionality of the I / O interface 30 may be divided into two or more separate components, such as, for example, a north bridge and a south bridge. In addition, in some embodiments, some or all of the functionality of the I / O interface 30 (e.g., an interface to the system memory 20) may be directly incorporated into the processor 10.

[0130] The network interface 40 may be configured to allow data to be exchanged between the computing device 15 and other one or more devices 60 (such as, for example, other computer systems or devices) attached to one or more networks 50. In various embodiments, the network interface 40 may support communication via any suitable wired or wireless general-purpose data network (such as, for example, an Ethernet network type). In addition, the network interface 40 may support communication via a telecommunications / telephone network (such as an analog voice network or a digital fiber optic communication network), via a storage area network (such as a Fiber Channel SAN (Storage Area Network)), or via any other suitable type of network and / or protocol.

[0131] In some embodiments, system memory 20 may be an embodiment of a computer-accessible medium configured to store program instructions and data for implementing embodiments of the corresponding methods and apparatus as described above. However, in other embodiments, program instructions and / or data may be received, sent, or stored on different types of computer-accessible media. In general, a computer-accessible medium may include a non-transitory storage medium or memory medium, such as a magnetic or optical medium, for example, a disk or DVD / CD coupled to the computing device 15 via an I / O interface 30. Non-transitory computer-accessible storage media may also include any volatile or non-volatile media, such as RAM (e.g., SDRAM, DDR SDRAM, RDRAM, SRAM, etc.), ROM (read-only memory), etc., which may be included in some embodiments of the computing device 15 as system memory 20 or another type of memory. In addition, a computer-accessible medium may include a transmission medium or signal, such as an electrical signal, an electromagnetic signal, or a digital signal transmitted via a communication medium (e.g., a network and / or a wireless link, such as those that may be implemented via a network interface 40).

[0132] A network established by an entity such as a company or public sector organization that is used to provide one or more web services (e.g., various types of cloud-based computing or storage) accessible via the Internet and / or other networks to a distributed group of clients may be referred to as a provider network. Such a provider network may include numerous data centers that host various resource pools, such as collections of physical and / or virtualized computer servers, storage devices, network devices, etc., that are required to implement and distribute the infrastructure and web services provided by the provider network. In some embodiments, resources may be provided to clients in various units related to web services, such as the amount of storage capacity for storage, processing power for processing, instances, sets of related services, etc. A virtual computing instance may, for example, include one or more servers with a specified computing capacity (which may be specified by indicating the type and number of CPUs, the size of main memory, etc.) and a specified software stack (e.g., a specific version of an operating system, which in turn may run on top of a hypervisor).

[0133] Computing nodes (also referred to as operation nodes) can be implemented in a variety of computing environments, such as commodity hardware computers, virtual machines, web services, computing clusters, and computing devices. For convenience, any of these computing devices or environments can be described as a computing node.

[0134] In various embodiments, a variety of different types of computing devices may be used, alone or in combination, to implement the resources of the provider network, such as computer servers, storage devices, network devices, etc. In some embodiments, a client or user may be provided with direct access to resource instances, for example, by giving the user an administrator login and password. In other embodiments, the provider network operator may allow the client to specify execution requirements for a specified client application and execute the application on behalf of the client on an execution platform suitable for the application (e.g., an application server instance, a Java JVM, etc.). TM The execution of these applications is scheduled on a virtual machine (JVM), a general or special operating system, a platform that supports various interpreted or compiled programming languages ​​(such as Ruby, Perl, Python, C, C++, etc.), or a high-performance computing platform) without, for example, requiring the client to directly access the instance or execution platform. A given execution platform can utilize one or more resource instances in some implementations; in other implementations, multiple execution platforms can be mapped to a single resource instance.

[0135] In many environments, operators of provider networks that implement different types of virtualized computing, storage, and / or other network-accessible functions may allow customers to reserve or purchase access to resources in various resource acquisition modes. Computing resource providers may provide customers with facilities to select and launch required computing resources, deploy application components to computing resources, and maintain applications executed in the environment. In addition, computing resource providers may provide customers with further conveniences so that as the demand for applications or the capacity requirements of applications change, the number and type of resources allocated to applications can be quickly and easily expanded or reduced manually or through automatic expansion. The computing resources provided by computing resource providers may be available in the form of discrete units, which may be referred to as instances. An instance may represent a physical server hardware platform, a virtual machine instance executed on a server, or some combination of the two. Instances of various types and configurations may be made available, including resources of different sizes executing different operating systems (OS) and / or hypervisors, as well as various installed software applications, runtimes, and the like. Instances may also be available in specific availability areas, for example, logical areas, fault-tolerant areas, data centers, or other geographic locations representing the underlying computing hardware. Instances can be replicated within or across availability zones to increase instance redundancy, and instances can be migrated within or across availability zones. As an example, the latency for a client to communicate with a particular server in an availability zone can be lower than the latency for a client to communicate with a different server. As a result, instances can be migrated from a higher latency server to a lower latency server to improve the overall client experience.

[0136] In some embodiments, the provider network can be organized into multiple geographic regions, and each region can include one or more availability zones. Availability zones (also referred to as available containers) can include one or more different locations or data centers, which are configured in such a way that the resources in a given availability zone can be isolated or isolated from the failures in other availability zones. That is, a failure in an availability zone is expected not to cause a failure in any other availability zone. Therefore, the availability profile of a resource instance is intended to be independent of the availability profiles of resource instances in different availability zones. The client may be able to protect its application from the impact of failures at a single location by starting multiple application instances in the corresponding availability zones. At the same time, in some implementations, a low-cost and low-latency network connection can be provided between resource instances located in the same geographic region (and the network transmission between resources in the same availability zone can be even faster).

[0137] As described above, a content provider can provide content to one or more clients. The term "content" used herein refers to any presentable information, and the term "content item" used herein refers to a collection of any such presentable information. For example, a content provider can provide one or more content services for providing content to a client. The content service can reside on one or more servers. The content service can be extended to meet the needs of one or more clients, and its capacity can be increased or decreased based on the number and type of incoming client requests. The parts of the content service can also be migrated to be placed in a position where the latency with the requesting client is reduced. For example, a content provider can determine the "edge" of a system or network associated with the content service, which is physically and / or logically closest to a specific client. Then, the content provider can, for example, "spin-up", migrate resources, or otherwise use components associated with the determined edge to interact with a specific client. In some cases, this edge determination process can provide an efficient technique for identifying and using components that are very suitable for interacting with a specific client, and in some embodiments, the latency of communication between the content provider and one or more clients can be reduced.

[0138] In addition, some method or process blocks may be omitted in certain implementations. The methods and processes described herein are also not limited to any particular sequence, and blocks or states associated therewith may be performed in other appropriate sequences. For example, the described blocks or states may be performed in a sequence different from the sequence specifically disclosed, or multiple blocks or states may be combined into a single block or state. Example blocks or states may be performed serially, in parallel, or in some other manner. Blocks or states may be added to or removed from the disclosed example embodiments.

[0139] It should also be understood that various items are shown as being stored in memory or on a storage device when in use, and that these items or portions thereof may be transferred between memory and other storage devices for memory management and data integrity purposes. Alternatively, in other embodiments, some or all of the software modules and / or systems may be executed in memory on another device and communicate with the illustrated computing system via inter-computer communication. In addition, in some embodiments, some or all of the systems and / or modules may be implemented or provided in other ways, such as at least in part in firmware and / or hardware, including but not limited to one or more application specific integrated circuits (ASICs), standard integrated circuits, controllers (e.g., by executing appropriate instructions, and including microcontrollers and / or embedded controllers), field programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), etc. Some or all of the modules, systems, and data structures may also be stored (e.g., as software instructions or structured data) on a computer-readable medium, such as a hard disk, memory, network, or portable media item, so as to be read by an appropriate drive or via an appropriate connection. Systems, modules, and data structures may also be transmitted as generated data signals (e.g., as part of a carrier wave or other analog or digital propagation signal) on various computer-readable transmission media (including wireless and wire / cable-based media), and may take various forms (e.g., as part of a single or multiplexed analog signal, or as multiple discrete digital data packets or frames). In other embodiments, such computer program products may also take other forms. Therefore, the present invention may be practiced with other computer system configurations.

[0140] Furthermore, embodiments of the present disclosure may be described according to the following clauses:

[0141] 1. A computing system comprising:

[0142] one or more processors; and

[0143] One or more memories, wherein the one or more memories store instructions, and when the instructions are executed by the one or more processors, the one or more processors perform operations, the operations comprising:

[0144] Add multiple identities to a new policy identity pool associated with the new policy generation, where

[0145] Each identity of the plurality of identities has a respective selected permission associated with a usage of permissions of the identity;

[0146] Generate a new policy corresponding to a maximum identity group in the new policy identity pool that satisfies the new policy constraint set based on a new policy constraint set, wherein the new policy constraint set includes a first constraint and a second constraint, the first constraint being that the new policy includes corresponding selected permissions for each identity in the maximum identity group, and the second constraint being that the new policy does not exceed one or more maximum additional permission thresholds;

[0147] providing one or more instructions to a user to attach the new policy to each identity in the maximum identity group;

[0148] removing the largest identity group from the new policy identity pool; and

[0149] The generating, providing and removing are repeated until the new policy identity pool is empty.

[0150] 2. The computing system of claim 1 , wherein the operations further comprise:

[0151] It is determined, respectively for each of the plurality of identities, that there is not a set of one or more existing policies that satisfy the set of existing policy constraints for the identity.

[0152] 3 . The computing system of claim 2 , wherein each of the plurality of identities is added to the new policy identity pool based on an absence of a set of one or more existing policies that satisfy the set of existing policy constraints for the identity.

[0153] 4 . The computing system according to claim 1 , wherein the new policy constraint set further includes a third constraint, namely, the new policy does not exceed a maximum permission quantity threshold.

[0154] 5. A computer-implemented method comprising:

[0155] adding a plurality of identities to a new policy identity pool associated with new policy generation, wherein each identity of the plurality of identities has a respective selected permission associated with permission usage of the identity;

[0156] generating a new policy corresponding to a maximum identity group in the new policy identity pool that satisfies the new policy constraint set based on a new policy constraint set, wherein the new policy constraint set comprises a first constraint and a second constraint, wherein the first constraint, i.e., the new policy comprises corresponding selected permissions for each identity in the maximum identity group, and the second constraint, i.e., the new policy does not exceed one or more maximum additional permission thresholds; and

[0157] One or more instructions are provided to a user to attach the new policy to each identity within the largest identity group.

[0158] 6. A computer-implemented method according to claim 5, wherein the one or more maximum additional permission thresholds include a plurality of maximum additional permission thresholds, and wherein each identity in the new policy identity pool has a corresponding maximum additional permission threshold among the plurality of maximum additional permission thresholds.

[0159] 7. The computer-implemented method of claim 5, further comprising:

[0160] It is determined, respectively for each of the plurality of identities, that there is not a set of one or more existing policies that satisfy the set of existing policy constraints for the identity.

[0161] 8. The computer-implemented method of claim 7, wherein each of the plurality of identities is added to the new policy identity pool based on an absence of a set of one or more existing policies that satisfy the set of existing policy constraints for the identity.

[0162] 9. The computer-implemented method of claim 5, further comprising:

[0163] removing the largest identity group from the new policy identity pool; and

[0164] The generating, providing and removing are repeated until the new policy identity pool is empty.

[0165] 10. The computer-implemented method of claim 5, wherein the new policy constraint set further includes a third constraint that the new policy does not exceed a maximum number of permissions threshold.

[0166] 11. The computer-implemented method of claim 5, wherein the new policy identity pool is an identity cluster among a plurality of identity clusters formed based on clustering of parent new policy identity pools based on selected permissions.

[0167] 12. The computer-implemented method of claim 5, further comprising:

[0168] The corresponding selected permissions are determined for each of the plurality of identities.

[0169] 13. A computer-implemented method according to claim 5, wherein the corresponding selected permissions include at least one of permissions used by the identity within a selected previous time window or permissions that are estimated to have a probability greater than a threshold probability of being used by the identity in a future time period.

[0170] 14. One or more non-transitory computer-readable storage media having stored thereon computing instructions that, when executed by one or more computing devices, cause the one or more computing devices to perform operations comprising:

[0171] adding a plurality of identities to a new policy identity pool associated with new policy generation, wherein each identity of the plurality of identities has a respective selected permission associated with permission usage of the identity;

[0172] generating a new policy corresponding to a maximum identity group in the new policy identity pool that satisfies the new policy constraint set based on a new policy constraint set, wherein the new policy constraint set comprises a first constraint and a second constraint, wherein the first constraint, i.e., the new policy comprises a corresponding selected permission for each identity in the maximum identity group, and the second constraint, i.e., the new policy does not exceed one or more maximum additional permission thresholds; and

[0173] One or more instructions are provided to a user to attach the new policy to each identity in the maximum identity group.

[0174] 15. One or more non-transitory computer-readable storage media according to claim 14, wherein the one or more maximum additional permission thresholds include a plurality of maximum additional permission thresholds, and wherein each identity in the new policy identity pool has a corresponding maximum additional permission threshold among the plurality of maximum additional permission thresholds.

[0175] 16. The one or more non-transitory computer-readable storage media of claim 14, wherein the operations further comprise:

[0176] It is determined, respectively for each of the plurality of identities, that there is not a set of one or more existing policies that satisfy the set of existing policy constraints for the identity.

[0177] 17. The one or more non-transitory computer-readable storage media of claim 16, wherein each of the plurality of identities is added to the new policy identity pool based on an absence of a set of one or more existing policies that satisfy the set of existing policy constraints for the identity.

[0178] 18. The one or more non-transitory computer-readable storage media of claim 14, wherein the operations further comprise:

[0179] removing the largest identity group from the new policy identity pool; and

[0180] The generating, providing and removing are repeated until the new policy identity pool is empty.

[0181] 19. The one or more non-transitory computer-readable storage media of claim 14, wherein the new policy constraint set further comprises a third constraint that the new policy does not exceed a maximum number of permissions threshold.

[0182] 20. One or more non-transitory computer-readable storage media according to claim 14, wherein the corresponding selected permissions include at least one of permissions used by the identity within a selected previous time window or permissions that are estimated to have a probability of being used by the identity in a future time period greater than a threshold probability.

[0183] Conditional language used herein, such as "can," "may," "could," "might," "for example," and the like, unless expressly stated otherwise or understood otherwise in the context of use, is generally intended to convey that certain embodiments include certain features, elements, and / or steps, while other embodiments do not include these features, elements, and / or steps. Thus, such conditional language is generally not intended to imply that features, elements, and / or steps are in any way required by one or more embodiments, or that one or more embodiments necessarily include logic (whether entered or prompted by the author) for determining whether these features, elements, and / or steps are included in any particular embodiment or whether they are performed in any particular embodiment. The terms "include," "comprises," "has," and the like are synonymous and are used inclusively in an open-ended manner and do not exclude additional elements, features, actions, operations, and the like. In addition, the term "or" is used in its inclusive sense (rather than an exclusive sense), so when used, for example, to connect a list of elements, the term "or" means one, some, or all of the elements in the list.

[0184] Although certain example embodiments have been described, these embodiments are presented by way of example only and are not intended to limit the scope of the inventions disclosed herein. Therefore, nothing in the foregoing description is intended to imply that any particular feature, characteristic, step, module, or block is necessary or indispensable. Indeed, the novel methods and systems described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions, and changes in the form of the methods and systems described herein may be made without departing from the spirit of the inventions disclosed herein. The accompanying claims and their equivalents are intended to cover forms or modifications that fall within the scope and spirit of certain inventions disclosed herein.

Claims

1. A computing system comprising: one or more processors; as well as One or more memories, wherein the one or more memories store instructions, and when the instructions are executed by the one or more processors, the one or more processors perform operations, the operations comprising: adding a plurality of identities to a new policy identity pool associated with new policy generation, wherein each identity of the plurality of identities has a respective selected permission associated with permission usage of the identity; Generate a new policy corresponding to a maximum identity group in the new policy identity pool that satisfies the new policy constraint set based on a new policy constraint set, wherein the new policy constraint set includes a first constraint and a second constraint, the first constraint being that the new policy includes corresponding selected permissions for each identity in the maximum identity group, and the second constraint being that the new policy does not exceed one or more maximum additional permission thresholds; providing one or more instructions to a user to attach the new policy to each identity in the maximum identity group; removing the largest identity group from the new policy identity pool; and The generating, providing and removing are repeated until the new policy identity pool is empty.

2. The computing system of claim 1 , wherein the operations further comprise: It is determined, respectively for each of the plurality of identities, that there is not a set of one or more existing policies that satisfy the set of existing policy constraints for the identity. 3 . The computing system of claim 2 , wherein each of the plurality of identities is added to the new policy identity pool based on an absence of a set of one or more existing policies that satisfy the set of existing policy constraints for the identity. 4 . The computing system according to claim 1 , wherein the new policy constraint set further includes a third constraint, namely, the new policy does not exceed a maximum permission quantity threshold.

5. A computer-implemented method comprising: adding a plurality of identities to a new policy identity pool associated with new policy generation, wherein each identity of the plurality of identities has a respective selected permission associated with permission usage of the identity; Generate a new policy corresponding to a maximum identity group in the new policy identity pool that satisfies the new policy constraint set based on a new policy constraint set, wherein the new policy constraint set includes a first constraint and a second constraint, the first constraint being that the new policy includes corresponding selected permissions for each identity in the maximum identity group, and the second constraint being that the new policy does not exceed one or more maximum additional permission thresholds; as well as One or more instructions are provided to a user to attach the new policy to each identity within the largest identity group.

6. A computer-implemented method according to claim 5, wherein the one or more maximum additional permission thresholds include a plurality of maximum additional permission thresholds, and wherein each identity in the new policy identity pool has a corresponding maximum additional permission threshold among the plurality of maximum additional permission thresholds.

7. The computer-implemented method of claim 5, further comprising: It is determined, respectively for each of the plurality of identities, that there is not a set of one or more existing policies that satisfy the set of existing policy constraints for the identity.

8. The computer-implemented method of claim 7, wherein each identity of the plurality of identities is added to the new policy identity pool based on an absence of a set of one or more existing policies that satisfy the set of existing policy constraints for that identity.

9. The computer-implemented method of claim 5, further comprising: removing the maximum identity group from the new policy identity pool; as well as The generating, providing and removing are repeated until the new policy identity pool is empty.

10. The computer-implemented method of claim 5, wherein the new policy identity pool is an identity cluster of a plurality of identity clusters formed based on clustering of parent new policy identity pools based on selected permissions.

11. One or more non-transitory computer-readable storage media having stored thereon computing instructions, which, when executed by one or more computing devices, cause the one or more computing devices to perform operations, the operations comprising: adding a plurality of identities to a new policy identity pool associated with new policy generation, wherein each identity of the plurality of identities has a respective selected permission associated with permission usage of the identity; Generate a new policy corresponding to a maximum identity group in the new policy identity pool that satisfies the new policy constraint set based on a new policy constraint set, wherein the new policy constraint set includes a first constraint and a second constraint, the first constraint being that the new policy includes corresponding selected permissions for each identity in the maximum identity group, and the second constraint being that the new policy does not exceed one or more maximum additional permission thresholds; as well as One or more instructions are provided to a user to attach the new policy to each identity in the maximum identity group.

12. One or more non-transitory computer-readable storage media according to claim 11, wherein the one or more maximum additional permission thresholds include a plurality of maximum additional permission thresholds, and wherein each identity in the new policy identity pool has a corresponding maximum additional permission threshold among the plurality of maximum additional permission thresholds.

13. The one or more non-transitory computer-readable storage media of claim 11, wherein the operations further comprise: It is determined, respectively for each of the plurality of identities, that there is not a set of one or more existing policies that satisfy the set of existing policy constraints for the identity.

14. The one or more non-transitory computer-readable storage media of claim 13, wherein each of the plurality of identities is added to the new policy identity pool based on an absence of a set of one or more existing policies that satisfy the set of existing policy constraints for the identity.

15. The one or more non-transitory computer-readable storage media of claim 11, wherein the operations further comprise: removing the maximum identity group from the new policy identity pool; as well as The generating, providing and removing are repeated until the new policy identity pool is empty.

Images