Resource allocation method, electronic device, computer storage medium and computer program product

Abstract

The embodiment of the invention provides a resource allocation method, electronic equipment, a computer storage medium and a computer program product. The resource configuration method comprises the following steps: acquiring a declaration configuration file of a target resource through a user side of a resource configuration hosting service; parsing the grammar description of the declaration configuration file to obtain each resource configuration item of the target resource; on the basis of a preset verification rule obtained from a management end of the resource configuration hosting service, verifying each resource configuration item of the target resource; and calling a configuration execution module to execute the declaration configuration file under the condition that the verification is passed.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular to a resource configuration method, electronic equipment, computer storage medium, and computer program product. Background Art

[0002] Resource configuration tools such as Terraform enable efficient and rapid configuration of resources, such as cloud service resources. Generally speaking, users pre-write the resource items they want to configure into a declarative configuration file, such as a Terraform tool. Configuration execution modules, such as resource orchestration engines, then execute the declarative configuration file, enabling automated configuration of resources such as cloud service resources.

[0003] In some cases, the input of various configuration items of resources such as cloud service resources requires team collaboration to determine, and resource configuration tools also require team members to download in advance and run locally, which leads to low efficiency in local management of declarative configuration files.

[0004] The emergence of managed resource configuration services deployed on cloud platforms has increased the efficiency of resource configuration tools. By renting remotely hosted resource configuration tools, the efficiency of editing declaration configuration files and operating configuration execution modules has been improved. Because resource configuration tools can configure resources such as cloud service resources, when different users share the hosted resource configuration tools, there is a risk that users could exploit vulnerabilities in the resource configuration tools to access unauthorized resources. For example, users could access other users' private resources or misappropriate unauthorized computing power from the platform that provides resources such as cloud service resources.

[0005] Therefore, in existing resource configuration solutions, the security of the hosting service of the resource configuration tool is relatively poor. Summary of the Invention

[0006] In view of this, embodiments of the present invention provide a resource configuration method, electronic device, computer storage medium, and computer program product, which improve the security of resource configuration hosting services.

[0007] According to a first aspect of an embodiment of the present invention, a resource configuration method is provided, comprising: obtaining a declaration configuration file of a target resource through a user end of a resource configuration hosting service; parsing the grammatical description of the declaration configuration file to obtain various resource configuration items of the target resource; verifying various resource configuration items of the target resource based on preset verification rules obtained from a management end of the resource configuration hosting service; and if the verification passes, calling a configuration execution module to execute the declaration configuration file.

[0008] According to a second aspect of an embodiment of the present invention, a resource configuration method is provided, including: obtaining a declaration configuration file of cloud service resources through a user end of a resource configuration hosting service; parsing the grammatical description of the declaration configuration file to obtain resource dependencies of the cloud service resources; structuring the resource dependencies to generate structured data; verifying the structured data based on preset verification rules obtained from the management end of the resource configuration hosting service; and if the verification passes, calling a configuration execution module to execute the declaration configuration file.

[0009] According to the third aspect of an embodiment of the present invention, a resource configuration device is provided, including: an acquisition module, which acquires a declaration configuration file of a target resource through a user end of a resource configuration hosting service; a parsing module, which parses the grammatical description of the declaration configuration file to obtain each resource configuration item of the target resource; a verification module, which verifies each resource configuration item based on preset verification rules obtained from the management end of the resource configuration hosting service; and an execution calling module, which calls a configuration execution module to execute the declaration configuration file if the verification passes.

[0010] According to a third aspect of an embodiment of the present invention, an electronic device is provided, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the method described in the first aspect or the second aspect.

[0011] According to a fourth aspect of an embodiment of the present invention, a computer storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method according to the first aspect or the second aspect is implemented.

[0012] According to a fifth aspect of an embodiment of the present invention, a computer program product is provided, comprising a computer program / instruction, which implements the method described in the first aspect or the second aspect when executed by a processor.

[0013] In the solution of the embodiment of the present invention, the preset verification rules are obtained from the management end of the resource configuration hosting service, which improves the flexibility and efficiency of the online verification of the declared configuration file. In addition, the grammatical description of the declared configuration file is parsed to obtain the various resource configuration items of the target resource. The use of preset verification rules can more reliably and flexibly verify the security of each resource configuration item, thereby improving the security of the resource configuration hosting service. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0015] Figure 1 The present invention is a flowchart of the steps of the resource configuration method according to some embodiments of the present invention.

[0016] Figure 2 for Figure 1 A schematic block diagram of a hosting service platform for resource configuration tools.

[0017] Figure 3 for Figure 1 A flowchart of the steps of a resource configuration method according to some examples of an embodiment.

[0018] Figure 4 The following is a flowchart of the steps of the resource configuration method according to some other embodiments of the present invention.

[0019] Figure 5 This is a structural block diagram of a resource configuration device according to some other embodiments of the present invention.

[0020] Figure 6 Schematic diagrams of the structures of electronic devices according to other embodiments of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments in the embodiments of the present invention should fall within the scope of protection of the embodiments of the present invention.

[0022] The specific implementation of the embodiment of the present invention is further described below with reference to the accompanying drawings of the embodiment of the present invention.

[0023] Generally speaking, the resource configuration hosting service is deployed in the cloud platform, which improves the editing efficiency of the declarative configuration file and the operating efficiency of the configuration execution module. The resource configuration hosting service is conducive to the efficient and flexible use of resource configuration tools through cloud services. Different users share the resource configuration tool by remotely accessing the hosted resource configuration tool, and users only need to edit declarative configuration files such as Terraform projects. Since the resource configuration tool can configure the target resources, when different users share the hosted resource configuration tool, there is a risk that users can exploit vulnerabilities in the resource configuration tool to access unauthorized target resources. For example, a user may access other users' private target resources, or a user may steal unauthorized computing resources of the platform that provides the target resources. To this end, the various embodiments of the present invention provide a series of solutions to improve the security of the resource configuration hosting service and improve the efficiency of online update verification rules.

[0024] For example, Figure 1 The resource configuration method of some embodiments of the present invention is shown. Figure 1 The resource configuration method can be executed by a cloud server such as a resource configuration hosting service platform, and the resource configuration method includes:

[0025] S110: Obtain a declaration configuration file of a target resource through a user end of the resource configuration hosting service.

[0026] It should be understood that the resource configuration hosting service is implemented through a resource configuration hosting service platform. The resource configuration hosting service platform can be a cloud service platform that is used to deploy the resource configuration service into a virtual machine for hosting. The resource configuration hosting service can be a service provided by the cloud service platform itself or a service provided by a tenant of the cloud service platform.

[0027] It should also be understood that target resources can refer to the hardware and software resources used to perform computing tasks in a computing environment. Target resources provide the ability to process, store, and manage data. Target resources include, but are not limited to, processor resources, memory resources, storage resources, network bandwidth resources, and software interface resources.

[0028] It should also be understood that the resource configuration hosting service includes a user end and a management end. The user end can be the user interface of the resource configuration hosting service, providing a portal for users to operate and use the resource configuration hosting service; the management end can be the management interface of the resource configuration hosting service, providing a portal for the resource configuration hosting service provider to manage and maintain the resource configuration hosting service. The user end can be used to receive user operation instructions for the resource configuration hosting service, as well as declarative configuration files to be executed by the resource configuration hosting service.

[0029] S120: Parse the syntax description of the declaration configuration file to obtain various resource configuration items of the target resource.

[0030] It should be understood that the declarative configuration file has a declarative syntax structure, and the user end (e.g., user) can edit the declarative configuration file using a specific format of syntax description. The declarative configuration file describes the required state of each resource configuration item of the target resource. That is, by defining various resource states, the declarative configuration file only requires the configuration execution module hosted by the resource configuration hosting service, such as the resource orchestrator, to execute the declarative configuration file, without the need for detailed configuration to implement the configuration process. For example, the resource state of a resource configuration item includes but is not limited to: resource type, resource attributes, resource dependencies, resource declaration lifecycle, etc. In addition, the declarative configuration file has good scalability and can be flexibly expanded and modified according to needs and circumstances. In addition, the declarative configuration file can be decoupled from the resource configuration hosting service platform, providing a universal way to describe and deploy various resource configurations of the target resource. In some cases, resource configuration and deployment can be performed across multiple platforms and environments. This resource configuration method can also be referred to as Infrastructure as Code (IaC). For example, Terraform projects, as an example of declarative configuration files, can be used for automated construction, version control, and management of target resources.

[0031] In some examples, the grammatical structure of a Terraform project defines a syntax tree between various resource configuration objects. For example, a Terraform project may include a main file (main.tf), a variable definition file (variables.tf), an output definition file (outputs.tf), a variable value file (terraform.tfvars), and a project document (README.md). The grammatical structure representing these resource configuration objects is predefined in the editor that declares the configuration file.

[0032] S130: Verify each resource configuration item of the target resource based on a preset verification rule obtained from the management end of the resource configuration hosting service.

[0033] It should be understood that the preset verification rules include, but are not limited to, various verification types such as required field verification, data type verification, data range verification, conditional and logical verification, uniqueness verification, dependency verification, and security verification. By using customized preset verification rules, each resource configuration item is verified, thereby eliminating the risk of illegal access to resources before executing the declared configuration file. In some examples, it can be determined whether there are risky resource configuration items that do not comply with the above-mentioned preset verification rules among the various resource configuration items. If such risky resource configuration items exist, the verification is determined to have failed; if such risky resource configuration items do not exist, the verification is determined to have passed.

[0034] S140: If the verification passes, the configuration execution module is called to execute the declaration configuration file.

[0035] It should be understood that the configuration execution module can be a core component of the resource configuration hosting service, and the configuration execution module can be implemented as a resource orchestrator or a configuration executor, for example, a Terraform executor.

[0036] In the solution of the embodiment of the present invention, the preset verification rules are obtained from the management end of the resource configuration hosting service, which improves the flexibility and efficiency of the online verification of the declared configuration file. In addition, the grammatical description of the declared configuration file is parsed to obtain the various resource configuration items of the target resource. The use of preset verification rules can more reliably and flexibly verify the security of each resource configuration item, thereby improving the security of the resource configuration hosting service.

[0037] In other embodiments, when verifying each resource configuration item of a target resource based on preset verification rules, each resource configuration item of the target resource can be constructed as structured data that is easy to query. To make the structured data more reliably represent each resource configuration item, the resource dependency relationships between the resource configuration items can be determined, and then the resource dependency relationships can be structured to generate structured data.

[0038] It should be understood that the key fields of each resource configuration item can be identified, and the resource dependencies of each resource configuration item can be constructed based on the association between the key fields. Alternatively, the syntax description of the declaration configuration file can be parsed to obtain the resource configuration items of the target resource and the resource dependencies of each resource configuration item.

[0039] Furthermore, the structured data may be verified based on preset verification rules obtained from the management end of the resource configuration hosting service. For example, the preset verification rules may include query conditions to more reliably and efficiently verify the structured data.

[0040] Furthermore, when configuring target resources, it's necessary to consider the dependencies between various resource configuration objects, which are determined by the target resource's software and hardware configuration. The creation of some resources may require the existence or initialization of other resources. These dependencies can be viewed as a relationship diagram between resources, describing their interdependencies and order.

[0041] It should also be understood that resource dependencies can be structured and converted into structured data representations to analyze and manage (e.g., add, delete, modify, and query) the dependencies between various resources. That is, the resources and the dependencies between them are converted into a data format suitable for computer query and analysis, such as a graph structure, a tree structure, a relational table, etc. For the configuration process of different target resources, the dependencies between various resource configuration objects may be different. Accordingly, structured data is constructed based on resource dependencies, and the correspondence between its attribute fields is also different accordingly. The format of the structured data can be a data format such as a JSON file.

[0042] In some specific examples, such as Figure 2 As shown, the resource configuration hosting service includes a user end 21 and a management end 22. The resource configuration hosting service platform includes a parser 210, a validator 220, and a resource orchestrator 230. Resource orchestrator 230 is an example of a configuration execution module, one of the core components of the resource configuration hosting service. The configuration execution module is capable of executing declarative configuration files, such as Terraform projects. In some examples, a Terraform execution engine, such as Terraform software, can be deployed to the resource configuration hosting service platform to implement the resource orchestrator's functionality.

[0043] In addition, the parser 210 and the validator 220 may be auxiliary logic provided by the resource configuration hosting service to more reliably manage and maintain the resource configuration hosting service.

[0044] For example, in some specific examples, the verifier 220 can directly verify the declarative configuration file received from the client 21, or it can receive and verify the structured data after the declarative configuration file is parsed by the parser 210. The verification process of the verifier 220 reduces the risk of the declarative configuration file using the resource orchestrator 230 to illegally access the resource configuration hosting service platform, thereby improving the security of the target resource configuration process.

[0045] More specifically, during the verification process of the validator 220, verification can be performed using preset verification rules. The preset verification rules include, but are not limited to, required field verification, data type verification, data range verification, conditional and logical verification, uniqueness verification, dependency verification, and security verification. Specifically, data type verification is used to verify whether field values ​​in structured data conform to expected data types and format requirements, such as strings, numbers, and Booleans. Data range verification is used to verify whether field values ​​in structured data are within a predefined range to avoid errors or abnormal values. Conditional and logical verification is used to verify whether field values ​​in structured data meet specific logical relationships and conditions based on business rules and conditions. Uniqueness verification is used to verify whether field values ​​in structured data are unique to avoid duplicate or conflicting configurations. Dependency verification is used to verify whether the dependencies between field values ​​in structured data and resources are correct to ensure correct resource configuration and association. For example, it checks whether references between resources or relationships between resources are correctly configured. Data format verification is used to verify whether input data for specific types of fields, such as timestamps, URLs, and IP addresses, conforms to specific formats and specifications. Security validation verifies whether structured data contains sensitive information such as passwords and keys, ensuring appropriate security encryption algorithms. Required field validation verifies the presence of required fields or risky fields in structured data to ensure the integrity and accuracy of resource configuration.

[0046] That is, when parsing the structured data of the declaration configuration file, the preset verification rules can include query conditions to more reliably and efficiently verify the structured data. As an example of the above-mentioned conditional and logical verification, the preset verification rules include risk logic query conditions, which can be constructed using query statements such as the structured query language SQL. Furthermore, when verifying the structured data, the structured data can be queried based on the risk logic query conditions. If there is an attribute field relationship that matches the risk logic query condition, the verification fails. If there is no attribute field relationship that matches the risk logic query condition, the verification passes.

[0047] Alternatively, as an example of the aforementioned required field verification, the preset verification rule includes a risk field query condition, which can be constructed using a query statement such as a structured query language (SQL). Accordingly, when verifying structured data, the structured data can be queried based on the risk field query condition. Then, if at least one field in each attribute field of the structured data matches the risk field query condition, the verification fails; if no field matches the risk field query condition, the verification passes.

[0048] For example, the main file main.tf of the Terraform project is:

[0049]

[0050]

[0051] In addition, if the verification passes, the call can be made; if the verification fails, a notification of modifying the declaration configuration file can be fed back through the user terminal 21 .

[0052] Further, in Figure 2 In the example, before generating the structured data of the declarative configuration file, the grammatical description of the declarative configuration file can be parsed by the parser 210 to obtain the resource dependency configured for the target resource. Specifically, a declarative configuration file such as a Terraform project can be read, and the content of the declarative configuration file can be split into symbols such as keywords, identifiers, operators, strings, etc. Then, based on the grammatical description of the declarative format of the declarative configuration file, the symbol sequence is organized into a syntax tree, wherein the syntax tree represents the relationship and hierarchy between different elements in the file in a hierarchical manner. Then, resources such as virtual machines, storage, networks, etc. defined in the declarative configuration file are identified and extracted. Then, based on the resource identifiers, attributes, dependencies, etc. in the syntax tree, the resource information is extracted and recorded. Then, the dependency relationship between resources is established by identifying references between resources, defining dependencies between resources, configuring associations between resources, etc.

[0053] Furthermore, as some examples of generating structured data by structuring resource dependencies, resource configuration objects such as virtual machines, storage, and networks can be used as attribute fields to generate structured data. It should be understood that the granularity of resource configuration items can be set as custom parameters for structured processing. For example, one or more resource configuration items can be set for each resource configuration object. Then, by identifying references between resources, defining dependencies between resources, configuring associations between resources, etc., a correspondence between various attribute fields is constructed to form structured data such as a data table. Without loss of generality, multiple attribute fields can be determined based on multiple resource configuration items in the declaration configuration file. For example, the description field of each resource configuration item is determined as an attribute field. Then, based on the resource dependency, a correspondence between multiple attribute fields is constructed to obtain structured data. The structured data thus generated fully characterizes the resource dependency in the declaration configuration file, and at the same time facilitates the execution of structured queries through query statements constructed by, for example, structured query languages ​​such as SQL.

[0054] In addition, in order to verify whether the parsed resource dependency is reliable, it can also be matched with the execution rules of the configuration execution module such as the resource orchestrator 230 for verification. The execution rules of the configuration execution module can execute the declaration configuration file based on the execution order of each resource configuration item. If the matching verification fails, it means that even if the verification passes, the declaration configuration file cannot be reliably executed. Therefore, when the matching fails, a notification of modifying the declaration configuration file can be fed back through the user terminal 21. On the contrary, when the parsed resource dependency matches the execution rule, the declaration configuration file can be reliably executed, and then the resource dependency is structured to generate structured data for subsequent verification processes. That is to say, before the resource dependency is structured to generate structured data, it can be determined whether the resource dependency of the declaration configuration file (i.e., the resource dependency between each resource configuration item) complies with the execution rules of the configuration execution module. If the resource dependency complies with the execution rule, the resource dependency is structured. If the resource dependency does not comply with the execution rule, a notification of modifying the declaration configuration file is fed back through the user terminal 21.

[0055] Further references Figure 2 For example, after passing the verification process of verifier 220, resource orchestrator 230 can execute the declarative configuration file. After executing the declarative configuration file, the automated configuration process of the target resource is completed. The resource configuration hosting service can also monitor the execution process of resource orchestrator 230 to identify risky configuration items that are difficult to detect during the verification process of verifier 220.

[0056] It should be understood that if verification logic or interception logic for risk configuration items is added to the resource orchestrator 230, the complexity of the resource orchestrator 230 will be increased and the execution efficiency of the resource orchestrator 230 will be reduced. Therefore, monitoring the execution process of the resource orchestrator 230 can be compatible with the inherent logic of the resource orchestrator 230 itself, and further discover risk configuration items in the declared configuration file without intruding the resource orchestrator 230. Specifically, in the process of monitoring the execution of the declared configuration file by the configuration execution module, in order to obtain abnormal execution operations of the configuration execution module, the execution log of the configuration execution module of the Terraform project can be monitored, and abnormal execution records such as log error information or log exception information in the execution log can be queried. Without loss of generality, the execution log of the configuration execution module for the declared configuration file can be obtained, and then the various execution records in the execution log can be parsed; based on the access records of service resources other than the target resource, the abnormal execution operation of the configuration execution module can be determined, for example, the operation associated with the access records of service resources other than the target resource can be determined as an abnormal execution operation.

[0057] Furthermore, the event notification component or event notification API of the resource orchestrator 230 can be accessed to obtain abnormal execution operations during the execution of the Terraform project. When the abnormal execution operation is obtained, the alarm component of the resource orchestrator 230 can be triggered to feedback notifications to the user end 21 and the management end 22, or the alarm component of the resource configuration hosting service can be used to feedback notifications to the user end 21 and the management end 22. The notification fed back to the management end 22 includes at least one risk configuration item corresponding to the abnormal execution operation, so that the management end 22 can change the preset verification rules with reference to the at least one risk configuration item. Without loss of generality, at least one risk configuration item related to the abnormal execution operation can be determined from each resource configuration item in the declaration configuration file, and then a second notification can be fed back through the management end, wherein the second notification indicates that the preset verification rules are changed with reference to the at least one risk configuration item.

[0058] Alternatively, if a risky configuration item is detected during the execution of the configuration execution module, the module can be interrupted to provide a notification of changes to the declared configuration file and retrieve pre-set validation rules that reference the risky configuration item changes. This immediate interruption of the configuration execution module allows for more reliable troubleshooting of abnormal operations defined in the declared configuration file.

[0059] In addition, the alarm component of the configuration execution module or the resource configuration hosting service can also be configured to interrupt the configuration execution module.

[0060] Figure 3 The following are some examples of resource configuration methods. Specifically, Figure 3 The resource configuration methods include:

[0061] In step S310, the syntax description of the declaration configuration file is parsed to obtain the resource dependencies of the target resources, and then the process goes to step S320. For example, the syntax structure of the Terraform project can be parsed to obtain the dependencies between the various resource configuration objects.

[0062] In step S320, determine whether the resource dependency of the declared configuration file complies with the execution rules of the configuration execution module? If yes, go to step S340, if not, go to step S330. For example, the execution rules of the configuration execution module can be obtained, and the execution rules at least indicate the execution order of each resource configuration item. It should be understood that the execution order of each resource configuration item is determined by the design architecture of the target resource and the virtualization rules of various resources. In addition, when the resource dependency complies with the execution rules of the configuration execution module, the configuration execution module can complete the process of declaring the configuration file with such resource dependency. When the resource dependency complies with the execution rules of the configuration execution module, the configuration execution module will report an error. Before the execution process of the configuration execution module, unreliable resource dependencies are eliminated through the execution rules, which is conducive to improving resource configuration efficiency.

[0063] In step S330, the user terminal provides feedback regarding modifications to the declared configuration file. For example, the user terminal may provide feedback directly stating that the declared configuration file does not comply with the execution rules, or may provide a suggestion for modifying the declared configuration file. Furthermore, feedback regarding modifications to the declared configuration file is provided until the modified declared configuration file complies with the execution rules.

[0064] In step S340, the resource dependency is structured to generate structured data, and the process proceeds to step S350. For example, each attribute field can be constructed based on each resource configuration object in the declaration configuration file, and the resource dependency can be constructed as a corresponding relationship between the attribute fields to generate structured data such as a JSON file.

[0065] In step S350, the structured data is verified to determine whether the verification is passed. If the verification is passed, the process proceeds to step S370; if the verification is not passed, the process proceeds to step S360.

[0066] In step S360, the user terminal provides feedback regarding modifications to the declared configuration file. For example, the user terminal may provide feedback directly indicating that the declared configuration file has failed verification, or may provide a suggestion for modifying the declared configuration file. Furthermore, feedback regarding modifications to the declared configuration file continues until the modified declared configuration file passes verification.

[0067] In step S370, the configuration execution module is called to execute the declaration configuration file, and step S380 is executed. For example, the verification process can be configured to trigger the startup instruction of the configuration execution module when the verification passes, so that the configuration execution module executes the declaration configuration file in response to the startup instruction.

[0068] In step S380, monitor the execution process of the declaration configuration file by the configuration execution module and determine whether there is any abnormal execution operation of the configuration execution module? If yes, go to step S390, if not, continue to execute S380. For example, when an abnormal execution operation is obtained, the alarm component of the configuration execution module can be triggered to interrupt the configuration execution module, and notify the user end to modify the declaration configuration file, and notify the management end to change the preset verification rules. In other words, the alarm instruction of the alarm component triggers the feedback notification to the user end and the management end. Alternatively, the configuration execution module can also be interrupted via the alarm component of the resource configuration hosting service, and the user end can be notified to modify the declaration configuration file, and the management end can be notified to change the preset verification rules.

[0069] In step S390, the management terminal provides feedback regarding changes to preset validation rules for at least one risk configuration item. For example, the notification may include the at least one risk configuration item, or query conditions related to the at least one risk configuration item may be provided for querying structured data. Furthermore, upon discovering the current risk configuration item, the configuration execution module may be interrupted to provide feedback regarding modifications to the declaration configuration file, while simultaneously obtaining preset validation rules that reference the changes to the current risk configuration item (e.g., by adding query conditions related to the current risk configuration item).

[0070] Furthermore, Figure 4 The resource configuration methods of other embodiments of the present invention are shown. Figure 4 The resource configuration method can be Figure 1 Specifically, Figure 4 The resource configuration methods include:

[0071] S410: Obtaining a declaration configuration file of cloud service resources through a user end of the resource configuration hosting service.

[0072] S420: Parse the syntax description of the declaration configuration file to obtain resource dependencies of the cloud service resources.

[0073] S430: Structuring the resource dependency relationship to generate structured data.

[0074] S440: Verify the structured data based on preset verification rules obtained from the management end of the resource configuration hosting service.

[0075] S450: If the verification passes, call the configuration execution module to execute the declaration configuration file.

[0076] It should be understood that cloud service resources include, but are not limited to, infrastructure resources such as memory, processors, accelerators, and network cards, as well as software platform-level resources such as operating systems and AI model frameworks. Cloud service resource declaration configuration files are used to configure cloud service resources. Cloud service resources here are those accessed by clients using the resource configuration hosting service. These cloud service resources can be infrastructure resources of the cloud service platform or cloud service resources of other cloud service platforms accessed by clients using the resource configuration hosting service.

[0077] It should also be understood that the resource dependencies are structured and converted into structured data representations to analyze and manage (e.g., add, delete, modify, and query) the dependencies between various resources. That is, the resources and the dependencies between them are converted into a data format suitable for computer query and analysis, such as a graph structure, a tree structure, a relational table, etc. For the configuration process of different target resources, the dependencies between various resource configuration objects may be different. Accordingly, structured data is constructed based on resource dependencies, and the correspondence between its attribute fields is also different accordingly. The format of the structured data can be a data format such as a JSON file.

[0078] In the solution of the embodiment of the present invention, the grammatical description of the declarative configuration file is parsed to obtain the resource dependencies of the cloud service resources. These resource dependencies are then structured to generate structured data. Because structured data reliably represents resource dependencies and is more convenient for querying, the use of preset verification rules can more reliably verify the security of the declarative configuration file obtained from the user end, thereby improving the security of the resource configuration hosting service. In addition, the preset verification rules are obtained from the management end of the resource configuration hosting service, which also improves the efficiency of online updating of verification rules.

[0079] In other embodiments, in the resource configuration method, the verification results of each resource configuration item of the cloud service resource can also be fed back through the management end of the resource configuration hosting service, so as to change the preset verification rules based on the verification results. In some specific examples, a notification of changing the preset verification rules with reference to at least one risk configuration item can be fed back through the management end. For example, at least one risk configuration item can be included in the notification, and query conditions related to at least one risk configuration item can also be given for querying structured data. In addition, when the current risk configuration item is discovered, a notification of modifying the declaration configuration file can be fed back, and the preset verification rules with reference to the change of the current risk configuration item can be obtained at the same time.

[0080] The following will be combined Figure 5 To describe the resource configuration devices of other embodiments of the present invention. Figure 5 The resource configuration device includes:

[0081] The acquisition module 510 acquires the declaration configuration file of the target resource through the client of the resource configuration hosting service;

[0082] The parsing module 520 parses the syntax description of the declaration configuration file to obtain various resource configuration items of the target resource;

[0083] A verification module 530 verifies each resource configuration item based on preset verification rules obtained from the management end of the resource configuration hosting service;

[0084] The execution calling module 540 calls the configuration execution module to execute the declaration configuration file if the verification passes.

[0085] In the solution of the embodiment of the present invention, the grammatical description of the declarative configuration file is parsed to obtain the resource dependencies of the target resources. The resource dependencies are then structured to generate structured data. Because structured data reliably represents resource dependencies and is more convenient for querying, the use of preset verification rules can more reliably verify the security of the declarative configuration file obtained from the user end, thereby improving the security of the resource configuration hosting service. In addition, the preset verification rules are obtained from the management end of the resource configuration hosting service, which also improves the efficiency of online updating of verification rules.

[0086] It should be understood that in the above embodiments, the resource configuration hosting service is implemented via a resource configuration hosting service platform. The resource configuration hosting service platform may be a cloud service platform that is used to deploy the resource configuration service into a virtual machine for hosting. The resource configuration hosting service may be a service provided by the cloud service platform itself or a service provided by a tenant of the cloud service platform.

[0087] In addition, target resources include but are not limited to infrastructure resources such as memory, processors, accelerators, and network cards, as well as software platform resources such as operating systems and AI model frameworks. The target resource declaration configuration file is used to configure target resources. The target resources here are the target resources accessed by the client using the resource configuration hosting service. The target resources can be target resources of this cloud service platform or target resources of other cloud service platforms accessed by the client using the resource configuration hosting service.

[0088] In addition, the resource configuration hosting service includes a user end and a management end. The user end serves as the user interface for the resource configuration hosting service, providing a portal for users to operate and use the resource configuration hosting service. The management end serves as the management interface for the resource configuration hosting service, providing a portal for the resource configuration hosting service provider to manage and maintain the resource configuration hosting service. The user end can be used to receive user operation instructions for the resource configuration hosting service, as well as declarative configuration files to be executed by the resource configuration hosting service.

[0089] In addition, the declarative configuration file has a declarative grammatical structure, and the user end (for example, the user) can edit the declarative configuration file using a grammatical description in a specific format. The declarative configuration file describes the desired state of the target resource. That is, the declarative configuration file defines various resource states, and only requires the configuration execution module such as the resource orchestrator hosted by the resource configuration hosting service to execute the declarative configuration file, without the need for detailed configuration to implement the configuration process. In addition, the declarative configuration file has good scalability and can be flexibly expanded and modified according to needs and circumstances. In addition, the declarative configuration file can be decoupled from the resource configuration hosting service platform, providing a common way to describe and deploy various resource configurations of target resources. In some cases, resource configuration and deployment can be performed across multiple platforms and environments. This resource configuration method can also be referred to as Infrastructure as Code (IaC). For example, the Terraform project, as an example of a declarative configuration file, can be used for automated construction, version control, and management of target resources.

[0090] It should also be understood that when configuring target resources, dependencies between various resource configuration objects must be considered. These dependencies are determined by the target resource's software and hardware configuration. The creation of some resources may require the existence or initialization of other resources. These dependencies can be viewed as a relationship diagram between resources, describing their interdependencies and order.

[0091] Furthermore, resource dependencies can be structured and converted into structured data representations to analyze and manage (e.g., add, delete, modify, and query) the dependencies between various resources. That is, resources and their dependencies are converted into a data format suitable for computer query and analysis, such as a graph structure, a tree structure, a relational table, and the like. For different target resource configuration processes, the dependencies between various resource configuration objects may differ. Accordingly, structured data is constructed based on resource dependencies, and the correspondence between its attribute fields also varies accordingly. The format of the structured data can be a data format such as a JSON file. Preset validation rules include, but are not limited to, required field validation, data type validation, data range validation, conditional and logical validation, uniqueness validation, dependency validation, security validation, and other validation types. By validating structured data using custom preset validation rules, the risk of unauthorized access to target resources is preemptively eliminated before executing the declarative configuration file. Furthermore, the configuration execution module can be a core component of the resource configuration hosting service. The configuration execution module can be implemented as a resource orchestrator or configuration executor, such as a Terraform executor.

[0092] In other embodiments, the verification module includes a structuring module and a verification execution module. The structuring module is configured to determine resource dependencies between the resource configuration items and then structure the resource dependencies to generate structured data. The verification execution module is configured to verify the structured data based on preset verification rules obtained from the management end of the resource configuration hosting service.

[0093] The structuring module is specifically used to: determine multiple attribute fields according to multiple resource configuration items of the declaration configuration file; and construct a corresponding relationship between the multiple attribute fields based on the resource dependency relationship to obtain the structured data.

[0094] In other embodiments, the parsing module is also used to: determine whether the resource dependency relationship between each resource configuration item complies with the execution rules of the configuration execution module, wherein the execution rules at least indicate the execution order of each resource configuration item; if the resource dependency relationship complies with the execution rules, the resource dependency relationship is structured.

[0095] In some other embodiments, the parsing module is further configured to: if the resource dependency does not comply with the execution rule, feed back a first notification via the user terminal, wherein the first notification instructs modification of the declaration configuration file.

[0096] In some other embodiments, the preset verification rule includes a risk field query condition. The verification execution module is specifically configured to: query the structured data based on the risk field query condition; if at least one field in each attribute field of the structured data matches the risk field query condition, then the verification fails.

[0097] In other embodiments, the execution call module is specifically used to: monitor the execution process of the configuration execution module on the declaration configuration file, and determine the abnormal execution operation of the configuration execution module; determine at least one risk configuration item related to the abnormal execution operation in each resource configuration item in the declaration configuration file; and feedback a second notification through the management end, wherein the second notification indicates to change the preset verification rule with reference to the at least one risk configuration item.

[0098] In other embodiments, the execution call module is specifically used to: obtain the execution log of the configuration execution module on the declared configuration file; parse each execution record in the execution log; and determine the abnormal execution operation of the configuration execution module based on the access record of the service resources other than the target resource.

[0099] In some other embodiments, the verification execution module is further configured to: if the verification fails, feed back a third notification via the user terminal, wherein the third notification instructs modification of the declaration configuration file.

[0100] The specific implementation of each module in the resource configuration device can refer to the corresponding description of the corresponding steps in the above method embodiment, and has corresponding beneficial effects, which will not be repeated here. Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working process of the above-described device and module can refer to the corresponding process description in the above method embodiment, and will not be repeated here.

[0101] Reference Figure 6 , shows a schematic structural diagram of an electronic device according to another embodiment of the present invention. The specific embodiment of the present invention does not limit the specific implementation of the electronic device.

[0102] like Figure 6 As shown, the electronic device may include: a processor (processor) 602 for executing a program 610 , a communication interface (Communications Interface) 604 , a memory (memory) 606 , and a communication bus 608 .

[0103] The processor, the communication interface, and the memory communicate with each other via a communication bus.

[0104] Communication interface, used to communicate with other electronic devices or servers.

[0105] The processor is used to execute the program, and specifically can execute the relevant steps in the above method embodiment.

[0106] Specifically, the program may include program codes including computer operation instructions.

[0107] The processor may be a CPU, an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs, or different types of processors, such as one or more CPUs and one or more ASICs.

[0108] Memory is used to store programs. The memory may include high-speed RAM memory, and may also include non-volatile memory (non-volatile memory), such as at least one disk storage.

[0109] The program may include multiple computer instructions. Specifically, the program may enable the processor to execute operations corresponding to the resource configuration method described in any of the aforementioned multiple method embodiments through the multiple computer instructions.

[0110] The specific implementation of each step in the program can refer to the corresponding description of the corresponding step, module or unit in the above method embodiment, and has corresponding beneficial effects, which will not be repeated here. Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working process of the above-described device, equipment or module can refer to the corresponding process description of the resource configuration method in each of the above embodiments, and will not be repeated here.

[0111] An embodiment of the present invention further provides a computer storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any of the aforementioned method embodiments. The computer storage medium includes, but is not limited to, a compact disc read-only memory (CD-ROM), random access memory (RAM), a floppy disk, a hard disk, or a magneto-optical disk.

[0112] An embodiment of the present invention further provides a computer program product, including computer instructions, which instruct a computing device to execute operations corresponding to each method in the above-mentioned multiple method embodiments.

[0113] In addition, it should be noted that the user-related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to sample data used to train the model, data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0114] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present invention can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present invention.

[0115] The method according to the embodiment of the present invention described above can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk or magneto-optical disk), or as computer code that is originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded via a network and will be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor or programmable or dedicated hardware (such as an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA)). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., random access memory (RAM), read-only memory (ROM), flash memory, etc.) that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the method shown here, the execution of the code converts the general-purpose computer into a dedicated computer for executing the method shown here.

[0116] Those skilled in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present invention.

[0117] The above implementation methods are only used to illustrate the embodiments of the present invention, and are not intended to limit the embodiments of the present invention. Ordinary technicians in the relevant technical field may make various changes and modifications without departing from the spirit and scope of the embodiments of the present invention. Therefore, all equivalent technical solutions also fall within the scope of the embodiments of the present invention, and the scope of patent protection of the embodiments of the present invention should be defined by the claims.

Claims

1. A resource allocation method, comprising: Obtain the target resource's declaration configuration file through the client of the resource configuration hosting service; Parsing the syntax description of the declaration configuration file to obtain various resource configuration items of the target resource; Verifying each resource configuration item of the target resource based on preset verification rules obtained from the management end of the resource configuration hosting service; If the verification passes, the configuration execution module is called to execute the declaration configuration file.

2. The method according to claim 1, wherein Verifying each resource configuration item of the target resource based on preset verification rules obtained from the management end of the resource configuration hosting service includes: Determining resource dependencies between the various resource configuration items; Structuring the resource dependency to generate structured data; The structured data is verified based on preset verification rules obtained from the management end of the resource configuration hosting service.

3. The method according to claim 2, wherein: Structuring the resource dependency to generate structured data includes: Determining multiple attribute fields according to multiple resource configuration items of the declaration configuration file; Based on the resource dependency relationship, a corresponding relationship between the multiple attribute fields is constructed to obtain the structured data.

4. The method according to claim 2, wherein: The method further comprises: Determining whether the resource dependency relationship between the resource configuration items complies with the execution rules of the configuration execution module, wherein the execution rules at least indicate the execution order of the resource configuration items; If the resource dependency relationship complies with the execution rule, the resource dependency relationship is structured.

5. The method according to claim 4, wherein The method further comprises: If the resource dependency does not comply with the execution rule, a first notification is fed back via the user terminal, where the first notification instructs modification of the declaration configuration file.

6. The method according to claim 2, wherein: The preset verification rules include risk field query conditions; Verifying the structured data based on preset verification rules obtained from the management end of the resource configuration hosting service includes: Querying the structured data based on the risk field query condition; If there is at least one field in each attribute field of the structured data that matches the risk field query condition, the verification fails.

7. The method according to claim 1, wherein The method further comprises: monitoring the execution process of the configuration execution module on the declaration configuration file, and determining abnormal execution operations of the configuration execution module; Determining, among the resource configuration items in the declaration configuration file, at least one risk configuration item related to the abnormal execution operation; A second notification is fed back through the management end, wherein the second notification indicates that the preset verification rule is changed with reference to the at least one risk configuration item.

8. The method according to claim 7, wherein: Monitoring the execution process of the configuration execution module on the declaration configuration file and determining abnormal execution operations of the configuration execution module includes: Obtaining an execution log of the configuration execution module on the declaration configuration file; Parsing each execution record in the execution log; An abnormal execution operation of the configuration execution module is determined according to access records of service resources other than the target resource.

9. The method according to claim 1, wherein The method further comprises: In the case that the verification fails, a third notification is fed back through the user terminal, and the third notification instructs to modify the declaration configuration file.

10. A resource allocation method, comprising: Obtain the declaration configuration file of the cloud service resources through the user end of the resource configuration hosting service; Parsing the syntax description of the declaration configuration file to obtain the resource dependency relationship of the cloud service resources; Structuring the resource dependency to generate structured data; Verifying the structured data based on preset verification rules obtained from the management end of the resource configuration hosting service; If the verification passes, the configuration execution module is called to execute the declaration configuration file.

11. The method according to claim 10, wherein: The method further comprises: The management end of the resource configuration hosting service feeds back verification results of the verification of each resource configuration item of the cloud service resource.

12. An electronic device comprising: A processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, where the executable instruction enables the processor to perform an operation corresponding to the method according to any one of claims 1 to 11.

13. A computer storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

14. A computer program product comprising a computer program / instruction, which implements the method according to any one of claims 1 to 11 when executed by a processor.

Images