Resource configuration method, electronic device, computer storage medium, and computer program product

Abstract

Embodiments of the present disclosure provide a resource configuration method, an electronic device, a computer storage medium, and a computer program product. The resource configuration method comprises: acquiring a declarative configuration file of a target resource by means of a user side of a resource configuration hosting service; parsing the syntactic description of the declarative configuration file to obtain resource configuration items of the target resource; on the basis of a preset verification rule acquired from a management side of the resource configuration hosting service, verifying the resource configuration items of the target resource; and when the verification is successful, invoking a configuration execution module to execute the declarative configuration file.

Description

[0001] TECHNICAL FIELD Embodiments of the present disclosure relate to the field of computer technology, and more particularly to a resource configuration method, electronic device, computer storage medium, and computer program product. Background: Resource configuration tools such as Terraform enable efficient and rapid configuration of resources, such as cloud service resources. Generally, users pre-write the resource items to be configured into a declarative configuration file, such as a Terraform tool. A configuration execution module, such as a resource orchestration engine, then executes the declarative configuration file, enabling automated configuration of resources, such as cloud service resources. In some cases, the inputs for various configuration items for resources, such as cloud service resources, require team collaboration, and resource configuration tools require team members to pre-download and run them locally. This results in inefficient local management of declarative configuration files. The emergence of resource configuration hosting services deployed on cloud platforms has improved the efficiency of resource configuration tools. By renting remotely hosted resource configuration tools, the efficiency of editing declarative configuration files and the operational efficiency of configuration execution modules are improved. Because resource configuration tools can configure resources such as cloud service resources, when different users share the hosted resource configuration tool, there is a risk that a user could exploit vulnerabilities in the resource configuration tool to access unauthorized resources. For example, a user could access another user's private resources, or misappropriate unauthorized computing resources from a platform providing resources such as cloud service resources. Therefore, in existing resource configuration solutions, the security of hosted services for resource configuration tools is relatively poor. SUMMARY OF THE INVENTION In view of this, embodiments of the present disclosure provide a resource configuration method, an electronic device, a computer storage medium, and a computer program product to enhance the security of hosted resource configuration services. According to a first aspect of embodiments of the present disclosure, a resource configuration method is provided, comprising: obtaining, via a user terminal of a resource configuration hosting service, a declaration configuration file for a target resource; parsing a grammatical description of the declaration configuration file to obtain various resource configuration items for the target resource; verifying the various resource configuration items for the target resource based on preset verification rules obtained from a management terminal of the resource configuration hosting service; and, if the verification passes, invoking a configuration execution module to execute the declaration configuration file.According to a second aspect of an embodiment of the present disclosure, a resource configuration method is provided, comprising: obtaining a declarative configuration file for a cloud service resource through a user end of a resource configuration hosting service; parsing a grammatical description of the declarative configuration file to obtain resource dependencies of the cloud service resource; structuring the resource dependencies to generate structured data; validating the structured data based on preset validation rules obtained from a management end of the resource configuration hosting service; and, if the validation passes, invoking a configuration execution module to execute the declarative configuration file. According to a third aspect of an embodiment of the present disclosure, a resource configuration apparatus is provided, comprising: an acquisition module, obtaining a declarative configuration file for a target resource through a user end of the resource configuration hosting service; a parsing module, parsing the grammatical description of the declarative configuration file to obtain resource configuration items of the target resource; a validation module, validating the resource configuration items based on preset validation rules obtained from the management end of the resource configuration hosting service; and an execution calling module, invoking a configuration execution module to execute the declarative configuration file if the validation passes. According to a third aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; the memory is configured to store at least one executable instruction, wherein the executable instruction causes the processor to perform operations corresponding to the method described in the first or second aspect. According to a fourth aspect of an embodiment of the present disclosure, a computer storage medium is provided, on which a computer program is stored, and when executed by a processor, the program implements the method described in the first or second aspect. According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, comprising a computer program / instructions, and when executed by a processor, the computer program / instructions implement the method described in the first or second aspect. In the solution of the embodiment of the present disclosure, preset verification rules are obtained from the management end of the resource configuration hosting service, improving the flexibility and efficiency of online verification of the declarative configuration file. In addition, the grammatical description of the declarative configuration file is parsed to obtain each resource configuration item of the target resource. Using the preset verification rules can more reliably and flexibly verify the security of each resource configuration item, thereby improving the security of the resource configuration hosting service.BRIEF DESCRIPTION OF THE DRAWINGS To more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below only illustrate some of the embodiments described in the present disclosure. Those skilled in the art can also derive other drawings based on these drawings. Figure 1 is a flowchart of the steps of the resource configuration method in some embodiments of the present disclosure. Figure 2 is a schematic block diagram of the hosting service platform of the resource configuration tool in Figure 1. Figure 3 is a flowchart of the steps of the resource configuration method in some examples of the embodiment of Figure 1. Figure 4 is a flowchart of the steps of the resource configuration method in some other embodiments of the present disclosure. Figure 5 is a structural block diagram of the resource configuration apparatus in some other embodiments of the present disclosure. Figure 6 is a schematic structural diagram of the electronic device in some other embodiments of the present disclosure. DETAILED DESCRIPTION To help those skilled in the art better understand the technical solutions in the embodiments of the present disclosure, the following will provide a clear and complete description of the technical solutions in the embodiments of the present disclosure, in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the embodiments described only represent some of the embodiments of the present disclosure, and not all of them. All other embodiments derived by those skilled in the art based on the embodiments of the present disclosure should fall within the scope of protection of the embodiments of the present disclosure. The following further illustrates the specific implementation of the embodiments of the present disclosure, with reference to the accompanying drawings. Generally speaking, a resource configuration hosting service deployed on a cloud platform improves the editing efficiency of declarative configuration files and the operational efficiency of the configuration execution module. This facilitates the efficient and flexible use of resource configuration tools through cloud services. Different users can share the hosted resource configuration tool by remotely accessing it, and users only need to edit declarative configuration files, such as Terraform scripts. Because resource configuration tools can configure target resources, sharing the hosted resource configuration tool by different users creates the risk of users exploiting vulnerabilities in the tool to access unauthorized target resources. For example, a user could access another user's private target resources, or misappropriate unauthorized computing resources from the platform providing the target resources. To address this issue, various embodiments of the present disclosure provide a series of solutions to improve the security of the resource configuration hosting service and the efficiency of online update verification rules. For example, Figure 1 illustrates a resource configuration method according to some embodiments of the present disclosure. The resource configuration method in Figure 1 can be executed on a cloud server, such as a resource configuration hosting service platform. The resource configuration method includes the following:

[0002] S110: Obtaining a target resource's declaration configuration file through a user terminal of the resource configuration hosting service. It should be understood that the resource configuration hosting service is implemented via a resource configuration hosting service platform. The resource configuration hosting service platform can be a cloud service platform that deploys the resource configuration service into a virtual machine for hosting. The resource configuration hosting service can be a service provided by the cloud service platform itself or by a tenant of the cloud service platform. It should also be understood that target resources can refer to hardware and software resources used to perform computing tasks in a computing environment. Target resources provide the ability to process, store, and manage data. Target resources include, but are not limited to, processor resources, memory resources, storage resources, network bandwidth resources, software interface resources, etc. It should also be understood that the resource configuration hosting service includes a user terminal and a management terminal. The user terminal can be the user interface of the resource configuration hosting service, providing a portal for users to operate and use the resource configuration hosting service. The management terminal can be the management interface of the resource configuration hosting service, providing a portal for the provider of the resource configuration hosting service to manage and maintain the resource configuration hosting service. The user terminal can be used to receive user operation instructions for the resource configuration hosting service, as well as the declaration configuration file to be executed by the resource configuration hosting service.

[0003] S120: Parse the grammatical description of the declarative configuration file to obtain the various resource configuration items of the target resource. It should be understood that the declarative configuration file has a declarative grammatical structure, and the client (e.g., user) can edit the declarative configuration file using a specific format of the grammatical description. The declarative configuration file describes the desired state of each resource configuration item of the target resource. Specifically, by defining various resource states, the declarative configuration file only requires the configuration execution module hosted by the resource configuration hosting service, such as the resource orchestrator, to execute the declarative configuration file, eliminating the need for detailed configuration implementation. For example, the resource states of resource configuration items include, but are not limited to, resource type, resource attributes, resource dependencies, and resource declaration lifecycle. Furthermore, the declarative configuration file is highly scalable and can be flexibly extended and modified based on needs and circumstances. Furthermore, the declarative configuration file can be decoupled from the resource configuration hosting service platform, providing a universal method for describing and deploying various resource configurations for the target resource. In some cases, resource configuration and deployment can be performed across multiple platforms and environments. This resource configuration approach is also referred to as Infrastructure as Code (IaC). For example, Terraform projects, as an example of declarative configuration files, can be used for automated builds, version control, and management of target resources. In some examples, the grammatical structure of a Terraform project defines a syntax tree between various resource configuration objects. For example, a Terraform project may include a main file (main.tf), a variable definition file (variables.tf), an output definition file (outputs.tf), a variable value file (terraform.tfvars), and a project documentation file (README.md). The grammatical structure representing these resource configuration objects is predefined in the editor of the declarative configuration file.

[0004] S130: Based on preset validation rules obtained from the management end of the resource configuration hosting service, each resource configuration item of the target resource is validated. It should be understood that preset validation rules include, but are not limited to, various validation types, such as required field validation, data type validation, data range validation, conditional and logical validation, uniqueness validation, dependency validation, and security validation. By validating each resource configuration item based on customized preset validation rules, the risk of unauthorized access to resources is preemptively eliminated before executing the declarative configuration file. In some examples, it may be determined whether any of the resource configuration items contain risky resource configuration items that do not comply with the preset validation rules. If such risky resource configuration items exist, the validation is determined to have failed; otherwise, the validation is determined to have passed.

[0005] S140: If verification passes, the configuration execution module is invoked to execute the declarative configuration file. It should be understood that the configuration execution module may be a core component of the resource configuration hosting service and may be implemented as a resource orchestrator or configuration executor, such as a Terraform executor. In the embodiments of the present disclosure, preset verification rules are obtained from the management end of the resource configuration hosting service, improving the flexibility and efficiency of online verification of the declarative configuration file. Furthermore, the grammatical description of the declarative configuration file is parsed to obtain the various resource configuration items of the target resource. Using the preset verification rules enables more reliable and flexible security verification of each resource configuration item, thereby improving the security of the resource configuration hosting service. In other embodiments, when verifying the various resource configuration items of the target resource based on the preset verification rules, the various resource configuration items of the target resource may be structured as easily queryable structured data. To ensure that the structured data more reliably represents the various resource configuration items, resource dependencies between the various resource configuration items may be determined, and then the resource dependencies may be structured to generate the structured data. It should be understood that key fields of each resource configuration item can be identified, and resource dependencies between the resource configuration items can be constructed based on the relationships between the key fields. Alternatively, the grammatical description of the declaration configuration file can be parsed to obtain the resource configuration items of the target resource and the resource dependencies between them. Furthermore, the structured data can be verified based on preset verification rules obtained from the management end of the resource configuration hosting service. For example, the preset verification rules can include query conditions to more reliably and efficiently verify the structured data. Furthermore, during the configuration of the target resource, the dependencies between various resource configuration objects must be considered. These dependencies are determined by the software and hardware configuration of the target resource. The creation of some resources may require that other resources already exist or have completed certain initialization operations. These dependencies can be viewed as a relationship diagram between resources, describing the interdependence and order between resources. It should also be understood that resource dependencies can be structured and converted into structured data representations to analyze and manage (for example, add, delete, modify, and query) the dependencies between various resources. In other words, resources and their dependencies are converted into a data format suitable for computer query and analysis, such as a graph structure, tree structure, or relational table. The dependencies between various resource configuration objects may differ for different target resource configuration processes. Accordingly, structured data is constructed based on resource dependencies, and the correspondence between its attribute fields also varies accordingly.The format of the structured data can be a data format such as a JSON file. In some specific examples, as shown in Figure 2, the resource configuration hosting service includes a user terminal 21 and a management terminal 22. The resource configuration hosting service platform includes a parser 210, a validator 220, and a resource orchestrator 230. The resource orchestrator 230 is an example of a configuration execution module, one of the core components of the resource configuration hosting service, capable of executing declarative configuration files such as Terraform projects. In some examples, a Terraform execution engine such as Terraform software can be deployed to the resource configuration hosting service platform to implement the resource orchestrator's functionality. Furthermore, the parser 210 and validator 220 can be auxiliary logic provided by the resource configuration hosting service to more reliably manage and maintain the resource configuration hosting service. For example, in some specific examples, the validator 220 can directly verify the declarative configuration file received from the user terminal 21, or it can receive and verify the structured data after the declarative configuration file is parsed by the parser 210. The validation process performed by the validator 220 reduces the risk of unauthorized access to the resource configuration hosting service platform by the declarative configuration file using the resource orchestrator 230, thereby improving the security of the target resource configuration process. More specifically, during the validation process, the validator 220 can perform validation based on pre-set validation rules. These pre-set validation rules include, but are not limited to, required field validation, data type validation, data range validation, conditional and logical validation, uniqueness validation, dependency validation, and security validation. Specifically, data type validation verifies whether field values ​​in structured data conform to expected data types and formats, such as strings, numeric values, and Boolean values. Data range validation verifies whether field values ​​in structured data fall within a predefined range to prevent errors or abnormal values. Conditional and logical validation verifies whether field values ​​in structured data satisfy specific logical relationships and conditions based on application rules and conditions. Uniqueness validation verifies whether field values ​​in structured data are unique, preventing duplicate or conflicting configurations. Dependency validation verifies whether the dependencies between field values ​​in structured data and resources are correct, ensuring correct resource configuration and association. For example, this involves checking whether references between resources or relationships between resources are correctly configured. Data format validation is used to verify that input data conforms to specific formats and specifications for fields such as timestamps, URLs, and IP addresses. Security validation is used to verify that structured data contains sensitive information such as passwords and keys, ensuring the use of appropriate security encryption algorithms.Required field verification is used to verify the presence of required fields or risk fields in structured data to ensure the completeness and accuracy of resource configuration. Specifically, after parsing the structured data of a declaration configuration file, the preset verification rules can include query conditions to more reliably and efficiently verify the structured data. As an example of the aforementioned conditional and logical verification, the preset verification rules include risk logic query conditions, which can be constructed using query statements such as the Structured Query Language (SQL). Furthermore, when verifying structured data, a query can be performed based on the risk logic query conditions. If an attribute field relationship matching the risk logic query conditions exists, the verification fails; if no attribute field relationship matching the risk logic query conditions exists, the verification passes. Alternatively, as an example of the aforementioned required field verification, the preset verification rules can include risk field query conditions, which can be constructed using query statements such as the Structured Query Language (SQL). Accordingly, when verifying structured data, you can query the structured data based on the risk field query criteria. If at least one field in each attribute field of the structured data matches the risk field query criteria, the verification fails. If no field matches the risk field query criteria, the verification passes. For example, the main file main.tf of the Terraform X program is: resource ami. instance type = "t2. micro" subnet id = "subnet-12345678" public ip = "666.666.6.6" # Risk field tags = {

[0006] Name = "example-instance"

[0007] The structured data is: instance type = "t2. micro" > subnet id = "subnet-12345678" > public ip = "666.666.6.6"o Edit the SQL statement for the structured data:

[0008] SELECT *

[0009] FROM resources

[0010] WHERE public ip = '666.666.6.6' Furthermore, if the verification passes, the call can be made; if the verification fails, a notification to modify the declarative configuration file can be fed back via the user terminal 21. Furthermore, in the example of FIG2 , before generating the structured data of the declarative configuration file, the parser 210 can parse the grammatical description of the declarative configuration file to obtain the resource dependencies configured for the target resources. Specifically, a declarative configuration file, such as a Terraform project, can be read and its contents broken down into symbols such as keywords, identifiers, operators, and strings. Then, based on the grammatical description of the declarative format of the declarative configuration file, the symbol sequence is organized into a syntax tree. The syntax tree hierarchically represents the relationships and hierarchies between different elements in the file. Resources defined in the declarative configuration file, such as virtual machines, storage, and networks, are then identified and extracted. Resource information is then extracted and recorded based on resource identifiers, attributes, and dependencies in the syntax tree. Then, resource dependencies are established by identifying references between resources, defining dependencies between resources, and configuring associations between resources. Furthermore, as some examples of generating structured data through structured processing of resource dependencies, resource configuration objects such as virtual machines, storage, and networks can be used as attribute fields to generate structured data. It should be understood that the granularity of resource configuration items can be set as a custom parameter for the structured processing. For example, one or more resource configuration items can be set for each resource configuration object. Then, by identifying references between resources, defining dependencies between resources, and configuring associations between resources, corresponding relationships between attribute fields are established, forming structured data such as a data table. Without loss of generality, multiple attribute fields can be determined based on multiple resource configuration items in the declarative configuration file. For example, the description field of each resource configuration item can be determined as an attribute field. Then, based on the resource dependencies, corresponding relationships between the multiple attribute fields are established to generate structured data. The resulting structured data fully represents the resource dependencies in the declarative configuration file and facilitates the execution of structured queries using query statements constructed using languages ​​such as the Structured Query Language (SQL).Furthermore, to verify the reliability of the parsed resource dependencies, a match verification can be performed against the execution rules of a configuration execution module, such as the resource orchestrator 230. The execution rules of this configuration execution module can execute the declarative configuration file based on the execution order of each resource configuration item. If the match verification fails, this indicates that even if the verification passes, the declarative configuration file cannot be reliably executed. Therefore, if the match fails, a notification to modify the declarative configuration file can be fed back through the user terminal 21. Conversely, if the parsed resource dependencies match the execution rules, the declarative configuration file can be reliably executed. The resource dependencies can then be structured to generate structured data for subsequent verification. In other words, before structuring the resource dependencies to generate structured data, it can be determined whether the resource dependencies in the declarative configuration file (i.e., the resource dependencies between the resource configuration items) comply with the execution rules of the configuration execution module. If the resource dependencies comply with the execution rules, the resource dependencies are structured. If the resource dependencies do not comply with the execution rules, a notification to modify the declarative configuration file can be fed back through the user terminal 21. Further referring to the example in FIG2 , after passing the verification process of the verifier 220, the resource orchestrator 230 can execute the declarative configuration file. After the declarative configuration file is executed, the automated configuration process of the target resource is completed. The resource configuration hosting service can also monitor the execution process of the resource orchestrator 230 to identify risky configuration items that are difficult to detect during the verification process of the verifier 220. It should be understood that adding validation or interception logic for risky configuration items to the resource orchestrator 230 would increase the complexity of the resource orchestrator 230 and reduce its execution efficiency. Therefore, monitoring the execution process of the resource orchestrator 230 can be compatible with the inherent logic of the resource orchestrator 230 and further identify risky configuration items in the declarative configuration file without intruding on the resource orchestrator 230. Specifically, in order to obtain abnormal execution operations of the configuration execution module during the execution of the declared configuration file by the monitoring configuration execution module, the execution log of the configuration execution module of the Terraform project can be monitored, and abnormal execution records such as log error information or log exception information in the execution log can be queried.Without loss of generality, the configuration execution module's execution log for the declared configuration file can be obtained, and then the execution records in the execution log can be parsed. Based on the access records of service resources other than the target resource, abnormal execution operations of the configuration execution module can be determined. For example, operations associated with the access records of service resources other than the target resource can be determined as abnormal execution operations. Furthermore, the event notification component or event notification API of resource orchestrator 230 can be accessed to obtain abnormal execution operations during the Terraform project execution process. Upon obtaining abnormal execution operations, the alarm component of resource orchestrator 230 can be triggered to provide feedback to user client 21 and management client 22, or the alarm component of the resource configuration hosting service can be used to provide feedback to user client 21 and management client 22. The notification provided to management client 22 includes at least one risk configuration item corresponding to the abnormal execution operation, so that management client 22 can modify the preset verification rules based on the at least one risk configuration item. Without loss of generality, at least one risk configuration item associated with an abnormal execution operation can be identified from each resource configuration item in the declaration configuration file. A second notification can then be fed back via the management terminal, where the second notification indicates that a preset verification rule should be modified with reference to the at least one risk configuration item. Alternatively, when a risk configuration item is detected during execution of the configuration execution module, the configuration execution module can be interrupted, a notification indicating modification of the declaration configuration file can be fed back, and the preset verification rule with reference to the change in the risk configuration item can be obtained. Immediately interrupting the configuration execution module allows for more reliable troubleshooting of abnormal operations defined in the declaration configuration file. Furthermore, the alarm component of the configuration execution module or the resource configuration hosting service can also be configured to interrupt the configuration execution module. Figure 3 illustrates some example resource configuration methods. Specifically, the resource configuration method of Figure 3 includes: In step S310, the grammatical description of the declaration configuration file is parsed to obtain resource dependencies of the target resource, i.e., the cloud service resource, and then proceeding to step S320. For example, the grammatical structure of a Terraform project can be parsed to obtain the dependencies between the various resource configuration objects. In step S320, it is determined whether the resource dependency declared in the configuration file complies with the execution rules of the configuration execution module. If so, the process proceeds to step S340; if not, the process proceeds to step S330. For example, the execution rules of the configuration execution module may be obtained. The execution rules at least indicate the execution order of each resource configuration item. It should be understood that the execution order of each resource configuration item is determined by the design architecture of the target resource and the virtualization rules of each resource.Furthermore, when the resource dependency conforms to the execution rules of the configuration execution module, the configuration execution module can complete the declaration configuration file process with such resource dependency. Otherwise, the configuration execution module will report an error. Before the configuration execution module executes the process, unreliable resource dependencies are eliminated by executing the rules, which helps improve resource configuration efficiency. In step S330, the user terminal provides feedback regarding modifications to the declaration configuration file. For example, a direct notification indicating that the declaration configuration file does not conform to the execution rules can be provided, or a suggestion for modifying the declaration configuration file can be provided in the notification. Furthermore, notifications regarding modifications to the declaration configuration file are provided until the modified declaration configuration file conforms to the execution rules. In step S340, the resource dependency is structured to generate structured data, and the process proceeds to step S350. For example, attribute fields can be constructed based on the resource configuration objects in the declaration configuration file, and the resource dependency can be constructed as a corresponding relationship between the attribute fields, generating structured data such as a JSON file. In step S350, the structured data is verified to determine whether the verification passes. If the verification passes, the process proceeds to step S370. If the verification fails, the process proceeds to step S360. In step S360, the user terminal provides feedback notifying the user of modifications to the declared configuration file. For example, the user terminal may provide a direct notification indicating that the declared configuration file verification failed, or may include a suggested modification method for the declared configuration file. Furthermore, feedback regarding modifications to the declared configuration file continues until the modified declared configuration file verification passes. In step S370, the configuration execution module is invoked to execute the declared configuration file, and step S380 is performed. For example, the verification process may be configured to trigger a startup instruction for the configuration execution module when verification passes, causing the configuration execution module to execute the declared configuration file in response to the startup instruction. In step S380, the configuration execution module's execution of the declared configuration file is monitored to determine whether any abnormal execution of the configuration execution module occurs. If the answer is yes, the process proceeds to step S390. If not, the process continues with step S380. For example, when an abnormal execution operation is detected, the alarm component of the configuration execution module can be triggered to interrupt the configuration execution module, notify the user end to modify the declaration configuration file, and notify the management end to change the preset verification rules. In other words, the alarm instruction of the alarm component triggers feedback notification to the user end and the management end.Alternatively, the alarm component of the resource configuration hosting service can interrupt the configuration execution module, notify the user end to modify the declaration configuration file, and notify the management end to change the preset verification rules. In step S390, the management end provides feedback regarding the change in the preset verification rules with reference to at least one risk configuration item. For example, the at least one risk configuration item can be included in the notification, or query conditions related to the at least one risk configuration item can be provided for querying structured data. Alternatively, when a current risk configuration item is discovered, the configuration execution module can be interrupted, providing feedback regarding the modification of the declaration configuration file and simultaneously obtaining preset verification rules that reference the change in the current risk configuration item (for example, by adding query conditions related to the current risk configuration item). Furthermore, FIG4 illustrates resource configuration methods according to other embodiments of the present disclosure. The resource configuration method of FIG4 can be an example of the resource configuration method of FIG1. ​​Specifically, the resource configuration method of FIG4 includes: S410: Obtaining, via the user end of the resource configuration hosting service, the declaration configuration file of the cloud service resource.

[0011] S420: Parse the syntax description of the declaration configuration file to obtain resource dependencies of the cloud service resources.

[0012] S430: Structuring resource dependencies to generate structured data.

[0013] S440: Verify the structured data based on preset verification rules obtained from the management end of the resource configuration hosting service.

[0014] S450: If verification passes, the configuration execution module is called to execute the declarative configuration file. It should be understood that cloud service resources include, but are not limited to, infrastructure resources such as memory, processors, accelerators, and network cards, as well as software platform resources such as operating systems and artificial intelligence model frameworks. The declarative configuration file for cloud service resources is used to configure cloud service resources. Cloud service resources herein are cloud service resources accessed by clients using the resource configuration hosting service. Cloud service resources can be infrastructure resources of the cloud service platform or cloud service resources of other cloud service platforms accessed by clients using the resource configuration hosting service. It should also be understood that resource dependencies are structured and converted into structured data representations to analyze and manage (e.g., add, delete, modify, and query) the dependencies between various resources. Specifically, resources and their dependencies are converted into a data format suitable for computer query and analysis, such as a graph structure, tree structure, or relational table. The dependencies between various resource configuration objects may vary for different target resource configuration processes. Accordingly, structured data is constructed based on resource dependencies, and the correspondence between its attribute fields also varies accordingly. The format of the structured data can be a data format such as a JSON file. In the embodiments of the present disclosure, the syntactic description of the declarative configuration file is parsed to obtain the resource dependencies of the cloud service resources. These resource dependencies are then structured to generate structured data. Because structured data reliably represents resource dependencies and is easier to query, the use of preset verification rules can more reliably verify the security of the declarative configuration file obtained from the user, thereby improving the security of the resource configuration hosting service. Furthermore, the preset verification rules are obtained from the management end of the resource configuration hosting service, which also improves the efficiency of online verification rule updates. In other embodiments, in the resource configuration method, the management end of the resource configuration hosting service can also provide feedback on the verification results of each resource configuration item of the cloud service resource, so that the preset verification rules can be modified based on the verification results. In some specific examples, the management end can provide feedback on a notification of a change to the preset verification rule with reference to at least one risky configuration item. For example, at least one risk configuration item can be included in the notification, and query conditions related to the at least one risk configuration item can be provided for querying structured data. Furthermore, when a current risk configuration item is discovered, a notification to modify the declaration configuration file can be provided, and preset verification rules that reference the changes to the current risk configuration item can be obtained. The resource configuration apparatus according to other embodiments of the present disclosure will be described below with reference to FIG5 .The resource configuration device in Figure 5 includes: an acquisition module 510, which acquires a target resource's declarative configuration file through a user terminal of a resource configuration hosting service; a parsing module 520, which parses the grammatical description of the declarative configuration file to obtain various resource configuration items of the target resource; a verification module 530, which verifies the various resource configuration items based on preset verification rules obtained from the management terminal of the resource configuration hosting service; and an execution and invocation module 540, which, if verification passes, invokes a configuration execution module to execute the declarative configuration file. In the embodiment of the present disclosure, the grammatical description of the declarative configuration file is parsed to obtain the resource dependencies of the target resource, and the resource dependencies are structured to generate structured data. Because structured data reliably represents resource dependencies and is easier to query, the use of preset verification rules can more reliably verify the security of the declarative configuration file obtained from the user terminal, thereby improving the security of the resource configuration hosting service. Furthermore, the fact that the preset verification rules are obtained from the management terminal of the resource configuration hosting service also improves the efficiency of online verification rule updates. It should be understood that in the above embodiments, the resource configuration hosting service is implemented via a resource configuration hosting service platform. The resource configuration hosting service platform can be a cloud service platform that deploys the resource configuration service into a virtual machine for hosting. The resource configuration hosting service can be a service provided by the cloud service platform itself or by a tenant of the cloud service platform. Furthermore, target resources include, but are not limited to, infrastructure resources such as memory, processors, accelerators, and network cards, as well as software platform-level resources such as operating systems and artificial intelligence model frameworks. The target resource declaration configuration file is used to configure the target resources. The target resources here are the target resources accessed by the user end using the resource configuration hosting service. The target resources can be target resources of the cloud service platform or target resources of other cloud service platforms accessed by the user end using the resource configuration hosting service. Furthermore, the resource configuration hosting service includes a user end and a management end. The user end can be the user interface of the resource configuration hosting service, providing the user with the entry point for operating and using the resource configuration hosting service. The management end can be the management interface of the resource configuration hosting service, providing the provider with the entry point for managing and maintaining the resource configuration hosting service. The client can be used to receive user operation instructions for the resource configuration hosting service, as well as the declarative configuration file to be executed by the resource configuration hosting service. In addition, the declarative configuration file has a declarative grammatical structure, and the client (e.g., user) can edit the declarative configuration file using a specific format of grammatical description.Declarative configuration files describe the desired state of target resources. Specifically, by defining various resource states, declarative configuration files only require the configuration execution module hosted by the resource configuration hosting service, such as the resource orchestrator, to execute the declarative configuration files, eliminating the need for detailed configuration implementation. Furthermore, declarative configuration files are highly scalable and can be flexibly extended and modified based on needs and circumstances. Furthermore, declarative configuration files can be decoupled from the resource configuration hosting service platform, providing a universal way to describe and deploy various resource configurations for target resources. In some cases, resource configuration and deployment can be performed across multiple platforms and environments. This resource configuration approach is also known as Infrastructure as Code (IaC). For example, Terraform X-Script, as an example of a declarative configuration file, can be used for automated build, version control, and management of target resources. It should also be understood that during the target resource configuration process, dependencies between various resource configuration objects must be considered, as they are determined by the target resource's software and hardware configuration. The creation of some resources may require the existence or completion of certain initialization operations for other resources. These dependencies can be viewed as a relationship diagram between resources, describing their interdependencies and order. Furthermore, resource dependencies can be structured and converted into structured data representations to analyze and manage (e.g., add, delete, modify, and query) the dependencies between various resources. Specifically, resources and their dependencies are converted into data formats suitable for computer query and analysis, such as graph structures, tree structures, or relational tables. The dependencies between various resource configuration objects may differ for different target resource configuration processes. Accordingly, the structured data is constructed based on resource dependencies, and the correspondence between its attribute fields also varies accordingly. The structured data format can be, for example, a JSON file. Pre-set validation rules include, but are not limited to, required field validation, data type validation, data range validation, conditional and logical validation, uniqueness validation, dependency validation, and security validation. By validating structured data using custom pre-set validation rules, the risk of unauthorized access to target resources is preemptively eliminated before executing the declarative configuration file. Furthermore, the configuration execution module can be a core component of the resource configuration hosting service. The configuration execution module can be implemented as a resource orchestrator or configuration executor, such as a Terraform executor.In other embodiments, the verification module includes a structuring module and a verification execution module. The structuring module is configured to determine resource dependencies between the resource configuration items and then structure the resource dependencies to generate structured data. The verification execution module is configured to verify the structured data based on preset verification rules obtained from the management end of the resource configuration hosting service. The structuring module is specifically configured to determine multiple attribute fields based on multiple resource configuration items in the declarative configuration file; and to establish corresponding relationships between the multiple attribute fields based on the resource dependencies to obtain the structured data. In other embodiments, the parsing module is further configured to determine whether the resource dependencies between the resource configuration items comply with execution rules of the configuration execution module, wherein the execution rules at least indicate the execution order of the resource configuration items; and if the resource dependencies comply with the execution rules, structure the resource dependencies. In other embodiments, the parsing module is further configured to provide a first notification to the user end if the resource dependencies do not comply with the execution rules, wherein the first notification instructs the user end to modify the declarative configuration file. In other embodiments, the preset verification rule includes a risk field query condition. The verification execution module is specifically configured to: query the structured data based on the risk field query condition; if at least one field in each attribute field of the structured data matches the risk field query condition, the verification fails. In other embodiments, the execution invocation module is specifically configured to: monitor the execution of the declarative configuration file by the configuration execution module to determine abnormal execution operations of the configuration execution module; determine at least one risk configuration item associated with the abnormal execution operation among each resource configuration item in the declarative configuration file; and provide a second notification via the management terminal, wherein the second notification indicates that the preset verification rule should be modified with reference to the at least one risk configuration item. In other embodiments, the execution invocation module is specifically configured to: obtain an execution log of the configuration execution module on the declarative configuration file; parse each execution record in the execution log; and determine abnormal execution operations of the configuration execution module based on access records of service resources other than the target resource. In some other embodiments, the verification execution module is further configured to: if the verification fails, feed back a third notification through the user terminal, where the third notification instructs to modify the declaration configuration file.The specific implementation of each module in the resource configuration device can be found in the descriptions of the corresponding steps in the above-mentioned method embodiments, and corresponding beneficial effects are achieved, so this description is omitted here. Those skilled in the art will clearly understand that, for ease of description and brevity, the specific operating processes of the devices and modules described above can refer to the corresponding process descriptions in the above-mentioned method embodiments, and are omitted here. Referring to FIG6 , a schematic diagram of the structure of an electronic device according to another embodiment of the present disclosure is shown. The specific embodiments of the present disclosure do not limit the specific implementation of the electronic device. As shown in FIG6 , the electronic device may include: a processor 602 for executing a program 610, a communications interface 604, a memory 606, and a communication bus 608. The processor, communications interface, and memory communicate with each other via the communication bus. The communications interface is used to communicate with other electronic devices or servers. The processor is used to execute the program, specifically, to perform the relevant steps in the above-mentioned method embodiments. Specifically, the program may include program code, which includes computer operating instructions. The processor may be a CPU, an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present disclosure. The one or more processors included in the smart device may be of the same type, such as one or more CPUs, or different types, such as one or more CPUs and one or more ASICs. A memory is used to store programs. The memory may include high-speed RAM or non-volatile memory, such as at least one disk drive. The program may include multiple computer instructions. Specifically, the program may cause the processor to perform operations corresponding to the resource configuration method described in any of the aforementioned method embodiments. The specific implementation of each step in the program can be found in the corresponding descriptions of the corresponding steps, modules, or units in the aforementioned method embodiments, and corresponding beneficial effects are achieved, so detailed description is omitted here. Those skilled in the art will clearly understand that, for ease and brevity of description, the specific operating processes of the aforementioned devices, equipment, or modules can refer to the corresponding process descriptions of the resource configuration method in the aforementioned embodiments, and are not further described here.The present disclosure also provides a computer storage medium storing a computer program that, when executed by a processor, implements the method described in any of the aforementioned method embodiments. The computer storage medium includes, but is not limited to, a compact disc read-only memory (CD-ROM), random access memory (RAM), a floppy disk, a hard disk, or a magneto-optical disk. The present disclosure also provides a computer program product comprising computer instructions that instruct a computing device to perform operations corresponding to each of the aforementioned method embodiments. Furthermore, it should be noted that all user-related information (including, but not limited to, user device information, user personal information, etc.) and data (including, but not limited to, sample data used for model training, data used for analysis, stored data, and displayed data, etc.) involved in the present disclosure are authorized by the user or fully authorized by all parties. The collection, use, and processing of the relevant data must comply with relevant regulations and standards, and corresponding operation portals are provided for the user to choose to authorize or reject. It should be noted that, depending on implementation needs, the various components / steps described in the embodiments of the present disclosure may be split into more components / steps, or two or more components / steps or partial operations of components / steps may be combined into new components / steps to achieve the objectives of the embodiments of the present disclosure. The methods according to the embodiments of the present disclosure described above may be implemented in hardware or firmware, or as software or computer code that can be stored on a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code originally stored on a remote recording medium or non-transitory machine-readable medium downloaded via a network and then stored on a local recording medium. Thus, the methods described herein may be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an application-specific integrated circuit (ASIC) or a field-programmable gate array (FPGA)).It will be understood that a computer, processor, microprocessor controller, or programmable hardware includes a storage component (e.g., random access memory (RAM), read-only memory (ROM), flash memory, etc.) that can store or receive software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the methods described herein are implemented. Furthermore, when a general-purpose computer accesses code for implementing the methods described herein, the execution of the code transforms the general-purpose computer into a dedicated computer for performing the methods described herein. Those skilled in the art will appreciate that the various exemplary units and method steps described in conjunction with the embodiments disclosed herein can be implemented using electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Professionals may use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the embodiments disclosed herein. The above embodiments are intended only to illustrate the embodiments of the present disclosure and are not intended to limit them. Persons skilled in the relevant art may make various changes and modifications without departing from the spirit and scope of the embodiments of the present disclosure. Therefore, all equivalent technical solutions are also within the scope of the embodiments of the present disclosure. The scope of patent protection for the embodiments of the present disclosure shall be defined by the claims. Industrial Applicability: Preset verification rules are obtained from the management end of the resource configuration hosting service, improving the flexibility and efficiency of online verification of declarative configuration files. Furthermore, the syntactic description of the declarative configuration file is parsed to obtain the various resource configuration items of the target resource. Using pre-set verification rules enables more reliable and flexible security verification of each resource configuration item, thereby improving the security of the resource configuration hosting service.

Claims

Claims 1. A resource allocation method, comprising: Obtain the target resource's declaration configuration file through the client of the resource configuration hosting service; Parsing the syntax description of the declaration configuration file to obtain various resource configuration items of the target resource; Verifying each resource configuration item of the target resource based on preset verification rules obtained from the management end of the resource configuration hosting service; If the verification passes, the configuration execution module is called to execute the declaration configuration file.

2. The method according to claim 1, wherein: Based on preset verification rules obtained from the management end of the resource configuration hosting service, each resource configuration item of the target resource is verified, including: determining resource dependency relationships between the each resource configuration item; structuring the resource dependency relationships to generate structured data; and verifying the structured data based on the preset verification rules obtained from the management end of the resource configuration hosting service.

3. The method according to claim 2, wherein: Structuring the resource dependency to generate structured data includes: determining multiple attribute fields according to multiple resource configuration items in the declaration configuration file; and constructing a corresponding relationship between the multiple attribute fields based on the resource dependency to obtain the structured data.

4. The method according to claim 2, wherein: The method further includes: determining whether the resource dependency relationship between the resource configuration items complies with the execution rules of the configuration execution module, wherein the execution rules at least indicate the execution order of the resource configuration items; and if the resource dependency relationship complies with the execution rules, performing structured processing on the resource dependency relationship.

5. The method according to claim 4, wherein: The method further includes: if the resource dependency does not comply with the execution rule, feeding back a first notification through the user terminal, where the first notification instructs to modify the declaration configuration file.

6. The method according to claim 2, wherein: The preset verification rules include risk field query conditions; based on the preset verification rules obtained from the management end of the resource configuration hosting service, the structured data is verified, including: querying the structured data based on the risk field query conditions; if there is at least one field in each attribute field of the structured data that matches the risk field query conditions, then the verification fails.

7. The method according to claim 1, wherein: The method further includes: monitoring the execution process of the configuration execution module on the declaration configuration file to determine abnormal execution operations of the configuration execution module; determining at least one risk configuration item related to the abnormal execution operation among each resource configuration item in the declaration configuration file; A second notification is fed back through the management end, wherein the second notification indicates that the preset verification rule is changed with reference to the at least one risk configuration item.

8. The method according to claim 7, wherein: Monitoring the execution process of the configuration execution module on the declared configuration file and determining abnormal execution operations of the configuration execution module includes: obtaining an execution log of the configuration execution module on the declared configuration file; parsing each execution record in the execution log; and determining the abnormal execution operation of the configuration execution module based on access records of service resources other than the target resource.

9. The method according to claim 1, wherein: The method further includes: in a case where the verification fails, feeding back a third notification through the user terminal, where the third notification instructs to modify the declaration configuration file.

10. A resource allocation method, comprising: Obtain the declaration configuration file of the cloud service resources through the user end of the resource configuration hosting service; Parsing the syntax description of the declaration configuration file to obtain the resource dependency relationship of the cloud service resources; Structuring the resource dependency to generate structured data; Based on preset verification rules obtained from the management end of the resource configuration hosting service, the structured data is verified; if the verification passes, the configuration execution module is called to execute the declaration configuration file.

11. The method according to claim 10, wherein: The method further includes: feeding back, through the management end of the resource configuration hosting service, verification results of the respective resource configuration items of the cloud service resources.

12. An electronic device, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is configured to store at least one executable instruction, the executable instruction causing the processor to perform operations corresponding to the following method: obtaining a declaration configuration file of a target resource through a user end of a resource configuration hosting service; parsing a syntax description of the declaration configuration file to obtain various resource configuration items of the target resource; Verifying each resource configuration item of the target resource based on preset verification rules obtained from the management end of the resource configuration hosting service; If the verification passes, the configuration execution module is called to execute the declaration configuration file.

13. The electronic device according to claim 12, wherein: The executable instructions cause the processor to further perform operations corresponding to the following method: determining resource dependency relationships between the resource configuration items; structuring the resource dependency relationships to generate structured data; The structured data is verified based on preset verification rules obtained from the management end of the resource configuration hosting service.

14. The electronic device according to claim 13, wherein: The executable instructions cause the processor to further perform operations corresponding to the following method: determining multiple attribute fields according to multiple resource configuration items of the declaration configuration file; and constructing a correspondence between the multiple attribute fields based on the resource dependency to obtain the structured data. 16 15. The electronic device according to claim 13, wherein The executable instructions cause the processor to further perform operations corresponding to the following method: determining whether the resource dependency relationship between the various resource configuration items complies with the execution rules of the configuration execution module, wherein the execution rules at least indicate the execution order of the various resource configuration items; if the resource dependency relationship complies with the execution rules, then performing structured processing on the resource dependency relationship.

16. The electronic device according to claim 15, wherein: The executable instructions cause the processor to further perform operations corresponding to the following method: if the resource dependency does not comply with the execution rule, feeding back a first notification through the user terminal, where the first notification instructs to modify the declaration configuration file.

17. The electronic device according to claim 13, wherein: The preset verification rule includes a risk field query condition; the executable instruction causes the processor to further perform operations corresponding to the following method: querying the structured data based on the risk field query condition; if there is at least one field in each attribute field of the structured data that matches the risk field query condition, then the verification fails.

18. The electronic device according to claim 12, wherein: The executable instructions cause the processor to further perform operations corresponding to the following method: monitoring the execution process of the configuration execution module on the declaration configuration file, and determining abnormal execution operations of the configuration execution module; determining at least one risk configuration item related to the abnormal execution operation among each resource configuration item in the declaration configuration file; and feeding back a second notification through the management end, wherein the second notification indicates to change the preset verification rule with reference to the at least one risk configuration item.

19. A computer storage medium having a computer program stored thereon, wherein the program implements the method according to any one of claims 1 to 11 when executed by a processor.

20. A computer program product, comprising a computer program / instruction, which implements the method according to any one of claims 1 to 11 when executed by a processor.

Images