Cloud Identity Mapping to OS User Groups for Secure Remote Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network-based service platforms face challenges in securely managing permissions and privileges for users managing resources, leading to potential unauthorized operations due to high-privilege agents executing commands beyond intended user permissions.
Innovation Solution
The solution involves mapping cloud identities of users to locally defined OS user groups, restricting permissions, and executing commands within the limitations of those permissions through shells launched by systems-manager agents, ensuring that users can only perform operations allowed by their assigned privileges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If high-privilege agents are used to execute commands on managed resources, then the agents can perform all necessary management operations, but users may execute commands beyond their intended permissions leading to unauthorized operations
Solution Approach 1:
The patent introduces shells as intermediary components between users and managed resources. These shells are launched by systems-manager agents and act as permission-enforcing mediators that filter and control command execution. The shells receive commands from users, verify permissions against the user's cloud identity, and only execute commands that are authorized, thereby preventing users from executing commands beyond their intended permissions while still allowing necessary management operations.
2Ease of operation
If users are granted broad permissions to manage resources effectively, then resource management flexibility improves, but the risk of accidental or malicious changes increases
Solution Approach 1:
The shells serve as permission-enforcing intermediaries that enable broad resource management capabilities while mitigating risks. Users can attempt to execute any management operation through the shell interface, but the shell validates each command against the user's authorized permissions before execution. This allows users to operate with flexible, broad permission scopes while the shell systematically filters out unauthorized commands, preventing both accidental and malicious changes.
Solution Approach 2:
The system implements feedback mechanisms where the shell provides real-time information to users about which commands are permitted and which are denied based on their permissions. When users attempt to execute commands, the shell responds with authorization status, allowing users to understand their permission boundaries and adjust their operations accordingly. This feedback loop maintains ease of operation by guiding users within their authorized scope while preventing harmful actions.
Data Source
AI summary
This disclosure describes techniques for defining a set of permissions, or privileges, for users who manage resources of a network-based service provisioned in a network-based service platform managed by a service provider. The techniques may include mapping cloud identities of the users to operating system (OS) user groups defined local to the resources that specify the set of permissions for user group members. Systems-manager agents that execute locally on the resources may determine to which OS user group the user belongs based on their cloud identity, and launch shells that are restricted by the set of permissions. Using these shells, a network-based service platform may allow users to remotely manage resources of the network-based service in various ways, such as through batch run commands and/or remote user sessions, while ensuring that the users are unable to execute commands on the resources that are outside the set of permissions.