Cross-Account Task Aliases for Secure On-Demand Code Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently executing code across multiple accounts while maintaining security and privacy, and in managing virtual machine resources to optimize computing efficiency and reduce complexity in creating network-based APIs.
Innovation Solution
An on-demand code execution environment enables cross-account execution of tasks using task aliases, which function as shortcuts to tasks owned by other accounts, ensuring security and privacy, and efficiently allocates executions to virtual machine instances, allowing users to customize parameters and permissions without managing resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If code execution is restricted to single-account environments, then security and privacy are maintained, but cross-account collaboration and resource sharing are limited
Solution Approach 1:
The patent introduces an alias as an intermediary entity that bridges the calling account and the owned account. The alias resides in the calling account's namespace but points to code owned by another account, enabling cross-account execution while maintaining clear ownership boundaries and security contexts. This mediator allows collaboration without compromising the security model.
2Productivity
If virtual machine resources are pre-provisioned for each account, then security isolation is ensured, but resource utilization efficiency and scalability are reduced
Solution Approach 1:
The patent merges the alias management functionality into the existing on-demand code execution environment, allowing aliases to be created and managed within the same platform that manages virtual machine resources. This integration enables the system to dynamically allocate resources based on alias resolutions without requiring separate resource management infrastructures for each account.
3Ease of operation
If users directly manage virtual machine instances, then control and customization are maximized, but administrative burden and operational complexity increase
Solution Approach 1:
The system implements self-service by automatically resolving aliases to the appropriate virtual machine instances and managing the execution lifecycle without requiring users to manually provision or configure VMs. Users simply create aliases and invoke them, while the underlying system handles resource allocation, security context setup, and execution management automatically.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods are described for managing cross-account access to tasks on an on-demand code execution environment or other distributed code execution environment. Such environments utilize pre-initialized virtual machine instances to enable execution of user- specified code in a rapid manner, without delays typically caused by initialization of the virtual machine instances. However, to ensure security, the code of different users is generally maintained separately, and executed on separate virtual machines. Embodiments described herein enable users of a first account to execute code of a second account, without gaining access to the code itself and while maintaining the privacy and security of each account. Specifically, aliases for a task of a first account can be created on a task of a second account, and used to invoke that task on behalf of the first account. Aliases may also allow users to customize how the task is executed.