Patent ID: 11863563
Assignee: AMAZON TECHNOLOGIES, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A computer-implemented method, comprising:
receiving, over a period of time, a plurality of requests to access a set of electronic resources in a multi-tenant environment;
determining whether to grant access to the set of electronic resources based on a first access policy, the first access policy including permissions relating to a set of actions capable of being executed against the set of electronic resources;
storing access information for the plurality of requests received over the period of time;
analyzing, after the period of time, the access information to determine a subset of actions, of the set of actions capable of being executed against the set of electronic resources, that were requested during the period of time;
determining a subset of the permissions of the first access policy that were used to grant the access for the subset of actions;
generating a new access policy granting permissions only corresponding to the subset of permissions that were used to previously grant access during the period of time and maintaining status of permissions previously denied in the first access policy;
evaluating the new access policy to check that the new access policy does not restrict access for all actions to one or more of the set of electronic resources previously allowed under the first access policy;
verifying, using a policy logic, that any change in scope of the permissions as granted in the new access policy does not violate the permissions of the first access policy;
providing the new access policy as a recommendation with respect to the set of electronic resources;
determining that permission for access should be granted corresponding to a second subset of permissions, the second subset of permissions not included in the subset of permissions;
modifying the new access policy to permit access corresponding to the second subset of permissions; and
causing the new access policy to be enforced for the set of electronic resources in response to receiving acceptance of the new access policy.