Patent ID: 11880483
Assignee: AMAZON TECHNOLOGIES, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A computer-implemented method, comprising:
provisioning a database manager of a relational database management system (RDBMS) with a security hook that overrides default access control capabilities of the database management system;
obtaining a database request;
identifying, based on the database request, a set of database resources to be accessed in order to fulfill the database request; providing the set of database resources to the security hook;
using the security hook to determine whether authorization to the set of database resources should be granted by:
determining a request context for the database request, wherein the request context comprises:
a principal identifier associated with a database user making the database request;
a set of resource identifiers associated with the set of database resources; and
an action corresponding to a statement type of the database request;

determining one or more applicable security policies managed by a policy management service; and
performing a policy evaluation based on the one or more applicable security policies and the request context to determine an indication of whether to grant access to the set of database resources; and

contingent upon the indication providing an approval, accessing the set of database resources to fulfill the database request.