Patent ID: 11968241
Assignee: AMAZON TECHNOLOGIES, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A system, comprising:
a multi-tenant provider network that provides a plurality of services and resources in a production environment; and
one or more computing devices configured to implement an access control management system, wherein the access control management system is configured to:
initiate a learning mode associated with execution of an application in a pre-production environment in which the application is isolated from client traffic in the production environment and tested using historical or synthetic traffic, wherein the pre-production environment enables the application to access the services and resources provided in the production environment;
monitor a plurality of access requests to the services and resources by the application tested using the historical or synthetic traffic during the learning mode;
after termination of the learning mode, perform an analysis of the monitored access requests by the application tested using the historical or synthetic traffic during the learning mode, wherein the analysis of the access requests determines which of the services and resources were used by the application during the learning mode so as to generate a subset of the services and resources to include the determined one or more services and resources;
generate an access control policy based at least in part on the analysis of the access requests, wherein the access control policy permits access to the subset of the services and resources that was used by the application during the learning mode; and
attach the access control policy to a role associated with the application in the production environment, wherein the application is executed in the production environment with the permitted access to the subset of the services and resources according to the access control policy attached to the role.