Patent ID: 11968241
Assignee: AMAZON TECHNOLOGIES, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 13:
14. One or more non-transitory computer-readable storage media storing program instructions that, when executed on or across one or more processors, perform:
providing a plurality of services and resources in a production environment of a multi-tenant provider network;
determining a plurality of access requests to the plurality of services and resources by an application during a learning mode associated with execution of the application in a pre-production environment in which the application is isolated from client traffic in the production environment and tested using historical or synthetic traffic, wherein the application is associated with a user account, and wherein the pre-production environment enables the application to access the plurality of services and resources provided in the production environment;
determining which of the plurality of services and resources were used by the user account tested using the historical or synthetic traffic during the learning mode so as to generate a subset of the services and resources to include the determined one or more services and resources;
generating an access control policy that permits access to the subset of the services and resources used by the user account during the learning mode; and
attaching the access control policy to a role associated with the user account, wherein the user account is permitted to access the subset of the services and resources according to the access control policy attached to the role.