Permissions decisions in a service provider environment

Permissions can be delegated to enable access to resources associated with one or more different accounts, which might be associated with one or more different entities. Accordingly, approaches for delegating security rights and privileges for services and resources in an electronic and/or multi-tenant environment are provided. In particular, various embodiments provide approaches for dynamically determining and authorizing delegation of permissions to perform actions in, on, or against one or more secured accounts, where those accounts may be associated with a number of different entities and/or resource providers.

BACKGROUND

In recent years, an ever-increasing number of applications and services have been made available over networks such as cellular networks and the Internet. Due to this, an increasing number of content and service providers are turning to technologies such as remote resource sharing and cloud computing. Cloud computing, in general, is an approach to providing access to electronic resources through services, such as Web services, where the hardware and/or software used to support those services is dynamically scalable to meet the needs of the services at any given time. A user or customer of a service provider will typically rent, lease, or otherwise pay for access to resources through the cloud, and thus does not have to purchase and maintain the hardware and/or software to provide access to these resources.

In some cases, the customer may wish to delegate or share permissions or other access rights to with services and resources that reside within the service provider or in external networks. It is thus desirable to enable the customer to achieve such sharing of privileges in a trusted and secure manner.

DETAILED DESCRIPTION

Systems and methods in accordance with the embodiments described herein overcome various deficiencies in existing approaches for delegating security rights and privileges for services and resources in an electronic and/or multi-tenant environment. In particular, the various embodiments provide approaches for dynamically determining and authorizing delegation of permissions to perform actions in, on, or against one or more secured accounts, where those accounts may be associated with a number of different entities and/or resource providers.

In accordance with various embodiments, a delegation profile can be associated with an appliance (e.g., a virtual machine that is pre-configured to provide a service) that allows a provider of the appliance to configure resources within accounts associated with customers of a service provider environment. In an example embodiment, the delegation profile can be enabled in response to a customer subscribing (e.g., selecting to use, purchasing, accessing, or otherwise acquiring the appliance) to the appliance. This allows the provider of the appliance to use the delegation profile to gain limited access to the customer's account to configure resources associated with the customer so that the appliance can be used.

In accordance with various embodiments, the appliance and the permissions granted by the delegation profile (or a plane English explanation of the actions that would be allowed under the delegation profile) can be listed in an electronic marketplace of the service provider. A customer can browse the electronic marketplace and select an appliance. In an embodiment, once the customer selects the appliance, a delegation profile can be created within the customer's account (or the appliance provider's account) that is associated with a policy that allows the appliance provider to access the customer's resources in a limited and restricted way. For example, suppose the appliance is a database appliance that needs an interface to a customer's virtual network. In this example, the delegation profile may give the appliance provider permissions to attach a network interface to the appliance. Additionally or alternatively, suppose the appliance performs network traffic monitoring. In this case, the delegation profile may give the appliance provider permission to perform certain actions within the customer's account, such as to configure the customer's virtual network topology so that data flowing in and out of the virtual network first goes through the appliance.

While in the example above the delegation profile was described as being listed with the appliance, in accordance with various other embodiments, the delegation profile can be generated at the time of purchasing or acquiring access to an appliance, when a provider of the appliance creates an account with a service provider, or at some other time. In accordance with various embodiments, the delegation profile can include information such as (a) a name (or other identifier), (b) a validation policy that specifies one or more security principals (e.g., application providers, users, etc.) that are permitted to assume the delegation profile or a reference identifier to a validation policy, and (c) an authorization policy specifying one or more allowable actions that a principal can perform within a customer's account or a reference identifier to such a policy. In some embodiments the allowable actions can be determined in accordance with one or more rules that map the operations that need to be performed within the customer's account to allowable actions that can be expressed in policy. In other situations, the permissions can be explicitly provided by the customer. In certain embodiments, the permissions can be a set of default permissions required by the service or application.

In the situation where a delegation profile has been determined, created, or otherwise associated with an appliance, permission can be granted to the appliance provider to use the delegation profile to configure resources within the customer's account. For example, in accordance with an embodiment, the delegation profile can be set by the appliance provider. For example, the appliance provider can create the delegation profile and submit the delegation profile to the service provider. In accordance with some embodiments, when the appliance is acquired by the customer, the delegation profile can appear in the customer's account with the service provider and a reference can appear in the appliance provider's account. Alternatively, the reference can appear in the appliance provider account and not in the customer's account. In certain embodiments, a read-only version of the delegation profile can be placed in the appliance provider account. It should be noted that other arrangements are possible in accordance with various embodiment and the described approaches are example approaches.

In an example embodiment, the delegation profile can be used by principals listed in it to obtain credentials that enable limited access to the customer's account. For example, when an appliance provider wants to configure the customer's resources, the appliance provider can send a request to obtain access under the delegation profile to a security service of the service provider. The security service can verify that the appliance provider can use the delegation profile by, for example, determining that the appliance provider is listed as authorized to use the profile and checking the status of the customer's account to see if the customer has subscribed (e.g., running the appliance, purchasing the appliance, adding the appliance to a list of instances associated with the customer account, etc.) to the appliance. If the appliance provider is authorized and the customer has subscribed to the appliance, a security token service associated with the security service can provide the appliance provider with credentials that enable the appliance provider to obtain limited access to the account of the customer. As described in more detail in subsequent paragraphs, in some embodiments, the credentials can be limited to a period of time, such as 10 minutes, an hour, a week, or a length of time the customer has access to the appliance.

FIG. 1illustrates an example of an electronic resource environment100that can be used in accordance with various embodiments. As described, various embodiments provide approaches for dynamically determining and authorizing delegation of permissions to perform actions in, on, or against one or more secured accounts, where those accounts may be associated with a number of different entities and/or resource providers. The secured accounts allow for secured access to resources provided by the resource environment. The resources can be accessed by a user or customer of the resource environment or by a third party (e.g., an appliance provider) on behalf of the customer. Environment100is an example of such an electronic resource environment. In this example, a computing device102for an end user is shown to be able to make calls through at least one network106(e.g., the Internet, a cellular network, a wireless network, a local area network (LAN), etc.) into a control plane108to perform a task such as to provision a data repository or launch a virtual machine in a data plane110. The user or an application104, for example, can access the repository and/or virtual machine directly through an interface of the data plane110. While an end user computing device and application are used for purposes of explanation, it should be understood that any appropriate user, application, service, device, component, or resource can access the interface(s) of the control plane and/or data plane as appropriate in the various embodiments. Further, while the components are separated into control and data “planes,” it should be understood that this can refer to an actual or virtual separation, logically or geographically, of at least some resources (e.g., hardware and/or software) used to provide the respective functionality.

The control plane108in this example is essentially a virtual layer of hardware and software components that handles control and management actions, such as provisioning, instantiating, launching, scaling, replication, etc. The control plane in this embodiment includes a Web services layer112, or tier, which can include at least one Web server, for example, along with computer-executable software, application servers, or other such components. The Web services layer also can include a set of APIs132(or other such interfaces) for receiving Web services calls or requests from across the at least one network106. Each API can be provided to receive requests for at least one specific action to be performed with respect to the data environment. Upon receiving a request to one of the APIs, the Web services layer can parse or otherwise analyze the request to determine the steps or actions needed to act on or process the call. For example, a Web service call might be received that includes a request to launch a virtual machine. In this example, the Web services layer can parse the request to determine the type of virtual machine to be created, the type of hardware requested (if any), or other such aspects. Information for the request can be written to an administration (“Admin”) data store, or other appropriate storage location or job queue, for subsequent processing.

A Web service layer in one embodiment includes a scalable set of customer-facing servers that can provide the various control plane APIs and return the appropriate responses based on the API specifications. The Web service layer also can include at least one API service layer that in one embodiment consists of stateless, replicated servers which process the externally-facing customer APIs. The Web service layer can be responsible for Web service front end features such as authenticating customers based on credentials, authorizing the customer, throttling customer requests to the API servers, validating user input, and marshalling or unmarshalling requests and responses. The API layer also can be responsible for reading and writing configuration data to/from the administration data store, in response to the API calls. In many embodiments, the Web services layer and/or API service layer will be the only externally visible component, or the only component that is visible to, and accessible by, customers of the control service. The servers of the Web services layer can be stateless and scaled horizontally as known in the art. API servers, as well as the persistent data store, can be spread across multiple data centers in a region, for example, such that the servers are resilient to single data center failures. Functions or configurations of the APIs or other such components can be managed by at least one system management component114, or other such system or service.

The control plane108in this embodiment includes at least one host monitoring component116. The host monitoring component can comprise any appropriate combination of hardware and/or software including instructions for monitoring aspects of the data plane. For example, the host monitoring component can include a dedicated host machine, process distributed across a number of machines, or a Web service, among other such options. When a virtual machine (“VM”) is created in the data plane, information for the VM can be written to a data store in the control plane, such as a monitoring data store120. It should be understood that the monitoring data store can be a separate data store, or can be a portion of another data store such as a distinct set of tables in an Admin data store122, or other appropriate repository. A host monitoring component116can access the information in the monitoring data store to determine active VMs, resource instances, or other such resources or components134in the data plane110. A host monitoring component also can perform other tasks, such as collecting log and/or event information from multiple components of the control plane and/or data plane, such as the Web service layer and various host managers128. Using such event information, the monitoring component can expose customer-visible events, for purposes such as implementing customer-facing APIs. A monitoring component can constantly monitor the health of all the running repositories and/or instances for the control plane, detect the failure of any of these instances, and initiate the appropriate recovery process(es).

Each resource instance134(e.g., data instance or virtual machine) in the data plane can include at least one data store126and a host manager component128for the machine providing access to the data store. A host manager in one embodiment is an application or software agent executing on an instance and/or application server, such as a Tomcat or Java application server, programmed to manage tasks such as software deployment and data store operations, as well as monitoring a state of the data store and/or the respective instance. A host manager in one embodiment listens on a port that can only be reached from the internal system components, and is not available to customers or other outside entities. In some embodiments, the host manager cannot initiate any calls into the control plane layer. A host manager can be responsible for managing and/or performing tasks such as setting up the instances for a new repository, including setting up logical volumes and file systems, installing database binaries and seeds, and starting or stopping the repository. A host manager can monitor the health of the data store, as well as monitoring the data store for error conditions such as I/O errors or data storage errors, and can restart the data store if necessary. A host manager can also perform and/or mange the installation of software patches and upgrades, as well as updates to configuration (e.g., specific virtual machine images) or firmware, etc. A host manger also can collect relevant metrics, such as may relate to CPU, memory, and I/O usage.

The host monitoring component116in the control plane108can communicate periodically with each host manager128for monitored instances, such as by sending a specific request or by monitoring heartbeats from the host managers, to determine a status of each host. In one embodiment, the monitoring component includes a set of event processors (or monitoring servers) configured to issue commands to each host manager, such as to get the status of a particular host and/or instance. In at least some embodiments, a deployment monitor component118can also communicate with hosts, instances, and other such components to attempt to determine when versions or configurations are deployed or updated, when communications are sent, and other such information. A deployment monitor can be part of, or separate from, the host monitor, as may both be provided as part of a monitoring service of the control plane.

As discussed, once an instance is provisioned and a user is provided with a DNS address or other address or location, the user can send requests “directly” to the data plane110through the network using a Java Database Connectivity (JDBC) or other such client to directly interact with that instance. In one embodiment, the data plane takes the form of (or at least includes or is part of) a computing cloud environment, or a set of Web services and resources that provides data storage and access across a “cloud” or dynamic network of hardware and/or software components. A DNS address is beneficial in such a dynamic cloud environment, as instance or availability failures, for example, can be masked by programmatically remapping a DNS address to any appropriate replacement instance for a use. A request received from a user102or application104, for example, can be directed to a network address translation (NAT) router124, or other appropriate component, which can direct the request to the actual instance or host corresponding to the DNS of the request. As discussed, such an approach allows for instances to be dynamically moved, updated, replicated, etc., without requiring the user or application to change the DNS or other address used to access the instance. As discussed, each instance can include a host manager128and a data store126, for example, and can have at least one backup instance or copy in persistent storage130. Using such an approach, once the instance has been configured through the control plane, a user, application, service, or component can interact with the instance directly through requests to the data plane, without having to access the control plane108. For example, the user can directly issue structured query language (SQL) or other such commands relating to the data in the instance through the DNS address. The user would only have to access the control plane if the user wants to perform a task such as expanding the storage capacity of an instance. In at least one embodiment, the functionality of the control plane108can be offered as at least one service by a provider that may or may not be related to a provider of the data plane110, but may simply be a third-party service that can be used to provision and manage data instances in the data plane, and can also monitor and ensure availability of those instances in a separate data plane110.

In accordance with various embodiments, a service provider may desire to ensure that a resource infrastructure is secure and that their customers' services and data are protected. Similarly, the customer of the service provider needs to ensure that the provider has taken the proper security measures to protect their information against unauthorized use or access from end users or various other third parties. Furthermore, in some cases, the customer may wish to delegate or share permissions or other access rights to with services and resources that reside within the service provider or in external networks. Accordingly, various embodiments provide approaches for dynamically determining and authorizing delegation of permissions to perform actions in, on, or against one or more secured accounts, where those accounts may be associated with a number of different entities and/or resource providers.

FIG. 2is a high level illustration of an environment200in which a service provider system can utilize a delegation profile or other such information that can be generated, selected, or applied for one or more accounts of at least one customer, where each customer has at least some level of access to one or more resources managed and/or offered by the system, in accordance with various embodiments. As illustrated, a service provider environment202can include one or more secured resources204of various types, as may be used to support various services and/or applications. These resources can include physical and/or virtual resources, such as application or data servers or instances (e.g., virtual machines), virtual networks, databases, storage servers, data stored in database or storage services, among other such resource types. A customer224of the resource provider environment202can obtain an account with the resource provider environment, enabling the customer224to access one or more of the secured resources204across at least one appropriate network214. The customer in some embodiments can utilize these resources to support appliances, applications, and other services.

An appliance developer, service provider, or party might provide an appliance, application, or other service that can be downloaded and executed or otherwise accessed by the customer224. In accordance with an embodiment, an appliance can include a machine image that can include software such as security software, business intelligence software, databases, storage backup, etc. The machine image can be used by a compute service to launch one or more instances of the machine image. In accordance with certain embodiments, the application or service can be downloaded or otherwise accessed from an electronic marketplace230and can be provided by appliance provider240. The appliance provider can be, for example, affiliated or unaffiliated with the service provider. For example, in accordance with an embodiment, the appliance is provided by the service provider and in various other embodiments the appliance is provided by a provider unaffiliated (or in some instances affiliated) with the service provider. In various embodiments, the appliance may need to utilize resources associated with the customer of the resource provider environment. In order to enable the appliance to obtain access to those resources, but be restricted to the amount or type of access that can be obtained, the developer can request permissions (or implicitly be granted access rights) or other access rights to access at least a portion of the resources associated with a customer of the resource provider environment.

For example, in accordance with various embodiments, when a customer subscribes to an appliance, subscribing can grant permission to at least the appliance provider and/or resource provider system to access, configure, and utilize certain resources associated with the customer's account. As described, an electronic marketplace230can provide one or more appliances (e.g., services, applications, or the like). The appliances can be created by a resource provider system or an application provider (e.g., a third party application provider). In accordance with various embodiments, the appliance may require access to one or more resources associated with a customer account. Once the appliance is selected (e.g., the customer subscribes to the appliance or adds the appliance to a list of instances the customer can launch), the customer can be presented a service policy. In various embodiments, the policy can be listed in the electronic marketplace230such that the user can view or otherwise access the service policy prior to selecting the appliance. In this way, the customer can see what access is required or otherwise needed by the appliance provider prior to subscribing the appliance.

In accordance with various embodiments, the policy can specify, for example, permissions or other access rights requested by the appliance provider. In certain embodiments, the policy can be a set of default permissions that cannot be adjusted. In various other embodiments, the customer can adjust and modify the default permissions. This can include updating certain fields of the policy as may include filling in blanks, selecting from a drop down menu, etc. Additionally, the fields can be automatically updated using account information for the customer. For example, in the situation where the policy is mandatory, when the customer subscribes to the appliance, the appliance provider can be granted the right to, for example, plug the appliance into the customer's virtual network. In the situation where the policy is advisory, the customer may decide that they do not want the appliance provider to plug into their network; rather, the customer would rather the appliance provider plug into a particular subnet in a particular virtual network. In some situations, the policy is templatized. For example, launching or otherwise using the appliance can grant the appliance provider permissions to plug into a predetermined network provided by the customer. If the customer does not provide a network, in an example, default options can be used.

Accordingly, in response to the user subscribing to the appliance (e.g., by selecting the appliance, agreeing to the terms and conditions associated with using the appliance, paying for the appliance, or some other arrangement such as the customer accepting the service policy and/or other conditions), a delegation profile associated with a policy including at least one permission can be made available to the appliance provider. For example, when a customer purchases access to the appliance, the access can implicitly grant permission to the appliance provider to access and utilize certain resources associated with the customer's account. In accordance with an embodiment, the permissions for use by the appliance can be included in a delegation profile206that can be created or otherwise associated with the account for the customer. The delegation profile can be maintained by the resource provider environment on behalf of the customer within the account management service232or the security service218, and the delegation profile can designate one or more principals (e.g., the appliance, service provider, etc.) of the customer224and a set of the shared resources (e.g.,204) that those principals can access and use. For example, when the customer adds the appliance, the electronic marketplace230can be configured to send a message to an account management service232when the customer selects the appliance indicating that the customer has purchased, subscribed to, or is using the appliance. The account management service232can add information to a database indicating that the customer has added the appliance to his or her account; and add the delegation profile to the account of the customer (or in certain embodiments the account of the appliance provider).

In accordance with an embodiment, an example delegation profile206includes a name208or identifier, at least one validation policy210, and at least one authorization policy212. The name208can be a string or any other identifier that is used to refer to the delegation profile. The validation policy210specifies which security principals, external entities (e.g., third party appliance providers, etc.), or other types of users that are allowed to utilize the delegation profile to perform various actions under the delegation profile. As discussed, the external entities, appliance providers, etc. can reside externally with respect to the customer and/or the account. In addition, the one or more authorization policies212can indicate which specific actions the various principals are allowed to perform (e.g., run instances, read or modify data, access other secured resources in the account etc.).

In accordance with an embodiment, as described, an entity can be specified in the validation policy in response to an indication to access an appliance. In accordance with various embodiments, the authorization policy can be based at least in part on the permissions or access rights required by the appliance provider to enable the appliance within the customer account. As described, the amount and/or type of access can be configurable, as may be determined by any of the customer, the appliance provider, or the service provider, among other such entities.

In accordance with various embodiments, the appliance can be associated with a delegation profile. In this situation, when a customer adds the appliance to his or her account, the delegation profile is made active within the customer's account, so that it can be used by the appliance provider. For example, permission can be granted to the appliance provider to use the delegation profile to configure resources within the customer's account. In certain embodiments, the customer can specify or create a delegation profile for each appliance, service provider, etc., and the delegation profile can be provided to a respective appliance provider.

In each case, the delegation profile might have to specify a subset of the access allowed to the appliance provider under the customer account. In this way, it is possible that requests from the appliance provider are received under one or more different types, amounts, or levels of access. Levels of access can include, for example, a first type of access when accessing the secured resources according to a default licensing template. The appliance provider also might be able to obtain access, which might be more restrictive when the customer has specified more restrictive access. For example, the customer might grant read and write access to data stored by the secured resources204under a delegation profile. In each of these cases, the set of shared resources that the principals can access and use can include and/or be based at least in part on the permissions allowed for in the policy. In at least some embodiments, the delegation profile associated with the appliance provider might differ from a delegation profile created by the customer and for the customer, and in at least some embodiments, can include a subset of the access as designated by the customer. As an example, at least the appliance provider might be able to only configure the appliance. A delegation profile for the customer, however, might enable the customer to access any or all of the data stored under the customer account.

In accordance with various embodiments, the delegation profile provides for permissions that permit the appliance provider to perform actions on resources204associated with the account, subject to the permissions specified in the authorization policy212. In accordance with an embodiment, a customer224associated with an account is able to provide the delegation profile to an appliance provider. For example, a reference to the delegation profile can be provided to the appliance provider when the customer purchases an appliance from the electronic marketplace230. For example, the reference can be stored in a database of the account management service232. The appliance provider240can access a web console that interlaces with the account management service232and displays the reference. In an alternative embodiment, the appliance provider240can obtain the reference by making a web service request to an application program interface of the account management service232to obtain the reference.

In accordance with an embodiment, if an appliance provider is provided with a reference to the delegation profile, the appliance provider can use the reference to obtain a set of credentials for performing certain actions in the account. Accordingly, the appliance provider can then obtain credentials to act as an authorized user under the account by way of the delegation profile206. The appliance provider may use the reference to the delegation profile206and request the credentials from a security service218, federation system, or other authorized entity that has access to a copy of the delegation profile206. The security service (or other identity or federation management entity) can verify whether the validation policy defined in the delegation profile properly identifies the appliance provider as being allowed to assume the delegation profile. If the appliance provider is verified, the security service can check whether the customer still has an active subscription to the appliance (e.g., whether the appliance is still within the account of the customer). For example, the security service can send a request to the account management service232for information indicating whether the customer has a valid subscription to the appliance or has the appliance in their account. If the appliance hasn't been removed or the subscription canceled, the security service218can issue the set of credentials that can be used by the appliance provider to perform actions on resources204associated with the account, subject to the permissions specified in the authorization policy210.

In an example embodiment, a subscription can be valid, for example, when a customer has paid for or otherwise been granted a license. For example, a customer may pay a subscription fee for a daily, monthly, yearly, or some duration of time subscription. In the situation where the customer does not have a valid subscription or license, for example because no fee has been received or the customer has canceled the subscription, access to resources associated with the customer can be denied. Advantageously, since the service provider can provide a marketplace that enables access to one or more appliances that can be provided by one or more appliance providers or other providers, the service provider can manage access to resources such as by determining whether a subscription is valid before granting access to resources associated with a customer. This can provide a more efficient control model over the actions and principals that are able to access the resources of the account under the assumption of the delegation profile.

Once it is determined that the customer has a valid subscription the appliance can submit requests to the customer's secured resources in the provider environment. The request can include a copy of the credentials and, in some embodiments, information such as an identifier for the appliance, an identifier for a delegation profile to be applied, or other such information. When the request is received to the provider environment, the security service218can obtain all the policy documents applicable to the request (e.g., any policy set by the customer as well as the policy associated with the delegation profile) to determine whether the appliance provider240has authorization to perform the action within the account. In the instance that the policy associated with the delegation profile allows the action, the security service218can permit the appliance provider240. In an example embodiment, instead of checking to see whether the customer has a valid subscription before issuing the credential, the check can be performed at the time of the request. For example, the security service218can receive the delegation profile and within the profile can be a condition that the customer have a valid subscription to the appliance. The security service218can send a request to the account management service232for status and the account management service232can respond with an acknowledgment as to whether the customer has a subscription. The security service218can use this information to determine whether to grant or deny the request.

For example, in accordance with various embodiments, a request to enable a first party to access, configure, and utilize certain resources associated with a second party can be received. In accordance with various embodiments, the first party can correspond to an appliance provider, third party application/service provider, or some other entity. The second party can correspond to a customer. The customer can have an account with a provider of the virtual infrastructure (e.g., the resources of the customer, such as virtual machines, databases, virtual networks, etc.). A request, by the first party, to make the change in virtual infrastructure associated with the second party can be received. In certain embodiments, the request can be received by a provider of the virtual infrastructure. Whether the first party is permitted by the second party to configure the appliance so that it can run on the virtual infrastructure of the second party can be validated. For example, a security service of the provider of the virtual infrastructure can validate the request. Thereafter, credentials can be provided to the first party for access to the virtual infrastructure associated with the second party, the access being subject to one or more permissions associated with a delegation profile. For example, in accordance with an embodiment, at least one of denying the request or processing the request can be performed based at least in part on the delegation profile. In this situation, one or more permissions in the delegation profile can be used to deny or perform the request. In various embodiments, a type of access to the virtual infrastructure granted to the first party can be different from a type of access granted to the second party and in accordance with an embodiment, the one or more permissions of the delegation profile are restricted to a scope that is less than or equal to permissions of the second party.

In accordance with various embodiments, a request to access the appliance by the second party can be received and in response to the request a license to use the appliance for at least a period of time can be enabled. In various embodiments, an indication that the second party is not permitted to access the appliance can be received. In response to such an indication, at least one of denying the first party access to the virtual infrastructure associated with the second party or disabling access to the appliance by the second party can be performed. The indication can include, for example, at least one of an indication that the second party no longer desires to use the appliance or an indication that a license period associated with a license to use the appliance has expired

FIG. 3illustrates an example process300that can be used to delegate permissions to manipulate resources of a customer in accordance with various embodiments. It should be understood that, for any process discussed herein, there can be additional, fewer, or alternative steps, performed in similar or different orders, or in parallel, within the scope of the various embodiments unless otherwise stated. As described, various embodiments provide approaches for dynamically determining and authorizing delegation of permissions to perform actions in, on, or against one or more secured accounts, where those accounts may be associated with a number of different entities and/or resource providers.

A request can be received302from a customer to acquire an appliance. In various embodiments, the request can be to subscribe to an appliance listed in an electronic marketplace operated by a service provider. For example, in accordance with various embodiments, an appliance developer might provide an appliance that can be run within the service provider environment and used with other resources of the customer. The customer can acquire the appliance by selecting the appliance in the electronic marketplace and a license to use the appliance may be stored in an account of the customer. The use can be for a determined period of time.

In various embodiments, the appliance may need to utilize resources associated with the customer of the service provider. As described, the customer can have an account maintained by a resource provider of the one or more resources accessible to the customer as determined by one or more terms of the account. For example, in accordance with various embodiments, a resource provider environment can include one or more secured resources of various types, as may be used to support various services and/or applications. These resources can include physical and/or virtual resources, such as application or data servers or server instances, among other such resource types. A customer of the resource provider environment can obtain an account with the resource provider environment, enabling the customer to access one or more of the secured resources across at least one appropriate network. The customer in some embodiments can utilize these resources to support applications and services and other appliances. In order to enable the appliance to obtain access to those resources, but be restricted to the amount or type of access that can be obtained, the developer of the appliance can be granted access rights to access at least a portion of the resources associated with a customer of the resource provider environment.

In accordance with an embodiment, in response to receiving the request to acquire the appliance, a delegation profile that includes an authorization policy can be enabled304. In accordance with various embodiments, the delegation profile can include or be associated with an authorization policy, that specifies one or more permissions for accessing and utilizing one or more resources associated with the customer, the customer having an account maintained by a provider of the one or more resources accessible to the customer. As described, when a customer indicates a desire to acquire an appliance, the request to acquire the appliance can implicitly grant permission to at least the appliance provider to access and utilize certain resources associated with the customer's account. A request can be received306from the appliance provider for access to at least a portion of the customer's resources in the resource provider environment. A request for a set of credentials to access the one or more resources associated with the account can be received308, the request including a reference to the delegation profile.

The security service of the service provider can verify310whether the customer has an active subscription to the appliance. For example, in accordance with various embodiments, the check to see if the customer has a subscription can be placed in the delegation profile. In this way, when the appliance service attempts to access resources associated with the customer, the service provider environment or some other system can check the subscription status, along with other data to determine whether to issue credentials. If the customer subscription is expired, for example, then system will deny the request. For example, in the situation the customer does have an active subscription to the appliance, the appliance provider can be provided312credentials that allow the appliance service provider to access to at least one resource allocated to the customer, as determined by the determined delegation policy. In the situation, the customer does not have an active subscription (or a limited subscription) to the appliance, a determination can be made as to the state of the customer's service subscription (e.g., default, terminated, etc.) and based at least in part on the state of the customer's subscription the customer can be associated with one of one or more levels of service subscription. In accordance with various embodiments, each level of service subscription may grant the appliance provider some level of access to resources allocated to the customer.

For example, in the situation where it is determined that the customer does not have an active subscription to the appliance, a determination314can be made as to the customer's service subscription level. In accordance with an embodiment, service subscription levels can include, for example, a service subscription that is active status, a service subscription that is in default status, or a service subscription that is in a terminated status. In the situation that it is determined that the customer's service subscription is terminated, the request to access and utilize the resources can be denied316.

In the situation that it is determined that the customer's service subscription is in, for example, a default status, the appliance provider may be provided318some level of access to resources allocated to the customer and/or may provide some level of service to the customer. In accordance with an embodiment, the customer's subscription may be in a default status because, for example, the customer has missed a payment, has not agreed to a service policy (or an updated service policy), or for some other reason. In this situation, the customer may be able to utilize the appliance for a determined period of time, but may receive some or no support. In some situations, the customer may be only be able to access a portion (or none) of the functions of the appliance. In certain embodiments, in the situation where the customer's service subscription is in the default status, the appliance provider's access to the resources allocated to the customer may be restricted by the service provider environment. For example, the appliance provider's access may be contingent on the customer having an active subscription and in the situation where the subscription is not active, the appliance provider may be allowed access to a portion (or none) of the resources allocated to the customer.

FIG. 4. illustrates an example process400that can be used to enable a customer of a service provider to delegate access to one or more resources in accordance with an alternate embodiment. As described, a customer can have an account maintained by a resource provider of the one or more resources accessible to the customer as determined by one or more terms of the account. For example, in accordance with various embodiments, a resource provider environment can include one or more secured resources of various types, as may be used to support various services and/or applications. A customer of the service provider can obtain an account with the service provider, enabling the customer to access one or more of the secured resources, such as appliances, across at least one appropriate network in order to setup the appliances. In order to enable the appliance provider to obtain access to those resources, but be restricted to the amount or type of access that can be obtained, the developer can request permissions or other access rights to access at least a portion of the resources associated with a customer of the resource provider environment.

In accordance with various embodiments, an appliance provider might provide402an appliance that can be downloaded or otherwise accessed and executed by the customer or users of the customer. The appliance can be downloaded or otherwise obtained from an electronic marketplace. The appliance provider may need to utilize resources associated with the customer of the resource provider environment. In order to enable the appliance provider to obtain access to those resources, but be restricted to the amount or type of access that can be obtained, the developer can request404permissions or other access rights to access at least a portion of the resources associated with a customer of the resource provider environment. For example, when the appliance is provided to the electronic marketplace, the developer of the appliance can specify default permissions required of the appliance provider, as may include the resources that the appliance provider will access on behalf of the customer. In this situation, required default permissions are received406.

In various embodiments, the customer can explicitly grant or otherwise specify specific permissions when the customer subscribes to the appliance. In this situation, explicitly granted permissions are received408. In some embodiments, one or more rules can be evaluated to determine410a set of policies or permissions. The rules can take the form of code that is evaluated in the context of the permissions to determine the appropriate policy, could involve simple declarative rules with support for conditional statements, or could utilize variable substitution, among other such options. There can be different rules for different types of appliance providers or appliances provided by those providers, as well as paths through which requests for access take.

In some embodiments, a set of templates can be used to allow mapping between the appliance, actions the appliance will execute, and the permissions. An example template can allow access to a specified link (e.g., a URL for a storage resource). Instead of (or in addition to) templates, another approach can be based at least in part upon a set of rules. Other approaches to performing the mapping can be used as well, wherein information associated with the customer such as user preferences and identity information can be used.

The various information and attributes from the various sources can, in at least some embodiments, be passed through a rules engine that can output a document with one or more policies dictating what the appliance provider is allowed to do against the resources allocated to the respective customer. The rules engine might also be operable to manipulate other resources in the course of making that determination, such as reading or writing information to a data store for purposes such as quota maintenance or mapping updates, etc.

In accordance with various embodiments, as described, the subscription or access to the appliance can be based on, for example, whether or not the customer has canceled the subscription or stopped paying for use of the appliance. For example, an appliance provider who provides appliances for use by customers or their end users might allow each customer to obtain a certain type of access, or a certain amount of access. This can include, for example, up to an amount of data storage capacity or processing capacity, or up to a maximum cost of resource usage. The customer can also specify how to handle any requests that exceed those limits. For example, the customer could indicate that the user is responsible for paying for any access beyond the limit, or might not enable the user to obtain any access to the customer resources when the user has reached the limit. When the customer has an active subscription to an appliance allowing for such a subscription, the appliance provider can be granted the permissions to access resources associated with the customer. Thereafter, access to at least some resources allocated to the customer is enabled412.

FIG. 5. illustrates an example process500that can be used to enable a customer of a service provider to explicitly unsubscribe to an appliance and revoke access by an appliance provider to resources associated with the customer's account. As described, the customer can have an account maintained by a resource provider of the one or more resources accessible to the customer as determined by one or more terms of the account. An appliance provider can access the resources associated with the customer but may be restricted to certain operations or the amount or type of access that can be obtained. For example, the appliance provider may be granted permissions or other access rights to access at least a portion of the resources associated with a customer of the service provider to configure the appliance. In the situation where the customer no longer wants access to the appliance or otherwise wants to revoke the access granted to the appliance provider, the customer can explicitly unsubscribe from the appliance or, in some embodiments, delete the delegation profile used by the appliance provider.

For example, in accordance with various embodiments, the customer can explicitly unsubscribe from the appliance. This can include, for example, receiving502, by an account management service, a request to terminate access to an appliance. Terminating access from the appliance can include, for example, requesting to the electronic marketplace to unsubscribe from the appliance, and the like. The request can be received at one of the service provider environment or the appliance provider. In response to receiving the request, permissions granted can be removed504. Removing permissions granted can include, for example, removing506the appliance provider access to the customer account and removing508the customer's access to the appliance. In accordance with various embodiments, removing the appliance provider's access to the customer account can include deleting the delegation profile or removing permissions to the appliance provider to access the resources allocated to the customer by the service provider environment. In this way, the appliance provider is no longer granted access to resources allocated to the customer. Removing the customer's access to the appliance can include, for example, removing the reference to the appliance in the account of the customer, removing access to the appliance as may include login information, account information, customer information (e.g., name, billing information), etc.

FIG. 6illustrates a logical arrangement of a set of general components of an example computing device600. In this example, the device includes a processor602for executing instructions that can be stored in a memory device or element604. As would be apparent to one of ordinary skill in the art, the device can include many types of memory, data storage, or non-transitory computer-readable storage media, such as a first data storage for program instructions for execution by the processor602, a separate storage for images or data, a removable memory for sharing information with other devices, etc. The device typically will include some type of display element606, such as a touch screen or liquid crystal display (LCD), although devices such as portable media players might convey information via other means, such as through audio speakers. The device can include one or more network interface components608configured to enable the device to transmit and receive information over a network. As discussed, the device in many embodiments will include at least one input element612able to receive conventional input from a user. This conventional input can include, for example, a push button, touch pad, touch screen, wheel, joystick, keyboard, mouse, keypad, or any other such device or element whereby a user can input a command to the device. In some embodiments, however, such a device might not include any buttons at all, and might be controlled only through a combination of visual and audio commands, such that a user can control the device without having to be in contact with the device. In some embodiments, the computing device600ofFIG. 6can include one or more network interface elements608for communicating over various networks, such as a Wi-Fi, Bluetooth, RF, wired, or wireless communication systems. The device in many embodiments can communicate with a network, such as the Internet, and may be able to communicate with other such devices.