Source: https://patents.google.com/patent/US9705888B2/en
Timestamp: 2018-06-25 16:27:45
Document Index: 304482776

Matched Legal Cases: ['application No. 201107040', 'application No. 2012028700', 'application No. 201202868', 'application No. 201202502', 'application No. 2012', 'application No. 201080053676', 'application No. 201080015811', 'application No. 201080056311', 'application No. 201080015811', 'application No. 201080049395', 'application No. 201080053676', 'application No. 2012', 'application No. 2013', 'application No. 201080056311', 'application No. 201202502', 'application No. 201202870', 'application No. 201202868', 'application No. 2', 'application No. 2', 'application No. 2', 'application No. 201202967', 'application No. 2012', 'application No. 2012', 'application No. 201080053676', 'application No. 201080053676', 'application No. 201080015811', 'application No. 2', 'application No. 2013', 'application No. 10827392', 'application No. 201080056327', 'application No. 201080056311', 'application No. 201080015811', 'application No. 201080049395', 'application No. 2012']

US9705888B2 - Managing security groups for data instances - Google Patents
Managing security groups for data instances Download PDF
US9705888B2
US9705888B2 US12416017 US41601709A US9705888B2 US 9705888 B2 US9705888 B2 US 9705888B2 US 12416017 US12416017 US 12416017 US 41601709 A US41601709 A US 41601709A US 9705888 B2 US9705888 B2 US 9705888B2
US12416017
US20100251339A1 (en )
Access level and security group information can be updated for a data instance without having to take down or recycle the instance. A data instance created in a data environment will have at least one default security group. Permissions can be applied to the default security group to limit access via the data environment. A control security group can be created in a control environment and associated with the default security group. Permissions can be applied and updated with respect to the control security group without modifying the default security group, such that the data instance does not need to be recycled or otherwise made unavailable. Requests to perform actions with respect to the control security groups are made via the control environment, while allowing native access to the data via the data environment.
This application is related to U.S. patent application Ser. No. 12/415,958, entitled “Control Service and Relational Data Management,” filed Mar. 31, 2009, now U.S. Pat. No. 8,713,060, which is hereby incorporated herein by reference.
Customers often need to modify the set of users granted access to a data source, such as where employees or other users are added, deleted, or obtain different access or responsibilities. In conventional systems, users and user access parameters are manually adjusted by a database administrator (DBA) or other such user. The adjustment of the native users of the data source typically affects the availability of the data source for a period of time, as the data source must be taken down to adjust user information for the data source. Such a process is not only time consuming and expensive, but requires periodic outages of the data source.
FIG. 4 illustrates an example process for associating a control security group with a default security group that can be used in accordance with one embodiment;
FIG. 5 illustrates components that can be used to store security group information in accordance with one embodiment; and
FIG. 6 illustrates an example interface for specifying security group parameters that can be performed in accordance with one embodiment.
Systems and methods in accordance with various embodiments of the present disclosure may overcome one or more of the aforementioned and other deficiencies experienced in conventional approaches to managing aspects of data storage in an electronic environment. In particular, various embodiments provide a separate control environment, or control plane, that can be used to monitor and/or control aspects of a data environment, or data plane. The functionality of a control plane can be provided as a set of Web services, for example, enabling the control plane to act as a virtual database administrator (DBA). A user or customer can submit a request to the control plane through an externally-visible application programming interface (API), for example, which can be analyzed to determine actions to be performed in the data plane, such as actions that create, delete, modify, expand, or otherwise modify a data store or data storage instance. State information can be passed to a component of the data plane for each task necessary to perform the action, such that the control plane can manage the performance of the tasks without having direct access into the data stores or other such components of the data plane. Once provisioned, a user can have native access to the data instance(s) in the data plane, and can simply point existing applications (such as MySQL applications) to the domain name system (DNS) name or other location information for the particular data instance. There is no restriction or modification of query models or other such functionality, as a user can continue to use applications built on MySQL, Oracle, or other such database technology.
Systems and methods in accordance with various embodiments take advantage of components of the control plane to manage access level and security group information for a data instance without having to take down or recycle the data instance in the data environment. A data instance created in a data environment can have at least one default security group generated. Using the control plane, permissions can be applied to the default security group to limit access via the data environment. At least one control security group can be created using the control plane, which can be associated with the default security group. Permissions can be applied and updated with respect to the control security group without modifying the default security group in the data environment, such that the data instance does not need to be recycled or otherwise made unavailable. Requests to perform actions with respect to the control security groups can be made via the control plane, while allowing native access to the data via the data environment.
An example “create database” workflow for a customer might includes tasks such as provisioning a data store instance, allocating a volume of off-instance persistent storage, attaching the persistent storage volume to the data store instance, then allocating and attaching a DNS (Domain Name System) address or other address, port, interface, or identifier which the customer can use to access or otherwise connect to the data instance. In this example, a user is provided with the DNS address and a port address to be used to access the instance. The workflow also can include tasks to download and install any binaries or other information used for the specific data storage technology (e.g., MySQL). The workflow component can manage the execution of these and any related tasks, or any other appropriate combination of such tasks, and can generate a response to the request indicating the creation of a “database” in response to the “create database” request, which actually corresponds to a data store instance in the data plane 210, and provide the DNS address to be used to access the instance. A user then can access the data store instance directly using the DNS address and port, without having to access or go through the control plane 208. Various other workflow templates can be used to perform similar jobs, such as deleting, creating, or modifying one of more data store instances, such as to increase storage. In some embodiments, the workflow information is written to storage, and at least one separate execution component (not shown) pulls or otherwise accesses or receives tasks to be executed based upon the workflow information. For example, there might be a dedicated provisioning component that executes provisioning tasks, and this component might not be called by the workflow component, but can monitor a task queue or can receive information for a provisioning task in any of a number of related ways as should be apparent.
Upon receiving the job information, the information is analyzed to determine and/or assemble an appropriate workflow for the requested action 310. As discussed, different tasks can be selected for the workflow based upon factors such as the type of action requested and the type of database engine being used. Beginning with the first task of the workflow, state information is sent to a host manager in the data environment operable to use the state information to determine a task to be performed, perform the task with respect to a data repository and/or data instance, and return a response upon completion of the task 312. Upon receiving the response, the workflow component determines whether there is another task to be performed 314. If so, state information for the next task is sent to the host manager, and upon completion of that task the host manager sends a response to the workflow component. After the final task has been completed, a message is sent to the requesting customer (or another appropriate user, application, or location) that the requested action has been completed 316. After the action has been performed, the customer is able to directly access the data instance upon which the action was performed using a data interface of the data environment, without accessing or passing through the control plane 318. As mentioned, the user can be provided with a DNS name and port number, for example, such that if the action resulted in movement of data or another similar action, the customer or an application can continue to use the same DNS name, which will be directed to the appropriate location in the data plane.
As discussed, one advantage to the use of a control plane is that the control plane can function as a virtual database administrator (DBA) and avoid the need for a human DBA to perform tasks such as monitoring performance data and performing trending or other such analysis. A control plane can also perform functions such as automatically performing scaling, recovery, or other such actions in the event of an actual or predicted need for action. Conventional approaches relying on a DBA to perform actions such as monitoring, analysis, cloning, and recovery are expensive and time-consuming, and can result in significant unavailability of customer data during the recovery and/or cloning processes.
A control plane can be used to perform tasks such as managing security and access groups for data stores, data instances, and other such aspects of a data plane or other such environment. A control plane can, in conjunction with the data plane, ensure that requests to perform certain actions in the data plane occur via the control plane. Thus, the control plane can manage user groups and control access for those tasks without modifying the default or native user information of the data environment. Such an approach enables access groups to be added, modified, or deleted without requiring an outage or other such unavailability of the corresponding data instance.
FIG. 4 illustrates an example process 400 for setting up a data store with control plane-based user management in accordance with one embodiment. In this example, a request is received from a customer (or other such user) requesting the creation of a data instance using a “create database” or similar call as discussed above 402. A workflow is generated and kicked off that includes tasks for creating the data instance 404. As part of the creation of the data instance, at least one default (or “native” from a data environment point of view) security user or security group is created in the data environment for the data instance. As part of the workflow, permissions can be applied to the default security group 406. Native access to the data instance through an API or other interface of the data plane can be restricted 408, such as by modifying or adding permission rules for the default security group. As part of the creation workflow, a separate workflow or process, and/or in response to a separate request, at least one RDS security group can be created for the data instance via the control environment 410. Each RDS security group for the data instance can be associated with the native control group in the data environment 412. Permissions can be set for each RDS security group 414, such as may include “read only” or “read and write” access. Once the data instance is created, customers or other authorized users are enabled to access the data instance according to permissions set in the appropriate RDS security group 416. Due to the restrictions on access through the data interface, a customer can be forced to call into the control environment to set or adjust access levels and/or permissions for users or groups of users.
FIG. 5 illustrates an example configuration 500 that can be used to store security group information in accordance with one embodiment. Reference numbers are carried over between figures for purposes of simplicity and explanation, but such use should not be construed as showing only a single embodiment or otherwise limiting the scope of the various embodiments. Further, only certain components are shown in each figure, but it should be understood that other, additional, or alternative components can be used as discussed and suggested herein. As illustrated, a data instance in the data environment includes a host manager and a data store, with information for the data store being stored to a native user data store 502. While shown as a separate data store, it should be understood that the native user data can be stored as part of another data store inside or outside the instance. When an RDS user group is associated with the native security group in the data environment, RDS user group information is created that can be stored in a data store 504 in the control environment 506 and/or a data store 508 in the data environment 510. Storing the RDS user group data in the data plane can allow users to access the data directly through an API or other interface of the data plane (assuming the users have such permission) without accessing the control plane. Storing the RDS user group data in the control environment allows the control plane to quickly access the information when required for a customer action, and enables the control plane to recover the groups more quickly in the event of a failure of the data environment. Other advantages can be obtained through storing the information in either or both locations.
As discussed, certain functionality can be disabled via the data plane. Customers can be restricted from modifying users through the data plane, and instead can utilize at least one API or interface of the control plane to make such changes. Even a “super user” created upon provisioning of a data instance cannot modify security user group information through the data plane in various embodiments. In one embodiment, separate APIs are provided for adding users, deleting users, modifying user information, and managing RDS security groups. Certain functionality can still be restricted, however. For example, customers may not be granted lower level access that allows the customers to request operations such as shutting down an instance in the data plane. APIs also can be provided that allow customers to obtain statistics or other data from a monitoring data store or other such location, relating to aspects such as identities of users accessing the data, types of access, etc.
A default or “super” user can typically perform low-level actions in the data environment such as changing schema or attributes of a data store, adding or deleting tables or rows, or other such actions. A customer might wish to add user groups with other levels of access, such as read-only access or access to specific tables. Various other levels of access can be granted as known in the art. In this example, however, calls to adjust users, users groups, data access, or other such functionality must be submitted through the control plane, such that the RDS user or security group information can be adjusted in the control environment. Since the RDS user information is tied to a native user group that does not change in the data environment, the changes do not require an outage of the data store or data instance.
In some embodiments, several data volumes in the data environment might make up a logical volume group associated with a data instance. Native permissions such as the ability to access, read, or write data to the data volumes can be handled through the control plane. The users can access the data instance independent of any knowledge of the underlying data volumes. The users are not given access to modify these native permissions through the data plane, but instead pass through an API or other interface of the control plane providing an identifier for the data instance.
When a data instance is created, customers can specify one or more security groups to restrict network access to the data instance. Customers can authorize access to the data instance by adding permission rules to the security group that are applied to the database via an AuthorizeDBSecurityGrouplngress or similar API. Customers can also add or remove security groups from a data instance at any time using a ModifyDatabase or similar API. Customers can create (or delete) security groups using a CreateDBSecurityGroup (or DeleteDBSecurityGroup) API.
As part of the CreateDatabase API, customers can supply a username and password for a special database user referred to herein as “Database Owner.” Database Owner is a special type of user who owns the data schema objects. Customers are not allowed to manage users directly in a provisioned data store, so this functionality is provided in one embodiment through three additional APIs. After creation of a data instance, a customer can add more users to the database using a CreateDatabaseUser API, remove users using a DeleteDatabaseUser API, and list the users using a DescribeDatabaseUsers API.
In one example, a customer can have a self-managed “Customer” MySQL database that the customer wants to move to an RDS environment. The current “Customer” database has a 60 GB capacity, running with peak concurrent processes less than 50 and having storage growth estimates around 10% per month. Based on these initial capacity requirements, the customer selects an instance to be provisioned with an initial capacity of 80 GB. The customer chooses a master user and master user password, and based on firewall requirements chooses an appropriate port number (e.g., 9030) on which the data instance will be listening.
The customer, if not already signed up or subscribed to the control service, can sign up for the service. In some embodiments, the user will receive software or will access an interface page through the Internet, for example, that will allow a user to submit requests to the control plane or service. In other embodiments, a user can manually (or otherwise) create and submit Web service calls to the control plane. In the following example, the customer generates a request to create a new data repository using a command line tool. A request can take the form of, for example:
--password master password --port 4030
When the customer executes a “create database” call using the API or command line tool, components of the Web service tier can prepare the control plane for provisioning. The Web service can authenticate and authorize the customer, validate request parameters, and create a record in the Admin data store for the customer data instance. The lifecycle in the record can be marked as “Creating,” for example, which can be changed to a state such as “Pending” to prepare the creation job for pickup by a workflow sweeper or other such component.
With completion of the initial activity by the Web service tier, the data instance is ready to be provisioned. A sweeper can periodically poll the Admin data store for work to complete. A database record with a change state of “Pending” can cause the sweeper to launch a “CreateDatabase” or similar workflow instance. An initial action of the workflow can be to update the change state of the data instance to a state such as “Applying” so that other sweepers are aware the change is in progress and do not attempt to launch another workflow.
In one embodiment, the workflow takes the initial steps to provision the resources that will makeup the data instance. The tasks of such a workflow can include the creation of the instance in the data environment, with allocation of a DNS name and/or port allowing users to access the instance. Other tasks can allocate and attach the data volumes to be used for the data instance. Data volumes can be requested based on configuration information specifying aspects such as a maximum size of an individual volume, and the desired minimum number of data volumes. Multiple volumes are provisioned in at least one embodiment because a single volume can provide a limited number of input/output per second (IOPS) operations, which can be increased by provisioning multiple data volumes and striping or otherwise allocating the data instance across the data volumes.
An RDS security group can provide functionality that acts as a firewall or other barrier protecting a data store or data instance in the data environment. An RDS security group enables a customer to define aspects such as which IP (Internet protocol) range and/or instances can communicate with a data store. The RDS security group permissions can be implemented using the respective security group for each data store.
For example, a customer can apply two RDS security groups to a data instance (i.e., with a database identifier such as “mydbid”) where a first RDS security group allows access from a classless inter-domain routing (CIDR) range “x.y.z.0” and a second RDS security group allows access from data instances associated with a first database security group, SecGroup1. In this example, a new security group (e.g., mydbidSecGroup) for the data store mydbid with permissions to allow access only from “x.y.z.0,” and allow access from data instances with security group SecGroup1. The group mydbidSecGroup can be applied to the instance that hosts the data store. By using a new native security group for each data store, changes can be made to the first security group without restarting the data instance. Each data instance (provisioned by RDS) also can be a member of a default security group.
Once each of the core resources becomes available, the workflow can prepare the data instance with the necessary components. The data volumes can be attached to the instance, and files for the host manager can be loaded and verified. Once verified, the host manager application can be deployed and executed. In one embodiment, a Tomcat manager for the instance is requested to deploy and install a Host Manager WAR file, then start the host manager application. Once the host manager is running, the data instance has the functionality needed to install the database engine (e.g., MySQL, Oracle RDBMS, etc.) and setup the customer data store. The workflow can now communicate with the host manager, and pass information that causes the host manager to mount the data volumes and prepare the file system. A file system may need to be built for at least three roles: binary, logs, and data. To do this, the control plane in one embodiment sends a storage configuration file (i.e., an XML file) which provides the information to the host manager on the mount points and volumes to be used for each role. Using this information, the host manager can create the physical devices, such as by using a pvcreate or similar process, for all volumes provisioned for a given role. The host manager then can create a logical volume that stripes the data across these devices for each role.
A public signing key can be installed to the host manager, and the database engine can be downloaded and installed. A Tomcat server on the data instance can download and verify the signed package manager, followed by an unpack, installation, and launch of the package. A blank data store can be installed to be used as the basis of the customer data store, enabling permissions and tables used for management to be easily applied. The customer data store can be created and the root password for the data store changed. The master user also can be created as specified in the customer request.
authorize default-s 205.192.0.0/16
A “DescribeDatabases” or similar API can be used to determine the status of the request. While provisioning is still in progress, the status will show as “Pending Creation,” for example, and can be changed to a state such as “Created” once the provisioning has been completed. At this point, the customer can have all the information necessary for connecting to the repository.
Once the provisioning process is completed, the instance is running and the customer data store can be exposed for customer use. As a final task of the workflow, a record in the Admin data store can be updated for the customer data store, such as to mark the lifecycle as “Available” and mark the change state as “none”.
In this example, the customer also wants to implement data security through role-based access control. Before turning on the provisioned and loaded data instance and making the instance available, the customer wants to implement role-based access control such that a development team will have read/write access to the repository but business analysts will only obtain read access. The client also wants “master user” access limited to handful of senior users, so the remaining developers need a different database user role.
With respect to the control plane, the customer can submit a request to create a new database user or user group using the command line tool, for example, such as by submitting the following:
The customer can, with respect to the data plane, perform an action such as granting read/write privileges to a develop1 user for all tables owned by master_username, such as by submitting through an API of the control plane:
to ‘develop1’@‘%’;
Mysql>grant select on master_username.*to‘analyst1’@‘%’;
When the customer makes a request to describe users to the API or command line tool, the Web service tier can immediately fulfill the request by querying the Admin data store for configured permissions if the user name is specified. If the user name is not specified, the Admin data store can be queried for all users on the data store. The Web service tier also can perform tasks such as formatting the data according to the API specification, and responding to the customer request.
Alternatively, a customer can be provided with an application and/or interface that allows the customer to specify parameters, groups, and other such information, and will generate the appropriate calls into the APIs of the control plane. For example, FIG. 6 illustrates an example of an interface page 600 that can be used to apply or update security group information in accordance with one embodiment. In this example, a customer can specify a customer group or customer identifier 602, or other such identifier, which can correspond to a particular data store or data instance for which security settings are to be reviewed and/or updated. The customer also can be provided with user-selectable elements 604 enabling the customer to specify, add, or delete RDS security groups, as well as to adjust parameters for each group, such as access passwords and access levels. A customer also can see and/or update a status of a security group. In this example, it can be seen that a first security group “Developer1” has “read and write” access to the data instance, while “Analyst1” has “read only” access. Both groups are active. If a customer wants to update this information, the customer updates the appropriate fields or other element(s), which causes an appropriate request to be submitted to an interface of the control plane.
When the customer requests a new data store user via the API or command line tool, the control plane can manage the creation. A state of the data store is validated to ensure that the state allows for the creation of a user (e.g., not in a “Creating” or “Deleting” state). A record can be created for the user in the Admin data store with a “Creating” lifestyle and “Pending” change state. A sweeper polling the Admin data store will locate the user record with a change state of “Pending,” and a lifecycle of “Creating” causes the sweeper to launch a workflow instance that satisfies the request. A first action is to update the change state to “Applying” or a similar state so that other sweepers are aware work is underway. The workflow can cause the user to be created for the data instance by requesting that the host manager create the user and updating the Admin data store user record to an “Available” lifestyle with a change state of “none”.
There can be a number of other actions performed via the control plane relating to users and security groups. For example, a ResetUserPassword or similar API can be exposed via the Web service layer to allow users to change forgotten passwords. When a customer requests a database user password reset, the Web service layer can validate that the lifecycle allows such user operations (e.g., not in a “Creating” or “Deleting” state), and validate that the user lifecycle allows a password reset (e.g., set to “Available”). The record for the user can be updated in the Admin data store with a lifecycle of “Reset_Password” and a change state of “Pending”. A sweeper discovering such a record can launch a workflow that updates the change state to “Applying,” and requests that the host manager modify the user password. The workflow then can update the record in the Admin data store to a lifecycle of “Available” and a change state of “None,” and can notify the customer.
When the customer requests to delete a user, the Web service layer can validate that the lifecycle allows such user operations (e.g., not in a “Creating” or “Deleting” state), and validate that the user lifecycle allows a password reset (e.g., set to “Available”). The record for the user can be updated in the Admin data store with a lifecycle of “Deleting” and a change state of “Pending”. A sweeper discovering such a record can launch a workflow that deletes the user by updating the change state to “Applying,” and requesting that the host manager delete the user and disconnect any current connections. The workflow then can delete the record for the user in the Admin data store, and can notify the customer.
The customer can request a list of security groups for a data store or data instance, wherein if the security group name is specified, the Admin data store is queried for configured permissions of this group. If the security group name is not specified, the Admin data store can be queried for all security groups for the customer, or as according to any other parameter specified by the request.
If the customer requests a new RDS security group, a record can be created for the security group in the Admin data store with a status of “Active.” If the customer requests to delete an existing RDS security group, the control plane can validate that no data stores or data instances are members of the security group, and removes the record for the security group in the Admin data store.
If the customer requests to add a new native security group in the data environment or modify an IP range for an existing native security group, the control plane can validate that the native security group state is “Active” and can add a new entry for the access rule in the Admin data store with a lifecycle of “Creating” and a change state of “Pending.” A sweeper can pick up such a record and launch a workflow to authorize a new security group, and updates the change state to “Applying.” A workflow can be launched with tasks for all data stores and/or data instances that are a member of the modified security group. For each affected member, the native security group permissions can be recomputed. When completed, the record for the security group in the Admin data store can be updated to a lifecycle of “Active” and a change state of “None.”
If the customer requests removal of a native security group or reduction of an IP range for an existing native security group, the control plane can validate that the native security group state is “Active” and can update the record for the access rule in the Admin data store with a lifecycle of “Deleting” and a change state of “Pending.” A workflow can be launched with tasks for all data stores and/or data instances that are a member of the modified security group.
As known in the art, relational databases can be run in different modes, such as may include: stand-alone (non-replicated), replicated, or replicated and partitioned. A customer typically makes the choice of which mode to run for a repository based on the availability and scalability needs of the repository and the incurred total cost of ownership (TCO). Some applications and services do not require a repository to be highly available and durable, and may instead utilize a stand-alone repository that is able to tolerate outages on the order of minutes. Other applications and servers can require a repository to be always available, and require the repository to never lose data even in the event of a failure. In this case, the applications and services typically require a replicated database offering. Some users, applications, or services require a massively scalable repository that can partition data across multiple repositories, such that scaling can occur beyond the compute and storage capacity of a single database. To address these different use cases, an approach in accordance with one embodiment offers at least two modes, such as stand-alone and high availability, for each database engine. Some embodiments also allow customers build their own partitioning layer on top of either stand-alone or high availability repositories.
One architecture that can be utilized advantageously relates to providing secure communications to the host managers of the data plane from the components of the host plane. In one embodiment, the workflow and monitoring components of the control plane are constantly communicating with the host managers to perform various tasks (e.g., database maintenance and software installation), as well as to check the status of the various instances and/or repositories. It is important in at least some embodiments that all communications between the control plane and the host managers occur over a secure network that prevents anyone from eavesdropping or issuing unauthorized commands to the host managers.
1. A computer-implemented method of managing security permissions, comprising:
provisioning a data instance in a data environment that includes a first distributed computing system configured to provide native access to data instances for a plurality of customers, wherein a separate control environment includes a second distributed computing system that is separate from and configured to manage the data environment, wherein the data environment that includes the first distributed computing system and the separate control environment that includes the second distributed computing system are both part of a service provider network;
generating a native security group for the data instance;
generating, by the separate control environment, at least one control security group for the data instance and associating the at least one control security group with the native security group for the data instance;
receiving, by the separate control environment, a request from a customer to update one or more permissions of the at least one control security group of the data instance;
subsequent to receipt of the request, updating at least one permission for the at least one control security group while allowing the customer native access to the data instance in the data environment in accordance with a permission in the native security group;
storing, in the separate control environment, the at least one permission for use in determining subsequent access to the data instance by at least one member of the at least one control security group; and
controlling access to the data instance via the data environment based at least in part upon the at least one permission stored in the separate control environment.
2. The computer-implemented method of claim 1, wherein: multiple control security groups are associated with the data instance for the customer, each of the multiple control security groups having at least one of a different set of permissions or a different set of members.
3. The computer-implemented method of claim 1, wherein updating the at least one permission for the at least one control security group includes at least one of: adding a new control security group, deleting the at least one control security group, adding at least one user, deleting at least one user, updating a password for the at least one control security group, or modifying an access level of the at least one control security group to the data instance in the data environment.
4. A computer-implemented method of managing a data instance, comprising:
provisioning the data instance in a data environment, the data environment comprising a first distributed computing system for providing native access to data instances for a plurality of customers;
receiving, by a separate control environment, a request from a customer to update a control security group for the data instance, the separate control environment comprising a second distributed computing system that is separate from the first distributed computing system of the data environment and that is configured to enable management of the data instances, wherein the data environment comprising the first distributed computing system and the separate control environment comprising the second distributed computing system are both part of a service provider network, the control security group being associated with a native security group for the data instance in the data environment;
updating the control security group while allowing the customer native access to the data instance in the data environment in accordance with a permission in the native security group; and
controlling access to the data instance via the data environment based at least in part upon the updated control security group.
5. The computer-implemented method of claim 4, wherein: the request is a Web services call received to an externally-facing application programming interface (API) of the separate control environment.
6. The computer-implemented method of claim 4, wherein updating the control security group includes at least one of: adding a new control security group, deleting the control security group, adding at least one user, deleting at least one user, updating a password for the control security group, or modifying an access level of the control security group to the data instance in the data environment.
7. The computer-implemented method of claim 4, wherein the request is received to a Web services layer including components operable to perform at least one task corresponding to at least one of: authenticating users based on credentials, authorizing the users, throttling user requests, marshalling requests and responses, or unmarshalling the requests and responses.
8. The computer-implemented method of claim 4, further comprising: in response to receiving the request, storing information for the request to a job queue.
9. The computer-implemented method of claim 8, further comprising: in response to detecting the information stored in the job queue, assembling and executing a workflow to manage updating the control security group.
10. The computer-implemented method of claim 4, wherein: information for the updated control security group is communicated to a host manager for the data instance in the data environment.
11. The computer-implemented method of claim 4, further comprising: providing separate interfaces in the separate control environment enabling a user to submit requests to add, delete, and modify user information for the control security group.
12. The computer-implemented method of claim 4, further comprising restricting processing of requests affecting the control security group to the control environment.
13. A system for controlling a data environment using a separate control environment, comprising:
provision a data instance in the data environment, the data environment comprising a first distributed computing system for providing native access to data instances for a plurality of customers;
receive, by the separate control environment, a request from a customer to update a control security group for the data instance, the separate control environment comprising a second distributed computing system, that is separate from the first distributed computing system of the data environment and that is configured to enable management of the data instances, wherein the data environment comprising the first distributed computing system and the separate control environment comprising the second distributed computing system are both part of a service provider network, the control security group being associated with a native security group for the data instance in the data environment;
update the control security group while allowing the customer native access to the data instance in the data environment in accordance with a permission in the native security group; and
control access to the data instance via the data environment based at least in part upon the updated control security group.
14. The system of claim 13, wherein the instructions, when executed to cause the system to update the control security group, cause the system to: add a new control security group, delete the control security group, add at least one user, delete at least one user, update a password for the control security group, or modify an access level of the control security group to the data instance in the data environment.
15. The system of claim 13, wherein the instructions that, when executed by the at least one processor, further cause the system to: in response to receiving the request, store information for the request to a job queue.
16. The system of claim 15, wherein the instructions that, when executed by the at least one processor, further cause the system to: in response to detecting the information stored in the job queue, assemble and execute a workflow to manage updating the control security group.
17. The system of claim 13, wherein: information for the updated control security group is communicated to a host manager for the data instance in the data environment.
18. The system of claim 13, wherein: multiple control security groups are associated with the data instance for the customer, each control security group having at least one of a different set of permissions or a different set of members.
19. The system of claim 13, wherein: requests affecting the control security group are restricted to being processed by the control environment.
20. A computer program product embedded in a non-transitory computer-readable medium and including instructions that, when executed by at least one computing device, cause the at least one computing device to:
provision a data instance in a data environment, the data environment comprising a first distributed computing system for providing native access to data instances for a plurality of customers;
receive, by a separate control environment, a request from a customer to update a control security group for the data instance, the separate control environment comprising a second distributed computing system, that is separate from the first distributed computing system of the data environment and that is configured to enable management of the data instances, wherein the data environment comprising the first distributed computing system and the separate control environment comprising the second distributed computing system are both part of a service provider network, the control security group being associated with a native security group for the data instance in the data environment;
21. The computer program product of claim 20, wherein the instructions that, when executed by the at least one computing device to cause the at least one computing device to update the control security group, cause the at least one computing device to: add a new control security group, delete the control security group, add at least one user, delete at least one user, update a password for the control security group, or modify an access level of the control security group to the data instance in the data environment.
22. The computer program product of claim 20, wherein the instructions that, when executed by the at least one computing device, further cause the at least one computing device to: in response to receiving the request, store information for the request to a job queue.
23. The computer program product of claim 22, wherein the instructions that, when executed by the at least one computing device, further cause the at least one computing device to: in response to detecting the information stored in the job queue, assemble and execute a workflow to manage updating the control security group.
24. The computer program product of claim 20, wherein: information for the updated control security group is communicated to a host manager for the data instance in the data environment.
US12416017 2009-03-31 2009-03-31 Managing security groups for data instances Active 2032-03-23 US9705888B2 (en)
US12416017 US9705888B2 (en) 2009-03-31 2009-03-31 Managing security groups for data instances
US15645886 US20170318025A1 (en) 2009-03-31 2017-07-10 Managing security groups for data instances
US15645886 Continuation US20170318025A1 (en) 2009-03-31 2017-07-10 Managing security groups for data instances
US20100251339A1 true US20100251339A1 (en) 2010-09-30
US9705888B2 true US9705888B2 (en) 2017-07-11
ID=42785992
US12416017 Active 2032-03-23 US9705888B2 (en) 2009-03-31 2009-03-31 Managing security groups for data instances
US15645886 Pending US20170318025A1 (en) 2009-03-31 2017-07-10 Managing security groups for data instances
US (2) US9705888B2 (en)
NL2008643C (en) * 2012-04-16 2013-10-17 Clinct Holding B V Computer network for services retrieval, method for managing such network and a computer system for such network.
US8997047B2 (en) 2012-12-13 2015-03-31 International Business Machines Corporation Dynamically updating code without requiring processes to restart
US7536056B2 (en) 2002-01-10 2009-05-19 Ricoh Co., Ltd. Header-based processing of images compressed using multi-scale transforms
Amazon HQ Wiki, "RDSMySQLConfigManagement/ConfigExecSummary", RDS/EDS/DesignDocs/RDSMySQLConfigManagement/ConfigExecSummary from https://w.amazon.com/index.php/RDS/EDS/ConfigExecSummary; downloaded Aug. 11, 2009.
Amazon HQ Wiki, "RDSMySQLConfigManagement/ConfigWorkflowDesign", RDS/EDS/DesignDocs/RDSMySQLConfigManagement/ConfigWorkflowDesign from hhtps://w.amazon.com/index.php/RDS/EDS/DesignDocs/RDSMySQLConfigManagement/ConfigWorkflowDesign; downloaded Feb. 11, 2009.
Candan, K. Selcuk; Frontiers in Information and Software as Services; 2009 IEEE international Conference on Data Engineering.
Cases for E-Business Application Using Web Services Technology and Research and Study of Problems, 1st Edition, Mar. 31, 2004, pp. 1-5.
Certificate of Grant issued May 21, 2014; in corresponding Singaporean patent application No. 201107040.6.
Certificate of Grant of patent issued Jul. 7, 2014; in corresponding Singapore patent application No. 2012028700.
Certificate of Grant of patent on Nov. 25, 2014; in corresponding Singapore patent application No. 201202868.4.
Certificate of Grant of patent on Oct. 24, 2014; in corresponding Singapore patent application No. 201202502.9.
Cordy, James R. , "Practical Language—Independent Detection of Near-Miss Clones", ACM, <http://delivery.acm.org/10.1145/1040000/1034915/p1-cordy.pdf>, 2001, 12 pages.
English abstract for CN101099172; published on Jan. 2, 2008 and retrieved on Feb. 6, 2015.
English abstract for CN101501688; published Aug. 5, 2009 and retrieved on Nov. 4, 2014.
English abstract for JP2000172721; published on Jun. 23, 2000 and retrieved on Feb. 6, 2015.
English abstract for JP2003330781; published Nov. 21, 2003 and retrieved on Jan. 8, 2015.
English abstract for JP2004206694; published Jul. 22, 2004 and retrieved on Feb. 6, 2015.
English abstract for JP2004362596; published Dec. 24, 2004 and retrieved on Feb. 6, 2015.
English abstract for JP2005267056; published Sep. 29, 2005 and retrieved on Feb. 6, 2015.
English abstract for JP2006048676; published Feb. 16, 2006 and retrieved on Nov. 4, 2014.
English abstract for JP2007516510; published Jun. 21, 2007 and retrieved on Feb. 6, 2015.
English abstract for JP2008141339; published on Jun. 19, 2008 and retrieved on Feb. 6, 2015.
English abstract for JP2009522659; published Jun. 11, 2009 and retrieved on Nov. 4, 2014.
English translation Notice of Allowance and Fee(s) Due mailed Sep. 2, 2014; in corresponding Japanese patent application No. 2012-503674.
English translation Notice of the First Office Action mailed Apr. 1, 2014; in corresponding Chinese patent application No. 201080053676.7.
English translation Notice on the Third Office Action mailed Jan. 19, 2015; in corresponding Chinese patent application No. 201080015811.9.
English translation of the First Office Action mailed May 5, 2014; in corresponding Chinese patent application No. 201080056311.X.
English translation of the First Office Action mailed Oct. 21, 2013; in corresponding Chinese patent application No. 201080015811.9.
English translation of the Notice of the First Office Action mailed Jun. 12, 2014; in corresponding Chinese patent application No. 201080049395.4.
English translation of the Notice of the Second Office Action mailed Oct. 29, 2014; in corresponding Chinese patent application No. 201080053676.7.
English translation of the Office Action mailed Dec. 3, 2013; in corresponding Japanese patent application No. 2012-503674.
English translation of the Office Action mailed Sep. 16, 2014; in corresponding Japanese patent application No. 2013-262835.
English translation the Second Office Action mailed Oct. 27, 2014; in corresponding Chinese patent application No. 201080056311.X.
Examination Report mailed Dec. 11, 2012; in corresponding Singaporean patent application No. 201202502-9.
Examination Report mailed Oct. 19, 2012; in Singaporean patent application No. 201202870-0.
Examination Report mailed Oct. 29, 2012; in corresponding Singaporean patent application No. 201202868-4.
Examiner's Report mailed Dec. 9, 2014; in corresponding Canadian patent application No. 2,778,456.
Examiner's Report mailed Jul. 25, 2014; in corresponding Canadian patent application No. 2,778,723.
Examiner's Report mailed Sep. 6, 2013; in corresponding Canadian patent application No. 2,778,456.
IBM Redbook, San Volume Controller: Best Practices and Performances Guidelines (draft), tate et al ; Jul. 2007.
Invitation to Respond to Written Opinion mailed Sep. 14, 2012; in corresponding Singaporean patent application No. 201202967-4.
Lahiri, Tirthankar et al., "Cache Fusion: Extending Shared—Disk Clusters with Shared Caches", 27th VLDB Conference; Roma, Italy., 2001, 4 pages.
Letters patent issued Apr. 25, 2014; in corresponding Japanese patent application No. 2012-536965.
Letters Patent issued on Apr. 25, 2014; in corresponding Japanese patent application No. 2012-536965.
McNett; Usher: An Extensible Framework for Managing Clusters of Virtual Machines; pp. 167-181 of the Proceedings of the 21st Large Installation System Administration Conference (LISA '07) Nov. 11-16, 2007.
Non-Final Office Action mailed Mar. 14, 2013; in corresponding U.S. Appl. No. 12/606,093.
Non-Final Officer Action mailed Jul. 30, 2014; in corresponding U.S. Appl. No. 12/575,381.
Notice of the First Office Action mailed Apr. 1, 2014; in corresponding Chinese patent application No. 201080053676.7.
Notice of the Second Office Action mailed Oct. 29, 2014; in corresponding Chinese patent application No. 201080053676.7.
Notice on the Third Office Action mailed Jan. 19, 2015; in corresponding Chinese patent application No. 201080015811.9.
Office Action mailed Oct. 3, 2013; in corresponding Canadian patent application No. 2,755,913.
Office Action mailed Sep. 16, 2014; in corresponding Japanese patent application No. 2013-262835.
Supplementary European Search Report mailed Oct. 9, 2013; in corresponding European patent application No. 10827392.1.
The First Office Action mailed Apr. 21, 2014; in corresponding Chinese patent application No. 201080056327.0.
The First Office Action mailed May 5, 2014; in corresponding Chinese patent application No. 201080056311.X.
The First Office Action mailed Oct. 21, 2013; in corresponding Chinese patent application No. 201080015811.9.
The Notice of the First Office Action mailed Jun. 12, 2014; in corresponding Chinese patent application No. 201080049395.4.
The Office Action mailed Dec. 3, 2013; in corresponding Japanese patent application No. 2012-503674.
Unix/Linux Administration Logical Volume Management Guide; 2005.
Z/VM and Linux on IBM System z′ The virtualization cookbook for Red hat Enterprise Linux 5.2.; Oct. 2008.
US20100251339A1 (en) 2010-09-30 application
US20170318025A1 (en) 2017-11-02 application
US20100325687A1 (en) 2010-12-23 Systems and Methods for Custom Device Automatic Password Management
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MCALISTER, GRANT ALEXANDER MACDONALD;REEL/FRAME:027496/0103