US 12,335,318 B1
Detecting conflicts between a generated access management policy and invoked access management policies
Homer Strong, Seattle, WA (US); Daniel George Peebles, Richland, WA (US); and Neha Rungta, San Jose, CA (US)
Assigned to Amazon Technologies, Inc., Seattle, WA (US)
Filed by Amazon Technologies, Inc., Seattle, WA (US)
Filed on Dec. 4, 2020, as Appl. No. 17/112,856.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/205 (2013.01) [H04L 63/10 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system, comprising:
at least one processor; and
a memory, storing program instructions that when executed by the at least one processor, cause the at least one processor to implement an identity and access management system, the identity and access management system configured to:
receive, via an interface of the identity and access management system, a request to update a first access management policy, wherein the request to update the first access management policy includes one or more example requests and respective expected results for the one or more example requests, wherein the one or more example requests and the respective expected results for the one or more example requests are used to detect a conflict between the first access management policy and a second access management policy;
responsive to the request:
identify the second access management policy that is invoked to evaluate the one or more example requests and the first access management policy;
detect a conflict between the respective expected results for the one or more example requests when invoked using the first access management policy and respective expected results for the same one or more example requests when invoked using the second access management policy, wherein the first access management policy and the second access management policy are different access management policies; and
provide, via the interface, an indication of the conflict between the respective expected results for the one or more example requests when invoked using the first access management policy and the respective expected results for the same one or more example requests when invoked using the second access management policy.