US 12,348,529 B2
Automated policy refiner for cloud-based identity and access management systems
Neha Rungta, Seattle, WA (US); Chungha Sung, Seattle, WA (US); Amit Goel, Seattle, WA (US); Zvonimir Rakamaric, Seattle, WA (US); and Loris D'Antoni, Seattle, WA (US)
Assigned to Amazon Technologies, Inc., Seattle, WA (US)
Filed by Amazon Technologies, Inc., Seattle, WA (US)
Filed on Sep. 30, 2022, as Appl. No. 17/957,904.
Prior Publication US 2024/0114035 A1, Apr. 4, 2024
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/107 (2013.01) [H04L 63/102 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method comprising:
obtaining, by a policy refiner service of a cloud provider network, a log of events related to activity associated with an account of the cloud provider network, wherein an event in the log of events indicates an action performed relative to a resource of the cloud provider network;
identifying a policy associated with the account, wherein the policy includes a statement defining a permission associated with the account, wherein the statement includes a plurality of field values defining the permission, and wherein a particular field value of the plurality of field values identifies one of: a type of action the policy allows or denies, a resource to which the statement relates, or a condition for granting the permission;
identifying, from the log of events, a plurality of events indicating actions that were permitted based on the statement by parsing the plurality of events from the log of events and mapping individual events from the log of events to the statement from the policy that caused an identity and access management service to permit requests represented by the individual events;
identifying a plurality of event values from the plurality of events corresponding to the particular field value in the statement;
generating, based on the plurality of event values, a modified field value, wherein the modified field value is generated using a field-specific abstraction algorithm, and wherein the modified field value is more restrictive than the particular field value;
determining, using a policy property analyzer, that a modified policy including the modified field value is more restrictive than the policy with the particular field value, wherein the policy property analyzer uses a Satisfiability Modulo Theories (SMT) solver to determine that the modified policy including the modified field value is more restrictive than the policy with the particular field value; and
causing display of a suggested modification to the policy based on the modified field value, wherein the suggested modification to the policy would result in the modified policy including the modified field value.