Substitution of requests or results in access control systems

Abstract

Approaches are described for allowing an access control policy to specify that a substitute operation be executed when a request for access matches certain conditions specified in the access control policy (e.g., when the identity of the requestor matches a specified identity in the policy). For example, the access control may specify that a substitute result should be provided to a requestor in response to a request for access or a substitute request should be executed instead of executing the received request and the results of the substitute request should be provided to the requestor in response to the request. The substitute result or the result of the substitute request may appear to the requestor as though their original request for access succeeded but the content of the result may be different than what would have been generated if the access control policy allowed the request to proceed.

What is claimed is: 
     
         1 . A computer implemented method comprising:
 receiving a request to access a resource, the request being associated with an unfiltered result including information responsive to the request;   causing a substitution result to be generated in response to the request, the substitution result comprising a filtered subset of the unfiltered result; and   generating, separate from the filtered subset, an indication in response to the request, indicating that the request has completed successfully with unfiltered information pertinent to the request.   
     
     
         2 . The computer implemented method of  claim 1 , wherein causing the substitution result to be generated further comprises:
 causing a read or write operation on a first resource to be replaced with a read or write operation on a second resource, wherein the second resource is a redacted version of the first resource.   
     
     
         3 . The computer implemented method of  claim 1 , wherein the request to access the resource is associated with a result set through an access control policy. 
     
     
         4 . The computer implemented method of  claim 1 , further comprising:
 generating the substitution result based at least in part on an access control policy and the request to access the resource.   
     
     
         5 . The computer implemented method of  claim 1 , wherein generating the substitution result further comprises replacing a first resource specified in the request to access the resource with a second resource. 
     
     
         6 . The computer implemented method of  claim 1 , wherein at least one of the substitution result is embedded in an access control policy. 
     
     
         7 . The computer implemented method of  claim 1 , further comprising:
 determining an identity of a client that initiated the request to access the resource; and   determining that the request satisfies one or more conditions based at least in part on the identify of the client.   
     
     
         8 . The computer implemented method of  claim 1 , wherein causing the substitution result to be generated further comprises performing at least one of:
 replacing a read operation of a first resource with a read operation of a second resource;   replacing a write operation of the first resource with a write operation of the second resource:   replacing a request for a list of available resources with a request for a list of a predetermined fixed list of resources that is different from the list of available resources;   replacing a request to terminate a virtual machine with a request to suspend the virtual machine; or   replacing a request to launch a virtual machine of a first type with a request to launch a virtual machine of a second type.   
     
     
         9 . A system, comprising:
 at least one processor; and   memory including instructions that, when executed by the at least one processor, cause the system to:
 receive a request to access a resource, the request being associated with an unfiltered result including information responsive to the request; 
 cause a substitution result to be generated in response to the request, the substitution result comprising a filtered subset of the unfiltered result; and 
 generate, separate from the filtered subset, an indication in response to the request, indicating that the request has completed successfully with unfiltered information pertinent to the request. 
   
     
     
         10 . The system of  claim 9 , wherein the instructions when executed to generate the substitution result further enable the system to:
 return a substitution result specified in an access control policy in response to the request.   
     
     
         11 . The system of  claim 9 , wherein the instructions when executed to generate the substitution result further enable the system to:
 generate the substitution result based at least in part on an access control policy and the request to access the resource.   
     
     
         12 . The system of  claim 9 , wherein the instructions when executed to generate the substitution result further enable the system to:
 replace a first resource specified in the request to access the resource with a second resource.   
     
     
         13 . The system of  claim 9 , wherein the instructions when executed to generate the substitution result further enable the system to perform at least one of:
 replace a read operation of a first resource with a read operation of a second resource;   replace a write operation of the first resource with a write operation of the second resource:   replace a request for a list of available resources with a request for a list of a predetermined fixed list of resources that is different from the list of available resources;   replace a request to terminate a virtual machine with a request to suspend the virtual machine; or   replace a request to launch a virtual machine of a first type with a request to launch a virtual machine of a second type.   
     
     
         14 . The system of  claim 9 , wherein generating the substitution result to be generated further comprises:
 causing a read operation on a document to be replaced with a read operation on a redacted version of the document.   
     
     
         15 . A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a computing device, cause the computing device to:
 receive a request to access a resource, the request being associated with an unfiltered result including information responsive to the request;   cause a substitution result to be generated in response to the request, the substitution result comprising a filtered subset of the unfiltered result; and   generate, separate from the filtered subset, an indication in response to the request, indicating that the request has completed successfully with unfiltered information pertinent to the request.   
     
     
         16 . The non-transitory computer-readable storage medium of  claim 15 , wherein the instructions when executed to generate the substitution result further enable the at least one processor to:
 return a substitution result specified in an access control policy in response to the request.   
     
     
         17 . The non-transitory computer-readable storage medium of  claim 15 , wherein the instructions when executed to generate the substitution result further enable the at least one processor to:
 generate the substitution result based at least in part on an access control policy and the request to access the resource.   
     
     
         18 . The non-transitory computer-readable storage medium of  claim 15 , wherein the instructions when executed to generate the substitution result further enable the at least one processor to:
 replace a first resource specified in the request to access the resource with a second resource.   
     
     
         19 . The non-transitory computer-readable storage medium of  claim 15 , wherein the instructions when executed to generate the substitution result further enable the at least one processor to perform one of:
 replace a read operation of a first resource with a read operation of a second resource;   replace a write operation of the first resource with a write operation of the second resource;   replace a request for a list of available resources with a request for a list of a predetermined fixed list of resources that is different from the list of available resources;   replace a request to terminate a virtual machine with a request to suspend the virtual machine; or   replace a request to launch a virtual machine of a first type with a request to launch a virtual machine of a second type.   
     
     
         20 . The non-transitory computer-readable storage medium of  claim 15 , wherein the request is an application programming interface (API) request received by a web service from a user over a network to access the resource provisioned for the user in a multitenant computing environment.