Techniques for credential generation

Abstract

A plurality of virtual computing resources is detected to have been provisioned. Credentials are distributed to the plurality of virtual computing resources. A credentials map that maps the credentials to the plurality of virtual computing resources is updated. The credentials for the plurality of virtual computing resources are activated to enable the plurality of virtual computing resources to use the credentials to authenticate to a second computer system that manages a resource service, with the credentials being inaccessible to resources of the resource service. A virtual computing resource of the plurality of virtual computing resources is detected to been deprovisioned, and the credentials for the virtual computing resource are deactivated.

What is claimed is: 
     
         1 . A computer-implemented method, comprising:
 detecting that a plurality of virtual machine instances has been provisioned;   distributing credentials to the plurality of virtual machine instances;   updating a credentials map that maps the credentials to the plurality of virtual machine instances;   activating the credentials for the plurality of virtual machines, thereby enabling the plurality of virtual machine instances to use the credentials for authenticating with a computer system that manages a resource service, the credentials being inaccessible to the computer system, the computer system separate from the one or more computer systems;   detecting that a virtual machine instance of the plurality of virtual machine instances has been deprovisioned; and   deactivating the credentials that are mapped to the virtual machine instance in the credential map.   
     
     
         2 . The computer-implemented method of  claim 1 , wherein detecting the deprovisioning occurs as a result of detecting one or more of:
 that hardware allocated to the virtual machine instance has been deallocated from the virtual machine instance, or   that a memory state of the virtual machine instance has been stored to persistent storage.   
     
     
         3 . The computer-implemented method of  claim 1 , wherein:
 the virtual machine instance is a first virtual machine instance;   the credentials mapped to the first virtual machine instance are also mapped to a second virtual machine instance; and   after the credentials have been deactivated for the first virtual machine instance, the credentials remain activated for the second virtual machine instance.   
     
     
         4 . The computer-implemented method of  claim 1 , further comprising receiving a command to distribute the credentials to at least two of the plurality of virtual machine instances. 
     
     
         5 . The computer-implemented method of  claim 4 , wherein the command includes granularity information usable to determine:
 a quantity of credentials to generate for the plurality of virtual machine instances; and   identities of the plurality of virtual machine instances.   
     
     
         6 . The computer-implemented method of  claim 1 , wherein updating the credentials map includes updating a table of an authentication service that associates credentials with virtual machine instances to indicate that the credentials are currently active for the plurality of virtual machine instances. 
     
     
         7 . The computer-implemented method of  claim 6 , wherein updating the table involves:
 adding at least one row in the table, or   setting a field in the table for the credentials to a value that indicates that the credentials are active.   
     
     
         8 . A system, comprising:
 one or more processors; and   memory including instructions that, as a result of execution by the one or more processors, cause the system to:
 detect that a plurality of virtual computing resources has been provisioned; 
 distribute credentials to the plurality of virtual computing resources; 
 update a credentials map that maps the credentials to the plurality of virtual computing resources; 
 activate the credentials for the plurality of virtual computing resources to enable the plurality of virtual computing resources to use the credentials to authenticate to another virtual resource service, the credentials being inaccessible to the other virtual resource service; 
 detect that a virtual computing resource of the plurality of virtual computing resources has been deprovisioned; and 
 deactivate the credentials that are mapped to the the virtual computing resource in the credential map. 
   
     
     
         9 . The system of  claim 8 , wherein:
 the other virtual resource service is a storage service; and   activation of the credentials enables the virtual computing resource to access a data store of the storage service.   
     
     
         10 . The system of  claim 8 , wherein instructions that cause the system to detect that the plurality of virtual computing resources has been provisioned includes receipt of a message that indicates that the virtual computing resource has been successfully provisioned. 
     
     
         11 . The system of  claim 8 , wherein the instructions that cause the system to update the credentials map include instructions that cause the system to:
 add the credentials into the credentials map, or   tag the credentials in the credentials map to indicate that the credentials are active.   
     
     
         12 . The system of  claim 8 , wherein the instructions further include instructions that cause the system to:
 obtain a policy conditioned on ownership of particular credentials; and   cause a second virtual computing resource to receive access to a resource of the other virtual resource service by providing proof of the ownership of the particular credentials to the other virtual resource service.   
     
     
         13 . The system of  claim 8 , wherein the instructions further include instructions that cause the system to:
 generate new credentials to replace the credentials that are mapped to the virtual computing resource;   reprovision, from a stored state of the virtual computing resource, a reprovisioned virtual computing resource; and   activate the new credentials for the reprovisioned computing resource.   
     
     
         14 . The system of  claim 8 , wherein individual virtual computing resources of the plurality of virtual computing resources receive different credentials from other individual virtual computing resources. 
     
     
         15 . A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a first computer system, cause the first computer system to at least:
 detect that a plurality of virtual computing resources has been provisioned;   distribute credentials to the plurality of virtual computing resources;   update a credentials map that maps the credentials to the plurality of virtual computing resources;   activate the credentials for the plurality of virtual computing resources to enable the plurality of virtual computing resources to use the credentials to authenticate to a second computer system that manages a resource service, the credentials being inaccessible to resources of the resource service;   detect that a virtual computing resource of the plurality of virtual computing resources has been deprovisioned; and   deactivate the credentials that are mapped to the virtual computing resource.   
     
     
         16 . The non-transitory computer-readable storage medium of  claim 15 , wherein:
 the executable instructions further cause the computer system to receive granularity information; and   the executable instructions that cause the first computer system to distribute the credentials include instruction that cause the first computer system to identify the plurality of virtual computing resources to which the credentials are to be distributed based at least in part on the granularity information.   
     
     
         17 . The non-transitory computer-readable storage medium of  claim 15 , wherein the credentials encode a security policy. 
     
     
         18 . The non-transitory computer-readable storage medium of  claim 15 , wherein the virtual computing resources include virtual machine instances. 
     
     
         19 . The non-transitory computer-readable storage medium of  claim 15 , wherein the virtual computing resource is deprovisioned as a result of detection of a security breach in connection with the virtual computing resource. 
     
     
         20 . The non-transitory computer-readable storage medium of  claim 15 , wherein the executable instructions that cause the computer system to distribute the credentials include executable instructions that cause the computer system to provide the credentials from a web server having a predetermined network location.