Policy enforcement delays

摘要

Policies are used to control access to resources. Requests to change a set of policies may be fulfillable, at least in some circumstances, only if the requests are submitted such that the requested changes would become effective at a time in the future that is in compliance with a requirement for delayed enforcement. The requirement for delayed enforcement may be encoded in a policy in the set of policies.

主权项

1. A computer-implemented method, comprising:
under the control of one or more computer systems that execute instructions to provide one or more services to a customer of a computing resource service provider,
storing a set of one or more policies that include a policy addition policy that specifies one or more conditions that are conditions precedent to changing a set of policies, wherein the one or more conditions include a requirement for a delay of enforcement for proposed policies;receiving a request to add a proposed policy, the policy addition policy being applicable to the proposed policy;determining, based at least in part on information, including a time indicating when the proposed policy is to become effective, the time included with the request, whether the proposed policy complies with the requirement;wherein, as a result of determining that the proposed policy complies with the requirement, causing the proposed policy to become effective in accordance with the time indicated; andwherein, as a result of determining that the proposed policy fails to comply with the requirement, causing the request to be denied.