Abstract: Systems and methods for facilitating cloud-computing provisioning using deployment templates. A deployment management system receives a deployment template that includes a declarative portion specifying a plurality of resources to be deployed and an imperative portion specifying at least one procedure for adding, reconfiguring, or terminating a resource. The deployment management system generates an enumeration of a set of resources deployed prior to implementing a transition based on the deployment template, and generates a second enumeration of resources prospectively representative of a deployment conformant with the template subsequent to implementing the transition. The deployment management system identifies difference between the enumerations and generates a transition plan including a sequence of procedures for implementing the deployment template. In some implementations, an administrator can modify the transition plan.

Abstract: Systems and methods for facilitating cloud-computing provisioning using deployment templates. A deployment management system receives a deployment template that includes a declarative portion specifying a plurality of resources to be deployed and an imperative portion specifying at least one procedure for adding, reconfiguring, or terminating a resource. The deployment management system generates an enumeration of a set of resources deployed prior to implementing a transition based on the deployment template, and generates a second enumeration of resources prospectively representative of a deployment conformant with the template subsequent to implementing the transition. The deployment management system identifies difference between the enumerations and generates a transition plan including a sequence of procedures for implementing the deployment template. In some implementations, an administrator can modify the transition plan.

Abstract: Systems and methods for authorizing execution of actionable data by receiving a request to enable third-party use of the actionable data, the request authorized by an account with a first set of permissions, and recording the first set of permissions in association with the actionable data, receiving a request to execute the actionable data, the request authorized by an account with a second set of permissions, determining that a unified set of permissions inclusive of the first set of permissions and the second set of permissions is sufficient to authorize execution of the actionable data, and authorizing execution of the actionable data responsive to the determination. Presented as an example of actionable data is a deployment template for provisioning resources in a cloud computing environment. The disclosed systems and methods are equally applicable to other forms and contexts of actionable data.

Abstract: A method and system for facilitating management of cloud-based service instances, the system including one or more computing systems configured to communicate with at least one multi-tenant computing cloud, and configured to establish a cloud-based service instance hosted in the multi-tenant computing cloud and an access entity with permissions to access the established cloud-based service instance. The system can receive a request for the cloud-based service instance, the request authenticated as originating from a requestor; consult a set of access controls associated with the cloud-based service instance; determine, responsive to the consulting, if the request is allowable by the requestor; and enable, responsive to determining that the request is allowable by the requestor, the requestor to complete the request using a restricted access credential associated with the access entity.

Abstract: The present invention is related to associating a machine or virtual machine instance with an access control right in a cloud-based computing environment. In one aspect, the present invention relates to an apparatus for or a method of associating a machine or virtual machine instance with an access control right in a cloud-based computing environment. In various embodiments, the apparatus is capable of, and the method includes, the following: receiving, in a cloud-based computing environment, a request to perform an action; using an identifier for the machine or virtual machine instance to determine that the received request was sent by, or on behalf of, the machine or virtual machine instance; and identifying an access control right associated with the machine or virtual machine instance making the request, to determine whether to perform the action on behalf of, or grant access by, the machine or virtual machine instance.

Abstract: A method and system for facilitating management of cloud-based service instances, the system comprising one or more computing systems configured to communicate with at least one multi-tenant computing cloud, and configured to establish a cloud-based service instance hosted in the multi-tenant computing cloud and an access entity with permissions to access the established cloud service instance. The system can receive a request for the cloud-based service instance, the request authenticated as originating from a requestor; consult a set of access controls associated with the cloud-based service instance; determine, responsive to the consulting, if the request is allowable by the requestor; and enable, responsive to determining that the request is allowable by the requestor, the requestor to complete the request using a restricted access credential associated with the access entity.

Abstract: A method and system for facilitating management of cloud-based service instances, the system including one or more computing systems configured to communicate with at least one multi-tenant computing cloud, and configured to establish a cloud-based service instance hosted in the multi-tenant computing cloud and an access entity with permissions to access the established cloud-based service instance. The system can receive a request for the cloud-based service instance, the request authenticated as originating from a requestor; consult a set of access controls associated with the cloud-based service instance; determine, responsive to the consulting, if the request is allowable by the requestor; and enable, responsive to determining that the request is allowable by the requestor, the requestor to complete the request using a restricted access credential associated with the access entity.

Abstract: The present invention is related to associating a machine or virtual machine instance with an access control right in a cloud-based computing environment. In one aspect, the present invention relates to an apparatus for or a method of associating a machine or virtual machine instance with an access control right in a cloud-based computing environment. In various embodiments, the apparatus is capable of, and the method includes, the following: receiving, in a cloud-based computing environment, a request to perform an action; using an identifier for the machine or virtual machine instance to determine that the received request was sent by, or on behalf of, the machine or virtual machine instance; and identifying an access control right associated with the machine or virtual machine instance making the request, to determine whether to perform the action on behalf of, or grant access by, the machine or virtual machine instance.

Abstract: The present invention is related to associating a machine or virtual machine instance with an access control right in a cloud-based computing environment. In one aspect, the present invention relates to an apparatus for or a method of associating a machine or virtual machine instance with an access control right in a cloud-based computing environment. In various embodiments, the apparatus is capable of, and the method includes, the following: receiving, in a cloud-based computing environment, a request to perform an action; using an identifier for the machine or virtual machine instance to determine that the received request was sent by, or on behalf of, the machine or virtual machine instance; and identifying an access control right associated with the machine or virtual machine instance making the request, to determine whether to perform the action on behalf of, or grant access by, the machine or virtual machine instance.