Provides the capabilty for a Service Provider to lock a VM
There are a number of opertaional reasons why a Servcie Provider needs to lock a VM such that a user is no longer able to perform any actions on it. One of the main reasons is where the VM has been reported for suspicious activity and forensic evidence needs to be preserved.
Blueprint information
- Status:
- Complete
- Approver:
- Russell Bryant
- Priority:
- Low
- Drafter:
- None
- Direction:
- Approved
- Assignee:
- Jason Dillaman
- Definition:
- Approved
- Series goal:
- None
- Implementation:
-
Implemented
- Milestone target:
-
2013.2
- Started by
- Russell Bryant
- Completed by
- Russell Bryant
Whiteboard
This has stalled, but is still a reasonable feature to add. Consider it open for volunteers to take on. --russellb
There is an existing user level lock capability supported via the EC2 and OSAPI, but currently restricted to being an admin only action in the default policy.
This blueprint introduces additional functionality that allows the lock to be used by users (to prevent accidental changes to an instance for example), but also allows the lock to enforced by an administrator with appropriate privileges such that it overrides any lock held by the user (for example to block actions on a rouge instance)
The change is implemented by adding a record of the tenant that takes the lock, which also provides an audit capability.
Aside from recording the id of the tenant the schematics of locking an instance remain the same and are protected by the existing policy
When unlocking an instance an additional check is made to see if the lock is held by the owner of the instance. If it isn't then an additional check is made against the unlock_override policy
This allows the lock and unlock policy to be changes as follows:
"compute_
"compute_
"compute_
Gerrit Topic: https:/
Gerrit topic: https:/
Addressed by: https:/
Allow user and admin lock of an instance
