COPYRIGHT NOTICE

Contained herein is material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction of the patent disclosure by any person as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all rights to the copyright whatsoever. Copyright © 2020, Fortinet, Inc.

BACKGROUND

Field

Embodiments of the present invention generally relate to the field of cybersecurity and expression of security policies with reference to tags assigned to resources. In particular, embodiments of the present invention relate to tag management and orchestration for cloud resources throughout a hybrid multi-cloud environment to facilitate real-time synchronization of such security policies implemented by the private network.

Description of the Related Art

There has been a significant increase in the use of cloud computing technology over the last few years. In a cloud environment, end-to-end automation of deployment of services is generally referred to as cloud orchestration. More specifically, cloud orchestration involves automated arrangement, coordination, and management of complex computer systems, middleware, and services, which accelerates delivery of services while reducing costs. Orchestration is used to manage cloud environments, which supply and assign cloud resources (e.g. creation of Virtual Machine (VMs), allocation of storage capacity, management of network resources, and granting access to cloud software).

While cloud platforms (e.g., Amazon Web Services (AWS), Google loud Platform (GCP) and Microsoft Azure) support the assignment of metadata to cloud resources in the form of tags (or labels) to manage, search for, and filter resources, different cloud providers may use inconsistent tag naming conventions, resulting in similar resources being tagged in a disparate manner across a multi-cloud environment and complicating definition and/or implementation of security policies.

SUMMARY

Systems and methods are described for automatically tagging cloud resources that are spread across multiple cloud platforms. According to one embodiment, information regarding each cloud provider of multiple cloud providers associated with a cloud environment used by a private network is received by a cloud-tagging orchestrator service running on a security manager associated with the private network. For each cloud resource of a plurality of cloud resources hosted by the cloud providers on behalf of the private network: (i) information associated with the cloud resource is retrieved by the cloud-tagging orchestrator service; (ii) a unified tag of multiple unified tags for the cloud resource is identified by the cloud-tagging orchestrator service based on a pre-defined global tagging policy; and (ii) the unified tag is assigned by the cloud-tagging orchestrator service to the cloud resource via an application programming interface (API) of a cloud provider of the multiple cloud providers hosting the resource.

Other features of embodiments of the present disclosure will be apparent from accompanying drawings and detailed description that follows.

