구글이 100억개의 권한 관리하는 법

Summary

Google operates nearly 200 services and impressively interconnects them, enabling capabilities like attaching Drive files when emailing. To coordinate services at scale, Google built Zanzibar - a database recording permissions for data like YouTube videos and Drive documents. It stores access rules easily, enabling developers to check permissions via API instead of complex custom code. As users create data, Zanzibar updates accordingly. The tradeoff is added complexity, but faster standardized access. Consider services like Zanzibar to elegantly coordinate complex permissions at scale.

Takeaways

• 😮 Google has hundreds of interconnected services like Gmail, Drive, Calendar, etc.
• 🧐 Interconnecting services requires complex access control and permissions.
• 🤯 Google created a unified database called Janus Graph to manage permissions.
• 👍 Janus Graph stores permissions as relationships between users, resources, and actions.
• 📝 It uses a simple tuple structure: (user, resource, relationship).
• 🌎 Janus Graph is replicated globally for speed and availability.
• ⚡ APIs make it easy for developers to integrate permissions checks.
• ⏩ But every data change requires updating the graph, which can be slow.
• 🤼‍♂️ The graph makes complex permission checks easy, by traversing relationships.
• 🏫 Understanding these designs helps developers plan for scale.

Q & A

What is the name of the service Google created?

Google created a service called Zanzibar to help manage permissions across their products.

How does Zanzibar store permissions?

Zanzibar stores permissions in relational tuples with the document name, user name, and their relationship.