Amazon Technologies, Inc.

Microsoft Technology Licensing, LLC

Amjad Hussain

Sivaprasad Venkata Padisetty

Ido Miles Ben-Shachar

Diwakar Chakravarthy

Steven Merlin Twitchell

Patrick McFalls

Xiong Wang

Ryan John Lohan

Anand Doshi

Anil M Kumar

Sriram Sampath

Tristan William Scott

Mats Lanner

Munindra Nath Das

Daniel Francis Conde

Prabhu Anand Nakkeeran

Manivannan Sundaram

Alan Hadley Goodman

Upender Sandadi

Kevin Scott London

Sergey A Kuzin

Julio Cesar Dos Santos Lins

Jonathan Austin Hoover

Derek Ying Chen Kwiatkowski

Kashif Mehmood

Anantharam Vaidyanathan

Emily Grace Aimette Freebairn

Anupam Shrivastava

Katherine Elizabeth Shaffer

Sundaresan Ramamoorthy

Robert Glenn Hearn

Lavanya Krishnan

Matthew Adam Ford

Samuel Seung Keun Carl

Bor-Ming Hsieh

John Eldridge

Huei Chung Wang

Robert K Leitman

Nikolaos Pamboukas

Ananth Vaidyanathan

Bharath Swaminathan

Aaron Jeremiah Sheldon

Sayali Suhas Deshpande

Susan Annette Loh

Ajay Kumar

Andrew Eremenko

Todd W Squire

Asif Hussain

Rahul Sharma

Mahadeva K Alladi

Travis Michael Howe

Raymond Matthew Reskusich

James Lamar Hood

Alvin K Tan

Sung Wook Kim

James Baker

Christopher T George

Olivier Robert Munn

Xiaodong Ma

Melonia Mendonca

Derek Kwiatkowski

Sami Azzam

Jingyuan Li

Shihua Zhang

Nihar Namjoshi

Christopher Benjamin Black

Ido Ben Shachar

Boyuan Feng

Rahul Garg

Victoria Michelle Jacobson

Sunil Jagadish

Mahadeva Kumar Alladi

Systems and methods provide for submission, verification, and validation of one or more code packages associated with provisioning logic for third-party applications. A user may request verification as a publisher and submit a code package for use with a third-party application within a resource provider environment. The code package may be tested and, upon passing, be published to a public repository for discovery and use by other users. The code package may form part of an extension that is integrated into a template that enables automated provisioning of resources and applications.

Third-party extension integration, verification, and publication for distributed environments

This disclosure describes techniques for resolving discrepancies that occur to interrelated computing resources from computing resource drift. Users may describe computing resources in an infrastructure template. However, computing resource drift occurs when 'out-of-band' modifications are made to the computing resources and are not reflected in the infrastructure template. To resolve discrepancies between the infrastructure template and the out-of-band modifications to the computing resources, a notification may be output to a user account associated with the computing resources detailing the differences. An updated infrastructure template may be received that resolves the differences, such as by including configuration settings that reflect a current state of the computing resources. The computing resources may then execute a workflow using the updated template, such that the workflow is executed on all of the computing resources in a current state.

Resolving configuration drift for computing resource stacks

A state management server applies configuration information to a set of virtual computer system instances in accordance with one or more limitations specified by an administrator. In an embodiment, the limitations include a velocity parameter that limits the number of virtual computer system instances to which the configuration may be applied concurrently. In an embodiment, the limitations include an error threshold that stops the application of the configuration if the number of configuration failures meets or exceeds the error threshold. In an embodiment, the set of virtual computer systems is identified by providing a list of the individual virtual computer system instances, or by specifying one or more tags that are associated with the virtual computer systems in the set. In an embodiment, the administrator is able to specify that an association be applied according to a predetermined schedule.

Reconfiguration rate-control

This disclosure describes techniques for providing users of services provided by network-based service platforms with additional control for approving patches that are to be deployed to computing resources that support their services. In some examples, the techniques include generating and using a 'snapshot,' or list, of patches that are preliminarily approved for deployment. Prior to deploying the patches to the computing resources, users are provided with access to the snapshot and are able to modify the snapshot. For example, users can modify the snapshot by adding patches, removing patches, specifying a sequence in which the patches are to be deployed, and so forth. The snapshot of patches may be 'frozen' for a period of time, meaning that patches that during the period of time, only patches in the snapshot are deployed, and patches that are not included in the snapshot are not permitted to be deployed to computing resources.

Controlling the approval of software updates for computing resources

Systems and methods provide for execution of different provisioning engines within a resource provider environment. A user may submit a request to provision one or more resources using a particular provisioning engine, which may include a provisioning engine that is non-native to the resource provider environment. A control plane may evaluate and transmit requests to the provisioning engine executing within the resource provider environment. Operations associated with the provisioning engine may be executed and stored within a data store, which may be processed upon completion and made accessible.

Provisioning engine hosting solution for a cloud orchestration environment

This disclosure describes techniques for defining a set of permissions, or privileges, for users who manage resources of a network-based service provisioned in a network-based service platform managed by a service provider. The techniques may include mapping cloud identities of the users to operating system (OS) user groups defined local to the resources that specify the set of permissions for user group members. Systems-manager agents that execute locally on the resources may determine to which OS user group the user belongs based on their cloud identity, and launch shells that are restricted by the set of permissions. Using these shells, a network-based service platform may allow users to remotely manage resources of the network-based service in various ways, such as through batch run commands and/or remote user sessions, while ensuring that the users are unable to execute commands on the resources that are outside the set of permissions.

Controlling permissions for remote management of computing resources

Compliance schemes may be associated with compliance types to provide resource compliance management. Compliance types may be created and associated with different compliance schemes. Compliance state for the compliance types may be generated and provided in response to requests to access the compliance state. Queries for compliance state, for example, may request compliance state, and query predicates or other criteria may be applied to the compliance state in order to perform the query.

Extensible resource compliance management

This disclosure describes techniques for testing and publishing of resource handlers in a cloud environment. For example, a code-development interface may be utilized to generate initial code for the building of resource handlers. The initial code may be verified and the resource handlers may be built and deployed to a test platform. One or more execution tests may be run on the resource handlers in the test platform to determine if the resource handlers execute successfully. The resource type associated with the resource handlers may be published to a registry service and the resource type may be made available for provisioning.

Testing and publishing of resource handlers in a cloud environment

A virtual computer system management service receives input from a user specifying operations to be performed by a web-based service. The input includes an indication of a set of resources to be used to perform the operations and control information to control the set of resources to perform the operations. The virtual computer system management service configures the resources to perform the operations according to the control information. This causes the set of resources to perform the operations and provide a result. The virtual computer system management service provides this result to the user.

Customized command execution for a computing resource fleet

Methods, systems, and computer-readable media for resource configuration based on dynamic group membership are disclosed. An association between a group of computing resources and an intended state is stored. The intended state represents a computing resource configuration. During operation of a computing resource, whether the computing resource belongs to the group of computing resources is determined based at least in part on analysis of one or more attributes associated with the computing resource. Based at least in part on determining that the computing resource belongs to the group of computing resources, one or more actions are caused be performed to bring the computing resource into the intended state. The computing resource is executed while having the computing resource configuration represented by the intended state.

Resource configuration based on dynamic group membership

This disclosure is directed to one or more computing services that provide users with secure access to a computing instance, which is auditable and accessible via a cross-platform browser-based shell or command-line interface (CLI). The computing service(s) forego any need to open up inbound ports, thereby improving security. The computing service(s) employ centralized authentication and auditing to ensure compliance with policies and to log activities for auditing, forensics, or other purposes. A message gateway service creates secure channels with a client device and the computing instance to establish a secure communication tunnel between the client device and computing instance. Once the tunnel is established, a user can send a command via the client device to the computing instance, via the message gateway service. The command output is uploaded to this tunnel and is sent back to the client device, via the message gateway service.

Facilitation of secure communications between a client and computing instance

This disclosure describes techniques for centralizing the management of computing resources that are provisioned across multiple service provider networks by infrastructure modeling services. A service provider network may host or provide a centralized management service that supports an open source framework that provides users, or developers, with a unified development interface to manage computing resources that are provisioned in different service provider networks. The unified development interface of the host service provider network may provide users with a meta schema or language format to create infrastructure schemas for modeling, provisioning, and operating computing resources across service provider networks that are managed by different service providers. Additionally, the host service provider network may provide an open provider registry where developers of infrastructure schemas may store and publish infrastructure schemas for the different service provider networks to share computing resource types with other developers or users of cloud-based services.

Centralized management of computing resources across service provider networks

Techniques for operating a multi-homed computing instance process are described herein. First credentials associated with a first attribute of a first account may be obtained. A process executing on a computing instance may communicate with the first account over a first communication channel based at least in part on the first credentials. Instructions may be received for the process to communicate with both the first account and a second account. Second credentials associated with a second attribute of the second account may be obtained. The second credentials may be obtained based, at least in part, on the first attribute acquiring the second attribute. The process may communicate with the second account over a second communication channel based at least in part on the second credentials. Additionally, the process may communicate with multiple different representations of a particular account, such as different representations that are hosted in different respective regions.

Multi-homed computing instance processes

Growing community of inventors

Bellevue, WA, United States of America

Amjad Hussain