Amazon Technologies, Inc.

Andrew Bruce Dickinson

Eric Jason Brandwine

Kevin Christopher Miller

Ian Roger Searle

David Brian Lennon

Shane Ashley Hall

Christopher Ian Hendrie

Eric Wayne Schultze

Arijit Ganguly

Christopher J Lefelhocz

Bradley D Roberts

Douglas Stewart Laurence

Colin John Whittaker

Kirk Arlo Petersen

Manish Agarwal

Daniel Todd Cohn

Bashuman Deb

Thomas Bradley Scholl

Richard Alexander Sheehan

Marwan Salah EL-Din Oweis

Deepak Mohan

David Carl Salyers

Eric Paul Wei

Michael Siaosi Voegele

Aniket Deepak Divecha

Joseph Paul Zipperer

Xiao Zhang

Ralph William Flora

Colin Whittaker

Tobias Lars-Olov Holgers

Matthew Shawn Wilson

Michael Phillip Czamara

Rebecca Claire Weiss

Joseph Elmar Magerramov

John William Eichelberg

Peter John Hill

Frederick David Sinn

Anoop Dawani

Nishant Kanaiyalal Mehta

Kyle Tailor Akers

Yohanes Santoso

Chao Yuan

Matthew Dean Rehder

Paul A Stancik

Albert Park Niemoller

Lee Spencer Dillard

Travis Steven Pepper

Bradley Kirk Roberts

Eduardo Manuel Parra

Daniel Lee McCarriar

Richard M Lotz

Samuel Joseph Mortimer

Joseph James Lindsay

Daniel J Rohrabaugh

Diwakar Gupta

James Christopher Sorenson

Pradeep Vincent

Jagwinder Singh Brar

Alan Michael Judge

Richard Jeffrey Cole

Justin Oliver Pietsch

Aaron Craig Thompson

Vishal Parakh

Brian James Schuster

Benjamin Tobler

Richard Hazen Galliher, Iii

Mahmoud Ali Abuelela

Christopher Thomas

Andriy Palamarchuk

Justin Canfield Crites

James A G Greenfield

Daniel Robert Fuller

Steven Gerard Betten

Llewllyn J Mason

Mark Jacobson

Rajagopal Subramaniyan

Avik Kumar Saha

Raj K Kizhakkekalathil

Michael Tyler Borgerding

Piyush Mathur

Faisal M Bhamani

Edwin S Hong

Karen R Haberkorn

Mike Perkowitz

Brett Steven Nash

Todd Freed

Christopher Carson Thomas

Colin J Whittaker

Methods and apparatus that allow clients to connect resource instances to virtual networks in provider network environments via private IP. Via private IP linking methods and apparatus, a client of a provider network can establish private IP communications between the client's resource instances on the provider network and the client's resource instances provisioned in the client's virtual network via links from the private IP address space of the virtual network to the private IP address space of the provider network. The provider network client resource instances remain part of the client's provider network implementation and may thus also communicate with other resource instances on the provider network and/or with entities on external networks via public IP while communicating with the virtual network resource instances via private IP.

Linking resource instances to virtual network in provider network environments

Systems and methods utilize network destination identifiers, such as IP addresses, that are simultaneously advertised from multiple locations. The network destination identifiers may be announced in multiple geographic regions. Network traffic routed to devices advertising the network destination identifiers may be routed to appropriate endpoints. When a device receives such traffic, it may send the traffic to an endpoint in a network served by the device. In some instances, such as when such an endpoint is not available, the network traffic may be sent to another network that is served by another device that advertises the network destination identifiers.

Techniques for utilizing network destination identifiers simultaneously announced from multiple locations

In accordance with a designation of a private alias endpoint as a routing target for traffic directed to a service from within an isolated virtual network of a provider network, a tunneling intermediary receives a baseline packet generated at a compute instance. The baseline packet indicates a public IP (Internet Protocol) address of the service as the destination, and a private IP address of the compute instance as the source. In accordance with a tunneling protocol, the tunneling intermediary generates an encapsulation packet comprising at least a portion of the baseline packet and a header indicating the isolated virtual network. The encapsulation packet is transmitted to a node of the service.

Private alias endpoints for isolated virtual networks

Disclosed are various embodiments of a stateful network router. In one embodiment, a network data connection is intercepted between a first host and a second host on a network. First data packets from the network data connection sent by the first host to the second host are routed to a target network appliance. Second data packets from the network data connection sent by the second host to the first host are also to the target network appliance.

Stateful network router for managing network appliances

Methods and apparatus for private network peering in virtual network environments in which peerings between virtual client private networks on a provider network may be established by clients via an API to a peering service. The peering service and APImay allow clients to dynamically establish and manage virtual network transit centers on the provider network at which virtual ports may be established and configured, virtual peerings between private networks may be requested and, if accepted, established, and routing information for the peerings may be specified and exchanged. Once a virtual peering between client private networks is established, packets may be exchanged between the respective client private networks via the peering over the network substrate according to the overlay network technology used by the provider network, for example an encapsulation protocol technology.

Private network peering in virtual network environments

Route tables may be associated with ingress traffic for logically isolated networks. A routing device at the edge of a logically isolated network may receive a route to include in a route table that is associated with ingress traffic to the logically isolated network to forward the ingress traffic to a network appliance hosted in the logically isolated network. Network packets received at the edge routing device may have a destination of a computing resource hosted in the logically isolated network. The edge routing device may identify the route in the route table to override the destination in the network packet with the network appliance and forward the network packet to the network appliance according to the route.

Associating route tables with ingress traffic to logically isolated networks

Satellites provide communication between devices such as user terminals (UTs) and ground stations that are connected to points-of-presence (PoP) connected to other networks, such as the Internet. The PoP accepts downstream data addressed to the UT. A representation of the communication resources that are expected to be used to pass the downstream data from the PoP to the UT is determined and executed on one or more processors. The representations may include representations of traffic shapers, modems, and so forth at different points in the network. The representations may consider real-world and simulated feedback data. Within the representation, traffic shaping is employed to determine preshaped data that includes resource metadata designating the communication resources to be used. The preshaped data is passed along to the actual communication resources for subsequent delivery. The preshaping substantially improves performance of constrained communication resources. The preshaped data may be reshaped as real-world conditions change.

System to preshape data sent via satellite

Satellites provide communication between devices such as user terminals (UTs) and ground stations that are in turn connected to points-of-presence (PoP) that connect to other networks, such as the Internet. Many factors affect latency for data passing between the PoP and the UT. The PoP accepts downstream data addressed to the UT and determines a target delivery window (TDW) indicating a window of time within which the downstream data is expected to be delivered. Communication resources are allocated to the downstream data based on the TDW. At subsequent points, such as at the ground station, the TDW is assessed to determine whether to continue sending the downstream data or to use a different communication resource. For example, a first ground station will forward the downstream data to a second ground station if the uplink will not be able to deliver the downstream data before expiration of the TDW.

System to manage satellite communications

Techniques are described for managing communications sent to and/or from multiple computing nodes, such as for a group of computing nodes that are part of one or more private networks. In at least some situations, the techniques are used in conjunction with providing network address translation ('NAT') functionality to a group of computing nodes that share one or more networks, such as to provide NAT functionality in a distributed and asymmetric manner using multiple computing devices that perform different types of operations at different locations within the private network.

Managing communications between computing nodes

Disclosed are various embodiments of a stateful network router. In one embodiment, a stateful network router intercepts a network data connection between a first host and a second host on a network. The stateful network router routes first data packets from the network data connection sent by the first host to the second host to a target. The stateful network router also routes second data packets from the network data connection sent by the second host to the first host to the target.

Bypass flow may be enabled for network traffic between devices. A source device may include a flow identifier in an outbound packet that is sent to a destination device. An inbound packed sent from the destination device may include information that describes a network path between the source device and the destination device. Subsequent outbound packets bound for the destination device may be rewritten based on the information describing the network path to bypass one or more network devices in the network path.

Enabling bypass flows for network traffic between devices

A flow policy service that allows clients to define policies for packet flows to, from, and within their virtual networks on a provider network. Logic may be embedded in a flow policy that dictates what happens to a packet as it enters the network, or after the packet leaves an appliance. Via the service, a client may define conditional rules that specify different paths that packets should follow on the provider network according to conditional evaluations of information about the packets, for example source and/or destination endpoints of the packets, or output codes from appliances that process the packets.

Conditional flow policy rules for packet flows in provider network environments

Growing community of inventors

Seattle, WA, United States of America

Andrew Bruce Dickinson