Amazon Technologies, Inc.

Anthony Nicholas Liguori

Matthew Shawn Wilson

Nafea Bshara

Ian Paul Nowland

Marc Stephen Olson

Eric Jason Brandwine

Marc John Brooker

Mark Bradley Davis

David R Richardson

Brian William Barrett

Danny Wei

Christopher Magee Greenwood

Douglas Stewart Laurence

James Michael Thompson

Joseph Elmar Magerramov

Surya Prakash Dhoolam

Stewart Allen

Darin Lee Frink

Asif Khan

Jason Alexander Harland

Barak Wasserstrom

Filippo Sironi

Jan Hendrik Schoenherr

Konrad Jan Miller

Karimallah Ahmed Mohammed Raslan

Adi Habusha

Georgy Machulsky

Jaspal Kohli

Eric Samuel Stone

Yaniv Shapira

Mikhail Danilov

Raviprasad Venkatesha Murthy Mummidi

Saar Gross

Clint Joseph Sbisa

Ziv Harel

Andrew Davenport

Ciprian Dan Cosma

Steven Anthony Kady

Diwakar Gupta

Norbert Paul Kusters

Robert Michael Johnson

Islam Mohamed Hatem Abdulfattah Mohamed Atta

Shuvabrata Ganguly

Nachiappan Arumugam

Yang Lin

Richard Hazen Galliher, Iii

Uwe Dannowski

Dheerendra Talur

David James Goodell

Hani Ayoub

Ronen Shitrit

Venkat Maithreya Paritala

William Ashley

Patrick John Lawrence

Erez Izenberg

Robert Charles Swanson

Upendra Bhalchandra Shevade

David James Borland

Nachiketh Rao Potlapally

Alan Michael Judge

Said Bshara

Avigdor Segal

Michael Brooke Furr

Michael Jon Moen

Rahul Gautam Patel

Nishant Kanaiyalal Mehta

Derek Del Miller

David Wachtfogel

Gourav Roy

Matthew B Barr

Erez Tsidon

Daniel T Marquette

Joshua Benjamin Levinson

Julien Ridoux

Kevin P Smith

Asif Kahn

Jonathan Chocron

Marc Bowes

Yotam Admon

Jonathan Welter Mullen

Ravi Akundi Murty

Stephen David Hildrey

Steven Douglas Robinson

Vitaly Ostrovsky

Tal Avraham

Tatiana Cooke

Abhishek Katuluru

James Alexander Morle

Nishant Mehta

Jan Schoenherr

Compact hosting of database query processors is performed using virtualization snapshots. When a request to access a database is received via a previously established connection from a client for an idle query processor that is not currently executing, a virtualization snapshot may be identified that is associated with the idle query processor. The virtualization snapshot of the query processor may be used to restore the query processor into virtual execution on a host system for the database using an origin snapshot that shares clean pages across multiple query processors on the host system. The request may be performed by the restored query processor in virtual execution on the host system.

Compact hosting of database query processors using virtualization snapshots

An interposer card and a virtualization offloading card are provided for installation in a third-party server to integrate the third-party server into a cloud service provider network. The interposer card includes a baseboard management controller that interfaces with a management console of the cloud service provider network. This allows the third-party server to be converted into a server controlled by the cloud service provider network. Additionally, the baseboard management controller of the interposer card acts as a firewall between the third-party server and a management control network of the cloud service provider network. The interposer card and the virtualization offloading card are installed in a chassis of the third-party server via an expansion slot without requiring modification of the hardware or firmware of the third-party server.

Hardware for integration of servers into a management network

A request to launch a compute instance is received at a control plane of a provider network. At an outbound command communicator, an indication that a compute instance is to be established at a target host at a client premise is obtained. A first address is associated with the target host at the control plane and also assigned to the communicator. A message with a second address within a first network of the client premise as a destination is transmitted. The message comprises a command to establish the compute instance at the target host. The first address is assigned to the target host within a second network of the client premise. Processing of the command at the target host results in establishment of a compute instance.

Provider network service extensions

A networking manager of an extension server of a virtualized computing service detects that a data link layer frame has been obtained at the extension server. The networking manager delivers at least a portion of contents of the frame to a compute instance running at the extension server in response to determining that a destination media access control (MAC) address of the frame matches a MAC address of a local-premise-access virtual network interface attached to the compute instance. The local-premise-access virtual network interface is not assigned an Internet Protocol (IP) address from a range of IP addresses managed by the virtualized computing service.

Virtual network interfaces for managed layer-2 connectivity at computing service extension locations

Techniques for compiling firewall rules into byte code or assembly code that can be loaded into cache memory of a processor and executed to evaluate received data packets. Rather than representing firewall rules in mid- or high-level languages stored in main memory, the techniques described herein include compiling the firewall rules into bytecode or assembly code, and distributing the code to the data plane. A packet-processing device may load the code representing the firewall rules into instruction cache of the processor. Further, the packet-processing device receives a data packet and extracts packet context data indicating attributes of the packet, and load the packet context data into a data cache of the processor. The processor can then execute the byte code or assembly code representing the firewall rules to evaluate the packet context data without having to access main memory to determine whether allow or block the data packet.

Compiling firewall rules into executable programs

A peripheral device may implement storage virtualization for non-volatile storage devices connected to the peripheral device. A host system connected to the peripheral device may host one or multiple virtual machines. The peripheral device may implement different virtual interfaces for the virtual machines or the host system that present a storage partition at a non-volatile storage device to the virtual machine or host system for storage. Access requests from the virtual machines or host system are directed to the respective virtual interface at the peripheral device. The peripheral device may perform data encryption or decryption, or may perform throttling of access requests. The peripheral device may generate and send physical access requests to perform the access requests received via the virtual interfaces to the non-volatile storage devices. Completion of the access requests may be indicated to the virtual machines via the virtual interfaces.

Virtualizing non-volatile storage at a peripheral device

Systems and methods are described for reducing latency to service requests to execute code on an on-demand code execution system by maintaining snapshots of virtual machine instances in a ready state to execute such code. A user may submit code to the on-demand code execution system, which code depends on other software, such as an operating system or runtime. The on-demand code execution system can generate a virtual machine instance provisioned with the other software, and initialize the instance into a state at which it is ready to execute the code. The on-demand code execution system can then generate a snapshot of the state of the instance, and halt the instance. When a request to execute the code is received, the snapshot can be used to quickly restore the instance. The code can then be executed within the instance, reducing the need to initialize the instance or maintain the instance in an executing state.

Reducing execution times in an on-demand network code execution system using saved machine states

Various embodiments of apparatuses and methods for multi-cast, multiple unicast, and unicast distribution of messages with time synchronized delivery are described. In some embodiments, the disclosed system and methods include a reference timekeeper providing a reference clock to one or more host computing devices. The one or more host computing devices host compute instances, and also contain respective isolated timing hardware outside the control of the compute instances. The isolated timing hardware of the one or more host computing devices then receive respective packets, and obtain the same time to deliver the respective packets. Each isolated timing hardware provides either the packet, or information to access the packet, to its respective destination compute instance subsequent to determining that the same specified time to deliver the packet has occurred. Thus, the respective packets are delivered near simultaneously to the one or more destination compute instances.

Distribution of messages with guaranteed or synchronized time of delivery

A first service of a provider network obtains an identification of one or more substrate addressable devices included in an extension of the provider network. Based on the identification, a launch of one or more compute instances within the provider network is initiated. The one or more compute instances are to connect the provider network to the extension of the provider network across at least a third-party network by receiving a first control plane message directed to a first substrate addressable device of the one or more substrate addressable devices, by updating a message state data store based at least in part on the first control plane message, and by sending a second control plane message to the first substrate addressable device via a secure tunnel.

Provider network connectivity management for provider network substrate extensions

A first block storage server virtual machine to host a first volume using one or more storage devices of a computer system is executed by the computer system. A second virtual machine having access to a virtual block storage device is executed by the computer system. A block storage client is executed by the computer system. A first block storage operation is received by the block storage client from the second virtual machine, the first block storage operation to perform on the virtual block storage device. A message is sent by the block storage client to the first block storage server virtual machine to cause the first block storage server virtual machine to perform the block storage operation with the first volume.

Virtualized block storage servers in cloud provider substrate extension

A peripheral device includes one or more processors and a memory storing program instructions that when executed implement an extension manager of a virtualized computing service. The extension manager establishes a secure network channel for communications between the peripheral device, which is located at a premise external to a provider network, and a data center of the provider network. The extension manager assigns a network address of the substrate network of the service to a hardware server at the external premise. The substrate address is also assigned to an extension traffic intermediary at the data center. In response to a command directed to the virtualized computing service, one or more compute instance configuration operations are performed at the hardware server.

Peripheral device enabling virtualized computing service extensions

A peripheral device includes one or more processors and a memory storing program instructions that when executed implement virtualization offloading components of a virtualized computing service, including a storage manager. The offloading components establish network connectivity with a control plane of the service. Based on detecting that a hardware server, in a separate enclosure, has been linked to the peripheral device, the hardware server is presented as a virtualization host of the service. The offloading components initiate compute instance configuration operations at the server in response to commands issued to the control plane, including at least one configuration operation initiated by the storage manager to enable access to a logical storage device from a compute instance.

Peripheral device for configuring compute instances at client-selected servers

A data storage manager may manage storage locations for blocks of a storage volume. The blocks of the storage volume may be assigned to a logical volume exposed to a computing instance supported by a host. Furthermore, the data storage manager may also generate and maintain a set of rules that specify the locations of blocks of the storage volume, and provides the set of rules to the host. The set of rules may be included in a data structure enabling the host to access the blocks based at least in part on the information included in the set of rules.

Enabling host computer systems to access logical volumes by dynamic updates to data structure rules

Security can be provided for data stored using resources that are deployed in an environment managed by a third party. Physical and logical detection mechanisms can be used to monitor various security aspects, and the resulting security data can be used to identify potential threats to these resources. In some embodiments, suspicious activity can cause resources such as data servers to be automatically and remotely rebooted such that keys stored in volatile memory on those data servers will be lost from those servers, such that an attacker will be unable to decrypt data stored on those servers. Once a determination of safety is made, the keys can be provided to the respective data servers such that data operations can resume.

Managing security in isolated network environments

At a virtualization host, an isolated run-time environment is established within a compute instance. The configuration of the isolated run-time environment is analyzed by a security manager of the hypervisor of the host. After the analysis, computations are performed at the isolated run-time environment.

Verified isolated run-time environments for enhanced security computations within compute instances

Growing community of inventors

Bainbridge Island, WA, United States of America

Anthony Nicholas Liguori