Amazon Technologies, Inc.

Aparna Nagargadde

Kevin Christopher Miller

Bashuman Deb

Mark Edward Stalzer

Michael Brooke Furr

Scott King Walker

Preethi Srinivasan

Shane Anil Pereira

Joel C Hegg

John David Backes

Adrian-Radu Grajdeanu

Vladimir Veselov

Anish Sukumaran

Everett Richard Anthony

Christopher Wooram Yi

Sreekanth Reddy Polaka

An automated security assessment service of a service provider network may identify, and notify a customer of, misconfigured VM instances that can be access (e.g., via the Internet). A scanner tool may call an automated reasoning service to identify any VM instances of a customer that can be accessed, and may receive information from the automated reasoning service that is usable to exchange packets with those identified instances. The scanner tool can use the information to send requests to the identified instances. After receiving responses from the identified instances, the scanner tool can store, in storage of a network-based storage service, and in association with a customer account of the customer, encrypted data about the results of the scan (e.g., any VM instances that are vulnerable to attackers), and this encrypted data is thereby accessible to the customer with proper decrypt permissions.

Active scanning tool for identifying customer misconfigurations of virtual machine instances

Systems for performing a security assessment of a target computing resource, such as a virtual machine or an instance of a virtual machine, include a scanning service that facilitates duplication of all or a portion of the target computing resource, and then performs the security assessment on the duplicate computing resource to avoid consuming processing time, processing power, and storage space of the target computing resource. A snapshot of the target computing resource, containing the data necessary to reproduce the portion to be assessed, is captured and used to implement the duplicate computing resource in newly allocated resources. The snapshot can be an image of a logical volume implementing the target computing resource. To reproduce a target virtual machine, the snapshot may include a configuration used to instantiate the target virtual machine; the scanning service may implement a duplicate virtual machine that is instantiated with the same configuration.

Security assessment of virtual computing environment using logical volume image

Devices and methods are provided for determining computer resource connectivity and providing computer resource protection. A computer system may identify a first indication of each network configuration between a computing resource and a data resource. The system may identify a second indication of a request for credentials associated with accessing at least one of the computing resource or the data resource. The system may determine an action including accessing the computing resource and the data resource using a network configuration and a credential. The system may determine that the action has occurred a number of times that is less than a threshold. The system may cancel a credential or network configuration associated with the action.

Computer resource vulnerability assessment and remediation

A network-based services platform receives a template that at least partially indicates an application to be performed, a service type, and at least one service parameter associated with the service type. The platform identifies one or more available network-accessible services corresponding to the service type, and assigns the identified network-accessible service to be used by the application. Each identified network-accessible service includes at least one service parameter.

Selecting platform-supported services

Customers of a computing resource service provider may operate one or more computing resource provided by the computing resource service provider. In addition, the customers may execute agent using the one or more computing resources provided by the computing resource service provider. Operational information from customer-operated computing resources may be obtained by the agents and evaluated for security threats. The operational information may be evaluated based at least in part on a set of security rules. The security rules may be generated at least in part on customer input to generate customer defined security rules.

Runtime behavior of computing resources of a distributed environment

Remote computing resource service providers allow customers to reduce overhead by using computing resources shared with other customers. Customers communicate with the computing resources over a network, such as the Internet, these networks enable the use of remote computing resources but do experience errors. To ensure access to resources by the customer, a network troubleshooting service allows the customer to determine connectivity between computing resources and provides operations to the customer that when performed establish connectivity between computing resources. Furthermore, monitoring of connectivity once a connection is established ensures that the resources maintain connectivity.

Troubleshooting network paths in a distributed computing environment

Systems and method for the management of virtual machine instances are provided. A network data transmission analysis system can host virtual machine networks. A component of a hosted virtual machine network is configured in a manner to receive commands directed towards a simulated network device. The component may then execute a process or processes on the hosted virtual machine network which correspond to the received command.

Interaction with a virtual network

A network-based services platform is configured to receive an application template that specifies characteristics of desired network-accessible service components for use by a network-based application. The network-based services platform searches from available services to find those having characteristics that are compatible with those specified by the application template, and returns an indication of the matching services to a client or developer.

Various electronic resources, such as multi-tenant or cloud resources, can be pooled together for access by specified members associated with a given pool. For example, users with access to different resources can enable their resources to be pooled together for purposes such as reduced pricing and increased flexibility. In some instances, a user can pool resources configured for a particular purpose, such that the user can effectively lease out an entire environment. The users accessing the pool can pay for some or all portion of the cost of the resources during the period of usage.

Resource pooling and subletting from user to another user

Disclosed are various embodiments for configuring virtual private networks (VPNs). A request is made, through a service call, for creation of a VPN through a client VPN gateway and a server VPN gateway. In response to the service call, a generic gateway configuration document is received. The generic gateway configuration document is applicable to the client VPN gateway. The generic gateway configuration document is translated to a device-specific gateway configuration document.

Automatically configuring virtual private networks

A direct network connection is established between a customer network and a service provider network. Computing resources are then provisioned in the service provider network in an automated fashion. The network connection between the service provider network and the customer network is also configured such that data can be transmitted from one of the computing resources to another one of the computing resources by way of at least a portion of the customer network. Test data is then transmitted from one computing resource to another computing resource by way of at least a portion of the customer network. One or more test results are then generated based upon characteristics of the transmission of the test data from one resource to the other resource by way of the customer network. The resources may be de-provisioned in an automated fashion following completion of the testing.

Automated testing of a direct network-to-network connection

Distributed computer systems prepare and instantiate snapshots by processing sets of nodes representing computer resources that are portions of a larger system. A user may choose to prepare or instantiate a snapshot containing all or only a portion of the data within the distributed computer system, such as a template of the distributed computer system. A template snapshot may be available in an electronic marketplace for other users to purchase and instantiate into a replica of the distributed computer system.

Distributed computer system snapshot instantiation with variable depth

Systems and methods involve receiving a connectivity subscription request for one or more connections, such as a virtual private network (VPN) connection. A connectivity subscription request may be received through an application programming interface (API) call and the connectivity subscription request may indicate that a user associated with a connection wants to receive a notification when a connectivity event occurs. A connectivity event can occur when changes to the connection are detected, such as when the connection becomes active, when the connection becomes inactive, or when one or more tunnel connections related to the connection becomes disconnected. A potential problem associated with the connectivity event may be detected and a potential solution to the problem may be determined. The potential solution can be sent to a user associated with the connectivity event.

Growing community of inventors

Herndon, VA, United States of America

Aparna Nagargadde