Amazon Technologies, Inc.

Brian Frederick Mulder

Joshua Dawie Mentz

Ross Bevan Engers

Ronen Dov Agranat

Willem Jacob Buys

Timothy Ralph Sjoberg

Stefan Letz

Daniel Bauman

Aidan Musnitzky

James Alfred Gordon Greenfield

A method for data aggregation of declassified sensitive data may include obtaining a policy associated with an isolated region of a service provider. The policy may identify a plurality of rules for declassifying sensitive data accessible within the isolated region. At least a portion of the plurality of rules identified by the policy may be obtained. A file with the sensitive data may be identified, the file being generated within the isolated region. An output file may be generated based on applying the obtained rules to the file. At least a portion of the sensitive data may be filtered out using the obtained rules. The generated output file may be provided for access outside of the isolated region. The sensitive data may be inaccessible by at least another region of the service provider.

Policy based data aggregation

A distributed execution environment provides resources such as computing resources, hardware resources, and software resources. Resource action rules ('rules') may be defined and associated with resources in the distributed execution environment. The rules may be evaluated based upon resource state data defining the state of one or more resources. The results of the evaluation of the rules may be utilized to take various actions. For example, the results of the evaluation of rules may be utilized to generate a user interface (UI) object for providing information regarding the evaluation of the rule, to initiate a workflow, and/or perform another type of action. The results might also be utilized to prohibit certain types of operations from being performed with regard to a resource. The results might be propagated to other resources. A UI might also be provided for use in defining the rules.

Rule-based actions for resources in a distributed execution environment

Entities such as resource and service providers can utilize a ticketing system to define operational actions as primitives that can be stored, combined into more complex workflows, and executed in a restricted zone wherein a portion of the resources or services are not directly accessible to those providers. These primitives can be stored in the provider environment and shared with the restricted zone, in order to provide a structured approach to the sharing of operational knowledge. When a primitive is first received to the restricted zone, a person vetted by the customer associated with the restricted zone can review and approve the primitive, and can cause the primitive to be executed in the restricted zone. When that same primitive is subsequently received to the restricted zone, a lookup can be performed to determine that an approval exists, whereby the primitive can be executed in the restricted zone without another review.

Managing restricted access resources

A computer-implemented method includes recording one or more actions being performed by an agent using at least one resource of a resource provider environment, the at least one resource being associated with a non-restricted zone in the resource provider environment. The method includes creating a primitive that describes the one or more actions. The primitive is able to be executed on at least one different resource in a restricted zone in the resource provider environment to perform the one or more actions using the different resource. The restricted zone includes resources associated with a customer that are directly accessible only to at least one authorized entity. The method includes submitting the primitive to the restricted zone in the resource provider environment. The primitive is able to be executed by the at least one authorized entity on the at least one different resource in the restricted zone.

Growing community of inventors

Western Cape, South Africa

Brian Frederick Mulder