Amazon Technologies, Inc.

Christoph Saalfeld

Alexandra Elizabeth Baoboe Lee

Himanshu Jindal

Tristam Kyle MacDonald

Eeshan Shreeram Thakar

Shyam Krishnamoorthy

Bryant Cutler

James Christopher Sorenson

Kyle Michael Roche

Joshua Marc Burgin

Nicholas Andrew Gochenaur

Joby Sky Lafky

Gary Keith Wicker

Artem Zhurid

Justin Robert Knoepfler

Aniruddha Shriram Daptardar

Shijia Yang

Jared Sharfin

Frank Lovecchio

Qing Ju

Calvin Yue-Ren Kuo

David Craig Yanacek

Derek Solomon Pai

Jin Dong Kim

Rameez Loladia

Dominique Fortier

Mark Edward Rafn

Douglas Cotton Kurtz

Ashutosh Thakur

Stephen Alden Elliott

Anupama Sharma

Aditya Bhalla

Asem Rustum

Venkata Harish Kommaraju

Dmitry Pushkarev

Aditya Subhash Jadhav

Dinkar Pataballa

Saurabh Chatterjee

Aniruddha Shrlram Daptardar

Travis Davidson Bybee

Jason Miguel Loo

A fleet-based migration system is described that can obtain requests to initiate network connections from individual client devices and divide the requests among one or more sets of endpoints with differing configurations. The endpoints initiate connection attempts based on the requests and capture data regarding the connection attempts. Using the captured data, the system can determine incompatibilities between client devices and fleet configurations and inform users of the incompatibility.

Fleet-migration based network compatibility analysis

The present disclosure generally relates to leveraging DNS (Domain Name Service) based client-side load balancing that directs IoT devices (clients) to network load balancer IP addresses. A management system obtains socket usage information about publicly accessible network load balancers. The system then uses socket thresholding information to determine whether individual network load balancers are exhausting a fixed set of available sockets. The system can then implement remedial actions to reduce individual network load balance presence to ensure that the IoT devices are equally distributed across all first layer network load balancers to maximize usage of capacity.

Network traffic distribution for network-based services

After a service receives a request from another service, the service determines an amount of time to process the request by the service as well as a remaining time allotment to complete processing the request (e.g., a timeout value). Based on the remaining time allotment and the amount of time to process the request by at least the service (predicted time or actual time), the service may determine whether to continue processing the request (e.g., by the service and/or one or more subsequent services) or fail the request. In response, the service may then continue processing the request (e.g., continue processing at the service itself or propagate the request to the next service), or the service may fail the request.

Using distributed services to continue or fail requests based on determining allotted time and processing time

An IoT service of a provider network may secure connections with IoT devices that are incapable of encrypted transport layer connections. The IoT service may expose a private endpoint of the IoT service into an isolated virtual network of a client. The provider network may provide a private pathway for traffic between the private endpoint and the isolated virtual network. The IoT service may receive, at the private endpoint from a remote edge device of the client, a request to connect to the IoT service. In response, the IoT network may determine that the request was received from the isolated virtual network of the client. In response to determining that he request was received from the isolated virtual network of the client, the IoT service may authenticate the private endpoint and establish a connection with the remote edge device.

Securing connections with edge devices that are incapable of encrypted transport layer connections

Adaptive load balancing may be implemented for a distributed system. An evaluation of criteria for creating a mapping for an identifier associated with requests may be performed. The created mapping may route requests to a distributed system to request handling nodes that cache request information for performing the requests. When requests are received, if an identifier determined to be associated with the request is mapped to request handling nodes, then the request may be sent to the identified request handling nodes instead of performing a load balancing technique to select a request handling node for the request.

Adaptive load balancing for distributed systems

Systems and methods are provided for dynamically configuring an IoT communications system. The IoT communications system receives a client message from an IoT device. The client message includes an endpoint designation (such as by specifying an endpoint in the Server Name Indication (SNI) field of the TLS client hello message). The IoT communications system determines whether the endpoint is associated with a custom or default processing logic and/or settings. Either custom or default processing logic is executed or custom or default settings are applied.

Configurable internet of things communications system

A message broker of a publish-subscribe messaging system (e.g., using the MQTT protocol or other publish-subscribe protocol) detects a life-cycle event for topic subscription and notifies a publisher of the life-cycle event. The message broker may detect a transition in a number of subscribers to a topic from zero subscribers to one or more subscribers or from one or more subscribers to zero subscribers. In response, the message broker provides an indication to the publisher that the number of subscribers to the topic has transitioned from zero to one or more (or from one or more to zero). This causes the publisher to begin publishing messages on the publisher's topic (or to stop publishing messages on the publisher's topic).

Notifying a publisher of life-cycle events for topic subscription

A technology is described for modifying a message frequency of a device. In one example, a network connection is identified between a device and a service provider environment. A message frequency is set for which to send reachability messages between the device and the service provider environment to maintain the network connection. The reachability messages may be sent between the device and the service provider environment at the message frequency. After testing whether the networking connection is maintained at the message frequency, the message frequency may be modified to a modified message frequency.

Message frequency modification for connection maintenance

A socket service may be used to link a peer socket to another peer socket. The peer socket is for communicating data to and from a client device and the other peer socket is for communicating data to and from another client device. If a socket opens and the corresponding peer socket is not yet open then the socket waits for the corresponding peer socket to open. When a client device requests a socket to be opened, the client device requests a particular client-defined function mapping to be associated with the socket. When the socket is opened, the endpoint specified in the client-defined function mapping is invoked. An identifier associated with the client device is sent to the endpoint. If the endpoint returns a socket identifier for another socket, then the socket service links the peer socket to the other peer socket, linking the client device to another client device.

Socket peering

Compute hosts and a routing system may be used for connection and application state migration for uninterrupted service availability. In response to an indication to transfer a connection from a particular compute host to another compute host, the particular compute host obtains a connection state and an application state for the connection and sends the connection state and the application state to the other compute host. The connection state includes information for a connection-oriented protocol and the application state includes information for an application-layer protocol. The other compute host receives and applies the connection state and the application state in order to establish a termination point to terminate the connection at the other compute host instead of at the particular compute host. The data for the connection is routed to the other compute host, wherein the client is unaware of transfer of the connection to the other compute host.

Connection and application state migration for uninterrupted service availability

A socket service may be used to implement client-defined function mappings (e.g., custom protocols) for sockets hosted by the socket service so that when a particular socket is opened for a particular client device, the socket operates according to a particular client-defined function mapping requested by the particular client device. To establish a particular client-defined function mapping, a socket manager may receive request from a user that specifies a particular endpoint (e.g., a client-registered function). When a client device requests a socket to be opened, the client device requests the particular client-defined function mapping to be associated with the socket. When the socket is opened, the endpoint is invoked. The particular client-defined function mapping may also specify one or more receive criteria for data received at the socket. If the one or more receive criteria is met, the endpoint is invoked by sending the data to the endpoint.

Managed secure sockets

A technology is provided for certificate authentication for registering a certificate in computing service environment. A request may be received to register a certificate authority (CA) certificate. A registration token associated with a customer account in a service provider environment may be generated to enable association of the customer account with the CA certificate and to authenticate a registration of the CA certificate. The registration token may be sent to a requester desiring to register the CA certificate. A verification certificate that contains the registration token and that is signed by a certificate authority (CA) of the CA certificate and the CA certificate that is signed by the CA may be received to register the CA certificate with the customer account within a service provider environment The CA certificate is persisted with the service provider environment after verifying the registration token is associated with the customer account and the CA certificate is signed by the CA.

Certificate registration

This document describes techniques for allocating instances in a service provider network. In an example embodiment, a resource manager provides a number of allocation strategies for determining which instances to assign to a client. The resource manager applies a client selected one of the allocation strategies to assign instances to the client. One of the allocation strategies includes determining for each of a plurality of pools of resource instances, an estimate of time that a unit cost of each of the number of resource instances in the pool will be no more than a maximum unit cost specified by the client. The instances are assigned to the client while the unit cost of the instances is less than a client specified amount.

Strategic resource allocation in a web-based computing system

In a computing environment, a request to fulfill a computational task and a constraint for fulfilling the computational task is received from an entity. The request is independent of the quantity or type of resource slot to fulfill the computation task. The quantity or type of resource slots sufficient to fulfill the request is determined in accordance with a constraint. The resource slots are associated with the entity and allocated a plurality of geographically separate computing environments. Master resource slots are allocated in the geographically separate computing environments based on the criterion and the quantity or type of resource slots. The master resource slots can be reallocated based on changes to the allocated resources slots.

Distributed resource allocation

This document describes techniques for activating multiple interruptible resource instances on servers of a service provider environment. In an example embodiment, a system can activate multiple interruptible resource instances on behalf of a given customer based on a comparison of a bid cost value from the customer to the current, but variable cost value of the interruptible resource instances. The customer also can specify a value indicative of the number of interruptible resource instances to be activated on behalf of the customer based on the bid cost value.

Growing community of inventors

Seattle, WA, United States of America

Christoph Saalfeld