Amazon Technologies, Inc.

Christopher Whitaker

Reto Kramer

Venkates Paramasivam Balakrishnan

Avinash Jaisinghani

Prashant Jayaraman

Richard Curtis Edwards, Jr

Adam M Thomas

Daniel Lee Osiecki

Nishanth Shankaran

Julien Jacques Ellie

Quan Binh To

Zachary Thomas Crowell

Benjamin David Newman

Jaykumar Harish Gosar

Geoffrey Scott Pare

Blake Meike

Jeffrey Lloyd Baker

Danny Rabbani

Frederik Christophe Delacourt

Mahendra Manshi Chheda

Sheshadri Supreeth Koushik

Rajesh Viswanathan

Tanya Bansal

Veeraraghavan Vijayaraj

Pete Peerapong Janes

Chetan Manohar Dandekar

Frank Stienhans

Matthew John Hinkle

Venkates P Balakrishnan

Systems and methods are described for enabling users to model security resources and user access keys as resources in a template language. The template can be used to create and update a stack of resources that will provide a network-accessible service. The security resources and access keys can be referred to in the template during both stack creation process and the stack update process. The security resources can include users, groups and policies. Additionally, users can refer to access keys in the template as dynamic parameters without any need to refer to the access keys in plaintext. The system securely stores access keys within the system and allows for templates to refer to them once defined. These key references can then be passed within a template to resources that need them as well as passing them on securely to resources like server instances through the use of the user-data field.

Template representation of security resources

Systems and methods are described for bootstrapping an application with metadata specified in a template. The template specifies a stack of resources that will be used to execute an application and also includes a set of metadata for customizing the resources and the application. When the system receives the template, it instantiates a compute node which will execute the application. The compute node may contain at least one initialization script for bootstrapping the application with the metadata contained in the template. This functionality allows users to bootstrap the application running on the compute node with data from within the template that was used to create the stack of resources for executing the application. In this manner, metadata, configuration files, package names and versions can be passed by the application owner to the remote compute node.

Using scripts to bootstrap applications with metadata from a template

A resource provisioning service allows users to provision multiple, different network resources in an atomic manner and with a single call to a resource provisioning service. In some instances, the multiple, different network resources comprise individual types of resources that form a portion of one or more cloud-computing platforms. For instance, one or more entities may host and operate a cloud-computing platform that includes different types of network resources, such a storage service, a load balancing service, a compute service, a security service, or any other similar or different type of network-accessible service.

Provisioning multiple network resources

A service provider system may implement an enterprise catalog service that manages catalogs or portfolios of software products (e.g., desktop applications and server products) on behalf of service provider customer organizations. Through the enterprise catalog service, an administrator in a customer organization may discover, select, and ingest products (e.g., based on their features, pricing, and terms), and may add them to catalogs or portfolios for subsequent use by end users in the organization. The administrator may apply constraints on product use and limit product access to particular end users. The products may include third party products that are made available through the enterprise catalog service and a customer's own applications. The enterprise catalog service may monitor usage of third party products and bill the customer organization. Products managed by the enterprise catalog service may be deployed through an application fulfillment platform or resource stack management platform.

Catalog service platform for deploying applications and services

Techniques are described that enable a user to upgrade a stack of resources by providing a template that reflects the desired end state of the stack. Upon receiving a new template, the system automatically detects changes that should be performed and determines the order in which the changes should be performed. The system can also detect if the desired changes to the stack are a result of direct modifications; because parameters to the resources have changed; or the changes are indirectly caused by other dependency/attribute changing. Additionally, the system determines whether the changes require creating new resources or if the changes can be made to the resources live. In case of replacement of resources, the system will first create the new resource, move that new resource into the stack and remove the old resource(s). In case of failures, the system ensures that the stack rolls back to the initial state.

Using a template to update a stack of resources

Technologies are disclosed herein for providing an asynchronous fleet configuration service for deploying and updating a fleet of network resources. The asynchronous fleet configuration service exposes an asynchronous application programming interface (API) that allows for individual resources to indicate an initialization status. Accordingly, the asynchronous fleet configuration service can asynchronously monitor the status of individual resources being deployed or updated, while performing other duties related to the fleet of network resources.

Asynchronous fleet configuration service

A service provider system may implement a notification service that manages actionable notification messages received from other services on behalf of a customer organization and its end users. An IT administrator of the customer organization may create and configure message inboxes to be maintained by the notification service. The messages stored in each inbox may be partitioned by source, type, targeted (authorized) recipients, or an associated message topic. Each message may include an identifier of the inbox to which it is directed, and active elements that, when selected by a recipient, cause a corresponding action to be performed. The service from which a message is received may, in response to a message recipient taking one of the available actions, submit a request to the notification service to update the message state. The notification service may provide APIs through which the other services and message recipients interact with the notification service.

Notification service for managing actionable messages from backend services

A service provider system may implement an enterprise catalog service that manages software products and portfolios of software products on behalf of service provider customer organizations. Through an administrator interface of the service, a customer organization administrator may create constraints on the use of the software products, and each constraint may include one or more rules about how the products can be launched. These may include environmental constraints (specifying a region in which a product launches), restrictions on input parameter values (including the types of resource instances on which a product can be launched), quotas (controlling the number of product installations), or billing constraints. Constraints may be applied on a user-to-product arc or on a portfolio-to-product arc. Constraints may be stored as objects, and reference to those objects may be added to product or portfolio objects. Constraints may be shared across object versions, portfolios, or service provider customer accounts.

Constraints and constraint sharing in a catalog service platform

A service provider system may implement an approval service that manages approval requests received from other services on behalf of a customer organization and its end users. An administrator in the organization may create approval templates that define voting strategies at multiple approval levels and associate them with particular requests (individually, or by product, portfolio, project, action, message topic, workflow, or request type). The administrator may create approval groups whose members are authorized to respond to particular requests. Each approval template (or approval level) may include a different voting strategy or be associated with a different approval group. The approval system may support pre-notification of subsequent approval levels, auto-escalation, or auto-expiration. The approval service may employ a notification service to manage actionable notification messages that include approval requests. Members of approval groups may retrieve requests and select from available actions (e.g., approve, deny, or request more information).

Approval service in a catalog service platform

A configuration management system may receive information defining a threshold range of deviation from a baseline configuration of at least one computing resource. The system may acquire periodic records of configuration information, from which it may be determined if the current configuration at least one computing resource has deviation from the baseline outside of the tolerated threshold. A record indicative of a prior configuration within a threshold configuration deviation may be identified. A template may be formed based on the record. The at least one computing resource may be reconfigured, based on the template, to be within the threshold configuration deviation.

Computing resources checkpoint restoration

A resource stack managed by a resource stack provider is created based on a resource stack template that integrates a custom resource from a second provider into the resource stack using a notification system with the second provider. For example, a customer may create a template that defines a resource stack that comprises resources available from the resource stack provider and one or more custom resources provided by a second provider. When a resource stack is created, resources available from the resource stack provider may be provisioned. Custom resources may be initialized by notifying the provider of the custom resource of the requested integration of the custom resource with the resource stack and requested configuration details. The custom resource provider may respond with an indication of successful integration when the custom resource has been successfully initialized. After initializing the resources, the resource stack may be enabled for use.

Custom resources in a resource stack

Methods, systems, and computer-readable media for implementing template generation for deployable units are disclosed. An indication of a deployable unit is received by a catalog system. A deployment template is generated that represents one or more directives for deploying the deployable unit. The deployment template is generated based at least in part on analysis of the deployable unit by the catalog system. The deployable unit is deployed to one or more resources of a multi-tenant provider network. The deployable unit is deployed based at least on part on the directives of the deployment template.

Template generation for deployable units

In a provider network, recommendations pertaining to resources associated with a customer of the provider network is determined. The recommendations are determined based on an analysis of the resources, a requested use of the resources, and industry best practices associated with the requested use, architectural guidance, cost parameters, and policies, among others. An interface configured to provide the recommendations pertaining to the resources and the requested use is provided. A template based on the recommendations is provided and associated with the customer. The template is usable to configure an instantiation of a resource by the provider network.

Growing community of inventors

Sammamish, WA, United States of America

Christopher Whitaker