Amazon Technologies, Inc.

David Brian Lennon

Kevin Christopher Miller

Andrew J Doane

Michael Siaosi Voegele

Kyle Tailor Akers

Chao Yuan

Andrew Bruce Dickinson

Patrick Stephenson

Ian Roger Searle

Shane Ashley Hall

Eric Wayne Schultze

Jeremy T Hall

Deepak Mohan

Benjamin David Strauss

Krishna P Balasubramanian

Yohanes Santoso

Daniel Robert Fuller

Daniel Lee McCarriar

Michael Tyler Borgerding

Piyush Mathur

Rebecca Claire Weiss

Mark Edward Stalzer

Po-Chun Chen

Michael Brooke Furr

Alexander Justin Penney

Patrick Brigham Cullen

Mahmoud Ali Abuelela

Peter N De Santis

Anish Sukumaran

Steven Gerard Betten

Marwan Salah Oweis

John Ryan Gartrell

Daniel Thomas Robinson

Siddartha Saddala

Gregory David May

Jawash Mohamed

Methods and apparatus that allow clients to connect resource instances to virtual networks in provider network environments via private IP. Via private IP linking methods and apparatus, a client of a provider network can establish private IP communications between the client's resource instances on the provider network and the client's resource instances provisioned in the client's virtual network via links from the private IP address space of the virtual network to the private IP address space of the provider network. The provider network client resource instances remain part of the client's provider network implementation and may thus also communicate with other resource instances on the provider network and/or with entities on external networks via public IP while communicating with the virtual network resource instances via private IP.

Linking resource instances to virtual network in provider network environments

A service implemented at a first isolated virtual network of a provider network is added to a database of privately-accessible services. Configuration changes that enable network packets to flow between the first isolated virtual network and a second isolated virtual network without utilizing a network address accessible from the public Internet are implemented. Service requests originating at the second isolated virtual network are transmitted to the first isolated virtual network via private pathways of the provider network. Metrics corresponding to service requests directed from the second isolated network to the service are collected and provided to the respective owners of one or both isolated virtual networks.

Private service endpoints in isolated virtual networks

Methods and apparatus for interfaces to manage inter-regional connectivity for direct network peerings. A system may include a connectivity coordinator, a first resource collection in a first geographical zone and a second resource collection in a second geographical zone. The coordinator implements a programmatic interface defining connectivity operations. The coordinator receives a request via the interface to establish a logically isolated network path to the second resource collection on behalf of a client that has a dedicated physical link set up to connect to the first resource collection. In response to the request, the coordinator performs one or more configuration operations to enable traffic to flow from the client's network to the second resource collection over a logically isolated network path using the dedicated physical link.

Interfaces to manage inter-region connectivity for direct network peerings

Techniques for dynamic allocation of network address spaces in virtual networks implemented in a service provider system are described. Upon a scaling condition of an allocation rule being determined to be satisfied, a network address space of a virtual network can be automatically expanded or contracted. The scaling condition can be specified by a customer associated with the virtual network. The allocation rule may also include a allocation factor that indicates an amount of network addresses that are to be added to or removed from the virtual network.

Dynamic network address space allocation for virtual networks

Techniques for defining and enforcing a set of rules that regulate network activity on a virtual network within a provider are described. An activity rule that regulates network activity on a virtual network within a provider network is received, the virtual network shared by a first customer of the provider network to allow other customers of the provider network to connect resource instances to the virtual network. Network activity data is received from a monitoring agent within the provider network, the network activity data relating to an activity of a first resource instance of a first other customer on the virtual network. The activity of the first resource instance is determined to violate the activity rule. The first resource instance is isolated from at least a portion of the virtual network.

Device isolation within a shared virtual network

Techniques for virtual network address space auto-migration are described. An existing network address space of a virtual network can be automatically migrated to a new network address space. The new network address space can be added to the virtual network, new subnets can be added to the new network address space that mirror existing subnets, and new compute instances can be added to the new subnets that mirror existing compute instances. Subsequent to the auto-migration, the virtual network can be connected with another network that has an address space that conflicted with the previous network address space of the virtual network but not the new network address space.

Virtual network address space auto-migration

Techniques are described for managing customer-specified routing policies for network-accessible computing resources. In some situations, the customer-specified routing policies may be based at least in part on DNS ('Domain Name System') information specified by a customer, such as if the customer specifies one or more target destinations to use with an indicated DNS domain name that are different from the destination IP address(es) provided for that DNS domain name by DNS servers&#x2014;if so, the managing of such a DNS-based routing policy for that customer may include identifying when network-accessible computing resources provided to the customer send electronic communications to that DNS domain name, and causing those electronic communications to be redirected to the customer-specified target destination(s). Such customer-specified target destinations may include, in different situations, final destinations, intermediate destinations, etc., as well as identify particular routes.

Customer-specified routing policies

A subnet of a logically isolated network within a provider network may be shared between client accounts of the provider network. A request to share a subnet of a logically isolated network created for one client account with another client account may be received. A link between an account object for the other client account and a shared subnet object for the subnet may be stored. When a request to host a resource with the subnet is received, an evaluation of the graph may indicate whether the request to place the host is permitted. If permitted, the resource for the other client host may be hosted within the subnet.

Sharing a subnet of a logically isolated network between client accounts of a provider network

Growing community of inventors

Reston, VA, United States of America

David Brian Lennon