Amazon Technologies, Inc.

David Craig Yanacek

Wei Xiao

Miguel Mascarenhas Filipe

Timothy Andrew Rath

David Alan Lutz

Maximiliano Maccanti

Kyle Michael Roche

Prashant Pandey

Khawaja Salman Shams

Swaminathan Sivasubramanian

Johanna S Olson

Omer Ahmed Zaki

Pejus Manoj Das

Johnny Ying Wu

Stuart Henry Seelye Marshall

Hendrik De Kock

Stefano Stefani

Matthew James Wren

Kiran-Kumar Muniswamy-Reddy

Samuel John Young

Yijun Lu

Jai Vasanth

Adam Douglas Morley

David Andrew Killian

Bjorn Patrick Swift

Eric D Crahen

Usman Ahmed Shami

Juan Antonio Sanchez

Amit Raghunath Kulkarni

Paul Lee Coleman, Iv

Mohammad Zeeshan Qureshi

Naveen Dasa Subramanyam

Sean Tyler Myers

Aritra Bandyopadhyay

Jianwei Cui

Krishnan Narayanan

Antony Didier Maurice Passemard

Drew Evan Atkin

Yogesh Aggarwal

James Christopher Sorenson

William Alexander Strand

Michael Martin George

Jonathan I Turow

Gustavo Eduardo Lopez

Benjamin Aldouby Schwartz

Rameez Loladia

Christoph Saalfeld

Steven Todd Rabuchin

Khai Tran

Fahad Ahmed

Alexandra Elizabeth Baoboe Lee

Alexander Slutsker

Osman Surkatty

Tristam Kyle MacDonald

Mark Ryland

Gary Keith Wicker

Aanchal Gupta

Andrew Desmond Budiman

Hendrik Jacobus De Kock

Jeffrey Hocheng Nieh

Brandon Yarbrough

Dinkar Pataballa

A network-connected device service receives a request to establish a communications session with a network-connected device. In response to the request, the service transmits a set of electronic messages to the network-connected device through an access point of the network-connected device to establish the communications session. The network-connected device service receives a notification from the network-connected device indicating whether the communications session has been established. If so, the service provides an indication to a controlling device that the session has been established. This enables the controlling device to submit commands executable by the network-connected device to the service, which provides the commands to the network-connected device through the access point.

Enabling communications between a controlling device and a network-controlled device via a network-connected device service over a mobile communications network

A structured data store service, such as a database service, may implement fine-grained access to data maintained at the database service using federated identity. Fine grained access requests may be received at a database service for specified data maintained for an application provider from a client of the application provider. An access credential may be also be received. Verification of the access credential may be obtained, and the database service may evaluate the fine-grained access request according to a delegation policy corresponding to the access credential to determine whether the fine-grained request is authorized. If authorized, the fine-grained access request may be service. If not authorized, the fine-grained access request may be denied. In some embodiments, multiple application clients may have the same authorization for data, such as read authorization, while another one or more application clients may have different authorization for the data, such as write authorization.

Fine-grained structured data store access using federated identity management

A system that provides services to clients may receive and service requests, various ones of which may require different amounts of work. The system may determine whether it is operating in an overloaded or underloaded state based on a current work throughput rate, a target work throughput rate, a maximum request rate, or an actual request rate, and may dynamically adjust the maximum request rate in response. For example, if the maximum request rate is being exceeded, the maximum request rate may be raised or lowered, dependent on the current work throughput rate. If the target or committed work throughput rate is being exceeded, but the maximum request rate is not being exceeded, a lower maximum request rate may be proposed. Adjustments to the maximum request rate may be made using multiple incremental adjustments. Service request tokens may be added to a leaky token bucket at the maximum request rate.

System and method for throttling service requests having non-uniform workloads

Systems and methods are described for providing on-demand virtual private environments (VPEs) to serverless code executions. Each VPE can represent a logical isolated network environment. On receiving a request to execute code, an on-demand code execution system can generate a VPE for the code and provision the VPE with network endpoints and gateways that provide access to network services and locations that the code is permitted to access, which services and locations can be identified based on permissions for the code. The on-demand code execution system can then execute the code within an execution environment attached to the VPE, such that network transmissions caused by the code are subject to network-level enforcement of the permissions for the code.

Virtual private network environments for serverless code executions

The load level on a server system is regulated by determining time-to-live (TTL) values to provide to requesting devices that request a content resource from the server system, thereby affecting the frequency of subsequent requests. This dynamic determination of TTL values may provide resilience to system load, for example by using longer TTL values when the system is under greater load to reduce the rate at which subsequent requests are received. A dynamic TTL service may calculate a TTL value based on one or more factors, such as overall system load, resource load, hardware load, and/or software load.

Load regulation using dynamically determined time to live values

Technology is described for providing preconfigured device representations in a service provider environment. A plurality of device representation parameters may be received for a device via a user account. A preconfigured device representation may be created for the device using the plurality of device representation parameters. The preconfigured device representation may be associated with the user account. The device may be registered with the service provider environment. A registration of the device may be performed when the device initially connects to the service provider environment. The registration may assign a device identifier to the device and may associate the user account with the device. The preconfigured device representation may be provided to the device after the registration of the device is completed.

Preconfigured device representations

A controlling device scans a label of a network-connected device to obtain a first set of information from a primary layer of the label, where the first set of information is about the network-connected device. The controlling device scans the label to obtain a second set of information from a secondary layer of the label, whereby the secondary layer is distinct from the primary layer. The controlling device transmits a request to a device server associated with the network-connected device to obtain device records for the device, whereby the request includes the second set of information. In response to the request, the controlling device receives the one or more device records.

Device state information access through machine-readable labels

Systems and methods are described for reducing cold starts code within a serverless code execution system by providing a set of environments reserved for the code. A frontend distribute calls for execution among a set of manager devices that manage environments in the system, distributed in a manner that groups calls together and attempts to distribute calls of the same group to a stable subset of the manager devices. In the case that a user reduces or eliminates the number of environments reserved for the code, a frontend continues to distribute calls for execution of the code to those environments while they continue to be used. This reduces cold starts that might otherwise occur during reduction or elimination of reserved environments.

Serverless call distribution to implement spillover while avoiding cold starts

A technology is described for modifying a message frequency of a device. In one example, a network connection is identified between a device and a service provider environment. A message frequency is set for which to send reachability messages between the device and the service provider environment to maintain the network connection. The reachability messages may be sent between the device and the service provider environment at the message frequency. After testing whether the networking connection is maintained at the message frequency, the message frequency may be modified to a modified message frequency.

Message frequency modification for connection maintenance

A technology is provided for managing maintenance operations in a distributed system. Maintenance operations of a plurality of hosts may be tracked in a service provider environment via a maintenance management service. The plurality of hosts are queried to determine availability of each of the plurality of hosts. A schedule for the maintenance operations of the plurality of hosts may be generated based at least in part on the availability of the plurality of hosts and a policy that manages when hosts are allowed to perform maintenance operations. Instructions from the maintenance management service may be sent to the plurality of hosts to schedule the maintenance operations of the plurality of hosts using the schedule.

Managing maintenance operations for a distributed system

Systems and methods are described for reducing cold starts code within a serverless code execution system by providing a set of environments reserved for the code. A frontend utilizes a consistent hash ring to distribute calls for execution among a set of manager devices that manage environments in the system, distributed in a manner that groups calls together and attempts to distribute calls of the same group to a stable subset of the manager devices. Each group is assigned an arc, representing a subset of manager devices. When a call is received to execute a set of code that has environments reserved, the frontend distributes the call to a manager device of a reserved arc. When a call is received to execute a set of code that does not have environment reserved, the frontend distributes the call to an arc associated with an arc for unreserved executions.

Serverless call distribution to utilize reserved capacity without inhibiting scaling

Methods and apparatus for connection redistribution in load-balanced systems that include multiple load balancers each serving multiple nodes. In the connection redistribution method, each node estimates a connection close rate, which may be based on an estimation of the percentage of the overall client traffic received by the respective load balancer that is being handled by the node. The node generates close requests for connections between the respective load balancer and clients according to the connection close rate. The node sends the close requests to its load balancer, which forwards the close requests to the appropriate clients. Upon receiving a close request, a client may close the connection(s) indicated by the request, obtain a public IP address for a load balancer, and initiate new connection(s) to the respective load balancer via the public IP address.

Connection redistribution in load-balanced systems

Methods and apparatus for dedicated endpoint instances for network-accessible services are disclosed. The number of dedicated endpoint instances to be established to direct work requests of a given client to back-end nodes of a service may be determined. Configuration policies for the instances, including one or more policies related to caching, authentication, redundancy, durability, availability, and/or load balancing, may also be determined. Configuration of the instances may be initiated, and an indication that the endpoint or endpoints have been configured may be provided to the client.

Dedicated endpoints for network-accessible services

Growing community of inventors

Seattle, WA, United States of America

David Craig Yanacek