Amazon Technologies, Inc.

David Everard Brown

Eric Jason Brandwine

Deepak Suryanarayanan

Christopher Richard Jacques De Kadt

Eugene Michael Farrell

Marvin Michael Theimer

Marc J Brooker

Marc John Brooker

Kevin Ross O'Neill

Mark Joseph Cavage

Abhinav Agrawal

Malcolm Russell Ah Kun

Ajit Nagendra Padukone

Matthew Scott Garman

Vivek Lakshmanan

Cornelle Christiaan Pretorius Janse Van Rensburg

Colin Harrison Brace

Eric Wayne Schultze

Duane J Krause

Richard Scott Brinkerhoff

Jean-Paul Bauer

Jason W Murray

Erik James Fuller

George Oliver Jenkins

John Chenault

Kent David Forschmiedt

Ian D Clarkson

David L Ballenger

Jason Ho

Roaan Hennie Vos

Peter Nicholas Desantis

James Alfred Gordon Greenfield

James T Pinkerton

John Michael Morkel

Shon Kiran Shah

John Sandeep Yuhan

Erik Jonathon Tellvik

Thomas Christopher Rizzo

Neil Andrew Eriksson

Stephen William Luszcz

Beth H Ginsberg

Keegan Carruthers Smith

Imogen A Wright

Users intending to launch instances or otherwise access virtual resources in a multi-tenant environment can specify a launch configuration. For each type of instance or each type of user, at least one launch configuration is created that includes parameters and values to be used in instantiating an instance of that type, the values being optimized for the current environment and type of instance. Launch configurations can be optimized for different types of users, such as to account for security credentials and access levels. Such an approach enables users to launch instances by contacting the resource provider directly without need for a proxy, which can function as a choke point under heavy load. The use of an appropriate launch configuration can be enforced for any type of user at any level, such as at the sub-net level, by modifying a request that does not specify an appropriate launch configuration.

Enforceable launch configurations

Techniques for are described which enable users of a service provider network to manage local storage devices connected to computer systems of the service provider network as a service. A service provider network provides an application programming interface (API) that enables users to manage local storage devices in association with compute instances created by users using a hardware virtualization service of the service provider network. The API can be used to attach local storage devices to compute instances (that is, make local storage devices available for use as a block storage device), detach local storage devices from compute instances (that is, make local storage devices unavailable for use by a compute instance and possibly available for use by other compute instances on the same computer system), among other possible operations.

Managing local storage devices as a service

A remote computing session management process is directed to the execution and management of aspects of virtual instances executed on data center computers at a program execution service (PES) platform. A computing session may be established between the PES platform and a computing device connected to the PES platform over a communications network. The data created by the user of the client computing device interacting with the virtual instance may be stored, and following an interruption of the remote computing session, the data may be used when re-establishing the remote computing session.

Management of computing sessions

A service management system prepares computing resources for use before a client requests the resource. For example, a service management system of a provider may restore an operating system image to a volume. The service management may then assign a processing resource to the volume to form a virtual machine. The service management system may cause the processing resource to finish preparation of the operating system on the volume. The service management system may disconnect the resulting staged volume from the processing resource. The staged volume may remain active in the low-latency data store and be added to a list of available staged volumes having the operating system. When a client requests a virtual machine having an operating system, the service management system may determine that the client receives the staged volume as part of the virtual machine to avoid the start-up costs of preparing a volume.

Resource prestaging

Data defining the actual time to availability for various configurations of instances of computing resources is collected. The collected data can be utilized to provide an estimate of the expected time to availability for a specific configuration of an instance of a computing resource in response to receiving a request to create a new instance of the computing resource.

Providing an instance availability estimate

Systems and methods are presented for accessing an application available from a data center of a program execution service. The metadata associated with a user computing device may be used to determine whether the user computing device is authorized to access the application through a virtual desktop instance. At least a portion of the application may be executed by the virtual desktop instance and provided to the user. Applications may be purchased, licensed, or rented by a user.

Application marketplace for virtual desktops

Systems and methods for attesting to information about a computing resource involve electronically signed documents. For a computing resource, a document containing information about the resource is generated and electronically signed. The document may be provided to one or more entities as an attestation to at least some of the information contained in the document. Attestation to information in the document may be a prerequisite for performance of one or more actions that may be taken in connection with the computing resource.

Techniques for attesting to information

Systems and methods are described for providing federated access to end-users of virtual machines. The method includes receiving a request from a user to access a resource outside of the user's original security domain. The user's existing security credentials are forwarded to an authentication entity, which determines if the user's credentials are authentic. If it is determined that the user's credentials are authentic, the user's target identity provider generates a security token that provides the virtual machine user with access to the resource, the resource residing in an external security domain. The user may log on to the virtual machine with access to the desired resource, subject to the privileges identified in the security token.

Virtual machine logon federation

Systems and methods are presented for automatically selecting a data center that can communicate with a user computing system over a connection that provides reduced or minimal latency. In some cases, the system can select the data center based on the calculation of one or more latency factors that correlate, at least in part, to the latency of a communication channel between the data center and the user computing system. Further, the selected data center may be identified from a set of data centers that include one or more computing resources the user has identified as desiring to access.

Automated data center selection

A plurality of virtual computing resources is detected to have been provisioned. Credentials are distributed to the plurality of virtual computing resources. A credentials map that maps the credentials to the plurality of virtual computing resources is updated. The credentials for the plurality of virtual computing resources are activated to enable the plurality of virtual computing resources to use the credentials to authenticate to a second computer system that manages a resource service, with the credentials being inaccessible to resources of the resource service. A virtual computing resource of the plurality of virtual computing resources is detected to been deprovisioned, and the credentials for the virtual computing resource are deactivated.

Techniques for credential generation

Techniques, including systems and methods, for virtual resource cost tracking account for unused capacity of implementation resources that are dedicated to particular customers and, as a result, are unusable for maintaining virtual resources for other customers. Customers requesting dedicated use of implementation resources are charged in a manner that compensates the virtual resource provider for the lost ability to use unused capacity of implementation resources to serve other customers. Customer charges may be determined by a pricing function that is calculated such that, for a base of customers, expected revenue from the base of customers approximates a revenue goal. The revenue goal may be determined based on revenue that would have been expected had the unused capacity of the dedicated implementation resources been available for serving other customers.

Statistically cost-following accounting model

Systems and methods are presented for storing and updating data. The metadata associated with a user computing device may be used to determine whether the user computing device is configured to maintain a synchronized copy of the file. Moreover, a user computing device may be authorized to modify a file through a virtual desktop instance on a PES. If a user computing device is authorized to synchronize the file, the file may be accessible locally without a network connection.

Automated data synchronization

Growing community of inventors

Cape Town, South Africa

David Everard Brown