Amazon Technologies, Inc.

David Walker

Ross Alan Cameron Gardner

Bradley Aaron Rebh

Syed Suhaib Sarmad Barbero

Bertram U Dorn

Jegan Chen

Charles Michael Hutchins Curran

Derric L McGarrah

Carlin Michael Rogers, Ii

Luis Rene Sempe Sosa

Attila Narin

Sean Michael Needham

Joshua Stephen Du Lac

Victor Chin

Scott Ryan Conrad

Joe W Pate

Mikhail Sosonkin

Matthew R Evans

Hugo Gabignon

Andrew Langhorn

Ryan Washington

Nathan Kevin McCarthy

Joel Naomi Cornett

Systems and methods are described to provide mechanisms for establishing a private anonymity network that allows network packets to be forwarded via an obfuscated network signal path that is highly configurable. The techniques described herein may allow users to establish a private obfuscated network signal path that utilizes a number of access points, load balancers, and packet forwarders that can collectively provide path randomization and node ephemerality in a manner that may not be feasible or available in public anonymity networks.

Network connection path obfuscation using global access points

A system intercepts, at an application programming interface (API) gateway, a request for access to a computing resource and obfuscates metadata associated with the request. The metadata is obfuscated by at least encrypting the metadata to generate encrypted metadata. The API gateway further generates a second request to include the encrypted metadata. The second request is then used to access the computing resource in response to the first request such that when the computing resource is accessed, the metadata associated with the computing resource is encrypted.

Dynamic metadata encryption

A visual scripting system can provide support for handling event-specific messages received through an event messaging system. The messaging system can provide event messages over one or more event buses that have a determined behavior context. An event node of a visual scripting system can enable a developer to specify event handlers to detect specific types of event notifications sent on a specified event bus, as well as specific actions to be taken in response to those event notifications, such as to send additional event messages, all of which comply with the behavior context. Once the event node is configured and properties and actions defined, the corresponding script can be generated by the visual scripting system, to be complied and executed as part of a user application.

Event handler nodes for visual scripting

Calls, such as API calls to a resource provider environment, can be modeled and evaluated using a shadow environment before executing the call in an actual target environment. Such an approach ensures that any changes made as a result of executing the call will not cause the actual environment to be out of compliance with any relevant rules or regulations. Changes may typically be reflected in a configuration management database. A shadow copy of this database can be generated, and the call can first be modeled in this shadow copy. Shadow log entries including results of the processing can be generated and evaluated. If the changes would be compliant then the call can be transmitted to the actual API endpoint for the target environment, where the API call can be executed.

Request simulation for ensuring compliance

Approaches provide for mandatory access controls and account identification masking controls in an electronic environment. For example, a customer can configure a client device to access an API gateway which acts as a proxy for a resource in a resource provider environment. Requests for resources or services can be redirected to the API gateway. A registered function may be triggered when the request is received and may filter the request. After filtering, the request can be forwarded on to the actual API endpoint to access the requested resource. From the client's perspective, the resource is being accessed directly, and from the resource's perspective, it is being accessed by the proxy. This layer of indirection enables data to be protected preemptively, rather than waiting for an undesirable condition to exist and then reactively attending to the issue. Additionally, log data may be redacted and/or masked automatically as it is created, protecting sensitive data before it is accessible to administrators or other users.

Request filtering and data redaction for access control

Systems, methods, and computer-readable media are disclosed for systems and methods for parallelized forensic analysis using cloud-based servers. Example methods may include generating a first request for one or more notifications in a notification queue, where the one or more notifications include a first notification indicative of a first data input at a datastore, determining a first data type of the first data input, and generating a second notification indicative of the first data type. Some example methods may include determining that a first software component is subscribed to notifications for the first data type, sending the second notification to the first software component, determining a first output of the first software component, where the first output comprises a set of extracted data from the first data input, and sending the set of extracted data to the datastore.

Parallelized forensic analysis using cloud-based servers

A system for servicing a request in a distributed computing environment includes a plurality of computing devices configurable to implement a first compute instance group. The first instance group includes a first plurality of compute instances of a provider network. One or more of the computing devices is configured to implement a first network device that is configured to receive a first service request from a client directed to an application and to provide the first service request to each of the first plurality of compute instances. The application is run on each of the first plurality of compute instances.

Load-balancing for achieving transaction fault tolerance

Technology is described for providing an ownership transfer service in virtual computing service environment. Computing resources under the control of one or multiple customers are stored in an ownership transfer account. Workflows based on a pre-defined set of triggers for releasing the computing resources from the ownership transfer account are established. Exclusive control over the computing resources may be transferred from the single or multiple customers to at least one of the multiple customers or to a receiving customer according to a triggering event. The exclusive control over the computing resources from one or at least one of the multiple customers is terminated upon occurrence of one of the pre-defined set of triggers or temporary control is granted based on rules such as time periods.

Ownership transfer account service in a virtual computing environment

Growing community of inventors

Old Basing, United Kingdom

David Walker