Amazon Technologies, Inc.

Oracle International Corporation

Eden Grail Adogla

Thomas W Kuehnel

Brijesh Singh

Jamin W Collins

Manish Agarwal

Iliya Roitburg

Kevin A Tegtmeier

Matthew Rushton

Steven Michael Noonan

Philip John Nesser, Ii

Marc John Brooker

Pradeep Vincent

Robert James Hanson

Paul William Berg

Jamie Hunter

Vikram Singh Bisht

John Clark Coonley Duksta

Kent David Forschmiedt

Adam K Loghry

Awo D Ashiabor

Benjamin E Howard

Navaneeth Garakahalli

David Dale Becker

Anthony Joseph Suarez

Andrew James Jorgensen

Maxim Baturin

Devin Kowatch

Jason Roy Rupard

John Ryan Gartrell

Abhishek Kar

Laura Ann Duffey

Zackery Vincent Paladino

Pritesh Champalal Kothari

Rajani Kanth Kolli

Michael Francis Quigley

Kimberly A Rodriguez

Techniques are disclosed for a mobile prefab factory for building region data centers. The mobile prefab factory can include a containment enclosure configured to mount physical computing resources of a data center, a networking device, a power supply electrically connected to the networking device, and a plurality of computing devices of the physical computing resources communicatively connected to the networking device and electrically connected to the power supply. A manager service can configure the computing devices for transmission to the destination site by implementing a seed server device of the plurality of computing devices and implementing a software resource repository at the seed server device. While the containment enclosure is in transit, the seed server device can deploy software resources to the plurality of computing devices.

Mobile prefab factory for building cloud regions

Techniques are disclosed for rotating network addresses following the installation of a prefab region network at a destination site. A manager service executing within a distributed computing system can allocate a rotation network address pool to a root allocator service that may be configured to provide network addresses from network address pools to dependent nodes within the distributed computing system, with each dependent node associated with a corresponding first network address of the network address pools. The manager service can receive an indication that a second network address of the rotation network address pool is associated with a dependent node. In response, the manager service can execute and a migration operation for the dependent node to redirect network traffic within the distributed computing system from the first network address to the second network address.

Techniques for rotating network addresses in prefab regions

Techniques are disclosed for validating a cloud region built at a prefab factory. A computing device of the cloud region can receive a network configuration from a manager service. The network configuration can correspond to a network topology of physical resources in the cloud region and can include a first identifier associated with a computing device, a second identifier associated with a neighboring computing device, and information associating the computing device with the neighboring computing device. The computing device can be configured for transmitting to a second data center and can boot into a test mode at the second data center and receive a new identifier from a server device. The computing device can verify the new identifier and send a validation request to the neighboring computing device. The computing device can validate a network connection to the neighboring computing device based on a response to the validation request.

Techniques for validating cloud regions built at a prefab factory

Techniques for facilitating connectivity to vPLCs created in a CSP-provided infrastructure in a region. Within the CSP-provided infrastructure in a region, when the destination of a packet is determined to be an endpoint associated with a particular vPLC, the packet is tagged with information related to the particular vPLC. The vPLC-related information for the particular vPLC can include, for example, a vPLC identifier identifying the particular vPLC, an identifier identifying a customer associated with the endpoint, a virtual cloud network identifier identifying a virtual cloud network (VCN) belonging to the particular vPLC and where the endpoint is part of the VCN, and other vPLC-related information. The packet is then routed or communicated within the CSP-provided infrastructure in a region along with the tagged vPLC-related information. The vPLC-related information is used as part of the connectivity and for routing of packets within the CSP-provided infrastructure in a region.

Connectivity for virtual private label clouds

Novel techniques are disclosed for providing vPLC-specific metadata service including customized vPLC-specific metadata. In certain embodiments, each vPLC may generate a customized metadata using its corresponding vPLC-specific customization instructions. In some embodiments, a vPLC-specific metadata service may be performed using pre-generated customized vPLC-specific metadata, on-the-fly customized metadata, pre-generated CSP-format metadata, or combinations thereof.

Metadata customization for virtual private label clouds

A method may include generating a first cloud network associated with a first security level and including data associated with a service. The method may include generating a second cloud network associated with the first security level and deploying the service and the data associated with the service to the second cloud network and generating a first ingress channel to permit data to be transmitted to the second cloud network. Restricted data associated with a tenant may be deployed to the second cloud network. The method may include generating a third cloud network associated with the first security level and including the service and the data associated with the service and generating a second ingress channel to permit data to be transmitted to the third cloud network. A data sync may be implemented between the second and third cloud networks to deploy the restricted data to the third cloud network.

Merging a new region into classified realms

Techniques are disclosed for rotating resource identifiers within a region network. An identities service can receive a first request for a first identifier of a software resource within the region network from a client node. The identities service can generate the first identifier based at least in part on first attributes and send the first identifier and a first caching instruction to the client node. The identities service can receive an identity rotation instruction that includes information usable by the identities service to provide a second caching instruction in response to requests for software resource identifiers. The identities service can receive a second request for a second identifier of the software resource. The identities service can generate the second identifier based at least in part on the second attributes and send the second identifier and the second caching instruction to the client node.

Techniques for rotating resource identifiers in prefab regions

Techniques are disclosed for bootstrapping a secure data center using a cross domain system with a static sidecar node. The cross domain system can be implemented at the secure data center to provide one-way ingress and egress channels for network traffic to the target data center. The cross domain system is connected to a host data center and can receive configuration data from the host data center to configure the static sidecar node. The static sidecar node can receive bootstrapping data from the host data center and store the bootstrapping data. The bootstrapping data can include software resources for provisioning services in the secure data center. The received bootstrapping data passes into the secure data center via the ingress channel.

Techniques for bootstrapping across secure air gaps with static sidecar

Techniques are disclosed for bootstrapping a secure data center using a cross domain system and a cluster of edge devices. The cross domain system can be implemented at the secure data center to provide one-way ingress and egress channels for network traffic to the target data center. The cross domain system is connected to a host data center and can receive configuration data from the host data center to configure the cluster of edge devices. The cross domain system can include a cluster configuration node that can request bootstrapping data from the host data center on demand, receive the requested bootstrapping data, and use the bootstrapping data to generate a virtual bootstrapping environment on the cluster of edge devices.

Techniques for bootstrapping across secure air gaps with edge device cluster

Techniques are disclosed for migrating one or more services from an edge device to a cloud computing environment. In one example, a migration service receives a request to migrate a first set of services from the edge device to the cloud computing environment. The migration service identifies a hardware profile of a computing device (or devices) of the cloud computing environment that matches the edge device, and then configures the computing device to execute a second set of services that corresponds to the first set of services. The migration service establishes a communication channel between the edge device and the computing device, and then executes a set of migration operations such that the second set of services is configured to execute as the first set of services. The computing device may operate in a virtual bootstrap environment or dedicated region of the cloud computing environment.

Migrating edge device resources to a cloud computing environment

Techniques are disclosed for deploying a computing resource (e.g., a service) in response to user input. A computer-implemented method can include operations of receiving (e.g., by a gateway computer of a cloud-computing environment) a request comprising an identifier for a computing component of the cloud-computing environment. The computing device receiving the request may determine whether the identifier exists in a routing table that is accessible to the computing device. If so, the request may be forwarded to the computing component. If not, the device may transmit an error code (e.g., to the user device that initiated the request) indicating the computing component is unavailable and a bootstrap request to a deployment orchestrator that is configured to deploy the requested computing component. Once deployed, the computing component may be added to a routing table such that subsequent requests can be properly routed to and processed by the computing component.

Techniques for providing cloud services on demand

Techniques are disclosed for deploying a computing resource (e.g., a service) in response to user input. A computer-implemented method can include operations of identifying a first set of computing components already deployed within the cloud-computing environment and identifying a second set of computing components available for deployment within the cloud-computing environment. A request for deployment may be subsequently received for one of the available computing components. A bootstrap request corresponding to the particular computing component requested may be transmitted to a deployment orchestrator, the deployment orchestrator being configured to deploy the particular computing component to the cloud-computing environment based at least in part on the bootstrap request. A user interface may present status indicators for each computing component (e.g., deployed, available, requested, etc.).

In some aspects, a network interface card (NIC) may receive, at a first node of a network interface card associated with a disconnected network, a message intended for the disconnected network and sent using a first communication protocol. The network interface card may send the message from the first node to a second node of the network interface card using a second communication protocol, the second communication protocol being configured for unidirectional communication. The network interface card may receive the message at the second node. The network interface card may send, from the second node, the message to a destination node of the disconnected network using a third communication protocol. Numerous other aspects are described.

Cloud based cross domain system—virtual data diode

Systems, devices, and methods discussed herein enable the provisioning of one or more virtual resources within a cloud-computing environment based at least in part on user-defined constraints. By way of example, a request to provision one or more virtual resources within the cloud-computing environment may be received. The request may include a set of user-defined constraints. Placement data indicating a mapping of a particular virtual resource to a particular hardware resource may be obtained based at least in part on the set of user-defined constraints. The virtual resource(s) may be provisioned within the cloud-computing environment in accordance with the set of user-defined constraints based at least in part on utilization of the placement data.

Techniques for allocating capacity in cloud-computing environments

Techniques are disclosed for implementing a dynamically reconfigurable network lattice within a distributed computing system. A computing device may determine a combined configuration that includes a union of at least a subset of cloud infrastructure component topologies. The computing device may then provide instructions for implementing a physical layer characterized by the combined configuration. The computing device may then determine a subset configuration corresponding to a cloud infrastructure component topology of the subset of cloud infrastructure component topologies. The computing device may then deploy the subset configuration to the physical layer of the distributed computing system.

Growing community of inventors

Seattle, WA, United States of America

Eden Grail Adogla