Amazon Technologies, Inc.

Oracle International Corporation

Eden Grail Adogla

Brijesh Singh

Jamin W Collins

Thomas W Kuehnel

Manish Agarwal

Iliya Roitburg

Kevin A Tegtmeier

Matthew Rushton

Steven Michael Noonan

Philip John Nesser, Ii

Marc John Brooker

Pradeep Vincent

Robert James Hanson

Paul William Berg

Jamie Hunter

John Clark Coonley Duksta

Vikram Singh Bisht

Kent David Forschmiedt

Adam K Loghry

Awo D Ashiabor

Benjamin E Howard

David Dale Becker

Anthony Joseph Suarez

Maxim Baturin

Andrew James Jorgensen

Devin Kowatch

Jason Roy Rupard

Abhishek Kar

Michael Francis Quigley

Navaneeth Garakahalli

Pritesh Champalal Kothari

Rajani Kanth Kolli

Thomas Werner Kuehnel

Novel techniques are disclosed for providing vPLC-specific metadata service including customized vPLC-specific metadata. In certain embodiments, each vPLC may generate a customized metadata using its corresponding vPLC-specific customization instructions. In some embodiments, a vPLC-specific metadata service may be performed using pre-generated customized vPLC-specific metadata, on-the-fly customized metadata, pre-generated CSP-format metadata, or combinations thereof.

Metadata customization for virtual private label clouds

A method may include generating a first cloud network associated with a first security level and including data associated with a service. The method may include generating a second cloud network associated with the first security level and deploying the service and the data associated with the service to the second cloud network and generating a first ingress channel to permit data to be transmitted to the second cloud network. Restricted data associated with a tenant may be deployed to the second cloud network. The method may include generating a third cloud network associated with the first security level and including the service and the data associated with the service and generating a second ingress channel to permit data to be transmitted to the third cloud network. A data sync may be implemented between the second and third cloud networks to deploy the restricted data to the third cloud network.

Merging a new region into classified realms

Techniques are disclosed for rotating resource identifiers within a region network. An identities service can receive a first request for a first identifier of a software resource within the region network from a client node. The identities service can generate the first identifier based at least in part on first attributes and send the first identifier and a first caching instruction to the client node. The identities service can receive an identity rotation instruction that includes information usable by the identities service to provide a second caching instruction in response to requests for software resource identifiers. The identities service can receive a second request for a second identifier of the software resource. The identities service can generate the second identifier based at least in part on the second attributes and send the second identifier and the second caching instruction to the client node.

Techniques for rotating resource identifiers in prefab regions

Techniques are disclosed for bootstrapping a secure data center using a cross domain system with a static sidecar node. The cross domain system can be implemented at the secure data center to provide one-way ingress and egress channels for network traffic to the target data center. The cross domain system is connected to a host data center and can receive configuration data from the host data center to configure the static sidecar node. The static sidecar node can receive bootstrapping data from the host data center and store the bootstrapping data. The bootstrapping data can include software resources for provisioning services in the secure data center. The received bootstrapping data passes into the secure data center via the ingress channel.

Techniques for bootstrapping across secure air gaps with static sidecar

Techniques are disclosed for bootstrapping a secure data center using a cross domain system and a cluster of edge devices. The cross domain system can be implemented at the secure data center to provide one-way ingress and egress channels for network traffic to the target data center. The cross domain system is connected to a host data center and can receive configuration data from the host data center to configure the cluster of edge devices. The cross domain system can include a cluster configuration node that can request bootstrapping data from the host data center on demand, receive the requested bootstrapping data, and use the bootstrapping data to generate a virtual bootstrapping environment on the cluster of edge devices.

Techniques for bootstrapping across secure air gaps with edge device cluster

Techniques are disclosed for migrating one or more services from an edge device to a cloud computing environment. In one example, a migration service receives a request to migrate a first set of services from the edge device to the cloud computing environment. The migration service identifies a hardware profile of a computing device (or devices) of the cloud computing environment that matches the edge device, and then configures the computing device to execute a second set of services that corresponds to the first set of services. The migration service establishes a communication channel between the edge device and the computing device, and then executes a set of migration operations such that the second set of services is configured to execute as the first set of services. The computing device may operate in a virtual bootstrap environment or dedicated region of the cloud computing environment.

Migrating edge device resources to a cloud computing environment

Techniques are disclosed for deploying a computing resource (e.g., a service) in response to user input. A computer-implemented method can include operations of receiving (e.g., by a gateway computer of a cloud-computing environment) a request comprising an identifier for a computing component of the cloud-computing environment. The computing device receiving the request may determine whether the identifier exists in a routing table that is accessible to the computing device. If so, the request may be forwarded to the computing component. If not, the device may transmit an error code (e.g., to the user device that initiated the request) indicating the computing component is unavailable and a bootstrap request to a deployment orchestrator that is configured to deploy the requested computing component. Once deployed, the computing component may be added to a routing table such that subsequent requests can be properly routed to and processed by the computing component.

Techniques for providing cloud services on demand

Techniques are disclosed for deploying a computing resource (e.g., a service) in response to user input. A computer-implemented method can include operations of identifying a first set of computing components already deployed within the cloud-computing environment and identifying a second set of computing components available for deployment within the cloud-computing environment. A request for deployment may be subsequently received for one of the available computing components. A bootstrap request corresponding to the particular computing component requested may be transmitted to a deployment orchestrator, the deployment orchestrator being configured to deploy the particular computing component to the cloud-computing environment based at least in part on the bootstrap request. A user interface may present status indicators for each computing component (e.g., deployed, available, requested, etc.).

In some aspects, a network interface card (NIC) may receive, at a first node of a network interface card associated with a disconnected network, a message intended for the disconnected network and sent using a first communication protocol. The network interface card may send the message from the first node to a second node of the network interface card using a second communication protocol, the second communication protocol being configured for unidirectional communication. The network interface card may receive the message at the second node. The network interface card may send, from the second node, the message to a destination node of the disconnected network using a third communication protocol. Numerous other aspects are described.

Cloud based cross domain system—virtual data diode

Systems, devices, and methods discussed herein enable the provisioning of one or more virtual resources within a cloud-computing environment based at least in part on user-defined constraints. By way of example, a request to provision one or more virtual resources within the cloud-computing environment may be received. The request may include a set of user-defined constraints. Placement data indicating a mapping of a particular virtual resource to a particular hardware resource may be obtained based at least in part on the set of user-defined constraints. The virtual resource(s) may be provisioned within the cloud-computing environment in accordance with the set of user-defined constraints based at least in part on utilization of the placement data.

Techniques for allocating capacity in cloud-computing environments

Techniques are disclosed for implementing a dynamically reconfigurable network lattice within a distributed computing system. A computing device may determine a combined configuration that includes a union of at least a subset of cloud infrastructure component topologies. The computing device may then provide instructions for implementing a physical layer characterized by the combined configuration. The computing device may then determine a subset configuration corresponding to a cloud infrastructure component topology of the subset of cloud infrastructure component topologies. The computing device may then deploy the subset configuration to the physical layer of the distributed computing system.

Dynamically reprogrammable region lattices

In some aspects, a computing device of the virtual cloud network may select one or more filters from a plurality of filters for a data pipeline, the plurality of filters comprising at least one of: a malware filter; a content filter; a signature filter; a content analyzer; a machine learning filter; or an artificial intelligence filter. A sequential order for the one or more selected filters in the data pipeline can be determined. A message may be received in the data pipeline from a network interface card (NIC), the network interface card being configured as a one-way transfer device. The message in the data pipeline may be filtered by passing the message through the one or more selected filters in the determined sequential order. The computing device of the virtual cloud network may provide logs of events occurring in the data pipeline via a logging network.

Cloud based cross domain system—CDSaaS

In some aspects, a computing device of the disconnected network may generate an application programming interface (API) configured to present a set of filter types. A selection of one or more filters types from the set of filter types may be received via an API. A sequential order for the selected filter types may be received via an API. A data pipeline with the selection of filters in the sequential order may be generated. A message received at a one-way transfer device may be analyzed by passing the message through the selected filters in the sequential order. A log of events occurring in the data pipeline may be received via a logging network. The log of events may be presented via the application programing interface. The data pipeline may be terminated upon receiving a termination command via the application programming interface.

Cloud based cross domain system—CDS with disaggregated parts

Embodiments are disclosed for recycling memory after a virtual machine reboots. Memory allocated to a rebooting virtual machine instance can be associated with the instance or otherwise marked as to be reserved for use after the virtual machine instance reboots. Subsequently, after the reboot process is initiated, the reserved memory can be reallocated to the virtual machine instance. Memory scrubbing can be ordinarily performed to avoid data leakage between customers, but scrubbing can be inhibited for memory that is returned to a rebooting virtual machine instance. Further features, such as API calls to configure memory recycling, indications to disable recycling, and the like can be supported.

Growing community of inventors

Seattle, WA, United States of America

Eden Grail Adogla