Amazon Technologies, Inc.

Emc IP Holding Company LLC

Ilia Gilderman

John MacDonald Winford

Didier Germain Durand

Jeremiah Wilton

Edward Paul Murray

Eran Schitzer

Nicolas Anton Medhurst Hertl

Rostislav Babocichin

Zachary Adam Bienenfeld

Arun Kumar Thiagarajan

Haim Sharabani

Oded Sharon

Ben Fedidat

Chen Zhang

Grant Alexander Macdonald McAlister

Michael J Russo

Harpreet Kaur Chawla

Parker J Lord

Hanna Ben-Moshe

Dmitrij Semionov

Ramya Kaushik

Zhifeng Wang

Eyal Cohen

Satheesh Peringandookaran Subramanian

Danial George Neault

Sameer Malik

Samujjwal Roy

Venu Reddy

Gal Eliraz Levonai

Michael D Soo

Siva Raghupathy

Priyesh Ranjan Tiwari

Romain Muller

Knievel Co

Damodar Shetyo

Harel Kodesh

Shruthi Ramakrishnan

Alexey Gershun

Harinderpal S Hanspal

An automated infrastructure creation service of a service provider network may be used to create infrastructure for a virtual computing environment of the service provider network based on application code. The service identifies a data structure(s) in application code, the application code to be executed in a virtual computing environment of the service provider network, and the service generates a manifest(s) based on the data structure(s) identified in the application code. Infrastructure as code (IaC) can then be executed to create infrastructure for the virtual computing environment based at least in part on the manifest(s). Accordingly, the IaC uses the application code to create infrastructure. In this way, duplicity in the process of developing IaC and application code is reduced, or eliminated, and errors in the respective code bases are mitigated.

Infrastructure creation based on application code

Remapping mainframe functional components from a mainframe computing environment onto a network of distinct but communicating accounts of a provider network. The mainframe computer (or network of such computers) is analyzed hierarchically through one or more of physical separation between logical partitions (LPARs), LPARs within the mainframe computer(s), separation of batch and transactional workloads, separation of batch and transactional accounts, or security of the mainframe architecture. Mainframe application artifacts obtained through the analyzing are used to generate a graph model representing relationships among the mainframe application artifacts. The graph model includes nodes representing the mainframe application artifacts and edges connecting pairs of the mainframe application artifacts, where the edges represent use relationships between the pairs of mainframe application artifacts. The nodes are then clustered, where the clusters represent sets of mainframe artifacts having high density of use relationships, and the clusters correspond to the distinct accounts in the provider network.

Decomposition of monoliths into multi-account provider network structures

Systems, devices, and methods are provided for implementing a cloud-based mainframe service. A cloud-based mainframe service may utilize various resources, including an operating system that is provisioned with an authorization interceptor that uses a first set of security policies stored in a policy database to determine whether to grant or deny access to resources managed by the operating system. The authorization interceptor may use the security policies of the policy database to determine whether to grant access to operating system resources. A database management system may use a second set of security policies stored in the policy database to determine whether to grant or deny access to resources managed by the database system. Security policies for a mainframe service may be centrally stored in a policy database managed by a policy management service.

Cloud-based mainframe service

Systems, devices, and methods are provided for authorizing access to operating system resources using security policies managed by a service external to the operating system. An operating system may be provisioned with a kernel-mode component that intercepts system calls from applications, determines a request context for the system call, and sends a request to an external policy management service. The policy management service may be used to perform a policy evaluation to determine whether to grant access to operating system resources. In some cases, policies are cached by the operating system. In various examples, the operating system and policy management service are both hosted on resources managed by a computing resource service provider on behalf of a customer to run mainframe workloads.

Authorizing access to operating system resources using security policies managed by service external to the operating system

The reliability of an application is improved by analyzing and implementing changes to application infrastructure that is represented, in some examples, as Infrastructure as Code ('IAC'). The system performs various tests on the infrastructure to determine how the infrastructure responds to failures and whether recovery procedures and monitoring services in place are effective and functioning properly. Various examples provide a measure of infrastructure resiliency that can be used to evaluate potential changes to application infrastructure.

Application reliability service

Systems, devices, and methods are provided for determining whether security assurances are satisfied by security policies that are used to control access to resources used by a mainframe application. A system may use a database to store a plurality of security policies that may comprise security polices of various resources used by mainframes, including resources managed by operating systems and database systems. A reference policy that corresponds to the security assurance being sought may be determined. The security policies may be evaluated using a satisfiability modulo theories (SMT) solver to determine whether the security policies are equally or less permissive than the reference policy.

Cloud-based security service for improved compliance of mainframe workloads

Systems, devices, and methods are provided for authorizing access to database management system (DBMS) resources using security policies managed by a service external to the DBMS. A DBMS may be provisioned to obtain a database request, identify one or more securable resources that from applications, determine a request context for the system call, and sends a request to an external policy management service. The policy management service may be used to perform a policy evaluation to determine whether to grant access to the securable resources. In some cases, policies are cached by the DBMS. In various examples, the DBMS and policy management service are both hosted on resources managed by a computing resource service provider on behalf of a customer to run mainframe workloads.

Authorizing access to database system resources using security policies managed by a service external to the database system

A workload of a database may be evaluated to provide a database migration recommendation. A request for a recommendation to migrate a database to a new host may be received. An evaluation of the workload of a client application of the database at a current host may be performed. The migration recommendation may be returned based on the evaluation of the workload of the client application of the database. In some embodiments, the migration recommendation may trigger an automated migration of the database to the new host.

Evaluating workload for database migration recommendations

A system such as a service of a computing resource service provider includes executable code that, if executed by one or more processors, causes the one or more processors to identify a set of resources associated with a first database system, determine, based at least in part on the set of resources, an expected outcome of an operation of a second database system, and generate, executable code that, if executed, verifies an actual outcome of the operation of the second database system against the expected outcome. The system may be utilized as part of a database migration process where data from a first database system is transferred to a second database system.

Database migration systems and methods

Data is migrated between a source database and a target database. The source database management system ('DBMS') remains operational during the migration. A user selects the source DBMS and target DBMS, provides connection information used to connect to the database management systems and selects a virtual machine instance to perform the migration in conjunction with a database migration service. After the setup is complete, the virtual machine instance in conjunction with the database migration service performs data type transformations, and other operations, without user intervention. The database migration service also converts, without user intervention, the source schema and code to a format compatible with the target DBMS. Any code that is not converted is marked to assist the user of the database migration service identify where manual re-coding is required. The database migration service can also provide recommendations as to a target DBMS that is a suitable target DBMS.

Migrating data between databases

Distributed extraction of data for migration may be implemented for migrating data sets from a first data store to a second data store. Assignments may be determined for different migration agents to obtain and store the data set in the second data store along with a format for storing the assigned data set portions. The migration agents may then be caused to obtain the assigned portions and store the assigned portions in the second data store according to the identified format. Further operations to request or direct the ingestion of the data set from the second data store may be performed by migration agents with respect to a third data store that performs data ingestion.

Distributed data set extraction for migration

Described herein is technology for replicating data from a source database to one or more target databases at different points in time. The system receives a request to replicate a data set stored in a source database. The system stores a copy of a first subset of the data set from the source database to a target database at a first time. The system stores a copy of a second subset of the data set from the source database to the target database at a second time.

Multi-tiered data replication

A method and system for validating data migrated from a source database to a target database and storing validation metrics resulting from validating the data are described. The system receives validation information to be used to validate data to be migrated from a source database to a target database. The system validates the data using the validation information and stores validation metrics resulting from validating the data.

Data validation of data migrated from a source database to a target database

Validation of a migration task to migrate data from one data store to another may be performed prior to the migration of the data. Parameters associated with the migration may be evaluated according to one or more types of validations for the migration task. In some embodiments, users may specify the validations to perform for the migration task. A determination as to whether the migration task is valid may be performed for the migration task based on the parameter evaluations. A result indicating whether the migration task is valid may be provided to a user.

Growing community of inventors

Bellevue, WA, United States of America

Ilia Gilderman