Amazon Technologies, Inc.

Joshua Benjamin Levinson

Alan Michael Judge

Julien Ridoux

Erez Izenberg

Said Bshara

Nafea Bshara

Anthony Nicholas Liguori

Colin John Whittaker

James Paul Rivers

Mark Ryland

Robert Klein

Techniques are described for enabling users of a cloud provider network to create policies used to control the use of temporary security credentials by computing resources other than a computing resource to which the credentials were issued. An identity and access management service encodes, into temporary security credentials, information about the virtual private network to which the credentials are issued. When a computing resource subsequently issues requests to perform actions and uses the temporary security credentials to sign the request, the cloud provider network further adds, to the network traffic, information associated with the virtual private network from which the request originates. A user can then create a policy with a statement indicating that request are to be permitted only if, e.g., the identity of the virtual private network as encoded in the temporary security credentials matches the identity of the virtual private network identified by the information included in the request.

Controlling use of temporary credentials using network metadata

Systems and methods are provided for highly accurate synchronization of machine instances in a distributed, hosted computing environment to a reference timekeeper. In addition to a general communication network accessible to machine instances, the distributed environment includes a second network dedicated to carrying time information, such as a pulse-per-second (PPS) signal to isolated timing hardware within host computing devices. The isolated timing hardware can use the PPS signal, along with a reference time, to set a hardware clock. The isolated timing hardware can further provide an interface to machine instances that enables the instances to read the time of the hardware clock. This configuration enables many instances can share access to a single reference timekeeper, thus synchronizing those instances to a much higher accuracy than in traditional network-based time protocols.

Highly accurate time information in hosted machine instances using dedicated timing network

Virtualized hardware clocks for providing highly accurate time information in hosted machine instances

Various embodiments of apparatuses and methods for multi-cast, multiple unicast, and unicast distribution of messages with time synchronized delivery are described. In some embodiments, the disclosed system and methods include a reference timekeeper providing a reference clock to one or more host computing devices. The one or more host computing devices host compute instances, and also contain respective isolated timing hardware outside the control of the compute instances. The isolated timing hardware of the one or more host computing devices then receive respective packets, and obtain the same time to deliver the respective packets. Each isolated timing hardware provides either the packet, or information to access the packet, to its respective destination compute instance subsequent to determining that the same specified time to deliver the packet has occurred. Thus, the respective packets are delivered near simultaneously to the one or more destination compute instances.

Distribution of messages with guaranteed or synchronized time of delivery

Growing community of inventors

Seattle, WA, United States of America

Joshua Benjamin Levinson