Amazon Technologies, Inc.

Joshua Dawie Mentz

Ronen Dov Agranat

Willem Jacob Buys

Timothy Ralph Sjoberg

Diwakar Gupta

Marnus Freeman

Ross Bevan Engers

Gregory Jonathan Kempe

Brian Frederick Mulder

Malcolm Featonby

Georgios Elissaios

Alan Hadley Goodman

Michael Groenewald

Stefan Letz

Daniel Bauman

Aidan Musnitzky

André Mostert

Stig Manning

Marc John Brooker

Christopher Magee Greenwood

James Alfred Gordon Greenfield

Madhuvanesh Parthasarathy

Surya Prakash Dhoolam

Steven J Kruy

Marc Levy

Gustav Karl Mauer

Mark Danoher

Gabriël De Vos Smit

Vikas Panghal

A component of a computing service obtains respective indications of placement policies that contain host selection rules for application execution environments such as guest virtual machines. With respect to a request for a particular application execution environment, a group of applicable placement policies is identified. A candidate pool of hosts is selected using the group of placement policies, and members of the pool are ranked to identify a particular host on which the requested application execution environment is instantiated.

Custom placement policies for virtual machines

Customers of a computing resource service provider may transmit requests to instantiate compute instances associated with a plurality of logical partitions. The compute instances may be executed by a server computer system associated with a particular logical partition of the plurality of logical partitions. For example, a compute service may determine a set of server computer systems that are capable of executing the compute instance based at least in part on placement information and/or a diversity constraint of the plurality of logical partitions.

User defined logical spread placement groups for computing resources within a computing environment

A customer having a deployment of resources in a resource provider environment can utilize a mechanism such as an application programming interface (API) to obtain fault, risk, and/or distribution information for the deployment. A risk score can be generated, by the customer or a component of the resource provider environment, that gives the customer a measure of the risk of the current deployment, whereby the customer can request one or more changes to the customer deployment. In some embodiments the customer can provide one or more risk criteria, such as a maximum risk score or minimum fault tolerance, that the resource provider environment can attempt to satisfy over the duration of the customer deployment, automatically making adjustments to the deployment as appropriate. The risk score can include information about the customer workload as well as the physical deployment in order to provide more accurate data.

Fault tolerance determinations for networked resources

A network visualization service may auto-generate graphical, dynamic, and interactive network diagrams of the infrastructure (resource instances, connections, etc.) of clients' virtual private networks as implemented on a provider network. A network diagram may include representations of various virtualized components of a client's virtual private network, as well as relationships among and connections between and among the various components. The diagram may also display logical and/or geographical groupings of the virtual resources in the client's virtual private network. The service may track changes to the virtual private network and update the diagram accordingly. The diagram may provide a user interface via which the client may select particular graphical objects on diagram to display additional information about a respective resource instance or connection and/or to change the client's virtual private network configuration via the network diagram.

Network visualization service

A customer of a computing resource service provider submits a request to a virtual computer system service to instantiate a virtual computer system. In response to the request, the service obtains physical network information in order to identify any hardware groupings that may be used, at a later time, to provision one or more data storage volumes that may be associated with the virtual computer system. The service assigns a score to each of these hardware groupings based at least in part on the available capacity for provisioning of these data storage volumes. Based at least in part on these assigned scores, the virtual computer system service selects a hardware grouping and instantiates the virtual computer system within the selected hardware grouping.

Hardware grouping based computing resource allocation

A provider network determines which servers to use to host a group of virtual machines for a customer. A placement manager within the provider network employs a placement technique which prioritizes spreading virtual machines for the customer across different 'subzones.' A subzone is a logical division of a provider network's hardware and/or software denoting risk boundaries. By placing virtual machines in separate subzones, the customer's virtual machines and thus the task collectively performed by the virtual machines are less impacted by a failure within one of the subzones.

Spread placement groups

Apparatus and method are described that relate to reserved virtual machine instances and location policies. Customers of a provider network can reserve one or more reserved virtual machine instances in a reservation and also specify a location policy for the reservation. The location policy provides restrictions as to which hardware may or may not be used to launch the reserved instances and/or how close together the hardware should or should not be to launch the instances of the reservation. The location policies afford customers some degree of control over which hardware is used by the provider network to launch the instances. As such, customers can help control increase security and/or reduce latency of their instances, or control other aspects of their instances.

Location policies for reserved virtual machine instances

A method for data aggregation of declassified sensitive data may include obtaining a policy associated with an isolated region of a service provider. The policy may identify a plurality of rules for declassifying sensitive data accessible within the isolated region. At least a portion of the plurality of rules identified by the policy may be obtained. A file with the sensitive data may be identified, the file being generated within the isolated region. An output file may be generated based on applying the obtained rules to the file. At least a portion of the sensitive data may be filtered out using the obtained rules. The generated output file may be provided for access outside of the isolated region. The sensitive data may be inaccessible by at least another region of the service provider.

Policy based data aggregation

A distributed execution environment provides resources such as computing resources, hardware resources, and software resources. Resource action rules ('rules') may be defined and associated with resources in the distributed execution environment. The rules may be evaluated based upon resource state data defining the state of one or more resources. The results of the evaluation of the rules may be utilized to take various actions. For example, the results of the evaluation of rules may be utilized to generate a user interface (UI) object for providing information regarding the evaluation of the rule, to initiate a workflow, and/or perform another type of action. The results might also be utilized to prohibit certain types of operations from being performed with regard to a resource. The results might be propagated to other resources. A UI might also be provided for use in defining the rules.

Rule-based actions for resources in a distributed execution environment

A distributed execution environment provides resources such as computing resources, hardware resources, and software resources. One or more resource data providers might also operate in conjunction with the distributed execution environment to provide resource data describing various aspects of the resources in the distributed execution environment. A query service may obtain resource data provided by the resource data providers in order to generate responses to queries. In order to obtain the resource data from the resource data providers, the query service may utilize various 'pull' and 'push' mechanisms. Using a push mechanism, the resource data providers push resource data to the query service. Utilizing a pull mechanism, the query service pulls the resource data from the resource data providers. The query service might also store resource data received from the resource data providers in a cache and utilize the cached resource data when responding to queries for resource data.

Resource data query processing

Requests to change attributes of servers or other computing resources can be validated by a veto service. For example, the veto service can receive requests to register for notification of changes to an attribute for a server, send a notification of a pending change to the attribute to each of a plurality of services, determine a response to the notification for each service, and based on the responses decide whether to allow or deny the pending change to the attribute. The responses from the notified services can be received responses or default responses.

Validating changes to attributes for computing resources

Entities such as resource and service providers can utilize a ticketing system to define operational actions as primitives that can be stored, combined into more complex workflows, and executed in a restricted zone wherein a portion of the resources or services are not directly accessible to those providers. These primitives can be stored in the provider environment and shared with the restricted zone, in order to provide a structured approach to the sharing of operational knowledge. When a primitive is first received to the restricted zone, a person vetted by the customer associated with the restricted zone can review and approve the primitive, and can cause the primitive to be executed in the restricted zone. When that same primitive is subsequently received to the restricted zone, a lookup can be performed to determine that an approval exists, whereby the primitive can be executed in the restricted zone without another review.

Managing restricted access resources

A computer-implemented method includes recording one or more actions being performed by an agent using at least one resource of a resource provider environment, the at least one resource being associated with a non-restricted zone in the resource provider environment. The method includes creating a primitive that describes the one or more actions. The primitive is able to be executed on at least one different resource in a restricted zone in the resource provider environment to perform the one or more actions using the different resource. The restricted zone includes resources associated with a customer that are directly accessible only to at least one authorized entity. The method includes submitting the primitive to the restricted zone in the resource provider environment. The primitive is able to be executed by the at least one authorized entity on the at least one different resource in the restricted zone.

Growing community of inventors

Cape Town, South Africa

Joshua Dawie Mentz