Amazon Technologies, Inc.

Kiran Kumar Chinta

Ippokratis Pandis

Gaurav Saxena

Naresh Chainani

Venkatraman Govindaraju

Abhishek Sharma

James Claiborne Moore

Todd Jeffrey Green

Yanzhu Ji

Dmytro Bogatov

Andrew Edward Caldwell

Martin Grund

Fabian Oliver Nagel

Naveen Muralimanohar

Nemanja Boric

Demala Palliye Gurunnanselage Shermal Ruwantha Fernando

Nikolaos Armenatzoglou

Hanna Loboda

Hui Shi

Techniques for priority-based masking policy selection in a database environment are described. Masking policies are defined and attached to columns of relational data for particular users or roles. The attachment of a masking policy to a column includes a user-specified priority value. When multiple policies could apply to a particular query, the conflict can be easily resolved and understood by use of the priority values, for example, by selecting a candidate policy having a highest priority value.

Priority-based masking policy selection in a database environment

Techniques for dynamic database redaction using protected encryption secret material are described. A masking policy is defined that includes a reference to a secret material stored by a secrets manager service. The masking policy further identifies a pseudonymous redaction function that utilizes a cryptographic function requiring such a secret material. The secrets manager service is configured to grant access to the secret material by an entity of the database service that executes queries, such as a leader node of a cluster. For a particular query, the cluster obtains the secret material from the secrets manager service in a secure manner, uses the secret material for applying the cryptographic function to values for redaction purposes, and deletes any copies of secret material thereafter.

Dynamic database redaction using protected secret material

Dynamic plan interpretation may be implemented to perform queries. A query is received at a database system. A plan to perform the query is generated. For at least a portion of the plan to perform the query, a domain-specific language may be applied to interpret and execute the portion of the plan to perform the query using one or more previously compiled executors instead of generating and compiling code to execute the portion of the plan. Returning a result of the query according to the execution of the plan.

Dynamic selection of plan interpretation to perform queries

Compiled portions of code generated to perform a query plan at a query engine may be shared with other query engines. A data store, separate from the query engines, may store compiled portions of query code generated for different queries. If a query engine does not have a locally stored compiled portion of query code, then the separate data store may be accessed in order to obtain a compiled portion of query code, allowing reuse of compiled query code across different queries engines for queries directed to different databases.

Sharing compiled code for executing queries across query engines

Growing community of inventors

Fremont, CA, United States of America

Kiran Kumar Chinta