Amazon Technologies, Inc.

Kristina Kraemer Brenneman

Marc John Brooker

Marc Stephen Olson

Pieter Kristian Brouwer

Jerry Lin

Danny Wei

Christopher Magee Greenwood

Sandeep Kumar

Varun Verma

Sriram Venugopal

Lalit Jain

Arvind Chandrasekar

Oscar Allen Grim Courchaine

Norbert Paul Kusters

James Michael Thompson

Jianhua Fan

Colin Williams

Mark Robinson

Linlin Ding

Sonal Agarwal

Gautham Narayanasamy

Generally described, one or more aspects of the present application correspond to techniques for creating encrypted block store volumes of data from unencrypted object storage snapshots of the volumes. These encryption techniques use a special pool of servers for performing the encryption. These encryption servers are not accessible to users, and they perform encryption and pass encrypted volumes to other block store servers for user access. The encryption context for the volumes can be persisted on the encryption severs for as long as needed for encryption and not shared with the user-facing servers in order to prevent user access to encryption context.

Encryption by default in an elastic computing system

Generally described, aspects of the present application correspond to enabling rapid duplication of data within a data volume hosted on a network storage system. The network storage system can maintain a highly distributed replica pool of the data volume, include a number of replicas duplicating data of the data volume. By providing increased parallelization, the replica pool can facilitate rapid duplication of the volume. In one configuration, each partition of a new volume is mapped to an individual replica within the replica pool, which supports population of the partition with data. Each replica can further include a set of replica partitions, such that read requests from each partition of a new volume are distributed among a number of servers to provide additional parallelization.

Replica pools to support volume replication in distributed storage systems

A data storage system stores information indicating a determined sequence for performing operations on a data store. A lock is acquired on a portion of the data store. It is determined that performing the operations comprises performing at least one additional operation on the data store. Uncommitted changes implied by the operations are stored in a transaction buffer according to the determined sequence. Changes implied by the additional operation are determined based on a reentrant call to a data store interface. The logged sequence of changes is applied to the data store and the lock is released.

Sequenced extension operations on a data store

A method for selecting a service endpoint from a plurality of service endpoints in a distributed system of a service provider may include storing processing data for each of the plurality of endpoints. A success rate may be calculated for each of the plurality of service endpoints and based on a number of processed requests from a plurality of received requests. An average latency may be calculated based on latency associated with each of the processed requests. A latency score may be calculated based on a minimum average latency and the average latency. A raw score may be calculated based on the latency score and the success rate. A selection weight may be calculated based on the raw score and a balancing parameter. One of the plurality of endpoints may be selected based on the selection weight.

Adaptive endpoint selection

Live migration may be performed for virtual computing resources utilizing network-based storage. A virtual compute instance operating at a source host may be moved to a destination host. The virtual compute instance may be a client of a network-based storage resource that stores data for the virtual compute instance. Access to the data stored for the virtual compute instance may be limited to the source host. When migration is performed, the destination host may be prepared to assume operation of the virtual compute instance. Operation of the virtual compute instance at the source host may be paused and the access to the data at the network-based storage resource may be modified to limit access to the destination host. Operation of the virtual compute instance may then resume at the destination host.

Live migration for virtual computing resources utilizing network-based storage

A network-based storage resource may implement access control for virtual computing resources that utilize the storage resource during live migration of the virtual computing resources. A network-based storage resource may enforce an access control that limits access to a host of a virtual compute instance. Upon detecting migration of the virtual compute instance, the network-based storage resource may allow a connection to be established with a destination host for the virtual compute instance. The access control mechanism may be updated to limit access to the destination host for data stored for the virtual compute instance at the network-based storage resource.

Network-based storage access control for migrating live storage clients

Techniques for preserving the state of virtual machine instances during a migration from a source location to a target location are described herein. A set of credentials configured to provide access to a storage device by a virtual machine instance at the source location is provided to the virtual machine instance. When the migration from the source location to the target location starts, a second set of credentials configured to provide access to a storage device by a virtual machine instance at the source location is provided to the virtual machine instance. During the migration, a response to an input-output request is provided to one or more of the locations using the set of credentials and based at least in part on the state of the migration.

Virtual machine instance migration using a triangle approach

Growing community of inventors

Bellevue, WA, United States of America

Kristina Kraemer Brenneman