Amazon Technologies, Inc.

Kyle Bradley Peterson

Samuel Leonard Moniz

Kevin Michael Beranek

Keian Christopher

Ajit Ashok Varangaonkar

Leon Robert Warman

Vijay Ravindra Kulkarni

Christopher Keakini Kaulia

Jun Xu

Peter F Hill

Peter Sven Vosshall

Kurt Kufeld

Michael James McInerny

Daniel Dwight Longley

Jesper Mikael Johansson

Brandon William Porter

Harsha Ramalingam

Chelsea Celest Krueger

Bhavnish H Lathia

Anton Vladilenovich Goldberg

Arun Sundaram

Anand Victor

Zhengqiang Xu

Ramnath R Iyer

David Edouard Louis Robert

Ankur Goenka

Keshav Aswathnarayana Narsipur

Christopher Allen Suver

Andrew Evenson

Melissa Elaine Davis

Todd Vaughn Jonker

Charles Alexander Carman

Srinivasa Susheel Kumar Mannepalli

Robert Stanley Bailes

George Okoth Oburu

Vinay Babubhai Patel

David Elfi

Renaud Bordelet

Chris Hasz

At a rule processing unit of an evolving, self-organized machine learning-based resource management service, a rule of a first rule set is applied to a value of a first collected metric, resulting in the initiation of a first corrective action. A set of metadata indicating the metric value and the corrective action is transmitted to a repository, and is used as part of an input data set for a machine learning model trained to generate rule modification recommendations. In response to determining that the corrective actions did not meet a success criterion, an escalation message is transmitted to another rule processing unit.

Artificial intelligence based self-organizing event-action management system for large-scale networks

Mechanisms for resource isolation allow tenants executing in a multi-tenant software container to be isolated in order to prevent resource starvation by one or more of the tenants. Mechanisms for dependency isolation may be utilized to prevent one tenant executing in a multi-tenant software container from using another tenant in the same container in a manner that requires co-tenancy. Mechanisms for security isolation may be utilized to prevent one tenant in a multi-tenant software container from accessing protected data or functionality of another tenant. Mechanisms for fault isolation may be utilized to prevent tenants in a multi-tenant software container from causing faults or other types of errors that affect other tenants executing in the same software container.

Isolating tenants executing in multi-tenant software containers

A customer in a computing resource service provider environment provisions a virtual machine instance configured with access to sensitive data in a secure storage facility. The virtual machine instance is provisioned specifically to generate reports using a subset of the sensitive data to satisfy different reporting requirements associated with governing entities and agencies. After generating the reports, the virtual machine instance is then removed from the computing resource service environment such that the sensitive data is inaccessible.

System and methods using ephemeral accounts to limit risk of exposing sensitive data

A plurality of virtual machines instances are instantiated and configured to use a subset of sensitive data to generate reports such that the reports can be visually inspected by authorized personnel or entities for potential abnormalities. After completion of the inspection, the virtual machine instances are then deleted such that the sensitive data that were used to generate the reports become inaccessible.

System and methods using ephemeral accounts to protect user accounts with sensitive data

A system is configured to receive a network resource request from a user device configured with a browsing application, wherein the request includes identification data associated with the user device. The system transmits, to a network resource provider, a request for the network resource, wherein the request transmitted to the network resource provider excludes identification data included in the request received from the user device. The system receives from the network resource provider a response, including a document comprising a field configured to receive payment information for an item purchase. The system receives from the browsing application an indication that an anonymous payment instrument, associated with a first entity different than the user, is to be used to purchase a first item at a first price. The system causes information regarding the anonymous payment instrument to be provided to the network resource provider.

Secure proxy service

Methods, systems, and computer-readable media for optimizing a load balancer configuration are disclosed. A load balancer is configured to perform traffic management for a distributed system. A new component is deployed to the distributed system or a performance deviation is predicted in the distributed system. In response to the initiation of the deployment or the prediction of the performance deviation, the configuration of the load balancer is modified from a first state to a second state. Modifying the configuration of the load balancer modifies the traffic management for the distributed system. If the configuration was changed due to a deployment, the configuration of the load balancer is restored from the second state to the first state after a period of time has elapsed.

Optimizing a load balancer configuration

Technologies are described herein for managing the activation of software containers, for throttling of requests directed to tenants executing in a software container, and for priming the execution of software containers. The activation of software containers and tenants may be managed by maintaining an activation queue for storing requests to activate software containers or tenants on a host computer. Requests may be retrieved from the queue and utilized to determine whether a software container or a tenant is to be activated on a host. 'Bounce' or hot swap tenant activations may be performed. Tenant activation requests might also be throttled by denying the requests or by postponing the requests until a later time. A software container might also be configured to throttle incoming requests to tenants executing therein. The execution of a software container might also be primed by replaying previously recorded network traffic to the software container.

Software container activation and throttling

Host computers in a host pool are configured to execute a tenant management service. The tenant management service receives a tenant configuration from a fleet management service that defines tenant services that are to be executed on each host computer. When tenant services are deployed, the tenant configuration may be utilized to determine whether deployed tenants are to be executed or not. The fleet management service might also provide commands at a later time to execute deployed but not executing tenant services or to terminate executing tenant services. The determination as to whether to execute or terminate tenant services may be made based, at least in part, on status information provided by the tenant management service to the fleet management service. The fleet management service might also provide a runtime configuration to tenant services in order to configure aspects of the runtime operation of the tenant services.

Deployment and management of tenant services

Methods, systems, and computer-readable media for implementing global optimization of a service-oriented system are disclosed. Trace data is collected for a plurality of service interactions between services in a service-oriented system. Respective costs are determined for a plurality of configuration options in the service-oriented system. An optimized configuration for the service-oriented system is determined based on the respective costs and the trace data. The optimized configuration comprises a selection of one or more of the configuration options. The optimized configuration is deployed to the service-oriented system.

Global optimization of a service-oriented system

Content inspection and analysis are described. A server stores a definition of sets of browser policies. A definition of one or more sets of users is stored. The server stores an association with a respective set of browser policies for the one or more sets of users. A request is received from a client browser associated with a user, wherein the client browser is configured to communicate with the server. The server determines which set of users the user is associated with. The server identifies a first set of browser policies that is associated with the determined set of users and applies the identified first set of browser policies to the request.

Distributed split browser content inspection and analysis

A routing service provides functionality for selecting an instance of a tenant service for processing a service request and for providing the network location of the selected instance to a service client. The service client may utilize the network location to make a service request to the selected instance of the tenant service. The routing service might also route the service request to the selected instance of a tenant service. The selection of a particular instance of a tenant service for processing a service request may be made based upon various factors including, but not limited to, attributes of the service client making the request and/or attributes of instances of the tenant service being called. The selection of an instance of a tenant service might also be made to implement segmentation, to implement A/B testing, to load balance service requests, and/or to gradually deploy new versions of a tenant service.

Routing to tenant services utilizing a service directory

Methods, systems, and computer-readable media for implementing service-oriented system optimization using static analysis are disclosed. A cross-service static analysis is performed for program code of a plurality of services in a service-oriented system. Based on the cross-service static analysis, one or more service dependencies in the program code are determined. An optimized configuration for the service-oriented system is determined based on the one or more service dependencies. Individual ones of the services are deployed to the service-oriented system based on the optimized configuration.

Service-oriented system optimization using static analysis

Methods, systems, and computer-readable media for implementing service-oriented system optimization using client device relocation are disclosed. An optimized configuration is determined for a service-oriented system based on trace data for a plurality of service interactions between services. One or more of the services are relocated to one or more client devices based on the optimized configuration. The relocation improves a total performance metric in at least a portion of the service-oriented system.

Service-oriented system optimization using client device relocation

Growing community of inventors

Seattle, WA, United States of America

Kyle Bradley Peterson