Amazon Technologies, Inc.

Niall Mullen

Marc John Brooker

Timothy Allen Wagner

Philip Daniel Piwonka

Mikhail Danilov

Holly Mesrobian

Mihir Sathe

Systems and methods are described for providing auxiliary functions in an on-demand code execution system in a manner that enables efficient execution of code. A user may generate a task on the system by submitting code. The system may determine the auxiliary functions that the submitted code may require when executed on the system, and may provide these auxiliary functions by provisioning or configuring sidecar virtualized execution environments that work in conjunction with the main virtualized execution environment executing the submitted code. Sidecar virtualized execution environments may be identified and obtained from a library of preconfigured sidecar virtualized execution environments, or a sidecar agent that provides the auxiliary function may be identified from a library, and then a virtualized execution environment may be provisioned with the agent and/or configured to work in conjunction with the main virtualized execution environment.

Execution of auxiliary functions in an on-demand network code execution system

Systems and methods are described for enabling graceful recovery of network connections in a virtual machine instance that has been migrated or temporarily halted. To prevent the virtual machine instance from attempting to reuse open connections, which might fail due to migration or halting, a host device identifies open connections just prior to halting the virtual machine instance on the host, and transmits to the virtual machine instance termination signals for the open connections. The host device may further transmit termination signals to the other parties to such connections. Each termination signal may be formatted so as to appear to originate from the other party to the connection, causing both parties to synchronize their knowledge of the connection. On reactivation, the virtual machine instance can recovery the connections without errors associated with attempted utilization of broken connections.

Network connection recovery after virtual machine transition in an on-demand network code execution system

Systems and methods are described for detecting and preventing execution of malware on an on-demand code execution system. An on-demand code execution system may execute user-submitted code on virtual machine instances, which may be provisioned with various computing resources (memory, storage, processors, network bandwidth, etc.). These resources may be utilized in varying amounts or at varying rates during execution of the user-submitted code. The user-submitted code may also be unavailable for inspection for security or other reasons. A malware detection system may thus identify user-submitted code that corresponds to malware by monitoring resource utilization during execution of the code and generating a resource utilization signature, which enables comparison between the signature of the user-submitted code and resource utilization signatures of codes previously identified as malware. The malware detection system may then take actions such as notifying the user who requested execution or preventing execution of the user-submitted code.

Resource utilization-based malicious task detection in an on-demand code execution system

Systems and methods are described for simulated data object storage on a data storage system. The system may allow clients to store computed data objects, which are generated from a source data object based on a user-defined transformation. For example, computed data objects may be thumbnail images generated based on a full resolution image. When a request to store a computed data object is received, the system can predict a timing of a next request for the data object. If expected resource consumption associated with storing the data object until a next request exceeds expected resource consumption associated with generating the data object in response to the next request, the system can acknowledge the request to store the data object, but not actually store the data object. Instead, the system may generate the data object in response to the next request.

Simulated data object storage using on-demand computation of data objects

Systems and methods are described for managing operating system customization in an on-demand code execution system in a manner that enables efficient execution of code. A user may generate a task on the system by submitting code. The system may determine the operating system functions that the submitted code may invoke when executed on the system, and may determine whether the required functionality can be provided by a customized operating system. The customized operating system may provide some functionality but omit other functionality, and thereby avoid consuming any resources associated with making the omitted functionality available. For example, the system may determine that the user-submitted code does not require filesystem interactions, network interactions, interactions with particular devices, caching, paging, profiling, etc., and may thus provide an operating system that does not include one or more of these services.

Operating system customization in an on-demand network code execution system

Systems and methods are described for providing performance-based hardware emulation in an on-demand network code execution system. A user may generate a task on the system by submitting code. The system may determine, based on the code or its execution, that the code executes more efficiently if certain functionality is available, such as an extension to a processor's instruction set. The system may further determine that it can provide the needed functionality using various computing resources, which may include physical hardware, emulated hardware (e.g., a virtual machine), or combinations thereof. The system may then determine and provide a set of computing resources to use when executing the user-submitted code, which may be based on factors such as availability, cost, estimated performance, desired performance, or other criteria. The system may also migrate code from one set of computing resources to another, and may analyze demand and project future computing resource needs.

Performance-based hardware emulation in an on-demand network code execution system

Systems and methods are described for providing auxiliary functions in an on-demand code execution system in a manner that enables efficient execution of code. A user may generate a task on the system by submitting code. The system may determine the auxiliary functions that the submitted code may require when executed on the system, and may provide these auxiliary functions by provisioning sidecar virtual machine instances that work in conjunction with the virtual machine instance executing the submitted code. The sidecars may provide auxiliary functions on a per-task, per-user, or per-request basis, and the lifecycles of the sidecars may be determined based on the lifecycles of the virtual machine instances that execute submitted code. Auxiliary functions may thus be provided only when needed, and may be provided securely by preventing a user from accessing the sidecars of other users.

Growing community of inventors

Seattle, WA, United States of America

Niall Mullen