Amazon Technologies, Inc.

Patrick Trentin

Daniel William Dacosta

John David Backes

Samuel Bayless

Nathan Launchbury

Sagar Chintamani Joshi

Nick Matthews

Benjamin F Jones

Nikolaos Giannarakis

Nadia Labai

Vaibhav Katkade

Syed Mubashir Iqbal

Nandita Mathews

Victor Heorhiadi

A network change verification (NCV) system is disclosed for checking whether a proposed configuration change on a network alters the way that the network controls recently observed network flows. In embodiments, the system builds an observed flow control model (OFCM) from logs of recent flows observed in the network. The OFCM, which may be periodically updated based on newly observed flows, provides a compact representation of how individual network flows were ostensibly controlled by the network. When a proposed configuration change is received, the system analyzes the change against the OFCM to check whether the change will alter how the network controls recently observed flows. If so, the proposed change is blocked, and an alert is generated identifying flows that are affected by the change. The NCV system thus prevents network operators from accidentally making changes on the network that will materially alter the behavior of the network.

Network change verification based on observed network flows

This disclosure describes techniques for identifying blocked paths and network configuration settings that block paths in networks, such as network paths in a virtual private cloud (VPC). The configuration of virtual networks depends on the correct configuration of many networking resources, such as firewalls, security groups, routing lists, access control lists (ACLs), and the like. In some cases, an analysis that uses formal methods can be performed to determine a network configuration of a virtual network. Using the network configuration information, network paths that are blocked and network configuration settings that may be blocking one or more of the network paths can be determined. The PAS can provide an explanation of what is blocking the network paths. For example, the PAS may identify that a configuration setting of a firewall, router, network gateway, an access control list (ACL), and the like may be blocking a network path.

Path analysis service for identifying network configuration settings that block paths in virtual private clouds (VPCs)

Growing community of inventors

Borgo Valsugana, Italy

Patrick Trentin