Amazon Technologies, Inc.

Microsoft Technology Licensing, LLC

Rajesh Viswanathan

Tanya Bansal

Veeraraghavan Vijayaraj

William Trotter Shelton

Prashant Prahlad

Benjamin John Ullom

Adam Daniel Everett Wright

David Steeves

Todd Alan Buiten

William J Reid

James Robert Hamilton

Michael Phillip Czamara

Matthew Scott Garman

Neha Rungta

Anil M Kumar

John Byron Cook

John William Eichelberg

William Frederick Hingle Kruse

Christopher Whitaker

Bruce Wayne Copeland

Carsten Varming

Abhinav Agrawal

Catherine Dodge

Alexander E Mallet

Pauline Virginie Bolignano

Terrance Douglas Hanold

Santosh Kalyankrishnan

Matthew John Hinkle

Andrew Ness

Daryl Stephen Cooke

Ravikanth Repaka

Christopher Rickman

Rodolfo Flores Hinojosa

David J Steeves

A system for providing resources to customers includes racks, sub-rack level secure containment units in the racks, and a provisioning control system. The sub-rack level secure containment units each enclose system resources. The racks hold two or more of the sub-rack level secure containment units. For each customer, the provisioning control system may provision a set of sub-rack level secure containment units to the customer. The provisioning control system may monitor, and create a record of, events of physical access to the system resources in each customer's set of sub-rack level secure containment units.

Providing system resources with secure containment units

A configuration management service provides data identifying its subscribers to a secure sharing service that executes in an account that has a higher security level than a service account used to provide the configuration management service. The secure sharing service securely determines whether each subscriber has authorized producer services to share resource configuration data with the configuration management service. If a subscriber has authorized such sharing, information identifying the subscriber can be stored in a location accessible to the producer services. If a subscriber has not authorized such sharing, the secure sharing service will not make the subscriber's information available to the producer services. The producer services can use the subscriber data to provide resource configuration data to the configuration management service only for those subscribers that subscribe to both the configuration management service and to the producer services.

Secure and efficient cross-service sharing of subscriber data

Techniques are described for identifying 'out-of-band' modifications to an interrelated set of computing resources, also referred to herein as a computing resource stack, that was provisioned at a service provider network using an infrastructure modeling service. An infrastructure modeling service generally allows users to describe a computing resource stack in a text file or other type of descriptive representation, referred to herein as an infrastructure template, and to automatically provision computing resource stacks defined in templates at a service provider network. Users may at times make so-called out-of-band modifications to one or more computing resources of a provisioned computing resource stack, either inadvertently or in response to time-sensitive demands, where an out-of-band modification is made outside of the infrastructure modeling service.

Detecting configuration drift for computing resource stacks

A security assessment system of a computing resource service provider performs security analyses of virtual resource instances, such as virtual machine instances and virtual data store instances, to verify that certain invariable security requirements are satisfied by the instances' corresponding configurations; these analyses are performed before the instances are provisioned and deployed. If the security checks, which can be selected by the administrator of the resources, fail, the requested resources are denied deployment. Notifications identifying the faulty configuration(s) may be send to the administrative user. A template for launching virtual resource instances may be transformed into an optimized template for performing the pre-deployment security checks, such as by storing information needed to perform the checks within the optimized template itself.

Pre-deployment security analyzer service for virtual computing resources

Configurations of computing resources established in a network-based computing service can be tested to assess impacts of proposed changes to the configuration states of the computing resources or to policies governing the configurations of such computing resources. Test environments can be established to simulate an operational computing environment under study. Changes to the configuration of one or more computing resources can be introduced to the test environment, and impacts to the test environment can be assessed. Changes to configuration policy can also be introduced and subsequent impacts can be observed.

Resource configuration testing service

A configuration management system may receive information defining a threshold range of deviation from a baseline configuration of at least one computing resource. The system may acquire periodic records of configuration information, from which it may be determined if the current configuration at least one computing resource has deviation from the baseline outside of the tolerated threshold. A record indicative of a prior configuration within a threshold configuration deviation may be identified. A template may be formed based on the record. The at least one computing resource may be reconfigured, based on the template, to be within the threshold configuration deviation.

Computing resources checkpoint restoration

A configuration history service for web-based computing resources is implemented by capturing and storing a historical record of each configuration state for each computing resource in a subscriber's account. Files of the configuration history store information about a computing resource type offered by the web service. The file comprises records for each particular resource of that type that is or was actively configured in the subscriber's account during the period that the configuration history service is active in the account. Each record lists a particular configuration state, at a particular point in time, for a particular computing resource. The configuration history of a computing resource can be displayed as a timeline by which a subscriber can access information describing the configuration state of the particular computing resource at any point in time.

Resource configuration history service

Configurations of computing resources established on a web-based computing service can be monitored, managed and controlled. According to one embodiment, a method may include discovering a set of computing resources being used by an enterprise. The disclosed resource configuration service can deliver a set of resource-specific data that uniquely identifies each computing resource and describes each resource's configuration state. The resource configuration service monitors the computing environment and detects changes to the configurations of computing resources. The resource configuration service can deliver a stream of notifications when computing resources are created, updated, deleted or otherwise reconfigured. The notifications can be used by, for example, software tools or system administrators.

Resource configuration service

Configurations of computing resources established on a web-based computing service can be monitored, managed and controlled. According to an embodiment, a configuration compliance service is implemented. Policy rules governing attributes of configuration states for computing resources in a subscriber's account are defined. The computing resources in the account are monitored for changes to configuration states. In response to detection of a change to a configuration state that violates a rule, a predefined action is taken. The predefined action can include sending a notification to the subscriber's account, reconfiguring the configuration state of the computing resource, and deactivating the computing resource.

Resource configuration compliance service

A user may utilize an existing digital identity to authorize the user's access to security-enabled device operations, where the security-enabled device comprises a cryptographic chip. The device can receive a user authentication token from the digital user identification service, which authenticates a user's identity. Further, the security-enabled device can validate the user authentication token, and provide the user access to device security operations on the security-enabled device if the user authentication token is successfully validated, allowing the user to reset their security access information for the device.

Alternate authentication

As provided herein, when using an untrusted network connection, a secure online environment can be created for a remote machine by connecting to a trusted computer with a trusted network connection. A proxy server is installed on a first computing device and shared encryption keys are generated for the first device and a portable storage device. A connection is initiated between a second computing device (e.g., remote device), connected to an untrusted network, and the first computing device, comprising initiating a proxy server protocol from the portable storage device (e.g., attached to the second device), using the second computing device. A secure connection between the first and second devices is created using the encryption keys.

Portable secure computing network

One or more techniques and/or systems are disclosed herein for aggregating web-based data stored in a distributed data store so that it can be retrieved in a first-in, first-out (FIFO) manner. A unique aggregation key is generated for respective one or more data generated from a web-based event, where the one or more data are added to the distributed data store, and the aggregation key corresponds merely to the data generated from the web-based event. The one or more data from the web based event is aggregated in a FIFO queue and stored in a same partition of the distributed data store, based on the aggregation key.

Aggregating data from a work queue

Growing community of inventors

Mercer Island, WA, United States of America

Rajesh Viswanathan