Amazon Technologies, Inc.

Bea Systems, Inc.

Oracle International Corporation

Reto Kramer

Christopher Whitaker

Venkates Paramasivam Balakrishnan

Avinash Jaisinghani

Prashant Jayaraman

Daniel Lee Osiecki

Nishanth Shankaran

Richard Curtis Edwards, Jr

Adam M Thomas

Anno Langen

Ioannis Cosmadopoulos

Geoffrey Scott Pare

Blake Meike

Jaykumar Harish Gosar

Jeffrey Lloyd Baker

Danny Rabbani

Eric Jason Brandwine

Gregory Branchek Roth

Dean Bernard Jacobs

John D Beatty

Vinod Mehra

Manoj Cheenath

David W Connelly

Rao Nasir Khan

Ananthan Bala Srinivasan

Abhishek Singh

David Nunnerley

Anssi Alaranta

Jeffrey Hoffman

Paul James Devine

Calvin J Domenico, Iii

Venkates P Balakrishnan

Systems and methods are described for enabling users to model security resources and user access keys as resources in a template language. The template can be used to create and update a stack of resources that will provide a network-accessible service. The security resources and access keys can be referred to in the template during both stack creation process and the stack update process. The security resources can include users, groups and policies. Additionally, users can refer to access keys in the template as dynamic parameters without any need to refer to the access keys in plaintext. The system securely stores access keys within the system and allows for templates to refer to them once defined. These key references can then be passed within a template to resources that need them as well as passing them on securely to resources like server instances through the use of the user-data field.

Template representation of security resources

Systems and methods are described for bootstrapping an application with metadata specified in a template. The template specifies a stack of resources that will be used to execute an application and also includes a set of metadata for customizing the resources and the application. When the system receives the template, it instantiates a compute node which will execute the application. The compute node may contain at least one initialization script for bootstrapping the application with the metadata contained in the template. This functionality allows users to bootstrap the application running on the compute node with data from within the template that was used to create the stack of resources for executing the application. In this manner, metadata, configuration files, package names and versions can be passed by the application owner to the remote compute node.

Using scripts to bootstrap applications with metadata from a template

A resource provisioning service allows users to provision multiple, different network resources in an atomic manner and with a single call to a resource provisioning service. In some instances, the multiple, different network resources comprise individual types of resources that form a portion of one or more cloud-computing platforms. For instance, one or more entities may host and operate a cloud-computing platform that includes different types of network resources, such a storage service, a load balancing service, a compute service, a security service, or any other similar or different type of network-accessible service.

Provisioning multiple network resources

A hardware serial adapter that can be connected to a serial port of a physical computing device and is associated with network credentials that include a unique hardware identifier and other security information. Upon receipt of data (or other initiation command), the hardware serial adapter transmits a registration request with the network credentials to a distributed network service. If the network credentials are valid, the network service provides communication channel configuration information and session credentials to establish a secure communication for the transmission of data from the hardware serial adapter to a virtual machine instance. The distributed network service can control and manage data transmissions and the communication channel.

Hardware adapter to connect with a distributed network service

Techniques are described that enable a user to upgrade a stack of resources by providing a template that reflects the desired end state of the stack. Upon receiving a new template, the system automatically detects changes that should be performed and determines the order in which the changes should be performed. The system can also detect if the desired changes to the stack are a result of direct modifications; because parameters to the resources have changed; or the changes are indirectly caused by other dependency/attribute changing. Additionally, the system determines whether the changes require creating new resources or if the changes can be made to the resources live. In case of replacement of resources, the system will first create the new resource, move that new resource into the stack and remove the old resource(s). In case of failures, the system ensures that the stack rolls back to the initial state.

Using a template to update a stack of resources

A debugger core captures one or more inputs to a distributed application during live execution of the distributed application in a production environment. The debugger core applies the one or more inputs to the distributed application during replay execution of the distributed application in a debugging environment and performs debugging of the distributed application in the debugging environment.

Microservice replay debugger

A resource stack managed by a resource stack provider is created based on a resource stack template that integrates a custom resource from a second provider into the resource stack using a notification system with the second provider. For example, a customer may create a template that defines a resource stack that comprises resources available from the resource stack provider and one or more custom resources provided by a second provider. When a resource stack is created, resources available from the resource stack provider may be provisioned. Custom resources may be initialized by notifying the provider of the custom resource of the requested integration of the custom resource with the resource stack and requested configuration details. The custom resource provider may respond with an indication of successful integration when the custom resource has been successfully initialized. After initializing the resources, the resource stack may be enabled for use.

Custom resources in a resource stack

An access control policy can be received. The access control policy can identify privileges of a client to use resources to perform authorized actions with the resources. A set of related actions that are related to the authorized actions can be determined. The access control policy can be modified to include at least one related action.

Automatic privilege determination

An access control determination service automatically determines and/or revises an access control policy using actions attempted by a client system. A client is observed during operation. A policy system analyzes the actions performed and/or results of the actions performed by a client system. Using the results of the analysis, the access control determination service determines the permissions needed in an access control policy that will be applied to the client.

Growing community of inventors

Sammamish, WA, United States of America

Reto Kramer