Amazon Technologies, Inc.

Shridhar Kulkarni

Bashuman Deb

Baihu Qian

Omer Hashmi

Thomas Nguyen Spendley

Anoop Dawani

Nick Matthews

Ramin Ali Dousti

Indira Radhika Pulla

Steve Ge

Nicholas Ryan Lombardi

Paul John Tillotson

Diwakar Gupta

Ishwardutt Parulkar

Upendra Bhalchandra Shevade

Georgios Elissaios

Dougal Stuart Ballantyne

Guru Kannan

Brandon Michael LaRue

Sandeep Bajaj

Christopher Brian Barclay

Shovan Kumar Das

Alok Mishra

Justin Lin Hsieh

Fahed Hijazi

Xiyuan Gou

Yuxin Ren

Jaywant U Kapadnis

Jessica Kira Szmajda

Sujan Bolisetti

Stephen A Saville

Brandon Michael Larue

David Jonathan Adams

Aaron Scott DeBruin

Christopher Barclay

Routing metadata, to be used at a transit gateway to transmit packets among a plurality of networks, is obtained from several routing information sources at a route processing node of a connectivity service. The node applies a rule to a subset of the metadata to generate at least a portion of a routing information base, with the first rule indicating a matching criterion for selecting the subset, as well as a mutation to be implemented with respect to the subset. A packet forwarding node of the connectivity service obtains at least a portion of a forwarding information base (FIB) generated by the node from the RIB, and transmits a data packet received at the transit gateway to a next hop destination indicated in the FIB.

Modification of routing and forwarding information for cloud network traffic using customer-specified rules

Systems and methods are provided for creating and running an instance of a dynamic access control system (DACS). Trust providers may be defined in a trust broker of the DACS such that trust information associated with the trust providers can be used to create a custom data structure. Resources and resource groups may be defined in the DACS. Policies may be configured or coded in the DACS to map the custom data structure to recourses or resources groups. Additionally, policies may be configured or coded in the DACS to route the data structure and request to network segments or shared with other parties.

Trust-based dynamic access control system

Techniques for utilizing dual-stack network addressing for compute instances hosted in an edge location of a cloud provider network along with communications service provider (CSP) network addresses are described. A first network address is assigned to the compute instance from a pool of network addresses of the cloud provider network, and a second network address is associated with the compute instance that is provided by the CSP network. A gateway of the edge location is updated to direct packets addressed to the second network address to the compute instance via use of the first network address.

Dual-stack network addressing in cloud provider network edge locations

A message indicating an auxiliary task associated with traffic transmitted via a virtual router between a pair of isolated networks is received at an offloading device. A stack multiplexer at the offloading device selects a protocol stack instance to process the message. A result of the auxiliary task is obtained by the multiplexer from the selected protocol stack instance and transmitted to the virtual router, where it is used to transmit a packet between the isolated networks.

Multi-tenant offloaded protocol processing for virtual routers

Systems and methods are provided for management of network segments that cross geographic regions and/or other types of network divisions in a cloud-based network environment. A cloud-based network provider's geographically-dispersed network infrastructure may serve as the core of a client's private wide area network, and the client may define isolated segments to which other networks (virtual private clouds, virtual private networks, etc.) may be attached. The various segments may remain logically isolated from each other even when implemented across some or all of the same regions—and using the same physical and/or virtual routing components—as other segments of the same client and/or other clients.

Tag-based cross-region segment management

A pair of virtual routers is configured. In response to programmatic requests, dynamic transfer of routing information between the routers in accordance with configuration settings indicated by a client is enabled. The routing information is associated with a set of isolated networks to which the virtual routers are attached. A network packet originating at an address in a first isolated network is transmitted to an address in a second isolated network using a route determined from routing information transmitted between the virtual routers according to the configuration settings.

Dynamic routing for peered virtual routers

Systems and methods are provided for management of network segments that cross geographic regions and/or other types of network divisions in a cloud-based network environment. Gateway may manage traffic across regions using routing metadata that includes a segment identifier. The gateways may also signal their routes across regions based on segment data, and implement the signaled routes using segment-based routing policies. Route selection may be performed using optimization data.

Metadata-based cross-region segment routing

An indication of a set of premises between which network traffic is to be routed via a private fiber backbone of a provider network is obtained. Respective virtual routers are configured for a first premise and a second premise, and connectivity is established between the virtual routers and routing information sources at the premises. Contents of at least one network packet originating at the first premise are transmitted to the second premise via the private fiber backbone using routing information obtained at the virtual routers from the routing information source at the second premise.

Wide area networking service using provider network backbone network

Growing community of inventors

Seattle, WA, United States of America

Shridhar Kulkarni