Amazon Technologies, Inc.

Sivaprasad Venkata Padisetty

Amjad Hussain

Manivannan Sundaram

Steven Merlin Twitchell

Xiong Wang

Anand Doshi

Patrick McFalls

James Alfred Gordon Greenfield

Georgios Elissaios

Michael Groenewald

Mats Lanner

Daniel Francis Conde

Damian Gorman Wylie

Anand Rajender Kumar

Rajnesh Umeshraya Pai

Scott Anthony Roberts

Alan Hadley Goodman

Manoj Krishna Ghosh

Derek Ying Chen Kwiatkowski

Matthew Adam Ford

Nikolaos Pamboukas

Martin Chen Mao

Aaron Jeremiah Sheldon

Katherine Elizabeth Shaffer

Sundaresan Ramamoorthy

Robert Glenn Hearn

Ananth Vaidyanathan

Lavanya Krishnan

Emily Grace Aimette Freebairn

Praerit Garg

Sameer Palande

Kevin Lester Quadros

Lekshmi Unnikrishnan

Bradley Scott Murphy

Munindra Nath Das

Divyang Mahendrabhai Upadhyay

Anantharam Vaidyanathan

Sung Wook Kim

Projesh Chowdhary

Melonia Mendonca

Volodymyr Drozdenko

Junyin Wu

Derek Kwiatkowski

Jun He

Shihua Zhang

Boyuan Feng

A customer submits a request to a virtual computer system service to launch a virtual machine instance and to join this instance to a managed directory. The service may obtain, from the customer, a domain name and Internet Protocol addresses for the selected directory, which is then stored within a systems management server. When launched, the instance may initiate an agent, which may communicate with the systems management server to obtain the configuration information. The agent may use this configuration information to establish a communications channel with the managed directory and create a temporary set of computer credentials that may be used to verify that the customer is authorized to join the virtual machine instance to the managed directory. If the credentials are valid, the managed directory may generate a computer account within the managed directory, which may be used to join the virtual machine instance to the managed directory.

Automatic domain join for virtual machine instances

A virtual computer system service receives a request from a customer to provision a dedicated server for the exclusive use of the customer. The dedicated server may be used to launch one or more virtual machine instances. The virtual computer system service subsequently selects, from a pool of available servers, a server that can be dedicated to the customer and that does not have capacity allocated to any other customer. The virtual computer system service may update a database to specify, in an entry corresponding to the selected server, that the server has been dedicated for the exclusive use of the customer. Once the database has been updated, the virtual computer system service will enable the customer to launch a virtual machine instance using the dedicated server.

Dedicated virtual computing system servers

This disclosure describes techniques for providing users of services provided by network-based service platforms with additional control for approving patches that are to be deployed to computing resources that support their services. In some examples, the techniques include generating and using a 'snapshot,' or list, of patches that are preliminarily approved for deployment. Prior to deploying the patches to the computing resources, users are provided with access to the snapshot and are able to modify the snapshot. For example, users can modify the snapshot by adding patches, removing patches, specifying a sequence in which the patches are to be deployed, and so forth. The snapshot of patches may be 'frozen' for a period of time, meaning that patches that during the period of time, only patches in the snapshot are deployed, and patches that are not included in the snapshot are not permitted to be deployed to computing resources.

Controlling the approval of software updates for computing resources

Compliance schemes may be associated with compliance types to provide resource compliance management. Compliance types may be created and associated with different compliance schemes. Compliance state for the compliance types may be generated and provided in response to requests to access the compliance state. Queries for compliance state, for example, may request compliance state, and query predicates or other criteria may be applied to the compliance state in order to perform the query.

Extensible resource compliance management

A processing device determines that a parameter in a data store is associated with a parameter policy, wherein the parameter comprises a key-value pair and the parameter policy comprises metadata that affects a behavioral characteristic of the parameter. The processing device determines that a criterion included in the parameter policy is satisfied. The processing device determines one or more operations specified in the parameter policy and performs the one or more operations.

Policy based management for key-value pairs

A virtual computer system management service receives input from a user specifying operations to be performed by a web-based service. The input includes an indication of a set of resources to be used to perform the operations and control information to control the set of resources to perform the operations. The virtual computer system management service configures the resources to perform the operations according to the control information. This causes the set of resources to perform the operations and provide a result. The virtual computer system management service provides this result to the user.

Customized command execution for a computing resource fleet

Methods, systems, and computer-readable media for resource configuration based on dynamic group membership are disclosed. An association between a group of computing resources and an intended state is stored. The intended state represents a computing resource configuration. During operation of a computing resource, whether the computing resource belongs to the group of computing resources is determined based at least in part on analysis of one or more attributes associated with the computing resource. Based at least in part on determining that the computing resource belongs to the group of computing resources, one or more actions are caused be performed to bring the computing resource into the intended state. The computing resource is executed while having the computing resource configuration represented by the intended state.

Resource configuration based on dynamic group membership

This disclosure is directed to one or more computing services that provide users with secure access to a computing instance, which is auditable and accessible via a cross-platform browser-based shell or command-line interface (CLI). The computing service(s) forego any need to open up inbound ports, thereby improving security. The computing service(s) employ centralized authentication and auditing to ensure compliance with policies and to log activities for auditing, forensics, or other purposes. A message gateway service creates secure channels with a client device and the computing instance to establish a secure communication tunnel between the client device and computing instance. Once the tunnel is established, a user can send a command via the client device to the computing instance, via the message gateway service. The command output is uploaded to this tunnel and is sent back to the client device, via the message gateway service.

Facilitation of secure communications between a client and computing instance

Techniques for operating a multi-homed computing instance process are described herein. First credentials associated with a first attribute of a first account may be obtained. A process executing on a computing instance may communicate with the first account over a first communication channel based at least in part on the first credentials. Instructions may be received for the process to communicate with both the first account and a second account. Second credentials associated with a second attribute of the second account may be obtained. The second credentials may be obtained based, at least in part, on the first attribute acquiring the second attribute. The process may communicate with the second account over a second communication channel based at least in part on the second credentials. Additionally, the process may communicate with multiple different representations of a particular account, such as different representations that are hosted in different respective regions.

Multi-homed computing instance processes

A customer of a shared resource environment can generate script to be executed by one or more virtual machines, or other such instances or resources, and share that script with other users. The script can relate to administrative or other such tasks, and can be encapsulated into a document, or other such expression, and stored to a network-accessible location. The owner of the document can designate permissions as to which users have rights to access and/or execute the script against their own virtual machines. An owner can grant permission to all users, no other users, or specific users. The script can include parameter values that can be set by the other users or links to specific executables or other objects, among other such options.

Script manager for distributed systems

A technology is described for invoking a command over a set of computing instances. An example method may include receiving a request to invoke a command over a set of computing instances managed within a service provider environment. In response, the computing instances included in the set of computing instances having an attribute may be identified and the command may be sent to the computing instances according to a send rate parameter specifying a rate at which the command is sent to a portion of the computing instances. Execution status indications may be received from the computing instances, wherein a number of errors indicated by the computing instances that exceeds an error threshold terminates execution of the command.

Command invocations for target computing resources

Software packages may be installed, uninstalled and/or updated across a group of computing instances by way of a single issuance of a user request. The request may include information such as a software package name, a software package version, an action (e.g., install or uninstall), and one or more operating constraints for the software package. For an installation request, an agent on a given computing instance may process the request by accessing a manifest that indicates various computing instance characteristics (e.g., operating system types, architecture types, etc.) and various respective available versions of the software package. The agent may then select, based on characteristics of the computing instance, a package type for the computing instance. An installation request may also allow operating constraints (e.g. regarding usage of processing, memory, I/O and other resources) to be set and enforced for the software package.

Software package installation and monitoring

Growing community of inventors

Bellevue, WA, United States of America

Sivaprasad Venkata Padisetty