Amazon Technologies, Inc.

William Frederick Hingle Kruse

Nima Sharifi Mehr

Ashish Rangole

Jeffrey Cicero Canton

Conor Patrick Cahill

Andrew Paul Mikulski

Colin Watson

Dmitry Frenkel

Harshad Vasant Kulkarni

Jeffrey John Wierer

Alexis Lynn Carlough

Kai Zhao

Hardik Navin Nagda

Bharath Mukkati Prakash

Kunal Chadha

Chenxi Zhang

Radu Mihai Berciu

Matthew John Campagna

Donald Lee Bailey, Jr

James E Scharf, Jr

Rajesh Viswanathan

Tanya Bansal

Hassan Sultan

Veeraraghavan Vijayaraj

Nicholas Howard Brown

James Leon Irving, Jr

Ravikanth Repaka

Peter Turk

Gergory Branchek Roth

Panagiotis Thomas

Rodolfo Flores Hinojosa

A request to add tags (e.g., labels, key-value pairs, or metadata) to resources can be digitally signed by the entity making the request, such that the source can be verified and an authorization determination made for each tag. For a request involving multiple services (or entities) that can each add tags, any tag added by a service can be included in the request and digitally signed by that service. Each service processing the request can also digitally sign the request before forwarding, so that each service signs a version of the request, which includes elements signed by other services earlier in the request chain. When the request is received to a tagging service, the service ensures that every tag was digitally signed by the appropriate authorized entity or service, and validates the signatures to ensure that no data was modified or omitted, before adding the tags to the designated resource(s).

Contribution signatures for tagging

A cryptographic key management service receives a request, associated with a principal, to use a cryptographic key to perform a cryptographic operation. In response to the request, the service determines whether a rate limit specific to the principal is associated with the cryptographic key. If the rate limit is associated with the cryptographic key, the service generates a response to the request that conforms to the rate limit. The service provides the response in response to the request.

Cryptographic key management to prevent data exfiltration

A provider network hosting multiple network-based services that implement different resources for a client may provide automated management of resource attributes across the multiple network-based services. A client may send a request to a resource attribute service implemented at the provider network to add a resource attribute to different resources implemented among different network-based services that satisfy resource metadata selection criteria. In response to receiving the request, resource metadata maintained for the different resources implemented among the different network-based resources, which may include one or more previously applied resource attributes, may be evaluated to identify those resources that satisfy the resource metadata selection criteria. For those resources that satisfy the resource metadata selection criteria, the resource attribute may be added to the resource metadata maintained for the different resources.

Automated management of resource attributes across network-based services

A policy management service receives a request to evaluate a provisional policy to determine the impact of implementation of the provisional policy. The policy management service evaluates an active policy against a request to access a computing resource to determine an authorization decision. The policy management service then evaluates the provisional policy against the request to access the computing resource to generate an evaluation of the provisional policy. The policy management service provides the evaluation and the authorization decision in response to the request to evaluate the provisional policy.

Provisional computing resource policy evaluation

A configuration management service provides data identifying its subscribers to a secure sharing service that executes in an account that has a higher security level than a service account used to provide the configuration management service. The secure sharing service securely determines whether each subscriber has authorized producer services to share resource configuration data with the configuration management service. If a subscriber has authorized such sharing, information identifying the subscriber can be stored in a location accessible to the producer services. If a subscriber has not authorized such sharing, the secure sharing service will not make the subscriber's information available to the producer services. The producer services can use the subscriber data to provide resource configuration data to the configuration management service only for those subscribers that subscribe to both the configuration management service and to the producer services.

Secure and efficient cross-service sharing of subscriber data

A record of usage data is obtained, with the record sampled according to a sampling rate from a set of usage data records, with the record specifying a request to access a resource of a computing resource service provider, with the request indicating a set of permissions, and with the sampling rate being based at least in part on a criterion associated with the request. The record is aggregated, based at least in part on a permission of the set of permissions, with at least another record sampled according to the sampling rate from the set of usage data records to produce a set of aggregated usage records and at least a portion of the set of aggregated usage records is provided.

Large-scale authorization data collection and aggregation

Techniques for generating access control policy warnings and suggestions are disclosed herein. An access control policy change specifying changes to one or more permissions associated with the access control policy is received and, based on a set of requests for access associated with the access control policy, an access control policy warning is produced which specifying an indication of whether or not the changes to the one or more permissions should be permitted.

Access control policy warnings and suggestions

Technologies for secure storage of utterances are disclosed. A computing device captures audio of a human making a verbal utterance. The utterance is provided to a speech-to-text (STT) service that translates the utterance to text. The STT service can also identify various speaker-specific attributes in the utterance. The text and attributes are provided to a text-to-speech (TTS) service that creates speech from the text and a subset of the attributes. The speech is stored in a data store that is less secure than that required for storing the original utterance. The original utterance can then be discarded. The STT service can also translate the speech generated by the TTS service to text. The text generated by the STT service from the speech and the text generated by the STT service from the original utterance are then compared. If the text does not match, the original utterance can be retained.

Secure utterance storage

A computing resource service receives a request to access the service and perform various actions. In response to the request, the computing resource service obtains a set of active policies that are applicable to the request. As a result of the service determining that the set of active policies fail to provide sufficient permissions for fulfillment of the request, the service determines if an enforcement policy is available that is applicable to the request. The service evaluates the request using the enforcement policy such that if the enforcement policy includes permissions sufficient for fulfillment of the request, the request is fulfilled.

Access control monitoring through policy management

A policy/resource decommissioning service determines whether a resource has been inactive for a period of time greater than at least one period of time threshold for decommissioning. If the resource has been inactive greater than a first period of time threshold, the service disables the resource such that requests to access the resource are denied. If the resource has been inactive for a period of time greater than a second threshold, longer than the first period of time threshold, the service archives the resource. The service deletes the resource if the inactivity period of the resource is greater than a third period of time threshold, where the third period of time threshold is longer than the first and the second period of time thresholds.

Automatic account resource and policy decommissioning

Growing community of inventors

Seattle, WA, United States of America

William Frederick Hingle Kruse