Amazon Technologies, Inc.

Joyent, Inc.

Yunong Jeff Xiao

Mark Joseph Cavage

Nathan R Fitch

Bryan M Cantrill

David Pacheco

Bradley Jeffery Behm

Fred Kuo

Brian Irl Pratt

Kevin Ross O'Neill

Anders Samuelsson

James E Scharf, Jr

Bradley Jeffrey Behm

Gerald Jelinek

Virtual firewalls may be established that enforce sets of policies with respect to computing resources maintained by multi-tenant distributed services. Particular subsets of computing resources may be associated with particular tenants of a multi-tenant distributed service. A tenant may establish a firewalling policy set enforced by a virtual firewall for an associated subset of computing resources without affecting other tenants of the multi-tenant distributed service. Virtual firewalls enforcing multiple firewalling policy sets may be maintained by a common firewalling component of the multi-tenant distributed service. Firewalling policy sets may be distributed at multiple locations throughout the multi-tenant distributed service. For a request targeting a particular computing resource, the common firewalling component may identify the associated virtual firewall, and submit the request to the virtual firewall for evaluation in accordance with the corresponding firewalling policy set.

Virtual firewalls for multi-tenant distributed services

A request is obtained that, if fulfilled, is operable to access a computing resource, with the request including an indication to evaluate the request in a verification mode while inhibiting fulfilment of the request. Responsive to the request, a policy applicable to the request is determined, decision data that is relevant to the policy is obtained, and the request is evaluated based at least in part on the policy and the decision data to produce an evaluation result. Further responsive to the request, fulfillment of the request is inhibited, a verification report is generated based at least in part on the evaluation result, and a notification is provided indicating that the verification report is generated.

Distributed policy enforcement with optimizing policy transformations

A policy is incorporated into a first set of policies at least in part by generating a second set of policies corresponding to the policy. An index of the first set of policies is generated based at least in part on a policy element of a normal form. Based at least in part on the index, a subset of the first set of policies that is relevant to at least one of a plurality of policy enforcement components is identified and provided to at least one of the plurality of policy enforcement components of a virtual resource provider identified as relevant. A request subject to the policy is received, and the policy is enforced at least in part by evaluating the request with respect to the subset of the first set of policies.

Object store management operations within compute-centric object stores are provided herein. An exemplary method may include transforming an object storage dump into an object store table by a table generator container, wherein the object storage dump includes at least objects within an object store that are marked for deletion, transmitting records for objects from the object store table to reducer containers, such that each reducer container receives object records for at least one object, the object records comprising all object records for the at least one object, generating a set of cleanup tasks by the reducer containers, and executing the cleanup tasks by a cleanup agents.

Object store management operations within compute-centric object stores

User-specified policies may be efficiently implemented and enforced with a distributed set of policy enforcement components. User-specified policies may be transformed into a normal form. Sets of normal form policies may be optimized. The optimized policies may be indexed and/or divided and provided to the distributed set of policy enforcement components. The distributed policy enforcement may have a sandbox mode and/or verification mode enabling policy configuration verification. With appropriate authorization, substitute data may be used in verification mode to evaluate requests with respect to policies. Evaluation results, relevant policies, and decision data utilized during request evaluation may be collected, filtered and reported at a variety of levels of detail. Originating user-specified policies may be tracked during the policy normalization process to enable reference to user-specified policies in verification mode reports.

Zone management of compute-based object stores is provided herein. An exemplary method may include assigning a virtual operating system container from the reserve zone pool to a task group, the task group including a set of tasks for a phase of a first request, and executing the set of tasks within the assigned virtual operating system container.

Zone management of compute-centric object stores

Instruction set architectures for compute-centric object stores. An exemplary method may include receiving a request from a user, the request identifying parameters of a compute operation that is to be executed against one or more objects in a distributed object store, generating a set of tasks from the request that comprise instructions for a daemon, locating the one or more objects within the distributed object store, the one or more objects being stored on a physical node. The method includes providing the set of tasks to a daemon, the daemon controlling execution of the compute operation by a virtual operating system container based upon the set of tasks, and storing an output of the virtual operating system container in the distributed object store.

Growing community of inventors

Seattle, WA, United States of America

Yunong Jeff Xiao