Eric Brandwine

Techniques are described for providing virtual networking functionality for managed computer networks. In some situations, a user may configure or otherwise specify a logical network topology for a managed computer network with multiple computing nodes that includes one or more virtual networking devices each associated with a specified group of the multiple computing nodes. Corresponding networking functionality may be provided for communications between the multiple computing nodes by… Show more

Techniques are described for providing virtual networking functionality for managed computer networks. In some situations, a user may configure or otherwise specify a logical network topology for a managed computer network with multiple computing nodes that includes one or more virtual networking devices each associated with a specified group of the multiple computing nodes. Corresponding networking functionality may be provided for communications between the multiple computing nodes by emulating functionality that would be provided by the networking devices if they were physically present and configured to support the specified network topology. In some situations, the managed computer network is a virtual computer network overlaid on a substrate network, and the networking device functionality emulating includes receiving routing communications directed to the networking devices and using included routing information to update the specified network topology for the managed computer network. Show less

A system for managing virtual machine instances comprising: a processor; a first computing device, the first computing device hosting at least one virtual machine instance associated with a first set of virtual machine instances and at least one virtual machine instance associated with a second set of virtual machine instances, wherein a virtual machine instance is associated with a set of virtual machine instances by an affiliation to one of a plurality of users; a second computing device, the… Show more

A system for managing virtual machine instances comprising: a processor; a first computing device, the first computing device hosting at least one virtual machine instance associated with a first set of virtual machine instances and at least one virtual machine instance associated with a second set of virtual machine instances, wherein a virtual machine instance is associated with a set of virtual machine instances by an affiliation to one of a plurality of users; a second computing device, the second computing device hosting at least one virtual machine instance associated with the first set of virtual machine instances; and a system manager executed on the processor, wherein the system manager is configured to: determine an event based at least partly on a detected activity associated with execution of one or more of the first set of virtual machine instances; in response to the determined event, prevent instantiation of an additional virtual machine instance not associated with the first set of virtual machine instances on the first computing device hosting the at least one virtual machine instance associated with the first set of virtual machine instances; initiate the additional virtual machine instance on another computing device not hosting one or more of the first set of virtual machine instances; migrate virtual machine instances not associated with the one or more of the first set of virtual machine instances from the first computing device; initiate a new virtual machine instance associated with the first set of virtual machine instances on the first computing device; and migrate the at least one virtual machine instance associated with the one or more of the first set of virtual machine instances from the second computing device to the first computing device. Show less

Techniques are described for providing managed virtual computer networks that have a configured logical network topology with virtual networking devices, such as by a network-accessible configurable network service, with corresponding networking functionality provided for communications between multiple computing nodes of the virtual computer network by emulating functionality that would be provided by the virtual networking devices if they were physically present. In some situations, the… Show more

Techniques are described for providing managed virtual computer networks that have a configured logical network topology with virtual networking devices, such as by a network-accessible configurable network service, with corresponding networking functionality provided for communications between multiple computing nodes of the virtual computer network by emulating functionality that would be provided by the virtual networking devices if they were physically present. In some situations, the networking functionality provided for a managed computer network of a client includes receiving routing communications directed to the virtual networking devices and using included routing information to update the configuration of the managed computer network, such as to allow at least some computing nodes of a managed computer network to dynamically signal particular types of uses of one or more indicated target network addresses and/or to dynamically signal use of particular external public network addresses based on such routing information. Show less

This patent relates to EC2's Virtual Private Cloud. According to this patent, a customer can send an application program interface request to EC2 to specify routing cost information. The Virtual Private Cloud control system can apply the routing cost information to a virtual network. The virtual network can then use the routing cost information to influence how packets are routed within the customer's virtual private cloud.

Techniques are described for providing managed virtual computer networks that have a configured logical network topology with virtual networking devices, such as by a network-accessible configurable network service, with corresponding networking functionality provided for communications between multiple computing nodes of the virtual computer network by emulating functionality that would be provided by the virtual networking devices if they were physically present. In some situations, the… Show more

Techniques are described for providing managed virtual computer networks that have a configured logical network topology with virtual networking devices, such as by a network-accessible configurable network service, with corresponding networking functionality provided for communications between multiple computing nodes of the virtual computer network by emulating functionality that would be provided by the virtual networking devices if they were physically present. In some situations, the networking functionality provided for a managed computer network of a client includes receiving routing communications directed to the virtual networking devices and using included routing cost information to update the configuration of the managed computer network, and/or includes determining actual cost information corresponding to use of an underlying substrate network and providing routing cost information to the client that reflects the determined actual cost information, so as to enable the client to modify the configuration of the managed computer network accordingly. Show less

Techniques are described for providing managed computer networks, such as for managed virtual computer networks overlaid on one or more other underlying computer networks. In some situations, the techniques include facilitating replication of a primary computing node that is actively participating in a managed computer network, such as by maintaining one or more other computing nodes in the managed computer network as replicas, and using such replica computing nodes in various manners. For… Show more

Techniques are described for providing managed computer networks, such as for managed virtual computer networks overlaid on one or more other underlying computer networks. In some situations, the techniques include facilitating replication of a primary computing node that is actively participating in a managed computer network, such as by maintaining one or more other computing nodes in the managed computer network as replicas, and using such replica computing nodes in various manners. For example, a particular managed virtual computer network may span multiple broadcast domains of an underlying computer network, and a particular primary computing node and a corresponding remote replica computing node of the managed virtual computer network may be implemented in distinct broadcast domains of the underlying computer network, with the replica computing node being used to transparently replace the primary computing node in the virtual computer network if the primary computing node becomes unavailable. Show less

This patent relates to making service compute capacity more resilient to failure by separating capacity geographically. Compute capacity is typically assigned as server racks are built. This may cause services (e.g., services that provide e-commerce and Web services) to become geographically close (e.g., same host for virtual machines and often on the same rack). If there is a hardware failure, capacity can be lost and the service can be interrupted. This invention identifies how… Show more

This patent relates to making service compute capacity more resilient to failure by separating capacity geographically. Compute capacity is typically assigned as server racks are built. This may cause services (e.g., services that provide e-commerce and Web services) to become geographically close (e.g., same host for virtual machines and often on the same rack). If there is a hardware failure, capacity can be lost and the service can be interrupted. This invention identifies how geographically redundant a service is (service data center risk) and moves service capacity from one hostclass to another to make services more geographically diverse. Show less

Techniques are described for providing users with access to computer networks, such as to enable users to interact with a remote configurable network service to create and configure computer networks that are provided by the configurable network service for use by the users. Secure private access between a computer network provided for a user by the configurable network service and one or more other remote computing systems of the user (e.g., a remote private network) may be enabled in various… Show more

Techniques are described for providing users with access to computer networks, such as to enable users to interact with a remote configurable network service to create and configure computer networks that are provided by the configurable network service for use by the users. Secure private access between a computer network provided for a user by the configurable network service and one or more other remote computing systems of the user (e.g., a remote private network) may be enabled in various ways. For example, a user may programmatically invoke an API provided by the configurable network service to obtain assistance in establishing remote access from a remote location to a provided computer network of the configurable network service, such as to establish a VPN connection from the remote location to the provided computer network using hardware and/or software supplied to the remote location in response to the API invocation. Show less

Methods and apparatus for provider-arbitrated mandatory access control policies in cloud computing environments are disclosed. A system includes an access manager, and a plurality of resources configurable to provide a plurality of distributed, web-accessible services. Each service has a respective service manager. The access manager determines whether a mandatory access control policy document specified by a service manager of a particular service applies to an administration request, wherein… Show more

Methods and apparatus for provider-arbitrated mandatory access control policies in cloud computing environments are disclosed. A system includes an access manager, and a plurality of resources configurable to provide a plurality of distributed, web-accessible services. Each service has a respective service manager. The access manager determines whether a mandatory access control policy document specified by a service manager of a particular service applies to an administration request, wherein the policy indicates that a permission setting for a resource being used to implement at least a portion of the particular service cannot be modified by a client with administrative rights on the resource. In response to determining that the policy document applies, and that an evaluation of the policy document indicates that an administrative operation specified in the administration request is prohibited by the policy, the access manager rejects the administration request. Show less

This patent relates to managing permissions for Elastic Network Interfaces (“ENIs”). A customer typically has full administrative control over their own AWS resources (e.g., customer instances); however, in cases where the customer wants to connect their resources to AWS resources, control of the ENI may need to be restricted to prevent accidental disconnection from the AWS resources. According to the patent, ENI’s can be associated with mandatory access control policies that limit a… Show more

This patent relates to managing permissions for Elastic Network Interfaces (“ENIs”). A customer typically has full administrative control over their own AWS resources (e.g., customer instances); however, in cases where the customer wants to connect their resources to AWS resources, control of the ENI may need to be restricted to prevent accidental disconnection from the AWS resources. According to the patent, ENI’s can be associated with mandatory access control policies that limit a customer’s ability to disconnect the ENI. If a customer attempts to remove an ENI, an access manager determines whether the mandatory access control policy specified by the service applies and denies the request. Show less

This patent relates to managing the operation of a virtual computer network. The patent describes a system that allows a client to describe a network topology, including how instances are connected to network appliances such as hardware firewalls, virtual private network devices, etc. The system may then select network appliances and use network address mappings to cause traffic from the instances to flow through the network appliances according to the network topology.

This patent relates to situations where multiple clients share computer resources. For example, in a “cloud computing” environment, multiple customers may rent the use of virtual machines, which are hosted by a physical computer. Customer virtual machines are isolated from each other to prevent one customer from accessing the data or the computing capacity of another. Customer virtual machines are separated using an isolating resource, such as a security token, which multiple virtual… Show more

This patent relates to situations where multiple clients share computer resources. For example, in a “cloud computing” environment, multiple customers may rent the use of virtual machines, which are hosted by a physical computer. Customer virtual machines are isolated from each other to prevent one customer from accessing the data or the computing capacity of another. Customer virtual machines are separated using an isolating resource, such as a security token, which multiple virtual machines that are associated with the same customer may share. To prevent duplicate allocation of the same isolating resource, isolating resources are allocated on a least-recently used basis. Show less

This patent relates to situations where multiple clients share computer resources. For example, in a “cloud computing” environment, multiple customers may rent the use of virtual machines, which are hosted by a physical computer. Customer virtual machines are isolated from each other to prevent one customer from accessing the data or the computing capacity of another. Customer virtual machines are separated using an isolating resource, such as a security token, which multiple virtual… Show more

This patent relates to situations where multiple clients share computer resources. For example, in a “cloud computing” environment, multiple customers may rent the use of virtual machines, which are hosted by a physical computer. Customer virtual machines are isolated from each other to prevent one customer from accessing the data or the computing capacity of another. Customer virtual machines are separated using an isolating resource, such as a security token, which multiple virtual machines that are associated with the same customer may share. To prevent duplicate allocation of the same isolating resource, isolating resources are allocated on a least-recently used basis. Show less

A computer-implemented method comprising:
receiving configuration information for a first virtual computer network having a plurality of computing nodes and having a first virtual local area network that includes a first computing node and one or more other computing nodes of the plurality of computing nodes, the configuration information further specifying that the first computing node uses a first communication link configured to be associated with multiple virtual local area networks;… Show more

A computer-implemented method comprising:
receiving configuration information for a first virtual computer network having a plurality of computing nodes and having a first virtual local area network that includes a first computing node and one or more other computing nodes of the plurality of computing nodes, the configuration information further specifying that the first computing node uses a first communication link configured to be associated with multiple virtual local area networks; and
providing, by one or more configured computing systems, the first virtual computer network in accordance with the received configuration information by overlaying the first virtual computer network on a distinct substrate network and by emulating functionality corresponding to the first virtual local area network by:
initiating, by the one or more configured computing systems, forwarding of a communication over the substrate network to the first computing node without the forwarded communication including an identifier specific to the first virtual local area network;
after the forwarding of the communication over the substrate network, modifying, by the one or more configured computing systems, the communication to include the identifier specific to the first virtual local area network based on the first computing node being included in the first virtual local area network and based on the first communication link being configured to be associated with multiple virtual local area networks; and
providing, by the one or more configured computing systems, the modified communication to the first computing node. Show less

Organizations maintain and generate large amounts of sensitive information using computer hardware resources and services of a service provider. Furthermore, there is a need to be able to delete large amounts of data securely and quickly by encrypting the data with a key and destroying the key. To ensure that information stored remotely is secured and capable of secure deletion, cryptographic keys used by the organization should be prevented from being persistently stored during serialization… Show more

Organizations maintain and generate large amounts of sensitive information using computer hardware resources and services of a service provider. Furthermore, there is a need to be able to delete large amounts of data securely and quickly by encrypting the data with a key and destroying the key. To ensure that information stored remotely is secured and capable of secure deletion, cryptographic keys used by the organization should be prevented from being persistently stored during serialization operations. If the keys used to encrypt the data have not been exposed during serialization operation, they may be deleted or destroyed enabling the destruction of data encrypted with the keys. Show less

This EC2 patent describes a 'Resource Placement Template', or RPT. An RPT is a document that describes placement constraints for EC2 instances (i.e., constrains on the virtual private cloud subnets the instance is attached too). Within the RPT, a customer can encapsulate all of the placement policy that the customer desires. A request to launch an instance can be accompanied by a reference to a RPT. The EC2 system responsible for launching instances can use the RPT to determine what subnets… Show more

This EC2 patent describes a 'Resource Placement Template', or RPT. An RPT is a document that describes placement constraints for EC2 instances (i.e., constrains on the virtual private cloud subnets the instance is attached too). Within the RPT, a customer can encapsulate all of the placement policy that the customer desires. A request to launch an instance can be accompanied by a reference to a RPT. The EC2 system responsible for launching instances can use the RPT to determine what subnets to attach the instance too. In the event that the customer changes the network topology or the subnets the instance is attached to, the definition of the RPTs can be updated. Thus, users of the RPTs do not need to be notified of the network reconfiguration or be aware of it. Show less

This patent relates to a way to reduce processing load on network routers in our AWS data centers. In particular, the described technology can offload pre-determined route calculations and storage from edge routers to a central processing system in order to increase edge router performance. In some cases, this facilitates the use of lower-capability, cheap commodity-based routers.

Techniques are described for managing communications for a managed virtual computer network overlaid on a distinct substrate computer network, including for communications between computing nodes of the managed virtual computer network connected to the substrate network and other network nodes external to the substrate network. The managed virtual computer network may have multiple associated virtual network addresses, with each of the computing nodes being associated with at least one of the… Show more

Techniques are described for managing communications for a managed virtual computer network overlaid on a distinct substrate computer network, including for communications between computing nodes of the managed virtual computer network connected to the substrate network and other network nodes external to the substrate network. The managed virtual computer network may have multiple associated virtual network addresses, with each of the computing nodes being associated with at least one of the virtual network addresses, and with one or more external network nodes being integrated into the managed virtual computer network based at least in part by associating one or more other of the virtual network addresses with the external network nodes. The managing of the communications may further include using one or more translation manager modules that interconnect the substrate network with one or more external networks or other external connections via which the external network nodes are accessible. Show less

Techniques are described for providing managed virtual computer networks that may have a configured logical network topology with one or more virtual networking devices, with corresponding networking functionality provided for communications between multiple computing nodes of the virtual computer network by emulating functionality that would be provided by the networking devices if they were physically present. In some situations, the emulating of networking device functionality includes… Show more

Techniques are described for providing managed virtual computer networks that may have a configured logical network topology with one or more virtual networking devices, with corresponding networking functionality provided for communications between multiple computing nodes of the virtual computer network by emulating functionality that would be provided by the networking devices if they were physically present. In some situations, the emulating of networking device functionality includes receiving routing communications directed to the networking devices and using included routing information to update the configured network topology for the managed computer network. In addition, the techniques may further include supporting interactions with devices that are external to the virtual computer network, including remote physical networking devices that are part of a remote computer network configured to interoperate with the virtual computer network, and/or specialized network devices that are accessible via a substrate network on which the virtual computer network is overlaid. Show less

A network-based service may generate notifications regarding items of interest to a user. A contact selection service may receive the notifications and generate a user interface for transmission of the notification to the user. The generated user interface may include a unique identifier and may further enable the user to submit user contact information to request contact with a service agent. The contact selection service may further pre-authorize contacts between users and customer service… Show more

A network-based service may generate notifications regarding items of interest to a user. A contact selection service may receive the notifications and generate a user interface for transmission of the notification to the user. The generated user interface may include a unique identifier and may further enable the user to submit user contact information to request contact with a service agent. The contact selection service may further pre-authorize contacts between users and customer service agents CSA. The unique identifier, and optionally the submitted user contact information, may be employed by the contact selection service to selectively determine which customer contact requests received by the contact selection service are pre-authorized for contact with a CSA and enables such contacts between customers and CSAs to proceed. Show less

A network-based service may generate notifications regarding items of interest to a user. A contact selection service may receive the notifications and generate a user interface for transmission of the notification to the user. The generated user interface may include a unique identifier and may further enable the user to submit user contact information to request contact with a service agent. The contact selection service may further pre-authorize contacts between users and customer service… Show more

A network-based service may generate notifications regarding items of interest to a user. A contact selection service may receive the notifications and generate a user interface for transmission of the notification to the user. The generated user interface may include a unique identifier and may further enable the user to submit user contact information to request contact with a service agent. The contact selection service may further pre-authorize contacts between users and customer service agents CSA. The unique identifier, and optionally the submitted user contact information, may be employed by the contact selection service to selectively determine which customer contact requests received by the contact selection service are pre-authorized for contact with a CSA and enables such contacts between customers and CSAs to proceed. Show less

Techniques are described for providing users with access to computer networks, such as to enable users to interact with a remote configurable network service in order to create and configure computer networks that are provided by the configurable network service for use by the users. Computer networks provided by the configurable network service may be configured to be private computer networks that are accessible only by the users who create them, and may each be created and configured by a… Show more

Techniques are described for providing users with access to computer networks, such as to enable users to interact with a remote configurable network service in order to create and configure computer networks that are provided by the configurable network service for use by the users. Computer networks provided by the configurable network service may be configured to be private computer networks that are accessible only by the users who create them, and may each be created and configured by a client of the configurable network service to be an extension to an existing computer network of the client, such as a private computer network extension to an existing private computer network of the client. If so, secure private access between an existing computer network and new computer network extension that is being provided may be enabled using one or more VPN connections or other private access mechanisms. Show less

This application is generally related to using information from the operation of a computer network to trigger actions outside of the computer network - the described techniques may be useful in services similar to, for example, Amazon.com's Virtual Private Cloud system. As one example, a service may provide a virtual computer network to a customer, and then monitor information that is sent to router devices within the client's virtual computer network. Such monitored routing information may… Show more

This application is generally related to using information from the operation of a computer network to trigger actions outside of the computer network - the described techniques may be useful in services similar to, for example, Amazon.com's Virtual Private Cloud system. As one example, a service may provide a virtual computer network to a customer, and then monitor information that is sent to router devices within the client's virtual computer network. Such monitored routing information may be used by the service to make changes to network devices that are used to run the customer’s virtual computer network. For example, the changes could be to update the service's DNS servers or its NAT (network address translation) devices. Show less

This patent is generally related to managing the operation of a computer network, such as a virtual computer network being provided by, for example, Amazon.com's Virtual Private Cloud service. The described techniques allow a client to describe a physical structure for their computer network. The service providing the computer network may then perform actions that correspond to the physical structure, even if the provided computer network does not actually use that physical structure. Example… Show more

This patent is generally related to managing the operation of a computer network, such as a virtual computer network being provided by, for example, Amazon.com's Virtual Private Cloud service. The described techniques allow a client to describe a physical structure for their computer network. The service providing the computer network may then perform actions that correspond to the physical structure, even if the provided computer network does not actually use that physical structure. Example actions may include handling a communication that is sent from one location to another by changing routing information so make it appear that the communications was routed according to the provided physical structure. Show less

A system and method for determining routing paths on a physical network based in part on user-specified characteristics (e.g., SLA, routing costs, etc.) of a virtual network. User-specified virtual network characteristics therefore affect routing on the physical network. For example, packets associated with a first virtual network with higher performance characteristics are prioritized or routed on a faster path on the physical network compared to packets associated with a second virtual… Show more

A system and method for determining routing paths on a physical network based in part on user-specified characteristics (e.g., SLA, routing costs, etc.) of a virtual network. User-specified virtual network characteristics therefore affect routing on the physical network. For example, packets associated with a first virtual network with higher performance characteristics are prioritized or routed on a faster path on the physical network compared to packets associated with a second virtual network with lower performance characteristics. Show less

Many organizations are required to retain not only data and the results of computation, but in some cases, they may be required to be able to reproduce those results. In many cases, these results are the output of a complex scientific algorithm, and seemingly inconsequential changes to the system such as recompiling a binary or changing a library can cause different results. This patent covers a compute service (e.g., based on Amazon’s EC2 service) that can perform a computation identified as… Show more

Many organizations are required to retain not only data and the results of computation, but in some cases, they may be required to be able to reproduce those results. In many cases, these results are the output of a complex scientific algorithm, and seemingly inconsequential changes to the system such as recompiling a binary or changing a library can cause different results. This patent covers a compute service (e.g., based on Amazon’s EC2 service) that can perform a computation identified as a “repeatable computation” and saves a terminal state of the computation. In response to a request to repeat the repeatable computation, the system repeats the computation and, dependent upon a comparison of the original and new terminal states, determines whether the repeatable computation has been successfully repeated according to a success criterion. Show less