Network-based resource configuration discovery service

Abstract

The present disclosure relates to a network-based resource configuration discovery service. A method is disclosed, the method comprising generating a representation of a client network-based resource configuration based on discovery information about a client network-based resource configuration of a provider network, wherein the provider network provides one or more services to the client. The method also comprises generating a migration plan recommendation based at least in part on the representation of the client network-based resource configuration, wherein the migration plan recommendation specifies a plan to migrate at least a portion of the client network-based resource configuration from the client network to the provider network. The method also comprises executing a migration plan based at least in part on the migration plan recommendation to migrate the at least a portion of the client network-based resource configuration from the client network to the provider network.

Description

[0001] This application is a divisional application of invention patent application No. 201680057194.6, filed on September 30, 2016, entitled “Network-based resource configuration discovery service”. Technical Field

[0002] The present disclosure relates to a network-based resource configuration discovery service. Background Art

[0003] Many companies and other organizations operate computer networks that interconnect numerous computing systems to support their operations, such as where the computing systems are located in the same location (e.g., as part of a local network) or are otherwise located in multiple different geographic locations (e.g., connected through one or more private or public intermediate networks). For example, data centers that house significant numbers of interconnected computing systems have become commonplace, such as private data centers (e.g., enterprise data centers) operated by and on behalf of a single organization, and public data centers operated by an entity as a business to provide computing resources to customers. Some public data center operators provide network access, power, and secure installation facilities for hardware owned by various customers, while other public data center operators provide "full-service" facilities that also include hardware resources available for use by their customers.

[0004] The advent of virtualization technology for commodity hardware has provided benefits to many customers with diverse needs for managing large-scale computing resources, thereby allowing various computing resources to be efficiently and securely shared by multiple customers. For example, virtualization technology can allow a single physical computing machine to be shared among multiple users by providing each user with one or more virtual machines hosted by the single physical computing machine. Each such virtual machine can be viewed as a software simulation that acts as a different logical computing system that provides users with the illusion that they are the only operator and manager of a given hardware computing resource, while also providing application isolation between the various virtual machines.

[0005] Some enterprises may need tools for discovering the configuration of enterprise resources and / or cloud computing resources. However, current discovery tools do not support public APIs or open data formats, and do not provide services that operate across hybrid networks (e.g., networks that include both enterprise data centers and service provider networks). Summary of the invention

[0006] A method is disclosed, the method comprising generating a representation of a client network-based resource configuration based on discovery information about the client network-based resource configuration of a client of a provider network, wherein the provider network provides one or more services to the client. The method also comprises generating a migration plan recommendation based at least in part on the representation of the client network-based resource configuration, wherein the migration plan recommendation specifies a plan to migrate at least a portion of the client network-based resource configuration from the client network to the provider network. The method also comprises executing a migration plan based at least in part on the migration plan recommendation to migrate the at least a portion of the client network-based resource configuration from the client network to the provider network. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 An exemplary system environment is illustrated in which a discovery service operates according to at least some embodiments.

[0008] Figure 2 An exemplary service provider system environment is illustrated in which a discovery service operates according to at least some embodiments.

[0009] Figure 3 An exemplary system environment with third-party tools and a configuration management database in which a discovery service operates according to at least some embodiments is illustrated.

[0010] Figure 4 A block diagram illustrating an exemplary organization of components of a discovery service according to at least some embodiments.

[0011] Figure 5 An exemplary flowchart illustrating a client-side process associated with a discovery service according to at least some embodiments.

[0012] Figure 6 An exemplary flowchart illustrating a server-side process associated with a discovery service according to at least some embodiments.

[0013] Figure 7 is a block diagram illustrating an exemplary block diagram of a system that uses output from a discovery service in at least some embodiments.

[0014] Figure 8 is an exemplary flow chart of a process associated with a migration service using output from a discovery service according to at least some embodiments.

[0015] Fig. 9 is a block diagram illustrating an example computer system according to at least some embodiments.

[0016] Although embodiments are described herein by way of examples of several embodiments and illustrative drawings, it will be appreciated by those skilled in the art that embodiments are not limited to the embodiments or drawings. It should be understood that the drawings and their detailed description are not intended to limit the embodiments to the specific forms disclosed, but on the contrary, they are intended to cover all modifications, equivalents and alternatives falling within the spirit and scope defined by the appended claims. The titles used herein are only for organizational purposes and are not intended to limit the scope of this specification or claims. As used throughout this application, the word "may" is used in a permissive sense (i.e., meaning with possibility) and not in a mandatory sense (i.e., meaning must). Similarly, the word "include / including / includes" means including but not limited to. DETAILED DESCRIPTION

[0017] Various embodiments of the methods and apparatus provide a client resource discovery service designed to help customers of the service automate the discovery of their enterprise IT assets (e.g., clients), whether those assets extend across some private cloud-based service provider and / or the customer's on-premises data center environment. In an embodiment, the service records findings in a database and keeps the database up to date with ongoing changes. The client resource discovery service (or "discovery service") can provide customers with a discovery platform for collecting, storing, and analyzing this information.

[0018] This information can be useful for several reasons. For example, a service (e.g., a network-based discovery service) can simplify the task of migrating workloads to a cloud-based service provider by identifying some or all of the resources that power a client's applications—typically a combination of servers, databases, and file shares—and tracking configuration and performance changes throughout the migration process.

[0019] Typically, a discovery service can provide a central location where customers can sign up for services, install necessary discovery components, analyze collected data, and monitor the health of the discovery service. A public API may be provided to view and populate discovery data. An interface for the installation of system components can reduce manual and / or engineering efforts because, in an embodiment, dependency management for agent installation can be substantially independent, with minimal to no dependency on managed configuration. In some architecture embodiments, connectors and on-premises retained agents are lightweight, and the processing of data can be moved out of the venue and can be disposed of by a service provider. In an embodiment, connectors and agents may be generally referred to as resources based on client networks. In an embodiment, the configuration of resources based on client networks may be referred to as resource configuration based on client networks. A discovery service may be able to collect discovery data from a client's on-premises host (e.g., a client of a service) service and a service provider computing instance executed on behalf of a client or under the guidance of a client. In an embodiment, discovery data may be securely collected from a client. For example, encryption for data at rest and data in transit may be present.

[0020] Figure 1 An exemplary system environment is illustrated in which a discovery service according to at least some embodiments operates to provide a client resource discovery service. The illustrated system environment includes multiple components, including a discovery service 100, which provides a client resource discovery service and is illustrated as having a console 112 (e.g., a website-based console, etc.) and a discovery database 120. Typically, a customer deploys components of the discovery service 100 and manages the discovery service 100 through the console 112. Various data is obtained from various different customer networks and stored in the discovery database 120 (e.g., client A network 130 configuration data is stored in the discovery database 120 as client A configuration 122, and client N network 140 configuration data is stored in the discovery database 120 as client N configuration 124). The illustrated embodiment also depicts two client networks A 130 and N 140 from many possible networks A...N. In some embodiments, the networks may be distributed networks A&N of the same single enterprise, while in other embodiments, the networks may be enterprise networks for different enterprises A and N or a combination thereof.

[0021] Client A network 130 is depicted with a data store 132 and corresponding discovery agent 133, a server 134 and corresponding discovery agent 135, an application 136 and corresponding agent 137, and a discovery connector 138. A local network 139 (e.g., an enterprise WAN / LAN or other network) links the data store 132, server 134, and application 136 to each other and to an intermediate network 150 (e.g., the Internet). Logical connections between discovery connector 138 and data store 132, server 134, and application 136 are also depicted. In some embodiments, the local network may also link discovery connector 138 to data store 132, server 134, and application 136 and / or corresponding agents. In general, in embodiments, the configuration of a client network and the network resources (e.g., client) of the network may be referred to as client network-based resource configuration.

[0022] exist Figure 1 In the embodiment, the client N network 140 is depicted as having agents corresponding to various corresponding resources. The client N network 140 is depicted as having a data store 142, a server 144, an application 146 and corresponding agents 143, 145, 147, and a discovery connector 148. The following explains additional and / or alternative features of the components that make up the various embodiments of the discovery service environment.

[0023] Please note that Figure 2 In FIG. 1 , client N network 140 is depicted as agentless (eg, an agentless implementation of a discovery service on the client network). Client N network 140 is depicted as having network infrastructure 149 (eg, a switch or firewall), data store 142, server 144, application 146, and discovery connector 148.

[0024] In an embodiment, the client-side discovery component may include one or more agents, one or more discovery connectors, one or more third-party discovery tools, or some combination thereof.

[0025] Architecture Components

[0026] In an embodiment, components of the disclosed network discovery service allow customers of the service to discover their enterprise IT assets extending across AWS and on-premises data center environments, record the findings in a database, and keep the database up to date with ongoing changes. In an embodiment, the service simplifies the task of migrating workloads to AWS by identifying all resources that power an application - typically a combination of servers, databases, and file shares - and tracks configuration and performance changes throughout the migration process.

[0027] Discovery Services

[0028] In an embodiment, a discovery service (e.g., discovery service 100) includes all components that implement a discovery-specific workflow. For example, agent service / data collection module 450 collects discovery data from agents installed on behalf of customers (e.g., instances of service providers and customers' on-premises hosts (e.g., hosts on the customer's own enterprise network)). Agent service / data collection module 450 can register itself with the agent service and provide a location where it will receive discovery data.

[0029] Functionality implemented by the proxy service / data collection module 450 may include starting / stopping data collection processes for clients, gathering health information for connectors and agents from the proxy service, communicating configuration information to the proxy service, and processing discovery data.

[0030] In some embodiments, the configuration information by the agent may include identification of one or more of the following: software packages installed on the computer system, processes running on the computer system, types of servers running on the computer system, types of operating systems on the computer system, source entities for network communications received at the computer system, destination entities for network communications sent from the computer system, or performance of processes running on the computer system. In some embodiments, the configuration information may include network information, performance information, component health information, and / or dependency information. The configuration information may include identification of one or more of the following: software packages installed on the computer system, processes running on the computer system, types of servers running on the computer system, types of operating systems on the computer system, source entities for network communications received at the computer system, content of network communications received at the computer system, destination entities for network communications sent from the computer system, performance of the computer system, or performance of processes running on the computer system. The information may include security-related configuration information (e.g., that the ports are open).

[0031] In an embodiment, new customers can sign up for the discovery service using their service provider credentials. Once signed up, they can provide: an encryption key for encrypting discovery data, and an access point for receiving notifications.

[0032] Discovery Console

[0033] In an embodiment, a discovery console (e.g., console 112) is a user interface for the discovery service. The console can be configured to allow customers to sign up for the discovery service, monitor the health of installed components (e.g., connectors, agents), change the configuration of connectors, discovery agents, and collection processes, and download connectors and agents. While in some embodiments customers can manually install these components, other embodiments can provide automatic installation.

[0034] For example, the console may be configured with a user interface element that, when selected by a user, causes the system to download, install, and set up a connector virtual appliance in an enterprise data center (in an embodiment, the downloaded virtual appliance is bundled with the connector).

[0035] The console may be configured with an interface element that allows a customer to selectively configure discovery data collection to change default values ​​for captured data and capture frequency. In an embodiment, the console may be configured with an interface element that allows a user to query, analyze, and / or export discovery data using the console. A public API may be provided to give similar functionality.

[0036] In an embodiment, console 112 may be configured with an interface element to allow a customer to export discovery data, properties, and dependencies between server lists (eg, as XML, CSV, and JSON files).

[0037] In some embodiments, the console is configured to provide a workflow that allows customers to perform agentless discovery (e.g., using connectors). In an embodiment, the console may include an interface element that allows customers to browse and list servers and other IT assets from the right side of the console. The console may also be configured with an interface element that allows customers to manage the deployment of agents to servers from the right side of the console (e.g., assisted by connectors).

[0038] Discover Connectors

[0039] In an embodiment, a connector (e.g., discovery connectors 138, 148) supports configuration of services and can act as an Internet gateway for an on-premises discovery agent. Figure 1 ), the agent collects discovery information and reports it back to the discovery service through the connector. In an embodiment, the connector can be configured with long-term credentials to the service, receive discovery data from the agent, and aggregate and push the data to the discovery service. In an embodiment, the aggregation can be performed by the agent, by the connector, or by the service.

[0040] In an embodiment, a discovery connector component (e.g., discovery connector 148) can be downloaded to and operated in a client's network environment, and can be responsible for collecting discovery data. In an exemplary implementation, once a client signs up for discovery services, they will be presented (e.g., through a console) with a link to a service provider location for downloading a connector. For example, a client can install a connector and run the connector on a virtual machine in a client's enterprise data center. In an embodiment, a connector acts as a local on-premises deployment manager for discovery services. A connector can provide any or all of the following functions: an agent installed on a host computer, discovery data is collected from an agent, data is aggregated, and aggregated data is sent to a discovery service, the health of these agents is monitored and this information is sent to an agent service, encryption keys are obtained and communicated to the agent, configuration information is communicated to the agent, and IDs are obtained from an agent service and assigned to the agent.

[0041] Customers can install more than one connector in their on-premises deployment environment. Each connector can be identified by an ID generated by, for example, a proxy service. In some embodiments, the proxy service can send messages to the connector via a message service (e.g., a message queuing service) or can piggy back on a healthy message sent by the connector.

[0042] In an embodiment, the connector, which may be a virtual appliance downloaded from a service provider network, is installed and run on a virtual machine in an enterprise data center. Customers can sign up to the connector. Once signed up, the service can boot and personalize the connector with a unique identity, trust certificate, and configuration information for different services.

[0043] In some embodiments, the connector can be configured to communicate directly with on-premises infrastructure (e.g. Figure 1 , Item 149; switches; firewalls, routers, etc.) for communication. For example, discovering connectors (e.g., Figure 3 138 ) may be configured to send a request to a firewall (not illustrated), receive data from the firewall, or monitor the firewall, or traffic passing through the firewall of the client network 130 .

[0044] Example connector setup:

[0045] Once a virtual machine is created with the downloaded image of the connector, the customer may be asked to open a preconfigured location (e.g., url) for setting up the connector. In an example, some or all of the following information may be requested from the customer: a user with the necessary permissions to talk to the proxy service, a signed certificate (and private key) that can be used for SSL, and a self-signed certificate.

[0046] Once installed, the connector can be configured to provide a setup wizard. The setup wizard can configure any common services (e.g., common services of the service provider such as web-based services) as well as steps specific to the selected service (e.g., discovery or other services). Common configuration settings may include setting up network connectivity, installing certificates, and configuring platform credentials on the connector. The network setup wizard can be configured to allow customers to select a static or dynamic IP address for their connector and optionally configure a website proxy server to access the service provider's services.

[0047] In an embodiment, the provisioning process may track mandatory metrics such as versions of software deployed, results of various stages of provisioning such as network provisioning, configuration of certified vendors, creation of trust certificates, etc., and the ultimate success or failure of the provisioning workflow. Such metrics may be relied upon to identify and resolve issues faced by customers during provisioning. Customers may optionally share additional metrics related to configuration choices, type and version of hypervisor platform, and type and version of server operating systems, etc.

[0048] In an embodiment, the system may provide an option to run the connector in audit mode. For example, when this mode is selected, all or some of the locally collected discovery data may be made available to the client for auditing. In an embodiment, this data may only be sent to the discovery service when manually verified by the client.

[0049] In an example, a configuration file with information about the proxy service endpoint may be automatically downloaded.A message queue service may be created for the benefit of the client and the information of the queue is sent to the proxy service.

[0050] In an embodiment, some or all of the communications between the proxy service and the connector are handled by a message queue service. For example, whenever a service needs to send a command to a connector, the service can queue a message in a specific message queue service of the connector. Each message can be identified by a unique message id. The connector can continuously long poll the queue for new messages and act on the new messages. For example, a response to a request from a connector can be automatically sent to the proxy service using the same message id.

[0051] The connector may also maintain a small local database. This database may be used to store information such as: encryption keys obtained from the backend service (e.g., this key is rotated every "x" hours), a list of proxies, their IDs, IP and Mac addresses, etc. Note that in some implementations, customers may use static IP addresses for connectors, although in other implementations a dynamic addressing scheme may be used.

[0052] In an embodiment, once the service and connector appliances are set up, the discovery service presents a user interface (e.g., a website-based user interface) as part of the management console. This interface can be used to configure and discover. Connector 148 can be configured to act as a contact point for the service in the enterprise data center and coordinate all discovery-related actions initiated from the service console. In an embodiment, the console will implement a workflow to start and stop data collection on the server and configure data aggregation and data upload strategies. In an embodiment, the client will also be able to export discovery data from the console in JSON format. In an embodiment, in addition to the console, the service will provide an API to programmatically access discovery data.

[0053] In an embodiment, the discovery service console can provide a workflow that allows clients to use connectors for agentless discovery. In addition, the system can provide clients with the ability to browse and list servers and other IT assets from the right side of the console.

[0054] In an embodiment, the connector provides common functionality to service providers, such as a virtual appliance platform, application setup, the ability to push upgrades, logging, troubleshooting, etc. In an embodiment, the connector will also provide a framework for creating and running platform services.

[0055] The connector may also provide an agent plug-in framework that can act as a repository for agent software for various vendor services delivered as plug-ins. When a customer configures a specific vendor service, the connector may install and enable use of that specific agent plug-in.

[0056] In an embodiment, the discovery service is configured to provide a public facing endpoint that the clients will be able to call when they want the discovery service to take a specific action. In some cases, the discovery service will provide a messaging framework for communicating with each connector instance, where each connector instance long polls the service to determine its instructions. In an embodiment, the connector maintains a persistent connection with each proxy or has the proxy poll for the work they need to do depending on the time sensitivity of the use case supported by the proxy. Using this mechanism, clients can effectively trigger on-premises actions, including all the way down to the proxy, without having to allow inbound network connections to their enterprise data center.

[0057] In an embodiment, the connector acts as an Internet gateway and can communicate with the discovery service using a simplified network setup for the proxy. In addition to this, in an embodiment, the connector is configured with long-term credentials for the service provider and aggregates and pushes data to the discovery service.

[0058] acting

[0059] The discovery service provides clients with software agents that can be installed on servers to collect data (e.g., data needed to plan their application migration efforts). Before or after installing the connector, the client can download an agent (e.g., a discovery agent, etc. 133, 135, 137, 143, 145, 147). Some or all of the agents may be available from, for example, a service provider. In an embodiment, the agent is responsible for collecting data from the host and communicating that data to the connector. In an embodiment, a user may be able to select the following configurations on the agent.

[0060] -The type of data that the agent can collect can be variable (eg, static data, dynamic data, etc.).

[0061] -The hostname / IP address of the connector and the port through which the proxy can send information to the connector

[0062] Typically, agent-based approaches can capture more information about client workloads and their dependencies than agentless approaches can capture. The additional information can include, for example, inter-process dependencies, OS-level monitoring data, and running applications.

[0063] The agent can be installed on an on-premises host or on a service provider instance. The agent can be configured to operate in a variety of environments (e.g., Windows and Linux families). The agent can also store a list of service tags (in a configuration file) that can be attached to the data collected by the agent.

[0064] Agent installed on an on-premises host

[0065] For agents installed on an on-premises host, customers may be provided with the ability (e.g., through configuration or an interface) to bundle the agent with a certificate that the connector uses for authentication (this certificate may be different from the certificate that the connector uses for SSL). For example, customers may use their personal certificate or create a self-signed certificate at the connector. In an embodiment, the connector then retains the public key of this certificate. In some embodiments, the registration certificate may be generated at the connector, while in other embodiments the registration certificate may be generated at the proxy service.

[0066] Proxy Authentication

[0067] In some embodiments, the connector may authenticate the agent in the following manner: For example, initially when the agent becomes active, the agent contacts the connector and sends the agent IP address, host name and Mac address details (the connector authenticates using a certificate installed on the connector). The connector receives the ID from the agent service and sends it to the agent. The agent encrypts the ID with its private key and sends it back to the connector. The connector decrypts the ID with the public key (the public key of the agent that the connector previously stored), and if the ID matches what it sent, the agent is authenticated. From now on, this ID is used to identify a specific agent.

[0068] In an embodiment, for sending discovery data, the agent can obtain an encryption key from the connector, encrypt the data and publish the data to the connector. In some examples, the ACK message can be used to backload any configuration-related changes back to the agent. All or some configurations related to the agent can be stored in a configuration file on the host.

[0069] Agent installed on the service provider instance

[0070] In an embodiment, the agent may also be installed on a service provider instance (e.g., Figure 2 , items 233, 214A-N). These agents can be preconfigured with the agent service endpoint to send discovery data (via a configuration file uploaded to the service provider network). These agents can communicate directly with the agent service (e.g., without a connector). For example, these agents can use instance roles for authentication and communication with the agent service endpoint. These agents can be given an ID from the agent service. In an embodiment, when an on-premises instance is migrated to a service provider, the corresponding agent can be given a new ID. The old ID can be retained on the agent for reference purposes.

[0071] Agent Services

[0072] Proxy services (e.g. Figure 4 450) can be an internal service of a service provider that helps manage agents that collect data from hosts. Exemplary functions of the agent service may include registration of agents and connectors (described below), providing IDs, service tags, and / or configuration values ​​to agents and / or connectors, providing encryption keys to agents and / or connectors, providing details and temporary credentials for accessing data streams to agents and / or connectors, collecting health information for agents and / or connectors, instructing agents and / or connectors to start / stop data collection, receiving data collection requests from the service provider's internal services, and / or distributing collected data to data streams provided by these services.

[0073] In an embodiment, the agent service provides a common framework that can be used by some or all of the service provider's internal services (e.g., internal services interested in collected data from agents installed on service provider computing instances) and / or the customer's on-premises hosts. In an embodiment, at startup, both the discovery service and the inspector service can be authenticated to use the agent service.

[0074] The discovery service can also be configured for agentless discovery using connectors. The connector (without deploying an agent) can be configured to obtain a list of the customer's data center inventory. Figure 2 Such an architecture is illustrated in . In an embodiment, agentless discovery from connector 148 may include setting credentials for WMI (Windows Management Instrumentation), SSH (Secure Shell), and SNMP (Simple Network Management Protocol) based discovery.

[0075] In an embodiment, the connector may provide customers with a low friction alternative to deploy the agent themselves. For example, a connector-managed installation provides customers with the ability to configure (through a combination of a console and a connector) and deploy a discovery agent to target a server. In an embodiment, in the case of a virtualized enterprise data center, the server is typically a VM running on a bare metal hypervisor. Examples may include workflows for identifying target machines using agentless discovery, deploying agents to machines, defining the length of data collection, and the like. The connector may then deploy the agent to the target machine using various techniques, including, for example, the use of hypervisor-level APIs (vSphere APIs, PowerShell) or operating system-level APIs (WMI, SSH). In an embodiment, the customer may then configure the user account and credentials required to execute these APIs through the connector.

[0076] The following methods can be used to provide various levels of agentless discovery.

[0077] The system can be configured to provide a basic version of agentless discovery by discovering an inventory of VMs (e.g., using the vCenter API). For example, this feature can capture the names of the VMs, VM containers such as data centers, host clusters, ESX hosts, and vCenter folders, their static virtual hardware configurations such as the CPU, network, storage, and memory capacity they provision, and the operating system they run. In an embodiment, the system can provide clients with an interface that can filter VMs based on these varying criteria to come up with a list of servers where they want to place agents.

[0078] WMI, WinRM, and SSH: In an embodiment, the system can be configured so that customers can set up connectors with valid user accounts on their servers, at which point agentless discovery can be performed using WMI, WinRM, or SSH-based technologies for remote command execution. For example, in an enterprise datacenter environment, where user accounts and authentication are typically managed through a central service such as Microsoft Active Directory, user accounts are created in the AD server and the credentials are pushed to all servers.

[0079] SNMP: In an embodiment, the system may be configured so that customers can configure SNMP in their servers with a specific MIB that will allow the connector to extract system configuration and network connectivity from the Linux server.

[0080] Advanced vCenter API: In an embodiment, the connector will use the advanced vCenter API to exploit constructs such as vSwitch, vApp, and VM Port Group to obtain relationships between VMs, which may indicate a collection of related VMs into which a customer can inject an agent.

[0081] Nmap: In an embodiment, the connector will use the open source Nmap tool to browse the target host for services running in the target host based on standard port numbers published by IANA.

[0082] Network Packet Capture: In an embodiment, the system may be configured so that customers can set up their physical or virtual switches to reflect ports to connectors that will have the ability to use this data to identify network protocols, application signatures, generate process records, and deduce network connections between servers.

[0083] Externalization using public APIs: In an embodiment, the system may be configured so that customers can write custom scripts to obtain this information from their private sources of this data, including the enterprise CMDB used to bootstrap the discovery service with agentless discovery data.

[0084] In an embodiment, the customer may manually use one of the techniques described above or meet with the application owner to propose a first server or set of servers where they would like to place the proxy.

[0085] In an embodiment, customers may use their existing deployment tools or tools from other software vendors to deploy the agent software to target servers.

[0086] Discovery Database

[0087] Discovery information specific to a customer may be stored in a discovery database (e.g., discovery database 120). In an embodiment, the discovery database may be a database or other type of data store. The data store may store static data, dynamic data, and / or configuration data (e.g., regarding discovery). In an embodiment, a combination of data stores may be selected to represent the nature of the data. For example, static data (such as IP, host name, etc.) may be stored in a NoSQL database, while data representing communications between different hosts may be stored in a graph database). In an embodiment, the data stored in the data store may be encrypted. Customers / third-party vendors may write tools to analyze / visualize the collected discovery data (e.g., using a public API service).

[0088] For purposes of illustration, the following non-exhaustive list of the kinds of data that can be collected is arranged into three broad categories of information. The list is indicative of the types of information, but is not exhaustive.

[0089] Static Configuration

[0090] Server host name, IP address, MAC address

[0091] Static CPU, network, memory, and disk resource allocation

[0092] DNS server used

[0093] The name of the installed application from the server

[0094] List of installed business enterprise applications from the website / application container

[0095] A list of active running processes from the server

[0096] Time Series Performance Metrics

[0097] CPU Usage

[0098] Memory usage

[0099] Observed network throughput and latency

[0100] Disk usage

[0101] relation

[0102] Established network TCP and UDP connections and associated processes

[0103] The network port the server is listening on and the listening process

[0104] The following represents an exemplary ontology for the discovery database 120. This list is not complete and does not cover every object that can be represented in the discovery database. For example, this particular list may be associated with objects needed to represent data captured from a SharePoint application. Other lists associated with other objects and other applications are also contemplated.

[0105] Class: Server

[0106] Description: Describes information about the server / host. Can have descendants based on OS or other parameters.

[0107] Attributes: Hostname, Serial Number, Manufacturer, OS, OS Version, CPU, CPU Speed ​​(GHz), CPU Cores, Disk Count, Disk Space, Storage (GB), Is Virtual, NIC Count, DNS Servers, Default Gateway, Custom (allows custom client data)

[0108] Class: Database

[0109] Description: Database can extend both server and software. Contains more specific information about the database. Can have descendants based on type (e.g. MySql).

[0110] Attributes: Name, Vendor, Version, Type, Allocated Memory, Allocated Space, Custom (allows custom client data),

[0111] Category: Software

[0112] Description: Covers applications and software required by a service. Applications run on one or more servers. May also be referred to as installed software. May have descendants based on type (e.g. database).

[0113] Attributes: Name, Vendor, Version, Type, CMDLine, Custom (allows custom client data).

[0114] Class: Process

[0115] Description: A process is an instance of a computer program that is being executed. It contains the program code and its current activity. A running software can have several processes. You can assume that a process is the connection between a server and an application.

[0116] Properties: PID, Name, CMDLine, Parameters, StartupTime, User, Priority, Custom (allows custom client data)

[0117] Class: Connection

[0118] Description: Keeps track of information about established connections between servers.

[0119] Properties: Source IP, Source Port, Destination IP, Destination Port, Protocol, Custom (allows custom client data), Link to process (optional).

[0120] Class: IP Subnet

[0121] Description: A subnet or subnetwork is a logical, visible subdivision of an IP network. The practice of dividing a network into two or more networks is called subnetting. Computers belonging to a subnet are addressed by a common, equal, most significant set of bits in their IP addresses.

[0122] Properties: IP network address, IP network mask, IP address type, Custom (allows custom client data), Link to server in subnet

[0123] Class: NIC

[0124] Description: A network interface controller (NIC, also called a network interface card, network adapter, LAN adapter, and by similar terms) is a computer hardware component that connects a computer to a computer network.

[0125] Attributes: Capacity, MAC address, subnet, local IP, global IP, custom (allows custom client data)

[0126] Class: Disk

[0127] Description: Tracking of storage information associated with a host.

[0128] Attributes: Type, Description, Disk Space, Name, Volume Serial Number, Custom (allows custom client data)

[0129] Figure 2 An exemplary service provider system environment is illustrated in which a discovery service operates according to at least some embodiments. In the illustrated embodiment, the discovery service 100, the client A network 130, and the client N network are depicted as being similar to Figure 1250. In the depicted embodiment, the discovery service 100 is illustrated as part of a service provider network 250. In an embodiment, the service provider network 250 can be a cloud-based service provider that provides various computing services to various and many different clients. For example, the service provider network 250 is illustrated as having a virtual database service 220, which includes a client A database 222 (with a corresponding discovery agent 233) and a client N database 224. The virtual database service 220 can be provided to various different clients (e.g., clients A...N) of the service provider. In some embodiments, the data stored in the virtual database service 220 can be accessed by a virtual computing workload of any one of the clients A...N operating on the service provider network 250, or by a client component on a client's network (e.g., client network 130 / 140). The service provider network 250 is also depicted as having a virtual computer service 210, which includes clients 212A-N (with corresponding discovery agents 214A-N) and a connector 216. In an embodiment, virtual computing service 210 may provide computing services to clients AN. Discovery service 100 may discover client configurations for both clients of a client's own enterprise network and / or clients or resources operated on behalf of a client in a cloud (e.g., on a service provider network). For example, in an embodiment, a virtual computing service may be a discovery agent (as depicted) and / or configured with a discovery connector (not illustrated) that performs discovery on instances of computing services on behalf of the respective client.

[0130] In some embodiments, the service provided by the service provider may provide an interface for collecting data without using an agent. For example, data may be collected from a virtual computing service (e.g., 210) by querying the service's API (e.g., a method data API or a login tool for a virtual computing service).

[0131] Figure 3 An exemplary system environment with third-party tools and configuration management databases in which a discovery service operates according to at least some embodiments is illustrated. Client A network 130 is depicted with third-party discovery tool 312 and configuration management database 310, which are connected to the discovery service via discovery connector 138. In the illustrated embodiment, the environment also includes third-party tools 320 and database 322, which can be connected to discovery service 100 and / or client A network 130 via an intermediate network 150 (e.g., the Internet, a private or public WAN, or the like).

[0132] Figure 4A block diagram illustrating an exemplary organization of components of a discovery service 100 according to at least some embodiments. One or more components of the depicted discovery service may perform, for example, Figure 5 and 6 In an embodiment, the illustrated discovery service 100 can identify the software running in servers (e.g., bare metal servers) and virtual machines based on analysis of data, and map dependencies between workloads that make up the application.

[0133] For example, in an embodiment, the depicted discovery service 100 analyzes data from a data store and identifies installed software packages, operating systems and application processes, network dependencies of these applications, and their runtime performance. The discovery service 100 can discover network communications between applications and record the network infrastructure dependencies of the applications used for discovery in an enterprise data center or on a computing node of a service provider. For example, the discovery service 100 can capture a snapshot of the health and performance of an application (e.g., establishing a baseline for comparison after the migration of an application to a service provider network). In an embodiment, the data survey results can be recorded in a discovery database 120, which can serve as a reliable picture of the IT assets of the customer that constitutes that application. The customer can interact with this information through an interface (e.g., console 112), for example, to find the workload that constitutes the application, analyze dependencies, build migration strategies, and evaluate migration results. In an embodiment, the discovery service can automate some or all of these functions.

[0134] like Figure 5 and 6 As illustrated in , the process begins by deploying components including agents, connectors, and a discovery service 100, which collects information (e.g., information needed to plan and monitor migrations) including dependency information and server utilization information. As data is received from agents and other collection sources, the data is added to the discovery service (e.g., to the discovery database 120). The discovery service also allows third-party monitoring and discovery tools to store information in the discovery service's repository through a public API (e.g., third-party adapters 455), so tools from third-party vendors can publish their findings to the database. Other adapters can be configured to provide interfaces to other third-party configuration management databases to synchronize that data with the discovery data store 120 repository.

[0135] Discovering Public API Services

[0136] Discover public API services (for example, in Figure 4457) may provide a public API for clients to update / add discovery data and retrieve the discovery data. For example, a client may have discovery data in a configuration management database. In an embodiment, public API 457 and / or third party adapters 455 provide tools to move this data to the discovery database. In an embodiment, the API will primarily be used to read data and write data to the discovery database 120. In an embodiment, a client may access the API using an SDK available for, for example, Java, Python, and Ruby.

[0137] At startup, the discovery service 100 can be integrated with discovery solutions from third-party vendors that publish information to the discovery service; third-party migration solutions can use the discovered information to support client migration; and third-party migration frameworks can provide a combination of analysis and migration support to customers based on the discovered information. This can be achieved through public APIs 457 and / or third-party adapters 455 provided by the service to read and write discovery data. These program interfaces can enable partners to perform discovery and migration of proprietary and vendor-specific technologies that are not originally supported by the discovery service. The program interfaces also enable customers, system integrators, and others to build project-specific discovery and migration tools on top of the platform.

[0138] Customers or ISVs can write their own adapters for enterprise CMDBs. If customers have already invested in one of these products, they can use these adapters to import data into the discovery database 120. If they continue to use these CMDBs, customers can periodically update the data in the discovery database with changes from their on-premises CMDBs. In an embodiment, the discovery service may include adapters for on-premises CMDB solutions in this space.

[0139] The system API may include APIs for adding configuration entries, modifying configuration entries, consuming stored data, and the like.

[0140] Discovery Service API

[0141] The following is a non-exhaustive list of exemplary APIs that may be utilized through the discovery service. Additional APIs are also contemplated that implement more complex operations by combining the functionality of two or more of the basic operations defined in this document. The APIs are functionally grouped into

[0142] ExportConfigurations

[0143] GetConfigurationAttributes

[0144] ListConfigurationItem

[0145] GetExportStatus

[0146] RemoveConfigurationItem

[0147] <Tag API's>

[0148] CreateTags

[0149] DeleteTags

[0150] DescribeTags

[0151] API Structure

[0152] ExportConfigurations

[0153] Description: Exports configuration data consisting of all discovered configuration items and relationships to a service provider storage service using the provided service provider storage service bucket and key.

[0154] Input: BucketName: Configure the service provider storage service bucket to be exported.

[0155] KeyPrefix: Configures the service provider storage service key that will be exported.

[0156] roleName: The role that the service will use to access the bucket

[0157] Filter: This is a sequence either key=<value> or key~=<value> and supports logical operators to separate them.

[0158] Output:

[0159] exportId: A unique identifier for the export request that can be used to query and find out the status of the export.

[0160] numberOfConfigurations: The count of configuration items that will be exported.

[0161] exception:

[0162] AuthenticationFailedException: This exception is thrown when the credentials provided by the caller are invalid.

[0163] AuthorizationErrorException: This exception is thrown when the credentials are valid but the user does not have the policy to call this specific API.

[0164] InvalidParameterException: This exception is thrown when calling the API with parameters that are not defined in the request. Review the available parameters for the API request.

[0165] InvalidParameterValueException: This exception is thrown when an API is called with a bad or out-of-bounds value supplied for an input parameter.

[0166] ServerInternalErrorException: This exception is thrown when the error is usually caused by a server-side problem.

[0167] GetConfigurationAttributes

[0168] Description: Get a list of properties associated with a configuration item identified by a configuration item id.

[0169] Input: configurationIds: List of configuration item identifiers

[0170] Filter: This is a sequence either key=<value> or key~=<value> and supports logical operators to separate them.

[0171] maxResults: # of items returned

[0172] nextToken: The token of the next listing that will be used by the client to list items Output:

[0173] Configuration: A map of configurationId and a list of <key,value>. Key-value is represented as AttributeName and AttributeValue.

[0174] nextToken: The token of the next listing that will be used by the client to list the item

[0175] exception:

[0176] AuthenticationFailedException: This exception is thrown when the credentials provided by the caller are invalid.

[0177] AuthorizationErrorException: This exception is thrown when the credentials are valid but the user does not have the policy to call this specific API.

[0178] InvalidParameterException: This exception is thrown when calling the API with parameters that are not defined in the request. Review the available parameters for the API request.

[0179] InvalidParameterValueException: This exception is thrown when an API is called with a bad or out-of-bounds value supplied for an input parameter.

[0180] ResourceNotFoundException: This exception is thrown when the configuration id provided by the client is not found.

[0181] ServerInternalErrorException: This exception is thrown when the error is usually caused by a server-side problem.

[0182] ListConfigurationItem

[0183] Description: Get a list of configuration items that match the one identified by a filter specification. A filter specification specifies conditions that apply to attributes associated with a relationship.

[0184] Input: configurationType: This is the valid type of the configuration item recognized by the discovery service. Internally, it will be an enum class.

[0185] Filter: This is a sequence either key=<value> or key~=<value> and supports logical operators to separate them.

[0186] maxResults: # of items returned

[0187] nextToken: The token of the next listing that will be used by the client to list the item

[0188] Output:

[0189] configurationIds: list of configuration item ids

[0190] nextToken: The token of the next listing that will be used by the client to list the item

[0191] exception:

[0192] AuthenticationFailedException: This exception is thrown when the credentials provided by the caller are invalid.

[0193] AuthorizationErrorException: This exception is thrown when the credentials are valid but the user does not have the policy to call this specific API.

[0194] InvalidParameterException: This exception is thrown when calling the API with parameters that are not defined in the request. Review the available parameters for the API request.

[0195] InvalidParameterValueException: This exception is thrown when an API is called with a bad or out-of-bounds value supplied for an input parameter.

[0196] ServerInternalErrorException: This exception is thrown when the error is usually caused by a server-side problem.

[0197] GetExportStatus

[0198] Description: API gets the status of the export request.

[0199] Input: exportId: Unique identifier for the export request. This can be used to query and find out the status of the export.

[0200] Output:

[0201] exportId: A unique identifier for the export request.

[0202] Status: The status of the export. (A set of fixed values)

[0203] statusMessage: A descriptive message for the current status of the export.

[0204] Exception: AuthenticationFailedException:

[0205] This exception is thrown when the credentials supplied by the caller are invalid.

[0206] AuthorizationErrorException: This exception is thrown when the credentials are valid but the user does not have the policy to call this specific API.

[0207] InvalidParameterException: This exception is thrown when calling the API with parameters that are not defined in the request. Review the available parameters for the API request.

[0208] InvalidParameterValueException:

[0209] This exception is thrown when an API is called with a bad or out-of-bounds value supplied for an input parameter.

[0210] ResourceNotFoundException: This exception is thrown when the configuration id provided by the client is not found.

[0211] ServerInternalErrorException: This exception is thrown when the error is usually caused by a server-side problem.

[0212] RemoveConfigurationItem

[0213] Description: API removes configuration items

[0214] Input: configurationId: The id of the configuration item to be removed

[0215] exception:

[0216] AuthenticationFailedException: This exception is thrown when the credentials provided by the caller are invalid.

[0217] AuthorizationErrorException: This exception is thrown when the credentials are valid but the user does not have the policy to call this specific API.

[0218] InvalidParameterException: This exception is thrown when calling the API with parameters that are not defined in the request. Review the available parameters for the API request.

[0219] InvalidParameterValueException: This exception is thrown when an API is called with a bad or out-of-bounds value supplied for an input parameter.

[0220] ResourceNotFoundException: This exception is thrown when the configuration id provided by the client is not found.

[0221] ServerInternalErrorException: This exception is thrown when the error is usually caused by a server-side problem.

[0222] CreateTags

[0223] Description: API to add tags to configuration items

[0224] Input: configurationId: The configuration item ID that needs to be tagged

[0225] Tags: List of keys and values

[0226] exception:

[0227] AuthenticationFailedException: This exception is thrown when the credentials provided by the caller are invalid.

[0228] AuthorizationErrorException: This exception is thrown when the credentials are valid but the user does not have the policy to call this specific API.

[0229] InvalidParameterException: This exception is thrown when calling the API with parameters that are not defined in the request. Review the available parameters for the API request.

[0230] InvalidParameterValueException: This exception is thrown when an API is called with a bad or out-of-bounds value supplied for an input parameter.

[0231] ResourceNotFoundException: This exception is thrown when the configuration id provided by the client is not found.

[0232] ServerInternalErrorException: This exception is thrown when the error is usually caused by a server-side problem.

[0233] DeleteTags

[0234] Description: API delete tag

[0235] Input: configurationId: Unique identifier of the configuration item

[0236] Tags: List of keys and values

[0237] exception:

[0238] AuthenticationFailedException: This exception is thrown when the credentials provided by the caller are invalid.

[0239] AuthorizationErrorException: This exception is thrown when the credentials are valid but the user does not have the policy to call this specific API.

[0240] InvalidParameterException: This exception is thrown when calling the API with parameters that are not defined in the request. Review the available parameters for the API request.

[0241] InvalidParameterValueException: This exception is thrown when an API is called with a bad or out-of-bounds value supplied for an input parameter.

[0242] ResourceNotFoundException: This exception is thrown when the configuration id provided by the client is not found.

[0243] ServerInternalErrorException: This exception is thrown when the error is usually caused by a server-side problem.

[0244] DescribeTags

[0245] Description: API description tag

[0246] enter:

[0247] Filters:

[0248] This is the sequence either key=<value> or key~=<value> and supports logical operators to separate them.

[0249] Output:

[0250] Label

[0251] A list of keys and values ​​along with the configuration type and configurationId

[0252] exception:

[0253] AuthenticationFailedException: This exception is thrown when the credentials provided by the caller are invalid.

[0254] AuthorizationErrorException: This exception is thrown when the credentials are valid but the user does not have the policy to call this specific API.

[0255] InvalidParameterException: This exception is thrown when calling the API with parameters that are not defined in the request. Review the available parameters for the API request.

[0256] InvalidParameterValueException: This exception is thrown when an API is called with a bad or out-of-bounds value supplied for an input parameter.

[0257] ResourceNotFoundException: This exception is thrown when the configuration id provided by the client is not found.

[0258] ServerInternalErrorException: This exception is thrown when the error is usually caused by a server-side problem.

[0259] Figure 4 Also illustrated is a console 112 having a discovery lifecycle manager 412 and a discovery presentation module 414. In an embodiment, the console may be configured to display interface elements associated with the status of discovery deployment, data collection, etc. For example, monitoring workflows may verify the correctness of the installation and functionality of deployed agents and connectors. In some cases, the health of connectors may be displayed in or by the console 112. For example, the console 112 may provide an interface element that provides management of health status data that may be obtained from the latest data upload of discovery data or even from a probe message in a queue. The health of the discovery agent may also be displayed in or by the console 112. For example, the health of the agent may be periodically published to the console. In some embodiments, error information about the agent is also published on the console.

[0260] In some embodiments, console 112 may be configured to receive changes to the discovery configuration. For example, console 112 may be configured to receive input from a user selecting options for changing the configuration of the agent, encryption keys, notification service topics, etc. used by the agent and / or discovery service. The connector may pull these or other settings (e.g., from a message queue) and place a response (e.g., place a message back into the queue). In an embodiment, an agent on the service provider network may poll the proxy service for configuration-related data.

[0261] In an embodiment, the discovery service 100 can be configured to eliminate a lot of manual labor from enterprise migration by automating the identification of applications and their dependencies (e.g., identifying what software workloads are running in the server and understanding their usage patterns). In the past, customers and IT practitioners collected this data by meeting with application and IT teams within the enterprise to identify applications and their dependencies and put together IT inventory lists, dependency mappings, and migration plans after months of manual labor. The discovery service can automate some or all of this function, including the identification of some or all of the workloads that make up the application and the purpose of each of them. In an embodiment, the discovery service 100 identifies what applications (if any) depend on the applications they want to migrate. The discovery service can also identify network infrastructure services (e.g., DHCP servers, AD servers, DNS servers, network LB, NAS appliances, etc.) that each of the dependencies in the workloads that contain the application.

[0262] In an embodiment, the discovery service 100 may be configured to export discovery data that can be used to visualize the workloads that make up the application and its dependencies. Visualization functionality may be provided by the discovery presentation module 414, and may also include network throughput and latency characteristics for each of those dependencies in the graph. In some cases, the system may be configured so that a customer can manually create (e.g., through a console or other interface) a migration plan from data provided by the discovery service. (e.g., using various service provider and / or third-party vendor tools for the execution of migration). In an embodiment, the discovery service 100 may continue to provide visibility (e.g., through a discovery presentation module) into the customer's application after the customer's application has moved to the service provider, so they can verify, for example, the success of the migration operation.

[0263] The discovery service 100 is depicted as having a discovery information analyzer 470, which includes a grouping module 472, a dependency module 474, and a modification module 478. The discovery information analyzer 470 can generate planned and designed component configurations based on data received from the agent (as well as additional inputs, e.g., as described below). Typically, in an embodiment, the components of the discovery information analyzer 470 include program instructions that are executed by a computer processor to analyze information in the discovery database 120, group identified resources (e.g., servers, applications, and other resources), generate a graphical representation of the resources, and modify the grouping and / or representation in response to additional user input. In an embodiment, the representation of the resources of the client or customer may be referred to as a client network-based resource configuration representation.

[0264] The results may be displayed or otherwise presented to the client (e.g., via the findings presentation module 414). In an embodiment, the system may be configured to present the results, generated plans, and / or generated designs to the client or to an expert on behalf of the client (e.g., via the findings presentation module 414). The recipient may review the findings and update the proposal, plan, or design (e.g., based on their own, additional, or other infrastructure knowledge). For example, an administrator, expert, or other user of the system may interact with the design via the findings presentation module to add to or otherwise modify the design (e.g., change, add, or remove relationships, groupings, or dependencies).

[0265] In at least some embodiments, the discovery presentation module 414 can be configured to deliver a graph representation capability (e.g., such as a graph of workloads including applications, where workload servers are nodes in the graph and dependencies are edges). In yet another example, an edge in the graph can also capture network throughput and latency metrics for that dependency. The discovery presentation module 414 can output instructions that cause a visual presentation of that information.

[0266] In an embodiment, the discovery service 100 collects metadata of the client's infrastructure, rather than raw client data; the discovery service may sanitize the data collected by the discovery service before sending to a database; and the discovery service may encrypt data at rest and in transit.

[0267] In various embodiments, various functions may be performed by one or more agents, by a discovery connector, or by various modules of a discovery service, or shared by some combination thereof.

[0268] For example, the application discovery function can describe the system capabilities to identify what applications are running within a workload that has been identified by the customer as an application server or one of its identified dependencies. In an embodiment, the data collection requirements for this feature can overlap with "dependency mapping". Other functions may include identifying business enterprise applications deployed within application or website server containers based on captured data. In some embodiments, the application container and the contained business enterprise applications may be part of the system ontology, API, and user interface. For example, enterprise website / application server containers such as Microsoft IIS and Apache Tomcat may also be included.

[0269] In some embodiments, the system can support web and application server containers such as Red Hat JBoss, IBM WebSphere, and Oracle WebLogic. Some embodiments can support automatically mapping the names of discovered processes to user-friendly application names for enterprise applications. Additional features provided by the system can include identifying enterprise application stacks (e.g., LAMP stacks) and / or identifying databases contained within database management system applications.

[0270] In an embodiment, the system may be configured with the ability to capture a snapshot of the health and performance of the application before migration. The data obtained may be pushed, stored, and retrieved from various data stores. The customer may use this data to compare health metrics, performance metrics, and data about active network connections from the application before and after the migration to determine whether the migration was successful.

[0271] For example, in an embodiment, dependency module 474 of discovery service 100 may be configured to build a graph of network dependencies for client applications. In an embodiment, the discovery service supplements this information with a basic collection of processes and monitoring data that describes what is happening in each of the workload servers.

[0272] The dependency module 474 may be configured to have the functionality to generate or map dependencies between the workloads that make up the application. For example, the dependency module 474 may discover network communications between applications and record network infrastructure dependencies for the discovered applications. In the case of past systems, customers may rely on manual processes and interviews to identify these dependencies; automated discovery of these dependencies may have a significant impact.

[0273] In some embodiments, the dependency module can analyze network packet captures (e.g., performed by an agent or connector 148) or perform network flow analysis. At least some network packet capture techniques capture traffic at the hypervisor level (e.g., to resolve inter-virtual machine traffic that may not traverse a physical switch). In some embodiments, the discovery system will capture network packets from a virtual NIC port and generate flow records by inspecting the packets. The data may also be obtained from a network processing hardware offload device that exists as part of the service provider network 250. For example, the agent can run on a network processing device attached to an interface (e.g., PCIe) of a host system, or receive network connection data from the network processing device, where the network processing device offloads at least some network processing functions from the host's main CPU.

[0274] In some embodiments, these or other modules may be configurable (e.g., via program instructions) to have additional capabilities (e.g., kernel drivers to obtain higher fidelity data for network dependencies, deep inspection of network packets from connectors, network flow-based collectors in connectors, and collection of this data by leveraging network processing hardware offload devices).

[0275] The grouping module 472 can analyze the configuration data obtained from the client's network and group resources into useful groups (e.g., grouping servers into applications). In an embodiment, the grouping module 472 can group applications based on the observed traffic. For example, machine learning such as clustering algorithms (e.g., spectral clustering) can be used for grouping. The grouping function can help customers visualize the customer network environment when combined with, for example, a presentation function. The system can provide an interface so that customers can make adjustments to the grouping. In an embodiment, the visualization of the environment can promote the design or modification of the migration plan.

[0276] Figure 5 An exemplary flow chart illustrating a client-side process associated with a discovery service according to at least some embodiments. The illustrated process begins with the allocation of components of the discovery service 100 and ends after the discovery data has been collected. Generally, in an embodiment, the illustrated process may be performed by Figure 1 , 2 , 3, 4 and 7 are performed with the various components illustrated.

[0277] As illustrated at block 516, a user may interact with the discovery service console to initiate discovery of the service. The agent may send the discovery data to a data collection service (e.g., data collection module 450, Figure 4 ). For example, the agent can publish the discovery data to the IP address of the connector. In some embodiments, the connector can obtain encryption keys and / or destination credentials from the proxy service and can add the encrypted aggregated data to the destination (e.g., a data stream or data store or service). If the data upload fails, the connector can try to send the data again (e.g., using one or more strategies, such as an exponential backoff strategy). All or some of the actions performed on the on-premises environment can be logged in a log file. In an embodiment, for an agent set up on a service provider, the agent can encrypt the data and add the data to the destination or data stream.

[0278] use Figure 1As an example, data may be captured by an agent (e.g., agent 143, 145, 147), sent to a data stream and then may be sent from the data stream to the discovery database 120. In an embodiment, the discovery service may consume the obtained data from the database 120 or directly from the data stream. For example, analyzing the data obtained directly from the data stream may be a way to update the client configuration in real time with the data received from the agent. In some embodiments, a visual representation of the client configuration may be updated in the console, based at least in part on the real-time data from the data stream. In some embodiments, a data stream with data from an agent or other source may simultaneously provide data to the discovery database 120 and other services of the console or service provider.

[0279] In general, the elements of the illustrated process can be represented by Figure 1-4 . For example, the discovery lifecycle manager 412 may be configured to receive a request from a client to download a discovery connector. The discovery lifecycle manager 412 may be configured to manage various different lifecycle processes of the discovery service. The discovery lifecycle manager may direct the agent service / data collection module 450 to install a connector. For example, a discovery connector may be downloaded from the discovery service 100 and installed to the client network, as at box 512. In some embodiments, the connector may be an optional feature of the system architecture.

[0280] Installation / Setup Workflow

[0281] Typically, in at least some embodiments, a client signs up for a discovery service and downloads a personalized connector, which may include a discovery agent framework. The console 112 may be configured to provide the client with a view of the status of the connector.

[0282] Keys for data encryption and message queues for connector communications with the proxy service may be created under the customer's account (e.g., the keys may be controlled by the customer, not the service) and sufficient privileges may be added to the proxy and internal service accounts. This initial setup may be sufficient for the connector to communicate with the discovery service. In some embodiments, it may not be necessary to install the connector on an instance of a resource on the service provider network.

[0283] Discovery Agent Installation

[0284] The discovery service agent can be downloaded from the discovery service and installed on the client on the client network, as in box 514. In some embodiments, it may be the responsibility of the customer to install the agent on the required host (e.g., after selecting the required configuration, the agent can be manually installed on the host; the customer can attach or create the required certificate for authenticating the agent). At box 514, the discovery service agent is downloaded from the discovery service to the client network and installed on the client on the client network. In other embodiments, the discovery service can install the agent on the required host. For example, the discovery service 100 can be configured to automate the installation of agents on resources within the service provider network on behalf of the customer. In some embodiments, the functions (downloading) described in boxes 512 and 514 can be performed in parallel or in reverse order. In some embodiments, one or more of the steps of the process can be iterated (e.g., the process can loop back to an earlier step). For example, the illustrated process may include a loop so that more agents are downloaded and installed after some of the previous agents have been run.

[0285] In an embodiment, the system may provide customers with the option to use a connector to manage the installation of software agents. In other embodiments, the system may automate the deployment of agents to discover dependencies. In some cases, the system may be configured to allow customers to iteratively deploy agents as dependencies are discovered. The system may also be used to deploy agents on a server scale identified by agentless discovery. For example, customers may script this feature on top of a public API.

[0286] A user (eg, administrator expert or other) may interact with the discovery service console to initiate discovery services (block 516). An agent runs in the client network and collects discovery data about the client configuration (block 518).

[0287] The data collected by the agent can end up at the discovery database 120 in several different ways. For example, the agent can send the data to a discovery connector (block 520). The discovery connector can process the data and / or send the data on to another component (e.g., the discovery database 120). In other embodiments, the agent can send the data directly to the discovery database 120 without sending the data to a connector.

[0288] In an embodiment, the agent is configured to collect information (e.g., from their virtual infrastructure management application about the customer's various resources such as virtual machines, their network connection devices (i.e., firewalls, routers, etc.), their storage arrays, databases, and more. In at least the illustrated embodiment, the connector can aggregate the discovery data and send the discovery data to the discovery service (box 522).

[0289] The user may interact with the discovery service console to stop (or modify) the discovery service (block 524). If the discovery service is modified or continued, the process may start over again with the agent running in the customer network and collecting discovery data about the customer's client configuration, etc. If the user chooses to stop the discovery service, the process terminates (block 526).

[0290] Figure 6 An exemplary flow chart illustrating a server-side process associated with a discovery service according to at least some embodiments. A connector and / or agent is provided to a client (block 610). For example, the discovery service may download the connector and / or agent to a client network or to a resource of a service provider operating on behalf of a client.

[0291] Discovery data for the client is received (e.g., from a connector, directly from the agent, and / or from other tools) (block 612). For example, in some embodiments, configuration data for resources operating on behalf of the customer or on the customer's data center may be collected by a discovery connector and sent to a discovery service, where the data is stored in a database, or may be sent directly to a database from the agent.

[0292] The discovery data is stored in a discovery database (614). The client discovery data is queried and analyzed to determine the client configuration and dependencies (block 616). For example, the discovery service 100 may analyze the client's data from database 120 and determine the configuration and dependencies of the client's resources. In some embodiments, the data may be analyzed to determine a hierarchy, grouping, or layer of components (e.g., identifying a server layer, logging into a server layer).

[0293] A presentation of the client's configuration and dependencies is generated and provided to the client (block 618). For example, the discovery presentation module may generate a presentation of the client's configuration and / or dependencies and indicate display of the presentation via the console 112. Modifications are received (block 620). For example, a user may review the presentation and modify the configuration and / or dependencies by interacting with an interface element of the console 112. The client configuration and / or dependencies are updated based on the modifications (block 622). For example, the modification module may update the configuration and / or dependencies and the presentation module 414 may generate a modified presentation of the client's configuration and / or dependencies and indicate display of the modified presentation via the console 112.

[0294] Figure 7 is a block diagram illustrating a system including a migration service 790 that uses output from a discovery service in at least some embodiments. Although the system described herein can be used for additional purposes (e.g., monitoring, etc.), one particular use is to provide information to a migration planning service that facilitates and automates much, if not all, of the migration process. The various portions of the depicted system can be performed Figure 8 Some or all of the features illustrated in are described below.

[0295] Exemplary customers for at least some of the disclosed services include enterprises migrating hundreds of servers. Various kinds of migrations (i.e., server migrations, application container migrations, data-only migrations, and cloud-optimized rewrites) and various data types (i.e., volumes, files, objects, and databases) may be supported. In some embodiments, system outputs may include migration guidance, and portions of the service may be related to management and monitoring efforts.

[0296] Customers interested in migrating workloads from an enterprise data center to a service provider can sign up for services from a connector. In an embodiment, there can be a single sign-up step for all of the services that are part of the migration platform and other hybrid services. In an embodiment, this step can create a unique identity and trust certificate that can be used by the service to authenticate and authorize the customer's connector instance. Signing up can be done as part of setting up the connector.

[0297] In the depicted embodiment, the discovery service 100 provides the client configuration information (e.g., from the discovery database 120 or otherwise) to the migration planning service 710. The migration planning service generates a migration plan recommendation based on the received client configuration information. The customer (e.g., a user associated with or working on behalf of the customer) can review the migration plan recommendation and add additional input to improve the migration plan. The selected plan (overall plan) is sent from the migration planning service 710 to the migration coordination service 720. In an embodiment, the migration coordination service 720 can call a collection of execution services, such as a disk replication component 722 (block-based or file-based replication), a virtual machine import component 724, and a DB replication component 726 that can perform the migration plan. During the migration or when the migration is completed, the migration verification service 730 can verify the migration.

[0298] The architecture of the system may be an open design; for example, third-party vendors may plug in at locations in the system and / or process and provide their own differentiated capabilities (eg, via an API).

[0299] Figure 8 is an exemplary flow chart of a process associated with a migration service using output from a discovery service according to at least some embodiments.

[0300] The discovery service provides the client configuration and dependency information to the migration planning service (box 810). The migration planning service generates a migration suggestion based on the client configuration and / or dependency (box 812). The migration planning service can propose at least one migration plan for each resource. For example, the migration planning service 710 can generate a migration plan that describes the method for how to migrate an application to a service provider network. In some cases, the migration planning service can propose multiple migration plans for a resource (e.g., an application). For example, for a simple website application, the migration planning service can generate a migration plan that will import each server into the service provider network based on a server-based migration, a second migration plan that recommends rewriting the application to be horizontally scalable and use a more native service (e.g., a relational database service) of the service provider, and a third migration plan that only moves the website server application code and its associated data but does not have the server in which the website server application code runs.

[0301] Provide recommendations to the client (box 814). For example, the system can bring relevant information and recommendations to the client so they can make an informed decision. When setting up the plan, the client can use other tools included in the migration platform (e.g., server migration services, application migration services) to perform the migration. Receive migration input from the client (box 816). Generate a migration plan based on the client's configuration and / or dependency information, and / or the client's input (box 818).

[0302] Migration coordination service 720 calls execution service to execute the migration plan and recreate at least a portion of the client's resources in the provider network according to the migration plan (block 820). Validation service obtains baseline performance data for the configuration from discovery service and performs validation analysis of the client configuration in the provider network (block 822).

[0303] It should be noted that in various embodiments, Figure 5 , 6 Some of the types of operations shown in FIG. 8 may be implemented in a different order than that shown in the figure, or may be performed in parallel rather than sequentially. For example, in some embodiments, the migration of several different applications of a given enterprise may be performed in parallel. In another alternative implementation, a load balancing instance may be migrated before an application processing instance is migrated. In at least one embodiment, some operations may not be required.

[0304] Example use cases

[0305] For example, when a large company wants to migrate a Microsoft SharePoint application to a cloud-based service provider, they engage with a solution architect. As a first step, the solution architect will set up a discovery service in their data center. Due to the widely distributed nature of large companies, the application owner that the solution architect engages with does not actually know any of the physical servers or infrastructure-level dependencies on which SharePoint runs. The solution architect will work with the application owner to identify the IP address or DNS name of at least one of the virtual machine workloads where SharePoint runs, and install the discovery agent within the workload with the help of the relevant operations team. The agent will enable the customer to identify the server that communicates with the workload and reports data to the discovery service. The solution architect can then install the agent on one or more of these servers to then discover their dependencies. The solution architect will iterate through this process until he has covered all of the dependencies for SharePoint.

[0306] Once this setup process is complete, and without any other prior knowledge of the application's architecture, the solution architect can observe that SharePoint depends on Microsoft SQL Server and Microsoft IIS Server in their network. In addition to these application dependencies, the SharePoint application depends on infrastructure services such as DHCP servers, DNS servers, Microsoft Active Directory (AD) servers, and log servers. Armed with this information, the solution architect can create a migration plan for the large company to migrate the SharePoint application.

[0307] Additionally, embodiments of the present disclosure may be described in light of the following terms:

[0308] 1. A system comprising:

[0309] one or more computing devices configured to implement a network-based discovery service configured to provide client resource discovery services to a plurality of clients over one or more networks;

[0310] a data store configured to store discovery information for client network-based resource configuration;

[0311] The discovery service is configured to:

[0312] providing, for respective clients of the plurality of clients, one or more client-side discovery components over the one or more networks, the one or more client-side discovery components configured to execute at and collect discovery information about respective client network-based resource configurations;

[0313] receiving the collected discovery information from the respective discovery components for the respective clients over the one or more networks;

[0314] storing the received discovery information in the data store for the corresponding client;

[0315] analyzing the discovery information to determine a corresponding client network-based resource configuration for the corresponding client; and

[0316] Representations of the determined respective client network-based resource configurations for the respective clients are generated, wherein each respective client network-based resource configuration representation includes descriptions of a plurality of computer-based resources and dependencies between at least some of the computer-based resources.

[0317] 2. The system of clause 1, further comprising:

[0318] a provider network configured to provide a plurality of network-based services, wherein the plurality of network-based services include one or more virtual computing or storage services configured to host at least a portion of one or more of the client network-based resource configurations; and

[0319] Wherein the network-based discovery service is one of the services provided by the provider network and is further configured to receive discovery information from a discovery component at one or more client network-based resource configurations hosted by the provider network in addition to one or more client network-based resource configurations implemented external to the provider network.

[0320] 3. A system as described in clause 2,

[0321] wherein at least one of the client network-based resource configurations is implemented at least in part by the one or more virtual computing or storage services of the provider network and at least in part at a client network external to the provider network, and

[0322] Wherein the network-based discovery service is configured to aggregate discovery information from both the provider network and the client network to determine a client network-based resource configuration representation for the same client network-based resource configuration across the provider network and the client network.

[0323] 4. A system as described in clause 1,

[0324] wherein the one or more client-side discovery components include one or more connector components and a plurality of proxy components,

[0325] wherein each of the plurality of agents is configured to be installed on a different computer system at a client network, and to collect configuration information about the computer system on which the agent is installed; and

[0326] Wherein the one or more connector components are configured to be installed at the client network, receive configuration information from the plurality of agents, aggregate the configuration information, and transmit the configuration information to the discovery service over the one or more networks.

[0327] 5. A system as described in clause 4, wherein the configuration information collected by each of the multiple agents for the corresponding computer system on which the agent is installed includes identification of one or more of the following: a software package installed on the computer system, a process running on the computer system, a type of server running on the computer system, a type of operating system on the computer system, a source entity for network communication received at the computer system, or a destination entity for network communication sent from the computer system.

[0328] 6. A system as described in clause 4, wherein the additional information collected by each of the multiple agents for the corresponding computer system on which the agent is installed includes security information, the content of network communications received at the computer system, the performance of the computer system, or the performance of a process running on the computer system.

[0329] 7. A method comprising:

[0330] by a network-based discovery service implemented by one or more computing devices including one or more hardware processors;

[0331] Providing one or more client-side discovery components to clients of the network-based discovery service over one or more networks, the one or more client-side discovery components being configured to:

[0332] is performed at a network-based resource configuration of the client at a client network, and

[0333] collecting discovery information about the network-based resource configuration of the client;

[0334] receiving the collected discovery information from the one or more client-side discovery components over the one or more networks;

[0335] storing the received discovery information in a data store;

[0336] analyzing the discovery information to determine the network-based resource configuration of the client; and

[0337] A representation of the network-based resource configuration of the client is generated, wherein the representation includes descriptions of a plurality of computer-based resources and dependencies between at least some of the computer-based resources.

[0338] 8. The method as described in clause 7,

[0339] wherein the representation of the network-based resource configuration of the client identifies:

[0340] the plurality of computer-based resources,

[0341] one or more applications, servers or processes running on the plurality of computer-based resources, and

[0342] said dependencies between at least some of said computer-based resources, and

[0343] Wherein the dependencies include network connectivity of at least some of the computer-based resources.

[0344] 9. The method as described in clause 8,

[0345] wherein generating the representation further comprises generating a graphical representation of the network-based resource configuration of the client, wherein the graphical representation comprises:

[0346] a plurality of nodes representing the plurality of computer-based resources, applications or processes, and

[0347] The connections between the plurality of nodes are based on the dependencies.

[0348] 10. The method of clause 9, further comprising:

[0349] providing the graphical representation to the client;

[0350] receiving from the client one or more modifications to the representation of the network-based resource configuration; and

[0351] The representation of the network-based resource configuration is modified in response to the one or more modifications.

[0352] 11. The method as described in clause 8,

[0353] wherein the analyzing includes mapping one or more relationships between the plurality of computer-based resources, applications, servers, or processes of the network-based resource configuration of the client based at least in part on the discovery information, wherein the one or more relationships are determined based on one or more of commonalities of the network connectivity or types of computer-based resources,

[0354] wherein the one or more relationships include one or more of membership in a network subnet, membership in a server cluster, or membership in a load balancing group, and

[0355] Wherein the dependency is determined based at least in part on the mapping of the one or more relationships.

[0356] 12. The method of clause 7, further comprising:

[0357] receiving discovery information for additional network-based resource configuration of the client hosted by a provider network external to the client network; and

[0358] The discovery information from both the provider network and the client network is aggregated to determine an aggregate network-based resource configuration for the client across both the provider network and the client network.

[0359] 13. A non-transitory computer-readable storage medium storing program instructions that, when executed by one or more processors, cause the one or more processors to implement a discovery service, the discovery service being configured to:

[0360] One or more client-side discovery components are provided to clients over one or more networks, the one or more client-side discovery components being configured to:

[0361] is performed at a network-based resource configuration of the client at a client network, and

[0362] collecting discovery information about the network-based resource configuration of the client;

[0363] receiving the collected discovery information from the one or more client-side discovery components over the one or more networks;

[0364] storing the received discovery information in a data store;

[0365] analyzing the discovery information to determine the network-based resource configuration of the client; and

[0366] A representation of the network-based resource configuration of the client is generated, wherein the representation includes descriptions of a plurality of computer-based resources and dependencies between at least some of the computer-based resources.

[0367] 14. A non-transitory computer-readable storage medium as described in clause 13, wherein the program instructions include program instructions for the one or more client-side discovery components, wherein the one or more client-side discovery components include a connector component, which is configured to be installed at the client network, collect the discovery information about the network-based resource configuration of the client, and transmit the configuration information to the discovery service via the one or more networks.

[0368] 15. The non-transitory computer-readable storage medium of clause 14, wherein, to collect the discovery information, the connector component is further configured to:

[0369] monitoring network communications between at least some of the plurality of computer-based resources at the client network; or

[0370] One or more information discovery application programming interfaces (APIs) supported by one or more network management protocols of the client or a server to configure network-based resource configuration are called.

[0371] 16. A non-transitory computer-readable storage medium as described in clause 13, wherein the program instructions include program instructions for the one or more client-side discovery components, wherein the one or more client-side discovery components include a plurality of agents, each of the plurality of agents being configured to be installed on a corresponding different one of the plurality of computer-based resources at a client network and to collect configuration information about the computer-based resources on which the agents are installed.

[0372] 17. The non-transitory computer-readable storage medium of clause 13, wherein the discovery service is further configured to:

[0373] providing an application programming interface (API) to receive additional discovery information from one or more tools not provided by the discovery service;

[0374] storing the other discovery information in the data store;

[0375] combining the other discovery information with the discovery information received from the one or more client-side discovery components; and

[0376] The representation of the network-based resource configuration of the client is generated based on the combined discovery information.

[0377] 18. The non-transitory computer-readable storage medium of clause 13, wherein the discovery service is further configured to provide a console interface configured to:

[0378] receiving a request from the client to download the one or more client-side discovery components; and

[0379] receiving one or more discovery management commands from the client to start / stop a discovery process at the client network;

[0380] To start / stop the discovery process, the discovery service is configured to remotely communicate with the one or more client-side discovery components installed at the client network through the one or more networks.

[0381] 19. The non-transitory computer-readable storage medium of clause 13, wherein the discovery service is further configured to provide a console interface configured to:

[0382] providing to the client a graphical representation of the network-based resource configuration of the client; and

[0383] One or more modifications to the representation of the network-based resource configuration are received from the client.

[0384] 20. The non-transitory computer-readable medium of clause 12, further storing program instructions that, when executed by the one or more processors, cause the one or more processors to implement a migration service including the discovery service, wherein the migration service is configured to:

[0385] generating a migration plan based at least in part on the representation of the network-based resource configuration of the client, wherein the migration plan specifies a plan for migrating at least a portion of the network-based resource configuration of the client from the client network to a provider network; and

[0386] The migration plan is executed to migrate the at least a portion of the network-based resource configuration of the client from the client network to the multi-tenant provider network.

[0387] 21. The non-transitory computer-readable medium of clause 19,

[0388] wherein the collected discovery information stored by the discovery service in the data store includes performance data for the network-based resource configuration operating at the client network,

[0389] The migration service is configured to:

[0390] capturing performance data for at least a portion of the network-based resource configuration for migration to the provider network, and

[0391] The captured performance data from the provider network is compared to the performance data from the data store for the at least a portion of the network-based resource configuration to verify migration of the at least a portion of the network-based resource configuration.

[0392] Illustrative Computer System

[0393] Fig. 9 is a block diagram illustrating an exemplary computer system according to at least some embodiments. In at least some embodiments, a server implementing one or more of the techniques described above for providing a discovery service, a virtual database service, or a virtual computing service may include a general-purpose computer system that includes or is configured to access one or more computer-accessible media. Resources of a client network may also be implemented by a general-purpose computer system that includes or is configured to access one or more computer-accessible media. Fig. 9 Such a general purpose computing device 900 is illustrated. In the illustrated embodiment, the computing device 900 includes one or more processors 910 (910a-910n) coupled to a system memory 920 (which may include both non-volatile and volatile memory modules) via an input / output (I / O) interface 930. The computing device 900 also includes a network interface 940 coupled to the I / O interface 930.

[0394] In various embodiments, the computing device 900 may be a single processor system including one processor 910, or a multiprocessor system including several processors 910 (e.g., two, four, eight, or another suitable number). The processor 910 may be any suitable processor capable of executing instructions. For example, in various embodiments, the processor 910 may be a general-purpose or embedded processor that implements any of a variety of instruction set architectures (ISAs), such as x86, PowerPC, SPARC, or MIPS ISAs, or any other suitable ISAs. In a multiprocessor system, each of the processors 910 may typically but not necessarily implement the same ISA. In some implementations, a graphics processing unit (GPU) may be used instead of or in addition to a conventional processor.

[0395] The system memory 920 may be configured to store instructions and data accessible by the processor 910. In at least some embodiments, the system memory 920 may include both volatile and non-volatile portions; in other embodiments, only volatile memory may be used. In various embodiments, the volatile portion of the system memory 920 may be implemented using any suitable memory technology such as static random access memory (SRAM), synchronous dynamic RAM, or any other type of memory. For the non-volatile portion of the system memory (which may include, for example, one or more NVDIMMs), in some embodiments, flash-based memory devices may be used, including NAND flash devices. In at least some embodiments, the non-volatile portion of the system memory may include a power source such as a supercapacitor or other power storage device (e.g., a battery). In various embodiments, any of memristor-based resistive random access memory (ReRAM), three-dimensional NAND technology, ferroelectric RAM, magnetoresistive RAM (MRAM), or various types of phase change memory (PCM) may be used at least for the non-volatile portion of the system memory. In the illustrated embodiment, program instructions and data implementing one or more desired functions such as those methods, techniques, and data described above are shown as being stored within system memory 920 as program instructions 925 and data storage 945. In an embodiment, the above detailed description (e.g., with respect to Figure 1-8 ) can be implemented by program instructions executed by one or more of the processors. In some embodiments, the instructions of the program can be grouped into modules or components, such as Figure 4 Those exemplified in .

[0396] In one embodiment, the I / O interface 930 may be configured to regulate the I / O throughput between the processor 910, the system memory 920, the network interface 940, or other peripheral interfaces such as various types of permanent and / or volatile storage devices. In some embodiments, the I / O interface 930 may perform any necessary protocols, timing, or other data conversions to convert data signals from one component (e.g., the system memory 920) into a format suitable for use by another component (e.g., the processor 910). In some embodiments, the I / O interface 930 may include support for devices attached through various types of peripheral buses, such as, for example, a low pin count (LPC) bus, a peripheral component interconnect (PCI) bus standard, or a variation of the universal serial bus (USB) standard. In some embodiments, the functions of the I / O interface 930 may be split into two or more separate components, such as, for example, a north bridge and a south bridge. In addition, in some embodiments, some or all of the functions of the I / O interface 930, such as an interface to the system memory 920, may be directly incorporated into the processor 910.

[0397] Network interface 940 may be configured to allow data to be exchanged between computing device 900 and computing device 990 attached to a network or networks (e.g., network 150), such as other devices such as, for example, Figures 1 to 4 7 and other computer systems or devices illustrated. In various embodiments, the network interface 940 can support communication through any suitable wired or wireless general data network such as, for example, an Ethernet network type. In addition, the network interface 940 can support communication through a telecommunications / telephony network such as an analog voice network or a digital fiber optic communication network, through a storage area network such as a Fiber Channel SAN, or through any other suitable type of network and / or protocol.

[0398] In some embodiments, system memory 920 may be one embodiment of a computer-accessible medium configured to store the computer-accessible medium as described above with respect to Figures 1 to 4and 7 to implement the program instructions and data for implementing the embodiments of the corresponding methods and apparatus. However, in other embodiments, program instructions and / or data may be received, sent, or stored on different types of computer-accessible media. In general, computer-accessible media may include non-transitory storage media or memory media such as magnetic or optical media, for example, a disk or DVD / CD coupled to the computing device 900 via the I / O interface 930. Non-transitory computer-accessible storage media may also include any volatile or non-volatile media such as RAM (e.g., SDRAM, DDR SDRAM, RDRAM, SRAM, etc.), ROM, etc., which may be included in some embodiments of the computing device 900 as system memory 920 or another type of memory. In addition, computer-accessible media may include transmission media or signals, such as electrical signals, electromagnetic signals, or digital signals transmitted through a communication medium such as a network and / or a wireless link, such as may be implemented via a network interface 940. As Fig. 9 Some or all of the multiple computing devices illustrated in the figure may be used to implement the described functionality in various embodiments; for example, software components running on various different devices and servers may cooperate to provide the functionality. In some embodiments, in addition to or instead of being implemented using a general-purpose computer system, some of the described functionality may be implemented using a storage device, a network device, or a special-purpose computer system. As used herein, the term "computing device" refers to at least all of these types of devices, and is not limited to these types of devices.

[0399] in conclusion

[0400] Various embodiments may also include receiving, sending or storing instructions and / or data implemented according to the foregoing description on a computer-accessible medium. In general, a computer-accessible medium may include a storage medium or memory medium, such as a magnetic or optical medium (e.g., a disk or DVD / CD-ROM), a volatile or non-volatile medium (e.g., a RAM (e.g., SDRAM, DDR, RDRAM, SRAM, etc.), a ROM, etc.), and a transmission medium or signal, such as an electrical signal, an electromagnetic signal, or a digital signal, transmitted through a communication medium such as a network and / or a wireless link.

[0401] The various methods illustrated in the figures and described herein represent exemplary embodiments of the methods. The methods may be implemented in software, hardware, or a combination thereof. The order of the methods may be changed, and various elements may be added, reordered, combined, omitted, modified, etc.

[0402] It will be apparent to those skilled in the art having the benefit of this disclosure that various modifications and variations may be made. It is intended to include all such modifications and variations, and therefore, the above description should be regarded in an illustrative rather than a limiting sense.

Claims

1. A system, include: A discovery service for the provider network, the discovery service being configured to: obtaining discovery information about client networks' resource configurations for clients of the provider network; as well as generating a representation of the client network-based resource configuration for the client based on the discovery information; and A migration service, wherein the migration service is configured to: generating a migration plan recommendation based at least in part on the representation of the client network-based resource configuration of the client, wherein the migration plan recommendation specifies a plan for migrating at least a portion of the client network-based resource configuration of the client from the client network to the provider network; as well as A migration plan recommended based at least in part on the migration plan is executed to migrate the at least a portion of the client network-based resource configuration of the client from the client network to the provider network.

2. The system according to claim 1, The discovery service is also configured to: obtaining another discovery information about another client of the provider network based on another network resource configuration; and generating, based on the further discovery information, a representation of the further network-based resource configuration of the further client; receiving one or more modifications to the another network-based resource configuration of the another client; as well as updating, based on the one or more modifications, a representation of the resource configuration based on the other network for the other client; The migration service is also configured to: generating another migration plan recommendation based at least in part on the updated representation of the another network-based resource configuration of the another client, wherein the another migration plan recommendation specifies a plan to migrate at least a portion of the another network-based resource configuration of the another client from the another network to the provider network; as well as The other migration plan is executed to migrate the at least a portion of the resource configuration based on the other network of the other client from the other network to the provider network.

3. The system of claim 1 or 2, wherein in order to perform the generating of the migration plan recommendation, the migration service is further configured to: generating migration recommendations based on client configuration or dependency information; providing one or more recommendations to the client; receiving migration input from the client; as well as A migration plan is generated based on the client configuration or dependency information and the migration input from the client.

4. The system of claim 3, wherein the representation of the client network-based resource configuration includes dependency information, the dependency information including one or more of the following: Dependencies between servers, Dependencies between application workloads, and Discover the network infrastructure dependencies of your applications.

5. The system of claim 1 or 2, wherein in order to execute the migration plan, the migration service is further configured to: An execution service is invoked to execute the migration plan and recreate at least a portion of the client's resources in the provider network according to the migration plan.

6. The system according to claim 1 or 2, further comprising: include: An authentication service, the authentication service being configured to: obtaining baseline performance data for the configuration from the discovery service; as well as A validation analysis is performed based at least in part on a comparison of the configuration of the client that has been migrated to the provider network with the baseline performance data.

7. The system according to claim 1 or 2, further comprising: include: a multi-tenant provider network configured to provide a plurality of network-based services, wherein the plurality of network-based services includes one or more virtual computing or storage services configured to host at least a portion of one or more client network-based resource configurations; and Wherein the discovery service is one of the services provided by the provider network and is further configured to receive discovery information from a discovery component at one or more client network-based resource configurations hosted by the multi-tenant provider network, in addition to one or more client network-based resource configurations implemented outside the multi-tenant provider network.

8. A method, the method comprising: include: generating a representation of the client network-based resource configuration based on discovery information about the client network-based resource configuration of a client of a provider network, wherein the provider network provides one or more services to the client; generating a migration plan recommendation based at least in part on the representation of the client network-based resource configuration, wherein the migration plan recommendation specifies a plan for migrating at least a portion of the client network-based resource configuration from the client network to the provider network; as well as A migration plan based at least in part on the migration plan recommendation is executed to migrate the at least a portion of the client network-based resource configuration from the client network to the provider network.

9. The method according to claim 8, further comprising: include: obtaining another discovery information about another client of the provider network based on a resource configuration of another client network; generating, based on the further discovery information, a representation of the further client network-based resource configuration; receiving one or more modifications to the resource configuration based on another client network; updating the representation of the resource configuration based on another client network based on the one or more modifications; generating another migration plan recommendation based at least in part on the updated representation of the another client network-based resource configuration, wherein the another migration plan recommendation specifies a plan for migrating at least a portion of the another client network-based resource configuration from the another client network to the provider network; as well as Another migration plan recommended based at least in part on the migration plan is executed to migrate the at least a portion of the resource configuration based on another client network from the another client network to the provider network.

10. The method according to claim 8 or 9, further comprising: include: generating the migration plan recommendation based on client configuration or dependency information; providing the migration plan recommendation to the client; receiving migration input from the client; as well as A migration plan is generated based on the client configuration or dependency information and the migration input from the client.

11. The method according to claim 10, Wherein the representation of the client network-based resource configuration includes dependency information, the dependency information including one or more of the following: Dependencies between servers, Dependencies between application workloads, and Discover the network infrastructure dependencies of your applications.

12. The method of claim 8 or 9, wherein said executing said migration plan include: An execution service is invoked to execute the migration plan and recreate at least a portion of the client's resources in the provider network according to the migration plan.

13. The method according to claim 8 or 9, further comprising: include: obtaining baseline performance data for the configuration from a discovery service; as well as A validation analysis is performed based at least in part on a comparison of the configuration of the client that has been migrated to the provider network with the baseline performance data.

14. The method according to claim 8 or 9, further comprising: include: receiving discovery information for additional network-based resource configurations for the client hosted by a multi-tenant provider network external to the client network; as well as Discovery information from both the provider network and the client network is aggregated to determine an aggregated network-based resource configuration for the client across both the provider network and the client network.

15. A non-transitory computer-readable storage medium storing program instructions executable by one or more processors to cause the one or more processors to perform: generating a migration plan recommendation based at least in part on a representation of a client network-based resource configuration of a client of a provider network, the representation being based on discovery information obtained about the client network-based resource configuration, the migration plan recommendation specifying a plan for migrating at least a portion of the client network-based resource configuration from the client network to the provider network; and A migration plan recommended based at least in part on the migration plan is executed to migrate the at least a portion of the client network-based resource configuration from the client network of the client to the provider network.

Images