Management of computing services for applications composed of service virtual computing components

Abstract

Systems and methods are provided for managing computing services for an application, the application comprising a plurality of virtual computing components executing on one or more host computing devices, wherein service virtual computing components are for performing application functions, and wherein system computing components are for performing system functions, the system functions comprising management of the application virtual computing components; determining that a service virtual computing component is for performing using a first access credential to provide a first computing service to an application virtual computing component, and that the service virtual computing component is for performing using a second access credential to provide a second computing service to a system computing component, wherein the first access credential is assigned a different set of computing resource access permissions than the second access credential.

Description

By incorporating via reference

[0001] The following application is incorporated herein by reference and forms part of this specification: U.S. Patent Application No. 18 / 478,375, filed on September 29, 2023, entitled “MANAGEMENT OF COMPUTING SERVICES FOR APPLICATIONS COMPOSED OFSERVICE VIRTUAL COMPUTING COMPONENTS”. Background Technology

[0002] Computing systems can utilize communication networks to exchange data. In some implementations, a computing system can receive and process data provided by another computing system. For example, a computing system can receive data input using another computing system, store data, process data, and so on. Some computing systems execute interactive or unattended applications, in which they process data or perform other operations in response to user requests or other events. Attached Figure Description

[0003] Embodiments of various inventive features will now be described with reference to the following accompanying drawings. Throughout the drawings, reference numerals may be used repeatedly to indicate correspondences between reference elements. The drawings are provided to illustrate exemplary embodiments described herein and are not intended to limit the scope of this disclosure.

[0004] Figure 1 It is a block diagram depicting an exemplary environment that enables the management of computing services for an application consisting of multiple service virtual computing components, according to some implementation schemes.

[0005] Figure 2 It is a flowchart of exemplary routines for managing computing services for an application consisting of multiple service virtual computing components, according to some implementation schemes.

[0006] Figure 3 Examples illustrate the data flow and interaction between the monitoring process, credential distribution service, and authentication and authorization service, according to some implementation schemes.

[0007] Figure 4 The illustrations illustrate the monitoring process according to some implementation schemes, the data flow and interaction between the various service virtual computing components of the application and various computing resources outside the application.

[0008] Figure 5 It is a block diagram of an exemplary computing device that can realize various aspects of the present disclosure according to some implementation schemes.

[0009] Figure 6It is a block diagram of an exemplary computing environment in which an on-demand code execution system, based on some implementation schemes, can operate in conjunction with a data storage system. Detailed Implementation

[0010] This disclosure relates to generating and managing virtual computing components that provide multiple computing services, such that each computing service can be provided with access credentials of different scopes. Applications (such as Software as a Service (SaaS) applications or serverless applications) may consist of one or more virtual computing components (such as virtual machine instances, containers, etc.). The platform hosting the virtual computing components of the application can provide various services, such as logging, execution tracing, networking, etc. To improve efficiency (and prevent performance and / or operational issues), functionally related computing services can be included within a single service virtual computing component, which can provide computing services to the application, the platform, or both, depending on the application's configuration. Therefore, it is no longer necessary to maintain a service virtual computing component for each individual computing service to be provided and for each individual user of that service, thereby reducing resource consumption (e.g., processor and / or memory) and preventing errors caused by managing a large number of service virtual computing components.

[0011] Furthermore, to further enhance security within the platform on which applications run (e.g., host computing devices in a data center or cloud environment), each computing service can be provided with access credentials of a different scope. These credentials are tailored to a subset of computing environment operations to be performed by the individual computing service, rather than using access credentials with permissions for all operations of the application or computing environment. Therefore, if a computing service is compromised or malfunctions, the security impact will be limited to the scope of the access credentials upon which that single computing service operates, rather than extending to the entire access scope of all components of the application or computing environment.

[0012] The terms “application” and “application software” are used herein according to their conventional and general meaning in the field of computer technology, and refer to a computer program (or set of computer programs) designed to perform a specific task (or set of tasks) other than those tasks relating solely to the operation of the computing system itself. In contrast, system software can be understood to refer to a computer program designed to manage the operation of a computing device or system of computing devices, while service and service software can be understood to refer to a computer program designed to set up, manage, track, or tune the operation of a computing system or application. Applications may use the same services as those used by system software, or applications and system software may use different services to set up, manage, track, or tune the operation of their respective components. Applications are typically executed by or at the instruction of an end user, but are not necessarily interactive. For example, an application may be scheduled to execute or triggered in response to an event, and may perform various processing tasks without any end-user interaction before termination.

[0013] Some conventional network-based computing environments (such as data centers and cloud-based computing systems) use virtualization technology to allow a single physical computing device to host one or more instances of virtual computing components (e.g., virtual machines, containers) that appear and operate as independent computing environments to users in the data center. Using virtualization, a single physical computing device can dynamically create, maintain, delete, or otherwise manage virtual computing components (e.g., virtual machines, microvirtual machines, containers, etc.). Consequently, users can request computing resources from such network-based computing environments, including configurations of single or networked computing devices, and be provided with varying numbers of virtual computing resources.

[0014] Some users may have applications comprised of one or more virtual computing components running within a host computing device in a network-based computing environment. A network-based computing environment—also referred to herein as a “platform” for brevity—may include multiple computing services that provide services to applications and / or platform components on which the application runs. For example, such computing services may include at least one of logging services, execution tracing services, or network configuration services. Typically, for each computing service to be provided, a corresponding service virtual computing component is generated to implement that service. Due to this arrangement, each service virtual computing component provides only a single service. Furthermore, each of the multiple service virtual computing components is managed separately, and each service virtual computing component consumes its own set of computing resources (e.g., processor time and memory). However, this arrangement can lead to performance and / or operational problems. For example, each additional service virtual computing component introduces increased overhead to the computing device hosting multiple service virtual computing components. More specifically, the increased consumption of computing resources (due to each additional service virtual computing component) can reduce the speed at which the processor performs processing (or memory accesses) and / or reduce the amount of available memory. Similarly, managing numerous service virtual computing components can overwhelm a computing device, leading to multiple errors.

[0015] Some aspects of this disclosure address some or all of the problems described above, as well as others, by using service virtual computing components, each providing multiple computing services. Furthermore, some or all of the different services that are part of the same service virtual computing component can each use access credentials with different scopes.

[0016] Applications can be defined by configuration data (e.g., configuration files) specifying the different computing services to be provided. When the platform initializes an application, it can use the configuration data to determine the virtual computing components to be instantiated (e.g., for the application), any virtual computing component images to be used to launch instances of the virtual computing components, and the access role to be assumed by each computing service. For example, multiple computing services may provide (1) services related to logging, execution tracing, and / or network configuration, and (2) services to the application and / or the platform computing environment in which the application executes.

[0017] In some implementations, the platform may use system components (such as a monitoring process) to manage application initialization. The monitoring process can use application configuration data to identify multiple sets of compute services with relevant functionalities and determine the service virtual compute components to be launched for each identified set of compute services. The monitoring process can further determine the access roles upon which the compute services are executed and can execute a process to obtain access credentials for each role. Additionally, the monitoring process can obtain a specific image corresponding to each service virtual compute component and use the appropriate access credentials and image to launch each service virtual compute component for execution. Advantageously, a limited number of containers can be launched simultaneously, providing the same number of compute services requested by the user, such that each compute service can be assigned to an access role whose scope is specifically for access to provide its assigned subset of application functionalities.

[0018] In some implementations, the credential distribution service can be implemented at runtime to obtain different access credentials for different computing services provided within the same virtual computing component of an application. For example, the credential distribution service can be configured to assume various security roles and interact with authentication and authorization services to obtain access credentials (e.g., access key secrets and session tokens) for those security roles. The credential distribution service can be configured to trust a limited set of processes requesting credentials, including a supervisory process for setting up the application. The supervisory process may request access credentials from the credential distribution service for each access role to be used by the application. The credential distribution service may assume each role and obtain the appropriate access credentials from the authentication and authorization service. The credential distribution service may provide the access credentials back to the supervisory process, and the supervisory process may inject the credentials into the appropriate service virtual computing component for use by the computing services included in that service virtual computing component.

[0019] Various aspects of this disclosure will now be described with respect to certain examples and implementations, which are intended to be illustrative and not limiting. Although aspects of some implementations described herein focus on specific examples of application architectures, virtual computing components, and access credential provisioning protocols for illustrative purposes, these examples are merely illustrative and not intended to be limiting. In some implementations, the techniques described herein can be applied to additional or alternative application architectures, virtual computing components, access credential provisioning protocols, etc.

[0020] Example computing environment and application startup

[0021] Refer to the exemplary implementation plan, Figure 1An example computing environment is illustrated, in which the management of computing services for an application comprised of one or more Virtual Computing Components (VCCs) is implemented. Features and services provided by and used to manage such applications can be implemented as web services that can be consumed via one or more communication networks. In some implementations, the features and services provided by and used to manage such applications are provided by one or more VCCs implemented in a managed computing environment. A managed computing environment may include one or more computing resources that can be rapidly provisioned and released, such as computing devices, networking devices, and / or storage devices. A managed computing environment may also be referred to as a cloud computing environment. An example of a cloud computing environment providing an on-demand code execution system for "serverless" execution of virtualized, containerized applications is shown in [the example]. Figure 6 It is shown in the figure and described in more detail below.

[0022] exist Figure 1 In the illustrated example, the computing environment includes any number of host computing devices 100 and credential distribution services 120. The host computing devices 100 and credential distribution services 120 can communicate with each other via one or more communication networks (not shown). Illustratively, the communication networks can be publicly accessible networks of linked networks, some or all of which can be operated by various different parties, such as the Internet. In some cases, the networks may include private networks, personal area networks (PANs), local area networks (LANs), wide area networks (WANs), cellular data networks, satellite networks, etc., or some combination thereof, some or all of which may or may not have access to the Internet and / or access from the Internet.

[0023] The host computing device 100, the credential distribution service 120, or both can be implemented using any of a variety of computing systems, such as server computing devices, mainframe computing devices, mid-range computing devices, etc. Example host computing device 100 and its components are shown in... Figure 5 Examples are illustrated below and described in more detail. In some embodiments, one or more host computing devices 100 may be used to implement the credential distribution service 120.

[0024] The host computing device 100 can run any number of applications 110. In some implementations, a hypervisor or virtual machine monitor (VMM) on the host computing device 100 can allocate the host's hardware resources across various VCCs. For example, a single host computing device 100 can host tens, hundreds, or thousands of virtual machines (VMs), depending on the computing resources available on the host computing device 100, the computing resources required by each VM, oversubscription protocols used on the host, etc. VMs can then be used to host containers, which package code and all its dependencies, so that applications (or parts thereof) can run quickly and reliably from one computing environment to another.

[0025] In some implementations, as shown in the figure, application 110 may be implemented within a VCC “sandbox” that is logically isolated from other sandboxes of the host computing device 100. For example, the sandbox may be a VM. Application 110 may be managed by a supervisory process 112, which may be a computing entity of the sandbox configured to launch or “boot” various containers or other VCCs that implement a subset of the application’s functionality and manage the entire lifecycle of application 110.

[0026] The monitoring process 112 can execute example routines 200 to start various containers or other VCCs of application 110. Figure 2 As shown in the image. Figure 1 The marked data streams and interactions shown will be described in the context of routine 200.

[0027] Routine 200 begins at block 202. Routine 200 may launch application 110 in response to a client request or instruction at a predetermined or dynamically determined schedule, or in response to some other event. When routine 200 is initiated, a set of executable program instructions stored on one or more non-transitory computer-readable media (e.g., hard disk drive, flash memory, removable media, etc.) may be loaded into the memory of host computing device 100 (e.g., random access memory or “RAM”) (e.g., loaded into a sandbox of host computing device 100) and executed by one or more processors. In some embodiments, routine 200 or portions thereof may be implemented serially or in parallel on multiple processors.

[0028] At box 204, the monitoring process 112 has access to the definition of application 110 to be launched within the sandbox, as shown. Application 110 may be defined by application configuration data 102. A user (e.g., application owner or administrator) of the network computing environment in which the application will be executed can determine the application functionality to be provided by one or more VCCs and the services of the platform to be used by the application. The platform may provide such computing services to an application VCC (e.g., application container 114) that performs the application functionality. The platform may also provide such services to system computing components (e.g., monitoring process 112, request broker, etc.) that manage the application's lifecycle. In some implementations, when application 110 is launched, the platform may automatically launch a container or other VCC that includes pre-determined computing services provided to the system computing components. Images or other storage units for application or service logic and data may be generated for each of the different VCCs. For example, images or other storage units for application logic and data may be generated for a container (e.g., application container 114) or other VCC corresponding to the functionality of application 110. In another example, an image or other storage unit for service logic and data can be generated for a container or other VCC (e.g., a service VCC) corresponding to the computing service specified in application configuration data 102.

[0029] Application configuration data 102 can specify the access role used by the application VCC during execution. For example, if there are multiple application VCCs that are to be initialized using different images, application configuration data 102 can specify the same role for each application VCC, so that each VCC will be provided with the same credentials for its execution. Alternatively, application configuration data 102 can specify different roles for different application VCCs, so that those application VCCs will be provided with different credentials for their execution.

[0030] In some implementations, application configuration data 102 may specify the access roles on which compute services provided by a service VCC are executed. For example, if there are multiple services of a platform that an application will use, application data 102 may specify the same role for each service, or may specify different access roles for different services (or subsets thereof), so that each compute service can execute under roles and access permissions that determine the scope for the specific operation to be performed by the compute service. Furthermore, application configuration data 102 may provide service-specific configuration information for any or each compute service to be provided to the application. Service-specific configuration information may provide further configuration to the corresponding compute service, allowing the functionality of the corresponding compute service to be enhanced or modified. Therefore, application configuration data 102 of application 110 may include a list of compute services and their corresponding identifiers, an image of an instance for launching one or more VCCs (e.g., application container 114), the access roles on which instances of compute services are executed, and service-specific configuration information for modifying or enhancing compute services.

[0031] exist Figure 1 In the illustrated example, at [A], the monitoring process 112 accesses application configuration data 102, which specifies a single application VCC to be instantiated using image 0 and executed using credentials for role 0. Application configuration data 102 further specifies that the platform should provide four (4) compute services for application 110: service 1 to be executed using credentials for role 1; service 4 to be executed using credentials for role 4. Additionally, as... Figure 1 As illustrated, computing services can also be performed using service-specific configuration information. For example, service-specific configuration information for service 1 may include port 1, for example, specifying a port (e.g., a virtual data connection between computer programs) or port number to listen for event logs when service 1 provides a logging service (explained in detail below). In another example, where service 1 provides a networking service, port 1 can be used to specify a port or port number to allow communication with an external network (e.g., the Internet) (explained in detail below). In yet another example, where service 4 provides a tracing service, service-specific configuration information for service 4 may specify bucket 1 as the location where traces should be stored. It should be noted that, although Figure 1 Four (4) computing services are shown included in the application configuration data 102, but depending on the user's configuration, there may be more (or fewer) four (4) computing services. Although Figure 1The application configuration data 102 shown indicates that different role and service-specific configuration information will be used for each computing service, but this example is provided for illustrative purposes only and is not intended to be limiting. In some implementations, depending on the desired functionality of the computing service and the design of application 110, the same role and / or service-specific configuration information may be used to launch two or more computing services. Additionally, although... Figure 1 The application configuration data 102 shown is formatted using a pseudo-standard format similar to JavaScript Object Notation (JSON), but the application configuration data 102 can be generated, stored, and accessed in any format, such as Extensible Markup Language (XML), other standard text-based formats, binary formats, etc.

[0032] At box 206, the monitoring process 112 determines the computing services to be used. In some implementations, the monitoring process 112 determines the computing services to be used by the application based on application configuration data 102. Figure 1 In the illustrated example, monitoring process 112 determines that the application will use services 1 through 4. In some implementations, monitoring process 112 determines the computing resources the platform will use when managing the application based on system configuration data, pre-programming of the monitoring process 112, or some other method. Figure 1 In the example shown, the monitoring process 112 determines that services 5 through 7 should be used.

[0033] At box 208, the monitoring process 112 may determine the container or other service VCC to be started. In some implementations, the monitoring process 112 may determine the service VCC to be started based on a pre-determined association between services or sets thereof. For example, various service VCC images may be pre-generated, in which services with similar or related functions are grouped together (e.g., an observability container image may include code for providing logging services and execution tracing services, a networking container may include code for provisioning and managing network connectivity, etc.). The monitoring process 112 may select the service VCC to be initialized based on the computing services specified in application configuration data 102, the computing services that the monitoring process 112 is pre-configured to use, the computing services specified in platform configuration data, or some combination thereof.

[0034] exist Figure 1In the illustrated example, the monitoring process 112 determines that services 1, 3, 6, and 7 (the first group of computing services) have related functionalities that have been grouped and will be provided by the first service container, and services 2, 4, and 5 (the second group of computing services) also have related functionalities that have been grouped together (albeit separately from the previous groups) and will be provided by the second service container. In some embodiments, the monitoring process 112 may make such a determination based on service-to-service container mappings, platform configuration data, or another source of information about service groups and the corresponding containers to be used to provide those groups. Therefore, the monitoring process 112 determines the service container or other VCC to be launched for each of the first and second groups of computing services. It should be noted that there may be individual computing services that the monitoring process determines do not belong to any computing service group. In this case, the monitoring process may launch a container or other VCC that includes the individual computing service without any other additional computing services.

[0035] At box 210, the monitoring process 112 determines the role on which each computing service operation is based. For services used by an application, the role can be determined based on application configuration data 102. For services used by components of the platform on which the application executes, the role can be determined based on platform configuration data, pre-programming of the monitoring process 112, or some other method. Figure 1 In the example shown, the monitoring process 112 determines that services 1 to 7 use roles 1 to 7 respectively.

[0036] At box 212, the monitoring process 112 can obtain credentials for the role used by application 110 for each computing service operation. For example... Figure 1 As shown, at [B], the monitoring process 112 can obtain credentials from the credential distribution service 120. In response, at [C], the credential distribution service 120 can authenticate and authorize the requesting party (monitoring process 112) to determine whether the credential distribution service 120 is authorized to obtain the credentials requested by the monitoring process 112. After authenticating the monitoring process 112, at [D], the credential distribution service 120 obtains the credentials requested by the monitoring process 112. After obtaining the credentials, at [E], the credential distribution service 120 transmits the credentials to the monitoring process 112.

[0037] Figure 3An example protocol is illustrated whereby the supervisory process 112 and the credential distribution service 120 can execute to obtain credentials for use by the computing services of application 110. At [1], the supervisory process 112 determines that the computing service will operate under a specific role, as described in more detail above. At [2], the supervisory process 112 may send a request to the credential distribution service 120 for credentials for the specified role. This request may be sent as a Hypertext Transfer Protocol (HTTP) request, an Application Programming Interface (API) call, or using some other request mechanism for communicating with the credential distribution service 120 over a network. The request may include data specifying the role for which credentials are to be obtained (e.g., a unique role identifier), data identifying the supervisory process (e.g., a unique process identifier or account identifier), data identifying the application (e.g., a unique application identifier), data identifying the user / account owner / administrator of the application (e.g., a unique account identifier), other data, or some combination thereof.

[0038] At [3], the credential distribution service 120 may authenticate the supervisory process 112. In some embodiments, the credential distribution service may be configured to trust a limited set of credential request sources, including (or specifically limited in some embodiments to) the supervisory process that sets up the application. The supervisory process 112 may be executed under certain credentials, and the credential distribution service 120 may authenticate the credentials of the supervisory process 112 before obtaining and providing the requested credentials for the computing services of the application 110.

[0039] At [4], the credential distribution service 120 may assume the role to which the credential is sought. By assuming the role, the credential distribution service 120 asserts that it is properly authorized and authorized to obtain the credential associated with the role, which provides permissions to access data and perform other computational operations granted to members of the role. For example, the credential distribution service 120 may be implemented such that it is permitted to assume any role to which a credential has been requested. As another example, the credential distribution service 120 may be implemented such that it is permitted to assume a limited set of roles available to the computational service.

[0040] At [5], the credential distribution service 120 may request specified credentials under the assumed role from the authentication and authorization service 300. In some implementations, the authentication and authorization service 300 (also referred to as the Authentication, Authorization and Accounting (AAA) service) may act as a central repository of credentials and serve as a central identity and access management authority within the network computing environment.

[0041] At [6], the authentication and authorization service 300 may authenticate the credential distribution service 120 and determine whether the credential distribution service 120 is authorized to obtain the requested credential. If the credential distribution service 120 is authenticated and authorized to obtain the requested credential, then at [7], the authentication and authorization service 300 may return the requested credential. For example, the credential returned to the credential distribution service 120 may include an access key secret and a session token. After obtaining the requested credential (for the first credential) from the authentication and authorization service 300, the actions performed at [3] through [7] are repeated until a credential is obtained for each role specified in the application configuration data and / or in the data about services to be used by the supervision process 112 or other components of the platform.

[0042] At [8], the credential distribution service 120 may send the requested credentials to the monitoring process 112, and the monitoring process 112 may use these credentials to set up the computing service for the corresponding VCC, as described in more detail below. Although Figure 3 The interactions and data flows involved involve requesting and obtaining individual access credentials, but this example is provided for illustrative purposes only and is not intended to be limiting. In some implementations, the monitoring process 112 may send multiple requests to the credential distribution service 120 serially or in parallel (e.g., different requests for each specified set of credentials).

[0043] Return to Figure 2At box 214, the monitoring process 112 may acquire an image of the VCC to be launched. In some implementations, the network computing environment may include an image repository, such as a set of one or more storage nodes configured to store and provision images for containers or other VCCs. The image may include all application software, utilities, and configuration settings required for the container to be instantiated into a running state. For example, the image may allow the instantiation of containers or other VCCs for an application or compute service. For a service VCC instantiated for provisioning a compute service, the compute service may be further configured based on service-specific configuration information in application configuration data 102. For example, if the VCC is an "observable" VCC providing a logging service (and other observability services), a default port number for the logging service may be provided. However, in some cases, application configuration data 102 may instead specify a different port number. Thus, a service container or other VCC may be launched, with the compute service within that service container or other VCC configured with the port number specified in application configuration data 102 (instead of the default port number). In yet another example, the image corresponding to the service VCC may include all functionally related compute services. In other words, an image for a service VCC corresponding to an observability service (explained in detail below) can include all compute services related to observability, while an image for a service VCC corresponding to a networking service (explained in detail below) can include all compute services related to networking. Therefore, when an image is used to start a container or other VCC, code for all compute services (e.g., for networking or observability) is included in the container or VCC, regardless of whether application configuration data 102 specifies such services. As a result, compute services specified in application configuration data 102 are activated, while compute services not specified in application configuration data 102 are inactive.

[0044] At box 216, the monitoring process 112 can use the image and credentials collected as described above to launch the VCC. Launching the VCC may include instantiating the VCC from the image and then provisioning the instance using appropriate credentials for each of the compute services within it. In some implementations, after instantiating the VCC from the image, the VCC may also be configured using service-specific configuration information for each of the compute services within it.

[0045] exist Figure 1In the example shown, at [F], the supervisory process 112 instantiates application container 114 (for implementing and executing application 110) and service container 1 116A and service container 2 116B. Application container 114 is supplied with credential 122A. Service container 1 116A includes four (4) compute services (service 1 118A, service 3 118B, service 6 118C and service 7 118D) and two (2) credentials (credential 122B and credential 122C). In this configuration, there can be multiple combinations of assigning the two (2) credentials to the four (4) compute services (depending on application configuration data 102). For example, both service 1 118A and service 6 118C may be supplied with credential 122B, while both service 3 118B and service 7 118D may be configured with credential 122C, or vice versa. In another example, three (3) of the computing services may be supplied with credential 122B, while the remaining computing services may be supplied with credential 122A, or vice versa. In other words, a credential may be used for more than one computing service. Service container 2 116B includes service 2118E (supplied with credential 122D), service 5 (supplied with credential 122E), and service 4 (supplied with credential 122F).

[0046] At box 218, the monitoring process 112 manages the execution of application 110. Managing the execution of application 110 may include monitoring for VCC failures and, when a failure is detected, restarting the VCC with appropriate images and credentials (for each compute service within it) to restore operation.

[0047] Example multi-container application

[0048] Figure 4 An example multi-container application 410 is illustrated, which can be configured by a supervisory process 412, as described in more detail above. Application 410 utilizes various computing resources and services available to applications running within the network computing environment 400.

[0049] In the illustrated implementation, application 410 includes service container A 414A and service container B 414B. Each of service container A 414A and service container B 414B can provide a computing service with an application-specific role (which is a computing service provided to an application computing component (e.g., application 410)) or a computing service with a service-specific role (which is a computing service provided to a system computing component (e.g., monitoring process 412)). Service container A 414A includes computing services related to observability, which can be (but are not limited to) services related to observing, for example, data in an application computing component (e.g., another container of application 410 for executing application-specific code) or a system computing component (e.g., monitoring process 412). Such observability services may include a logging service that serves as a repository for event logs of the application computing component or the system computing component. For example, an application may send event logs to a logging service in which the event logs are accessible to a user (e.g., an application owner or administrator) to monitor or troubleshoot the operation of the application computing component or the system computing component. Observability services may also include tracing services (e.g., performing tracing) that track data as it traverses application computing components (e.g., application 410) or system computing components (e.g., monitoring process 412). Therefore, it should be noted that containers or other VCCs (e.g., service container A 414A) may not necessarily include the same exact computing services (logging and tracing), but may include computing services with similar functionality (e.g., observation) and that can provide services to different entities (e.g., application computing components, system computing components). Service container B 414B includes networking-related computing services that may, for example, provide computing services that allow application computing components (e.g., application 410) or system computing components (e.g., monitoring process 412) to access a network (e.g., the Internet) or communicate via that network.

[0050] like Figure 4As illustrated, service container A 414A includes log service A 404A, log service 404B, and tracing service 404C. Log service A 404A is provided in an application-specific role, in which credential C 416C is supplied to log service A 404A to support application computing components (e.g., application 410). Log service B 404B is provided in a service-specific role, in which credential A 416A is supplied to log service B 404B to allow access to system computing components (e.g., monitoring process 412). Tracing service 404C is provided in a service-specific role, in which credential B 416B is supplied to tracing service 404C to allow access to system computing components. Network service A 406A is provided in an application-specific role, in which credential E 416E is supplied to network service A 406A to allow access to application computing components (e.g., application 410). Network service B 406B is provided as an application-specific role, in which credential F 416F is supplied to network service A 406A to allow access to application computing components. Network service C 406C is provided as a service-specific role, in which credential D 416D is supplied to network service C 406C to allow access to system computing components.

[0051] like Figure 4 As shown, although Log Service B 404B and Tracing Service 404C have the same role (i.e., service-specific role), each is provided with different credentials, credential A 416A and credential B 416B. Credential A 416A allows Log Service B 404B to access a first set of specific data (e.g., events) in the system computing component, but not the remaining data. Similarly, credential B 416B allows Tracing Service 404C to access a second set of specific data to perform tracing in the system computing component, but not the remaining data (e.g., requests or events) in the system computing component. In other words, credentials allow computing services to access specific parts of the application computing component or the system computing component, while preventing access to the rest of the application computing component or the system computing component.

[0052] In an exemplary implementation, the credentials may further include additional features that grant a user permission to access the corresponding computing service. As previously discussed, although Log Service B 404B and Tracking Service 404C have the same role (i.e., service-specific role), each is provided with different credentials, credential A 416A and credential B 416B. Credential A 416A may allow a first user (e.g., an administrator) to access the service provided by Log Service B 404B. However, this first user may not be granted permission to access the service provided by Tracking Service 404C. Similarly, credential B 416B may allow a second user (e.g., another administrator) to access the service provided by Tracking Service 404C. However, the second user may not be granted permission to access the service provided by Log Service B 404B. This may be the case even if the first user and the second user belong to the same entity (e.g., a group, organization, or company).

[0053] Example host computing device

[0054] Figure 5 Example host computing device 100 is illustrated in some embodiments for performing processes and implementing the features described above. In some embodiments, host computing device 100 may include: one or more computer processors 502, such as a physical central processing unit (CPU) or graphics processing unit (GPU); one or more network interfaces 504, such as a network interface card (NIC); one or more computer-readable media drives 506, such as a hard disk drive (HDD), a solid-state drive (SSD), a flash memory drive, and / or other persistent non-transitory computer-readable media; and one or more computer-readable memories 510, such as random access memory (RAM) and / or other volatile non-transitory computer-readable media. The network interface 504 provides connectivity to one or more networks or computing devices. The computer processor 502 may receive information and instructions from other computing devices or services via the network interface 504. The network interface 504 may also store data directly in the computer-readable memory 510. The computer processor 502 may communicate with and from the computer-readable memory 510, execute instructions, and process data in the computer-readable memory 510, etc.

[0055] Computer-readable storage device 510 may include computer program instructions that a computer processor 502 executes to implement one or more embodiments. Computer-readable storage device 510 may store a management program 512 that provides computer program instructions for the computer processor 502 to perform general management and operation of the host computing device 100 and management of virtual components (such as virtual machines in which applications execute). Computer-readable storage device 510 may also include computer program instructions for monitoring processes 112 and containers (such as container 1 114) and application containers (such as service container 1 116A and service container 2 116B).

[0056] Example On-Demand Code Execution System

[0057] In some implementations, some or all of the application's VCCs may be initiated, managed, and / or hosted by an on-demand code execution system. The on-demand code execution system can provide a network-accessible service that allows users to submit or specify computer-executable code—also referred to herein as "function code" or simply "code"—to be executed by virtual machine instances on the on-demand code execution system. Each set of function code on the on-demand code execution system can define a "task" and implement specific functionality corresponding to that task when executed on a virtual machine instance of the on-demand code execution system. Individual tasks or related groups of tasks can be implemented in a single VCC, and an application can consist of multiple such VCCs. To provide the security benefits described above, the individual compute services within a VCC may be provided with credentials that scope the access and permissions required to execute their respective tasks, without access or permissions for executing other tasks managed by other VCCs of the application.

[0058] Figure 6 This is a block diagram of an exemplary operating environment 600 in which a service provider system 610 operates to enable a client device 602 to submit or request that user-defined code—including applications to be composed of multiple containers—be invoked by an on-demand code execution system 620.

[0059] For illustration, various example client devices 602 are shown communicating with service provider system 610, including desktop computers, laptop computers, and mobile phones. Generally, client device 602 can be any computing device, such as a desktop computer, laptop computer or tablet computer, personal computer, wearable computer, server, personal digital assistant (PDA), hybrid PDA / mobile phone, mobile phone, e-book reader, set-top box, voice command device, camera, digital media player, etc.

[0060] In general description, data storage service 660 is operable to enable clients to read, write, modify, and delete data, such as files, objects, blocks, or records, each representing a set of data associated with an identifier (“object identifier” or “resource identifier”) that can be interacted with as a separate resource. For example, an object may represent a single file submitted by client device 602 (although data storage service 660 may or may not store such objects as single files). This object-level interaction contrasts with other types of storage services, such as block-based storage where data is manipulated at the block level, or database storage where data manipulation may occur at the table level.

[0061] The data storage service 660 exemplary includes one or more front-ends 662 that provide an interface (command-line interface (CLI), application programming interface (API), or other programming interface) through which client devices 602 can interact with the service 660 to configure the service 660 and perform I / O operations on the service 660 on behalf of these client devices. For example, client device 602 can interact with front-end 662 to create a collection of data objects (e.g., a “bucket” of objects) on the service 660 and configure permissions for that collection. Client device 602 can then create, read, update, or delete objects within the collection based on the interface of front-end 662.

[0062] During normal operation, frontend 662 can be configured to receive a call to a requested method and apply that requested method to the input data of that method. For example, frontend 662 can respond to a request to put (PUT) the input data as an object into service 660 by storing the input data as an object on service 660.

[0063] Data can be stored, for example, on data storage area 668, which corresponds to any persistent or substantially persistent storage device (including hard disk drive (HDD), solid-state drive (SSD), network accessible storage device (NAS), storage area network (SAN), non-volatile random access memory (NVRAM), or any of the various storage devices known in the art). As yet another example, front end 662 can respond to a request for access to a dataset or a portion thereof from service 660 by retrieving the requested data (e.g., an object representing input data for a GET resource request) from storage area 668 and returning that object to the requesting client device 602.

[0064] In some cases, a call to a request method can invoke one or more native data manipulations provided by service 660. For example, a SELECT operation can provide a query in SQL format to be applied to an object (also identified in the request), or a GET operation can provide a specific range of bytes of an object to be returned.

[0065] Service provider system 610 exemplary includes caching service 670, which is configured to cache datasets of code executed by on-demand code execution system 620. Data can be cached on, for example, data cache 672, which corresponds to any data storage device, such as hard disk drive (HDD), solid-state drive (SSD), network accessible storage device (NAS), storage area network (SAN), non-volatile random access memory (NVRAM), random access memory (RAM), or various storage devices known in the art. Although shown as separate from and outside of data storage service and on-demand code execution system 620, in some embodiments, caching service 670 may be implemented within or in connection with one or both of data storage service 660 and on-demand code execution system 620 (e.g., on a physical or logical communication system that is part of data storage service 660 or on-demand code execution system 620).

[0066] Client device 602, data storage service 660, and on-demand code execution system 620 can communicate via network 604, which can include any wired network, wireless network, or a combination thereof. For example, network 604 can be a personal area network (PAN), local area network (LAN), wide area network (WAN), over-the-air broadcast network (e.g., for radio or television), cable network, satellite network, cellular telephone network, or a combination thereof. As another example, network 604 can be a publicly accessible network of linked networks that can be operated by various different parties, such as the Internet. In some embodiments, network 604 can be a private or semi-private network, such as a corporate or university intranet. Network 604 can include one or more wireless networks, such as a Global System for Mobile Communications (GSM) network, a Code Division Multiple Access (CDMA) network, a Long Term Evolution (LTE) network, or any other type of wireless network. Network 604 can use protocols and components for communicating via the Internet or any of the aforementioned types of networks. For example, protocols used by network 604 can include Hypertext Transfer Protocol (HTTP), HTTP Secure (HTTPS), Message Queuing Telemetry Transfer (MQTT), Constrained Application Protocol (CoAP), and so on. Protocols and components for communication via the Internet or any of the aforementioned types of communication networks are well known to those skilled in the art and therefore are not described in more detail herein.

[0067] System 620 includes one or more front-ends 630 capable of interacting with the on-demand code execution system 620. In an exemplary embodiment, front-end 630 serves as a "front door" to other services provided by the on-demand code execution system 620, enabling a user (via client device 602) to provide computer-executable code, request execution of the computer-executable code, and view the results of the computer-executable code. Front-end 630 includes various components for enabling interaction between the on-demand code execution system 620 and other computing devices. For example, each front-end 630 may include a request interface that provides client device 602 with the ability to upload or otherwise transmit user-specified code to the on-demand code execution system 620 and subsequently request execution of that code. In one embodiment, the request interface communicates with external computing devices (e.g., client device 602, front-end 662, etc.) via a graphical user interface (GUI), CLI, or API. Front-end 630 processes requests and ensures that requests are properly authorized. For example, front-end 630 may determine whether the user associated with the request is authorized to access the user code specified in the request.

[0068] As used herein, references to user code can refer to any program code written in a particular programming language (e.g., program, routine, subroutine, thread, etc.). In this disclosure, the terms "code," "user code," "function code," and "program code" are used interchangeably. For example, such user code can be executed in conjunction with specific data transformations developed by the user to implement a particular function. As described above, a single collection of user code (e.g., for implementing a particular function) is referred to herein as a "task," and a particular execution of that code (including, for example, compiling, interpreting, or otherwise enabling the code to execute) is referred to as "task execution" or simply "execution." Tasks can be written in JavaScript (e.g., node.js), Java, Python, or Ruby (and / or another programming language) in a non-limiting manner.

[0069] To manage requests for code execution, frontend 630 may include an execution queue that maintains a record of requested task executions. Exemplarily, the number of tasks that can be executed simultaneously by on-demand code execution system 620 is limited, and therefore, new task executions initiated at on-demand code execution system 620 (e.g., via API calls, via calls from already executed or currently executing tasks, etc.) can be placed on the execution queue and processed, for example, in a first-in, first-out (FIFO) order. In some embodiments, on-demand code execution system 620 may include multiple execution queues, such as individual execution queues for each user account. For example, a user of service provider system 610 may wish to limit the rate of task execution on on-demand code execution system 620 (e.g., for cost reasons). Therefore, on-demand code execution system 620 may utilize account-specific execution queues to regulate the rate of simultaneous task execution by a particular user account. In some instances, on-demand code execution system 620 may prioritize task executions, such that task executions for a particular account or with a specified priority are bypassed or prioritized within the execution queue. In other instances, the on-demand code execution system 620 can execute a task immediately or substantially immediately after receiving a call to it, and therefore, the execution queue can be omitted.

[0070] The front end 630 may also include an output interface configured to output information about the tasks performed on the on-demand code execution system 620. Example, the output interface may send data about the task execution (e.g., the results of the task, errors related to the task execution, or details of the task execution, such as the total time required to complete the execution, the total data processed by the execution, etc.) to the client device 602 or the data storage service 660.

[0071] In some implementations, the on-demand code execution system 620 may include multiple front-ends 630. In such implementations, a load balancer may be provided to distribute incoming calls to the multiple front-ends 630, for example, in a round-robin manner. In some implementations, the load balancer may distribute incoming calls to the multiple front-ends 630 based on the location or status of other components of the on-demand code execution system 620. For example, the load balancer may distribute calls to a geographically nearby front-end 630 or a front-end with the capability to serve the call. Where each front-end 630 corresponds to a separate instance of another component of the on-demand code execution system 620 (such as the activity pool 648 described below), the load balancer may distribute calls based on the capacity or load on those other components. In some instances, calls may be distributed deterministically among the front-ends 630 such that a given call to execute a task will always (or nearly always) be routed to the same front-end 630. This can, for example, help maintain an accurate record of task execution to ensure that a task is executed only the expected number of times. For example, calls may be distributed to achieve load balancing among the front-ends 630. Those skilled in the art will appreciate other distribution techniques, such as anycast routing.

[0072] The on-demand code execution system 620 also includes one or more worker managers 640 that manage virtual execution environments, such as virtual machine instances 650 (shown as VM instances 650A and 650B, generally referred to as "VMs") for servicing incoming calls to perform tasks. While the following description refers to virtual machine instance 650 as an example of such an environment, embodiments of this disclosure may utilize other environments, such as software containers. Figure 6 In the example shown, each worker manager 640 manages an activity pool 648, which is a group of virtual machine instances 650 (sometimes referred to as a pool) running on one or more physical host computing devices. These virtual machine instances are initialized to perform a given task (e.g., by loading the task's code and any dependency data objects into the instance).

[0073] Although virtual machine instance 650 is generally described above as being assigned to a specific task, in some implementations, the instance can be assigned to a group of tasks, such that the instance is bound to that group of tasks and any task in that group can be executed within the instance. For example, tasks in the same group may belong to the same application, and each task (or a subset of application tasks) may be implemented in a different container or other VCC. Tasks may be associated with permissions that cover various aspects controlling how a task can be executed. For example, task permissions may define which network connections (if any) the task's execution environment can initiate. As another example, task permissions may define what authentication information is passed to the task, thereby controlling which network-accessible resources can be used to execute the task (e.g., objects on service 660). As described in more detail above, each task or compute service of the application may be provided with access credentials of different scopes to provide permissions for executing a subset of application functionality provided by each compute service.

[0074] Once frontend 630 successfully processes a triggering event for executing an application or individual task, frontend 630 passes a request to worker manager 640 to execute the application or individual task. In one embodiment, each frontend 630 may be associated with a corresponding worker manager 640 (e.g., a worker manager 640 co-located with or geographically close to the frontend 630), and thus, frontend 630 may pass most or all of its requests to that worker manager 640. In another embodiment, frontend 630 may include a location selector configured to determine the worker manager 640 to which to pass the execution request. In one embodiment, the location selector may determine the worker manager 640 to receive the call based on a hash of the call and distribute the call to the worker manager 640 selected based on the hash value (e.g., via a hash ring). Various other mechanisms for distributing calls among worker managers 640 will be apparent to those skilled in the art.

[0075] Afterward, the worker manager 640 can modify the code of the virtual machine instance 650 (if needed) and execute tasks within instance 650. For example... Figure 6 As shown, the corresponding instance 650 may have an operating system (OS) 652 (shown as OS 652A and 652B), a language runtime 654 (shown as runtime 654A and 654B), and user code 656 (shown as user code 656A and 656B). OS 652, runtime 654, and user code 656 can work together to execute the user code to perform tasks. Therefore, through the operation of the on-demand code execution system 620, tasks can be executed quickly within the execution environment.

[0076] In one implementation, each VM 650 further includes assembly code 657, which is executable to facilitate the aggregation of input data and the processing of output data written to the VM 650, as well as the VM data store 658 accessible via the VM 650's local file system. Exemplarily, assembly code 657 represents a process executed on the VM 650 (or potentially the host device of the VM 650) and is configured to obtain data from a data storage service 660 or a caching service 670 and place that data into the VM data store 658. Assembly code 657 may be further configured to obtain data written to a file within the VM data store 658 and send that data to the data storage service 660 or the caching service 670. Because this data is available at the VM data store 658, user code 656 does not need to obtain the data over the network, thus simplifying user code 656 and allowing user code 656 to further restrict network communication, thereby improving security. Conversely, as discussed above, user code 656 can interact with input and output data as files on VM data store 658 by using file handles passed to code 656 during execution. In some implementations, the input and output data can be stored as files within the kernel space file system of data store 658. In other instances, assembly code 657 can provide a virtual file system, such as a User Space File System (FUSE) interface, which provides an isolated file system accessible to user code 656, thereby restricting user code access to VM data store 658.

[0077] As used herein, the term "local file system" generally refers to a file system maintained within an execution environment, enabling software running within that environment to access data as files, rather than via a network connection. According to various aspects of this disclosure, a data storage device accessible via a local file system can be local (e.g., a local physical storage device) or remote (e.g., accessed via a network protocol such as NFS, or represented as a virtualized block device provided by a network-accessible service). Therefore, the term "local file system" is intended to describe the mechanism by which software accesses data, rather than the physical location of the data.

[0078] VM data store 658 may include any persistent or non-persistent data storage device. In one embodiment, VM data store 658 is a physical storage device of the host device or a virtual disk drive hosted on a physical storage device of the host device. In another embodiment, VM data store 658 is represented as a local storage device, but is actually a virtualized storage device provided by a network-accessible service. For example, VM data store 658 may be a virtualized disk drive provided by a network-accessible block storage service. In some embodiments, data storage service 660 may be configured to provide file-level access to objects stored on data store 668, thus enabling VM data store 658 to be virtualized based on communication between assembly code 657 and service 660. For example, data storage service 660 may include a file-level interface that provides network access to objects within data store 668 as files. The file-level interface may, for example, represent a network-based file system server (e.g., a network file system (NFS)) that provides access to objects as files, and assembly code 657 may implement a client of this server, thus providing file-level access to objects of service 660.

[0079] In some instances, VM data store 658 can represent virtualization access to another data store executed on the same host device as VM instance 650. For example, activity pool 648 may include one or more aggregated VM instances ( Figure 6 (Not shown in the image), these bundled VM instances can be co-leased with VM instance 650 on the same host device. The bundled VM instances can be configured to support retrieving and storing data from service 660 (e.g., data objects or portions thereof, input data passed by client device 602, etc.), and storing that data on a data store of the bundled VM instance. For example, the bundled VM instance can be specified as not usable for supporting the execution of user code 656, and therefore has elevated privileges relative to instance 650 supporting user code execution. The bundled VM instance can allow other VM instances 650 within its host device (or potentially on a nearby host device) to access the data, such as by using a network-based file protocol (e.g., NFS). These other VM instances 650 can then act as clients of the bundled VM instance, enabling the creation of a virtualized VM data store 658, which, from the perspective of user code 656A, appears as a local data store. Advantageously, given that the data aggregation VM and VM instance 650 are both located on or near the host device, network-based access to the data stored at the data aggregation VM can be expected to occur very quickly.

[0080] While this document provides some examples of reading from or writing to the VM data store 658 using IO stream handles, IO streams can also be used to read from or write to other interfaces of the VM instance 650 (while still requiring user code 656 to perform operations other than stream-level operations, such as creating network connections). For example, assembly code 657 can "piped" input data as an input stream to the execution of user code 656, and its output can be "piped" as an output stream to assembly code 657. As another example, the hypervisor assembling the VM instance or VM instance 650 can pass input data to the network port of VM instance 650, which can be read by assembly code 657 and passed as an input stream to user code 657. Similarly, data written to an output stream by task code 656 can be written to a second network port of instance 650A for retrieval by the assembly VM instance or hypervisor. In yet another example, the hypervisor of instance 650 can pass input data as data written to a virtualized hardware input device (e.g., a keyboard), and aggregation code 657 can pass a handle to the I / O stream corresponding to that input device to user code 656. Similarly, the hypervisor can pass a handle to an I / O stream corresponding to a virtualized hardware output device to user code 656 and read data written to that stream as output data. Therefore, the examples of file streams provided herein can generally be modified to involve any I / O stream.

[0081] Data storage service 660, caching service 670, and on-demand code execution system 620 are in Figure 6 It is described as operating in a distributed computing environment, which includes the use of one or more computer networks ( Figure 6 Many interconnected computer systems (not shown). Data storage service 660, caching service 670, and on-demand code execution system 620 can also be used in systems with more... Figure 6 The devices shown operate within a computing environment with fewer or more devices. Therefore, it should be... Figure 6The descriptions of data storage service 660, caching service 670, and on-demand code execution system 620 herein are intended to be illustrative and not limiting of this disclosure. For example, on-demand code execution system 620, or various configurations thereof, may implement various web service components, hosting or “cloud” computing environments, or peer-to-peer network configurations to implement at least a portion of the processes described herein. In some instances, data storage service 660, caching service 670, and on-demand code execution system 620 may be combined into a single service. Further, data storage service 660, caching service 670, and on-demand code execution system 620 may be implemented directly in hardware or software executed by hardware devices, and may include, for example, one or more physical or virtual servers implemented on physical computer hardware configured to execute computer-executable instructions for performing the various features described herein. The one or more servers may be geographically dispersed or geographically co-located, for example, in one or more data centers. In some instances, the one or more servers may operate as part of a system for rapidly provisioning and releasing computing resources (often referred to as a “cloud computing environment”).

[0082] exist Figure 6 In the example, data storage service 660, caching service 670, and on-demand code execution system 620 are shown connected to network 604. In some embodiments, any of the components within data storage service 660, caching service 670, and on-demand code execution system 620 may communicate with other components of on-demand code execution system 620 via network 604. In other embodiments, not all components of data storage service 660, caching service 670, and on-demand code execution system 620 may communicate with other components of virtual environment 600. In one example, only front-ends 630 and 662 (in some instances, multiple front-ends may represent) of on-demand code execution system 620 and data storage service 660 may be connected to network 604, and other components of data storage service 660 and on-demand code execution system 620 may communicate with other components of environment 600 via their respective front-ends 630 and 662.

[0083] While this document uses individual components of the data storage service 660, caching service 670, and on-demand code execution system 620 to describe some functionalities, other components or combinations thereof can also implement similar functionalities. Therefore, Figure 6 The specific configuration intent of the components in the text is illustrative.

[0084] Terminology and Additional Notes

[0085] Some inventive aspects of this disclosure are set forth in the following clauses:

[0086] Clause 1. A system comprising: A credential distribution service, comprising one or more computing devices configured to obtain access credentials used by a service virtual computing component; and An on-demand code execution service, comprising multiple host computing devices, wherein the on-demand code execution service is configured to provide on-demand execution of function code, and wherein the host computing devices among the multiple host computing devices are configured as follows: Receive an instruction for starting a service virtual computing component, the service virtual computing component being configured to provide one or more computing services to an application virtual computing component and a system computing component, wherein the application virtual computing component is used to perform application functions, and wherein the system computing component is used to perform system functions, the system functions including the management of the application virtual computing component; Based on configuration data, it is determined that the service virtual computing component is used to perform an action using a first access credential to provide a first computing service to the application virtual computing component, and the service virtual computing component is used to perform an action using a second access credential to provide a second computing service to the system computing component, wherein the first access credential is assigned a different set of computing resource access permissions than the second access credential. Obtain the first access credential and the second access credential from the credential distribution service; and The execution of the service virtual computing component is initiated using the first access credential and the second access credential. The credential distribution service is configured as follows: The host computing device receives a request for the first access credential, wherein the request is associated with the access role to which the first access credential is assigned. At least in part, the credential distribution service assumes the access role to retrieve the first access credential from the authentication and authorization service; and Send the first access credential to the host computing device.

[0087] Clause 2. The system as described in Clause 1, wherein initiating the execution of the service virtual computing component includes executing the service virtual computing component in the same virtual machine as the application virtual computing component and the system computing component.

[0088] Clause 3. The system as described in Clause 1, wherein initiating the execution of the service virtual computing component includes executing at least one of the following: a logging service, an execution tracing service, or a network configuration service.

[0089] Clause 4. The system as described in Clause 1, wherein the host computing device among the plurality of host computing devices is further configured to: Obtain the first image to be used to start the service virtual computing component; and A second image is obtained to be used to launch the application's virtual computing component, wherein the second image is different from the first image.

[0090] Clause 5. A computer-implemented method comprising: Under the control of a computing system including one or more computing devices configured to execute specific instructions: It is determined that a service virtual computing component is started on the computing system, the service virtual computing component being configured to provide one or more computing services to an application virtual computing component and a system computing component, wherein the application virtual computing component is used to perform application functions, and wherein the system computing component is used to perform system functions, the system functions including the management of the application virtual computing component; The service virtual computing component is determined to use a first access credential to perform an action to provide a first computing service to the application virtual computing component, and the service virtual computing component is determined to use a second access credential to perform an action to provide a second computing service to the system computing component, wherein the first access credential is assigned a different set of computing resource access permissions than the second access credential. Obtain the first access credential and the second access credential; and The execution of the service virtual computing component is initiated using the first access credential and the second access credential.

[0091] Clause 6. A computer-implemented method as described in Clause 5, wherein initiating the execution of the service virtual computing component includes executing the service virtual computing component in the same virtual machine as the application virtual computing component and the system computing component.

[0092] Clause 7. The computer-implemented method as described in Clause 5, wherein initiating the execution of the service virtual computing component includes executing a first container separate from the second container executing the application virtual computing component.

[0093] Clause 8. The computer-implemented method as described in Clause 5 further includes obtaining application configuration data that specifies a plurality of computing services to be provided to the application virtual computing component, wherein for each of the plurality of computing services, the application configuration data specifies a corresponding access credential to be used.

[0094] Clause 9. The computer-implemented method as described in Clause 5, further comprising: Obtain the first image to be used to launch the service virtual computing component; and A second image is obtained to be used to launch the application's virtual computing component, wherein the second image is different from the first image.

[0095] Clause 10. A computer-implemented method as described in Clause 5, wherein initiating the execution of the service virtual computing component includes executing at least one of the following: a logging service, an execution tracing service, or a network configuration service.

[0096] Clause 11. The computer-implemented method as described in Clause 5, further comprising determining to launch a second service virtual computing component on the computing system, the second service virtual computing component being configured to provide a second set of one or more computing services to the application virtual computing component, the second set of one or more computing services being different from the one or more computing services that the service virtual computing component is configured to provide.

[0097] Clause 12. The computer-implemented method as described in Clause 5, wherein obtaining the first access credential comprises: A request for the first access credential is sent to a credential distribution service, wherein the credential distribution service assumes the role associated with the first access credential to obtain the first access credential from an authentication and authorization service; and In response to the request, the first access credential is received from the credential distribution service.

[0098] Clause 13. A computer-implemented method as described in Clause 5, wherein obtaining the first access credential includes obtaining an access key secret and a session token, wherein the access key secret and the session token are used to access computing resources in relation to the operation of the service virtual computing component.

[0099] Clause 14. A system comprising: A computer-readable storage medium storing executable instructions; and One or more computer processors, said one or more computer processors being programmed by said executable instructions to: The system determines to start a service virtual computing component, which is configured to provide one or more computing services to an application virtual computing component and a system computing component, wherein the application virtual computing component is used to perform application functions, and wherein the system computing component is used to perform system functions, including the management of the application virtual computing component. The service virtual computing component is determined to use a first access credential to perform an action to provide a first computing service to the application virtual computing component, and the service virtual computing component is determined to use a second access credential to perform an action to provide a second computing service to the system computing component, wherein the first access credential is assigned a different set of computing resource access permissions than the second access credential. Obtain the first access credential and the second access credential; and The execution of the service virtual computing component is initiated using the first access credential and the second access credential.

[0100] Clause 15. The system as described in Clause 14, wherein, in order to initiate the execution of the service virtual computing component, the one or more computer processors are further configured by the executable instructions to execute the service virtual computing component in the same virtual machine as the application virtual computing component and the system computing component.

[0101] Clause 16. The system as described in Clause 14, wherein, in order to initiate the execution of the service virtual computing component, the one or more computer processors are further configured to execute a first container separate from the second container executing the application virtual computing component.

[0102] Clause 17. The system as described in Clause 14, wherein the one or more computer processors are further configured to obtain application configuration data specifying a plurality of computing services to be provided to the application virtual computing component, wherein for each of the plurality of computing services, the application configuration data specifies a corresponding access credential to be used.

[0103] Clause 18. The system as described in Clause 14, wherein said one or more computer processors are further configured to: Obtain the first image to be used to start the service virtual computing component; and A second image is obtained to be used to launch the application's virtual computing component, wherein the second image is different from the first image.

[0104] Clause 19. The system as described in Clause 14, wherein, in order to initiate the execution of the service virtual computing component, the one or more computer processors are further configured to perform at least one of the following: a logging service, an execution tracing service, or a network configuration service.

[0105] Clause 20. The system as described in Clause 14, wherein the one or more computer processors are further configured to determine to initiate a second service virtual computing component, the second service virtual computing component being configured to provide a second set of one or more computing services to the application virtual computing component, which are different from the one or more computing services that the service virtual computing component is configured to provide.

[0106] All methods and tasks described herein can be performed and fully automated by a computer system. In some cases, the computer system may include multiple different computers or computing devices (e.g., physical servers, workstations, storage arrays, cloud computing resources, etc.) that communicate and interoperate via a network to perform the described functions. Each such computing device typically includes a processor (or multiple processors) that executes program instructions or modules stored in memory or other non-transitory computer-readable storage media or devices (e.g., solid-state storage devices, disk drives, etc.). The various functions disclosed herein may be embodied in such program instructions or implemented in the computer system's dedicated circuitry (e.g., ASICs or FPGAs). In cases where the computer system includes multiple computing devices, these devices may, but need not, be located in the same location. The results of the disclosed methods and tasks can be persistently stored by transforming physical storage devices such as solid-state memory chips or disks into different states. In some embodiments, the computer system may be a cloud-based computing system whose processing resources are shared by multiple different business entities or other users.

[0107] Depending on the implementation, certain actions, events, or functions of any process or algorithm described herein may be performed in a different order, or may be added, combined, or omitted entirely (e.g., not all described operations or events are necessary for the practical algorithm). Furthermore, in some implementations, operations or events may be performed simultaneously rather than sequentially, for example, through multithreading, interrupt handling, or on multiple processors or processor cores or other parallel architectures.

[0108] The various exemplary logic blocks, modules, routines, and algorithm steps described in conjunction with the embodiments disclosed herein can be implemented as electronic hardware or a combination of electronic hardware and computer software. To clearly illustrate this interchangeability, the various exemplary components, blocks, modules, and steps have been generally described above in accordance with their functionality. Whether such functionality is implemented as hardware or as software running on hardware depends on the specific application and design constraints imposed on the system as a whole. For each specific application, the described functionality may be implemented in different ways, but such implementation decisions should not be interpreted as departing from the scope of this disclosure.

[0109] Furthermore, the various exemplary logic blocks and modules described in conjunction with the embodiments disclosed herein can be implemented or executed by machines designed to perform the functions described herein, such as processor devices, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic components, discrete hardware components, or any combination thereof. The processor device may be a microprocessor, but alternatively, it may be a controller, microcontroller, or state machine, a combination thereof, etc. The processor device may include electronic circuitry configured to process computer-executable instructions. In another embodiment, the processor device includes an FPGA or other programmable device that performs logic operations without processing computer-executable instructions. The processor device may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors along with a DSP core, or any other such configuration. Although this document primarily describes digital technologies, the processor device may also primarily include analog components. For example, some or all of the algorithms described herein may be implemented in analog circuitry or mixed analog and digital circuitry. Computing environments can include any type of computer system, including, but not limited to, microprocessor-based computer systems, mainframe computers, digital signal processors, portable computing devices, device controllers, or computing engines within appliances.

[0110] Elements of the methods, processes, routines, or algorithms described in conjunction with the embodiments disclosed herein may be directly embodied in hardware, software modules executed by a processor device, or a combination of both. Software modules may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disks, removable disks, CD-ROMs, or any other form of non-transitory computer-readable storage medium. Exemplary storage media may be coupled to a processor device such that the processor device can read information from and write information to the storage medium. Alternatively, the storage medium may be integrated with the processor device. The processor device and storage medium may reside in an ASIC. The ASIC may reside in a user terminal. Alternatively, the processor device and storage medium may reside as discrete components in the user terminal.

[0111] Unless otherwise specifically stated, or otherwise understood as used in the context herein, the conditional language used herein (such as, in addition to, “can,” “may,” “may,” “may,” “may,” “for example,” etc.) is generally intended to convey that certain embodiments include certain features, elements, or steps that are not included in other embodiments. Therefore, such conditional language is generally not intended to imply that one or more embodiments require features, elements, and / or steps in any way, or that one or more embodiments must include a means for determining, with or without further input or prompting, whether such features, elements, and / or steps are included or performed in any particular embodiment. The terms “comprising,” “including,” “having,” etc., are synonymous and used inclusively in an open-ended manner, without excluding additional elements, features, actions, operations, etc. Furthermore, the term “or” is used in its inclusive sense (and not exclusively) such that, when used, for example, to connect a list of elements, the term “or” means one, some, or all of the elements in the list.

[0112] Unless otherwise specifically stated, disjunctive language such as the phrase “at least one of X, Y or Z” is understood in context to generally represent that items, terms, etc., can be X, Y or Z or any combination thereof (e.g., X, Y and / or Z). Therefore, such disjunctive language is generally not intended and should not imply that certain embodiments require the presence of at least one of X, at least one of Y or at least one of Z.

[0113] Unless otherwise expressly stated, articles such as “a” or “an” should generally be understood to include one or more of the described items. Thus, phrases such as “a device configured to…” are intended to include one or more of the described devices. Such one or more described devices may also be collectively configured to perform the stated description. For example, “a processor configured to perform descriptions A, B, and C” may include a first processor configured to perform description A, which works in conjunction with a second processor configured to perform descriptions B and C.

[0114] While the above detailed description has shown, described, and pointed out novel features applicable to various embodiments, it is understood that various omissions, substitutions, and changes in the form and details of the illustrated apparatus or algorithm may be made without departing from the spirit of this disclosure. It will be appreciated that some embodiments described herein may be embodied in forms that do not provide all the features and benefits set forth herein, as some features may be used or practiced separately from other features. The scope of certain embodiments disclosed herein is indicated by the appended claims rather than by the foregoing description. All changes falling within the meaning and scope of the equivalents of the claims will be included within the scope of the claims.

Claims

1. A computer-implemented method, comprising: It is determined that a service virtual computing component is started on the computing system, the service virtual computing component being configured to provide one or more computing services to an application virtual computing component and a system computing component, wherein the application virtual computing component is used to perform application functions, and wherein the system computing component is used to perform system functions, the system functions including the management of the application virtual computing component; The service virtual computing component is determined to use a first access credential to perform an action to provide a first computing service to the application virtual computing component, and the service virtual computing component is determined to use a second access credential to perform an action to provide a second computing service to the system computing component, wherein the first access credential is assigned a different set of computing resource access permissions than the second access credential. Obtain the first access credential and the second access credential; and The execution of the service virtual computing component is initiated using the first access credential and the second access credential.

2. The computer-implemented method of claim 1, wherein initiating the execution of the service virtual computing component includes executing the service virtual computing component in the same virtual machine as the application virtual computing component and the system computing component.

3. The computer-implemented method of claim 1, wherein initiating the execution of the service virtual computing component includes executing a first container separate from the second container executing the application virtual computing component.

4. The computer-implemented method of claim 1, further comprising obtaining application configuration data, the application configuration data specifying a plurality of computing services to be provided to the application virtual computing component, wherein for each of the plurality of computing services, the application configuration data specifies a corresponding access credential to be used.

5. The computer-implemented method as described in claim 1, further comprising: Obtain the first image to be used to launch the service virtual computing component; as well as A second image is obtained to be used to launch the application's virtual computing component, wherein the second image is different from the first image.

6. The computer-implemented method of claim 1, wherein initiating the execution of the service virtual computing component includes executing at least one of the following: a logging service, an execution tracing service, or a network configuration service.

7. The computer-implemented method of claim 1, further comprising determining to launch a second service virtual computing component on the computing system, the second service virtual computing component being configured to provide a second set of one or more computing services to the application virtual computing component, the second set of one or more computing services being different from the one or more computing services that the service virtual computing component is configured to provide.

8. The computer-implemented method of claim 1, wherein obtaining the first access credential comprises: A request for the first access credential is sent to a credential distribution service, wherein the credential distribution service assumes the role associated with the first access credential to obtain the first access credential from an authentication and authorization service; and In response to the request, the first access credential is received from the credential distribution service.

9. The computer-implemented method of claim 1, wherein obtaining the first access credential includes obtaining an access key secret and a session token, wherein the access key secret and the session token are used to access computing resources related to the operation of the service virtual computing component.

10. A system comprising: A computer-readable storage medium storing executable instructions; and One or more computer processors, said one or more computer processors being programmed by said executable instructions to: The system determines to start a service virtual computing component, which is configured to provide one or more computing services to an application virtual computing component and a system computing component, wherein the application virtual computing component is used to perform application functions, and wherein the system computing component is used to perform system functions, including the management of the application virtual computing component. The service virtual computing component is determined to use a first access credential to perform an action to provide a first computing service to the application virtual computing component, and the service virtual computing component is determined to use a second access credential to perform an action to provide a second computing service to the system computing component, wherein the first access credential is assigned a different set of computing resource access permissions than the second access credential. Obtain the first access credential and the second access credential; and The execution of the service virtual computing component is initiated using the first access credential and the second access credential.

11. The system of claim 10, wherein, in order to initiate the execution of the service virtual computing component, the one or more computer processors are further configured by the executable instructions to execute the service virtual computing component in the same virtual machine as the application virtual computing component and the system computing component.

12. The system of claim 10, wherein, in order to initiate the execution of the service virtual computing component, the one or more computer processors are further configured to execute a first container separate from the second container executing the application virtual computing component.

13. The system of claim 10, wherein the one or more computer processors are further configured to obtain application configuration data, the application configuration data specifying a plurality of computing services to be provided to the application virtual computing component, wherein for each of the plurality of computing services, the application configuration data specifies a corresponding access credential to be used.

14. The system of claim 10, wherein the one or more computer processors are further configured to: Obtain the first image to be used to start the service virtual computing component; and A second image is obtained to be used to launch the application's virtual computing component, wherein the second image is different from the first image.

15. The system of claim 10, wherein the one or more computer processors are further configured to determine to initiate a second service virtual computing component, the second service virtual computing component being configured to provide a second set of one or more computing services to the application virtual computing component, the second set of one or more computing services being different from the one or more computing services that the service virtual computing component is configured to provide.

Images