212 results about "Cloud provider" patented technology

Systems and methods described herein provide for a customizable console, for use with providing cloud environments. Cloud computing offerings enable access within the context of a cloud environment by third-party operators acting as resellers of products or services owned or managed by a cloud provider. An operator provides access to their customers via consoles that are customizable by the operators to enable greater control over their cloud-based products and services.

Disclosed are various embodiments for dynamic availability zones in radio-based networks. In one embodiment, excess resource capacity on a radio access network (RAN)-enabled edge server in a cloud provider network is determined. The RAN-enabled edge server is located at a cell site and is configured to perform distributed unit (DU) and / or centralized unit (CU) functions for a RAN. The excess resource capacity is offered as part of a cellular capacity zone that is generally available to customers of the cloud provider network.

A cloud deployment automation system consisting of: a deployment automation device housed in a rack-mountable enclosure, the device comprising: a multi-core orchestration processor configured to execute deployment logic as compiled execution graphs; a storage module operatively coupled to the orchestration processor, the storage storing a set of deployment templates, real-time execution states, telemetry logs, and policy configurations; a secure credential management processing unit embedded in the device, configured to generate, store, and rotate cloud access tokens, API keys, and user-specific credentials, and to provide encrypted access to those credentials during deployment execution; an in-memory workflow execution engine executed by the orchestration processor, configured to analyze a user-defined deployment configuration that includes a declarative specification of infrastructure resources and compile that configuration into a directed acyclic graph (DAG) that represents the resource deployment order, dependency mapping, and rollback relationships, a cloud provider interface subsystem communicatively connected to multiple heterogeneous cloud platforms via appropriate API adapters, the subsystem enabling the orchestration processor to send provisioning requests and receive status events from the platforms; a customizable workflow compiler unit configured to convert graphical workflow definitions or domain-specific language (DSL) scripts into execution sequences that can be used by the workflow execution engine, where the workflow compiler unit supports conditional branching, asynchronous operations, and runtime variable resolution; and A policy enforcement control unit integrated into the deployment automation device, with the policy engine configured to apply organization-specific compliance rules, tagging conventions, security group configurations, and runtime resource limits to all deployment actions in a context-aware manner prior to execution.

Disclosed are various embodiments for automated deployment and management of distributed units (DUs) in a radio-based network. In one embodiment, it is determined to deploy a radio-based network at least partially using infrastructure of a cloud provider network. A radio access network (RAN)-enabled edge server of the cloud provider network is deployed to a physical location of the radio-based network. The RAN-enabled edge server is configured to perform a set of distributed unit (DU) functions for the radio-based network.

Techniques for adaptive sleep virtual machine management are described. A service of a provider network receives a parameter indicating that a first virtual machine can be slept and determines to sleep the first virtual machine based at least in part on the parameter. A state of the first virtual machine is captured, and the first virtual machine is terminated. The service determines to resume the captured state of the first virtual machine based at least in part on an indication. A second virtual machine is launched using the captured state of the first virtual machine and resumes execution of the captured state of the first virtual machine. A proxy server sends traffic to the first virtual machine before the termination of the first virtual machine and to the second virtual machine after the resumption of execution of the captured state of the first virtual machine by the second virtual machine.

Techniques for host fleet management in a cloud provider network are described. Forecast data including a forecasted demand for virtual machines in each capacity pool of a set of capacity pools is obtained. A mathematical optimizer application is executed to generate a first optimal fleet plan, the mathematical optimizer application having an objective function to minimize a number of new host computer systems to add to the set of host computer systems to satisfy the forecasted demand for each capacity pool, the first optimal fleet plan includes an identification of a set of hardware types and, for each hardware type in the set, a quantity of new host computer systems of the hardware type. A plurality of new host computer systems is deployed, based on the first optimal fleet plan, for a hardware type in the set of hardware types into the set of host computer systems.

Systems and methods are provided for allowing function-initiated traffic of an on-demand code execution system within a cloud provider network to be routed to a private path such based on opt-in settings. An opt-in request may be received indicating a desire of a function invoker to use a private path. Subsequent to the opt-in request, a function invocation request may be received to send communication to a service within the cloud provider network and external to the on-demand code execution system. Subsequent to the function invocation request, a virtual execution environment may be configured to execute the function with mapping of a network-based service to an IP address of a private endpoint. The function is then executed with its traffic sent to the private endpoint.

Disclosed are various embodiments that extend customer premises networks onto a cloud provider network. In one embodiment, a layer-3 virtual private network is established between a tunneling agent and a virtual private network server on a cloud provider network. The tunneling agent is executed on an edge customer premises equipment (CPE) device on a customer premises network. A layer-2 virtual interface is established for an edge application on the cloud provider network using a tunnel to encapsulate layer-2 traffic between the customer premises network and the edge application over the layer-3 virtual private network.

Techniques for intelligent user-configured multi-location service deployment and scaling are described. Autoscaling configuration data is received, the autoscaling configuration data including an application redistribution trigger condition and a placement optimization constraint, the application redistribution trigger condition based on a variable associated with a state of an application, the application deployed across a first set of deployment zones of a plurality of deployment zones of a cloud provider network. The application redistribution trigger condition is determined to be satisfied. A redistribution placement plan is obtained that satisfies the placement optimization constraint and identifies a second set of deployment zones of the plurality of deployment zones of the cloud provider network across which to deploy the application. The application is redistributed across the second set of deployment zones.

Disclosed are various embodiments relating to cloud computing in communications service provider networks. In one embodiment, a message to launch a customer container is received at an edge location of a cloud provider network embedded within a communications service provider network. The message is received from a control plane service of the cloud provider network. The customer container is launched on a computer system of the edge location, where the computer system has capacity for executing customer containers. The edge location communicates with the cloud provider network at least partly via the communications service provider network. The customer container communicates with a mobile device via the communications service provider network.

Techniques are disclosed for managing aspects of a dedicated region cloud at a customer location (a “DRCC”). A DRCC may comprise cloud infrastructure components provided by a cloud provider and hosted by computing devices located at the customer's (a “cloud owner's”) location. Services of the central cloud-computing environment may be similarly executed at the DRCC. The DRCC may include a service configured to collect, store, and / or present data corresponding to the cloud infrastructure components via one or more interfaces (e.g., interfaces provided to the cloud provider and / or the cloud owner). Data collected within the DRCC (e.g., capacity and usage data, etc.) may be provided and accessible to the central cloud at any suitable time. Obtaining such data enables the user to ascertain various operational aspects of the DRCC, while enabling the system and / or user to execute various DRCC-specific operations regarding capacity planning, health and performance, change management, and the like.

The aim of the invention is to define a method that allows the management of a particularly large MES / MOM project to be simplified, which may involve a plurality of manufacturing sites and a plurality of servers that require strict guidance regarding as low as possible to hold patches and update thresholds. According to the invention, this object is achieved by a method for operating a plurality of production plants by means of a manufacturing execution system, said method comprising the following steps: a) providing central computing hardware as a regional hub for running MES software; the MES software can manage a production process running through a plurality of production factories; b) configuring a first manufacturing execution system for a first single plant connected to the regional hub; c) creating a respective manufacturing execution system for each other plant by inheriting all configurations of the first manufacturing execution system to the other manufacturing execution systems; and d) configuring these additional plants with existing solutions in the regional hub over time without the need to reinstall the software of the manufacturing execution system and without the need to reapply some configurations that have been executed in the first plant and / or without the need to stop the system. Therefore, the method provides a better value for a multi-plant solution by reducing TCO. Indeed, the same number of servers required to hosting MES / MOM solutions serving a single manufacturing plant in the prior art can now be used to manage multiple plants (as presented in Figure 1). The set of servers constitutes a single MES / MONM solution distributed environment and is hosted by the same regional hub or at least a single "virtual data center" in the event of selecting a public cloud deployment according to the functionality provided by the cloud provider.

Techniques are described for enabling computing devices in computing environments distinct from a cloud provider network to use temporally staggered container image pull requests upon initiating execution of a container-based task. For example, upon determining to launch a container on a computing device running in a computing environment that is distinct from a cloud provider network, an agent running on the computing device can select a time in the future at which to request the container image(s) to be used to launch the container from a container registry based on a randomized value. The randomized value, for example, can enable each computing device in the environment to request the container image(s) at a time that differs from times at which other computing devices in the environment generate similar requests (e.g., such that the request times are “staggered” relative to one another).

Techniques are described for enabling a container service of a cloud provider network to detect imbalances of container placements across a selected set of availability zones (AZs) and to automatically rebalance placement of the containers, if needed. An actual distribution of containers may differ from an expected distribution according to a configured placement strategy, e.g., due to an outage or other operational issue affecting one or more of the AZs, scaling operations over time, and the like. In these and other scenarios, the container service can rebalance placement of the containers by terminating one or more containers in one or more of the AZs and launching additional containers in one or more other AZs to restore a more desirable balance. The periodic rebalancing of containers in this manner improves a container-based application's ability to load balance demand and further improves application availability by ensuring sufficient capacity is spread across multiple AZs.

The technology described herein is directed towards fault injection to cloud provider resources, through a system that facilitates selection of specific resources in availability zone(s) / region(s). Example resources include VMs (virtual machines), VM clusters, tagged resource grouping and / or managed services. Based on (e.g., user) input data, the system injects faults to specified resources through cloud provider interfaces. The input data can specify availability zone(s), fault injection start time and duration. The input data can also specify fixed mode (fail specified resources together) or chaos mode (randomly inject failures for each resource individually). Failure type can be specified, e.g., graceful (e.g., clean shutdown) or non-graceful (e.g., a non-clean, hard fault). Based on the input, the system injects fault(s) using the modes selected to the specified resource(s) in the selected availability zone(s) for the duration entered. The user is provided the fault-related status information the during the duration.

Disclosed are various embodiments relating to remotely connecting to customer premises networks to access cloud-executed edge applications. In one embodiment, a layer-3 virtual private network is established between a cloud provider network and a customer premises network of a customer. A layer-2 virtual interface is established for an edge application executed on the cloud provider network using a tunnel to encapsulate layer-2 traffic over the layer-3 virtual private network. A client device outside of the cloud provider network is connected to the customer premises network via the layer-3 virtual private network.

Systems and methods are described for implementing a distributed unit in a radio access network that executes code on behalf of a mobile device. The distributed unit may be implemented on an edge server physically in close proximity to the radio unit with few or no intermediary devices. Thus, the edge server may provide services to a mobile device, such as executing code in an execution environment on behalf of the mobile device with significantly lower latency than a further cloud-based server on the edge server. The edge server may preload a computing environment with code for which a mobile device is likely (e.g., since a particular application is executing on the mobile device) to execute, and may determine whether to execute code on the edge server or on a cloud provider network.

provisioning cloud-agnostic resource instances by sharing cloud resources is described herein. One example method includes creating a blueprint using a development platform, wherein the blueprint includes a definition of a resource, and wherein provisioning the resource includes provisioning a first cloud resource and a second cloud resource provided by a cloud provider, provisioning a first instance of the resource of the blueprint by provisioning a first instance of the first cloud resource and a first instance of the second cloud resource, and provisioning a second instance of the resource of the blueprint, wherein provisioning the second instance of the resource includes provisioning a second instance of the first cloud resource and sharing the first instance of the second cloud resource.

Techniques for providing a computer-implemented authentication integrity challenge (AIC) service are described. According to some examples, a computer-implemented method includes receiving, at a cloud provider network, a first request from an end customer device to log into an end customer account of the cloud provider network; sending, in response to the first request, a second request that does not include login credentials for the end customer account from the cloud provider network to a challenge provider service separate from the cloud provider network for the first request; receiving, by the cloud provider network, a validation indication from the challenge provider service that indicates the second request is validated by an integrity challenge of the challenge provider service; generating, by the cloud provider network, a proof based on the validation indication; sending the proof by the cloud provider network to the end customer device; receiving, by the cloud provider network, a third request from the end customer device that comprises the login credentials and the proof sent by the cloud provider network; and logging the end customer device into the end customer account in response to the proof provided in the third request being validated by the proof generated by the cloud provider network and the login credentials provided in the third request matching corresponding login credentials for the end customer account.

A system and method for providing virtual desktops to client devices of users is disclosed. The system includes available cloud regions that each can provide virtual desktops and associated resources. A desktop pool resource management engine is coupled to the available cloud regions and collects constraint data from the available cloud regions as well as operational data from desktop clients and desktop agents. A cloud usage profile is created for a subset of the users from the operational data. A priority list of available cloud regions for a user in the subset is created based on the usage profile and the constraint data of the available cloud regions. The highest priority cloud region from the priority list is recommended for the user requesting a desktop. A control plane selects the highest priority cloud region according to the priority list to provide the desktop to the client device.

An access policy analysis system may use stored policy summaries to efficiently perform access analysis. A request that causes an access analysis of an entity in a cloud service provider with respect to a resource hosted in the cloud service provider may be received. An access policy summary generated for the entity based on a set of access policies applied by an access management system of the cloud service provider may be obtained. An access policy summary generated for the resource based on the set of access policies may be obtained. A tree structure that describes a hierarchy of entities in the cloud service provider may be traversed to identify a parent node of the entity in the hierarchy of entities. The access analysis may then be generated based on the access policy summaries for the identified node in the tree structure, for the entity and for the resource.

An access policy analysis system may use visual exploration to efficiently perform access analysis. A request to display an effective access of an entity with respect to a resource hosted in a cloud provider may be received via a visual exploration user interface element. An analysis of a set of access policies applied by an access management system to determine an effective access of the entity with respect to the resource may be performed. One or more selectable access policy interface elements may be generated that correspond to one or more access policies of the set of access policies that are used to determine the effective access of the entity with respect to the resource. The one or more selectable access policy interface elements may be included in a display of the visual exploration user interface element along with the determined effective access of the entity with respect to the resource.

Disclosed are various embodiments that expose interfaces on customer premises networks for use by cloud-executed edge applications. In one embodiment, a layer-3 virtual private network is established between a cloud provider network and a customer premises network of a customer. A layer-2 virtual interface is established for an edge application executed on the cloud provider network using a tunnel to encapsulate layer-2 traffic over the layer-3 virtual private network. An interface on an edge device of the customer premises network is mapped so that the interface is accessible by the edge application via the tunnel.

A system and method for providing virtual desktops to client devices of users is disclosed. The system includes available cloud regions that each can provide virtual desktops and associated resources. A desktop pool resource management engine is coupled to the available cloud regions and collects constraint data from the available cloud regions as well as operational data from desktop clients and desktop agents. A cloud usage profile is created for a subset of the users from the operational data. A priority list of available cloud regions for a user in the subset is created based on the usage profile and the constraint data of the available cloud regions. The highest priority cloud region from the priority list is recommended for the user requesting a desktop. A control plane selects the highest priority cloud region according to the priority list to provide the desktop to the client device.

Disclosed are various embodiments for self-service management of network address allocations using hierarchical allocation pools. A first network address pool is created for a customer of a cloud provider network. The first network address pool is divided into a second network address pool for a cloud resource of the customer. A first network address block from the second network address pool is assigned to the cloud resource.

Disclosed are systems and methods that offload the work traditionally performed by a thick software client operating on each container instance of a cloud provider network with a thin and generalized agent that can be instructed in a piece-wise manner to perform operations as instructed by a workload manager executing on a control plane that is separate from the container instance. The workload manager, executing on the control plane of a cloud provider network, may precompute a set of operations and order of execution of those operations in the control plane and present those operations in a controlled manner to the agent that executes each operation as instructed. The agent executing on the data plane, rather than polling an orchestrator for work and then establishing the runtime environment based on a received Application Specification, awaits an operation or task that is pushed to the agent from the control plane.

Techniques for a container orchestration system are disclosed. A container orchestration API server receives a request from a virtual agent in a container orchestration cluster that includes a cloud provider authentication token. The request is generated by the virtual agent using a resource principal that corresponds to the virtual agent. The container orchestration API server attempts authentication of the virtual agent using a container orchestration native authentication. Upon failure of the container orchestration native authentication, the container orchestration API server authenticates the virtual agent using a cloud provider authentication unit via an authentication webhook using the cloud provider authentication token.

Disclosed are various embodiments for managing excess capacity in radio access network (RAN) edge systems. In one embodiment, a RAN-enabled edge server is located at a cell site, is configured to execute distributed unit (DU) and / or centralized unit (CU) functions for a RAN, and includes a physical layer accelerator specialized for DU physical layer communication. A computing device is configured to determine that the RAN-enabled edge server has excess resource capacity beyond a quantity necessary to execute the DU / CU functions for the RAN, determine a demand for the excess resource capacity from a cloud provider network, and determine whether to offer the excess resource capacity to third-party customers of the cloud provider network based at least in part on the demand.

Techniques for utilizing a cloud-side link module and a provider substrate extension (PSE) link module to secure a communications channel between a cloud provider network and a provider substrate extension are described. A PSE link module receives a request originated by a compute instance in the PSE that is destined to a destination within the cloud provider network. The request was encrypted using an encryption scheme that encrypts traffic of a virtual private cloud that the compute instance operates in. The PSE link module decrypts the first request, encrypts it using a separate encryption scheme, and transmits it via a secure tunnel to a second link module in the cloud provider network. The second link module can decrypt the encrypted traffic and cause it to be validated before it is passed on via the cloud provider's substrate network to be processed.

The technology described herein is directed towards automatically scaling cloud provider resources allocated for one enterprise's service based on the resources being used or expected to be used by another enterprise's service, in which there is a value chain-based load-dependency relationship between the two enterprises' services. In one example implementation, a first prediction engine determines a predicted workload for a first enterprise service, and sends that information to a load manager that allocates resources for the first enterprise service based on the prediction. Based on the load-dependency relationship, the first prediction engine sends the predicted workload to a second prediction engine, which predicts a second predicted workload for a second enterprise's service, and sends the second prediction information to a load manager that allocates resources for the second enterprise service based on the second prediction. The automatic scaling is done without sharing any enterprise-sensitive data among the enterprises.