287 results about "Cloud provider" patented technology

Generally described, one or more aspects of the present application relate to prefetching container image layers for use in a cluster of compute instances. For example, the dependencies among the individual layers within the container images stored and / or executed on a cloud provider network may be analyzed. Then, the layers that are likely to be used by a user of the cloud provider network may be identified and prefetched into the caches of the compute instances provided by the cloud provider network, before execution of the container images including such layers is requested by the user. By doing so, the latency between the time a request to execute a set of container images is received and the time the execution of the set of container images is actually initiated can be reduced, thereby providing an improved and more efficient application execution experience to the user.

Techniques are described for monitoring and analyzing input / output (I / O) messages for patterns indicative of ransomware attacks affecting computer systems of a cloud provider, and for performing various remediation actions to mitigate data loss once a potential ransomware attack is detected. The monitoring of I / O activity for such patterns is performed at least in part by I / O proxy devices coupled to computer systems of a cloud provider network, where an I / O proxy device is interposed in the I / O path between guest operating systems running on a computer system and storage devices to which I / O messages are destined. An I / O proxy device can analyze I / O messages for patterns indicative of potential ransomware attacks by monitoring for anomalous I / O patterns which may, e.g., be indicative of a malicious process attempting to encrypt or otherwise render in accessible a significant portion of one or more storage volumes as part of a ransomware attack.

A hosting system to facilitate connecting to multiple cloud providers may comprise a first cloud exchange; a second cloud exchange; one or more cloud point-of-presence (PoPs) communicatively coupled to the first and second cloud exchanges; a software-defined network (“SDN”) automation engine; a data collection layer; an artificial intelligence (AI) layer comprising one or more AI modeling engines configured to deploy one or more AI models; and a non-transitory computer readable medium comprising computer program instructions that when executed by a processor cause the system to generate a real-time conversational agent (a “chat-bot”), display the chat-bot on a user device, receive input comprising network specification parameters via the chat-bot, convert the input into one or more commands, generate a customized, on-demand SDN that complies with the network specification parameters, capture and model user data and network data, and automatically initiate one or more actions responsive to the modeling.

Techniques are described for enabling users of a cloud provider network to create policies used to control the use of temporary security credentials by computing resources other than a computing resource to which the credentials were issued. An identity and access management service encodes, into temporary security credentials, information about the virtual private network to which the credentials are issued. When a computing resource subsequently issues requests to perform actions and uses the temporary security credentials to sign the request, the cloud provider network further adds, to the network traffic, information associated with the virtual private network from which the request originates. A user can then create a policy with a statement indicating that request are to be permitted only if, e.g., the identity of the virtual private network as encoded in the temporary security credentials matches the identity of the virtual private network identified by the information included in the request.

Techniques for resource-based network traffic management are described. A service of a cloud provider network receives a traffic policy, the traffic policy identifying a path to a gateway to an external network, the path identifies at least one network function in the path by a resource identifier of the cloud provider network. Traffic policy association data is received, the traffic policy association data associating the traffic policy with one or more virtual networks hosted by the cloud provider network. A network configuration of the cloud provider network is updated to route network traffic from a first virtual network to the gateway to the external network through the network function.

Systems and methods described herein provide for a customizable console, for use with providing cloud environments. Cloud computing offerings enable access within the context of a cloud environment by third-party operators acting as resellers of products or services owned or managed by a cloud provider. An operator provides access to their customers via consoles that are customizable by the operators to enable greater control over their cloud-based products and services.

Disclosed are various embodiments for dynamic availability zones in radio-based networks. In one embodiment, excess resource capacity on a radio access network (RAN)-enabled edge server in a cloud provider network is determined. The RAN-enabled edge server is located at a cell site and is configured to perform distributed unit (DU) and / or centralized unit (CU) functions for a RAN. The excess resource capacity is offered as part of a cellular capacity zone that is generally available to customers of the cloud provider network.

A cloud deployment automation system consisting of: a deployment automation device housed in a rack-mountable enclosure, the device comprising: a multi-core orchestration processor configured to execute deployment logic as compiled execution graphs; a storage module operatively coupled to the orchestration processor, the storage storing a set of deployment templates, real-time execution states, telemetry logs, and policy configurations; a secure credential management processing unit embedded in the device, configured to generate, store, and rotate cloud access tokens, API keys, and user-specific credentials, and to provide encrypted access to those credentials during deployment execution; an in-memory workflow execution engine executed by the orchestration processor, configured to analyze a user-defined deployment configuration that includes a declarative specification of infrastructure resources and compile that configuration into a directed acyclic graph (DAG) that represents the resource deployment order, dependency mapping, and rollback relationships, a cloud provider interface subsystem communicatively connected to multiple heterogeneous cloud platforms via appropriate API adapters, the subsystem enabling the orchestration processor to send provisioning requests and receive status events from the platforms; a customizable workflow compiler unit configured to convert graphical workflow definitions or domain-specific language (DSL) scripts into execution sequences that can be used by the workflow execution engine, where the workflow compiler unit supports conditional branching, asynchronous operations, and runtime variable resolution; and A policy enforcement control unit integrated into the deployment automation device, with the policy engine configured to apply organization-specific compliance rules, tagging conventions, security group configurations, and runtime resource limits to all deployment actions in a context-aware manner prior to execution.

Techniques for automatically integrating SD-WAN constructs to security policies are described. The techniques may include defining, by a security cloud provider, a security policy for an entity, the entity represented by a VPN security policy label and the security policy absent source and destination CIDR IP addresses. The security cloud provider notifies an SD-WAN controller of the security policy. The SD-WAN controller maps the VPN security policy label to an IP address pool and a VPN ID. The SD-WAN controller generates an enhanced security policy by automatically adding source and destination CIDR IP addresses to the security policy. The SD-WAN controller deploys the enhanced security policy to an SD-WAN branch router and generates a VPN segment between the SD-WAN branch router and the security cloud provider to establish a common secure internet gateway tunnel for the IP address pool.

Disclosed are various embodiments for automated deployment and management of distributed units (DUs) in a radio-based network. In one embodiment, it is determined to deploy a radio-based network at least partially using infrastructure of a cloud provider network. A radio access network (RAN)-enabled edge server of the cloud provider network is deployed to a physical location of the radio-based network. The RAN-enabled edge server is configured to perform a set of distributed unit (DU) functions for the radio-based network.

Embodiments of the present disclosure include a non-transitory computer readable medium that when executed by at least one processor cause the at least one processor to perform operations for dynamic cloud workload protection, the operations comprising: installing an agentless scanning system, the agentless scanning system being configured to scan a cloud server, the cloud server including a network and a memory; detecting, using a cloud provider application program interface (API), an installation of a new workload in the cloud server, the new workload including disks; scanning, using the agentless scanning system, the disks of the new workload; installing an agent on the new workload; monitoring, using the agent, the disks, the network, and the memory of the new workload; generating, using the agent, a notification when an interesting event occurs; scanning, using the agentless scanning system, the cloud server; and generating at least one command to perform one or more of a remediation or a policy update.

Techniques for adaptive sleep virtual machine management are described. A service of a provider network receives a parameter indicating that a first virtual machine can be slept and determines to sleep the first virtual machine based at least in part on the parameter. A state of the first virtual machine is captured, and the first virtual machine is terminated. The service determines to resume the captured state of the first virtual machine based at least in part on an indication. A second virtual machine is launched using the captured state of the first virtual machine and resumes execution of the captured state of the first virtual machine. A proxy server sends traffic to the first virtual machine before the termination of the first virtual machine and to the second virtual machine after the resumption of execution of the captured state of the first virtual machine by the second virtual machine.

A system and method for isolating security credentials from a desktop management system using security Cloud proxy to communicate with a Cloud service provider system. Application programming interface (API) credentials are stored in a credential store managed by a secure proxy service system protected by a security environment. The secure proxy service system is interposed between the Cloud provider system and the desktop management service system. An operational request from the desktop service system is received by the secure proxy service system. The desktop service system is in network communication with a user device accessing the Cloud provider system. An API credential is retrieved from the credential store to authorize the operational request. An API adaptor is activated to communicate with an application programming interface (API) of the Cloud provider system to allow the Cloud provider to perform operational request.

Methods and systems are described herein for dynamically applying a security policy based on one or more tag attributes. The method comprises receiving, at a network controller, information about an instance of a cloud workload instantiated at a cloud provider. The cloud workload is associated with a tag attribute. The method further comprises querying the cloud provider for at least one IP address associated with the tag attribute and learning the at least one IP address associated with the tag attribute, including the IP address for the instance of the cloud workload. The method further comprises associating a security policy with the at least one IP address associated with the tag attribute and propagating the security policy to at least one edge router for implementation.

Systems, apparatus, articles of manufacture, and methods are disclosed for template generation to enforce desired states on cloud accounts. An example apparatus disclosed herein includes programmable circuitry to access a privilege from a cloud account, the privilege associated with a resource to be deployed based on a template, validate the privilege relative to template privileges specified in the template, secure the resource before deployment of the resource by imputing a privilege access condition to the resource based on the privilege satisfying at least one of the template privileges, and deploy the resource based on the template in a secure state, the secure state corresponding to the privilege access condition.

Cloud provider accounts can be integrated into a software-as-a-service platform. Configuration options can be provided to support various levels of granularity so that different cloud provider accounts can be provided to different tenants, workgroups, users, applications, and the like. From a user perspective, the fact that data is being stored at a cloud provider account can be transparent in that the same features and authentication process can be supported across different cloud provider types. In practice, limited temporary derived credentials can be generated from underlying credentials to provide fine-grained control of access to cloud provider account resources while avoiding administrative overhead.

Techniques for host fleet management in a cloud provider network are described. Forecast data including a forecasted demand for virtual machines in each capacity pool of a set of capacity pools is obtained. A mathematical optimizer application is executed to generate a first optimal fleet plan, the mathematical optimizer application having an objective function to minimize a number of new host computer systems to add to the set of host computer systems to satisfy the forecasted demand for each capacity pool, the first optimal fleet plan includes an identification of a set of hardware types and, for each hardware type in the set, a quantity of new host computer systems of the hardware type. A plurality of new host computer systems is deployed, based on the first optimal fleet plan, for a hardware type in the set of hardware types into the set of host computer systems.

Systems and methods are provided for allowing function-initiated traffic of an on-demand code execution system within a cloud provider network to be routed to a private path such based on opt-in settings. An opt-in request may be received indicating a desire of a function invoker to use a private path. Subsequent to the opt-in request, a function invocation request may be received to send communication to a service within the cloud provider network and external to the on-demand code execution system. Subsequent to the function invocation request, a virtual execution environment may be configured to execute the function with mapping of a network-based service to an IP address of a private endpoint. The function is then executed with its traffic sent to the private endpoint.

Disclosed are various embodiments that extend customer premises networks onto a cloud provider network. In one embodiment, a layer-3 virtual private network is established between a tunneling agent and a virtual private network server on a cloud provider network. The tunneling agent is executed on an edge customer premises equipment (CPE) device on a customer premises network. A layer-2 virtual interface is established for an edge application on the cloud provider network using a tunnel to encapsulate layer-2 traffic between the customer premises network and the edge application over the layer-3 virtual private network.

Techniques for intelligent user-configured multi-location service deployment and scaling are described. Autoscaling configuration data is received, the autoscaling configuration data including an application redistribution trigger condition and a placement optimization constraint, the application redistribution trigger condition based on a variable associated with a state of an application, the application deployed across a first set of deployment zones of a plurality of deployment zones of a cloud provider network. The application redistribution trigger condition is determined to be satisfied. A redistribution placement plan is obtained that satisfies the placement optimization constraint and identifies a second set of deployment zones of the plurality of deployment zones of the cloud provider network across which to deploy the application. The application is redistributed across the second set of deployment zones.

Systems, apparatus, articles of manufacture, and methods are disclosed to manage configuration of a cloud resource. An example system disclosed herein to manage configuration of a cloud resource includes programmable circuitry to at least one of execute or instantiate machine-readable instructions to compare a cloud resource configuration state with a cloud resource target configuration, generate an updated cloud resource configuration specification based on a difference between the cloud resource configuration state and the cloud resource target configuration, and cause an update of a cloud resource configuration parameter in a cloud provider based on the updated cloud resource configuration specification.

Techniques for adaptive network connectivity in a cloud provider network are described. A managed networking service obtains metadata associated with an application deployed in the cloud provider network and uses the metadata to construct a graph including application components and network components. Network flows are identified from the metadata and used to construct flow metadata that is linked to paths of the graph. The flow metadata is further enhanced with capability information for the network components on the path. The graph can be efficiently analyzed to identify alternative, superior networking configurations for the application.

Disclosed are various embodiments for extending cloud-based virtual private networks to radio-based networks. In one embodiment, a subnet of a virtual private cloud network of a cloud provider network is created in a radio-based network. An identifier of a subscriber identity module of a client device is registered in the virtual private cloud network. The subscriber identity module is assigned to a security group of the virtual private cloud network. A request from the client device to connect to the radio-based network is received, and the request presents the identifier. The virtual private cloud network to which the client device is permitted access is determined. The client device is provided with access to a resource on the virtual private cloud network through the radio-based network.

An automated, dynamic system and method of testing infrastructure-as-code (IaC). The system is configured to validate infrastructure provisioned in multi-cloud environments and is able to accommodate any cloud provider. Implementation of such as system can eliminate manual errors, as well as enable early detection of errors (i.e., before production deployment), thus empowering early ‘go live’. Furthermore, the proposed embodiments are configured to integrate with already existing devOps pipelines for rapid test execution and can run as many times as needed with minimal configuration, allowing for creation and execution of complex scenarios to test low-level validation upon cloud infrastructure setup.

Disclosed are various embodiments relating to cloud computing in communications service provider networks. In one embodiment, a message to launch a customer container is received at an edge location of a cloud provider network embedded within a communications service provider network. The message is received from a control plane service of the cloud provider network. The customer container is launched on a computer system of the edge location, where the computer system has capacity for executing customer containers. The edge location communicates with the cloud provider network at least partly via the communications service provider network. The customer container communicates with a mobile device via the communications service provider network.

Techniques are disclosed for managing aspects of a dedicated region cloud at a customer location (a “DRCC”). A DRCC may comprise cloud infrastructure components provided by a cloud provider and hosted by computing devices located at the customer's (a “cloud owner's”) location. Services of the central cloud-computing environment may be similarly executed at the DRCC. The DRCC may include a service configured to collect, store, and / or present data corresponding to the cloud infrastructure components via one or more interfaces (e.g., interfaces provided to the cloud provider and / or the cloud owner). Data collected within the DRCC (e.g., capacity and usage data, etc.) may be provided and accessible to the central cloud at any suitable time. Obtaining such data enables the user to ascertain various operational aspects of the DRCC, while enabling the system and / or user to execute various DRCC-specific operations regarding capacity planning, health and performance, change management, and the like.

The aim of the invention is to define a method that allows the management of a particularly large MES / MOM project to be simplified, which may involve a plurality of manufacturing sites and a plurality of servers that require strict guidance regarding as low as possible to hold patches and update thresholds. According to the invention, this object is achieved by a method for operating a plurality of production plants by means of a manufacturing execution system, said method comprising the following steps: a) providing central computing hardware as a regional hub for running MES software; the MES software can manage a production process running through a plurality of production factories; b) configuring a first manufacturing execution system for a first single plant connected to the regional hub; c) creating a respective manufacturing execution system for each other plant by inheriting all configurations of the first manufacturing execution system to the other manufacturing execution systems; and d) configuring these additional plants with existing solutions in the regional hub over time without the need to reinstall the software of the manufacturing execution system and without the need to reapply some configurations that have been executed in the first plant and / or without the need to stop the system. Therefore, the method provides a better value for a multi-plant solution by reducing TCO. Indeed, the same number of servers required to hosting MES / MOM solutions serving a single manufacturing plant in the prior art can now be used to manage multiple plants (as presented in Figure 1). The set of servers constitutes a single MES / MONM solution distributed environment and is hosted by the same regional hub or at least a single "virtual data center" in the event of selecting a public cloud deployment according to the functionality provided by the cloud provider.

A method for permission misuse detection and data leakage in a serverless cloud environment, comprising the steps of providing a Permission Misuse Detection (PMD) model that is adapted to utilize the cloud provider's native monitoring tools to detect abnormal behavior of serverless applications; filter log records that represent an interaction between a resource and the initiating entity; transform the records into a sequence of tokens; transform a predefined number of sequential tokens into an n-gram model; predict the last token in the sequence, to detect an anomaly. The method uses a Graph Representation of Logs for Access Detection (GR-LAD) model that is adapted to aggregate the log records and builds graph representations of the cloud services; learn the interactions between services and detect anomalies in such interactions by using graph theory features. A Compromised Function Detection (CFD) model is used to: generate multivariate sequences to represent each serverless function instance as a flow of the function's internal operations, using high-resolution logging of the serverless functions; analyze the sequences, to detect anomalies within the function flow itself, and within individual events in the function.

Techniques are described for enabling computing devices in computing environments distinct from a cloud provider network to use temporally staggered container image pull requests upon initiating execution of a container-based task. For example, upon determining to launch a container on a computing device running in a computing environment that is distinct from a cloud provider network, an agent running on the computing device can select a time in the future at which to request the container image(s) to be used to launch the container from a container registry based on a randomized value. The randomized value, for example, can enable each computing device in the environment to request the container image(s) at a time that differs from times at which other computing devices in the environment generate similar requests (e.g., such that the request times are “staggered” relative to one another).

Techniques are described for enabling a container service of a cloud provider network to detect imbalances of container placements across a selected set of availability zones (AZs) and to automatically rebalance placement of the containers, if needed. An actual distribution of containers may differ from an expected distribution according to a configured placement strategy, e.g., due to an outage or other operational issue affecting one or more of the AZs, scaling operations over time, and the like. In these and other scenarios, the container service can rebalance placement of the containers by terminating one or more containers in one or more of the AZs and launching additional containers in one or more other AZs to restore a more desirable balance. The periodic rebalancing of containers in this manner improves a container-based application's ability to load balance demand and further improves application availability by ensuring sufficient capacity is spread across multiple AZs.