Abstract: Systems and methods are described for implementing a coordinator within a coordinated environment, which environment includes set of coordinated devices managed by the coordinator. The coordinator can be provisioned with a set of tasks, each task corresponding to a segment of code that can be executed by the coordinator, such as to manage the coordinated devices. To assist in execution of the tasks, the coordinator can include a resource manager that generates execution environments corresponding to an individual task execution, which environments may be isolated from other execution environments. The coordinator can further include a scheduler to obtain calls to execute tasks, and implement a queue from which to select tasks for execution. On selecting a task, the scheduler may interact with the resource manager to generate an execution environment for the task, and cause execution of the task within the execution environment.

Abstract: A distributed, web-services based storage system. A system may include a web services interface configured to receive, according to a web services protocol, a given client request for access to a given data object, the request including a key value corresponding to the object. The system may also include storage nodes configured to store replicas of the objects, where each replica is accessible via a respective unique locator value, and a keymap instance configured to store a respective keymap entry for each object. For the given object, the respective keymap entry includes the key value and each locator value corresponding to replicas of the object. A coordinator may receive the given client request from the web services interface, responsively access the keymap instance to identify locator values corresponding to the key value and, for a particular locator value, retrieve a corresponding replica from a corresponding storage node.

Abstract: The following description is directed to the use of encryption by a computing system. In one example, a method can include determining whether information associated with a logical address is stored unencrypted within an on-chip memory of an integrated circuit or whether the information associated with the logical address is stored encrypted within an off-chip memory external to the integrated circuit. When the information is not stored unencrypted within the on-chip memory and is stored encrypted within the off-chip memory: a page associated with the logical address can be retrieved from the off-chip memory containing the encrypted information; the retrieved page can be decrypted to generate unencrypted information; and the unencrypted information can be stored in a frame of the on-chip memory.

Abstract: A host-side network processing device coupled between a storage system and a host machine to reconstruct a data object that has been encoded according to a sharding technique. Reconstructing the data object includes receiving, at the network processing device from the host machine, a request for the data object. The network processing device provides the request for the data object and an in-line network object reconstruction indicator to the storage system. The network processing device receives a location list from the storage system, where the location list includes location identifiers corresponding to respective shards of the requested data object. The network processing device requests at least a subset of the shards of the location list via a plurality of shard requests and reconstructs the data object from the subset. The network processing device provides the reconstructed data object to the host machine.

Abstract: Systems and methods are described for implementing a coordinator within a coordinated environment, which environment includes set of coordinated devices managed by the coordinator. The coordinator can be provisioned with a set of tasks, each task corresponding to a segment of code that can be executed by the coordinator, such as to manage the coordinated devices. To assist in execution of the tasks, the coordinator can include a communications manager that enables communications between tasks. The communications manager can provide a language-independent interface to call for execution of tasks, pass information to a task, and obtain outputs of a task. In some embodiments, the communication manager may utilize a language-independent protocol, such as the hypertext transport protocol, and be configured to respond to requests addressed to uniform resource identifiers associated with the communications manager.

Abstract: A provisioning device may be shipped to a client and used to automatically provision an IoT device to join a local network to communicate with a remote service provider. In response to a trigger input, the provisioning device creates a wireless hotspot that is recognizable by an IoT device as a provisioning hotspot. The provisioning device receives a signal from the IoT device indicating that the IoT device is available to be provisioned. The provisioning device obtains provisioning data and transmits the provisioning data to the IoT device. The IoT device uses the provisioning data to connect to a local wireless network and to establish a connection to the remote service provider. The IoT device may then use one or more IoT services of the service provider.

Abstract: A technology is provided for certificate authentication for registering a certificate in computing service environment. A request may be received to register a certificate authority (CA) certificate. A registration token associated with a customer account in a service provider environment may be generated to enable association of the customer account with the CA certificate and to authenticate a registration of the CA certificate. The registration token may be sent to a requester desiring to register the CA certificate. A verification certificate that contains the registration token and that is signed by a certificate authority (CA) of the CA certificate and the CA certificate that is signed by the CA may be received to register the CA certificate with the customer account within a service provider environment The CA certificate is persisted with the service provider environment after verifying the registration token is associated with the customer account and the CA certificate is signed by the CA.

Abstract: Systems and methods are described for configuring a coordinator within a coordinated environment, which environment includes set of coordinated devices managed by the coordinator. The coordinated devices may include devices configured to be managed remotely, such as thin devices, devices with alternative primary functions (e.g., appliances, household objects, etc.), or devices with limited localized user interfaces. To manage the set of coordinated devices, the coordinator can execute tasks, each task corresponding to a set of portable code executable by the coordinator to implement a desired functionality. A user may generate one or more tasks, and submit them to a service provider environment for deployment to the coordinator. The service provider environment can utilize a device shadow to notify the coordinator of the obtained tasks, and thereafter deliver the tasks to the coordinator, thus modifying a configuration of the coordinator.

Abstract: A client request, formatted in accordance with a file system interface, is received at an access subsystem of a distributed multi-tenant storage service. After the request is authenticated at the access subsystem, an atomic metadata operation comprising a group of file system metadata modifications is initiated, including a first metadata modification at a first node of a metadata subsystem of the storage service and a second metadata modification at a second node of the metadata subsystem. A plurality of replicas of at least one data modification corresponding to the request are saved at respective storage nodes of the service.

Abstract: A provisioning device may be shipped to a client and used to automatically provision an IoT device to join a local network to communicate with a remote service provider. In response to a trigger input, the provisioning device creates a wireless hotspot that is recognizable by an IoT device as a provisioning hotspot. The provisioning device receives a signal from the IoT device indicating that the IoT device is available to be provisioned. The provisioning device obtains provisioning data and transmits the provisioning data to the IoT device. The IoT device uses the provisioning data to connect to a local wireless network and to establish a connection to the remote service provider. The IoT device may then use one or more IoT services of the service provider.

Abstract: A technology is described for managing dynamic groups of devices using device representations. An example method may include receiving a request for a dynamic group of device representations. In response to the request, a membership parameter used to identify member device representations included in the dynamic group of device representations may be obtained. Device representations may be queried using the membership parameter to identify member device representations that have a state that corresponds to the membership parameter, and the dynamic group of device representations may be generated to include identifiers for the member device representations.

Abstract: A technology is described for operating a device shadowing service that calculates an aggregated group state for a group of device representations. An example method may include receiving device states for devices represented using a group of device representations, where the devices connect over a network to a device shadowing service configured to manage the device states. In response to an event, device representations included in the group of device representations may be identified. Device states indicated by the device representations may be obtained and an aggregated group state for the group of device representations may be calculated using the device states indicated by the device representations.

Abstract: A computing environment is disclosed that receives from devices requests directed toward services accessible in the environment, and that forwards communications from services in the environment to devices registered with the environment. During a registration process at the environment, devices are assigned a device identifier that is used to identify and authenticate each particular device and requests communicated from and to the device via the environment. The computing environment maintains state information for each device that has been registered with the system. As the device interacts with the system, the state information is updated to reflect the changes in the device. When requests to perform functions are received from devices, the computing environment determines for the particular device and the particular function requested what processing needs to be performed by the environment in response to the request.

Abstract: Techniques for treating surfaces of a multi-platter disk as independent units are described herein. Each surface of a plurality of surfaces of a multi-platter disk is identified and a set of storage layout data describing the storage format of the surface is received. A logical address is calculated based on the surface layout data and at least a portion of the storage layout data is stored on the surface. The logical address of the surface is then provided for use by other services.

Abstract: Methods and apparatus for handling failure of servers in traffic forwarding (TF) systems between networks. A TF system may include units each including multiple servers. Outbound and inbound traffic for a local network may be distributed among the units according to a routing technique, with each unit responsible for an allocated portion of the traffic. Servers in a unit may participate in a health check protocol to detect servers that are not healthy. If the healthy servers in a unit drops below a threshold at which the unit cannot reliably handle its allocated portion of the traffic, the servers may automatically take the unit out of service, for example by stopping advertisement of routes, and the traffic may be reallocated across the remaining units. This may help prevent congestion-related delays, high latency, packet losses, and other problems on connections through the unhealthy unit.

Abstract: Methods, apparatus, and computer-accessible storage media for providing a volume-based block storage service and application programming interfaces (APIs) to the service. A block storage service and block storage service APIs may allow processes (applications or appliances) on the service client network to leverage remote, volume-based block storage provided by the service provider. The APIs may provide a standard interface to volume-based block storage operations on a remote data store. The service provider, the service clients, and/or third parties may develop various applications and/or appliances that may, for example, be instantiated in service clients' local networks and that leverage the block storage service via the APIs to create and manage volumes and snapshots on the remote data store and to upload and download data from the volumes and snapshots on the remote data store.

Abstract: Systems and methods are described for configuring a coordinator within a coordinated environment, which environment includes set of coordinated devices managed by the coordinator. The coordinated devices may include devices configured to be managed remotely, such as thin devices, devices with alternative primary functions (e.g., appliances, household objects, etc.), or devices with limited localized user interfaces. To manage the set of coordinated devices, the coordinator can execute tasks, each task corresponding to a set of portable code executable by the coordinator to implement a desired functionality. A user may generate one or more tasks, and submit them to a service provider environment for deployment to the coordinator. The service provider environment can utilize a device shadow to notify the coordinator of the obtained tasks, and thereafter deliver the tasks to the coordinator, thus modifying a configuration of the coordinator.

Abstract: A storage manager may be used to perform a coding operation (e.g., an encoding operation or a decoding operation) on a data object using a refined version of a coding matrix in a storage system, such as an object-redundant storage system. The coding operation may include identifying a coding matrix for the data object and retrieving a refined version of the identified coding matrix from a data store of pre-refined coding matrices. The refined version of the coding matrix may identify two or more computations to be performed as part of the coding operation, where the two or more computations have common terms and operations. The coding operation may include determining one or more precomputed results of the two or more identified computations. The precomputed results may be used instead of performing the computations when performing the coding operation.

Abstract: A storage manager may be used to perform a refinement operation on a coding matrix as part of a coding operation (e.g., an encoding operation or a decoding operation) in a storage system, such as an object-redundant storage system. The refinement operation may include identifying a plurality of computations to be performed as part of the coding operation, where the plurality of computations have common terms and operations. The refinement operation may include refining a coding matrix associated with the coding operation based on the identified computations and precomputing the identified computations. The precomputed computations may be used instead of performing the computations when performing the coding operation.

Abstract: Systems and methods are described for management of data transmitted between computing devices in a communication network. An administrative component can configure one or more devices in the communication path of messages to be exchanged by devices to interpret codes embedded in the communication messages. A receiving device can review incoming messages for security information. The receiving devices can then process the message based on the security information to determine how the communication message will be routed or otherwise processed.