Abstract: A resource-based authorization control may be added to a data processing service. A control-plane action requested by an account or entity creates a resource-based authorization policy. The resource-based authorization policy pertaining to respective resources allows recurrent data-plane actions to maintain a data flow in a data pipeline to be authorized independent of a separate authorization service.

Abstract: Systems, methods, and computer-readable media are disclosed for determining virtual product placement opportunities in a media content and determining product candidates for virtual insertion into the media content. The product placement system may determine shot segments from the media content and for each shot segment may determine candidate product placement locations. The product placement system may determine contextual information from the shot segments and from the contextual information determine candidate products suitable for the product placement locations. The product placement system may determine total screen time for each product placement opportunity as well as quality of each opportunity. For each product and product placement opportunity, the product placement system may determine an expected revenue and a projected insertion cost.

Abstract: Described are systems and methods directed to determining a topology for the efficient allocation and distribution of a service to customers that are distributed over a geographic area. For example, the topology can facilitate the planning, scheduling, and allocation of resources for the efficient provisioning of services to customers at locations distributed over the geographic area. Certain input parameters and/or constraints associated with the provisioning of the service may be processed to define a cost function that may represent a total cost of providing the service while ensuring that none of the constraints are exceeded. The cost function may be optimized to determine a lowest relative cost for providing the services to the customers using the various mechanisms and/or types of resources, and a topology associated with the optimized cost function can be generated to specify how the service should be provided to satisfy the demand.

Abstract: Techniques are described for managing communications between multiple computing nodes, such as computing nodes that are separated by one or more physical networks. In some situations, the techniques may be used to provide a virtual network between multiple computing nodes that are separated by one or more intermediate physical networks, such as from the edge of the one or more intermediate physical networks by modifying communications that enter and/or leave the intermediate physical networks. In some situations, the computing nodes may include virtual machine nodes hosted on one or more physical computing machines or systems, such as by or on behalf of one or more users (e.g., users of a program execution service). The managing of the communications may include determining whether communications sent to managed computing nodes are authorized, and providing the communications to the computing nodes only if they are determined to be authorized.

Abstract: Code may be dynamically routed to computing resources for execution. Code may be received for execution on behalf of a client. Execution criteria for the code may be determined and computing resources that satisfy the execution criteria may be identified. The identified computing resources may then be procured for executing the code and then the code may be routed to the procured computing resources for execution. Permissions or authorization to execute the code may be shared to ensure that computing resources executing the code have the same permissions or authorization when executing the code.

Abstract: A unique identifier of an expression which refers to a cell of a data sheet is stored in a repository. In an application comprising an operation based on evaluating the expression, the expression is indicated by the unique identifier. In response to detecting a write directed to the cell, a modified version of contents of the cell is stored without re-evaluating the expression. The expression is re-evaluated in response to determining that the operation of the application is to be implemented.

Abstract: This disclosure describes a natural language question (NLQ) query service within a service provider network that provides row level security (RLS) for autocomplete during entry of NLQs and fuzzy matching in NLQ answering. The rules take the form of per-user predicates such as Tim can only see rows with region=US. In configurations a complex extraction and preprocessing pipeline to extract distinct combinations of values against RLS predicate “rule keys” is used. Those distinct values are indexed along with grouped rule keys to enable pushing down predicates at auto-complete time. This enables pushing part of RLS rule handling to ingestion time of a dataset rather than handling all RLS rule handling at query time, enabling meeting of latency goals. In configurations, a single logical document of unique cell values is split into multiple documents with a subset of rule keys to handle scalability limits.

Abstract: Techniques for managing access to sensitive data in transcriptions are described. A method for managing access to sensitive data in transcriptions may include receiving a request to generate a redacted transcript of content, obtaining a transcript of the content, sending at least a portion of the transcript to a model endpoint to identify sensitive entities in the transcript, receiving an inference response identifying one or more sensitive entities in the transcript, and generating the redacted transcript based at least one the transcript and the inference response.

Abstract: In one example, a pallet jack cap system includes a stabilization outrigger secured around steer wheels of a pallet jack, a bonnet in an elevated position over forks of the pallet jack, an anchor base for attachment to the pallet jack, and a vertical extension system between the anchor base and the bonnet. The vertical extension system supports the bonnet in the elevated position over the forks of the pallet jack. The vertical extension system can include an elevating vertical support assembly, an elastic counterpoise to assist with positioning the bonnet at a particular elevation based on an extension of the vertical support assembly, and an extension lock to secure the vertical support assembly at the particular elevation. The bonnet can be lowered down over a unit load on a pallet transported by the pallet jack, to secure the unit load and items in transport by the pallet jack.

Abstract: Techniques are described for managing access of executing programs to non-local block data storage. In some situations, a block data storage service uses multiple server storage systems to reliably store network-accessible block data storage volumes that may be used by programs executing on other physical computing systems. A group of multiple server block data storage systems that store block data volumes may in some situations be co-located at a data center, and programs that use volumes stored there may execute on other physical computing systems at that data center. If a program using a volume becomes unavailable, another program (e.g., another copy of the same program) may in some situations obtain access to and continue to use the same volume, such as in an automatic manner in some such situations.

Abstract: Idle periods may be for management actions at processing clusters for managed databases. A leader node of a processing cluster for a managed database may monitor a network endpoint at a proxy service associated with a database managed by the database service. An idle period for the database may be detected. A management action for the processing cluster may be determined to be performed during the detected idle period. The leader node may cause the determined management action to be performed.

Abstract: An operating system, or operating system update, management service uses a shared read-only multi-attach volume of a block-based storage service to distribute operating systems or operating system updates to a set of virtualized computing instances. Also, to store launch specific information, that is specific to a given virtualized computing instance, additional writable volumes are used, wherein a write volume is attached to each of the computing instances of the set. This eliminates the need to provide a full copy of an OS volume to each of the computing instances.

Abstract: A materialized view management service (MVMS) is capable of monitoring resource allocation changes of a source data object at a source data store and responsively generating resource change alerts to the owner of a target data object (the materialized view) in the target data store. Resource allocation changes may include autoscaling changes to the source data object's partition scheme, throughput limit, storage limit, and the like. The MVMS generates resource change alerts in response to these detected events and pushes the alerts to interested subscribers. Depending on the embodiment, the alerts may be pushed to human administrators, or the target data store itself, which may be configured to automatically adjust the resource allocation of the target data object to match the source data object. Advantageously, the disclosed alerts allow view owners to gain real time visibility of resource auto-scaling at the data source and appropriately react to such changes.

Abstract: Systems and methods are disclosed for rapid PCR testing. Example embodiments may include a PCR testing module that includes a housing having a PCR machine disposed therein; a sample input station on the housing, wherein the sample input station is configured to receive a sample collection device (SCD) comprising a biological specimen sample provided by the patient; an SCD processing mechanism configured to transfer a lysed microportion of the biological specimen sample into a PCR sample tube attached to the SCD; at least one mechanism configured to separate the PCR sample tube from the SCD and transfer the PCR sample tube to the PCR machine; and a controller configured to (i) use the PCR machine to conduct a PCR test on contents of the PCR sample tube, and (ii) generate results of the PCR test.

Abstract: A boot process for a computing device, such as integrated circuit, includes security features that are inaccessible during certain operation modes. An image including permission to access those security features is received during the boot process and may be verified using one or more keys. In operation, access to the security features is permitted during the operation modes after the image is verified. Such an approach enables a boot process to permit access to certain features after receipt and verification of different images.

Abstract: Various mounting systems for mounting heat sink apparatus to bare die processors are disclosed. The mounting systems include an upper plate, which may include a heat transfer portion, positioned in proximity to the upper surface of bare die processors to provide heat conduction away from the processors. The disclosed mounting systems secure the upper plate to the processors with balanced and centralized forces to inhibit tilting of the upper plate and reduce the risk of damaging the processors.

Abstract: Systems and methods are disclosed for securing fabric to speaker-based devices. An example device may include a housing having a first portion devoid of apertures, and a second portion having a first number of apertures. The device may include a fabric disposed about the housing, and an adhesive disposed between the fabric and the housing. The adhesive may include a first portion disposed between a first portion of the fabric and the first portion of the housing, and a second portion disposed between a second portion of the fabric and the second portion of the housing. The first portion of the adhesive may have a patterned non-liquid material that is bonded, and the second portion of the adhesive may have the patterned non-liquid material that is unbonded.

Abstract: A computing system includes a rack having standard slots for computing devices and computing devices coupled to the rack. One or more of the computing devices includes a chassis, a circuit board assembly in a primarily horizontal orientation, and one or more processors coupled to the circuit board assembly. One or more stacks of hard disk drives are coupled to the chassis. The chassis has a width that is equal to or less than half of the width of one of the standard slots of the rack.

Abstract: A file system manager implemented at a provider network identifies a storage device of a first group of storage devices of a provider network as an initial location of a file system object. Based on an access metric associated with the object, the file system manager initiates a transfer of contents of the object to a second storage device of a different storage device group, without receiving a client request specifying the transfer. In response to an access request received via a file system programmatic interface, contents of the object are provided from the second storage device. Based on a second access metric, the object is transferred back to the first group of storage devices.