Abstract: A distributed data store may maintain versioned hierarchical data structures. Different versions of a hierarchical data structure may be maintained consistent with a transaction log for the hierarchical data structure. When access requests directed to the hierarchical data structure are received, a version of the hierarchical data structure may be identified for processing an access request. For access requests with snapshot isolation, the identified version alone may be sufficient to consistently process the access request. For access requests with higher isolation requirements, such as serializable isolation, transactions based on the access request may be submitted to the transaction log so that access requests resulting in committed transactions may be allowed, whereas access requests resulting in conflicting transactions may be denied.

Abstract: Techniques for unique label recognition and notification for streaming video. A video stream from a camera-equipped electronic device is received via the API endpoint of a stream processing service in a provider network. A request for unique label recognition and notification is received via an API endpoint of a computer vision service in the provider network. The computer vision service analyzes a video fragment of the video stream. If a unique label is recognized in the video fragment, then a notification service in the provider network sends a notification that the unique label was recognized in video captured by the camera-equipped electronic device.

Abstract: An integrated circuit for distributing processing tasks includes a pre-selector circuit and a scheduler circuit. The pre-selector circuit is configured to receive a processing task, determine a category of the processing task, and select, from a set of task distribution techniques and based at least in part on the category of the processing task, a task distribution technique for distributing the processing task to a group of processing units. The scheduler circuit is configured to implement the selected task distribution technique to select, from the group of processing units, a target processing unit for performing the processing task.

Abstract: Methods and apparatus for interfaces to manage inter-regional connectivity for direct network peerings. A system may include a connectivity coordinator, a first resource collection in a first geographical zone and a second resource collection in a second geographical zone. The coordinator implements a programmatic interface defining connectivity operations. The coordinator receives a request via the interface to establish a logically isolated network path to the second resource collection on behalf of a client that has a dedicated physical link set up to connect to the first resource collection. In response to the request, the coordinator performs one or more configuration operations to enable traffic to flow from the client's network to the second resource collection over a logically isolated network path using the dedicated physical link.

Abstract: Queries may be made against a non-relational database without impacting the capacities of the non-relational database by enabling performance of queries to a non-relational database via an external query management, backup management, and a non-relational database backup hosted in an external data storage. The query management and backup management of the non-relational database service may split transactional load to the non-relational database and analytical load, and furthermore allow selection of a desired data freshness for queries including various time ranges, such as seconds, minutes, or days.

Abstract: Techniques are described for enabling users of a cloud provider network to create policies used to control the use of temporary security credentials by computing resources other than a computing resource to which the credentials were issued. An identity and access management service encodes, into temporary security credentials, information about the virtual private network to which the credentials are issued. When a computing resource subsequently issues requests to perform actions and uses the temporary security credentials to sign the request, the cloud provider network further adds, to the network traffic, information associated with the virtual private network from which the request originates. A user can then create a policy with a statement indicating that request are to be permitted only if, e.g., the identity of the virtual private network as encoded in the temporary security credentials matches the identity of the virtual private network identified by the information included in the request.

Abstract: Techniques for certificate authority (CA) selection are described. A certificate management service of a cloud provider network receives a first request to generate a certificate from an electronic device, the first request including an indication of an identity of a user and an identification of a domain name to associate with the certificate. A CA selection policy applicable to the first request is identified, the CA selection policy including a CA selection rule. A CA to generate the certificate is identified by evaluating the CA selection rule, the CA selection rule associates at least a portion of the domain name with the CA. A second request to generate the certificate is sent to the identified CA. The certificate or an identification of the certificate from the CA is returned to the electronic device.

Abstract: Methods, systems, and computer-readable media for dynamic bucketization based on real-time access patterns are disclosed. Item identifiers corresponding to items in a data store are distributed among of buckets based at least in part on one or more bucket parameters. The item identifiers are divided into access windows within the buckets. Items corresponding to item identifiers in one or more access windows are loaded from the data store. Based at least in part on one or more access requests from a client with respect to the loaded items, one or more item identifiers are moved between access windows. The updated access windows with different sets of items are stored back to the data store.

Abstract: A fuzzy scoreboard can compute, using a signature function, a first signature of an expected data stream associated with an input data stream that is being inputted to a design-under-test (DUT) for a datapath test. The first signature of the expected data stream can be stored without storing the expected data stream. The fuzzy scoreboard can also compute, using the same signature function, a second signature of an output data stream that is outputted from the DUT during the datapath test. The first signature can be compared with the second signature to determine whether there is a match. Storing the first signature of the expected data stream without storing the expected data stream can reduce the memory space consumed by the fuzzy scoreboard.

Abstract: A computer-implemented method includes generating, based on a representation of a tensor mapping between an input tensor and an output tensor, a list of mappings from elements of the input tensor to elements of the output tensor, and generating groups of mappings from the list of mappings, where each of the groups of mappings corresponds to a respective set of matrix multiplications, a matrix transpose, or both. The computer-implemented method also includes generating a respective expression for each of the groups of mappings and generating code for summing results of the respective expressions, where each respective expression includes the respective set of matrix multiplications, the matrix transpose, or both.

Abstract: Route tables may be associated with ingress traffic for logically isolated networks. A routing device at the edge of a logically isolated network may receive a route to include in a route table that is associated with ingress traffic to the logically isolated network, where the ingress traffic is destined for a block of public or private IP addresses. The route instructs the edge routing device to forward such ingress traffic to a network interface of a network appliance hosted in the logically isolated network. Network packets received at the edge routing device may have a destination of one or more public or private IP addresses in the block of public/private IP addresses. The edge routing device may identify the route in the route table that forwards the ingress network traffic destined for the block of public or private IP addresses to the network interface for the network appliance.

Abstract: Methods and apparatus for dynamic modification of interruptibility settings of network-accessible resources are disclosed. A system includes a resource manager and a plurality of resource instances, each of which has an interruptibility setting. In response to an instance acquisition request, the resource manager allocates an instance with a first interruptibility setting, allowing the resource manager to revoke the client's access to the instance without a notification. In response to an approval of an interruptibility upgrade request, the resource manager modifies the interruptibility setting to a second setting that allows the client to retain access to the instance for at least a specified time. Respective billing amounts for the client's use of the instance are determined for each of the interruptibility settings used.

Abstract: Techniques for resource-based network traffic management are described. A service of a cloud provider network receives a traffic policy, the traffic policy identifying a path to a gateway to an external network, the path identifies at least one network function in the path by a resource identifier of the cloud provider network. Traffic policy association data is received, the traffic policy association data associating the traffic policy with one or more virtual networks hosted by the cloud provider network. A network configuration of the cloud provider network is updated to route network traffic from a first virtual network to the gateway to the external network through the network function.

Abstract: Disclosed are various embodiments for managing security credentials for an authentication management client on a client device. In one non-limiting example, a computing device is configured to receive an authentication request from an authentication management client of a client and determine an affinity of the authentication management client based at least in part on the authentication request. The computing device is configured to determine that the authentication management client is supported based at least in part on the affinity. The computing device is configured to generate a session for the authentication management client based at least in part on a security credential being received from the authentication management client.

Abstract: Systems and methods are disclosed for visual indicators for optimized packing of multi-item packages. In one embodiment, an example system may include an optionally bottomless container, a projector, and a controller configured to determine a first size of a first item to be placed in the bottomless container, determine a second size of a second item to be placed in the bottomless container, determine an item arrangement for the first item and the second item, and determine a first position for a first visual indicator. The controller may be configured to determine a second position for a second visual indicator, determine a size for a square to be projected by the projector, and cause the projector to project the first visual indicator at the first position, the second visual indicator at the second position, and the square onto the bottomless container.

Abstract: This disclosure describes, in part, techniques for generating location information associated with a video. For instance, an electronic device may use a radar sensor to generate radar data. The electronic device may then analyze the radar data in order to determine a location associated with an object. In some instances, the location may correspond to at least a first coordinate along a first axis and a second coordinate along a second axis. The electronic device may also generate image data using the imaging device. Additionally, the electronic device may analyze the image data in order to determine that the image data represents an object and/or a type of object. The electronic device may then generate location data representing an identifier for the object and the location. Next, the electronic device may send the image data and the location data to one or more computing devices.

Abstract: A processing service of a provider network may protect media content from being tampered with when it is transmitted from the provider network/transcoder to untrusted networks (e.g., third-party networks/CDNs) and to a media player. The processing service (e.g., the transcoder) generates a public and a private key. The service uses the private key to digitally sign content portions (e.g., video frames) before distribution to untrusted CDNs. The provider network creates a manifest that includes the public key. To play the media content, the media player obtains a manifest that includes the public key (via a secure/trusted connection with the provider network). The media player may then obtain the media content from an untrusted edge server/CDN and validate it using the public key that was separately obtained from the manifest (to verify the content was not tampered with).

Abstract: A vehicle software deployment management system generates a modifiable deployment plan and one or more associated vehicle software modules that is sent to an edge device at a vehicle activity site. The edge device stores the modifiable deployment plan and the one or more vehicle software modules for updating a given vehicle at a future time. In some embodiments, the vehicle may have insufficient network connectivity to perform the update remotely from the vehicle activity site. In some embodiments, the modifiable deployment plan may be modified by the edge device at the future time when the vehicle is present at the vehicle activity site, based on vehicle information obtained by the edge device and based on vehicle user/technician input obtained by the edge device.

Abstract: Methods, systems, and computer-readable media for orchestration of computations using a remote repository are disclosed. A representation of one or more inputs to a computation is stored in a repository. The computation is assigned to one or more hosts of a plurality of hosts. A representation of program code executable to perform the computation is stored in the repository. A local copy of the one or more inputs is stored on the one or more hosts. The computation is initiated on the one or more hosts using the program code and the local copy of the one or more inputs. The computation is initiated for a plurality of keys. The computation succeeds for one or more keys after the computation has failed for one or more other keys. A representation of one or more outputs of the computation is stored in the repository.