Abstract: Security policies can be dynamically updated in response to changes in endpoints associated with those policies. A user can indicate one or more regions or networks from which access is to be granted under a specific security policy. The user can subscribe to receive notifications upon a change relating to those endpoints, such as the addition or removal of one or more endpoints. When a change is detected, new policy information can be generated automatically and published for subscribed policies, which can then have the updates applied automatically or provided for manual review and application. Such a process enables access determinations to be made based upon up-to-date endpoint information.

Abstract: Variable reclamation of data copies can be performed. Copies of data may be stored in a data store. The copies of the data may be available to restore or return the data to a state described in or based on one of the copies. One or more copies, or portions of a copy, may be selected for invalidation according to a variable rate. The variable rate may be determined based on accesses to the data. Selected copies, or portions of a copy, may then be invalidated.

Abstract: Described implementations obtain a proof of valid attestation data. The attestation data may include configuration data of a host computing system. A prover service may receive the attestation data. The prover service may generate a proof to prove that the attestation data includes valid configuration data of the host computer system, without revealing sensitive or private information of the host computing system. The proof may be a zero-knowledge proof.

Abstract: Systems and methods described herein provide for novel configuration features for setting up a user device automatically to connect to a network and register the user device to a user account. A mapping of user devices to cryptographic keys for the user devices may be maintained by a computer system. The computer system may receive information that specifies network information and user account information for a particular user device. A mapping of the network information and user account information to the particular user device may be generated. A machine-readable code that includes the network information for connecting the particular user device to the network and a token that includes credentials for the user account information may be generated and transmitted to a assistant configuration device.

Abstract: Techniques are described for a domain-specific language and associated framework for implementing analyses of security, operational, or functional properties involving computing resources. The specification language enables users to readily define the semantics of a set of cross-resource relations of interest using a human-readable language. For example, the language enables users to express properties over computing resources based on a user-defined set of cross-resource relations. The specification language is human-readable, allowing users to easily add new cross-resource relations or to modify existing relations and properties, thereby enabling users to readily modify existing analyses or to create new ones entirely.

Abstract: A plurality of events is extracted from a set of sources, including an event representing a transfer of a first data set from one data storage stage of a data pipeline to another stage to form a second data set, and another event representing a completion of a computation performed on the second data set. Based on analysis of the plurality of events, a graph is stored; the nodes of the graph represent data sets at respective stages of the data pipeline, and edges represent the events. In response to a request for lineage information pertaining to a particular data set at a particular stage of the pipeline, an indication of a sequence of events represented in the graph is provided, including a particular event which led to the presence of the particular data set at the particular stage.

Abstract: A semiconductor package can include a capacitance die. The package can have multiple dice (e.g., logic die, memory die) mounted on a substrate. Each die can include a power domain. The dice can be distributed on the substrate such that an extra space is present on the substrate between at least some of the dice. For example, an extra space may be present between two dice, at a corner of the substrate, or other locations. The extra space can disrupt a coplanarity of the semiconductor package. The capacitance die can be located in the extra space so as to establish the coplanarity with the other dice. The capacitance die can include a capacitor array electrically coupled to multiple power domains of the plurality of dice.

Abstract: Systems, methods, and computer-readable media are disclosed for systems and methods for automated identification and mapping of objects in video content. Example methods may include determining a first set of frames in video content, determining, using one or more object recognition algorithms, a first object present in the first set of frames, determining that a first product corresponding to the first object is present in a product catalog comprising a set of product images, associating a first product identifier of the first product with a video identifier of the video content, and causing presentation of a set of product identifiers associated with the video identifier.

Abstract: Cameras having storage fixtures within their fields of view are programmed to capture images and process clips of the images to generate sets of features representing product spaces and actors depicted within such images, and to classify the clips as depicting or not depicting a shopping event. Where consecutive clips are determined to depict a shopping event, features of such clips are combined into a sequence and transferred, along with classifications of the clips and a start time and end time of the shopping event, to a multi-camera system. A shopping hypothesis is generated based on such sequences of features received from cameras, along with information regarding items detected within the hands of such actors, to determine a summary of shopping activity by an actor, and to update a record of items associated with the actor accordingly.

Abstract: To take advantage of the architecture of a systolic array tailored to perform sparse matrix multiplications, a weight matrix can be converted into a set of constrained fine-grained sparse weight matrices. The conversion process may include receiving a request to perform a matrix multiplication operation with a weight matrix, and determining that the weight matrix satisfies a sparsity condition to convert the weight matrix into a set of constrained fine-grained sparse weight matrices. The weight matrix can then be converted into a set of constrained fine-grained sparse weight matrices. Computer instructions can then be generated for an integrated circuit device to perform the requested matrix multiplication operation as a set of sparse matrix multiplication operations using the set of constrained fine-grained sparse weight matrices.

Abstract: Network traffic between a source node and a destination node in a network fabric can be routed by distributing the network traffic from the source node to a set of one-hop neighbors of the source node. Each one-hop neighbor of the source node can be set as a first waypoint. A one-hop neighbor of the destination node mapped to the corresponding one-hop neighbor of the source node is identified and set as a second waypoint. The distributed traffic is then routed from the first waypoint to the second waypoint via a network fabric having network nodes connected according to harmonics.

Abstract: Using a first set of machine learning models, a communication from a user of a restaurant is analyzed at an order coordinator linked via a network to resources of an order management service at a provider network. A response to the communication is prepared using another set of models at the provider network and presented to the user. An order of the user for one or more restaurant menu items is fulfilled, based at least partly on analysis of a second communication received from the user after the response is presented.

Abstract: A connection-based service impersonates request-based security for requests from clients that do not include credentials for the requests (e.g., data plane requests made via a connection-oriented security). A connection between a client and a connection-based service is established based on connection credentials that are based on security credentials from a request-based security service. The credentials are sent by a security component of the service to a local agent of the remote security service to be authenticated by the security service. An impersonation token is returned by the security service and cached by the local agent. Requests from the client to perform operations do not include credentials. For each request, the service passes an identifier for the client and the operation to a local authorization component that calls the agent for authorization of the requested operation. The agent uses the impersonation token to obtain authorization for the requested operation.

Abstract: A system for storing data includes a rack, one or more data storage modules coupled to the rack, and one or more data control modules coupled to the rack. The data storage modules may include a chassis, two or more backplanes coupled to the chassis, and one or more mass storage devices (for example, hard disk drives) coupled to the backplanes. The data control modules may access the mass storage devices in the data storage modules.

Abstract: A rack within a datacenter or other environment can include a plurality of appliances arranged in the rack such that ports of the appliances are aligned vertically or in another direction. A cartridge can include an elongate rigid body along which connectors are arranged. The connectors may be engageable with the aligned ports of the appliances in response to translation of the cartridge toward the rack. The cartridge can include an electronics board within the elongate rigid body, and the electronics board can provide paths among subsets of the connectors, for example, such that subsets of the appliances are accordingly connected for transmission of data or other signals.

Abstract: Requests to perform activity with respect to a customer account can be monitored to attempt to detect fraudulent activity due to compromised customer credentials or other unauthorized access. The unauthorized party can request actions such as to create a new account, mount a snapshot of customer data, and exfiltrate the customer data. Various embodiments monitor such requests and permissions granted to accounts not directly owned by a customer, and can apply automatic mitigations for suspicious activity in order to reduce the risk of exposing data to unauthorized accounts. Such an offering determines mitigations to perform, such as to block, alert, rate limit, or terminate the linked or non-linked account based on account reputation. The detection mechanism can use various heuristics to make mitigation decisions, as may consider factors such as account age, geolocation, access history, device fingerprint, network domain, payment type, prior suspicious activity, and the like.

Abstract: Described herein is a computer-implemented method for generating a task-specific simulated robotic manipulator. A computing device receives, via a robotic design user interface, at least one of task information or constraint information. The computing device selects a set of components for a simulated robotic manipulator from a plurality of components in accordance with at least one of the task information or the constraint information. The computing device generates geometric, kinematic, and/or dynamic information corresponding to the set of components. The geometric, kinematic, and/or dynamic information identifies, for individual components of the set of components, one or more properties. The computing device generates a simulated representation of the simulated robotic manipulator based at least in part on set of components and the geometric, kinematic, and/or dynamic information.

Abstract: An item delivery system can include a conveyor. The conveyor can be positioned in a delivery vehicle, for example. The conveyor can include a conveyance surface for receiving items and dividers. While remaining coupled with the conveyance surface, the dividers can move between a storage configuration and an operating configuration. In the operating configuration, the dividers can be positioned between the items. The conveyor can move the items to a position for removal. The removal position may correspond to an area accessible from an operator area of the delivery vehicle, for example.