Abstract: A database system may include a database service and a separate distributed storage service. The database service (or a database engine head node thereof) may be responsible for query parsing, optimization, and execution, transactionality, and consistency, while the storage service may be responsible for generating data pages from redo log records and for durability of those data pages. For example, in response to a write request directed to a particular data page, the database engine head node may generate a redo log record and send it, but not the data page, to a storage service node. The storage service node may store the redo log record and return a write acknowledgement to the database service prior to applying the redo log record. The server node may apply the redo log record and other redo log records to a previously stored version of the data page to create a current version.

Abstract: A method and system for dynamic pricing of web services utilization. According to one embodiment, a method may include dynamically predicting utilization of a web services computing resource that is expected to occur during a given interval of time, and dependent upon the dynamically predicted utilization, setting a price associated with utilization of the web services computing resource occurring during the given interval of time. The method may further include providing the price to a customer.

Abstract: Implementations for providing event processing services for a plurality of services are described. An example method may comprise receiving, by a payment processing service, data indicative of a payment event associated with an ordering service. The method may comprise causing, based on an accounting rule specific to a payment option associated with the payment event, a first entry associated with a handover account and the payment event to be added to a data store. The method may comprise sending, to the ordering service, handover information indicating the handover account and the payment event. The ordering service may cause, based on the handover information, a second entry associated with the handover account and the payment event to be added to the data store. The handover account may facilitate satisfying accounting rules for payment events without the ordering service having to manage satisfaction of the accounting rules.

Abstract: A processing service of a provider network may protect media content from being tampered with when it is transmitted from the provider network/transcoder to untrusted networks (e.g., third-party networks/CDNs) and to a media player. The processing service (e.g., the transcoder) generates a public and a private key. The service uses the private key to digitally sign content portions (e.g., video frames) before distribution to untrusted CDNs. The provider network creates a manifest that includes the public key. To play the media content, the media player obtains a manifest that includes the public key (via a secure/trusted connection with the provider network). The media player may then obtain the media content from an untrusted edge server/CDN and validate it using the public key that was separately obtained from the manifest (to verify the content was not tampered with).

Abstract: This disclosure describes, in part, methods and techniques for providing network applications. For instance, remote system(s) may generate a link that provides access to a network application. After generating the link, the remote system(s) may provide the link to a device of a source, such as a user, a developer, or a third-party service. The source may then use the device to share the link with a user. For example, the source may use the device to send a message that includes the link, post the link on a website, or share the link using a social media platform. The user may then use a device to view and select the link. Based on selecting the link, the remote system(s) may perform one or more actions. For example, the remote system(s) may create a session for the network application and provide the device with data to connect to the session.

Abstract: A convertible tote bag includes a bag body including an upper portion and a lower portion. A handle strap is fixedly anchored at a first anchor point to the lower portion of the bag body, and slidably anchored at a second anchor point to the upper portion of the bag body. The handle strap is slidable between a first position in which a first segment of the handle strap, between the first anchor point and the second anchor point, is cinched against a side of the bag body, and in which a second segment of the handle strap extends above the second anchor point away from the bag body, and a second position in which the first segment of the handle strap and the second segment of the handle strap are pulled below the second anchor point to form a loop off the side of the bag body.

Abstract: Methods and systems for training a neural network are provided. In one example, an apparatus comprises a memory that stores instructions; and a hardware processor configured to execute the instructions to: control a neural network processor to perform a loss gradient operation to generate data gradients; after the loss gradient operation completes, control the neural network processor to perform a forward propagation operation to generate intermediate outputs; control the neural network processor to perform a backward propagation operation based on the data gradients and the intermediate outputs to generate weight gradients; receive the weight gradients from the neural network processor; and update weights of a neural network based on the weight gradients.

Abstract: Systems and techniques for retrieving video data associated with a selected attribute are described. The systems and techniques include receiving a multimodal input associated with the attribute for querying a catalog of video data to identify video data including the attribute. A first embedding is determined for the input using a first encoder to map the input to a representation space. A second embedding is determined for the video data to map the video data to the representation space. A similarity score is determined between the video data and the input based on a distance between the embeddings. The video data associated with the attribute may be selected based on the similarity score.

Abstract: A certificate revocation manager performs scheduled synchronization of a certificate revocation table with certificate revocation lists (CRLs) independent of connection requests from clients. The certificate revocation table includes entries that each indicate a client certificate that has been revoked by a certificate authority (CA). On a scheduled basis, the certificate revocation manager synchronizes the entries of the certificate revocation table with current CRLs obtained from different CAs. When a service at receives a request from a client to establish a connection, the service generates a composite key based on a CA identifier and a certificate identifier of a client certificate provided by the client. The service performs a lookup on the certificate revocation table based on the composite key. Based on a result of the lookup, the certificate revocation manager determines whether the client certificate is revoked.

Abstract: A networking manager of an extension server of a virtualized computing service detects that a data link layer frame has been obtained at the extension server. The networking manager delivers at least a portion of contents of the frame to a compute instance running at the extension server in response to determining that a destination media access control (MAC) address of the frame matches a MAC address of a local-premise-access virtual network interface attached to the compute instance. The local-premise-access virtual network interface is not assigned an Internet Protocol (IP) address from a range of IP addresses managed by the virtualized computing service.

Abstract: A cable-jetting installation sleeve can be used to advance a fiber-optic cable through a conduit. The cable-jetting installation sleeve can include a housing and an expandable section. The expandable section can include an opening which can be expanded to receive or remove an end of the cable and contracted to engage the cable with the expandable section. A parachute can be positioned on one end of the cable-jetting installation sleeve. The parachute can be pushed by compressed air in the conduit to advance the cable-jetting installation sleeve through the conduit.

Abstract: An identity set may be selected from an identity pool of an identity management service. The identity set may be selected based on a threshold quantity of unnecessary permissions relative to one or more existing managed policies provided by the identity management service. The identity set may be grouped into a plurality of identity subsets. The grouping may be performed based at least in part on services accessed by the identity set. A plurality of candidate policies may be generated, such as by generating, for each identity subset of the plurality of identity subsets, based at least in part on a plurality of policy generation rules, a respective candidate policy. At least one candidate policy of the plurality of candidate policies may be selected as a new managed policy that is provided by the identity management service to users.

Abstract: Techniques for delivery guarantee compliance for an application synchronization service are described. In certain embodiments, a publishing service utilizes its memory queue to receive a request to publish a notification of a modification of a monitored data source from an application synchronization service, and then sends a success code to the application synchronization service based at least in part on the storing of the request to publish the notification in the memory queue. Embodiments herein are directed to a publishing service that delivers messages with a level one Quality of Service (QOS) that indicates that a message will be delivered one time at least.

Abstract: Shard management may be implemented for scalable database tables. A table may be identified as aligned with another table of the database according to a common shard key across multiple shards that are mapped to respective storage volumes of a data store of the database according to a placement hierarchy. Different portions of the table may be stored across the shards as respective table slices with corresponding portions of the other table as respective other table slices with same values of the shard key. Metadata for performing access requests to the database may be updated to identify individual ones of the table slices stored with individual ones of the other table slices as respective table slice groups that are mapped to respective ones of the shards in the placement hierarchy.

Abstract: A system comprises a data storage service includes a web service interface operating as a proxy to the data storage service. Data obtained at the data storage service is analyzed by one or more criteria of a data loss prevention policy, the data is encrypted by a key that is inaccessible to a remote service, and then the encrypted data is transmitted to the remote service.

Abstract: Disclosed are methods, systems, and other techniques for modeling concurrency between a set of nodes to be executed on a set of execution engines of an integrated circuit device. A computation graph that includes the set of nodes is received. A set of edges connecting the set of nodes are determined based on the computation graph. An edge type for each of the set of edges is determined based on the computation graph, the edge type indicating a type of synchronization between connected nodes. A vector clock is generated for each of the set of nodes, the vector clock for a particular node being calculated based on the vector clock for each connected preceding node and the edge type for the one of the set of edges that connects each connected preceding node and the particular node.

Abstract: A request to launch a compute instance is received at a control plane of a provider network. At an outbound command communicator, an indication that a compute instance is to be established at a target host at a client premise is obtained. A first address is associated with the target host at the control plane and also assigned to the communicator. A message with a second address within a first network of the client premise as a destination is transmitted. The message comprises a command to establish the compute instance at the target host. The first address is assigned to the target host within a second network of the client premise. Processing of the command at the target host results in establishment of a compute instance.

Abstract: A namespace monitoring service may track released namespaces such as internet protocol (IP) addresses and manage namespace cooldown pools, available namespace pools, and a registry of released namespaces to detect and mitigate security vulnerabilities that arise from reassignment of namespaces. The namespace monitoring service provides access to the released namespace registry and/or sends a data stream of namespace registry updates. The namespace monitoring service may manage namespace reassignment process and extend the cooldown period of released namespaces or place a hold on available namespaces.

Abstract: A first encoding representing a set of detected signals is obtained at a sensor-proximity resource of an object recognition application which also includes resources of an analytics service of a provider network. In response to a determination that a cache at the sensor-proximity resource does not include a second encoding which satisfies a similarity criterion with respect to the first encoding, at least a portion of a partition of a spatial index is obtained from another resource selected using an index partition map. A recognition-based action is initiated based on determining that the partition includes an encoding which satisfies the similarity criterion.