Abstract: An opportunistic storage service, or system, identifies currently unused storage capacity on a plurality of physical storage components of computing devices dispersed throughout a provider network. In some embodiments, the currently unused storage capacity is provisioned as primary storage, but is not currently being used to store primary storage data. The opportunistic storage service advertises at least a portion of the currently unused storage capacity as opportunistic storage capacity and provisions the opportunistic storage capacity subject to revocation if additional storage capacity of the physical storage components is needed to store primary storage data to fulfill a primary storage commitment.

Abstract: A technology is described for generating and modifying tunable parameter settings for use with a distributed application. An example method may include providing a first set of tunable parameter settings for a distributed application, where the first set of tunable parameter settings may be selected based at least in part on historical data associated with similar distributed applications. Performance metrics and implementation attributes associated with the distributed application may then be collected during a time period. The performance metrics and the implementation attributes collected may be input to a machine learning model configured to output a second set of tunable parameter settings for the distributed application, and the second set of tunable parameter settings may be provided for use with the distributed application, where performance of the distributed application may be better as compared to a performance using the first set of tunable parameter settings.

Abstract: Methods and apparatus for post data synchronization in live migration of domains. Host devices on a network may implement virtual machines (VMs) as domains in an execution environment, and may provide local persistent storage for data of the VMs. A migration technique for moving a domain including the persistent data from one host device to another host device is described in which the VM is instantiated on the target device, and the domain is switched to the target device. Synchronization of the VM's data from the persistent storage on the source device to the target device is then initiated, for example according to a distributed replicated storage technique that makes the target device's persistent storage the primary storage and the source device's persistent storage the secondary storage for the VM. Once the data is synchronized, the VM and its respective storage on the source device are released.

Abstract: Methods and systems for automated service tuning are disclosed. A plurality of tests are performed using a plurality of servers. Individual ones of the plurality of tests vary candidate values for one or more configuration parameters for the servers. A respective fitness value is determined for individual ones of the plurality of tests. The fitness values are determined based on the performance of the servers during the tests. One or more optimized values are selected for the one or more configuration parameters based on the fitness values. The one or more selected values collectively optimize the servers.

Abstract: A machine learning system builds and uses computer models for identifying how to evaluate the level of success reflected in a recorded observation of a task. Such computer models may be used to generate a policy for controlling a robotic system performing the task. The computer models can also be used to evaluate robotic task performance and provide feedback for recalibrating the robotic control policy.

Abstract: A structured query language server may receive a command from a backup control server to provision a virtual device and perform a backup operation on the structured query language server. The structured query language server may be configured to write data to the virtual device in order to be transmitted to a data storage service. The backup and restore operations directed to the structured query language server may include a web service application programming interface request to the data storage service to cause the data written to the virtual device to be stored as a data object in the data storage service.

Abstract: Systems and methods for viseme data generation are disclosed. Uncompressed audio data is generated and/or utilized to determine the beats per minute of the audio data. Visemes are associated with the audio data utilizing a Viterbi algorithm and the beats per minute. A time-stamped list of viseme data is generated that associates the visemes with the portions of the audio data that they correspond to. An animatronic toy and/or an animation is caused to lip sync using the viseme data while audio corresponding to the audio data is output.

Abstract: A customer may place an order for items to be picked up at a merchant location. Upon receiving an indication that the customer is initiating travel to the merchant location to pick up the items, multiple ETA data points for the customer may be determined while the customer is in transit to the merchant location. Based on the ETA data, it may be determined that the customer is likely to arrive after the merchant location closes, which may prevent the customer from being able to pick up the items from the merchant location. Alternative fulfillment options may be presented to the customer to enable the customer to obtain the items. The alternative fulfillment options may include picking up the items at an alternative merchant location, scheduling a delivery of the items, picking up the items from the merchant location at a subsequent time, or facilitating a cancelation of the order.

Abstract: Techniques for controlling a robotic picking arm using estimated seal quality metrics. A plurality of candidate contact points for holding an item using a suction device of the robotic picking arm, based on captured images of the item and an n-dimensional surface model of the item. An expected seal quality metric for a first one of the candidate contact points, by processing the n-dimensional surface model of the item and physical properties of the suction device of the robotic picking arm. Based on the expected seal quality metric, embodiments can determine whether to retrieve the item from the storage container by holding the item at the first candidate contact point using the suction device of the robotic picking arm.

Abstract: This disclosure describes techniques for defining a set of permissions, or privileges, for users who manage resources of a network-based service provisioned in a network-based service platform managed by a service provider. The techniques may include mapping cloud identities of the users to operating system (OS) user groups defined local to the resources that specify the set of permissions for user group members. Systems-manager agents that execute locally on the resources may determine to which OS user group the user belongs based on their cloud identity, and launch shells that are restricted by the set of permissions. Using these shells, a network-based service platform may allow users to remotely manage resources of the network-based service in various ways, such as through batch run commands and/or remote user sessions, while ensuring that the users are unable to execute commands on the resources that are outside the set of permissions.

Abstract: Described herein are approaches for presented interactive user experience cards within an application menu of an application. Dynamic content of the cards can be downloaded from an external server and presented in response to user inputs. The dynamic content can be updated dynamically and served when appropriate.

Abstract: A data storage system includes a rack, multiple head nodes, multiple data storage sleds, and at least two networking devices. The at least two network devices are configured to implement at least two redundant networks within the data storage system. Also, each of the head nodes is assigned at least two network addresses for communication with the data storage sleds of the data storage system via the at least two networking devices. The data storage sleds each include multiple mass storage devices and a sled controller that is configured to couple with the at least two network switches. In some embodiments, the data storage system further includes redundant power systems within a rack in which the head nodes, the data storage sleds, and the at least two networking devices are mounted.

Abstract: A simulated attack service of a computing resource service provider generates a cloned computing resource environment on which a simulated attack is executed. The cloned computing resource environment may be based at least in part on a computing resource environment including a set of computing resources. The simulated attack service may execute the simulated attack by at least directing a simulated attack payload to the cloned computing resource environment based at least in part on a signature included in the simulated attack payload. A measure of the effectiveness of an intrusion detection system may then be generated based at least in part on threat analysis information generated by the intrusion detection system and the simulated attack payloads of the simulated attack.

Abstract: Methods and systems for implementing custom access controls are disclosed. A first task is added to a first workflow. A first role is generated for the first workflow. The first role comprises a first set of one or more permissions for using one or more computing resources. The one or more permissions in the first role are selected based on the first task. The first task is performed using the one or more computing resources in accordance with the first role.

Abstract: A device such as a network-attachable data transfer device may be configured to operate in a cluster to coordinate the storage of data. A first manifest may be generated inventorying a first set of data successfully transferred to the data transfer device from a data source. A second manifest may be generated inventorying a second set of data successfully transferred from the data transfer device to a data destination. The first manifest may be compared with the second manifest to determine a transfer status of one or more data objects. The transfer status may indicate one or more data objects successfully transferred to the data destination from the data source. The one or more objects may be processed according to the transfer status.

Abstract: Network devices, such as load balancers may be configured to forward client metadata to back-end nodes using defined fields of a security protocol. For example, client metadata may be inserted into an extension field or certificate defined by a security protocol that is used for a secure connection between the load balancer and the back-end node. In some instances, a source IP address based on a received request may be inserted into the extension field or certificate defined by the security protocol before the request is forwarded to the back-end node. The back-end node may extract the client metadata and use the client metadata for any of a number of processes (e.g., billing, tracking, security, logging, etc.).

Abstract: A service request and a credential are sent from a customer environment to a service provider. The service provider maintains information, such as a credential whitelist, that identifies which credentials may be used with each customer environment. The service provider identifies the particular customer environment from which the service request was submitted using the IP address of the requester (or other environment-identifying information), and retrieves information that restricts the use of the credentials. A request may be approved or rejected based on the presence of the associated credential in a whitelist notwithstanding whether the credential otherwise authorizes the service request. In some examples, the system is used to limit data exfiltration from a customer environment.

Abstract: Technologies are provided for identifying a source of errors within a computer network that uses cut-through forwarding of network packets. For example, inbound network packets can be received by network devices configured to perform cut-through forwarding. Once the network packets are received, they are processed using cut-through forwarding. If any packet errors are detected, error data associated with the detected errors are stored by the network devices. The error data is transmitted to a monitoring service that uses the error data to create a model of a flow of the errors through the network and to identify a source of the errors. In at least some embodiments, a topology of the network is used by the monitoring service to create the model of the packet error flow.

Abstract: Systems and methods for validation of log formats are described herein. Log data is stored via a logging service in a data store or other storage system. An example log or proposed log format is received by the logging service. The proposed log format is validated against validation rules provided by log consumers.

Abstract: An HSM cluster includes a set of hardware security modules that maintain a set of cryptographic keys that are synchronized across the HSM cluster. Individual applications running on client computer systems access the HSM cluster using HSM duster clients running on the client computer systems. The HSMs are accessed via a set of HSM cluster servers that monitor the synchronization of the cryptographic keys. Synchronization of the HSMs is maintained by the HSM cluster clients. If the HSM cluster loses synchronization, an HSM cluster client resynchronizes the HSM cluster by acquiring a list of keys and key versions stored on each HSM, and generating an update map. Using the update map, the HSM client obtains, form various HSM in the HSM cluster, the latest versions of the out-of-date keys in an encrypted form. The HSM cluster client assembles and distributes updates to each HSM in the HSM cluster.