Abstract: Techniques for a dynamic encoder-time scaling service for live and on-demand adaptive streaming are described. As one example, a computer-implemented method includes determining a first resolution for a first fragment of a video file based on a first encoding complexity of the first fragment at a bitrate, encoding the first fragment at the first resolution for the bitrate to generate an encoded first fragment, determining a second different resolution for a second fragment of the video file based on a second different encoding complexity of the second fragment at the bitrate, encoding the second fragment at the second different resolution for the bitrate to generate an encoded second fragment, receiving a request for a manifest for the video file from a client device, generating the manifest for the client device that identifies a single video representation for the bitrate that comprises the encoded first fragment and the encoded second fragment, and sending the manifest to the client device.

Abstract: Vulnerabilities to physical memory, such as server dynamic random access memory (DRAM) with error correction code (ECC) capability, can be mitigated though the use of guard pages allocated in that physical memory. Physical memory pages can be mapped to virtual memory pages of a contiguous virtual address space. When an error such as a bit flip is detected in a physical memory page, the data from that physical memory page can be copied to a protected page, such as a guard page or page isolated from other sensitive data. Information such as an error correction code (ECC) can be used to determine and correct the erroneous bit. The mappings in a related page table can be updated such that the same virtual pages or addresses are then mapped to the guard page that now includes the relevant data.

Abstract: Systems and methods are described for providing a risk assessment for a software application based on evidence obtained from one or more sources. In some aspects, security and compliance evidence may be obtained from one or more evidence sources, for an application offered through a service provider, where the evidence sources include operational data from the application executing within a runtime environment provided by the service provider. The obtained evidence may be mapped to risk assessment criteria to generate a risk assessment. In some cases, the risk assessment criteria includes a plurality of attributes of the application, with the attributes indicating potential vulnerabilities of the application. A representation of the risk assessment may be generated across at least some of the attributes based on the risk assessment comparison. The risk assessment representation may then be updated based on monitoring of the security and compliance evidence for the application.

Abstract: Techniques for sharing content using a voice user interface are described. A user may speak an input to share content presently being output by a device as audio and or displayed content. A backend system may determine the presently being output content, and generate message payload data representing the content. The backend system may also perform processing to determine an intended recipient of the content. The backend system may send the message payload data to the recipient using various modalities.

Abstract: Techniques for generating and utilizing investigative playbooks for cloud security events are described. Activity is detected indicative of a potential compromise in association with a resource of a multi-tenant cloud provider network. API calls originated by a client are determined to utilize API methods that exist within a set of known API methods included in a formal model of attack tactics. Responsive to both the detection and the determination, an investigative playbook is executed, based on the activity, that includes multiple logical tests to generate an attack report that can be presented to a user such as a security analyst for use in investigating cloud security events.

Abstract: Aspects related to a resource-constrained system are described herein that can provide object storage services after a service interruption is resolved, even if all of the transactions that were pending and incomplete prior to the service interruption have not yet been recovered and/or executed. For example, file systems implemented by computing systems of the resource-constrained system may treat each file or directory as a separate object. Thus, a transaction directed to one file may not affect the file's directory or other files in the directory. As a result, the resource-constrained system can achieve read-after-write consistency without first recovering and executing the pending, incomplete transactions. Instead, read-after-write consistency for an object can be achieved simply by completing any pending, incomplete transaction directed to that object.

Abstract: A content distribution environment enables acquisition of a video feed in a first format, conversion into a second format, and transmission to a cloud service using on-premises equipment managed and operated by the content provider. A gateway or bridge may facilitate operation with one or more managed services, such as a content distribution service, that provides a reliable way to ingest a video stream from a source, replicate the video stream to one or more destinations, and permit sharing of video streams to affiliates and partners. The on-premises equipment may execute a software package to provide end-to-end operations that leverage operations of a cloud service while executing on content provider owned or managed hardware.

Abstract: A system may be configured to detect custom acoustic events, where the system generates an acoustic event profile for the custom acoustic event based on a natural language description provided by a user and using an audio sample of the described acoustic event. For example, the user may describe the custom acoustic event as “dog bark.” The system may ask the user questions to refine the description (e.g., dog breed, dog gender, age, etc.). Using an audio sample of the refined description, the system may then determine that audio captured in the user's environment is a potential sample of the custom acoustic event. Such captured audio may be presented to the user for confirmation, and then may be used to detect future occurrences of the custom acoustic event in the user's environment.

Abstract: A data storage system stores a plurality of partitions for a volume and at least one parity partition for the volume. The parity partition includes erasure encoded data that enables any one of the partitions to be reconstructed using the erasure encoded data of the parity partition. Additionally, the data storage system is configured to generate parity data updates in response to modifications to the volume and store updated parity data in the parity partition, such that a current state of any of the partitions of the volume can be re-created in response to a loss of one of the partitions.

Abstract: Techniques for providing friction-free transactions using geolocation and user identifiers are described herein. These techniques may ascertain a user's location based on a location of a mobile device. A transaction between the user and a merchant may be completed with zero or minimal input from the user based on the geolocation of the mobile device and the user identifiers. In some implementations, a transaction initiated earlier is completed when the mobile device arrives at the merchant. Additionally, a parent-child or similar relationship may be established between multiple devices. Security on the mobile device based may be provided by biometric identification and calculation of variance from regular movement patterns. Advertisements may be sent to the mobile device based on bids from merchants near to the mobile device. Promotions may be sent to the mobile device when more than a threshold number of mobile devices are located at the same merchant.

Abstract: Methods, systems, and computer-readable media for similarity detection based on token distinctiveness are disclosed. A similarity detection system determines candidate items for a seed item based on a comparison of tokens in textual descriptions of the candidate items to tokens in a textual description of the seed item. The system uses machine learning to determine importance scores for the tokens of the seed item. An importance score is determined based on the frequency of the individual token and the frequency of the most commonly occurring token in the candidate items. Importance scores for the same token differ from the seed item to another seed item. Based on the importance scores, the system determines similarity scores for the candidate items to the seed item. The system selects, from the candidate items, a set of similar items to the seed item based (at least in part) on the similarity scores.

Abstract: A distributed voice controlled system has a primary assistant and at least one secondary assistant. The primary assistant has a housing to hold one or more microphones, one or more speakers, and various computing components. The secondary assistant is similar in structure, but is void of speakers. The voice controlled assistants perform transactions and other functions primarily based on verbal interactions with a user. The assistants within the system are coordinated and synchronized to perform acoustic echo cancellation, selection of a best audio input from among the assistants, and distributed processing.

Abstract: Techniques are described for monitoring and analyzing input/output (I/O) messages for patterns indicative of ransomware attacks affecting computer systems of a cloud provider, and for performing various remediation actions to mitigate data loss once a potential ransomware attack is detected. The monitoring of I/O activity for such patterns is performed at least in part by I/O proxy devices coupled to computer systems of a cloud provider network, where an I/O proxy device is interposed in the I/O path between guest operating systems running on a computer system and storage devices to which I/O messages are destined. An I/O proxy device can analyze I/O messages for patterns indicative of potential ransomware attacks by monitoring for anomalous I/O patterns which may, e.g., be indicative of a malicious process attempting to encrypt or otherwise render in accessible a significant portion of one or more storage volumes as part of a ransomware attack.

Abstract: Systems and methods are described for service coordination using a PartiQL query. For instance, a method may include selecting a recipe from a plurality of recipes in response to a request from a user device, wherein the recipe includes a plurality of operations to provide a complex function, each of the plurality of operations corresponding to a service of a plurality of services; determining a PartiQL query for an operation of the plurality of operations; executing the PartiQL query to obtain a result; transmitting a call to a service of the plurality of services that corresponds to the operation based on the result; receiving a response from the service; and after all operations of the plurality of operations are called, transmitting a response to the request to the user device.

Abstract: Techniques are described for enabling users of a certificate management service to create certificate issuance policies that can be applied to certificate issuance requests across both public and private certificate authorities (CAs) and other certificate-related services. According to embodiments described herein, a certificate issuance policy includes one or more certificate issuance rules to be applied to requests associated with one or more specified user accounts or roles for certificate-related resources (e.g., public certificates, private certificates, etc.). The application of a certificate issuance rule can be conditioned on a particular request context (e.g., based on a user account or role associated with a request, a type of certificate requested, a subject name identified in the request, etc.) and can specify a wide range of actions to be performed on requests matching a rule (e.g., allowing or denying a request, modifying one or more parameters of the request, etc.).

Abstract: Techniques for performing spoken language understanding (SLU) processing are described. An SLU component may include an audio encoder configured to perform an audio-to-text processing task and an audio-to-NLU processing task. The SLU component may also include a joint decoder configured to perform the audio-to-text processing task, the audio-to-NLU processing task and a text-to-NLU processing task. Input audio data, representing a spoken input, is processed by the audio encoder and the joint decoder to determine NLU data corresponding to the spoken input.

Abstract: This disclosure describes a data dependency and monitoring service that includes a database module (data dictionary) that contains information about database entities, for example, reports, tables, views, dashboards, etc. The information may include, for example, description, ownership, location, refresh cadence, etc. The data dependency and monitoring system provides a data dependency module that lists upstream data sources behind the data entities and also illustrates other entities and table dashboards that use the data entities downstream. The data dependency monitoring system provides a data monitoring and alert module that triggers alerts when data within a data entity is not refreshed by a predefined refresh cadence, e.g., a predetermined amount of time, thereby causing the corresponding data to be stale or out of date.

Abstract: A system receives a request to retrieve a data object from a data storage device associated with an asynchronous-access data storage service. For data object retrieval, the system identifies the data storage device and creates a job corresponding to the data object retrieval. Once the job is executed, the data object is retrieved to satisfy the request without having to restore the data object and further provided to a data storage device associated with a synchronous-access data storage service to satisfy subsequent requests synchronously.

Abstract: A speech-processing system may provide access to multiple virtual assistants via one or more voice-controlled devices. Each assistant may leverage language processing and language generation features of the speech-processing system, while handling different commands and/or providing access to different back applications. Different assistants may be available for use with a particular voice-controlled device based on time, location, the particular user, etc. The voice-controlled device may include components for facilitating user interaction with multiple assistants. For example, a multi-assistant component may facilitate enabling/disabling assistants, assigning gestures and/or wakewords, etc. The multi-assistant component may handle routing commands to a command processing subsystem corresponding to an assistant invoked by the command. The voice controlled device may further include observer components, each configured to monitor the voice-controlled device for invocations of a particular assistant.

Abstract: A timecoding technique for determining and assigning timecodes for variable frame rate video. Content identified for timecode assignment is decoded, and for sequential frames of the content, portions of timestamps are compared to determine if the frames are from a same time period (e.g., from the same second in time). For a subsequent frame from the same time period, an index is atomically incremented, a timecode generated from a combination of the time period and the index, and the timecode assigned to the frame. For a subsequent frame from a different time period, the index is initialized, a timecode generated from a combination of the different time period and the initialized index, and the timecode assigned to the frame. Accumulated durations of frames may be used in place of timestamps, in some instances.