Abstract: A stream of storage requests can be received for data objects stored by a storage service. A streaming algorithm can be utilized to identify the most frequently accessed objects stored by the storage service. A statistical distribution of the most frequently accessed objects can then be generated and utilized to estimate the number of infrequently accessed objects. Machine learning can also be utilized to identify correlations between attributes of objects stored by the storage service and their associated access rates. For instance, machine learning can be utilized to determine that objects stored in a certain location or having other characteristics typically have low access rates. Information regarding the number of infrequently accessed objects and their learned attributes can be utilized to take action with regard to the infrequently accessed objects, such as moving the infrequently accessed objects to long-term storage.

Abstract: A policy management system is described herein that allows an administrator to compose custom policies that can be applied to target devices and that achieve tasks specific to the administrator's organization and network. The composed policies can be standalone policies that are applied independently or sequenced policies that are applied in a specified order. A composed policy may be associated with one or more targets and stored in a policy database. A target device may periodically query the policy management system for any policies that pertain to the target device. If policies have been composed that pertain to the target device and such policies have been updated or have not been previously transmitted to the target device, the policy management system can retrieve the policies from the policy database, merge the policies, and transmit the merged policies to the target device. The target device can then apply the merged policies.

Abstract: Systems and methods are described for a storage processing service that processes multiple storage commands. The storage processing service uses tags from test storage commands to determine whether a test storage service is to be instantiated that reflects a corresponding production service. Test storage commands with the same tag are tested on that test service. Additionally, the storage processing service determines a strategy for testing processes on production services when the storage system is overloaded. In one embodiment, the test service manager can determine to stop testing processes for a period of time, and issue a shed command that queues or sheds test storage commands. Advantageously, a shed command, while active at a storage processing service, may alleviate the overload on production services. The test service manager can continue to monitor the storage system to determine whether the overload continues to exist.

Abstract: Multi-table partitions may be implemented for a key-value database. Items in tables of the database may be assigned storage locations in partitions of the key-value database according to a same partitioning scheme so that different items from different tables may be stored in the same partition. When requests to access a table are received, the partitioning scheme may be applied to identify which partition to access for the requests. A table index structure may be maintained to identify the items in a table.

Abstract: Transaction requests may be ordered in a distributed database according to an independently assigned sequence. Different distributed system nodes, such as a transaction coordinator and a storage node may independently assign sequence numbers to requests to access a distributed database. A storage node may receive the request from a transaction coordinator with an assigned sequence number and another request to which the storage node may assign a sequence number. The storage node can then order performance of the requests based on the sequence numbers.

Abstract: Methods, systems, and computer-readable media for automatic archiving of data store log data are disclosed. One or more operation records in a log are selected for archival. The one or more operation records comprise data indicative of operations performed on one or more data objects of a data store. The one or more operation records are selected for archival prior to deletion from the log. The one or more operation records are replicated from the log to an archive. Based at least in part on the replicating, the one or more operation records in the log are marked as archived. Based at least in part on the marking as archived, the deletion of the one or more operation records from the log is permitted.

Abstract: An administrative agent running at a virtualization host of a network-accessible virtualized computing service determines that a first virtual machine is to be instantiated. The agent initiates at least a first configuration operation to enable connectivity for at least a portion of network traffic associated with the first virtual machine. The first configuration operation is performed at least in part using a first virtualization offloading card of the virtualization host. The agent causes a virtualization intermediary process of the virtualization host to launch one or more execution threads of the virtualization intermediary process to implement the first virtual machine. The intermediary process may be swapped to persistent storage, e.g., based on an analysis of resources of the virtualization host.

Abstract: Systems and processes are described for establishing and using a secure channel. A shared secret may be used for authentication of session initiation messages as well as for generation of a private/public key pair for the session. A number of ways of agreeing on the shared secret are described and include pre-sharing the keys, reliance on a key management system, or via a token mechanism that uses a third entity to manage authentication, for example. In some instances, the third party may also perform endpoint selection by providing a particular endpoint along with the token. The particular cipher suite applied in a particular implementation may be configurable. The process is applicable to either implicit key confirmation (e.g., handshake negotiation) or explicit key confirmation (e.g., full negotiation).

Abstract: Systems, methods, and computer-readable media are disclosed for voice activated devices with integrated heatsinks and speakers. In one embodiment, an example device may include a light ring, a first light emitting diode, a heatsink having a first side and a second side, and a speaker assembly coupled to the first side of the heatsink assembly. The heatsink and the speaker assembly together may form a first sealed cavity. The device may include a reflector component coupled to the second side and configured to direct light towards the light ring. The reflector component may optionally include a substantially linear member and a bent member.

Abstract: Source code of a graph analysis program expressed in a platform-independent language which supports linear algebra primitives is obtained. An executable version of the program is generated, which includes an invocation of a function of a parallel programming library optimized for a particular hardware platform. A result of executing the program is stored.

Abstract: A first entity and a second entity establish a protected authenticated communication channel using an implicit certificate issued by a certificate authority. In some examples, the implicit certificate is generated based at least in part on the ring learning with errors (“RLWE”) problem. Using the implicit certificate, the first entity and the second entity exchange information that enables the entities to negotiate a shared secret. The shared secret may be used to establish a cryptographically protected communication channel. Successful use of the shared secret authenticates the identity of the first entity and the second entity.

Abstract: Techniques for detecting and mitigating distributed denial of service (DDoS) attacks sourced from within a service provider system are described. A service obtains traffic data comprising a plurality of entries that describe outbound network traffic originated by a plurality of compute instances within the service provider system that is destined to locations outside the service provider system. The service determines that one or more destination network addresses identified within the traffic data are likely targets of a DDoS attack, determines a responsive action from a plurality of candidate responsive actions to perform with regard to the one or more compute instances, and causes the responsive action to be performed in the service provider system.

Abstract: Disclosed are various embodiments for predictive caching of content to facilitate use of the content. If account is likely to commence use of a content item, the content item is cached before the use is commenced. The cache may be divided into multiple segments with different content selection criteria.

Abstract: Described are systems and methods for determining if assistance is to be provided to a user. In some instances, a total weight associated with a user pattern may be monitored by sensors of a base surface and a determination made if an abnormality related to the user pattern is present. If an abnormality exists, the appropriate assistance may be determined based on the abnormality and provided to the user.

Abstract: Virtual bookmarks can be set in digital content to enable a user to quickly locate a portion of interest. A user can provide an input to enter into an overview mode wherein multiple pages of content are displayed concurrently. The user can navigate through the pages, and when a bookmarked page is caused to no longer appear on the display an overlay element such as a thumbnail of the page can be positioned near the edge of the display, representing the current relative location of the page in the overview. A user can select one of the displayed pages to view, or can select the bookmark overlay element to return to the current page. A user can perform an action to cause the bookmarked page to be updated, or can perform various actions to cause multiple bookmarks to be created with respect to the content.

Abstract: A collection of key-value pairs may be maintained by a key-value database management system. Updates to the collection may be provided by a partially trusted entity. The updates to the collection may be stored in a series of transactions that are committed synchronously but associated with a second version of the collection of key-value pairs that is not immediately visible to a data consumer. The second version of the collection may initially be associated with an unaccepted state. The second version may be accepted and made available to the data consumer, or rejected and rolled back to the previous version.

Abstract: Methods, systems, and computer-readable media for resource configuration based on dynamic group membership are disclosed. An association between a group of computing resources and an intended state is stored. The intended state represents a computing resource configuration. During operation of a computing resource, whether the computing resource belongs to the group of computing resources is determined based at least in part on analysis of one or more attributes associated with the computing resource. Based at least in part on determining that the computing resource belongs to the group of computing resources, one or more actions are caused be performed to bring the computing resource into the intended state. The computing resource is executed while having the computing resource configuration represented by the intended state.

Abstract: Computing resource service providers may operate a plurality of computing resources in a distributed computing environment. In addition, the computing resource server providers may provide customers with access to applications and/or services. The applications and/or services may include sensitive data. Sensitive data in the distributed computing environment may be tracked by analyzing source code associated with the applications and/or services. Analysis of the source code may include detecting operations associated with databases and generating schemas associated with the databases based at least in part on attributes included in the source code. Sensitive data may be detected based at least in part on the schemas generated by analyzing the source code.

Abstract: A service of a service provider can cause a compartment to be created in an account of a customer of the service provider. Computing resources are provisioned in the compartment and the service has administrative authority over the computing resources. The customer may have administrative authority over the compartment, but may lack authority over the computing resources inside of the compartment.

Abstract: Methods and systems for selecting and displaying items includes causing the display of a large image of a selected item, a plurality of view icons indicative of different views of the selected item, and item details associated with a selected item. After the customer selects a view and/or color for the large image and mouses over the image, a zoom box appears and a corresponding magnified image window appears with a magnified image of the zoom box image for the selected view and color of the item.