Abstract: Techniques for connecting computer system entities to remotely extended local computer system resources are described herein. A computer system entity that requests access to a local computer system resource has that request fulfilled by a managed directory service which receives the request and connects the computer system entity to the local computer system resource. While connected, the managed directory service extends the local computer system resource to a corresponding extended remote computer system resource, receives commands to perform operations on the local or extended remote computer system resources and, if the computer system entity is authorized to perform the operations on the appropriate computer system resource, the managed directory service performs the operations on the appropriate computer system resource.

Abstract: Provided are systems and methods for hot-plugging emulated peripheral devices (e.g., endpoints) into host devices that either have a hypervisor that does not support virtualized peripheral device or that do not include a hypervisor. In various implementations, a configurable peripheral device can emulate a switch that includes upstream ports and downstream ports. When a new endpoint device is requested, the configurable peripheral device can, using an emulation configuration for the new endpoint device, generate an emulation for the new endpoint device. The configurable peripheral device can connect the endpoint device to a downstream port, and then trigger a hot-plug mechanism, through which the host device can add the new endpoint device to the known hardware of the host device.

Abstract: Custom policies are definable for use in a system that enforces policies. A user, for example, may author a policy using a policy language and transmit the system through an application programming interface call. The custom policies may specify conditions for computing environment attestations that are provided with requests to the system. When a custom policy applies to a request, the system may determine whether information in the attestation is sufficient for the request to be fulfilled.

Abstract: Techniques are disclosed for providing a software application executed on a mobile device to obtain a set of service endpoints for web services used by that application. As disclosed, an endpoint resolution service may select a service endpoint for a given web service based at least on a geographic proximity of the mobile device to a set of cloud computing regions or data center locations hosting an instance the given web service.

Abstract: A tape library rack includes partitions defining a slot for receiving a tape cartridge. A hook is coupled with the rack to engage a notch in the cartridge and retain the cartridge within the rack slot. A gripper for retrieving the cartridge includes a ramped surface to engage the hook and laterally displace the hook from the cartridge notch as the hook travels along the ramped surface. The gripper engages the notch from which the hook has been displaced and pulls the cartridge from the slot.

Abstract: A computing resource associated with a user is scheduled to undergo a transition. Prior to the scheduled transition, the computing resource is placed in a pending state. The user is notified that the computing resource is scheduled to undergo the transition. In response to an input received from the user, the computing resource is allowed to undergo the transition when the input indicates that the transition can proceed.

Abstract: First data representing geographic coordinates defining a proximity zone for access to an A/V recording and communication device may be received from a first client device associated with the A/V recording and communication device. Based at least in part on a graphical user interface being accessed within an application executing on the second client device, second data representing a location of the second client device may be received. A determination that the second client device is within the proximity zone may be made, and third data indicating that the A/V recording and communication device is accessible by the second client device may be transmitted to the second client device. A request for access to the A/V recording and communication device may be received from the second client device, and image data generated by the A/V recording and communication device may be obtained and transmitted to the second client device.

Abstract: Techniques described and suggested herein include various systems and methods for determining risk levels associated with transiting data, and routing portions of the data in accordance with the determined risk levels. For example, a risk analyzer may apply risk classifiers to transiting data to determine overall risk levels of some or all of the transiting data. A traffic router may route transiting data according to determined risk profiles for the data. A sandbox may be implemented to compare, for a given input, expected and observed outputs for a subset of transiting data, so as to determine risk profiles associated with at least the subset.

Abstract: Described are systems, methods, and apparatus for managing the movement of inventory items within a materials handling facility using rollable containers and a gravity feed conveyance system. Inventory items are placed in the rollable containers and are routed to different locations within the materials handling facility along the gravity feed conveyance system, through use of gravitational forces that cause the rollable containers to roll. By using gravity to route inventory items within the materials handling facility, the energy and power requirements for the materials handling facility are reduced, which reduces overhead costs and which is better for the environment.

Abstract: Execution of an executable portion of an application source executing in a first computer instance is monitored at least up to a point relative to a variation point. The execution is halted at the point. An application image of the first computer instance usable to instantiate a second computer instance is copied based at least in part on the variation point such that the second computer instance continues execution of the executable portion of the application source from the variation point, and the application image is caused to be stored.

Abstract: A package delivery apparatus uses an unmanned aerial vehicle (UAV) to deliver a package containing a product to a delivery destination area. The UAV uses GPS signals to guide it to the delivery destination area and an altimeter to determine its height above the delivery destination area. The UAV then adjusts its height to a preferred drop or release height for that package and product and releases the package. An optional camera allows a human operator to view the delivery destination area. An expandable foam package surrounds the product to protect the product from impact and moisture. The package may be streamlined to reduce air resistance and increase the range of the UAV. The package characteristics, such as its thickness, are determined based one or more of the weight and fragile nature of the product, and the drop height.

Abstract: Disclosed are various embodiments for detecting replay attacks in voice-based authentication systems. In one embodiment, audio is captured via an audio input device. It is then verified that the audio includes a voice authentication factor spoken by a user. The audio is then compared with stored audio spoken by the user. If it is determined that an exact copy of the voice authentication factor is in the stored audio, one or more actions may be performed.

Abstract: In large distributed computing environments, application execution may be distributed between a plurality of groups, the plurality of groups containing a set of host computer systems responsible for the execution of one or more operations of the application. Group membership may be determined by generating configuration information based at least in part on the plurality of groups. The configuration information may be provided to a plurality of host computer systems and each host computer system of the plurality of host computer systems may determine membership to a particular group of the plurality of groups based at least in part on the configuration information.

Abstract: Two parties to a communication establish public and private keys through the use of implicit certificates. Each party establishes a new static key pair, and determines a difference between the new static key pair and the previously established keys. The differences are exchanged and used to determine new public static keys. Each party generates an ephemeral key pair from the static key pair, and a shared secret is derived from a combination of the ephemeral keys and the new static keys.

Abstract: A digital signature over a message may be compressed by determining a plurality of values based at least in part on the message. A mapping of the plurality of values over a digital signature scheme may be used to determine a value from which a portion of the compressed digital signature is decompressible by cryptographically deriving one or more components of the uncompressed digital signature. A public key may be used to verify the authenticity of the compressed digital signature and message.

Abstract: In one embodiment, an inventory storage module has a plurality of conveyor segments that define a movement path that is elongate along a longitudinal direction from a first end of the storage to a second end of the module. The module has a plurality of container carriers that are supported by the conveyor segments. Each container carrier supports at least one inventory storage container that supports at least one inventory item therein. The storage module can transfer the container carriers around the movement path until a desired one of the container carriers is presented at one of the first and second module ends. In another embodiment, a plurality of instances of the storage module are arranged in a vertical stack of independently controllable storage modules.

Abstract: A service implemented at a first isolated virtual network of a provider network is added to a database of privately-accessible services. Configuration changes that enable network packets to flow between the first isolated virtual network and a second isolated virtual network without utilizing a network address accessible from the public Internet are implemented. Service requests originating at the second isolated virtual network are transmitted to the first isolated virtual network via private pathways of the provider network. Metrics corresponding to service requests directed from the second isolated network to the service are collected and provided to the respective owners of one or both isolated virtual networks.

Abstract: A system for storing data includes a discrete cooling module that can enable discrete cooling of mass storage devices installed in the chassis interior of a data storage module coupled to a rack. The discrete cooling module includes an air moving device and an air cover. The air moving device can induce and airflow through the chassis interior of the data storage module to remove heat from heat producing components of mass storage devices installed in the chassis interior. The air cover directs the airflow through the chassis interior. The discrete cooling module can isolate rotational vibrations generated by the air moving device from the mass storage devices installed in the chassis. Partial isolation can include indirectly coupling the discrete cooling module to the chassis via directly coupling with the rack.

Abstract: Methods and apparatus for flexible batch job scheduling in virtualization environments are disclosed. A descriptor for a batch job requested by a client is received at a job scheduling service. The descriptor comprises an indication of a time range during which a job iteration may be performed. A target time for executing the iteration is determined based on an analysis of a plurality of received descriptors. An indication of the target time at which the iteration is to be scheduled is provided to a selected execution platform.

Abstract: A multi-column index is generated based on an interleaving of data bits for selectivity for efficient processing of data in a relational database system. Two or more columns may be identified for inclusion in the multi-column index for a relational database table. Based, at least in part, on the interleaving of data bits for selectivity from the identified columns, a multi-column index is generated for the relational database table that provides a respective index value for each entry in the relational database table. The entries of the relational database table may then be stored according to the index values of the multi-column index.