Abstract: Managed lifecycle roles are disclosed. Managed lifecycle roles may be used for secure credential vending or otherwise. For instance, an entity (e.g., administrator or other entity) requests, via an interface of a role manager, creation of a role associated with a lifecycle definition (e.g., an expression of an enforceable expiration of the role or similar characteristic). The role manager stores the role and role lifecycle definition to a data store. Another entity requests to use the role to perform some operation with respect to a resource. A credential service validates the request against a lifecycle definition for the role (and against an access control list, in some examples) and responds to valid requests with credentials useable to perform the operation with respect to the resource. The other entity uses the credentials to perform the operation with respect to the resource. A sweep process manages attributes of the roles.

Abstract: Systems, methods, and computer-readable media are disclosed for language-agnostic subtitle drift detection and correction. A method may include determining subtitles and/or captions from media content (e.g., videos), the subtitles and/or captions corresponding to dialog in the media content. The subtitles may be broken up into segments which may be analyzed to determine a likelihood of drift (e.g., a likelihood that the subtitles are out of synchronization with the dialog in the media content) for each segment. For segments with a high likelihood of drift, the subtitles may be incrementally adjusted to determine an adjustment that eliminates and/or reduces the amount of drift, and the drift in the segment may be corrected based on the drift amount detected. A linear regression model and/or human blocks determined by human operators may be used to otherwise optimize drift correction.

Abstract: A distributed storage system may store data object instances in persistent storage and may store keymap information for those data object instances in a distributed hash table on multiple computing nodes. Each data object instance may include a composite key containing a user key. The keymap information for each data object instance may map the user key to a locator and the locator to the data object instance. A request to store or retrieve keymap information for a data object instance may be routed to a particular computing node based on a consistent hashing scheme in which a hash function is applied to a portion of the composite key of the data object instance. Thus, related entries may be clustered on the same computing nodes. The portion of the key to which the hash function is applied may include a pre-determined number of bits or be identified using a delimiter.

Abstract: Artifacts, including parameters are data sets, associated with experiment tasks are stored at an experiment management service. A query specifying a particular value of a parameter and a particular data set is received, and an indication of an experiment result associated with the particular data set and the particular parameter value is provided.

Abstract: A network address assigned to a virtual network interface of a packet transformation node of a flow management service is identified. A packet of a particular network flow associated with an application implemented at an isolated virtual network is sent to the network address. Using a rewrite directive generated at a rewriting decisions node of the service and cached at the packet transformation node, a transformed packet corresponding to a packet received at the packet transformation node is generated and transmitted to a destination.

Abstract: A customer of a computing resource provider configures a virtual computer system in a virtual private network with a web service application. The web service application comprises a web service interface that executes instructions provided by the customer to cause one or more hardware security modules (HSMs) to perform cryptographic operations on data on behalf of the customer without the need to generate programmatic code.

Abstract: A computing equipment box assembly can include a chassis base and a tray. The chassis base can include a bottom panel, an opening through the bottom panel, and a rim defined around the opening. The tray can include a body configured for supporting computing components, a frame section of the body sized to be supported atop the rim of the chassis base; and a downwardly embossed portion of the body extending downwardly from the rim and sized to fit within the opening of the chassis base when the frame section is supported atop the rim of the chassis base.

Abstract: Disclosed are various embodiments for analyzing searches of verbal media content associated with media content features. A relatively popular portion of a media content item is determined based at least in part on a dialogue of the relatively popular portion of the media content item being included in a plurality of dialogue search queries received from a plurality of client devices. The media content item is rendered via a client device, and a recommendation for an item is via the client device in response to the relatively popular portion of the media content item being rendered.

Abstract: This disclosure describes an unmanned aerial vehicle (“UAV”) configured to autonomously deliver items of inventory to various destinations. The UAV may receive inventory information and a destination location and autonomously retrieve the inventory from a location within a materials handling facility, compute a route from the materials handling facility to a destination and travel to the destination to deliver the inventory.

Abstract: A distributed database receives a first command and second command sent by a client for processing in the context of a transaction. The distributed database validates the transaction by computing a digest based on signatures of the first and second commands, and comparing the computed digest to a digest received from the client. The transaction is committed upon validation.

Abstract: Disclosed are various embodiments for delegated evaluation of a decision tree. A client device receives an expression and a plurality of responses from a second computing device, the expression providing an evaluation of a user input and each of the plurality of responses representing a potential response for the first computing device to provide to the user input. The client device then evaluates the user input with the expression received from the second computing device to determine a user intent. The client device then selects a response to the user intent from the plurality of responses and renders the response within a user interface.

Abstract: Multi-tenant hosting of inverted indexes for text searches is implemented. Text search requests are routed to different index nodes that cache inverted indexes for different user accounts. Updates to inverted indexes are routed to index nodes that have acquired a lock on an inverted index. The index nodes have access to a common data store that persistently stores the inverted indexes.

Abstract: Ordering rules, such as those enforced by the peripheral component interconnect express (PCIe) protocol for data communications, can be intelligently enforced for independent transactions. A single device might host or be associated with multiple PCIe devices, such as virtual machines, and treating requests from these separate PCIe devices as coming from separate domains enables the ordering rules to be bypassed for certain transactions. Further, since a virtual machine might host multiple applications or be associated with multiple processors that can submit independent requests, the ordering rules can be bypassed at the transaction level in at least some instances. The ability to intelligently bypass ordering rules can help to improve the performance of the overall system, as requests do not need to be unnecessarily delayed and data storage capacity can be more fully utilized.

Abstract: This disclosure describes threat detection monitoring of systems executing in environments (consisting of hosts, networks, and/or applications, etc.), e.g., service provider networks, using trained deep learning/machine learning (ML) models. The models may be trained in one or more stages in simulators within a service provider network, e.g., the cloud, and/or in a simulator located in an on-premises environment, as well as on systems executing within the network. The models may be trained without relying on any security device/feature being configured or enabled, or with such security device/features being configured or enabled.

Abstract: A computing system is configured to access intermediate outputs of a neural network by augmenting a data flow graph generated for the neural network. The data flow graph includes a plurality of nodes interconnected by connections, each node representing an operation to be executed by the neural network. To access the intermediate output, the data flow graph is augmented by inserting a node representing an operation that saves the output of a node which produces the intermediate output. The node representing the save operation is inserted while maintaining all existing nodes and connections in the data flow graph, thereby preserving the behavior of the data flow graph. The augmenting can be performed using a compiler that generates the data flow graph from program code.

Abstract: An autonomous mobile device (AMD) in a physical space uses its own reflection to detect and map reflective surfaces. A first image is acquired by a camera of the AMD at a first time while a light on the AMD is turned on. The first image is processed to find a candidate reflection, characterized by a bright spot in the image. A second image is acquired at a second time while the light is off. The reflection is confirmed by absence of the candidate reflection in the second image. A display on the AMD presents a displayed image at a third time. A third image acquired during the third time is processed to find the features of the displayed image. Once found, a location and orientation in physical space of a plane of the surface causing the reflection is calculated. An occupancy map is updated to include this information.

Abstract: Described is a system and apparatus that provides redundant flight control for an aerial vehicle without the use of independent and dedicated redundant flight control boards and processors. Additional compute resources available on processors of other device boards of an aerial vehicle may be used to execute redundant flight control programs. The device boards and/or those redundant flight control programs monitor the operability of the various flight controllers. If any of the flight controllers is determined to be inoperable, one of the redundant flight control programs assumes the role of the inoperable controller.

Abstract: A dialog system receives a user request corresponding to a dialog with a user. The dialog system processes the user request to determine multiple service providers capable of responding to the user request. The dialog system selects one service provider based on a request-to-handle score, and selects another service provider based on a satisfaction rating. The dialog system updates the dialog state based on further input provided by the user to determine an output responsive to the user request.

Abstract: Cross domain resource access includes accessing resources in a first domain from a second domain. This may be performed using the methods, system, and devices described herein. This may include maintaining a mapping identifier for a user of a service provider based on user information. The service provider may provide first and second security domains for the user. The mapping identifier may be associated with an endpoint of a private cloud computing service of the first security domain. The may also include receiving, from the first security domain, a request associated with a resource of the second security domain, the request comprising the mapping identifier. This may also include routing the request from the first security domain to the second domain via a first private network link of the first security domain and a second private network link of the second security domain using a confidentiality controlled interface.

Abstract: A User State Management Service (USMS) stores, in a backend database, the progress of a workflow of a web-based application, and the state of the attributes in the webpages of the workflow. When the workflow is interrupted and resumed at a later time, the application can receive from the USMS the progress step where it was last in and the states and/or values of the attributes and repopulate the states and/or values of the attributes. The data are stored in a database can be configured using optimized organizations and can be device-independent, and the USMS can work persistently across different platforms and devices. The USMS can be a service, for example, software provided at a server, or servers, over the web or the cloud. The USMS can include an application interface which can improve performance and provide device and browser independence and scalability.