Abstract: A connection-based service impersonates request-based security for requests from clients that do not include credentials for the requests (e.g., data plane requests made via a connection-oriented security). A connection between a client and a connection-based service is established based on connection credentials that are based on security credentials from a request-based security service. The credentials are sent by a security component of the service to a local agent of the remote security service to be authenticated by the security service. An impersonation token is returned by the security service and cached by the local agent. Requests from the client to perform operations do not include credentials. For each request, the service passes an identifier for the client and the operation to a local authorization component that calls the agent for authorization of the requested operation. The agent uses the impersonation token to obtain authorization for the requested operation.

Abstract: Systems, devices, and methods are provided for depth-guided structure from motion. A system may obtain a plurality of image frames from a digital content item that corresponds to a scene and determine, based at least in part on a correspondence search, a set of 2-D keypoints for the plurality of image frames. A depth estimator may be used to determine a plurality of dense depth map for the plurality of image frames. The set of 2-D keypoints and the plurality of dense depth maps may be used to determine a corresponding set of depth priors. Initialization and/or depth-regularized optimization may be performed using the keypoints and depth priors.

Abstract: At a first resource to be used to perform a computing operation, a pair of execution environments is configured. I/O permissions of programs running in the different environments are based on respective sets of constraints. A program performs the operation in one of the environments, with input data being provided to the program from the second environment. A result of the operation is provided to a destination from the second environment.

Abstract: The following description is directed to a logic repository service. In one example, a method of a logic repository service can include receiving a first request to generate configuration data for configurable hardware using a specification for application logic of the configurable hardware. The method can include generating the configuration data for the configurable hardware. The configuration data can include data for implementing the application logic. The method can include receiving a second request to download the configuration data to a host server computer comprising the configurable hardware. The method can include transmitting the configuration data to the host server computer in response to the second request so that the configurable hardware is configured with the host logic and the application logic.

Abstract: An IoT gateway at a client site uses sensing functions and actuating functions to safely implement actions for equipment. The client provides, to the IoT service, specifications for a sensing function and one or more actuating functions that are to communicate with the sensing function. The functions are deployed to the IoT gateway at the client site. The sensing function may be assigned read only access to the equipment and the actuating function may be assigned write only access to the equipment. The sensing function may collect data from the equipment and determine that a condition has been met (e.g., temperature is above an upper limit). In response, the sensing function provides an indication of an action to the actuating function (e.g., via a unique topic). If the action is a supported action, then the actuating function causes the equipment to perform the action; otherwise, it ignores the indicated action.

Abstract: An airframe design may include a frame or assembly, and one or more components that may be removably attached to the frame. The frame may include struts, central bulkheads, a tail section, a plurality of wing sections, and motor mounts that are attached together. The one or more attachable components may include a forward fuselage, motors, propellers, motor pod fairings, stabilizer fins, and landing gear that are attached using fasteners. The frame may reduce the number of parts of the airframe design and may also reduce complexity, cost, and weight, while also increasing stiffness and strength. Further, the various attachable components may facilitate fabrication, assembly, and maintenance of an aerial vehicle having the airframe design.

Abstract: Synchronous replication for a distributed database system may be performed using an erasure coding scheme. A request that causes a write to a database hosted in a distributed database system is received. A replication message for a synchronous replication technique is generated, then divided and encoded into a number of chunks according to an erasure encoding scheme that allows the replication message to be reassembled with less than the number of chunks. The chunks are sent to another instance of the database which receives and reassembles the replication message from the chunks and responds to acknowledge that the write is committed.

Abstract: Systems and method for implementing quantum circuit compilation as-a-service are disclosed. In some embodiments, a quantum circuit compilation service is configured to compile quantum circuits for a plurality of third-party customers, wherein the compilation service supports compiling quantum circuits to be executed on a plurality of different quantum processing units that utilize various different quantum computing technologies. In some embodiments, the quantum computing service generates a customized compilation job plan for each quantum circuit to be compiled. The compilation job plan may reference modular compilation passes stored in a repository of the quantum circuit compilation service. The modular passes may be mixed and matched as needed to allow for compilation of a wide-variety of quantum circuits to be executed using various different quantum computing technologies.

Abstract: A database system may include a database service and a separate distributed storage service. The database service (or a database engine head node thereof) may be responsible for query parsing, optimization, and execution, transactionality, and consistency, while the storage service may be responsible for generating data pages from redo log records and for durability of those data pages. For example, in response to a write request directed to a particular data page, the database engine head node may generate a redo log record and send it, but not the data page, to a storage service node. The storage service node may store the redo log record and return a write acknowledgement to the database service prior to applying the redo log record. The server node may apply the redo log record and other redo log records to a previously stored version of the data page to create a current version.

Abstract: Systems and methods for performing medical audio summarizing for medical conversations are disclosed. An audio file and meta data for a medical conversation are provided to a medical audio summarization system. A transcription machine learning model is used by the medical audio summarization system to generate a transcript and a natural language processing service of the medical audio summarization system is used to generate a summary of the transcript. The natural language processing service may include at least four machine learning models that identify medical entities in the transcript, identify speaker roles in the transcript, determine sections of the transcript corresponding to the summary, and extract or abstract phrases for the summary. The identified medical entities and speaker roles, determined sections, and extracted or abstracted phrases may then be used to generate the summary.

Abstract: In response to a programmatic request, configuration information representing a multi-network-segment gateway established on behalf of a customer is stored at a networking service. In response to another programmatic request, a communication session is established between a route signaling node of the gateway and a routing information source located at a customer premise. In response to additional programmatic input, the networking service stores an indication that the gateway is to be used to transfer packets between a cloud-side virtual network and a customer-side virtual network. The routing information exchanged in the session pertains to the cloud-side and customer-side virtual network, and is used to transfer data packets between the two virtual networks.

Abstract: Based on analysis of a workload associated with a throttling key of a client request directed to a first service, a scale-out requirement of the throttling key is obtained at respective resource managers of a plurality of other services which are utilized by the first service to respond to client requests. The resource managers initiate, asynchronously with respect to one another, resource provisioning tasks at each of the other services to fulfill the scale-out requirement. A throttling limit associated with the throttling key is updated to a second throttling key after the resource provisioning tasks are completed by the resource managers, and the updated limit is used to determine whether to accept another client request associated with the throttling key.

Abstract: Systems and methods of determining and providing optimized deployment plans for deploying software to vehicles are disclosed. In some embodiments, a vehicle software deployment system evaluates one or more cost functions to determine relative costs of different deployment configuration options for deploying software to a vehicle, such as resource costs (e.g., bandwidth, compute, memory, etc.), isolation costs (e.g., limited access to input information, limited connectivity to other ECUs, etc.), performance costs, etc. Based on the evaluation of the one or more cost functions, the vehicle software deployment system determines an optimized deployment plan. Also, the vehicle software deployment system receives telemetry data from the vehicle and automatically determines updated optimized deployment plans in response to changes in configuration of the vehicle indicated in the telemetry data.

Abstract: A vehicle signal relay system enables a relay agent in a first zone of a vehicle to send sensor signals having a first link-layer communication protocol to a software application deployed on a compute unit in another zone of the vehicle that is connected using another link-layer communication protocol. The vehicle signal relay system allows the software application to identify target relay agents with access to needed sensor signals. The vehicle signal relay system may further enable one way or mutual attestation. The vehicle signal relay system may also allow filters to be applied to the subscribed vehicle sensor signals, and may allow the software application to determine a communication protocol to be used between the software application and the relay agent.

Abstract: Techniques for encoding quantum circuit mapping problems as SAT solver optimization problems are disclosed. Quantum circuit mapping often requires the use of SWAP gates in order to configure logical quantum computations to be executed using fixed quantum hardware device layouts. A quantum compilation service takes a logical quantum circuit, a physical qubit connectivity graph, and a requested number of SWAP gates to solve the mapping using and encodes the information into a Conjunctive Normal Form (CNF) equation using a layout-transition-based encoding scheme. The CNF equation is then provided to a SAT solver which attempts to determine an assignment for the mapping using the set number of SWAP gates requested. Multiple CNF equations corresponding to different requested numbers of SWAP gates may be solved for in parallel using multiple SAT solving instances.

Abstract: An automatic technique is disclosed to enrich presented answers by highlighting relevant shopping recommendations. The shopping recommendations can either be highlighted within the answer itself, or as an auxiliary list of suggestions. A model is described for selecting phrases from the answer text (sequences of consecutive terms called noun phrases) that refer to potential products that likely represent relevant shopping recommendation in context of the question-answer pair. The noun phrases are then ranked in order of importance. The top-ranked noun phrases are used to search products to be displayed in association with the noun phrases. Clicking or tapping on a highlighted noun phrase launches a shopping-related flow, such as presenting a widget with product recommendations or running a search in a search engine.

Abstract: A vehicle software test environment management system provides a virtual vehicle environment that includes virtual electronic control units (vECUs) having a virtual bus connectivity configuration used to simulate respective ones of electronic control units (ECUs) of a real-world vehicle. The vehicle software test environment management system determines respective instance types of one or more virtual compute instances to be used to implement the vECUs based on respective configuration of respective ones of the ECUs and further determines respective machine images to emulate respective software environments of the respective ones of the ECUs. The vehicle software test environment management system may also deploy a vehicle software application to be certified on one or more of the vECUs and test the deployed vehicle software application using recorded signals of one or more ECUs of the real-world vehicle.

Abstract: Techniques for solving quantum circuit mapping problems using reinforcement learning techniques are disclosed. Quantum circuit mapping often requires the use of SWAP gates in order to configure logical quantum computations to be executed using fixed quantum hardware device layouts. A reinforcement learning model takes inputs such as a logical quantum circuit, a physical qubit connectivity graph corresponding to a quantum hardware device, and an initial qubit allocation scheme, and uses such information to schedule quantum gates of the logical quantum circuit for execution using respective physical qubits of the quantum hardware device. A reinforcement learning model that is configured to solve such quantum circuit mapping problems may comprise a neural network that is assisted by a Monte Carlo Tree Search (MCTS) algorithm, wherein the MCTS algorithm guides the neural network towards quantum circuit routing pathways which are more efficient (e.g., require fewer SWAP gates to be scheduled).

Abstract: Systems and methods for providing vehicle software deployment plans that include one or more fallback deployment plans are disclosed. In some embodiments, a vehicle software deployment system determines a deployment plan for deploying one or more software applications one or more electronic control units (ECUs) of a vehicle. Additionally, for one or more failure scenarios, the vehicle software deployment system determines one or more respective fallback deployment plans, such as a deployment plan that assumes one of the ECUs of the vehicle has failed. A deployment plan bundle is provided to the vehicle, comprising a primary deployment plan as well as the one or more fallback deployment plans. In the event that one of the failure scenarios takes place with respect to the vehicle, a deployment agent of the vehicle automatically deploys one of the fallback deployment plans that was provided with the deployment bundle.

Abstract: Techniques are described for executing satisfiability modulo theories (SMT) solvers in a “shadow” system configuration where input queries are provided to a primary SMT solver system and additionally to one or more secondary SMT solver systems. SMT solver systems can be used by cloud providers and in other computing environments to analyze the implications of configured user account policies defining permissions with respect to users' computing resources and associated actions within a computing environment, to help ensure the security of computing resources and user data, etc. The results generated by a primary SMT solver system can be provided to one or more secondary SMT solver systems, where each of the secondary SMT systems can comprise different system components or different versions of system components, to assess the correctness of the primary SMT solver system, to compare performance metrics, among other possible types of analyses.

Abstract: A namespace monitoring service may track released namespaces such as internet protocol (IP) addresses and manage namespace cooldown pools, available namespace pools, and a registry of released namespaces to detect and mitigate security vulnerabilities that arise from reassignment of namespaces. The namespace monitoring service provides access to the released namespace registry and/or sends a data stream of namespace registry updates. The namespace monitoring service may manage namespace reassignment process and extend the cooldown period of released namespaces or place a hold on available namespaces.

Abstract: A first encoding representing a set of detected signals is obtained at a sensor-proximity resource of an object recognition application which also includes resources of an analytics service of a provider network. In response to a determination that a cache at the sensor-proximity resource does not include a second encoding which satisfies a similarity criterion with respect to the first encoding, at least a portion of a partition of a spatial index is obtained from another resource selected using an index partition map. A recognition-based action is initiated based on determining that the partition includes an encoding which satisfies the similarity criterion.

Abstract: Methods, systems, and computer-readable media for analysis of role reachability with transitive tags are disclosed. An access control analyzer determines a graph including nodes and edges. The nodes represent roles in a provider network hosting resources. The roles are associated with access control policies granting or denying access to individual resources. One or more of the access control policies grant or deny access based (at least in part) on key-value attributes. The access control analyzer determines, based (at least in part) on a role reachability analysis of the graph, whether a first role can assume a second role using role assumption steps for a particular state of the attributes. The attributes may include transitive attributes that persist during the role assumption steps.

Abstract: Methods and apparatus for providing persistent execution environments for computation systems including but not limited to interactive computation systems. A service is provided that extends the notion of static containers to dynamically changing execution environments into which users can install code, add files, etc. The execution environments are monitored, and changes to an execution environment are automatically persisted to environment versions(s) so that code run in the execution environment can be run later or elsewhere simply by referring to the environment. There is no explicit build step for the user. Instead, incremental changes are added to environment versions which are stored and are ready to be used to instantiate respective execution environments on other compute instances.

Abstract: When a client requests a data import job, a remote storage service provider provisions a shippable storage device that will be used to transfer client data from the client to the service provider for import. The service provider generates security information for the data import job, provisions the shippable storage device with the security information, and sends the shippable storage device to the client. The service provider also sends client-keys to the client, separate from the shippable storage device (e.g., via a network). The client receives the device, encrypts the client data and keys, transfers the encrypted data and keys onto the device, and ships it back to the service provider. The remote storage service provider authenticates the storage device, decrypts client-generated keys using the client-keys stored at the storage service provider, decrypts the data using the decrypted client-side generated keys, and imports the decrypted data.

Abstract: Methods, systems, and computer-readable media for automated threat modeling using application relationships are disclosed. A graph is determined that includes of nodes and edges. At least a portion of the nodes represent software components, and at least a portion of the edges represent relationships between software components. An event is received, and a sub-graph associated with the event is determined. The event is indicative of a change to one or more of the nodes or edges in the graph. Threat modeling is performed on the sub-graph using one or more analyzers. The one or more analyzers determine whether the sub-graph is in compliance with one or more policies.

Abstract: Methods and apparatus for client-directed placement of remotely configured service instances are described. One or more placement target options are selected for a client of a network-accessible service based on criteria such as service characteristics of the placement targets. The selected options, including a particular placement target that includes instance hosts configurable from remote control servers, are indicated programmatically to the client. A determination is made that a service instance is to be configured at the particular placement target on behalf of the client. A remote control server is configured to issue administrative commands to an instance host at the particular placement target to configure the service instance.

Abstract: A connectivity monitor of a vehicle determines current and/or future states of antennas. A workload monitor of the vehicle receives execution criteria for different workloads to be executed. An intelligent connectivity engine at the vehicle receives the current and/or future states of the antennas and the execution criteria for the respective workloads. Based on the current and/or future states of the antennas and the execution criteria for the respective workloads, the intelligent connectivity engine assigns at least one of the respective workloads for current execution and at least another of the respective workloads for future execution. A client may use an intelligent connectivity service to configure various aspects of the vehicle connectivity. For example, the client can provide workload recommendation code for the intelligent connectivity engine to assign workloads for current or future execution.

Abstract: Techniques are described for providing virtual networking functionality for managed computer networks. In some situations, a user may configure or otherwise specify a logical network topology for a managed computer network with multiple computing nodes that includes one or more virtual networking devices each associated with a specified group of the multiple computing nodes. Corresponding networking functionality may be provided for communications between the multiple computing nodes by emulating functionality that would be provided by the networking devices if they were physically present and configured to support the specified network topology. In some situations, the managed computer network is a virtual computer network overlaid on a substrate network, and the networking device functionality emulating includes receiving routing communications directed to the networking devices and using included routing information to update the specified network topology for the managed computer network.

Abstract: A post-task-completion retention period for which a computing resource is to be retained, without de-activating the resource, on behalf of a set of requesters of machine learning tasks is determined at a machine learning service. A first task, identified at the service prior to expiration of the retention period at a first computing resource at which a second task has completed, is initiated at the first computing resource. In response to obtaining an indication of a third task and determining that a threshold criterion associated with the retention period satisfies a criterion, the third task is initiated at an additional computing resource. The additional computing resource is de-activated after the third task completes, without waiting for the retention period to expire.

Abstract: Components of a public certificate authority (CA) generate respective cryptographic assertions during performance of respective tasks of a certificate issuance workflow and a workflow approval component approves/rejects certificate issuance, based upon verification of the cryptographic assertions. For example, a workflow manager may assign tasks of a certificate workflow process to a number of components that process the tasks. The components generate responses and sign the respective responses with keys particular to each component. The workflow manager gathers the cryptographic assertions and sends them to a workflow approval component that validates the assertions, verifies the assertions indicate successful completion of the workflow and approves or rejects certificate issuance.

Abstract: An interactive interpretation session with respect to a first version of a machine learning model is initiated. In the session, indications of factors contributing to a prediction decision are provided, as well indications of candidate model enhancement actions. In response to received input, an enhancement action is implemented to obtain a second version of the model. The second version of the model is stored.

Abstract: An interruption-handling setting for a category of interactions of an application is determined via a programmatic interface. A set of user-generated input is obtained while presentation to a user of a set of output of the category is in progress. A response to the set of user-generated input is prepared based at least in part on the interruption-handling setting.

Abstract: A system, method and processor that mitigates security vulnerabilities using context-dependent address space hiding. In some embodiments, a hardware mechanism allows a more-privileged software component managing multiple less-privileged software components to blind itself against “out-of-context” less-privileged software components. The hardware mechanism can allow the more-privileged software component to dynamically hide a portion of the more-privileged address space related to the “out-of-context” less-privileged software components, based on knowledge of the “in-context” less-privileged software component. A context register is set with a value from which an address range, within the address space of the more-privileged software component, can be determined, where the address range is associated with a first less-privileged software component can be determined.

Abstract: At an artificial intelligence system, training iterations of a first machine learning model are implemented. In a particular iteration, a group of data items are selected from an item collection using active learning, and respective labels selected from a set of tags are obtained for at least some of the items of the group. Using feature processing elements of a different machine learning model, a respective feature set corresponding to individual labeled items is generated in the iteration, and the feature sets are included in a training set used to train the first machine learning model. A trained version of the first machine learning model is stored after a training completion criterion is met.

Abstract: A candidate attribute combination of a first data set is identified, such that the candidate attribute combination meets a data type similarity criterion with respect to a collection of data types of sensitive information for which the first data set is to be analyzed. A collection of input features is generated for a machine learning model from the candidate attribute combination, including at least one feature indicative of a statistical relationship between the values of the candidate attribute combination and a second data set. An indication of a predicted probability of a presence of sensitive information in the first data set is obtained using the machine learning model.

Abstract: The following description is directed to a logic repository service. In one example, a method of a logic repository service can include receiving a first request to generate configuration data for configurable hardware using a specification for application logic of the configurable hardware. The method can include generating the configuration data for the configurable hardware. The configuration data can include data for implementing the application logic. The method can include encrypting the configuration data to generate encrypted configuration data. The method can include signing the encrypted configuration data using a private key. The method can include transmitting the signed encrypted configuration data in response to the request.

Abstract: A quantum computing service may store, in a cache, one or more compiled files of respective quantum functions included in one or more quantum computing programs received one or more customers. When the quantum computing service receives another quantum computing program, from the same or a different customer, the quantum computing service may determine whether the quantum computing program may include one or more of the quantum functions corresponding to the compiled files in the cache. If so, the quantum computing service may use the compiled files in the cache to compile the quantum computing program.

Abstract: An Identity and Access Management Service implements persistent source values PSVs) for assumed identities. A source value (e.g., an original identifier of an entity) is persisted across assumed identities, facilitating identification of entities (users or applications) responsible for actions taken by the assumed (e.g., alternative) identities. The Manager receives a request to assume an identity. The request includes the entities current credentials and a PSV. The current credentials are authenticated and a persistent source value policy may be relied on to determine whether and/or how to grant the assumed identity. The PSV may be copied from credentials in the request in order to be included in the credentials for the requested identity that the Manager provides in response to the request. Use of the requested credentials, including the PSV, to access services or resources may be logged, the logs including the PSV from the request to assume the identity.

Abstract: Techniques are described for providing logical networking functionality for managed computer networks, such as for virtual computer networks provided on behalf of users or other entities. In some situations, a user may configure or otherwise specify a network topology for a virtual computer network, such as a logical network topology that separates multiple computing nodes of the virtual computer network into multiple logical sub-networks and/or that specifies one or more logical networking devices for the virtual computer network. After a network topology is specified for a virtual computer network, logical networking functionality corresponding to the network topology may be provided in various manners, such as without physically implementing the network topology for the virtual computer network. In some situations, the computing nodes may include virtual machine nodes hosted on one or more physical computing machines or systems, such as by or on behalf of one or more users.

Abstract: Systems, methods, and computer-readable media are disclosed for systems and methods for automated generation and presentation of sign language avatars for video content. Example methods may include determining, by one or more computer processors coupled to memory, a first segment of video content, the first segment including a first set of frames, first audio content, and first subtitle data, where the first subtitle data comprises a first word and a second word. Methods may include determining, using a first machine learning model, a first sign gesture associated with the first word, determining first motion data associated with the first sign gesture, and determining first facial expression data. Methods may include generating an avatar configured to perform the first sign gesture using the first motion data, where a facial expression of the avatar while performing the first sign gesture is based on the first facial expression data.

Abstract: At a radio-based application pipeline processing server at which a portion of a distributed unit (DU) of a radio-based application is implemented, a particular networking hardware device is selected from among several devices (which include least one device incorporated within a network function accelerator card and at least one device which is not part of an accelerator card) for transmission of at least a portion of mid-haul traffic to a centralized unit (CU). The mid-haul traffic is transmitted to the CU via the selected device. At least a portion of front-haul traffic is transmitted to a radio unit (RU) via a networking hardware device incorporated within a network function accelerator card of the server.

Abstract: A data service implements a configurable data compressor/decompressor using a recipe generated for a particular data set type and using compression operators of a common registry (e.g., pantry) that are referenced by the recipe, wherein the recipe indicates at which nodes of a compression graph respective ones of the compression operators of the registry are to be implemented. The configurable data compressor/decompressor provides a customizable framework for compressing data sets of different types (e.g., belonging to different data domains) using a common compressor/decompressor implemented using a common set of compression operators.

Abstract: A determination is made that an explanatory data set for a common set of predictions generated by a machine learning model for records containing text tokens is to be provided. Respective groups of related tokens are identified from the text attributes of the records, and record-level prediction influence scores are generated for the token groups. An aggregate prediction influence score is generated for at least some of the token groups from the record-level scores, and an explanatory data set based on the aggregate scores is presented.

Abstract: Techniques are described for providing managed computer networks, such as for managed virtual computer networks overlaid on one or more other underlying computer networks. In some situations, the techniques include facilitating replication of a primary computing node that is actively participating in a managed computer network, such as by maintaining one or more other computing nodes in the managed computer network as replicas, and using such replica computing nodes in various manners. For example, a particular managed virtual computer network may span multiple broadcast domains of an underlying computer network, and a particular primary computing node and a corresponding remote replica computing node of the managed virtual computer network may be implemented in distinct broadcast domains of the underlying computer network, with the replica computing node being used to transparently replace the primary computing node in the virtual computer network if the primary computing node becomes unavailable.

Abstract: A journaling file system may implement remote durable logging. Updates to a file system may be received, and log records describing the updates may be stored in a locally-accessible file system change log. The update may then be acknowledged as committed. The log records may then be sent to be stored in a network-based data store in a remote version of the file system change log. Once it may be determined that the log records are stored in the remote version, storage space for the log records in the local file system change log may be reclaimed. Various types of restoration and duplication techniques may be implemented based on the remote version of the change log to restore a file system at an originating device or to duplicate the file system at a different device.

Abstract: Various embodiments of systems and methods for providing virtualized (e.g., serverless) broker clusters for a data streaming service are disclosed. A data streaming service uses a front-end proxy layer and a back-end broker layer to provide virtualized broker clusters, for example in a Kafka-based streaming service. Resources included in a virtualized broker cluster are monitored and automatically scaled-up, scaled-down, or re-balanced in a way that is transparent to data producing and/or data consuming clients of the data streaming service.

Abstract: A respective set of features, including emotion-related features, are extracted from segments of a video for which a preview is to be generated. A subset of the segments is chosen using the features and filtering criteria including at least one emotion-based filtering criterion. Respective weighted preview-suitability scores are assigned to the segments of the subset using at least a metric of similarity between individual segments and a plot summary of the video. The scores are used to select and combine segments to form a preview for the video.

Abstract: Methods, systems, and computer-readable media for auto-tuning permissions using a learning mode are disclosed. A plurality of access requests to a plurality of services and resources by an application are determined during execution of the application in a learning mode in a pre-production environment. The plurality of services and resources are hosted in a multi-tenant provider network. A subset of the services and resources that were used by the application during the learning mode are determined. An access control policy is generated that permits access to the subset of the services and resources used by the application during the learning mode. The access control policy is attached to a role associated with the application to permit access to the subset of the services and resources in a production environment.

Abstract: Systems, methods, and computer-readable media are disclosed for dynamic voice search transitioning. Example methods may include receiving, by a computer system in communication with a display, a first incoming voice data indication, initiating a first user interface theme for presentation at a display, wherein the first user interface theme is a default user interface theme, and receiving first voice data. Example methods may include sending the first voice data to a remote server for processing, receiving an indication from the remote server to initiate a second user interface theme, and initiating the second user interface theme for presentation at the display.