Abstract: A multi-assistant speech-processing system that centrally determines multiple execution plans to respond to a user input. A central component determines whether a particular input should be processed using a requested assistant or a different assistant or should be terminated. Assistant handoff may be determined based on system policies as well as user input-specific data. A ranked list of execution options may be supplemented by augmented data corresponding to messages to a user. The system may attempt to execute plans in the ranked order until a plan succeeds.

Abstract: An authentication system receives authentication information from a user as part of a request to access a web-based service. The authentication system transmits the authentication information to a set of second users authorized to evaluate the authentication information. If a threshold number of the set of second users authenticate the identity of the first user, the authentication system enables the user to access the web-based service.

Abstract: A record of usage data is obtained, with the record sampled according to a sampling rate from a set of usage data records, with the record specifying a request to access a resource of a computing resource service provider, with the request indicating a set of permissions, and with the sampling rate being based at least in part on a criterion associated with the request. The record is aggregated, based at least in part on a permission of the set of permissions, with at least another record sampled according to the sampling rate from the set of usage data records to produce a set of aggregated usage records and at least a portion of the set of aggregated usage records is provided.

Abstract: Techniques for generating access control policy warnings and suggestions are disclosed herein. An access control policy change specifying changes to one or more permissions associated with the access control policy is received and, based on a set of requests for access associated with the access control policy, an access control policy warning is produced which specifying an indication of whether or not the changes to the one or more permissions should be permitted.

Abstract: A technology is described for generating and modifying tunable parameter settings for use with a distributed application. An example method may include providing a first set of tunable parameter settings for a distributed application, where the first set of tunable parameter settings may be selected based at least in part on historical data associated with similar distributed applications. Performance metrics and implementation attributes associated with the distributed application may then be collected during a time period. The performance metrics and the implementation attributes collected may be input to a machine learning model configured to output a second set of tunable parameter settings for the distributed application, and the second set of tunable parameter settings may be provided for use with the distributed application, where performance of the distributed application may be better as compared to a performance using the first set of tunable parameter settings.

Abstract: A computing resource service receives a request to access the service and perform various actions. In response to the request, the computing resource service obtains a set of active policies that are applicable to the request. As a result of the service determining that the set of active policies fail to provide sufficient permissions for fulfillment of the request, the service determines if an enforcement policy is available that is applicable to the request. The service evaluates the request using the enforcement policy such that if the enforcement policy includes permissions sufficient for fulfillment of the request, the request is fulfilled.

Abstract: A policy/resource decommissioning service determines whether a resource has been inactive for a period of time greater than at least one period of time threshold for decommissioning. If the resource has been inactive greater than a first period of time threshold, the service disables the resource such that requests to access the resource are denied. If the resource has been inactive for a period of time greater than a second threshold, longer than the first period of time threshold, the service archives the resource. The service deletes the resource if the inactivity period of the resource is greater than a third period of time threshold, where the third period of time threshold is longer than the first and the second period of time thresholds.

Abstract: A customer's resources are protected from malicious or accidental deletion or termination. In some embodiments anomaly detection is used for identifying suspicious activities, which is combined with options to restore previously deleted resources. To define and detect anomalies, resource profiles are generated indicative of how resources are being used, and user profiles of how users use resources of the compute service provider. Instead of immediately deleting a resource, a temporary marker can be placed on the resource. The temporary marker blocks attempts to access the resource just as if the resource was deleted. However, the resource can easily be recovered by simply removing the marker. When a deletion event is identified as anomalous, an alert is generated to the customer. Upon receiving the alert, customers can opt to restore the resource that has been deleted, which will remove the marker.

Abstract: A record of usage data is obtained, with the record sampled according to a sampling rate from a set of usage data records, with the record specifying a request to access a resource of a computing resource service provider, with the request indicating a set of permissions, and with the sampling rate being based at least in part on a criterion associated with the request. The record is aggregated, based at least in part on a permission of the set of permissions, with at least another record sampled according to the sampling rate from the set of usage data records to produce a set of aggregated usage records and at least a portion of the set of aggregated usage records is provided.

Abstract: Techniques for self-learning access control policies are disclosed herein. A set of security policy modification recommendations is produced based on set of effective permissions and also based on a set of requests for access subject to that set of effective permission. Each policy modification recommendation is configured to alter the set of effective permissions by performing one or more actions altering one or more of the effective permissions. A selected policy modification recommendation is provided that is configured to produce a modified set of effective permissions.

Abstract: A computing resource service receives a request to access the service and perform various actions. In response to the request, the computing resource service obtains a set of active policies that are applicable to the request. As a result of the service determining that the set of active policies fail to provide sufficient permissions for fulfillment of the request, the service determines if an enforcement policy is available that is applicable to the request. The service evaluates the request using the enforcement policy such that if the enforcement policy includes permissions sufficient for fulfillment of the request, the request is fulfilled.

Abstract: Techniques for large-scale authorization data collection and aggregation are disclosed herein. An authorization data service may first receive a set of usage data records, may next aggregate the set of usage data records to reduce the number of usage data records, may next store the aggregated set of usage data records in a usage data repository, and may next provide subsets of the aggregated set of usage data records in response to an application processing request to inform policy decisions associated with a computer system.

Abstract: A computing resource service receives a request to access the service and perform various actions. In response to the request, the computing resource service obtains a set of active policies that are applicable to the request. As a result of the service determining that the set of active policies fail to provide sufficient permissions for fulfillment of the request, the service determines if an enforcement policy is available that is applicable to the request. The service evaluates the request using the enforcement policy such that if the enforcement policy includes permissions sufficient for fulfillment of the request, the request is fulfilled.

Abstract: A technology is described for generating and modifying tunable parameter settings for use with a distributed application. An example method may include providing a first set of tunable parameter settings for a distributed application, where the first set of tunable parameter settings may be selected based at least in part on historical data associated with similar distributed applications. Performance metrics and implementation attributes associated with the distributed application may then be collected during a time period. The performance metrics and the implementation attributes collected may be input to a machine learning model configured to output a second set of tunable parameter settings for the distributed application, and the second set of tunable parameter settings may be provided for use with the distributed application, where performance of the distributed application may be better as compared to a performance using the first set of tunable parameter settings.