Abstract: A structured data store service, such as a database service, may implement fine-grained access to data maintained at the database service using federated identity. Fine grained access requests may be received at a database service for specified data maintained for an application provider from a client of the application provider. An access credential may be also be received. Verification of the access credential may be obtained, and the database service may evaluate the fine-grained access request according to a delegation policy corresponding to the access credential to determine whether the fine-grained request is authorized. If authorized, the fine-grained access request may be service. If not authorized, the fine-grained access request may be denied. In some embodiments, multiple application clients may have the same authorization for data, such as read authorization, while another one or more application clients may have different authorization for the data, such as write authorization.

Abstract: A system that provides services to clients may receive and service requests, various ones of which may require different amounts of work. The system may determine whether it is operating in an overloaded or underloaded state based on a current work throughput rate, a target work throughput rate, a maximum request rate, or an actual request rate, and may dynamically adjust the maximum request rate in response. For example, if the maximum request rate is being exceeded, the maximum request rate may be raised or lowered, dependent on the current work throughput rate. If the target or committed work throughput rate is being exceeded, but the maximum request rate is not being exceeded, a lower maximum request rate may be proposed. Adjustments to the maximum request rate may be made using multiple incremental adjustments. Service request tokens may be added to a leaky token bucket at the maximum request rate.

Abstract: A system that provides services to clients may receive and service requests, various ones of which may require different amounts of work. The system may determine whether it is operating in an overloaded or underloaded state based on a current work throughput rate, a target work throughput rate, a maximum request rate, or an actual request rate, and may dynamically adjust the maximum request rate in response. For example, if the maximum request rate is being exceeded, the maximum request rate may be raised or lowered, dependent on the current work throughput rate. If the target or committed work throughput rate is being exceeded, but the maximum request rate is not being exceeded, a lower maximum request rate may be proposed. Adjustments to the maximum request rate may be made using multiple incremental adjustments. Service request tokens may be added to a leaky token bucket at the maximum request rate.

Abstract: Technology is described for providing preconfigured device representations in a service provider environment. A plurality of device representation parameters may be received for a device via a user account. A preconfigured device representation may be created for the device using the plurality of device representation parameters. The preconfigured device representation may be associated with the user account. The device may be registered with the service provider environment. A registration of the device may be performed when the device initially connects to the service provider environment. The registration may assign a device identifier to the device and may associate the user account with the device. The preconfigured device representation may be provided to the device after the registration of the device is completed.

Abstract: Technology is described for providing preconfigured device representations in a service provider environment. A plurality of device representation parameters may be received for a device via a user account. A preconfigured device representation may be created for the device using the plurality of device representation parameters. The preconfigured device representation may be associated with the user account. The device may be registered with the service provider environment. A registration of the device may be performed when the device initially connects to the service provider environment. The registration may assign a device identifier to the device and may associate the user account with the device. The preconfigured device representation may be provided to the device after the registration of the device is completed.

Abstract: A controlling device scans a label of a network-connected device to obtain a first set of information from a primary layer of the label, where the first set of information is about the network-connected device. The controlling device scans the label to obtain a second set of information from a secondary layer of the label, whereby the secondary layer is distinct from the primary layer. The controlling device transmits a request to a device server associated with the network-connected device to obtain device records for the device, whereby the request includes the second set of information. In response to the request, the controlling device receives the one or more device records.

Abstract: A system that provides services to clients may receive and service requests, various ones of which may require different amounts of work. The system may determine whether it is operating in an overloaded or underloaded state based on a current work throughput rate, a target work throughput rate, a maximum request rate, or an actual request rate, and may dynamically adjust the maximum request rate in response. For example, if the maximum request rate is being exceeded, the maximum request rate may be raised or lowered, dependent on the current work throughput rate. If the target or committed work throughput rate is being exceeded, but the maximum request rate is not being exceeded, a lower maximum request rate may be proposed. Adjustments to the maximum request rate may be made using multiple incremental adjustments. Service request tokens may be added to a leaky token bucket at the maximum request rate.

Abstract: A technology is described for modifying a message frequency of a device. In one example, a network connection is identified between a device and a service provider environment. A message frequency is set for which to send reachability messages between the device and the service provider environment to maintain the network connection. The reachability messages may be sent between the device and the service provider environment at the message frequency. After testing whether the networking connection is maintained at the message frequency, the message frequency may be modified to a modified message frequency.

Abstract: A network-connected device service receives a request to establish a communications session with a network-connected device. In response to the request, the service transmits a set of electronic messages to the network-connected device through an access point of the network-connected device to establish the communications session. The network-connected device service receives a notification from the network-connected device indicating whether the communications session has been established. If so, the service provides an indication to a controlling device that the session has been established. This enables the controlling device to submit commands executable by the network-connected device to the service, which provides the commands to the network-connected device through the access point.

Abstract: A system that provides services to clients may receive and service requests, various ones of which may require different amounts of work. The system may determine whether it is operating in an overloaded or underloaded state based on a current work throughput rate, a target work throughput rate, a maximum request rate, or an actual request rate, and may dynamically adjust the maximum request rate in response. For example, if the maximum request rate is being exceeded, the maximum request rate may be raised or lowered, dependent on the current work throughput rate. If the target or committed work throughput rate is being exceeded, but the maximum request rate is not being exceeded, a lower maximum request rate may be proposed. Adjustments to the maximum request rate may be made using multiple incremental adjustments. Service request tokens may be added to a leaky token bucket at the maximum request rate.

Abstract: A technology is provided for managing maintenance operations in a distributed system. Maintenance operations of a plurality of hosts may be tracked in a service provider environment via a maintenance management service. The plurality of hosts are queried to determine availability of each of the plurality of hosts. A schedule for the maintenance operations of the plurality of hosts may be generated based at least in part on the availability of the plurality of hosts and a policy that manages when hosts are allowed to perform maintenance operations. Instructions from the maintenance management service may be sent to the plurality of hosts to schedule the maintenance operations of the plurality of hosts using the schedule.

Abstract: A network-connected device service receives a request to establish a communications session with a network-connected device. In response to the request, the service transmits a set of electronic messages to the network-connected device through an access point of the network-connected device to establish the communications session. The network-connected device service receives a notification from the network-connected device indicating whether the communications session has been established. If so, the service provides an indication to a controlling device that the session has been established. This enables the controlling device to submit commands executable by the network-connected device to the service, which provides the commands to the network-connected device through the access point.

Abstract: Methods and apparatus for connection redistribution in load-balanced systems that include multiple load balancers each serving multiple nodes. In the connection redistribution method, each node estimates a connection close rate, which may be based on an estimation of the percentage of the overall client traffic received by the respective load balancer that is being handled by the node. The node generates close requests for connections between the respective load balancer and clients according to the connection close rate. The node sends the close requests to its load balancer, which forwards the close requests to the appropriate clients. Upon receiving a close request, a client may close the connection(s) indicated by the request, obtain a public IP address for a load balancer, and initiate new connection(s) to the respective load balancer via the public IP address.

Abstract: Methods and apparatus for dedicated endpoint instances for network-accessible services are disclosed. The number of dedicated endpoint instances to be established to direct work requests of a given client to back-end nodes of a service may be determined. Configuration policies for the instances, including one or more policies related to caching, authentication, redundancy, durability, availability, and/or load balancing, may also be determined. Configuration of the instances may be initiated, and an indication that the endpoint or endpoints have been configured may be provided to the client.

Abstract: One or more computing nodes located in a first region may maintain a first collection of data items. A second set of one or more computing nodes in a second region may maintain a collection of data items that is at least a partial replica of the first collection. Notifications of changes to the first collection may be transmitted, via a broadcast communications channel, to a replication module, which may be included in a client application. The replication module may transmit requests to update the second collection of data based on changes to the first collection. Conflicts may be resolved through a last-write wins policy.

Abstract: Technology is described for providing preconfigured device representations in a service provider environment. A plurality of device representation parameters may be received for a device via a user account. A preconfigured device representation may be created for the device using the plurality of device representation parameters. The preconfigured device representation may be associated with the user account. The device may be registered with the service provider environment. A registration of the device may be performed when the device initially connects to the service provider environment. The registration may assign a device identifier to the device and may associate the user account with the device. The preconfigured device representation may be provided to the device after the registration of the device is completed.

Abstract: Methods and apparatus for configurable-capacity time-series tables are disclosed. A schedule of database table management operations, including at least an operation to change a throughput constraint associated with a table in response to a triggering event, is generated. The table is instantiated with an initial throughput constraint in accordance with the schedule. Work requests directed to the table are accepted based on the initial throughput constraint. The throughput constraint is modified in response to the triggering event. Subsequent work requests are accepted based on the modified throughput constraint.

Abstract: A repository of key-value data may store a first object value having an internal structure of a hierarchy of sub-objects. The repository may receive a request to modify the first object, expressed as a projection of locations in the object to be updated and a function that, upon evaluation, returns values to be used to update the projected locations of the object. The repository may determine that the locations specified by the projections correspond to non-overlapping regions of the object and, based on the determination, update the object using the results of evaluating the function.

Abstract: A system that provides services to clients may receive and service requests, various ones of which may require different amounts of work. The system may determine whether it is operating in an overloaded or underloaded state based on a current work throughput rate, a target work throughput rate, a maximum request rate, or an actual request rate, and may dynamically adjust the maximum request rate in response. For example, if the maximum request rate is being exceeded, the maximum request rate may be raised or lowered, dependent on the current work throughput rate. If the target or committed work throughput rate is being exceeded, but the maximum request rate is not being exceeded, a lower maximum request rate may be proposed. Adjustments to the maximum request rate may be made using multiple incremental adjustments. Service request tokens may be added to a leaky token bucket at the maximum request rate.

Abstract: A network-connected device service receives a request to establish a communications session with a network-connected device. In response to the request, the service transmits a set of electronic messages to the network-connected device through an access point of the network-connected device to establish the communications session. The network-connected device service receives a notification from the network-connected device indicating whether the communications session has been established. If so, the service provides an indication to a controlling device that the session has been established. This enables the controlling device to submit commands executable by the network-connected device to the service, which provides the commands to the network-connected device through the access point.