Abstract: Access level and security group information can be updated for a data instance without having to take down or recycle the instance. A data instance created in a data environment will have at least one default security group. Permissions can be applied to the default security group to limit access via the data environment. A control security group can be created in a control environment and associated with the default security group. Permissions can be applied and updated with respect to the control security group without modifying the default security group, such that the data instance does not need to be recycled or otherwise made unavailable. Requests to perform actions with respect to the control security groups are made via the control environment, while allowing native access to the data via the data environment.

Abstract: Aspects of a data environment, such as the cloning, hibernation, and recovery of databases, are managed using a separate control environment. A monitoring component of the control environment can periodically communicate with the data environment to determine any necessary actions to be performed, such as to recover from faults or events for a data instance in the data environment. A workflow can be instantiated that includes tasks necessary to perform actions such as recovery, hibernation, resumption from hibernation, or backup or cloning. Tasks of the workflow can cause certain jobs to be performed by host managers in the data environment to affect calls made to the control environment.

Abstract: A replicated database can be provisioned that provides primary and secondary replicas that can be provisioned in different data zones or geographical locations. The database can be installed on the primary replica, and both the primary and secondary replica can have installed a block level replication mechanism that allows any I/O operation to be replicated by between the primary and secondary replicas. Any failure or outage of the primary replica can be addressed by performing a failover operation to the secondary replica. A DNS name or other such approach can be used such that the name can be aliased to the secondary replica during a failover, such that there is no action needed on the part of the customer to utilize the “new” primary replica. The creation of the database and provisioning of the replicated instance can be initiated using a Web service call to a control environment.

Abstract: Replicated instances in a database environment provide for automatic failover and recovery. A monitoring component can periodically communicate with a primary and a secondary replica for an instance, with each capable of residing in a separate data zone or geographic location to provide a level of reliability and availability. A database running on the primary instance can have information synchronously replicated to the secondary replica at a block level, such that the primary and secondary replicas are in sync. In the event that the monitoring component is not able to communicate with one of the replicas, the monitoring component can attempt to determine whether those replicas can communicate with each other, as well as whether the replicas have the same data generation version. Depending on the state information, the monitoring component can automatically perform a recovery operation, such as to failover to the secondary replica or perform secondary replica recovery.

Abstract: Access level and security group information can be updated for a data instance without having to take down or recycle the instance. A data instance created in a data environment will have at least one default security group. Permissions can be applied to the default security group to limit access via the data environment. A control security group can be created in a control environment and associated with the default security group. Permissions can be applied and updated with respect to the control security group without modifying the default security group, such that the data instance does not need to be recycled or otherwise made unavailable. Requests to perform actions with respect to the control security groups are made via the control environment, while allowing native access to the data via the data environment.

Abstract: A system that implements a scaleable data storage service may maintain tables in a data store on behalf of storage service clients. The service may maintain data in partitions stored on respective computing nodes in the system. The service may support multiple throughput models, including a committed throughput model and a best effort throughput model. A service request to create a table may specify that requests directed to the table should be serviced under a committed throughput model and may specify the committed throughput level in terms of logical service request units. The service may reserve low-latency storage and other resources sufficient to meet the specified committed throughput level. A client/user may request a modification to the committed throughput level in anticipation of workload changes, such as an increase or decrease in traffic or data volume. In response, the system may increase or decrease the resources reserved for the table.

Abstract: Replicated instances in a database environment provide for automatic failover and recovery. A monitoring component can periodically communicate with a primary and a secondary replica for an instance, with each capable of residing in a separate data zone or geographic location to provide a level of reliability and availability. A database running on the primary instance can have information synchronously replicated to the secondary replica at a block level, such that the primary and secondary replicas are in sync. In the event that the monitoring component is not able to communicate with one of the replicas, the monitoring component can attempt to determine whether those replicas can communicate with each other, as well as whether the replicas have the same data generation version. Depending on the state information, the monitoring component can automatically perform a recovery operation, such as to failover to the secondary replica or perform secondary replica recovery.

Abstract: A system that implements a scaleable data storage service may maintain tables in a data store on behalf of storage service clients. The service may maintain data in partitions stored on respective computing nodes in the system. The service may support multiple throughput models, including a committed throughput model and a best effort throughput model. A service request to create a table may specify that requests directed to the table should be serviced under a committed throughput model and may specify the committed throughput level in terms of logical service request units. The service may reserve low-latency storage and other resources sufficient to meet the specified committed throughput level. A client/user may request a modification to the committed throughput level in anticipation of workload changes, such as an increase or decrease in traffic or data volume. In response, the system may increase or decrease the resources reserved for the table.

Abstract: Aspects of a data environment, such as the cloning, hibernation, and recovery of databases, are managed using a separate control environment. A monitoring component of the control environment can periodically communicate with the data environment to determine any necessary actions to be performed, such as to recover from faults or events for a data instance in the data environment. A workflow can be instantiated that includes tasks necessary to perform actions such as recovery, hibernation, resumption from hibernation, or backup or cloning. Tasks of the workflow can cause certain jobs to be performed by host managers in the data environment to affect calls made to the control environment.

Abstract: Aspects of a data environment, such as various capacities of data stores and instances, can be managed using a separate control environment. A monitoring component of the control environment can periodically communicate with the data environment to obtain performance information. The information is analyzed, using algorithms such as trending and extrapolation algorithms, to determine any recommended scaling of resources in the data environment. The scaling can be performed automatically, or as authorized by a customer. A workflow can be instantiated that includes tasks necessary to perform the scaling. The scaling of storage capacity can be performed without affecting the availability of the data store.

Abstract: Aspects of a data environment, such as the creation, provisioning, and management of data stores and instances, are managed using a separate control environment. A user can call into an externally-facing interface of the control environment, the call being analyzed to determine actions to be performed in the data environment. A monitoring component of the control plane also can periodically communicate with the data environment to determine any necessary actions to be performed, such as to recover from faults or events in the data environment. A workflow can be instantiated that includes tasks necessary to perform the action. For each task, state information can be passed to a component in the data environment operable to perform the task, until all tasks for an action are completed. Data in the data environment can be accessed directly using an externally-facing interface of the data environment, without accessing the control plane.

Abstract: Replicated instances in a distributed computing environment provide for automatic failover and recovery. A component monitors the status of event processors in a set or bucket and handles the failure of an event processor. For a large number of instances, the data environment can be partitioned such that each monitoring component is assigned a partition of the workload. At intervals, each event processor sends a “heartbeat” message to the event processors in the bucket covering the same workload partition, to inform the other event processors of the status of the event processor sending the heartbeat. If it is determined that a heartbeat is received from each event processor in the bucket, a current process can continue. In the event of monitoring component failure, the instances can be repartitioned, and the remaining monitoring components can be assigned to the new partitions to substantially evenly distribute the workload.

Abstract: A replicated database can be provisioned that provides primary and secondary replicas that can be provisioned in different data zones or geographical locations. The database can be installed on the primary replica, and both the primary and secondary replica can have installed a block level replication mechanism that allows any I/O operation to be replicated by between the primary and secondary replicas. Any failure or outage of the primary replica can be addressed by performing a failover operation to the secondary replica. A DNS name or other such approach can be used such that the name can be aliased to the secondary replica during a failover, such that there is no action needed on the part of the customer to utilize the “new” primary replica. The creation of the database and provisioning of the replicated instance can be initiated using a Web service call to a control environment.

Abstract: Aspects of a data environment, such as the cloning, hibernation, and recovery of databases, are managed using a separate control environment. A monitoring component of the control environment can periodically communicate with the data environment to determine any necessary actions to be performed, such as to recover from faults or events for a data instance in the data environment. A workflow can be instantiated that includes tasks necessary to perform actions such as recovery, hibernation, resumption from hibernation, or backup or cloning. Tasks of the workflow can cause certain jobs to be performed by host managers in the data environment to affect calls made to the control environment.

Abstract: Aspects of a data environment, such as the creation, provisioning, and management of data stores and instances, are managed using a separate control environment. A user can call into an externally-facing interface of the control environment, the call being analyzed to determine actions to be performed in the data environment. A monitoring component of the control plane also can periodically communicate with the data environment to determine any necessary actions to be performed, such as to recover from faults or events in the data environment. A workflow can be instantiated that includes tasks necessary to perform the action. For each task, state information can be passed to a component in the data environment operable to perform the task, until all tasks for an action are completed. Data in the data environment can be accessed directly using an externally-facing interface of the data environment, without accessing the control plane.

Abstract: Various embodiments of a system and method for tracking service requests are described. Embodiments may include call tree generation logic configured to receive multiple request identifiers associated with a respective one of multiple service requests. Each given request identifier may include an origin identifier, a depth value, and a request stack comprising one or more interaction identifiers. The call tree generation logic may also be configured to, based on multiple request identifiers that each include an origin identifier associated with a particular root request, generating a data structure that specifies a hierarchy of services called to fulfill that particular root request. Based on one or more of the interaction identifiers and one or more of the depth values, the generated data structure may specify for each given service of the hierarchy: a parent service that called the given service, and one or more child services called by the given service.

Abstract: A replicated database can be provisioned that provides primary and secondary replicas that can be provisioned in different data zones or geographical locations. The database can be installed on the primary replica, and both the primary and secondary replica can have installed a block level replication mechanism that allows any I/O operation to be replicated by between the primary and secondary replicas. Any failure or outage of the primary replica can be addressed by performing a failover operation to the secondary replica. A DNS name or other such approach can be used such that the name can be aliased to the secondary replica during a failover, such that there is no action needed on the part of the customer to utilize the “new” primary replica. The creation of the database and provisioning of the replicated instance can be initiated using a Web service call to a control environment.

Abstract: Data loss thresholds are enforced when performing updates to mirrored data sets. When an update is received for a data set that is mirrored to other copies of the data set, an evaluation of the difference between the data set and the other copies of the data set may be performed. If the evaluation determines that the difference fails to satisfy a threshold for acceptable data loss at the other copies upon a failure of the data set, a data loss mitigation action may be applied to performance of the update until the difference satisfies the threshold.

Abstract: Aspects of a data environment, such as various capacities of data stores and instances, can be managed using a separate control environment. A monitoring component of the control environment can periodically communicate with the data environment to obtain performance information. The information is analyzed, using algorithms such as trending and extrapolation algorithms, to determine any recommended scaling of resources in the data environment. The scaling can be performed automatically, or as authorized by a customer. A workflow can be instantiated that includes tasks necessary to perform the scaling. The scaling of storage capacity can be performed without affecting the availability of the data store.

Abstract: Aspects of a data environment, such as various capacities of data stores and instances, can be managed using a separate control environment. A monitoring component of the control environment can periodically communicate with the data environment to obtain performance information. The information is analyzed, using algorithms such as trending and extrapolation algorithms, to determine any recommended scaling of resources in the data environment. The scaling can be performed automatically, or as authorized by a customer. A workflow can be instantiated that includes tasks necessary to perform the scaling. The scaling of storage capacity can be performed without affecting the availability of the data store.