Abstract: Methods and apparatus that allow clients to specify custom network rules for their resource instances or network constructs in a provider network environment. Services and interfaces may be provided that allow a client to provide an executable module that implements custom rules for their resources, or alternatively to specify or select custom rules for their resources. The module may be installed on a host device, and may apply the custom rules to packets to and from the client's resources. Alternatively, the client-defined rules may be applied to packet flows according to the custom rules specified by the client and applied by a client rules service implemented on the provider network external to the host device or on a client resource instance on the host device. The custom network rules may, for example, extend or modify standard network rules for the client's resources on the host device.

Abstract: A computing system includes one or more processors and memory that includes instructions, that when executed by the one or more processors, cause the processors to receive, by an networking device of a data interface of a computing environment, a command instruction that instructs the networking device to change state to a state corresponding with a requested state stored in a data store of a control interface of the computing environment. When implemented by the networking device, the command instruction causes the networking device to implement a network configuration option. The instructions also cause the processors to determine, by the networking device, whether the state information in the command instruction is valid by utilizing network heuristic based rules; and reject, by the networking device, the command instruction based on a determination that the state information is not valid.

Abstract: Dynamic data partitioning for stateless request routing may be implemented. Respective partitions of data and corresponding mapping information may be maintained at partition hosts. A repartitioning event may be detected for the data to move a portion of data from a source partition host to a destination partition host. In response, the mapping information at the source partition host may be updated to indicate that the portion of data is located at the destination partition host for subsequent access requests received at the source partition host. The portion of the data may be copied from the source partition host to the destination partition host. Upon completion of the copy of the portion of the data, the mapping information at the destination partition host may be updated to indicate that the portion of the data is located at the destination partition host and is available for access.

Abstract: Methods and apparatus that allow clients to specify custom network rules for their resource instances or network constructs in a provider network environment. Services and interfaces may be provided that allow a client to provide an executable module that implements custom rules for their resources, or alternatively to specify or select custom rules for their resources. The module may be installed on a host device, and may apply the custom rules to packets to and from the client's resources. Alternatively, the client-defined rules may be applied to packet flows according to the custom rules specified by the client and applied by a client rules service implemented on the provider network external to the host device or on a client resource instance on the host device. The custom network rules may, for example, extend or modify standard network rules for the client's resources on the host device.

Abstract: A physical host agent receives configuration information from a virtual computer system service specifying network traffic information to be extracted from network traffic for one or more virtual machines. The agent extracts the specified network traffic information from the network traffic for the one or more virtual machines and aggregates the network traffic information into one or more data segments for storage in a repository. A publishing sub-system of the service obtains the one or more data segments and compiles the one or more data segments into data logs for delivery to an analytics service to make the network traffic information available to customers.

Abstract: Methods and apparatus that allow clients to specify custom network rules for their resource instances or network constructs in a provider network environment. Services and interfaces may be provided that allow a client to provide an executable module that implements custom rules for their resources, or alternatively to specify or select custom rules for their resources. The module may be installed on a host device, and may apply the custom rules to packets to and from the client's resources. Alternatively, the client-defined rules may be applied to packet flows according to the custom rules specified by the client and applied by a client rules service implemented on the provider network external to the host device or on a client resource instance on the host device. The custom network rules may, for example, extend or modify standard network rules for the client's resources on the host device.

Abstract: Methods and apparatus for providing rating and usage models for IP traffic to and from clients' resource instances in a provider network environment. A service provider may implement rating and usage models that may be used to associate provider network addresses with address ranges of external networks. The models may be provided to or selected by clients and applied to traffic between the clients' provider network addresses and the addresses of user devices that are in the address ranges of external networks associated with the models. Rating models may be applied to provider network clients' usage on the provider network resulting from the clients' customers' accesses of the clients' applications on resource instances in the provider network. Usage models may be applied to the clients' customers' usage on intermediate networks when accessing the clients' applications on resource instances in the provider network.

Abstract: A system for propagating network configuration changes in a distributed computing system includes one or more processors and memory that includes instructions, that when executed by the one or more processors, cause the processors to receive a configuration propagation instructions from a client, receive a network configuration change request from the client, generate a first command instruction, and transmit the first command instruction to one or more of a plurality of network devices in accordance with the configuration propagation instruction. The first command instruction instructs the plurality of network devices to change state from a first state to a second state. The second state corresponds with a network configuration contained in the network configuration change request.

Abstract: Components associated with the management, instantiation, and control of instances, such as virtual machine instances, are configurable for immutability. In some embodiments, immutability is requested for one or more functionalities affecting or otherwise associated with an instance. Information regarding the request, as well as the requested immutability, may be propagated to one or more components, such as management components, for enforcement. Instances configured to have some or part of their functionality designated as immutable may be used to implement some or all of the management components themselves, and thus be used as a part (or entirety) of a management subsystem for other instantiations.

Abstract: Disclosed are various embodiments for employing spillover tables that may improve the performance of data store updates. In some embodiments, transaction data that specifies a value by which to adjust a field in a data table is received. The field in the data table is associated with a predefined constraint. An attempt to obtain an exclusive lock for at least a portion of the data table is initiated. Whether the value has a potential to cause the predefined constraint to remain satisfied is identified. The transaction data is stored in a spillover table in response to a failure to obtain the exclusive lock and in further response to the value having the potential to cause the predefined constraint to remain satisfied.

Abstract: A computing system includes one or more processors and memory that includes instructions, that when executed by the one or more processors, cause the processors to receive, by a sentinel device of a data interface of a distributed computing environment, command instructions that instruct a plurality of networking devices to change state to implement network configuration requests from a synchronization node of a distribution interface of the distributed computing environment utilizing a communication protocol. The data interface includes a networking group that includes the sentinel device and the edge devices. The instructions also cause the processors to identify, by the sentinel device, distribution latency patterns of the command instructions based on distribution delay of the command instructions and generate, by the sentinel device, an alarm based on a determination that the distribution delay of one of the command instructions exceeds a threshold value.

Abstract: Techniques and solutions are provided for performing automated allocation of Internet Protocol (IP) addresses. For example, automated allocation of IP addresses can be performed by determining that remaining IP addresses in an available IP address pool are below a threshold value, obtaining a range of contiguous IP addresses from a common spare IP address pool, and allocating the range of contiguous IP addresses from the common spare IP address pool to the available IP address pool. The available IP address pool can then be used to allocate IP addresses to instances and/or services.

Abstract: Disclosed are various embodiments for employing spillover tables to improve performance of data store updates. A request to update a data field is received, and if an exclusive lock on a data table cannot be obtained, the request is placed in a spillover table until the exclusive lock can be obtained. If the request causes a constraint on the data field to be violated or causes the data field to move closer to the constraint, the request is not placed in the spillover table. A spillover task can collapse entries in the spillover table into the data store when an exclusive lock can be obtained.

Abstract: Disclosed are various embodiments for facilitating data redistribution in database sharding. A database is maintained that is horizontally partitioned into a set of first buckets using modulo-based assignments. A fixed number of the first buckets are stored in each of multiple physical data stores. The database is repartitioned into a set of second buckets using modulo-based assignments. The number of second buckets in the set is a multiple of the sum of a positive integer and the quantity of the physical data stores. The data in the database is unmoved between the physical data stores by repartitioning.