Abstract: Systems for processing requests to use virtual computing resources in communicatively isolated computing environments apply a multi-tier framework for limiting the amount of virtual computing resources that can be allocated to a user in a computing environment. A bottom tier is associated with a user account that has not been analyzed for security risks, a top tier is associated with a user account that has been validated to use a corresponding computing environment; an intermediate tier, having limits between the bottom and top tiers, is applied to computing environments where the user has not requested resources. Initially, all computing environments are on the bottom tier. In response to a valid request for resources, validated computing environments are moved to the top tier and all other computing environments are moved to the intermediate tier. Requests in an intermediate-tier computing environment trigger validity review; the computing environment can move to top tier.

Abstract: Methods and apparatus for a client account versioning metadata manager for cloud computing environments are disclosed. A system includes a plurality of resources, a plurality of service managers coordinating respective multitenant network-accessible services, and a metadata manager. The metadata manager receives a multi-service account state view request. The metadata manager generates a representation of an administrative state of a client account indicated by the request with respect a plurality of services accessible by the client account, as of a time indicated in the request. The administrative state with respect to a particular service comprises an indication of an assignment to the client account of resources participating in implementation of the particular service.

Abstract: Methods and apparatus for a client account versioning metadata manager for cloud computing environments are disclosed. A system includes a plurality of resources, a plurality of service managers coordinating respective multitenant network-accessible services, and a metadata manager. The metadata manager receives a multi-service account state view request. The metadata manager generates a representation of an administrative state of a client account indicated by the request with respect a plurality of services accessible by the client account, as of a time indicated in the request. The administrative state with respect to a particular service comprises an indication of an assignment to the client account of resources participating in implementation of the particular service.

Abstract: Methods and apparatus for an account state simulation service for cloud computing environments are disclosed. A system includes a plurality of service managers coordinating respective distributed network-accessible services, and a metadata manager. The metadata manager receives an account state change simulation request, indicating (a) an initial account state of a client account and (b) a collection of operations to be simulated. The metadata manager generates a response to the account change state simulation request, comprising at least one of (a) a representation of an expected end state of the client account reachable as a result of performing the collection of operations (b) an indication of an expected failure of a particular operation of the collection of operations or (c) an estimate of an expected billing amount associated with an implementation of the collection of operations.

Abstract: Methods and apparatus for a mixed-mode authorization metadata manager for cloud computing environments are disclosed. A system includes a plurality of service managers coordinating respective distributed multitenant services, and a metadata manager. In response to a metadata request for an authorization entity, the metadata manager identifies a first and a second service manager coordinating services in use by a client account with which the authorization entity is affiliated. The first and second service managers implement respective authorization APIs. The metadata manager provides composite authorization metadata of the authorization entity based at least in part on (a) service authorization metadata provided by each of the first and second service managers and (b) identity authorization metadata provided by an identity manager.

Abstract: Methods and apparatus for an account state simulation service for cloud computing environments are disclosed. A system includes a plurality of service managers coordinating respective distributed network-accessible services, and a metadata manager. The metadata manager receives an account state change simulation request, indicating (a) an initial account state of a client account and (b) a collection of operations to be simulated. The metadata manager generates a response to the account change state simulation request, comprising at least one of (a) a representation of an expected end state of the client account reachable as a result of performing the collection of operations (b) an indication of an expected failure of a particular operation of the collection of operations or (c) an estimate of an expected billing amount associated with an implementation of the collection of operations.

Abstract: Methods and apparatus for an account state simulation service for cloud computing environments are disclosed. A system includes a plurality of service managers coordinating respective distributed network-accessible services, and a metadata manager. The metadata manager receives an account state change simulation request, indicating (a) an initial account state of a client account and (b) a collection of operations to be simulated. The metadata manager generates a response to the account change state simulation request, comprising at least one of (a) a representation of an expected end state of the client account reachable as a result of performing the collection of operations (b) an indication of an expected failure of a particular operation of the collection of operations or (c) an estimate of an expected billing amount associated with an implementation of the collection of operations.

Abstract: Methods and apparatus for an account cloning service for cloud computing environments are disclosed. A system includes a plurality of resources, a plurality of service managers coordinating respective distributed network-accessible services, and a metadata manager. The metadata manager receives an account cloning request specifying a source client account. The metadata manager identifies a representation of an administrative state of the source client account with respect to a plurality of services, including configuration settings of an original set of resources of the plurality of resources providing functionality of the set of services. The metadata manager stores a record of an association of a clone client account of the particular source client account with the representation of the administrative state.

Abstract: Methods and apparatus for client-specified schema extensions in cloud computing environments are disclosed. A system includes a plurality of service managers coordinating respective multitenant network-accessible services, and one or more computer servers. In response to a schema extension request specifying a client account, a client attribute set, and a client data source, the one or more computer servers generate a composite schema customized for the client account comprising (a) attributes of a plurality of resources implementing the functionality of at least one service to which the client account has access and (b) the client attribute set. In response to an account state view request specifying the client account, the one or more computer servers provide a state representation comprising (a) at least one value of a particular client attribute and (b) at least one attribute value of a resource.