Abstract: A computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by public and/or private certificate authorities. In an embodiment, customers may use the certificate management service to generate private certificate authority which can issue signed certificates to network entities within the customer enterprise. In an embodiment, the private certificate authority is hosted by the computing resource service provider, and the certificate management service automates the renewal and management of active certificates. In an embodiment, the certificate management service allows customer applications to create, renew, and revoke certificates issued by both private and public certificate authorities via an application programming interface.

Abstract: A first analysis based on at least a subset of collected health metrics of a monitored resource is performed at a health monitoring service. If the first analysis indicates that the probability that the monitored resource is in an unhealthy state is above a threshold, a mitigation action that includes directing at least some of the workload away from the monitored resource is implemented. In addition, a remediation analysis of the monitored resource is started to determine, using at least one additional health metric that was not examined in the first analysis, whether a longer-term remediation action is to be initiated.

Abstract: A first analysis based on at least a subset of collected health metrics of a monitored resource is performed at a health monitoring service. If the first analysis indicates that the probability that the monitored resource is in an unhealthy state is above a threshold, a mitigation action that includes directing at least some of the workload away from the monitored resource is implemented. In addition, a remediation analysis of the monitored resource is started to determine, using at least one additional health metric that was not examined in the first analysis, whether a longer-term remediation action is to be initiated.

Abstract: Techniques are described for enabling users of a certificate management service to create certificate issuance policies that can be applied to certificate issuance requests across both public and private certificate authorities (CAs) and other certificate-related services. According to embodiments described herein, a certificate issuance policy includes one or more certificate issuance rules to be applied to requests associated with one or more specified user accounts or roles for certificate-related resources (e.g., public certificates, private certificates, etc.). The application of a certificate issuance rule can be conditioned on a particular request context (e.g., based on a user account or role associated with a request, a type of certificate requested, a subject name identified in the request, etc.) and can specify a wide range of actions to be performed on requests matching a rule (e.g., allowing or denying a request, modifying one or more parameters of the request, etc.).

Abstract: Techniques for validating digital certificate information before signing are described. A method of validating digital certificate information before signing may include generating a to-be-signed (TBS) certificate, providing the TBS certificate to a certificate pre-issuance validation service to perform one or more validations on the TBS certificate, and receiving a request to issue a signed certificate based on the TBS certificate following validation of the TBS certificate by the certificate pre-issuance validation service.

Abstract: A computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by public and/or private certificate authorities. In an embodiment, when a new certificate is generated, a certificate template is used to apply various settings and policies for the new certificate. In various examples, templates may be used to establish default values, enforce required and optional values, place restrictions on one or more data fields, and enforce signature requirements. In some embodiments, the template establishes rules for rejecting certificate requests that don't conform to the template.

Abstract: Systems and method for generating and managing certificate authorities. For instance, a certificate service may provide one or more user interfaces for creating certificate authorities, such as a root certificate authority, a subordinate certificate authority, and/or an intermediate certificate authority. For example, a user may use a user device to create a certificate hierarchy. The certificate service may also provide one or more user interfaces for issuing certificates using the certificate authorities. One or more computing resources may then use the end-entity certificates issued from the certificate authority hierarchy for authentication and/or encryption. For security purposes, the certificate authority may also allow the user to set policies representing users that are able to access and/or utilize the certificate authorities to perform actions, such as issuing certificates.

Abstract: In an embodiment, a computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by private certificate authorities. In an embodiment, a private certificate authority hosted by the computing resource service provider is able to issue signed certificates to network entities within the customer enterprise. In an embodiment, the certificate management service provides a network-accessible application programming interface to the private certificate authority that allows applications to create and deploy private certificates programmatically. In an embodiment, the system provides the flexibility to create private certificates for applications that require custom certificate lifetimes or resource names.

Abstract: A first analysis based on at least a subset of collected health metrics of a monitored resource is performed at a health monitoring service. If the first analysis indicates that the probability that the monitored resource is in an unhealthy state is above a threshold, a mitigation action that includes directing at least some of the workload away from the monitored resource is implemented. In addition, a remediation analysis of the monitored resource is started to determine, using at least one additional health metric that was not examined in the first analysis, whether a longer-term remediation action is to be initiated.

Abstract: A first analysis based on at least a subset of collected health metrics of a monitored resource is performed at a health monitoring service. If the first analysis indicates that the probability that the monitored resource is in an unhealthy state is above a threshold, a mitigation action that includes directing at least some of the workload away from the monitored resource is implemented. In addition, a remediation analysis of the monitored resource is started to determine, using at least one additional health metric that was not examined in the first analysis, whether a longer-term remediation action is to be initiated.

Abstract: Domain Name System (DNS) requests can be routed to either a private DNS server or a public DNS server based on a determination made by a DNS classifier. The private DNS server allows customers to use custom DNS names for internal resources without exposing the names or IP addresses to the public Internet.

Abstract: A message indicating a route to a network destination is received at a routing service from a particular routing device of a provider network. The message is formatted in accordance with a set of APIs implemented using a stateless protocol, and indicates a route to a particular network destination associated with a particular RIB stored at a persistent data store accessible from various nodes of the routing service. The RIB is modified accordingly. A routing service back-end node generates an entry of a forwarding information base (FIB) associated with the particular RIB. The FIB entry is transmitted to one or more routing devices including the particular routing device, and is used to forward data packets of one or more other services.