Abstract: A feature deployment service of a provider network may deploy feature processing units (FPUs) to implement data processing features at both a provider network and edge devices. The use of FPUs may allow a client to use new features at the edge, without delays due to compliance/testing or software upgrades. An FPU includes a model and compute logic that are used to implement a data processing feature. A feature processing service deploys the FPU to an FPU engine at the provider network and also deploys the FPU to edge devices of the client's network that each include an edge FPU engine. The FPU engine at the provider network and the edge FPU engine at each edge device conform to a common specification/API, allowing deployment and use of the same FPU/data processing features at both the cloud and the edge.

Abstract: A feature deployment service of a provider network may deploy feature processing units (FPUs) to implement data processing features at both a provider network and edge devices. The use of FPUs may allow a client to use new features at the edge, without delays due to compliance/testing or software upgrades. An FPU includes a model and compute logic that are used to implement a data processing feature. A feature processing service deploys the FPU to an FPU engine at the provider network and also deploys the FPU to edge devices of the client's network that each include an edge FPU engine. The FPU engine at the provider network and the edge FPU engine at each edge device conform to a common specification/API, allowing deployment and use of the same FPU/data processing features at both the cloud and the edge.

Abstract: A workload adaptation service of a provider network may perform smart deployment of industrial an IoT workload across resources of a provider network and a client network. The workload adaptation service may receive, from a user, an indication of one or more constraints for performance of a workload (e.g., daily upload limit, maximum acceptable latency). The service determines a deployment for the workload across client resources and provider resources based at least on the constraints. The service deploys portions of the workload to the client network and other portions to the provider network according to the deployment. The workload adaptation service may also perform dynamic adaptation of the IoT workload by moving portions of the workload from the client network to the provider network or vice-versa, based on workload performance metrics or based on changes to the available resources.

Abstract: A device management service at a provider network may assign a contextual identity to a newly installed device at a client network based on proximity of other devices to the new device. When a new device is installed on a client network, the device broadcasts a request for proximity data. When another device receives the request, it generates proximity data. For example, it may measure a strength of the radio signal received from the new device, which varies depending on how close the devices are. The new device receives proximity data from the other devices on the client network. The new device then transmits the proximity data to a device management service. The device management service uses an algorithm to determine an estimated location of the new device based on the proximity data. The device management service determines a contextual identity of the new device based on the estimated location.

Abstract: A device management service to facilitate onboarding of a remote IoT device may receive, from a client service, a request for a session certificate for a remote device. The device management service may send the session certificate to the client service, where the session certificate is valid for the remote device to obtain a primary certificate during a session duration. The device management service may receive, from the remote device, a request for the primary certificate for the remote device. The device management service may send, to the remote device, the primary certificate, wherein the primary certificate enables communication between the remote device and the device management service, and wherein the primary certificate has a primary duration that is longer than the session duration. The device management service may establish a communication channel with the remote device according to the primary certificate.

Abstract: At a computing device, contents of one or more transaction records are obtained from a record-keeping network at which a decentralized consensus-based protocol is used to store transaction records of administrator changes of various devices. Using the contents of the obtained records, an administrator of the computing device is identified, as well as a network endpoint of the administrator. A set of instructions is obtained from the endpoint and executed.

Abstract: A workload adaptation service of a provider network may perform smart deployment of industrial an IoT workload across resources of a provider network and a client network. The workload adaptation service may receive, from a user, an indication of one or more constraints for performance of a workload (e.g., daily upload limit, maximum acceptable latency). The service determines a deployment for the workload across client resources and provider resources based at least on the constraints. The service deploys portions of the workload to the client network and other portions to the provider network according to the deployment. The workload adaptation service may also perform dynamic adaptation of the IoT workload by moving portions of the workload from the client network to the provider network or vice-versa, based on workload performance metrics or based on changes to the available resources.

Abstract: Methods, systems, and computer-readable media for template-based onboarding of internet-connectible devices are disclosed. A device onboarding service receives an onboarding request comprising a proof and context of identity (PCI) of an Internet-connectible device (ICD). The service determines an account associated with the ICD based at least in part on the onboarding request. The account is associated with an account policy in an onboarding template that is determined at least in part by an owner of the account. If the PCI is verified against one or more criteria of the onboarding template, then a device configuration is determined based at least in part on the onboarding template. The service sends the device configuration to the ICD, and the ICD's behavior is determined at least in part on the device configuration. The ICD uses the access credentials of the device configuration to communicate with an application in a cloud computing environment.

Abstract: A technology is described for connecting a device to a network. An example method may include identifying a preinstalled network configuration for a default wireless network from device memory. The preinstalled network configuration may be used by the device to connect to the default wireless network and obtain a local network configuration for a local wireless network. Thereafter, the device may disconnect from the default wireless network and connect to the local wireless network using the local network configuration.

Abstract: A device management service at a provider network may assign a contextual identity to a newly installed device at a client network based on proximity of other devices to the new device. When a new device is installed on a client network, the device broadcasts a request for proximity data. When another device receives the request, it generates proximity data. For example, it may measure a strength of the radio signal received from the new device, which varies depending on how close the devices are. The new device receives proximity data from the other devices on the client network. The new device then transmits the proximity data to a device management service. The device management service uses an algorithm to determine an estimated location of the new device based on the proximity data. The device management service determines a contextual identity of the new device based on the estimated location.

Abstract: Methods, systems, and computer-readable media for template-based onboarding of internet-connectible devices are disclosed. A device onboarding service receives an onboarding request comprising a proof and context of identity (PCI) of an Internet-connectible device (ICD). The service determines an account associated with the ICD based at least in part on the onboarding request. The account is associated with an account policy in an onboarding template that is determined at least in part by an owner of the account. If the PCI is verified against one or more criteria of the onboarding template, then a device configuration is determined based at least in part on the onboarding template. The service sends the device to the ICD, and the ICD's behavior is determined at least in part on the device configuration. The ICD uses the access credentials of the device configuration to communicate with an application in a cloud computing environment.