Abstract: Techniques are described for providing a policy refiner application used to analyze and recommend modifications to identity and access management policies created by users of a cloud provider network (e.g., to move the policies toward least-privilege permissions). A policy refiner application receives as input a policy to analyze, and a log of events related to activity associated with one or more accounts of a cloud provider network. The policy refiner application can identify, from the log of events, actions that were permitted based on particular statements contained in the policy. Based on field values contained in the corresponding events, the policy refiner application generates an abstraction of the field values, where the abstraction of the field values may represent a more restrictive version of the field from a policy perspective. These abstractions can be presented to users as recommendations for modifying their policy to reduce the privileges granted by the policy.

Abstract: A network switch holds a routing table and a network topology table so that when a link failure is detected at the network switch, the network switch may independently reroute a packet intended for that failed link using the network topology table. This processing can be performed in the data plane at a speed that can eliminate dropped packets. Intercommunication with a central controller is not required and intercommunication with other network switches may be accomplished through data plane communication by embedding the link failure information in the affected packet.

Abstract: A network switch holds a routing table and a network topology table so that when a link failure is detected at the network switch, the network switch may independently reroute a packet intended for that failed link using the network topology table. This processing can be performed in the data plane at a speed that can eliminate dropped packets. Intercommunication with a central controller is not required and intercommunication with other network switches may be accomplished through data plane communication by embedding the link failure information in the affected packet.

Abstract: The claimed subject matter includes techniques for processing gestures. An example method includes receiving a gesture from an application. The gesture includes one or more primitives from a language that is domain-specific to gestures. The method also further includes receiving skeletal data from a motion detection system. The method also includes comparing the skeletal data with the gesture from the application in a runtime module. The method also further includes sending a gesture event to the application.

Abstract: Functionality is described herein by which plural environment-sensing applications capture information from an environment in a fine-grained and least-privileged manner. By doing so, the functionality reduces the risk that private information that appears within the environment will be released to unauthorized parties. Among other aspects, the functionality provides an error correction mechanism for reducing the incidence of false positives in the detection of objects, an offloading technique for delegating computationally intensive recognition tasks to a remote computing framework, and a visualization module by which a user may inspect the access rights to be granted (or already granted) to each application.

Abstract: The claimed subject matter includes techniques for processing gestures. An example method includes receiving a gesture from an application. The gesture includes one or more primitives from a language that is domain-specific to gestures. The method also further includes receiving skeletal data from a motion detection system. The method also includes comparing the skeletal data with the gesture from the application in a runtime module. The method also further includes sending a gesture event to the application.

Abstract: Functionality is described herein by which plural environment-sensing applications capture information from an environment in a fine-grained and least-privileged manner. By doing so, the functionality reduces the risk that private information that appears within the environment will be released to unauthorized parties. Among other aspects, the functionality provides an error correction mechanism for reducing the incidence of false positives in the detection of objects, an offloading technique for delegating computationally intensive recognition tasks to a remote computing framework, and a visualization module by which a user may inspect the access rights to be granted (or already granted) to each application.