Abstract: The updating of a definition layer or schema for a large distributed database can be accomplished using a plurality of data store tiers. A distributed database can be made up of many individual data stores, and these data stores can be allocated across a set of tiers based on business logic or other allocation criteria. The update can be applied sequentially to the individual tiers, such that only data stores for a single tier are being updated at any given time. This can help to minimize downtime for the database as a whole, and can help to minimize problems that may result from an unsuccessful update. Such an approach can also allow for simplified error detection and rollback, as well as providing control over a rate at which the update is applied to the various data stores of the distributed database.

Abstract: A key distribution host determines a trust level of a user authentication server, wherein the trust level is based, at least in part, on one or more attributes of the user authentication server and provides one or more authentication keys to the user authentication server only if the trust level of the user authentication server is above a threshold value.

Abstract: A policy management service receives a request to associate a version of a computing resource policy as a default version of the policy. In response to the request, the service identifies, from a policy database, an entry for the default version of the policy. The service updates the entry in order to associate the version specified in the request as the default version of the policy. This results in the version of the policy becoming applicable to control access to the computing resources associated with principals associated with the default version of the policy.

Abstract: A consistent view of associations between independently replicated data objects may be provided. Data objects may be stored in separate data stores. Copies of the data stores may also store the data objects. The copies of the data stores may independently receive the data objects to be stored as part of independently replicating data stores to one or more copies of the data stores. An association can be created between objects in the different data store. If when the association is created it is determined that a referenced object is not yet stored in a copy of a data store, then both the association and the referenced object may be stored in the same data store so that the association and the referenced object are replicated together to a copy of the same data store.

Abstract: A security token service receives a request for a token. The request indicates a set of access control policies that define a set of permissions for access to a resource. The security token service generates the token to comprise a set of identifiers of the set of access control policies. The security token service provides the token in response to the request to enable the token to be used to access the resource in accordance with the set of access control policies.

Abstract: A key distribution host determines a trust level of a user authentication server, wherein the trust level is based, at least in part, on one or more attributes of the user authentication server and provides one or more authentication keys to the user authentication server only if the trust level of the user authentication server is above a threshold value.