Abstract: An administrative agent running at a virtualization host of a network-accessible virtualized computing service determines that a first virtual machine is to be instantiated. The agent initiates at least a first configuration operation to enable connectivity for at least a portion of network traffic associated with the first virtual machine. The first configuration operation is performed at least in part using a first virtualization offloading card of the virtualization host. The agent causes a virtualization intermediary process of the virtualization host to launch one or more execution threads of the virtualization intermediary process to implement the first virtual machine. The intermediary process may be swapped to persistent storage, e.g., based on an analysis of resources of the virtualization host.

Abstract: A number of cells of a control plane of a virtualized computing service are set up, including a first cell with one or more request processing nodes, a local instance of a data store, and metadata indicating a set of virtualization hosts. A request processer transmits a request for a virtual machine to the first cell. A request processor of the cell initiates a workflow to launch the virtual machine using a virtualization host; the workflow includes storing a record of the request in the local instance of the data store.

Abstract: A number of cells of a control plane of a virtualized computing service are set up, including a first cell with one or more request processing nodes, a local instance of a data store, and metadata indicating a set of virtualization hosts. A request processer transmits a request for a virtual machine to the first cell. A request processor of the cell initiates a workflow to launch the virtual machine using a virtualization host; the workflow includes storing a record of the request in the local instance of the data store.

Abstract: Techniques are disclosed for auditing an IP address prefix that has been assigned to an entity as part of an administrator policy, to determine whether the assignment was implemented on the network. In an embodiment, associations between IP addresses and their assignment are stored in a database. IP addresses are read and semi-authoritative sources (e.g., DNS servers) are queried for information about the IP addresses. Information received in response to the query may be used to validate the IP address (e.g., in a network, all IP addresses used for VM instances will have a corresponding URL in a specific format).

Abstract: An administrative agent running at a virtualization host of a network-accessible virtualized computing service determines that a first virtual machine is to be instantiated. The agent initiates at least a first configuration operation to enable connectivity for at least a portion of network traffic associated with the first virtual machine. The first configuration operation is performed at least in part using a first virtualization offloading card of the virtualization host. The agent causes a virtualization intermediary process of the virtualization host to launch one or more execution threads of the virtualization intermediary process to implement the first virtual machine. The intermediary process may be swapped to persistent storage, e.g., based on an analysis of resources of the virtualization host.

Abstract: A number of cells of a control plane of a virtualized computing service are set up, including a first cell with one or more request processing nodes, a local instance of a data store, and metadata indicating a set of virtualization hosts. A request processer transmits a request for a virtual machine to the first cell. A request processor of the cell initiates a workflow to launch the virtual machine using a virtualization host; the workflow includes storing a record of the request in the local instance of the data store.

Abstract: A traffic analyzer of a provider network identifies endpoint categories into which traffic directed to or from a first isolated virtual network of the provider network is to be classified. A first endpoint category includes an endpoint configured in a second isolated virtual network. Using packet-level metrics collected at virtualization management components of virtualization hosts, the traffic analyzer determines the amount of data transmitted between the first isolated virtual network and the various endpoint categories during selected time intervals. The traffic analyzer provides the categorized traffic amounts as input to a predictive model, and stores expected future traffic trends generated by the model.

Abstract: A request to establish a VPN connection between a customer data center and a set of resources of a provider network is received. A new isolated virtual network (IVN) is established to implement a virtual private gateway to be used for the connection. One or more protocol processing engines (PPEs) are instantiated within the IVN, and a respective VPN tunnel is configured between each of the PPEs and the customer data center. Routing information pertaining to the set of resources is provided to the customer data center via at least one of the VPN tunnels, enabling routing of customer data to the set of resources within the provider network from the customer data center.

Abstract: Methods and apparatus for bandwidth metering in large-scale networks are disclosed. Metadata for a network transmission involving a virtualized resource at a host of a provider network, including endpoint address information and a traffic metric, is determined at a metering component. The metadata is aggregated at another metering component and provided to a traffic classification node. The traffic classification node generates a categorized usage record for the network transmission, based at least in part on network topology information associated with the provider network. The categorized usage record is used to determine a billing amount for the network transmission.

Abstract: Distributed computer systems prepare and instantiate snapshots by processing sets of nodes representing computer resources that are portions of a larger system. A user may choose to prepare or instantiate a snapshot containing all or only a portion of the data within the distributed computer system, such as a template of the distributed computer system. A template snapshot may be available in an electronic marketplace for other users to purchase and instantiate into a replica of the distributed computer system.

Abstract: Methods and apparatus for bandwidth metering in large-scale networks are disclosed. Metadata for a network transmission involving a virtualized resource at a host of a provider network, including endpoint address information and a traffic metric, is determined at a metering component. The metadata is aggregated at another metering component and provided to a traffic classification node. The traffic classification node generates a categorized usage record for the network transmission, based at least in part on network topology information associated with the provider network. The categorized usage record is used to determine a billing amount for the network transmission.