Abstract: A data storage and retrieval system stores a collection of data in which a first portion is encrypted using a first cryptographic key, and comprises a second portion encrypting using a second cryptographic key. The data storage and retrieval system receives a request to query the collection on behalf of a security principal. The request comprises information indicative of the first and second keys. The system confirms the authorization of the security principal to access at least some of the collection of data, and generates intermediate results which comprise the encrypted first and second portions. The system causes the intermediate results to be decrypted using the first and second key information.

Abstract: Technology is described for detecting a presence of a hardware assisted overlay network. An agent running on a host in a service provider environment may receive an assistance identifier that is assigned to a gateway associated with the host in the service provider environment. The agent running on the host may determine that the host is running in a hardware assisted overlay network operating in the service provider environment using the assistance identifier of the gateway. The agent running on the host may initiate a hardware assisted function that uses hardware resources accessible to the hardware assisted overlay network.

Abstract: A technology is described for emulating a multicast network. An example method may include receiving a data transaction request at a data store service. The data transaction request may contain a network packet for multicast distribution to destination clients, and the data transaction request may be received from a source client having a multicast conversion driver configured to convert the network packet into a data transaction request format. A determination may be made that the data transaction request is a multicast request to distribute the network packet to the destination clients. Having determined that the data transaction request is a multicast request, destination clients that are subscribed to receive the multicast group communication may be determined. A data record containing the network packet may be distributed to the destination clients, where the destination clients have the multicast conversion driver configured to convert the data record to the network packet.

Abstract: Embodiments presented herein disclose a VPN service which includes a cluster of VPN appliances that requires only an eventually consistent database to share VPN session data among cluster nodes. Doing so provides a VPN service that can scale both horizontally (i.e., the VPN service can support large numbers of VPN appliances) as well as geographically (i.e., nodes of the cluster do not need to be physically proximate to one another in order to satisfy latency requirements). Thus, the VPN service can provide regional endpoints to VPN clients that do not share common points of failure or administrative burdens.

Abstract: A technology is provided for proxying network traffic. A computer system activates a proxy function in response to a network communication identified in a compute service of a service provider environment. The system receives parameters from the network communication originating from a client at the proxy function and the parameters identify a destination function and a network packet. The proxy function is applied to the network packet. The system launches the destination function with the network packet and parameters from the proxy function, wherein the destination function is configured to launch on a computing instance of the compute service.

Abstract: Techniques are disclosed for monitoring the health of a computing application, system or service. A health monitoring service performs event driven health status checks for applications that use non-HTTP workloads. To do so, heath status messages (e.g., HTTP status requests) are directed to an API gateway at a specified frequency. In response to each health status message, the API gateway triggers at least a first event driven function to perform a health check of an application. Results of the health-status check performed by the first event driven function may be written to a status database. Further, results of the first event driven function can result in additional event driven functions being triggered (e.g., to remove an unhealthy application from production use).

Abstract: Technology is described for removing sensitive information. An audio block that represents a portion of a conversation may be identified. A text representation for the audio block may be obtained using a speech-to-text process. The text representation for the audio block may be compared to pattern rules to mark sensitive information in the audio block. A portion of audio data from the audio block marked as sensitive information may be removed in the audio block.

Abstract: A technology is described for selecting a distributed network service based at least in part on consistency, availability, and partition tolerance (CAP) metrics. An example method may include receiving a client request for a listing of distributed network services and associated CAP metrics that are within a range of at least one CAP specification included in the client request. In response to the client request, a directory service may be queried for a set of distributed network services having the CAP metrics that are within the range of the least one CAP specification included in the client request. A listing of distributed network services that includes the CAP metrics for the distributed network services may be generated from the set of distributed network services, and the listing of distributed network services and CAP metrics may be returned in response to the client request.

Abstract: Embodiments presented herein disclose a VPN service which includes a cluster of VPN appliances that requires only an eventually consistent database to share VPN session data among cluster nodes. Doing so provides a VPN service that can scale both horizontally (i.e., the VPN service can support large numbers of VPN appliances) as well as geographically (i.e., nodes of the cluster do not need to be physically proximate to one another in order to satisfy latency requirements). Thus, the VPN service can provide regional endpoints to VPN clients that do not share common points of failure or administrative burdens.

Abstract: A network traffic processing device (NTPD) implements a plurality of virtual network traffic processing devices (VNTPDs), a control plane, and an NTPD manager. The plurality of VNTPDs are configured to perform respective versions of a network processing function on network transmissions, where at least two of the respective versions are different. The control plane is configured to select, for a network transmission based on a management policy, one or more of the VNTPDs to perform respective versions of the network processing function. The NTPD manager is configured to monitor results of the selected VNTPDs performing the respective versions of the network processing function and, based on the monitored results, to determine a configuration change for one or more of the VNTPDs or to control output of the network transmission.