Abstract: Provided herein are systems, methods, and computer-storage media for credential-less access to remote resources. An example method includes creating, by at least one hardware processor, a security integration object. The security integration object includes an identification of a role associated with access to an external resource. The method includes creating a secret object comprising a token associated with the security integration object. The method includes binding the security integration object and the secret object to generate a storage integration object. The storage integration object includes an external access integration. The method includes retrieving a cloud provider token during execution of a user-defined function (UDF). The method includes granting the UDF access to the external resource based on authenticating the cloud provider token using the external access integration.

Abstract: To provide outbound private link support for a multi-tenant data system with tenant isolation, a separate, dedicated virtual network is provided, referred to as private link (PL) virtual network. The PL virtual network may host a plurality of host interface endpoints and resource endpoints. A core virtual network and the PL virtual network may be peered together to work in conjunction. The private endpoints in the PL virtual network may then be connected to external systems using a private link without exposure to the public internet.

Abstract: The subject technology receives, by one or more hardware processors, a request to execute a user-defined function (UDF) within a sandbox process. The subject technology establishes a secure egress path for the UDF using an overlay network, where the overlay network includes a dedicated DNS resolver at a proxy service. The subject technology receives, from the UDF, a DNS request to resolve a hostname. The subject technology validates, by the proxy service, that the hostname is included in an allowed host list associated with the UDF. The subject technology resolves, by the dedicated DNS resolver, the hostname to an IP address using a UDP listener configured to handle DNS protocol traffic on a designated port of the proxy service. The subject technology enables the UDF to communicate with a host at the resolved IP address via the secure egress path.

Abstract: Systems and methods are disclosed for securely executing user-defined functions within a cloud data platform. A method involves receiving, via hardware processors, a request to execute a user-defined function (UDF) contained within a sandbox process. The UDF comprises code for performing specified operations that necessitate access to external resources. To facilitate this access, a secure egress path is established using an overlay network designed to isolate the UDF's network traffic from other processes. Authentication and authorization details for the UDF are managed externally to the sandbox process, ensuring that the UDF's functionality remains orthogonal to the cloud data platform's operations. This approach enables the secure and controlled execution of UDFs, allowing them to interact with external systems while maintaining the integrity and security of the cloud data platform environment.

Abstract: This disclosure provides methods and techniques of performing source network address translation (SNAT) at a packet sender (e.g., a client device) instead of a gateway device (e.g., a proxy device). The present disclosure performs a SNAT operation at the packet sender, relieving the gateway device from the SNAT operation to perform other duties (e.g., policy enforcement). An example method of network address translation includes modifying, by a processing device at a data packet origination device (e.g., a client device), network address information in an internet protocol (IP) header of a packet using a public IP address. The method further includes sending the packet to a public network based on the public IP address.

Abstract: Systems and methods are disclosed for securely executing user-defined functions within a cloud data platform. A method involves receiving, via hardware processors, a request to execute a user-defined function (UDF) contained within a sandbox process. The UDF comprises code for performing specified operations that necessitate access to external resources. To facilitate this access, a secure egress path is established using an overlay network designed to isolate the UDF's network traffic from other processes. Authentication and authorization details for the UDF are managed externally to the sandbox process, ensuring that the UDF's functionality remains orthogonal to the cloud data platform's operations. This approach enables the secure and controlled execution of UDFs, allowing them to interact with external systems while maintaining the integrity and security of the cloud data platform environment.

Abstract: Methods, systems, and computer programs are presented for enabling any sandboxed user-defined function code to securely access the Internet via a cloud data platform. A remote procedure call is received by a cloud data platform from a user-defined function (UDF) executing within a sandbox process. The UDF includes code related to at least one operation to be performed. The cloud data platform provides an overlay network to establish a secure egress path for UDF external access. The cloud data platform enables the UDF executing in the sandbox process to initiate a network call.

Abstract: An apparatus is provided for extending a data model. The apparatus may include at least one memory and at least one processor configured to provide information to a queue responsive to detection of new data associated with a user or an encounter or detection of modified data associated with the user or encounter. The processor is also configured to identify a pattern(s) based on analyzing the information in the queue. The information includes content of the new data or the modified data. The patterns include instructions specifying a calculation(s) for execution based on usage of the new data or the modified data. The processor is also configured to provide results of the calculation(s) to a database to enable access of the results by an application(s) or a communication device(s) responsive to executing a pattern(s) and determining the results of the calculation. Corresponding computer program products and methods are also provided.

Abstract: Methods and apparatus to correlate healthcare information are disclosed. An example method includes receiving a healthcare message from a first entity of a healthcare enterprise, wherein the healthcare message is configured according to a first identification schema of the first entity; identifying one or more subjects of the healthcare message for correlation into an electronic clinical information system; selecting one of a plurality of correlators for each identified subject to correlate each identified subject, wherein each of the correlators are customizable to handle a specific type of healthcare message subject; and correlating the identified subjects of the message to associate each of the identified subjects with an identifier internal to the electronic clinical information system.

Abstract: Methods and apparatus to correlate healthcare information are disclosed. An example method includes receiving a healthcare message from a first entity of a healthcare enterprise, wherein the healthcare message is configured according to a first identification schema of the first entity; identifying one or more subjects of the healthcare message for correlation into an electronic clinical information system; selecting one of a plurality of correlators for each identified subject to correlate each identified subject, wherein each of the correlators are customizable to handle a specific type of healthcare message subject; and correlating the identified subjects of the message to associate each of the identified subjects with an identifier internal to the electronic clinical information system.

Abstract: Methods and apparatus for dynamic customization of clinical workflows are disclosed. An example method includes receiving a script that implements one or more actions of a clinical workflow from a first healthcare entity that utilizes an electronic clinical information system, wherein the electronic clinical information system aggregates healthcare information from a plurality of healthcare entities including the first healthcare entity; loading the script into a dynamic module core framework that interacts with a runtime environment to execute application bundles; and publishing the script of the dynamic module core framework to the runtime environment such that the clinical workflow is installed into the electronic clinical information system dynamically at runtime.

Abstract: Methods and apparatus to manage instances of an enterprise clinical information system are disclosed.