Abstract: Functionality is disclosed for throughput and latency optimized volume initialization. Data blocks used for boot processes of multiple virtual machine (VM) instances are identified, for example, where the multiple VM instances are created from a specific VM image. A load order document is generated that identifies the data blocks, and also identifies an order in which the data blocks are used for the boot process. The identified data blocks are coalesced to generated a coalesced boot volume. Subsequently, each time a VM instance is created from the specific VM image, the coalesced boot volume (e.g., instead of the individual data blocks) is transmitted from a data store to the a block storage service in the order specified by the load order document. The block storage service exposes a storage volume to the VM instance that can be used to initialize the VM instance.

Abstract: The amount of drift in an oscillator, as a function of temperature, can be profiled by adjusting the temperature and monitoring the corresponding change in frequency of the oscillator. Temperature sensors on a computing device can provide the temperature readings for the profiling, as well as readings during operation. A system clock on the computing device can be synchronized with a reliable external clock at a regular interval, such as every fifteen minutes. Between those synchronizations, the temperature values provided by the temperature sensors can be determined and the corresponding oscillator drift determined according to the oscillator profile. The drift value can be used to adjust the output of the system clock to account for variations that may become present between the synchronization times. Effects of factors such as voltage and humidity can also be profiled to provide a more accurate timing signal.

Abstract: Methods and apparatus for flexible batch job scheduling in virtualization environments are disclosed. A descriptor for a batch job requested by a client is received at a job scheduling service. The descriptor comprises an indication of a time range during which a job iteration may be performed. A target time for executing the iteration is determined based on an analysis of a plurality of received descriptors. An indication of the target time at which the iteration is to be scheduled is provided to a selected execution platform.

Abstract: Techniques for configurable compute instance resets are described. A user can issue a request to securely reset one or more compute instances implemented within a service provider system. Each compute instance is reset to a previous point in time, such that any activity of the compute instance or effects thereof occurring since that point in time are completely eliminated. Each compute instance reset can include removing an existing volume of the compute instance, obtaining a volume, attaching the obtained volume to the compute instance, and rebooting the compute instance. Configuration data of the compute instance, such as an instance identifier or network addresses, can be maintained after the reset.

Abstract: Methods and apparatus for client-directed placement of remotely configured service instances are described. One or more placement target options are selected for a client of a network-accessible service based on criteria such as service characteristics of the placement targets. The selected options, including a particular placement target that includes instance hosts configurable from remote control servers, are indicated programmatically to the client. A determination is made that a service instance is to be configured at the particular placement target on behalf of the client. A remote control server is configured to issue administrative commands to an instance host at the particular placement target to configure the service instance.

Abstract: Methods and apparatus that allow clients to specify custom network rules for their resource instances or network constructs in a provider network environment. Services and interfaces may be provided that allow a client to provide an executable module that implements custom rules for their resources, or alternatively to specify or select custom rules for their resources. The module may be installed on a host device, and may apply the custom rules to packets to and from the client's resources. Alternatively, the client-defined rules may be applied to packet flows according to the custom rules specified by the client and applied by a client rules service implemented on the provider network external to the host device or on a client resource instance on the host device. The custom network rules may, for example, extend or modify standard network rules for the client's resources on the host device.

Abstract: A physical host agent receives configuration information from a virtual computer system service specifying network traffic information to be extracted from network traffic for one or more virtual machines. The agent extracts the specified network traffic information from the network traffic for the one or more virtual machines and aggregates the network traffic information into one or more data segments for storage in a repository. A publishing sub-system of the service obtains the one or more data segments and compiles the one or more data segments into data logs for delivery to an analytics service to make the network traffic information available to customers.

Abstract: Methods and apparatus for flexible batch job scheduling in virtualization environments are disclosed. A descriptor for a batch job requested by a client is received at a job scheduling service. The descriptor comprises an indication of a time range during which a job iteration may be performed. A target time for executing the iteration is determined based on an analysis of a plurality of received descriptors. An indication of the target time at which the iteration is to be scheduled is provided to a selected execution platform.

Abstract: Methods and apparatus for client-directed placement of remotely configured service instances are described. One or more placement target options are selected for a client of a network-accessible service based on criteria such as service characteristics of the placement targets. The selected options, including a particular placement target that includes instance hosts configurable from remote control servers, are indicated programmatically to the client. A determination is made that a service instance is to be configured at the particular placement target on behalf of the client. A remote control server is configured to issue administrative commands to an instance host at the particular placement target to configure the service instance.

Abstract: Methods and apparatus that allow clients to specify custom network rules for their resource instances or network constructs in a provider network environment. Services and interfaces may be provided that allow a client to provide an executable module that implements custom rules for their resources, or alternatively to specify or select custom rules for their resources. The module may be installed on a host device, and may apply the custom rules to packets to and from the client's resources. Alternatively, the client-defined rules may be applied to packet flows according to the custom rules specified by the client and applied by a client rules service implemented on the provider network external to the host device or on a client resource instance on the host device. The custom network rules may, for example, extend or modify standard network rules for the client's resources on the host device.

Abstract: Computer systems, such as a client and a server operably interconnected via a network, are subject to stress on computational resources due to an abundance of automated-user traffic. To improve resource functionalities and control the resources available to automated-agents, value information of valuable assets is encrypted such that a client must perform an algorithm for calculating a decryption key in order to view the unencrypted content. Wherein the encryption is tuned in such a way that any computational delay caused by the encryption is imperceptible to a human-user and largely perceptible to an automated-agent such that the need to determine if a user is an automated-user or a human-user is irrelevant.

Abstract: Techniques for exposing network health over network connections in service provider network are disclosed. Monitors such as connection tracking modules may be configured to process network information (e.g., TCP connection state information) relating to network traffic and to transmit the network information to a health manager for analysis. As an example, a customer may request network information relating to a virtual instance provided by a service provider. In response to the request, TCP connection state information relating to the virtual instance may be extracted and processed to determine a network health condition. Information relating to the determined network health condition may be provided to the requesting customer.

Abstract: Methods and apparatus that extend private network functionality to client devices that are not part of a provider network. A net device may provide private network control plane functionality to devices that are external to the provider network and connected to ports on the net device. The devices are assigned addresses within the address space of the private network. Packets sent from the devices through the net device are encapsulated by the net device and routed over the private network to their destinations. Packets sent to the devices are routed by the private network to the net device, decapsulated, and provided to the devices. Via the functionality provided by the net device, a client may configure and manage client devices as part of their client private network using the same services and APIs that are used to configure and manage their virtual resources on the client private network.

Abstract: A virtualization management component of a particular host at a virtualized computing determines that a packet duplication phase of a migration of a virtual machine from a source host to the particular host has begun. The virtualization management component detects that a migrated version of the virtual machine, instantiated at the particular virtualization host, has generated a baseline packet directed to a destination address. The virtualization management component sends a first encapsulation packet comprising the baseline packet to an encapsulation intermediary associated with the destination address. The virtualization management component sends a second encapsulation packet comprising the baseline packet to the source virtualization host, with a directive to forward the second encapsulation packet to the encapsulation intermediary.

Abstract: Attacks, such as MITM and DoS attacks, on a distributed computing system may be detected by sending a work assignment to an execution device through a first communication channel. A report may then be received through a second communication channel of the work assignment received by the execution device. Information regarding the received work assignment may then be in view of information regarding the sent work assignment to determine whether an error, such as an MITM or DoS attack, has occurred. If the analysis indicates that the report does not include the sent work assignment, then a DoS attack may have occurred. If the analysis indicates that the work assignment received by the recipient does not correspond to the sent work assignment, then a MITM attack may have occurred. If an error has occurred, an indication might be recorded and/or other types of actions might also be taken.

Abstract: Methods and apparatus for profile-guided preloading for virtualized resources are described. A block-level storage volume whose contents are to be populated via data transfers from a repository service is programmatically attached to a compute instance. An indication of data transfers from the repository to a block storage service implementing the volume is obtained, corresponding to a particular phase of program execution at the compute instance. A storage profile is generated, based at least in part on the indication of data transfers. The storage profile is subsequently used to pre-load data from the repository service on behalf of other compute instances.

Abstract: An example method of launching a virtual machine in a multi-tenant environment using dynamic configuration may include receiving a customer request to launch a virtual machine in the multi-tenant environment. The multi-tenant environment may include a plurality of host server computers. In response to the customer request, configuration parameters stored in association with an account of the customer may be retrieved in the multi-tenant environment. One or more parameters of a hardware and/or a software resource in the multi-tenant environment may be dynamically configured in accordance with the retrieved configuration parameters. The virtual machine may be launched on one of the plurality of host server computers, using the configured hardware and/or software resource. The configuration parameters may be associated with at least one desired performance characteristic of the virtual machine to be launched.

Abstract: Web services hosted at a data center may employ architectural patterns that tend to obfuscate the source of queries made against databases and other resources in the data center. The queries may be the source of performance, capacity or utilization problems, and may contribute to the cost of hosting the web service. Web service invocations may be associated with identifiers that can be included in modified queries sent to databases and other resources. Summarized cost information may be calculated based on recorded associations between the identifiers and query performance information.

Abstract: Methods and apparatus for profile-guided preloading for virtualized resources are described. A block-level storage volume whose contents are to be populated via data transfers from a repository service is programmatically attached to a compute instance. An indication of data transfers from the repository to a block storage service implementing the volume is obtained, corresponding to a particular phase of program execution at the compute instance. A storage profile is generated, based at least in part on the indication of data transfers. The storage profile is subsequently used to pre-load data from the repository service on behalf of other compute instances.

Abstract: Computer systems, such as a client and a server operably interconnected via a network, are subject to stress on computational resources due to an abundance of automated-user traffic. To improve resource functionalities and control the resources available to automated-agents, value information of valuable assets is encrypted such that a client must perform an algorithm for calculating a decryption key in order to view the unencrypted content. Wherein the encryption is tuned in such a way that any computational delay caused by the encryption is imperceptible to a human-user and largely perceptible to an automated-agent such that the need to determine if a user is an automated-user or a human-user is irrelevant.