Abstract: A network visualization service may auto-generate graphical, dynamic, and interactive network diagrams of the infrastructure (resource instances, connections, etc.) of clients' virtual private networks as implemented on a provider network. A network diagram may include representations of various virtualized components of a client's virtual private network, as well as relationships among and connections between and among the various components. The diagram may also display logical and/or geographical groupings of the virtual resources in the client's virtual private network. The service may track changes to the virtual private network and update the diagram accordingly. The diagram may provide a user interface via which the client may select particular graphical objects on diagram to display additional information about a respective resource instance or connection and/or to change the client's virtual private network configuration via the network diagram.

Abstract: A network visualization service may auto-generate graphical, dynamic, and interactive network diagrams of the infrastructure (resource instances, connections, etc.) of clients' virtual private networks as implemented on a provider network. A network diagram may include representations of various virtualized components of a client's virtual private network, as well as relationships among and connections between and among the various components. The diagram may also display logical and/or geographical groupings of the virtual resources in the client's virtual private network. The service may track changes to the virtual private network and update the diagram accordingly. The diagram may provide a user interface via which the client may select particular graphical objects on diagram to display additional information about a respective resource instance or connection and/or to change the client's virtual private network configuration via the network diagram.

Abstract: A network visualization service may auto-generate graphical, dynamic, and interactive network diagrams of the infrastructure (resource instances, connections, etc.) of clients' virtual private networks as implemented on a provider network. A network diagram may include representations of various virtualized components of a client's virtual private network, as well as relationships among and connections between and among the various components. The diagram may also display logical and/or geographical groupings of the virtual resources in the client's virtual private network. The service may track changes to the virtual private network and update the diagram accordingly. The diagram may provide a user interface via which the client may select particular graphical objects on diagram to display additional information about a respective resource instance or connection and/or to change the client's virtual private network configuration via the network diagram.

Abstract: A method for data aggregation of declassified sensitive data may include obtaining a policy associated with an isolated region of a service provider. The policy may identify a plurality of rules for declassifying sensitive data accessible within the isolated region. At least a portion of the plurality of rules identified by the policy may be obtained. A file with the sensitive data may be identified, the file being generated within the isolated region. An output file may be generated based on applying the obtained rules to the file. At least a portion of the sensitive data may be filtered out using the obtained rules. The generated output file may be provided for access outside of the isolated region. The sensitive data may be inaccessible by at least another region of the service provider.

Abstract: A distributed execution environment provides resources such as computing resources, hardware resources, and software resources. Resource action rules (“rules”) may be defined and associated with resources in the distributed execution environment. The rules may be evaluated based upon resource state data defining the state of one or more resources. The results of the evaluation of the rules may be utilized to take various actions. For example, the results of the evaluation of rules may be utilized to generate a user interface (UI) object for providing information regarding the evaluation of the rule, to initiate a workflow, and/or perform another type of action. The results might also be utilized to prohibit certain types of operations from being performed with regard to a resource. The results might be propagated to other resources. A UI might also be provided for use in defining the rules.

Abstract: A distributed execution environment provides resources such as computing resources, hardware resources, and software resources. One or more resource data providers might also operate in conjunction with the distributed execution environment to provide resource data describing various aspects of the resources in the distributed execution environment. A query service may obtain resource data provided by the resource data providers in order to generate responses to queries. In order to obtain the resource data from the resource data providers, the query service may utilize various “pull” and “push” mechanisms. Using a push mechanism, the resource data providers push resource data to the query service. Utilizing a pull mechanism, the query service pulls the resource data from the resource data providers. The query service might also store resource data received from the resource data providers in a cache and utilize the cached resource data when responding to queries for resource data.

Abstract: Requests to change attributes of servers or other computing resources can be validated by a veto service. For example, the veto service can receive requests to register for notification of changes to an attribute for a server, send a notification of a pending change to the attribute to each of a plurality of services, determine a response to the notification for each service, and based on the responses decide whether to allow or deny the pending change to the attribute. The responses from the notified services can be received responses or default responses.

Abstract: Entities such as resource and service providers can utilize a ticketing system to define operational actions as primitives that can be stored, combined into more complex workflows, and executed in a restricted zone wherein a portion of the resources or services are not directly accessible to those providers. These primitives can be stored in the provider environment and shared with the restricted zone, in order to provide a structured approach to the sharing of operational knowledge. When a primitive is first received to the restricted zone, a person vetted by the customer associated with the restricted zone can review and approve the primitive, and can cause the primitive to be executed in the restricted zone. When that same primitive is subsequently received to the restricted zone, a lookup can be performed to determine that an approval exists, whereby the primitive can be executed in the restricted zone without another review.

Abstract: A computer-implemented method includes recording one or more actions being performed by an agent using at least one resource of a resource provider environment, the at least one resource being associated with a non-restricted zone in the resource provider environment. The method includes creating a primitive that describes the one or more actions. The primitive is able to be executed on at least one different resource in a restricted zone in the resource provider environment to perform the one or more actions using the different resource. The restricted zone includes resources associated with a customer that are directly accessible only to at least one authorized entity. The method includes submitting the primitive to the restricted zone in the resource provider environment. The primitive is able to be executed by the at least one authorized entity on the at least one different resource in the restricted zone.