Abstract: A service provider system may implement an enterprise catalog service that manages software products and portfolios of software products on behalf of service provider customer organizations. A graph processing service of the enterprise catalog service may create a graph representation of the enterprise catalog service data, including principals, product listings, portfolios, and constraints (and the relationships between them) that may be used to manage access control, launch contexts, and searches within the enterprise catalog service. A primary (key-value) store may maintain an adjacency list and a secondary index of de-normalized edges. A secondary (document) store may maintain the de-normalized edges. In response to various queries directed to the graph processing service, the service may query the adjacency list or the secondary index. For example, one query may return a list of products that an end user can access, and another may return a count of products within a portfolio.

Abstract: Techniques for natural language searches are described. In an example, a computer system receives a search associated with a computing device. Based on the search, the computer system determines first search results from a first data source and associated with a first type and second search results from a second data source and associated with a type. The computer system also determines a context associated with at least one of the computing device or a user. Based on the context, the computer system generates instructions associated with a presentation of the first search results and the second search results at a user interface of the computing device. The instructions indicate a first presentation order of the first search results and the second search results and a second presentation order of search results within the first search results. The computer system sends the instructions to the computing device.

Abstract: A service provider system may implement an enterprise catalog service that manages catalogs or portfolios of software products (e.g., desktop applications and server products) on behalf of service provider customer organizations. Through the enterprise catalog service, an administrator in a customer organization may discover, select, and ingest products (e.g., based on their features, pricing, and terms), and may add them to catalogs or portfolios for subsequent use by end users in the organization. The administrator may apply constraints on product use and limit product access to particular end users. The products may include third party products that are made available through the enterprise catalog service and a customer's own applications. The enterprise catalog service may monitor usage of third party products and bill the customer organization. Products managed by the enterprise catalog service may be deployed through an application fulfillment platform or resource stack management platform.

Abstract: A service provider system may implement an enterprise catalog service that manages software products and portfolios of software products on behalf of service provider customer organizations. A graph processing service of the enterprise catalog service may create a graph representation of the enterprise catalog service data, including principals, product listings, portfolios, and constraints (and the relationships between them) that may be used to manage access control, launch contexts, and searches within the enterprise catalog service. A primary (key-value) store may maintain an adjacency list and a secondary index of de-normalized edges. A secondary (document) store may maintain the de-normalized edges. In response to various queries directed to the graph processing service, the service may query the adjacency list or the secondary index. For example, one query may return a list of products that an end user can access, and another may return a count of products within a portfolio.

Abstract: Techniques for natural language searches are described. In an example, a computer system receives a search associated with a computing device. Based on the search, the computer system determines first search results from a first data source and associated with a first type and second search results from a second data source and associated with a type. The computer system also determines a context associated with at least one of the computing device or a user. Based on the context, the computer system generates instructions associated with a presentation of the first search results and the second search results at a user interface of the computing device. The instructions indicate a first presentation order of the first search results and the second search results and a second presentation order of search results within the first search results. The computer system sends the instructions to the computing device.

Abstract: A distributed key-value database management system may provide transactions having a high degree of conformance to ACID properties. A data element may be maintained as a versioned list, where each entry may comprise a timestamp and a value indicative of a corresponding version of the data element. The timestamp may be based at least in part on a vended time value. Timestamps may be monotonically increasing and unique across all entries in a distributed system. Conflicting updates to a data element may be detected directly, prior to the completion of involved transactions.

Abstract: A service provider system may implement an enterprise catalog service that manages software products and portfolios of software products on behalf of service provider customer organizations. A graph processing service of the enterprise catalog service may create a graph representation of the enterprise catalog service data, including principals, product listings, portfolios, and constraints (and the relationships between them) that may be used to manage access control, launch contexts, and searches within the enterprise catalog service. A primary (key-value) store may maintain an adjacency list and a secondary index of de-normalized edges. A secondary (document) store may maintain the de-normalized edges. In response to various queries directed to the graph processing service, the service may query the adjacency list or the secondary index. For example, one query may return a list of products that an end user can access, and another may return a count of products within a portfolio.

Abstract: A service provider system may implement an enterprise catalog service that manages software products and portfolios of software products on behalf of service provider customer organizations. Through an administrator interface of the service, a customer organization administrator may create constraints on the use of the software products, and each constraint may include one or more rules about how the products can be launched. These may include environmental constraints (specifying a region in which a product launches), restrictions on input parameter values (including the types of resource instances on which a product can be launched), quotas (controlling the number of product installations), or billing constraints. Constraints may be applied on a user-to-product arc or on a portfolio-to-product arc. Constraints may be stored as objects, and reference to those objects may be added to product or portfolio objects.

Abstract: A service provider system may implement a notification service that manages actionable notification messages received from other services on behalf of a customer organization and its end users. An IT administrator of the customer organization may create and configure message inboxes to be maintained by the notification service. The messages stored in each inbox may be partitioned by source, type, targeted (authorized) recipients, or an associated message topic. Each message may include an identifier of the inbox to which it is directed, and active elements that, when selected by a recipient, cause a corresponding action to be performed. The service from which a message is received may, in response to a message recipient taking one of the available actions, submit a request to the notification service to update the message state. The notification service may provide APIs through which the other services and message recipients interact with the notification service.

Abstract: A service provider system may implement an enterprise catalog service that manages software products and portfolios of software products on behalf of service provider customer organizations. Through an administrator interface of the service, a customer organization administrator may create constraints on the use of the software products, and each constraint may include one or more rules about how the products can be launched. These may include environmental constraints (specifying a region in which a product launches), restrictions on input parameter values (including the types of resource instances on which a product can be launched), quotas (controlling the number of product installations), or billing constraints. Constraints may be applied on a user-to-product arc or on a portfolio-to-product arc. Constraints may be stored as objects, and reference to those objects may be added to product or portfolio objects.

Abstract: A service provider system may implement an approval service that manages approval requests received from other services on behalf of a customer organization and its end users. An administrator in the organization may create approval templates that define voting strategies at multiple approval levels and associate them with particular requests (individually, or by product, portfolio, project, action, message topic, workflow, or request type). The administrator may create approval groups whose members are authorized to respond to particular requests. Each approval template (or approval level) may include a different voting strategy or be associated with a different approval group. The approval system may support pre-notification of subsequent approval levels, auto-escalation, or auto-expiration. The approval service may employ a notification service to manage actionable notification messages that include approval requests. Members of approval groups may retrieve requests and select from available actions (e.g.

Abstract: Methods, systems, and computer-readable media for implementing template generation for deployable units are disclosed. An indication of a deployable unit is received by a catalog system. A deployment template is generated that represents one or more directives for deploying the deployable unit. The deployment template is generated based at least in part on analysis of the deployable unit by the catalog system. The deployable unit is deployed to one or more resources of a multi-tenant provider network. The deployable unit is deployed based at least on part on the directives of the deployment template.

Abstract: A service provider system may implement an enterprise catalog service that manages software products and portfolios of software products on behalf of service provider customer organizations. A graph processing service of the enterprise catalog service may create a graph representation of the enterprise catalog service data, including principals, product listings, portfolios, and constraints (and the relationships between them) that may be used to manage access control, launch contexts, and searches within the enterprise catalog service. A primary (key-value) store may maintain an adjacency list and a secondary index of de-normalized edges. A secondary (document) store may maintain the de-normalized edges. In response to various queries directed to the graph processing service, the service may query the adjacency list or the secondary index. For example, one query may return a list of products that an end user can access, and another may return a count of products within a portfolio.

Abstract: A service provider system may implement an enterprise catalog service that manages software products and portfolios of software products on behalf of service provider customer organizations. A graph processing service of the enterprise catalog service may create a graph representation of the enterprise catalog service data, including principals, product listings, portfolios, and constraints (and the relationships between them) that may be used to manage access control, launch contexts, and searches within the enterprise catalog service. A primary (key-value) store may maintain an adjacency list and a secondary index of de-normalized edges. A secondary (document) store may maintain the de-normalized edges. In response to various queries directed to the graph processing service, the service may query the adjacency list or the secondary index. For example, one query may return a list of products that an end user can access, and another may return a count of products within a portfolio.

Abstract: Technologies are described herein for scanning machine images using a scanning service to identify potential risks. The scanning service may be associated with a service provider network. A scan request is received at the scanning service that requests machine images to be scanned. One or more scans may be performed on each of the machine images. An execution environment may host a machine image during a scan of the machine image. Scan result data associated with the scans is stored. The scan result data may be used to provide scan results to the requestor.

Abstract: A service provider system may implement an enterprise catalog service that manages catalogs and portfolios of software products (e.g., desktop applications and server products) on behalf of service provider customer organizations. Through the service, a customer organization administrator may create a portfolio (e.g., a container) and configure the portfolio for subsequent use by end users in the organization, which may include adding products, users, permissions, and constraints on the usage of the products (individually or collectively) to the portfolio for all authorized end users or particular end users. Portfolios may be shared with other administrators by publishing them or through direct notification of sharing. A recipient of a shared portfolio may, after importing it, further restrict access to the portfolio or the use of the products therein, but cannot modify the portfolio itself. Changes made by a portfolio owner may be propagated to authorized users and to portfolio importers automatically.

Abstract: A service provider system may implement an enterprise catalog service that manages software products and portfolios of software products on behalf of service provider customer organizations. Through an administrator interface of the service, a customer organization administrator may create constraints on the use of the software products, and each constraint may include one or more rules about how the products can be launched. These may include environmental constraints (specifying a region in which a product launches), restrictions on input parameter values (including the types of resource instances on which a product can be launched), quotas (controlling the number of product installations), or billing constraints. Constraints may be applied on a user-to-product arc or on a portfolio-to-product arc. Constraints may be stored as objects, and reference to those objects may be added to product or portfolio objects.

Abstract: A service provider system may implement an enterprise catalog service that manages catalogs or portfolios of software products (e.g., desktop applications and server products) on behalf of service provider customer organizations. Through the enterprise catalog service, an administrator in a customer organization may discover, select, and ingest products (e.g., based on their features, pricing, and terms), and may add them to catalogs or portfolios for subsequent use by end users in the organization. The administrator may apply constraints on product use and limit product access to particular end users. The products may include third party products that are made available through the enterprise catalog service and a customer's own applications. The enterprise catalog service may monitor usage of third party products and bill the customer organization. Products managed by the enterprise catalog service may be deployed through an application fulfillment platform or resource stack management platform.

Abstract: Each virtualized environment on a computer has its own set of firewall rules. The virtualized environments share a single instance of the operating system image, a filter engine and a single network stack. A virtualized environment may be a compartment or a server silo. A virtualized environment is a network isolation mechanism and may be used to prevent use of a computer to traverse network boundaries by creating a separate virtualized environment for each network, enabling a separate set of rules to be applied to each virtualized environment and the network interfaces within it. Virtualized environments may also be used to assign different trust levels to the same physical network. Firewall rules are applied by virtualized environment identifier (ID), enabling separate filters to be applied to each virtualized environment on a computer. A virtualized environment may include or be associated with one or more network interfaces.

Abstract: Each virtualized environment on a computer has its own set of firewall rules. The virtualized environments share a single instance of the operating system image, a filter engine and a single network stack. A virtualized environment may be a compartment or a server silo. A virtualized environment is a network isolation mechanism and may be used to prevent use of a computer to traverse network boundaries by creating a separate virtualized environment for each network, enabling a separate set of rules to be applied to each virtualized environment and the network interfaces within it. Virtualized environments may also be used to assign different trust levels to the same physical network. Firewall rules are applied by virtualized environment identifier (ID), enabling separate filters to be applied to each virtualized environment on a computer. A virtualized environment may include or be associated with one or more network interfaces.