Abstract:
Policies can be applied to, and enforced for, specific resources by applying a corresponding tag to those resources. An entity, such as a customer of a resource provider, can generate one or more policies to be applied to a set of resources, where those policies can relate to data retention, backup, lifecycle events, and other such aspects. Each policy can be associated with a particular tag, which may comprise a key-value pair to be applied to various resources. A policy enforcement manager can determine the tagged resources and ensure that the relevant policies are applied. The policies can include logic or intelligence for performing a variety of tasks with respect to resources, groups of resources, or types of resources, as identified using the tags.
Abstract:
Systems and methods are provided to implement a metadata record migration system that schedules the migrations of metadata records that are frequently mutated. In embodiments, the scheduler collects timing data of jobs that modify the metadata records, including the timing of various mutation operations within the jobs. In embodiments, when it is determined that a metadata record is to be migrated to a different storage location, the scheduler determines a time to migrate the metadata record. The migration time may lie within a migration window, selected based on an expected migration time needed for the metadata record and the collected time data in order to reduce a probability that record mutations will occur during the migration. In embodiments, the jobs may be snapshot jobs that modify a snapshot record, and the migration may be performed as a result of a cell partitioning operation occurring within the snapshotting system.
Abstract:
A method for selecting a communication protocol for a virtual desktop instance in a service provider environment may include providing to a client computing device, access to a virtual desktop instance running on a server computer using a first communication channel associated with a first communication protocol. A request for functionality from a user of the device is detected, the requested functionality being unsupported by the first communication protocol. A second communication protocol from a plurality of available communication protocols may be selecting based on the requested functionality. The second communication protocol may support the requested functionality. A user authorization for using the second communication protocol can be verified. Upon successful verification, a second communication channel is established between the server computer and the device using the second communication protocol for performing the functionality, while maintaining access to the virtual desktop instance using the first communication channel.
Abstract:
Generally described, one or more aspects of the present application correspond to techniques for creating encrypted block store volumes of data from unencrypted object storage snapshots of the volumes. These encryption techniques use a special pool of servers for performing the encryption. These encryption servers are not accessible to users, and they perform encryption and pass encrypted volumes to other block store servers for user access. The encryption context for the volumes can be persisted on the encryption severs for as long as needed for encryption and not shared with the user-facing servers in order to prevent user access to encryption context.
Abstract:
Generally described, one or more aspects of the present application correspond to techniques for creating encrypted block store volumes of data from unencrypted object storage snapshots of the volumes. These encryption techniques use a special pool of servers for performing the encryption. These encryption servers are not accessible to users, and they perform encryption and pass encrypted volumes to other block store servers for user access. The encryption context for the volumes can be persisted on the encryption severs for as long as needed for encryption and not shared with the user-facing servers in order to prevent user access to encryption context.
Abstract:
A virtual desktop service may receive a request from a user to provision a virtual desktop and establish a secure communications connection between the virtual desktop service, a user client device, and additional client devices via a proxy server in order to stream same feed or virtual screens from the virtual desktop to multiple client devices. The virtual desktop service may provide for natively sharing or multiplexing an entire data stream from a virtual desktop to multiple client devices or natively sharing or multiplexing portions of a data stream from a virtual desktop to render each portion on a different client device.
Abstract:
A router of a block-level data storage service receives a request to generate a snapshot of a block device. The router, based on routing metadata for the block-level data storage service, identifies active metadata that indicates a first cell that may maintain the block device and alternate metadata that indicates a second cell that may maintain the block device. Based on a first state of the block device in the first cell, a second state of the block device in the second cell, and a predetermined set of rules defining operations corresponding to outcomes associated with the first state and the second state, the router determines which of the first cell and the second cell authoritatively maintains the block device. The router transmits the request to the appropriate cell in accordance with the predetermined set of rules.
Abstract:
A computing system that provides virtual computing services may generate and manage remote computing sessions between client computing devices and virtual desktop instances hosted on the service provider's network. A computing resource instance manager may monitor connections to and disconnections from a virtual desktop instance during particular time periods, and may apply a resource management policy to determine whether and when to shut down an underlying virtualized computing resource instance following a disconnection (e.g., immediately, after some period of time, or only between certain hours). A storage volume for the virtual desktop instance may be detached during a shutdown. In response to a reconnection request, the virtualized computing resource instance (or another such instance) may be restarted and the storage volume may be reattached. The computing resource instance manager may develop a model for predicting when to shut down or restart an instance based on historical data or machine learning.
Abstract:
A computing system that provides virtual computing services may generate and manage remote computing sessions between client computing devices and virtual desktop instances hosted on the service provider's network. A computing resource instance manager may monitor connections to and disconnections from a virtual desktop instance during particular time periods, and may apply a resource management policy to determine whether and when to shut down an underlying virtualized computing resource instance following a disconnection (e.g., immediately, after some period of time, or only between certain hours). A storage volume for the virtual desktop instance may be detached during a shutdown. In response to a reconnection request, the virtualized computing resource instance (or another such instance) may be restarted and the storage volume may be reattached. The computing resource instance manager may develop a model for predicting when to shut down or restart an instance based on historical data or machine learning.
Abstract:
Systems and methods for geographic-aware virtual desktops are disclosed. In one example, a pool of network addresses can be maintained. Each network address can be associated with a respective geographical location. The pool of network addresses can include network addresses associated with different respective geographical locations. A geographical location associated with a client device accessing a virtual desktop can be determined. An external-facing network address can be selected from the pool of network addresses based on the geographical location associated with the client device. The external-facing network address can be assigned for network traffic associated with the virtual desktop.