Abstract:
A method for executing commands on virtual machine instances in a distributed computing environment can include receiving, from a client computing device, a command execution request for executing a command on one or more virtual machine instances within the distributed computing environment. The command execution request includes a tag, and instance identification information for the one or more virtual machine instances is retrieved based on the tag. A command specification document associated with the command specified by the command execution request is retrieved. A command execution message, including the command specification document and at least one command parameter, is communicated to each of the one or more virtual machine instances. A command execution result from executing the command at the one or more virtual machine instances is received from the one or more virtual machine instances. The command execution result is sent to the client computing device.
Abstract:
Systems and methods provide for execution of different provisioning engines within a resource provider environment. A user may submit a request to provision one or more resources using a particular provisioning engine, which may include a provisioning engine that is non-native to the resource provider environment. A control plane may evaluate and transmit requests to the provisioning engine executing within the resource provider environment. Operations associated with the provisioning engine may be executed and stored within a data store, which may be processed upon completion and made accessible.
Abstract:
This disclosure describes techniques for resolving discrepancies that occur to interrelated computing resources from computing resource drift. Users may describe computing resources in an infrastructure template. However, computing resource drift occurs when “out-of-band” modifications are made to the computing resources and are not reflected in the infrastructure template. To resolve discrepancies between the infrastructure template and the out-of-band modifications to the computing resources, a notification may be output to a user account associated with the computing resources detailing the differences. An updated infrastructure template may be received that resolves the differences, such as by including configuration settings that reflect a current state of the computing resources. The computing resources may then execute a workflow using the updated template, such that the workflow is executed on all of the computing resources in a current state.
Abstract:
This disclosure describes techniques for defining a set of permissions, or privileges, for users who manage resources of a network-based service provisioned in a network-based service platform managed by a service provider. The techniques may include mapping cloud identities of the users to operating system (OS) user groups defined local to the resources that specify the set of permissions for user group members. Systems-manager agents that execute locally on the resources may determine to which OS user group the user belongs based on their cloud identity, and launch shells that are restricted by the set of permissions. Using these shells, a network-based service platform may allow users to remotely manage resources of the network-based service in various ways, such as through batch run commands and/or remote user sessions, while ensuring that the users are unable to execute commands on the resources that are outside the set of permissions.
Abstract:
A technology is described for invoking a command over a set of computing instances. An example method may include receiving a request to invoke a command over a set of computing instances managed within a service provider environment. In response, the computing instances included in the set of computing instances having an attribute may be identified and the command may be sent to the computing instances according to a send rate parameter specifying a rate at which the command is sent to a portion of the computing instances. Execution status indications may be received from the computing instances, wherein a number of errors indicated by the computing instances that exceeds an error threshold terminates execution of the command.
Abstract:
Software packages may be installed, uninstalled and/or updated across a group of computing instances by way of a single issuance of a user request. The request may include information such as a software package name, a software package version, an action (e.g., install or uninstall), and one or more operating constraints for the software package. For an installation request, an agent on a given computing instance may process the request by accessing a manifest that indicates various computing instance characteristics (e.g., operating system types, architecture types, etc.) and various respective available versions of the software package. The agent may then select, based on characteristics of the computing instance, a package type for the computing instance. An installation request may also allow operating constraints (e.g. regarding usage of processing, memory, I/O and other resources) to be set and enforced for the software package.
Abstract:
A state management server applies configuration information to a set of virtual computer system instances in accordance with one or more limitations specified by an administrator. In an embodiment, the limitations include a velocity parameter that limits the number of virtual computer system instances to which the configuration may be applied concurrently. In an embodiment, the limitations include an error threshold that stops the application of the configuration if the number of configuration failures meets or exceeds the error threshold. In an embodiment, the set of virtual computer systems is identified by providing a list of the individual virtual computer system instances, or by specifying one or more tags that are associated with the virtual computer systems in the set. In an embodiment, the administrator is able to specify that an association be applied according to a predetermined schedule.
Abstract:
A system for managing configuration of multiple computing systems associated with a customer in a cloud computing environment. A command associated with the desired configuration is identified for execution on a total quantity of instances associated with the customer system to be configured. An invocation rate parameter selected by the customer system is used to control a rate in which the configuration command is invoked on the targeted instances. Based on the invocation rate parameter, the system invokes the configuration command on identified portions or sets of the targeted instances during different stages of the configuration invocation.
Abstract:
Software packages may be installed, uninstalled and/or updated across a group of computing instances by way of a single issuance of a user request. The request may include information such as a software package name, a software package version, an action (e.g., install or uninstall), and one or more operating constraints for the software package. For an installation request, an agent on a given computing instance may process the request by accessing a manifest that indicates various computing instance characteristics (e.g., operating system types, architecture types, etc.) and various respective available versions of the software package. The agent may then select, based on characteristics of the computing instance, a package type for the computing instance. An installation request may also allow operating constraints (e.g. regarding usage of processing, memory, I/O and other resources) to be set and enforced for the software package.
Abstract:
A selection of a document that includes a command and a parameter is received, and a user is caused to be associated with a policy that grants permission to execute the document. A request is received, from a requestor, to execute the document, the request including a parameter value, and the requestor is determined to be the user associated with the policy. The user is validated to have access to a resource indicated by the parameter value, and the command is caused to be executed against the resource.