On-demand network code execution with cross-account aliases

• US 10,203,990 B2
• Filed: 06/30/2016
• Issued: 02/12/2019
• Est. Priority Date: 06/30/2016
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Wagner, Timothy Allen, Brooker, Marc John, Nair, Ajay, Manwaring, Derek Steven
• Primary Examiner(s): Sun, Charlie
• Application Number:
  US15/199,613
• Publication Number:
  US 20180004553A1
• Time in Patent Office: 957 Days
• CPC Class Codes: G06F 2209/5011 Pool
• CPC Class Codes: G06F 9/485 Task life-cycle, e.g. stopping, restarting, resuming execution G06F9/4881 takes precedence
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455

Abstract

Systems and methods are described for utilizing cross-account access to tasks on an on-demand code execution environment or other distributed code execution environment to implement an application programming interface (API) on a network-accessible service. An on-demand code execution environment can utilize pre-initialized virtual machine instances to enable execution of user-specified code in a rapid manner, without delays typically caused by initialization of the virtual machine instances. While users may generally execute their own code, the present application enables code of a first user to be executed by a second user, while maintaining the privacy and security of the code and associated accounts. Further, the present application enables a set of tasks to be grouped together as an API, enabling any user to create an API for a service, while the on-demand code execution environment manages execution of the tasks and allocation of underlying computing resources.

Claims

1. A system to enable use of tasks on an on-demand code execution environment as application programming interfaces, the system comprising:

a non-transitory data store configured to store tasks, wherein individual tasks are owned by accounts of the on-demand code execution environment and are associated with code executable to implement functionality corresponding to the individual tasks; and

one or more processors configured with computer-executable instructions to;

receive a request from a user computing device associated with a first account to designate a set of tasks owned by the first account on the on-demand code execution environment as an application programming interface (“

API”

) for a network-accessible service;

receive a request from a second user computing device associated with a second account to access the API;

enable the second user computing device to call the set of tasks owned by the first account on the on-demand code execution environment;

receive an API call from the second user computing device corresponding to at least one task of the set of tasks;

select a virtual machine instance within the on-demand code execution environment on which to execute code corresponding to the at least one task, wherein the virtual machine instance is dedicated to at least one of execution of tasks of the first account or execution of tasks of the second account;

execute within the virtual machine instance the code corresponding to the at least one task on behalf of the second account;

monitor computing resources associated with the execution of the code; and

attribute computing resources associated with the execution of the code to the second account.

2. The system of claim 1, wherein the one or more processors are further configured with the computer-executable instructions to obtain permissions-associated with the API by a user of the first account, and to verify that the second account complies with the permissions.

3. The system of claim 2, wherein the permissions indicate at least one of individual accounts permitted to generate aliases to the task or types of accounts that are permitted to generate aliases to the task.

4. The system of claim 1, wherein the one or more processors are configured with the computer-executable instructions to enable the second user computing device to call the set of tasks owned by the first account on the on-demand code execution environment at least partly by generating an alias associated with the first account and referencing at least one of the set of tasks.

5. The system of claim 4, wherein generating the alias associated with the first account and referencing at least one of the set of tasks comprises at least one of generating a distinct alias for each task of the set of tasks or generating an alias referencing the set of tasks collectively.

6. A computer-implemented method to enable to enable use of tasks on an on-demand code execution environment as application programming interfaces, the computer-implemented method comprising:

receiving, from a first computing device associated with a first account on the on-demand code execution environment, executable code corresponding to a set of tasks, wherein execution of the executable code corresponding to an individual task implements functionality associated with a network-accessible service;

receiving, from the first computing device, a request to designate the set of tasks as an application programming interface (“

API”

) for the network-accessible service;

receiving from a second computing device associated with a second account an API call corresponding to a task of the set of tasks;

selecting a virtual machine instance within the on-demand code execution environment on which to execute code corresponding to the task, wherein the virtual machine instance is associated with at least one of execution of tasks of the first account or execution of tasks of the second account;

executing within the virtual machine instance the executable code corresponding to the task on behalf of the second account;

monitoring computing resources associated with the execution of the code; and

attributing computing resources associated with the execution of the code to the second account.

7. The computer-implemented method of claim 6 further comprising receiving a request from the second user computing device to access the API, wherein the request comprises one or more customizations to be made when executing at least one task of the set of tasks on behalf of the second account.

8. The computer-implemented method of claim 7 further comprising modifying the virtual machine instance according to the customizations prior to execution of the code.

9. The computer-implemented method of claim 7 further comprising receiving, from the user computing device, authentication information associated with a network resource of the second account, wherein executing within the virtual machine instance the code corresponding to the task on behalf of the second account comprising passing the authentication information to the virtual machine.

10. The computer-implemented method of claim 6, wherein the request to designate the set of tasks as the API for the network-accessible service further comprises selection criteria to be applied when selecting the virtual machine instance, and wherein selecting the virtual machine instance includes selecting the virtual machine instance according to the selection criteria.

11. The computer-implemented method of claim 6 further comprising generating an alias associated with the second account and referencing at least one of the set of tasks.

12. The computer-implemented method of claim 6 further comprising:

receiving, from the first computing device, modified executable code for the task;

applying the modified executable code to the task to result in a modified task; and

verifying that the alias complies with the modified task.

13. Non-transitory computer-readable storage media including computer-executable instructions that, when executed by a computing system, cause the computing system to:

receive, from a first user computing device associated with a first account on an on-demand code execution environment, executable code corresponding to a set of tasks, wherein execution of the executable code corresponding to an individual task implements functionality associated with a network-accessible service;

receive, from the first user computing device, a request to designate the set of tasks as an application programming interface (“

API”

) for the network-accessible service;

receive, from a second user computing device associated with a second account on the on-demand code execution environment, an API call corresponding to a task of the set of tasks;

select a virtual machine instance within the on-demand code execution environment on which to execute code corresponding to the task, wherein the virtual machine instance is associated with at least one of execution of tasks of the first account or execution of tasks of the second account;

execute within the virtual machine instance the executable code corresponding to the task on behalf of the second account;

monitor computing resources associated with the execution of the code; and

attribute computing resources associated with the execution of the code to the second account.

14. The non-transitory storage media of claim 13, wherein the API call further includes one or more customizations to be made when executing the task on the on-demand code execution environment, and wherein the computer-executable instructions cause the computing system to execute the code at least in part by applying the one or more customizations.

15. The non-transitory storage media of claim 14, wherein the customizations include at least one of a modification to or addition of a parameter to be passed to the code corresponding to the task when executed on behalf of the second account, a modification of permissions to be given to the virtual machine instance when executing the code, a modification of the execution environment to be used within the virtual machine instance, or a modification of the resources to be provided to the virtual machine instance when executing the code.

16. The non-transitory storage media of claim 13, wherein the computer-executable instructions cause the computing system to generate an alias associated with the second account and referencing at least one task of the set of tasks.

17. The non-transitory storage media of claim 16, wherein the computer-executable instructions cause the computing system to:

receive, from the first user computing device, modified executable code for the task;

apply the modified executable code to the task to result in a modified task; and

verify that the alias complies with the modified task.

18. The non-transitory storage media of claim 13, wherein the computer-executable instructions cause the computing system to obtain selection criteria provided by a user of the first account to be applied when selecting the virtual machine instance, and to select the virtual machine instance according to the selection criteria.

19. The non-transitory storage media of claim 13, wherein the computer-executable instructions cause the computing system to obtain permissions associated with the API by a user of the first account, and to verify that the first account complies with the permissions.

20. non-transitory storage media of claim 19, wherein the permissions specify a license that must be associated with the second account prior to execution of the task on behalf of the second account.

21. The non-transitory storage media of claim 13, wherein the second computing device associated with the second account is a virtual machine instance within the on-demand code execution environment.