Amazon patents cloud links connecting serverless code across accounts
Amazon has been granted a patent for a system that creates user-defined network connectors between serverless functions and isolated cloud resources. This technology allows traffic to route between different user accounts without relying on fixed network addresses, which are difficult to assign to dynamic serverless executions.
In the filing’s own words
Systems and methods are described for facilitating cross-account network traffic between serverless function executions and isolated cloud resources within virtualized network environments. Virtualized network environments, by default, may be isolated such that external traffic is not permitted to enter the environment. Permissions for traffic that may enter the environment are often set on the basis of network addresses. In the context of serverless functions, such permissions may be difficult to establish because executions of serverless functions can occur on a dynamically selected environment without a fixed network address. The present disclosure provides for creation of user-defined connectors that facilitate routing of network traffic between executions of serverless functions and user virtualized network environments without requiring that routing occur on the bases of network addresses. In some instances, connectors may route between functions owned by a first account and environments owned by a second account thus providing for cross-account communication.
What exactly they claim (claim 1)
1. A cloud provider system to enable cross-account communication between serverless function executions and virtualized network environments, the cloud provider system comprising: one or more computing devices hosting a user virtualized network environment containing one or more network accessible resources, wherein the user virtualized network environment is hosted on behalf of a first user account on the cloud provider system and a serverless code execution system hosting executions of a user-defined serverless function on behalf of a second user account on the cloud provider system, wherein the second user account is distinct from the first user account; and one or more processors configured to: obtain a request to create a logical network connector enabling communication between the user virtualized network environment hosted on behalf of the first user account and the executions of the user-defined serverless function hosted on behalf of the second user account on the cloud provider system; obtain, from a client computing device authorized by the first user account, first permissions permitting the logical network connector to join the user virtualized network environment hosted on behalf of the first user account; obtain, from a client computing device authorized by the second user account, second permissions permitting the logical network connector to act as a network endpoint for traffic of executions of the user-defined serverless function hosted on behalf of the second user account; responsive to receiving the first permissions from the client computing device authorized by the first user account and receiving the second permissions from the client computing device authorized by the second user account, initialize the logical network connector, wherein initializing the logical network connector comprises: generating a first endpoint within the user virtualized network environment hosted on behalf of the first user account; generating a second endpoint within a second virtualized network environment corresponding to the serverless code execution system hosting the executions of the user-defined serverless function on behalf of the second user account on the cloud provider system; and configuring a substrate physical network to route traffic between endpoints respectively associated with the first user account and the distinct second user account, the endpoints including the first endpoint within the user virtualized network environment hosted on behalf of the first user account and the second endpoint within the second virtualized network environment corresponding to the serverless code execution system hosting the executions of the user-defined serverless function on behalf of the second user account; obtain, at the first endpoint represented by the logical network connector within the user virtualized network environment hosted on behalf of the first user account, a network communication from an execution of user-defined code representing the user-defined serverless function on the serverless code execution system; and using the logical network connector, route the network communication to the user virtualized network environment hosted on behalf of the first user account subject to the first permissions obtained from the client computing device authorized by the first user account and the second permissions obtained from the client computing device authorized by the second user account.
Facts
- Company
- Amazon (Amazon Technologies, Inc.)
- Official title
- User-defined network connectors between serverless functions and isolated cloud resources
- Patent number
- US12739250B1
- Application number
- 18065544
- Filed
- Dec 13, 2022
- Granted
- Sep 15, 2026
- Inventors
- 5
- Claims
- 20
Classified under
H04L 63/10 Electricity & electronicsH04L 63/0263 Electricity & electronicsMore from Amazon in AI & software
- Amazon patents system that cites sources for AI answers Sep 29, 2026
- Amazon patents tech to swap words in movies using actor's voice Sep 8, 2026
- Amazon patents ML tool to add graphics to live sports from moving cameras Sep 15, 2026
- Amazon patents shopping assistant that remembers your search filters Oct 6, 2026
- Amazon patents system where AI agents split tasks and talk to each other Oct 20, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.