# US 11,115,404 B2 · Facilitating service connections in serverless code executions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,404 B2 - Document ID: US11115404B2 - Status: Granted - Kind: B2 - Application number: 16/457,537 - Filed: 2019-06-28 - Published: 2020-12-31 - Granted: 2021-09-07 - Earliest claimed: 2019-06-28 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Adam Charles Siefker; Sean Oczkowski; David Richardson; Samvid H. Dwarakanath; Marc John Brooker; Orr Weinstein - Web page: https://patentgrep.com/patent/US11115404B2 ## CPC - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06F 9/45533: {Hypervisors; Virtual machine monitors} - H04L 63/0272: {Virtual private networks} - H04L 63/0281: {Proxies} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/101: {Access control lists [ACL]} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - H04L 67/562: Brokering proxy services - H04L 69/22: Parsing or analysis of headers - H04L 69/326: in the transport layer [OSI layer 4] (H04L69/16 takes precedence) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods are described for facilitating service connections by user-defined code executing on an on-demand code execution system. Rather than hard code state information used by network services into the code, the code can be provided with an interface that augments requests for network services with state information. When the user-defined code is executed by the on-demand code execution system, additional code can also be executed that provides the interface. The user-defined code may access the target network service through the interface, as if the target network service existed locally to an environment of the code. The interface can then augment requests to the target network service with state information. Because state information is maintained outside the user-defined code, portability of the user-defined code can be increased. ## Claims ### Claim 1 A system comprising: a hosting system associated with an on-demand code execution system, the hosting system comprising one or more computing devices configured to: receive a request to execute user-defined code implementing a task on the on-demand code execution system, wherein the task is associated with metadata including an authentication role under which the task should be executed; in response to the request, execute, within an execution environment of the on-demand code execution system, the user-defined code implementing the task and additional code implementing an interface to a network-accessible service; and pass to the interface an authentication token corresponding to the authentication role for the task; wherein the user-defined code causes the computing device to request access to the network-accessible service from the interface; and wherein the additional code providing the interface causes the computing device to: receive the request to access the network-accessible service; encapsulate the request with a header including the authentication token for the task to result in an encapsulated request; and transmit the encapsulated request to a router, wherein the router is configured to authenticate the request based on the authentication token. ### Claim 2 (depends on 1) The system of claim 1, wherein the network-accessible service is a connection-limited database service, and wherein the interface provides a connection pool for the database service. ### Claim 3 (depends on 1) The system of claim 1, wherein the additional code providing the interface causes the computing device to implement a transport control protocol (TCP) server on which to receive the request. ### Claim 4 (depends on 3) The system of claim 3, wherein the user-defined code causes the computing device to request access to the network-accessible service from the interface by transmitting the request to the TCP server by use of a local relative identifier for the execution environment. ### Claim 5 A computer-implemented method comprising: receiving a request to execute user-defined code implementing a task on an on-demand code execution system, wherein the task is associated with metadata specifying that calls to a network-accessible service originating from executions of the task are to be augmented with information regarding a state of an execution environment in which the task is executed; in response to the request, executing, on the on-demand code execution system, the user-defined code implementing the task and additional code implementing an interface to the network-accessible service; and passing to the interface the information regarding the state of the execution environment in which the task is executed; wherein executing the user-defined code implementing the task comprises requesting access to the network-accessible service from the interface; and wherein executing the additional code providing the interface comprises: receiving the request to access the network-accessible service; augmenting the request with the information regarding the state of the execution environment in which the task is executed to result in an augmented request; and transmitting the augmented request to the network-accessible service. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, wherein the information regarding the state of the execution environment in which the task is executed comprises an authentication token indicating the state of the execution environment as authenticated by the on-demand code execution system. ### Claim 7 (depends on 5) The computer-implemented method of claim 5, wherein the additional code is executed within the execution environment. ### Claim 8 (depends on 5) The computer-implemented method of claim 5, wherein requesting access to the network-accessible service from the interface comprises identifying the interface using a relative identifier of a local execution environment. ### Claim 9 (depends on 5) The computer-implemented method of claim 5, wherein requesting access to the network-accessible service from the interface comprises requesting access without specifying authentication information. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein the information regarding the state of the execution environment in which the task is executed comprises a listing of resources to which the task has access permissions. ### Claim 11 (depends on 5) The computer-implemented method of claim 5, wherein augmenting the request with the information regarding the state of the execution environment in which the task is executed to result in the augmented request comprises encapsulating the request with a header comprising the information regarding the state of the execution environment in which the task is executed. ### Claim 12 A system comprising: a hosting system associated with an on-demand code execution system, the hosting system comprising one or more computing devices configured to: receive a request to execute user-defined code implementing a task on the on-demand code execution system, wherein the task is associated with metadata specifying that calls to a network-accessible service originating from executions of the task are to be augmented with information regarding a state of an execution environment in which the task is executed; in response to the request, execute, within an execution environment of the on-demand code execution system, the user-defined code implementing the task and additional code implementing an interface to the network-accessible service; and pass to the interface the information regarding the state of the execution environment in which the task is executed; wherein the user-defined code causes the computing device to request access to a network-accessible service from the interface; and wherein the additional code providing the interface causes the computing device to: receive the request to access the network-accessible service; augment the request with the information regarding the state of the execution environment in which the task is executed to result in an augmented request; transmit the augmented request to the network-accessible service. ### Claim 13 (depends on 12) The system of claim 12, wherein augmenting the request with the information regarding the state of the execution environment in which the task is executed to result in the augmented request comprises encapsulating the request with a header comprising the information regarding the state of the execution environment in which the task is executed. ### Claim 14 (depends on 12) The system of claim 12, wherein the request is in a wire protocol format of the network-accessible service and wherein encapsulating the request maintains the wire protocol format of the request within an encapsulated portion of the augmented request. ### Claim 15 (depends on 12) The system of claim 12, wherein the one or more computing devices of the hosting system are further configured to pass to the interface authentication information for the task, wherein the additional code providing the interface further causes the computing device to add the authentication information to the request, and wherein the request to the network-accessible service is authenticated based at least partly on the authentication information for the task. ### Claim 16 (depends on 12) The system of claim 12, wherein the one or more computing devices of the hosting system are further configured to pass to the interface an identifier of the network-accessible service, wherein the additional code providing the interface further causes the computing device to add the identifier to the request, and wherein the request to the network-accessible service is routed to the network-accessible service based at least partly on the identifier. ### Claim 17 (depends on 12) The system of claim 12, wherein the additional code providing the interface causes the computing device to implement a transport control protocol (TCP) server on which to receive the request, and wherein the user-defined code causes the computing device to request access to a network-accessible service from the interface by transmitting the request to the TCP server by use a local relative identifier for the execution environment. ### Claim 18 (depends on 12) The system of claim 12, wherein executing the user-defined code and the additional code comprising executing the user-defined code within a first virtual machine instance and executing the additional code within a second virtual machine instance. ### Claim 19 (depends on 12) The system of claim 12, wherein the user-defined code causes the computing device to request access to the network-accessible service from the interface without specifying authentication information for the network-accessible service. ### Claim 20 (depends on 12) The system of claim 12, wherein the additional code providing the interface causes the computing device to act as a proxy for additional communications between the user-defined code and the network-accessible service.