# US 2019/0356587 A1 · Linking Resource Instances to Virtual Network in Provider Network Environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0356587 A1 - Document ID: US20190356587A1 - Status: Published application - Kind: A1 - Application number: 16/530,881 - Filed: 2019-08-02 - Published: 2019-11-21 - Earliest claimed: 2014-11-14 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Kevin Christopher Miller; Andrew Bruce Dickinson; Eric Wayne Schultze; Ian Roger Searle; Shane Ashley Hall; Deepak Mohan; David Brian Lennon - Web page: https://patentgrep.com/patent/US20190356587A1 ## CPC - H04L 45/586: of virtual routers - H04L 45/74: Address processing for routing - H04L 45/745: Address table lookup; Address filtering - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0272: {Virtual private networks} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and apparatus that allow clients to connect resource instances to virtual networks in provider network environments via private IP. Via private IP linking methods and apparatus, a client of a provider network can establish private IP communications between the client's resource instances on the provider network and the client's resource instances provisioned in the client's virtual network via links from the private IP address space of the virtual network to the private IP address space of the provider network. The provider network client resource instances remain part of the client's provider network implementation and may thus also communicate with other resource instances on the provider network and/or with entities on external networks via public IP while communicating with the virtual network resource instances via private IP. ## Claims ### Claim at position 1 -21. (canceled) ### Claim 22 A method, comprising: providing one or more application programming interfaces (APIs) to clients of a provider network; receiving input via one of the one or more APIs to link a client resource in the provider network, but not in a client virtual network within the provider network, to one or more resources in a given client virtual network within the provider network, and responsive to the input: configuring the given client virtual network to route network packets between the one or more resources and the client resource; and linking the client resource to the given client virtual network according to input received via the API, wherein the linking adds a private network address of the client resource to an access control of the given client virtual network so that the client resource can access the one or more resources. ### Claim 22 (depends on 22) The method as recited in claim 22, wherein: the given client virtual network implements one or more client virtual network access groups each including at least one of the one or more resources in the given client virtual network; the linking the client resource to the client virtual network comprises adding the client resource to at least one of the client virtual network access groups such that the linked client resource can access the one or more resources in the at least one access groups to which it is added. ### Claim 23 (depends on 22) The method as recited in claim 22, wherein: the client resource is implemented as a virtual machine on a host machine in the provider network; the host machine includes a virtual machine monitor (VMM); and the linking configures the VMM to: obtain network packets from the client resource, each network packet indicating a target network address; determine that the target network address of at least one network packet is a network address accessible via the client virtual network and send the at least one network packet to the client virtual network for routing via the client virtual network to a respective resource; and determine that the target address of at least one other network packet is a network address that is not accessible via a private network address space of the client virtual network and send the at least one other network packet to a respective resource via the provider network. ### Claim 25 (depends on 22) The method as recited in claim 22, wherein the configuring comprises configuring the client virtual network to route one or more network packets each indicating the private network address of the client resource as a target network address from one or more of the client virtual network resource instances to the client resource. ### Claim 26 (depends on 22) The method as recited in claim 22, wherein: the client virtual network implements one or more route tables configured for routing network packets on the client virtual network; and the configuring comprises adding a route to the one or more route tables for routing network packets to private network addresses on the provider network via the client virtual network. ### Claim 27 (depends on 22) The method as recited in claim 22, further comprising: routing, by the client virtual network, one or more network packets each indicating the private network address of the client resource as a target network address from one of the one or more resources in the given client virtual network to the client resource. ### Claim 28 (depends on 22) The method as recited in claim 22, wherein at least one of the one or more resources in a given client virtual network corresponds to an implementation of a provider network service. ### Claim 29 One or more non-transitory computer-readable storage media storing program instructions that when executed on or across one or more processors cause the one or more processors to implement one or more services in a provider network, the one or more services configured to: provide one or more application programming interfaces (APIs) to clients of a provider network; receive input via one of the one or more APIs to link a client resource in the provider network, but not in a client virtual network within the provider network, to one or more resources in a given client virtual network within the provider network, and responsive to the input: configure the given client virtual network to route network packets between the one or more resources and the client resource; and link the client resource to the given client virtual network according to input received via the API, wherein the linking adds a private network address of the client resource to an access control of the given client virtual network so that the client resource can access the one or more resources. ### Claim 30 (depends on 29) The one or more non-transitory computer-readable storage media as recited in claim 29, wherein: the client resource is implemented as a virtual machine on a host machine in the provider network; the host machine includes a virtual machine monitor (VMM); and to link the client resource to the given client virtual network, the one or more services is configured to: obtain network packets from the client resource, each network packet indicating a target network address; determine that the target network address of at least one network packet is a network address accessible via the client virtual network and send the at least one network packet to the client virtual network for routing via the client virtual network to a respective resource; and determine that the target address of at least one other network packet is a network address that is not accessible via a private network address space of the client virtual network and send the at least one other network packet to a respective resource via the provider network. ### Claim 31 (depends on 29) The one or more non-transitory computer-readable storage media as recited in claim 29, wherein: the given client virtual network implements one or more client virtual network access groups each including at least one of the one or more resources in the given client virtual network; to link the client resource to the given client virtual network, the one or more services is configured to add the client resource to at least one of the client virtual network access groups such that the linked client resource can access the one or more resources in the at least one access groups to which it is added. ### Claim 32 (depends on 29) The one or more non-transitory computer-readable storage media as recited in claim 29, wherein the configuring comprises configuring the client virtual network to route one or more network packets each indicating the private network address of the client resource as a target network address from one or more of the client virtual network resource instances to the client resource. ### Claim 33 (depends on 29) The one or more non-transitory computer-readable storage media as recited in claim 29, the one or more services further configured to: route, by the client virtual network, one or more network packets each indicating the private network address of the client resource as a target network address from one of the one or more resources in the given client virtual network to the client resource. ### Claim 34 (depends on 29) The one or more non-transitory computer-readable storage media as recited in claim 29, wherein at least one of the one or more resources in a given client virtual network corresponds to an implementation of a provider network service. ### Claim 35 A system, comprising: a host device in a provider network comprising at least a processor and a memory and configured to: receive input via one of one or more APIs, implemented at one or more services in the provider network, to link a client resource in the provider network, but not in a client virtual network within the provider network, to one or more resources in a given client virtual network within the provider network, and responsive to the input: configure the given client virtual network to route network packets between the one or more resources and the client resource; and link the client resource to the given client virtual network according to input received via the API, wherein the linking adds a private network address of the client resource to an access control of the given client virtual network so that the client resource can access the one or more resources. ### Claim 36 (depends on 35) The system as recited in claim 35, wherein the client resource is one of a plurality of virtual machine instances on the host device, wherein the host device further implements a virtual machine monitor (VMM) configured to perform the configuring and the linking. ### Claim 37 (depends on 35) The system as recited in claim 35, wherein the host device is further configured to: obtain network packets from the client resource, each network packet indicating a target network address; determine that the target network address of at least one network packet is a network address accessible via the given client virtual network and send the at least one network packet onto the given client virtual network for routing via the given client virtual network to a respective endpoint; determine that the target address of at least one other network packet is a network address that is not accessible via a private network address space of the given client virtual network and send the at least one other network packet to a respective resource via the provider network. ### Claim 38 (depends on 35) The system as recited in claim 35, wherein: the given client virtual network implements one or more client virtual network access groups each including one or more of the given client virtual network resources; the linking the client resource to the given client virtual network comprises adding the client resource to at least one of the given client virtual network access groups; and the linked client resource can access the given client virtual network resources in the at least one access groups to which it is added. ### Claim 39 (depends on 38) The system as recited in claim 38, wherein the configuring and the linking configure the given client virtual network to route one or more network packets each indicating the private network address of the client resource as a target network address from one or more of the given client virtual network resources to the client resource. ### Claim 40 (depends on 35) The system as recited in claim 35, wherein: the given client virtual network implements one or more route tables configured for routing network packets on the given client virtual network; and the configuring adds a route to the one or more route tables for routing network packets to private network addresses on the provider network via the given client virtual network. ### Claim 41 (depends on 35) The system as recited in claim 35, wherein the given client virtual network is further configured to route one or more network packets each indicating the private network address of the client resource as a target network address from the respective endpoint to the client resource.