Sending virtual desktop information to multiple devices

A virtual desktop service may receive a request from a user to provision a virtual desktop and establish a secure communications connection between the virtual desktop service, a user client device, and additional client devices via a proxy server in order to stream same feed or virtual screens from the virtual desktop to multiple client devices. The virtual desktop service may provide for natively sharing or multiplexing an entire data stream from a virtual desktop to multiple client devices or natively sharing or multiplexing portions of a data stream from a virtual desktop to render each portion on a different client device.

BACKGROUND

Current workspaces or remote desktop applications are provisioned for organizing and sharing files, and are commonly used as business communication tools for assigning tasks, scheduling meetings, and maintaining business information that is available across remote desktop terminals. Generally, virtual or remote desktop clients may span across multiple monitors only when the native operating system and device the client is executed on support multiple screens. In order to support a large number of collocated devices, such as a wall of multiple mobile devices (e.g., multiple televisions, tablet computers, e-books, etc.), where any number of the devices is running a different set of clients, a need exists to provide a method to display the same screen simultaneously on all devices, display the same screen expanded on multiple devices, provide multiple virtual windows or screen-desktops to increase screen real estate, and the like.

DETAILED DESCRIPTION

Techniques described and suggested herein relate to the joining of a client to a virtual computing service through client registration operations. In an embodiment, an administrator associated with a customer, via a virtual computing service, requests a virtual desktop environment be established in order to be utilized by the administrator, non-personal users, and/or non-desktop users. The administrator may be required to provide administrator credentials or authorization information, such as a username and password pair, in order to be authenticated with a user account for the administrator. The user account may specify permissions available for that user, such as what resources the user may access, create, and/or modify within the virtual desktop environment.

After the administrator has been authorized, the administrator may configure the virtual desktop environment according to the customer's needs. The administrator may request from the virtual desktop service that a virtual desktop or remote desktop be provisioned in order to share the virtual desktop with other client devices. For example, if the customer intends to provide access to the virtual desktop environment for ten client devices, the administrator may generate one or more client registration credentials to be provided to the client devices. The client registration credentials may be utilized by the virtual desktop environment to determine whether the client devices are authorized to access a virtual desktop of the virtual desktop environment. The client registration credentials may further contain a network address or information related to a specific virtual desktop that the client device is authorized to access.

In some example embodiments, the client devices may be a computer terminal that consists mostly of just a display monitor, a keyboard, and perhaps a mouse; such terminals are frequently referred to as “dumb terminals.” For example, the client may simply be a display monitor without an internal central processing unit (CPU) or hard disk drive (HDD); thus, a client may have little or no processing power on its own. In such cases, the client device may be operably interconnected to a network via a service provider that includes one or more servers configured to run one or more application programs that may be accessed via the client terminal. The client device may similarly be a network computer, a thin client, or any other form of computing device configured to provide a graphical user interface for receiving resources from the virtual desktop environment.

In the case of a “dumb client” or non-personal client (e.g., a computer terminal operating without a user), the administrator may provide the client registration credentials to the client or may enter the client registration credentials into the non-personal client in order for the client to gain access to the virtual desktop environment. In other embodiments, a user of a client provides the client registration credentials to a security gateway, such as an authorization or proxy server in order to access the virtual desktop environment. If the security gateway is able to authenticate, based on the provided client registration credentials, that the user of the client is authorized to access the virtual desktop environment, the security gateway may establish or provision a secure communications channel between the user's client and a virtual desktop of the virtual desktop environment.

In this manner, a client device may join the virtual desktop environment via the security gateway in order to access or receive data streams from the virtual desktop without having to install or download an agent. Once the client devices have been authorized and have established connections with the security gateway, the administrator may begin streaming data from the virtual desktop to the multiple client devices. For example, the administrator's client may receive a virtual desktop transmitted by an operating system running on an agent of the virtual desktop service. The virtual desktop may be transmitted to the administrator's client via the security gateway and, once received, the administrator may manipulate the virtual desktop via a user input device associated with the administrator's client device. The manipulated representation or description appearing on the virtual desktop is transmitted back to the agent via the gateway, and the virtual desktop service implements the modified or manipulated representation or description of what appears on the virtual desktop at the agent and transmits the new (i.e., updated) virtual desktop to the gateway. This process of manipulating and updating the virtual desktop may continue based on the needs of the administrator or other rationales.

In an embodiment, the client devices with established communications channels connecting the client device to the virtual desktop service via the gateway may begin receiving data streams from the security gateway in read-only manner, such that the client devices may receive data from the gateway but may not transmit data to the gateway. In addition, the techniques described and suggested herein can facilitate additional technical advantages. For example, because, in some embodiments, because the agent is available from the virtual desktop service, the client devices do not need to install or download a service specific or client specific agent. Further, as the client devices are operably interconnected to the virtual desktop service via the gateway, no client is directly connected with the administrator's client; the clients may continue to receive all data streams configured for each client even in the event of a failure or disconnection by the administrator's client.

FIG. 1is an example embodiment of an environment100for implementing aspects in accordance with various embodiments. As will be appreciated, although a virtual desktop service environment is used for purposes of explanation, different environments may be used, as appropriate, to implement various embodiments. In the environment100, a computing resource service provider112provides various computing resource services to customers of the computing resource service provider. The computing resource service provider112may be an organization that hosts various computing resources on behalf of one or more customers. For example, a computing resource service provider may operate one or more facilities that are used to host various computing hardware resources, such as hardware servers, data storage devices, network devices and other equipment, such as server racks, networking cables and the like.

The computing resource service provider may utilize its computing hardware resources to operate one or more services. Such services may include services that enable customers of the computing resource service provider to remotely access computing resources to support the customers' operations. The services may be used by customers to support a wide variety of activities, such as multicasting advertisements on digital billboards, operating enterprise systems supporting an organization using virtual desktops, multiplexing data streams from virtual displays from the same virtual desktop to multiple devices, and/or other activities. A virtual desktop service may be used for commercial advertising boards, scientific multiple-visual display walls, and other client devices in order to receive a virtual desktop via the service. Further example use cases may include a single computing device providing different advertisements on different devices, such as a remote computer multicasting multiple advertisements to multiple billboards in different geographic locations or a single computing device multiplexing a same data stream on multiple digital billboards or client devices. Additional use cases may include sectioning portions of a single desktop display or single virtual desktop to multiple devices, such that a display may be divided into quadrants and each quadrant is multiplexed to one of four different devices.

The customer may be an individual, organization or automated process that could utilize one or more services provided by the computing resource service provider106to provision and manage one or more resources to support operations. In some embodiments, the computing resource service provider may provide for virtual desktop services114, which may include hardware servers, data storage devices, network devices and other equipment, such as server racks, networking cables and the like for hosting virtual desktops116for customers.

As illustrated inFIG. 1, the environment100includes a virtual desktop service114that may be provided by a computing resource service provider112to its customers and other users. The virtual desktop service114may comprise one or more physical hosts, which may be used to instantiate one or more virtual machine images. These one or more virtual machine images may include an operating system and one or more applications. As with the customer client102, the virtual desktop service116may provide customers and other users with a virtual computing environment interface, which may be used to multiplex, multicast, and/or stream data streams from a single customer client to multiple user clients.

The virtual computing environment may include one or more agents that are configured to verify user identities and establish a connection between the virtual computing environment and the client network101and/or the user clients103a-cto enable access to the virtual desktop. For example, the client network101may include or be operably interconnected to a connection manager104, which may be an agent configured to enable joining of one or more clients to the virtual desktop service114. In an embodiment, an administrator, via a customer client102, may access the virtual desktop service114to provision one or more virtual desktops116. An administrator using customer client102may provide administrative credentials usable to identify the administrator and/or an associated account specifying one or more permissions for accessing and modifying objects within the virtual desktop. The credentials may be used by the connection manager104in order to authenticate the administrator, confirm that the customer client102maintains the proper authority to access the virtual desktop, and perform additional configuration and connection procedures directed to the provisioning of a communications channel between the client and the virtual desktop service.

The connection manager, once having determined proper authorization of the requesting customer client, may provide the customer client102with a network address of the virtual desktop116which the customer client is attempting to access. The customer client102may further request the connection manager or other server operably interconnected thereto, provide registration credentials, such as user names, passwords, and registration codes for user clients103a-cthat the administrator determines or decides to have join the virtual desktop service. The registration codes are provided to the user clients103a-c, which use the credentials to request, from a security gateway108, that a communications channel be provisioned, where the communications channel is used to connect the user client to the virtual desktop service via the security gateway108. The security gateway108may be a proxy server configured to enable connections between the clients and the virtual desktop service in order for the clients to receive access to the virtual desktop.

FIG. 2is an illustrative example of an environment200in which a user is authenticated for access to a virtual desktop service through a connection manager according to various embodiments. The environment ofFIG. 2provides for a first client202provisioning a virtual desktop service (VDS)214via a connection manager204. The first client202provides credential pairs to the connection manager, such as a username and password205, in order to be authenticated by the connection manager. The connection manager may be an authentication server or other administrative console configured to at least manage the connections or possible connections between the clients, being in at least one network, and the virtual desktop service being in a different network.

Once the connection manager204receives the credential pairs, the connection manager may access a user account associated with the credentials to determine whether the credentials are authentic and, if so, determine whether the first client is authorized to access and/or modify the virtual desktop (VD)216in the virtual desktop service214. Authentication, authorization, and/or registration information may include credentials and/or information derived from credentials, including information cryptographically derived from credentials. The registration information may be generated and provided to a client, such that the registration information includes the registration credentials. After the connection manager has authenticated the first client and determined the access the first client is to be provided, the connection manager provides the first client202with information regarding the virtual desktop206the first client is permitted to access. Furthermore, the connection manager may provide an acknowledgement to the security gateway208that the first client has been authenticated and is authorized up to certain permissions to access the virtual desktop service214and perform one or more actions using the virtual desktop216or other permitted activities.

In some example embodiments, a servant client may be configured to transmit a request message, to the connection manager, to receive a virtual desktop from the virtual desktop service. The connection manager, in real time, near real time or based on previously configured administrative controls, may grant or deny the request. When the connection manager grants the request from the servant client, the connection manager responds to the servant client and provides a token. The servant client transmits the token to the security gateway in order to receive the virtual desktop, and the security gateway transmits the token back to the connection manager to confirm the token is valid. Once the token is validated by the connection manager, the security gateway initiates a log-in process for the servant client.

Provided by a computing resource service provider212, the virtual desktop service214is provisioned according to a request for a network resource made by the first client. The virtual desktop service may include one or more physical hosts, which may be used to instantiate one or more virtual machine images that may include an operating system and one or more applications. The virtual desktop service214having the established VD216may transmit the VD (e.g., may transmit a representation or description of what appears on the virtual desktop216) from the operating system of the host to the first client202via the security gateway208. In the example embodiment ofFIG. 2, the virtual desktop is shown as combined blocks210,220, and230, which is transmitted from the VDS to the gateway208and then to the first client. A user of the first client, upon receipt of the VD at the first client, may manipulate the VD as per the user's permissions, and the information detected as being performed by the user of the first client is transmitted (e.g., via a data stream) to the virtual desktop service via the gateway208.

Once the VDS214receives a modified or manipulated representation or description of what appears on the virtual desktop from the first client202, the VDS implements the manipulations performed by the user of the first client at the server and transmits the new VD (being the updated version of the original VD) back to the gateway208. This process (e.g., the path from the VDS to the gateway to the first client, and then from first client to the gateway to the VDS) may continue for an undefined period of time (e.g., indefinitely), as the communications channel is open and is available for the user of the first client while using the virtual desktop in some capacity.

The various modification, manipulations, or access the user of the first client performs on the VD may be monitored by the virtual desktop service in order to determine changes made. Some embodiments include detecting input made by the user of the first client via an input method, for example, such as user input from a computer keyboard, virtual keyboard or motion from a pointing device such as a mouse or a finger on a touch-screen. Additional examples of input received by a client may include, for example, detecting scrolling in a window, detecting the distance of a scroll event, detecting resizing of a graphical user interface and other events currently known or hereinafter developed useful for tracking human user input. As some scripting languages, such as JavaScript®, are configured to be executed locally in a client, a client executing a script may detect a user's actions on the client, such as individual keystrokes or mouse movements or other events from an input device. It is noted that an input device may be a physical or virtual input device. Examples of interaction events may include, mouse click events, key stroke events, touchscreen events, swipe events, gesture events, window resize events, haptic response events, scrolling events, mouse movements and other such human user actions currently known or hereinafter determined for tracking user behavior. Such interaction event data, and possibly additional data/information attached thereto, may be recorded in a log or memory at, or operably interconnected with, the client, the gateway, and/or the virtual desktop service.

Turning back toFIG. 2, three additional clients, such as clients203a-c, may be digital billboards that are configured to receive content (e.g., audiovisual content) from a streaming server. A user interacting with a remotely executed computer system desktop environment, such as the virtual desktop service214, may provide information to the streaming server to provide the content to the additional clients. The clients203a-care provided with respective registration codes215a-cby the first client and the registration codes are utilized by the security gateway208in order to identify and authorize each of the clients203a-cand provision a secure communications channel for each of the clients. Once the clients203a-chave been connected with the virtual desktop service in the virtual computing environment, each client's access is defined by the administrator's configurations (not shown).

Accordingly, the embodiment ofFIG. 2depicts client203areceiving a first portion210of the virtual desktop216displaying an “A” in the billboard; client203breceiving a second portion230of the virtual desktop216displaying a “C” in the billboard; and client203creceiving a third portion220of the virtual desktop216displaying a “B” in the billboard. The administrator is able to configure the viewing specifications for each client accessing the virtual desktop service, such that the administrator may manipulate the virtual desktop in the manner they choose, and the three portions210,220, and230of the virtual desktop216will only be multiplexed to the client that is configured to receive that portion of the virtual desktop. In other words, the security gateway208is provided with configuration terms such that the data stream of the virtual desktop216is multiplexed into three portions, such that portion “A”210is only multiplexed to client203a, portion “B”220is only multiplexed to client203c, and portion “C”230is only multiplexed to client203b.

In alternative example embodiments, when a customer or other administrator first accesses the virtual computing environment service, he/she may request provisioning of one or more virtual computing environments, which delegated users may utilize to interact with one or more applications and data as defined by the customer or other administrator. In this manner, a client device may join the virtual desktop environment via the security gateway in order to access or receive data streams from the virtual desktop without having to install or download an agent. Once the client devices have been authorized and have established connections with the security gateway, the administrator may begin streaming data from the virtual desktop to the multiple client devices. For example, the administrator's client may receive a virtual desktop transmitted by an operating system running on an agent of the virtual desktop service. The virtual desktop may be transmitted to the administrator's client via the security gateway and, once received, the administrator may manipulate the virtual desktop via a user input device associated with the administrator's client device. The manipulated representation of what appears on the virtual desktop is transmitted back to the agent via the gateway and the virtual desktop service implements the modified representation of what appears on the virtual desktop at the agent and transmits the new (i.e., updated) virtual desktop to the gateway. This process of manipulating and updating the virtual desktop may continue based on the needs of the administrator or other rationales.

FIG. 3is an illustrative example of an environment300showing a master client user interface and a servant client user interface in accordance with at least one embodiment.FIG. 3displays a master client302, which may be an administrator client with a split-screen monitor311that enables the administrator to divide the portion of their graphical user interface into multiple sections. In the instant embodiment, the split-screen monitor is divided into two sections, delineated by a “casting” half and a “not casting” half of the monitor. This enables the administrator to maintain applications on their screen without sharing it with the servant clients, such as servant client303.

The servant client303is a billboard terminal receiving the virtual desktop from the master client via the proxy server304. As inFIGS. 1 and 2, the servant client is configured to receive client credentials from the administrator in order to request to join the virtual computing environment provided by the virtual desktop service314. The virtual desktop service314provides the virtual desktop316to the master client via the proxy server304, wherein the proxy server is configured to multiplex a data stream to the servant client according to the configurations selected by the administrator. The proxy server may be a multi-tenant service implemented via a computer resource service provider, which may be an Internet-as-a-Service, Platform-as-a-Service, and/or Software-as-a-Service provider. The proxy server may be scaled according to the number of clients (or instances) that are receiving the data stream.

The administrator may manipulate the virtual desktop316on the monitor311such that there is a visible delineating line319to provide visual reference for the user to determine which applications are being multi-casted to a group of clients and which applications are simply visible to the user. At the servant client303, the virtual desktop317is being multiplexed by the proxy server to the servant client in order to provide the servant client with the data stream configured by the administrator to be accessed by the servant client. The administrator may determine the configurations prior to provisioning the virtual desktop service or may configure the servant configurations when the commands are executed (e.g., at runtime). The administrator may further modify the applications on the monitor in order to move an application from the not casting portion of the monitor to the casting portion of the monitor.

In alternative example embodiments, the virtual computing environment allows for scalability for security based on the number of instances receiving multicasting, such that a master client may establish a communication channel with a desktop service, servicing multiple desktops, via multiple security gateways.

FIG. 4is an illustrative example of a process400for authenticating a user for access to a virtual desktop service in accordance with at least one embodiment. The process400may be accomplished by a proxy server, such as a security gateway208depicted and described in connection withFIG. 2or a suitable component thereof. As illustrated inFIG. 4, the process400may include a gateway receiving a request to establish a virtual desktop (402). The gateway may provision a virtual computing environment, including establishing a secure communications channel between a master client and the virtual desktop service (404).

The gateway may further be configured to receive additional requests, where a servant client provides registration credentials from the master client to the gateway (406). Once the gateway or other suitable component thereof has successfully authorized the servant client based at least in part on the provided registration credentials, the gateway establishes a communications channel for the servant client to join the virtual computing environment (408). The gateway receives a data stream from a virtual desktop service (410) and transmits at least a part of the data stream to a servant client (412).

In further example embodiments, an agent, such as a server, operating within the virtual desktop service may be configured to monitor one or more of the user clients or servant clients to ensure that the request to join the virtual desktop service to the one or more managed directories is fulfilled. Further, the agent may perform other actions to address failures associated with a user client being denied access to the virtual desktop service (e.g., transmit notification to an administrator or the customer regarding the issue).

FIG. 5is a swim diagram illustrating a process500for provisioning a virtual desktop in a virtual desktop service in accordance with some embodiments. The process500may be performed, for example, by various components of the virtual computing environment described and illustrated in connection withFIGS. 1-3. For example, the process500may be performed by a customer client, such as the customer client102, a virtual desktop service, such as the virtual desktop service114, a user client, such as the user client103, and a security gateway, such as the security gateway108all depicted and described in connection withFIG. 1or a suitable component thereof.

Returning toFIG. 5, the process500includes at a step502, a customer client transmitting, to a connection manager, a request to provision a virtual desktop service, and including authorization credentials of the customer client. In step504, the customer client receives a response from the connection manager, based on the credentials being authorized, including virtual desktop service configuration information. The configuration information includes, for example, a network address for the virtual desktop service. At step506, the customer client transmits a request, to a security gateway, to establish a communications connection with a virtual desktop service. The security gateway, at step508, receives the request and, at step510, establishes a secure communications connection between the customer client and the virtual desktop service.

At step512, the customer client transmits, to the user client, credentials for the user client to join the virtual desktop service. The customer client may transmit user client credentials at any time after the customer client has requested the credentials be generated. The user client, at step514, receives the credentials to provide to the security gateway with a request to join the virtual desktop service. Joining the virtual desktop service may include maintaining limited access rights to read data from and transmit data to the security gateway. At step516, the user client transmits, to the security gateway, a request to join the virtual desktop service, the request including the provided credentials for the user client. Upon receipt and validation of the credentials, at step518, the security gateway establishes a communications channel with the user client, wherein the user client is in direct communications with the security gateway, but is not directly connected with the customer client.

At step520, the virtual desktop service transmits a virtual desktop to the customer client via the security gateway. The customer client, at step522, receives the virtual desktop from the virtual desktop service and a user of the customer client may access, manipulate, or modify the virtual desktop according to the authorizations provided. At step524, the customer client transmits the virtual desktop back to the virtual desktop service via the security gateway. The virtual desktop may similarly be automatically returned to the virtual desktop service based on certain actions; for example, the virtual desktop may be updated at the virtual desktop service each time the user of the customer client opens a new file. The virtual desktop service receives the manipulated representation of what appears on the virtual desktop, and, at step526, updates the original virtual desktop with the changes performed by the user of the customer client. The virtual desktop service transmits the virtual desktop to the security gateway at step528. In some example embodiments, the virtual desktop may be automatically provided to the security gateway upon completion of the updated information.

At step530, the security gateway, having received an updated virtual desktop including the changes or actions performed on it by the user of the customer client, multiplexes a data stream of the virtual desktop to the user clients associated with the virtual desktop service. At step532, the user clients receive the multiplexed data stream of the virtual desktop according to the configuration for each user client.

While many of the disclosed embodiments are described in the context of a system where the client device is remotely situated from other computing resources, at least some embodiments can also be used in situations where the client device interacts with computing resources located in an on-premises installation. For example, the client device could use a virtual desktop infrastructure (VDI) located within the same building or campus as the client device.

FIG. 6shows an illustrative example of an environment600in which various embodiments can be implemented. In the environment600, a computing resource service provider602may provide a variety of services to a customer604or other users. The customer604may be an organization that may utilize the various services provided by the computing resource service provider602to remotely generate and maintain one or more resources and provide a mapping of user roles for use within a customer network to enable management of one or more delegated access permissions to define a level of access for users of his or her resources. As illustrated inFIG. 6, the customer604may communicate with the computing resource service provider602through one or more communications networks606, such as the Internet. Some communications from the customer604to the computing resource service provider602may cause the computing resource service provider602to operate in accordance with various techniques described herein or variations thereof.

As noted above, a computing resource service provider602may provide various computing resource services to its customers. For instance, in this particular illustrative example, the computing resource service provider602provides at least seven types of services. The services provided by the computing resource service provider, in this example, include a virtual computer system service608, a database service610, an object-based data storage service612, a block-level data storage service614, a managed directory service616, a virtual network service616, a virtual computing environment service620and one or more other services622, although not all embodiments of the present disclosure will include all such services and additional services may be provided in addition to or as an alternative to services explicitly described herein.

The virtual computer system service608may be a collection of computing resources configured to instantiate virtual machine instances onto virtual computer systems on behalf of the customers604of the computing resource service provider602. Customers604of the computing resource service provider602may interact with the virtual computer system service608to provision and operate virtual computer systems that are instantiated on physical computing devices hosted (e.g., physical hosts) and operated by the computing resource service provider602. The virtual computer systems may be used for various purposes, such as to operate as servers supporting a website. Other applications for the virtual computer systems may be to support database applications, electronic commerce applications, business applications, and/or other applications.

The object-based data storage service612may comprise a collection of computing resources that collectively operate to store data for a customer604. The data stored in the data storage service612may be organized into data objects. The data objects may have arbitrary sizes except, perhaps, for certain constraints on size. Thus, the object-based data storage service612may store numerous data objects of varying sizes. The object-based data storage service612may operate as a key value store that associates data objects with identifiers of the data objects, which may be used by the customer to retrieve or perform other operations in connection with the data objects stored by the object-based data storage service612. Access to the object-based data storage service612may be through appropriately configured API calls.

The block-level data storage service614may comprise a collection of computing resources that collectively operate to store data for a customer. For instance, the block-level data storage system may be configured to provide block-level data storage volumes for use with a virtual machine instance, as noted above. A customer may interact with the block-level data storage service614to provision a block-level data storage volume that, in turn, may be mounted as a storage device (e.g., hard drive) onto a virtual machine instance. The storage volume may be configured to behave like a raw, unformatted block storage device with a block level customer interface. Accordingly, a customer, through properly configured API calls to the service, may create a file system on top of the block-level data storage volumes or utilize the volume as a block-level storage device (e.g., a hard drive).

The managed directory service616may provide a variety of services to enable computer systems and/or computer system client devices to access customer directories including, but not limited to, authentication, authorization, and directory services. For example, the managed directory service616may provide authentication services, which may authenticate credentials of a user, computer system, process, automated process or other such entity to at least determine whether that entity is authorized to access the managed directory service616and/or the customer directories associated with the managed directory service616. In some embodiments, the credentials may be authenticated by the managed directory service616itself, or they may be authenticated by a process, program or service under the control of the managed directory service616, or they may be authenticated by a process, program or service that the managed directory service616may communicate with, or they may be authenticated by a combination of these and/or other such services or entities.

The managed directory service616may also provide authorization services, which may authorize a user, computer system, process, automated process, or other such entity to at least determine which actions of one or more possible actions that entity may perform. Examples of actions that an entity may or may not be authorized to perform include, but are not limited to, creating directories on the customer directory, destroying directories on the customer directory, attaching to directories on the customer directory, detaching from directories on the customer directory, providing access links to directories on the customer directory, reclaiming access links to directories on the customer directory, allowing reads from directories on the customer directory, allowing writes to directories on the customer directory and/or other such actions.

The managed directory service616may also provide directory services, which may provide an authenticated entity access to the customer directories according to the authorization credentials and/or policies. For example, in an embodiment where a computer system entity may be authorized to read and write a certain data store on a customer directory, the ability to do so may be provided by the directory services. Directory services may provide access to customer directories by providing links to the customer directory locations such as by a URI object or some other such linkage. As may be contemplated, the URI may be provided by the computer system client device, or by a process running at the data center, or by a process running on a computer system connected to the data center, or by the managed directory service716, or by a combination of these and/or other such computer system entities.

The virtual network service618may enable customers to provision a logically isolated virtual network within the computing resource service provider602environment. Within this isolated virtual network, a customer604may be able to define a range of IP addresses for various computing resources and configure network gateways and virtual network interfaces to enable public communications with these computing resources. Through the virtual network service618, a customer604may be able to create a network connection between his/her on-premises network and the virtual network, such that the computing resources within the computing resource service provider602environment may be able to access computing resources located within the customer's on-premises network.

The virtual computing environment service620may allow customers604to interact, through the interface, with one or more virtual computing environments. For instance, the virtual computing environment service620may enable customers604to remotely manage and maintain one or more virtual machine images. These virtual machine images may be maintained in data storage within a virtual machine image data store. When a customer604submits a request for provisioning a virtual machine instance, the virtual computing environment service620may identify the machine image the customer604has requested and allocate the resources necessary (e.g., the processors and random-access memory (RAM) required to operate the components of the machine image) to process the machine image. The machine image may be instantiated on one or more physical storage devices (e.g., one or more servers or hard drives) that may act as a physical host for the instance. The virtual computing environment may be configured to communicate with one or more managed directories through the managed directory service616or through a directory domain controller within the customer's604on-premises network.