Storage expansion devices for provider network substrate extensions
A first one or more messages is received, the one or more messages including a request for a storage expansion device for an extension of a provider network, an identifier of the extension of the provider network, and a set of one or more identifiers associated with objects to load to the storage expansion device. For each identifier in the set, an object associated with the identifier is copied from an object store of the provider network to the storage expansion device. A shipment of the storage expansion device to a specified location is initiated. The extension of the provider network is caused to launch an instance to communicate with the storage expansion device upon connection of the storage expansion device to the extension of the provider network.
1. A computer-implemented method comprising:
receiving, by a service of a provider network, a first one or more messages including a request for a storage expansion device for an extension of the provider network, an identifier of the extension of the provider network, and a set of one or more identifiers associated with objects to load to the storage expansion device;
copying, for each identifier in the set, an object associated with the identifier from an object store including the object to the storage expansion device, wherein at least one of the objects copied to the storage expansion device is encrypted using a first key and a second key;
initiating a shipment of the storage expansion device to a specified location;
causing, by the service, the extension of the provider network to launch an instance to communicate with the storage expansion device upon connection of the storage expansion device to the extension of the provider network, wherein the extension of the provider network is in communication with the provider network via at least a third-party network; and
sending the first key and the second key to the instance via a secure tunnel between the provider network and the extension of the provider network.
2. The computer-implemented method of claim 1 , further comprising:
receiving a second message from the instance indicating the storage expansion device is available for use; and
sending a third one or more messages to the extension of the provider network to add a route to a routing table associated with an isolated virtual network of another instance hosted by the extension of the provider network, wherein the route includes an address of the storage expansion device.
3. The computer-implemented method of claim 1 , further comprising:
identifying a first object associated with an identifier in the set of one or more identifiers, wherein the first object includes client-side encryption;
decrypting the first object with a third key to generate a decrypted object;
encrypting the decrypted object with a fourth key to generate an encrypted object, wherein the fourth key can be sent to the extension of the provider network; and
storing the encrypted object in an object store associated with the extension of the provider network.
4. A computer-implemented method comprising:
receiving a first one or more messages including a request for a storage expansion device for an extension of a provider network, an identifier of the extension of the provider network, and a set of one or more identifiers associated with objects to load to the storage expansion device;
copying, for each identifier in the set, an object associated with the identifier from an object store including the object to the storage expansion device;
initiating a shipment of the storage expansion device to a specified location; and
causing the extension of the provider network to launch an instance to communicate with the storage expansion device upon connection of the storage expansion device to the extension of the provider network.
5. The computer-implemented method of claim 4 , wherein the extension of the provider network includes one or more physical computing devices located outside of a data center of the provider network and on a premises of a customer of the provider network, wherein the extension of the provider network is in communication with the provider network via at least a third-party network.
6. The computer-implemented method of claim 4 :
receiving a second message from the instance indicating the storage expansion device is available for use; and
sending a third one or more messages to the extension of the provider network to add a route to a routing table associated with an isolated virtual network of another instance hosted by the extension of the provider network, wherein the route includes an address of the storage expansion device.
7. The computer-implemented method of claim 4 :
wherein at least one object of the one or more objects copied to the storage expansion device is encrypted using a first key and a second key;
wherein the first key is associated with object-level encryption of the at least one object on the storage expansion device; and
wherein the second key is associated with block-level encryption of a volume of the storage expansion device that contains the at least one object.
8. The computer-implemented method of claim 7 , further comprising:
encrypting the first key and the second key in a manifest file using an unlock code and a hardware key associated with the storage expansion device; and
sending the manifest file and the unlock code to the instance via a secure tunnel between the provider network and the extension of the provider network.
9. The computer-implemented method of claim 4 , further comprising:
identifying a first object associated with an identifier in the set of one or more identifiers, wherein the first object includes client-side encryption;
decrypting the first object with a third key to generate a decrypted object;
encrypting the decrypted object with a fourth key to generate an encrypted object, wherein the fourth key can be sent to the extension of the provider network; and
storing the encrypted object in an object store associated with the extension of the provider network.
10. The computer-implemented method of claim 4 , wherein the storage expansion device provides an application programming interface that includes a first command to read an object from the storage expansion device and a second command to write an object to the storage expansion device.
11. The computer-implemented method of claim 4 , wherein the first one or more messages further include an indication of the specified location and an indication of an account permitted to access the storage expansion device.
12. The computer-implemented method of claim 4 , further comprising storing authentication data for one or more users on the storage expansion device.
13. A system comprising:
one or more object stores implemented by a first one or more electronic devices of a provider network; and
a service implemented by a second one or more electronic devices of the provider network, the service including instructions that upon execution cause the service to:
receive a first one or more messages including a request for a storage expansion device for an extension of the provider network, an identifier of the extension of the provider network, and a set of one or more identifiers associated with objects to load to the storage expansion device;
copy, for each identifier in the set, an object associated with the identifier from a first object store of the one or more object stores to the storage expansion device;
initiate a shipment of the storage expansion device to a specified location; and
cause the extension of the provider network to launch an instance to communicate with the storage expansion device upon connection of the storage expansion device to the extension of the provider network.
14. The system of claim 13 , wherein the extension of the provider network includes one or more physical computing devices located outside of a data center of the provider network and on a premises of a customer of the provider network, wherein the extension of the provider network is in communication with the provider network via at least a third-party network.
15. The system of claim 13 , the service including further instructions that upon execution cause the service to:
receive a second message from the instance indicating the storage expansion device is available for use; and
send a third one or more messages to the extension of the provider network to add a route to a routing table associated with an isolated virtual network of another instance hosted by the extension of the provider network, wherein the route includes an address of the storage expansion device.
16. The system of claim 13 :
wherein at least one object of the one or more objects copied to the storage expansion device is encrypted using a first key and a second key;
wherein the first key is associated with object-level encryption of the at least one object on the storage expansion device; and
wherein the second key is associated with block-level encryption of a volume of the storage expansion device that contains the at least one object.
17. The system of claim 16 , the service including further instructions that upon execution cause the service to:
encrypt the first key and the second key in a manifest file using an unlock code and a hardware key associated with the storage expansion device; and
send the manifest file and the unlock code to the instance via a secure tunnel between the provider network and the extension of the provider network.
18. The system of claim 13 , the service including further instructions that upon execution cause the service to:
identify a first object associated with an identifier in the set of one or more identifiers, wherein the first object includes client-side encryption;
cause another service to decrypt the first object with a third key to generate a decrypted object;
cause the other service to encrypt the decrypted object with a fourth key to generate an encrypted object, wherein the fourth key can be sent to the extension of the provider network; and
cause the other service to store the encrypted object in an object store associated with the extension of the provider network.
19. The system of claim 13 , wherein the storage expansion device provides an application programming interface that includes a first command to read an object from the storage expansion device and a second command to write an object to the storage expansion device.
20. The system of claim 13 , wherein the first one or more messages further include an indication of the specified location and an indication of an account permitted to access the storage expansion device.