Question: Why are Availability Zone Names Inconsistent?

"I'm having trouble creating a Terraform Plan that creates subnets. Specifically, I sometimes get errors that the Availability Zones don't exist.Doing some troubleshooting I noticed really strange behavior in AWS when it comes to AZ name to AZ ID mappings, and just AZ names in general.When I do this in the aws cli: aws ec2 describe-availability-zones --region us-west-1I see the following:ZoneName: us-west-1bZoneID: usw1-az3ZoneName: us-west-1cZoneID: usw1-az1In the AWS GUI Console I'm logged in to two different accounts, but both are set to N. California.When I go to create a new subnet, in one account the two available AZs are:us-west-1b (usw1-az3)us-west-1c (usw1-az1)But in the other account when I create a subnet the two AZs listed are:us-west-1a (usw1-az1)us-west-1c (usw1-az3)I don't really care as long as the subnets get created in two diff AZs, but I don't know whether to use a & b, b & c, or a & c.What gives?FollowComment"

Answer: "0Accepted AnswerAvailability Zones represented by a particular letter can mean different AZs to different AWS accounts. For example for Account A us-west-1a can be different from what us-west-1a is for account B.In Cloudformation, you can usePublicSubnet1:    Type: AWS::EC2::Subnet    Properties:      VpcId: !Ref VPC      AvailabilityZone: !Select [ 0, !GetAZs '' ]       CidrBlock: !Ref PublicSubnet1CIDR      MapPublicIpOnLaunch: true      Tags:        - Key: Name          Value: !Sub ${EnvironmentName} Public Subnet (AZ1)PublicSubnet2:    Type: AWS::EC2::Subnet    Properties:      VpcId: !Ref VPC      AvailabilityZone: !Select [ 1, !GetAZs  '' ]      CidrBlock: !Ref PublicSubnet2CIDR      MapPublicIpOnLaunch: true      Tags:        - Key: Name          Value: !Sub ${EnvironmentName} Public Subnet (AZ2)Note how different array indexes are chosen for the two Public Subnets in the AvailabilityZone: !Select [ 0, !GetAZs '' ]  statement in the Cloudformation template snippet above, thereby ensuring the two subnets are created in two different AZsI see a similar concept being used in Terraform - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones# Declare the data sourcedata "aws_availability_zones" "available" {  state = "available"}# e.g., Create subnets in the first two available availability zonesresource "aws_subnet" "primary" {  availability_zone = data.aws_availability_zones.available.names[0]  # ...}resource "aws_subnet" "secondary" {  availability_zone = data.aws_availability_zones.available.names[1]...}CommentShareEXPERTIndranil Banerjee AWSanswered 9 months agoEXPERTToni_Sreviewed 9 months agoToni_S EXPERT9 months agoThis is also publicly documented behaviour: https://docs.aws.amazon.com/ram/latest/userguide/working-with-az-ids.htmlAnd we have some naming convention guidance: https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/use-consistent-availability-zones-in-vpcs-across-different-aws-accounts.htmlShare"


Question: How to handle Kafka CVE-2023-25194 when MSK does not support the patched version

Apache recently released a report on CVE-2023-25194 - POSSIBLE RCE/DENIAL OF SERVICE ATTACK VIA SASL JAAS JNDILOGINMODULE CONFIGURATION USING KAFKA CONNECTWe are using MSK for Kafka.  The fixed version for this vulnerability (3.4.0) is not yet available in MSK.  I'm hoping someone can help me understand what we can do about this vulnerability.FollowComment

Answer: 0As state in CVE-2023-25194 this is an issue with Apache Kafka Connect. Do you use the MKS Connect?CommentShareIbrahim Cesaranswered 3 months ago


Question: Amazon DNS server and VPC Primary CIDR block

"In the documentation[1][2] it says "For VPCs with multiple CIDR blocks, the IP address of the DNS server is located in the primary CIDR."I had planned out a network topology, but when I read that sentence it now has me wondering if I need to treat that first subnet in the primary CIDR block differently than any other subnet.I'm trying to understand what that means in relation to the IP address at the network base+2 that's reserved for the AWS DNS server on each subnet.  As I understand it, a Subnet can have only one IPv4 CIDR block, so does this mean that if a Subnet is given a CIDR block from a non-primary VPC CIDR then while the network base+2 address is reserved for AWS DNS, there won't be anything there?Another possible way I can interpret that statement is that if I allocate 10.32.0.0/16 to a VPC, and then create only one Subnet with CIDR 10.32.16.0/20 that there might be issues with AWS DNS because there's no subnet containing 10.32.0.2?  Or that there might be issues if there was a network containing that IP but access to it from some other subnets is blocked by ACL?FollowComment"

Answer: "1Accepted AnswerYour subnet design is independent of AWS VPC DNS, see below statement:The Amazon DNS server does not reside within a specific subnet or Availability Zone in a VPC. It's located at the address 169.254.169.253 (and the reserved IP address at the base of the VPC IPv4 network range, plus two) and fd00:ec2::253. For example, the Amazon DNS Server on a 10.0.0.0/16 network is located at 10.0.0.2. For VPCs with multiple IPv4 CIDR blocks, the DNS server IP address is located in the primary CIDR block.Reference: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.htmlCommentShareEXPERTTushar_Janswered 3 months agobuc 3 months agoJust mentioning for clarity that this does mean that the subnet containing VPC Primary CIDR base+2 is special, and this should be taken into account with network design.For example, with the topology shown at https://aws-quickstart.github.io/quickstart-aws-vpc/ the VPC is 10.0.0.0/16, so the DNS server will use the IP 10.0.0.2, which is located within "Availability Zone 1" / "Private subnet A".  If there were ACLs that prevented any of the other subnets from communicating with that subnet then systems on those subnets could only use the 169.254.169.253 IP for the AWS DNS service.Share"


Question: Account Verification issue with new accounts joined under existing AWS Organization

"I have experienced a few times that new AWS accounts created under AWS Organization don't get verified. Hence, I was not able to use services like CloudFront Distribution, CodeBuild project, etc. because the default limit doesn't get applied until verification is done.When I opened a support case with AWS, they ask to submit a request for a limit increase. But in reality, this is not a service limit or quota issue. I wasn't able to create one CDN distribution or run one CodeBuild project.If I go to Service Quotas and request for CDN distribution limit, I can't put any value lower than 200 because that's the default quota. But I literally need to create just one distribution.AWS needs to tackle these two issues differently. If customers are not able to use any service due to account verification then that should not be treated as service limit issue.If there is any AWS representative here to respond to this, I can share the case numbers for reference.FollowComment"

Answer: "0Hi Ricky,I'm sorry for any frustration regarding our processes for account verification and service quotas, and I've passed along your feedback internally for further review. Since we're not able to discuss account or case specifics here for security reasons, I recommend providing feedback directly within your cases for our support agents to reference, so we may better assist you.Best regards,- Kita B.CommentShareEXPERTAWS Support - Kitaanswered 6 months ago"


Question: Lightsail instance slows down and website stops responding

"Hi there,I have many Lightsail instances for small, low demand websites. I have one though which I setup around 18 months ago. Recently, in the past few months it has been alerting me to the CPUUtilization being too high and it the site fails to respond.I am able to restart the instance it and then it was fine for a few days more. Now though, it only lasts a matter of minutes. I managed to get in and update Wordpress and plugins. I am not sure how to troubleshoot it further if it is completely non respnsive. Wordfence has now given me any errors either.Domain: https://cloverleaf3d.xyz/Instance: 512 MB RAM, 1 vCPU, 20 GB SSDMonitored Details:MonitoredResourceType: Lightsail/InstanceMonitoredResourceName: Cloverleaf3DComparisonOperator: GreaterThanOrEqualToThresholdThreshold: 5.0 PercentMetricName: CPUUtilizationPeriod: 300 SecondsStatistic: AverageAny help to diagnose would be really appreciated.Thanks!FollowComment"

Answer: 1Lightsail specs are likely to be low and we recommend increasing the specs.Spec changes can be made by using the methods in the following documents.https://repost.aws/knowledge-center/change-lightsail-planCommentShareEXPERTRiku_Kobayashianswered 13 days ago0Thank you. I honestly think it should be OK as the site is so lightweight and almost no traffic. I think I may have diagnosed a plugin conflict.CommentShareJack155Q4answered 12 days ago


Question: Cannot open Configuration in Elastic Beanstalk because of an invalid option value

"When I try to open the Configuration page I get the following error message:A problem occurred while loading your page: Configuration validation exception: Invalid option value: '5.6.51' (Namespace: 'aws:rds:dbinstance', OptionName: 'DBEngineVersion'): Engine Version 5.6.51 not supported for mysql dbDo I need to upgrade my Elastic Beanstalk environment to Amazon Linux 2? I tried to update my database version but the "DB parameter group" input gets grayed out so I cannot add anything and I am required to in order to upgrade it.FollowComment"

Answer: 0This should fix your problem :https://stackoverflow.com/questions/71209961/cant-set-rds-while-creating-elastic-beanstalk.It worked for me but now I want to disconnect the database from my EB environment and I get the same error...CommentShareAWS-User-5933005answered a year ago


Question: Programatically detach EMR clusters from EMR Studio workspaces

"Hello team, is there a way to programmatically attach and detach EMR clusters from a studio workspace? I didnt see an action in the EMR API, seems like it can only be done manually from the workspace UI. My customer needs to be able to detach the cluster as they are shutting down the clusters overnight and then reattaching doesnt work again in the mornings. Thanks!FollowComment"

Answer: "0As of today, unfortunately there's no such Programatic  API.CommentShareMannem Ranswered 5 months ago"


Question: Does AWSManagedRulesAmazonIpReputationList only look for BOTS?

"We want to use the AWS WAF to block traffic from known bad IPs.  However, when looking at the documentation and posts about the AWSManagedRulesAmazonIpReputationList rule set, it seems it only blocks identified BOTS, but doesn't distinguish between known malicious IPs and others.  Is that correct?  If so, does AWS have managed rules that can help me accomplish what I need?FollowComment"

Answer: "0Hi Scot, inside of Amazon IP reputation List you can use 03 rules:AWSManagedIPReputationList - Inspects for IP addresses that have been identified as bots.AWSManagedReconnaissanceList - Inspects for connections from IP addresses that are performing reconnaissance against AWS resources.AWSManagedIPDDoSList - Inspects for IP addresses that have been identified as actively engaging in DDoS activities.All of these rules are based on AWS IP Reputation List rule group that are based on Amazon internal threat intelligence.https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-ip-rep.htmlIn case that you want to control your own IP list you can create your own rules and rule groups. https://docs.aws.amazon.com/waf/latest/developerguide/waf-user-created-rule-groups.htmlCommentShareMHollandaanswered 2 months agoscot 2 months agoMy main question was related to AWSManagedIPReputationLIst.  It appears you are not basing that on reputation at all, but just that something behaves like a BOT.  I have seen others questioning this as well, identifying cases where legitimate BOTs, like ones owned by Google for indexing purposes, are being blocked.  I really need something that is blocking known bad IPs, not just blocking all BOTs.  Do you have a managed rule set that does that?ShareMHollanda 2 months agoBefore using any managed rule group in production, it is recommended to test it in a non-production environment according to the guidance (https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-testing.html). Follow the testing and tuning guidance when you add a rule group to your web ACL, to test a new version of a rule group, and whenever a rule group isn't handling your web traffic as you need it to. Using this best practice you can evaluate if it is blocking any BOT IP that should not be blocked bases on your requirements.Share"


Question: Apigateway S3 Proxy Integration -- How to handle keys that don't exist?

"GoalI have set up an apigateway rest api that has a s3 proxy using an aws integration.Currently it is mostly working.ProblemIf I pass in a path that is not a key in the s3 bucket, I get an xml page that displays xml with a NoSuchKey error code.For context, this s3 bucket is set up for static web hosting & it does have an index and error document specified, so ideally the index.html page should be returned rather than the error code xml.QuestionsIs it possible to return a default html page when aws integration response is a 404 error?Do I need to change anything in the aws integration settings to get the s3 bucket to return it's error page instead of the nosuchkey xml?Is there any resources/ recommendations for how to handle 404 errors with s3 integrations?FollowComment"

Answer: "0Yes, it is possible to return a default HTML page when the AWS integration response is a 404 error. To do this, you will need to set up an error handling mechanism in your API Gateway REST API.One way to handle 404 errors is to use an HTTP integration with a mock integration to return a default HTML page. To do this, you can create a mock integration in your API Gateway REST API and specify an HTTP status code of 404 and a response body that contains the HTML for the default page that you want to return.Then, you can set up a catch-all route in your API Gateway REST API that routes all requests to the mock integration. This catch-all route can be set up using a wildcard path parameter, such as {proxy+}. This will catch any request that does not match any of the other routes in your API, including requests for non-existent keys in your S3 bucket.Alternatively, you can configure your S3 bucket to return a default page for 404 errors. To do this, you can specify an error document in the S3 bucket's static website hosting configuration. When a request is made for a non-existent key, S3 will return the error document instead of the NoSuchKey error code.CommentShareSeanSianswered 5 months agorePost-User-5328691 5 months agoI should have clarified, but the way that the apigateway aws integration s3 proxy works is:I have the following route structure:{default} - GET method is an aws integration that gets the s3 object from a bucket using the path override bucketname/default{default}/{proxy+} - GET method is an aws integration that gets the s3 object from a bucket using the path override bucketname/default/proxyI am confused by your answer-- if I got a 404 error from the aws integration, how would I then route back to the mock http integration to return a 404 response?Also as mentioned in my post, I have already set the error document in the s3 buckets static website hosting config, but I still get the nosuchkey xml instead of the error page.  Is there anything else that I would need to configure on the s3 bucket to ensure that the bucket returns the error page instead?Share"


Question: SES Authorization Policy not working

"Hello, within SES sending mails is possible and working, but i would like to restrict the FROM address which is not working.Even with a limiting(aws@example.com) sending authorization policy I can send with any FROM address.Here is my Sending authorization policies:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "XXX",      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::XXX:user/ses-smtp-userXXX"      },      "Action": "ses:SendRawEmail",      "Resource": "arn:XXX:identity/XXX",      "Condition": {        "StringLike": {          "ses:FromAddress": "aws@example.com"        }      }    }  ]}IAM policy:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": "ses:SendRawEmail",            "Resource": "*"        }    ]}Do i have to set the condition also for the IAM policy? What is the better/right way for which use-case: IAM or sending authorization policyFollowComment"

Answer: "0Accepted AnswerHi.The default policy is allowed.You can allow only specific addresses by denying other than specific From addresses as shown below.{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "XXX",      "Effect": "Deny",      "Principal": {        "AWS": "arn:aws:iam::XXX:user/ses-smtp-userXXX"      },      "Action": "ses:SendRawEmail",      "Resource": "arn:XXX:identity/XXX",      "Condition": {        "StringNotLike": {          "ses:FromAddress": "aws@example.com"        }      }    }  ]}CommentShareEXPERTiwasaanswered a year ago"


Question: Run RDP Client on MacBook

"Greetings,I am running a MacBook trying to connect to an AWS Instance that is running, using Microsoft Remote Desktop.I downloaded the Remote Desktop file, and added it to Microsoft Remote Desktop.I have installed and launched Microsoft Remote Desktop.I entered the Public DNS that is in the Connect to instance, get an error message.Any suggestions to resolve this issue is much appreciated.ThanksCliveERROR**We couldn't connect to the remote PC. Make sure the PC is turned on and connected to the network, and that remote access is enabled.Error code: 0x204**FollowCommentClives-online 7 months agoHi Indranil, Thanks for your input, just to give some background. I am running on a MacBook, NOT Windows.I edited the Firewall adding the Microsoft Remote Desktop appAllowing incoming connectionsI downloaded a RDP fileThe Session Manager says that Session Manager is not installed.The AWS documents says "AWS Systems Manager Agent (SSM Agent) is preinstalled".I don't understand why it is not available??When I try to connect to the AWS Windows instance I get the Error code: 0x204** It is really frustratingShare"

Answer: "2Have you taken a look at this document - https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/troubleshoot-connect-windows-instance.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 7 months agoEXPERTAWS-User-Nitinreviewed 7 months ago0The solution was really simple, the error message sent me down a rabbit hole.I needed to add a RDP Security rule, and it connected.CommentShareClives-onlineanswered 7 months ago"


Question: Getting InvalidS3ObjectException: Unable to get object metadata from S3

"About two weeks ago or so, I have started seeing in the logs the following error message that is produced as a result of "startDocAnalysis" call.2021-06-09T03:52:54.215Z5e1c9ff3-7b60-5522-b6bd-c6c9463127dfERRORInvalidS3ObjectException: Unable to get object metadata from S3. Check object key, region and/or access permissions.at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:52:27)at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20)at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10)at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:688:14)at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:690:12)at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:116:18) {code: 'InvalidS3ObjectException',time: 2021-06-09T03:52:54.212Z,requestId: '598d7ac4-00ac-4c25-b239-6c9deba0e3d1',statusCode: 400,retryable: false,retryDelay: 26.7125437006851}The code that we use didn't change, and it issues a retry in a few seconds automatically and the second "startDocAnalysis" call succeeds.Seeing this in eu-west-2 region.What is causing this behavior? I assume there was a change in the underlying AWS infrastructure either for S3 or for Textract.Regards,AlbertFollowComment"

Answer: "0Hi Albert,Thank you for choosing Textract. I took a look at our log and it seems like for this request and other 2 requests, we couldn't get object metadata from S3. Could you check object key, region and/or access permissions are setup correctly? If nothing is wrong and it happens again, feel free to cut us a ticket and we will do a further investigation.ThanksAlanCommentShareAWS-User-3852616answered 2 years ago0Hi Alan,The files for processing were there. They were uploaded into an S3 bucket as part of our pipeline before the Textract processing was started. And as I have mentioned previously, we have auto retry that kicked off a 2nd attempt to do Textract processing, and the second attempt succeeded.This is new behavior, I started seeing this around May 25 or so. Previously it did have this issue (our processing pipeline didn't change).Also worth mentioning, this doesn't happen for all files that we process. For example, if we issue processing for, say, 200 files, only one or two PDF files will issue this error. And in some cases the error doesn't happen at all and everything works just fine.Regards,AlbertCommentShareAlbertKanswered 2 years ago0Hi Albert,Took a deeper look. We could see error message 404 status code while trying get the metadata from s3. Could you please let us know how do you prepare the data (e.g. data uploaded to S3, and then call textract), and whether the data is encrypted using CMK or S3 managed key? After knowing it, we would have more detail to discuss with S3 team to understand why the data was not available immediately. Maybe there are strong consistency and weak availability issue.ThanksAlanCommentShareAWS-User-3852616answered 2 years ago0Hi Alan,The processing that we have is as follows.Obtain S3 URLs. They are given to us via s3.getSignedUrl('getObject', params) call. Usually there are two URLs given to us as part of the work item (there could be many work items).Upload files into working S3 bucket via s3.upload(params).Once files are uploaded (code physically waits until the files are uploaded), the process publishes SNS message for downstream processing.Downstream processing checks whether a PDF file has been submitted into Textract, and if not then issue startDocAnalysis call.This is where we are seeing occasionally the aforementioned error.Files are not encrypted. We are using js SDK if that has matters.Regards,AlbertCommentShareAlbertKanswered 2 years ago0Hi Albert,Thank you for providing your data preparing information. We will forward this issue to S3 team and make improvement on this.ThanksAlanCommentShareAWS-User-3852616answered 2 years ago0I'm having the exact same issue, same sort of data preparationCommentSharegeoffatsourceanswered 7 months ago0I found my problem - looks like the Textract SDK must be configured to be in the same region as the bucketCommentSharegeoffatsourceanswered 7 months ago"


Question: Local IoT device's unique value

"How do you get a specific local IoT device's unique value?for example, IP address　or MAC address.My local IoT device is Raspberry Pi.v1.9 and node.js lambda functions.FollowComment"

Answer: "0Not sure about JS, but in Python you can do this:import sockets = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)s.connect(('10.255.255.255', 1))  # any address worksip_addr = s.getsockname()[0]import uuidhex_val = '{:012x}'.format(uuid.getnode())mac_addr = ':'.join(hex_val[i: i + 2] for i in range(0, 11, 2))You can also get the CPU serial number from:cat //proc/cpuinfo | grep SerialEdited by: JennaSys on Jun 26, 2019 4:17 PM added importsCommentShareJennaSysanswered 4 years ago0You can use process mode to get those informationCommentShareawsjinboanswered 4 years ago0Thank you!!!I got it.const serial = require('proc-cpuinfo')()["Serial"][0];CommentShareyuki-kanswered 4 years ago"


Question: How to use existing OpenSearch reserved instance while creating an OpenSearch domain in Terraform?

"Hi AWS community,I'm working on creating an OpenSearch domain using Terraform and would like to use an existing reserved instance to save on costs. However, I'm not sure how to specify this in my Terraform script.Can someone provide guidance on how to use an existing OpenSearch reserved instance when creating a new OpenSearch domain with Terraform?FollowComment"

Answer: "0Hello,Once you have purchased a reserved instance, your OpenSearch domain using same instance type will start getting billing discounts without any changes in OpenSearch domain.Similarly, you don’t have to specifically specify the reserved instance while creation of OpenSearch domain. The billing discount is automatically applied to the instances you have reserved.Amazon OpenSearch RIs are not flexible; they only apply to the exact instance type that you reserve. For example, a reservation for eight c5.2xlarge.search instances does not apply to sixteen c5.xlarge.search instances or four c5.4xlarge.search instances.Note: OpenSearch reserved instances are different from EC2 reserved instances and are purchased from AWS OpenSearch console/CLI/SDK. Please refer to below document for reference.[+] Reserved Instances in Amazon OpenSearch Service - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ri.html[+] https://aws.amazon.com/opensearch-service/pricing/#Reserved_Instance_pricingCommentShareSUPPORT ENGINEERRajat_Canswered 24 days agoEXPERTFabrizio@AWSreviewed 23 days ago"


Question: do we have some mechanism to extract the step function graph as svg or png which shows the states got excuted and and states got errored and flow of execution ?

"After the step function got executed, do we have some mechanism to extract the step function graph as svg or png which shows the states got excuted and and states got errored and flow of execution ? I couldn't find any resources from aws documentation. Reaching out to this forum to see any tools from aws builder community.FollowComment"

Answer: "2You want to obtain this image via API or via console? If it's via console, you can easily do that via any screen capture utility. Via API, you can use https://awscli.amazonaws.com/v2/documentation/api/latest/reference/stepfunctions/describe-execution.htmlCommentShareDidier_AWSanswered 2 months agoG V Navin 2 months agoI think the api gives execution details not the graph.Share1No. Currently there is mo such API for retrieving the image of the execution.CommentShareEXPERTUrianswered 2 months ago"


Question: Cognito Migration Trigger errors when Lambda execution time too high

"I am currently in the process of validating the migration of a set of users to a cognito user pool via the migration trigger, the essence of the lambda function for the trigger can be boiled down to:def lambda_handler(event, context):   response = requests.post(external_auth_api_url, json_with_user_and_pass)   if response.status_code = 200:      event["response"] = {            "userAttributes": {                "username": event["userName"],                "email": event["userName"],                "email_verified": "true"            },            "finalUserStatus": "CONFIRMED",            "messageAction": "SUPPRESS"        }      return eventThis is doing an external rest call to the old system the user was signing in through as per the documentation and returning a success response.The issue I noticed is that if the lambda function time is too long, for example, the average execution time of this lambda for me right now via ngrok is about 5 seconds total, cognito is failing when I call initiateAuth with USERNAME_PASSWORD flow and returning the following:botocore.errorfactory.UserNotFoundException: An error occurred (UserNotFoundException) when calling the InitiateAuth operation: Exception migrating user in app client xxxxxxxxxxxxI managed to validate that this issue was occurring by simply returning a success response without doing an external REST call and essentially bringing the lambda function runtime down to milliseconds, in which case I got the tokens as expected and the user was successfully migrated.I also tested this by simply having a lambda function like:def lambda_handler(event, context):    time.sleep(5)    event["response"] = {            "userAttributes": {                "username": event["userName"],                "email": event["userName"],                "email_verified": "true"            },            "finalUserStatus": "CONFIRMED",            "messageAction": "SUPPRESS"        }    return event This fails with the same error response as above.If anyone can advise, I am not sure if there is  a maximum time the migration trigger will wait that is not documented, I wouldn't expected the trigger to have such a thing if the migration trigger's intention is to do external REST calls which may or may not be slow.Thanks in advance!FollowComment"

Answer: "0Accepted AnswerThere is a 5 second execution limit on the trigger.Unfortunately, the official Cognito documentation says that this timeout is not configurable:Except for Custom Sender Lambda triggers, Amazon Cognito invokes Lambda functions synchronously. When Amazon Cognito calls your Lambda function, it must respond within 5 seconds. If it does not, Amazon Cognito retries the call. After three unsuccessful attempts, the function times out. You can't change this five-second timeout value. For more information, see the Lambda programming model.CommentSharerowanuanswered a year agoDiogo a year agoThank you! It would be good if the cognito team updated the docs to highlight this execution time limit in the migration trigger page, as that's where it's most criticalShare"


Question: Datazone Portal unable to sign in using IAM

"HiI've been trying to set up DataZone today. I'm not using SSO as I don't have it set up, so I'm using the IAM option. However when click the 'Data portal URL' shown in Datazone and then click to sign in with IAM, it shows the 'Signing in' timer, but it does not. Subsequent attempts go straight to the 'Signing in' timer. Has anyone else experienced this and maybe fixed it please?Thanks.FollowComment"

Answer: "1If you login using the IAM credentials of the principal that you used to create the domain, then you click on the domain URL, you should be auto logged in.CommentShareVarsha-AWSanswered 2 months ago"


Question: AWS Backup DynamoDB billing

"Hi everyone! I'd like to understand better the billing composition regardless of AWS Backup on DynamoDB resources since I got an unexpected increase in my billing.I'm aware of AWS Backup billing itself thanks to the documentation, anyway, when I access the Billing service I can notice an exponential billing pricing in DynamoDB service, on the section Amazon DynamoDB USE1-TimedBackupStorage-ByteHrs the description allows me to see that I'll be paying $0.10 per GB-month of storage used for on-demand backup, showing me that I've used 14,247.295 GB-Month (This makes sense with the billing I got) but where my doubt comes from is, where does all those GB come from? The last snapshot-size just shows 175.5 GBI've configured my backup plan with the following parameters:{    "ruleName": "hourly-basis",    "scheduleExpression": "cron(0 * ? * * *)",    "startWindowMinutes": 60,    "completionWindowMinutes": 180,    "lifecycle": {        "toDeletedAfterDays": 30    }}I'm also copying snapshots into a second region on us-west-2As you can see, I'm handling a schedule expression on an hourly basis backup because of compliance requirements. Is this enough justification for the high billing? I'm aware that backups with low RPO are commonly expensive but I just want to be sure that this billing is not higher than it should be because of any wrong Backup configuration.Thanks in advance!FollowComment"

Answer: "1Hello,I understand that you need further information regarding the increase in your billing.The reason for the increase in your bill is because you are handling 175GB hourly snapshots for an entire month which is approximately 126,000GB per month: 24 hours x 30 days x 175GB = 126,000GB-month of snapshots.Please refer to this documentation and scroll down to "Working example" for more details on how billing works: https://aws.amazon.com/blogs/storage/automating-backups-and-optimizing-backup-costs-for-amazon-efs-using-aws-backup/Another cause for high billing is that AWS Backup does not support DynamoDB incremental snapshots.Please refer to this documentation for additional information: https://aws.amazon.com/backup/features/#Incremental_backupsRecommendations:One recommended way to reduce billing costs is to either reduce the backup schedule or the amount of time the backup is stored for.Another thing that could be done is relying on DynamoDB PITR and using AWS Backup for weekly/monthly snapshots. You can also use PITR (point-in-time-recovery) with hourly, daily, and weekly backups for more compliance.Please refer to this documentation for further information on PITR for Amazon DynamoDB: https://aws.amazon.com/dynamodb/pitr/Please contact AWS Support if you have any further questions, and feel free to reach out to us via a support case ticket to facilitate a discussion on the specifics of your resources: https://console.aws.amazon.com/support/home#/case/create?issueType=technicalCommentShareMaria_Eanswered 10 months agoSUPPORT ENGINEERAjinkya B-AWSreviewed 10 months ago"


Question: Can I use SES to send marketing emails for my users using my AWS account?

"I am building an email marketing app and would like to enable my users to send marketing emails using my AWS account. The from email addresses will be added to SES and verified, so that my users can send emails using those from addresses. Is this an allowed use-case for SES?FollowComment"

Answer:
"0Hey there, you mention that you are trying to use AWS SES to allow other users within your AWS account to send emails on your behalf.For you use case it is possible to have other users within your AWS account send emails on your behalf through the means of Sender Authorisation . It you can create an IAM user and create a a sending authorization Policy which allows you to give permissions to that user so that they can send emails on your behalf .

See references below on information on your use case and creating a Policy for that user.You may contact Premium Support for more details regarding your use case [4].References:

[1] https://docs.aws.amazon.com/ses/latest/dg/sending-authorization-overview.html[2] https://docs.aws.amazon.com/ses/latest/dg/sending-authorization-identity-owner-tasks-policy.html[3] https://docs.aws.amazon.com/ses/latest/dg/sending-authorization-identity-owner-tasks-identity.html[4] https://aws.amazon.com/premiumsupport/knowledge-center/CommentShareAntonioanswered a year ago"


Question: action geo:GetPlace not recognizable for IAM policy

"currently working on an app that uses the Amazon Location Service.Everything is working wwll from render map to autocomplete and reverse geocoding.But i would like to use the results from autocomplete by using the method geo:GetPlace using PlaceIndex and PlaceID. The function is being called successfully with the correct parameters but the function is returning an err 403 saying that the user is not authorized to use action geo:GetPlace. I have configured the IAM policy using Cognito and has appropriate actions and resources. But when i try to enter geo:GetPlace i get an error that it is not recognizable. Anyone knows how to enter this action to the IAM Policy.Here is the error:AccessDeniedException: User: arn:aws:sts::58*******976:assumed-role/Cognito_*************Management_***/CognitoIdentityCredentials is not authorized to perform: geo:GetPlace on resource: arn:aws:geo:ap-southeast-1:58*****65976:* Here is my code:    const identityPoolId = "ap-southeast-1:*******-6dcb-***-ad06-*******";          AWS.config.region = identityPoolId.split(":")[0];          // instantiate an Amazon Cognito-backed credential provider      const credentials = new AWS.CognitoIdentityCredentials({        IdentityPoolId: identityPoolId,      });          const location = new AWS.Location({ credentials, region: AWS.config.region });      const getLocation = (placeID) => () => {        console.log("getting place..");        console.log(placeID);            let params = {          IndexName: "IndexGrabber",          PlaceId: placeID,        };            location.getPlace(params, function (err, data) {          if (err) console.log(err.stack);          console.log(data);        });      };IAM Policy{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "geo:SearchPlaceIndexForText",                "geo:SearchPlaceIndexForSuggestions",                "geo:GetMap*",                "geo:SearchPlaceIndexForPosition"            ],            "Resource": [                "arn:aws:geo:ap-southeast-1:************:place-index/HEREGrabber",                "arn:aws:geo:ap-southeast-1:************:place-index/LocationGrabber",                "arn:aws:geo:ap-southeast-1:************:map/LocationGrabber",                "arn:aws:geo:ap-southeast-1:************:map/GreyLocationGrabber",                "arn:aws:geo:ap-southeast-1:************:map/HEREGrabber"            ],            "Condition": {                "StringLike": {                    "aws:Referer": [                        "http://localhost:*/*",                        "http://jularbs.com:*/*",                        "http://*******.herokuapp.com/*"                    ]                }            }        },        {            "Sid": "VisualEditor1",            "Effect": "Allow",            "Action": "geo:GetPlace",            "Resource": [                "arn:aws:geo:ap-southeast-1:************:place-index/HEREGrabber",                "arn:aws:geo:ap-southeast-1:************:place-index/LocationGrabber",                "arn:aws:geo:ap-southeast-1:************:map/LocationGrabber",                "arn:aws:geo:ap-southeast-1:************:map/GreyLocationGrabber",                "arn:aws:geo:ap-southeast-1:************:map/HEREGrabber"            ],            "Condition": {                "StringLike": {                    "aws:Referer": [                        "http://localhost:*/*",                        "http://jularbs.com:*/*",                        "http://*******.herokuapp.com/*"                    ]                }            }        }    ]}FollowComment"

Answer: "3@jularbs I successfully called GetPlace using an unauthenticated Cognito pool. I tried the steps you've mentioned with the following IAM policy.  Please let me know if it works for you.{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "PlacesReadOnly",            "Effect": "Allow",            "Action": [                "geo:SearchPlaceIndex*",                "geo:GetPlace"            ],            "Resource": "arn:aws:geo:us-east-1:************:place-index/*"        }    ]}Here's the (greatly simplified) code I'm using to call GetPlace:const AWS = require('aws-sdk')AWS.config.update({ region: 'us-east-1' })const credentials = new AWS.CognitoIdentityCredentials({  IdentityPoolId: 'us-east-1:********-****-****-****-************'})const location = new AWS.Location({  credentials,  region: AWS.config.region || 'us-east-1'})async function main () {  const suggestions = await location.searchPlaceIndexForSuggestions({ IndexName: /*name*/, Text: /*text*/ }).promise()  const placeID = suggestions.Results[0].PlaceId  const place = await location.getPlace({ IndexName: /*name*/, PlaceId: placeID }).promise()  console.log(place)}main()CommentSharepatyukanswered 7 months agoDevesh 7 months agoThanks patyuk!Share0ErrorHaving a look at the error:"AccessDeniedException: User: arn:aws:sts::58*******976:assumed-role/Cognito_*************Management_***/CognitoIdentityCredentials is not authorized to perform: geo:GetPlace on resource: arn:aws:geo:ap-southeast-1:58*****65976:*",it looks like the role associated with Cognito identity pool doesn't have the permission to perform the action or doesn't adhere with the condition mentioned in the permission policy associated.ReplicationUsing the below permission policy, I was able to get place ID details :CLI: aws location get-place --index-name explore.place --place-id AQAAAIw...QWQIAM Policy used:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "geo:GetPlace"            ],            "Resource": "arn:aws:geo:*:0123456789:place-index/*",            "Condition": {                "StringLikeIfExists": {                    "aws:Referer": "http://localhost:*/*"                }            }        }    ]}SummaryIn regard to your issue, it would require some troubleshooting in order to isolate the issue here. There can be multiple avenues to look at the issue:Is condition criteria met ?Is there any SCP restricting the action ?Check error logs to verify the errorThat been said, I can see that you have associated a global condition "aws:Referer", so kindly make sure that referrer in the request sent indeed have referrer as included in the IAM policy. The aws:referer request context value is provided by the caller in an HTTP header. The Referer header is included in a web browser request when you select a link on a web page. Please note that when you perform the action by typing the URL into your browser, aws:referer is not present. When you invoke the API directly, aws:referer is also not present.Having said that, I would recommend using the permission policy shared above and see if it works for you. You may also try to remove the condition and try to isolate the issue. If it still doesn't work for you, I would recommend reaching out to our "Amazon Location service" team through a support case to further troubleshoot, as it would require some tests to be performed in order to narrow down the issue here.Thank you.CommentShareSUPPORT ENGINEERVarunanswered 8 months agojularbs 8 months agowhile editing my IAM policy, I am getting this error: Ln 10, Col 16Invalid Action: The action geo:GetPlace does not exist. Do i ignore this error?ShareVarun SUPPORT ENGINEER7 months agoYes, you may ignore that error.Sharejularbs 7 months agoStill getting the same error, removed the referer to be sure. tried using geo:* in actions still no use. Also tried using All Resources, still no use. I am using the same IdentityPool for all actions. GetMap* and SearchIndexPlaceFor* works but GetPlace doesn't.if it may help, the action geo:GetPlace is not defined by Amazon Location based on https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlocation.htmlis geo:GetPlace unusable as of the moment?Share0Just an FYI, GetPlace didnt work with via Cognito with an IAM policy indicated above, but using AWS Access Key and Secret Key for credentials worked for me. I just set my aws config with:  AWS.config.credentials = {     accessKeyId: process.env.AWS_ACCESS_KEY_ID,     secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,   };Then i create location object as usual  const location = new AWS.Location({     region: AWS.config.region,   });But i still use my cognito identity pool for my map initialize.CommentSharejularbsanswered 7 months ago"


Question: AWS Route 53 DNS errors after moving from LightSail to EC2

"I have a website called sudhata.com . It used to run on LightSail but I decided to move to EC2 and stop depending on burstable CPU. When I did that, I deleted all my records in LightSail networking. I deleted the static IP and DNS zone.I recreated an Elastic IP address that I associated to the EC2 engine, my website connection works well based on the IP address. Then, I recreated a new hosted zone and rewrote the DNS associated to sudhata.com. I also created the A record for the elastic IP address. After 48 hours, I am still not able to access my website with my registered domain name. I also tried with the IP address of the EC2 VM but no luck.At this point, I have tried everything I could think of and I am still not able to make it work. I get an error like the DNS server is not responding but I think my DNS servers match with the hostname. I also checked here (https://dnschecker.org/#NS/sudhata.com). Some parts of the world have the right DNS. I am a bit lost.Everything was working very well before. Thank you for your help.FollowComment"

Answer: 0I had to change my registered domain and not my hosted zone dns.CommentSharearnoAWSanswered 2 years ago


Question: Unable to change 'max_buckets' cluster setting

"I'm having an error when I run an especific query:{..."caused_by": {"type": "too_many_buckets_exception","reason": "Trying to create too many buckets. Must be less than or equal to:  10000 but was 10001.This limit can be set by changing the search.max_buckets cluster level setting.","max_buckets": 10000}...}Upon some investigation, I found this topic about how to change this setting but it resulted an errorhttps://discuss.elastic.co/t/increasing-max-buckets-for-specific-visualizations/187390Request: PUT _cluster/settings{"transient": {"search.max_buckets": 20000}}Response:{"Message": "Your request: '/_cluster/settings' payload is not allowed."}Upon further investigation, I found this link that lists all supported operations from Elasticsearch Service: https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-supported-es-operations.html#es_version_7_7 (I'm using version 7.7).I couldn't find 'max_buckets' on the list.Am I really unable to change this setting?FollowComment"

Answer: "0Hey,Due to the managed nature of AES, this isn't available as a customer modifiable setting.You can create a support case to get the limit increase and limit increases don't require Premium Support subscription.Good luck!CommentShareAjayRajanswered 2 years ago"


Question: AWS 2dsphere limitation

"Hi all,I am using DocumentDB with Mongo support on AWS and we are having documents that include geolocation. We have read the documentation of AWS for mongo support here  but despite it says that it's supported we are receiving error during the creation of the index.The error we are getting when creating the index is : "Command createIndexes failed : Index type not supported : 2dsphere"The c# code that should generate the index is the below :var prefixIndexName = nameof(Account.Address)+"."+nameof(Account.Address.Geolocation);if (!accountCollection.ExistIndex(prefixIndexName+"_2dsphere")){       Console.WriteLine("Seeding Geolocation Geo2DSphere Index ...");       var geoLocation = new StringFieldDefinition<Account>(prefixIndexName);       var indexDefinition = new IndexKeysDefinitionBuilder<Account>().Geo2DSphere(geoLocation);       var indexModel = new CreateIndexModel<Account>(indexDefinition, new CreateIndexOptions { Background = false });       accountCollection.CreateIndex(indexModel);}The field that we are trying to add in the index is the "Address" and it looks like this :"Address":  {        "CountryId": number,         "PostCode": string,        "AddressLine1": string,        "AddressLine2": string,        "City": string,        "State": string,        "Geolocation": {            "type": "Point",            "coordinates": decimal[] // e.g. [xx.xxxxxxx, xx.xxxxxxx]        }    }The code is working on my local MongoDB installation, so I believe I am missing something to make it run on AWS.Any help you could provide is valuable, thanks in advance for your time!FollowCommentMihai A 6 months ago2dsphere indexes are indeed supported, have you tried creating the index from the mongo shell? The limitation is that is supported only for GeoJSON type Point, not for polygons or multi-polygons. Do you have other geospatial shapes, other than points, in the collection? However, if that's the case,  the error would be something like "Unsupported GeoJson type" when creating the 2dspehere index.Share"


Question: Use Cognito as primary identity provider for non-AWS-hosted applications?

"Hello,Is it possible to use Cognito as primary identity provider for non-AWS-hosted applications?AUTHENTICATION: It seems to be possible to do authentication via the Cognito User Pools.I see it returns an access token after authentication:http://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.htmlDOWNSTREAM AUTHORIZATION: Assuming trust with the downstream non-AWS-hosted service provider, I'm not sure how any authorization could happen within this service provider considering I don't see any standard token (SAML...) being provided by Cognito. Any way to forward a standard token to a downstream non-AWS-hosted service provider?Thanks!FollowComment"

Answer: 0Accepted AnswerYou can accomplish custom authorization in your downstream apps by using the Cognito User Pool Groups. You can place your users into groups on the Cognito side. The JWT ID Token will contain the role values associated with the user in the cognito:roles claim. You will then grant the appropriate authorization level based on the role that the user is assigned.Here's more info: http://docs.aws.amazon.com/cognito/latest/developerguide/role-based-access-control.htmlCommentShareAWS-User-2528356answered 6 years ago


Question: Keep amazon workspace windows machine unlocked

"Hi all, I would be running some automation tests on a windows machine (from amazon workspaces https://clients.amazonworkspaces.com/) . The machine gets locked as soon as I disconnect from the desktop session and my tests fail. Is there a good way to keep it unlocked? I have tried ultravnc - https://wiki.imacros.net/How_to_keep_the_Windows_desktop_active, configured auto logon, also configured a few registry settings but nothing seems to work.FollowCommentRodney Lester a year agoThis sounds like a batch job that would be better suited for AWS Batch? https://docs.aws.amazon.com/batch/latest/userguide/what-is-batch.htmlShare"

Answer: 0hi there;i notice you want to keep windows machine unlocked.you can achieve this by disabling Turn OffDisplay setting via Group Policy.select enable and under options:Turn Off the Display enter 0there's ways you can manage you workspace session timeout that can keep your windows machine running.that is by using group policies(GPO) below is the documentation you can follow[1] https://docs.aws.amazon.com/workspaces/latest/adminguide/group_policy.htmlCommentSharerePost-User-9017359answered a year ago


Question: Cannot change configuration settings for lambda functions

"Hi all,When trying to change any of the configuration settings for a lambda function, we have run into an ambiguous error message:You do not have sufficient permission. Access denied.If we try to do this via aws CLI, the message reads:An error occurred (AccessDeniedException) when calling the UpdateFunctionConfiguration operation: NoneWe have tested this across three different users, two of whom have AWSLambda_FullAccess policy and one has AdministratorAccess policy. My understanding is that each of these users should be able to take this action, based on these policies. Is there something else I'm missing?It's worth mentioning that we have previously had no problems doing this. We recently had an incident where access and security keys for one user were compromised, and so I wonder if this is related to that - either the compromised keys were used to make some modifications that I can't find, or perhaps AWS took some action to prevent unauthorized changes.Also, we haven't noticed any similar permission problems when using other AWS services.Any help would be much appreciated.FollowComment"

Answer: "0This appeared to have been a problem on the AWS side. I took no action other than opening a service ticket. Several days later, the problem disappeared.CommentSharetriddleanswered 2 years ago"


Question: How do I reset access to my root account. The current user has left the organisation and we no longer have access to his mobile or 2FA but we do have access to his email account?

How do I **reset ** access to my root account. The current user has left the organisation and we no longer have access to his mobile or 2FA but we do have access to his email account? I do have an administrator IAM User account but I want to reclaim access to the **root ** account.FollowComment

Answer: 0Hi TherePlease take a look at this article for resetting a lost MFA when no access to the mobile device is available.https://repost.aws/knowledge-center/reset-mfa-deviceCommentShareEXPERTMatt-Banswered 2 months ago


Question: "Incorrect Time Zone for Central Mexico, Guadalajara, Monterrey in WorkMail"

"Last year, the Mexican government decreed the elimination of daylight saving time across the country. As a result, the time zone for Central Mexico is now permanently set to UTC-6.However, it has been noted that, even though users' devices are set to the Mexico City time zone, AWS WorkMail has not yet implemented the necessary update to reflect the change to UTC-6, incorrectly displaying UTC-5 instead. When will the appropriate modification be made to address this issue?FollowComment"

Answer: "0Hi,I indeed see that there were changes to the DST for 2023 in Mexico (https://www.timeanddate.com/time/change/mexico). I have forwarded the case to the service team to investigate.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 2 months ago0Hi,As a follow-up the service team has merged the changes for the Mexican DST changes and they should roll out soon.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 2 months ago"


Question: Inspector Vuln Scan doesn't work with Windows

"Hi all, I'm testing the new Inspector feature to scan for Vulns, but it's only working for Linux EC2 instances.On the Windows Instances it says: Unsupported OSBut the documentatio says that all the SSM Supported Operating Systems can be scaned.Both Windows and Linux instances are showed in SSM as Managed, and the service is running perfect.Any thoughts? ThanksFollowComment"

Answer: "1Currently Windows OS is not currently supported for Amazon Inspector. The full list of supported Operating Systems is available in the documentation here: https://docs.aws.amazon.com/inspector/latest/user/supported.htmlAmazon Inspector Classic does support certain Windows-based OSes however: https://docs.aws.amazon.com/inspector/latest/userguide/inspector_supported_os_regions.htmlCommentShareGreg_Hanswered a year agoJere a year agoWill it be supported any time? We are considering it as our Vuln Scan tool replacement but with this limitation is impossible.ShareBruno Lopes a year agoYes Jere, we have a roadmap and customers asking for this, in the future. But no ETA at this moment.Share0Windows is now supported https://aws.amazon.com/about-aws/whats-new/2022/09/amazon-inspector-windows-os-continual-software-vulnerability-scanning-ec2-workloads/CommentShareJeremy_Sanswered 9 months ago"


Question: Creating new custom vocabularies from a table is broken

"When I try to use the AWS Transcribe console to create a new custom vocabulary from a file stored on S3, it always returns this result: "Internal Failure. Please try your request again."This happens even when using the example provided in the documentation, attached here.It seems like this feature is broken. Can anybody validate whether you've ever gotten a custom vocabulary table to work? If so, could you post your text file so that I could try it out?FollowComment"

Answer: "0I found that changing the line endings from LF (ASCII 13) to CR (ASCII 10) fixed the issue. As far as I can see, this requirement is not documented at https://docs.aws.amazon.com/transcribe/latest/dg/how-vocabulary.html#char-english.CommentSharejesse360answered 3 years ago0Changing line endings to ASCII 10 fixed it.CommentSharejesse360answered 3 years ago0This does not work for me. In fact, anything I put in IPA column fails with "Validation error: File contains invalid characters or format in the IPA column."Content isPhraseTABIPATABSoundsLikeTABDisplayAsCRHeyTABhe:ɪTABTABCRNo issues with list format but I can't create vocabulary with table format including IPA field. I have another vocabulary that contains only Phrase and DisplayAs - and it works fine.Does this feature work at all?Edited by: jzgoda on Sep 3, 2020 8:48 AMWTF formattingCommentSharejzgodaanswered 3 years ago0It is now in the documentation. https://docs.aws.amazon.com/transcribe/latest/dg/how-vocabulary.htmlCommentShareEarl L.answered 2 years ago0We have reviewed the documentation in detail and keep getting the same error. We use LF format as indicated in the docs and unicode UTF8.When using UTF8, we get the "IPA invalid characters" error but if we change to UTF-16 big endian in order to fit the characters code with 2 bytes, we get a "invalid header names" error.We keep researching.. any clue?CommentShareFeranswered a year ago0I wasn't able to fix this issue after trying various line endings. I started with their example download file which works.I think this is related to what they consider to be valid IPA characters. I can't find any docs from AWS on valid IPA other than industry info.Example file:PhraseIPASoundsLikeDisplayAsLos-AngelesLos AngelesF.B.I.ɛ f b i aɪFBIEtienneeh-tee-enCommentShareSeattleGreganswered 8 months ago0Using their own example from the Guide https://docs.aws.amazon.com/transcribe/latest/dg/charsets.html#char-frenchMany Unicode characters can appear identical in popular fonts, even if they use different code points. Only the code points listed in this guide are supported. For example, the French word déjà can be rendered using precomposed characters (where one Unicode value represents an accented character) or decomposed characters (where two Unicode values represent an accented character, one value for the base character and another for the accent).Precomposed version: 0064 00E9 006A 00E0 (renders as déjà)Decomposed version: 0064 0065 0301 006A 0061 0300(renders as déjà)I tried to create a very simple french vocabulary for testing:Phrase[TAB]SoundsLike[TAB]IPA[TAB]DisplayAs[EOL]Test[TAB][TAB]déjà[TAB]Test[EOL]using either [LF], [CR] or [CRLF] as EOL, UTF-8, UTF-16 BE, UTF-16 LEalways getting one of the already in this thread described errors,"Validation error: Your custom vocabulary file contains one or more unsupported characters ("é", "à") in the IPA column on line 2."I made sure to use exactly the characters from the charset-guideline (copying from the guideline, checking my vocabulary in a HEX-editor) and it does not work.If I create a Vocabulary, where only one of those characters is used (and no other character, even those with only one byte) then it works:Phrase[TAB]SoundsLike[TAB]IPA[TAB]DisplayAs[EOL]Test[TAB][TAB]é[TAB]Test[EOL]it looks like an internal conversion breaks because the second byte mixes stuff up.CommentSharepuchmuanswered 2 months ago"


Question: Can you create API Gateway methods using a CloudFormation template without a Lambda proxy function?

A customer is currently using CloudFormation template to create API Gateway with the help of a Lambda function to create the methods and mappings. They’re currently looking for a way to do this without using a Lambda function as a proxy to build out the methods. Does CloudFormation support creating API Gateway methods without needing that extra Lambda function?FollowComment

Answer: "0Accepted AnswerYes, you can create these resources either natively in CloudFormation or using OpenAPI (Swagger) templates. Details below. The Swagger templates can either be imported to APIGW, references in CloudFormation, or referenced in an AWS SAM template.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-method.htmlhttps://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions.htmlhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-restapi.htmlhttps://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessapiCommentShareAWS-User-2615075answered 5 years ago0Yes CloudFormation supports creating API Gateway. The first step for customer is familiarizing with different integration options available for an API.In the previous answer post, swagger integration option was mentioned. Customers can start API development or prototyping by using swagger editor and other API development plugins.https://swagger.io/The next step could be to create API endpoint using CloudFormation. API Gateway version 2 is available and it provides lot of benefits.  We could start without backend integration of Lambda and use integration type as MOCK.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-integration.htmlOnce we have the skeleton ready we could create the backend in either AWS Lambda or HTTP endpoints of choice and wire them. This enables independent development of back end and testing based on API contract.CommentShareEXPERTAWS-User-7407181answered 7 months ago"


Question: AWS Transit Gateway Site-to-Site VPN Dynamic routes limit of 100. Is it per Connection or Aggregate?

"Is the dynamic routes advertised from a customer gateway device to a Site-to-Site VPN connection on a Transit Gateway (TGW) limit of 100 per attachment or aggregate?What happens if there are multiple VPN attachments to the same TGW? Say I have a VPN to the TGW and I’m learning 75 routes there from propagation, and then another VPN attached to the TGW with another 75 routes advertised there. Will that have any issues, since it will be 150 routes learned to the TGW? Is the total aggregate to the TGW or per connection and then limited to the total 10,000 total routes per TGW?FollowComment"

Answer: "0Accepted AnswerThe 100 routes from on-premises is per VPN attachment and can scale out with multiple VPN attachments. We'd typically recommend route summarization or using a default route for situations where a customer wants to advertise over 100 routes. If neither of those options will work, the customer can use multiple VPN attachments and splitting the routes. The 10,000 route limit is the total per TGW. Another thing to look out for here is that you can advertise up to 1,000 routes to on-premises through VPN. Make sure you don't have more routes than that in the TGW route table, as the max routes advertised from a Site-to-Site VPN connection on a TGW to a customer gateway device: 1,000CommentShareAWS-James-Devineanswered 3 years agoEXPERTsedat_salmanreviewed 2 days ago"


Question: Cannot access ECS service unless inbound rule allows all traffic

"Hello,I have created an ECS service. Specifically I've created it following these instructions https://github.com/dagster-io/dagster/tree/master/examples/deploy_ecsThe service was created properly and I can access it.However, it was created with a security group that has a 0.0.0.0/0 TCP inbound rule.When I remove the rule, and replace it with rules for my specific IP address, I can no longer access my application.I've verified that it is the correct IP address; I've tried multiple IP addresses from multiple people at multiple physical locations; I've tried with devices that don't have firewalls or vpns or proxies; I've tried IPV4 and IPV6.I tried enabling access logs within the load balancer but that seems like the wrong approach as it only logs TLS not TCP.I don't have any other ideas for what could be causing this issue. As soon as I re-add the 0.0.0.0/0 rule it works again, which seems to eliminate a lot of the possible issues I've come accross. I'm new to ECS and would appreciate some help!FollowComment"

Answer: "0As you are using a load balancer, You will need to put your IP address in the security group of the load balancer not the SG on the ecs serviceThe security group on the ecs service only needs to allow IP from your internal network load balancer.  You which is the load balancer IP addresses.CommentShareGary Mcleananswered 8 days agoausteane 8 days agoHm, I'm using a Network Load Balancer which I think doesn't have any security group attached.ShareGary Mclean 8 days agoOk that makes sense. So your ecs security group will have to allow the ip addresses from your NLB. These will be internal ip addresses from the subnet that your NLB is attached too. You can’t lock this down to your own IP addresses!!The only way round this is too move to an ALB with your Ecs services registered to target groups and follow my answer to support what your trying to achieve.Share"


Question: SES - Host Verification via CNAME for auto-generated FQDN of dedicated IPs

We use dedicated IPs for sending our emails with SES and need to add a TXT to the host/FQDN that ist automatically generated for the IP (e.g. SES dedicated IP: XX.XXX.XXX.XXX >> FQDN from SES: XXX.smtp-out.eu-central-1.amazonses.com).Is there a way to access the DNS settings for the generated hosts/FQDNs?FollowComment


Question: Finding Specific Actions in CloudTrail

"Hi, all,New to the community so will do my best to follow the dos and don't but a bit of a AWS novice so bear with me.It was noticed that the new "Malware Protection" trial had started in our AWS environment. However, nobody knows who did it, whether it was set up to continue after, etc. I went to CloudTrail to try and search for any indicators and all I can see is where folks have looked at the service page, but not necessarily enabled the service or activated the trial. Does anyone know of the correct attributes/parameters to use to determine this?Thank you!FollowComment"

Answer: "1Hi and welcome to the community!You can search for the updateDetector event name to find who updated the Guard Duty configuration.In particular you should search to see if scanEc2InstanceWithFindings is set to true.    "requestParameters": {        "detectorId": "56bf249c0b2004c6e5f32f00b3cfda80",        "enable": true,        "findingPublishingFrequency": "SIX_HOURS",        "dataSources": {            "malwareProtection": {                "scanEc2InstanceWithFindings": {                    "ebsVolumes": true                }            }        }    },CommentSharePablo Guzmananswered 6 months agorePost-User-4475545 6 months agoThanks. I followed your guidance and it isn't showing me any events. I know we have logging enabled as a user search shows events. Does logging need to be enabled separately for the config changes?Share"


Question: Amplify Custom Subscription VTL

"I am trying to provide multitenancy checks in a VTL that runs as part of a custom subscription.  I am using the @function and @aws_subscribe annotations; the @function references an amplify function I added using amplify add function, naming it perfectQueuePortalReceiveOrder .  Here are excerpts from my schema.graphql:type ReceiveOrderResponse {    brandSlug: String! @aws_iam @aws_cognito_user_pools(cognito_groups: ["perfectCoAdmin", "tablet"])    storeNumber: String! @aws_iam @aws_cognito_user_pools(cognito_groups: ["perfectCoAdmin", "tablet"])    orderDetails: String! @aws_iam @aws_cognito_user_pools(cognito_groups: ["perfectCoAdmin", "tablet"])}type Mutation {    receiveOrder(brandSlug: String!, storeNumber: String!, orderDetails: String!): ReceiveOrderResponse @function(name: "perfectQueuePortalReceiveOrder-${env}") @aws_iam @aws_cognito_user_pools(cognito_groups: ["perfectCoAdmin"])}type Subscription {    onReceiveOrder(brandSlug: String!, storeNumber: String!): ReceiveOrderResponse @aws_subscribe(mutations: ["receiveOrder"]) @aws_cognito_user_pools(cognito_groups: ["perfectCoAdmin", "tablet"])}The issue is that it does not appear that any VTL templates are generated for the Subscription.   After issuing amplify api gql-compile, I see in the build/resolvers directory that VTL resolvers were generated both for the mutation, Mutation.receiveOrder.res.vtl as well as the lambda request/response templates: InvokePerfectQueuePortalReceiveOrderLambdaDataSource.req.vtl InvokePerfectQueuePortalReceiveOrderLambdaDataSource.res.vtl.  However, no Subscription.onReceiveOrder.* VTL template gets generated at all.My goal is simply to override the VTL template only for the subscription, in order to compare custom cognito user attributes against the arguments provided to the subscription, and give an unauthorized error if the arguments do not match the identity claims.  But no VTL templates seem to get generated for the subscription; only for the mutation.  How can I compare the arguments to a custom Subscription that is @aws_subscribed to a custom Mutation, itself using @function, against the cognito-based identity claims provided in the $ctx during VTL processing for the initiation of the subscription?What is particularly confusing is that everywhere else I have used the @aws_cognito_user_pools and @aws_iam tags, the results have appeared in the build/resolvers VTL templates.  But not for subscriptions.  Why not?  Strangely, these annotations do seem to be honored, however, I cannot find any VTL code that implements that honoring, as I can with Queries and Mutations.  Help?FollowCommentTimHeilman a year agoMore detailed research culminated on this stackoverflow post: https://stackoverflow.com/questions/72718125/how-to-specify-custom-subscription-resolvers-for-aws-subscribe-d-types-in-aws-aessentially: is Amplify simply not capable of maintaining a custom DS_NONE-backed resolver with custom request mapping template for custom Subscriptions using @aws_subscribe?  Is my only option to depend on amplify for almost everything appsync-related, and then manually maintain the DS_NONE resolvers with custom request mapping templates for all subscriptions defined using @aws_subscribe in schema.graphql?Share"


Question: Websocket Authorizer Status 500

"I have created an API Gateway Websocket with $connect and $disconnect and it works fine, I can connect and save the connectionId  to Dynamodb. The problem appears when I add the authorizer in front of the $connect route using the console and following the steps  and the output  format in the Documentation, I got then always "error: Unexpected server response: 500", of course, I can see the logs of the Authorizer lambda and the return json which looks like following:Region: eu-central-1{    "principalId": "me",    "context": null,    "usageIdentifierKey": "<API-ID>",    "policyDocument": {        "Version": "2012-10-17",        "Statement": [            {                "Action": "execute-api:Invoke",                "Resource": "arn:aws:execute-api:eu-central-1:<ACC-ID>:<API-ID>/Test/$connect",                "Effect": "Allow"            }        ]    }}So, after the authorizer function is invocked, the connection function is  not called.has someone already faced this Problem and if yes, how did you solve it?FollowComment"

Answer: "0Hurrrrra, I have found it, I will add my Problem hier, may be it helps someone else.The Problem in case  was the Trust relationships permssion that needs to be added to the role of the functions that you integrated with API Gateway. And how I found that, I have check the logs of the API not the functions, so you may find in the logs under CloudWatch => Logs => Log groups => (/aws/apigateway/<API-ID>/<Stage>), the following error:(<ConnectionId>) Execution failed due to configuration error: API Gateway does not have permission to assume the provided role arn:aws:iam:<ACC-ID>:role/<Role-name>Then go to the role it self and then to the trusted relationhsips and then edit this permission to have the api gateway like following:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "Service": [          "apigateway.amazonaws.com",          "lambda.amazonaws.com"        ]      },      "Action": "sts:AssumeRole"    }  ]}I hope it will help someone else.CommentShareynahshalanswered 8 months ago"


Question: "ACM was unable to automatically renew your certificate, AWS is the domain controller. Stranded."

"I got the: "ACM was unable to automatically renew your certificate"  ... for domain "smurf.sad" (example)AWS is the domain controller.Email verification is (for some reason) turned on and the emails in questions are set on the smurf.sad.For instance: admin@smurf.sad, webmaster@smurf.sad, etc.Therefore the renewal certificates end up in dev/null. Is there an easy way to get those emails? (I tried lambda email forwarding but got lost in the SES/S3/lambda policies and rules).I'd be happy to switch to domain record verification, but for some reason such an option is not available.See: https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.htmlThe 'Create record in Route 53' is not available, and the instructions on pagehttps://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-DNS-validation.html#troubleshooting-route53-1left me stranded as I feel I am compliant with all the requirements...I believe the button is not there because the certificate has still not expired.If there's a simple way to add a CNAME / TXT entry, I'd like to learn what would be the values.By all accounts I should be able to renew the certificate as I am the sole admin with full access privileges and the domain is controlled by AWS.Any hints?FollowComment"

Answer: "1HiAs per the your problem above, I am assuming that you are not able to see the CREATE RECORDS button from the ACM console,ACM Console does not display "Create record in Route 53" button --> This is the same link you have shared aboveIf you select Amazon Route 53 as your DNS provider, AWS Certificate Manager can interact directly with it to validate your domain ownership. Under some circumstances, the console's Create record in Route 53 button may not be available when you expect it. If this happens, check for the following possible causes.On the Validation page, you did not click the down-arrow next to your domain name.You are not using Route 53 as your DNS provider.You are logged into ACM and Route 53 through different accounts.You lack IAM permissions to create records in a zone hosted by Route 53.You or someone else has already validated the domain.The domain is not publicly addressable.Suggestions/Recommendations:You can use DNS validation for the ACM certificates instead of the Email validation. as far as i remember the DNS records generated by ACM are always the same if you create the certificate in any AWs account, So once DNS records are updated thats all ne need to update it again.If you do not see the DNS records button you can try to update the DNS manually orYou can automate ACM and DNS validation by using Cloud formation. How to use AWS Certificate Manager with AWS CloudFormation Hope it works for you. Thank YouCommentShareGKanswered 3 months agoTomTom 3 months agoHi,The certificate in question is (type) Amazon issued.I would like to let AWS recreate it automatically.I would like to solve this via DNS validation, but I do not know what should be added to the CNAME record to be able to do this.a) do I need to manually switch to DNS validation or the CNAME check is done implicitly even if I have email validation turned on?b) should I just put the certificate ID in CNAME?c) if not the certificate ID, then what should be added to my zone's records?d) I do not understand the CloudFormation proposal at the slightest.e) Would an easy way out also be to create a new public certificate and DNS validate it?ThanksShareGK 3 months agoHiGreat, You got the SSL issued. If you would like to know how to add the DNS records here is the info this can help you , Pls check this link https://aws.amazon.com/premiumsupport/knowledge-center/route-53-validate-acm-certificates/a) Once Certificate is ISSUED  it is not possible to change, So instead of that you can create new ACM and use DNS validation.b) No CNAME records you have got you need to update like the same, Example screenshot https://knowledge.amimoto-ami.com/hubfs/Knowledge%20Base%20Import/downloads.intercomcdn.comio19113792531e905dadade1d235a7570cdimage.pngc) You shoud not add Certificate ID, you need to add the DNS records, because ACM is going to check you are the owner of the domain or not . once DNS is updated you need to wait till the DNS propagated.d) The Cloudformation is simple way, If will create ACM certificate also update the DNS entry you dont have to add manuallye) it is very simple and not much technical knowledge required. Youtube video link help you more https://www.youtube.com/watch?v=ookzXuMr8eYThank YouShare0Accepted AnswerAfter reading more about the issue and listening to GK's suggestions, I decided to drop the whole 'renewal' approach and did the following:Created a new certificate (DNS verification)Added the provided CNAME name/value via Route 53 to the hosted zone... after a few seconds, the new certificate was validated.I went to my EC2 load balancer and associated the new certificate with https:443... the new certificate was correctly associated with the https:433.Thank you GK for your prompt help and kind suggestionsCommentShareTomTomanswered 3 months agoGK 3 months agoPlease accept above answer if you are solvedShare"


Question: AWS ACM 64 character limit

I'm trying to add a pubic certificate in AWS ACM but its saying there is a 64 chracter limit which seems too small. I'm only trying to register domain name "www.shortenthisurlasitiswaytoolongandashorteronewouldbeappreciated.info"Is it possible to remove this arbitrary limit?FollowComment

Answer: "1As stated in this document, the first domain to be registered cannot exceed 64 characters including periods.https://docs.aws.amazon.com/acm/latest/APIReference/API_RequestCertificate.htmlIn compliance with RFC 5280, the length of the domain name (technically, the Common Name) that you provide cannot exceed 64 octets (characters), including periods. To add a longer domain name, specify it in the Subject Alternative Name field, which supports names up to 253 octets in length.So we will need to take measures such as shortening the domain name.CommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: Is it possible to retrieve AD Object GUID from the API?

"Hello,I am developing an application that needs a way to retrieve associated Microsoft 365 immutable ID/AdObjectGuid from users on the IAM Identity Center. I've seen methods like DescribeUser or ListUsers that retrieve some information about the users on the Identity Center pool but not its AD Object GUID.In the console, you are able to see the AD Object GUID and it's accessing this information by requesting on https://<region>.console.aws.amazon.com/singlesignon/api/userpool API endpoint  with DescribeUsers operation, but I don't see any related information on the docs about this method and I suppose this is a console-reserved method.How can I be able to retrieve this ID from the API? Is it even possible?Thank you.FollowComment"


Question: Moving to Amazon connect

"Hi Team,One of my customer is using Asterisk cloud as their CTI solution in one of the countries they are operating. The contract is still valid and the team wants to move to AWS connect in a phased manner. Could you please suggest if AWS connect can be integrated with Asterisk cloud for time being and then completely removed once the contract ends.FollowComment"

Answer: "0I’m not familiar with Asterisk cloud, but it sounds like it’s a contact center solution based on Asterisk. Now, there’s no out of the box integration with Asterisk, but you could maybe think about breaking up your contact center and slowly move things over. For example, start with Lex as your IVR. You don’t really need Connect to use Lex, you can just use it as a stand alone service. Next would be sending calls to a queue and those queues could live in Asterisk. Depending on what you’re doing there are other things you could migrate slowly, but you’ll have to figure that out.DavidCommentSharedmaciasanswered a year ago"


Question: How do I get the ip address that is using the access key from a IAM User?

I'm making changes to the applications to no longer use IAM User but IAM Role. But there are credentials that are still in use and I can't find them easily. A factor that would help would be to see the ip address that is using it. I tried to find it through CloudTrail but I wasn't successful. Is it possible to find out the ip address?FollowComment

Answer: "0SourceIpAddress is available in CloudTrail, can you give a little more detail on how you tried to find it and why it didnt work or you?CommentShareEXPERTMatt-Banswered 3 months agoWendel_Bartz_Ubots 3 months agoI have a CloudTrail with the configuration to log all API activity. I downloaded the event history with the last access key use time window, but I didn't find anything related. Usually the last use of the key I can see in IAM which was with SQSShareMatt-B EXPERT3 months agoThere may be temporary credentials at play.  Take a look at this guide for finding user activity in CloudTrail.  you should not need to download anything if the access happened within the last 90 days, you can use the CLoudTrail console to search.  See https://aws.amazon.com/premiumsupport/knowledge-center/view-iam-history/Share"


Question: Trying to get console.log() calls into a GreenGrass v2 log file

"I'm trying to get console.log() calls from my JavaScript lambda to show up in a log file in AWS GreenGrass version 2. Version 1 has a "Local logs configuration" option area, under "Groups" -> "Settings", but I haven't been able to find any comparable settings for version 2. I see various log files in /greengrass/v2/logs, but none of them show my console.log() calls. My lambda is named ggOpcLee, and I see an empty ggOpcLee-component.log file, and a ggOpcLee.log file which has entries, but none from my log() calls. I upgraded to 2.1.0 to see if that would fix the problem, but still no logs. I have the aws.greengrass.LogManager component deployed. I see CloudTrail and CloudWatch logs for my lambda, but the log() calls do not seem to appear there.Any thoughts appreciated...FollowComment"

Answer: "0I found AWS "IoT > Settings > Logs" and set "Log Role" to "leeIotRole2" and "Log level" to "Debug", after creating a role "leeIotRole2" to allow IoT as described here https://docs.aws.amazon.com/iot/latest/developerguide/iot-create-role.html , but still no logging.CommentShareLeeMerrillanswered 2 years ago0My GreenGrass lambda was not getting called, I added console.log() call that always happens, and I uninstalled and reinstalled Greengrass, and now I see log messages.Uninstall: https://docs.aws.amazon.com/greengrass/v2/developerguide/uninstall-greengrass-core-v2.htmlInstall: https://docs.aws.amazon.com/greengrass/v2/developerguide/install-greengrass-core-v2.htmlCommentShareLeeMerrillanswered 2 years ago"


Question: AWSServiceRoleForApplicationAutoScaling_RDSCluster user throwing errors when executing autoscaling

"I have an autoscaling policy on my RDS Aurora cluster which has been working well for a while.  I recently added cloudtrail alerts when a role attempts to do something that is unauthorized, and every time there is a scaling action the AWSServiceRoleForApplicationAutoScaling_RDSCluster throws an error:{    "eventVersion": "1.08",    "userIdentity": {        "type": "AssumedRole",        "principalId": "XXXXX:AutoScaling-UpdateDesiredCapacity",        "arn": "arn:aws:sts::XXXXX:assumed-role/AWSServiceRoleForApplicationAutoScaling_RDSCluster/AutoScaling-UpdateDesiredCapacity",        "accountId": "XXXXX",        "sessionContext": {            "sessionIssuer": {                "type": "Role",                "principalId": "XXXXX",                "arn": "arn:aws:iam::XXXXX:role/aws-service-role/rds.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_RDSCluster",                "accountId": "XXXXX",                "userName": "AWSServiceRoleForApplicationAutoScaling_RDSCluster"            },            "webIdFederationData": {},            "attributes": {                "creationDate": "2023-01-09T16:54:55Z",                "mfaAuthenticated": "false"            }        },        "invokedBy": "rds.application-autoscaling.amazonaws.com"    },    "eventTime": "2023-01-09T16:54:56Z",    "eventSource": "ec2.amazonaws.com",    "eventName": "DescribeSubnets",    "awsRegion": "us-east-1",    "sourceIPAddress": "rds.application-autoscaling.amazonaws.com",    "userAgent": "rds.application-autoscaling.amazonaws.com",    "errorCode": "Client.UnauthorizedOperation",    "errorMessage": "You are not authorized to perform this operation.",    "requestParameters": {        "subnetSet": {},        "filterSet": {            "items": [                {                    "name": "subnet-id",                    "valueSet": {                        "items": [                            {                                "value": "XXXXX"                            },                            {                                "value": "XXXXX"                            }                        ]                    }                }            ]        }    },    "responseElements": null,    "requestID": "XXXXX",    "eventID": "XXXXX",    "readOnly": true,    "eventType": "AwsApiCall",    "managementEvent": true,    "recipientAccountId": "XXXXX",    "eventCategory": "Management"}I don't see any way that I can modify the permissions of this service role, but I also don't like my cloudwatch alerts being filled with these notifications.  Any way I can give this role the proper permissions?FollowComment"

Answer: "0Hello,I hope you're doing well.Thank you for reaching out to us with your concern.Firstly, I would like to inform you that the service-linked policy is linked to a service and used only with a service-linked role for that service. You cannot attach, detach, modify, or delete this policy.  To know more, Please follow the solution defined in AWS Documentation. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html?icmpid=docs_iam_console#iam-term-service-linked-role.Alternatively, you can create a service role and assign a specific permission for the role. For Creating a role to delegate permissions to an AWS service : https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.htmlFrom the cloudtrail log , I could see that you are facing "Client UnauthorizedOperation" error. This error usually happned because the user/role, who is trying to access the configuration may lack with permission.As we have only limited information, we can't find the actual cause of the issue. sry for the inconvience caused. To troubleshoot further, I would request you raise a support case ticket, where we can go deep dive into the issue to find out the actual root cause.CommentSharerePost-User-5962359answered 5 months ago"


Question: Redirect that could work for any query string?

"{"source": "/old/path?<qry>","target": "/new/path/?<qry>","status": "301","condition": null}Why doesn't this work?Edited by: WD40erik on Jul 9, 2019 6:57 PMFollowComment"

Answer: "0Accepted AnswerThe redirect query string can contain multiple parameters but cannot be formatted as a single string param like you've listed there. Additionally, the target currently only supports path based URL's when using query strings (like those used with SPA routing frameworks, aka react-router, angular-router, etc).The following are valid redirects (the names are arbitrary):/docs?id=<idValue>/documents/<idValue>/docs?id=<idValue>&nextId=<nextIdValue>&finalId=<finalIdValue>/documents/<idValue>/<nextIdValue>/<finalIdValue>etc...Note that if any target is not a valid path within your app, the default redirect rule will redirect all invalid requests back to root.CommentShareAWS-User-2147846answered 4 years ago0Hi WD40erik,I have the same issue with multiple environments using GitFlow.We have qa.example.com and dev.example.com with zero code changes between the two. However, qa.example.com was deployed 3 days before dev.example.com and qa works as I expect.When navigating to /dashboard and /dashboard/, with or without a trailing slash on qa it works fine and renders the page. If you navigate to the dev subdomain without a trailing slash, /dashboard it redirects to /dashboard/ with the appended trailing slash and removes any query parameters.This is super frustrating as there are no differences between the codebases and there are no rewrites and redirects rules set for the app. My only guess is that AWS Amplify Console changed its default routing/redirects within the past week or so. Hence qa subdomain was not affected, since it was deployed a few days earlier, and dev subdomain was affected by some Amplify Console code change.CommentShareaffableblokeanswered 4 years ago"


Question: govCloud RDS cert update

"The current govCloud RDS use certificate rds-ca-2017, which is expiring soon. When I goes to modify database, I do not see rds-ca-2019, but rds-ca-rsa2048-g1 and rds-ca-rsa4096-g1. Should we use these two instead? When would they expired? and where do I download  the cert for my application? Do I download the certificate bundle from the govCloud?Thanks.FollowComment"

Answer: "0According to the AWS GovCloud (US) User's Guide or the RDS service:Since the AWS GovCloud (US) Regions use a unique certificate authority (CA), update your DB instances for the AWS GovCloud (US) Regions to use the Region-specific certificate identified by rds-ca-rsa4096-g1 in DescribeCertificates calls as soon as possible. The remaining instructions described in the Rotating your SSL/TLS certificate topic are the same, except for the certificate identifier.Running the following command: aws rds describe-certificates --region us-gov-east-1Produces:{    "Certificates": [        {            "CertificateIdentifier": "rds-ca-2017",            "CertificateType": "CA",            "Thumbprint": "12fef37925cf5758c3c2d32b4dfca31e74a5dde4",            "ValidFrom": "2018-07-28T00:52:33+00:00",            "ValidTill": "2022-06-01T12:00:00+00:00",            "CertificateArn": "arn:aws-us-gov:rds:us-gov-east-1::cert:rds-ca-2017",            "CustomerOverride": false        },        {            "CertificateIdentifier": "rds-ca-rsa2048-g1",            "CertificateType": "CA",            "Thumbprint": "f8fdfb895f10acb081e6003666c9ec20771f589f",            "ValidFrom": "2022-04-20T19:21:26+00:00",            "ValidTill": "2027-04-20T20:21:26+00:00",            "CertificateArn": "arn:aws-us-gov:rds:us-gov-east-1::cert:rds-ca-rsa2048-g1",            "CustomerOverride": false        },        {            "CertificateIdentifier": "rds-ca-rsa4096-g1",            "CertificateType": "CA",            "Thumbprint": "beb497e3471c0f7b230cba284179c54bdc6add97",            "ValidFrom": "2022-01-03T20:42:15+00:00",            "ValidTill": "2027-01-03T21:42:15+00:00",            "CertificateArn": "arn:aws-us-gov:rds:us-gov-east-1::cert:rds-ca-rsa4096-g1",            "CustomerOverride": false        }    ]}Links for downloading the CA bundles can be found here: Using SSL/TLS to encrypt a connection to a DB instance.CommentShareEXPERTkentradanswered a year ago"


Question: Connect chat agent - agent transfer

"We have implemented below for Live chat feature in our web site. Challenge is transferring from one agent to another agent. Before the second agent accepts the call, if we refresh the browser - session is lost.How do we keep it alive with the participant token, initial contact id until we receive the new contact id?We need a chat SDK developer - to assist.https://github.com/amazon-connect/amazon-connect-chat-ui-examples/tree/master/cloudformationTemplates/asyncCustomerChatUXFollowComment"

Answer: "1Hello,Greetings!I would like to mention that, this is the default behaviour of Connect CCP. I went ahead and followed the same instructions mentioned in the github link provided by you and I also witnessed the same scenario.Furthermore, when a chat is transferred to the agent2 by agent agent1 and if the browser is refreshed before agent2 accepts the chat, then, the session is lost for the agent1 and agent1 is moved to the "After chat work state".I went ahead and checked the same thing using connect's default CCP from connect console and witnessed the same thing here as well.CommentShareSUPPORT ENGINEERrePost-User-3624199answered 9 months agosgana123_aws 8 months agoSorry for the delayed response. I was trying to get assistance from AWS Tech through account engagement. What would be the fix or alternate solution?Share"


Question: Venn diagram of permissions in SageMaker Studio?

"Is there any overlap of permissions between a space execution role and a user profile execution role, if those two are given different permissions? Does it behave the same as with service control policies (SCPs) and policies on IAM roles, where the overlap is what takes effect? For example, if the space execution role has an explicit deny (or even an implicit deny for that matter!) for CreateApp, but the user profile execution role has an explicit allow for CreateApp, then that user profile won't be able to CreateApp?FollowComment"

Answer: "1Accepted AnswerHi Yann, the user profile's execution role is what will be used within the context of the private app of the user profile. So, once a user hits Launch -> Studio or is redirected to Studio UI through SSO, the user's execution role will allow them to launch apps such as data science app, data wrangler app, etc.The default space execution role is what is assumed by the user once they are in a shared space. So, once the user is in the UI by clicking Launch -> Spaces, the user cannot create apps to run notebooks in, within that space.TL;DR - they are two distinct roles, each giving the user permissions on a private space or a shared space, and do not work like SCPs. Any user in the shared space within a domain, will share the same execution role as of today. However, for the private space, each user profile can have their own role if needed.CommentShareDurga_Sanswered 5 months ago"


Question: AWS Managed MS AD DNS forwarder to ec2 domain instance

"Hello,I am trying to setup an environment to replicate my on-prem environment.VPC 1 has 2 ec2 instances, one with Microsoft AD installed. The other instance is added to this domain. I am able to login with domain credentials. domain is 'manual.test.local'VPC 2 has an AWS managed MS AD, one EC2 instance, joined to this domain. domain is 'awsmanaged.work.local'Both VPC's are peered & all ports on DCs are able to be connected to (only tested TCP ones).I want to setup a one way trust from the AWS managed instance.Setup a conditional forwarder from each domain to the other.From VPC 1 I am able to resolve names in the AWS Managed domain.From VPC 2 I am NOT able to resolve names in the EC2 manually installed domain.I dont believe that it is a security group issue.If I perform an nslookup from the ec2 instance in VPC 2 to the other domain (to manual.test.local) just using the aws managed DNS servers this fails. If I put the DNS server to be queried as the dc running manual.test.local this resolves as expected.I have not put anything in route 53.Do I need to create a Route 53 resolver record? If so is this because it is the AWS Managed domain?Thanks,MattFollowComment"

Answer: "1Hello,I resolved this myself (after not following my own advice)It WAS an issue with the Security group.The managed directory service group sets outbound connections are only allowed to the domain controllers that it created.I added the rule to allow all ports out to the DC that I am trying to get to & all was good.Able to crete & verify trusts.Thanks,MattCommentShareMattriddanswered 3 years agoEXPERTJeremy_Greviewed a year ago"


Question: Unable to start or launch instance

While  starting Ec2 instance it shows "Failed to start the instance i-03df5975c5898aedfThis account is currently blocked and not recognized as a valid account. Please contact aws-verification@amazon.com if you have questions." Because  of this we were stuck with the application.Please try to solve this issueFollowComment

Answer: 0You will have to check your payment details and may be you got any email from Amazon about your account block but it is better to see in section IAM Users or contact to AWS by creating ticket for consultancyCommentShareArsalananswered 12 days ago


Question: 'S3' object has no attribute 'detect_document_text' (python code)

'S3' object has no attribute 'detect_document_text' this error show when try to extract raw text data from invoice document using AWS Textract python function  detect_document_text inside AWS Lambda.FollowComment

Answer: "2Sounds like you're doing something like this:s3 = boto3.client("s3")# maybe some other code heres3.detect_document_text(...)But you need to create a textract client:textract = boto3.client("textract")# maybe some other code hereresponse = textract.detect_document_text(    Document={        "S3Object": { "Bucket": "mybucketname", "Name": "my-object-name.jpg" }    })Check out the boto3 documentation for textract, and for detect_document_text() specifically for more info, including the value of the response you'll get back.CommentShareEXPERTJames_Sanswered 7 months ago"


Question: INVALID_CAST_ARGUMENT: Cannot cast '' to DOUBLE - Error

"I have been using the below statement to retrieve the sum of all the values from that column as shown belowSUM(CAST(column1 AS DOUBLE)) as cnt but now it is erroring out with the below errorINVALID_CAST_ARGUMENT: Cannot cast '' to DOUBLEThis query ran against the "imdsout" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 004997cb-e355-445c-b502-28ecd8f8aaafFollowComment"

Answer: "1Accepted AnswerHi, does column1 contain empty string? If so it will throw a cast error.If so, make sure to use where clause to excluded unwanted values such as ‘’.Hope it helps ;)CommentShareEXPERTalatechanswered 3 months ago0Thank you @alatech. Yes it did contain empty string. Once I excluded it works.CommentSharerePost-User-2359319answered 3 months ago"