Question: Unable to change SSO Idp to AD instance in member account

"My SSO is currently using an AWS AD instance in the management account. I would like to reconfigure the SSO to use a different Idp that is an AWS managed AD instance in a member account. I have set the delegated administrator in the SSO to the member account; however, when I try to change the Idp from the management account I only see the AD instance in that account as an option. When I try to change the Idp from the delegate member account I dont have the option to change to Idp. Not sure if I am misunderstanding how the admin delegate functionality is intended to work. Any help or pointers would be much appreciated.Thanks. PeterFollowComment"

Answer: "0Hello,In regards to AWS SSO and Organization, the following points are needed to be considered -When you designate a member account as a delegated administrator for the organization, users and roles from that account can perform administrative actions for AWS SSO that otherwise can be performed only by users or roles in the organization's management account. [1]Here is an AWS table that clarified on the tasks that can be performed in the delegated administrator account [2] - One of these AWS SSO administrative tasks is -> "Change or manage identity sources". Hence, your delegated member administrator account should be able to change the identity source.To confirm on the same, I ran a quick test in my own environment -Logged into AWS management account and registered a member account as a delegated admin account [7].Created an Azure AD AWS Single Sign-on Enterprise application and configured the SAML options [8].After that I signed into the delegated Admin member account and changed the Identity Source from "AWS SSO"  to "External identity provider" in AWS SSO Console settings using the information collected from Azure AD such as Sign In URL, Issuer URL, IdP certificate [9].The identity source for AWS SSO was changed to External identity provider - AD Azure without any errors.I also confirmed that I was able to revert back to AWS SSO as IdP Source as well using delegated Admin member account.After this I also deployed a AWS Managed Microsoft AD [11] in delegated Admin member account in AWS Directory Service in the same region as the AWS SSO to test the behavior of changing IdP Source to Azure AD this time.Once the Directory was created in the delegated member account, I switched to AWS SSO Console in the delegated Admin member account, and was able to see and select the recently created directory listed when changing IdP source to Azure Directory.I was also able to successfully change the IdP from AWS SSO to Active Directory's -> AWS Managed Microsoft AD directory using Delegated Admin member account as seen from the output below, and after which I was successfully able to revert back to AWS SSO IdP source as well.Output -Active Directory connected to AWS SSO successfully. To add users and groups to the sync scope, do one of the following: 1) Choose Start guided setup, and follow the steps to configure your sync scope, or 2) Choose Manage sync, and add users and groups as required to configure your sync scope.Hence, this testing confirmed that the change in identity source can be made using Delegated Admin member account.Also please note that the delegated administrator account will not be able to perform the following actions [3]:- Delete the AWS SSO configuration.- Delegate (to other accounts) administration of AWS SSO.- Manage user or group access to the management account.- Manage permission sets that are provisioned (have a user or group assigned) in the = organization management account.Now considering your scenario -"I would like to reconfigure the SSO to use a different Idp that is an AWS managed AD instance in a member account."Your AWS resource - "AWS managed AD instance" as you stated is in the member account, hence only the member account will be able to access the AWS resource.Although a question here comes to my mind, have you shared your directory as well? [6]"When I try to change the Idp from the management account I only see the AD instance in that account as an option."This should be expected behavior as the management account will only be able to access the resources found in the management account. Remember that you are logged/signed in your management account so you only have access to your account's AWS resources.You can setup up cross account access for resources by assuming a role in another account to access it's resources or in cases like with Secret Manager, S3, the resource based policies attached to these resources can allow access."When I try to change the Idp from the delegate member account I dont have the option to change to Idp."So if I understand this correctly, you mean to say that you are not even seeing the option to change the IdP source to say "Active Directory" or "External identity provider" in your settings in your AWS SSO Console from delegated member account Peter?Example ScreenshotAlso can you confirm that your AD directory exists in the same region as the AWS SSO as well? The reason I ask this query is because to connect AWS SSO to AWS Managed Microsoft AD, you need to make sure that the AWS SSO console is using one of the Regions where your AWS Managed Microsoft AD directory is located [10].Please note that AWS SSO requires a directory/store in place before you configure an identity source as "External Identity Provider" as part of the prerequisites. [4]AWS SSO store is created by default once you enable AWS SSO and is immediately ready for use. The reason for these requirements is that if you delete or switch to/from external IdP, your entitlements will be preserved by the AWS SSO's own directory as per AWS SSO considerations documentation.If the prerequisite directory/store doesn't exist, then I have seen in the past that the option to change to External Identity Provider on the UI is missing because the pre-req isn't met and to resolve the issue, one need to first meet the pre requisite by creating an AWS SSO directory after which the option to change to external identity provider appears on the UI. I am wondering if you are facing a similar case scenario with your AD managed instance.To be able to troubleshoot this further Peter, and be able to take a look at your AWS resources to see what might be going on, I would request you to create a support case with our AWS SSO Premium Support team directly so as to investigate the behavior you are currently facing regarding not seeing the option to change IdP.I hope the above shared information was able to shed light on tasks that can/cannot be performed by Delegated Admin account in your AWS SSO.References:[1] https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-sso.html[2] Delegated administration - What tasks can be performed in the delegated administrator account - https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html#delegated-admin-tasks-member-account[3] https://aws.amazon.com/blogs/security/getting-started-with-aws-sso-delegated-administration/[4] AWS SSO prerequisiteshttps://docs.aws.amazon.com/singlesignon/latest/userguide/prereqs.html[5] Considerations for changing your identity source  - Changing between AWS SSO and an external identity providerhttps://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-considerations.html#changing-between-sso-and-azure-active-directory[6] https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_directory_sharing.html[7] Delegated administration - Register a member account - https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html#delegated-admin-how-to-register[8] Tutorial: Azure AD SSO integration with AWS Single Sign-on - https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/aws-single-sign-on-tutorial[9] Change your identity source - https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-change.html[10] Connect AWS SSO to an AWS Managed Microsoft AD directory - https://docs.aws.amazon.com/singlesignon/latest/userguide/connectawsad.html[11] Create your AWS Managed Microsoft AD directory - https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_getting_started_create_directory.htmlCommentShareSUPPORT ENGINEERYash_Canswered a year ago"


Question: I want to cancel private CA Renewal. What should I do?

I want to cancel private CA Renewal. What should I do?FollowComment

Answer: "0Unless it is already in expired or failed state, one must disable it before decommissioning it. Make sure you select the right restoration period in case of rollback. Refer to: https://docs.aws.amazon.com/privateca/latest/userguide/PCADeleteCA.htmlCommentShareGAanswered 4 months ago"


Question: "Glue Workflow: Add same glue job multiple times, each with different parameters"

"I have created a templated job (with parameters) to ingest data from different tables (passing the database and table as parameter) and write the data to S3 (passing the destination bucket as parameter as well). Now I would like to create a workflow where I can add the job multiple times, once for each table I need to ingest from. But in the Workflow UI, when I try to add the same job again, it doesn't add a new block for the job. How should I approach to solve this?FollowComment"


Question: Is there a way to get stale DNS records from SSM or AWS Trusted Advisor?

"I'm wondering to know if there is a way to distinguish stale DNS records in Route53 using SSM, trusted advisor or any other AWS tool.FollowComment"

Answer: "2What is a "stale DNS record"? What I think you're asking is "how can I tell if a DNS record is pointing to an AWS resource that doesn't exist anymore".The short answer to your question is no, there isn't an easy way to do that. And you should also consider stale CloudFront origin configurations.If so: The resource records of interest will be A, CNAME, MX and ALIAS. Perhaps NS too. There's a good (external) post on this topic but it only does half the job. If you have a multi-account environment then you will need to create an inventory of resources (IP addresses, load balancers, etc.) that are available in all of those accounts and then check the Route 53 entries against them.For CloudFront, take a look at this post.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: ECS Fargate + Service Discovery + ALB

"A customer wants to use ECS Fargate to run tasks with AWS Service Discovery front-ended by an ALB (to manage scaling and TLS). In testing, Service Discovery bypasses the ALB and just sends requests to the tasks.Is the Service Discovery -> ALB pattern just not supported? They're trying to avoid deploying something else to manage (Consul for example).FollowComment"

Answer: "1Accepted AnswerService Discovery is an alternative to ALB, and makes use of Route 53 hosted zones. As new tasks are started, they are automatically registered into the Route 53 hosted zone under the 'friendly' service name, and other services can then use this name when contacting their dependencies.ALB can be used either simple to balance incoming traffic from customers to your first tier of services, or as an alternative to Service Discovery by providing your applications with a DNS endpoint to use when they need to contact their dependencies.CommentShareAWS-User-7102490answered 5 years ago"


Question: AWS Batch on Fargate: AccessDenied trying to access secrets manager

"I am able to run ECS tasks and access secrets from Secrets Manager to pass as environment variables to my container. I am attempting to do the same thing with my AWS Batch job definition.I am using the same ecsTaskExecutionRole on both ECS and Batch, so I know the permissions are good for accessing the desired secret because it works on ECS. I triple checked the permissions per https://docs.aws.amazon.com/batch/latest/userguide/execution-IAM-role.htmlI am almost certain it's not a networking issue, as I'm running the job with a public IP and in a public subnet of my VPC (the same VPC subnet that I have ECS tasks successfully fetching secrets in)When attempting to run a job, I get the following error:"statusReason": "ResourceInitializationError: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve secrets from ssm: service call has been retried 1 time(s): AccessDeniedException: User: arn:aws:sts::XXXXXXXX:assumed-role..."If I remove the secrets from the job definition the container will pull from the registry.Both the AWS Web Console and CLI have the truncated statusReason error, which is frustrating because there may be useful info there.FollowComment"

Answer: "1Turns out I had an invalid "ValueFrom" value on a secret, and the error message would presumably have pointed to the invalid secret if the error message was not truncated. Would be nice if the ARNs were validated in the job definition.CommentSharedirkhanswered 2 years ago"


Question: AWS EFS link to ECS

"Hi All,I created POC with EFS as temporary storage for my ECS Cluster. I'm using Fargate, and already setup EFS link on my ECS Task Definition.When I tried it, seems like it's failed because write permission denied.Is there any official article about how to link EFS to ECS? Article that I saw is to link EFS to EC2 that using Amazon Linux 2 image.Thank You.FollowComment"

Answer: "1Make sure that you have set up the correct IAM permissions for your ECS tasks to access the EFS file system. You should have a policy that allows your ECS tasks to perform actions such as elasticfilesystem:ClientMount and elasticfilesystem:ClientWrite.Secondly, you should ensure that your task definition is set up correctly to use EFS. This means including the efsVolumeConfiguration section in your task definition with the correct mount point and file system ID.Or you can giving your ECS tasks superuser privileges, That might be a quick way to get around the issue.CommentShareTasadduq Burneyanswered 3 months ago1This AWS Blog is also a good reference.https://aws.amazon.com/blogs/containers/developers-guide-to-using-amazon-efs-with-amazon-ecs-and-aws-fargate-part-2/#:%7E:text=POSIX%20permissionsCommentSharekenchoanswered 3 months ago"


Question: Configuring Neptune for HTTP requests using aws-sdk with an IAM account

"I want to setup Neptune as my App DB (as a Property Graph using openCypher queries).My App is an Angular/Ionic App to be run on Mobile devices.I learned that once I define an IAM account with AmazonNeptuneFullAccess policy, I then have an Access Key and Secret Key to use with the aws-sdk in my Angular app.What I'm not sure, is what configuration is needed on the Neptune Instance/DB, to happily allow such HTTP requests coming in from the App.Do I need to define something in the default VPC security group? VPC endpoints? something else?Thank you!MorFollowComment"

Answer: "0There are a couple of different ways to architect this.First approach - Exposing Neptune outside of a VPCBy default, Neptune can only be accessed within a VPC.  We do not presently attach public IP addresses to the Neptune cluster.  If you want to access Neptune directly from an application hosted outside of a VPC, then you would need to use some sort of proxy, such as a load balancer.  More details on deploying this architecture can be found here:  https://github.com/aws-samples/aws-dbs-refarch-graph/tree/master/src/connecting-using-a-load-balancerSecond approach - Build an API LayerAnother approach would be to build an API layer on top of Neptune using a combination of API Gateway and AWS Lambda functions.  With this approach, your application would only need to make API requests and the Lambda functions (which can run within the same VPC with Neptune) can execute the related graph queries and return the responses to your application via the API response.  This architecture has the benefit of using features such as API throttling and caching, which may be more advantageous as the usage of your application increases over time.  It also allows you to incorporate other data services and extend your API-layer without a lot of refactoring on the application side.  You can use this workshop (https://catalog.us-east-1.prod.workshops.aws/workshops/2ae99bf2-10df-444f-a21f-8ad0537a9bdd/en-US) to learn more about this architecture.Regarding IAMIn either case, you would likely want to create or use an integration between the user auth you're designing for your app and the ability to federate those credentials with related IAM credentials.  An easy service to use for this purpose is Amazon Cognito.  The only difference regarding the two approaches above is that the IAM role that gets federated for the First Approach would have the policies for access Neptune directly.  Whereas for the Second Approach, the role would contain the policies needed for accessing the APIs for API Gateway.  Access to Neptune in that case would be done through the Lambda functions, so the Lambda functions would need an IAM role with attached policies for access Neptune.You may also want to take a look at AWS Amplify, as this contains pre-built components (for Angular, React, and other frameworks) for performing authentication and integrating with Cognito: https://docs.amplify.aws/lib/auth/getting-started/q/platform/js/#option-1-use-pre-built-ui-componentsCommentShareTaylor-AWSanswered 4 months agomor 4 months agoTaylor, thank you for the clear answer.Out of the two, the second definitely sounds better for me.However, I'm sure I learned that access through an IAM account with a Programmatic access as the access type might also be an option. In the documentation, it is also described how to store and use of the Access Key and Secret Key with the aws-sdk package. I see you have not at all mentioned this as an option.Did I miss anything?ShareTaylor-AWS 4 months agoUpdated the response to include information about IAM.Share"


Question: Block Internet on Workspaces

"Hello!I cannot block Internet access on Workspaces.In security group related to Workspaces in "Outbound rules" I deleted "0.0.0.0" rule, in "Outbound rules" I have only one rule, which allows traffic to local network (Workspaces subnet itself).In directory settings "Access to Internet" is set up to "disable".But I can access Internet resources from Workspace itself. And I don't understand why traffic is passing while no rules is set up.What I need to set up for block access to Internet from Workspaces?Thanks!FollowComment"

Answer: "0Hello!I missed that there is additional Security Group.You can check it here:AWS Console-> Workspaces->Directories -> Select your directory -> Actions (update details) -> Security Groups ->"Select a security group to add to your WorkSpaces"This group will be added to all new generated WorkplacesIn my case this additional group contains outbound rule for 0.0.0.0/0Thanks!Edited by: Scullone on Feb 25, 2019 3:23 AMEdited by: Scullone on Feb 25, 2019 3:24 AMCommentShareSculloneanswered 4 years ago"


Question: Enabling cloudwatch slowlogs and engine logs for elasticache redis cluster

"Hello,I'm trying to create log streams for slow logs and engine logs for elastic cache redis.Redis returns this error : "Failed to grant access to log group <logGroup>. Check the length of the resource policy document". I have tried to add a resource policy in order to enable cloudwatch logs access but it doesn't work.Do you have any Idea ?Thanks a lot for your supportFollowComment"

Answer: "0Hello there,One of the problems for this error could be that your resource policies are violating the CloudWatch Logs resource policy size restrictions.Please note that CloudWatch Logs resource policies are limited to 5120 characters as stated in the documentation, see reference [1].To avoid reaching the CloudWatch Logs resource policy size limit, prefix your CloudWatch Logs log group names with /aws/vendedlogs/.Also please take note that Redis Slow Log is supported for Redis cache clusters and replication groups using engine version 6.0 onward whilst Redis Engine Log is supported for Redis cache clusters and replication groups using engine version 6.2 onward, see reference [2].It is also important to note that you must set the apply-immediately parameter for all log delivery modifications.Make sure that you include the following IAM permissions in your IAM user/role policy (also see reference [3]):logs:CreateLogDeliverylogs:UpdateLogDeliverylogs:DeleteLogDeliverylogs:FetLogDeliverylogs:listLogDeliveriesReferences:[1] https://docs.aws.amazon.com/step-functions/latest/dg/bp-cwl.html[2] https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html[3] https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Logging-destinations.htmlCommentShareAsenathianswered a year ago"


Question: AWS Certificate Manager: Additional Verification Required

"I created a certificate which I needed for my elastik beanstalk app but the status is showing failed.However, it shows the reason for failing is that "ACM requires additional information to process this certificate request.  If you don't have a support plan, post a new thread in the ACM Discussion Forum"Hence this thread. Please help.FollowCommentAlberto Fernandes 3 months agoDo you have a domain name in Aws Route53?Share"

Answer: "0HelloKindly open an account and billing support case, provide them with your domain and region.The team will be  get you out of the error. You do not need a support plan to open an account and billing case.CommentShareAdeyinianswered 3 months ago"


Question: AWS Public IP to AWS Public IP Traffic

"If one AWS Public IP/EIP communicates with another AWS Public IP/EIP, will the traffic still be with in AWS backbone? or will this traffic still go outside of AWS network to Internet?FollowComment"

Answer: "4Accepted AnswerThe traffic will stay on the AWS network, see below from the VPC FAQQ. Does traffic go over the internet when two instances communicate using public IP addresses, or when instances communicate with a public AWS service endpoint?No. When using public IP addresses, all communication between instances and services hosted in AWS use AWS's private network. Packets that originate from the AWS network with a destination on the AWS network stay on the AWS global network, except traffic to or from AWS China Regions.CommentShareEXPERTTushar_Janswered a month agoEXPERTBrettski-AWSreviewed a month agoGary Mclean a month agoTechnically it’s internet traffic which is outside of your vpcShare"


Question: Can not create a stepfunction with create-state-machine command in docker-compose

"Hi, I am trying to create a step function in local using step-function-local docker images and ones the step function is created, I am using aws-cli docker image to create state machine, but I would like the aws-cli container to be alive so that I can do testing in my local environment, I tried setting tty option to true but that doesn't work. please help with achieving this, here is my docker-compose file.version: "3.9"services:  dynamo-db:    image: "amazon/dynamodb-local"    ports:      - "8000:8000"  step-function:    image: "amazon/aws-stepfunctions-local"    environment:      - AWS_ACCESS_KEY_ID=<access-key>      - AWS_SECRET_ACCESS_KEY=<secret-key>    ports:      - "8083:8083"  state-machine:    image: amazon/aws-cli:latest    stdin_open: true # equivalent of -i    tty: true        # equivalent of -t    network_mode: host    #entrypoint: tail -F anything    depends_on:      - step-function    deploy:      mode: replicated      replicas: 1      resources:        limits:          cpus: "2"          memory: 2048M      restart_policy:        condition: on-failure        delay: 5s        max_attempts: 3        window: 120s    env_file:      - aws-stepfunctions-local-credentials.txt    volumes:      - ./config:/config    command: stepfunctions --endpoint http://localhost:8083 create-state-machine --definition file:///config/<file-name> --name test --role-arn "arn:aws:iam::123456789012:role/HelloWorldFunctionRole"FollowComment"

Answer: "0Hello,As docker isn’t an AWS service I may not be able to help debug the docker file itself, however I did find our documentation on setting up step function local with docker and how to test this:Setting Up Step Functions Local (Downloadable Version) and Docker - https://docs.aws.amazon.com/step-functions/latest/dg/sfn-local-docker.htmlSetting Configuration Options for Step Functions Local - https://docs.aws.amazon.com/step-functions/latest/dg/sfn-local-config-options.htmlTesting Step Functions State Machines Locally - https://docs.aws.amazon.com/step-functions/latest/dg/sfn-local.htmlTesting Step Functions and AWS SAM CLI Local - https://docs.aws.amazon.com/step-functions/latest/dg/sfn-local-lambda.htmlI’d recommend taking a peek at our documentation and seeing if you can scaffold a solution from within it. It can be hard to determine what is occurring since we have three items in play:Your local machines setupDockerStep Function LocalCommentShareSUPPORT ENGINEERTim_Panswered a year ago"


Question: Athena Query failing

"Insufficient permissions to execute the query. Encountered an exception executed in context[Split[ef558767-2775-49fb-966a-fbf03c7baee6:0]] with message[Encountered an exception executed in context[retrieving blocks] with message[Encountered an exception executed in context[executing] with message[Forbidden resource: Forbidden: HTTP response error code: 403 Message: AccessDenied Access Denied x-amz-request-id: 5480WZTXCTTG38F1 x-amz-id-2: PfypL0EbdlVgPIFfrK7WkBIu5em35z1Pn8lpghOClK1yNMPulHZq09OmONNdBcOIa1gD2FTi6Q4hJv4R4SZAJQ==This query ran against the "andes" database, unless qualified by the query.Query Id: b3d31e9c-654a-402e-a20b-e026ff409608FollowComment"

Answer: "0It seems that the IAM user using Athena doesn't have the required permissions to access the S3 bucket that you want to query.You can check this Access denied in Athena troubleshooting guide for detailed information.The first section covers the permissions required by a IAM user to access the S3 buckets from Athena. As you can see in the example policy your user needs to have ListBucket and GetObject permissions for the S3 source bucket.Here is the example policy. Fore more guidance check the troubleshooting guide.{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:ListBucket"      ],      "Resource": [        "arn:aws:s3:::my-athena-source-bucket"      ]    },    {      "Effect": "Allow",      "Action": [        "s3:GetObject"      ],      "Resource": [        "arn:aws:s3:::my-athena-source-bucket/data/*"      ]    },    {      "Effect": "Allow",      "Action": [        "s3:GetBucketLocation",        "s3:GetObject",        "s3:ListBucket",        "s3:ListBucketMultipartUploads",        "s3:AbortMultipartUpload",        "s3:PutObject",        "s3:ListMultipartUploadParts"      ],      "Resource": [        "arn:aws:s3:::my-athena-result-bucket",        "arn:aws:s3:::my-athena-result-bucket/*"      ]    }  ]}CommentShareigsalvaranswered 20 days agoEXPERTFabrizio@AWSreviewed 19 days ago"


Question: IAM poilcy for an user to access Enhanced Monitoring for RDS.

"I am trying to create an IAM user that will have least privileges to be able to view enhanced monitoring for a particular RDS database. I have created a ROLE (Enhanced Monitoring) and attached a managed policy to it:'AmazonRDSEnhancedMonitoringRole'. This role is passed to RDS database using the passrole permission. The policy that I am attaching to this IAM user is as below:{"Version": "2012-10-17","Statement": [    {        "Sid": "VisualEditor0",        "Effect": "Allow",        "Action": [            "cloudwatch:PutMetricData",            "rds:*",            "cloudwatch:GetMetricData",            "iam:ListRoles",            "cloudwatch:GetMetricStatistics",            "cloudwatch:DeleteAnomalyDetector",            "cloudwatch:ListMetrics",            "cloudwatch:DescribeAnomalyDetectors",            "cloudwatch:ListMetricStreams",            "cloudwatch:DescribeAlarmsForMetric",            "cloudwatch:ListDashboards",            "ec2:*",            "cloudwatch:PutAnomalyDetector",            "cloudwatch:GetMetricWidgetImage"        ],        "Resource": "*"    },    {        "Sid": "VisualEditor1",        "Effect": "Allow",        "Action": [            "iam:GetRole",            "iam:PassRole",            "cloudwatch:*"        ],        "Resource": [            "arn:aws:cloudwatch:*:accountnumber:insight-rule/*",            "arn:aws:iam::accountnumber:role/Enhanced-Monitoring",            "arn:aws:rds:us-east-1:accountnumber:db:dbidentifier"        ]      }    ]}As you can see, I have given almost every permission to this user, but still I am getting 'Not Authorized' error on the IAM user RDS dashboard for enhanced monitoring, although cloudwatch logs are displaying normally.I am following this guide (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html) for enhanced monitoring of RDS. Refer to example 2 on this page.FollowComment"

Answer: "0Hello there,I understand that you are trying to create an IAM user that will have least privileges to be able to view enhanced monitoring for a particular RDS database but you are getting a 'Not Authorized' error on the IAM user RDS dashboard although cloudwatch logs are diplaying normally.The general approach to this problem would be to turn on the “Enhanced Monitoring” option for your Amazon RDS DB Instance and set a granularity and Enhanced Monitoring will collect vital operating system metrics and process information, at the defined granularity.To set up and enable Enhanced Monitoring, see reference [1].You can also consider protecting against the confused deputy problem, see reference [1] - Protecting against the confused deputy problem.Make sure that you have the necessary permissions to pass the role to the service.To allow a user to pass a role to an AWS service, you must grant the PassRole permission to the user's IAM user, role, or group.References: [1] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.Enabling.htmlCommentShareAsenathianswered a year agorePost-User-6831256 a year agoOk let me check.Share"


Question: AWS DeepLens Terms of Use

"Hi,I would like to know if DeepLens can be utilized in production workload. The DeepLens Terms of agreement says it should not be used in the production environment.https://aws.amazon.com/deeplens/device-terms-of-use/I would appreciate any help.Regards,VikFollowComment"


Question: Simulate a "thing" in Java?

"I'm hoping I can write a quick function that simulates a "thing" in Java and be able to use it to either post messages to a topic, or update its shadow.I have the AWS Java SDK in my project and I know how to use the IotClient and IotDataPlaneClient. The problem is that these clients are both authenticated with an access key that belongs to an AWS account, and in the case of the IotDataPlane client, I have to specify the name of the thing who's shadow I want to update.What I'd like to do instead is mimic what an actual thing would do, which is to say, use a certificate to connect with the service, and only be able to update its own shadow, etc.It seems like this should be possible, but I can't find any kind of credentials provider that works with certificates or any other obvious way to do it.I know there is a complicated device simulator available and I may use it months from now when my application is further along, but for right now I'm just looking for something very quick and simple to prove a few concepts and work out my strategy.Thanks,FrankFollowComment"

Answer: "1Hi Frank. I'm going to mention the device SDK again. It's what a device, implemented in Java, would normally use.https://github.com/aws/aws-iot-device-sdk-java-v2/blob/main/samples/BasicPubSub/src/main/java/pubsub/PubSub.javahttps://github.com/aws/aws-iot-device-sdk-java-v2/blob/main/samples/Shadow/src/main/java/shadow/ShadowSample.javaStepping outside of Java, we have similar samples in most of our other-language device SDKs. We also have the Device Client: https://github.com/awslabs/aws-iot-device-clientYou can use pretty much any MQTT client though. You could even use mosquitto_pub: https://manpages.debian.org/testing/mosquitto-clients/mosquitto_pub.1.en.htmlCommentShareEXPERTGreg_Banswered a year ago0Thanks, I have that and I think I see how it can work with certificates. I guess that when a thing updates it's "shadow" it's just posting to a queue with a reserved name, correct? Does the "thing" need to tell its own name to IoT or does IoT figure that out from its certificate?CommentShareFrankanswered a year agoRyan_B a year agoThe reserved topic includes the thing name, e.g. $aws/things/THING_NAME/shadow/updateShare"


Question: AWS Secrets Manager InvalidRequestException when enabling rotation with cross account lambda on schedule

When trying to use a cross account Lambda function (i.e. secret is in Account A and Lambda in Account B) for secret rotation with a set schedule e.g. 90 days the API returns the below error code and message:InvalidRequestException: The AWS account that owns the Lambda function isn't the AWS account that's trying to invoke the function.This only occurs if you use the --rotation-rules option to rotate-secret i.e. you can enable rotation without setting rotation rules.Is this by design or an issue?FollowComment


Question: Use 'pinpoint' in app that doesn't have accounts

"I'm trying to set up Push Notifications on an Android app by following the instructions provided. I've reached the step where I need to call the function "Amplify.Notifications.Push.identifyUser()".My app is completely anonymous. Users install it, run it, and it does what it does, without ever prompting anyone to log in or otherwise identify themselves. What should I pass to the identifyUser function? Can I pass a constant value? Should I generate a random number? Do I need to call this function at all?Thanks,FrankFollowComment"

Answer: "0In your case, since your app is completely anonymous and does not have user accounts, you still need to call  **Amplify.Notifications.Push.identifyUser() **function but you can pass a unique identifier for each device instead of a user ID.You can generate a unique ID when the app is first launched and store it in the device's local storage. This ID will then be used as the user ID for that particular device. Android provides a few different IDs that are unique to each device, such as the Android ID. You can use one of these IDs as the user ID. Note that you should be aware of the privacy implications and adhere to Google's guidelines when using device identifiers. You should not use a constant value for all devices, as this would prevent you from being able to send notifications to individual devices. The ID you pass to the identifyUser function should be unique for each device.CommentShareEXPERTsdtslmnanswered 6 days ago"


Question: MediaLive Input loss behavior not working as expected.

"Hello! We're using MediaLive for livestreaming the output of MediaConnect streams. We have 2 redundant streams coming out of MediaConnect and into standard MediaLive channel. This channel is handling switching if one of the streams is unavailable. We also configured input loss behavior to display when BOTH of the inputs are down."globalConfiguration": {      "supportLowFramerateInputs": "DISABLED",      "inputEndAction": "NONE",      "outputTimingSource": "INPUT_CLOCK",      "inputLossBehavior": {        "repeatFrameMsec": 1000,        "blackFrameMsec": 10000,        "inputLossImageType": "SLATE",        "inputLossImageColor": "000000",        "inputLossImageSlate": {          "uri": "<technical difficulties image.png>"        }While testing, we noticed that disabling one of the inputs makes the channel to properly switch to the other one. But when we disable the second one, streaming stops without displaying the slate image (then repeats last 10 seconds of stream).When I was testing the same configuration as above on single pipeline channel, it was working fine.Do you know what might be the issue?FollowComment"

Answer: "0Several items need more detail to fully understand what is occurring.First, are the 2 inputs from MediaConnect each only feeding one MediaLive pipeline of the Standard (dual pipe) MediaLive? Second, what is the Input Loss Behavior on the Output Group setting? (This is different than the Input Loss Behavior for the input.) Third, what is MediaLive delivering its output to? MediaPackage? Some other origin server?The Standard MediaLive has dual pipelines, each with their own input and output. Each will respond separately to an input loss, based on the Input Loss behavior settings for both Input and Output. Redundancy and failover will be handled downstream from MediaLive. Ex: MediaPackage is designed to receive the outputs from the dual pipe MediaLive, and will switch btwn those inputs if the current used input stops delivering HLS data. A Single pipeline MediaLive will only have one output and MediaPackage will not have another MediaLive output to switch to.Under a MediaLive Output Group, if the Input Loss Behavior is set to Pause, no output will be sent if the input to that ML pipeline stops. If it is set to Emit Output, then that output should contain the last output for 1s, then black for 10s (as per your configuration).  When using the Emit Output setting, a downstream service may not detect and loss of data and would not switch to the other ML pipeling. Note that the other pipeline from a Standard ML will continue to operate normally if its input remains.If MediaPackage is being used with a Standard MediaLive (dual pipeline) it will switch from using data from one pipeline to the other if the active input stops receiving data.The combination of all of these can may it challenging to predict what is viewed by a player when input sources stop working.CommentShareMike-MEanswered a year ago"


Question: AWS Issue - Fragmented View of Services Due To Acct/Role

Hi AWS Community:We run our tenant with multiple VPC's along with account/role based on permissions granted.    While this does a good job segmenting it presents a "front-end" issue:   our tenant lacks a top-down view of all service configuration/reporting.Example - we use Inspector to scan all 100 EC2's.   The problem is I cannot get a single report or even view into ALL results... they are broken out based on what the logged in acct/role can see.   That produces what is at best a fragmented view - incredibly inefficient & prone to blind spots.This issue persists across all services.How does one solution this - either within AWS (preferable) or if not does anyone have suggestions for 3rd-party vendors who can help reconcile this?FollowComment

Answer: "0Hello,Firstly, I would like to dive into the functionality of IAM entities - IAM Roles/Users/Groups etc. So the AWS IAM service exists to provide the secure control of individual or group access to the AWS resources.What is a IAM User?A user is a unique identity recognized by AWS services and applications. Similar to a login user in an operating system like Windows or UNIX, a user has a unique name and can identify itself using familiar security credentials such as a password or access key.What is an IAM Role?An IAM role is an IAM entity that defines a set of permissions for making AWS service requests. IAM roles are not associated with a specific user or group. Instead, trusted entities assume roles, such as IAM users, applications, or AWS services such as EC2.https://aws.amazon.com/iam/faqs/For example -An IAM Role/User can have complete access to EC2 actions with an IAM Policy like below -{"Version": "2012-10-17","Statement": [{"Action": "ec2:","Resource": "","Effect": "Allow",}]}Also, you can restrict the same IAM Role/User to be only able to access EC2 resources in a specific region by using condition keys. Basically the below example shows how you might create an IAM policy that allows full EC2 access within a specific Region.{"Version": "2012-10-17","Statement": [{"Action": "ec2:","Resource": "","Effect": "Allow","Condition": {"StringEquals": {"ec2:Region": "us-east-2"}}}]}So as you can see the IAM Policies are the JSON structures which define what an IAM entity is authorized to perform or vice versa what specific actions are denied implicitly or explicitly.Please note that when a principal tries to use the AWS Management Console, the AWS API, or the AWS CLI, that principal sends a request to AWS. When an AWS service receives the request, AWS completes several steps to determine whether to allow or deny the request.Please feel free to refer to our AWS Documentation on how AWS Policy's logic is evaluated here -https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.htmlSo as you can understand the limited view according to the permissions provided to an IAM entity is a service design capability that has been provided as a security mechanism feature. For example, you wouldn't want a sales member entity to be able to access dev/admin information that they shouldn't be able to access otherwise. Hence, you only provide them with the least privilege access which is one of the security best practices recommended by AWS.https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"When you create IAM policies, follow the standard security advice of granting least privilege, or granting only the permissions required to perform a task. Determine what users (and roles) need to do and then craft policies that allow them to perform only those tasks."Also in regards to best practices, I do want to mention that the access key for your AWS account's root user gives full access to all your resources for all AWS services, and you cannot reduce the permissions associated with your AWS account root user access key.Therefore it is another security best practice recommendation that you do not use the root user for your everyday tasks, even the administrative ones. Instead, use your root user credentials only to create your IAM admin user. Then securely lock away the root user credentials and use them to perform only a few account and service management tasks.https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentialsFurthermore, to shed some more light on the difference between the access of root user and an IAM Admin User, you can only perform the tasks listed in the AWS Doc below only when you sign in as the root user of an account. For example tasks such as changing account settings, closing account etc.https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.htmlTo summarize - There are two different types of users in AWS. You are either the account owner (root user) or you are an AWS Identity and Access Management (IAM) user.Root user credentials -> The credentials of the account owner allow full access to all resources in the account.IAM credentials -> For example, if you require administrator-level permissions, you can create an IAM user, grant that user full access, and then use those credentials to interact with AWS.https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html{"Version": "2012-10-17","Statement": {"Effect": "Allow","Action": "","Resource": ""}}Important Note - When you give a user full access, you are effectively giving them full access to all resources in your AWS account. This includes access to delete all resources. You should grant these permissions to only trusted administrators, and you should enforce multi-factor authentication (MFA) for these administrators.In case if you still have any questions on the service design in regards to IAM permission please feel free to open up a case with premium support team for further discussion if need be.Secondly, please feel free to refer to our AWS documentation which provides information on usage of IAM in cross account access and its practices -https://aws.amazon.com/blogs/apn/securely-accessing-customer-aws-accounts-with-cross-account-iam-roles/https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.htmlBasically, you can allow a principal in one account to access resources in a second account. This is called cross-account access. When you allow cross-account access, the account where the principal exists is called the trusted account. The account where the resource exists is the trusting account. To allow cross-account access, you attach a resource-based policy to the resource that you want to share. You must also attach an identity-based policy to the identity that acts as the principal in the request. The principal's identity-based policy must allow the requested access to the resource in the trusting service.Now, in case if you are looking for an aggregation of data from multiple account, several AWS services have integration with AWS Organization service to help one achieve such a use case to have a broader view per say. For example Config, Inspector, GuardDuty, Security Hub etc.https://docs.aws.amazon.com/config/latest/developerguide/config-rule-multi-account-deployment.htmlhttps://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-inspector2.htmlhttps://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.htmlhttps://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-securityhub.htmlThirdly, in regards to your front end issue with your application, we also have the dedicated AWS Solutions Architect team which addresses the architecture and design level queries for custom/development/architectural solutions. I would suggest you reach out directly to our Sales team as they can help you to get in touch with our Solutions Architect (SA) team.You can request for a member of the sales (Business Development) team to contact you using any of the following methods:> Via form:    http://aws.amazon.com/contact-us/aws-sales/> Via Live Chat:   https://pages.awscloud.com/live-chat-contact-us.html> Phone support:   +1 (833) 662-9873 - 6:30am - 4:00pm (Pacific) Monday - Friday.Fourthly, in regards to the inspector service. You can leverage the AWS Organization integration which will allow you to aggregate all finding data. Using Amazon Inspector you can manage multiple accounts that are associated through AWS Organizations by simply delegating an administrator account for Amazon Inspector. The delegated administrator manages Amazon Inspector for the organization and is granted special permissions to perform tasks on behalf of your organization such as:- Enable or disable scans for member accounts- View aggregated finding data from the entire organization- Create and manage suppression ruleshttps://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-inspector2.htmlIn case if you are facing issues during implementation or are running into any errors, please feel free to open a support case with our team so that we can assess your environment and the issues at hand to better assist you.CommentShareSUPPORT ENGINEERYash_Canswered a year ago0Thanks for the response Yash - a question:   if I wanted a user to be granted read access so that they could view/print/export any report from any service...   what would the order of config of Organizations, Cross-Account Access, individual service configs & testing access/aggregation be?There are a finite group of IAM users who would require this.    One one hand there are INFR admins who'd like to have ability to view/export reports on EC2's - a common request is asset list & performance metrics (CPU, RAM, HD space util).   Another are SECURITY folks - looking for same view into various services (Inspector, SecHub, GuardDuty, etc).And is there a list of services where this process applies?    In a perfect world we would use the same template - Organizations/Cross-Account so a "global/top-down" view of a service running across multiple Accounts/Roles - would be possible.CommentSharemohara-avonanswered a year ago"


Question: EBS Snapshot - Retention complance & Export

"One of our customer asked us the following questions. I am not sure about the answer. Could you provide some guidance?1-        Does AWS maintain hypervisor backward compatibility for the backup? If yes how many years. This is to ensure we are able to meet our data retention compliance with APRA (7 years)My understanding is that a customer should be able to restore EBS snapshot. Do we have an official response for that?2-        Can VMs be exported to standard format and moved to an alternate platform. This is also as part of business continuityI believe that EBS snapshot cant be used for that purpose.I understand VM export can be used to export an AWS EC2 instance but there are some limitations (e.g. instance’s AMI must have been previously imported with VM import).Thanks for your help in advance,FollowComment"

Answer: "0Accepted AnswerFor #1 (Does AWS maintain hypervisor backward compatibility for the backup? )In terms of EBS Snapshots - any snapshot created using one of our APIs (CreateSnapshot/CopySnapshot) can be used to create a new EBS volume for the life of the snapshot. We ensure that as we launch new volume types, or keep updating our software, new volumes can be created from old snapshots. If the customer does not want the snapshot anymore (either after 1 minute or after any number of years), they can delete the snapshot. We do not expire snapshots. Snapshots do not go end of life.For #2 (Can VMs be exported to standard format and moved to an alternate platform. This is also as part of business continuity)Your understanding about lack of exportability of snapshots is correct. We currently do not have a way to export snapshots directly. Customer have to create volumes (either EBS Volumes or Storage Gateway volumes) and read the data off of them, or they can use VM Export service to export images. For DR, they can also keep copies of their snapshots in  different regions and spin up EBS volumes in one of those regions in case of DR.CommentShareAWS-User-0590575answered 5 years ago"


Question: How to avoid truncating log lines in greengrass component logs

"I'm having a problem with starting SystemManagerAgent after a full system OTA upgrade. I can see in the logs that it attempts to run a command when the component starts up - and that it fails, but I can't see the full command that it attempted to run as it appears that the log line is truncated (Ending in SystemsManage...")How can I view the complete log line to debug this issue ?for example:*2022-09-20T08:24:19.663Z [INFO] (Copier) aws.greengrass.SystemsManagerAgent: stdout. INFO Starting agent installation. {scriptName=services.aws.greengrass.SystemsManagerAgent.lifecycle.Install.Script, serviceName=aws.greengrass.SystemsManagerAgent, currentState=NEW}2022-09-20T08:24:20.345Z [INFO] (Copier) aws.greengrass.SystemsManagerAgent: stdout. ERROR Failed to install agent: snap install: Failed to install snap with output '' and error: exit status 10. {scriptName=services.aws.greengrass.SystemsManagerAgent.lifecycle.Install.Script, serviceName=aws.greengrass.SystemsManagerAgent, currentState=NEW}2022-09-20T08:24:20.349Z [WARN] (pool-2-thread-20) aws.greengrass.SystemsManagerAgent: shell-runner-error. {scriptName=services.aws.greengrass.SystemsManagerAgent.lifecycle.Install.Script, serviceName=aws.greengrass.SystemsManagerAgent, currentState=NEW, command=["/data/greengrass/v2/packages/artifacts-unarchived/aws.greengrass.SystemsManage..."]}2022-09-20T08:24:20.358Z [INFO] (pool-2-thread-20) aws.greengrass.SystemsManagerAgent: shell-runner-start. {scriptName=services.aws.greengrass.SystemsManagerAgent.lifecycle.Install.Script, serviceName=aws.greengrass.SystemsManagerAgent, currentState=NEW, command=["/data/greengrass/v2/packages/artifacts-unarchived/aws.greengrass.SystemsManage..."]}*FollowComment"

Answer: "0Hi @MichaelDombrowski-AWSHere is the other information requested - I can't see how to post this as a comment in any useful way formatting wise.I can't see any obvious problem - Also, please note, that when i manuall run the command"snap install /data/greengrass/v2/packages/artifacts-unarchived/aws.greengrass.SystemsManagerAgent/1.0.0/artifacts/amazon-ssm-agent.snap --classic"This is works, and SystemsManagerAgent comes up sucessfully.  But I can't see why it doesn't work correctly when running in the component.# tail -F aws.greengrass.SystemsManagerAgent.2022-09-28T05:57:42.576Z [INFO] (Copier) aws.greengrass.SystemsManagerAgent: stdout. INFO Starting agent installation. {scriptName=services.aws.greengrass.SystemsManagerAgent.lifecycle.Install.Script, serviceName=aws.greengrass.SystemsMa}2022-09-28T05:57:43.508Z [INFO] (Copier) aws.greengrass.SystemsManagerAgent: stdout. ERROR Failed to install agent: snap install: Failed to install snap with output '' and error: exit status 10. {scriptName=services.aws.greengrass.System}2022-09-28T05:57:43.511Z [WARN] (pool-2-thread-23) aws.greengrass.SystemsManagerAgent: shell-runner-error. {scriptName=services.aws.greengrass.SystemsManagerAgent.lifecycle.Install.Script, serviceName=aws.greengrass.SystemsManagerAgent, }root@jeteye:/data/greengrass/v2/logs# dateWed Sep 28 06:00:39 UTC 2022root@jeteye:/data/greengrass/v2/logs# snap refresh --timetimer: 00:00~24:00/4last: n/ahold: today at 07:55 UTCnext: today at 05:59 UTC (but held)root@jeteye:/data/greengrass/v2/logs# snap changesID   Status  Spawn               Ready               Summary1    Done    today at 05:55 UTC  today at 05:55 UTC  Initialize system state2    Done    today at 05:57 UTC  today at 05:59 UTC  Install "amazon-ssm-agent" snap from file "/data/greengrass/v2/packages/artifacts-unarchived/aws.greengrass.SystemsManagerAgent/1.0.0/artifacts/amazon-ssm-agent.snap"3    Done    today at 05:57 UTC  today at 05:57 UTC  Initialize deviceroot@jeteye:/data/greengrass/v2/logs# snap change 2Status  Spawn               Ready               SummaryDone    today at 05:57 UTC  today at 05:57 UTC  Ensure prerequisites for "amazon-ssm-agent" are availableDone    today at 05:57 UTC  today at 05:59 UTC  Prepare snap "/var/lib/snapd/snaps/.local-install-620492052" (5103)Done    today at 05:57 UTC  today at 05:59 UTC  Mount snap "amazon-ssm-agent" (5103)Done    today at 05:57 UTC  today at 05:59 UTC  Copy snap "amazon-ssm-agent" dataDone    today at 05:57 UTC  today at 05:59 UTC  Setup snap "amazon-ssm-agent" (5103) security profilesDone    today at 05:57 UTC  today at 05:59 UTC  Make snap "amazon-ssm-agent" (5103) available to the systemDone    today at 05:57 UTC  today at 05:59 UTC  Automatically connect eligible plugs and slots of snap "amazon-ssm-agent"Done    today at 05:57 UTC  today at 05:59 UTC  Set automatic aliases for snap "amazon-ssm-agent"Done    today at 05:57 UTC  today at 05:59 UTC  Setup snap "amazon-ssm-agent" aliasesDone    today at 05:57 UTC  today at 05:59 UTC  Run install hook of "amazon-ssm-agent" snap if presentDone    today at 05:57 UTC  today at 05:59 UTC  Start snap "amazon-ssm-agent" (5103) servicesDone    today at 05:57 UTC  today at 05:59 UTC  Run configure hook of "amazon-ssm-agent" snap if presentDone    today at 05:57 UTC  today at 05:59 UTC  Run health check of "amazon-ssm-agent" snapDone    today at 05:57 UTC  today at 05:59 UTC  Ensure prerequisites for "core18" are availableDone    today at 05:57 UTC  today at 05:59 UTC  Download snap "core18" (2570) from channel "stable"Done    today at 05:57 UTC  today at 05:59 UTC  Fetch and check assertions for snap "core18" (2570)Done    today at 05:57 UTC  today at 05:59 UTC  Mount snap "core18" (2570)Done    today at 05:57 UTC  today at 05:59 UTC  Copy snap "core18" dataDone    today at 05:57 UTC  today at 05:59 UTC  Setup snap "core18" (2570) security profilesDone    today at 05:57 UTC  today at 05:59 UTC  Make snap "core18" (2570) available to the systemDone    today at 05:57 UTC  today at 05:59 UTC  Automatically connect eligible plugs and slots of snap "core18"Done    today at 05:57 UTC  today at 05:59 UTC  Set automatic aliases for snap "core18"Done    today at 05:57 UTC  today at 05:59 UTC  Setup snap "core18" aliasesDone    today at 05:57 UTC  today at 05:59 UTC  Run install hook of "core18" snap if presentDone    today at 05:57 UTC  today at 05:59 UTC  Start snap "core18" (2570) servicesDone    today at 05:57 UTC  today at 05:59 UTC  Run health check of "core18" snapDone    today at 05:57 UTC  today at 05:57 UTC  Ensure prerequisites for "snapd" are availableDone    today at 05:57 UTC  today at 05:58 UTC  Download snap "snapd" (17032) from channel "stable"Done    today at 05:57 UTC  today at 05:58 UTC  Fetch and check assertions for snap "snapd" (17032)Done    today at 05:57 UTC  today at 05:58 UTC  Mount snap "snapd" (17032)Done    today at 05:57 UTC  today at 05:58 UTC  Copy snap "snapd" dataDone    today at 05:57 UTC  today at 05:58 UTC  Setup snap "snapd" (17032) security profilesDone    today at 05:57 UTC  today at 05:59 UTC  Make snap "snapd" (17032) available to the systemDone    today at 05:57 UTC  today at 05:59 UTC  Automatically connect eligible plugs and slots of snap "snapd"Done    today at 05:57 UTC  today at 05:59 UTC  Set automatic aliases for snap "snapd"Done    today at 05:57 UTC  today at 05:59 UTC  Setup snap "snapd" aliasesDone    today at 05:57 UTC  today at 05:59 UTC  Run install hook of "snapd" snap if presentDone    today at 05:57 UTC  today at 05:59 UTC  Start snap "snapd" (17032) servicesDone    today at 05:57 UTC  today at 05:59 UTC  Run health check of "snapd" snap......................................................................Make snap "snapd" (17032) available to the system2022-09-28T05:59:03Z INFO Requested daemon restart (snapd snap).......................................................................Automatically connect eligible plugs and slots of snap "snapd"2022-09-28T05:59:03Z INFO Waiting for automatic snapd restart...2022-09-28T05:59:03Z INFO Waiting for automatic snapd restart...CommentSharemajhanswered 8 months agomajh 8 months ago@MichaelDombrowski-AWS,I was wondering if it was waiting for a snapd restart - perhaps this didn't happen automatically ??, so I did "systemctl restart snapd", then "systemctl restart greengrass", and it then came up successfully. Is it possible these restarts are missing from the component somehow ?Share0Hello @majh,Seeing the command will not help you to debug the issue. The error log is never truncated. The log is ERROR Failed to install agent: snap install: Failed to install snap with output '' and error: exit status 10.SSM is trying to install using snap. Please provide the full SSM component log and the following informationsnap refresh --timesnap changessnap change <change-id> <change-id> should be the number of the ID from snap changes which is the ID associated with installing SSM.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 8 months ago"


Question: Unable to  view my instance name

"Hi,I've tried in the various paths on the instance page like going through tags list, and checking in the Actions/instance settings but nothing seems to be workingI request you to please guide me on how to enable and view my instance name on the instance page itself.FollowComment"

Answer: "1In EC2 section of the AWS console click on the gear wheel icon just under the orange "Launch Instances" button:In the preferences panel that comes up, make sure that Name is specified in the Tags section.CommentShareRWCanswered 23 days ago"


Question: How can I stop an in progress Lift and Shift migration

"I have a number of servers that are currently migrating to AWS which I need to cancel.I've got them configured with the wrong network interface so need to stop, reconfigure and start the process again.FollowComment"


Question: Deploy AWS Amplify Container to Graviton 2

"Hi, I have currently deployed a container-based API service to Fargate using AWS Amplify's CLI. However, the container sits on a 0.5cpu x86 instance. How would I go about deploying this with Amplify to a graviton-based instance, or specify memory-cpu configurations?  Thanks.Docker File: created by Amplify:FROM public.ecr.aws/bitnami/node:14-prod-debian-10ENV PORT=8080EXPOSE 8080WORKDIR /usr/src/appCOPY package*.json ./RUN npm installCOPY . .CMD [ "node", "index.js" ]FollowComment"


Question: CSRF attack though ALB cookies because of samesite=none

"I have a web application with tomcat, and I configured the jsessionid cookie for samesite=lax, and it prevents CSRF attacks.When I put the application behind an ALB with OIDC authenticator, I encounter the following issue:ALB cookies explicitly set samesite=none.The CSRF attack is a form POST submit from an external page. It sends the ALB cookies together with the request, but doesn't send my jsessionid cookie (as expected).The ALB lets the request pass into the my application. The application sees this is a new session with an authenticated user and treats it as a legitimate request (typically it is the first request of the user after login and redirect from the IDP). It loads the user details and then proceeds with the request. Thus, the CSRF attack succeeds.How can I solve this? Is there a way to change the cookies in the ALB to use samesite=lax?FollowComment"

Answer: "0Hi Yoni ,If the SameSite attribute is set to Lax, then the browser will include the cookie in requests that originate from another site but only if two conditions are met:The request uses the GET method. Requests with other methods, such as POST, will not include the cookie.The request resulted from a top-level navigation by the user, such as clicking a link. Other requests, such as those initiated by scripts, will not include the cookie.Most CSRF attacks tend to happen on POST requests. So the LAX mode is only a partial defense. You should use it in conjunction with CSRF tokens.You can use Spring Security (if you are using Java and Spring) or you can use the CSRFGuard from OWASP. Please see the link below for the CSRF Guardhttps://owasp.org/www-project-csrfguard/The OpenID connect protocol does not have any specifications for CSRF .Here are a few resources that might help you (see below) but the general pattern is to use the state parameter.Some reputed OpenId providers do provide protection but the smaller ones do not.https://developer.amazon.com/docs/login-with-amazon/cross-site-request-forgery.htmlhttps://technospace.medium.com/csrf-in-idp-initiated-openid-connect-7a2873420e86https://developers.google.com/identity/openid-connect/openid-connectCommentShareGauravanswered 6 months agoyoni 6 months agoThank you for this finely crafted answer, but it actually adds nothing to my question in way of a solution. I care about POST requests, not GET, and I know what OIDC is. The question is about the ALB cookies, that effectively allow a request from answer site to pass-throughShare0Yoni, you can utilize duration based stickiness  and give it a shot. This way your cookie (JSESSIONID) will maintain the lax value.Please , see the following resourcehttps://docs.aws.amazon.com/elasticloadbalancing/latest/application/sticky-sessions.htmlGive it a shot.CommentShareGauravanswered 6 months ago"


Question: Using a Device Shadow to notify device(s) of new OTA update

"Hello,I am looking to use device shadows for my device (ESP32) and am looking for some guidance on how I could have a creation of an AWS job update a device's desired shadow state to a newer version of firmware. I would like to have my device to then check this desired state and if the device's current firmware version is a lower version then it would start an OTA update on my device. My initial thoughts is to use the reserved MQTT topics from AWS Jobs API to notify via MQTT (/jobs/notify or /jobs/notify-next?), look to trigger a device shadow desired state change to the version number. The device would then check the desired section of its shadow and if the version is lower it would then proceed with an OTA update. For more context, I will have multiple devices that will require the same firmware.FollowComment"

Answer: "1Hi kevinah,to create OTA update you can use AWS IoT jobs. There is no need to use the shadow device. You can place for example the desired firmware version in the job template for your OTA job.You can find examples for (OTA) jobs for FreeRTOS or the AWS IoT Device Client.Cheers,PhilippCommentSharePhilipp Sanswered 2 months ago"


Question: "Access Denied (Service: S3, Status Code: 403, Request ID: 8NSXN34YN0YHZ9EB"

"Backup job failed Access Denied (Service: S3, Status Code: 403, Request ID: 8NSXN34YN0YHZ9EB, Extended Request ID: jj7gnjNpcpaJyDFollowComment"

Answer: 1Hi THerePlease check that your AWSBackupDefaultServiceRole has the appropriate permissions.You need to add additional permission policies manually in order to be able to backup and restore S3 buckets.See https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.html#one-time-permissions-setupCommentShareEXPERTMatt-Banswered 8 months ago


Question: Can we have our own schema in Dynamo DB ?

"I want to have a fixed schema in DynamoDB, even though it's a NoSQL database. I want to define specific column names beforehand so that whenever I add data to the database, the column names will be visible. How can I achieve this?FollowComment"

Answer: "4Accepted AnswerUnfortunately DynamoDB does not provide out of the box capability to define a strict schema. You must impose schema validation on the client side, ensuring users add the desired fields for every mutation.As you mention, DynamoDB is a NoSQL schemaless database, which means you must only define the keys up-front. Your application code would be responsible for ensuring all the items follow a strict schema, and can do so by setting empty values for those attributes.CommentShareEXPERTLeeroy Hannigananswered 2 months agorePost-User-1996984 2 months agoIs there an easy to integrate readily available low or no code way to put a simple frontend in AWS using I AM authentication allowing authorised users to fill a form that calls a lambda function?Share0Yes, you can have null values for attributes with some qualifications around indexes. See: Amazon DynamoDB now supports empty values for non-key String and Binary attributes in DynamoDB tables.CommentShareEXPERTkentradanswered 2 months ago"


Question: [Issue] Lambda LexEvent returns "null" values from Lex v2 Request

"TL;DR: The "OrderFlowers" blueprint for Lex + Lambda on .NET Core 3.1 doesn't seem to work. Instead of populating the values for CurrentIntent and SlotDetails as expected, these values are null instead.Note: Python and Node.js lambda equivalents seem to work just fine, but work use case requires .NET.ContextGoal: Setup blueprint "OrderFlowers" chatbot with AWS Lex v2 using .NET Core 3.1 and AWS Lambda. (Link)This may be an issue with Lex v2 rather than with Lambda, but this may be unlikely as Python and Node.js work fine when interchanged with the .NET lambda used.DescriptionWhen invoking the OrderFlowers blueprint lambda function via AWS Lex, the LexEvent does not populate the expected fields, such as CurrentIntent and SlotDetails.Compare this to using the Python or Node.js blueprints which do populate the expected fields.Reproduction StepsCreate a new .NET project using the "AWS Lambda Project (.NET Core - C#)" template with the "Order Flowers Chatbot" Blueprint.Log the lexEvent variable to CloudWatch within the FunctionHandler function: LambdaLogger.Log(JsonSerializer.Serialize(lexEvent));Publish the solution to AWS Lambda (default settings, arbitrary function name).Create a new Lex v2 Chatbot with the "Order Flowers Chatbot" Example.Configure the new chatbot to use the new lambda function you uploaded under Bot > Alias > Language.Under Intents > OrderFlowers > Fulfillment > Advanced Options, ensure "Use a Lambda function for fulfillment" is checked.Save the intent, build the bot, and test the conversation.An error should appear when attempting to fulfill the intent - when you check CloudWatch, the LexEvent body should appear with null values for fields such as CurrentIntent and SlotDetails.LogsLexInvalid Lambda Response: Received error response from Lambda: UnhandledCloudWatch{    "CurrentIntent": null,    "SlotDetails": null,    "Bot": {        "Name": "OrderFlowersBot",        "Alias": null,        "Version": "DRAFT"    },    "UserId": null,    "InputTranscript": "yes",    "InvocationSource": "FulfillmentCodeHook",    "OutputDialogMode": null,    "MessageVersion": "1.0",    "SessionAttributes": null,    "RequestAttributes": null,    "AlternativeIntents": null,    "SentimentResponse": null,    "RecentIntentSummaryView": null,    "ActiveContexts": null}EnvironmentBuild Version: Amazon.Lambda.Core 2.1.0, Amazon.Lambda.LexEvents 3.0.0, Amazon.Lambda.Serialization.SystemText 2.2.0OS Info: Windows 10 EnterpriseBuild Environment: Visual Studio 2019Targeted .NET Platform:  .NET Core 3.1ResolutionThere may be an issue serializing the incoming request from Lex v2 based on the configuration laid out in the current Order Flowers .NET 3.1 blueprint. To resolve this, effort will need to be made comparing the expected Lex v2 request payload with the actual payload and the serialization may have to be adjusted accordingly.FollowCommentAWS-User-7156689 a year agoGitHub Issue Thread: https://github.com/aws/aws-lambda-dotnet/issues/1077Seems like a missing featureShareABHISHEK a year agoHey, from the information shared in this question, it seems like we are using blueprint from Lex V1 and creating the bot in Lex V2. Input formats for V1 and V2 are different.Lex V1: https://docs.aws.amazon.com/lex/latest/dg/lambda-input-response-format.html#using-lambda-input-event-formatLex V2: https://docs.aws.amazon.com/lexv2/latest/dg/lambda.html#lambda-input-formatYou can look here for more details: https://docs.aws.amazon.com/lex/latest/dg/message-lambda.htmlPlease let me know if this is not the case.Share"


Question: Issue with loading neuron model

"I am trying to load a neuron compiled model generated as given in https://awsdocs-neuron.readthedocs-hosted.com/en/latest/src/examples/tensorflow/huggingface_bert/huggingface_bert.html . I am still a newbie so please excuse my mistakes. This is my code for loading a neuron compiled model.It is almost entirely based on the code in the page referred earlier.from transformers import pipelineimport tensorflow as tfimport tensorflow.neuron as tfnclass TFBertForSequenceClassificationDictIO(tf.keras.Model):def init(self, model_wrapped):super().init()self.model_wrapped = model_wrappedself.aws_neuron_function = model_wrapped.aws_neuron_functiondef call(self, inputs):input_ids = inputs['input_ids']attention_mask = inputs['attention_mask']logits = self.model_wrapped([input_ids, attention_mask])return [logits]class TFBertForSequenceClassificationFlatIO(tf.keras.Model):def init(self, model):super().init()self.model = modeldef call(self, inputs):input_ids, attention_mask = inputsoutput = self.model({'input_ids': input_ids, 'attention_mask': attention_mask})return output['logits']string_inputs = ['I love to eat pizza!','I am sorry. I really want to like it, but I just can not stand sushi.','I really do not want to type out 128 strings to create batch 128 data.','Ah! Multiplying this list by 32 would be a great solution!',]string_inputs = string_inputs * 32model_name = 'distilbert-base-uncased-finetuned-sst-2-english'neuron_pipe = pipeline('sentiment-analysis', model=model_name, framework='tf')example_inputs = neuron_pipe.tokenizer(string_inputs)pipe = pipeline('sentiment-analysis', model=model_name, framework='tf')reloaded_model = tf.keras.models.load_model('./distilbert_b128_2')model_wrapped = TFBertForSequenceClassificationFlatIO(pipe.model)example_inputs_list = [example_inputs['input_ids'], example_inputs['attention_mask']]model_wrapped_traced = tfn.trace(model_wrapped, example_inputs_list)rewrapped_model = TFBertForSequenceClassificationDictIO(model_wrapped_traced)This is the stacktrace2022-11-05 02:46:55.553817: W tensorflow/python/util/util.cc:368] Sets are not currently considered sequences, but this may change in the future, so consider avoiding using them.All model checkpoint layers were used when initializing TFDistilBertForSequenceClassification.All the layers of TFDistilBertForSequenceClassification were initialized from the model checkpoint at distilbert-base-uncased-finetuned-sst-2-english.If your task is similar to the task the model of the checkpoint was trained on, you can already use TFDistilBertForSequenceClassification for predictions without further training.Some layers from the model checkpoint at distilbert-base-uncased-finetuned-sst-2-english were not used when initializing TFDistilBertForSequenceClassification: ['dropout_19']This IS expected if you are initializing TFDistilBertForSequenceClassification from the checkpoint of a model trained on another task or with another architecture (e.g. initializing a BertForSequenceClassification model from a BertForPreTraining model).This IS NOT expected if you are initializing TFDistilBertForSequenceClassification from the checkpoint of a model that you expect to be exactly identical (initializing a BertForSequenceClassification model from a BertForSequenceClassification model).Some layers of TFDistilBertForSequenceClassification were not initialized from the model checkpoint at distilbert-base-uncased-finetuned-sst-2-english and are newly initialized: ['dropout_39']You should probably TRAIN this model on a down-stream task to be able to use it for predictions and inference.WARNING:tensorflow:No training configuration found in save file, so the model was not compiled. Compile it manually.Traceback (most recent call last):File "inferencesmall.py", line 40, in <module>model_wrapped_traced = tfn.trace(model_wrapped, example_inputs_list)File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/tensorflow_neuron/python/_trace.py", line 167, in tracefunc = func.get_concrete_function(*example_inputs)File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/tensorflow/python/eager/def_function.py", line 1264, in get_concrete_functionconcrete = self._get_concrete_function_garbage_collected(*args, **kwargs)File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/tensorflow/python/eager/def_function.py", line 1244, in _get_concrete_function_garbage_collectedself._initialize(args, kwargs, add_initializers_to=initializers)File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/tensorflow/python/eager/def_function.py", line 786, in _initialize*args, **kwds))File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/tensorflow/python/eager/function.py", line 2983, in _get_concrete_function_internal_garbage_collectedgraph_function, _ = self._maybe_define_function(args, kwargs)File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/tensorflow/python/eager/function.py", line 3292, in _maybe_define_functiongraph_function = self._create_graph_function(args, kwargs)File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/tensorflow/python/eager/function.py", line 3140, in _create_graph_functioncapture_by_value=self._capture_by_value),File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/tensorflow/python/framework/func_graph.py", line 1161, in func_graph_from_py_funcfunc_outputs = python_func(*func_args, **func_kwargs)File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/tensorflow/python/eager/def_function.py", line 677, in wrapped_fnout = weak_wrapped_fn().wrapped(*args, **kwds)File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/tensorflow/python/framework/func_graph.py", line 1147, in autograph_handlerraise e.ag_error_metadata.to_exception(e)tensorflow.python.autograph.impl.api.StagingError: in user code:File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/keras/engine/base_layer.py", line 987, in error_handler  *return fn(*args, **kwargs)StagingError: Exception encountered when calling layer "tf_bert_for_sequence_classification_flat_io" (type TFBertForSequenceClassificationFlatIO).in user code:  File "inferencesmall.py", line 22, in call  *      output = self.model({'input_ids': input_ids, 'attention_mask': attention_mask})  File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/keras/utils/traceback_utils.py", line 67, in error_handler  **      raise e.with_traceback(filtered_tb) from None  StagingError: Exception encountered when calling layer "tf_distil_bert_for_sequence_classification_1" (type TFDistilBertForSequenceClassification).    in user code:        File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/transformers/models/distilbert/modeling_tf_distilbert.py", line 798, in call  *          distilbert_output = self.distilbert(      File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/keras/utils/traceback_utils.py", line 67, in error_handler  **          raise e.with_traceback(filtered_tb) from None        StagingError: Exception encountered when calling layer "distilbert" (type TFDistilBertMainLayer).            in user code:                File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/transformers/models/distilbert/modeling_tf_distilbert.py", line 423, in call  *              inputs = input_processing(          File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/transformers/modeling_tf_utils.py", line 372, in input_processing  *              output[parameter_names[i]] = input                IndexError: list index out of rangeThanks in advanceAjayFollowComment"

Answer: "0Hi Ajay,Thank you for your interest in neuron. This response assumes that you followed the tutorial that you linked, compiled the neuron model in the underlying HuggingFace pipeline and saved it to disk. Then, in the code in the post, you are trying to reload the compiled model and run inference on the reloaded model.If you followed the tutorial then these two lines of code were executed:#compile the wrapped model and save it to diskmodel_wrapped_traced = tfn.trace(model_wrapped, example_inputs_list)model_wrapped_traced.save('./distilbert_b128')This saves an already traced (compiled) model to the disk that accepts input in the form of a list (remember this is required to use the neuron_model.save() function). Remember that HuggingFace tokenizers take string inputs and convert them into dictionaries.In your code it looks like you reload the model with reloaded_model = tf.keras.models.load_model('./distilbert_b128_2'). Note that if this model was already compiled and then saved (see the two lines of code above) then it does not need to be recompiled. It looks like you have attempted to compile another model with this line of code: model_wrapped_traced = tfn.trace(model_wrapped, example_inputs_list). This isn’t necessary as you already have a compiled neuron model saved to your disk. One of the main benefits of saving neuron models is to avoid the time-consuming recompilation step.Try something like this:#First we define a wrapper class that wraps a model that accepts list inputs # (what we needed in order to originally save the model)# into a model that accepts dictionary inputs# (what the huggingface tokenizer outputs)class TFBertForSequenceClassificationDictIO(tf.keras.Model):  def __init__(self, model_wrapped):    super().__init__()    self.model_wrapped = model_wrapped    self.aws_neuron_function = model_wrapped.aws_neuron_function  def call(self, inputs):    input_ids = inputs['input_ids']    attention_mask = inputs['attention_mask']    logits = self.model_wrapped([input_ids, attention_mask])    return [logits]#Since we are in a new process we have to recreate our neuron pipeline# with it's special tokenizer that makes sure all the inputs have the same shapeneuron_pipe = pipeline('sentiment-analysis', model=model_name, framework='tf')#the first step is to modify the underlying tokenizer to create a static#input shape as inferentia does not work with dynamic input shapesoriginal_tokenizer = pipe.tokenizer#you intercept the function call to the original tokenizer#and inject our own code to modify the argumentsdef wrapper_function(*args, **kwargs):  kwargs['padding'] = 'max_length'  #this is the key line here to set a static input shape  #so that all inputs are set to a len of 128  kwargs['max_length'] = 128  kwargs['truncation'] = True  kwargs['return_tensors'] = 'tf'  return original_tokenizer(*args, **kwargs)#insert our wrapper function as the new tokenizer as well#as reinserting back some attribute information that was lost#when you replaced the original tokenizer with our wrapper functionneuron_pipe.tokenizer = wrapper_functionneuron_pipe.tokenizer.decode = original_tokenizer.decodeneuron_pipe.tokenizer.mask_token_id = original_tokenizer.mask_token_idneuron_pipe.tokenizer.pad_token_id = original_tokenizer.pad_token_idneuron_pipe.tokenizer.convert_ids_to_tokens = original_tokenizer.convert_ids_to_tokens#now wrap your neuron model that you reloaded with the wrapper classreloaded_model = tf.keras.models.load_model('./distilbert_b128_2')rewrapped_model = TFBertForSequenceClassificationDictIO(model_wrapped_traced)#now you can reinsert our reloaded model back into our pipelineneuron_pipe.model = rewrapped_modelneuron_pipe.model.config = pipe.model.config#Run inference on your reloaded model (that you didn't have to recompile)#Our example data!string_inputs = [  'I love to eat pizza!',  'I am sorry. I really want to like it, but I just can not stand sushi.',  'I really do not want to type out 128 strings to create batch 128 data.',  'Ah! Multiplying this list by 32 would be a great solution!',]string_inputs = string_inputs * 32outputs = neuron_pipe(string_inputs)CommentSharemrnikwawsanswered 7 months agorePost-User-6132983 7 months agoCouldnt get it to work. After filling in the gaps I got this:StagingError: Exception encountered when calling layer "tf_bert_for_sequence_classification_flat_io" (type TFBertForSequenceClassificationFlatIO).in user code:    File "answer.py", line 15, in call  *        output = self.model({'input_ids': input_ids, 'attention_mask': attention_mask})    File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/keras/utils/traceback_utils.py", line 67, in error_handler  **        raise e.with_traceback(filtered_tb) from None    StagingError: Exception encountered when calling layer "tf_distil_bert_for_sequence_classification" (type TFDistilBertForSequenceClassification).      in user code:  File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/transformers/models/distilbert/modeling_tf_distilbert.py", line 798, in call  *            distilbert_output = self.distilbert(        File "/home/ubuntu/huggingface/venv/lib/python3.7/site-packages/keras/utils/traceback_utils.py", line 67, in error_handler  **            raise e.with_traceback(filtered_tb) from None    StagingError: Exception encountered when calling layer "distilbert" (type TFDistilBertMainLayer).SharerePost-User-6132983 7 months agoCould you please share the complete code with me. I think as I added the code for the gaps in your answer, I might have made more mistakes.SharerePost-User-6132983 7 months agoAlso I need neuron compilation of a Google bert large model with sequence length 512. Can I do this without referring to HF code?Share0Hi Ajay, if you want the complete code, I would recommend following the tutorial exactly. Please see https://awsdocs-neuron.readthedocs-hosted.com/en/latest/frameworks/tensorflow/tensorflow-neuron/tutorials/tensorflow-tutorial-setup.html#tens[…]etup for how to setup the tutorial. Huggingface is not required to use neuron, but it does offer lots of useful features. The bert-large-uncased model https://huggingface.co/bert-large-uncased is a Google BERT wrapped with Huggingface features. If you cannot use Huggingface we may be able to assist with a different solution.CommentSharerePost-User-6281931answered 4 months ago"


Question: WebDriver Instance for mobile web testing

"I'm working on adapting functional tests of a web to be able to use Device Farm as the device pool for testing in mobile devices. The tests are written in Java, using TestNG and Appium, and i have no problems launching them in desktop browsers locally or in my android phone through a local installation of Appium.I have adapted the pom.xml following the guidelines in  https://docs.aws.amazon.com/devicefarm/latest/developerguide/test-types-appium.html , but i haven't found anything in the documentation stating how i should instantiate WebDriver. I have also reviewed and tested with the method to instantiate it as a RemoteWebDriver using the sdk like this:String myProjectARN = "arn:evicefarm:us-west-2:XXXXXXXXXX:testgrid-project:XXXXXXXX";DeviceFarmClient client  = DeviceFarmClient.builder().region(Region.US_WEST_2).build();CreateTestGridUrlRequest request = CreateTestGridUrlRequest.builder().expiresInSeconds(300).projectArn(myProjectARN).build();CreateTestGridUrlResponse response = client.createTestGridUrl(request);URL testGridUrl = new URL(response.url());WebDriver driver = new RemoteWebDriver(testGridUrl, DesiredCapabilities.chrome());This works fine for testing in desktop environments, but if i try to adapt it to android environment, i get the following error:[TestNG] software.amazon.awssdk.services.devicefarm.model.DeviceFarmException: User: arn:aws:sts::XXXXXXXXXXXXX:assumed-role/EC2DeviceHostRole/XXXXXXXXXXXXXXXX is not authorized to perform: devicefarm:CreateTestGridUrl on resource: arn:aws:devicefarm:us-west-2:XXXXXXXXXXXXX:project:XXXXXXXXXXXXXXXXXXXXXXXXX (Service: DeviceFarm, Status Code: 400, Request ID: XXXXXXXXXXXXXXXXXXXXXX, Extended Request ID: null)How should WebDriver be instantiated for mobile tests? My goal is to run this tests both in Android and iOS devices.FollowComment"

Answer: "1Accepted AnswerHi there,Thank you for reaching out. Device Farm Mobile Device Testing operates uses a server-side, rather than client-side, execution model. This means that you would instead package your tests according to our instructions here (https://docs.aws.amazon.com/devicefarm/latest/developerguide/test-types-appium.html), then upload them to Device Farm for testing against a pool of devices. In particular, in your test code, you would put code such as the following to indicate that you are using server-side execution during your driver setup method:[code]@BeforeSuitepublic void setUpDriver() {    if (System.getenv("DEVICEFARM_DEVICE_NAME") == null) {          // This runs against device farm desktop browser devices, client-side          String myProjectARN = "arn:evicefarm:us-west-2:XXXXXXXXXX:testgrid-project:XXXXXXXX";          DeviceFarmClient client = DeviceFarmClient.builder()              .region(Region.US_WEST_2)              .build();          CreateTestGridUrlRequest request = CreateTestGridUrlRequest.builder()              .expiresInSeconds(300)              .projectArn(myProjectARN)              .build();          CreateTestGridUrlResponse response = client.createTestGridUrl(request);          URL testGridUrl = new URL(response.url());          WebDriver driver = new RemoteWebDriver(testGridUrl, DesiredCapabilities.chrome());      else {          // This runs against device farm mobile devices, server-side          driver = new AndroidDriver(              new URL("http://127.0.0.1:4723/wd/hub"),              new DesiredCapabilities());      }  }  [/code]Please give this code and those linked instructions a try and let us know your thoughts.Thank youCommentSharesimsjon at AWSanswered 2 years ago0Yes, that's exactly the code i was looking for.Thanks a lot!CommentSharecfernandezanswered 2 years ago"


Question: "AWS Amplify : Old failing tests running in cypress, even though they are deleted locally"

"I enabled cypress tests for my Amplify pipeline. Some of the tests are failing during deployment. My changes to the tests (even completely deleting the failing test specs) is working locally - I see successful tests pass. However when I push the changes, I see failures in Amplify console. Is there a possibility that caching of some sort is going on here? Or if I need to compile the tests each time for the changes to take effect?I also see this warning in my log file for Cypress tests :2023-02-09T05:54:38.899Z [WARNING]: ! Test config file not found for the configFilePath glob provided in your build spec: **/mochawesome.jsonThis is the structure of my cypress folderfixturesdownloadspluginsreportssupporttsconfig.jsonwebpack.config.jsreporte2eintegrationAnd this is the test section of my amplify.ymltest:  artifacts:    baseDirectory: cypress    configFilePath: "**/mochawesome.json"    files:      - "**/*.png"      - "**/*.mp4"  phases:    preTest:      commands:        - npm ci        - npm install -g pm2        - npm install -g wait-on        - npm install mocha mochawesome mochawesome-merge mochawesome-report-generator        - npx pm2 start npm -- start        - 'npx wait-on --timeout 60 http://localhost:3000'    test:      commands:        - npm run build        - "npx serve -s -l 3000 build & sleep 30; yarn e2e"        - 'npx cypress run --reporter mochawesome --reporter-options "reportDir=cypress/report/mochawesome-report,overwrite=false,html=false,json=true,timestamp=mmddyyyy_HHMMss"'    postTest:      commands:        - npx mochawesome-merge cypress/report/mochawesome-report/mochawesome*.json > cypress/report/mochawesome.json        - npx pm2 killFollowComment"


Question: Error while importing ArrayType in Glue job

"from pyspark.sql.functions import ArrayType For this I am getting error in Glue job.Glue Version I am using is 3.0 which supports spark 3.1ImportError: cannot import name 'ArrayType' from 'pyspark.sql.functions' (/opt/amazon/spark/python/lib/pyspark.zip/pyspark/sql/functions.py)On using next Glue version Glue 4.0 with spark 3.3 getting another error from pyspark.sql.functions import ArrayType from pyspark.sql.functions import StringTypeclass JobBase(object):        #all udf has to be initialised as first step     def __init__(self):        print("Inside the constructor of Class phases ")        self.winner_org_calculation_udf=udf(JobBase.winner_org_calculation, ArrayType(StringType()))TypeError: ArrayType.__init__() missing 1 required positional argument: 'elementType'FollowComment"

Answer: 0Accepted AnswerIssue got  resolved for me when I used following imports :from pyspark.sql.types import ArrayTypefrom pyspark.sql.types import StringTypeCommentShareAWS-User-6494745answered 3 months ago


Question: Free services and their duration for a new startup

Can I please know as to what all services can a new startup avail for free? Can I get a rough estimate as to what all services AWS can provide for new startup and for how long for free?FollowComment

Answer: "1Hi,There are a couple of things you can look into:Activate program: https://aws.amazon.com/activate/ . I helped a startup recently to apply for it. Essentially you have opportunity to get certain AWS Credits that you can use to substain your business. You can find more info in the linkGenerally, AWS offers some free-tier prices by the time you create a new account. https://aws.amazon.com/free. That page gives you an idea what it is and should apply to any customer.Hope it helps!CommentShareEXPERTalatechanswered 3 months ago"


Question: Two subnets attached to any new resources we create that aren't related to our account

"Recently tried to create a new database and other resources but they all fail. Reason being is they keep being attached to two subnets not on our account. Or at least subnets we can't see/control.subnet-0ab2af4c2b244bb3dsubnet-0c887e580214ba746Have no idea where these subnets came from or why our current database has these attached to it as well but definitely didn't attach them. We haven't made changes to this account in so long either and its definitely a new issue.Hopefully someone from amazon reads this that can look into our account but at this point it looks like we have to abandon this account in question.Partly related to that, these errors are also fun: Rate exceeded (Service: AmazonRDS; Status Code: 400; Error Code: Throttling; Request ID: 67a1ac01-898f-471d-ace3-2ebc5666df90; Proxy: null)FollowComment"

Answer: "0Perhaps those subnets are shared resources from other accounts and some settings in those subnets are preventing you from creating resources. You could check this by going to Resource Access Manager and listing resources under "Shared with Me." You could then contact the administrator of the account specified therein and try addressing the issue.CommentShareGovardhanan_Ranswered a year agoAWS-User-5399846 a year agoNope, no shared resources. Like literally there is no where in AWS where these subnets are listed yet they auto attach. With no ability to remove or even see them how can they even be part of our account to begin with?Share"


Question: Can I track user login attempts in Transfer Family?

Using CyberDuck to login in a user into Transfer Family using its own identity service. Is there a way to track if a user's authenticated key failed? Or how many login attempts they made? I only know that you can track data transfer info here but it's not what I'm looking for.ThanksFollowComment

Answer: "0Accepted AnswerThe answer was not in CloudTrail, but actually Cloudwatch.CommentSharerePost-User-0976558answered 10 months ago"


Question: Is it possible to get paused in SES for reasons outside of the account?

"Basically, I have an account that was paused this morning...the account health dashboard looks phenomenal  (0.34% bounce rate, zero complaints for the account). We seem to be following best practices regarding emails only going to users who have requested them, offering opt out of email notifications, etc.I am struggling to find the reason behind us being paused and AWS support will give no information other than "Do some things, tell us you did some things". How am I supposed to know how to remediate the issue if I have no idea what the issue is and cannot seem to find any flaws in our current system? With such a great health, how can we be paused?FollowComment"

Answer: "1Amazon SES might pause your SES account’s ability to send additional emails for one of the following reasons:      If the bounce rate is more than or equal to 10%.      If the complaint rate is more than or equal to 0.5%.      If an AWS SES account was already placed under review and the issue wasn’t corrected before end of the review period or if the AWS SES account was placed under review several times for the same issue.      If the email sent from the AWS SES account has violated the AWS Service Terms.Note: This won’t impact any other AWS services in the AWS account. However, service quota increases for any AWS service that sends outbound communications (such as Amazon SNS) may be denied until the AWS account’s ability to email sending is restored.I would reach out to AWS Premium Support or the Technical Account Manager on the same to check if the above are not the issue OR this has happened frequently.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months agorePost-User-1972059 10 months agoSupport sent me here. None of the 4 reasons listed are applicable. According to our health dashboard we have less than half a percent bounce rate, no complaints (at all), have never been under review and did not violate any terms.We have since been changed from 'paused' to 'under review' but still, no information has been given as to the reasoning, only things they recommend (which we already seem to be doing all the necessary steps so its hard to tell them things changed).If I understand you correctly, the only way to get an answer is to pay for premium support?Share0Unfortunately, yes. I would recommend going for a developer plan which is the cheapest option and provides basic level support & reach out to the AWS accounts and billing team and request a review using the basic plan. Hope this helps, if yes, please click on the accepted answers button in the post.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago"


Question: AWS EC2 instance automatically restarts

"Hi,On AWS EC2 Ubuntu 20.04 and earlier, I was able to set up a crontab to shut down the instance at night.0 5 * * * /sbin/shutdown -h nowOn Ubuntu 22.04 the server automatically restarts again.  Could this be modified so the shutdown command works correctly?Thanks.FollowComment"

Answer: "1Accepted AnswerThe instance may have Auto Recovery set to true. The link shows how to disable this.I've been able to recreate this behavior on both Ubuntu 20 and 22. Though, I can not recreate it consistently. Seems to happen more often on t2.small vs t3.small. Also, seems to happen more often the first time I issue the sudo shutdown -h now command. But after that first failure, it works as expected. All of this was independent of the Auto Recovery setting. Recommendation at this point is to use the stop-instances API for consistent behavior. See: Instance SchedulerCommentShareEXPERTkentradanswered 3 months agosdarwin 3 months agoAlthough this idea "The behavior recently changed so mostly likely connected the age of the instance" sounds very plausible and more believable, I have just retested another time, and the results are as follows. A new ubuntu 20 instance can be shutdown from the command line. A new ubuntu 22 instance gets auto restarted.Sharekentrad EXPERT3 months agoInteresting. I'll give it a try today.Share0@kentrad thanks!There is still some mystery to it, because I re-verified that on Ubuntu 20 auto recovery didn't need to be adjusted.Not sure what's possible and what's not possible but the ideal behavior would be that a manual shutdown by issuing the shutdown command would stop the instance, and a crash would auto recover. However, if aws can't distinguish the difference between those two conditions, then maybe it has no choice but to reboot both of them.CommentSharesdarwinanswered 3 months agokentrad EXPERT3 months agoThe behavior recently changed so mostly likely connected the age of the instance (when it was created) than the Ubuntu version. https://aws.amazon.com/about-aws/whats-new/2022/03/amazon-ec2-default-automatic-recovery/You could also use the Instance Scheduler instead of an internal cron. https://aws.amazon.com/solutions/implementations/instance-scheduler-on-aws/Share"


Question: How to keep instance running after disconnecting SSH.

"So currently I have a Lightsail instance, with a domain connected to it.I SSH into the instance and do ./run.sh which is a script I have to start a webserver. Great, the webserver now works and the domain is also working. But as soon as I disconnect the SSH connection, the website is no longer up. If I go back into it again, I can see that the processes are not running anymore, but my instance has been active this entire time.How do I keep it running when I'm not connected to it?FollowComment"

Answer: "0Accepted AnswerTo fix your immediate need:./run.sh &That puts it in the background.CommentShareEXPERTkentradanswered a year agoAWS-User-4806096 a year agoI'm not sure why I didn't think of this... for context, my run.sh even makes use of & to run some of the commands in there.Yep, doing ./run.sh & fixes it.Share"