Question: "ECS/Fargate task won't launch, fails to authenticate with ECR and won't log anything"

"I am trying to spin up a container using ECS/Fargate. I created the Task Definition, Execution IAM Role, and Cloudwatch Group all through Terraform. Then I am using the AWS CLI to try and launch the task, with a command like this:aws ecs run-task --cluster my-cluster --launch-type FARGATE \--task-definition transcode:2 --network-configuration \'{"awsvpcConfiguration": {"subnets": ["subnet-...", "subnet-...", "subnet-..."], "securityGroups": ["sg-..."], "assignPublicIp": "ENABLED"}}'Suffice it to say that I replaced all the "..." in the subnets/security group with real values. I am just using the default VPC for my account; this container does not need internet ingress/egress anyways as it only interacts with S3 and SNS when running. However when I launch that command, it creates the ECS task which proceeds from "Provisioning" to "Pending," then it spins for a bit before failing with the following error message:ResourceInitializationError: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve ecr registry auth: service call has been retried 3 time(s): RequestError: send request failed caused by: Post "https://api.ecr.us-east-1.amazonaws.com/": dial tcp 52.46.154.25:443: i/o timeout. Please check your task network configuration.The execution IAM role has the following inline policy associated with it. I admit a few of these permissions may be overly broad but I wanted to take a maximalist approach while trying to get this to run, since it currently is not able to run.{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "ecr:*",                "logs:CreateLogStream",                "logs:DescribeLogGroups",                "logs:DescribeLogStreams",                "logs:GetLogEvents",                "logs:CreateLogGroup",                "logs:PutLogEvents",                "s3:ListBucket",                "s3:GetObject",                "s3:PutObject",                "sns:Publish"            ],            "Resource": "*"        }    ]}Also, if I click on the "Logs" tab for the task in the AWS console, there are no logs shown and instead I see this error in a red banner on top:There was an error while retrieving logs from log stream: transcode/transcode/2dff4575e60945e4b23945a4372f782b in log group: transcode_log_group. The specified log stream does not exist.Let me know if there are any more details I can provide. I am very frustrated that ECS/Fargate is so hard to get working in Terraform as it is not obvious to me what I am missing.EDIT: here is the Terraform which defines the task definition:resource "aws_ecs_task_definition" "transcode" {  cpu                      = 2048  family                   = "transcode"  memory                   = 4096  network_mode             = "awsvpc"  execution_role_arn       = aws_iam_role.transcode.arn  requires_compatibilities = ["FARGATE"]  runtime_platform {    operating_system_family = "LINUX"    cpu_architecture        = "X86_64"  }  container_definitions = templatefile("${path.module}/templates/transcode.json", {    bucket_name = aws_s3_bucket.csm.id    date        = "2023-05-17"    image       = "123456789012.dkr.ecr.us-east-1.amazonaws.com/zoom-transcode:latest"    log_group   = aws_cloudwatch_log_group.transcode.name    topic_arn   = aws_sns_topic.zoom.arn  })}And here is the JSON template file which that resource references:[    {      "name": "transcode",      "image": "${image}",      "cpu": 2048,      "memory": 4096,      "essential": true,      "command": ["${date}"],      "environment": [        {          "name": "BUCKET_NAME",          "value": "${bucket_name}"        },        {          "name": "TOPIC_ARN",          "value": "${topic_arn}"        }      ],      "networkMode": "awsvpc",      "logConfiguration": {        "logDriver": "awslogs",        "options": {          "awslogs-group": "${log_group}",          "awslogs-region": "us-east-1",          "awslogs-stream-prefix": "transcode"        }      }    }]FollowComment"

Answer: "0Did you specify the iam role when you created the task definition?Be sure to specify execution_role_arn in your terraform resourceYou may also want to use an ecs service and not start a task which you can create with terraform.If you need access to Ecr, sns, s3, logs then you will need internet access or VPC endpoints to access these services.CommentShareGary Mcleananswered 9 days agosoapergem 9 days agoThanks for your comment. I just updated the original question with the Terraform definition of the task. In short: yes, the task references the execution role (you cannot define a task without one). I do not want a service because this task runs to completion; it is not a long-running container by design. And as I mentioned I am just using the default VPC that AWS creates, and the default security group which does allow egress to anything.ShareGary Mclean 9 days agoThanks. Added a new answerShare0I see you have public ip assigned, try and make sure the subnets defined when you start the task are public and route to an internet gateway and not on a subnet routing to a NAT gateway.That may be your issue.CommentShareGary Mcleananswered 9 days ago0Hello,You've informed that this container does not need internet ingress/egress anyways. Also, the error message is RequestError: send request failed caused by: Post "https://api.ecr.us-east-1.amazonaws.com/": dial tcp 52.46.154.25:443: i/o timeout. Please check your task network configuration..As per our docs:Tasks using the Fargate launch type don't require the interface VPC endpoints for Amazon ECS, but you might need interface VPC endpoints for Amazon ECR, Secrets Manager, or Amazon CloudWatch Logs described in the following points.Since you don't have internet connection from the provided subnet, it will fail to pull the image from ECR due to lack of connection to the ECR endpoint.In order to overcome this error, you'll need to configure these endpoints:ECR and S3 Gateway Endpoint:Amazon ECS tasks hosted on Fargate using Linux platform version 1.4.0 or later require both the com.amazonaws.region.ecr.dkr and com.amazonaws.region.ecr.api Amazon ECR VPC endpoints as well as the Amazon S3 gateway endpoint to take advantage of this feature.Cloud Watch LogsIf your VPC doesn't have an internet gateway and your tasks use the awslogs log driver to send log information to CloudWatch Logs, you must create an interface VPC endpoint for CloudWatch Logs.Another option is to configure Public Subnet with Public IP address or Private Subnet using NatGateway. Please check further information on this Best Practice Documentation.This Knowledge Center article also describes all the steps that need to be followed to run an Amazon ECS task on Fargate in a private subnet.CommentShareHenrique Santanaanswered 8 days ago"


Question: "DynamoDB, TTL not deleting items"

"I set up TTL to delete an item called "epoch" with is just the epoch time casted to an integer. I set up TTL 2 weeks ago, and nothing has been deleted yet. I tried the preview with "payload.epoch" as well, just to check, and no dice.Here is what a JSON entry looks like:{ "timestamp": "2022-01-26 13:00:30.676968", "payload": {  "air_flow": 1.5,  "rssi": -93,  "temp": 19.09,  "data": "03d10775018f0a006ff3",  "rx_freq": 929000000,  "humidity": 28.659,  "epoch": 1643230830,  "ep": 1,  "pressure": 102154,  "seq": 71,  "timestamp": "2022-01-26 13:00:30.676968" }}FollowComment"

Answer: "1Accepted AnswerYou must set your TTL attribute as a top level attribute. You cannot have it inside a map:{ "timestamp": "2022-01-26 13:00:30.676968", "epoch": 1643230830, "payload": {  "air_flow": 1.5,  "rssi": -93,  "temp": 19.09,  "data": "03d10775018f0a006ff3",  "rx_freq": 929000000,  "humidity": 28.659,  "ep": 1,  "pressure": 102154,  "seq": 71,  "timestamp": "2022-01-26 13:00:30.676968" }}CommentShareEXPERTLeeroy Hannigananswered a year agoIan a year agoI made another table, and used epoch as the primary key instead, it did not delete in the preview. I also made it an item in the top level, along side the primary key, it doesn't delete.ShareLeeroy Hannigan EXPERTa year agoYou are aware it can take 48 hours. Please provide more details on your table:The output of:aws dynamodb describe-time-to-live --table-name <your table name>A sample item which you expected to have been evicted, including the time it was inserted to the table.ShareIan a year agooutput:{"TimeToLiveDescription": {"TimeToLiveStatus": "ENABLED","AttributeName": "epoch"}}I am aware of the 48 hour period. I was using the "run preview" feature to see what would be deleted in a week, and there are no results in the query.ShareIan a year agoDon't use the preview...it doesn't seem to workShareLeeroy Hannigan EXPERTa year agoI encourage you to use the feedback button in the console, it will alert the team responsible for the preview feature.Share"


Question: Mac Client USB Redirect

Im on a 13in 2020 macbook pro running BIg Sur. Currently using the AWS Workspaces Mac client (v.4.0.7.2248) to start a WIndows 10 streaming OS. Trying to figure out how to get the USB redirect to work for a security key when prompted for 2fa. Currently using a Thetis FIDO2 USB key.  Do I need third party software to assist with the passthrough? I know this works when the Local OS hosting the Workspaces client is WIndows OS. HalpFollowComment

Answer: 0Currently the Amazon WorkSpaces Client for macOS does not have usb redirection for security keys like the Yubikey redirection support in the Client for Windows.CommentShareEXPERTStevieStetsanswered a year agoEvgeniy Rusaliov 9 months agoWill the USB redirection for Mac Client be included in the future updates?Share


Question: How to customize AWS access portal

"Hello,I want IAM AWS access portal to be used by my customers as a SSO landing page. So I would like to add my customize business logo. I didn't find the way to customize the web site. Is there any tutorial to customize the IAM AWS access portal website?RegardsFollowComment"

Answer: "1Hi,As of now, you can only customise the URL of the AWS Access Portal. Reference: https://docs.aws.amazon.com/singlesignon/latest/userguide/howtochangeURL.htmlOther page level customisations like change of logo are not available yet.CommentShareRamaanswered 3 months ago"


Question: Lambda component with IPC permissions in Greengrass V2

"We have migrated a lambda from AWS Greengrass v1 to AWS Greengrass v2. This lambda needs to extract and decrypt a secret from Greengrass Core.How can we authorize the component to perform IPC permissions to the lambda for that?Regular components recipes have the option ComponentConfiguration/DefaultConfiguration/accessControl.However when we build the component out of a lambda using AWS CLI create-component-version and option --lambda-function, there is no option to assign authorization policies.One way we tried to make it work is by using a merge update in our deployment (as documented here).    "accessControl": {        "aws.greengrass.SecretManager": {            "<my-component>:secrets:1": {                "policyDescription": "Credentials for server running on edge.",                "operations": [                    "aws.greengrass#GetSecretValue"                ],                "resources": [                    "arn:aws:secretsmanager:us-east-1:<account-id>:secret:xxxxxxxxxx"                ]            }        }    }However the end recipe of the component (in the deployment) does not display the accessControl (AWS Greengrass Console), so we assume it has not been merge updated....  "ComponentConfiguration": {    "DefaultConfiguration": {      "lambdaExecutionParameters": {        "EnvironmentVariables": {          "LOG_LEVEL": "DEBUG"        }      },      "containerParams": {        "memorySize": 16384,        "mountROSysfs": false,        "volumes": {},        "devices": {}      },      "containerMode": "NoContainer",      "timeoutInSeconds": 30,      "maxInstancesCount": 10,      "inputPayloadEncodingType": "json",      "maxQueueSize": 200,      "pinned": false,      "maxIdleTimeInSeconds": 30,      "statusTimeoutInSeconds": 30,      "pubsubTopics": {        "0": {          "topic": "dt/app/+/status/update",          "type": "PUB_SUB"        }      }    }  },Any guidance here would be greatly appreciated! ThanksFollowComment"

Answer: "1Accepted AnswerMerge updates are in a deployment, they do not update the recipe of the component.The merge is the correct way to set the access control. You can view the actual configuration which is applied on the device by using the local greengrass CLI. https://docs.aws.amazon.com/greengrass/v2/developerguide/gg-cli-component.html#component-detailsCommentShareEXPERTMichaelDombrowski-AWSanswered 6 months agorodmaz 6 months agoWe checked using Greengrass-cli in GG Core and the accessControl is there. Works like a charm! Thanks!Share"


Question: Can't understand how to get SNS event data via HTTPS API endpoint protocol

"I wanted to set up the configuration set to my SES (Amazon Simple Email Services) and have already done that with SNS (Amazon Simple Notification Services) but now it's with an email endpoint that can deliver with event type like emails Open, send, delivered, etc... & it was just a test purpose and was successful.Now I want to create a subscription with HTTPS API endpoint like the below screenshot:Screenshot ImageBut the struggling part is how to receive the data from my application endpoint? The Email subscription is just receiving email after any event occurred but in the API need to receive data and then process this to my database.Exactly I am stacked into the create SNS topic & subscribe to the HTTPS API endpoint & Receive Event data from the API endpoint, if I point out these then it will be like belowCreate SNS Topic for HTTPS endpointCreate a Subscription with HTTPS endpoint protocolConfirm the subscription with HTTPS API endpoint protocolReceive event data from HTTPS API endpointHere is the example link that I can't understand properly!ThanksFollowComment"

Answer: "1One way you can experiment and learn is to use the webhook.site webapp, which will generate a public API URL that you can use in SNS and see the data as it's coming in.CommentSharePurdyanswered a year agorePost-User-4567686 10 months agoHi Purdy,Thanks for your reply! It was really a great hook for testing, but the problem exists still now, which is I couldn't get the query params to receive these data into my endpoint! You can see the below data coming after creation. How do I reciev?{  "eventType": "Delivery",  "mail": {    "timestamp": "2022-07-21T08:31:29.513Z",    "source": "hello@example.com",    "sourceArn": "arn:aws:ses:ap-southeast-1:8632329965905:identity/hello@example.com",    "sendingAccountId": "860059328965905",    "messageId": "010e01821f124520e9-a1b669b0-06f4-4668-8ad5-b2eb6bb605c8-000000",    "destination": [      "john@ex.software"    ],    "headersTruncated": false,    "headers": [      {        "name": "From",        "value": "hello@example.com"      },      {        "name": "To",        "value": "john@ex.software"      },      {        "name": "Subject",        "value": "Discount Offer"      },      {        "name": "MIME-Version",        "value": "1.0"      },      {        "name": "Content-Type",        "value": "multipart/alternative;  boundary=\"----=_Part_8032350_320900719.1658392289516\""      }    ]  },  "delivery": {    "timestamp": "2022-07-21T08:31:32.116Z",    "processingTimeMillis": 2603,    "recipients": [      "john@ex.software"    ],    "smtpResponse": "250 2.0.0 OK  1658392xx292 x191-20020a6386c800087xx0b0041a03c29a95si1274597pgd.651 - gsmtp",    "reportingMTA": "e262-6.smtp-out.ap-southeast-3.amazonses.com"  }}ThanksShare0I'm not sure what you mean by query parameters, but I use a constant URL for the endpoint and rely on tags to identify the specific recipient. So when I send an email, I create a db row, which gives me the row ID from the database insert id. Then I use that ID as a tag in the destination. Then when I send the email, AWS SES returns the message ID, which I update the db row. And when the SQS message comes through, the tag is part of the message, which helps me match up the database row.https://docs.aws.amazon.com/ses/latest/APIReference/API_BulkEmailDestination.htmlCommentSharePurdyanswered 10 months ago"


Question: AWS z1d.large CPU speed

"I just set up a z1d.large instance Windows server. I need this instance to run an application that uses a single thread (and hence a single CPU core)The application took 21 minutes to run on my i7 laptop and when I tested on the AWS z1d.large instance it took 30 minutes. The application used 50% of the Xeon CPU (2 core) that is 100% of a single core.My question is, is the AWS z1d.large the fastest AWS product in terms of a single core processing power or should I be using something else? Does anything exist that is faster?When I setup the z1d.large instance the display on the desktop shows Architecture of AMD64 (which is what I expected) and an Instance size of z1d.large however the task manager shows CPU as Intel Xeon Platinum 8151 3.40GHz.Is something set up wrong, hence the z1d instance being slow or is this as fast as AWS gets?FollowCommentChris Pollard a year agoDid you disable hyperthreading on the instance? https://aws.amazon.com/blogs/compute/disabling-intel-hyper-threading-technology-on-amazon-linux/ShareRodney Lester a year agoApplication performance is often more than just CPU speed. The large instance has only 16 GiB of memory. Is it possible that it is memory starved? Does it use disk access? Have you enabled enhanced networking?Share"

Answer: "0Hello,I understand you are looking for a faster EC2 instance type with just one Core. AWS provides a wide selection of instance types optimized to fit different use cases.  This list of Instance Types might be helpful to you in selecting an instance that fits your needs as it breaks it down by CPU cores and threads per CPU core per instance type.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cpu-options-supported-instances-values.html This link may be helpful along side the above link to learn more about each instance type:https://aws.amazon.com/ec2/instance-types/ Possibly an Compute Optimized or Accelerated computing instance type would help speed up your application. Compute Optimized instances are ideal for compute bound applications that benefit from high performance processors. Instances belonging to this family are well suited for batch processing workloads, media transcoding, high performance web servers, high performance computing (HPC), scientific modeling, dedicated gaming servers and ad server engines, machine learning inference and other compute intensive applications. Accelerated computing instances use hardware accelerators, or co-processors, to perform functions, such as floating point number calculations, graphics processing, or data pattern matching, more efficiently than is possible in software running on CPUs. There are options for 1 core in both of these categories.  I hope this is helpful in selecting an EC2 Instance that fits your needs. Best of luckCommentShareAWS_Gerald_Hanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: "Reserved Instance, then become our billing double."

"Hello there,We recently apply reserved instance no upfront, then the next day our billing shows double EC2 bills, can you clarify this ?On DemandReserve InstanceSame specs.Please adviseFollowComment"

Answer: "1Accepted AnswerThere could be a number of things happening here.there could be on-demand usage for part of the day and RI usage once the RIs were purchased, after a couple of days, do you see the on-demand go away?is the RI a Regional or Zonal RI? Zonal RIs are for a specific AZ and Regional RIs are for the entire region. Also, are you sure that the on-demand usage reported is in the same region as the RI?UP Front RI usage will not show up in Cost Explorer unless you are viewing Amortized costs.If you would like support to investigate your specific issue, you are encouraged to raise a Billing Support Case, in the AWS Console, click on the ? with a circle -> Support Center -> Create Case -> Account and Billing Support. The support folks should be able to investigate your specific account and situation.CommentShareEXPERTShlomo Dubrowinanswered a year agoEXPERTNataliya_Greviewed a year agoNataliya_G EXPERTa year ago+1 to this response. There are multiple variables here, and it's better to submit a support case to ask for additional review and investigation. If the attributes of the RI and the running instance match, then the discount should be applying. The most important point is that the billing works hourly. Each hour the system will check if you have RIs and if you have any running instances that match the attributes of the RI, and will apply the discount accordingly. If you purchased the RI mid-month, then any usage BEFORE the purchase, would be stil charged on-demand fees.Share0Hi There, Thank you for your respond. I have managed this issue with local support and understanding better on our billing now.Thank youCommentShareAWS-User-6636854answered a year ago"


Question: Greengrass - Stream Manager - Failed to establish connection with the server

"Hi there,I've installed the stream manager via pip, also installed the stream manager component via AWS console and everything looks healthy. I am trying to run these samples from github: https://github.com/aws-greengrass/aws-greengrass-stream-manager-sdk-python/tree/main/samples and I am getting this error message (using sudo):ERROR:StreamManagerClient:Received ConnectResponse with unexpected status ResponseStatusCode.Unauthorized.ERROR:root:Exception while runningTraceback (most recent call last):  File "s3.py", line 41, in main    client = StreamManagerClient()  File "/usr/local/lib/python3.8/dist-packages/stream_manager-1.1.1-py3.8.egg/stream_manager/streammanagerclient.py", line 114, in __init__    UtilInternal.sync(self.__connect(), loop=self.__loop)  File "/usr/local/lib/python3.8/dist-packages/stream_manager-1.1.1-py3.8.egg/stream_manager/utilinternal.py", line 39, in sync    return asyncio.run_coroutine_threadsafe(coro, loop=loop).result()  File "/usr/lib/python3.8/concurrent/futures/_base.py", line 444, in result    return self.__get_result()  File "/usr/lib/python3.8/concurrent/futures/_base.py", line 389, in __get_result    raise self._exception  File "/usr/local/lib/python3.8/dist-packages/stream_manager-1.1.1-py3.8.egg/stream_manager/streammanagerclient.py", line 152, in __connect    await asyncio.wait_for(self.__connect_request_response(), timeout=self.request_timeout)  File "/usr/lib/python3.8/asyncio/tasks.py", line 494, in wait_for    return fut.result()  File "/usr/local/lib/python3.8/dist-packages/stream_manager-1.1.1-py3.8.egg/stream_manager/streammanagerclient.py", line 309, in __connect_request_response    raise ConnectFailedException("Failed to establish connection with the server")stream_manager.exceptions.ConnectFailedException: Failed to establish connection with the serverSo the error says that if failed to establish a connection with the server, but I am not sure what server is it referring to? DId I miss a step somewhere?Cheers,MarkFollowCommentAmeer H 7 months agoYou are getting an "Unauthorized" error. Have you updated the Stream Manager component configuration? The "STREAM_MANAGER_AUTHENTICATE_CLIENT" is set to true by default. https://docs.aws.amazon.com/greengrass/v2/developerguide/stream-manager-component.htmlShare"


Question: SRT pull inputs in MediaLive

"We need to create a channel with 10 pull inputs from SRT. The only way to ingest SRT is trough MediaConnect, but there is a limitation of 2 push inputshttps://docs.aws.amazon.com/medialive/latest/ug/eml-limitations-and-rules.htmlAny workaround? We think SRT native support in MediaLive both for input and output is really urgent.FollowComment"

Answer: "1Yeah, MediaConnect can be limiting.You would need to use software running on an EC2 instance such as Nimble Streamer, or Virtual Video Control Room by LiveX to create the SRT Pull inputs and convert to UDP or RTMP within your VPC.CommentSharerePost-User-9252307answered 5 months ago"


Question: [MSK] Maintenance window setting

Is it possible to customize the maintenance window for MSK?FollowComment

Answer: "1Currently you cannot customize maintenance window. If/when you get notification about scheduled patch/maintenance, you can open support ticket to reschedule/postpone.CommentShareEdbEanswered 4 months ago-1Yes, it is possible to customize the maintenance window for Amazon MSK (Managed Streaming for Kafka). You can do this by specifying the desired maintenance window when you create a new MSK cluster or by modifying the maintenance window for an existing cluster using the AWS Management Console, AWS CLI, or SDK. The maintenance window is a weekly recurring window of time during which Amazon MSK can perform routine software and security updates on your cluster. The maintenance window can be set to a maximum of 7 hours and must be set to a time when your cluster is not in use.CommentShareTasadduq Burneyanswered 4 months agoEdbE 4 months agoCould you please help me, where can I specify/modify the maintenance window, or just a reference to the documentation?Share"


Question: How to Prefix 0's  in Athena Query?

"I would like to prefix 0's for employee id  column and not sure how can I do this on Athena?  It appears LPAD function work differently in Athena vs Redshift.select LPAD(CAST(employee_id As varchar),8,0) as EmployeeIDFollowComment"

Answer: "1I have fixed this by adding an If condition.This is what worked for me:select IF(LENGTH(employee_id)<8,LPAD(employee_id,8,'0'),employee_id) from table1CommentSharerePost-User-8515311answered 5 months agoEXPERTFabrizio@AWSreviewed 5 months ago0The third argument is expected to be a string for LPAD function - can you pelase try it like this?select LPAD(CAST(employee_id As varchar),8,'0') as EmployeeIDCommentShareAlex_Tanswered 5 months agoEXPERTFabrizio@AWSreviewed 5 months ago0Thank you for your response. I tried this last night and found a problem with Lpad function. Its prefixing the 0's however, its also truncating the string if the string size is more than the size of the padding we give. Just wondering if there is any way we can avoid truncating.select lpad(employee_id,8,'0') from table1  --> This is prefixing 0's to employee id less than 8 however its also truncating employee ids more than 8 characters.Example: 123456  --> 00123456123456789012 --> 12345678CommentSharerePost-User-8515311answered 5 months ago"


Question: Dependency TimeOut Error when making requests to Neptune

"we have recently encountered a timeout error halfway through the loading process when making requests to Neptune for bulk loading from S3 (via AWS lambda), with the following errors log. Does anyone have any hints on what might be causing this dependency timeout issue?Error message'code': 'InternalFailureException', 'detailedMessage': 'Dependency Timeout'And for some reasons, somehow this timeout issue disappears when the same scheduled process was run today, even though the pipeline and scripts stay the same (except the data in S3)FollowComment"


Question: AWS Pricing for a Soup Kitchen Finder App

What would be the best service for a map app?  Lightsail? EC2?Trying to design an app to look for local soup kitchens and we dont want to hit the ground already spending money that really isnt there. Looking for a low cost option at the moment.FollowComment

Answer: "1This is a really broad question with equally (if not more) broad answers. If I was developing something from scratch I would consider the range of AWS serverless services as well as Amazon Location Services. Why? Because running EC2 or Lightsail instances means that you pay for capacity you aren't using when they are idle. You can certainly scale up and down but serverless does that for you automatically.Again: This is a very short answer to a very big question. I'd strongly recommend you reach out to your local AWS Solutions Architect to discuss the best way (for you) to build your application.CommentShareEXPERTBrettski-AWSanswered 9 months ago0What are your development strengths? Are you wanting to build something from scratch? Are you wanting it to be running on Wordpress as a plugin? are you wanting to save your results to compile a database? do you want your results cached for others to see? Are you expecting more than 10-100 people using this at any given time? Lot's of questions that will determine the outcome of which service you choose. that being said. Lightsail is an easy way to get started. If you are new you can get 3 months free of the lower tier instances, which could give you some time to play around and get a better idea of what you want to do. Lightsail is nice for the predictable bundle pricing.CommentShareBrian Grafanswered 9 months ago"


Question: pg_ivm plugin for Aurora PostgreSQL

"The pg_ivm plugin helps us solve a bunch of design issues that we are having. When can we expect this plugin to be available to RDS users?https://github.com/sraoss/pg_ivmI have already asked this using AWS Support, but the request was posted to internal teams.FollowComment"

Answer: "0You already did what you could by raising to Support, and then them raiding as feature feedback (as suggested also here: https://aws.amazon.com/rds/aurora/faqs/ on the extensions section).You ll have to wait until gets prioritized from AWS team. If you have an account manager you may contact him/her too.CommentShareEXPERTalatechanswered 4 months ago"


Question: Instance unreachable / drops out

"Hi,My instance (i-05a19d44995eb83cd) has, over the past couple of days, become just about unusable. The status check often indicates unreachable but now even when this check passes I still cannot connect to my instance. I use Putty and Virtualmin - both time out/ drop connection. Reboot / restart used to provide a few hours working time but as of today that has stopped working. Afraid I'm a AWS newbie so any help would really be appreciated.ThanksEdited by: gedw on Apr 22, 2021 7:42 AMNot sure if this has any relevance but noticed that Virtualmin dashboard shows virtual memory running at about 97% constantly - even though there is no activity apart from normal services running.Edited by: gedw on Apr 23, 2021 2:18 AMAs of this morning I cannot connect at all. Reboot / restart has no effect.Any help - please!FollowComment"

Answer: 0Instance size was too small!CommentSharegedwanswered 2 years ago0Instance size was too small!CommentSharegedwanswered 2 years ago


Question: Enabling cross-account functionality in CloudWatch without AWS console

"I would like to automate the process of Enabling cross-account functionality in CloudWatch for each new account so that there is no need to go through this link tutorial on each new account.I have an account dedicated to monitoring that should have CloudWatch access by default in every new and existing account in the organisation.Ideally, it would be possible to set something like this up via CDK, but any alternative would be welcome.FollowComment"

Answer: "1Accepted AnswerIf you have a look at what the console is doing, it just deploys a single CloudFormation template into the account, creating one IAM role: CloudWatch-CrossAccountSharingRole.  Repeating the same with CDK or CloudFormation is how you can automate.  For AWS Organizations integration, have a look at CloudFormation StackSets which can auto-deploy the IAM role to new accounts as they are onboarded.Here is the YAML for a typical CloudFormation stack that creates the needed role (same as what you'll see deployed in the AWS Console):---Parameters:  MonitoringAccountIds:    Description: Allows one or more monitoring accounts to view your data. Enter AWS account ids, 12 numeric digits in comma-separated list    Type: CommaDelimitedList    Default: 012345678901Conditions:  CWCrossAccountSupported: {"Fn::Equals": [{"Ref": "AWS::Partition"}, "aws"]}Resources:  CWCrossAccountSharingRole:    Condition: "CWCrossAccountSupported"    Type: AWS::IAM::Role    Properties:      RoleName: CloudWatch-CrossAccountSharingRole      AssumeRolePolicyDocument:        Version: '2012-10-17'        Statement:          - Effect: Allow            Principal:              AWS: !Split                - ','                - !Sub                  - 'arn:${AWS::Partition}:iam::${inner}:root'                  - inner: !Join                      - ':root,arn:${AWS::Partition}:iam::'                      - Ref: MonitoringAccountIds            Action:              - sts:AssumeRole      Path: "/"      ManagedPolicyArns:        - arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess        - arn:aws:iam::aws:policy/CloudWatchAutomaticDashboardsAccessCommentShareAmazon-CloudWatch-01answered a year agorePost-User-7229714 a month agodo you need to create OAM::Link ?Share"


Question: How do I access the WorkMail Safe Senders List?

Where is the WorkMail Safe Senders List located? How can I access it? How can I edit it?FollowComment

Answer: "0Accepted AnswerHi,I'm not sure if WorkMail exposes any list like that. Can you share more details on your use case for accessing the Safe Senders List?Kind regards,RobinCommentShareMODERATORrobinkawsanswered 6 months ago"


Question: Error msg when running query in aws athena

Please find packages at http://spark.apache.org/third-party-projects.htmlFollowComment


Question: HSCN connection procedure?

"We need to connect an EC2 instance to the HSCN network.So far we have the physical cable provisioned and a virtual interface defined and active (the state is showing a green tick).The virtual interface has IP addresses for the router peers in the 10.x.x.x range.We have defined a Direct Connect gateway, and it also has a status of "available" and is showing a green tick.The remote provider is saying that the connection isn't correct because we are advertising the internal AWS IP range for our VPC (i.e. in the 172.x.x.x range), but it should be advertising a public IP address that we have been assigned.Does anyone know how to (a) advertise public IP addresses to the HSCN connection from our instance and (b) make the interface available to the EC2 instance?FollowComment"

Answer: "0This may be difficult to troubleshoot without knowing more about the organisation; HCSN is a UK healthcare network that operates across both private and unrouted public IP address space.  When you connect to the HSCN network via Direct Connect (DX), you would typically be given a small number of HSCN routable IP addresses (normally just a /30), which cannot overlap with your VPC CIDR range.  Since this isn't big enough to create an additional VPC CIDR block from, you would normally create static NATs from your HSCN-side router to private IP VPC addresses in the Amazon VPC (in this case, to your EC2 instance).If you have been given a bigger block (at least a /27), then you can create an additional CIDR block in the VPC, create two /28 routable subnets (1 per AZ), and then have DX route to those addresses.  To scale, you would run something like an NLB for inbound connections, and a NAT Gateway for outbound connections.CommentShareEXPERTmhjworkanswered 14 days agorePost-User-4712965 13 days agoThis seems like it is what I need to do, I will do some research on setting up "static NATs".I was hoping that quite a few people would have gone through this process, as the NHS is huge and there must be 1000s of external systems that need to connect into it, i.e. a well trodden path, so things like this would be common(ish) knowledge.Since that doesn't appear to be the case, I will comment back once I do have it working, to give as many details as I can for my fellow travellers.Sharemhjwork EXPERT13 days agoSo, for HSCN you definitely don't want to go down a Public VIF route; this is where you are able to connect to publicly available IP addresses in AWS from your network.  HSCN is a closed network with separate routing from the Internet, so Private VIF is correct.The challenge is that because of the number and scale of networks, you can't just assume that you can route the entire VPC CIDR range onto the HSCN - this is also the reason why you only get a /29 address space - which introduces challenges of how you integrate this into an Amazon VPC construct.Given the complexity of this, I would recommend looking to contact the AWS UK public sector account team; we can give you specific information around routes to connecting to HCSN, both 1st and 3rd party partner options that manage away a lot of the complexity of doing this.You can contact the team here: https://aws.amazon.com/government-education/contact/ - make sure you flag that this is for the attention of the UK public sector healthcare team.SharerePost-User-4712965 4 days agoOK, so first thing was to get our IP address allocation increased from /29 to /28.  Once that was done, adding the subnet to our VPC was possible.After adding the new CIDR to the VPC, I was able to update the Virtual Private Gateway to advertise the new IP range, and the connection provider was happy that it was all OK from their end.So I added a route table in the VPC that only had the 2 local VPC subnets and the CIDRs of the gateways, and a 0.0.0.0/0 rule going through the Virtual Gateway.I create a new Network Interface on the /28 subnet and attached it to our instance.I added the new /28 subnet to this route table and ran the Reachability Analyzer between my EC2 instance and known IP addresses inside the HSCN (specifically their DNS servers) and all checked out OK.However, adding routes on the (Debian) EC2 instance to point the gateway CIDRs and the HSCN IP addresses to the new network interface and then using traceroute failed miserably, not even reaching the Virtual Private Gateway.Share0The currently defined VIF is private, but that's not to say it should be something else - the people who provide the link to the HSCN network have no clue as to how to set up the networking inside AWS, so I've just been guessing up until this point.  The VIFs (as there are two connections for redundancy) are showing "available" with a green tick.The architecture I was hoping would be quite simple: we run a service on an EC2 instance and we need to pull information via an API from a server inside the HSCN network.To that end: we have a physical connection from HSCN to the zone where our EC2 instance is located.  I've defined a Direct Connect Gateway, and 2 private Virtual Private Interfaces, all of which show as available.I can see in a "public" Virtual Private Interfaces page that I can specify CIDR prefixes to advertise, but the range we've been asked to advertise is a /29 network, and the smallest that I'm allowed to specify in "public" VIF is /24.  Not only that but the range isn't associated with the VPC that our EC2 instance is in, so the definition of our CIDR just can't be entered at all.I can't create a VPC with the right CIDR, and I can't add the CIDR to our existing VPC.I'm guessing that I need to define some kind of private NAT or something, but I have no idea really.I was asked to create a gateway with IP addresses in the 10.x.x.x range (AWS side and HSCN side), our EC2 instance is in our default VPC with a 172.x.x.x range.  So I have no idea where a public IP address range should go.CommentSharerePost-User-4712965answered 14 days agomhjwork EXPERT13 days agoSo, for HSCN you definitely don't want to go down a Public VIF route; this is where you are able to connect to publicly available IP addresses in AWS from your network.  HSCN is a closed network with separate routing from the Internet, so Private VIF is correct.The challenge is that because of the number and scale of networks, you can't just assume that you can route the entire VPC CIDR range onto the HSCN - this is also the reason why you only get a /29 address space - which introduces challenges of how you integrate this into an Amazon VPC construct.Given the complexity of this, I would recommend looking to contact the AWS UK public sector account team; we can give you specific information around routes to connecting to HCSN, both 1st and 3rd party partner options that manage away a lot of the complexity of doing this.You can contact the team here: https://aws.amazon.com/government-education/contact/ - make sure you flag that this is for the attention of the UK public sector healthcare team.Share0This knowledge article goes through the details https://repost.aws/knowledge-center/direct-connect-vpc-bgpPlease elaborate more on your architecture.Whether you're using public, private, or transit VIF?Is the VIF in UP state or is it in DOWN state?Essentially, you want to advertise your on-prem CIDR to AWS and VPC CIDR to on-prem.CommentShareMatt_Eanswered 14 days ago0You first mentioned that the VIF is private, "The currently defined VIF is private".You then mentioned about public VIF, I can see in a "public" Virtual Private Interfaces page that I can specify CIDR prefixes to advertise.Since you're trying to connect your on-prem to your VPC, then I guess it's a private VIF. Private VIF is used to connect to VPC resources (EC2 in your case). See below knowledge article for more details https://repost.aws/knowledge-center/public-private-interface-dxAlso, You cannot create a public virtual interface to a Direct Connect gateway, see https://docs.aws.amazon.com/directconnect/latest/UserGuide/virtualgateways.htmlWith private VIF, there is no public IP addresses in the picture.What you need is advertise your default VPC CIDR 172.31.0.0/16 by adding this in the allowed prefixes. https://docs.aws.amazon.com/directconnect/latest/UserGuide/multi-account-associate-vgw.html#allowed-prefixesI hope this help!CommentShareMatt_Eanswered 14 days agoEXPERTBrettski-AWSreviewed 14 days ago"


Question: How to collect OS level logs on from Mobile devices attempting access to Application behind Application Load Balancer

"Need help identifying how to collect OS level data on mobile applications attempting to log into web server hosted on an EC2 windows machine. We are using Cognito as well as an ALB to route traffic. Would like to collect OS level information (Iphone SE, Samsung Galaxy etc.)Is there a way to configure this natively in AWS via Cloudwatch or Cloudtrail? Was not able to see from the documentation. Thank youFollowComment"

Answer: 0I presume you are looking for User-Agent from ALB logs? The instructions are here: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.htmlCommentShareRodney Lesteranswered 9 months ago


Question: Amazon Gamelift: How to tell what VPC the servers are running in - Verifying Servers' access to backend services

"Hello,An expansion to an original question: https://repost.aws/questions/QU0MPwSTJGQhKDcl9Zw1e_zQ/aws-game-lift-server-best-solution-for-generating-and-rotating-api-keys-for-aws-server-authenticationIs there a way to find which VPC and addresses the individual game servers are running on within Gamelift?Actually, in writing this, I found this thread as well: https://repost.aws/questions/QUoLdwDhJRSCy4EhLSJwzvxw/running-a-proxy-process-on-gameliftWe are just trying to make sure that certain calls to our backend services originate from within the actual servers running within game lift and not via an outside client. UE4 packages the server and client code together, so we just want an extra layer of security check.FollowComment"

Answer: "0GameLift is running in a VPC owned and managed by the service. This VPC is not visible in your AWS account. If you have a need to enable private connectivity between the GameLift server fleets and backend running in your own VPC you can then use VPC Peering. This lets you connect to your backends using private IP addresses.UE4 doesn't package the server and client code together if you don't want to. In my understanding there is a way to separate server-only code from the client code. Allowing you to define the what kind of build you are doing and what parts of code is even included. I believe the terminology in UE4 is Cook and Packaging. When searching UE Dev Community forums I found at least one post describing how to disable server-only code from client builds.Even without splitting the code, your Client to Game Server backend should be secured by using known methods such as Oauth and JWTs. As for your server to backend communicate you could use shared secret or some other method to validate that it's a server under your control calling and not something else on the internet.CommentShareEXPERTToni_Sanswered 6 months ago"


Question: How can I create deployment package for my lambda to work with my libraries or an alternative solution?

"I'm receiving error: Receive error in Lambda: Unable to import module 'functions': No module named 'functions' Tracebackcode: Code.fromAsset(path.resolve(__dirname, BundleLocation + name)),I'm deployig this via the CDK. I confirmed I have this in my code for CDK for my Lambda; however I am still receiving an error. However, when I go into Lambda to troubleshoot why my app is not working I see logs in CloudWatch and I look through Cloudwatch logs and I am receiving this error.I also want to note my CDK stack is in typescript and my python code is in python. I'm not sure if this makes a difference. Does anyone know what could cause this error after me detailing I have the correct syntax?Also is there any work arounds for this?FollowComment"

Answer: "0Hi,Did you try the approach described here? https://aws.amazon.com/premiumsupport/knowledge-center/lambda-import-module-error-python/CommentShareEXPERTalatechanswered 3 months agoMjr 3 months agoYes, I have looked at this first.I also do not need lambda layer for this as this will be in one region.Share"


Question: Ubuntu Serial Console Connection Vanished

"I was working with a new ubuntu instance this morning, alternating between a serial console and ssh connection.  I took a lunch break.  When I came back the EC2 Dashboard is taking me to a bit of a different instances list.  Once I select my instance, the connect button no longer gives an option for the serial connection.  I checked and EC2 serial console access is still allowed under the account attributes.I would appreciate advice on how to get back to where I was earlier.thanksCliffFollowComment"

Answer: "0Hello, Below are the few considerations you must remember while using Serial connection with EC2:Only one active serial console connection is supported per instance.The serial console connection typically lasts for one hour unless you terminate it. However, during system maintenance, Amazon EC2 will terminate the serial console session.It takes 30 seconds to tear down a session after you've disconnected from the serial console in order to allow a new session.Supported serial console port for Linux: ttyS0Check out this troubleshooting document that helps go through the steps in a systematic manner along with the pre-requisites and make sure the method followed by yourself complies by the same.However in order to access the instance & check the logs, it is recommended to directly reach out Premium Support engineers via a Support Case from the (EC2) team since they have the necessary access needed to check the logs.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year ago"


Question: Does AWS Device Farm support Android background service execution?

"The app I would like to test executes Android background services which perform various network tests to various sites.  These results are reported to our backend for analysis.  The UI is negligible, logging a terse test summary as tests occur.  I started a session on a device, uploaded our app & set the appropriate permissions.  The UI indicates tests are beginning.However, the background services do not appear to be executing.  Is the AWS Device Farm intended to support UI interactions but NOT background service execution?  Is there some setting in the console that would enable background service execution?  Thanks.FollowComment"


Question: Multi-file source_dir bundle with SM Training Compiler (distributed)

"I'm hoping to use SageMaker Training Compiler with a (Hugging Face Trainer API, PyTorch) program split across multiple .py files for maintainability. The job needs to run on multiple GPUs (although at the current scale, multi-device single-node would be acceptable).Following the docs, I added the distributed_training_launcher.py launcher script to my source_dir bundle, and passed in the true training script via a training_script hyperparameter....But when the job tries to start, I get:Traceback (most recent call last):  File "/opt/conda/lib/python3.8/runpy.py", line 194, in _run_module_as_mainreturn _run_code(code, main_globals, None,  File "/opt/conda/lib/python3.8/runpy.py", line 87, in _run_code    exec(code, run_globals)  File "/opt/conda/lib/python3.8/site-packages/torch_xla/distributed/xla_spawn.py", line 90, in <module>main()  File "/opt/conda/lib/python3.8/site-packages/torch_xla/distributed/xla_spawn.py", line 86, in mainxmp.spawn(mod._mp_fn, args=(), nprocs=args.num_gpus)AttributeError: module 'train' has no attribute '_mp_fn'Any ideas what might be causing this? Is there some particular limitation or additional requirement for training scripts that are written over multiple files?I also tried running in single-GPU mode (p3.2xlarge) instead - directly calling the train script instead of the distributed launcher - and saw the below error which seems to originate within TrainingArguments itself? Not sure why it's trying to call a 'tensorflow/compiler' compiler when running in PT..?EDIT: Turns out the below error can be solved by explicitly setting n_gpus as mentioned on the troubleshooting doc - but that takes me back to the error message aboveFile "/opt/ml/code/code/config.py", line 124, in __post_init__super().__post_init__()  File "/opt/conda/lib/python3.8/site-packages/transformers/training_args.py", line 761, in __post_init__if is_torch_available() and self.device.type != "cuda" and (self.fp16 or self.fp16_full_eval):  File "/opt/conda/lib/python3.8/site-packages/transformers/file_utils.py", line 1764, in wrapperreturn func(*args, **kwargs)  File "/opt/conda/lib/python3.8/site-packages/transformers/training_args.py", line 975, in devicereturn self._setup_devices  File "/opt/conda/lib/python3.8/site-packages/transformers/file_utils.py", line 1754, in __get__cached = self.fget(obj)  File "/opt/conda/lib/python3.8/site-packages/transformers/file_utils.py", line 1764, in wrapperreturn func(*args, **kwargs)  File "/opt/conda/lib/python3.8/site-packages/transformers/training_args.py", line 918, in _setup_devicesdevice = xm.xla_device()  File "/opt/conda/lib/python3.8/site-packages/torch_xla/core/xla_model.py", line 231, in xla_devicedevices = get_xla_supported_devices(  File "/opt/conda/lib/python3.8/site-packages/torch_xla/core/xla_model.py", line 137, in get_xla_supported_devicesxla_devices = _DEVICES.value  File "/opt/conda/lib/python3.8/site-packages/torch_xla/utils/utils.py", line 32, in valueself._value = self._gen_fn()  File "/opt/conda/lib/python3.8/site-packages/torch_xla/core/xla_model.py", line 19, in <lambda>_DEVICES = xu.LazyProperty(lambda: torch_xla._XLAC._xla_get_devices())RuntimeError: tensorflow/compiler/xla/xla_client/computation_client.cc:273 : Missing XLA configurationFollowComment"

Answer: "0Accepted AnswerAhh I solved this a while ago and forgot to update -Yes, the training script needs to define a _mp_fn (which can just execute the same code as gets run if __name__ == "__main__") and number of GPUs (at least the last time I checked - hopefully this could change in future) needs to be explicitly configured.For my particular project the fix to enable SMTC on the existing job is available online here. For others would also suggest referring to the official SMTC example notebooks & scripts!CommentShareEXPERTAlex_Tanswered a year ago"


Question: Direct Connect Public VIF

Trying to use Direct Connect to copy files from on prem to an S3 bucket using direct connect. Looks like this is possible.Have a direct connect connection from a providerThink the next step is set up a public VIF.I'm not sure what I need to specify in 'your router peer ip' and 'amazon router peer ip' Where do these details come from? It says they need to be public IP addresses.FollowComment

Answer: "0When you create a Public VIF the IP addresses on the link between you and AWS need to be public IP addresses. You will need two - one for your router and one for the AWS router. Customers can provide IP addresses from their public IP address allocation (if they own public IP addresses); for customers that do not you can request a /31 (two IP addresses) from AWS using a support case.CommentShareEXPERTBrettski-AWSanswered a year ago0Per the documentation:** Your router peer ip**, enter the destination IPv4 CIDR address to which Amazon should send traffic.For Amazon router peer IP, enter the IPv4 CIDR address to use to send traffic to AWS.More details can be found here: https://docs.aws.amazon.com/directconnect/latest/UserGuide/create-vif.htmlCommentShareLen-AWSanswered a year ago0For AWS Direct connect Public VIF, you need to specify the a /30 or /31 subnet which will be used for establishing BGP peering between your customer gateway device and AWS Direct Connect router. These IPs are used as BGP peers as you are seeing option in the creation of the Public VIF. In addition you also have to provide the Public IP address prefixes (which will act as the source of traffic to S3 from your on-premises) that you want to advertise over the peering. The Public IP addresses either need to be owned by you or should have been provided to you by your ISP, which in case needs a letter of authorization to use them.As an alternate to Public VIF, if you already have a Private VIF configured over your Direct connect, then you can use AWS Private link for S3 and access it over Direct Connect Private VIF or VPN connection. https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.htmlCommentSharesumitawsanswered a year ago"


Question: S3 Bucket Object Lock - Deleting an object version with no retention settings requires 'BypassGovernanceRetention' permissions

"Scenario:An S3 Bucket has 'Object Lock' Enabled.  Default retention is, and always has been - 'Disabled'An S3 Object in the bucket has multiple versions. Object Lock (Legal Hold & Retention) are both 'Disabled' for all versions of the object.Object Lock (Legal Hold & Retention) settings have never been enabled for the object or any of its previous versionsIssue:An IAM User with 'DeleteObjectVersion' permission receives 'access denied' when attempting to perform 'version delete' on a version of the object.The delete succeeds with the additional 'BypassGovernanceRetention' allowed for the same userQuestion:Is this the expected behavior?  It seems like a bug to me!I understood the purpose of the 'BypassGovernanceRetention' is to allow changes to objects where 'governance mode' retention is enabled for the object.But it appears 'BypassGovernanceRetention' is required to delete a version in the bucket, even if the version does not have 'governance mode' enabled.I can find no reference in documentation for this behaviorI have confirmed this behavior occurs only for objects in buckets where object lock is enabled.For objects in buckets with versioning only (object lock disabled) - the behavior is as expected.  Only the 'DeleteObjectVersion' permission is required to delete object versions.Please adviseRegardsJasonFollowComment"

Answer: "-1Please refer "Enabling S3 Object Lock" under https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-bucket-configWhen you create a bucket with Object Lock enabled, Amazon S3 automatically enables versioning for the bucket.If you create a bucket with Object Lock enabled, you can't disable Object Lock or suspend versioning for the bucket.When you turn on Object Lock for a bucket, the bucket can store protected objects. However, the setting doesn't automatically protect objects that you put into the bucket. If you want to automatically protect object versions that are placed in the bucket, you can configure a default retention period. Default settings apply to all new objects that are placed in the bucket, unless you explicitly specify a different retention mode and period for an object when you create it. Bucket default settings require both a mode and a period. A bucket default mode is either governance or compliance.Reference : https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.htmlCommentShareEXPERTAWS-User-Nitinanswered 6 months agoboxing_surfer 6 months agoHi. Thanks for your response but I already read and understood the documentation. My question is specific. Let me ask in a more simplified way:For a bucket with object lock configured'BypassGovernanceRetention' is required to delete object versions, where object versions do not have 'governance retention' enabledWhy should this permission be required when objects do not have governance retention?ThanksThis is the reason I asked the questionShare"


Question: AWS  Free Tier services

"Hi, I created the AWS account around a year back and i have no background related to this at all. I'm only here because I received a mail from AWS asking me to cancel any active services or i'll be billed for any active services. I'm really confused what to do now, i have no used this service even once.I opened "Bill Management" page and clicked on the "Free Tier" tab on the left side and it showed this message under the "AWS Free Tier summary" " There is no Free Tier services data available".Does this mean I did not subscribed and started any services? I can just close the account and not worry about any payments right?FollowComment"

Answer: "0Firstly, I would suggest you to look at the existing monthly bills in the Billing Dashboard (under 'Bills' section) to understand what were the charges on your account for the past 12 months and the services being consumed. Then you can view the 'Payments' section to understand any dues. Usually during each billing cycle, any dues you have would be automatically charged onto the card you have used for Account creation.Regarding the Free Tier limits - there are different types of free limits based on the service (12 month free, always free, etc). Refer this link to understand which services are always Free - https://aws.amazon.com/free/ (apply relevant 'Tier Type' filter). And to your query, yes - if you are not seeing any services listed under the 'AWS Free Tier Summary', that means you are not consuming any 'Free Tier' eligible resources.If you no longer want to use this account, you can safely close it and if needed create a new one at a later stage. However, to avoid any charges, if you are consuming any services/resources, it is recommended to disable/delete/clean-up before Account Closure, as 'Account Closure' will kick-in a 90 day notice period, within which you could reopen the account. Refer below 'Account Closure' documentation links. Hope this helps !!Please review these to understand the account closure process, considerations and recommendations -https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/close-account.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/close-aws-account/CommentShareRajesh Sanswered 9 months agorePost-User-1306522 9 months agoHi, thanks for the detailed answer.I went and checked in the billing section(Using the old billing UI here) and i manually went through all the months since the creation and the only message I saw on all pages is "There are no invoices for the selected month.". I think it's safe to assume I've not accidently started any services, I've not been charged anything from AWS in the past 12 months. So i think i can close the account safely.Share"


Question: Intermittent connection issue between webserver and database ("The network path was not found")

"Several times a day, we are getting this error message in our logs when our front-end webserver (i-08a436fb2d0811658) attempts to connect to our database server (i-0ddd3807ec3bac491):The network path was not found: A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server)The configuration of these EC2 instances has not changed in years, and this issue just randomly started a few days ago. We tried stopping the web server and starting it again, to hopefully move it to new hardware, but the issue persists. There are no warnings or errors in the event logs on the web server or the database server indicating what might be the cause. TCP is the primary protocol to communicate with SQL Server. The reference to "named pipes" above indicates it was used a the secondary protocol after the TCP connection failed.Can someone please assist us in troubleshooting this issue. Thank you.FollowComment"

Answer: "0Accepted AnswerAfter 4 days of these intermittent connectivity issues, the issue suddenly stopped with no action on our part other than making a post here. I'm assuming AWS monitors these posts and intervenes behind the scenes on issues like this, and that is what got our issue resolved.I only wish there would have been some sort of confirmation or feedback to us if that's what occurred.CommentShareAWS-User-7975177answered a year ago0This could be a DNS issue (lookup is failing) or some other network problem. Given that this is an intermittent problem the best thing to do is to raise a support case and have the team troubleshoot this with you.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-7975177 a year agoHi Brett and thanks for the reply. Those two servers are on a VPC and communicate via IP address, so a DNS issue was not the likely cause. I do agree with you that a network issue was likely to blame. It also appears it was likely resolved by AWS. I say that because after having dozens of these connectivity issues daily, starting randomly last Saturday, the issue suddenly stopped after I made my post here yesterday with no action on our part. If AWS did intervene behind the scenes as I suspect, it would have been nice to have someone confirm something was in fact fixed on your end.We do not have a support contract with you, so there was no way for us to raise what we believed was likely a networking issue on your end short of making this post and hoping someone there saw it. It would be nice if there was a more direct way of alerting you guys to probably issues outside of our control like this was.ShareBrettski-AWS EXPERTa year agoA support contract is the "more direct way of alerting you guys". The forum is here to provide best-effort guidance but is no substitute for being in touch with the support team. Yes, some of the team do watch the forums but because there's no way to relate your forum username to an AWS account it's not that helpful. Sure, publishing your EC2 instances ids means they can find that but even then the team can't delve into the account without your permission.Business-level support is not that expensive; can be cancelled if you don't want it; and does provide SLAs for response times. Well worth the money if you're running critical workloads.Share"


Question: Lambdas using urllib3 2.0.0 fails in python 3.8 runtime

"We are running some cloudformation custom resources on lambda 3.8 runtime that uses cfnresponse package.Cfnresponse depends on the package urllib3 which recently released a new major version 2.When importing urllib3 of version 2.0.0 in our lambdas we get the following error:[ERROR] Runtime.ImportModuleError: Unable to import module '<lambda name>': urllib3 v2.0 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with OpenSSL 1.0.2k-fips  26 Jan 2017. See: https://github.com/urllib3/urllib3/issues/2168Traceback (most recent call last):Can we expect python 3.8 runtime to get upgraded to OpenSSL 1.1.1+ any time soon?Otherwise cfnresponse should probably get a explicit dependency on urllib3 1.x.x, since it's main purpose is to be run in lambdas and urllib3 2.x.x cannot be run there as it is now.FollowCommentmmetr 25 days agoFOLLOWING THIS. Experiencing the same issue.ShareShik12 21 days agogetting the same issue,i tried  to update openssl version also checked that indeed the openssl version was 1.1.1f (using openssl version) ,used pip install urllib3==1.26.15 and pip install requests==2.28.1(as my lambda was using "request" module)did the changes in buildspechttps://kb.vmware.com/s/article/92237?lang=en_USstill the lambda giving the same error,why it is not picking the changesShare"

Answer: 0pip install 'urllib3<2' might help. urllib3==1.26.18 also helped.CommentSharerePost-User-0875852answered 6 days ago


Question: AWS fargate - pulling from internal (private) repo possible with SSL cert bypass?

"Hello expertsI read a lot of the questions and answers about ECS/fargate with private repo, and I have been assigned to use ECS with our company's internal repo - nexus, since this Nexus is an HTTPS with a self-sign cert it seems ECS do not like self-sign certIs that any way to bypass the SSL cert check?error belowCannotPullContainerError: inspect image has been retried 1 time(s): failed to resolve ref "/<repo_acc>/:latest": failed to do request: Head https:///<repo_acc>//manifests/latest: x509: certificate signed by unknown authorityFollowComment"

Answer: "0Accepted AnswerThere is no way to bypass the SSL certificate check.https://github.com/aws/containers-roadmap/issues/740Unfortunately, no way to add a private CA certificate is provided either.https://github.com/aws/containers-roadmap/issues/1301CommentSharehayao-kanswered a year agorePost-User-6232598 a year agomany thanks! that seems the root of the yes/no what I need, and then I can move on with ECR ! thanks!Share"


Question: Access API running on-prem from private EKS cluster pods

IHAC having EKS cluster running on private subnets and needs to access API running on-prem. CX has DX connection to on-prem that is connected via CGW. Access through EC2 is allowed but pods can't access the on-prem url. We enabled SNAT on pods but it says NAT gateway is required to do so. What is the correct pattern for above access using DX for EKS pods?FollowComment

Answer: "0What about using Route 53 Resolver Outbound Endpoint?This can be used to resolve on-premises DNS names.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-forwarding-outbound-queries.htmlOr you could set up a private host zone in the VPC, etc.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.htmlCommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: "Alexa Smart Home" option not showing on lamda trigger

"When creating a trigger, the "Alexa Smart Home" option does not appear, but "Alexa" does, which is what I use for the function. I am using the US_EAST_1 region. Testing the lambda function works fine.  When trying to save a skill in the Alexa developer console with the default endpoint of "arn:aws:lambda:us-east-1:561716694277:function:HomeAssistant" it returns the errorPlease make sure that "Alexa Smart Home" is selected for the event source type, for provided arn [Invalid value] : arn:aws:lambda:us-east-1:561716694277:function:HomeAssistantAny ideas?ThanksFollowComment"

Answer: "0Accepted AnswerHi,According to AWS documentation, the Alexa Smart Home trigger is only available at US East (N. Virginia), US West (Oregon) and EU (Ireland) regions, so you must deploy the Lambda function in one of them, depending on your use case country and language requirements.Then,  select "Alexa" as trigger configuration source and "Alexa Smart Home" as the Alexa product.CommentShareMikel Del Tioanswered 16 days agorePost-User-3056844 15 days agoHuh, I was following very closely the steps on a Youtube video and didn't see the "Alexa Smart Home" button. It defaulted to "Alexa Skills Kit", evidently. Worked like a charm after I created a new trigger with the proper selection. Thank you!!!!!!!Share"


Question: InnoDB: Stopping purge

"What is the Reason Behind the Purge Resume/Stopping Cases  ?Just to Elaborate , We  noticed that the MySQL error log was flooded with the below note:2023-04-22T16:57:07.937+05:302023-04-22T11:27:07.937341Z 197724 [Note]InnoDB: Stopping purge2023-04-22T16:57:07.944+05:302023-04-22T11:27:07.944310Z 197724 [Note]InnoDB: Resuming purge**Any Idea why we are getting these ? **FollowComment"


Question: Redis Performance Across Different Regions

"I have a redis db on an EC2 in the us west region while other regions, eu-central and ap-southeast connect to it. I am using Global Accelerator to reduce the latency but I was wondering, are there other ways to reduce the latency here? The instances in other regions need to read and write on the redis Db. I was looking at elastic cache using Global Datastore but it seems the secondary redis db will be a readonly option. I was thinking of using Redis Enterprise but wondered if there is a way using AWS first.PS. I moved my redis db from another cloud provider to AWS and saw a massive performance increase because of the latency difference. Hoping to get another way to increase performance here.FollowComment"

Answer: "0What instance size are you using? If you are using Instances which have more than 4 cores - this comes with a feature called Enhanced IO enabled by default - which improves throughput by upto 83% and upto 47% reduction in latency with no application code changes required.Additional details can be found in this Blog -  https://aws.amazon.com/blogs/database/boosting-application-performance-and-reducing-costs-with-amazon-elasticache-for-redis/There are a few other changes that can improve overall latencies but that could involve looking at the metrics.CommentShareMahee Gunturuanswered 8 months agoAWS-User-9513630 8 months agoAt the moment it's a r6a.xlarge. You do have a point. I did see that in the docs. I will spin up a new server and do some testing and return with my findings.Share0Unfortunately, there's no beating the speed of light. As you've seen, using Global Accelerator can make a difference but it isn't going to reduce latency enough for some users - because they are just further away.Adding a read-only replica in a region closer to the users is a good idea; but that does mean that writes have to go back to the read/write replica (assuming you want synchronous writes) or you could have some process in the region local to the users that accept asynchronous write requests. Either way means a change in your application architecture.CommentShareEXPERTBrettski-AWSanswered 8 months ago"


Question: AWS Glue crawler creating multiple tables

"I have following S3 structure and want to craw the parquet filesbucket/basefolder    subfolder1        logfolder            log1.json        file1.parquet    subfolder2        logfolder            log2.json        file2.parquet        file3.parquetI have used exclude pattern as below to exclude unwanted files.**/logfolder/**So these are the tables the crawler got:file1.parquetfile2.parquetfile3.parquetHow to get just one table? All these parquet files have exact same schema, there is no partition.I have also ticked the check box : Create a single schema for each S3 path in crawler settings, but the result is the same.FollowComment"

Answer: "0This might be due to data compatibility issue. By default, when a crawler defines tables for data stored in Amazon S3, it considers both data compatibility and schema similarity. Since you already selected option “Create a single schema for each S3 path”, schema similarity will be ignored in this case but it will still check for data compatibility. Please check here for more information: https://docs.aws.amazon.com/glue/latest/dg/crawler-configuration.html#crawler-grouping-policyIf the crawler identifies that data is not compatible even in a single file it will create a table for each file. Please open a support case with Glue team and provide crawler name, region and sample data (if possible) for us to troubleshoot further.CommentShareMeghana_Sanswered a year agoAWS-User-6447855 a year agoI have tried check and uncheck that option (Create a single schema for each S3 path), the result is the same.Share0You are essentially creating the same schema twice, as you've already selected single schema. Crawlers take into consideration both the data compatibility and schema similarity, since your data compatibility is met it won't create another table. If however, the data wasn't compatible it will then create a table for each file.CommentShareEricaDosanswered a year agoAWS-User-6447855 a year agoI have tried check and uncheck that option (Create a single schema for each S3 path), the result is the same.Share0I may want to have a workflow with a pythonshell job that rebuilds your file structure to have bucket/basefolder/logfolder. Then have a crawler in the same workflow crawl the bucket structure. The confusion is coming from the crawler not knowing how to jump between the tags (directories) like that. You can maintain subfolders with partitions but probably not required. You might need to set a table level for the crawler as shown at bottom of this doc page. https://docs.aws.amazon.com/glue/latest/dg/crawler-configuration.htmlCommentSharejb-poanswered a year ago"


Question: "Before the amazon linux 2 kernel patch release, can I download it in advance?"

"I work for a S/W development company.Before the live patch of Amazon Linux 2 /2022 is released, I want to download the kernel patch in advance and verify the compatibility. How do I get support? Can I get support by subscribing to AWS support?FollowComment"

Answer: "0Hi there!From the notes, I understand that you would like to download the Amazon Linux 2 kernel patch in advance and also get AWS Support. Please correct me if my understanding is wrong.Please note that all kernel patch options are available/accessible from the Amazon Linux Extra repository. You can verify what kernel versions are offered, or which are currently available by the amazon-linux-extras repository by running the following command: sudo amazon-linux-extras |grep kernel.AWS Support offers a range of plans that provide access to tools and expertise that support the success and operational health of your AWS solutions, this includes support for Amazon Linux 2 through subscriptions. Please check the following link [1] for the different features of AWS Support plans.Hope you find the above information helpful.Have a great day ahead!References:[1] https://docs.aws.amazon.com/awssupport/latest/user/getting-started.htmlCommentShareLettyanswered a year ago"


Question: EC2 dual-homed based on workload/role

"Hi,This might be a basic question, but I can't understand on how topology would look like."You can place a network interface on each of your web servers that connects to a mid-tier network where an application server resides. The application server can also be dual-homed to a backend network (subnet) where the database server resides. Instead of routing network packets through the dual-homed instances, each dual-homed instance receives and processes requests on the front end, initiates a connection to the backend, and then sends requests to the servers on the backend network."Source https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/scenarios-enis.htmlPlease shade some light.Thank you.FollowComment"

Answer: "0Accepted AnswerDual-homing looks like this:CommentShareEXPERTskinsmananswered 4 months agoEXPERTTushar_Jreviewed 4 months agoAman 4 months agoThank you for the reply.I was hoping to get a diagram based in the content I sent on my original post.I know how a dual-homed instance looks like in it's simple form.Thanks.Share0Each dual-homed instance would have two ENIs, one in a subnet of the "mid-tier network" (group of subnets) and one in a subnet of the "backend network" (group of subnets).CommentShareEXPERTskinsmananswered 4 months agoAman 4 months agoThank you for the reply skinsman.Perhaps a simple drawing might help may be a link. Just can't get the hang of it.Share"


Question: Getting error : throttling rate exceeded

"We are usingses.getIdentityVerificationAttributesto check is email is verified or not in awsfor examplevar params = {Identities: ['test@test.com']};ses.getIdentityVerificationAttributes(params, async (err, data) => {if (err) {console.log("IN Err =======>> ", err);}});here we are getting are error some time.throttling rate exceededwhat is the reason of this error ?is there any alternative way to get email verified details.ThanksFollowComment"

Answer: "0Hello,Refer this link for maximum rate exceeded error with respect to SES.Link- https://aws.amazon.com/blogs/messaging-and-targeting/how-to-handle-a-throttling-maximum-sending-rate-exceeded-error/ -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago"


Question: Does Athena geospatial support compression?

"I'm using Athena to query some geospatial data encoded in GEOJSON. If I do it with uncompressed GEOJSON files, it works fine, but if I compress those files using gzip I get:HIVE_CURSOR_ERROR: Illegal character ((CTRL-CHAR, code 31)): only regular white space (\r, \n, \t) is allowed between tokens at [Source: org.apache.hadoop.fs.FSDataInputStream@6acf4fe5: org.apache.hadoop.fs.BufferedFSInputStream@2793fa25; line: 1, column: 2]Is it possible to use compressed geospatial data on Athena?EDIT to include table create statement as requested:CREATE EXTERNAL TABLE `locations`(  `id` bigint COMMENT 'from deserializer',   `boundaryshape` binary COMMENT 'from deserializer')ROW FORMAT SERDE   'com.esri.hadoop.hive.serde.JsonSerde' STORED AS INPUTFORMAT   'com.esri.json.hadoop.EnclosedJsonInputFormat' OUTPUTFORMAT   'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'LOCATION  's3://mydata/transformed/'TBLPROPERTIES (  'classification'='json',   'last_modified_by'='hadoop',   'last_modified_time'='1674393793',   'transient_lastDdlTime'='1674393793',   'write.compression'='GZIP')FollowCommentCorvus_L 4 months agoCan you paste the result of SHOW CREATE TABLE <your table name>?Sharegreg-eb 4 months agoHave updated with statement as requestedShareCorvus_L 4 months agoPlease try the following: 1/ change GZIP to lowercase 'compressionType'='gzip', 2/ make sure 1 gzip file contains 1 json file only.Sharegreg-eb 4 months agoHave made that change but still getting the same error. The gzip file does contain only one file.Share"


Question: Urgent Help needed to make last name correction in AWS Training and Certification.

"Greetings,My Canadiate ID is AWS03296801I have registered for the cloud practitioner exam, scheduled for (03/02/2023) at 10:00 am Singaporean time. I noticed that my name in my certification account is as follows:First Name: HamidrezaLast Name: MalekioksoueiAccording to my identification card my first name and last name are as follows:First Name: HamidrezaLast Name: MalekioskoueiAs seen above, my Last Name doesn't match my identification card, as the k should come after s.I have already created a support case using this link: https://support.aws.amazon.com/#/contacts/aws-trainingThe correct way to write my name would be as follows:First Name: HamidrezaLast Name: MalekioskoueiTherefore, can you please help me change my last name to match my identification card?Regards,                                                                                Hamidreza.FollowComment"

Answer: "1Thank you for the response; my problem has been resolved.CommentShareHamidrezaanswered 4 months ago0Accepted AnswerYou did the right thing by issuing a Support ticket. Wait for their answer and I am sure they ll be able to help and do the exam without issues, hope it helps.CommentShareEXPERTalatechanswered 4 months ago"


Question: Lightsail with 32 GB running is running slow. Sometimes goes down

"I have a lightsail server 35.178.93.78 running my business critical application. I'm very much frustrated about its performance. Everyday around 11 PM at night(IST) application hosted here becomes unresponsive and sometimes it goes down. Whenever I'm running any video kept on server, it is taking 30-45 minutes to get buffered. This is so frustrating. The lightsail server has such a high configuration with disappointing performance. Interesting fact is I have a same application hosted in just host with very lower configuration but giving me better performance.FollowComment"

Answer: "0Thanks for using Lightsail!Have you looked at the "Metrics" tab to see what's going on with the underlying hardware? It's possible that you are running out of resources.If you need further help, please contact Customer Support and cut us a ticket and Lightsail engineer can help investigate the issue in detail.CommentShareYiran-AT-AWSanswered a year ago"


Question: VMware HCX between two VMware Cloud on AWS SDDCs

"I am working with a partner that is having some difficulties setting up a test on-prem vSphere environment where they can test VMware HCX capabilities with VMware Cloud on AWS.While that is being sorted out internally within their teams, other options to provide such an environment are being considered. Can another VMware Cloud on AWS SDDC be simulated to be an on-prem environment? As HCX is included with VMware Cloud on AWS, can you run a VPN between two VMC SDDCs and use HCX to perform migration?I understand that the process of setting up HCX in an on-prem vSphere environment is completely different. But I'd still like to know if this is technically possible or not.FollowComment"

Answer: "2Accepted AnswerThat's correct, you can run HCX from SDDC to SDDC via a VPN connection. The configuration is slightly different as you no longer download the OVF from the target. By simply adding the HCX service on both the source and the target, the HCX components are deployed along with the Network and Compute profiles. Just make sure that the firewall ports for HCX are allowed out of the management gateway then you can go ahead and create the site pairing along with Service Mesh.CommentShareAWS-User-4515914answered 3 years ago"


Question: Ground Truth Job Validation post completion

"We annotated 10 pdf files in Ground Truth, how do I validate the annotations done by the team ?Do we have any metrics ?  Is there a way to get summary of daily task completion details ?Some example data that I want to get is Number of documents labelled everyday, the count of documents annotated by each person every day.This metric is very important to track the progress and make a follow up.Can Ground truth experts provide some insights in this ?FollowCommentialuronico 6 months agoCan you tell more about this task? What are you labelling in the PDFs? Each PDF has a label? You are labelling sentences in the PDFs?ShareNavin GV 5 months agoI am labelling the entities (our use case specific entities) present in the PDFShareialuronico 5 months agoFrom here https://github.com/aws-samples/aws-sagemaker-ground-truth-recipe/blob/master/aws_sagemaker_ground_truth_sample_lambda/annotation_consolidation_lambda.py it seems that you can only get the worker ID at the moment. I don't know if you could add a timestamp for each annotation by modifying a custom template https://docs.amazonaws.cn/en_us/sagemaker/latest/dg/sms-custom-templates-step3.html But this might be complicatedShare"

Answer: "0This is a machine learning problem and goes beyond AWS Ground Truth.Usually you do not get to measure how confident each annotation is, unless you asked the annotators to say how confident they are on each annotation.Usually you have to provide some gold standard annotations that you think are correct. You do this on some sample PDFs that you annotated yourself. Then you check the performance of each annotator on your set. You can compute metrics such as Cohen's Kappa to assess agreement between annotators: https://en.wikipedia.org/wiki/Cohen%27s_kappaCommentShareialuronicoanswered 6 months agoNavin GV 5 months agoSorry for not giving clarity in the question. I actually want the work completion status. Is there a way to get summary of daily task completion details ?  Some example data that I want to get is Number of documents labelled everyday, the count of documents annotated by each person every day.This metric is very important to track the progress and make a follow up.(I made an edit in the question) Thanks.Share"


Question: How to upload a file as multipart form data to a lambda for processing ?

"I have an HTTP API in API Gateway that calls to a lambda function to process a file. As of now I have followed below steps to achieve this.Created a lambda function for file processing.Created an API proxying the lambda in 1. Since lambda proxy integration is used lambda function receives the file as a base64 encoded string in the event body.Inside the lambda I decode the body content, apply required processing and send the result back.I need to know whether there is an easier way to do this without having to decode the file content inside the lambda ? Like in normal JAVA rest application we receive the multipart content as an input stream.FollowComment"

Answer: "1Accepted AnswerLambda receives a JSON event object, as such, you must encode binary data before including it in the JSON and passing it to Lambda.CommentShareEXPERTUrianswered 6 days ago"


Question: AWS SLES 12 Image -> Upgrade to SLE15 not possible

"Since mid-August it seems that it's no longer possible to migrate from SUSE SLE12-SP5 to SLES 15.After successful zypper in suse-migration-sle15-activation and with the start of run_migration on the console. After a short time the following message appears in the log in /system-root/var/log/distro_migration.log***Executing 'zypper --root /system-root --non-interactive --gpg-auto-import-keys refresh'.Error retrieving metadata for 'SLE-Module-Adv-Systems-Management12-Pool':Not ready to read within timeout.Skipping repository 'SLE-Module-Adv-Systems-Management12-Pool' because of the above error.***The message applies on all repos and is independent of the AWS account and various Securtiy groups, VPC and Network ACLs etc.Also tested in a new account including with a new base images "SUSE Linux Enterprise Server 12" exactly this message appears again.  It seems that something has been changed on the AWS side regarding the access of the SUSE SLES repositories.Is this problem already known ? Is there any solution for this ?Thanks for any feedback.FollowCommentAWS-User-2560483 9 months agoEven I am facing the same issue, any update on this?Share"

Answer: "1There is a known issue where using cloud-regionsrv-client-10.x version that breaks Distribution Migration System.SUSE has published the following knowledge base article with a workaroundhttps://www.suse.com/support/kb/doc/?id=000020748CommentSharerePost-User-3645086answered 9 months agoAWS-User-2560483 9 months agoAfter following the provided article, we are still facing the issue with below errors in the log file /system-root/var/log/distro_migration.log :Running suse-migration-pre-checks with options: fix: FalseCalling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-label/ROOT']Calling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-uuid/fe69830e-def4-45d7-856e-4a1abc6fc792']Calling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-uuid/b7bbd4b5-81ee-4cf9-b80f-048dd3eb6085']Calling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-uuid/b9459393-776b-473c-bc7a-7d17de295a6d']Calling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-uuid/f7cf5298-1a20-4a79-8b22-546b0c44176b']Calling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-uuid/242dbaba-e687-48ea-99fb-3b5f905123da']Calling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-uuid/aef286fb-4fb0-4e47-a2cd-f2bc31af7d03']Calling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-uuid/19456e98-c7da-4591-b295-e0fc297179f4']Calling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-uuid/03eefbc1-b95f-4125-a7bc-83034bff48ae']Please suggestSharerePost-User-1541962 9 months agoHi,the workaround from suse https://www.suse.com/support/kb/doc/?id=000020748 works fine.So thank you very much it was a great helpI wish you all the best and see you ;-)Regards Klaus HShareAWS-User-2560483 9 months agoAnd further logs from the file "/var/log/distro_migration.log" are :Calling: ['systemctl', 'stop', 'suse-migration-console-log']Umounting systemCalling: ['umount', '--lazy', '/usr/lib/zypp/plugins/services']Umounting /usr/lib/zypp/plugins/services: command(output='', error='', returncode=0)Calling: ['umount', '--lazy', '/system-root/usr/sap/trans']Umounting /system-root/usr/sap/trans: command(output='', error='', returncode=0)Calling: ['umount', '--lazy', '/system-root/sybase/GFP/saplog_1']Umounting /system-root/sybase/GFP/saplog_1: command(output='', error='', returncode=0)Calling: ['umount', '--lazy', '/system-root/sybase/GFP/sapdata_1']Umounting /system-root/sybase/GFP/sapdata_1: command(output='', error='', returncode=0)Calling: ['umount', '--lazy', '/etc/sysconfig/network/providers']Umounting /etc/sysconfig/network/providers: command(output='', error='', returncode=0)Calling: ['umount', '--lazy', '/system-root/usr/sap']Umounting /system-root/usr/sap: command(output='', error='', returncode=0)Calling: ['umount', '--lazy', '/system-root/sybase/GFP']Umounting /system-root/sybase/GFP: command(output='', error='', returncode=0)Calling: ['umount', '--lazy', '/system-root/sapmnt/GFP']Umounting /system-root/sapmnt/GFP: command(output='', error='', returncode=0)Calling: ['umount', '--lazy', '/system-root/tmp']Umounting /system-root/tmp: command(output='', error='', returncode=0)Calling: ['umount', '--lazy', '/system-root/proc']Umounting /system-root/procShare"


Question: "Additional Verification Required" when requesting ACM Certificate

"We have tried requesting for ACM certificates however they just seem be waiting for "Pending Validation" despite we using the DNS method to authenticate and the relevant CNAME being added directly to the DNS of the domain within S3 services.Check attached screenshot!, wherein we can directly create CNAME records within Route 63Please help!FollowCommentBard Lan 3 months agoCould you use nslookup thru shell/cli console to check if the CNAME name and value are configured successfully and correctly?e.g. nslookup [Record Name]Resp: [CName name]canonical name = [CNAME value with a '.' behind].Shareskinsman EXPERT3 months ago@Sportobuddy that sounds right at a high level, but what do you mean "within S3 services"?ShareSportobuddy 3 months agoCNAME records added directly from the ACM console (as domain is also registered with AMAZON S3)Share"

Answer: "1Accepted AnswerIn addition to the above answer, I would like to add this below:$whois sportobuddy.com | grep 'Name Server'I have found your "sportobuddy.com" has four name server with a company other than AWS. In your Route 53 hosted zone, edit NS record, copy all the name servers of record 'NS" of Route 53 and paste those in the other DNS provider Name Server's record, save those, wait a few minute and try agin with ACM.Option two:I do understand you have domain name registered with Route 53. Go to Route 53 Dashboard, choose your doamin (sportobuddy.com). On the top right corner, you will see "Add or edit name servers". Follow the previous instructions to edit the name servers.But it is better, delete ACM's previous certificate even though it was not validated. Please advise the update.CommentSharerePost-User-7136343answered 3 months agoSportobuddy 3 months agoThanks for pointing out the issues and now i have resolved the same successfully.Share0Looking at your DNS records with dig, it looks like your nameservers are outside AWS i.e. not pointing at Route53. This means that when ACM queries DNS it's looking at your existing DNS data, and not that in Route53 so it can't see the validation details.You'll either need to copy the records from Route53 to your DNS configuration or tell your DNS configuration to use Route53.CommentShareSimon Hanmeranswered 3 months agoSportobuddy 3 months agoThanks for pointing out the issues and now i have resolved the same successfully.Share"


Question: Keyspaces max WCU for partition when deleting data with queries

"Suppose I have table that are storing records of size 100KB each. I would like to remove these records with DELETE query.Does max WCU for partition equal 1000 WCU/second apply to DELETE? So I can remove 10 objects per second if they are in same partition?If so, how to approach to rate limiting this if I don't know size of rows stored in table. Should I move towards retrying operations with long pausing between?FollowComment"

Answer: "0Hello,Firstly, Amazon Keyspaces charges you for the reads and writes that you perform on your tables in terms of read request units (RRUs) and write request units (WRUs). [1]Secondly, one WRU represents one write for a row up to 1 KB in size. If you need to write a row that is larger than 1 KB, the write operation uses additional WRUs. The total number of WRUs required depends on the row size. For example, if your row size is 2 KB, you require 2 WRUs to perform one write request. Also, one WCU represents one write per second for a row up to 1 KB in size. If you need to write a row that is larger than 1 KB, the write operation uses additional WCUs.The gist here is that the delete operations are considered write operations so they will consume WriteRequestUnits (WRUs) for On-Demand tables and WriteCapacityUnits (WCUs) for Provisioned tables. Hence, a record of 100 KB will require 100 WCU to sustain 1 write request per second.In regards to partition (which have a throughput limit of 3,000 RCUs or 1,000 WCUs), if all the 100 KB records were stored on a single partition, you could delete 10 records per second, consuming 1000 WCU per second and not exceed the partition limit.Additionally, please refer to the following documentation [2][3] for understanding rate limit approaches.Please let us know if this resolves your issue. If you need assistance with further troubleshooting, please open a support case and we'll be glad to assist!References:[1] https://docs.aws.amazon.com/keyspaces/latest/devguide/ReadWriteCapacityMode.html[2] https://docs.aws.amazon.com/keyspaces/latest/devguide/autoscaling.html[3] https://docs.aws.amazon.com/keyspaces/latest/devguide/data-modeling.htmlCommentShareSUPPORT ENGINEERYash_Canswered 8 months ago"


Question: "When implementing envelope encryption with AWS KMS, is it desirable to generate a data key every time the server restarts? Which cycle would you prefer?"

"Let me explain my current situationWe will implement envelope encryption utilizing aws kms.Save the data to the db in the format of "encrypted data key + encrypted text".The validity period of the data key is 2 years, and data must be re-encrypted with a new data key immediately before expiration.The generated encrypted datakey cannot be stored alone in db but able above form.I want to store the generated data key in the cache and retrieve it.Question: Is there any way to know the datakey used just before when the server restarts without saving it to the db? There doesn't seem to be an API for querying data keys. Generating a new key every time the server restarts complicates the logic when re-encrypting the data key later (I'm not sure).However, I don't want to use other aws services (e.g. S3). If I need to use it, I want to save it to the vault I was using. However, I don't want to use this method as it seems to create dependencies on other services.However, retrieving the "encrypted data key + encrypted text" value from the db to retrieve the plaintext key for kms with the encrypted data key seems too legacy.However, if the datakey is created every time the server is restarted, I don't think there is a need to process it first... How about doing it this way...-> This method seems to create difficult rencrpytion logic, but I'm willing to do it if this is best practice.What are the best practices..?FollowComment"

Answer: "0Not sure I understand the scenario completely, but data keys are usually long lasting, and do not need to be rotated unless there's a data breach and you need to manually re-encrypt data.Key rotation means that the data key is decrypted using the old KMS key and then re-encrypted with a new KS key. Data keys should be stored in a persistent store, even if they are not stored with the encrypted data itself.CommentShareTushar Aanswered a month agorePost-User-5140398 a month agoThank you for answering. By national law, it must be rotated every two years and then destroyed. We are also considering a storage like vault because we can't even store it in our own db for the same reason.That's why I don't want to create a lot of data keys, so I try to use generatedDatakey once every two years.So, without these constraints, what best practice would be to know when to use generateDataKey?it sounds like you could use generateDataKey virtually infinitely.Share"


Question: Couldn't see the PKCS#11 .so file to access AWS Cloud HSM (Client SDK5) using Java

"Hi,I have installed the AWS PKCS#11 library from on Ubuntu. When I search for the PKCS#11 .so file inside /opt/cloudhsm I couldn't see any. The only set of .h files I see is: /opt/cloudhsm/include/pkcs11 Normally PKCS#11 implementations for an HSM comes with a .dll or .so file which can easily be configured in Java based crypto provides like IAIK. Isn't the PKCS#11 implementation provided or is there a way to compile and make one? I already have a Java application which support PKCS#11 integration hence this will save effort integrating with AWS Cloud HSM. If not then the only option would be to use AWS JCE Provider.Ref: https://docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-library-install.htmlFollowComment"


Question: Which redirect URI should I use when creating a QuickBooks flow on AppFlow?

"HelloI need to create a flow in AppFlow using the Quickbooks connector. After I enter the ID, Secret, URL and CompanyId I get the following error (for now I'm using the sandbox enviroment, not production):"The redirect_uri query parameter value is invalid. Make sure it is listed in the Redirect URIs section on your app's keys tab and matches it exactly. Click here to learn more about the redirect_uri query parameter."After looking up in the QuickBooks Documentation, looks like I need to set a special URI that belongs to the connector (Postman in their example), but I don't know which one should I use with Amazon AppFlow. This Redirect URI is entered in the Settings of the QuicbkBooks app (not in AWS of course).I tried adding the following ones in the QuickBooks Redirect URI settings, but the same error appears:"https://us-east-1.console.aws.amazon.com/appflow/oauth""https://developer.intuit.com/v2/OAuth2Playground/RedirectUrl""http://localhost""https://sandbox-quickbooks.api.intuit.com/v2/OAuth2Playground/RedirectUrl"FollowComment"