Question: CodeCatalyst and java based maven CDK project

"Hi everyoneI am trying to move a project to CodeCatalyst that is using CDK for Infrastructure as code and Java as a CDK language. Maven is used as a build tool.The project structure is like this:.cdk-infrastructure--. cdk.jsonlambda-codewebsite-code-. cdk.jsonProblem 1)As the CDK deploy action is not able to execute "cdk deploy" in a sub-folder, I've changed my cdk.json in the root folder to include a directory change:{  "app": "cd mpaga-web-infrastructure; mvn -e -q compile exec:java",  "context": {    "@aws-cdk/core:enableStackNameDuplicates": "true",    "aws-cdk:enableDiffNoFail": "true",    "@aws-cdk/core:stackRelativeExports": "true",    "profile" :"mpaga"  }}Ask: Can we please getn option to pass the "execution directory" for the cdk-deploy (and synth) action?Problem 2)As I did that, the project started to execute and build but failed at the first CDK step with the following error:Do you have an idea on what the root cause for problem #2 could be?If I execute a normal build on CodePipelines (using CDK pipelines) it just works....ThanksJohannesFollowComment"

Answer: "1Accepted AnswerThe solution to your Problem 1 is in production now. The field you can use to specify the directory of your CDK stack/app is CdkRootPath. You can just provide the relative path to the cdk folder for this field. Let me know if that works for you!CommentShareMODERATORAWS-Anaanswered 6 months agoLockhead 6 months agoThanks for getting back to me Ana, thats great. I was able to test this.Is there a chance to somewhere see the changes going into CodeCatalyst at least for this preview time?Share0Hi Johannes - We're so sorry you ran into some issues during the preview. I've checked with our team and they're working on your request/solution for Problem 1, it should be available in the next few days, and I can comment again when it's available for you to use.For Problem 2,  the CDK action executes what is specified in the "app" key , so in this case: cd mpaga-web-infrastructure; mvn -e -q compile exec:java. It's trying to execute mvn -e -q compile exec:java and failing. The error seems to say that mvn could not find the required dependency software.amazon.awscdk.core in the public maven repo, so we think it is a dependency issue in the project.Try to execute this command locally cd mpaga-web-infrastructure; mvn -e -q compile exec:java and see if you get more information on what the problem is. If it works locally, you can try to execute cd mpaga-web-infrastructure; ls -a;  mvn -e -q compile exec:java (includes the ls -a) in CodeCatalyst and it will give you more informationCommentShareMODERATORAWS-Anaanswered 6 months agoLockhead 6 months agoHi there, thanks for the great and detailed answer. Would be glad if you could get back to me once the change for 1 is deployed.You are correct, I copy/pasted a wrong pom.xml and had a wrong version for the dependencies. I've fixed that, but I am now facing the next problem:2022-12-03T22:34:14.3825655Z [22:34:14] Reading cached notices from /root/.cdk/cache/notices.json2022-12-03T22:34:14.3958505Z2022-12-03T22:34:14.3958851Z [22:34:14] Error: ENOENT: no such file or directory, open 'cdk.out/manifest.json'2022-12-03T22:34:14.3958984Z     at Object.openSync (node:fs:590:3)ShareLockhead 6 months agoThis problem seems to be related to problem#1, I am trying to workaround it with creating the folder manually....lets see...Share0Sorry for the delay. For the last problem you mentioned, When the CDK synthesizes a template, it copies the artifacts under the cdk.out directory. Based on what you are experiencing, this would suggest that your CDK synth is failing for some reason. It could be that your bin/app.ts file is not initializing the stack in your CDK code, example:const app = new cdk.App();new MyStack(app, 'MyStack');or one of many other reasons listed out on GitHub in the aws-cdk issues resources on GitHub. I would suggest checking there for other possible reasons as there are a few that are similar to what you have shared but it's hard for me to see if any of those would solve your problem. Let me know if you figure it out and I'll respond when we have the fix in place for Problem 1CommentShareMODERATORAWS-Anaanswered 6 months agoLockhead 6 months agoHi Anathanks for getting back to me - I've verified that "cdk synth" works locally (I am using a CDK for Java)...If've changed my cdk.json to be "app": "ls -al; cd mpaga-web-infrastructure; ls -la; whoami; ls -al cdk.out;mvn -e -q compile exec:java",and I can see that the cdk.out folder exists and the stacks have been created - but when it tries to do the deploy after the synth it refers to the cdk.out directory in the root and not in my sub-folder....I'll wait for problem1 solution and then hope that it gets resolved with that? ;)JohannesShareLockhead 6 months agothe cdk deploy action now works with this cdk.json:{"app": "ls -al; cd mpaga-web-infrastructure; ls -la; whoami; ls -al cdk.out;mvn -e -q compile exec:java; cp -r cdk.out/* ../cdk.out","context": {"aws-cdk:enableDiffNoFail": "true","@aws-cdk/core:stackRelativeExports": "true","profile" :"mpaga"}}Share"


Question: Cant able to connect elb to route 53

"Hi team,i bought domain amazon jeevanresume.link but when i trying to access its not working even i mapped ELB to rout53 domain by creating records is anything i should do after buying domainother than email confirmationFollowComment"

Answer: 0Accepted AnswerLooks like you need to add NS records to the hosted zone. Pull those from a 'whois' of your domain name.CommentShareEXPERTkentradanswered a year agosai a year agoi did when i creating hosted zones even i can see both NS and SOA then i created records even my domain is verifiedSharesai a year agoHi kentrad could you please tell me how to do that still iam facing the issueShare


Question: How to add correct permissions to create image collection?

I setup a user in sagemaker.Added role permissions.Executed python code snippet to create collection.An error occurred (AccessDeniedException) when calling the CreateCollection operation: User: arn:aws:sts::767317008127:assumed-role/AmazonSageMaker-ExecutionRole-20200713T124931/SageMaker is not authorized to perform: rekognition:CreateCollection on resource: arn:aws:rekognition:us-east-1:767317008127:collection/testive triedTo add role policy to userRecreate user in sagemakerIm able to create s3 bucket through portal under user idneed some help getting unstuck.FollowComment

Answer: "0Hi jklacy@,Thank you for your interest in Rekognition. In your role policy that you added to your user, did it contain the "rekognition:CreateCollection" action? (See [1] and [2] for an in depth view) This action (or a broader action "rekognition:*") will be necessary in order for your user to be able to create a Rekognition collection.[1] https://docs.aws.amazon.com/rekognition/latest/dg/security_iam_service-with-iam.html[2] https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonrekognition.htmlCommentShareseanfAWSanswered 3 years ago"


Question: HIVE_CANNOT_OPEN_SPLIT:  can not read class org.apache.parquet.format.ColumnIndex

"HI I have a paquet file which I am trying to read in Athena but is giving below error:SELECT * FROM "xxx_db"."bot_info" where bot_alias='test_bot';HIVE_CANNOT_OPEN_SPLIT: Error opening Hive split s3://xxxxxx/xxxxxx/test_bot.parquet (offset=0, length=1198): java.io.IOException: can not read class org.apache.parquet.format.ColumnIndex: Required field 'null_pages' was not present! Struct: ColumnIndex(null_pages:null, min_values:[74 65 73 74 5F 62 6F 74], max_values:[74 65 73 74 5F 62 6F 74], boundary_order:null)But when I try query SELECT * FROM "xxx_db"."bot_info" limit 10. It works totally fine.FollowComment"

Answer: "0Greetings from AWS!The error message indicates that the parquet file s3://xxxxxx/xxxxxx/test_bot.parquet contains records that mismatch the table schema because "field 'null_pages' was not present". It is possible that "SELECT * FROM "xxx_db"."bot_info" limit 10." works because with LIMIT 10, the query does not scan the whole dataset and only return first 10 records (randomly) from the dataset. On the other hand, when ran "SELECT * FROM "xxx_db"."bot_info" where bot_alias='test_bot';" the query needs to scan the whole table (or partition), and such gave the error when it scanned the problematic records which don't match the table schema.In order to fix this issue, I'd suggest you to download and double check the schema of the parquet files s3://xxxxxx/xxxxxx/test_bot.parquet with "parquet-tools" an open source command line tool provided by Apache, and ensure the table schema and files match with each other. I hope this information helps!CommentShareEthan_Hanswered 3 months ago"


Question: Cancel Savings Plans

"We purchased the Savings Plans mistakenly and contacted customer support as soon as we saw the charge.What are the steps to process the refund? I don't see any option to cancel the plan. Happy to provide the created case Id.We are an early-stage company, and the charge is too expensive for us at this moment.Looking forward to hearing soon!FollowComment"

Answer: 0I don't think there is a refund policy. But it is likely that Amazon will consider your request as you did it in error but keep in mind that backing out is something not encouraged. There can be one off however. Reach out to support and raise a ticket and see for yourself. Good luck.CommentShareSandeepVudataanswered a year ago


Question: Can AWS Fault injection simulator used for AZ failure simulation?

"Aware that AWS FIS works with ECS, EKS, RDS, EC2. But is it possible to use AWS FIS to simulate a complete zone level failure?Does FIS support API gateway related failure injections?Kindly help me with the details.FollowComment"

Answer: "1As of today, AWS Fault Injection Simulator does not support complete Availability Zone failure or API Gateway failure.These feature requests have been passed to the FIS team and will be reviewed.CommentShareEXPERTChris_Ganswered a year ago1AZ failures are much more complicated than they seem on the surface. AWS Fault Injection Simulator can be used to simulate outages that affect your infrastructure in ways that are similar to the way a real AZ outage might. However, this requires a clear understanding of how the control plane and data plane for your service will react to a failure. See this blog post and this workshop for some additional details.CommentSharerudpotanswered 10 months ago"


Question: Private IP changed for Load Balancer

"Hi folks,we experienced with a problem - private IP changed for Load Balancer, docs says it shouldn't change during LB lifetime:https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.htmlThese private IP addresses provide your load balancer with static IP addresses that will not change during the life of the load balancer.We saw this today, our production version has broken, it's very bad. Question to AWS specialists - how could it be? And how often to expect such undocumented behavior?DmitryFollowCommentalatech EXPERT2 months agoHave you redeployed/reprovisioned it with different info?ShareAndreas Seemueller EXPERT2 months agoHi Dmitry,I would not expect this behavior at all. Do you have AWS config activated in your account? Can you verify in the configuration timeline that this modification was indeed induced by the service?ShareDmitry a month ago@alatech, no we haven't redeployed/reprovisioned anything.ShareDmitry a month agoHi Andreas,thanks for your reply. No, we haven't enabled AWS Config, it seems it might help, I tried it, I selected AWS EC2 NetworkInterface as a target resource, but I have stuck on choosing AWS Managed Rules for it - the urls looks strange and not relevant on what we need to track - we need to track address change, but all rules are bout checking dropping HTTP headers, checking SSL certificates etc. How I should correctly set this up to catch this type of change (IP change)?Thanks,DmitryShare"

Answer: "1Accepted AnswerThe IPs from the printscreen belongs an Application Load Balancer (ALB), at least the filter it is using.ALB doesn't have static IPs, like Network Load Balancer (NLB).Network Interfaces for NLB will have a description with pattern "ELB net/xxxxxxxxxxxxxx"Network Interfaces for ALB will have a description with pattern "ELB app/xxxxxxxxxxxxxx"CommentShareLeonardo Azizeanswered a month agoDmitry a month agoHi Leonardo!thanks for your reply and explanation! It is helpful! :)We had a problem that target server standing behind this LB haven't got a traffic because firewall rules disallowed new IP. We solved it by changing a rule from type of IP to type of Security group. Security group is static.Best,DmitryShare"


Question: Aws-sdk UpdateSecret doesn't work to update secrets

"I have the following code to update a secret in Secrets Manager service. This code is inside a Lambda Function with the following permissions: UpdateSecret, PutSecretValue, UpdateSecretVersionStage and GetSecretValue. When I run the lambda function, I receive no errors, but still my secrets doesn't change. What is the problem? Can I work it around with API request? How?  const { SecretsManager } = require('aws-sdk');  // function to update secret  const secrets = { API_KEY: newValue }  SecretsClient = new SecretsManager({ region: REGION });  const allSecrets = await getAllSecrets();  const updatedSecretsJson = {    ...allSecrets,    ...secrets  };  const updatedSecrets = JSON.stringify(updatedSecretsJson);  await SecretsClient.putSecretValue({ SecretId: SECRET_ID, SecretString: updatedSecrets })Also tried:Also, I've tried giving my lambda function all Secrets Manager permission.The only ways I could update my secrets were by AWS Console and AWS CLI.FollowComment"


Question: Best setup to broadcast live stream (video+chat) from webcam

"I'm looking to build out web-based live streaming capabilities & video chat client for my application, similar to the twitch but not as heavy or highly trafficked. While I've looked at some of the many services offered by AWS, there's just so many (MediaLive, IVS, Kinesis etc) that it's hard to know which service or combo of services would be the best fit and so I'm looking for some general guidance from anyone who has experience setting this up, or if there are existing guides that may be of help.In general, here are my requirementsBroadcasters should be able to broadcast via their webcam/media device in the browser (ie. via getUserMedia)Broadcasts will be 1 to many, with only the broadcaster streaming video and likely an average of 20-30 audience members consuming the streamAudience members would use a separate front end client, which should also be web basedI would like to be able to include a user/chat function, so that users can chat globally, thus will need live 2-way data stream capabilities, but not sure if this is best handled by the media streaming service itself, web sockets, WebRTC etcI could possibly utilize existing JS libraries to capture media as well as a viewing/chat application or even develop my own, but I'm also wondering if there are AWS recommended JS libraries or guides that can aid in this as well.hope someone can help me get started, thanks!FollowComment"

Answer: "2I'd recommend giving the Amazon Interactive Video Service (IVS) a try to see if it meets your needs. The other services you mentioned are lower-level building blocks that could be used to create such a streaming service, but would require a lot of heavy lifting from you to implement all the functionality that IVS already provides. IVS is meant to be a more complete, turn-key solution. (A "managed" solution in AWS lingo.)If you haven't already, check out the examples on ivs.rocks. The "Simple Chat" example in particular seems relevant to what you described. You can download the source code for that example from GitHub (linked further down the page).CommentShareKrisanswered a year ago"


Question: FTP - transfer family setup

"Hi, I would like to host ftp server using transfer family.Able to create a server and do a test. Now, I am trying to test it from FileZilla.Where do I find the host name?FollowComment"

Answer: 1Did you create your AWS Transfer Family server inside a VPC or as a public endpoint? Can you please take a look at one of my recent answers for another customer - https://repost.aws/questions/QU6AqEnaDmSTa5WBBt776d3w/connect-to-an-internal-sftp-server-from-outside-private-vpc-on-prem#ANX7atpx3iSJK6ssIcY4hpUwCommentShareEXPERTIndranil Banerjee AWSanswered 8 months agoEXPERTChris_Greviewed 8 months ago


Question: Potential bug with ST_INTERSECTS and handling of Well Known Binary geometry

"Hi,SYSTEM SETUP:Amazon Redshift dc2.large 1 node at cluster version 1.0.27085 in the Ohio region (us-east-2)USE CASE:When working with the ST_INTERSECTS spatial function, I found a weird behavior. I am passing the same shape as both arguments. When I pass them in as WKBs, the function shows that there are no intersections (1), but when I pass the same shape as WKTs, I get the return value as is expected from ST_INTERSECTS (2)select ST_INTERSECTS( ST_GEOMFROMWKB('010300000001000000050000000000000000003E4000000000000024400000000000004440000000000000444000000000000034400000000000004440000000000000244000000000000034400000000000003E400000000000002440', 4326), ST_GEOMFROMWKB('010300000001000000050000000000000000003E4000000000000024400000000000004440000000000000444000000000000034400000000000004440000000000000244000000000000034400000000000003E400000000000002440', 4326));                                                                               (1)Result:   Falseselect ST_INTERSECTS(ST_GEOMFROMTEXT('POLYGON((30 10,40 40,20 40,10 20,30 10))', 4326), ST_GEOMFROMTEXT('POLYGON((30 10,40 40,20 40,10 20,30 10))', 4326));                                                 (2)Result:   TrueUpon further analysis, I found that taking the geometry shape as a WKB, converting that into text and back into geometry also works as expected only if the other shape is also converted from text (3) (4).select ST_INTERSECTS(  ST_GEOMFROMTEXT(ST_ASTEXT(ST_GEOMFROMWKB('010300000001000000050000000000000000003E4000000000000024400000000000004440000000000000444000000000000034400000000000004440000000000000244000000000000034400000000000003E400000000000002440', 4326)),4326), ST_GEOMFROMTEXT('POLYGON((30 10,40 40,20 40,10 20,30 10))', 4326));                                                 (3)Result:   Trueselect ST_INTERSECTS(  ST_GEOMFROMTEXT(ST_ASTEXT(ST_GEOMFROMWKB('010300000001000000050000000000000000003E4000000000000024400000000000004440000000000000444000000000000034400000000000004440000000000000244000000000000034400000000000003E400000000000002440', 4326)),4326), ST_GEOMFROMWKB('010300000001000000050000000000000000003E4000000000000024400000000000004440000000000000444000000000000034400000000000004440000000000000244000000000000034400000000000003E400000000000002440', 4326));                                                                                (4)Result:   FalseWhen I do the same check with EWKBs, it seems to work fine (5) suggesting a potential bug with the WKB internal handlingselect ST_INTERSECTS(ST_GEOMFROMEWKB('0103000020E610000001000000050000000000000000003E4000000000000024400000000000004440000000000000444000000000000034400000000000004440000000000000244000000000000034400000000000003E400000000000002440'), ST_GEOMFROMEWKB('0103000020E610000001000000050000000000000000003E4000000000000024400000000000004440000000000000444000000000000034400000000000004440000000000000244000000000000034400000000000003E400000000000002440'));                                                                               (5)Result:   TrueNOTE: Performing inserts to geometry column tables using ST_GEOMFROMWKB seems to work fine, and the geometry is good when read back out.FollowComment"

Answer: 0Hi NChokshiWe’ve identified and fixed the issue. We will post an update to this thread once the fix is rolled out.Thank you for bringing this to our attention.BestHinnerkCommentShareHinnerk-AWSanswered 2 years ago0The fix is deployed with version 1.0.28043 and higherBestHinnerkCommentShareAWS-User-8494252answered 2 years ago0FixedCommentShareNChokshianswered 2 years ago


Question: Enabling Anti-Virus on an S3 Bucket

"Hi, users will be uploading zip files to my S3 bucket directly through my website shop.To ensure security I would need 2 things from AWS.Anti virus scan for the uploaded zip files, if a detection occurs than we'd need to collect relevant incident details, ensure the file has no way to interact with anything and remove it completely.complete separation of the files on storage, that means that even if a file is corrupted and it somehow passed the anti-virus from step one than it will not be able to spread anywhere cause its will be contained in its own box.Are this possible? if yes how can I start?Does AWS provide a scanner or do I need to purchase those from a 3rd party?FollowComment"

Answer: 1Hi thereThere isn't a managed service from AWS for S3 AntiVirus.  However take a look at this previous re:post answer for some ideas.  There are a few options on the AWS marketplace or you can build your own.https://repost.aws/questions/QU-AQ_-MzFRsuSSBQC1W8KCw/how-to-exacute-virus-scan-before-uploading-the-file-to-the-s-3-bucketHere are a couple of blog posts that cover how to do this:Integrating Amazon S3 Virus Scanning into Your Application Workflow with Cloud Storage Security Amazon S3 Malware Scanning Using Trend Micro Cloud One and AWS Security HubVirus scan S3 buckets with a serverless ClamAV based CDK constructCommentShareEXPERTMatt-Banswered 8 months ago


Question: How to influence deploy behaviour in single-instance single-container env

"Hi,The scenario is that we have an app (YouTrack) running in a single Docker container on a single-instance EB environment. The app keeps its state in a mounted EFS filesystem. In trying to upgrade to the next version of the app, the deploy fails with an exit code of 1 for the container and a "YouTrack is already running" error message.It appears that:EB uploads the new container to the instance and attempts to start it.While starting up, the new version finds that some of the filesystem resources are in use by the still-running old container.It quits with the above error and the deploy fails.I've read somewhere (but not 100% sure) that this is expected behaviour - that the old container is left running while the new one is started, and then the two are switched.How can I prevent that happening? Is there something about the deploy configuration I can change that will cause EB to stop the old container, wait for it to exit, and only then start the new one?(Have tried ssh'ing into the instance and killing the old container manually, but something apparently outside Docker itself is instantly restarting it every time)FollowComment"

Answer: "0Solved the issue - the key was to run "sudo stop eb-docker" on the EB instance before the deploy - that stopped the old container, prevented the locking issue, and all went ahead ok.CommentSharejlmtanswered 3 years ago"


Question: CIDR for VPC creation on below use case

"I am new on AWS, Could someone have to verify it?Create a VPC that should be able to accommodate 20000 IPsThe network should be further subdivided into 8 Sub Networks, across 2 Availability Zones2 Public Subnets ( 100 IPs every subnet)2 Private Application Subnets ( 2000 IPs each subnet)2 Private Database Subnets (500 IPs each subnet)2 Private Middleware Subnets (1000 IPs each subnet)Please suggest the correct CIDR. Could you please verify the attached diagram or let me is there any issue with that.Appreciate your efforts.FollowComment"

Answer: "0You've calculated the CIDR ranges appropriately. However, that's a very large VPC. Having a lot of instances/containers in that VPC means a significantly large blast radius if things start to fail.You might consider splitting the public and private subnets across a third Availability Zone. In the model you have, in order to survive a catastrophic failure of an AZ you need to have 100% of the capacity in a single AZ (meaning that you need to have 200% of your available capacity running at any one time). If you are working across three AZs then you only need to have 50% in each AZ (150% of your available capacity). It's less expensive to run in three AZs than it is in two.Given the large scale at which you wish to operate I strongly recommend you reach out to your local AWS Solutions Architect to discuss this design.CommentShareEXPERTBrettski-AWSanswered 10 months agorePost-User-3745454 10 months agoThanks for brief explain and response,However /16 have lot of waste/extra IP, our requirement only 20000 across VCP. Then further subdivided into subnets as explained on main post. What is your thought for /17.ShareBrettski-AWS EXPERT10 months agoGiven that you're using private IP address space, whether you use a /16 or /17 is going to depend on your expansion plans in the future. If you need to expand the VPC to accommodate more resources then a /16 is good. If you are planning on using additional VPCs then a /17 is probably the right thing. Again, I would talk with your local Solutions Architect.Share"


Question: OpenSSH Last version in Amazon Linux 2

"Hi to all,I'm trying to update OpenSSH Server version in a Amazon Linux 2, to fix some vulnerabilities like CVE-2017-15906 and CVE-2020-15778.But, to fix it, I need the last version of OpenSSH server, which is 8.6. If I try to do "sudo yum update" and "sudo yum install openssh-server", the last version in the repositories are the 7.4p1.Anyone know the way to upgrade to the 8.6 version? Many thanks!FollowComment"

Answer: "0CVE-2017-15906 has been resolved as part of https://alas.aws.amazon.com/AL2/ALAS-2018-1042.html.https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15778 is disputed by the vendor, so no fix has been published for that yet.Amazon Linux 2 uses the same process originating from Red Hat Enterprise Linux for stable linux distributions where they do not perform major upgrades of software. They will backport the fixes and keep the same version numbers.CommentShareJimmyFitbuxanswered 2 years ago0Sorry, maybe i don't explain my problem clearly.My Vulnerability scanner detects and old version of OpenSSH (7.4). Therefore, associate this older version with this vulnerabilities. No detects explicitly the vulnerability, only de older version of OpenSSH.So I need to update OpenSSH, but Amazon Linux repositories are out of date. Is there any way to update to 8.6 version?I don't know how to add a new repository to fix this. Any tip?ThanksCommentSharemateogonzalezanswered 2 years ago"


Question: Sending Reublished MQTT data to DynamoDB table

"I have successfully republished data from my "lorawan/+/uplink" topic to my new topic "datashow". I am now trying send the data I extracted from the original topic to a DynamoDB. I created a rule named "SensorDB_rule" to select the data from the "datashow" topic and send it to a DynamoDB.The data I receive is listed below.{  "output": {    "DeviceID": "eui-70b3d57ed004c725",    "PayloadData": {      "Battery": 100,      "Sensor": -27.730278573288206,      "alt": 63.10,      "lat": 38.789196,      "lon": -77.073914,      "time": "18:52:43"    }  }}The rule SQL Statement is listed belowSELECT output.DeviceID as Device_ID, output.PayloadData.Battery as Battery, output.PayloadData.Sensor as Sensor, output.PayloadData.alt as Altitude, output.PayloadData.lat as Latitude, output.PayloadData.lon as Longitude, output.PayloadData.time as Time FROM 'datashow'I created a DynamoDB table named "SensorDB" and set "DeviceID" as my Partition Key and "time" as my Sort key. With both set to StringDeviceIDtimeI'm using the Default settings for my DB table. and created the tableBack in the "SensorDB_rule" I selected my table I just created ("SensorDB") and entered the followingPartition key- DeviceIDPartition key type- STRINGPartition key value- $DeviceIDSort Key- timeSort key type- STRINGSort key value- $timeand wrote the message to the column "MyMessageData"finally I created a new IAM role names "SensorDB_role" and attached the following permissionsAWSIoTLoggingAWSIoTRuleActionsAWSIoTEventsFullAccessAWSIoTFullAccessAmazonDynamoDBFullAccessI have double checked all my information but I am still not getting anything inside of my table. Any suggestions on how to fix this? (adding policies, correcting my SQL statement, changing my table settings)FollowComment"

Answer: "1The only thing different in my CLI was this   {                "republish": {                    "roleArn": "arn:aws:iam::795806302730:role/service-role/IoTRule_20220508_repost",                    "topic": "datashow",how do you create service roles?CommentShareAWS-User-6259931answered a year ago0This method worked fine. It appears that the JSON structure needs to be converted when republishing.(I don't know why.)Create republish ruleEntryValueruleNameRepublishsqlSELECT output.DeviceID as Device_ID, output.PayloadData.Battery as Battery, output.PayloadData.Sensor as Sensor, output.PayloadData.alt as Altitude, output.PayloadData.lat as Latitude, output.PayloadData.lon as Longitude, output.PayloadData.time as Time FROM 'lorawan/+/uplink'actionrepublishCreate insert to DynamoDB ruleEntryValueruleNameSensorDB_rulesqlSELECT * FROM 'datashow'actiondynamoDBDynamoDB tableNameSensorDBDynamoDB operationINSERTDynamoDB hashKeyFieldDeviceIDDynamoDB hashKeyValue${Device_ID}DynamoDB hashKeyTypeSTRINGDynamoDB rangeKeyFieldtimeDynamoDB rangeKeyValue${Time}DynamoDB rangeKeyTypeSTRINGDynamoDB payloadFieldpayloadThe results of the AWS CLI output are left as evidence.[cloudshell-user@ip-10-0-77-70 ~]$ aws iot list-topic-rules{    "rules": [        {            "ruleArn": "arn:aws:iot:ap-northeast-1:795806302730:rule/SensorDB_rule",            "ruleName": "SensorDB_rule",            "topicPattern": "datashow",            "createdAt": "2022-05-08T09:15:52+00:00",            "ruleDisabled": false        },        {            "ruleArn": "arn:aws:iot:ap-northeast-1:795806302730:rule/Republish",            "ruleName": "Republish",            "topicPattern": "lorawan/+/uplink",            "createdAt": "2022-05-08T09:14:50+00:00",            "ruleDisabled": false        }    ]}[cloudshell-user@ip-10-0-77-70 ~]$ aws iot get-topic-rule --rule-name SensorDB_rule{    "ruleArn": "arn:aws:iot:ap-northeast-1:795806302730:rule/SensorDB_rule",    "rule": {        "ruleName": "SensorDB_rule",        "sql": "SELECT * FROM 'datashow'",        "description": "",        "createdAt": "2022-05-08T09:15:52+00:00",        "actions": [            {                "dynamoDB": {                    "tableName": "SensorDB",                    "roleArn": "arn:aws:iam::795806302730:role/service-role/IoTRule_20220508_repost",                    "operation": "INSERT",                    "hashKeyField": "DeviceID",                    "hashKeyValue": "${Device_ID}",                    "hashKeyType": "STRING",                    "rangeKeyField": "time",                    "rangeKeyValue": "${Time}",                    "rangeKeyType": "STRING",                    "payloadField": "payload"                }            }        ],        "ruleDisabled": false,        "awsIotSqlVersion": "2016-03-23"    }}[cloudshell-user@ip-10-0-77-70 ~]$ aws iot get-topic-rule --rule-name Republish{    "ruleArn": "arn:aws:iot:ap-northeast-1:795806302730:rule/Republish",    "rule": {        "ruleName": "Republish",        "sql": "SELECT output.DeviceID as Device_ID, output.PayloadData.Battery as Battery, output.PayloadData.Sensor as Sensor, output.PayloadData.alt as Altitude, output.PayloadData.lat as Latitude, output.PayloadData.lon as Longitude, output.PayloadData.time as Time FROM 'lorawan/+/uplink'",        "description": "",        "createdAt": "2022-05-08T09:14:50+00:00",        "actions": [            {                "republish": {                    "roleArn": "arn:aws:iam::795806302730:role/service-role/IoTRule_20220508_repost",                    "topic": "datashow",                    "qos": 0                }            }        ],        "ruleDisabled": false,        "awsIotSqlVersion": "2016-03-23"    }}[cloudshell-user@ip-10-0-77-70 ~]$ Thanks.CommentSharemoritalousanswered a year agoAWS-User-6259931 a year agoI followed what you said and I am still not getting any data populating inside my table. I even checked my CLI to verify what you suggested. What do you mean by " JSON structure needs to be converted when republishing"Share0Sorry for the delay in confirmation.The service role was created in the management console.[cloudshell-user@ip-10-1-1-158 ~]$ aws iam get-role --role-name IoTRule_20220508_repost{    "Role": {        "Path": "/service-role/",        "RoleName": "IoTRule_20220508_repost",        "RoleId": "AROA3SSOAQIFJZM7UGIHM",        "Arn": "arn:aws:iam::795806302730:role/service-role/IoTRule_20220508_repost",        "CreateDate": "2022-05-08T08:55:10+00:00",        "AssumeRolePolicyDocument": {            "Version": "2012-10-17",            "Statement": [                {                    "Effect": "Allow",                    "Principal": {                        "Service": "iot.amazonaws.com"                    },                    "Action": "sts:AssumeRole"                }            ]        },        "MaxSessionDuration": 3600,        "RoleLastUsed": {            "LastUsedDate": "2022-05-08T09:44:01+00:00",            "Region": "ap-northeast-1"        }    }}[cloudshell-user@ip-10-1-1-158 ~]$ aws iam list-attached-role-policies --role-name IoTRule_20220508_repost{    "AttachedPolicies": [        {            "PolicyName": "AmazonDynamoDBFullAccess",            "PolicyArn": "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess"        },        {            "PolicyName": "AWSIoTRuleActions",            "PolicyArn": "arn:aws:iam::aws:policy/service-role/AWSIoTRuleActions"        },        {            "PolicyName": "AWSIoTFullAccess",            "PolicyArn": "arn:aws:iam::aws:policCommentSharemoritalousanswered a year ago"


Question: Can't get tagging enforcement to work

"I have followed all the steps in the AWS' KB to create a policy and assign it to the member (active AWS Account).:https://aws.amazon.com/blogs/mt/implement-aws-resource-tagging-strategy-using-aws-tag-policies-and-service-control-policies-scps/I am having issues enforcing the creation of the EC2 instances and requiring 'Name' and 'Product' tags to be included before launching it and displaying 'Launch Failed'.Here is the code provided that I modified to my need:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "DenyEC2CreationSCP1",      "Effect": "Deny",      "Action": [        "ec2:RunInstances"      ],      "Resource": [        "arn:aws:ec2:*:*:instance/*",        "arn:aws:ec2:*:*:volume/*"      ],      "Condition": {        "Null": {          "aws:RequestTag/Product": "true"        }      }    }  ]}Could someone let me know what I could be doing wrong?FollowComment"

Answer: "0Did you follow all of the steps:Enable tag policies for the organizationCreate the tag policy for the Name and Product tags (your code snippet above only shows a policy for a Product tag)Attach the tag policy to the Account or OU containing the account your testing in?Create the SCP(s) to enforce the presence of the the two required tags? -- the tag policy in step 2 only enforces the required tag value, not that the tag itself is presentAttach the 'tag present' SCP to the Account or OU containing the account your testing in?CommentShareScott_Kanswered 10 months ago0I don't think I did 4. I did the other items already. Let me work on these and will report back. Thanks for your help.CommentSharerePost-User-0288970answered 10 months ago0I did this although I am not 100% sure I am doing it correctly. I want the 'Product' tag to be only these values specified and if they are not, or the tag is not even added, then enforce for the instance to error out and not launch. What am I missing here?{  "tags": {    "Product": {      "tag_key": {        "@@assign": "Product"      },      "tag_value": {        "@@assign": [          "Name1",          "Name2",          "Name3",          "Name4",          "Name5",          "Name6",          "Name7",          "Name8"        ]      },      "enforced_for": {        "@@assign": [          "ec2:instance",          "ec2:volume"        ]      }    }  }}CommentSharerePost-User-0288970answered 9 months ago"


Question: Serverless Python Webhooks handler on AWS with Lambda Function URLs

"I need to upload a video file, which is available via the download URL of a webhook event.  I am looking for a solution to directly put/stream a video file into an S3 bucket using a Python webhooks handler lambda URL function. Is this possible? Here is the script:import certifiimport boto3import urllib3def lambda_handler(event, context):    body = json.loads(event["body"])    recording_files = body["payload"]["object"]["recording_files"]    download_token = body["download_token"]    bucket = 'tstbucket00'  #s3 bucket    upload_download_key = 'folder/folder' #desired s3 path or filename        for idx in range(len(recording_files)):       recording_files[idx]= recording_files[idx]["download_url"] +'?access_token=' + download_token       s3=boto3.client('s3',aws_access_key_id=y_access_key,  aws_secret_access_key=y_secret_key)       http=urllib3.PoolManager(cert_reqs='CERT_REQUIRED',ca_certs=certifi.where())       get_recording = http.request('GET', recording_files[idx]l,preload_content=False)       s3.upload_fileobj(get_recording, bucket, upload_download_key)The about script successfully creates a folder in the s3 bucket but does not directly stream the mp4 file into s3 bucket.FollowComment"

Answer: "0I think the issue is that you're passing the entire get_recording object to upload_fileobj where you should be passing the data. Perhaps the final line should be s3.upload_fileobj(get_recording.data, bucket, upload_download_key) ?Also: Where you're creating the s3 object you don't need to specify the access and secret keys if the Lambda function has the appropriate IAM role attached to it. You can just do s3 = boto3.client('s3') which is much simpler and means you don't have to set up the credentials yourself.CommentShareEXPERTBrettski-AWSanswered a year ago0Thank you so much for your thoughtful answer @Brettski@AWS! It really helped me figure out the issue. I am a newbie to working with s3 and you've made the development experience amazing. That side, it turns out that the script was uploading as expected. I just needed to add the .mp4 file extension to the filename. Here is the snippet I used in my testing in the terminal:zoom_access_token = " Your_Token"download_url = "Your_download_URL"new_download_url = download_url +'?access_token=' + zoom_access_tokenbucket = 'Yourbucket00' #your s3 bucketupload_download_key = 'folder/folder.mp4' #your desired s3 path or filenames3=boto3.client('s3',aws_access_key_id=y_access_key, aws_secret_access_key=y_secret_key)http=urllib3.PoolManager(cert_reqs='CERT_REQUIRED',ca_certs=certifi.where())get_recording = http.request('GET', new_download_url,preload_content=False)s3.upload_fileobj(get_recording, bucket, upload_download_key)CommentSharefit-devanswered a year ago"


Question: AWS IoT - No Lifecycle events - Fleet Indexing shows all devices disconnected

"I have enabled fleet indexing with "thing connectivity", however when I run a search on things using "search-index" all things come back as not connected.I can see on the AWS IoT Monitor Dashboard, using the  "Metric type rate(%)" Pie Chart, that there are definitely "Connect" and "Ping" metrics.I have turned on debug logging in IoT and can search for logs in cloudwatch, but there are no lifecycle events showing.Any suggestions for how to debug this further?FollowComment"

Answer: "0Accepted AnswerOk so yea - this seems to be answered by the other post linked in the comment below."If your client is using a different client ID from Thing Name when connecting to AWS IoT, the connectivity status of your "thing" will not be indexed by Fleet Indexing"It seems though that there is some delay between connects and the thing connectivity state updating as per https://repost.aws/questions/QU5zUQchQ3SWyLWQPeDH7umQ/aws-io-t-core-takes-too-long-to-update-the-connectivity-information-of-a-deviceCommentShareAWS-User-3949958answered a year ago0Possible duplicate - https://repost.aws/questions/QUyWYanxZcSuOMICoY-EX9Pg/aws-io-t-core-and-fleet-indexing-connected-false-responseCommentShareAWS-User-3949958answered a year agoAWS-User-3949958 a year agook, I just tried this and still getting 0 connect life cycle events, and fleet indexing says it's disconnectedShare"


Question: AWS Backup Using ESX Host

"Hello,I've had my backups running great. All of a sudden they all started failing with the following error message.Error opening disk on the virtual machine during backup data processing. Aborted backup jobI have checked the gateway, hypervisor, and virtual machines and everything is saying online within AWS Backup.Not sure where to turn from here.FollowComment"

Answer: "0GreetingsThe error message you received indicates that AWS Backup was unable to open the disk on the virtual machine during the backup process. There could be several reasons why this is happening, but here are some steps you can take to troubleshoot the issue:Check the virtual machine's logs: Check the logs on the virtual machine to see if there are any errors or issues that may be causing the backup to fail. Look for any disk errors or warnings in the system logs.Check the backup policy: Review the backup policy to ensure that it is configured correctly. Make sure that the backup policy is not attempting to back up any disks that are not available or are no longer attached to the virtual machine.Check the backup schedule: Ensure that the backup schedule is not conflicting with other processes that are running on the virtual machine. For example, if there is a process running on the virtual machine that is causing high disk usage during the backup window, it may be causing the backup to fail.Check the backup gateway: Verify that the backup gateway is properly configured and connected to your virtual environment. Ensure that the backup gateway has sufficient resources, such as disk space and memory, to perform the backup.Check the hypervisor: Verify that the hypervisor hosting the virtual machine is properly configured and functioning correctly. Ensure that the virtual machine is not experiencing any resource contention, such as high CPU or memory usage, that may be causing the backup to fail.I hope these steps help you resolve the issue and get your backups running smoothly againPlease let me know if that answered your questionCommentShareZJonanswered 3 months agoZJon 3 months agodid I answer your question? please let me knowShare"


Question: EC2 instance centos7 running on a VPC- Cannot start Amazon Cloudwatch Agent.

"Hi there,I'm trying to install an Amazon cloud watch agent in my instance which running on a VPC ( internal using only, not facing the internet ). to sent Ram usage metric to cloud watch.I'm following documents on Amazon to create Interface VPC endpoint.1/ Stop Amazon-ssm-agent in my instance.2/ Install Amazon cloud watch agent and related package.Manual create config using amazon-cloudwatch-agent-config-wizardchange name of config file from config.json to amazon-cloudwatch-agent.jsonalso add "endpoint_override": "vpc.XXXXXXXXXXXX.logs.ap-southeast-1.vpce.amazonaws.com",When I'm run manual by command sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.jsonfile amazon-cloudwatch-agent.json dissapear in folder etc and new file named file_amazon-cloudwatch-agent.json generated in folder amazon-cloudwatch-agent.d with the same content of amazon-cloudwatch-agent.json.Checking log file a see the logs like this:2022-02-09T08:04:01Z W! [processors.ec2tagger] ec2tagger: Unable to describe ec2 tags for initial retrieval: RequestError: send request failedcaused by: Post "https://ec2.ap-southeast-1.amazonaws.com/": dial tcp 52.95.35.53:443: connect: connection timed outAnd I can't see the metric in Amazon cloud watch console. Can someone help me to make it workEdited: after enable debug in log I see more log like this:2022-02-09T09:53:07Z D! [outputs.cloudwatch] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:07Z D! [outputs.cloudwatchlogs] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:08Z D! [outputs.cloudwatchlogs] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:08Z D! [outputs.cloudwatch] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:09Z D! [outputs.cloudwatchlogs] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:09Z D! [outputs.cloudwatch] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:10Z D! [outputs.cloudwatch] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:10Z D! [outputs.cloudwatchlogs] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:11Z D! [outputs.cloudwatchlogs] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:11Z D! [outputs.cloudwatch] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:12Z D! [outputs.cloudwatch] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:12Z D! [outputs.cloudwatchlogs] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:13Z D! [outputs.cloudwatch] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:13Z D! [outputs.cloudwatchlogs] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:14Z D! [outputs.cloudwatch] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:14Z D! [outputs.cloudwatchlogs] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:15Z D! [outputs.cloudwatchlogs] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:15Z D! [outputs.cloudwatch] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:16Z D! [outputs.cloudwatch] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:16Z D! [outputs.cloudwatchlogs] Buffer fullness: 0 / 10000 metrics2022-02-09T09:53:17Z D! [outputs.cloudwatch] Buffer fullness: 0 / 10000 metricsFollowComment"

Answer: "1Hello Cuong,I'm understanding your scenario as below, please correct me if I'm wrong.Ec2 instance in a private subnet, that does not have access to the Internet.You want to push Memory(Ram usage) metrics to CloudWatchYou have created VPC Endpoint for CloudWatch LogsBased on above information, it seems that you are not using the correct VPC Endpoint. To push metrics you need VPC Endpoint for CloudWatch service not CloudWatch Logs, on the contrary you will need VPC Interface Endpoint for CloudWatch Logs to push logs from Private EC2 instance with CW Agent. You can have details from [1] for endpoint_override configuration for Metrics section and [2] for VPC Endpoint for CloudWatch.In addition to above, when pushing metrics from EC2 instance - EC2 instances needs to connect to EC2 service to obtain the EC2 tags initially. For this purpose you will also need to have VPC Interface endpoint for EC2 service as well. This can be seen from the error that you are observing:2022-02-09T08:04:01Z W! processors.ec2tagger ec2tagger: Unable to describe ec2 tags for initial retrieval: RequestError: send request failed caused by: Post "https://ec2.ap-southeast-1.amazonaws.com/": dial tcp 52.95.35.53:443: connect: connection timed outand make sure the EC2 instance's associated IAM Role/Instance Profile has the required permissions as described [3]. Precisely for above error, the required permission is "ec2:DescribeTags".Hope this helps. Looking forward to your feedback.ThanksCommentShareSUPPORT ENGINEERMunkhbat_Tanswered a year ago"


Question: Cognito Facebook Login: bad id_token issuer

"I'm trying to get my react native application working with social logins. After clicking the login button in the Hosted UI, my network traffic shows my app callback along with the following error message attached:error_description=Bad_id_token_issuer+https%3A%2F%2Fwww.facebook.com&error=invalid_requestHas anyone run into this issue before? I've been stumped on it for a couple of weeks now and can't seem to find a similar issue anywhere.Thanks in advance@FollowComment"

Answer: "0I am facing the same problem with the Cognito Facebook Login.  This is my first time to implement a social login with Cognito so I assumed it was something I did wrong.  Might still be.CommentShareShaneGanswered 2 years ago0I am facing the same problem with the Cognito Facebook Login.  This is my first time to implement a social login with Cognito so I assumed it was something I did wrong.  Might still be.CommentShareShaneGanswered 2 years ago0I thought the same thing until I implemented Google Sign In and noticed that's working correctly. Looks like Cognito doesn't know about the 'https :// www. facebook.com' issuer (possibly just expecting 'Facebook'??) so it keeps rejecting the token.Edited by: menubles on Oct 26, 2021 9:53 AMEdited by: menubles on Oct 26, 2021 9:53 AMCommentSharemenublesanswered 2 years ago0This has just started happening to me. Is the implication that facebook changed the issuer name and this has broken using facebook as a federated identity provider in cognito? If so and the Cognito team have not fixed it yet why is someone not shouting very loudly? Otherwise is no-one actually using federated identity with facebook in production systems? Or am  i missing something?CommentShareJimmyTanswered 2 years ago0Same problem here. It`s becoming urgent.@AWS: When will it be fixed?Thank you very much.Edited by: obi1 on Nov 20, 2021 6:00 AMCommentShareobi1answered 2 years ago0+1CommentShareAdelGrimmanswered 2 years ago0We are aware of the issue and are working on a resolution.CommentShareAWS-User-1493064answered 2 years ago0The issue with Amazon Cognito User Pools where customers federating through Facebook were receiving the error “Bad id_token issuer https://www.facebook.com” has been resolved. If you are still encountering this issue please reach out to us.CommentShareAWS-User-1493064answered 2 years ago0Woooo. Thanks so much AWS Team!CommentSharemenublesanswered 2 years ago"


Question: Migration of an AWS database failed due to code pipeline issues

I simply want to know how to debug the error that is described in the following link. I don't have the any additional error logs.https://textsaver.flap.tv/lists/5118Thanks in advance!!!FollowComment

Answer: "0To answer your question, we require details that are non-public information. Please open a support case with AWS using the following linkCommentShareSUPPORT ENGINEERcontainerisedanswered 9 months ago"


Question: 504 From Specific Edge Locations

"I finally managed to reproduce issues where were seeing from European customers by using my VPN service through Germany.  Everything seems fine from the US and some other European locations.CloudFront logs are showing the 504's across several Edge locations in Europe, so I don't think this is isolated to one Edge location.What we are seeing.Both default and test.cfm behaviors are configured the same, except path.From FRA50-C1:https://www.photoeye.com/test2.cfm (200) Always a Cache Misshttps://www.photoeye.com/test.cfm (504) After 30 secondsFrom PHX50-C1:https://www.photoeye.com/test2.cfm (200) Always a Cache Misshttps://www.photoeye.com/test.cfm (200) Works as expectedIn the first case, if I drop the test.cfm behavior, things work as test2.cfm.We have several other paths that are doing the same exact thing (work at on edge, but not another), and really only seems specific to Europe.FollowComment"

Answer: "0So I narrowed things down a bit, if I set all the TTLs to 0, things work, although nothing is cached. Setting the max or default above 0 results in the behavior.I recreated a new distribution and it's acting the same. Seems like Germany, Italy and France are the main edge locations with issue.CommentShareByron1021answered 4 years ago0So testing, I believe I have a solution.So we have all HTTPS to CloudFront.  Then our custom Origin (which lives outside AWS) had to be HTTP, since the load balancer at the Origin only had the domain we needed to serve on CloudFront. If we did, CloudFront would just redirect to itself.....https://domain.com --> CloudFront --> https://domain.com --> goto CloudFront instead of origin.Originally I attempted another origin domain with the origin SSL, but as it thought, CloudFront didn't like the SSL mismatch.Didn't work.https://domain.com --> CloudFront --> https://random.domain.com --> goto Origin, but just got 504Did work, as I took the origin out of SSLhttps://domain.com --> CloudFront --> http://random.domain.com --> goto Origin, OK in U.S. and other places, but a not working in Europe.We had a demo version of the site working under a different CNAME and valid SSL, and I tested successfully in that manner.https://domain.com --> CloudFront --> https://demo.domain.com --> goto Origin, valid SSL, everything is AWESOME!I think this is probably somehow related to EU privacy laws. And yes, this isn't how we probably should have configured things, but the SSL limitations on our Origin made it somewhat necessary.We'll have to get another SSL on our load balance to resolve this, but at least we have a solution.CommentShareByron1021answered 4 years ago"


Question: Elasticsearch 6.2 cluster snapshot process stuck with missing file

"I have an AWS Elasticsearch 6.2 cluster whose snapshot process has been failing for several months, preventing new automatic or manual snapshots from being taken. The error in the logs seems to indicate that one of the snapshot files is missing from S3:[2022-06-01T09:17:06,613][WARN ][r.suppressed             ] path: __PATH__ params: {pretty=, s=id, v=, repository=cs-automated}SnapshotException[[__PATH__] Snapshot could not be read]; nested: SnapshotMissingException[[__PATH__] is missing]; nested: NoSuchFileException[Blob object [snap-9jgcTbzlSGKVwY6iFhDh5Q.dat] not found: The specified key does not exist. (Service: Amazon S3; Status Code: 404; Error Code: NoSuchKey; [...]I had to add storage to the cluster, which replaced the existing cluster nodes, but this made no difference. It's not clear how to unblock this. Any ideas?FollowComment"


Question: The TagValue you have provided is invalid

"I am sending an "&"  and a few other AscII characters as a keyValue when tagging documents in S3, but I am getting the following error:The TagValue you have provided is invalidThe documentation says we should be able to send all ASCII characters.  Please let me know how to get around this or please fix the tagging in S3.FollowComment"

Answer: 0This was answered on Stack Overflow.https://stackoverflow.com/questions/69399496/s3-tagging-error-the-tagvalue-you-have-provided-is-invalidCommentShareMichaelAkinanswered 2 years ago


Question: GG CloudWatch Metrics connector vs IoT Analytics

"I 'm currently using the GG CloudWatch Metrics connector for creating custom CW metrics from collected telemetry data (operational data like memory usage, operating temperatures, local device alarms, etc. - not application data) from a GG Core device.  Now I'm wondering if I should be using IoT Analytics instead.  Are there any guidelines for when to use one over the other in terms of data storage, cost, or performance?FollowComment"

Answer: "0Hi JennaSys,It sounds like you're wanting time series data. Greengrass 1.10 just released a stream manager.https://docs.aws.amazon.com/greengrass/latest/developerguide/stream-manager.htmlHere's another blog post you might be interested in regarding IoT Analytics.You can also look at the AWS Solutions page.https://aws.amazon.com/solutionsAs for cost and other comparisons it would really depend on your specific use case.Thanks,KR-AWSCommentShareKR-AWSanswered 3 years ago"


Question: How to easily replicate Athena tables from one region to another

"Hello,We are trying to replicate our existing tables to live in another region and I was wondering if there is an established process to accomplish this easily and quickly (and ideally to update the tables on a continuing schedule as the existing tables are updated)?I am able to create the external table with the same DDL as I was in the other region, but running MSCK REPAIR TABLE to try load the partitions into the new table fails with:FAILED: Execution Error, return code 1 from org.apache.hadoop.hive.ql.exec.DDLTaskWe have created Quicksight dashboards based on these tables and we would like to move them to us-east-1 so the user management and actual datasets and dashboards all live in the same region. Our understanding was that to do this we will need to migrate our Athena tables as well.FollowComment"

Answer: "1Hi,We can programmatically copy the tables by executing the DDL statements in different regionshttps://docs.aws.amazon.com/athena/latest/ug/code-samples.htmlAlso since the Athena tables are basically Glue data catalogs, you can also refer the following Github link for migration of glue data catalog to another data catalog, and see if that helps with your requirement.https://github.com/aws-samples/aws-glue-samples/tree/master/utilities/Hive_metastore_migration#aws-glue-data-catalog-to-another-aws-glue-data-catalog.I understand that you are getting the following error while running MSCK REPAIR TABLE command.FAILED: Execution Error, return code 1 from org.apache.hadoop.hive.ql.exec.DDLTaskThere can be different reasons for this error, but the most common one is with permissions issue. I would recommend you to check the IAM user/role permissions and S3 bucket permissions (if it is an S3 source).https://aws.amazon.com/premiumsupport/knowledge-center/access-denied-athena/https://aws.amazon.com/premiumsupport/knowledge-center/quicksight-access-denied-athena-data/CommentShareSUPPORT ENGINEERSantosh_S_Sanswered 8 months agoEXPERTFabrizio@AWSreviewed 8 months ago"


Question: Media Live details

"HelloCould you please help me in my application? I read all the media live documentation but I still have many questions in order to use media live in a web tv application. I'm newbie in aws services.I will describe you my goal. It is a web TV application to live stream once a month a webinaire about a subject. Meanwhile, this video must be stored for later use.My questions:In the input, three cameras will be used. How can I integrate them. RTMP pull or push? I have to use software encoder like OBS?The live streaming must be stored. How can I do it? By aws media store or use the output archive of the media package service?To serve the most of devices, what output group formats I have to use?The Interactive Video Service (IVS) can replace media live in my case? I discovered that is simpler than media live but I haven't idea about what is the better in cost, utility ...Best regardsFollowComment"

Answer: "0meriemiagI'll try to answer your questions in the order you had posed them.Storage for later useThis can be done via either an Archive output group, or an HLS output group to S3, or by using MediaPackage ad using the Live to VOD harvest capability to create a VOD asset for later use.Q1. 3 inputsCan you elaborate on the requirement of 3 cameras? Do you mean that for a single MediaLive channel you would like to switch between 3 different cameras, or that you want to create 3 MediaLive channels each with a single camera? If 3 cameras to a single MediaLive channel then this is not possible for push type inputs such as RTMP Push, RTP inputs etc. MediaLive has a current limit of a maximum of 2 Push inputs that can be attached to a MediaLive channel at any given time. A workaround would be to use something upstream of MediaLive such as OBS. With OBS you would select the active camera that is then sent via RTMP to the MediaLive channel.Q2 & Q3Easier to answer questions 2 & 3 at the same time. MediaPackage can create multi output formats, e.g. DASH, HLS , CMAF. This will allow for the broader device coverage. As previously mentioned MediaPackage also has Live to VOD capability (https://docs.aws.amazon.com/mediapackage/latest/ug/ltov.html) that can create the VOD assets for you to easily archive the events.Q4.IVS and MediaLive have somewhat different customer bases and therefore have different feature sets. The MediaLive  / MediaPackage workflow gives you many different output formats, and destinations that the content can be routed to. Therefore it is a bit more complex to configure. IVS is more built for interactive solutions, and therefore has that functionality that isn't available in MediaLive. See https://aws.amazon.com/ivs/faqs/  for some info describing the difference between an IVS workflow and a workflow using the MediaServices, e.g. MediaLive -> MediaPackage -> CloudFront. As for pricing the pricing page of each of these describes the cost of each service.IVS: https://aws.amazon.com/ivs/pricing/MediaLive: https://aws.amazon.com/medialive/pricing/MediaPackage: https://aws.amazon.com/mediapackage/pricing/See also the new MediaLive Workflow Wizard that was recently added to the MediaLive console. This is an easy 4 stop process to stand up a workflow that can span multiple AWS service, e.g. RTMP in to MediaLive to MediaPackage to CloudFront. Using the Wizard you can easily select the output rates you want for your channel. Once the workflow is configured you can still edit the services to tailor the workflow to better suite your needs, e.g. add an additional output to the MediaLive channel, or add another output endpoint in the MediaPackage channel.CommentShareAWS-User-5437070answered 2 years ago0Thank you for all these informationsCommentSharemeriemiaganswered 2 years ago"


Question: Sending QuickSight Analysis and Dashboard via email

"Hi all - We have a requirement where we need to send QuickSight Analysis or Dashboard via email ( business users). The business users are NOT part of QuickSight Group or access to QuickSight. All they need to have the statistics, graph and get the details via email. Is this possible in QuickSight.Please advise.Regards - SanjeebFollowComment"

Answer: "0Accepted AnswerHi, @Sanjeeb.I understand that you would like to distribute QuickSight statistics and graphs via email reports to non-QuickSight users.First, QuickSight has an email reporting feature.However, you must use QuickSight Enterprise Edition, and the user must have access to his QuickSight to use this feature.https://docs.aws.amazon.com/quicksight/latest/user/sending-reports.htmlSo you should consider another method.If your mail system supports workflow, you will be able to forward reports received by QuickSight users.For example, emails received by Office 365 could be forwarded to another email address by his PowerAutomation.Alternatively, I think you can handle his email received by Amazon SES with Lambda and deliver it with Amazon SES or Pinpoint.As a completely different approach, QuickSight dashboards and analytics can be embedded into external websites.There may also be a way to create your own mechanism to convert the contents rendered by the headless browser into PDF with a web application and send it by e-mail.In any case, you can't do it with QuickSight's standard features, so you'll have to come up with a custom solution.CommentShareEXPERTiwasaanswered 3 months agoSanjeeb 3 months agoThanks iwasa.. The details are useful and let me explore these options.Share"


Question: "Is database migration cloud, desktop or both?"

"The Amazon DMS documentation talks about downloading the Windows or Linux based migration tool. But there is also an online cloud based DMS thing "migration projects", which supposedly you setup and do database migration. It seems like there are two options for doing it, on the desktop and in the cloud... however the documentation doesn't cover the cloud based one, and for me at least it fails with no discernable error message. So unsure how to proceed.FollowComment"

Answer: "0The AWS Database Migration Service (DMS) is a managed service (cloud) that allows you to migrate your on-premise or RDS database to an Amazon database.It doesn't require drivers or configuration changes in your database.There are a couple of step-by-step instructions available on how to migrate an Amazon database.You can walk through these to get a better sense of how to use DMS to migrate your database to an Amazon database.Hope this helps,CommentShareCarlos del Castilloanswered a month agoChris a month agoBut that's what I'm saying, the step by step guide for Oracle to Postgres is for desktop version. I've set up the conversion in the cloud under "AWS DMS migration projects" rather than the desktop product, but it fails with no error message. But there's no apparent guide for using the product in the cloud. It wants access to an S3 bucket for some reason, I don't know if it expects me to put something there or what, it is opaque.Share"


Question: Add Delay to Lex Bot chat responses

"Currently, my test chatbot is working fine, but the responses are really fast. I there any way to add a slight delay to the bot responses?FollowComment"

Answer: "0Hi,Based on the documentation and the following stackoverflow article, unfortunately, it does not look like its possible to add a delay to the Lex Bot chat responses.Link: https://stackoverflow.com/questions/55030578/put-a-user-on-hold-with-amazon-lex-randyCommentShareRandyTakeshitaanswered 4 years ago0kg1980,You can use SSML to control the response experience : https://docs.aws.amazon.com/lex/latest/dg/API_runtime_PostText.htmlCan you please explain what ‘too fast’ means and how you want the experience to be?Randy,You can add a ‘please wait’ you get lex to fulfil the intent and get Amazon connect to play the please wait, followed by 5s of silence, then get connect to play the data/message required.ThanksDanCommentShareDanBloyanswered 4 years ago"


Question: Sagemaker XGBoost parameter error

"When I run a training job from SageMaker with the XGBoost algorithm, I get the error:Traceback (most recent call last):File "/miniconda3/lib/python3.7/site-packages/sagemaker_containers/_trainer.py", line 84, in trainentrypoint()File "/miniconda3/lib/python3.7/site-packages/sagemaker_xgboost_container/training.py", line 94, in maintrain(framework.training_env())File "/miniconda3/lib/python3.7/site-packages/sagemaker_xgboost_container/training.py", line 90, in trainrun_algorithm_mode()File "/miniconda3/lib/python3.7/site-packages/sagemaker_xgboost_container/training.py", line 68, in run_algorithm_modecheckpoint_config=checkpoint_configFile "/miniconda3/lib/python3.7/site-packages/sagemaker_xgboost_container/algorithm_mode/train.py", line 121, in sagemaker_trainvalidated_train_config = hyperparameters.validate(train_config)File "/miniconda3/lib/python3.7/site-packages/sagemaker_algorithm_toolkit/hyperparameter_validation.py", line 280, in validateraise exc.UserError("Extraneous hyperparameter found: {}".format(hp))sagemaker_algorithm_toolkit.exceptions.UserError: Extraneous hyperparameter found: prob_buffer_rowExtraneous hyperparameter found: prob_buffer_rowI cannot delete the prob_buffer_row parameter as it comes by default when defining the algorithm. Am I doing something wrong or is it a bug?FollowCommentMarc a year agoHow are you creating the Training Job ? If you are using the SageMaker Python SDK, can you share the Estimator you are using?  What version of the XGBoost container are you using? I would suggest testing a different version of the SageMaker XGBoost container and note the behavior.Share"

Answer: "0Hello - can you share the exact code that you use when training? Cannot see parameter prob_buffer_row for XGboost:https://docs.aws.amazon.com/sagemaker/latest/dg/xgboost_hyperparameters.htmlhttps://xgboost.readthedocs.io/en/release_1.2.0/parameter.htmlAs Marc has pointed out, you may need to use the latest version. Please let me know if this does help.CommentShareAWS-User-9634033answered 10 months ago"


Question: Flexmatch validation doesn't fail if you miss a closing bracket on a rule

"Hi,After an unfortunately long time trying to debug why my rules were not working on Flexmatch, I discovered that Rule validation doesn't spot if you mistype a measurement.I.e. if you mistype "measurements": ["flatten(teams[*].players.attributes[gameMode])"] as "measurements": ["flatten(teams[*].players.attributes[gameMode]"] (note the missing closing bracket) then the rule will silently fail despite validation saying it's fine.FollowComment"

Answer: "0Hello, i took a look at our code base and did a testing, showing the API does validation on brackets. If you want us to take a look at your case, can you provide the full rule set of yours?CommentSharerePost-User-5046723answered a year ago0Hey, unfortunately that's confidential, however this is a broader issue than I initially reported.{    "name": "example-ruleset",    "playerAttributes": [        {            "name": "character",            "type": "string"        }    ],    "ruleLanguageVersion": "1.0",    "algorithm": {        "backfillPriority": "high",        "strategy": "exhaustiveSearch",        "expansionAgeSelection": "newest"    },    "teams": [        {            "name": "characters",            "maxPlayers": 10,            "minPlayers": 5        }    ],    "rules": [        {            "name": "SameCharacters",            "type": "comparison",            "operation": "=",            "measurements": [                "this is not a valid rule"            ]        }    ],    "expansions": [        {            "target": "teams[characters].minPlayers",            "steps": [                {                    "waitTimeSeconds": 5,                    "value": 5                },                {                    "waitTimeSeconds": 10,                    "value": 1                }            ]        }    ]}You can feed any measurement you like into the "measurements" array. This is not validated.CommentSharerePost-User-7765631answered a year ago0Hi @REDACTEDUSERThanks for reporting this issue and providing the example, I have cut a ticket for the GameLift team to investigate.V534740657CommentSharerePost-User-7108006answered a year ago0Hi @REDACTEDUSERThanks for your inquiry! We're tracking this fix as part of a back log item for more granular rule set validation.GLIFT-16322CommentSharerePost-User-4754183answered a year ago"


Question: AWS EC2 MacOS Monterey Apple Silicon Initialize Error

"Hi,I wanted to create a new MacOS Monterey Apple Silicon Instance (not Intel or x86_64/AMD64) but it always runs into this error message.Instance launch failedLaunch log:Intializing request:  SuccededCreating security groups: SuccededCreate security group rules SucceededLaunch initiation FailedAMI ID ami-01a9da8de3d589094macOS Monterey 12.4 AMI built by Amazon Web ServicesArchitecture: 64-bit (Mac-Arm)Virtual server type (instance type)mac2.metal Family: mac2 8vCPU, 16 GBytes MemoryFollowCommentrePost-User-0796844 10 months agoWe have the same experience with that AMI (ami-01a9da8de3d589094). The instance state was "Running", but only 1/2 status checks passed (later it changed to 0/2). The instance didn't become reachable. The termination of this broken instance took about 30 min. After the instance was successfully terminated, our dedicated host stays in the Pending state, and we can't use it for another try. If someone looks into this, the instance ID was i-04821eed7f0870b7a, and the dedicated host ID: h-055bf66f353b20893.SharerePost-User-0796844 10 months agoI did one more try with a new mac2.metal dedicated host and the Big Sur AMI (ami-003e18eed609f3e46). And the experience is the same - Instance state: Running; 1/2 checks passed. After a few minutes "0/2 checks passed" or sometimes "Insufficient data" was reported as the Status check value.SharerePost-User-0796844 10 months agoSo hopefully the final comment from me. I kept the instance running even with the failures. When I checked after half an hour, it was reachable. So now I have the instance finally properly running. I have two pieces of advice for other users - be patient and be patient.And to the AWS experts: try to improve the user experience, please.Share"


Question: Cognito returns invalid_request and unauthorized_client

"Hi, when we try to get the tokens from token endpoint using authorization code, we get invalid request and unauthorized responses. We use PKCE flow, hence we have setup two clients, one with secret and other without secret. Both clients have Authoriztion Code flow enabled. All the required paramenters are provided, properly posted in querystring format in the request body, method is set to Post, Content-Type is set, Authorization header is present for client with secret, the parameters provided are all correct and exactly the same as defined in the console. No issues with double URL-encoding or things of that sort. We need to know where Cognito emits the logs with reasons as to why it rejects the requests. Console log in lambda with Cloud watch is there, but it the response provided by cognito. So where can we find detailed logs? And the reason for trying with a client secret is to see if we can hide the refresh token in the server. But we are ready to leave that route, if the client without secret can respond with tokens.FollowComment"

Answer: "1It was a mistake of URL-encoding redirect_uri in the Post request that caused unauthorized_client error. invalid_client was due to mismatch in the way code verifier was used. Here are some confirmations, we can use PKCE against a client with Secret in Cognito, as of now. During sign in format for code_challenge is Base64(SHA256(code-verifier)). During code exchange pass the code-verifier as it is without Base64 encoding.CommentShareorumukhamanswered 8 months ago0Accepted AnswerHello there,From the description of the issue, I gather that you are leveraging the PKCE extension to secure the authorization code exchange while retrieving the tokens from your Cognito domain's oauth2/token endpoint. But while doing so, you are encountering the 400 series HTTP error codes, "Invalid_Grant" and "Invalid Request"[1].At the time of posting this answer, I see that you were able to resolve the issue. For future references and other developers that are encountering this issue, I'm pasting below the generic issues that are usually encountered with the setup that is described above.Setting PKCE extension/flow aside, when you hit your Cognito user pool domain's /oauth2/token endpoint and encounter the error message "invalid_request", it indicates that one or more of the request parameters in the header/body is incorrect or missing. Now, if the request is retried (while the "code" request parameter is kept the same), you would encounter an "invalid_grant" error message, and this is expected. The authorization code once consumed, cannot be used again. Also, the authorization code has to be consumed by the token endpoint within 5 minutes of its generation[2].Upon bringing PKCE extension into the above mix, the same error sequence of "invalid_request" and "invalid_grant" is expected if the code verifier and code challenge don't match. As per RFC standards[3], the code challenge is derived in the following manner from the code verifier string.plaincode_challenge = code_verifierS256code_challenge = BASE64URL-ENCODE(SHA256(ASCII(code_verifier)))Having stated the above, provided that the request parameters 'client_id', 'redirect_uri' and the 'Authorization' header (if your app client has a client secret) are accurate, the two most probable causes for this issue are:Incorrect/Expired Authorization codeMismatch between the code_challenge string sent in the '/authorize' request and the code_verifier string sent in the '/token' request. Kindly ensure that the code_challenger is encoded as per the above process[3].For testing purposes, you may use the 2 functions from the below python snippet to:Generate a code_verifier and it's code_challenger counter part. (For experimental purposes)Check if the code_verifier and challenger generated by your application are valid.---import base64import stringimport randomimport hashlibdef generate_code():    rand = random.SystemRandom()    code_verifier = ''.join(rand.choices(string.ascii_letters + string.digits, k=128))    code_sha_256 = hashlib.sha256(code_verifier.encode('utf-8')).digest()    b64 = base64.urlsafe_b64encode(code_sha_256)    code_challenge = b64.decode('utf-8').replace('=', '')    return ("\nCode verifier: '{0}'\n\nCode challenge: '{1}'\n".format(code_verifier, code_challenge)) def checkCodeChallengeAndVerifier(code_verifier, code_challenge):    # Returns True if the Code verifier matches with the code challenge, else False    return code_challenge ==  base64.urlsafe_b64encode(hashlib.sha256(code_verifier.encode('utf-8')).digest()).decode('utf-8').replace('=', '')---Checking if the code_verifier and code_challenger are the corresponding counterparts will help eliminate double URL encoding and other issues contributed with PKCE in the token retrieval process. Please do feel free to raise a technical support case with us if you continue to experience issues post passing the above 2 checks.Moving ahead to viewing logs; although not verbose, you may view your Amazon Cognito Domain endpoint interactions via Amazon CloudTrail[4].I hope the above shared information is helpful. If you require assistance with further troubleshooting, please open a support case and we'll be glad to assist :)=================References:[1]. Examples of negative responseshttps://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html#post-token-negative[2]. Authorize endpoint - Examples requests with positive responses (Take a look at the 'Note' section)https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html#get-authorize-positive[3]. Proof Key for Code Exchange by OAuth Public Clients - Derivation (Refer section 4.2)https://www.rfc-editor.org/rfc/rfc7636#page-8[4]. Amazon Cognito information in CloudTrailhttps://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-info-in-cloudtrail.htmlCommentShareSUPPORT ENGINEERAWS-User-5557385answered 8 months ago"


Question: NLP with a custom model

"A wants to use a 120-question cognitive assessment program in order to define and describe someone’s thinking preferences, according to 4 quadrants (for example analytic, emotional, creative, organised).They are interested in adding an NLP feature to their assessment and are thus interested in finding a platform that could provide a classifier model. The aim of this classifier would be to:Diagnose if a piece of free text (answer to an open-ended question) demonstrates high or low preference for a particular quadrant.Ultimately this classifier should be able to analyse communication (emails, documents, job descriptions)Identify the words/strings/characteristics in the text that reflect each quadrant.Be able to use the classifier as en e-mail plugin that would highlight the different words/expression according to the quadrant they represent and suggest recommendations according to the thinking preferences of the recipient of the email.I was wondering if Amazon Comprehend will meet this requirements for the classifier model because, from what I could see in the FAQs of the service, Comprehend does not support custom models. Could anyone confirm if Comprehend will be a good fit for this use case and, in case it is not, what could be workaround to meet the customer's requirements in the AWS cloud?FollowComment"

Answer: "0Accepted AnswerI think Sagemaker seq2seq could provide such a service:If their target is one single label (primary quadrant), they can experiment training seq2seq to predict primary quadrant based on input text sequenceIf their target is a sequence (score in each quadrant) they could experiment training seq2seq to predict quadrant scores sequence (eg 8/10 creative, 10/10 emotional, etc)Also, on the security aspect note that non-public free-form text from individuals and emails are usually regarded as very sensitive data; depending on applicable compliance framework and internal customer policies this may impact technical choices.CommentShareEXPERTOlivier_CRanswered 5 years ago"


Question: Basic (ELI5) Question about Queries in Amplify Studio

"Sorry, I'm not a dev or coder by any means, but I am trying to "professionalize" the application I developed using no code. I was able to recreate my Schema within Amplify studio but I'm struggling with a basic coding concept:In Airtable and in Access (what I'm used to), you can make fields that are essentially queries of a DB. Each data from the table is in view the DB will query and populate that field to represent the most recent data. In airtable, they're called calculated fields. In developing the Amplify Studio Schema I found there were no "Calculated fields" and no visual way to build queries and integrate them into the system.So my question is this: if I wanted a persistent query for a table, or to display visually on my app, where would I input it during my development? e.g. The number of comments for a post given a relationship of Many comments for every One Post.is it connected to the UI by React-native code in Amplify Studio?Is it a function in AWS Lambda (Node.js) that is constantly triggered and then updates DynamoDB?Is it a Datastore code filled out in AWS CLI?Is there a visual editor within Amplify Studio for "Calculated Fields" and Functions?Please walk me through it.FollowComment"


Question: Is codecommit cli and sdk command for get-file and get-folder deprecated?

"I've been using cli and sdk calls to CodeCommit to manage my companies code repositories. I've been able to get around this issue for a while now by just using getDifferences and then using getBlob to retrieve each of those files.But now, I want the files for a specific folder in my code repository. I was thinking of just doing a getFolder and then doing a getBlob for all the files that it returned using promises but it seems that I can't use the getFolder sdk command or the get-folder cli command. The aws documentation says that these commands are still available but all I get back is that the command is not recognized.Am I missing something here?FollowComment"

Answer: "0Hi vwhitehurstSorry to hear you are having problems calling CodeCommit APIs via SDK and CLI.Would you be able to give us more information about the error you are getting?Which region are you using to make the calls?What is the actual error message you are getting?Which Operating System are you using?Which command are you trying in the CLI?It would also be helpful to know the version of your SDK and AWS CLIThose information will help us investigate the problem.ThanksEdited by: robison-aws on Apr 3, 2019 11:15 AMEdited by: robison-aws on Apr 3, 2019 11:16 AMCommentSharerobison-awsanswered 4 years ago0OS: macOS Mojave 10.14.2Region: us-east-1Command:aws codecommit get-folder --repository-name ${my_repo_name} --folder-path ${path_to_folder_in_repo} --profile ${aws_creds_for_account} --region us-east-1Error:usage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]To see help text, you can run:  aws help  aws <command> help  aws <command> <subcommand> helpaws: error: argument operation: Invalid choice, valid choices are:batch-get-repositories                   | create-branchcreate-pull-request                      | create-repositorydelete-branch                            | delete-comment-contentdelete-repository                        | describe-pull-request-eventsget-blob                                 | get-branchget-comment                              | get-comments-for-compared-commitget-comments-for-pull-request            | get-commitget-differences                          | get-merge-conflictsget-pull-request                         | get-repositoryget-repository-triggers                  | list-brancheslist-pull-requests                       | list-repositoriesmerge-pull-request-by-fast-forward       | post-comment-for-compared-commitpost-comment-for-pull-request            | post-comment-replyput-file                                 | put-repository-triggerstest-repository-triggers                 | update-commentupdate-default-branch                    | update-pull-request-descriptionupdate-pull-request-status               | update-pull-request-titleupdate-repository-description            | update-repository-namecredential-helper                        | helpWhere get-folder and get-file aren't listed which made me think they were deprecated or something.CommentSharevwhitehurstanswered 4 years ago0Hi, thanks for the response.Can you confirm the version of the CLI you are using?You should be able to execute those commands in CLI versions aws-cli/1.16.102 and newer.usage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]To see help text, you can run:  aws help  aws <command> help  aws <command> <subcommand> helpaws: error: argument operation: Invalid choice, valid choices are:batch-get-repositories                   | create-branchcreate-commit                            | create-pull-requestcreate-repository                        | delete-branchdelete-comment-content                   | delete-filedelete-repository                        | describe-pull-request-eventsget-blob                                 | get-branchget-comment                              | get-comments-for-compared-commitget-comments-for-pull-request            | get-commitget-differences                          | get-fileget-folder                               | get-merge-conflictsget-pull-request                         | get-repositoryget-repository-triggers                  | list-brancheslist-pull-requests                       | list-repositoriesmerge-pull-request-by-fast-forward       | post-comment-for-compared-commitpost-comment-for-pull-request            | post-comment-replyput-file                                 | put-repository-triggerstest-repository-triggers                 | update-commentupdate-default-branch                    | update-pull-request-descriptionupdate-pull-request-status               | update-pull-request-titleupdate-repository-description            | update-repository-namecredential-helper                        | clonehelpRobisonCommentSharerobison-awsanswered 4 years ago0Ahhhh, that was it. I was running version 1.15.0. Now I see the commands. Thank you.CommentSharevwhitehurstanswered 4 years ago"


Question: Emails are suddenly going to spam..??

"I've been using Sendy with AWS SES for a few months now without problem.  Suddenly today my test emails that I'm sending to myself before launching a campaign are going to my Gmail spam, when I never had this problem before.All my domain verification is still good in AWS.This email is the same body that we've sent before and this did not happen.I have checked MX blacklist checkers, and our domain/IP is not on there (although, that IP is not AWS, but rather my web server, so may not be relevant.)I can't figure out why this would suddenly be happening.  Any information on this would be greatly appreciated.  Thanks!FollowComment"

Answer: "0Hi angelleye@I understand that you use AWS SES to send emails, however suddenly the emails started landing in spam folder.Please note that Amazon SES is an email relay service, that is, it accepts the message from sender ISP, processes it and attempts to deliver email messages to the recipient's mail server (ISP) until the ISP accepts the message and sends a 250 OK response. If Amazon SES is unable to deliver your email, it returns an error message similar to the following:"550 4.4.7 Message expired: unable to deliver in 840 minutes."If the ISP accepts the email and sends a 250 OK response, then the ISP decides whether the email is categorized as spam and determines the overall mailbox placement. If the ISP flags the email message as spam, then the email might be placed in the recipient's spam or junk folder.From SES end, I would recommend you to follow all SES sending best practices to improve email deliverability. There can be several factors due to which an email can land in spam. As you mentioned that the same email body was previously delivered to inbox so I am suspecting that you are sending good quality emails. However, you can improve email deliverability by authenticating your emails in SES by using SPF, DKIM and DMARC so that email authentication passes.I would also suggest you to make sure that you maintain a very low bounce and complaint rate.Please refer the below given documents:to understand SES best practices : https://docs.aws.amazon.com/ses/latest/DeveloperGuide/best-practices.htmlWhy an email can land in spam: https://aws.amazon.com/premiumsupport/knowledge-center/ses-email-flagged-as-spam/Additionally, I would also suggest you to reach out to postmaster of Recipient ISP (gmail) to understand why they are marking your emails as spam.Please let us know if you have further queries or concerns.RegardsCommentShareSUPPORT ENGINEERIsha_Panswered 2 years ago0Hi AngelleyeHave you tried https://www.gmail.com/postmaster/ ?Also... on the email marked as "spam" in Gmail, click on "show original" and see if there's a reason for SPAM. Also see other headers in the emailCommentShareVenkyNakuanswered 2 years ago"


Question: Can't connect via ssh to ec2 instance (Amazon Linux 2) after Openssh upgrade

"Hi,There was an OpenSSH Vul. reported by our scans for Amazon Linux 2 EC2 Instance. I upgraded the server to OpenSSH_9.0p1 but I can't login to it now.I am getting the error "Server refused our key" when trying to connect via putty and "Failed to connect to your instance" via EC2 Instance connect. Is there any way I can reclaim my ssh access?Everything else is working normally and I can access the web application deployed on the server.ThanksFollowComment"

Answer: 0You may want to try this: EC2 Serial Console for Linux instances.CommentShareEXPERTkentradanswered 2 months ago


Question: "Oregon's multiple VPC run instances ,remote connection failure"

"In the oregon region of aws, vpc vpc-0257a65c1dc6c094e and vpc-036aa6d40506eb636  launch instances, and with the ssh port added to the security group, the ssh port cannot be connected, and the telnet test ssh port cannot be connected.Can you tell me why this failure occurs?This affects our business.FollowComment"

Answer: "0Are you trying to SSH from outside or withing your VPC?Meanwhile, check:your IGW configyour IGW is attached to the VPCyour public subnet where you launched instanceyour network ACLCommentShareJules_Nanswered a year agorePost-User-9775320 10 months agoThe booted machine cannot be accessed via ssh port 22, either from any Internet outside the VPC or from another previously booted normal machine within the same VPC.Both the staging VPC and the sandbox VPC have IGWs to connect to.In the ACL of the VPC, we allow all IP traffic from 0.0.0.0 into that VPC.The affected VPCs are as follows.vpc-036aa6d40506eb636 The ACL associated with it is acl-091f2e46c2fe1364a, and the IGW associated with it is igw-0ea7d09c318f7c9d3. if you select subet as subnet-07423a9f71e9eb962 or subnet- 0eabdf489f8de52d5 will not be able to connect to ssh port 22vpc-0257a65c1dc6c094e The ACL associated with it is acl-001174d67b9e53fa5, and the IGW associated with it is igw-089e0c4f5d403dc7e. if you select subnet as subnet-0c38bafd69fcf279e or subnet- 0c4ca8b30a53e1c89 will not be able to connect to ssh port 22.We have added port 22 to the security group to which the machine belongs when we name the machine.Please help us to find out the cause as soon as possible, this is already having a big impact on our business.Thanks.Share0from another previously booted normal machine within the same VPCIs the source machine in the same subnet?Are you using the default network ACL?Please try these:Check your outbound rules and make sure you're allowing return traffic (configured in the inbound rules); remember network ACL aren't stateful as SG.Check your subnet associations.For the Source & Destination (port 22) host in the same VPC, please try running the  Reachability Analyzer  and share the result.With the Source as IGW & Destination host (port 22), run the  Reachability Analyzer  and share the result.CommentShareJules_Nanswered 10 months ago"


Question: SQS Listener not working Profile based authentication

"Folks,Now that it’s getting annoying us and getting out of our hands , seeking help from experts here.In our firm, I am working on Spring boot/AWS cloud native application, where there is only profile based authentication ( no ACCESS KEY/SECRET KEY ) in place when we use AWS SDK 2.x Java libraries.AWS S3 client is easily authenticating itself when I attach ProfileCredentialProvider instance.We have a use case where we are in need of SQS listener that needs to consumer messages from queue which is not working.Our set up : AWS EKS cluster is running in an account where our application is hosted. Our AWS application specific resources are hosted in separate account. Cross account roles are set up but Spring boot SQS listener is not able to authenticate itself since we are not provided with access key and secret key.AwsS3Client and AWSSQSClient are individually able to authenticate itself using ProfileCredentialsProvider.create()How to establish authentication for the SQS listener while it tries to talk to cross account ?@SQSListener(value=“queuename/absoluteurl”) does not work hereOr advise what is the best way to poll messages continuously from SQS with only profile based authentication in placeFollowComment"

Answer: "1It's not quite clear from your question what you're trying to solve: Is this a cross-account issue; or is it a credentials issue; or is it something else. So I'm going to answer this with a bunch of general things that might help.First, the instance metadata service gives out a bunch of things including (important for this discussion) some access/secret keys. These are rotated periodically (also important). When you're using the AWS SDK it automagically retrieves those credentials for you (nice!) and also handles refreshing the in-memory credentials when the ones that were previously retrieved expire.Why the background? Because if you're using another third-party library it is up to that library to do much the same thing. If it doesn't then you could have a situation where your code works for a while and then it doesn't. Restart it, and it works again - for a while.Note that you can retrieve this "manually" (in your own code) if you choose - but having other libraries do it for you is much easier.Second, cross-account access is a little more complex. The instance/container role has to have permissions to assume a role in the other account (actually, it has to have permissions on both sides). You do that by calling the STS service with your current credentials. The credentials given back are "new" and apply to your permissions in the other account; and also expire periodically - so you have to refresh those as well.So, to get your code working you need to:Have a working set of "local" (i.e. in your current account) credentialsEnsure that you refresh them periodically (assuming they come from the instance metadata)Use STS to assume a role in the "other" account and get some appropriate credentialsEnsure that you refresh those credentials periodicallyUse the "other" account credentials to call SQSI'm not sure if this is entirely helpful or whether you know this already; but it's the best I can do because there are no error messages, logs or anything else to go on.CommentShareEXPERTBrettski-AWSanswered a year agoRagavi M a year agoThanks for pitching in Brett.Rather confusing so much let me ask a simpleQuestion. How to continuously poll messages from SQS using Spring Boot and AWS SDK 2.xShare"


Question: Amazon RDS for MariaDB instance read replica between regions

"I need to create a database with mariadb to work with a failover between regions. So, If the primary region does not work, how is the replication process with the other region?FollowComment"

Answer: "0refer https://aws.amazon.com/premiumsupport/knowledge-center/rds-mysql-cross-region-replica/ for a better understanding,CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months agoRamiro 9 months agoHi, thank you.I want to create in the same accountShare0Hello there,RDS supports creating cross-region read replica for MariaDB across all regions. You can use AWS console to quickly provision a cross-region read replica. RDS uses asynchronous replication to replicate the changes from source database to the cross-region read replica database.In case the primary database goes down, you can "promote" this cross-region read replica to a stand-alone instance and use this database's endpoint in your application. Please note that "promoting" operation is same for both in-region read replicas (source and replica in same region) and cross-region read replicas. Please note that once the read-replica is "promoted", it will no longer replicate the changes even if the previous primary database recovers.In short, as mentioned in our documentation, the suggested "failure recovery" strategy is:Promote the read replica.Direct database traffic to the promoted DB instance.Create a replacement read replica with the promoted DB instance as its source.For more information, please refer the below links:RDS Cross region read replicas - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html#USER_ReadRepl.XRgnPromoting a read-replica (applicable for both in-region and cross-region read replicas) - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html#USER_ReadRepl.PromoteHow Amazon RDS does cross-Region replication - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html#USER_ReadRepl.XRgn.ProcessCommentShareprasanth_awsanswered 9 months ago"