Question: Imported Splat Maps does not use assigned texture layer color from rollup bar

"I built a world. Imported the heightmap.I then set up my texture layers by assigning them each a material and texture.I then used the roll up bar to assign each texture layer a color.I then assigned each texture layer a splat map.I then imported splat maps.I then generated my terrain texture.The terrain is textured properly, but the colors of each layer did not carry over so my entire map is the default peach color. I can paint on the terrain, but shouldn't the terrain textures have colored the terrain when I imported the splat maps?? I saved my layer colors in the rollup bar, but the terrain does not show color, it's just the default peach. Is it bugged or am I doing something wrong?Follow"

Answer: "0Accepted AnswerHello @REDACTEDUSERApologies for the delay in our response, to answer your question there is not currently any color information stored in the Splat Maps as they are 8bit files so loading the Splat Maps to use as color will not accomplish your goal, however, there is a way to achieve the result you are trying to create. Think of your Splat Maps as masks which will separate which materials will appear where, rather than coloring the terrain for you. For setting up your Splat Maps follow these steps:Build your level and import your heightmapIn the Terrain Texture Layer Window create you layers, name them and assign your materialsAssign each layer a Splat Map and then import the splat maps for each layerIn the Rollup Bar set your layer colors and save each layerStarting from your topmost layer and working down Flood the terrain for each layer in your Layer Painter.Once your layers have been flooded, Generate Terrain Texture to bake the materials to the terrain.Please let us know if this resolves the issue.Thanks!SharerePost-User-1172586answered 6 years ago0So I can change the diffuse color of the material assigned to the texture layer, but I cannot change the color of the texture layer through the rollup bar for splat maps, I can paint with the rollup bar's color. It would be nice if the terrain automatically tinted according to the color saved in the rollup bar texture layer, but since the rollup bar is being deprecated I imagine that is not a priority.SharerePost-User-4975070answered 6 years ago0The latest 1.9 version. Thanks.SharerePost-User-4975070answered 6 years ago0Hello 3Gi,I am diving into your questions right now, can you please provide me with the version of Lumberyard you are using?Thanks!SharerePost-User-1172586answered 6 years ago0I noticed that in the Terrain Texture Layers editor that among the many editable values for each layer, there is a value for brightness which carries over from the Layer Painter brightness slider in the rollup bar, however, there is no column for color value. Could it be that because there is no color value column, that when you import splat maps they have no color value to assign? So my splat maps are all #FFFFFF by default.Is there a way to add in a color value setting in the Terrain Texture Layers editor that reflects the value in the Layer Painter the way that brightness is reflected?SharerePost-User-4975070answered 6 years ago0I've updated the ticket with this information and hoe to have you some answers soon.SharerePost-User-8353690answered 6 years ago0After looking over the Terrain Texture.cpp file, it appears that when you import splat maps, the LayerFilterColor is not imported. I have tried unsuccessfully to modify the code to import it since I don't know how to convert the RGB color in the layer to something the code can read. Any help on this would be appreciated.SharerePost-User-4975070answered 6 years ago0Thanks, I'll try itSharerePost-User-4975070answered 6 years ago0When I flood a layer, it overwrites the previous layer and floods the entire terrain. How do I get the terrain to only flood that layer?SharerePost-User-4975070answered 6 years ago0Did you assign and import the splatmaps? If the TTL is flooding the entire terrain then the splatmaps may not be imported, They could be assigned but not imported.SharerePost-User-1172586answered 6 years ago0Yes, I added 3 terrain layers, assigned each a material and a splat map, and then imported the splat maps. When I import them, the terrain materials apply, but their is no color, just the default tan color on all terrain. So then I went to the rollup bar and added a color to each of my terrain layers and flooded them one at a time, top to bottom. Each time I flooded the terrain layer, it flooded the entire heightmap, and overwrote the previous flood. For some reason the rollup bar flood is not recognizing the splat maps assigned to each layer.SharerePost-User-4975070answered 6 years ago"


Question: "As a seller, how do I integrate AWS API Gateway with my AWS Marketplace SaaS listing?"

I want to sell my API currently powered by AWS API Gateway in AWS Marketplace. How do I integrate AWS API Gateway with AWS Marketplace SaaS listing? How does the integration work with AWS Marketplace SaaS BatchMeterUsage API? What are the steps to integrate? What are the limitations?FollowComment

Answer: "0Accepted AnswerFor the BatchMeterUsage integration to work properly, please note the following:Your SaaS product MUST either have the pricing model “SaaS Subscription” or “SaaS Contract with Consumption”.Your SaaS product MUST have a single billing dimension called “apigateway”.If you are listing a “SaaS Contract with Consumption” pricing model, this dimension MUST be an “out-of-contract” (or overage) dimension (see pricing page in SaaS product submission tool). Please note that API Gateway is not aware of any “gifted” or “included” units. All usage will be automatically sent to the “apigateway” dimension.Please note that API Gateway cannot report to other dimensions. It only reports to the single “apigateway” dimension. This means that all endpoints if enabled will be reported to and billed on that single dimension.Your API Gateway MUST be in the seller account and have proper permission.Your API Gateway MUST first have a Usage Plan setup that is associated with the AWS Marketplace product code.When a new user onboards to your SaaS product/landing page, you must first retrieve their marketplace Customer ID using the ResolveCustomer API. You MUST then create an API key for the user with their Customer ID in API Gateway and add the API key to the Usage Plan associated with your marketplace product. This is NOT automatically done and requires you to implement this logic. If one is already created, you can retrieve it and filter by the Customer ID.When your customer calls the API Gateway endpoints, they MUST use their API key.If you have followed ALL 8 points above, API Gateway should report every hour or so if there are usage.You can confirm that BatchMeterUsage was called by using AWS CloudTrail in your seller account. Please note that CloudTrail is an opt-in service that stores logs in S3 and there is generally a 15-minute delay for logs to show up.CommentShareJoseph Shihanswered 2 years ago"


Question: How to handle failover Timeout with JDBC - Retrying failed queries

"We created a Multi-AZ AWS Postgres (13.4) RDS Instance and are using a java application with Spring + hibernate and HikariCP as poolmanager.If a failover occures in the middle of a query, the query will fail and throw an exception, afterwards HikariCP will wait for a new connection and the application will continue working. We were hoping that there is a way to retry queries that failed due to a failover, either on AWS side by caching the query during downtime or by the use of the RDS proxy, but there is no such functionality.Is there a way to configure RDS, RDS-proxy, Postgres or another aws service to retry failed queries or do we have to handle these errors within our application?FollowComment"

Answer: "0Hello,It's typically the JDBC driver that should be cluster-aware and that's smart enough to cache, failover and retry. It's done the same way on different DB engines, special drivers are provided by DB vendors that achieve all or some of these functionalities.AWS provides its own JDBC Postgres driver that's cluster-aware but only when used with Aurora (not regular RDS Postgres database):  https://github.com/awslabs/aws-postgresql-jdbcCommentShareAWS-ADolganovanswered a year ago"


Question: Can AWS credits be used to pay AWS training & certification

"HiI would like to know, how Can i Use AWS provided Promotional/Partnership credits to pay cost of certification.As I found under AWS Promotional Credit Terms & Conditions that the Promotional Credit will not be applied to any fees or charges for AWS Training, AWS Certification.Please suggest is it possible to used credits against certification?FollowComment"

Answer: "0I believe credits and cert vouchers/discounts are separate. You may be able to get a discount if you are a partner or if you have taken an exam before.CommentShareEvananswered 5 months agorePost-User-8271898 5 months agoYes, We are a APN customer and also taken exam before.We have Professional & Specialty credit code, Can it be used against certification cost?Can you help us to understand is Professional & Specialty credit code comes under credits or cert vouchers?Share"


Question: "create-account-assignment calls fail from CLI, work in console"

"Hello there -I'm running into a problem where I'm trying to run aws sso-admin create-account-assignment from a terminal and while the request is accepted, I then run `aws sso-admin describe-account-assignment-creation-status with the returned requestId and eventually the status transitions to "FAILED" with the error message:{"AccountAssignmentCreationStatus": {"Status": "FAILED","RequestId": "[REDACTED]","FailureReason": "An unexpected internal service exception was encountered","TargetId": "[REDACTED]","TargetType": "AWS_ACCOUNT","PermissionSetArn": "arn:aws:sso:::permissionSet/ssoins-[REDACTED]/ps-[REDACTED]","PrincipalType": "GROUP","PrincipalId": "[REDACTED]","CreatedDate": "2021-09-17T18:20:33.708000-04:00"}}This is when using AWS Access Keys associated with a user in my organizational account.  When I attempt to attach the same permission set to the same group and account in the console, the request succeeds.Has anyone experienced this issue and have an idea what might be going on.  Unfortunately, I'm on a basic plan which doesn't include support.Thanks.FollowComment"

Answer: "0Well, I think I found out what was going on.  The account I was attempting to assign a permission set assignment to was the organizational root account.   When I switched to another account within my organization it worked fine from the CLI.  Not sure why it works when in the in the console though.This gets me unblocked as I can continue with my experimentations becoming familiar with SSO -- especially as managed via terraform.Cheers.CommentSharetgmcrananswered 2 years ago"


Question: Steps to validate user after Force change password

"Hi team,I created a new user in my Cognito user pool with AdminCreateUser AP call, the user is added with sates Force change passwordthen the user will be prompted with an angular front-end page to enter a new password.I'm confused about which method I can use to confirm the user: adminConfirmSignUp, initiateAuth, adminInitiateAuth, AdminRespondToAuthChallenge or adminSetUserPassworddo the user need the temporary password received by email to signup? or only his new password? i don't see any SDK API that takes the 2 arguments:1 -  temporary password generated b Cognito2 - the user chooses the new passwordmy goal is to give the user access, move away from Force change password status, and have a confirmed user who can log in and have an access token.what are the API calls to do after the user receives the invitation message with a temporary password and gives his new password?Thank you team for clarificationappreciate any example that helps me continue the process after AdminCreateUser and Force change passwordThank you!!FollowComment"

Answer: "0Hello,When the user authenticates (InitiateAuth) using the temporary password, Cognito will respond with a ChallengeName=NEW_PASSWORD_REQUIRED. You then need to use RespondToAuthChallenge to respond to the challenge with NEW_PASSWORD and any required attributes that Amazon Cognito returned in the requiredAttributes parameter.Please see the ChallengeName Response Elements of InitiateAuth here [1].[1] https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html#API_InitiateAuth_ResponseElementsCommentShareAWS-Woleanswered 8 months ago"


Question: AWS Deepracer update Error using 20.04.01 update

"https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-vehicle-factory-reset-preparation.htmlI upgraded the aws deepracer to 20.04.01 using the document provided by aws. However, when I booted to usb iso file and installed ubuntu20.04, I received the message "ubuntu has been blocked by the current security policy", so I can no longer proceed. The answers written by aws representatives in the link below are neither correct nor relevant to the document.How should we solve this problem?Please give me accurate information that I can solve this problem.I need a quick answer.https://repost.aws/questions/QUvRolXJh2SVanVuL8aDiUUA/aws-deep-racer-reinstallation-error-and-the-ubuntu-has-been-blocked-by-the-current-security-policyhttps://repost.aws/questions/QUhzOK7OazR5O692KZ9nZxpA/ubuntu-has-been-blocked-by-the-current-security-policy-error-after-updating-aws-deep-racer-device-to-the-ubuntu-20-04FollowComment"

Answer: "0Hello,Sorry you're still having problems with your car, I'm curious as to which version of the car you have, is your car running the 0.0.6 or 0.0.8 BIOS? (you can tell the car type by the size of the front bumper, if the car has a very small front bumper under the camera it is likely to be 0.0.6, if it has a larger front bumper and an AWS logo printed on the side of the compute unit above the HDMI port then 0.0.8) I've flashed both versions of the cars to run 20.04 and not come across this issue, I'm checking with the DeepRacer pit crew to see if anyone has hit this issue that can help and I'll also see what the engineering team suggestsIt's probably worth re-creating the bootable USB stick from scratch and giving a full install another go.https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-ubuntu-update-preparation.htmlYou mention in one of the posts you linked that the screen turned off whilst installing, that's just the screen saver of the live version of Ubuntu we use to perform the install.  During the install we run a shell script that will show on the desktop in a terminal window, once it has completed the install it will but close but the car doesn't reboot itself (it did under 16.04) you should then be able to reboot the car (you'll get a warning about removing the install media)If it fails again with the same error it might be worth looking at flashing the car to 16.04 using these instructions instead.https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-vehicle-factory-reset-preparation.htmlBe careful which version of the restore package you download as you need to use the correct one for the BIOS.Hope this helps and I'll see if I can get a solution to the error you're seeing.RegardsDaveCommentShareDavidFSmithanswered a year ago"


Question: Maintain Table and Column Case During Conversion

"I can't figure out how to maintain table and column case when converting SQL Server Schema to Postgres.I have tried settting"Treat source database object names as case sensitive" = YES In the source database settings"Avoid casting to lowercase for case-sensitive operations" = True in Conversion SettingsThe help context states that "Treat source database object names as case sensitive" option is only valid if the Source Database Case Sensitivity is ON, however, that option is disabled. If the value of "Case Sensitivity" is coming from the collation settings of the source database, then I can't change that.Every time I convert, the table and column names default to lowercase.Update:  I mounted and connected to a test database with a case-sensitive collation, however, the Case Sensitivity property on the Source still has a value of OFF. Perhaps I am daft, but I am not seeing anywhere in the documentation on how to override this value.FollowComment"

Answer: "1Accepted AnswerPlease note that SQL Server is, by default case insensitive.That being said that, case sensitivity in DMS selection rules depends on case sensitiveness of source. However, we can refer to below 3rd party article on "How to Check Case-Sensitivity in SQL Server" to check if case sensitivity has been enabled on database level or table level or column level.[+]  https://www.webucator.com/article/how-to-check-case-sensitivity-in-sql-server/CommentSharePrasad Swamyanswered 4 months agorePost-User-2961749 4 months agoThanks , I follow this comment onlyShareRoss Bush 4 months agoThanks for the answer. I attached a source with the collation set to _CS in one of my tests. I will try again. Maybe I missed something.Share"


Question: Allowing WHM to manage DNS Records from Namecheap

"Hey guysSo, i want to start a small WHM server, i am currently learning cPanel and WHM, and i have a domain with namecheap, i would like to make it so that WHM can manage the domain records, so that i can make accounts etc but i dont get how.I have heard of using Bind to setup nameservers, or using separate nameservers but i am not experienced enough to understand how that works.FollowComment"

Answer: "0First off, I don't know cPanel or WHM at all.That said ...Is namecheap hosting the DNS?I don't think cPanel or WHM would be able to manage the DNS for externally hosted domains.You could setup a bind dns server, but that's pretty complicated and not recommended for those unfamiliar with it.Does cPanel or WHM have a DNS management module so it can manage the bind configuration files?CommentShareDavid Ganswered 2 years ago0I actually figured it outWent to namecheap and used the create Nameserver option and pointed ns1 and ns2 to my server Public IPWent to WHM and changed the default NS Manager to BINDAdded records for my domain on WHM and the nameserversTested and it all works nowCommentSharenatsukireianswered 2 years ago"


Question: Custom domain error

"Hi,Below error message we are getting it on API gateway>Custom Domain Name >Mutual Authentication>while using sectigo certificate. AWS console page is not saving due to below error:Invaild OwnershipVerficationCertificate. OwnershipVerificsationCertificate should be public ACM CertificateRegardsHarryFollowComment"

Answer: 0Accepted AnswerYou need to include the certificate chain in the original certificate. So not only the certificate itself but also the "chain" or the certificate.Read further details here:https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-mutual-tls.htmlCommentShareLockheadanswered 6 months ago


Question: Will AWS SSO conflict with IAM ID provider?

"Hi -I already have a few AWS accounts that use IAM and a SAML identity provider (Azure AD).  I'd like to start implementing AWS SSO, but I want to make sure that it will not conflict with my existing integrations with IAM and federations.  Can anyone comment on that?ThanksAlFollowComment"

Answer: "0Accepted AnswerHi Al,If you start using SSO your existing integrations with IAM will not be impacted.When you use SSO a new IdP(Identity provider) with the name format: "AWSSSO_e1234a56b0b90f8b_DO_NOT_DELETE" is created.After this when you create permission sets and assign them to user, the roles corresponding to these permission sets are then created in IAM with the following name format:-This role was created for the permission set name: AdministratorAccess= "AWSReservedSSO_AdministratorAccess_e12a34c56dfb478a"These roles then have a trust relationship policy which trust the Identity provider created by SSO.I hope this answers your query.CommentShareAWS-User-1257231answered 3 years ago"


Question: Can I get a list of iOT topics?

"I'm working with IOT services using the Java SDK. The main class I'm using is software.amazon.awssdk.services.iot.IotClient.Is there a way to get a list of MQTT topics via the SDK? I can see that there is a function to listTopicRules, but I don't see anything to list the topics themselves.Thanks,FrankFollowCommentFrank a year agoI found some sample code that uses a class called "software.amazon.awssdk.crt.mqtt.MqttClientConnection". However, this package doesn't seem to exist anymore; it's not in the documentation or available in my project.Share"

Answer: "0MQTT topics are ephemeral in that clients simply specify them in publish and subscribe operations. The service does not provide APIs listing topics that your clients are currently using. For reserved service topics defined by AWS IoT services, you can refer to https://docs.aws.amazon.com/iot/latest/developerguide/reserved-topics.htmlCommentShareRyan_Banswered a year ago0Thanks. Regardless of the list of topics, which client or package do I need to publish and subscribe?I'm a bit confused about the AWS client in general. There seems to be a 1.x version and a 2.x version. I assumed I should use the 2.x version, but most of the examples I can find don't work; I think it's because they're written against the 1.x API. What should I do?CommentShareFrankanswered a year ago0You should favor 2.x version.Which AWS IoT SDK are you using?CommentShareDoron-AWSanswered a year ago0You may use IoT Java Client Library. Here is the sample code:import com.amazonaws.services.iot.client.AWSIotException;import com.amazonaws.services.iot.client.AWSIotMqttClient;import com.amazonaws.services.iot.client.AWSIotTopic;public class MQTTTopicList {public static void main(String[] args) {AWSIotMqttClient client = new AWSIotMqttClient("<AWS IoT endpoint>", "<client id>", "<AWS access key>", "<AWS secret key>");try {client.connect();for (AWSIotTopic topic : client.getTopics()) {System.out.println(topic.getTopic());}} catch (AWSIotException e) {e.printStackTrace();} finally {client.disconnect();}}}CommentShareGAanswered 4 months ago"


Question: Control Tower and Baseline CloudTrail versus Organizational Trail

"Can someone please explain what the difference is between the Trail that is created when you create Control Tower versus an Organizational Trail? I created an Org Trail and when i create a new OU, i dont see that action in the cloudwatch logs that is being fed by the baseline trail, but i do see it in my manually created Org Trail and cloudwatch logs. What am i missing? What does the Control Tower Baseline Trail log?FollowComment"

Answer: "0Control Tower generated CloudTrail by default logs management events and pushes logs to CloudWatch logs and S3 bucket.AWS Control Tower is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in AWS Control Tower. CloudTrail captures actions for AWS Control Tower as events. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for AWS Control Tower.CloudTrail is enabled on your AWS account when you create the account.Logging AWS Control Tower Actions with AWS CloudTrailFor organizations trail, it depends on what you enable on the trail but the trail is created in linked accounts in the organization as well.  Unless you have any specific use case for having two same trails, it is best to keep the control tower trail to optimize cost. When you have multiple trails on an account, you incur costs for any additional copies of events delivered. This blog post talks about integrating existing CloudTrail configurations with control tower.CommentShareTaka_Manswered 10 months ago0Just side note: since Control Tower v3 (July 2022) Organizational Trail is and option for Control Tower https://aws.amazon.com/about-aws/whats-new/2022/07/aws-control-tower-adopts-aws-cloudtrail-organization-logging/CommentShareaortegaanswered 2 months ago"


Question: RDS Multi-region design discussion

"Hi guys!I'm designing a global application that host in 2 Regions.My app use SQL database may be MySQL, SQL Server, Oracle, PostgeSQL...My question is if Amazon RDS can deploy the database in 2 different regions and synchronize effectively?FollowComment"

Answer: "1Accepted AnswerThere's an interesting AWS disaster recovery lab that gives information you might be interested. This page: https://disaster-recovery.workshop.aws/en/services/databases/rds/rds-cross-region.html gives an overview of replication options for various RDS database types. Aurora global databases might also be of interest: https://disaster-recovery.workshop.aws/en/labs/advanced/aurora-global-database.html.Being a good distance apart will always mean a compromise between transaction latency and RPO whichever option you choose.Out of interest, is the multi-region design for performance (to keep data relatively close to users) or disaster recovery? I guess you could have a pair of databases, one active in each region with a corresponding passive replica in the other region.CommentShareedeastwoodanswered 10 months agoSteven 10 months agoThanks! Your information is helpful.Share"


Question: Pinpoint exception during endpoint update

"Hi,I've spent the last two hours meticulously following the published instructions for setting up push notifications in my Android app using the Amplify and Pinpoint services.When I run my app, I see this:PinpointException occurred during endpoint update:AuthException{message=Failed to get credentials. Check if you are signed in and configured identity pools correctly., cause=null, recoverySuggestion=Sorry, we don't have a suggested fix for this error yet.}I do not have the slightest idea where to begin debugging this. The stack trace that appears does not lead to any code that I wrote myself, so I don't know where in my app the problem originates. However I can tell with the debugger that my app does execute the Amplify.configure() method without exception.What should I do?FollowCommentFrank 10 days agoI'm confused by all the references to authentication that I'm seeing. My app does not require users to log in to AWS accounts, or any accounts for that matter. I just want to be able to send push notifications to the device. Is this possible?Share"

Answer: "0pinpoint uses Amazon Cognito identity pools to manage and authenticate users. Even if your app does not require users to log in, Amazon still needs a way to uniquely identify each device that uses your app, and that's where the Cognito identity pool comes in. If your app does not require users to log in, you should ensure that you have configured your Cognito identity pool to allow unauthenticated identities. This allows devices to interact with AWS services without the need for a user to log in. You can check this in the AWS Console under Cognito > Manage Identity Pools > [Your Identity Pool] > Edit identity pool. There should be a checkbox for "Enable access to unauthenticated identities".CommentShareEXPERTsedat_salmananswered 9 days ago"


Question: Mounting EFS volume on every Cloud9 EC2 instance

"I would like to create a Cloud9 environment for every developer in my team. Each environment  causes an EC2 instance being spinned up. The developers would all be accessing raw data from an EFS volume. Instead of asking each developer to mount the EFS volume, I would like each environment to mount it automatically. Is that possible?FollowComment"

Answer: "0Take a look at this, AWS Cloud9 Cloud-Based IDE on AWS. You'll see that they use a custom resource (Lambda function) to use Systems Manager to do things on the OS (expand the volume). You could reuse this code to configure your EFS mount.CommentShareEXPERTkentradanswered 10 months ago"


Question: Reuse container layer on docker-compose for GreenGrass deployment

"We have a component that starts multiple container on our greengrass device using docker-compose. According to the documentation, the correct way to provide the private docker images from ECR is to supply them as artefact:"URI": "docker:public.ecr.aws/cloudwatch-agent/cloudwatch-agent:latest"One important aspect of our project is that we can reuse layers of our images. We have limited bandwidth on our devices and images can be big (i.e. PyTorch). If we have modification to do to our images, usually only the last small layer will be updated over the limited bandwidth network. I am worried when we are using images as artifacts, the whole image is going to be re-downloaded. Is that the case ?I currently have a workaround of using the "install" lifecycle step to execute "docker-compose pull" and removing the artifacts, but that has the issue of being run on reboot, while I would rather only have it update the images when there is a new deployment.FollowComment"

Answer: "1Accepted AnswerHello TSpark,Docker pull will not redownload images which already exist. It will only download layers which have changed or do not exist. When using Greengrass to download images as artifacts, Greengrass simply calls docker pull, so all the same caching which Docker does applies equally to Greengrass.CommentShareEXPERTMichaelDombrowski-AWSanswered a year agoTSpark a year agoAwesome, that is great news. Thanks a lot !Share"


Question: error while communicating with connector client error the request to sap failed with status code 400 connection time out

""error while communicating with connector client error the request to sap failed with status code 400 connection time out"Hi, when trying to make a connection between SAP & Appflow with SAP OData connector, we are getting the above error message, please guide on resolutionFollowComment"

Answer: "0Hello Prem, Can you confirm if you are still facing the same issue and can you please provide more details about the error. here are some of the common appflow error [[https://docs.aws.amazon.com/appflow/1.0/APIReference/CommonErrors.html]CommentShareDeep_Kanswered 3 months agoPrem 3 months agoHi Deepak,It's about certificate error, after implementing SSL certificate the issue is resolved as there is a mismatch with the host name.Share"


Question: How to handle path-based routing for SPA when CloudFront has multiple behaviors?

"We have an Angular SPA hosted on S3/CloudFront and we would like to use path-based routing. When a link like https://ourapplication.com/foo/bar is opened in a browser, we need the request to resolve to a 200 response containing the contents of index.html, so that the path part of the URL /foo/bar can be processed as a route by the Angular app running in the client.We got this working by adding "Custom Error Responses" to the CloudFront distribution -  when the path /foo/bar is sent to the S3 origin, a 403 is generated. The custom error response maps this 403 to a 200 response with the contents of index.html. Perfect, apart from the fact that we also have another behavior on the CloudFront distribution that routes requests matching /api/* to API Gateway. Since the custom error response applies to the entire distribution, any API response returning 403 will also be mapped to index.html/200 - not what we want.Ideally we would have a per-behaviour or per-path custom error response.We tried to replicate something similar with redirection rules on the S3 bucket, but for various reasons this doesn't seem to be possible. Even if this could be made to work, it would always result in a redirect being sent back to the client instead of the index.html content being returned in the original request, so an extra round trip is required.We also considered Cloudfront/Lambda@Edge functions - we'd prefer not to use the latter for cost reasons. It's not clear how we would implement this with Cloudfront functions given that only Viewer Requests/Responses are supported there.This SO post describes the same problem, and a possible solution based on Lambda@Edge Origin response handlers, which we'd rather not use for cost reasons.If we can't solve this, we'll probably fall back to hash-based routing but that has drawbacks for SEO, analytics etc.A path-based SPA with a same-origin API routed via a CloudFront behavior must be a fairly common scenario, so hopefully there's a better way or perhaps something on the CloudFront roadmap.FollowComment"

Answer: "1There are a couple of options I can think of for solving this:Using CloudFront Functions: Inspect the URI and rewrite (not redirect) any requests for /foo/bar etc. to /index.html. CloudFront will serve index.html from cache if it's present, or from the origin if required.Using Lambda@Edge: On Origin Request for your non-API behaviors, inspect the URI (if necessary) and return the static HTML directly from Lambda - see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-generating-http-responses-in-requests.html for details on generating HTML responses in Lambda@Edge. This may not have the cost impact that you think, as the function will only be invoked in the event of a cache miss. Provided your cache hit ratio is high enough (above about 85%), this option would actually cost less than CloudFront Functions.You could also use Lambda@Edge to perform a rewrite, if you'd prefer to store the html content in S3 rather than generate it in Lambda every time. Again, this may work out cheaper than CloudFront functions if your cache hit ratio is high enough.CommentSharePaul_Lanswered 9 months ago"


Question: I cannot create lambda function

"I have a constant red error banner at the top of the /lambda/home page.I have an error 403 access denied from my cloudFomtion for lambda,I can't create it with ui, only Create function has infinite loadFollowComment"

Answer: "1Hi,Could be related to this: https://repost.aws/questions/QUJ_HWorvjR_6UBV2LHwbx_g/cannot-access-aws-lambda-console-with-the-error-saying-you-do-not-have-sufficient-permission-access-deniedHope it helps ;)CommentShareEXPERTalatechanswered a month ago0I hope you don't have access for same.Few things is not clear in the question. Could you please explain little moreAre you able to create Lambda function from UI?Are you able to create Lambda function from Cloudformation template?Do you/clout formation execution role have sufficient permission to create lambda function?CommentShareNirmalanswered a month ago0If you don't have access to create it in the AWS Portal with your user, then you can't create it in cloudformation since it is using the access with the default setting.You could create an IAM Role for Cloudformation with policies that allows you to create Lambda Functions, then attach it to the Cloudformation Stack:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.htmlCommentSharevtjeananswered a month ago0Hello,If you are getting red banner on top that means you don't have permission to create lambda function in AWS management console and for the same reason cloud formation would not work because it basically create resources automatically on your behalf.In your question it's not clearly mentioned whether the AWS account that you logged into is your own personal account or you logged into an AWS account as a federated user with permission applied to the account from the management account.If its personal account, then I believe you should be able to access all the AWS services. Just make sure you create an IAM admin user account and should lock down the root account. If you are using AWS account as a federated user then please contact your AWS system administrator to provide you AWSLambda_FullAccess and all other applicable service access.I hope its just a permission issue and by contacting the system administrator, you should be able to resolve it.CommentShareHarry Siddhuanswered a month ago"


Question: Sudden NET::ERR_CERT_AUTHORITY_INVALID on ACM certs

"Suddenly we see NET:ERR_CERT_AUTHORITY_INVALID on our ACM certificates we have not changed the certificate, and all looks good in the ACM dashboard. What could be causing this?Edit browsers are chromeFollowComment"

Answer: "0Hello,Given these informations, it possible that your certificate expired. If you imported your certificate in ACM, ACM is not able to automatically renew your certificate (cf. Managed renewal for ACM certificates).In this case, you need to request a new certificate.Also, I recommend you take a look to the following to prevent and/or anticipate certificates expiration:AWS Certificate Manager now provides certificate expiry monitoring through Amazon CloudWatchHow to monitor expirations of imported certificates in AWS Certificate Manager (ACM)CommentShareMickael-AWSanswered 10 months agouser-4564135734 10 months agoSo it looks like the certificate is still valid for another year.ShareMickael-AWS 10 months agoIs your cert self-signed ?Share"


Question: Working with AWS Inspector ECR Findings - How do you do it?

"I've enabled AWS Inspector and Security hub across my organization with all scanning modes. Ideally, I'd like to use either the official Jira Service Management integration or the aws-samples version for Jira software (https://github.com/aws-samples/aws-securityhub-jira-software-integration) as a way of integrating these findings into something that lets me manage them.The problem is, when I look at the findings for ECR I can see there are a lot of duplications and would therefore create a lot of noise and duplicate tickets. This is because the same vulnerability is detected across every image in the repo (there are hundreds in each repo). Which is then magnified again when the same base image is used across multiple repos (there are about 50 repos). Really, I only care if a vulnerability is detected in the most recent image.I tried creating a suppression rule but Inspector's suppression rules are way too basic. Say I want to suppress any image that does not have the "latest" tag. This means any image that has both the "latest" tag and another tag of any name is then suppressed. So either I have to create a separate repo specifically for inspector scans or I make sure the tag I want to scan has a different digest somehow.I guess all of this is to compensate for a Jira integration that doesn't handle the aggregation. So my question really is, how do you consume and act on Inspector findings?FollowComment"

Answer:
"1Hello,

When you activate Amazon Inspector scans for Amazon ECR, you set Amazon Inspector as your preferred scanning service for your private registry. This replaces the default Basic scanning, which is provided at no charge by Amazon ECR, with Enhanced scanning, which is provided and billed through Amazon Inspector [1]Enhanced scanning gives you a choice between continuous scanning or on-push scanning at the repository level. Continuous scanning includes on-push scans and automated rescans. On-push scanning scans only when you initially push an image. For both options, you can refine the scanning scope through inclusion filters.Also automated re scans are triggered for container images based on whether you use the continuous or on-push option in your Enhanced scanning settings.Configuring enhanced scanning for Amazon ECR repositories:Open the Amazon ECR console
Select the Region that contains the repositories that you want to scan.
In the navigation pane, choose Private registry, then choose Scanning.
In the Scanning configuration section, choose Edit.
Under Scan type, choose Enhanced scanning.
By default, the Continuously scan all repositories option is selected which turns on complete Amazon Inspector scan coverage for all repositories. Deselect that option and select Scan on push all repositories to run scans only on initial push of an image.

(Optional) Specify which repositories to include in scans for continuous or on-push scans by entering the repository names in the input box and selecting Add filter.

Choose Save.
(Recommended) Repeat these steps in each AWS Region for which you want to activate Amazon Inspector scans for Amazon ECR repositories.Now to Act upon Inspector findings, kindly find below link [2]  which mentions all the  bulletins for security or privacy events pertaining to the Amazon Linux AMI.Thank you,References :

[1] https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html
[2] https://alas.aws.amazon.com/CommentSharerePost-User-9930743answered a month agorePost-User-4721317 a month agoThanks for this info. The direction I was going in with my question was more relating to business process than the technicalities of how to remediate individual findings. I.e. Inspector has detected hundreds (or thousands) of findings... So now how do we work out within the business what findings are effective duplicates and which findings matter. Of course, this is entirely dependent on everyone's individual circumstances but I was interested to hear some examples.Share"


Question: 503 Service Temporarily Unavailable

"I got this page after deploying a version which was previously running successfully. There's only one instance in my application and I'm getting a "degraded" integrity. As for the causes, it is stated that "Application deployment failed [...] with exit status 1 and error: Engine excution has encountered an error. Incorrect application version 'app-....' (deployment 67). Expected version 'app-...' (deployment 66)."It's my first time AWS and I'm a overall newbie... What am I missing, since the website was running smoothly before this last attemped deployment?I appreciate any help....Ovidio (from Brazil)FollowComment"

Answer: "0Hi Ovidio!From the notes, I understand that you got an error 503 Service Temporarily unavailable, with application deployment failed, engine execution has encountered an error and incorrect application version, after deploying your app. Please correct me if my understanding is wrong.Please note that the 503 Service temporarily unavailable error response code indicates that the server is not ready to handle the request. This could mean that the targets behind the Application Load Balancer (ALB) are either not responding to the requests, or the ALB does not have registered targets. You can follow the document link [1] to figure out the problem. You can enable access logs for your ALB to help you figure out the reasons for the failure [2].For “Engine execution has encountered an error”, you can use the following document link [3] for the steps to troubleshoot.Please note that Elastic Beanstalk monitors your environment for consistency following deployments. If a rolling deployment fails, the version of your application running on the instances in your environment may vary. You can check the document in link [4] on notifications and troubleshooting.This will help you solve the issue, by giving you steps on how to redeploy a previous version which you know works and configuring your environment to ignore health checks during deployment and redeployment of the new version to force the deployment to complete.I hope you find the above information helpful.Have a great day ahead!References:[1] https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html[2] https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#enable-access-logging[3] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/troubleshooting.html[4] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environments-health-enhanced-notifications.htmlCommentShareLettyanswered a year ago"


Question: Custom domain with aws-appsync's AppsyncClientService

"Hi,I am using the AppsyncClientService in Angular with the package aws-appsync and it worked fine for me - until I wanted to use custom domains for my AWS graphql interface - then subscriptions stopped to work (more precisely the websocket connection).I was using following code:public getAppsyncClient() {    if (this.awsAppSyncClient == null) {      this.awsAppSyncClient = new AWSAppSyncClient({        url: aws_exports.aws_appsync_graphqlEndpoint,        region: aws_exports.aws_project_region,        auth: {          type: AUTH_TYPE.API_KEY,          apiKey: aws_exports.aws_appsync_apiKey        },        disableOffline: true      }).hydrated();    }    return this.awsAppSyncClient;  }In some magical way, the specified address was converted from https://xxx.appsync-api.eu-central-1.amazonaws.com/graphql to wss://xxx.appsync-realtime-api.eu-central-1.amazonaws.com/graphql in the background. This does not happen using custom domains (where the realtime url is simply the http url + "/realtime"). So, AWSAppSyncClient lost its magic.Is there any way to tell AWSAppSyncClient to use a custom websocket url?Thanks for any hint!!FollowCommentNoneNone a year agoHi Big Red,I did not understand the problem clearly, would you be able to detail it better?Anyway, try to see if there is any field in the configurations that might interest you (maybe disableHostPrefix?)https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-appsync/interfaces/appsyncclientconfig.htmlShare"


Question: Viewing To: address in Amazon Workmail web client

"In WorkMail, I have a primary e-mail address (of course) and one e-mail alias. When I receive a message, I would like to be able to tell whether the message was sent to my primary address or to the alias.When using the Amazon WorkMail web client, is there a way to view the e-mail address that a message was sent to?FollowComment"

Answer: "0Accepted AnswerHi,You can find the original email address a message was sent to in the message headers. For WebMail this means opening the message by double clicking (not in the standard reading pane) and clicking the envelope + gear icon in the top right of the email. This will open the message headers and allows you to find the original addressed email. (https://docs.aws.amazon.com/workmail/latest/adminguide/email-headers.html)You can also create a email rule that checks the message headers for an alias and move it to a different inbox to make it a little easier. (https://docs.aws.amazon.com/workmail/latest/userguide/email-rules.html)Kind regards,RobinCommentShareMODERATORrobinkawsanswered a year agoMonica_Lluis SUPPORT ENGINEERa year agoThank you for the answer, robinkaws.AWS-User-8851673, let us know if this answers your question. If this solved your issue, please remember to click on the "Accept" button to let the community know that your question is resolved. This helps everyone. Thank you in advance.ShareAWS-User-8851673 a year agoThanks for the info. I found that reading the envelop/message headers does provide the info, but is not very human-friendly.I was able to add an email rule to route e-mail addressed to the alias to a specific folder. That solution works for me. It took a few tries to find a rule that worked, but I discovered the trick: in the "is sent to..." rule, I have to precede the address with "smtp:", e.g. smtp:alias@myidentifier.awsapps.comShare"


Question: Global accelerator and traffic redirection across regions

"We have a load balancer serving traffic on us-east-1 region. In order to improve latency for european users, I was thinking to use Global Accelerator anycast and create another load balancer in one European regio (e.g. eu-central). In order to save costs, I would like not to duplicate the infrastructure in the new region, basically I want to redirect traffic from the european load balancer to the machines running in us-east-1.I would like to clarify the following points:Does it make sense to use the Global Accelerator in such scenario? My reasoning is that using anycast a european user will be redirected to an AWS entrypoint closer to its location and from that point it is inside the AWS backbone (which should be faster than reaching the US entrypoint via normal internet).Is it possible to redirect traffic from a load balancer in one region to machines (target group) in another region?FollowComment"

Answer: "0I would look at doing it without the extra load balancer.  Although you're not leveraging the failover benefits of GA you still reduce routing over public internet which leads to inconsistent performance, and improve DDoS protection.  AWS claim up to 60% improved performance.  You can check https://speedtest.globalaccelerator.aws to see what performance improvement you would get from your location.CommentShareEXPERTskinsmananswered 2 months ago"


Question: "I could not access my lightsail instance and after a re-boot, I now get a 'welcome to nginx!'  message"

"The title of the question is pretty much the problem i.e. I can not access my app via http://3.98.148.132/I need access, so how do I remove nginx?FollowComment"

Answer: "0I think we can place your application content in the Nginx document root."welcome to nginx!" is the default Nginx page.This appears when content has not yet been placed in the document root.The Nginx document root is probably "/usr/share/nginx/html", so try placing your content in this directory.Incidentally, if the directory is different, please check the Nginx configuration file named "nginx.conf" in the directory "/etc/nginx".CommentShareEXPERTRiku_Kobayashianswered 22 days ago"


Question: "Elasticache shows network in and out as exceeded, but how?"

"I have a small redis instance running in Elasticach with one shard running with clustering mode off.It is showing that we have exceeded our network bandwidth in and out:It also shows that we're barely using our network, with peaks below 30Mbps:That's not much bandwidth that we're using, but to confirm what we have available, I went to the pricing page, which says that my instance (cache.t4g.small) provides "Up to 5 Gigabit" of network performance. Seems like 30Mbps is a lot less than 5Gbps!Is this an error in the metrics reporting or am I missing something? Should I be worried about the exceeded bandwidth problems? If so, I don't have many options. The next bigger instance that provides more network performance is a cache.m6g.large, which costs about 10× what I'm paying now!I'm not doing anything crazy with this cache. I'm surprised I'm running into all this.Edit, after scale-upPer comments, I scaled up Elasticache to the next size bigger, which has twice the baseline network capacity. I hoped this would remove the exceeded network problem or at least halve it, but it seems to have made no impact at all. Here's the latest charts. The spike in the middle is the scale-up event (when the entire DB was copied to the larger instance), so left of the spike is the small instance, right of it is the larger one:FollowComment"

Answer: "1Hello,I don't see any major issues with the graphs you're sharing here because there are no plateaus in the graphs, they're all spikes.  Are you seeing any performance issues with the application that's actively querying these cache clusters or are you just concerned with the metrics themselves?A things I'd like to note about the graphs:The "Network Bytes In" and "Network Bytes Out" or NetworkBytesIn/NetworkBytesOut is measured in Bytes and not Bits, so effectively you're using ~287Mbps Out and ~207Mbps In at the peak of those spikes listed together which makes ~500Mbps.  The instance type you're using (cache.t4g.small) has a burstable rate of 5Gbps, but that's an amount that can be sustained over long periods of time.  Per this Available instance bandwidth doc:Typically, instances with 16 vCPUs or fewer (size 4xlarge and smaller) are documented as having "up to" a specified bandwidth; for example, "up to 10 Gbps". These instances have a baseline bandwidth. To meet additional demand, they can use a network I/O credit mechanism to burst beyond their baseline bandwidth. Instances can use burst bandwidth for a limited time, typically from 5 to 60 minutes, depending on the instance size.The values you're seeing on the "Network Bandwidth In Allowance Exceeded" and "Network Bandwidth Out Allowance Exceeded" or NetworkBandwidthInAllowanceExceeded and NetworkBandwidthOutAllowanceExceeded  graphs are individual packets that are dropped due to exceeding the inbound/outbound aggregate rates. Relevant Docs.Because you're effectively using ~300-500Mbps at the peak of your spikes, some packets may be dropped due to the small size of the individual instance and the supported network throughput baseline.  It would be beneficial to either spread the load out over multiple cache.t4g.small instances or upgrade the size of the current instance to a larger instance that supports additional network throughput.If you're not seeing any performance degradation of the application that's querying the cluster, then you should be fine in the current configuration.CommentShareEXPERTChris_Ganswered a year agomlissner a year agoThanks, this is very helpful. So now the question is, "What is the baseline bandwidth for various instance types?" I understand that it bursts up to 5Gbps, but if that's true a baseline of ~500Mbps seems off. That's a huge delta but I can't find what the "baseline" actually is. I also have been trying to see if going up to the next instance size (which also has "up to 5Gbps" network) would increase the baseline or not. The docs mention network credits, but there seems to be no way to see them in metrics. Finally, I'm having network problems, but they could be from something else. Thank you!Sharemlissner a year agoAh ha! I found the baseline bandwidths here. They really are totally different from the "Up to" amounts, wow. It looks like the baseline for a t4g.small is 0.128Gbps, and for t4g.medium is 0.256Gbps, so hopefully scaling up will help. I just gave that a try. Will know soon if it worked. I'd still love to see a metric of network credits though, if such a thing exists.Sharemlissner a year agoSorry to keep commenting. I scaled up the instance and it made no impact at all. I updated my question with the details. Thank you again for your thoughts.Share0There are two types of bandwidth limits - baseline limits and burst limits - and these limits vary by instance type - These are limits imposed by EC2 and not ElastiCache. There is a metric that calculates the bandwidth used (Bytes in/Bytes out are calculated separately) and basically based on this utilization, you will see the service throw the message - I would reach out to either support/your account rep to get additional details. Let me know if you have any questions, thx.CommentShareMahee Gunturuanswered a year ago"


Question: AWS SES Subscription Managemnet

I am try to create contact list and try to use along with send email function in aws cli. I do find any option to create list. the command is no longer available. Earlier it was available and I don't not find any documentation regarding the change. I would like to new if there is any changes in aws SES and how to manage subcription list of users using aws service.FollowComment


Question: Are IAM Unique Ids globally unique?

"As described here, all IAM users have a unique identifier. Is this identifier unique per account, or is it unique globally across all AWS accounts?FollowComment"

Answer: "0Accepted AnswerGive a peek to this talk I gave at SANS for more detail. https://www.sans.org/webcasts/aws-id-prefixes-aws-doesnt-cover-11Unique IDs AWS confirms in many support cases that an ID "collision" will not happen.Let me know if you have any issues with this, or if it helps you then please accept my answer after you've tried it out - it would be much appreciated! Good luck :)CommentShareD Ganswered 17 days agorePost-User-7543992 17 days agoThanks! The talk was very interesting and helpful.ShareD G 16 days agorePost-User-7543992@ no problem I gave that talk quite sometime ago. Glad you enjoyed it!Share0Hi,given IAM users are defined by account-related ArNs (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html), I would say they are unique across account, not globally.Hope it helps ;)CommentShareEXPERTalatechanswered 17 days agoGary Mclean 17 days agoI believe they were referring to the ID and not the arn.Technically there could be a clash and not knowing if aws accounts or track theses some where. but based on the  complexity of the unique ID then it’s very unlikely.The unique ID is like a GUID or a SHAThe arn is a friendly name.Sharealatech EXPERT17 days agoOk, I thought it referred to the unique IAM User ARN, but good that D G could clarify ;)ShareD G 16 days agoThey ARE unique globally they have to be to make sure that cross account unintended access would not be granted.Share"


Question: AWS TRANSFER FAMILY SFTP SERVER

"Hello All,I have deleted my sftp server in transfer family that contain all my users. Worst i don't have any inventory for the users. How do i recover.FollowComment"

Answer: "0Unfortunately, there is no way to recover the deleted server and users.CommentShareKevinanswered a year ago"


Question: AWS ECR Storage Usage

"If I push a new tag for an existing image in ECR, it is shown in the UI as a separate image.  Likewise I may have many different images, where only the top layer changes, but it will be shown as a lot of (large) images.  Is there a way to view the actual storage utilization of the account on ECR, taking into account the layers that are shared between images?Thank you for your timeFollowComment"

Answer: "0In the AWS Cost Explorer, by filtering on service: Amazon ECR and applying a group by usage type, you could get down to an hourly pricing per region for your repositories. From there, you could get a rough estimate of the total storage by using the pricing of the ECR storage for that region.If you need something more precise, I suggest to look at the Cost and Usage Report (CUR), it will have more granular details per repositories, etc. Using Athena it's possible to build query to get the exact report you're looking for.Here's a link to the documentation to use Amazon Athena to query CUR : https://docs.aws.amazon.com/cur/latest/userguide/cur-query-athena.htmlCommentShareMBanswered a year ago"


Question: One Organization vs Multiple AWS organizations for a large enterprise

"As we plan to move to cloud, we are debating whether we should have multiple AWS organizations (one for IT workloads , one for Customer Service, one for SaaS products/offreings we provide to our end customers)..What are the pros and cons of creating multiple organizations (one for each of the above) vs creating one at Enterprise level and creating three OUs underneath and then multiple other OUs under each represening their own workloads/orgs ?Is it possible to consolidate billing at OU level vs master a/c level?Edited by: ViralPatel on Jul 25, 2020 5:07 PMFollowComment"

Answer: "0Billing cannot be consolidated at the OU level.For a large enterprise, it depends what your use-case is. Multiple Orgs makes sense if you have a separate sandbox org where you may want to test policies or org changes before they are applied to the entire organization, or if your enterprise runs like completely separate teams without any central governance and separate billing considerations. However, if you just have a large enterprise with multiple different teams, a single Org likely serves that use-case better, with divisions at the OU levels, which you can manage up to 5 deep.All of the central management features from Organizations lose their ability outside of the Organization. For example, do you have central teams that manage infrastructure or security? Will there be a single team (/admin) that manages the whole cloud infrastructure? Are there any policies that you plan to apply for the entire enterprise? Multiple Orgs adds some overhead if you have any central team management, because you'll have to apply any central changes in multiple Orgs. In addition, you lose some of the visibility or capabilities from AWS services that have org features (e.g. Access Analyzer/GuardDuty/Config/Backup, etc.)You can read more about the org structure suggested by AWS, which serves both large and small enterprises: https://aws.amazon.com/organizations/getting-started/best-practices/Edited by: andybee113 on Aug 7, 2020 2:18 PMCommentShareandybee113answered 3 years ago0Thanks Andybee113.In our case, IT infrastructure will be centrally managed while other functions like Engineering or Customer Experience may manage their own applications. Within IT, we have 6-7 functional teams and 3-4 shared team with 1000+ applications across all. Our budgeting process, security requirement, compliance etc may differ for IT applications (mostly internal) vs Customer expeirnce and Engineering (SaaS products) but all of them could still benefit from organization concept.Hence our thought to have 3 different organization with centralized billing, infra management, security and compliance etc at each of this Organization level.CommentShareViralPatelanswered 3 years ago0Based on what you describe, it sounds like it could still be achievable with a single organization, at least for the sake of shared infrastructure. The whole idea of an organization is that you should be able to set up OU's that serve differing needs (e.g. OU for infra, OU for security, then OUs for workloads/applications/teams...you could create 3 sub-OUs in security for the separate security needs, then sub-OUs in each workload for the differing compliance requirements.)Having three separate orgs works too, but the main benefits you'll miss out on is consolidated costs (you'll have three separate bills with varying costs), and then having to set up any org-related actions/features for three separate organizations instead of one.CommentShareandybee113answered 3 years ago0+1 on the other responses.Although you can't consolidate billing per OU (currently, a good feature request!), you can create billing reports based on linked accounts.  This may or may not meet your needs.If you are large enough to chargeback or budget based on multiple accounts (or per OU), I'd look at 3rd-party cloud-service billing options.  These are much more flexible at getting the billing and other reporting details (usage, savings, security, etc.) out that you may need, usually for a nominal price (1.5-3% of your cloud spend, depending on features.)  We use one of them, which also can integrate with your ITIL systems, custom integration via APIs, etc.Another option is to take your Cost and Usage Reports and feed them into something like Quicksight or 3rd-party options, to create dashboards with actionable information.  Can be very slick if you have the resources to do so.Also, there are some needs for multiple Orgs (legal/regulatory/etc.) that you may not be able to avoid.  However, if you don't have those requirements, I would advise against more than one PRODUCTION Org.  You may want a test Org for something like Control Tower, which is hard to test some changes (currently) in one Org.  If you're working with AWS Prof. Services or other consulting, that may also help keep everything in one Org.Good luck on your cloud journey!RobCommentShareRobElanswered 3 years ago0Thank you Andy and Rob for additional information and suggestions.CommentShareViralPatelanswered 3 years ago"


Question: Livestream Restreaming without Transcoding – AWS Elemental

"Hi,is it possible to restream the ingested livestream without transcoding to avoid quality loss?The planned workflow is to ingest a SRT livestream with AWS Elemental MediaConnect and then restream the livestream with AWS Elemental MediaLive to YouTube and Facebook.Is it possible to re-wrap the SRT stream into a RTMP stream without transcoding the video? I do it with FFmpeg all the time. How would I setup such a workflow in AWS Elemental?Thank you.FollowComment"

Answer: "1Accepted AnswerCurrently AWS Elemental MediaLive does not provide rewrapping to different protocols without transcoding. For MediaLive to create RTMP output streams, it needs to transcode from the input source.https://docs.aws.amazon.com/medialive/latest/ug/creating-rtmp-output-group.htmlIf your SRT stream contains a video with a bit rate higher than the desired RTMP distribution bit rate, then the transcoding of the video should not create much of a quality impact on the final output stream. This is a typical workflow that many providers use to create an RTMP source to social media feeds.If you already have a working rewrap using FFMPEG, then you may need to create a component that receives the output transport stream from AWS Elemental MediaConnect. If the SRT stream to MediaConnect is a multiprogram stream (MPTS) then you will also need to select the desired stream within the MPTS to feed to the FFMPEG rewrapping.CommentShareMike-MEanswered 17 days agosaltarob 17 days agoThank you so much.Share"


Question: AWS elastic DR for data replication

"Hello ,Can we use AWS elastic DR for continuous replication of data between two AZ in Mumbai region.  We are evaluating Elastic DR against cloudendure for Mumbai regionFollowComment"

Answer: "0Yes. It is a supported use case. You need to specify the subnets where your recovery is desired in the settings, and it can be same region.CommentShareRodney Lesteranswered 8 months agorePost-User-0382502 8 months agoHi, as per the AWS documentation (https://docs.aws.amazon.com/drs/latest/userguide/replication-server-settings.html) it says "Replication Servers are automatically launched and terminated as needed" .Can you help me understand1.) what's the trigger for automation on and off2.) Can we apply EC2 instance savings plan for replication server3.) What's the OS used by replication serverShare"


Question: Stuck at Connecting to Asset Processor

"Hi all,I'm attempting to run Lumberyard on a Windows 10 Amazon Workspace(Graphics Bundle). I'm getting stuck right after setup at "Connecting to Asset Processor".I'll attach screenshots of the error.REMOVEDUPLOADworkspaceslumberyardeditor3.pngI've tried a lot of the suggested fixes like the below: https://forums.awsgametech.com/t/unable-to-connect-to-the-local-asset-processor/2578/1But running AssetProcessor and AssetProcessorBatch doesn't seem to do anything. No AssetProcessor process actually ever gets started according to what I can see in Task Manager, and Windows Sysinternals Process Explorer.There's no local Cache file in /dev/ for me to delete cause the AssetProcessor doesn't ever seem to have started successfully.I turned off the Windows Firewall in case there was an issue with networking on the local interface. (I also tried with the firewall on with rules allowing the documented ports through.)I've tried uninstall/reinstall, I've also tried this on another separate windows 10 workspace and I'm running into the same issue. Asset Processor just appears to never get started, even when I attempt to start it manually.Kinda stumped here, anyone able to help? Or encountered this before? Are there any debug logs for editor crashes I can find somewhere that might help? This worked fine on my Windows 10 local machine, same Lumberyard build.Thanks,RobFollow"

Answer: "0Accepted AnswerHello @REDACTEDUSERHave you tried running the Asset Processor as an Administrator? I experienced the same issue when I was using AppStream 2.0 as well.Let me know.Thanks!SharerePost-User-5162062answered 5 years ago0Hey @REDACTEDUSERStay tuned!SharerePost-User-5738838answered 5 years ago0Thanks! Appreciate it :DSharerePost-User-3909545answered 5 years ago0So, I decided to just straight up try running the Lumberyard Editor as an administrator hoping that the permission would be inherited by the Asset Processor, and it worked :DThanks for the help!SharerePost-User-3909545answered 5 years ago"


Question: ECS Fargate charge by CPU/memory defined on task or on container

"I have an ECS Fargate task with a few containers that depend on each other sequentially (so container A runs first when the task starts, then container B starts once A succeeds, and so on). Some containers need large CPU/memory while some only need small ones. To make sure all of them have sufficient resources, I set the CPU/memory for the task as the maximum resources needed across all containers.My question is, does AWS charge me based on the resources allocated to each container, or on the resources requested by the task? The latter would be much more expensive because all container run time will be charged by the maximum rate.FollowComment"

Answer: 0Example 1 in this document shows the fee based on the number of tasks.https://aws.amazon.com/fargate/pricing/?nc1=h_lsSo I guess the answer to your question would be to charge based on the resources requested by the task.CommentShareEXPERTRiku_Kobayashianswered 15 days ago


Question: EC2 Serial Console - 500 Server Error

"Hi!I'm trying to use the EC2 Serial Console but doesn't work. I did all configuration follow the documentation and when I try to connect I get the message "EC2 service page is currently unavailable" with the title "AWS: 500 Server Error". Does it a bug? What can I do to use the EC2 Serial Console in my EC2 Instance?Thanks!Att,Marcos MeiraFollowComment"

Answer: "0EC2 Serial Console is available in AWS GovCloud (US), us-west-1, ca-central-1, eu-west-2 , eu-west-3 , ap-northeast-2 , ap-south-1 , sa-east-1 and eu-north-1 regions. Can you verify the same if the region is appropriate ?Also, EC2 Serial Console Access is available for Nitro virtual instances running either Windows or Linux.Also, check out the step by step troubleshooting mentioned in this document with respect to the Serial port.Link- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.htmlCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year ago"


Question: How to fix the error code 1020

I am trying to build an application to connect to the site chat.openai.com in the amazon ECS.BUT there is something wrong with access the site.The access request is denied. The response code is 1020 error.Would you help me out?FollowComment

Answer: "0I would suggest checking the OpenAI support/forum pages, this seems like an error returned from their side (either CDN or API).CommentShareEXPERTRaphaelanswered 2 months ago"


Question: https 적용이 안됩니다.처리부탁드립니다.

"Currently, I purchased the ssl certificate for ariacoin.info from aws and have completed the certification. I did everything according to the manual.http://ariacoin.infoOrYou can access http://www.ariacoin.info.https://ariacoin.infoOrhttps://www.ariacoin.infois not accessible by .I want you to take care of this.Please.FollowComment"

Answer: "0Please submit a ticket to the AWS Training & Certification customer support team, and they will provide assistance. If you already submitted a case, please allow at least 48 hrs to get a response.CommentShareNelliT-AWSanswered 3 months ago"


Question: "Lightrail: Oh boy, this is very frustrating"

"Hi everyone,I am new here but having a terrible time with Lightrail that I hope you can guide me with. I set up a Windows 2019 Instance for $8/mth. I followed the online video instructions as I just need a simple web server to serve web pages. Since WordPress is not available under Windows I installed IIS and copied a single index.html file to it. I can remotely browse to the page albeit very slowly, or sometimes not at all.The system itself on AWS though is completely unusable, the browser-based RDP connection is very hit and miss and always takes many minutes to connect (if it does at all).  I stop the server or reboot but nothing helps with RDP and I am locked out for hours. When I can RDP connect each and every mouse-click takes minutes to respond, most of the time open windows (when they finally do open) display a "Not Responding" message as they slowly paint and repaint on the screen, application use on the server is impossible (they never start and even the Start menu can takes minutes to open). I have also used my local Remote Desktop client to connect with the same performance issues. I am on a gigabit connection.Can anyone tell me what I am doing wrong, or is Lightrail a realistic solution for a website? I am running IIS locally and have never had a problem but could that be incompatible with Light rail in some way? Is there an option I should be using that I am not aware of (all I did to start was select N. Virginia and Windows 2019). Any guidance you can give me would be a great help as I think I need to delete what I have and start again.Thank you for any help you can provide.FollowComment"

Answer: "0Hi, cutTheBlueWireIt is reasonable that you try to use more expensive and powerful instance than 8$ one you choose.I recommend you check the minimum system requirement for Windows Server 2019 athttps://docs.microsoft.com/en-us/windows-server/get-started-19/sys-reqs-19AWS guys, 8$ 512MB memory instance can reasonably work for the Windows Server 2019?Good luck.LipiCommentShareLipianswered 3 years ago0Thank you Lipi,I think you are correct. I looked at your link and when I look at the instance type it is a T2.nano with only 512MB of RAM and an AMD chip which is probably not the most powerful so I suspect the machine is just too small. I'll try again with a larger instance and see what happens. Also, I choose the latest Windows Server 2019 which possibly needs more resources (Windows Server 2012 and 2016 are also options) and it is really locked down from a security point of view.Thank you!CommentSharecutTheBlueWireanswered 3 years ago0I thought I'd come back with an update:I created a new Windows instance. This time I went for Windows 2016 and 1vCPU with 2GB RAM instead of the 1vCPU with 512 MB last time, this is the $20/month option. This time it created a "t2.small" instead of the "t2.nano" it created late time so I think the CPU is better too.Result: a total transformation - everything works perfectly now and performance is very good. I was able to do more in 30 minutes today than I did in 10 frustrating hours yesterday battling the smaller $8/month ("Free") instance option. It now runs IIS great. My advice then is that if you are choosing a Windows instance on LightSail you need to stay away from that first $8 low-cost option and go with something bigger and with more memoryThank you.CommentSharecutTheBlueWireanswered 3 years ago"


Question: Need to use Postgres 14.3 as source in DMS

"Need to create CDC pipeline in DMS with Postgres 14.3 as source, can you please help to add this request or provide a timeline by when will this be added.FollowComment"

Answer: "0Hi,Our DMS engineering team is working on supporting the minor releases under engine version 14.X PostgreSQL to be supported as source/target for Database Migration Service.Requesting you to kindly keep an eye on the below links for getting update on once they are released:[1] Document History - https://docs.aws.amazon.com/dms/latest/userguide/WhatsNew.html[2] AWS DMS Release Notes - https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReleaseNotes.htmlCommentShareVivekananda Mohapatraanswered 9 months ago"


Question: create Secret with namy generated password/keys with CDK

"Hi team,I want to create a secret via CDK that contains 2 passwords (API keys)secretName = ApiKeyskeys/values =key: password1, value: auto-generated password (current)key: password2, value: auto-generated password (previous)the CDK syntax I found allows only to create a secret with one secret inside it, is there a way to create a secret in a secret manager with many generated secrets inside it? any snippet code would be helpful.Thank you.FollowComment"

Answer: "0Here is a example of secrets creation using SAM. You can potentially update line 113  for SecretString in this file to create multiple KVs.Hope that helps.CommentShareRajarshi_Danswered a year agoJess a year agoso I need to npm install that project? I don't understand the solutionShareRajarshi_D a year agoMy apologies as it's not a CDK based project.It's a SAM based project and the README (https://github.com/aws-samples/secret-creator-secrets-manager/blob/main/README.md) walks you through how to set it up, build and deployShareJess a year agoI need to modify the source code to be able to have 2 KVs ? it's not doable directly via CDK ? I can do it via AWS console add new KVShare"


Question: Cost Management for RDS db instance

"I had bought a reserved instance for RDS db instance db.r5.4xlarge on January-05-2022 for 3 years duration. In the month of December-2022, I had to upgrade that instance to db.r5.8xlarge because we were facing some high database load.Since then I saw the increase in billing and I need your help to bring down these additional charges.I'm expecting to save the overall cost by $1500.I see that the reserved instance db.r5.4xlarge is being 100% utilized, at the same time $320.14 got charged in this month for USD 0.4303 hourly fee per Aurora MySQL, db.r5.4xl instance which is not there anymore in my account. so this $320.14 charges are extra for me.Then, these charges USD 0.021 per GB-month of backup storage exceeding free allocation for Aurora MySQL costed me $283.38 so far.Kindly advise how I can reduce the cost?FollowComment"

Answer: "0Hello,I would recommend to use AWS Cost and Usage Reports to analysis what are components are costing you.  In your analysis you may include storage, backup, compute, rds etc. to narrow down where extra cost getting added.https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.htmlThanksCommentShareJitenderanswered 2 months ago"


Question: Does Amazon Gamelift support for WebGL Clinet build?

I am facing "bad ioctl syscall 35090" error when I try to build to WebGL by using Unity 2019.4 LTS. and Realtime Servers client API (C#).FollowComment

Answer: "0Hi, you may be able to find an answer here, as there are some newer comments from 2019-present. If not, asking there might be another option.CommentShareSierra Washingtonanswered 9 months ago"


Question: EC2 upgrade fails and rollsback

"Hello,I have been trying to upgrade an instance type for some time, but it becomes stuck at "Still waiting for the following 1 instances to become healthy: (instance id)". It has given a reason null for rollback once and then: Received 0 SUCCESS signal(s) out of 1. Unable to satisfy 100% MinSuccessfulInstancesPercent requirement, so I am not really sure what this means. My instance has never been healthy to begin with, but it was working fine (I still have to understand why is not healthy).Could that be the reason?Thanks.Edited by: gzuniga on Apr 1, 2019 4:32 PMFollowComment"

Answer: "0Well, if anyone had this very same problem... well, yes. It was because it was never healthy. I deployed a WebSockets only server, so it was not handling any http requests over '/'. So elastic beanstalk would consider it dead because it was failing the health check. Once I created an end point, elastic beanstalk could request and get its 200 status code, I managed to upgrade my instance type.CommentSharegzunigaanswered 4 years ago"


Question: Quicksight: Navigation Action with parameters doesn't update the controls in the new tab

"Hello!  I have an analysis in Quicksight with two tabs - one is an "overview" tab where we look at all of our units, and then there's a "deep dive" tab where it gives more detail about a single unit.The "overview" tab has a table where it lists all of the units and various metrics for them.  I want to be able to click on a row in that table, and have it take me to the "deep dive" tab.  When it goes to the deep dive tab, I want it to fill in a couple controls on the new tab (like the unit serial number) so that all the visuals filter by that serial number, and the tab is showing me just information about this specific unit.It seems like a Navigation Action with updating parameters is the way to go, but it doesn't work.  When I click on the row I want (both in the analysis and the dashboard), it takes me to the deep dive tab, but it doesn't fill in the controls, so they still display "all".  it seems like this is not the functionality intended.In the "Action" tab for the visual in the "overview" tab, I have selected the following options:Activation: "Select"Action Type: Navigation ActionTarget Sheet: deep dive tabParameters: Here I have listed the parameters I want to fill, and the fields that correspond to them.Again, when I click on the row, it takes me to the new tab, but it doesn't fill in the parameters.  Is this a bug or is this as intended?  If it's intended, how do I make it so users can click on a row and it takes me to the deep dive tab and fills in the controls so that the visuals filter by the control values?FollowComment"

Answer: "0Hello jros14,Thank you for posting this detailed question. Firstly this behavior you are expecting as I understand it, is possible.In an effort to keep this post concise, I have found and reviewed this youtube video  from a third party, that gives great insight into Navigation actions and the passing of parameters + controls to the secondary sheet .If this resource does not provide the required insight into the Navigation action issue you are experiencing I would invite you to  Create a support case so that we may further dive into the specifics of your configuration.CommentShareAWS_Dylananswered a year ago"


Question: Is AWS SNS/SMS a viable replacement for Twilio?

"We are looking at using AWS as a replacement for Twilio but so far the onboarding process is challenging.  First, AWS says it will take 7-10 days to approve a phone number.  Second, the phone number is assigned.  With Twilio we can find 10DLC numbers by a preferred area code and the assignment of the phone number is instant.  Before we drop AWS as a solution, I want to ask the community if my findings are correct or if I am missing something.  We are using AWS Pinpoint to do all of the 10DLC onboarding (including brand registration and campaign).Beyond the onboarding challenges, has anyone experienced any other challenges we may face by converting to AWS-SNS/SMS?FollowComment"

Answer: "1Some threads you might want to be aware of...Can I register a new 10DLC number programmatically?https://repost.aws/questions/QU0VIZGRGSSUuX7sOqkjIe9wOne phone number for Amazon Connect AND Pinpointhttps://repost.aws/questions/QUDM3_Y1zlR0yZv5UgtBq5yg/one-phone-number-for-amazon-connect-and-pinpointFull disclosure: I love most all-things AWS, but phone number use/administration between Connect and Pinpoint for our solutions has not been ideal compared to Twilio... From what I remember from long ago in my brief Twilio days, Twilio made it so easy and simple to acquire a number, get it hooked up to all your channels (voice/SMS), setup spend/billing, and get going. (I can't 100% remember if I had to do the newer registration process -- but I'd be willing to bet they allow for that programmatically, too? Do you know?)Maybe AWS is doing more due-diligence to make it harder on "the bad guys" (spammers/malicious actors) and as a result all the good guys get bogged down too.But the lack of joint phone voice/SMS on same phone number (separation between Connect/Pinpoint) has been a big issue for us as a customer, and is a request AWS is well aware of, per thread above.Just my two cents. Would love to hear from others too.CommentShareJeremyanswered 2 months agodmacias 2 months ago+1 on the two cents. I believe that one of the reasons why it's harder/manual to get a phone number is based on the PSTN design that Connect has where there really are multiple providers which feed into Connect. While Twilio really is there own telco provider.davidShareJeremy 2 months agorePost-User-7120914:@dmacias is the most experienced, knowledgable Twilio/Connect expert you could hope to ever meet. Just check out his list of re:Post contributions!David -- thanks for the insights.Share"


Question: After RDS OS patched in an offline operation RDS Database is not accepting connection from outside the VPC

After a offline operation RDS OS patchInfo:Status is availableConnection attempts from outside the VPC is always receive timeoutConnection Inside our VPC workingLast time worked at Saturday 20:40 (outside attempts)RDS instance - 8.0.23Publicly accessible - yesNote:Creating identical RDS instances in prior version to v8.0.23Test RDS instances with same VPC configurations:v8.0.21 - workingv8.0.23 - not workingv8.0.28 - not workingFollowComment


Question: How to check if ECR image exists by URI?

"How can I check if an image exists in ECR using AWS CLI given its URI like:xxxxxxxxxxxx.dkr.ecr.us-west-2.amazonaws.com/ai-api:2022-08-25T23-10-58-main ?I've tried describe-images with parameters --image-ids, but it can only accept --image-ids imageDigest=string,imageTag=string ..., no URI option.Do you have a script that I can check if the ECR image exists by URI?FollowComment"

Answer: 0Accepted AnswerTrying to use AWS CLI is a wrong way.We should use docker manifest inspect to check whether the image exists.CommentShareJiaqi Zhanganswered 9 months ago


Question: "Glue: SnowFlake table cataloged, send to S3 after some transformations."

"Hi, i have ran a crawler that connects by jdbc to SnowFlake and it creates a table into the Glue catalog database, that works nice.now i want to use glue studio to take the source (AWS Glue Data Catalog, and the table created by the above crawler) and do some transformations and later write to a S3 bucket. the flow is:AWS Glue Data Catalog|Filter (C_CUSTKEY=1)|S3in Cloudwathc it's showing the next errors:2023-05-17T14:12:10.801+02:00Copy23/05/17 12:12:10 ERROR GlueExceptionAnalysisListener: [Glue Exception Analysis]{"Event": "GlueETLJobExceptionEvent","Timestamp": 1684325530798,"Failure Reason": "Traceback (most recent call last):\n  File "/tmp/SFCatalogToS3.py", line 20, in <module>\n    transformation_ctx="AWSGlueDataCatalog_node1684308467551",\n  File "/opt/amazon/lib/python3.6/site-packages/awsglue/dynamicframe.py", line 787, in from_catalog\n    return self._glue_context.create_dynamic_frame_from_catalog(db, table_name, redshift_tmp_dir, transformation_ctx, push_down_predicate, additional_options, catalog_id, **kwargs)\n  File "/opt/amazon/lib/python3.6/site-packages/awsglue/context.py", line 186, in create_dynamic_frame_from_catalog\n    makeOptions(self._sc, additional_options), catalog_id),\n  File "/opt/amazon/spark/python/lib/py4j-0.10.9-src.zip/py4j/java_gateway.py", line 1305, in call\n    answer, self.gateway_client, self.target_id, self.name)\n  File "/opt/amazon/spark/python/lib/pyspark.zip/pyspark/sql/utils.py", line 117, in deco\n    raise converted from None\npyspark.sql.utils.IllegalArgumentException: No group with name <host>","Stack Trace": [{"Declaring Class": "deco","Method Name": "raise converted from None","File Name": "/opt/amazon/spark/python/lib/pyspark.zip/pyspark/sql/utils.py","Line Number": 117},{"Declaring Class": "call","Method Name": "answer, self.gateway_client, self.target_id, self.name)","File Name": "/opt/amazon/spark/python/lib/py4j-0.10.9-src.zip/py4j/java_gateway.py","Line Number": 1305},{"Declaring Class": "create_dynamic_frame_from_catalog","Method Name": "makeOptions(self._sc, additional_options), catalog_id),","File Name": "/opt/amazon/lib/python3.6/site-packages/awsglue/context.py","Line Number": 186},{"Declaring Class": "from_catalog","Method Name": "return self._glue_context.create_dynamic_frame_from_catalog(db, table_name, redshift_tmp_dir, transformation_ctx, push_down_predicate, additional_options, catalog_id, **kwargs)","File Name": "/opt/amazon/lib/python3.6/site-packages/awsglue/dynamicframe.py","Line Number": 787},{"Declaring Class": "<module>","Method Name": "transformation_ctx="AWSGlueDataCatalog_node1684308467551",","File Name": "/tmp/SFCatalogToS3.py","Line Number": 20}],"Last Executed Line number": 20,"script": "SFCatalogToS3.py"}23/05/17 12:12:10 ERROR GlueExceptionAnalysisListener: [Glue Exception Analysis] {"Event":"GlueETLJobExceptionEvent","Timestamp":1684325530798,"Failure Reason":"Traceback (most recent call last):\n File "/tmp/SFCatalogToS3.py", line 20, in <module>\n transformation_ctx="AWSGlueDataCatalog_node1684308467551",\n File "/opt/amazon/lib/python3.6/site-packages/awsglue/dynamicframe.py", line 787, in from_catalog\n return self._glue_context.create_dynamic_frame_from_catalog(db, table_name, redshift_tmp_dir, transformation_ctx, push_down_predicate, additional_options, catalog_id, **kwargs)\n File "/opt/amazon/lib/python3.6/site-packages/awsglue/context.py", line 186, in create_dynamic_frame_from_catalog\n makeOptions(self._sc, additional_options), catalog_id),\n File "/opt/amazon/spark/python/lib/py4j-0.10.9-src.zip/py4j/java_gateway.py", line 1305, in call\n answer, self.gateway_client, self.target_id, self.name)\n File "/opt/amazon/spark/python/lib/pyspark.zip/pyspark/sql/utils.py", line 117, in deco\n raise converted from None\npyspark.sql.utils.IllegalArgumentException: No group with name <host>","Stack Trace":[{"Declaring Class":"deco","Method Name":"raise converted from None","File Name":"/opt/amazon/spark/python/lib/pyspark.zip/pyspark/sql/utils.py","Line Number":117},{"Declaring Class":"call","Method Name":"answer, self.gateway_client, self.target_id, self.name)","File Name":"/opt/amazon/spark/python/lib/py4j-0.10.9-src.zip/py4j/java_gateway.py","Line Number":1305},{"Declaring Class":"create_dynamic_frame_from_catalog","Method Name":"makeOptions(self._sc, additional_options), catalog_id),","File Name":"/opt/amazon/lib/python3.6/site-packages/awsglue/context.py","Line Number":186},{"Declaring Class":"from_catalog","Method Name":"return self._glue_context.create_dynamic_frame_from_catalog(db, table_name, redshift_tmp_dir, transformation_ctx, push_down_predicate, additional_options, catalog_id, **kwargs)","File Name":"/opt/amazon/lib/python3.6/site-packages/awsglue/dynamicframe.py","Line Number":787},{"Declaring Class":"<module>","Method Name":"transformation_ctx="AWSGlueDataCatalog_node1684308467551",","File Name":"/tmp/SFCatalogToS3.py","Line Number":20}],"Last Executed Line number":20,"script":"SFCatalogToS3.py"}2023-05-17T14:12:10.934+02:00Copy23/05/17 12:12:10 ERROR GlueExceptionAnalysisListener: [Glue Exception Analysis] Last Executed Line number from script SFCatalogToS3.py: 2023/05/17 12:12:10 ERROR GlueExceptionAnalysisListener: [Glue Exception Analysis] Last Executed Line number from script SFCatalogToS3.py: 20is it possible to do what i try to do ?, cheersFollowComment"

Answer: "0Sounds like you are passing some option to create_dynamic_frame_from_catalog that is incorrect, are you specifying something in addition to the catalog and table?CommentShareGonzalo Herrerosanswered 17 days agoWilli5 17 days agoHi, nop i'm not passing nothing, only mi source is "AWS Glue Data Catalog" apply one filter and the target is S3, the table was created by a crawler and exist in the catalog:Name                                                                                Databasesnowflake_sample_data_tpch_sf1_customer                                             testsfLocation                                                                                ConnectionSNOWFLAKE_SAMPLE_DATA.TPCH_SF1.CUSTOMER                                snowflake-glue-jdbc-connection2ShareGonzalo Herreros 16 days agoPlease open a support ticket, sounds there is something in the table or connection configuration that the job is not able to handle correctlyShare"


Question: How do I filter query results using the WHERE keyword with Redshift python connector?

"I am using the python connector for Redshift to query my database. Queries work predictably until I attempt to use the WHERE keyword. For example, running the query:"select * from dev.public.test_host WHERE first_column = git" returnsredshift_connector.error.ProgrammingError: {'S': 'ERROR', 'C': '42703', 'M': 'column "git" does not exist in test_host', 'F': '../src/pg/src/backend/parser/parse_expr.c', 'L': '1523', 'R': 'transformColumnRef'}Another example: "select * from information_schema.tables WHERE table_name = test_host" returnsredshift_connector.error.ProgrammingError: {'S': 'ERROR', 'C': '42703', 'M': 'column "test_host" does not exist in tables', 'F': '../src/pg/src/backend/parser/parse_expr.c', 'L': '1523', 'R': 'transformColumnRef'}These queries return the correct answer when run in Redshift Query Editor v2. They also return correct answers when run without the 'where' part. Please help.FollowComment"

Answer: 1Accepted Answeryou need to add single quotes around the string you're filtering forit would be= 'git'and not= gitCommentShareAWS-ADolganovanswered a year agoEXPERTFabrizio@AWSreviewed a year agoAWS-ADolganov a year ago(this is true for most SQL-like languages)Share


Question: AWS S3 delete multiple files: signature does not match the signature you provided

"I'm trying to use an Apex Class in Salesforce to remove multiple files from any specified S3 bucket, but at the moment of sending the request, I recieve the following response:SignatureDoesNotMatch The request signature we calculated does not match the signature you provided. Check your key and signing method.I tried testing a multiple file delete in Postman using the same information (access key and secret key) that I'm using on my class and it works. I'm creating the canonical request based on another class that uploads files, but I'm not sure how the '?delete' instruction should be included on it, if either on the URL for the request or in the Query string for the canonical. And since the request needs the body to be an XML with the file names, I'm alsonot sure if I'm doing the right thing creating a DOM.Document variable and then converting it into a string to finally add it as a blob to be used as a payload.I've been using the documentation provided by Amazon as a reference too.String accessKey = 'redacted';String secretKey = 'redacted';final String ALGORITHM = 'AWS4-HMAC-SHA256';final String SERVICE = 's3';final String AWS_DOMAIN = 's3.amazonaws.com';final String DEFAULT_REGION = 'us-east-1';String s3BucketName = 'redacted';Datetime dt = Datetime.now();String currentDate = dt.formatGMT('yyyyMMdd');String isoTimeStamp = dt.formatGMT('yyyyMMdd\'T\'HHmmss\'Z\'');String scope = currentDate + '/' + DEFAULT_REGION + '/' + SERVICE + '/aws4_request';//DOM.Document requestBody = xmlBody(filesToRemove);//String xmlToString = requestBody.toXmlString();//Blob decodedContent = Blob.valueOf(xmlToString);String url = 'https://' + s3BucketName + '.' + AWS_DOMAIN + '/?delete';Blob payload = Blob.valueOf('');String payloadHash = EncodingUtil.convertToHex(Crypto.generateDigest('SHA-256', payload));String canonicalRequest = 'POST\n' +            + '/' + '\n'            + '?delete' + '\n'              + 'host:'+s3BucketName +'.' + AWS_DOMAIN + '\n'            + 'x-amz-date:' + isoTimeStamp + '\n' + '\n'             + 'host;x-amz-date' + '\n'             + payloadHash;String stringToSign = ALGORITHM + '\n' +  isoTimeStamp + '\n' +  scope + '\n' +             EncodingUtil.convertToHex(Crypto.generateDigest('SHA-256', Blob.valueOf(canonicalRequest)));Blob dateKey =  Crypto.generateMac('hmacSHA256',Blob.valueOf(currentDate),Blob.valueOf('AWS4'+secretKey));Blob dateRegionKey = Crypto.generateMac('hmacSHA256',Blob.valueOf(DEFAULT_REGION),dateKey);Blob dateRegionServiceKey = Crypto.generateMac('hmacSHA256',Blob.valueOf(SERVICE),dateRegionKey);Blob signingKey = Crypto.generateMac('hmacSHA256',Blob.valueOf('aws4_request'),dateRegionServiceKey); string calculatedSignature = EncodingUtil.convertToHex(Crypto.generateMac('HMACSHA256', blob.valueof(stringToSign), signingKey));        String authorizationHeader = ALGORITHM + ' '                 + 'Credential=' + accessKey + '/' + scope + ', '                + 'SignedHeaders=content-md5;host;x-amz-content-sha256;x-amz-date' + ', '                + 'Signature=' + calculatedSignature;Http http = new Http();HttpRequest req = new HttpRequest();req.setMethod('POST');        req.setHeader('Authorization', authorizationHeader);req.setHeader('x-amz-date', isoTimeStamp);req.setHeader('X-Amz-Content-SHA256', payloadHash);req.setHeader('Content-Type','application/xml');req.setEndpoint(url);HttpResponse resp = http.send(req);System.debug('Response: '+resp.getBody());FollowComment"


Question: CryptoShredding

Is there an AWS guide for the best practices on CryptoShredding or secure data deletion? Thanks!FollowComment

Answer: "0Hi, if you're looking for AWS Practices - check out https://aws.amazon.com/compliance/data-center/controls/ about their media destruction.  Also check out https://d0.awsstatic.com/whitepapers/compliance/AWS_Risk_and_Compliance_Whitepaper.pdf for more information.Those are high level details - there may be service-specific information on service documentation.  Hope that helps!CommentSharejsoncanswered a year agosmikerboyz a year agoThanks! I was looking if there is specific guidance such as when my organisation needs to delete specific customer records in DynamoDB or PostgresSQL DB, what would be the recommended handling method for a secure deletion (e.g. overwriting the records prior to deletion or if possible to destroy the corresponding encryption key in KMS specific to those records only, etc.)Share"


Question: error: An unknown server-side error occurred while processing the command. Original error: Cannot start the 'com.XXX.staging' application

"Hi all.i got this error while using aws device farm while try to run java appuim testng project:Unable to create a new remote session. Please check the server log for more details. Original error: An unknown server-side error occurred while processing the command. Original error: Cannot start the 'com.XXX.staging' application. Visit https://github.com/appium/appium/blob/master/docs/en/writing-running-appium/android/activity-startup.md for troubleshooting. Original error: 'com.XXX.YYY.ui.activities.MainActivity' or 'com.XXX.staging.com.YYY.core.ui.activities.MainActivity' never started. Visit https://github.com/appium/appium/blob/master/docs/en/writing-running-appium/android/activity-startup.md for troubleshootingBuild info: version: '3.141.59', revision: 'e82be7d358', time: '2018-11-14T08:17:03'System info: host: 'ip-111-11-11-11', ip: '111.11.11.61', os.name: 'Linux', os.arch: 'amd64', os.version: '3.13.0-139-generic', java.version: '1.8.0_151'Driver info: driver.version: AndroidDriverlocally it's run well.i sent this caps for aws server:AppiumDriver driver;final String URL_STRING = "http://127.0.0.1:4723/wd/hub";URL url1 = new URL(URL_STRING);DesiredCapabilities desiredCapabilities = new DesiredCapabilities();driver = new AndroidDriver(url1, desiredCapabilities);please help, thanks head!Oron.FollowComment"