Question: How to switch role in AWS CLI when logged in as an Identity Center user?

"I have configured the AWS CLI to use IAM Identity Center for authentication as recommended here https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-authentication.html. As such I have followed the recommended guide at https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html to set up the CLI. For now, everything is working fine. The problem is I need to use an IAM role to perform some tasks via the CLI and I don't see how.The IAM role that I have to assume is defined as{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": [                    "arn:aws:iam::123456789012user/User1",                    "arn:aws:iam::123456789012:user/User2"                ]            },            "Action": "sts:AssumeRole"        }    ]}As you can see, I have allowed to IAM users the ability to assume this role. But I have no idea how I can let an Identity Center user to assume this role. Moreover, how do I tell the CLI to perform actions by assuming a role? I see this documentation https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-role-overview but this again asks for a source profile.FollowComment"

Answer: "0Accepted AnswerThanks to kentrad's answer, I found a good solution to this.First run the below while logged into the CLI with the SSO user you want to addaws sts get-caller-identity --query Arn --output texThis should generate an output likearn:aws:sts::123456789012:assumed-role/ROLEID:SSOUSERWhatever gets generated, just put it into the policy like{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": [                    "arn:aws:iam::123456789012:user/User1",                    "arn:aws:iam::123456789012:user/User2",                    "arn:aws:sts::123456789012:assumed-role/ROLEID:SSOUSER"                ]            },            "Action": "sts:AssumeRole"        }    ]}That should be enough to get the SSO user to be able to assume that role.CommentShareSayakanswered a month ago0You can add your role ARN to the trust policy of the role you want to assume. You can find your ARN using the following CLI commands.RoleId=$(aws sts get-caller-identity --query UserId --output text | cut -f1 -d':')aws iam list-roles --query Roles[?RoleId==\`$RoleId\`].ArnOnce the trust policy is updated you can issues the aws sts assume-role command to get the access key id and secret key for the new role.You can also something like this:RoleId=$(aws sts get-caller-identity --query Arn --output text)aws iam list-roles --query Roles[?RoleId==\`$RoleId\`].ArnCommentShareEXPERTkentradanswered 2 months agoSayak 2 months agoSo, the RoleId that is getting fetched here is the role that was created in IAM for the Permission set created in Identity Center, right? In that case, won't all users in Identity Center having this permission set get added to the trust policy? Is it not possible to only add a user from Identity Center? Would it be possible to use Federated or something?Share"


Question: how can i fix this error: serial8250: too much work for irq4  EC2 Instance

"https://www.smartpharma.com.co/Service UnavailableThe server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.Additionally, a 503 Service Unavailable error was encountered while trying to use an ErrorDocument to handle the request.FollowComment"

Answer: "0I think there are several things here.First, the serial8250 message: This means that there is some process (or multiple processes) writing data to the instance serial port. This is normally used to output debug messages (see EC2 Serial Console for more information) - so check to see what logging is enabled and what on your instance is send things to the serial port.Normally this won't affect anything else - it's just a warning to say that there is too much data being sent for the serial port to keep up - they are generally low speed devices when compared to Ethernet. In the dim, dark, historical days of computing it was possible for a single interrupt to consume too many CPU resources and therefore cause performance problems but that's very unlikely in the modern world.The "Service Unavailable" message you're seeing is because there is some error in the web server software on the instance. That you're getting a 503 error means that the web server is running fun; but whatever it is trying to do is throwing an error. I doubt this is related to the serial console error message. In this case, look at the web server logs to determine where the error is.CommentShareEXPERTBrettski-AWSanswered 5 months ago"


Question: Customer would like to know if it is possible to cache API requests in Amazon CloudFront if the app cannot set cache-control headers

"Is it possible to cache API requests in CloudFront if the application the customer is using cannot set cache-control headers?  I can see that content can be cached without these headers, but I am unable to find the answer for API requests specifically.FollowComment"

Answer: "0Accepted AnswerAPI requests are 'just' HTTP requests, so the documentation for CloudFront is applicable to all content, regardless as to whether it is an API, dynamically generated HTML, or static content.You can configure CloudFront caching using MinTTL, MaxTTL (which will place a minimum/maximum limit provided by the origin) and DefaultTTL (which provides a cache TTL when the origin doesn't specify any). These are configured for each cache-behavior, and so it's the same for all URLs matching the bevhavior's path pattern. It also doesn't create or modify the cache-control headers that are passed to the client.If you need more specific control over of caching (for instance, it is based on a cookie) or you want to actually set the cache=-control header for clients (so they are able to cache downstream) then you could use origin-facing Lambda@Edge to set cache-control before it returns through the cache.CommentShareEXPERTLeeAtk@AWSanswered 3 years ago"


Question: Performing a Latency Test

"Hi ThereI am new to computer clouding and I have been asked if I could run a latency test on our system.Basically our hardware communicates via the internet to our application which is hosted on AWS Cloud using Fargate with AWS ECS to run containers (as detailed below).My question is, is it possible to run a latency test when our application is structured on the cloud and structured in such way?UI Hosting:AWS Fargate with AWS ECS  to run containers,NLB,AWS Ireland region.Backend:AWS ECS with AWS EC2 to run containers,AWS ECS with AWS Fargate,AWS Ireland region.FollowComment"

Answer: "0Hello,the recommendation of tools and solutions depends on a lot of factors (e.g. whether you want to do a simple latency test or a load test).For a quick manual check you can always use tools like ping, iperf or netperf. Running ping <url> -c 50 for example will send 50 ICMP packets and then show you the min, max and mean latency. This approach of course is manual and depends from where you run it.For more automated approaches I would first recommend looking at the CloudWatch metrics of your Elastic Load Balancers. One of the metrics is TargetResponseTime this is the "time elapsed, in seconds, after the request leaves the load balancer until a response from the target is received" (see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html).Route53 also offers the option to create health checks and monitor latency. When you create a health check you can choose to monitor the status of an endpoint and choose the Latency graphs option to get insights into TCP connection time, time to first byte and time to complete SSL handshake (see: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/monitoring-health-check-latency.html).AWS X-Ray traces user requests as they travel through your application and help you get insights into how your application is performing and discover root causes. With the tracing features, you can follow request paths to pinpoint where in your application and what is causing performance issues. Integration depends a lot on the framework you use (e.g. for Node.js see https://docs.aws.amazon.com/xray/latest/devguide/xray-nodejs.html).CommentShareAlexanderanswered a year agoAWS-User-4507994 a year agoHi Alexander, thank you so much for your answer it was really helpful.  I tried to perform a basic ping and tracert on the application browser (UI) using just the url as per your answer but but both test just time out. Is this because where and how the UI is hosted, on AWS using Fargate with AWS ECS to run containers including NLB?Share"


Question: How to install new kernels in workspace with EMR Studio

"Hi there,I need to create a custom kernel with my own libraries for use in EMR, so Im trying to follow this EMR Workshophttps://catalog.us-east-1.prod.workshops.aws/workshops/3c29bc13-0f30-42f7-9f97-4ce8e2ef9b17/en-US/kernels-and-libraries/additional-kernelsAll works ok, but I can't get the new kernel in the launch notebook section.I don't know if this is because the new studio version, but I can't use it after I installed,Do you know what could it be? Is there another tutorial I can follow?I already try the installing additional kernels and libraries from the EMR documentation.Thanks!FollowComment"


Question: Measuraments not reported in Iot SiteWise

"Hi,I have followed the tutorial here.I can see my data in IoT core, but the measurement are not reported in IoT SiteWise. There seem to be a permission problem. This is the error from the error rule{  "ruleName": "SiteWiseTutorialDeviceRule",  "topic": "$aws/things/SiteWiseTutorialDevice1/shadow/update/accepted",  "cloudwatchTraceId": "e3aec656-d5d7-b500-5558-d51ae7aee895",  "clientId": "N/A",  "base64OriginalPayload": "eyJzdGF0ZSI6eyJyZXBvcnRlZCI6eyJ0ZW1wZXJhdHVyZSI6MTAuMSwiaHVtaWRpdHkiOjY0LjIsInRpbWVzdGFtcCI6MS42NTU3OTk2MjQ0NTczODFFOX19LCJtZXRhZGF0YSI6eyJyZXBvcnRlZCI6eyJ0ZW1wZXJhdHVyZSI6eyJ0aW1lc3RhbXAiOjE2NTU3OTk2MjR9LCJodW1pZGl0eSI6eyJ0aW1lc3RhbXAiOjE2NTU3OTk2MjR9LCJ0aW1lc3RhbXAiOnsidGltZXN0YW1wIjoxNjU1Nzk5NjI0fX19LCJ2ZXJzaW9uIjo5NjAsInRpbWVzdGFtcCI6MTY1NTc5OTYyNCwiY2xpZW50VG9rZW4iOiIyYzU2Zjg1NC0zM2IzLTQzNmQtYjJjZC1kMzk2ZmZkNTYxMGYifQ==",  "failures": [    {      "failedAction": "IotSiteWiseAction",      "failedResource": "",      "errorMessage": "Failed to send message data to IoT SiteWise asset properties. [Code: AccessDeniedException, Message: User: arn:aws:sts::908401988620:assumed-role/SiteWiseTutorialDeviceRuleRole/9SUxG6SG is not authorized to perform: iotsitewise:BatchPutAssetPropertyValue on resource: /tutorial/device/SiteWiseTutorialDevice1/temperature because no identity-based policy allows the iotsitewise:BatchPutAssetPropertyValue action]. Message arrived on: $aws/things/SiteWiseTutorialDevice1/shadow/update/accepted, Action: iotSiteWise"    }  ]}Any suggestion?FollowComment"

Answer: "2Hi Ruggiero. Most likely the SiteWiseTutorialDeviceRuleRole role used by the rule has not been granted the iotsitewise:BatchPutAssetPropertyValue permission. More info here:https://docs.aws.amazon.com/iot-sitewise/latest/userguide/troubleshoot-rule.html#rule-error-role-not-authorizedhttps://docs.aws.amazon.com/iot-sitewise/latest/userguide/iot-rules.html#grant-rule-accessCommentShareEXPERTGreg_Banswered a year agoRuggiero a year agoThanks that helped. Now there is no error. However, there is not measurement in IoT SiteWise. I have refreshed the measurement page of the asset a few times to be sure.Share"


Question: AppSync Unauthorized Error When Called From PreSignUp Lambda Trigger

"Hello Everyone,I'm using AWS Amplify for provisioning resources via the CLI, and CI/CD.I have a presignup lambda trigger and a postconfirmation lambda trigger on my cognito pool.The presignup trigger calls my AppSync GraphQL API to create a User object in Dynamo.The postconfirm trigger makes the same call to update the User's status to confirmed in Dynamo.I currently have this deployed in my dev environment.The PostConfirm trigger is working perfectly fine, but the PreSignUp trigger is throwing an unauthorized error:"errors": [        {            "path": [                "createUser"            ],            "data": null,            "errorType": "Unauthorized",            "errorInfo": null,            "locations": [                {                    "line": 3,                    "column": 7,                    "sourceName": null                }            ],            "message": "Not Authorized to access createUser on type Mutation"        }    ]This is very strange to me as both Lambdas have access to the same resource:arn:aws:appsync:us-west-2:XXXXXXX:apis/XXXXXXXX/types/Mutation/*To troubleshoot I set the execution role of the PreSignUp trigger to the same execution role as the PostConfirmation trigger and that worked.This is a temporary fix for dev as I need the PreSignUp trigger to use it's respective role set by the Amplify CLI.I've looked at both roles in IAM and cannot see a single difference amongst policies.FollowComment"

Answer: "0Hello,Based on the scenario that you have outlined, It seems that you have IAM authorization configured on the User model like@auth(rules: [{ allow: private, provider: iam }])In this case, IAM-based @auth rules are scoped down to only work with Amplify-generated IAM roles. To allow-list a custom role (for e.g. PreSignUp Lambda trigger's execution role), you'd need to update the existing or create amplify/backend/api/<your-api-name>/custom-roles.json and include the custom role name. Kindly ensure that you push the changes to the backend once you have updated the custom-roles.json. Please find the reference documentation for the same here.Having said that, if you are still facing the challenges, please feel free to reach out to us via Support Center with the resources information like schema.graphql, local amplify folder contents, code snippets of Lambda function that are making these requests.CommentShareSUPPORT ENGINEERVishal_Nanswered a month ago"


Question: "2 instances - both running similar ubuntu server projects and both inaccessible from web gui, ssh slow"

"Happy New Year!I've two ubuntu servers, one 16.04 and the other 20.04 running dedicated Unifi controller software. Both are on different versions of Unifi and both have been solid since build in 2020.  Last couple days both have had limited web access to the Unifi gui and ssh connection is there but slow.  Top shows 30% cpu usage, 90% memory and 40% swap, pretty normal.  I can't find any smoking gun on the server side and it would seem its a aws issue beings they both crapped out at the same time.  I have tried to connect from several different pcs and isp to make sure its not on my connection.  Any tips on where to start looking?FollowComment"

Answer: "0You don't mention what instance types you're using. If you're using the T-series instances then it's possible that you're running out of CPU credits. Even though the operating system is showing low CPU usage it may still be throttled. Check CloudWatch Metrics for those instances and see what the CPU Credit metric displays.If that is the problem: To fix it, either change the instance to "Unlimited" (but you'll be charged 50 cents per hour if the CPU credits are exhausted); choose a larger instance size; or choose a different (non-T) instance type.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: dynamic web application template (+1)

"Looking to build a 3 tier application web application (not serverless) for lab purpose. I plan to leverage services in the following order:  User > Route53 > ALB > EC2 > RDS, will integrate S3 in the architecture as well. I tied to boring default template I can use out of the box with wordpress. So I was wondering if you may point to  a not so boring web app i can use in my architecture. For example, ride, dental or any other interesting template I can use.Thanks in advance :-)FollowComment"

Answer: "1Hi,Look at this workshop: https://ecsworkshop.com/introduction/3tier/You will learn deployment tips on ECS via a NodeJs app. Hope is less boring than ec2 ;)CommentShareEXPERTalatechanswered 4 months ago"


Question: I can't stop/close my redshift cluster

"Dear Team,since 6 hours I tried to pause/close the redshift cluster which I created and it shows always 'modifying/pausing'.. So I created a second cluster and used it. After using I want to stop both clusters because of the costs..  However, I can't. So the problem never happened to me and I do want to close them before I go to sleep... because it costs every minute. Can you please help me to do that? I will appreciate it.FollowComment"

Answer: "0Accepted AnswerIf it is in us-east-1 (N.Virginia) region then this can be attributed to the LSE, so please wait for it to get resolved. Also check the AWS Service Health Dashboard for updates, also you can check the AWS Personal Health Dashboard in your AWS account.CommentShareKunal_Ganswered a year ago"


Question: InvalidLambdaresponse : While calling a Java Handler sitting behind an ALB

"I'm trying to invoke a Lambda (Java 8) using a DNS endpoint --> ALB --> Lambda as the target group.Lambda does what its supposed to do (Upload a file in S3) upon its invocation but on the postman or curl command i see a 502 error . When i check the ALB logs it says InvalidLambdaResponseMy lambda is returning a Map (String , Object). When i print the JSON it looks good as well. What am i missing here ?{"headers": {"Cache-Control": "no-store","Content-Type": "application/json"},"isBase64Encoded": "False","statusCode ": "200","statusDescription ": "200 OK","body": "Lambda S3 Upload"}FollowComment"

Answer: "0Accepted AnswerIt looks like there are a few small errors in the format of the object you're returning. There are some additional spaces in some of the keys (might just be an effect of copy and paste), isBase64Encoded should be boolean, and statusCode should be an integer.https://docs.aws.amazon.com/elasticloadbalancing/latest/application/lambda-functions.html#respond-to-load-balancerThis slightly modified version seems to work:{  "headers": {    "Cache-Control": "no-store",    "Content-Type": "application/json"  },  "isBase64Encoded": false,  "statusCode": 200,  "statusDescription": "200 OK",  "body": "Lambda S3 Upload"}CommentShareEdanswered a year agopsingh409 a year agoThanks Ed ! Yes the spaces on statusCode and statusDescription were the culprit .Share"


Question: How to do this setup : LB+2*WindowsEC2+ "Active" Shared Drive.

"Hello everyone ,Instead of finding the solution for my last post i thought it would be better to ask .I have this enveironment :one Load Balancer with a target group of 2 windowss EC2 instances running a web app on port 80both windowss ec2 must have a shared drive eg: an " D:\ "What would be the best aproach for this situation ?I already created this env. but i cannot succed in creating the shared drive.What i have tried :an FSX share but after i joined the windows ec2 instances the tomcat service cannot see that drive. I have tried to run the tomcat service either with the Local System user(default) or the Domain User that is an local Admin and also with the Local Workgroup Adminstrator.Here i have also tried with MKLINK and same outcome.I thought in creating a FailOverCluster between the nodes and then add a storadge and create a Cluster Shared Volume.This might work but i think its an "overkill" as infrustructure and also prices.(even thou im not sure what type of storage to add to the ec2 instances , in phisical env. this would require a SAN with ISCSI).So , please let me know if there are other solution i should take in consideration.Thank you for reading my post.FollowComment"

Answer: "0Hello @ all ,I have found the solution.I just did the MKLINK directly to the share .So instead of net use x:\   \fs-abcd\Share  and then mklink /d x:\ c:\abci did mklink /d \fs-abcd\Share c:\abcFound out that if you map the shared drive as a local Drive eg : x:\ it will not work.CommentShareBogdanNanswered 3 years ago"


Question: OTA update for raspberrypi4

"As per the documents of AWS Greengrass V2 does support 32-bit OS also in raspberrypi4. But If I install 64 bit OS for raspberrypi4, is it possible that I can send OTA updates to my IoT devices?Thank you in advanceNikFollowComment"

Answer: "1Accepted AnswerWhere do you see that 32 bit isn't supported?Greengrass V2 supports armv7 which is 32 bit and is the same processor architecture in your device.https://docs.aws.amazon.com/greengrass/v2/developerguide/setting-up.html#greengrass-v2-supported-platformsYou can also install a 64 bit os.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 3 months agoEXPERTGreg_Breviewed 3 months ago"


Question: Renewing AWS credentials

"I'm following this AWS documentation to make ECS tasks access other AWS services using task role credentials. When I run curl http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI it returns a JSON document that looks something like this JSON document:{  "RoleArn":"arn:aws:iam::718304...",  "AccessKeyId":"ASIA2...",  "SecretAccessKey":"BNZD...",  "Token":"IQoJ...",  "Expiration":"2023-03-03T17:56:46Z"}My ECS instances are long running which means they will outlive the expiration timestamp provided in the above result.Do I need to poll that endpoint regularly to avoid expired credentials? if so is there a way to extend the credentails life?FollowComment"

Answer: "1Accepted AnswerYou will need to periodically refresh the credentials obtained from the metadata endpoint because as you mentioned, they have an expiration timestamp. You can do this by setting up a scheduled task or a cron job to fetch the new credentials from the metadata endpoint before they expire.To extend the credentials' life, you can increase the session duration when you assume the task role using AWS Security Token Service (STS). When you assume a role, you can specify the duration of the role session, up to a maximum of 12 hours. The default session duration is one hour.From here - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.htmlTemporary security credentials are short-term, as the name implies. They can be configured to last for anywhere from a few minutes to several hours. After the credentials expire, AWS no longer recognizes them or allows any kind of access from API requests made with them.CommentShareNikoanswered 3 months agoBrettski-AWS EXPERT3 months agoNote that AWS-supplied SDKs will poll the Instance Metadata Service for you - so this answer does depend on the libraries you're using.ShareAWS-User-Arman 3 months ago@Brettski-AWS that's excellent info but unfortunately for me this is an Elixir app so I won't get that benefit for free.Scratch what I said above. As you say, ex_aws will take care of this.Share"


Question: [Solved in LY 1.25] AI Bug and AI Crash in Script Canvas in Lumberyard 1.23 & 1.24

"Hi LY team,I found a bug & a crash about AI System & AI Script Canvas in Lumberyard 1.23.Please see :slight_smile:https://www.youtube.com/watch?v=az_SeFupYgQ&t=151sPlease Fix this bug/crash...ThanksFollow"

Answer: "0Accepted AnswerHi AhmadKarami,Does this issue still exist in 1.25?SharerePost-User-8164888answered 3 years ago0NOW , Why I can make AI Script Canvas in 1.18 but I can not that in 1.23 ?!SharerePost-User-8224505answered 3 years ago0Hi LY Team,I tested in LY 1.24 , The crack has been fixed , but the bug still exists!REMOVEDUPLOADI did all the steps correctly in LY 1.24 but Does not work! BAD BUG! 😤 I've done this before in LY 1.18 and even made  video tutorials 😭https://www.youtube.com/watch?v=rT4MCtrr20I&list=PLGiO9ZyED9TMdfUmxK3hNbobHsYQjjVlH&index=2&t=0shttps://www.youtube.com/watch?v=PcUInwAErpM&list=PLGiO9ZyED9TMdfUmxK3hNbobHsYQjjVlH&index=3&t=0shttps://www.youtube.com/watch?v=4j8PUAGn04A&list=PLGiO9ZyED9TMdfUmxK3hNbobHsYQjjVlH&index=4&t=0sSharerePost-User-8224505answered 3 years ago0Hi, I've filed a ticket for the team responsible for this component.SharerePost-User-8164888answered 3 years ago0I verified Starter Game in LY 1.24**.0** , this bug/problem is for Ctrl+E(Do not work Export to Engine AI AREA), I do not tested this for LY 1.24.1 , Do you know that this bug exist in LY 1.24**.1** ??REMOVEDUPLOADSharerePost-User-8224505answered 3 years ago0Hi @REDACTEDUSERsorry for delay , I want test , so I insert the result here today 🙂SharerePost-User-8224505answered 3 years ago0[quote="lmbr_Saulty, post:6, topic:8635, full:true"]Hi AhmadKarami,Does this issue still exist in 1.25?[/quote]Hi @REDACTEDUSERI tried A LOT, I tried different methods but the result is nothing , looks like does not work! but I think , I am wrong, I using starter game 2.0, how to implement AI-Robot ? Please see entity inspector in AI_Area Entity , also I tested my script canvas file in LY 1.18 does work , but when I tested in LY 1.25 , does not work! 🙂It should be noted that because the API have changed, there are definitely some things I do not know , I suggest to lumberyard team step-by-step make video tutorials will certainly solve this issue, especially about the behavior tree and target coverage points. 🌹 🙏REMOVEDUPLOADSharerePost-User-8224505answered 3 years ago0SOLVED AI Navigation in LY 1.25 :star_struck: 😍THANK YOU SO MUCH FOR HELP @REDACTEDUSERSharerePost-User-8224505answered 3 years ago"


Question: An error while communicating to amazon athena from tableau desktop

Bad connection: Tableau could not connect to the datasource.Error  code: AA76601Fcom/amazonaws/ClientConfiguration
Unable to connect to the Amazon Athena server "athena.us-west-2.amazonaws.com". Check that the server is running and that you have access privileges to the requested database.FollowComment

Answer: "0First, make sure you have the necessary IAM permissionsNext, make sure the endpoint you are connecting to is correctOften the region is wrongNext, make sure that the required JDBC drivers are installedhttps://docs.aws.amazon.com/athena/latest/ug/connect-with-jdbc.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-2134540 2 months agoathena.us-west-2.amazonaws.com ( both athena & s3 bucket are in oregon region)Share0Check if to connect to Amazon Athena you need ports 443 (ssl) and 444 to be open and also proper permissions are there.  Also Athena connects to Tableau via an Athena JDBC driver, ensure you have proper version.Referencehttps://aws.amazon.com/blogs/big-data/building-aws-data-lake-visualizations-with-amazon-athena-and-tableau/https://help.tableau.com/current/pro/desktop/en-us/examples_amazonathena.htmCommentShareEXPERTAWS-User-Nitinanswered 2 months agorePost-User-2134540 2 months agoNote: To connect to Amazon Athena you need ports 443 (ssl) and 444 to be open.How to set these ports to be open?Share"


Question: ignore certificate errors in python for synthetic canary's

"I'm trying to run a Cloudwatch > Synthetics Canaries (using Python 3.8) and getting this error.'<' not supported between instances of 'str' and 'int'It strongly appears to be because the certificate being self signed.  It would be nice if AWS fixed this on their end (adding support for self signed), but until that happens is there anyway in the aws webdriver to ignore certificate errors?Runtime versionsyn-python-selenium-1.0(Python 3.8, Selenium 3.141.0, Chromium 83.0.4103.0)This is the canary script provided by AWS.from aws_synthetics.selenium import synthetics_webdriver as syn_webdriverfrom aws_synthetics.common import synthetics_logger as loggerdef main():    url = "xyz"    # Set screenshot option    takeScreenshot = False    browser = syn_webdriver.Chrome()    browser.get(url)    if takeScreenshot:        browser.save_screenshot("loaded.png")    response_code = syn_webdriver.get_http_response(url)    if not response_code or response_code < 200 or response_code > 299:        raise Exception("Failed to load page!")    logger.info("Canary successfully executed")def handler(event, context):    # user defined log statements using synthetics_logger    logger.info("Selenium Python heartbeat canary")    return main()FollowCommentMichael_B a year agoHave you verified this hypothesis by changing the URL to a different HTTPS url?ShareAWS-User-8544142 a year agoIn fact I did, originally the self signed cert url errored, while a 3rd part signed cert worked.  But it's possible user-3302110 was right and I'll try some other things.Share"

Answer: "2The syn-python-selenium-1.0 runtime version by default launches browser with the --ignore-certificate-errors option set. The reason for the error might be a different error. It might help to log the response prior to the "if not response_code or response_code < 200 or response_code > 299" checkCommentShareAWS-User-3302110answered a year agoAWS-User-8544142 a year agoPerhaps your right, an AWS rep said it was due to the self signed cert.  I'll try something else.ShareAWS-User-8544142 a year agoSo this morning I created a new syn-python-selenium-1.0 canary and I picked a url with a valid 3party signed cert and it worked.  Then I created a 2nd canary, with the same runtime with a self-signed cert and it failed.  I have also tried to log the "response_code" but it says it's not set.  And I'm presuming it's not set because it can't get past the cert to get a response code.User-3302110, how can you be certain that it launches with --ignore-certificate-errors?  Thank youShareAWS-User-8544142 a year agoERROR: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1131)>ERROR: Canary execution exception.Traceback (most recent call last):File "/var/task/index.py", line 76, in handle_canaryresponse = customer_canary.handler(event, context)File "/opt/python/pageLoadBlueprint.py", line 26, in handlerreturn main()File "/opt/python/pageLoadBlueprint.py", line 19, in mainif not response_code or response_code < 200 or response_code > 299:TypeError: '<' not supported between instances of 'str' and 'int'SharerePost-User-4799667 a year agoI am currently using syn-python-selenium-1.3 and I am having similar certificate issues as well. I even added the --ignore-certificates-errors argument and still no luck. Any updates or workaround for this issue yet?Share1What about 1.3? Does it also use --ignore-certificate-errors? I'm getting this error:ERROR: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1131)>I tried to usefrom selenium.webdriver.chrome.options import Optionsoptions = Options()options.add_argument('--ignore-certificate-errors')browser = syn_webdriver.Chrome(chrome_options=options)but I'm still getting the error above.CommentShareDenisBYanswered a year agorePost-User-4799667 a year agoI am getting the same error were you able to find a possible solution by any chance?Share"


Question: Exam Revoked After PASSING - Bad Experience with PSI Online (AWS Solution Architect Associate Exam)

"I want to report an extremely bad experience giving the AWS Solution Architect Associate (SAA-C02) exam on 01/22/2022.  Apologies if this is not the right place to post this experience as I did not find any other forum to post exam-related experiences.I appeared for AWS Certified Solutions Architect - Associate (CONFIRMATION NUMBER: G81923108) on 01/22/2022. I was able to start the exam after 30 minutes of struggle in getting the PSI software loaded and working. I followed all the guidelines and requirements of the proctor and gave my full 130-minute attention to the exam. After completing the exam, I submitted the exam for the result and was very happy to see the screen "Grade: PASS. Congratulation! You have successfully passed the AWS Certified Solutions Architect .... Within 5 business days, you will receive an email stating your exam result ......"  After that, I thought that the exam is now over, as I sat for another 30 seconds and did not see any notification from Proctor or any other dialog on the PASS result screen. I took the photo of the screen from my mobile to keep it for my records so that I don't lose my result and have proof. Right then I saw a screen stating your exam is terminated due to a violation of taking photos and within 10 seconds screen closed.I called PSI and explained the matter that I completed the exam and saw the result on the screen as "PASS". Only after that, I take the picture. They opened a ticket but says you need to contact AWS for resolution.This is a very frustrating situation as after 9 days, today 02/01, and I gave exam on 01/22, there is no update on the AWS certification page and also no update on the PSI website related to the result. It's not acceptable for AWS/PSI to make candidates suffer and lose belief in the certification process.FollowComment"

Answer: "1Hi there,I’m sorry to hear of this frustration.Our Training & Certification support team will gladly assist you with this.Please reach out, providing as many details as possible, here: http://go.aws/contact-training.AWS Support - RandiCommentShareEXPERTAWS Support - Randianswered a year agoAWS-User-5010890 a year agoHi,I have raised ticket #9533957511 on 01/26/2022 with the Training And Certification team. As per their latest comment received from PSI "I've received an update from the team that "Please allow us a few more days. You will be notified of your score by email as soon as possible. We apologize for the delay. "However, this is more than 8 days, and it is difficult to understand that system is having issues for8 days?Share0Almost 18 days now and counting. Very frustrating that I could not find any resolution either from AWS or PSI both. I have asked them repeatedly to confirm why after passing an exam and seeing a pass screen, still my exam is revoked (why taking a photo after passing an exam is an issue)CommentShareAWS-User-5010890answered a year agorePost-User-8551289 5 months agoAny update ?Share0AWS-User-5010890, I hope you were able to contact the training and certification team at http://go.aws/contact-training. Please let us know if this answers your question. If this solved your issue, please remember to click on the "Accept" button to let the community know that your question is resolved. This helps everyone. Thank you in advance.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago0HI Floks,Any update on this, how it would be resolved ?CommentSharepnkj-3957654answered a year ago"


Question: "How do I verify a domain registered in AWS Route 53 with AWS Simple Email Service (SES) purely through the Python client, boto3?"

"I have read every ounce of documentation I could find related to this topic. I've been using the boto3 Python client to work with AWS to register a new domain and verify it to be used with the AWS Simple Email Service (SES).This is an entirely painless task in just a few clicks with the GUI:And I thought, reading the SES boto3 documentation, I could achieve the same thing via API with the Python client.But nothing happens. I get no error. No indication appears in the GUI that the verification is pending (the way it does when done through the GUI). Even after 72 hours, nothing changes. But when I do it in the GUI, it works pretty quickly, so presumably I just missed some important API step.%pip install boto3 # a Jupyter-ismimport boto3import timeclass Domain:        # AWS Route 53 Domains Documentation:        # https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/route53domains.html#Route53Domains.Client.get_operation_detail        def __init__(self, static_domain=False): # identity: Identity        self.client = boto3.client('route53domains')                if static_domain:                        domain_list_response = self.client.list_domains()            print(domain_list_response)            domain_owned = False                        for domain in domain_list_response['Domains']:                if domain['DomainName'] == static_domain:                    domain_owned = True                                if domain_owned:                print('Domain already owned...')                self.name = static_domain                            else:                availability_response = self.client.check_domain_availability(                    DomainName=static_domain                )                first_name = 'First' # identity.fname                last_name = 'Last' # identity.lname                org_name = 'Testing123' # identity.org                address = '123 Testing Drive' # idenity.addr                city = 'TestingCity' # identity.city                state = 'TestingState' # identity.state_code                country = 'US' # identity.country_code                zip_code = '12345' # identity.zip_code                phone = '+1.1234567890' # identity.phone                email = f'admin@{static_domain}'                if availability_response['Availability'] == 'AVAILABLE':                    print('Domain available...')                    registration_response = self.client.register_domain(                        DomainName=static_domain,                        DurationInYears=1,                        AutoRenew=False,                        AdminContact={                            'FirstName': first_name,                            'LastName': last_name,                            'ContactType': 'PERSON',                            'OrganizationName': org_name,                            'AddressLine1': address,                            'City': city,                            'State': state,                            'CountryCode': country,                            'ZipCode': zip_code,                            'PhoneNumber': phone,                            'Email': email                        },                        RegistrantContact={                            'FirstName': first_name,                            'LastName': last_name,                            'ContactType': 'PERSON',                            'OrganizationName': org_name,                            'AddressLine1': address,                            'City': city,                            'State': state,                            'CountryCode': country,                            'ZipCode': zip_code,                            'PhoneNumber': phone,                            'Email': email                        },                        TechContact={                            'FirstName': first_name,                            'LastName': last_name,                            'ContactType': 'PERSON',                            'OrganizationName': org_name,                            'AddressLine1': address,                            'City': city,                            'State': state,                            'CountryCode': country,                            'ZipCode': zip_code,                            'PhoneNumber': phone,                            'Email': email                        },                        PrivacyProtectAdminContact=False,                        PrivacyProtectRegistrantContact=False,                        PrivacyProtectTechContact=False                    )                    print(registration_response)                    operation_id = registration_response['OperationId']                    print(operation_id)                    operation_detail_response = self.client.get_operation_detail(                        OperationId=operation_id                    )                    print(operation_detail_response)                    while operation_detail_response['Status'] == 'IN_PROGRESS':                        time.sleep(10)                        operation_detail_response = self.client.get_operation_detail(                            OperationId=operation_id                        )                        print(operation_detail_response)                        if operation_detail_response['Status'] == 'IN_PROGRESS':                            print('Domain registration in progress...')                        else:                            print('Domain registration successful...')        else:            print('dynamic domain generation not yet supported')class Inbox:    def __init__(self, domain, username: str):        self.client = boto3.client('ses')        self.domain = domain        self.username = username        self.address = f'{self.username}@{self.domain.name}'        print(f'Inbox ({self.domain.name}) ready...')                verify_domain_id_response = self.client.verify_domain_identity(            Domain=self.domain.name        )        print('verify_domain_id_response[\'VerificationToken\']', verify_domain_id_response['VerificationToken'])        print('')                domain_verified = False        while domain_verified == False:            get_identity_verification_attributes_response = self.client.get_identity_verification_attributes(                Identities=[                    self.domain.name,                ]            )            print('get_identity_verification_attributes_response', get_identity_verification_attributes_response)            print('')            for identity in get_identity_verification_attributes_response['VerificationAttributes']:                status = get_identity_verification_attributes_response['VerificationAttributes'][identity]['VerificationStatus']                if status == 'Success':                    domain_verified = True                else:                    print('Domain verification status:', status)                    print('This could take up to 72 hours. Feel free to close this notebook and re-execute the code from this cell later. The process is happening on AWS\'s end and will not be interrupted. Once verified, re-executing the code won\'t reset the status, don\'t worry.')                    time.sleep(100)                            verify_domain_dkim_response = self.client.verify_domain_dkim(            Domain=self.domain.name        )        print('verify_domain_dkim_response[\'DkimTokens\']', verify_domain_dkim_response['DkimTokens'])        print('')                enable_id_dkim_response = self.client.set_identity_dkim_enabled(            Identity=self.domain.name,            DkimEnabled=True        )        print('enable_id_dkim_response', enable_id_dkim_response)        print('')        # ... snip ... code to create actual inboxes + send & receive emails        # from domain                print('Inbox verified...')domain = Domain(static_domain='testing.com')inbox = Inbox(domain=domain, username='admin')Output:{'Domains': [{'DomainName': '... snip ...', 'AutoRenew': False, 'TransferLock': False, 'Expiry': datetime.datetime(2024, 1, 21, 16, 51, 56, tzinfo=tzlocal())}], 'ResponseMetadata': {'RequestId': '... snip ...', 'HTTPStatusCode': 200, 'HTTPHeaders': {'x-amzn-requestid': '... snip ...', 'content-type': 'application/x-amz-json-1.1', 'content-length': '104', 'date': 'Mon, 23 Jan 2023 02:31:27 GMT'}, 'RetryAttempts': 0}}Domain already owned...Inbox (... snip ...) ready...verify_domain_id_response['VerificationToken'] ... snip ...get_identity_verification_attributes_response {'VerificationAttributes': {'... snip ...': {'VerificationStatus': 'Pending', 'VerificationToken': '... snip ...'}}, 'ResponseMetadata': {'RequestId': '... snip ...', 'HTTPStatusCode': 200, 'HTTPHeaders': {'date': 'Mon, 23 Jan 2023 02:31:27 GMT', 'content-type': 'text/xml', 'content-length': '639', 'connection': 'keep-alive', 'x-amzn-requestid': '... snip ...'}, 'RetryAttempts': 0}}Domain verification status: PendingThis could take up to 72 hours. Yes, really. Feel free to close this notebook and re-execute the code from this cell later. The process is happening on AWS's end and will not be interrupted. Once verified, re-executing the code won't reset the status, don't worry.What am I missing here? Is what I'm trying to do a simple matter of something I missed in the documentation? Or is this not even viable purely via API in AWS? I suspect the former.Maybe I need to handle the record assignment process manually with the Route53 API? I'd really appreciate an example of what that would like if so. Otherwise just a hint that this is a requirement, and that SES will not do it automatically like with the GUI functionality, would be helpful to know.FollowComment"


Question: AppStream Latency Issue

"I have a district that we have deployed Adobe Creative Cloud on AppStream (stream.graphics-design.xlarge instances). In a room of 20 students using Chromebooks, some students are just fine, and when they are typing, the application is responsive, and for a few students, when typing, there is a delay when they type before characters show up.  If you go into the AppStream client and check the latency on these devices, it is only 46ms.  The school district has a 1Gbps fiber connection, and their overall bandwidth usage is 40% - 50%, so I don't think their uplink is the issue.  Any other thoughts or things to look at to troubleshoot the issue?FollowComment"


Question: "Why am I being billed for Cloudwatch when I have NO running instances, no used storage, no active services of any kind?"

"I stopped and removed all my ec2 instances, IPs, images, snapshots, etc. I have ZERO active services this month, yet I am being billed for Cloudwatch.How do I turn it off?FollowComment"

Answer: "1Have a look at https://aws.amazon.com/cloudwatch/pricing/CloudWatch doesn't just bill for gathering metrics from running services but also for having dashboards and alarms created and for gathering and storing logs and some other things. The storing of logs can stack up costs quite quickly.You will have to clean up those other CloudWatch components as well, and make sure that no other unexpected service like CloudTrail is pushing logs through which you should be able to tell from the log group name.CommentShareTerence Whiteanswered a year ago"


Question: Resetting AWS Environment

"Good morning,I just finished the Coursera AWS Cloud Technical Essentials course and am in the process of registering for the second part, Architecting Solutions on AWS.  Is there any way I can automatically reset my AWS environment back to a type of factory default so that it appears as a newly created account?Thank you,JasonFollowComment"

Answer: "0I'm not entirely sure what you mean by AWS environment, but if you're referring to account configuration, you could check this page. If you refer to custom resources you've created, I'm not aware of anything that resets everything automatically, you should trace back and delete what you created.CommentShareRonaldanswered 5 months agojdlangdon 5 months agoThank you Ronald.  What I want to do is somehow automatically delete everything in my ROOT aws account so that I can start over without actually deleting the account itself.Share0There is no built-in way to reset an AWS Account to a "factory default". When using AWS services, you might change your Account configuration and/or create various resources like IAM roles or CloudWatch log groups. Additionally, you might change global or regional service configuration (e.g. for AWS Config or Amazon API Gateway). Further more, while using the services, your Account's internal metrics will change. These are the reasons why there is no way to do a factory reset of an AWS account.Even when you deploy your resources using the IaC approach (AWS CloudFormation or AWS CDK) and then delete the stacks, you still might end up with having some data or configuration that differs from defaults (consider e.g. CloudWatch metrics - you cannot delete them, they expire automatically).The only way to fully reset everything is to close your existing Account and create a new one.You could try manually deleting all resources you have created. You can use AWS Tag Editor to find all resources in all regions and then manually delete them. Alternatively, there are third-party open source tools that try to do this in an automated way (offered not by AWS).CommentShareDmitry Balabanovanswered 5 months ago"


Question: aws athena to s3 communication

"Hi,my understanding is Athena to S3 communication happens with in AWS network and it does not go through public. Can some one confirm this?FollowComment"

Answer: "0Accepted AnswerYes, you are right.CommentShareAWS-User-4025440answered 3 years ago"


Question: How to deploy a Laravel Application on AWS EC2?

I have using EC2 for almost a year. I always gets lost when I need to deploy a Laravel app on EC2. I have described my steps in an article. Could the experts have a look at the article and comment if these steps are correct or need to be adjusted?https://medium.com/@ravitaxali/how-to-deploy-a-laravel-app-on-aws-ec2-ubuntu-9a5b3d0999d8FollowComment


Question: Moving DNS hosting from external to AWS Route53

"We have an App hosted on AWS and our DNS is hosted at a different provider (cPanel). We are currently evaluating to move DNS hosting and homepage hosting from  cPanel to AWS Route53 in order to make DNS management more easy. We are struggling with the cost estimations. We pay annually 97€ for hosting of two main domains + approx. 5 sub domains including the hosting of our homepage using WordPress at cPanel right now and I need to understand the costs for moving to AWS Route53. Any help on getting at least an idea of the costs is highly appreciated.Best Regards,falk von RönnFollowComment"

Answer: "0At a very high level pricing of many AWS services are categorised in 2 (per hour charges and usage charge)For example if you move 2 public domains acme.com and example.com to AWS R53, you will create 2 public hosted zones.2 public hosted will be charged @ 0.50/hosted zone/month i.e. per year you will pay 20.512=12$A hosted zone includes 10,000 records.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-routing-traffic-to-resources.htmlPlus you will also be charged for the number of times someone queries your record.$0.40 per million queries – first 1 Billion queries / month$0.20 per million queries – over 1 Billion queries / monthi hope this clarifies some of your doubts, if you are still interested to learn more open a support case or get in touch with your AWS account team.CommentShareAzeem Ayazanswered 6 months ago-1You can review AWS Pricing here and use the calculator to estimate the cost you will incur based on you usage.https://aws.amazon.com/route53/pricing/CommentShareAzeem Ayazanswered a year agoFalk von Roenn a year agoTo be honest this is exactly what I did. But it is still not clear to me how the pricing works!Share"


Question: How do I keep the time in sync in docker based lambda functions

I have a lambda using a container based off of the public.ecr.aws/lambda/python:3.9 image and the time is getting out of sync over time. What do I need to install and run so the time gets synced from amazon.pool.ntp.org?FollowCommentMichael_F EXPERTa year agoAre you using x86 or arm64 for your Lambda function?Share

Answer: "0Accepted AnswerIt's not clear from the error message which is the timestamp for "now" and which is the timestamp in the signature. Is it possible that the request signature was generated when the function was created; and because the function has been warm for a while that signature has expired? If so, that's not time drift; it means that you'll need to regenerate the signature before calling the service.CommentShareEXPERTBrettski-AWSanswered a year ago0As a Lambda function runs for 15 minutes maximum, this does not seem a real issue to me.Seems even difficult to notice this. How did you notice the drift?CommentSharerik2803answered a year agohb2638 a year agoI got an error making a boto3 call --> botocore.exceptions.ClientError: An error occurred (InvalidSignatureException) when calling the PutLogEvents operation: Signature expired: 20220211T120131Z is now earlier than 20220211T120138Z (20220211T120638Z - 5 min.)Also, the lambda doesn't get killed off immediately, it sticks around for an unspecified amount of time to service additional requests. This is to avoid/reduce the number of cold starts.Share0Didn't provide enough info of this but this error was occurring from a Lambda Extension we wrote and this error was a result of a race condition where the extension was "frozen" by AWS between lambda invocations.... and it got frozen after signing a AWS request but before actually sending it out.CommentSharehb2638answered a year ago"


Question: EC2 in public subnet reachable by public IP but not by public DNS

"When launching ec2 instance in a specific public subnet, the instances automatically show a Public IPv4 address and a Public IPv4 DNS. However, they are only reachable (by SSH) through their IP address; not through their DNS name. What could be the cause?Some additional information:The VPC containing the subnet has "DNS hostnames" enabled and "DNS resolution" enabled.The Subnet ACL allows all traffic.FollowComment"

Answer: 0Your VPC automatically has a private Route 53 zone to which the private IP address of the EC2 instance is added. But that won't help you connect to the public IP address of the instance. You will need to have a Route 53 public hosted zone (or a public hosted zone from another DNS provider) and add the public IP address of the EC2 instance to that zone.That you can connect using the IP address is good - it means that everything there is correct; it's a matter now of ensuring that the DNS records are in place.Edit (based on excellent feedback from a colleague): I had missed that you'd mentioned the Public DNS that is automatically assigned. It is of the format ec2-xx-xx-xx-xx.region-name.compute.amazonaws.com which means you should be able to use that as well as the IP. My answer above applies if you want a custom DNS name.CommentShareEXPERTBrettski-AWSanswered 7 months agoEXPERTTushar_Jreviewed 7 months ago


Question: Unable to RDP to Workspace (Resolved)

"After searching this forum, I've found similar issues but they're either materially different or unresolved.I'm standing up machines for a client's small business and want to remove Local Administrator privileges for her team so they can't install applications on the VMs.  Before doing that, I've attempted to test that I can access their machines if needed, by using username Administrator and the domain administrator password I created with the directory.I can't actually reach the machines though.I've added my IP to the test machine's security group under Network Interfaces in EC2, and I've even tried it with "Anyone" permitted.  I get an error in RDP that it cannot connect to the machine either because remote access is not enabled, the computer is turned off, or the computer is unavailable on the network.  I've run out of ideas here.I've tested that I can initiate an RDP connection from within the machine itself, though I don't know how significant of a test that is.  I've run out of ideas here.  Any thoughts?Edited by: DavidCarr on Mar 5, 2020 11:16 AMMarking this as resolved.FollowComment"

Answer: 0Was using public IP address indicated in the Workspace details rather than the one from the Network Interface.CommentShareDavidCarranswered 3 years ago


Question: connection to AWS t2 Micro service from 3CX

"I have been using AWS to host Debian 10 to connect my 3CX accounts for our phone systems. All working fine.All of a sudden, when i go to create a new service on AWS and then connect to it from 3CX via the installer, I get the following messageAn unknown error occured: User: arn:aws:iam::090946289178:user/ICT is not authorized to perform: servicequotas:GetServiceQuota on resource: arn:aws:servicequotas:ap-southeast-2:090946289178:ec2/L-34B43A08 because no identity-based policy allows the servicequotas:GetServiceQuota actionI have tried everything I can think of.Delete the AWS service and install againCreate user in IAMCreate key pairsadd debian subscription.I am following the same path as when I setup the existing system which works fine.I have also tried connecting with my other subscriptions to AWS and get the same messageI also created a new AWS account and added a new subscription, IAM and Key pair there and got the same message.3CX support has no idea what it is.Can anyone shed some light here?DavidFollowComment"

Answer: 2The error message relates to the AWS IAM (Identity and Access Management) system. It's saying that the user you're logged in as (ICT) isn't authorised to call the GetServiceQuota API. Creating new keys; recreating an instance in the service you're using - these won't make any difference as they all refer back to IAM to ensure that you have permissions to perform the actions you request.Something that you're doing (or some code that is running on your behalf) is calling out to the AWS Service Quota service - in order to make that call successfully you'll need to add permissions for your user to do that in the IAM console. It might be as simple as adding the AWS-managed ServiceQuotasReadOnlyAccess policy to your IAM user.CommentShareEXPERTBrettski-AWSanswered a year ago1you would need to add "ServiceQuotasFullAccess" as a permission in IAM the same way you did the EC2 access permissionCommentShareFelipeMCanswered 8 months ago


Question: Begin exam option not present

I had my exam today but i didn't find "begin exam" option there.So i reschedule my exam.But whats the guarantee that it will work next timeFollowComment

Answer: "1Go the AWS Certification page and select the option"Exam Reschedule"Now you will land to the Pearson Portal.If you are logging to this section then you would see Run System Test option there, if it is 30 Minutes before the exam then you would be getting Check In option, and if it is during the exam window then you will find Launch Exam option.CommentShareGovind Kumaranswered a month ago"


Question: One of my AWS Workmail user can't receive email anymore.

"Hi there,I have a workmail account with two users.User Info@User Zach@Both worked fine for 2 months.User Zach@ still work fine.User info@ can send email but can't receive any emails for 2 weeks.I disabled the SAS inbound rule (as suggested in a different post) but with no success.My DNS configuration in my hosted zone remains the same. I've configured everything as instructed in the documentation.I'm unsure of what to do or what could the problem be.Can someone please assist?RegardsFollowComment"

Answer: "0Hi,When a single user is unable to receive mail the SES inbound rules is a good place to check. Disabling it not the best option as it can block all incoming mail. You can "reset" you inbound rules by adding your domain again in the WorkMail console. You don't have to remove your domain first.You can also check your SES Inbound rules to ensure either "WorkMail" is the only rule in the set or that other rules that apply to the info@ email address work correctly. If a rule fails or has a stop action it might cause following rules to fail.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 8 months agorePost-User-5562795 8 months agoI added the domain again in the WorkMail console but the user still can't receive any emails. I checked the SES Inbound rules and there is only one for that domain.There are no stop action in place.I didn't change anything with any settings and it suddenly stopped working.Share"


Question: best apprach to monitor and loging the cloudfront  on cloudwatch

"Hi All,I am very new to AWS DevOps.  I am trying to find the best approach to logging and monitoring the CloudFront activity on Cloudwatch.  I have tried the belowenabled the Cloudfront logs to s3, then analyze the data with Athenaenable real-time logging to Cloudwatch from the CloudFront console.but I am stuckin  1st I am not aware of how to enable visual monitoring of thisin the 2nd approach. that data is logged but does not provide sufficient data.please helpFollowComment"

Answer: "0Accepted AnswerHi,there are 2 main ways:for access logs in realtime (seconds), you should setup an integration with Cloudfront ->Amazon Kinesis Data Streams -> Amazon Kinesis Firehose, which then can be moved to S3, OpenSearch, etc.for access logs needed in minutes, you could just send logs directly to S3.For more you can see here: https://repost.aws/knowledge-center/cloudfront-logging-requestsHope it helps ;)CommentShareEXPERTalatechanswered a month ago0thank you so.. much :)CommentSharerePost-User-4715454answered a month ago"


Question: Error generated from encrypted envelope?

"Hi,I'm new to FPGAs on AWS and I'm trying to get a simple modification to the cl_hello_world to compile.  The simple modification is to have two memory addresses to write to and then when read it is the XOR of the two written 32-bit values.  As far as I can tell theverilog is okay but when compiling with the aws_build_dcp_from_cl.sh script, vivado exits with a bunch of"ERROR: \[ Synth 8-5809 ] Error generated from encrypted envelope. [/home/centos/src/project_data/aws-fpga/hdk/cl/examples/cl_hello_world/build/src_post_encryption/cl_hello_world.sv:281]" in the log file."Could someone explain what is going on and point me to some references?Thanks,AndrewEdited by: AndrewPR on Oct 28, 2020 6:22 AMEdited by: AndrewPR on Oct 28, 2020 6:23 AM - trying to get error code rightFollowComment"

Answer: "0Accepted AnswerHello,The build errors you reported are coming from an encrypted module. Hence the actual error message is obfuscated. You can temporarily disable encryption by commenting following lines (line 57-60) in your encrypt.tcl:https://github.com/aws/aws-fpga/blob/develop/hdk/cl/examples/cl_hello_world/build/scripts/encrypt.tclHere is also another forum post regarding this same issue for your reference:https://forums.aws.amazon.com/thread.jspa?messageID=947131ThanksKavyaEdited by: awskavya on Oct 28, 2020 8:16 AMCommentShareawskavyaanswered 3 years ago0Thank you for the response, there was indeed a syntax error that was being hidden.What is the purpose of the encryption step?  What happens if I disable it, will it not make AFIs properly as a result?CommentShareAndrewPRanswered 3 years ago0Hi AndrewPR,Thats correct, AFI creation will fail if your CL source files are not encrypted.Please refer to https://github.com/aws/aws-fpga/blob/master/hdk/cl/developer_designs/Starting_Your_Own_CL.md#3-modify-the-build-scripts .Thanks,Sunil.CommentShareawssunilanswered 3 years ago"


Question: Gamelift fleet instance deploy location

"I started using gamelift matchmaking with gamelift fleets for custom server builds, And i have major issue which i can't wrap my head around.Right now i have couple of setups which both have same issue "i think",Both setups have one thing in common which is matchmaking rule set, config and queue which all on us-east-1 "as it's the only region available to me to make those features on".First setup, I have a gamelift fleet on us-east-1 works perfect with matchmaking and queue but for my current location us server has too much delay so i added couple of other locations to the fleet, ap-south-1 and me-south-1 "which both have way better ping/delay than us", but trying to get in the queue for matchmaking it still deploys only on us-east-1 every single time. Even when i scale us-east-1 down to 0 the matchmaking ticket gets stuck in "PLACING" status which means it still tries to find server or fleet instance not active.Second setup, the same matchmaking as the first one but what is different is the fleet is deployed on ap-south-1 and the queue target fleet set to that south-1, trying to place a ticket into queue will result on the same issue which gets stuck in placing and never find or deploys the server.I can't place matchmaking related stuff anywhere i deployed my fleets on "all the available options for me will result in the same delay as us-east-1"Please let me know how if i missed some option to enable dynamic instance deployment or i did something wrong with my setups.FollowComment"

Answer: "0Update, i tried an eu region "eu-west-1" for everything "rule set, config and queue" along with the fleet and build but still the ticket stuck in placing, so currently only us-east-1 region is working for me.CommentSharerePost-User-5420421answered 2 years ago0Hello James,Thanks for your reply.I have already dummy latencies for test purposes and its low "60 ms", which means it will have no issue to connect to any fleet. Still, if I removed all fleets and left the one I want, it won't work and no instances will be created at all.In my queue, I have the regions and fleet added in destinations "I tried removing all fleets except the one I want to", but if the us-east-1 fleet not there It won't, it won't create any instance and the tickets will get timed out.I tried that too, I wrote a lambda function that creates game sessions and worked fine and instances created.CommentSharerePost-User-5420421answered 2 years ago0Hey Hassan,Could you verify a few things for us?The best practice is that that you should be passing in player latencies for all the fleet locations. If not, then GameLift uses a very high value (1000) as the default latency for the location, and it may be filtered out if you have a player latency policy on your queue. If you have a player latency policy on the queue, try removing that first, or specify a dummy latency for all of your locations.Check your queue's filterConfiguration (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-gamelift-gamesessionqueue-filterconfiguration.html) to see if you allowed only placement on us-east-1? (If FilterConfiguration is not configured then by default it should allow all locations)Try manually calling CreateGameSession to see if you can create a game session in locations besides us-west-2? Part of what makes a Matchmaking ticket successful is that a game session is successfully created.CommentSharerePost-User-7108006answered 2 years ago0For #2, could you check if your queue has a filter configuration? If not, then please give us the following information to help us verify if there is an issue in the backend:Queue nameRegion of the queueApproximate time when you last tried to place a game session on the queue and faced the timeout issueCommentSharerePost-User-7108006answered 2 years ago"


Question: Set the access permission of objects in S3 buckets

"I have created objects in S3 buckets and created multiple folders under the objects. How do I control the access permissions of IAM users for these folders?How do I manage IAM user permissions if there are folders under folders?For example, IAM users have the permission to modify the files in that folder, can access that folder, can not access that folder, and so on, how to set the permission?Note: All are IAM users under the same AWS account.I just want to do something like NAS file permission management, thank you.FollowComment"

Answer: "1Hi   shengxian_huangHere are the links for your requirements. They should help you with what you are looking for.  You may accept the answer if it helped so that I know.Different ways to grant access:https://aws.amazon.com/blogs/security/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-s3-resources/#:~:text=IAM%20policies%20vs.&text=You%20attach%20IAM%20policies%20to,attached%20only%20to%20S3%20buckets.Granting access to folders:https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/https://aws.amazon.com/premiumsupport/knowledge-center/s3-folder-user-access/https://aws.amazon.com/premiumsupport/knowledge-center/iam-s3-user-specific-folder/Writing IAM policies:https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/Policy generaotor:https://awspolicygen.s3.amazonaws.com/policygen.htmlCommentShareSandeepVudataanswered a year ago0I don't know how to layer folders for access.CommentShareshengxian_huanganswered a year agoSandeepVudata a year agoNot sure I understood what you meant by layer foldersShareshengxian_huang a year agoIt is the level one directory, level two directory, level three directory access and modify permission Settings.ShareSandeepVudata a year agoCreate separate folders and use policies for each based on how you want permissions to different users. You can create use groups, assign users to those groups and then attach policies to user groupsShareshengxian_huang a year agoBecause I used RaiDrive to connect to S3, the network drive disk was directly mapped to the root directory of S3 bucket, and I logged in with different IAM accounts on different computers. After all the data of the company was migrated to S3 bucket, I needed to check many folders (root directory, level 1 directory, level 2 directory, Assign permissions to different users or groups (add, delete, modify, search, etc.). I have tried IAM strategy, bucket strategy, access point, etc., and it doesn't seem to meet the demand, or do I not know how to do it?ShareSandeepVudata a year agoNot sure where you are going wrong. You may have to figure out a way to achieve what you want to by experimenting or see if anyone else can throw more light on this.ShareShow 1 more comment0You can check NirvaShare - https://nirvashare.comWith that, you can share file or folder level access to internal or external users with fine access control. Also easy to integrate with AWS SSO users with a group, etc.CommentShareNirvaShareanswered a year ago"


Question: DMS migration from Aurora MySQL 5.6 to Aurora MySQL 5.7 on graviton

"Hi there, I am having recurring issues migrating Aurora MySQL 5.6.10 on db.r5.large to Aurora MySQL 5.7.12 on db.r6g.large.I started by trying to replicate all schemas I had created, but this failed with an unknown error.I then broke this down into one schema per replication group, this also failed with an unknown error.I then turned on CloudWatch logging for all tasks. This worked other than one table repeatedly fails to replicate. If I use the mysql cli to drop or repair the table, mysql drops the connection!When I look at the table in phpmyadmin, it says 'unknown storage engine' and/or table in use.When I try to drop the schema using phpmyadmin, it logs me out straight away! I've waited a few minutes and now can log back in, and can see the schema has been dropped successfully.This looks like a bug in DMS creating the table, or in Aurora somehow locking the table and putting it into an inconsistent state.I've now resolved the issue and moved on, but the service team might want to be aware of this.The table schema is very simple:CREATE TABLE IF NOT EXISTS lkcities (state varchar(2) DEFAULT NULL,city varchar(16) DEFAULT NULL,country_id varchar(2) NOT NULL,UNIQUE KEY country_id (country_id,state,city)) ENGINE=InnoDB DEFAULT CHARSET=utf8;---- Dumping data for table lkcitiesINSERT INTO lkcities (state, city, country_id) VALUES('AK', 'Akhiok', 'US'),('AK', 'Akiachak', 'US'),('AK', 'Akiak', 'US'),('AK', 'Akutan', 'US'),('AK', 'Alakanuk', 'US'),('AK', 'Aleknagik', 'US'),('AK', 'Allakaket', 'US'),('AK', 'Ambler', 'US'),('AK', 'Anaktuvuk Pass', 'US'),('AK', 'Anchorage', 'US'),etc ~25,705 rows.FollowComment"

Answer: "0Thank you for the note. May I ask - Why didn't you move to a Graviton2 instance by upgrading the primary or the reader instance? The downtime with this approach is just 60-120 seconds. We always suggest using native tools rather than AWS DMS for homogeneous migrations.CommentShareAWS-VGanswered 8 months agorePost-User-3276097 8 months agoAt the cluster level, there is no option to change the instance type. At the instance level, the only options are to move to another db.r5.* type. db.r6g is not offered.I am contemplating upgrading first from Aurora 1.22.2 (MySQL 5.6) to Aurora 2.10.2 (MySQL 5.7) - will there be an option to switch to Graviton2 after that?A native tool is going to cost me far more time than 60-120 seconds.ShareAWS-VG 8 months agoYes, that will work.Share0A key gap here is that the UI does not indicate that the instance types have been filtered based on the Aurora version. I would lose 10 inserts per second during any downtime. So the only option I could see was to use DMS. I spent about 6 hours battling DMS because the DMS info omitted to mention the requirement to restart the cluster after changing the parameter group to allow replication. I only found this detail by chance on a parameter group doc page.CommentSharerePost-User-3276097answered 8 months ago"


Question: Workspace DNS resolution is wrong

"I have a workspace machine (Windows 10) where the DNS resolution is always returning the wildcard domain over the actual entries in the domain.  For example if I have the following DNS entries:*.somecompany.com        CNAMEapp.somecompany.com      CNAMEThen I do a dns lookup on the workspace machine for nslookup app.somecompany.com then it returns the entry for *.somecompany.com and not the expected entry for app.somecompany.com.  In fact I can test with several other domains registered in my DNS Zone settings, and they all return *somecompany.com.  My zone is hosted on Route 53.  If I do a similar resolution outside of the workspace it resolves correctly.  And this used to work flawlessly on workspaces.  What I did notice was that my DNS server on the workspace instance is set to my Simple Directory for my account, but outside of the workspace it's set to VPC's DNS server or an external DNS server.  I don't see a lot of ways to inspect how the DNS is set up on the Simple Directory either.I should also add if I do a nslookup google.com I get the answer for *.somecompany.com!  But if I go into Chrome or Firefox and enter google.com then it returns the expected results.  But other programs on my machine seem to be suffering from the same issue.So something about the Simple Directory server running for my domain isn't updating from Route53 or is just not working.  What is going on?FollowComment"

Answer: "0This is really weird because as you probably know a wildcard is handled "server side" and would never be exposed to a DNS client. So, assume the following sequence:t0 - only *.example.com A 10.1.1.1 TTL 3600 existst1 - you nslookup test1.example.com -> result is 10.1.1.1 and it's cachedt2 - test2.example.com A 10.2.2.2 is addedt3 - you run nslookup test2.example.com -> at this point the only thing the client can do is go to server, it doesn't know at t1 the response would have been the same than for test1The only case what you are describing would happen is:t4 - you nslookup test3.example.com -> 10.1.1.1 (from the wildcard) is returned, with a ttl of 900t5 - test3.example.com A 10.3.3.3 is addedt6 - you nslookup test3.example.com again -> 10.1.1.1 will be returrned until the record cached at t4 expires, 10.3.3.3 afterwardsTo rule out any caching issue, have you tried creating a new subdomain you've never queried before (in the same zone with the * record), and see how it resolves?CommentShareGiorgio@AWSanswered a year agochubbsondubs a year agoI will try to create a new domain, but I will also say that if I try and resolve the public DNS name from amazon  ec2-3-277-231-288.compute-1.amazonaws.com (I modified the number so that it was invalid so I could post it).  That too resolves to *.somecompany.com.  It seems like the DNS server (not the client) is hard wired to return that for every inquiry.  nslookup www.yahoo.com, nslookup amazon.com, etc.  They all return the same answer.Sharechubbsondubs a year agoIs there a service in windows 10 that could be disabled (particularly an amazon related one), that might cause the DNS records to not be updated with Route53?  I had to turn off several services a while back while fixing something else, and things were broken until I turned them back on.  I may have a service that I didn't turn back on hence causing this issue.Share0Hello! According to this link https://docs.aws.amazon.com/directoryservice/latest/admin-guide/simple_ad_dns.html Simple AD does not support dynamic DNS updates. When launching a WorkSpace, the IP's of your Simple AD domain controllers are assigned as static. The previous link offers additional guidance so I recommend taking a look.EC2 instances work differently in this regard. When launching an EC2 instance and joining to the domain, the DNS IP settings are not set, so the default DHCP option takes place (unless your AD has a group policy that sets them). If you have DHCP Options configured in your VPC https://docs.aws.amazon.com/directoryservice/latest/admin-guide/dhcp_options_set.html the EC2 instance will get its domain name and DNS settings from it.CommentShareSUPPORT ENGINEERFrancisco_Lanswered a year agochubbsondubs a year agoThanks for the answer.  I figured out part of the issue where some of the programs I was using couldn't connect to other machines in the VPC.  It came down to a missing security group not being applied.  So just a dumb configuration problem.  However, when debugging it I started using nslookup to try and see where these DNS names were going, and nslookup still reports bad results which I can't explain.  But all of the programs (chrome, firefox, ssh tools, etc) are in agreement on DNS resolution, and are working as expected.  But for some reason nslookup is still being weird.Share"


Question: Lambda SnapStart Xray Tracing

"Hello, we are considering using Lambda SnapStart to our Java11 based Lambda functions.Looks like there is a limitation on using Lambda tracing feature along with SnapStart (TracingConfig is not supported for SnapStart enabled functions).Is this limitation is pernament? (due to the SnapStart underlying tech) or there is a plan to enable tracing in the near future?Are there good ways to mitigate this limitation?FollowComment"

Answer: "0This feature request is Under Review.CommentShareRahul Popatanswered 6 months ago0hey, the limitation on X-Ray is temporary, and the team is working to support X-Ray in the coming months.CommentShareTarunanswered 5 months ago"


Question: "Managed AD, Multi Region, Limited to 5 : How to use same domain in more regions?"

"We have hundreds of machines spread across 12 regions. We started implementing AWS Directory Service Managed AD with multi-region Replication and ran up against the 5 region limit (why the limit if I'm willing to pay for the additional regions?).  We'd like to have all of the instances in the same domain as we are a global organization and use machines around the world for sales, service and support of our software products.What is the best practice and architecture (and how) to get domain services into the remaining 7 regions?FollowComment"

Answer: "1Accepted AnswerThe limit of 5 regions is a soft limit.  Please open a support case to request a limit increase.https://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-caseCommentShareJoeD_AWSanswered 8 months agometageek 8 months agoThanks - I had opened a parallel case and this was the first option offered, to raise the soft limit. I'm still curious if it's possible to use the 5 existing and join machines in other regions to the domain assuming peering is enabled between all of the regions.ShareJoeD_AWS 8 months agoYes, you can domain join from regions without domain controllers provided there is a network path to a region with domain controllers.  Your suggestion of a peering connection between the two is ideal for this scenario.  The only thing that wouldn't work is EC2's Seamless Domain Join¹ feature which will domain join at instance launch.  Instead you will have to manually join² the instance or automate it yourself by adding some code to User Data or authoring an SSM document.1 - https://docs.aws.amazon.com/directoryservice/latest/admin-guide/launching_instance.html2 - https://docs.aws.amazon.com/directoryservice/latest/admin-guide/join_windows_instance.htmlShare0Hi Metageek,I understand you have hundreds of machines spread across 12 regions and want to use the same domain in the 12 regions.You  further more want to know the best practice and architecture of AWS domain services.Please note Multi-Region replication can be used to automatically replicate your AWS Managed Microsoft AD directory data across multiple Regions.AWS Managed Microsoft AD is available in two editions, Standard and Entrerprise. Link [1].However Multi-Region replication is only supported for Enterprise Edition of AWS Managed Microsoft AD. Please be on the lookout for feature realize on this link [2] because this feature is unavailable in the following regions:•Africa (Cape Town) af-south-1•Asia Pacific (Hong Kong) ap-east-1•Europe (Milan) eu-south-1•Middle East (Bahrain) me-south-1I hope this helps.Reference[1] https://docs.aws.amazon.com/directoryservice/latest/admin-guide/what_is.html[2] https://aws.amazon.com/new/CommentShareKaraboanswered 8 months agometageek 8 months agoThanks for the general information on directory services.  As I've said, I've already deployed to 5 regions so I'm beyond the basics.Share-1https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_directory_sharing.htmlWhile you can increase the soft limit You can consider this - share a single directory with other trusted AWS accounts within the same organization or share the directory with other AWS accounts that are outside your organization. You can also share your directory when your AWS account is not currently a member of an organization.CommentSharepranjalianswered 8 months agoJoeD_AWS 8 months agoDirectory sharing is a Regional feature of AWS Managed Microsoft AD.  You can not use sharing in regions where the directory does not exist.Share"


Question: Can't upload files or create files in WorkDocs

"Since last week no users can upload any files or create files within WorkDocs in browser. As far as I can see we havent hit any limits on storage. Have tested with different users, using different browsers and still have the same issue. Have contacted support who have confirmed the issue isn't due to outstanding bill etc. Any ideas on what to look at next to fault find the issue?FollowComment"

Answer: "0Not answer but y entire team is unable to upload any files whether using the browser or the app. My last successful upload dates back to August 27, 2022. Clearly there is an issue. My case was supposed to be elevated but I have yet to hear any kind of update on the issue.CommentSharerePost-User-9572154answered 8 months ago0Thanks for sharing the issue you're running into. To better assist you, please file a support ticket so the team can investigate it further? ThanksCommentShareShrutianswered 8 months ago"


Question: Receiving EntityNotFoundException error intermittently

"Hello everyone,We have been receiving this EntityNotFoundException error intermittently for one of our lambda fuctions.We've found that the EntityNotFoundException error we've been getting is actually a result of the GLUE job not being processed properly, which is why it's failing. By looking at the logs, We can see that the GLUE job is having issue in creating new table after deleting the old one which is why the lambda function is not able to locate it. We need guidance on why the error is occuring as there have been no code changes from our side.Error Details:[ERROR] EntityNotFoundException: An error occurred (EntityNotFoundException) when calling the GetTable operation: Table tbl_site_crowdflower not found.Traceback (most recent call last):  File "/var/task/lambda_function.py", line 104, in lambda_handler    create_generic_db(data,bus_date,src_bucket_name)  File "/var/task/lambda_function.py", line 146, in create_generic_db    res = glue.get_table(DatabaseName=backup_databasename, Name=tbl_name)  File "/var/runtime/botocore/client.py", line 391, in _api_call    return self._make_api_call(operation_name, kwargs)  File "/var/runtime/botocore/client.py", line 719, in _make_api_call    raise error_class(parsed_response, operation_name)FollowCommentGonzalo Herreros 3 months agoAre you creating and deleting the same table? I wonder if it's a timing issue.Share"

Answer: "0Hello,Based on the error message:EntityNotFoundException: An error occurred (EntityNotFoundException) when calling the GetTable operation: Table tbl_site_crowdflower not found.Looking into the stack trace, the exception was triggerred by this lineres = glue.get_table(DatabaseName=backup_databasename, Name=tbl_name) , which is a Glue get_table API call via boto3.The exception indicates your boto3 client cannot find table "tbl_site_crowdflower". Such an issue can be caused by various reasons, please double check and make sure:The specific table exists under the database and the region.If your account has enabled Lake Formation permission control, check if the IAM role has sufficient Lake Formation permissions to list the database and the table.I hope this helps resolve the issue. Have a nice day!Ref:https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.htmlhttps://docs.aws.amazon.com/lake-formation/latest/dg/granting-catalog-permissions.htmlCommentShareEthan_Hanswered 2 months ago"


Question: How do I find the storage that I'm being billed for?

"I get a monthly bill for a few cents each month, and the amount is gradually growing. The bill says it is forAmazon Relational Database Service Backup Storage$0.100 per additional GB-month of backup storage exceeding free allocationI can't see where this storage is being used so that I can delete it - I've cleared out everything else on my account so there is no database to backup. There are no backup plans, jobs or vaults, no snapshots belonging to me in any of the RDS snapshot tabs, no reserved instances or automated backups.FollowComment"

Answer: "3HelloYou can get information from the AWS Cost explorer You can open AWS account and click the link of the Cost explorer it will redirect to the product page there you can filter and see the information of the prices.Backup Storage – Backup storage is the storage associated with your automated database backups and any customer-initiated database snapshots. Increasing your backup retention period or taking additional database snapshots increases the backup storage consumed by your database.You can check the RDS Snapshots if you have any from the link hereWhy does my additional backup storage cost more than allocated DB instance storage?The storage provisioned to your DB instance for your primary data is located within a single Availability Zone. When your database is backed up, the backup data (including transactions logs) is geo-redundantly replicated across multiple Availability Zones to provide even greater levels of data durability. The price for backup storage beyond your free allocation reflects this extra replication that occurs to maximize the durability of your critical backups.CommentShareGKanswered a year agoAWS-User-8921996 a year agoThe key piece of information I had overlooked was that the RDS management console only shows snapshots etc. in one selected zone - I was looking in the wrong one, and found my snapshots in the Europe (London) zone.It's a shame the RDS management console can't show global information, or at least somehow indicate which regions I am active in.ShareGK a year agoHi I am happy that you found the issue, Yes there is no global information of resources in RDS console instead of EC2 you can see everything. ThanksShare"


Question: Mediaconvert not adding some CEA-608 captions

"I'm using mediaconvert to embed CEA-608 captions into a .MP4 file. It mainly works - the output file contains most of the captions - but occasionally it drops a caption and doesn't embed it.Does anybody have any idea why, or how to troubleshoot this? All the captions are of under 32 character line lengths and so on.Thanks!FollowComment"


Question: Starter Game - Player Jack won't move?

"Hi guys,I just downloaded Lumberyard 1.13 Beta. And I open Starter Game and see that the animation of robot Jack isn't loaded, thus I can't make him walk, he just stand there like this:REMOVEDUPLOADI guess this because my laptop is not powerful, but here is my laptop spec:Processor: Intel(R) Core(TM) i5-4200H CPU @REDACTEDUSERMemory: 6144MB RAMCard name: NVIDIA GeForce GTX 950MDisplay Memory: 7042 MBDedicated Memory: 4026 MBShared Memory: 3016 MBMaybe the animation is just slow to load, but is there anyway I can check the loading the process and force load specific animation?Thanks.Edit: After a really long while, the animations work & Jack can move now. I guess it's because the Asset Processor did it work, but I wonder if this issue happen on users PC when I ship the game for the users?Follow"

Answer: "0Accepted AnswerHey @REDACTEDUSERSharerePost-User-5738838answered 5 years ago0I know, I noted that in the Question edit several days ago :) Thanks for your answer tho. Now everything works great after the Asset Processor has done its job.SharerePost-User-6460635answered 5 years ago0Noice! MB on that xD — thanks for sharing :)SharerePost-User-5738838answered 5 years ago"


Question: Iot Topic Rule - Cross Account Kinesis

"Hi there,I am trying to setup a cross account Iot topic rule, that will forward the messages to a Kinesis stream in a different account.Here is a snippet from my cfn:  IoTTopicRule10:    Type: AWS::IoT::TopicRule    Properties:      TopicRulePayload:        RuleDisabled: false        Sql: !Sub SELECT *  FROM '${ConnectorTopicName}'        Actions:          - Kinesis:              StreamName: arn:aws:kinesis:eu-west-1:targetaccountID:stream/input-machine-data-stream              RoleArn: !Sub '${IoTTopicRuleRole.Arn}'The role has cross account setup.However, this does not send the data to the target account, and I can not really figure out why.Do you have any suggestions how can I troubleshoot this? or what is causing the problem?CheersFollowComment"

Answer: "0Hi there! At present, AWS IoT Core Rules only supports cross-account actions for four services:SQSSNSS3LambdaYou could use AWS Lambda to write the message to Kinesis in the other account.CommentShareGavin_Aanswered 9 days ago"


Question: Easiest way to switch greengrass device region

"Hi,I am looking to switch regions on one of my greengrass core devices.  Is the easiest way just to delete the core device and install new in the new region?  then re-deploy the components?ThanksFollowComment"

Answer: "1The easiest way to change the Greengrass Core device region is to recreate the Greengrass Core in the new region using the Greengrass installer instructions and then redeploying the components.If there is no component state data that must be preserved, I would also suggest to remove the /greengrass/v2/ folder completely and reinstall.If data should be preserved, I would suggest to first remove all components from the current region, then run the installer for the new region (without removing the /greengrass/v2 folder) and finally redeploying the same components in the new region.CommentShareEXPERTMassimilianoAWSanswered a month ago-2If you want to switch your AWS Greengrass core device to a different region, you don't necessarily need to delete and re-create the device. Instead, you can simply update the configuration of the existing device to point to the new region.Here are the general steps you can follow to switch the region of your Greengrass core device:Stop the Greengrass daemon running on the core device.Update the configuration file for the core device to point to the new region. The configuration file is typically located at /greengrass/config/config.json. Edit the "aws.greengrass.core.region" key to reflect the new region you want to use.Restart the Greengrass daemon.Update the subscription configuration for any Lambda functions running on the core device to use the new region. This may require updating the ARN of the Lambda function to reflect the new region.Redeploy any components that depend on the region, as they may need to be updated to use the new region-specific endpoints.That being said, if you prefer to delete and re-create the Greengrass core device in the new region, you can do so as well. Just be aware that this will require you to re-provision and configure the new device from scratch, which may be more time-consuming than simply updating the configuration of the existing device.CommentSharehashanswered a month ago"


Question: An error occurred (InvalidBlockDeviceMapping) when calling the RunInstances operation: Invalid device name C:/Program Files/Git/dev/sda1

"I am trying to run a shellscript on my local which launches an ec2 instance .when I try to run the script this error comes up. An error occurred (InvalidBlockDeviceMapping) when calling the RunInstances operation: Invalid device name C:/Program Files/Git/dev/sda1,  what should be done. the blockdevicemapping is already mapped in the script. I have awscli installed in my device, access keys configured.FollowComment"

Answer: "4Ref: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.htmlthe device name is obviously invalid since C:/Program Files/Git/dev/sda1 it merges two os path into a single one (windows and Linux)Use the run-instances AWS CLI command with the --block-device-mappings option to specify a block device mapping for an instance at launch and check the block device mapping pathand update your script accordingly.CommentShareEXPERTsedat_salmananswered a month agoKiran 23 days agoHey thanks @sdtslmn for taking time for help, The output name shown here is the error message the terminal gives me, the device name that is mapped in the script is correct which meant to be /dev/sda1. I think there should be some other issue with my git configuration or something? Because the same script were successfully executed by my colleague .Share1Try prepending MSYS_NO_PATHCONV=1 to the beginning of your command-line. See Git for Windows: Known Issues.CommentShareennuianswered 12 days agoKiran 10 days agoHi @ennui Hope you are doing well. Thanks for taking time to help .This is actually a correct answer, but can you narrow down it to the exact answer what should be the permanent solution for this?  I tried editing the path in  script to --block-device-mappings "DeviceName=//dev\sda1 instead of --block-device-mappings "DeviceName=/dev/sda1 which originally was in the script and it worked for me. The solution you suggested is correct but I need to know what exactly I should do to avoid this error without modifying the path.Share"


Question: Command (message/data) enrichment from UI to Event Bridge after cognito authorization

"We are designing a asynchronous process. The flow of steps are,user login in using hosted cognito login form, ui receives the idTokenuser interacting with the form in UI - for ex: createUserui invokes REST api gateway endpoint, and sends the idToken from cognitoapi gw validates the request with cognito using the idTokenafter this step, we want to enrich the data and add userId and role from idToken to data. (We want to do this after the authorization step, not from ui)api gw integrates with event bridge and send the command data to event bridge.Need some suggestion on the step #4. How do we able to achieve this ?FollowComment"


Question: Team profile section not visible while applying for credits in AWS Activate

"Hi,I recently applied for aws activate portfolio credits and mistakenly used wrong email id. Now, after getting rejected and re-applying for the credits, I see the team profile step is missing which includes email id section. How do I change the email id to apply for aws activate portfolio credits with correct email id?FollowComment"

Answer: "0Hello there,I did some research and found the following article which may help you change your AWS account email: https://aws.amazon.com/premiumsupport/knowledge-center/change-email-address/.If you still require additional assistance, please contact the AWS Activate team via: https://aws.amazon.com/activate/contact-us/.Kind Regards,- Ash R.CommentShareEXPERTAWS Support - Ashanswered 5 months ago"


Question: Cognito Pre-Token Generation Lambda Cannot Accept List Overrides

"Looking at the docs for Cognito pre-token generation lambda hooks: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.htmlI see I can change the fields in the ID token. One field I need to update involves setting the value to an array: e.g. "permissions": ["read", "write", "execute"].This is what my Lambda looks likeexports.handler = (event, context, callback) => {    event.response = {        "claimsOverrideDetails": {            "claimsToAddOrOverride": {                "role": "user",                "permissions": ["read", "write", "execute"]            }        }    };    callback(null, event);};However, the hook fails. JWT allows for there to be array (and object) parameters. Any idea when this feature might be enabled?Thanks!FollowCommentJaccoPK a year agoThis is a very long standing bug (2018). I would not expect a solution very soon. I saw a workaround that you could work with: Just stringify the array.Share"

Answer: "2Is there any update or plan when this feature will be implemented?We really need this feature for an amplify application where we want to make use of the "groupClaim" attribute which we want to generate by ourselves in a pre token lambda function.I cannot really understand why there is this option (groupClaim in graphql auth) when you cannot create another array then cognitogroups with AWS cognito pre token generation lambda.CommentSharechansteranswered a year ago0This bug has been around for almost 5 years now, like JaccoPK said. Is there any update or plan when this feature will be implemented? It's becoming a very big problem with Amplify/Appsync apps and with how their resolvers handle custom claims.CommentSharelis10appanswered 3 months ago-1Hi,Currently only string type is supported for custom claims, you need to represent your list as a string. something like that..."permissions": "[read, write, execute]"CommentShareEXPERTMahmoud Matoukanswered a year agoAWS-User-7365078 a year agoHey Mahmoud,Thanks for the quick reply, is there any timeline when this will change? I'm using a service that needs it in this format; I'm unable to set these parameters as a string; it must be a list.If Cognito cannot accept list parameters (which is part of the JWT spec) then I cannot use Cognito and will have to use something else such as KeyCloak.ThanksThanks!Share"