Question: nat gateway network acl inbound outbound rule

"helloI'm trying to make a VPC with public and private subnets (NAT) and referring to this nacl rulehttps://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html#nacl-rules-scenario-2I was wondering why do we need ephemeral ports in inbound rules of a public and a private subnetAs I know of, ephemeral ports are used for the NAT gateway, which only uses outbound traffic?Also, I'm not sure of 32768-65535 ports used in outbound rulesAny help would be appreciatedThanks in advance!FollowComment"

Answer: "0Hello AWS Customer,Network ACLs are stateless, which means that responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa).[1]And stateless protocol is a communication protocol in which the receiver must not retain session state from previous requests. The sender transfers relevant session state to the receiver in such a way that every request can be understood in isolation, that is without reference to session state from previous requests retained by the receiver.[2]In further, in most TCP/IP client/server communications, the client uses a random ephemeral port number and sends a request to the appropriate reserved port number at the server’s IP address. The server sends its reply back to whatever port number it finds in the Source Port field of the request.Therefore, when using NAT gateway for TCP communication with the internet, Ephemeral Port (1024 ~ 65535) must be allowed in the ACL inbound rule applied to NAT gateway in order to receive response packets.Hope you will find this information useful. Please let me know if you have any further questions or concerns. I will be more than glad to assist you.I hope you are always healthy and have a nice day.CommentShareSUPPORT ENGINEERJisoo_Kanswered 4 months ago0NACLs are stateless so for any outbound requests you need to allow for inbound return traffic which will be on the ephemeral ports, so you need to open a wide range of inbound ports.  It's not just related to NAT Gateway.  For this reason NACLs are probably best left open except for specific use cases, and you should rely on least-privilege Security Groups instead which are stateful.If you do want to define ephemeral ports in your NACLs anyway, note that the client that initiates the request chooses the ephemeral port range. The range varies depending on the client's operating system. Many Linux kernels (including the Amazon Linux kernel) use ports 32768-61000. Requests originating from Elastic Load Balancing use ports 1024-65535. Windows operating systems through Windows Server 2003 use ports 1025-5000. Windows Server 2008 and later versions use ports 49152-65535. A NAT gateway uses ports 1024-65535. For example, if a request comes into a web server in your VPC from a Windows XP client on the Internet, your network ACL must have an outbound rule to enable traffic destined for ports 1025-5000.CommentShareEXPERTskinsmananswered 4 months ago0Network ACLs are stateless, which means that responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa).In this example for the public subnet w.r.t to ephemeral ports[Inbound] Allows inbound return traffic from hosts on the internet that are responding to requests originating in the subnet.[Outbound] Allows outbound responses to clients on the internet (for example, serving webpages to people visiting the web servers in the subnet)Now In the example for the private subnet w.r.t to ephemeral ports[Inbound] Allows inbound return traffic from the NAT device in the public subnet for requests originating in the private subnet.[Outbound] Allows *outbound responses to the public subnet *(for example, responses to web servers in the public subnet that are communicating with DB servers in the private subnet).Note : The range  is an example only. For information about choosing the correct ephemeral ports for your configuration, see Ephemeral ports.CommentShareEXPERTAWS-User-Nitinanswered 4 months ago0Hi Suin,100% agree with others here that NACLs are stateless so inbound and outbound rules need to account for return traffic that traverses your NAT Gateway.Depending on your use case, it is important to remember that NAT Gateway only supports NACLs (NOT Security Groups).  If you are planning to "open" your NACL to allow all traffic bi-directionally, be sure to address your Security Groups on your instances to only allow appropriate traffic.  Security needs to be top of mind for all of us!Hope this helps!CommentShareAWS-User-0357409answered 4 months ago"


Question: "Switching to Node16, CodeArtifact does not authenticate with npm 9"

"We have been using the following standard way to authenticate to CodeArtifact:aws codeartifact login --tool npm --repository MyRepository --domain MyDomain --domain-owner 123456789 --query authorizationToken --output text --duration-seconds 43200Works fine for :node v14.20.0 (npm v6.14.17)Successfully configured npm to use AWS CodeArtifact repository https://nems-123456789.d.codeartifact.eu-central-1.amazonaws.com/npm/MyRepository/Login expires in 12 hours at 2023-05-11 01:56:58+02:00Switching with nvm for:node v16.20.0 (npm v9.6.6)Gives the following error:Command '['npm', 'config', 'set', '//nems-123456789.d.codeartifact.eu-central-1.amazonaws.com/npm/*MyRepository/:always-auth', 'true']' returned non-zero exit status 1.Only after downgrading to npm v6.14.17 am i able to authenticate, does npm version 9 does not work with Codeartifact or am i missing something?EDIT(Note: was able to authenticate until version npm@8.19.4 )FollowComment"

Answer: "1Hi,You likely have an outdated version of the AWS CLI as this issue was fixed in https://github.com/aws/aws-cli/pull/7468. Update to at least AWS CLIv2 2.9.5 or CLIv1 1.27.23.CommentShareCarl Lewisanswered 20 days ago"


Question: Custom AMI with nvidia driver via packer.

"Hello,I have a curious problem that I can seem to make heads or tails of.  I am using packer to create a custom AMI that includes the nvidia driver.  I am using the base ubuntu 16.04 image on a g4dn.xlarge instance as the packer base and packer completes successfully.  It installs the nvidia driver using the NVIDIA-Linux-x86_64-440.33.01.run package.  Everything looks good, but when I provision a new ec2 instance from this ami, the nvidia driver is not loaded and I get "NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver. Make sure that the latest NVIDIA driver is installed and running." when running nvidia-smi.  I have tried adding extra steps to the packer project that follow the steps outlined here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/install-nvidia-driver.html#public-nvidia-driver, but the result is always the same.   What I am missing here?ThanksJeremyFollowComment"

Answer: "0I figured out the issue, I need to set the ephemeral storage devices that come with a g4dn in packer to no device:  "launch_block_device_mappings": \[      {        "device_name": "/dev/sda1",        "delete_on_termination": true,        "volume_size": "125",        "volume_type": "gp2"      },      {        "device_name": "/dev/sdb",        "no_device": true      },      {        "device_name": "/dev/sdc",        "no_device": true      }    ]CommentSharejeremyweberanswered 3 years ago"


Question: ElasticSearch Domain not responsive anymore

"Our ElasticSearch Domain unexpectedly stopped responding. Since we cannot look into the logs anymore we do not have the chance to find out the reason for that. We noticed that the ebs volume appeared to be at 3GB size, however we cannot verify if this indeed is the reason why the elasticsearch domain is not responsive anymore. We also do not see any possibility to find out why this happend (as mentioned above, logs are not accessible).We started an update of the ebs volume to double in size using the AWS webconsole, as we expected that new space might help. The update was marked as 'green' so we agreed on starting it. Even after 24 hours the update is stuck in the state 'Processing'. As described in the documentation, this means that the update of the ebs volume failed (https://aws.amazon.com/premiumsupport/knowledge-center/opensearch-domain-stuck-processing/).We have found a long list of reasons for why this update may have failed:CDI Failure: creation of new DI failedCustomer makes simultaneous configuration changes on the clusterFailed CDI due to overloaded mastr node or any other activity failures like insufficient IP addresses in the customer subnetNodes went out of service due to heavy processing load or internal hardware failurePrevious DDI Failure: New CDI executed before Previous DDI activities are completed.Large number of shards and continues node failure due to high JVM memory Pressure and CPU Usage.Nodes went out of service due to heavy processing load or internal hardware failureStuck shard relocation due to insufficient free storage in the new DI, custom shard routing and service/es issuesSingle domain can usually have 2 DIs at maximum. If CDI happens before previous DDI is completed, new CDI is queued but won't be executed.But this list does not help to solve the issue that our ElasticSearch Domain is currently in a state that we cannot change. The only action that we see is deleting the domain and start a new one. However we would like to ask if there is some action that AWS can do for bringing the domain back to life. We need the logs that are within the domain.FollowComment"

Answer: "0Hi,AWS support could definitely help you both to retrieve the logs, understand the root cause of your issue, and possibly fix the existing cluster.Your best next steps would be to open a Support case, in case you have not yet a Support subscription, consider to upgrade to Developer Support or Business support  depending on the urgency of your case.Without looking at the internal logs or having more detailed information on the situation it is not possible to provide ANY OTHER guidance, sorry.CommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Cannot setup CodeCommit because there is no Source Control setup

"I am deploying Django based static website on Elastic beanstalk, referering eb aws documentations.After eb init command i am getting this error"Cannot setup CodeCommit because there is no Source Control setup"FollowComment"

Answer: 0Did you check the EBS developer guide "Deploying from your CodeCommit repository"?https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/eb-cli-codecommit.html#eb-cli-codecommit-deployCommentShareIgviranswered a year ago0It helps to run eb init --interactive. Not sure why ;)CommentSharevirshuanswered 6 months ago


Question: Force my AWS Lambda function to use X memory

"I want to force my lambda function to alway use at least 6000 MB of memory when its invoked, for the whole timeout, until it has finished.I have a lambda function that i have given a memorySize of 9216 MB, and because i'm running a high computational task, it has to use most of this memory for it to be able to finish before the timeout i set (90 seconds), sometimes it uses around the amount of memory i assigned, which is around 5500 MB to 4500 MB and works ok, but randomly and consistently, my lambda will only use 1000 or 500 MB, even though i set the memorySize of my lambda to 9216 MB. So i want to force my lambda to use at least 6000 MB of memory every time its invoked, so i don't keep running into this error.Screeshot of error:https://i.stack.imgur.com/3LWhE.pngFollowComment"

Answer: "2Time taken for Lambda execution will have multiple factors like memory, cpu, network involved. The screenshot shared indicates that the operation you are performing is not memory intensive as it is consuming only small portion of total memory allocated.When a Lambda function is invoked, the function will be allocated with the maximum memory configured and equivalent vCPUs allocated i.e. every 1769MB of memory allocated will have 1vCPU allocated.You can increase the memory to maximum allowed value of 10240MB and test if it improves the performance with little more additional vCPU added. Also, suggest you to look at optimizing the function by identifying the code snippet taking time. If it has any network calls involved or extensive computations involved, it may be ideal to increase the timeout value.https://docs.aws.amazon.com/lambda/latest/dg/configuration-function-common.html?icmpid=docs_console_unmapped#configuration-memory-consoleYou can also, create functions with both x86_64 and ARM processors to compare the performance and choose the best one for your function.You can also opt-in for the Compute Optimizer recommendations (only supports x86_64 based functions at this time) -https://docs.aws.amazon.com/compute-optimizer/latest/ug/getting-started.html?icmpid=docs_lambda_help#account-opt-inhttps://docs.aws.amazon.com/compute-optimizer/latest/ug/requirements.html?icmpid=docs_lambda_help#requirements-lambda-functionsAlso, can profile the functions - https://docs.aws.amazon.com/lambda/latest/operatorguide/profile-functions.htmlCommentShareRajesh Sanswered a year ago0The Lambda services doesn't determine nor control the amount of memory that your function uses - that's up to the code that you write; the libraries you use and the runtime that you're running the code in.If you're having issues where the code is behaving inconsistently (and in this case timing out because there's something going wrong) I'd suggest debugging all of the things above to find out where the issue is. But Lambda itself will not "force" your code to use any resources that you give it; it's up to the code to do that.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: EMR Serverless IPV6 connectivity issue in private subnet VPC

"Hi,I have just been fiddling in EMR Serverless recently from this week after GA Release. I found that I am not able to download my AWS S3 jar files if I try to run EMR Serverless job from private VPC subnet. I have already tested the connectivity from EC2 using same subnet and same security group but the problem exist only in EMR Serverless Job. From the error logs I can see it is trying to connect to Spark IPV6 address which I am not sure why it is not connecting.Region: ap-northeast-1Subnet: ap-northeast-1a (I have tried other subnets too)Here are my tail logs:22/06/03 19:08:42 INFO SparkContext: Added JAR file:/tmp/spark-cdc6b2aa-657b-4464-b7d8-3cbe2fea3872/xbean-asm9-shaded-4.20.jar at spark://[2406:da14:5a:5a01:41a7:4134:a18b:f5f8]:42539/jars/xbean-asm9-shaded-4.20.jar with timestamp 165428332205822/06/03 19:08:42 INFO SparkContext: Added JAR file:/tmp/spark-cdc6b2aa-657b-4464-b7d8-3cbe2fea3872/xz-1.8.jar at spark://[2406:da14:5a:5a01:41a7:4134:a18b:f5f8]:42539/jars/xz-1.8.jar with timestamp 165428332205822/06/03 19:08:42 INFO SparkContext: Added JAR file:/tmp/spark-cdc6b2aa-657b-4464-b7d8-3cbe2fea3872/zookeeper-3.6.2.jar at spark://[2406:da14:5a:5a01:41a7:4134:a18b:f5f8]:42539/jars/zookeeper-3.6.2.jar with timestamp 165428332205822/06/03 19:08:42 INFO SparkContext: Added JAR file:/tmp/spark-cdc6b2aa-657b-4464-b7d8-3cbe2fea3872/zookeeper-jute-3.6.2.jar at spark://[2406:da14:5a:5a01:41a7:4134:a18b:f5f8]:42539/jars/zookeeper-jute-3.6.2.jar with timestamp 165428332205822/06/03 19:08:42 INFO SparkContext: Added JAR file:/tmp/spark-cdc6b2aa-657b-4464-b7d8-3cbe2fea3872/zstd-jni-1.5.0-4.jar at spark://[2406:da14:5a:5a01:41a7:4134:a18b:f5f8]:42539/jars/zstd-jni-1.5.0-4.jar with timestamp 165428332205822/06/03 19:08:42 INFO SparkContext: Added JAR s3://datalake-cbts-test/spark-jobs/app.jar at s3://datalake-cbts-test/spark-jobs/app.jar with timestamp 165428332205822/06/03 19:08:42 INFO Executor: Starting executor ID driver on host ip-10-0-148-61.ap-northeast-1.compute.internal22/06/03 19:08:42 INFO Executor: Fetching spark://[2406:da14:5a:5a01:41a7:4134:a18b:f5f8]:42539/jars/protobuf-java-2.5.0.jar with timestamp 165428332205822/06/03 19:08:43 ERROR Utils: Aborting taskjava.io.IOException: Failed to connect to /2406:da14:5a:5a01:41a7:4134:a18b:f5f8:42539at org.apache.spark.network.client.TransportClientFactory.createClient(TransportClientFactory.java:288)at org.apache.spark.network.client.TransportClientFactory.createClient(TransportClientFactory.java:218)at org.apache.spark.network.client.TransportClientFactory.createClient(TransportClientFactory.java:230)at org.apache.spark.rpc.netty.NettyRpcEnv.downloadClient(NettyRpcEnv.scala:399)at org.apache.spark.rpc.netty.NettyRpcEnv.$anonfun$openChannel$4(NettyRpcEnv.scala:367)at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)at org.apache.spark.util.Utils$.tryWithSafeFinallyAndFailureCallbacks(Utils.scala:1508)at org.apache.spark.rpc.netty.NettyRpcEnv.openChannel(NettyRpcEnv.scala:366)at org.apache.spark.util.Utils$.doFetchFile(Utils.scala:763)at org.apache.spark.util.Utils$.fetchFile(Utils.scala:550)at org.apache.spark.executor.Executor.$anonfun$updateDependencies$13(Executor.scala:962)at org.apache.spark.executor.Executor.$anonfun$updateDependencies$13$adapted(Executor.scala:954)at scala.collection.TraversableLike$WithFilter.$anonfun$foreach$1(TraversableLike.scala:985)at scala.collection.mutable.HashMap.$anonfun$foreach$1(HashMap.scala:149)at scala.collection.mutable.HashTable.foreachEntry(HashTable.scala:237)at scala.collection.mutable.HashTable.foreachEntry$(HashTable.scala:230)at scala.collection.mutable.HashMap.foreachEntry(HashMap.scala:44)at scala.collection.mutable.HashMap.foreach(HashMap.scala:149)at scala.collection.TraversableLike$WithFilter.foreach(TraversableLike.scala:984)at org.apache.spark.executor.Executor.org$apache$spark$executor$Executor$$updateDependencies(Executor.scala:954)at org.apache.spark.executor.Executor.<init>(Executor.scala:247)at org.apache.spark.scheduler.local.LocalEndpoint.<init>(LocalSchedulerBackend.scala:64)at org.apache.spark.scheduler.local.LocalSchedulerBackend.start(LocalSchedulerBackend.scala:132)at org.apache.spark.scheduler.TaskSchedulerImpl.start(TaskSchedulerImpl.scala:220)at org.apache.spark.SparkContext.<init>(SparkContext.scala:582)at org.apache.spark.SparkContext$.getOrCreate(SparkContext.scala:2694)at org.apache.spark.sql.SparkSession$Builder.$anonfun$getOrCreate$2(SparkSession.scala:949)at scala.Option.getOrElse(Option.scala:189)at org.apache.spark.sql.SparkSession$Builder.getOrCreate(SparkSession.scala:943)at np.com.ngopal.spark.SparkJob.getSession(SparkJob.java:74)at np.com.ngopal.spark.SparkJob.main(SparkJob.java:111)ThanksFollowComment"

Answer: "0Hi, @privatejavaHow do you provide a route from your private VPC subnet to your S3 bucket? (NAT gateway, VPC endpoint)If the EC2 that accessed the S3 bucket had a public IP address attached, you'll need to consider how EMR serverless ENI will access S3.If IPv6 is the cause, try not to use dual stack endpoints.https://docs.aws.amazon.com/AmazonS3/latest/userguide/dual-stack-endpoints.html#dual-stack-endpoints-descriptionCommentShareEXPERTiwasaanswered a year agoprivatejava a year agoI am able to connect S3  using NAT Gateway and I even did ping with ipv6 which works good .Right now  EMR Serverless uses IPV6 natively for linking associated library jar files that I provide during runtime so that is why I had to use ipv6 compatible VPC. I do not think there is any way to assign ENI for EMR Serverless because it is all managed internally.ThanksShare"


Question: t4g.nano cannot be initialized

"Hello,Is there a way to ask Amazon to optimize t4g.nano instances?The issue is that it's not possible to log in using an SSH key after instance initialization and the only solution is to reboot the instance and try again. Sometimes one reboot isn't enough.I suppose this happens due to the lack of memory (512MB) for ARM64 architecture (as memory page size is bigger for aarch64) and the instance should be initialized with SWAP (256-512MB) by default.FollowCommentMichael_F EXPERTa year agoDo you have the same problem when you use the Amazon Linux 2 AMI?Share"

Answer: "1Also, I'm thinking that the issue should be addressed to AMI developers. I'm using AMI with CentOS 8.4 for aarch64, so devs should preconfigure swap for such cases.In addition: https://www.mail-archive.com/centos-virt@centos.org/msg05892.htmlCommentShareAWS-User-3414678answered a year ago0Accepted AnswerSo, if use Amazon Linux 2 it works as expected. I had the issue with CentOS 8, but according to Minimum RAM requirements 768 MiB is a minimum value, so, it looks like expected. Meanwhile, I have no issues with CentOS 8 on t4g.nano in Hong Kong region, but it takes a bit of time.CommentShareAWS-User-3414678answered a year ago0Have you considered starting a session via SSM instead. Requires the EC2 instance is running the SSM agent and relevant policy attached to the EC2 instance role. SSM essentially provides one-click access to ec2 instances without the need to open inbound ports or manage SSH keys.Refer toStart a sessionCommentShareRoBanswered a year agoAWS-User-3414678 a year agoSSM is great but it's just a workaround because base functionality doesn't work.Share0To add to RoB's answer, you can also use Use EC2Rescue for Linux. refer to link {1}With the help of SSM, The AWSSupport-TroubleshootSSH runbook installs EC2Rescue for Linux and then uses the tool to check or attempt to fix common issues that prevent a remote connection to a Linux machine via SSH.  For more information, refer to link {2}Please refer to the below link to know more:{1} https://aws.amazon.com/blogs/mt/how-to-fix-ssh-issues-on-ec2-linux-instances-using-aws-systems-manager/?nc1=b_rp{2} https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-awssupport-troubleshootssh.htmlCommentShareSwwapnilanswered a year ago"


Question: Not able to make AWS ECS service accessible over public domain mapped to service discovery

"i have created an ECS service and during creation i have enabled service discovery, which in its turn create a namespace in cloudmap service, then cloudmap have created a hosted zone in Rout53 for the ecs service, then i have used that cloud map provided dns name as a CNAME to my domain sub.example.com which is located in different public hosted zone,I have tested the endpoint internally and it's working but while browsing the public domain, i get error DNS_PROBE_FINISHED_NXDOMAINso, any suggestions why this mapping did not work ?FollowComment"

Answer: "0Hello,Here are some questions/things to consider:Assuming your ECS cluster is in a private subnet behind an ALB, do you have a NAT Gateway configured in a public subnet with security groups allowing the default traffic to the NAT?Is you Route 53 zone setup correctly? As in are you using the appropriate Alias/CNAME records? Is your hosted zone in route 53 public?Are your security groups configured to allow the traffic or are there any firewalls or NACLs blocking traffic?Have you enabled FlowLogs and checked to see if you see the incoming traffic to your ECS cluster or not?If using an ALB, do you have logging enabled for that as well?CommentShareCloud_Ganswered 5 months agomma 5 months agoi don't use ALB as i wanted actually to use service discovery feature instead.the public hosted zone is the public domain name we already use for our platform, there i should create a subdomain mapped to the ecs service discovery record created in the private hosted zone,after enabling service discovery, cloud map service creates a private hosted zone with 4 record, i should acutally map the public sub-domain to the SRV record in the private hosted zone.ec2 security group and subnets NACL are open to most of traffic.i did not have enabled flow logs but i can access the service through the service discovery endpoint in local vpci don't use ALBShare"


Question: S3 Bucket's last modified time

Is there a way to get the Bucket's last modified time in go language?FollowComment

Answer: "0Yes, use AWS SDK for Go: https://aws.amazon.com/sdk-for-goAnd build with Go something equivalent to https://www.learnaws.org/2022/10/10/aws-s3-list-files-date/CommentShareDidier_AWSanswered a month agorePost-User-5661035 a month agoThanks for the reply. I do get the last modified date for objects inside the bucket, however I need the last modified time for bucket, I wanted to track what changes has occurred at particular time interval like policy update, file upload etc.  for bucket.Share0Oh, I seeHave a look at the example at end of https://docs.aws.amazon.com/cli/latest/reference/macie2/describe-buckets.htmlAre you looking for "lastUpdated" parameter then?CommentShareDidier_AWSanswered a month ago"


Question: Remote access to GameLift Fleet instance that uses SDK5 with SSM returns error

First I get the instance id of the fleet :aws gamelift --profile <my_profile> get-compute-access \--fleet-id <fleet_id> \--compute-name <instance_id>get the key info and session token :export AWS_ACCESS_KEY_ID=<AccessKeyId>export AWS_SECRET_ACCESS_KEY=<SecretAccessKey>export AWS_SESSION_TOKEN=<SessionToken>then try to connect with ssm :aws ssm start-session --target <instance_id> --profile <my_profile>Then I get this error :An error occurred (TargetNotConnected) when calling the StartSession operation: <instance_id> is not connected.FollowComment

Answer: "0It seems that the issue is related to the connectivity of the GameLift Fleet instance. Here are a few things that you can check:Make sure that the instance is in a running state and is able to communicate with the AWS SSM service. You can check the instance status in the GameLift console or by running the following command:aws gamelift --profile <my_profile> describe-instances --fleet-id <fleet_id> --instance-ids <instance_id>Verify that the instance has the AWS SSM agent installed and running. You can check the agent status by connecting to the instance using SSH and running the following command:sudo systemctl status amazon-ssm-agentIf the agent is not running, you can start it using the following command:sudo systemctl start amazon-ssm-agentCheck if the instance is configured to allow SSM sessions. You can verify this by checking the instance profile associated with the instance. Make sure that the instance profile has the required permissions to start an SSM session. You can check the instance profile by running the following command:aws gamelift --profile <my_profile> describe-instance-attributes --fleet-id <fleet_id> --attribute-names instanceAccessThe output should show the instance profile name and the SSM role ARN associated with the instance.If you still encounter issues, you may want to check the GameLift and SSM logs for any errors or warnings that could indicate the source of the problem.CommentSharehashanswered a month agorePost-User-7041330 a month agoThank you for your answer. How may I SSH into the instance to check the SSM agent ? It seems I cannot. When I try the old way (get-instance-access) I get this error :An error occurred (InvalidRequestException) when calling the GetInstanceAccess operation: This API does not support fleets using builds integrated with GameLift Server SDK 5 and above. Use the GetComputeAccess operation to access this fleet resource.The command describe-instance-attributes does not seem to exist, I can only find describe-fleet-attributesShare0It seems the problem was that this does not work :aws ssm start-session --profile <my_profile> --target <instance_id>but this does :aws ssm start-session --target <instance_id>CommentSharerePost-User-7041330answered a month ago"


Question: Does AWS AppFlow automatically trust AWS Private CA certs?

"Does AWS Infrastructure such as AppFlow automatically trust AWS Private CA certs?This  page seems to suggest that it does:The SAP instance must have a certificate installed for end-to-end TLS communication. You can use Amazon private CA for obtaining server certificates and installing them on the SAP system via transaction code STRUST. If you want to terminate the SSL at the load balancer, then you can skip this step and just forward the traffic to the target group on a port where SAP does not require a certificate for SSL communication.FollowComment"

Answer: "0AWS Private CA do not trust appflow automatically. you need to create Private certificate in AWS Private CA and then install the certifcate on the SAP system via transaction code STRUST.  AWS gives options to export only private Certificate from the console.https://docs.aws.amazon.com/acm/latest/userguide/export-private.htmlCommentShareAWS-User-7653869answered 6 months agowooly 6 months agoyes, I understand that the certificate needs to be installed. Once that process is complete, does the trust work?Share"


Question: SNS not sending message from S3 object creation

"Some time ago I created a topic and an S3 event notification. I then confirmed an HTTPS endpoint, and subscribed my email as well. This is all working fine.I recently added another event notification in S3, from the same bucket but with a different prefix and no suffix. When I save the new event notification I can see a test event notification is published and it's hitting the server endpoint and I am receiving the email. However I do not receive object creation events for this new event notification!Is it possible to have multiple event notifications for the same bucket but with different prefixes posting to the same topic? I would assume so?I have a fairly open Access Poilcy that should allow any AWS resource to publish to the topic and this would seem to be confirmed by the test event getting through. I have enabled CloudWatch logging but I am not seeing any entries appear in there after the object creation events.The only other differences between the origninal event notification and the new one is there is a space in the prefix and there is no suffix.What could the problem be?FollowComment"

Answer: "0Yes it is possible to have multiple event notifications for the same bucket with different prefixes posting to the same topic.Could you please confirm if you are using space " " in URL Encoded formatIf you use any of the following special characters in the value of the prefix or suffix, you must enter them in URL-encoded (percent-encoded) format:ASCII character ranges 00–1F hex (0–31 decimal) and 7F (127 decimal)Dollar ("$")Ampersand ("&")Plus sign ("+")Comma (",")Colon (":")Semicolon (";")Equals sign ("=")Question mark ("?")At sign ("@")Space (" ")For example, to define the value of a prefix as "test abc/", enter "test%20abc/" for its value.Edited by: aws-Anirudh on Dec 22, 2020 1:02 AMCommentShareaws-Anirudhanswered 2 years ago0I was not using %20 in the prefix instead of the space. So I changed it to use %20 and it still didn't work.So then I changed it to use + instead of space, and that worked.Thanks for the clue.It would be nice if the console did this automatically, or at least issue a warning that the user needs to encode the string in a required format.CommentSharejamesssssanswered 2 years ago"


Question: Need to get team member access to Polly.

We are a learning team within AWS and I need to obtain access to Polly for each of my team members that bills to a single payee. I need help learning how to do this.FollowComment

Answer: 0This is a good starting point: Tutorial: Creating and configuring an organization.CommentShareEXPERTkentradanswered 5 months ago


Question: "Fetch hardware details(Physical Ram, Number of Cores, Operating System) of a RDS(Postgresql, Aurora) instance"

"Fetch hardware details(Physical Ram, Number of Cores, Operating System) of an RDS(Postgresql, Aurora) instance. There are APIs to check the details of CPU usage, Memory usage, etc. But, the use case which I want to achieve is not the amount of resource consumed but the capacity of the instance where RDS is running. Is there any way to achieve this?FollowComment"

Answer: "0Accepted AnswerHi - Not sure what the use case is but you can try the following combination to get what you need.describe-db-instances - this will provide "DBInstanceClass"describe-instance-types - this will provide details on "DefaultVCpus", "MemoryInfo" which will be "SizeInMiB". You may have to remove "db." before making call e.g. aws ec2 describe-instance-types --instance-types r6i.12xlargeCommentShareEXPERTAWS-User-Nitinanswered 9 months agoTasleema Shaik 9 months agoHi - Yeah It surely worked, Thanks for the answer :), But the operating system still I'm not sure on which type of OS platform an rds instance is created. I have a use case to consider OS(like on which platform DB is installed). Can we consider it always getting created on the Linux platform? If yes, any idea if it's documented anywhere?Thanks in Advance!Share"


Question: DynamoDB Eventually Consistency Reads for new items

"I did try to search this in AWS documentation and answers, would like to confirm my interpretation of this.We know Amazon S3 offers Read after Write consistency for new objects, does Amazon DynamoDB Eventually Consistent Reads behave in the same way?https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.ReadConsistency.htmlAs per the documentation it seems like that specific condition is not called out and all Eventually Consistent Reads seem to behave the same way whether new Items or updates to existing Items.FollowComment"

Answer: "0Accepted AnswerThe documentation is correct, eventually consistent reads behave the same way for new items or updates to existing items. The beauty of Amazon DynamoDB is that you can chose to do a consistent read when it's needed.CommentShareEXPERTAdam_Wanswered 3 years agokiwichris a year ago"when it's needed" - except when its needed on a GSI :-)  As GSI's do not support consistent readsShare"


Question: create one cloudwatch alarm for multiple instances

"Hello everyone,Is there any method that can create one cloudwatch alarm for multiple on-prem servers?FollowComment"

Answer: "1Hi,there are 2 ways to understand your request, and I think the 2 answers you've already received are tied to the same way.1 way to understand it is "I want a single alarm to show a unified status for multiple servers simultaneously. That is, an alarm that will turn red if one of the servers goes red". This is what the 2 other answers already help you with: you can create a composite alarm or metric-math alarm to blend multiple signals into a single alarm.Another way to understand your request is "I want to write only once a single alarm definition that can monitor every server I send metrics for, and every server is monitored separately (a distinct action will be executed for every server that crosses the threshold, and I can see the status of each server separately)". At this time, you would need to implement custom logic to do that. When customers use EC2, they can rely on events to detect the addition of a server. Since you refer to on-prem servers, you cannot leverage the exact same approach: you'd need to either fire the lambda on a schedule to detect new metrics, or invoke the lambda yourself from your on-prem servers start/stop scripts.Last option would be to be able to write once a single alarm definition that shows a unified status for multiple servers simultaneously, merging both points above. This last one is much simpler than it seems: you could simply ingest a custom metric without your server name in the dimensions, so that all servers' observations data is aggregated by CloudWatch as a single metric, and alarm using advanced statistics (e.g. the max, average, percentile or trimmed mean of that metric).CommentShareJscanswered a year ago0Hi there,I understand that you would like to create a single Cloudwatch alarm for multiple on-premise servers. This can be achieved by installing the AWS CloudWatch agent on your on-premise servers which will the allow you to create a composite alarm. To install the CloudWatch agent, please see reference [1].Please note that if you have downloaded the AWS CloudWatch agent on one computer and created the agent configuration file you want, you can use that configuration file to install the agent on other on-premises servers. Please see reference [2] to create a CloudWatch agent.With Amazon CloudWatch composite alarms, you can now combine multiple alarms to reduce alarm noise and focus on critical operational issues. You can easily combine multiple alarms together into alarm hierarchies that only trigger once when multiple alarms fire at the same time.To create a composite CloudWatch Alarm, please see reference [3].References:[1] https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-on-EC2-Instance.html[2] https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-cloudwatch-agent-configuration-file-wizard.html[3] https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_Composite_Alarm.htmlI hope this helps.CommentShareAsenathianswered a year agorePost-User-7340636 a year agoHello @Asenathi,I very much appreciate your reply. But the thing is I want to set up same alarm to multiple servers.For example, let's say "mem_used_percent > 26" I want to set up this alarm for "x" servers.x is server count.Share0Hello rePost-User-7340636,Once the metrics are available in the CloudWatch service, graph them first.  You should then create a metric math expression based on the graphed metrics and set up an alarm over the expression. Hope this helps.CommentShareEXPERTShree_Canswered a year agorePost-User-7340636 a year agoHello Shree_CThank you for the answer, let me try itShare"


Question: How to set up step functions to split Dataframe and process in EC2

"Hi everyone,I'm a student doing research and part of that research requires me to download over 2 million files and analyse them, I have a python script that I can run and it does what I need it to do however, I would like to split the data frame into 256 chunks and run each chunk on a separate EC2 instance to download the files into an S3 bucket  and then as a file hits that bucket I would like a second python script to run analysing the file. I know this can be done a number of ways but I'm hoping someone can help steer me in the right direction, from what little i have had to do with AWS I'm thinking something like a steps function could help to achieve this?thanks in advanceTomFollowComment"

Answer: "0I would look into Lambda functions. You will have 2 buckets, one for the large files and one for the small files. One function will trigger from the first bucket, it will read the file and split it into multiple, smaller files, which it will save in the second bucket. The second function will be triggered from the second bucket and will run the analysis on the small files.This is assuming that the large files can be loaded into a function (size wise) and that it takes less than 15 minutes to split a large file and less than 15 minutes to analyze a small file.CommentShareEXPERTUrianswered a year ago"


Question: Conversion api issues

is the instance for the conversion api compatible with a t2 micro instance or does it need to be one of the m5 ones?FollowComment


Question: SES Complaints - how does a user complain?

"Let me preface this by saying that I run a very small service with less than 50 active customers.It is a GPS tracking service where the customer decides on the email alerts they will receive about their tracker(s).I've started receiving complaint emails for one of my customers, so I contacted them about it. They said that they did not intend to complain and that they value the emails they receive and must have accidentally done this on their phone somehow. However, I have received another 4 complaint emails over the last 24 hours. So how does the user actually complain, and how can this be done by accident?My emails always explain why they are receiving it, and also provide instructions/link on how to configure the alert emails they receive.FollowComment"

Answer: 0The complaint rate increases if the receiving e-mail client judges the e-mail as spam or treats it as junk mail.I think it would be a good idea for the client to set up the client's own settings so that it does not go into the junk mail.It is also a good idea to check SPF/DKIM settings and bounced mail on the SES side as well.CommentShareEXPERTRiku_Kobayashianswered a month ago


Question: Scrolling bug in Web console

When scrolling down (or up) in the list of test execution in the Device Farm web console the UI tends to scroll all the way down (or up) by itself very easily making it close to impossible to scroll to executions which are not at the top or very bottom of the list (which is most of them).We encountered this with various browsers. Is this a known problem? Are there any fixes in the pipeline or known workarounds?FollowComment

Answer: "0Thank you for reporting the problem.This is a known issue and we have this happening over chrome. Currently we do not have any workarounds for this since the trigger of the event is not completely reproducible.What browsers have you been getting this issue and is it been happening consistently?CommentShareAWS-User-9707822answered 5 years ago0In my case it happens in Chrome 67 under GNU/Linux when I scroll down. Firefox 61 works well.CommentSharemiguelangelanswered 5 years ago0Hi,We have a fix for this problem, and will release it soon.Thank youFloraCommentShareAWS-User-8954877answered 5 years ago0It would be great if you could provide filtering on the date column so that other results don't distract. Since any projects tends to have a huge set of runs, we mostly tend to look at runs for a specific date and doing that is a big pain right now.Edited by: abhicarousell on Aug 9, 2018 6:56 PMEdited by: abhicarousell on Aug 9, 2018 6:57 PMCommentShareabhicarousellanswered 5 years ago0Hi,We just released the fix for scrolling problem.Thanks for your feedback, we will create a feature request for your suggestion.ThanksLingyiCommentShareAWS-User-8954877answered 5 years ago"


Question: CodeStar forgot how to connect Cloud9 to CodeCommit and support stopped responding

"I created a project with CodeStar.  Cloud9 was integrated with CodeCommit.  My last commits were in March, 2022.  Tried to commit a file in July 2022 and Cloud9 has forgotten how to connect to the repository.  I opened a ticket and the first level of support "transferred the ticket to the CodeStar team", who have not done anything for three business days.I have posted a couple replies in the support ticket, does anyone know how to escalate a ticket?  Or at least to get it noticed, that it is waiting on AWS response and not on customer?FollowComment"

Answer: "0Hello,I apologize for the delay in our Support team getting back to you.I was able to check the case and the case has been replied with detailed investigation of the issue by the assigned support engineer.Please don't hesitate to reach out should you have any additional questions!Thank you for your patience!CommentShareAditya_Tanswered 10 months ago"


Question: RDS Mysql connection lost and Rebooting state

The current running RDS MySQL database connection was lost. I could not connect again and tried to reboot the database. It is now in rebooting state. I don't know what is going wrong. Everything was running normally.Need suggestions on what to do?FollowComment

Answer: "1Accepted AnswerHey Raj,The database could have gone under a schedule maintenance, I suggest to you to create a support case to have AWS investigate what may have happened.CommentSharefercunhaanswered 5 months ago"


Question: Errors while upgrading from CEDR to DRS in Linux AMI 2.0

Getting below mentioned Warning Messages while trying to upgrade from CEDR to DRS in Linux System installed with AMI 2.0.python3 cloudendure_to_drs_upgrade_tool.py start-upgrade --api-token <API Token> --project-id <ProjectID> —aws-access-key-id <AccessKey> —aws-secret-access-key <SecretKey> --import-blueprint --import-replication-configuration --import-test-snapshotRunning the CloudEndure to DRS Upgrade tool.Connecting to the CloudEndure Console... Finished.Warnings:- Unable to detect if the Machine's operating system is supported by DRS.Refer to DRS documentation for the list of supported operating systems (UnableToDetermineOperatingSystemSupport)- Unencrypted volumes are not supported in DRS.It is recommended to set an explicit encryption key in your Replication settings prior to performing the upgrade.Machines with no volume encryption configured will be converted to use the default EBS encryption key in DRS. (UnencryptedVolumesUnsupported)There are warnings for this machine. Would you like to continue? [Y/n]:nAs per below mentioned AWS Doc AL 2.0 is supported by DRS:https://docs.aws.amazon.com/drs/latest/userguide/Supported-Operating-Systems.htmlMoreover I have set Default key for EBS Volume Encryption in both CEDR and DRS Service.What should I do fix these warning signs besides the steps which I have taken?FollowComment


Question: What is the difference between iam-aws-authenticator and aws eks get-token?

These two command both generate tokens to login to EKSAWS_PROFILE=MYPROFILE aws eks get-token --cluster-name myclustername | jq -r '.status.token'AWS_PROFILE=MYPROFILE aws-iam-authenticator -i myclustername token --token-onlyI can use the aws eks get-token with kubectl no problem but I can't use that token to login to kubernetes-dashboard.But I can use the aws-iam-authenticator token to login to kubernetes-dashboard.I thought both tokens just identify me as arn:aws:iam::111111111:user/username  but there must be some difference.So what are the differences? or how I can troubleshoot this? Is there any command can show what the token authenticates to?FollowComment

Answer: "0Never mind, I didn't realize that I spelled the name of the cluster wrong in the  aws eks get-token --cluster-name xxxxx.The tokens generated by both commands are valid credentials to login to kubernetes-dashboard and kubectlThe command will not complaint if you provide a non-existing cluster name.CommentSharerubelaguanswered 3 years ago"


Question: EC2 instance fails to fully start - fails Instance Status Check

"Hi,I have an EC2 instance which seems to have crashed recently.  When trying to restart, it fails the Instance Status Health Check and we cannot connect to correct the issue.  A new public IP address has been assigned but there's nothing changed in the firewall rules.  We've also followed the troubleshooting guide and downloaded the system log, but nothing unusual there.Any help would be appreciated.FollowComment"

Answer: "0Unfortunately, there's not really enough information to go on here. Please create a support case because our support team can help you troubleshoot this issue.Note that we have documentation to help:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/ec2-windows-system-status-check-fail/CommentShareEXPERTBrettski-AWSanswered a year agosolarbee a year agoLooking further into the system log, it shows the original IP address even though this changed after reboot - we had not set an elastic IP(Instance ID is i-0047e658913bb7c02) .Creating a clone (i-0123f19b737b00af2) from the original does not help as it inherits the same IP address problem.I assume this is set in the /etc/hosts file but we have no way of changing unless we can get the instance started.Is there any other way we can wipe this?  Perhaps create a new root volume and attach that to this system?ShareBrettski-AWS EXPERTa year agoWhat you can do is create a new instance; mount the existing volume to that instance; edit the /etc/hosts file; then relaunch the (original) instance.Share"


Question: What is the best ETL tool for ongoing loads of data into Redshift?

"What would be the best AWS ETL tool that a customer would use to set up ongoing loads of data into Redshift, that would provide some sort of transform functionality, similar to Microsoft SSIS? E.g. “load data from this file into this table daily as a full replace, compute these columns, etc.”FollowComment"

Answer: "0Accepted AnswerDepending on the customer's anticipated timeframe, this is precisely what Glue (https://aws.amazon.com/glue/ ) is intended to be really good at.Alternatively, if your customer can persuade their data source to stream its content (what is their data source, btw?), Kinesis with its capability to trigger Lambda functions for the "TL" piece, may be a good fit - see eg https://aws.amazon.com/blogs/big-data/tag/aws-lambda/ .CommentShareEXPERTDave_Wanswered 6 years ago0Is it possible to run an advanced SQL query on the Glue job? I have at least 15 tables in my SQL and the query is quite advanced itself. Doesn't Glue work only with a small number of tables like e.g. 1-3 with simple conditions? Is there an option to run my own query on it, without building the query by using boxes in Job?CommentSharerePost-User-0993831answered a year ago"


Question: IPhone-Video got rotated 90 degrees

"Hello,we are using MediaConvert to convert videos into a streamable HLS format and it works great. Today we had a video which was rotated by 90 degrees in the conversion. Our input selector for the video has "No rotation" selected (confirmed by looking at the job) and the metadata of the video does not seem to have any rotation metadata which could indicate why it was rotated.Here is the metadata{"streams": [{"index": 0,"codec_name": "aac","codec_long_name": "AAC (Advanced Audio Coding)","profile": "LC","codec_type": "audio","codec_tag_string": "mp4a","codec_tag": "0x6134706d","sample_fmt": "fltp","sample_rate": "44100","channels": 1,"channel_layout": "mono","bits_per_sample": 0,"r_frame_rate": "0/0","avg_frame_rate": "0/0","time_base": "1/44100","start_pts": 0,"start_time": "0.000000","duration_ts": 17687408,"duration": "401.075011","bit_rate": "63153","nb_frames": "17274","disposition": {"default": 1,"dub": 0,"original": 0,"comment": 0,"lyrics": 0,"karaoke": 0,"forced": 0,"hearing_impaired": 0,"visual_impaired": 0,"clean_effects": 0,"attached_pic": 0,"timed_thumbnails": 0,"captions": 0,"descriptions": 0,"metadata": 0,"dependent": 0,"still_image": 0},"tags": {"creation_time": "2021-05-03T18:45:16.000000Z","language": "und","handler_name": "Core Media Audio","vendor_id": "[0][0][0][0]"}},{"index": 1,"codec_name": "h264","codec_long_name": "H.264 / AVC / MPEG-4 AVC / MPEG-4 part 10","profile": "High","codec_type": "video","codec_tag_string": "avc1","codec_tag": "0x31637661","width": 1920,"height": 1080,"coded_width": 1920,"coded_height": 1080,"closed_captions": 0,"has_b_frames": 1,"sample_aspect_ratio": "1:1","display_aspect_ratio": "16:9","pix_fmt": "yuv420p","level": 42,"color_range": "tv","color_space": "bt709","color_transfer": "bt709","color_primaries": "bt709","chroma_location": "left","refs": 1,"is_avc": "true","nal_length_size": "4","r_frame_rate": "60000/1001","avg_frame_rate": "14430000/240647","time_base": "1/600","start_pts": 0,"start_time": "0.000000","duration_ts": 240647,"duration": "401.078333","bit_rate": "15763017","bits_per_raw_sample": "8","nb_frames": "24050","disposition": {"default": 1,"dub": 0,"original": 0,"comment": 0,"lyrics": 0,"karaoke": 0,"forced": 0,"hearing_impaired": 0,"visual_impaired": 0,"clean_effects": 0,"attached_pic": 0,"timed_thumbnails": 0,"captions": 0,"descriptions": 0,"metadata": 0,"dependent": 0,"still_image": 0},"tags": {"creation_time": "2021-05-03T18:45:16.000000Z","language": "und","handler_name": "Core Media Video","vendor_id": "[0][0][0][0]","encoder": "H.264"}}]}Can you think of any reason why this happened?Edited by: puelo on May 6, 2021 6:43 AMFollowComment"

Answer: "0Hello,MediaConvert will not rotate the video if Rotation is not defined. Are you seeing Rotate = Degree 0 in the JSON file?    },      "VideoSelector": {        "ColorSpace": "FOLLOW",        "Rotate": "DEGREE_0",        "AlphaBehavior": "DISCARD"      },  What would happen if you run the job again when setting Rotation to "No rotation" and "Auto"? Will both output got rotated?-SamCommentSharesamuelAWSanswered 2 years ago0Hello,we don't define any rotation in our job and to my understanding this will default to "No Rotation", right?Best Regards,pueloCommentSharepueloanswered 2 years ago0Hi Puelo,By default the rotation is disabled, you should see "No Rotation" in the JSON. If you could DM me your account ID, region and job id, I can confirm your setting submitted.-SamCommentSharesamuelAWSanswered 2 years ago0Hello,the JSON does not specify any rotation, but i can see "No Rotation" in the UI display of the details.Anyways, i've sent you the requested information.Thanks!CommentSharepueloanswered 2 years ago0Hi,Thanks, I confirmed that the job has no Rotation set. And in our MediaConvert log, it shows that the resolution is 1080 x 1920. However, the metadata provided shows the resolution is 1920 x 1080. How did you get the source metadata? Can you use mediainfo [1] to confirm the metadata?When you said video go rotated, was the JPEG and the HLS segment got rotated or only the JPEG was rotated?I did a quick test here by capturing a vertical video with iPhone and parse the capture with mediainfo.The result shows that that the resolution is 1920x1080 with a 90° rotation tag.Width                                    : 1 920 pixels  Height                                   : 1 080 pixels  Display aspect ratio                     : 16:9  Rotation                                 : 90°  When I ingested this source into MediaConvert, the log shows the resolution is 1920 x 1080. I cannot reproduce the 1080 x 1920 resolution in the log. I suspect that there might be something wrong with the metadata. Can you raise a support along with the source in order to further troubleshoot on this issue?[1] https://mediaarea.net/en/MediaInfoEdited by: samuelAWS on May 11, 2021 7:49 PMCommentSharesamuelAWSanswered 2 years ago0Video sent by the customer was not the original input file and contained different metadata. The video uploaded indeed had a rotation defined in the metadataCommentSharepueloanswered 2 years ago"


Question: Databrew Data Quality Queries

"Planning to use databrew for data validation.I not going to clean the data using Recipe, but just profile and write rule sets and then create a profile job to run on any new datsets.Could you please help me with the below:can databrew work on streaming data?can databrew profile job be run concurrently (at same time)  on 2 split files(both have same structure)These are key to determine whether I can use databrew or not. Please advise.Thank you!!FollowComment"

Answer: "0Hi,Data brew does not support streaming data as of today.You can run a profile job manually for each dataset, not at the same time.CommentShareCHELSEA IPanswered 10 months agoEXPERTJulia Beckreviewed 10 months ago"


Question: NodeJS Beanstalk EC2 HTTPS Load Balancing

Hello!I setup a Nodejs Beanstalk instance and created a NLB for balancing.My whole flow is Client -> Global Accelerator -> NLB -> EC2 -> Out.I pointed my subdomain for my API to the global accelerator DNS Name and was able to access it via https and http however I could not get SSL working.Is this because NLB cant have a SSL cert (I may be wrong on this)?What is the solution to this. Also would it be better todo Client -> Global Accelerator -> NLB -> ALB -> EC2 -> Out.I saw some documentation stating that I need to have a ALB infront of my NLB to have SSL Https.FollowComment


Question: Account Factory for Terraform without Control Tower

"We have an existing multi-account  environment with the majority of AWS services, so do not need to use Landing Zone Accelerator (LZA) or AWS Control Tower.  We use Terraform to build resources within the account and would like to use the Account Factory for Terraform [1] and [2] to build an account within the management account and integrate with AWS Organizations.Can you tell me if it is possible to use AFT in an environment that does not have AWS Control Tower?[1] https://registry.terraform.io/modules/aws-ia/control_tower_account_factory/aws/latest[2] https://aws.amazon.com/blogs/aws/new-aws-control-tower-account-factory-for-terraform/ThanksFollowComment"

Answer: "0I believe Control Tower is required to set up AFT and the linkage to AWS Organizations. Step 1 in the AFT setup instructions, https://registry.terraform.io/modules/aws-ia/control_tower_account_factory/aws/latest, is Control Tower setup.CommentShareAWS-Everettanswered 7 months ago"


Question: AWS CloudWatch logs

"Hello,I am having a cloudwatch logs issue.it is concerning FSX Gateway logs"type": "InvalidFileState","operation": "FSxUploadFileContent"Can someone explain this to me ?As the file was uploaded succesfully, and we can open it normally. So why do we get this log ?FollowComment"

Answer: "0Hi,this doesn't sound like a CloudWatch question, rather an FSX gateway question.There's an explanation of this error message along with a description of potential harmful consequences and explanation of how to solve this in the FSX Gateway documentation.Please make sure you read this paragraph in the documentation, hopefully it will help you fix the file state to prevent any future errors.CommentShareJscanswered 7 months ago"


Question: GuardDuty False Positive Rates

"Hello All,Does anyone experience False Positives with GuardDuty?  If yes, what do you do to tune or update false positive findings?  What options do customers have?Recently, i've notice a lot of false positives with C&C findings in that they are simply triggered by a an DNS lookup (dig or nslookup) it seems and domain reputations in the threat lists that Guard Duty is using are not up to date.FollowComment"

Answer: "0I encountered a Guard Duty false positive before, but it was regarding an IP address that I use. I followed this document to add it as a trusted IP: https://aws.amazon.com/premiumsupport/knowledge-center/guardduty-trusted-ip-list/You can also try Suppression rules to filter false-positive findings:https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule.htmlCommentSharejoahnaanswered a year ago"


Question: How to run Cloud Formation Init commands in PowerShell and not cmd?

"In Coudformation templates, there is a section to specfiy commands like below. Under fullServer I am running the command install. However, when I look at the logs after cfn has run on the server, it shows2022-10-20 13:41:25,780 [INFO] Command install succeeded2022-10-20 13:41:25,796 [DEBUG] Command install output: $MAGICThis is because the $Magic is how to declare and use variables in powershell where as cmd needs the set keyword. I would expect the output of this command to be Command install output: I am from the full server env."AWS::CloudFormation::Init": {                "configSets": {                    "downloadS3Data": ["downloadS3"],                    "Full": [{"ConfigSet": "downloadS3Data"}, "fullServer"],                    "default": [ {"ConfigSet": "Full"}],                    "App": [{"ConfigSet": "downloadS3Data"}, "appServer"],                    "Interface": [{"ConfigSet": "downloadS3Data"}, "interfaceServer"],                    "Notification": [{"ConfigSet": "downloadS3Data"}, "notificationServer"]                },                "downloadS3": {                    "files": {                        "C:\\ccw_downloads\\test.txt": {                            "source": "https://ccw-to-rds-poc-1.s3.us-east-2.amazonaws.com/test.txt",                            "authentication": "S3AccessCreds"                        }                    }                },                "fullServer": {                    "commands": {                        "install": {                            "command": "echo $MAGIC",                            "env": {"MAGIC": "I am from the full server env"},                            "cwd": "C:\\ccw_downloads",                            "waitAfterCompletion": 120                        }                    }                }             }I would like to run the command with PowerShell and not cmd. Is there a way to specify that like I can with User Data?I know that I could append PowerShell -Command to the beginning, making cmd call PowerShell and pass args. However, that would not allow me to use the enviornment variable MAGIC. For example "command": "Powershell -Command 'echo $magic'"FollowComment"

Answer: 1The way that cfn-init works it will launch a cmd shell and then launch a powershell shell. I would recommend looking at AWS Systems Manager and using the integration between those two services that are available today. AWS Systems Manager gives you the ability to go directly into PowerShell.https://aws.amazon.com/blogs/mt/using-state-manager-over-cfn-init-in-cloudformation-and-its-benefits/https://www.youtube.com/watch?t=73&v=ckrwyijiJ7U&feature=youtu.behttps://aws.amazon.com/blogs/infrastructure-and-automation/using-aws-systems-manager-automation-and-aws-cloudformation-together/CommentShareaaron_lanswered 7 months ago


Question: Are there on instances on aws which do no charge for storage ?

Are there on instances on aws which do no charge for storage as in on a budget unfortunately.FollowComment

Answer: "1First of all you have the free tier.Free tierIt means that you can get some limited AWS resources for free. For example for EBS storage you get 30GB for free for a year.Some instance types contain internal storage called Ephemeral storage that is included in the price of the instance, be aware though that ephemeral storage is lost when the instance is stopped.It is best used for high performance caching or ephemeral resources where you can loose the storage.If the free tier is not enough there are lots of AWS resources that have a low price.Also remember that at AWS you pay for what you use. So depending on your use case the price can be quite low.Make sure to define budget alerts, so you are notified if you go beyond your budget.CommentShareYair Carelanswered 4 months agorePost-User-2921856 4 months agoIs that 30gb EBS storage per server?ShareYair Carel 4 months agoIt is 30GB of total usage in the account.The pricing details for EBS are in the following linkhttps://aws.amazon.com/ebs/pricing/Share"


Question: S3 Gateway Endpoint bandwidth limitations?

VPC Interface endpoints have a limitation of 10Gbps per AZ (https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#vpce-interface-limitations).Does the Gateway endpoints have any such bandwidth limitations?FollowComment

Answer: "0Accepted AnswerNo, S3 Gateway endpoints don't have any such limitations, other than those applicable to EC2 instances.CommentShareEXPERTmhjworkanswered 4 years ago"


Question: Layers with ES in node18.x

"Is it the case that we can't use layers with ES in node18.x?I am getting the following error upon trying to convert to ES in node18.x when my lambda tries to use layer code:Runtime.UserCodeSyntaxError: SyntaxError: The requested module '/opt/nodejs/index.js' does not provide an export named 'MyLayerCode'"I found this response to a question about 14.x and 16.xACCEPTED ANSWERUnfortunately AWS support has confirmed we can't utilize layers with ES:importing ESM modules from layers seems to not be supported when using a module type in Lambda. [...] this is a Node feature blocking us to import ES modules from a layer as "NODE_PATH" variable is not supported by the ESM loader in nodeDisappointing that AWS is making headway on supporting ES, but it means we lose the functionality of layers. Support provided a wrapper workaround that we'll be trying. It corresponds with what we found here. Hopefully this saves someone else the headache we've gone through the last week.FollowComment"

Answer: "0Hi, just for clarity I m putting a reference of the solution here: https://repost.aws/questions/QUkqtaCZBNTguN6qr5Oj2hpg/node-js-module-not-found-using-es-import-with-lambda-layersCommentShareEXPERTalatechanswered 3 months ago0Hi,I would recommend you to raise a GitHub issue with the AWS NodeJS team. They would be able to provide assistance over the error that you are receiving.Have a great day ahead!CommentShareSUPPORT ENGINEERrePost-User-8220277answered 3 months ago"


Question: Cannot load my FPGA Image

"Hello,I developed an FPGA accelerator for f1-instances. Several years ago I made it. I set it as public. Now, I want to use it again, but cannot load it. Here are some details.In short, it is my image, set also as public. It matches with the shell on the aws-instance. However, I cannot load it. The details are below.Can you please help me resolve the issue and load the image?Kind Regards,FurkanThese are the details of my image, with afi-0da97a1d59bf1e558 and agfi-05bfb2806dd7970d2. I am the owner with correct Owner ID. Besides, it is set as public.[centos@ip-172-31-92-65 xdma]$ aws ec2 describe-fpga-images --fpga-image-ids afi-0da97a1d59bf1e558{    "FpgaImages": [        {            "UpdateTime": "2019-12-06T13:58:03.000Z",             "Name": "he_v1_5_afi",             "Tags": [],             "PciId": {                "SubsystemVendorId": "0xfedd",                 "VendorId": "0x1d0f",                 "DeviceId": "0xf000",                 "SubsystemId": "0x1d51"            },             "DataRetentionSupport": false,             "FpgaImageGlobalId": "agfi-05bfb2806dd7970d2",             "State": {                "Code": "available"            },             "ShellVersion": "0x04261818",             "OwnerId": "210929643974",             "FpgaImageId": "afi-0da97a1d59bf1e558",             "Public": true,             "Description": "he_v1_5_description"        }    ]}Here is the slot information. You can see that shell version 0x04261818 matches with the accelerator information above[centos@ip-172-31-92-65 xdma]$ sudo fpga-describe-local-image -S 0 -HType  FpgaImageSlot  FpgaImageId             StatusName    StatusCode   ErrorName    ErrorCode   ShVersionAFI          0       none                    cleared           1        ok               0       0x04261818Type  FpgaImageSlot  VendorId    DeviceId    DBDFAFIDEVICE    0       0x1d0f      0x1042      0000:00:1d.0Now, if I try to load it, I receive error[centos@ip-172-31-92-65 xdma]$ sudo fpga-load-local-image -S 0 -I agfi-05bfb2806dd7970d2Error: (5) invalid-afi-idThe agfi id passed is invalid or you do not have permission to loadthe AFI.FollowCommentawschakra 10 months agoHello,Thank you for reaching out to AWS. Could you please confirm if you are loading the AFI in the same region where it was originally created?If you are running instance in a different region, then the AFI needs to be copied into that region. Please see instructions in the link below:https://github.com/aws/aws-fpga/blob/master/hdk/docs/copy_fpga_image.mdPlease let us know if you see any issues or have questions.Thanks!ChakraSharefurkanturan 10 months agoHello Chakra,Thanks a lot for your answer. It was indeed the problem I was facing. With your comment, I found my mistake. Now everything works well.Kind Regards,FurkanShare"

Answer: "0Hello, thank you for confirming that copying AFI into desired region solved your problem. We shall mark this post as "Answered". Please feel free to reach us if you have any further questions. Thank you!-ChakraCommentShareawschakraanswered 10 months ago"


Question: AWS Aurora issues with MySQL.Data connector for .NET clients

With our upgrade of Aurora from 2.10.2 to 2.11 we've experienced connection timeouts to one of our DBs in our aurora clusters that couldn't be explained by load or number of connections.  We've investigated and found that the MySQL.Data library for .Net as provided by Oracle appears to have issues with this latest version of Aurora which can cause the server to block new connections.  We have reproduced this using the latest version of MySQL.Data 8.0.31 (as well as past versions of this package) and issuing parallel connections.  The server ceases to accept new connections after two parallel connections are made.  In error logs we see "Bad handshake" and "Got an error reading communication packets" errors and the user shows as "unauthenticated".   When pointing at a cluster using 2.10.2 we cannot replicate any issues and the MySQL.Data library works as expected.Are there any advisory's on this?FollowComment

Answer: "0Hello,The 'Got an error reading communication packets' is a generic warning message and could appear due to a variety of reasons including improper termination of a client connection, sleeping connections exceeding the 'wait_timeout' or the 'interactive_timeout' values and consequently being forcibly closed by the Aurora MySQL server, the client exceeding the 'max_allowed_packet' value for queries etc.Some of the common reasons for such error messages are as follows:It takes more than connect_timeout seconds to obtain a connect packet.The client had been sleeping more than wait_timeout or interactive_timeout seconds without issuing any requests to the server. I can see that you have increased the time out values for these parameters.The max_allowed_packet variable value is too small or queries require more memory than you have allocated for mysqld.The client program did not call mysql_close() before exiting.The client program ended abruptly in the middle of a data transfer.A connection packet does not contain the right information.These are some checks that could be made:show full processlist;SHOW GLOBAL STATUS like '%aborted%';select * from innodb_locks;select * from innodb_trx;select * from innodb_lock_waits;Show engine InnoDB StatusThis will give you some extra information in order to dive into this issue since the information about the status of the connections is internal and due to security reasons we do not have access to this data.Here are some possible remediation methods that might help you resolve/reduce the occurrence of these errors :Close the connection properly on the application side rather than waiting for it to timeout. We strongly recommend changing the application logic to properly close connections at the end of an operation, this can be done by calling the close() function from within your application.Set 'wait_timeout' to a higher value (max. value possible) [+] https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_wait_timeoutSet max_allowed_packet to a higher value [+] https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_max_allowed_packetIf you are using an application to connect, make sure the timeout value on the application end is not shorter than the 'wait_timeout' otherwise connections will be aborted abruptly from the application end thus causing this error.You may also refer to the following links for more information:•How do I resolve the "Got an error reading communication packets" error in Amazon RDS MySQL? : https://aws.amazon.com/premiumsupport/knowledge-center/rds-mysql-communication-packet-error/•https://www.percona.com/blog/2016/05/16/mysql-got-an-error-reading-communication-packet-errors/•https://www.percona.com/blog/2008/08/23/how-to-track-down-the-source-of-aborted_connects/•https://aws.amazon.com/blogs/database/best-practices-for-configuring-parameters-for-amazon-rds-for-mysql-part-3-parameters-related-to-security-operational-manageability-and-connectivity-timeout/•       Aurora MySQL database engine updates 2022-10-25 (version 2.11.0) : https://docs.aws.amazon.com/AmazonRDS/latest/AuroraMySQLReleaseNotes/AuroraMySQL.Updates.2110.html•       MySQL bugs fixed by Aurora MySQL database engine updates : https://docs.aws.amazon.com/AmazonRDS/latest/AuroraMySQLReleaseNotes/AuroraMySQL.Updates.MySQLBugs.htmlI hope the above information helps!Thank you and wishing you a great day ahead!CommentShareVedanshi_Aanswered 5 months ago"


Question: How to choose which Spark kernel to use in SageMaker Studio?

"Available Amazon SageMaker Kernels include the following two Spark kernels:PySpark (SparkMagic) with Python 3.7Spark (SparkMagic) with Python 3.7Spark Analytics 1.0Spark Analytics 2.0And at re:Invent 2022 there was an announcement that "SageMaker Studio now supports Glue Interactive Sessions." "The built-in Glue PySpark or Glue Spark kernel for your Studio notebook to initialize interactive, serverless Spark sessions."It seems like the benefits of using one of the Glue Spark kernels are that you can "quickly browse the Glue data catalog, run large queries, and interactively analyze and prepare data using Spark, right in your Studio notebook." But can't you already do all that with the existing two SageMaker kernels?In other words, how do you choose whether to use one of the existing two SparkMagic kernels in SageMaker Studio notebooks or to use this new Glue Interactive Sessions feature?FollowCommentyann_stoneman 3 months agoI just looked up SparkMagic and looks like it's "a set of tools for interactively working with remote Spark clusters in Jupyter notebooks" -- meaning it's for executing Spark on EMR from SageMaker? And this announcement now makes it possible to do the same, but with Glue?Share"

Answer: "0The difference is that with SparkMagic you would need to provide a Spark cluster and link to it using SparkMagic configuration.With Glue Interactive Sessions all that time consuming work is taken case for you, you can easily create and destroy Spark clusters as you need.CommentShareGonzalo Herrerosanswered 3 months ago"


Question: Packaging Lambda functions into a Cloud formation Template for sharing and deployment

Hi -I have a requirement to build a file parser for mainframe fixed file from S3 and push the results to Elastic Search. I have written bunch of lambda functions  using Python orchestrate by step functions. I need to package this as a solution as customers are interested to this use this POC code artifacts and  enhance it for their environment. I am looking for a better to option to package my functions and sharing it. Please advise.FollowComment

Answer: "1You can use AWS Serverless Application Model to package your step-function and lambda functions - https://docs.aws.amazon.com/step-functions/latest/dg/tutorial-state-machine-using-sam.htmlCommentSharepete-from-AWSanswered a year ago0You could use AWS SAR if you are happy for this code to be public. Otherwise, similarly to how SAR does it, have the same template structure etc. but you then need to grant access to the bucket that stores your Lambdas code so that they can use it. Mind you, you will need to then publish the functions into buckets for each region.For example, with this template you I distribute the Lambda layer and the functions "all in one". If I wanted that to be private, the only thing for me to do is to have codebuild push to each S3 bucket (1 per region) and later on grant the access to the customers for them to pull there.CommentShareJohnPrestonanswered a year ago"


Question: GovCloud Accessibility

"This is a very specific situation and I am getting conflicting opinions.  Let's say there is a premise site.  This site has a VPN into a GovCloud (FedRamp High) environment running Amazon Connect.  There is an agent PC that is accessing the CCP and taking calls via the softphone.  So, this PC is said to be within a FedRamp High environment.Can this PC have access to the Internet, through which the agent is accessing a Cloud CRM application like Salesforce or ServiceNow?  I mean I know the network can be configured to allow this scenario, but does that PC having internet access violate the requirements of FedRamp High?  Would Amazon have an issue with this configuration?Thank you for any thoughts.KurtFollowComment"

Answer: 0This is something you would need to discuss with your Compliance team or auditors.Amazon/AWS is unable to provide compliance/legal guidance for a specific customer environment.CommentShareGreg_Hanswered 5 months agoEXPERTAWS-samfredreviewed 2 months ago


Question: ALB: What will happen if I have too many connections that have to wait for idle timeout elapsed to close?

"I think that if I set the idle timeout of the ALB to be higher, it means that the time of 1 connection if there is nothing sent or received, the connection time will be longer. And the next connections will have to wait for the previous connections to be closed before they can reach to the target. And in this case, there will be impacts on query performance.Because ALB is used as a load balancer, Since the required LCU is automatically assigned in terms of the number of connections, etc., ALB itself may change the billing amount, but it is extremely unlikely that performance will deteriorate.=> Question:In the above 2, which statement is right?And in the case that I have too many connections that have to wait for idle timeout elapsed to close, is there any impacts on the performance of the webserver?Sorry for trouble you, but thank you!FollowComment"

Answer: "2Hi Yen Trinh,I understand on your notes that you would like to set the idle timeout on your ALB to be higher and what impact it will have on the performance, will it affect billing and will the performance deteriorate.Please correct me if my understanding is wrong.Firstly the load balancer by default set the idle timeout value to 60 seconds, that applies to its connections. If no data has been sent or received by the time that the idle timeout period elapses, the load balance closes the connection.In recommendation you can configure the idle timeout of your application to larger than the idle timeout configured for the load balancer considering that the application closes the TCP connection to the load balancer ungracefully the load balancer might send a request to the application before it receives the packet indicating that the connection is closed.In that case the server refuses the request from the load balancer and then the load balancer sends an HTTP 502 Bad Gateway error to the application. You can use the link below for steps to set different timeout value using your console[1] or cli[2].[1] https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html[2]https://docs.aws.amazon.com/cli/latest/reference/elbv2/modify-load-balancer-attributes.htmlI hope you find this information useful.CommentShareWinnieanswered a year ago1Accepted AnswerHello, thanks for reaching out!In addition to what Winnie clarified about configuring the idle time out, I wanted to address your questions. There is actually some truth to both of your original statements.I think that if I set the idle timeout of the ALB to be higher, it means that the time of 1 connection if there is nothing sent or received, the connection time will be longer. And the next connections will have to wait for the previous connections to be closed before they can reach to the target. And in this case, there will be impacts on query performance.If HTTP keep-alives are enabled in your application in order to maintain connections between the ALB and the targets, the ALB can actually re-use existing backend connections for new incoming requests without needing to wait for a previous connection to close after a completed request. If all existing backend connections are in use, the ALB will attempt to make a new connection for other new incoming requests.Because ALB is used as a load balancer, Since the required LCU is automatically assigned in terms of the number of connections, etc., ALB itself may change the billing amount, but it is extremely unlikely that performance will deteriorate.This is true, the billing amount you see will be dependent on charged LCUs, which are based on new connections, active connections, processed bytes, and rule evaluations. Performance will be dependent on the ALB's decisions to scale up or down based on the number of incoming requests, as well as your targets' ability to handle the amount of requests. You can see a previous answer here which provides some further detail on the ALBs ability to scale in response to incoming traffic.CommentShareSUPPORT ENGINEERJustin_Banswered a year ago"


Question: Increase the frequency of face detection | AWS Rekognition (StartFaceSearchCollection)

I am using AWS Rekognition to analyse faces in a supplied video.Currently -- the gap between timestamps is 500ms in the response from the analysis.After pouring over the documentation - I am see no reference to:Is this the fixed gap/rate for analysisCan you increase the rate from 500ms to something shorterFollowComment

Answer: "0What you are referring to is addressed as latency and depends on multiple factors - the more faces to be recognized (you can create an array of faces to be checked in each frame ) the more faces the more latency will be introduced.For example, the random landscape image’s response latency is less than 1 second, whereas calls to Amazon Rekognition for images with one face count have a response latency between 1 second and 1.5 seconds. Images with multiple face counts have a much higher response latency, greater than 1.5 seconds.CommentShareAndy Shahbazianswered 3 months ago"


Question: how to solve Safari Mobile cors

"i have a problemI get a CORS error when I try to load an image from my S3 on iPhone Safari.my issue here'Failed to load resource Preflight response is not successful Status code 403'my agent here'Mozilla/5.0 (iPhone; CPU iPhone OS 16_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.4 Mobile/15E148 Safari/604.1'onlyMy S3 bucket is connected to CloudFront. Here are my CloudFront settingsCache policy and origin request policyCachingOptimizedResponse HearderSimpleCORSAccess HttpGET,HEAD,OPTIONS,PUT,POST,PATCH,DELETEView access - NOwhy i see cors error ??FollowComment"


Question: ECS Fargate task fails with InvalidDhcpOptionID.NotFound

Trying to launch an ECS Fargate task in a VPC that does not have a DHCP option set. The task fails with:Unexpected EC2 error while getting DHCP options for VPC vpc-NNNN: InvalidDhcpOptionID.NotFound.Is DHCP option set required? How is it being used? Is there a workaround other than setting a DHCP option set?Thanks.FollowComment

Answer: "0Hello,Is DHCP option set required?DHCP option set is required in order to run ECS Fargate tasks in your VPC.How is it being used?DHCP option set provides DNS nameserver configuration for your VPC.When you create an EC2 instance, the /etc/resolv.conf file gets populated with the nameserver configuration that you specify in the DHCP option sets for your VPC. All of the DNS queries within the EC2 instance uses the nameserver provided in the /etc/resolv.conf to perform DNS resolution.While using ECS Fargate, your tasks will run on EC2 instances that are managed by AWS.The underlying EC2 instance (managed by AWS) will use your DHCP option sets to configure nameserver configuration to perform DNS resolution.Even your ECS tasks will use the nameserver provided in the DHCP option sets to perform DNS resolution.Is there a workaround other than setting a DHCP option set?As you can understand from the above information, it is not possible for ECS Fargate to perform its functionalities without enabling the DHCP option sets for your VPC.I hope this helps!CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 9 months ago"


Question: Problems when converting to TS files

"I am trying to convert an mxf file into a TS file with MediaConvert.Basically it works, but i notice that at the beginning of the TS video there is a freeze frame that lasts about 2 seconds.I have looked at the media files in detail and could already determine the following.The input file *.mxf has a total length of 15s 0 ms.After converting it into a TS file, I see the total length of 16s 739ms.However, the video and audio itself still have the original length of 15s.A menu is added to the TS file that has a length of 16s 789ms and thus extends the total duration of the file.How can we avoid adding this menu?Or is it possible to limit this menu to the video length?FollowComment"


Question: Verified Identity - FROM/TO

"Hi,I'm starting to use SES and I think I'm missing something :-)In the doc I read:"In Amazon SES, a verified identity is a domain or email address that you use to send email. Before you can send an email using Amazon SES, you must create and verify each identity that you're going to use as a "From", "Source", "Sender", or "Return-Path" address. Verifying an identity with Amazon SES confirms that you own it and helps prevent unauthorized use. "https://docs.aws.amazon.com/ses/latest/dg/verify-addresses-and-domains.htmlI have email@mydomain.com  and the domain mydomain.com that are both verified.  Sending a mail FROM email@mydomain.com    TO email@mydomain.com   works fine.  However when sending it FROM email@mydomain.com   TO somone@otherdomain.com  I get an error as somone@otherdomain.com  is not verified.However based on what I read in the doc, I have to verify the FROM of the mail, not the TO.From what I understand in the doc, only the FROM needs to be verified, from the errors it seems that both the TO and the FROM need to be verified.Any thoughts?And mostly how can I get SES to work with my verified FROM, so I can send to "any" TO?dirk.FollowComment"

Answer: 0Problem seems to be solved now that I'm no longer running SES in the sandbox.CommentShareDirkWoodstoneanswered 2 years ago


Question: Secondary Index in DynamoDB

"Hi,I have a use case where I am fetching data  on certain items (unique itemID) multiple times a day (identified by day_BatchTime) and storing them on a dyanmoDB. My composite primary key consists of itemID &  day_BatchTime. I have set itemID  as parition key and day_BatchTime as sort key.But I need to report data for each day on a daily basis. So I tried setting up a global secondary index as feedDate. But running the query on global secondary index did not return any result (screenshot: https://ibb.co/kJ3p5mZ ). Please let me know if I am missing something and if there is a better way to achieve my objective of day wise items.I am using  AWS console to fetch this data for now.Regards,DbeingsFollowComment"

Answer: "0Hi,have you verified that feedDate has the same data type in both the table and the Secondary Index?could you please share the table and index details?thank youCommentShareEXPERTFabrizio@AWSanswered a year agodbeing a year agoHi Fabrizio,The feedDate query is now working in AWS console but cant get it working through Python code in Lambda. I followed the docs and below is the snippet.  My dataframe is not getting populated. Without the filter expression, it gets populated so I think there is something off in filter expression. It would be great if you could provide some pointers.done = Falsestart_key = Nonescan_kwargs = {'FilterExpression': Key('feedDate').eq('15-03-2022'),'ProjectionExpression':'feedDate, itemID, val'}while not done:if start_key:scan_kwargs['ExclusiveStartKey'] = start_keyresponse = table.scan(**scan_kwargs)items = response.get('Items', [])page_no = page_no+1item_i = 0if len(items) == 0:breakwhile item_i<len(items):for key in items[item_i]:#mystr = mystr + ":"  + key + str(items[item_i][key])df_list.loc[row_num,key] = str(items[item_i][key])item_i = item_i+ 1row_num = row_num+1start_key = response.get('LastEvaluatedKey', None)done = start_key is NonedfLen = len(df_list)Regards,DbeingsShare0Hi Fabrizio,The feedDate is of type String in both cases. Now I am able to run scan and get the results but I am still not able to run a query. The query requires a partition key and my partition key are different item ids for each day.Below are key elements of table and details on global secondary index:Partition key: itemID (String)Sort key: Batch (String)feedDate(String)Global secondary index detailsNamefeedDate-indexStatus ActivePartition keyfeedDate (String)Sort key-Read capacityRange: 1 - 10; Auto scaling at 70%; Current provisioned units: 1Write capacityRange: 1 - 10; Auto scaling at 70%; Current provisioned units: 1Size2.4 megabytesItem count8527Regards,DbeingsCommentSharedbeinganswered a year ago0DynamoDB is designed for quick LOOKUP using specific keys. It is not designed to be an analytical tool, even if you have options such as SCAN and QUERY.If you know that you need to provide aggregations (or any other type of analytical functions), it is better to either create aggregation tables in DDB or export the data through DynamoDB streams to an analytical tool such as Athena.For example, every time that you put another record in your main table above, you can also increase a counter to a day-count table. See an example for such logic here: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GettingStarted.Python.03.html#GettingStarted.Python.03.04You don't need to limit your LOOKUP to a single record, as you have the sort key to get a few records. However, if you see that you need to read hundreds or even dozens of records to generate a specific statistic such as count, max, mean, etc. you are using DynamoDB inefficiently.CommentShareMLGuyanswered a year ago"


Question: SES Managed Dedicated IP addresses

How can we get the list of the dedicated pool of IP addresses allotted to us?How can we get the details about what percentage of emails are sent through the dedicated pool of IP addresses?FollowComment

Answer: "0To apply for a dedicated IP, you need to send a limit case to the support center. For detailed operations, please refer to this link: https://docs.aws.amazon.com/zh_cn/ses/latest/dg/dedicated-ip-case.html，If you use a dedicated ip to send emails, you need to use the configuration set to select the dedicated ip pool：https://docs.aws.amazon.com/zh_cn/ses/latest/dg/managing-ip-pools.htmlPlease pay attention to preheating your dedicated ip pool. When the dedicated ip is applied for, do not send all emails through the dedicated ip：https://docs.aws.amazon.com/zh_cn/ses/latest/dg/dedicated-ip-warming.htmlCommentShareivesanswered 5 months ago"


Question: Bandwidth Cost and How to track and control

I am using EC2 and Static IP.  From last two months I have been charged for bandwidth charges a lot. Does bandwidth charges are due to downloading and uploading of data from ec2 server to local computer via internet. If not then what it is? How to track which user is causing bandwidth charges and how to control it.FollowComment

Answer: "1Hello,I assume charged for bandwidth cost you mean transfer cost? Here are are a link to the documentation regarding understanding data transfer charges. Aslo, this blogpost dives a bit deeper when it comes to when data transfer cost "kicks in".In cloud environments, data transfer into the system is typically free, while data transfer out carries associated costs. Therefore, when considering what drives up expenses related to data transfer, it is crucial to examine your networking architecture. Factors such as incorporating a transit gateway or an inspection VPC can potentially increase costs, necessitating a thorough evaluation of your overall networking setup.By carefully analyzing your networking architecture, you can identify potential cost escalators and implement measures to optimize data transfer expenditure. Understanding how different components interact and impact pricing allows you to make informed decisions that align with your budget and operational requirements.Remember, while data transfer in may not incur costs, it is essential to consider the broader networking framework to manage expenses associated with data transfer out effectively.As the source, I would recommend establishing VPC flow logs on your VPC to track connected resources and monitor data transfer. You can use Amazon Athena or Amazon CloudWatch (if i remeber correctly, there are some pre-defined queries in CloudWatch that can help you out with the Flow Logs) to query the cost and gain the required granularity - where in your case you want to get the data transfer in to see the host that consume the most bytes. VPC flow logs provide valuable insights, and Amazon Athena enables efficient analysis of the data.Enforcing traffic throttling is crucial for optimal network performance. In my experience, there are several effective approaches to achieve this:Next-Generation Firewall: Consider leveraging a next-generation firewall like AWS Network Firewall. These advanced firewalls provide robust traffic control capabilities, allowing you to define specific rules and policies for throttling traffic.Granular Security Group Configuration: Take advantage of granular security group configurations. By specifying detailed rules within your security groups, you can effectively throttle traffic at the network level, granting you more control over traffic flow and bandwidth allocation.Throttling at the EC2 Instance/Application Level: Enable throttling mechanisms directly within your EC2 instance or within the application running on the instance. This approach involves implementing traffic shaping or rate-limiting mechanisms within your application code or utilizing tools provided by the operating system to control network traffic.By employing these strategies, you can ensure that network traffic remains within desired limits, preventing congestion and optimizing overall performance. Choose the approach that aligns with your specific requirements and network architecture to achieve effective traffic throttling.Hope this helps.CommentShareemnedanswered 16 days agoEXPERTFabrizio@AWSreviewed 16 days ago"


Question: Lambda error code

"Is there anyway to control Lambda error code? For example, in case I have exception, for some cases I want to put the error code value as 412 and not 200 as it nowFollowComment"

Answer: "0If you mean for use with apigateway, you need to return a specifically formatted response.{    "isBase64Encoded": true|false,    "statusCode": httpStatusCode,    "headers": { "headerName": "headerValue", ... },    "multiValueHeaders": { "headerName": ["headerValue", "headerValue2", ...], ... },    "body": "..."}https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-lambda-proxy-integrations.html#api-gateway-simple-proxy-for-lambda-output-formatCommentShareEllisonanswered 3 years ago0I'm not using API gateway. I trigger Lamda using S3, and in case of error, i'm using DLQ. In DLQ message there is an attribute ErrorCode which the value is always is 200, but I want to customize this code as part of my Lambda code to publish different code for different errorsCommentShareasafhaanswered 3 years ago0Ah, I see. No, that is not possible. That field is for the code that would have been returned by invoke if it were synchronous, which should be 200 most of the time, even in the case of exceptions in the user controlled lambda code. The possible values are here: https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html#API_Invoke_ErrorsCommentShareEllisonanswered 3 years ago"


Question: Looking for the product demo videos for Amazon Quicksight

Where can I find detailed information and demo videos for Amazon Quicksight?FollowComment

Answer: 0Accepted AnswerThe product demo videos and webinars are available in the Amazon Quicksight resources section.CommentShareAWS-User-5862030answered 2 years ago0you can find more about quicksight on aws youtube channel for quicksight and aws workshophttps://www.youtube.com/channel/UCqtI0cKSreCwUUuKOlA1towworkshop.aws.comCommentShareAWS-User-7736698answered a year ago0Try this https://aws.amazon.com/quicksight/features/CommentShareCloudXLanswered a year ago


Question: Aws backup : How to forced a full backup

"Hello all,I'm currently working on aws backup service , I know aws backup is doing a full backup the first time but the next backup are incremental.I would like to force full backup. How to do it?Best regardsFollowComment"

Answer: "1Once a full backup is obtained, subsequent backups are incremental.So if we were to do it, we would delete the full backup each time and then get a backup, which would be a full backup.https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html#features-by-resourceAs described in the following document, even if a full backup is lost, the data can be fully restored from the incremental backups taken afterward, so there is no point in taking a full backup every time.https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup.html#how-incremental-backup-worksCommentShareEXPERTRiku_Kobayashianswered a month agoEXPERTkentradreviewed a month ago0Depending on the type of service, you can enforce a full backup.If it is EFS, S3, VMWareVM's or DynamoDB with advance feature enabled then you can create a full backup by creating an on-demand backup to a vault where a previous backup for the same resource doesn't exist. Basically, you have to pick a different vault.For EC2, RDS, EBS, etc, the backups are region wise incremental. That means all the backups for these resources are incremental in the same region.CommentShareSSanswered a month agoEXPERTkentradreviewed a month ago"


Question: EC2 is in shutting-down state since several hours

"Hello,we have an instance which stucks in shutting-down state since about 14 hours.$ aws ec2 describe-instances --instance-ids i-003cbe5742a5db1fe --query "Reservations[*].Instances[*].[StateTransitionReason,State.Name]" --output text ; date -uUser initiated (2019-07-23 00:42:03 GMT)    shutting-downmar 23 lug 2019, 14.00.09, UTCHow to solve?FollowComment"

Answer: "0It should be automatically "garbage-collected" in about 24 hours, as I can understand by the old tickets on this argument.CommentShareE Gabriellianswered 4 years ago0the ec2 is off now indeed.. thanksCommentShareantoninocaccamoanswered 4 years ago0Hi antoninocaccamo,I am glad that the issue has been resolved for you. Please let us know if you need any further help.Regards,awstomasCommentShareAWS-User-3892169answered 4 years ago"


Question: Slow network between EC2 instances

"I copy files from an i3.metal instance to a t3.medium instance with 16Gb sc1 EBS disk. Both located in us-west-2 (Oregon) region (though in different AZs). Sometimes I have up to 200Mb/s speed (which might be a limitation of an SSD on i3.metal, so this is a different question), but sometimes only 30Mb/s! See the graph from CloudWatch: https://i.stack.imgur.com/JiiS8.pngi3.metal is said to have 3125 Mb/s network, t3.medium is said to have up to 625 Mb/s network. sc1 disk baseline IO throughput should be 192Mb/s. But clearly, something is limiting my speed. Could anyone suggest what this can be?Edited by: mmatrosov on May 21, 2021 7:47 AMFollowComment"

Answer: "0Ok, seems like the CPU just cannot handle much of a traffic input: https://stackoverflow.com/a/67639812/261217CommentSharemmatrosovanswered 2 years ago"


Question: Is it possible to create Transmit Gateway attachment to ipv6 only subnet?

"I try to attach transmit gateway to ipv6 only subnet, but when treating tgw attachment I am getting error " There was an error creating transmit gateway attachment.  Insufficient Free IP Addresses in  subnet..." Not sure if this is supported configuration.FollowComment"

Answer: "1Accepted AnswerYou are not doing anything wrong. Just that its not yet supported. However, it works with a Subnet that contains both IPv4 and IPv6 but not with a IPV6-only Subnet yet.CommentShareJiballs-AWSanswered a year agoEXPERTToni_Sreviewed a year agoJarota a year agoThank you. Make sense.Share"