Question: Lumberyard support for visual studio 2017

For date we could see the support of visual studio 2017 in lumberyard?Follow

Answer: "0Accepted AnswerUnfortunately we don;t have a date to announce on VS2017 support at this time. It is something we are working on though.SharerePost-User-8353690answered 6 years ago0New to lumberyard ...how to open lumberyard game in visual studio 2017 (UWP) ?tx.SharerePost-User-9450880answered 6 years ago0I've been seeing this same question pop up over and over again. When will we see support for Visual Studio 2017, and why is it taking so long to implement? Also what about support for 3ds Max 2018, 3ds Max 2017, and Maya 2018, and Maya 2017? It seems like development tools are REALLY lagging behind (2-4+ years) and I really wish that Lumberyard Dev Team would REALLY take development tools seriously, and please focus on getting Lumberyard "up to date" with the most current development tools, it would really help out developers!SharerePost-User-9149768answered 6 years ago0It's been over a year now, is there any update on this? It seems that "development tools" support in Lumberyard are at least 2-4+ years behind and it makes it extremely difficult to develop with Lumberyard. We have all the latest versions of development tools installed, and can't use them (or develop) with Lumberyard. We've been waiting for years for Lumberyard to update the Dev Tools Support in Lumberyard. When will we see support for Visual Studio 2017, and why is it taking so long to implement? Also what about support for 3ds Max 2018, 3ds Max 2017, and Maya 2018, and Maya 2017? It seems like development tools in Lumberyard are REALLY lagging behind (2-4+ years) and I really wish that Lumberyard Dev Team would REALLY take supporting the latest development tools seriously, and please focus on getting Lumberyard "up to date" with the most current development tools, it would really help out developers! I really wish Amazon would permanently "Dedicate" at least 3 or 4 people to focus SOLELY 100% on "development tools" support (i.e. Visual Studio 2017, 3ds Max 2018, 3ds Max 2017, and Maya 2018, and Maya 2017, etc.) This way as newer versions of development tools are released, they will automatically work with the latest version of Lumberyard. Lumberyard is always 2-4 years behind, and by the time 2017 or 2018 versions of development tools are finally supported, the 2019 versions will already be out. The current "lag time" is about 2-4 years for Lumberyard to "add support" to Lumberyard for the latest Development Tools (i.e. Visual Studio 2017, Visual Studio 2019, 3ds Max 2017/2018/2019, Maya 2017/2018/2019, etc.) Please dedicate a few Amazon Lumberyard developers SOLELY to focus on "development tools" support (adding support to Lumberyard for the latest versions of Visual Studio 2017/2019, 3ds Max 2017/2018/2019, Maya 2017/2018/2019, etc.) Please and thank-you!SharerePost-User-9149768answered 5 years ago0Hi ECHS_BACHS,Unfortunately VS2017 (Visual Studio 2017) is not supported in the latest Lumberyard at this time. Amazon/Lumberyard seems to be a few years behind when it comes to adding support for "Dev Tools" to Lumberyard. It's only been a few months since we've had VS2015 support (just a few months ago, only VS2013 was supported). So Amazon/Lumberyard is about 3-4+ years behind in supporting Development Tools for users/devs.I'm hoping that this can be "addressed" but as you can see (from the date on this post), it's already been over a year and we still don't have VS2017 support added to Lumberyard yet.Unfortunately it might be another 3-4 years before we see VS2017 support added to Lumberyard, "Development Tools" support seems to be really "lagging" really far behind in Lumberyard, and we still don't have "Visual Studio 2017" or "3ds Max 2018" (or 3ds Max 2017), or "Maya 2018" (or even Maya 2017?) support added to Lumberyard yet.Hopefully this is something that can be resolved fairly soon, but as you can see it's already been almost a year (since my last post) and these "issues" still haven't been resolved.SharerePost-User-9149768answered 5 years ago0I'm NO expert on release schedules per se, but if you see this:https://docs.microsoft.com/en-us/visualstudio/install/visual-studio-build-numbers-and-release-dates?view=vs-2017It indiacates while 2017 came out in March 7,2017, that its still going through updates as of 6/11/2019 .2019 just came out 4/2019 which you noted.I guess based on that I can't fault them too hard for waiting.However again, I'm no expert on this, and since I"ve never compiled unity OR ue4 ,and I have both, I"ve yet to need to compile them so I have no idea what they're using as default.Not being lazy or anything o_0, I just checked and :https://docs.unrealengine.com/en-US/Programming/Development/VisualStudioSetup/index.htmlSure indicates that THEY don't even support 2019 yet, as 2015/2017 are defaults.No insult intended at all, I just checked myself, down about 2019 not being supported.I've just been edified, hope this helps you, and again in no way am I insulting anyone,- I just found out too, THO sorry if this doesn't apply to you, or your needs.MOre choices are always better than less, ofc.EDIT EDIT: Btw, took a tiny bit of finding, but see here:https://visualstudio.microsoft.com/vs/support/need-installing-visual-studio/then you just click on 'community edition' or whichever version you wish.I know this is prob. not what you're after, or you may have already pruchased 2019, sorry if that is the case.Good luck .GaillardSharerePost-User-2755327answered 4 years ago"


Question: Best Practices for ElasticSearch Cluster Failovers

"Hello All,A customer is currently using AWS ElasticSearch in order to run their primary search function on their e-commerce website. Currently their queries often run for extended periods of time which ends up putting pressure onto the ES instances themselves, which forces them to crash and reboot.This causes their websites functionality to be down until the AWS ElasticSearch service reboots the nodes. They are currently working on reducing the query times and have already been in contact with Premium support.Ideally, I would just like to suggest any alternatives or failover solutions that they could implement until they are able to reduce the violent query requests they receive. I was wondering if the Cross-Cluster functionality could also be used as a backup option? Or perhaps implementing Route 53 Health Checks as well as another solution.Either way, any feedback or input would be greatly appreciated!FollowComment"

Answer: "0Accepted AnswerIt sounds like the customer is already addressing the root cause of the problem (long queries), so I would suggest the following improvements/additions (if not already in place):Query caching. Put Redis on Elasticache in front of Elasticsearch to cache query results. This can be as simple as base64-encoding the full JSON query object to use as the key, with the results as the value. Redis can expire cached objects as appropriate for the query validity (even if TTL is only 30 seconds, it can help enormously in a high-traffic ecommerce site).Scale ES nodes vertically. ES loves memory and big queries love CPU. Not sure what their cluster looks like, but it sounds like fewer, larger nodes could help.Rather than cross-cluster search, I'd rather suggest having a hot standby if they really really can't solve the root problem (and caching doesn't help). Route53 could be used to switch over to the hot standby. But this is an expensive option, obviously. And it should not be unnecessary if they right-size their cluster and resolve the query size issues. It feels like they may also have sub-optimal index patterns, document formats etc....?CommentShareMODERATORAWS-User-7002480answered 3 years ago"


Question: Lightsail Instance 1GB/1Core Keeps going down

"I've tried running a LightSail WordPress instance for awhile now (4-5 months) and I'm having some stability problems.  I started out with the low end instance 512MB/1Core and started having issues where it will occasionally go down.  It says still running but it's unreachable.  This is usually coincided with some network traffic and a short CPU spike.  This usually doesn't last very long but it never comes back up.  If I stop, wait, start then it works again.  If I add a R53 healthcheck it will go down within 24 hours.  I only get about 50 visits a day (max) to the site so I know it's very low traffic.I thought maybe the instance was underpowered so I upped it to 1GB/1core and it went down again today after running only about 1 day.There's clearly something wrong here.  Can I get some assistance on determining what is going on here?Thanks in advance!FollowComment"

Answer: "0Accepted AnswerI'm able to run a number of basic wordpress servers in a single 512mb lightsail instance.The only thing I did was buy 8gb of extra storage and make it a swap partition.Before I had the swap partition, the mySQL server was constantly crashing due to OOM problems.I blogged about it here: https://www.geekyramblings.net/2018/02/01/amazon-lightsail#512mb-isnt-a-lot-of-memorydavidCommentShareDavid Ganswered 4 years ago0David, thank you.  I will give this a shot and see if it fixes my problem.  I appreciate you taking the time to respond to my question.I will let you know how it works out!Regards,ShawnCommentSharesnag01answered 4 years ago0This definitely fixed my problem.  After implementing a swapfile, the instance has been stable ever since.I appreciate your help!!CommentSharesnag01answered 4 years ago"


Question: aws lex bot integration in a web ui

"I'm trying to integrate a lex bot in a web ui; I followed this documentation :https://docs.aws.amazon.com/lex/latest/dg/ex-web.htmlbut i found an two different errors :1 - when I tested the : "Greetings, visitor!"—Engage Your Web Users with Amazon Lex" and configured all the dependencies.although the bot is already existing; I found this error :Error: The specified resource 'PizzaOrderTestBot' does not exist. Choose another resource. (see console for details)2 - when I tested the : Deploy a Web UI for Your Chatbot, the probelm is that the bot is working fine in the lex console and the web ui is missing things and returns " message: "The slot to elicit is invalid." "any idea about this problems ?PS: I worked with aws lex V2FollowComment"

Answer: "0Hi,The error message "The specified resource 'PizzaOrderTestBot' does not exist" indicates that the bot named "PizzaOrderTestBot" could not be found in your AWS account. Make sure that you have created the bot and that you have specified the correct name when you configured the web UI.Regarding the "The slot to elicit is invalid" error, this message indicates that your bot is trying to elicit a slot that is not defined in your bot. This could happen if the slot name has been misspelled or if the slot has been deleted from your bot.To troubleshoot this issue, check the logs in CloudWatch Logs for your Lex bot to see if there are any errors or exceptions being thrown. You can also try testing your bot in the Lex console to see if you encounter the same error.If the problem persists, you may need to update your bot's configuration to ensure that all the required slots are defined correctly. Make sure that the slot names and types are correct and that the slot is marked as required if necessary. You may also need to update your Lambda function code to handle the slot elicitations correctly.Hope it helps.CommentShareTina Qiananswered 2 months agoayoub 2 months agothanks for responding, dealing with  "The slot to elicit is invalid" error; I tried the bot in the lex console and it works fine, but when try it in the web ui , I allways recieve the same error, and I didn't figure out the causeShareTina Qian 2 months agoHi, could you check the logs in CloudWatch Logs for your Lex bot to see if there are any errors or exceptions being thrown when using web ui?Shareayoub 2 months agoI already check and every thing it's ok, I retry to delete the stack and create a new stack that deal with the project and now it's running ok, I figure out that when updating the bot in aws console that does not mean there will be an automatic update in the web ui, every time I need to delete the stack an create a new one.Share"


Question: AWS SES can i use sendBulkTemplatedEmail without send the emails?

"I need to use the sendBulkTemplatedEmail function without sending the emails to be able to estimate the time of sending emails, to see the speed we have on our server including the request to make the sendBulkTemplatedEmail function.FollowComment"

Answer: 0I use sendBulkTemplatedEmail too when I test about sending I use temp-mail to create email receiver.CommentShareTeerapong-janswered a year ago


Question: Data wrangler flow export option not visible

I want to export the data wrangler transforms but i am not able see flow export option but only tranformed data set export is availableFollowComment

Answer: "0Click on the "< Data flow" link at the top of the window. This should bring you back to the designer.Then select the "+" button and you will have an "Export to >" option.CommentShareEXPERTMassimilianoAWSanswered 4 months ago0Follow the " export-to"steps as per the documentation ->https://docs.aws.amazon.com/sagemaker/latest/dg/data-wrangler-data-export.html#:~:text=Destination%20Node-,Export,-toCommentShareAWS-User-0741373answered 4 months ago"


Question: can i add compliance policy to root account?

in azure i will create compliance policy that automatically apply all usershow to add  compliance policy to AWS root account?FollowComment

Answer: 0in AWS Management Account (also called root account) - you can leverage Service Control Policies (SCPs) to add a policy that meets a specific compliance policy.Use this link to find out exactly how to create a specific SCP and apply to your organization :https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.htmlCommentShareAbhishek Naikanswered a year agochaitanya a year agoyou cannot add Service Control Policies  to AWS Management Account. you can add to member accounts.Share


Question: Using company (corporate) card as primary payment means

"We are transferring one of AWS accounts under a company's (organization's) account, and we plan to use corporate card to pay the AWS bills.Company is based in Russian Federation. Should we expect any problems paying with corporate card:whether the taxes are added automatically to our billswhether such a card is accepted as payment meanswhether the base currency of RUR is OK with AWS?Thanks.FollowComment"

Answer: "0Accepted AnswerHi Konstantin,It may be best to discuss this via case in the Support Center in order to get the most specific info, but I'll try my best to answer your questions."Whether the taxes are added automatically to our bills"All VAT collected by AWS Europe from customers in Russia will be paid to the Federal Tax Service of Russia, please check out the info on this page for more details: https://aws.amazon.com/tax-help/russia/"Whether such a card is accepted as payment means"We'd need more specific info to confirm this, but our accepted payment methods can be confirmed,here: https://aws.amazon.com/premiumsupport/knowledge-center/accepted-payment-methods/."Whether the base currency of RUR is OK with AWS"We currently do not accept payments for RUR, but this list isn't fixed and maybe expanded upon in the future. The currently supported currencies can be found here: https://aws.amazon.com/about-aws/whats-new/2015/02/16/get-billed-and-pay-in-your-preferred-currency/If you have more specific questions to this, please open a case in the Support Center: https://console.aws.amazon.com/support/home.Warm regards,Craig E.CommentShareEXPERTAWS Support - Kraiganswered 3 years ago"


Question: Fn::GetAtt Arn fails on a AWS::Scheduler::Schedule

"I am unable to use Fn::GetAtt in a CloudFormation template to get the ARN of an AWS::Scheduler::Schedule. CloudFormation fails to update the stack with this error.Unable to retrieve Arn attribute for AWS::Scheduler::Schedule, with error message Resource of type 'AWS::Scheduler::Schedule' with identifier 'lops-coder-DjangoBackendClearDjangoSessionsSchedul-VZ00I61PNLJ4' was not found.According to the resource and policy reference for AWS::Scheduler::Schedule, Fn::GetAtt is defined for Arn.In my CFT, I have an AWS::Scheduler::Schedule resource defined and successfully deployed.Resources:  ScheduleGroup:    Type: AWS::Scheduler::ScheduleGroup    DjangoBackendClearDjangoSessionsSchedule:    Type: AWS::Scheduler::Schedule    Properties:      GroupName: !Ref ScheduleGroup      # …If I add an output for the schedule's ARN, CloudFormation fails with the message above. This is the only change to the template.Outputs:  DjangoBackendClearDjangoSessionsScheduleArn:    Value: !GetAtt DjangoBackendClearDjangoSessionsSchedule.ArnI have confirmed that there is in fact a schedule named lops-coder-DjangoBackendClearDjangoSessionsSchedul-VZ00I61PNLJ4 in the same account and the same region.FollowCommentJim Nicholls 2 months agoIt appears to me that this issue is limited to not using the default schedule group.I looked at the CloudTrail events. CloudFormation is not including GroupName in the GetSchedule API call. GroupName is required if the schedule is not in the default group.Share"

Answer: 0Accepted AnswerI was able to reproduce it in my environment.It may be a bug and you should contact AWS support.CommentShareEXPERTRiku_Kobayashianswered 2 months ago


Question: When are the VOD mediapackage streams ready ?

"Hello,with VOD MediaPackage, after creating a new asset, we obtain the urls for the packaging configuration urls.usually it takes a few minutes for the streams to be downloadable (meaning not to return a 404 error).But today I have a longer 2hours videos and it tooks 10+ minutes for the playlist file to be available.Is there a notification event that we could track to be aware when the packaging outputs are ready to be published ?JoelFollowComment"

Answer: "0Accepted AnswerHi Joel, thanks for opening this forum post with us!There are different ingest statuses available to monitor: "IngestStart", "IngestComplete", "IngestError" which defines the status of ingest, and "VodAssetPlayable" which denotes when the URL is ready to play back. A URL is generated when the "IngestComplete" event is triggered, but won't be playable until "VodAssetPlayable" is triggered. Until then, you will receive a 404 on that endpoint as it is not yet ready - as you have already noted.I would suggest setting up SNS Topics for the above events, especially "VodAssetPlayable". You can find more details on this here: https://docs.aws.amazon.com/mediapackage/latest/ug/cloudwatch-events-example.htmlDo let us know if you have any other questions!Regards,BenCommentShareAWS-User-0287910answered 3 years ago"


Question: How to switch from AISPL to AWS account?

"I made a Lex Bot and now I want to integrate it with Amazon Connect so that I can make an IVR. Yesterday when I was doing that then an error came as Indian AWS accounts are administered through ASIPL, not AWS, The error screenshot is provided below:I have checked the same thing on the web and on repost itself but I haven't gotten any particular answer. So, can anyone please give me a workaround on how to access Connect from India? Can I get a US based account from India itself?FollowComment"

Answer: 0Please review What are the differences between AWS accounts and AISPL accounts? and we recommend to open a support case for the same.CommentShareEXPERTAWS-User-Nitinanswered 6 months ago


Question: Where is `Data Source Experimental` Option on OpenSearch?

"Hi there,I am using a 2.5 OpenSearch instance managed by AWS (not serverless). I would like to collect my Prometheus metrics from an EKS in the same VPC as the OpenSearch cluster. But I found no button of configuring data source on the OpenSearch dashboard. I tried to find it using the tutorial here https://opensearch.org/docs/2.4/dashboards/discover/multi-data-sources/. Is it because I do not have the proper permission to do this?FollowComment"

Answer: "0I'd suggest taking the following steps to collect Prometheus metrics from your EKS cluster and send them to your OpenSearch instance:Firstly, deploy Prometheus server on your EKS cluster. You can do this by following the official Prometheus guide or use the Prometheus Operator for a simpler deployment process.Use the Prometheus OpenSearch Exporter to convert your Prometheus metrics to the OpenSearch format. This Exporter helps in generating and exporting your Prometheus metrics in a format that can be ingested by OpenSearch.Configure the OpenSearch Exporter to send metrics data to your OpenSearch instance. This step involves providing your OpenSearch instance's endpoint and authentication details.Once the metrics are ingested into OpenSearch, you can use OpenSearch Dashboards to visualize and analyze the metrics data.In case you're facing permission issues, make sure that your IAM role or user has the necessary permissions to access the OpenSearch cluster and create/update indices. Additionally, ensure that the security group associated with your OpenSearch cluster allows inbound traffic from your EKS cluster.CommentShareEXPERTsedat_salmananswered 2 months ago0Do you mean prometheus exporter for OpenSearch plugin found here https://github.com/aiven/prometheus-exporter-plugin-for-opensearch? It seems expose only the OpenSearch metrics. Where I can find the plugin you mentioned to sent metrics data in my EKS to the OpenSearch cluster?CommentSharerePost-User-3977349answered 2 months ago"


Question: Incremental training with custom keras code in script mode

"Hi,I'm moving my first steps in sagemaker. I'm using script mode to train a classification algorithm. Training is fine, however I'm not able to do incremental training. I want to train again the same model with new data. Here what I did. This is my scriptimport sagemakerfrom sagemaker.tensorflow import TensorFlowfrom sagemaker import get_execution_rolebucket = 'sagemaker-blablabla'train_data = 's3://{}/{}'.format(bucket,'train')validation_data = 's3://{}/{}'.format(bucket,'test')s3_output_location = 's3://{}'.format(bucket)tf_estimator = TensorFlow(entry_point='main.py',                           role=get_execution_role(),                          train_instance_count=1,                           train_instance_type='ml.p2.xlarge',                          framework_version='1.12',                           py_version='py3',                          output_path=s3_output_location)inputs = {'train': train_data, 'test': validation_data}tf_estimator.fit(inputs)The entry point is my custom keras code, which I adapted to receive arguments from the script.Now the training is successfully completed and I have in my s3 bucket the model.tar.gz. I want to train again, but it's not clear to me how to do it.. I tried thistrained_model = 's3://sagemaker-blablabla/sagemaker-tensorflow-scriptmode-2019-11-27-12-01-42-300/output/model.tar.gz'tf_estimator = sagemaker.estimator.Estimator(image_name='blablabla-west-1.amazonaws.com/sagemaker-tensorflow-scriptmode:1.12-gpu-py3',                                               role=get_execution_role(),                                              train_instance_count=1,                                               train_instance_type='ml.p2.xlarge',                                              output_path=s3_output_location,                                              model_uri = trained_model)inputs = {'train': train_data, 'test': validation_data}tf_estimator.fit(inputs)Doesn't work.. first I don't know how to retrieve the training image name (for this I looked for it in the aws console, but I guess there should be a smarter solution), second this code throws an exception about the entry point.. but it is my understanding that I shouldn't need it when I do incremental learning with a ready image..I'm surely missing something important, any help? Thank youFollowComment"

Answer: "0Found by myself, here the answer: https://stackoverflow.com/a/59096925/4267439CommentSharerokk07answered 4 years ago"


Question: Connect IIS virtual drive to FSX

I have connected the fsx drive to the ec2 instance and can view files through the windows explorer. I can not get IIS to serve files from the drive.  I have added the virtual drive and can browse to it under IIS but when I test the "connect as..." setting it fails with message:The path does not exist or environment variables in the path could not be expanded to verify whether it exists.I have tried the EC2 admin user I have tried the active directory admin user(admin@activedirectoryxxxxxx.com) and of courset the IIS passthrough user.I have added everyone to a subfolder in the fsx drive. And tried adding various users to the permissions.  Why cant iis find the fsx drive?FollowComment

Answer: 0You can not used the aliased drive name(z:). It has to be the DNS name from the fsx console \DNS_NAME\shareCommentSharekpetrowanswered 7 months ago


Question: Encrypted Amazon RDS DB snapshots shared with another account can't be restored without first copying it locally in the shared account.

"Hey there,I'm looking for a way to share an encrypted RDS snapshot and restore it from the shared tab in the (shared account).More information:Today we have encrypted snapshots in our main account, and we created a shared KMS to share the snapshots between accounts.The process is working, and we can see the shared snapshot in the shared account, but the restored option is disabled.The snapshot is a big one over 3TB. Copying it locally is not an option.Could someone please help me and tell me why AWS is not letting us restore the encrypted shared snapshot directly without copying it?FollowComment"

Answer: "0Accepted AnswerYou have to copy the snapshot to the new account before you can restore it.But yeah, snapshots need to encrypted with a kms key. Kms key needs to be accessible by the account where you are looking to restore the snapshot.CommentShareGary Mcleananswered a month agoLarry a month agowhy can't I restore the snapshot from the shared tab (in the account i want to restore to).i don't want to copy it. because the snapshot is more then 3TB.ShareGary Mclean a month agoYou can always delete the snapshot after you have restored it.ShareGary Mclean a month agoAfraid that’s just the way the process works. You copy the snapshot into your own Rds snapshot area then restore from there.Share"


Question: Remove "server awselb/2.0" header from application responses

"During a pentest of one of our apps running behind an AWS API GW the report showed that the API GW returns a "server awselb/2.0" header, which is identified as a risk by the pentesters. To my knowledge there is no way to remove/suppress such a header, but perhaps I am missing something? Is this something anybody else has ever faced?FollowCommentrePost-User-2589686 6 months agocan you please update on how did you resolve this?Share"

Answer: 0I am facing the same issueCommentShareAWS-User-1125538answered a year ago0Facing the same issue. Is there any WAF that can be used to avoid this issue?CommentShareNeronanswered 3 months ago


Question: Sagemaker Region

"Hi everyone!Im having problems trying to connect to sagemaker on us-east-2, i have no problems with other regions but every project on sagemaker is made on us-east-2, ¿is anyone having same problems? thank u !FollowCommentAWS-User-8567723 9 months agoShould be something specific to your account, please raise a support ticket to investigate.Share"


Question: AWS S3 listObjectV2 Feature Requests

"It is stated in the documentation in listObjectV2 API(Javascript SDK) that "Objects are returned sorted in an ascending order of the respective key names in the list. For more information about listing objects", is it possible to add a feature to sort it in descending order?FollowComment"

Answer: "-1Hello,I understand that you need to list S3 Objects in descending order.I also see that you have read the AWS Documentation about this matter, however it is not clearly stated that there is a way to list S3 Objects in descending order even if you are using the revised API ListObjectV2I have done some research and found that you can use python's sorted function to sort the keys in descending order.Here is a code sample:import boto3s3 = boto3.client('s3')res = s3.list_objects(Bucket='bucketname')output = sorted(res['Contents'],key=lambda i:i['Key'],reverse=True)  print(output)To list object keys programmatically using other languages, please refer to this AWS Document.I hope this helps.CommentShareLungaanswered a year agohowdyhyber a year agoHi Lunga!Thanks for the reply. Is there an equivalent in Javascript SDK for this? That is what I'm using right now, as far as i know based on docs, this is not implemented yet.Sharejmbldwn 6 days agoThis is not a solution if you keep any meaninful number of objects in S3.   It makes no sense that you wouldn't at least allow a reverse sort order.  Even better, let me sort by creation date in either ascending or descending order.Share"


Question: "Connection to Oracle, Bueller? Bueller? Anyone?"

"Hi,I have a DAG that connects to Oracle, I was able to install cx_Oracle requirement, however it needs Oracle's instant client, is there a way to add/install the client?ERROR - DPI-1047: Cannot locate a 64-bit Oracle Client library: "libclntsh.so: cannot open shared object file: No such file or directory".Thanks,VictorFollowComment"

Answer: "0I know that this is an old post, but I'm currently struggling with the same issues and didn't know if anyone had any guidance?I'm currently trying to use cx_Oracle both with both AWS MWAA (v2.0.2) and the AWS MWAA Local Runner (v2.2.3). In both cases, I've tried the following:Installed  libaio in an Amazon Linux Docker imageDownloaded Oracle Instant Client binaries (I've tried both v18.5 & v21.6) to plugins/instantclient_21_6/Copied lib64/libaio.so.1, lib64/libaio.so.1.0.0, and lib64/libaio.so.1.1.1 into plugins/instantclient_21_6/ (I also tried copying /lib64/libnsl-2.26.so and /lib64/libnsl.so.1 like @esloss did above)Created a file plugins/env_var_plugin_oracle.py where I've set the following:from airflow.plugins_manager import AirflowPluginimport osos.environ["LD_LIBRARY_PATH"]='/usr/local/airflow/plugins/instantclient_21_6'os.environ["ORACLE_HOME"]='/usr/local/airflow/plugins/instantclient_21_6'os.environ["DPI_DEBUG_LEVEL"]="64"class EnvVarPlugin(AirflowPlugin):                        name = 'env_var_plugin' Set 'core.lazy_load_plugins' to false in docker/confic/airflow.cfgRecreated Docker imageI'm trying to run the example Oracle DAG here:from airflow import DAGfrom airflow.operators.python_operator import PythonOperatorfrom airflow.utils.dates import days_agofrom datetime import datetime, timedeltaimport cx_Oracledefault_args = {    "owner": "airflow",    "depends_on_past": False,    "start_date": datetime(2015, 6, 1),    "email": ["airflow@airflow.com"],    "email_on_failure": False,    "email_on_retry": False,    "retries": 1,    "retry_delay": timedelta(minutes=5)}def testHook(**kwargs):    cx_Oracle.init_oracle_client()    version = cx_Oracle.clientversion()    print("cx_Oracle.clientversion",version)    return versionwith DAG(dag_id="oracle", default_args=default_args, schedule_interval=timedelta(minutes=1)) as dag:    hook_test = PythonOperator(        task_id="hook_test",        python_callable=testHook,        provide_context=True     )Every time I get the error:cx_Oracle.DatabaseError: DPI-1047: Cannot locate a 64-bit Oracle Client library: "/usr/local/airflow/plugins/instantclient_21_6/lib/libclntsh.so: cannot open shared object file: No such file or directory". See https://cx-oracle.readthedocs.io/en/latest/user_guide/installation.html for helpHowever, I did find that if I add the 'lib_dir' flag to the 'cx_Oracle.init_oracle_client()' method like cx_Oracle.init_oracle_client(lib_dir = os.environ.get("LD_LIBRARY_PATH")) I get a different error which makes me think the issues is somehow related to the 'LD_LIBRARY_PATH' not being set correctly:cx_Oracle.DatabaseError: DPI-1047: Cannot locate a 64-bit Oracle Client library: "libnnz21.so: cannot open shared object file: No such file or directory". See https://cx-oracle.readthedocs.io/en/latest/user_guide/installation.html for helpCommentSharemmccarthyanswered a year agommccarthy a year agoAs an update, I did find that I can get it to work if I go into the Dockerfile of the local runner and add the lineENV LD_LIBRARY_PATH="/usr/local/airflow/plugins/instantclient_21_6"Which makes me think that the whole issue is due to LD_LIBRARY_PATH not being set correctly in plugins/env_var_plugin_oracle.pyShare0Hi,Unfortunately the Oracle client library is not yet part of the MWAA Airflow container image, primarily due to the size of the former. The MWAA team is looking for a way to include a slimmed-down version, however in the meantime an external container needs to be used to connect to Oracle such as ECS or EKS (example of the latter at https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-eks-example.html )Thanks!CommentShareJohn_Janswered 2 years ago0Thanks John,Do you have an approximate ETA on this being added?If size is the concern here are some ideas:Have it external to the image, that's how we manage it currently in our in-house container, we just mount it and point the LD_LIBRARY_PATH to the mounted locationinclude it in the plugins.zip and set a static LD_LIBRARY_PATH=$AIRFLOW_HOME/plugins/libEither one of those approaches simplifies the solution and allows the customer to have control of the Oracle client's version.Regards,VictorCommentShareVictorDCanswered 2 years ago0Thanks Victor!  Those are great suggestions.  The MWAA team is working to add Oracle support and the ticket has been updated to reflect your suggestions to possibly accelerate the implementation.CommentShareJohn_Janswered 2 years ago0Here's a workaround for Oracle support:download https://download.oracle.com/otn_software/linux/instantclient/185000/instantclient-basic-linux.x64-18.5.0.0.0dbru.zip from https://www.oracle.com/database/technologies/instant-client/linux-x86-64-downloads.html as plugins.zipadd the following to the above as zip -j plugins.zip env_var_plugin.pyfrom airflow.plugins_manager import AirflowPluginimport osos.environ square bracket "LD_LIBRARY_PATH" square bracket='/usr/local/airflow/plugins/instantclient_18_5'os.environ square bracket "DPI_DEBUG_LEVEL" square bracket ="64"class EnvVarPlugin(AirflowPlugin):name = 'env_var_plugin'Extract the following files from libaio-0.3.109-13.amzn2.0.2.x86_64.rpm (for example, by running yum -y install libaio on Amazon Linux and copying from /lib64 folder) and add to the /instantclient_18_5 folder of plugins.ziplibaio.so.1libaio.so.1.0.0libaio.so.1.0.1Upload to S3 and select as your MWAA environment's plugins.zip fileTest with the following DAG:from airflow import DAGfrom airflow.operators.python_operator import PythonOperatorfrom airflow.utils.dates import days_agoimport osimport cx_OracleDAG_ID = os.path.basename(file).replace(".py", "")LIB_DIR = '/usr/local/airflow/plugins/instantclient_18_5'def testHook(**kwargs):cx_Oracle.init_oracle_client(lib_dir=LIB_DIR)version = cx_Oracle.clientversion()print("cx_Oracle.clientversion",version)return versionwith DAG(dag_id=DAG_ID, schedule_interval=None, catchup=False, start_date=days_ago(1)) as dag:hook_test = PythonOperator(task_id="hook_test",python_callable=testHook,provide_context=True)Edited by: JohnJ-AWS on Mar 30, 2021 7:43 PMCommentShareJohn_Janswered 2 years ago0Hello John,I did follow the instructions at Creating a custom plugin with Oracle: https://docs.aws.amazon.com/mwaa/latest/userguide/samples-oracle.htmlBut I'm having the following issues for instantclient_18_5 and instantclient_12_2:print("cx_Oracle.version: " + cx_Oracle.version)print("LD_LIBRARY_PATH: " + os.environ\["LD_LIBRARY_PATH"])print("ARCH:", platform.architecture())print("FILES at " _ lib_dir _ ":")for name in os.listdir(lib_dir):print(name)cx_Oracle.init_oracle_client()INFO - cx_Oracle.version: 8.1.0INFO - LD_LIBRARY_PATH: /usr/local/airflow/plugins/instantclient_12_2INFO - ARCH: ('64bit', '')INFO - FILES at /usr/local/airflow/plugins/instantclient_12_2:INFO - libons.soINFO - libaio.so.1INFO - libclntsh.soINFO - libmql1.so...cx_Oracle.DatabaseError: DPI-1047: Cannot locate a 64-bit Oracle Client library: "libclntsh.so: cannot open shared object file: No such file or directory".cx_Oracle.init_oracle_client(lib_dir = os.environ\["LD_LIBRARY_PATH"])cx_Oracle.DatabaseError: DPI-1047: Cannot locate a 64-bit Oracle Client library: "libmql1.so: cannot open shared object file: No such file or directory".So the environment variable LD_LIBRARY_PATH is set by the EnvVarPlugin and also the folder is valid and contains the instantclient files.Is it possible that this solution is somehow broken for Airflow v2.0.2?Thank you!Kind regardsMartinCommentSharemilleckeranswered 2 years ago0Hi!With Airflow 2.0, issue is that plugins are not loaded until used:https://airflow.apache.org/docs/apache-airflow/stable/plugins.html#when-are-plugins-re-loadedThis bypasses setting LD_LIBRARY_PATH in the plugin.Adding the configuration override core.lazy_load_plugins = False should resolve this issue.Thanks!CommentShareJohn_Janswered 2 years ago0Hi There,I followed the steps from this thread, created the plugins.zip, updated MWAA 2.0.2 env. Added the config - "core.lazy_load_plugins" set to False and still getting the error -cx_Oracle.DatabaseError: DPI-1047: Cannot locate a 64-bit Oracle Client library: "/usr/local/airflow/plugins/instantclient_18_5/libclntsh.so: cannot open shared object file: No such file or directory". See https://cx-oracle.readthedocs.io/en/latest/user_guide/installation.html for helpAnyone was able to resolve the error? Is there any other step required to solve this error.Thanks.CommentShareRVCloudanswered 2 years ago0Hi,Please ensure that you've packaged libaio correctly per https://docs.aws.amazon.com/mwaa/latest/userguide/samples-oracle.html#samples-oracle-create-pluginszip-stepsThanks.CommentShareJohn_Janswered 2 years ago0If it helps anyone else, I was able to get the plugin functioning with a couple of additions to the linked instructions.Extract /lib64/libnsl-2.26.so and /lib64/libnsl.so.1 from the container into the local instantclient_18_5 folderAdd os.environ\["ORACLE_HOME"]='/usr/local/airflow/plugins/instantclient_18_5' to the env_var_plugin_oracle.pyFor some reason I wasn't seeing the same error logging in MWAA that I was seeing in local VM testing the cx_Oracle.init_oracle_client, but locally mentioned being unable to load libnsl.so.1 and missing ORACLE_HOME.Edited by: esloss on Oct 12, 2021 12:22 PMEdited by: esloss on Oct 12, 2021 1:06 PMCommentShareeslossanswered 2 years ago0Not a Linux expert, but I did successfully make a plugin following this guide on an Amazon Linux EC2:https://docs.aws.amazon.com/mwaa/latest/userguide/samples-oracle.htmlMWAA version: 2.2.2Some minor changes I made:Requirements:change the constrain file to be version 2.2.2-c https://raw.githubusercontent.com/apache/airflow/constraints-2.2.2/constraints-3.7.txtcx_Oracleapache-airflow-providers-oracleCreate the custom plugin:I used 3 terminal windows on this step.Window 1:Download dependencies.In the end it says "Keep this window open for subsequent steps." It just means to keep this window open, but not use it to run any other following commands.window 2: Download client folder.window 3:Extract files from Docker and make the plugins.zip. In one of the steps,Run zip -r instantclient_18_5 plugins.zip  rather than zip -r ../plugins.zip ./. In the latter case the "client.zip " will be included in the plugins.zip  too.Probably you can combine window 2 and window 3, but like I said, not a Linux expert.To debug, from my experience, I listed the files in the plugins folder to make sure the path is set correctly like millecker@ did. Sometimes the client folder ended up in /usr/local/airflow/plugins/plugins/ folder.Then if it still has the error, something might be missing during the copy. I used my local terminal (Mac OS) to create the plugins, which is about 70MB, and gave me the error. However, when I used Amazon Linux EC2, the plugins.zip is about 90MB and it worked.I don't know exactly why and how, but just hope my post can help someone who is as struggling as I was.CommentShareJannPanswered a year ago"


Question: Assume Role issue - when using Assume Role in Console application inside EC2 instance it is able to retrieve temporary credentials using metadata Service.

"Assume Role issue - when using Assume Role in Console application inside EC2 instance it is able to retrieve temporary credentials using metadata Service. but not able to connect to metadata service when same code used inside windows Service , it again was able to connect to metadata service when fiddler was open. Please let me know what might be the issue . Below are the error and inner errors which is thrown when using inside windows service.One or more errors occurred. Amazon.Runtime.AmazonServiceException: Unable to get IAM security credentials from EC2 Instance Metadata Service. at Amazon.Runtime.DefaultInstanceProfileAWSCredentials.FetchCredentials() at Amazon.Runtime.DefaultInstanceProfileAWSCredentials.GetCredentials() at Amazon.Runtime.DefaultInstanceProfileAWSCredentials.GetCredentialsAsync() at Amazon.Runtime.Internal.CredentialsRetriever.d__71.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Amazon.Runtime.Internal.RetryHandler.d__101.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Amazon.Runtime.Internal.RetryHandler.d__101.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Amazon.Runtime.Internal.CallbackHandler.d__91.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Amazon.Runtime.Internal.CallbackHandler.d__91.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Amazon.Runtime.Internal.ErrorCallbackHandler.d__51.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Amazon.Runtime.Internal.MetricsHandlerExpected BehaviorMy use case is retrieving AWS Temporary Credentials using Metadata service inside EC2 instance . which is also the expected behaviour.Current BehaviorNot able to retrieve Temporary Credentials when code is run inside windows service , but works completely fine when run in a Console Application . or able to run inside windows service when fiddler is open and running .Reproduction StepsAmazonSecurityTokenServiceClient client = new AmazonSecurityTokenServiceClient();var response = client.AssumeRoleAsync(new AssumeRoleRequest{RoleArn = "rolearn",RoleSessionName = "sessionname"});Amazon.SecurityToken.Model.Credentials credentials = response.Result.Credentials;Possible SolutionNo responseAdditional Information/ContextNo responseAWS .NET SDK and/or Package version usedAWSSDK.SecurityTokenAWSSDK..CoreTargeted .NET Platform.NET Framework 4.8Operating System and versionWindows 10FollowComment"

Answer: 0Try the following: https://repost.aws/questions/QUd5z7kzwGSpKmCY7AXn76tg/questions/QUd5z7kzwGSpKmCY7AXn76tg/aws-secret-value-c-net-framework-4-8-unable-to-get-iam-security-credentials-from-ec2-instance-metadata-service?CommentSharevtjeananswered 2 months ago0The error Amazon.Runtime.AmazonServiceException: Unable to get IAM security credentials from EC2 Instance Metadata Service. at Amazon.Runtime.DefaultInstanceProfileAWSCredentials.FetchCredentials() is likely not able to reach or find the instance profile credentials. The call will then cascade through other options described in https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html and I suspect timing out.It would be helpful to understand the call you are making that is generating this error. Can you provide that? Sanitised with any identifying info...CommentShareleftbrainstuffanswered 2 months ago


Question: Step function state to execute a Glue job seems to be stalling

"Hi - I have a step function set up that invokes a glue job. This happens successfully, and the glue job succeeds in about 30 seconds. The step function state simply stays on running, never moving to the next state. I've waited about an hour after the glue job succeeded.Here is my state for the glue job:"Glue-Transform": {"Type": "Task","Resource": "arn:aws:states:::glue:startJobRun.sync","Parameters": {"JobName": "job-name","Arguments": {"--argument.$": "$"}},"Catch": [{"ErrorEquals": ["States.DataLimitExceeded","States.Runtime","States.Timeout","States.TaskFailed","States.Permissions"],"ResultPath": "$.Error","Next": "MapFailed"}],"Catch": [{"ErrorEquals": ["States.ALL"],"ResultPath": "$.Error","Next": "MapFailed"}],"End": true}I haven't been able to find documentation on troubleshooting anything related to this, besides this page which only details how to start a simple job, which I believe I am following correctly: https://docs.aws.amazon.com/step-functions/latest/dg/connect-glue.htmlFollowComment"

Answer: "0Found my answer here - https://stackoverflow.com/questions/56812780/how-to-have-a-python-glue-job-return-when-called-in-step-functionThe solution to my actual problem was permissions. You need four permissions when running a startJogRun.sync:glue:StartJobRunglue:GetJobRunglue:GetJobRunsglue:BatchStopJobRunThose are actually the Terraform values, but should help anybody struggling with this.CommentShareratiugoanswered 2 years ago"


Question: Route network traffic to other network

"Hi,Am using the below template for creating new was transfer family with vpc end point.But we could not reach VPC end point with  other networks.Because it seems to route issue.Can any one please suggest me to fix.Error Screen shotSuccessful screen shot - Currently in productionDescription:  This template create aws transfer family with add user and deploys a VPC and security group, with a pair of public and private subnets spread  across Single Availability Zones. It deploys an internet gateway, with a default  route on the public subnets. It deploys a pair of NAT gateways (one AZ),  and default routes for them in the private subnets, AWSTemplateFormatVersion: '2010-09-09'Parameters:  EnvironmentName:    Description: An environment name that is prefixed to resource names    Type: String  VpcCIDR:    Description: Please enter the IP range (CIDR notation) for this VPC    Type: String    Default: 10.192.0.0/16  PublicSubnetCIDR:    Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability Zone    Type: String    Default: 10.192.10.0/24  PrivateSubnetCIDR:    Description: Please enter the IP range (CIDR notation) for the private subnet in the first Availability Zone    Type: String    Default: 10.192.20.0/24  CreateServer:    AllowedValues:      - 'true'      - 'false'    Type: String    Description: >-      Whether this stack creates a server internally or not. If a server is      created internally, the customer identity provider is automatically      associated with it.    Default: 'true'    Endpointtype:    AllowedValues:      - 'Internal'      - 'Internet facing'    Type: String    Default: 'Internet facing'Conditions:  CreateServer:    'Fn::Equals':      - Ref: CreateServer      - 'true'    Resources:  VPC:    Type: AWS::EC2::VPC    Properties:      CidrBlock: !Ref VpcCIDR      EnableDnsSupport: true      EnableDnsHostnames: true      Tags:        - Key: Name          Value: !Sub ${EnvironmentName} Resources  CloudWatchLoggingRole:    Description: IAM role used by Transfer  to log API requests to CloudWatch    Type: 'AWS::IAM::Role'    Condition: CreateServer    Properties:      AssumeRolePolicyDocument:        Version: '2012-10-17'        Statement:          - Effect: Allow            Principal:              Service:                - transfer.amazonaws.com            Action:              - 'sts:AssumeRole'       GoldcoastTvodUser:    Type: 'AWS::Transfer::User'    Properties:      HomeDirectory: "/goldcoast-tvod"      HomeDirectoryType: "PATH"      Policy:        'Fn::Sub': |          {            "Version": "2012-10-17",            "Statement": {              "Sid": "AllowFullAccessToBucket",              "Action": "s3:*",              "Effect": "Allow",               "Resource": [                "arn:aws:s3:::goldcoast-tvod",                "arn:aws:s3:::goldcoast-tvod/*"              ]            }          }      Role:        'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:role/TransferManagementRole'      ServerId:        'Fn::GetAtt': TransferServer.ServerId      SshPublicKeys:        - >-          ssh-rsa          AAAAB3      UserName: GoldcoastTvodUser  etcsvoduser:    Type: 'AWS::Transfer::User'    Properties:      HomeDirectory: "/etc-svod"      HomeDirectoryType: "PATH"      Policy:        'Fn::Sub': |          {            "Version": "2012-10-17",            "Statement": {              "Sid": "AllowFullAccessToBucket",              "Action": "s3:*",              "Effect": "Allow",               "Resource": [                "arn:aws:s3:::my-bucket",                "arn:aws:s3:::my-bucket/*"              ]            }          }      Role:        'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:role/TransferManagementRole'      ServerId:        'Fn::GetAtt': TransferServer.ServerId      SshPublicKeys:        - >-          ssh-rsa AAAAB3      UserName: etc-svod-user  etctvoduser:    Type: 'AWS::Transfer::User'    Properties:      HomeDirectory: "/tvn-tvod"      HomeDirectoryType: "PATH"      Policy:        'Fn::Sub': |          {            "Version": "2012-10-17",            "Statement": {              "Sid": "AllowFullAccessToBucket",              "Action": "s3:*",              "Effect": "Allow",               "Resource": [                "arn:aws:s3:::my-bucket",                "arn:aws:s3:::my-bucket/*"              ]            }          }      Role:        'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:role/TransferManagementRole'      ServerId:        'Fn::GetAtt': TransferServer.ServerId      SshPublicKeys:        - >-          ssh-rsa AAAAB3      UserName: etc-tvod-user  lhtcsvoduser:    Type: 'AWS::Transfer::User'    Properties:      HomeDirectory: "/lhtc-svod"      HomeDirectoryType: "PATH"      Policy:        'Fn::Sub': |          {            "Version": "2012-10-17",            "Statement": {              "Sid": "AllowFullAccessToBucket",              "Action": "s3:*",              "Effect": "Allow",               "Resource": [                "arn:aws:s3:::my-bucket",                "arn:aws:s3:::my-bucket/*"              ]            }          }      Role:        'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:role/TransferManagementRole'      ServerId:        'Fn::GetAtt': TransferServer.ServerId      SshPublicKeys:        - >-          ssh-rsa AAAAB3      UserName: lhtc-svod-user  lhtctvoduser:    Type: 'AWS::Transfer::User'    Properties:      HomeDirectory: "/tvn-tvod"      HomeDirectoryType: "PATH"      Policy:        'Fn::Sub': |          {            "Version": "2012-10-17",            "Statement": {              "Sid": "AllowFullAccessToBucket",              "Action": "s3:*",              "Effect": "Allow",               "Resource": [                "arn:aws:s3:::my-bucket",                "arn:aws:s3:::my-bucket/*"              ]            }          }      Role:        'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:role/TransferManagementRole'      ServerId:        'Fn::GetAtt': TransferServer.ServerId      SshPublicKeys:        - >-          ssh-rsa AAAAB3      UserName: lhtc-tvod-user  mastercopyfoleuser:    Type: 'AWS::Transfer::User'    Properties:      HomeDirectory: "/mastercopyfiles"      HomeDirectoryType: "PATH"      Policy:        'Fn::Sub': |          {            "Version": "2012-10-17",            "Statement": {              "Sid": "AllowFullAccessToBucket",              "Action": "s3:*",              "Effect": "Allow",               "Resource": [                "arn:aws:s3:::my-bucket",                "arn:aws:s3:::my-bucket/*"              ]            }          }      Role:        'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:role/TransferManagementRole'      ServerId:        'Fn::GetAtt': TransferServer.ServerId      SshPublicKeys:        - >-          ssh-rsa AAAAB3      UserName: mastercopyfole-user    InternetGateway:    Type: AWS::EC2::InternetGateway    Properties:      Tags:        - Key: Name          Value: !Ref EnvironmentName  InternetGatewayAttachment:    Type: AWS::EC2::VPCGatewayAttachment    Properties:      InternetGatewayId: !Ref InternetGateway      VpcId: !Ref VPC  PublicSubnet:    Type: AWS::EC2::Subnet    Properties:      VpcId: !Ref VPC      AvailabilityZone: !Select [ 0, !GetAZs '' ]      CidrBlock: !Ref PublicSubnetCIDR      MapPublicIpOnLaunch: true      Tags:        - Key: Name          Value: !Sub ${EnvironmentName} Public Subnet  PrivateSubnet:    Type: AWS::EC2::Subnet    Properties:      VpcId: !Ref VPC      AvailabilityZone: !Select [ 0, !GetAZs  '' ]      CidrBlock: !Ref PrivateSubnetCIDR      MapPublicIpOnLaunch: false      Tags:        - Key: Name          Value: !Sub ${EnvironmentName} Private Subnet  NatGatewayEIP:    Type: AWS::EC2::EIP    DependsOn: InternetGatewayAttachment    Properties:      Domain: vpc      Tags:        - Key: Name          Value: !Sub ${EnvironmentName} Elsatic Ip  PublicRouteTable:    Type: AWS::EC2::RouteTable    Properties:      VpcId: !Ref VPC      Tags:        - Key: Name          Value: !Sub ${EnvironmentName} Public Routes  PublicSubnetRouteTableAssociation:    Type: AWS::EC2::SubnetRouteTableAssociation    Properties:      RouteTableId: !Ref PublicRouteTable      SubnetId: !Ref PublicSubnet  PrivateRouteTable:    Type: AWS::EC2::RouteTable    Properties:      VpcId: !Ref VPC      Tags:        - Key: Name          Value: !Sub ${EnvironmentName} Private Routes  PrivateSubnetRouteTableAssociation:    Type: AWS::EC2::SubnetRouteTableAssociation    Properties:      RouteTableId: !Ref PrivateRouteTable      SubnetId: !Ref PrivateSubnet  SecurityGroup:    Type: AWS::EC2::SecurityGroup    Properties:      GroupName: "Production Security Group"      GroupDescription: "Security Group with inbound and outbound rule"       VpcId: !Ref VPC      SecurityGroupIngress:      - IpProtocol: tcp        FromPort: 80        ToPort: 80        CidrIp: 0.0.0.0/0      - IpProtocol: tcp        FromPort: 22        ToPort: 22        CidrIp: 0.0.0.0/0      - IpProtocol: udp        FromPort: 69        ToPort: 69        CidrIp: 96.47.148.171/32      - IpProtocol: tcp        FromPort: 22        ToPort: 22        CidrIp: 3.16.146.0/29      SecurityGroupEgress:      - IpProtocol: tcp        FromPort: 80        ToPort: 80        CidrIp: 0.0.0.0/0      Tags:        - Key: Name          Value: !Sub ${EnvironmentName}  TfVPCInterfaceEndpoint:    Type: 'AWS::EC2::VPCEndpoint'    Properties:      VpcEndpointType: Interface      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.logs'      VpcId: !Ref VPC      SubnetIds:         - !Ref PublicSubnet      SecurityGroupIds:        - !Ref SecurityGroup  TransferServer:    Type: 'AWS::Transfer::Server'    Condition: CreateServer    Properties:      EndpointType: 'VPC'      SecurityPolicyName: TransferSecurityPolicy-FIPS-2020-06      LoggingRole:        'Fn::GetAtt': CloudWatchLoggingRole.Arn      Tags:        - Key: Name          Value: !Sub ${EnvironmentName} Transferserver      EndpointDetails:        VpcId: !Ref VPC        SubnetIds:           - !Ref PublicSubnet        AddressAllocationIds:          - !GetAtt NatGatewayEIP.AllocationId      Tags:        - Key: Name          Value: !Sub ${EnvironmentName} TransferserverFollowComment"

Answer: "1The AWS private Link setup needs the following items to be setup.VPC endpointsEndpoint network interfacesEndpoint policiesfor your usecase you mentioned please find a step by step guide to set up the AWS private link.https://docs.aws.amazon.com/vpc/latest/privatelink/getting-started.htmlPlease take a look and try the same.CommentSharepavananswered 2 months agoMahendra Kumar V 2 months agoHi,I have worked slightly with an internet gateway and route table configuration.That will work for me.myCarrierRoute:Type: AWS::EC2::Route#DependsOn: GatewayToInternetAndCarrierNetworkProperties:RouteTableId:Ref: PublicRouteTableDestinationCidrBlock: 0.0.0.0/0GatewayId:Ref: InternetGatewayThanks,Share"


Question: I am getting Access Denied and Incorrect Routing Issues in Deployment of Tailwind Next.js Starter Template on AWS.

"Problem Statement:The tailwind nextjs starter template is unable to be deployed properly on AWS using Github Actions. The deployment process involves pushing the export files to S3, and displaying them using S3 + Cloudfront + Route53.One of my domains example: https://domainA.com works by just sharing this files to S3 without exporting them (Using github actions, I share this files to s3 and then connect it with cloudfront using Origin access identity. (It is working as expected)but another one of my domains example: https://domainB.com doesn't work and gives access denied issue. (I checked bucket policy and it allows access to s3 bucket, bucket is publicly accessible)I want to solve above error, please suggest options.Now coming to another problem, As I have realized that the files in S3 should be output files andso I now export this files to s3 locations using github actions. The cloudfront is connected to s3 bucket using OAI or public origin access. Once everything is setup correctly, I am able to route to my domain but it is unable to work properly. I am assuming that the system is unable to locate additional files from S3 that it needs.how can I also solve above error.FollowComment"

Answer: "0It is hard to say what the exact issue might be, but a few things to try.Can you access the content directly using the S3 URL?Can you access the content using the CloudFront domain name (e.g. abcd12345.cloudfront.net)?Also, which error code is returned when you say access denied? 403? A 403 can happen when access to the specific object is restricted OR when the requested object does not exist. The default action for S3 is to return a 403 for missing objects, as opposed to 404, which is done as a security precaution.CommentShareJeremyAWSanswered 4 months agoAdit 4 months agoThank you for your response! I am unable to access the content through either the S3 URL or the CloudFront for https://domainB.com (PS - https://domainA.com is accessible only on Cloudfront and not on S3). I am receiving a 403 error, and I suspect it has something to do with a missing object.Considering this, I would appreciate any input or suggestions on how to proceed in resolving this problem.Share"


Question: Amazon Linux 2023 Where is xdebug?

As the title says - is xdebug available for Linux 2023?FollowComment

Answer: "1Xdebug is an extension for PHP, and provides a range of features to improve the PHP development experience.Step Debugging. A way to step through your code in your IDE or editor while the script is executing.how to install Xdebug on Amazon Linux.Update your system packages:sudo yum updateInstall the EPEL repository, which provides additional packages, including Xdebug:sudo amazon-linux-extras install epelInstall the appropriate PHP development package:3.1. For PHP 7.x:sudo yum install php-devel3.2. For PHP 8.x:sudo yum install php80-develInstall the Xdebug extension:sudo yum install php-xdebugEnable and configure Xdebug by editing your php.ini file, typically located at /etc/php.ini or /etc/php.d/xdebug.ini.Add the following lines to enable remote debugging:inizend_extension=xdebug.soxdebug.mode=debugxdebug.start_with_request=yesxdebug.client_host=<YOUR_HOST_IP>xdebug.client_port=9003Replace <YOUR_HOST_IP> with the IP address of your development machine.Restart your web server (Apache or Nginx) to apply the changes:6.1. For Apache:sudo systemctl restart httpd6.2. For Nginx:sudo systemctl restart nginxRestart the PHP-FPM service if you are using it:sudo systemctl restart php-fpmCommentShareEXPERTsedat_salmananswered 2 months agomike 2 months agoThanks for the attempt but....These instructions work for Linux 2 but not for 2023.It fails at:sudo amazon-linux-extras install epelwithsudo: amazon-linux-extras: command not foundAny one know what happened to linux-extras for 2023?Edit: I just found in the release documents: However, AL2023 doesn't support EPEL or EPEL-like repositories.Share0Sorry you are righti have tested the steps Installation From Source @ https://xdebug.org/docs/install#linuxby installing php-devel and gitso i managed to install php xdebug on amazon 2023 maybe this works for younote 1: replace git:// with https://note 2 : run rebuild sith sudeo ./rebuild.sh to compile and deploy xdebug then follow the other stepsCommentShareEXPERTsedat_salmananswered 2 months agomike 2 months agoI was hoping to avoid compiling from source but -- since you have been so good as to try it and you say it works I will give it a go.ThanksSharesedat_salman EXPERT2 months agoGood Luckand please update this post if you find another way to do i tShare"


Question: Cross Region private link

I'd like to be able to configure private link across regions as a provider only supports it's product in a region they we don't have our workloads in.  Currently this is not available ( Feb 2022 ).  Is the current best practice to setup the private link in the same region as the provider then use VPC peering to connect back to my application in the "other region"?FollowComment

Answer: "2Accepted AnswerBasis for the pattern is from this whitepaper - https://d1.awsstatic.com/whitepapers/aws-privatelink.pdfDeploy a dedicated VPC in vendor region in your accountCreate a Private Link connection between Vendor account and your accountCreate a cross region VPC peering connection between your VPCsCommentShareAJ_Canswered a year agoEXPERTBrettski-AWSreviewed a year agoPaul-K a year agoThanks for that reference and for confirming AJ.ShareAWS-User-1585900 a year agowill it work with Transit Gateway connection between regions instead of cross region VPC peering ?Share0Hey AWS-User-1585900 -  typically if you are interacting with a 3rd party provider you want to use Private Link and not use something like a transit gateway. Connecting all of your own VPCs together across regions, transit gateway peering would be perfect.CommentShareAJ_Canswered a year ago"


Question: ClientError while uploading files to AWS

"Hi, I'm using a django file upload project and this issue keeps on popping up.An error occurred (SignatureDoesNotMatch) when calling the CreateMultipartUpload operation: The request signature we calculated does not match the signature you provided. Check your key and signing method.This is my settings.pyAWS_STORAGE_BUCKET_NAME = 'bucket-name'AWS_S3_REGION_NAME = 'region-name'My .envAWS_ACCESS_KEY_ID='Access_key_ID'AWS_SECRET_ACCESS_KEY='Secret_Key_ID'A detailed helpful with step-by-step procedure to solve this issue would be highly helpful as I'm super beginner with AWS (I started this project 2 days ago).Thank youFollowComment"

Answer: "1The "SignatureDoesNotMatch" error typically indicates an issue with the request signature used to authenticate the request to AWS. Here are a few things to check to resolve this issue:Ensure that the AWS access key and secret access key in your .env file are correct and have sufficient permissions to perform the desired operation on the S3 bucket.Ensure that the region name specified in your settings.py file matches the region where your S3 bucket is located. You can check the region in the AWS Management Console or by running the aws s3api get-bucket-location --bucket <bucket-name> command in the AWS CLI.Verify that you are using the correct endpoint URL for the S3 service in your Django code. The endpoint URL should be in the format https://s3.<region-name>.amazonaws.com or https://s3.<region-name>.amazonaws.com/<bucket-name>. If your bucket is in a region other than us-east-1, you should use the former format.Check that the system time on the server running your Django application is correct. If the time is not synced with the AWS servers, it can cause authentication issues.Ensure that the version of the AWS SDK you are using is compatible with the version of the S3 API you are trying to access. You can check the API version in the AWS documentation or by running the aws s3api get-bucket-versioning --bucket <bucket-name> command in the AWS CLI.If you have tried all of the above and are still encountering issues, you may want to enable AWS CloudTrail to log API requests and responses to help diagnose the issue. Additionally, you can try enabling debug logging in the AWS SDK for Python to get more detailed error messages.CommentSharemishdaneanswered 2 months ago"


Question: I accidentally put root user into my sftp group and now I cannot log in

"I was using aws linux server and MobaXterm. While I was in the server I accidentally put root user into my sftp group using command:sudo usermod -a -G sftp ubuntuand now I exited the server and when I tried to log back in I receive this error mes on MobaXterm:Saying "This service allows sftp connection only"I do not have any other user besides root user. Now I cannot log in to my server, I can only log in to my sftp. Is there any fix to this?FollowComment"

Answer: "0Hi,It looks like you have forced internal-sftp service for sftp group in /etc/ssh/sshd_config file.  Now that you added the default ubuntu user to sftp group, it will only allow ftp connection for ubuntu user.  Use one of the following methods to remove the ubuntu user from sftp group and regain ssh access.Option 1If your EC2 instance is managed by AWS Systems Manager, you can use the Run Command feature to execute following command in the instance. This will remove the ubuntu user from sftp group.gpasswd -d ubuntu sftpFor more details about running remote commands on an EC2 Instance with AWS Systems Manager see following documentation.https://aws.amazon.com/getting-started/hands-on/remotely-run-commands-ec2-instance-systems-manager/After creating the instance profile, attach it to your EC2 instance and reboot the instance. Since you already have an EC2 instance running, you can skip Steps 2,3 & 5.Option 2If you can stop the instance, you can re run the user-data to remove the ubuntu user from sftp group.  You can use following user-data script to achieve this.Content-Type: multipart/mixed; boundary="//"MIME-Version: 1.0--//Content-Type: text/cloud-config; charset="us-ascii"MIME-Version: 1.0Content-Transfer-Encoding: 7bitContent-Disposition: attachment; filename="cloud.cfg"#cloud-configcloud_final_modules:- [scripts-user, once]--//Content-Type: text/x-shellscript; charset="us-ascii"MIME-Version: 1.0Content-Transfer-Encoding: 7bitContent-Disposition: attachment; filename="script.sh"#!/bin/bash -xgpasswd -d ubuntu sftpRefer to following KC article for the steps re run the user-data in an an existing EC2 instance.https://aws.amazon.com/premiumsupport/knowledge-center/execute-user-data-ec2/CommentShareRenjith_Ranswered 10 months ago"


Question: Insight into Accuracy/Reliability of Redshift SVV_TABLE_INFO.estimated_visible_rows

"I am looking at the documentation for SVV_TABLE_INFO and know that the estimated_visible_rows column doesn't include rows marked for deletion (unlike the tbl_rows column, which does include these rows). However, I couldn't find any additional information into the overall accuracy/reliability of the estimated_visible_rows column. Is anything else estimated, besides rows that may/may not be marked for deletion? What is the guaranteed maximum delay in this number being updated (hours, days?).FollowComment"

Answer: "1This is an advanced topic - SVV_TABLE_INFO is a system view so you can check its DDL to find where the column it comes from.First run show view SVV_TABLE_INFO;. According to the DDL, estimated_visible_rows is defined as following.(psi.stairows) :: numeric(38, 0) AS estimated_visible_rows,In the DDL, you can find that psi an alias for pg_statistic_indicator.The document says:Stores information about the number of rows inserted or deleted since the last ANALYZE. The PG_STATISTIC_INDICATOR table is updated frequently following DML operations, so statistics are approximate.To answer your question, this number is approximate and there's no guaranteed maximum delay since ANALYZE happens automatically or triggered by user. Check STL_ANALYZE for ANALYZE operation history.CommentShareYota_Hanswered 4 months ago"


Question: TypeError: ecs.tagResource is not a function

"Hi,Trying to work out why I cant tag a Running ECS Task via Lambda.  I've enabled the new ARNs in ECS.  Using Node.js 6.10 runtime.  Error message seems to indicate that the function doesnt exist on the object Im calling (See Code).What am I doing wrong, is the function on a different object?  Also if I try to tag when starting the task, it tells me that the "tags" property is unexpected.Many Thanks!Paul.Example Code:'use strict';var AWS = require('aws-sdk');var ecs = new AWS.ECS();exports.handler = (event, context, callback) => {if(event['id'] && event.id!=null && event.id.length>0){var params = {resourceArn: process.env.PREFIX _ "/" _ event.id,tags: [{key: "TestTag",value: "TestTag"}]};ecs.tagResource(params, function(err, data) {if (err){console.log(err, err.stack); // an error occurredcallback(null, { status: true });} else {console.log(data);           // successful responsecallback(null, { status: true });}});}else{callback(null, { status: true });}};Output:2019-05-10T17:03:12.966Z7ae84b85-846f-4638-845c-3414fc96f009TypeError: ecs.tagResource is not a functionat exports.handler (/var/task/index.js:17:14)FollowComment"

Answer: 0Fixed by changing the run time.  Had to use NodeJS 10.x.CommentShareBafflingTangentanswered 4 years ago


Question: Endpoint already registered with a different token error while trying to create a new platform endpoint

I am trying to create a new Platform Endpoint at my Platform Application and receiving this error message while inputting some device tokens: "Invalid parameter: This endpoint is already registered with a different token".Currently I've checked and the device tokens inputted were not being used by another existing platform endpoint at the same platform application. If I try to create the same Platform Endpoint at another Platform Application it works fine.FollowComment


Question: "Deleted Route53 Hosted Zone, but A records are still populated"

"I moved my domain to a service outside of AWS.  I deleted the Route53 Hosted Zone with the DNS entries for my domain.  However when I do a DNS Lookup on the domain, it still resolves to the two Amazon IPs that contain it in an A record.   It's been a few days now and the TTL is set to 600 seconds but AWS won't release those DNS entries.  Does anyone have any idea why this is happening?  I have zero resources related to that domain that exist anymore.Any ideas why these are still populated?nslookup my-domain.comServer:         172.17.160.1Address:        172.17.160.1#53Non-authoritative answer:Name:   my-domain.comAddress: 15.X.X.X (AWS IP)Name:   my-domain.comAddress: 3.X.X.X (AWS IP)FollowComment"

Answer: "0The reason might be that the DNS records haven't yet expired. TTL (Time To Live) determines how long the records will be cached by the resolvers. If the TTL value is set to 600 seconds, it means that the DNS resolvers will cache the records for 10 minutes. You need to wait until the TTL value expires, and then perform the DNS lookup again to see if the AWS IPs have been released.If the issue persists even after the TTL has expired, you can try the following:Clear the cache of the DNS resolver that you are using to perform the lookup.Try the lookup from a different DNS resolver to confirm if the issue is specific to your current resolver.If the issue still persists, you can reach out to the service provider you moved your domain to and ask for assistance.CommentShareGabriel Olaleyeanswered 4 months ago"


Question: Nvidia Driver Issue

I have an ec2 m4.xlargeRef: ec2-100-25-182-26.compute-1.amazonaws.comos: ubuntu 22.04Display INFO:ubuntu@ip-172-30-4-91:~$ sudo lshw -C display*-display UNCLAIMEDdescription: VGA compatible controllerproduct: GD 5446vendor: Cirrus Logicphysical id: 2bus info: pci@0000:00:02.0version: 00width: 32 bitsclock: 33MHzcapabilities: vga_controllerconfiguration: latency=0resources: memory:f0000000-f1ffffff memory:f3008000-f3008fff memory:c0000-dffffI install nvidia-driver-525-server in this instance but when I check by"nvidia-smi" command it showsNVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver. Make sure that the latest NVIDIA driver is installed and running.Please solve the issueFollowComment

Answer: "0The m4 instance type is the one that does not have a GPU running, so try changing the instance type.GPUs can be used, such as the P4 and G5 listed in the following document.https://aws.amazon.com/ec2/instance-types/?nc1=h_ls#Accelerated_ComputingCommentShareEXPERTRiku_Kobayashianswered 10 days ago"


Question: Question on overwrite and multiagent syncing

"Hi. I had a question on the "Overwrite files" flag, which I wasn't sure about, and cant find an exact answer on. Does enabling this flag overwrite each and every file that it finds in the source to the destination, or does it overwrite ONLY changed files based on the checksum?If it's the former, which options should I choose so that AWS only uploads new and changed files (to accommodate a case where eg. only half the file has been pushed into S3 before the agent went down)?One other question. Is it possible to have 2 x Agents syncing from 2 different locations into one destination bucket?Thanks.FollowComment"

Answer: "01/ Overwrite will only apply to files that changed on the source.2/ You can have two agents write to the same bucket in parallel, but it's only recommended if you're writing to different prefixes, to avoid conflicts.Regards,OlgaCommentShareAWS-User-9583871answered 3 years ago0Great, thanks Olga!CommentSharegdeployanswered 3 years ago"


Question: "Unable to start the environment. To retry, refresh the browser or restart by selecting Actions, Restart AWS CloudShell."

"I can´t use AWS CludShell.I created a root user ferku3108I checked refresh the website, restart CloudShell, but still the same.I used the available areas.What could happen?Thank You.FernandoFollowCommentAWS-User-8346588 a year agoSame issue. Looking for solutionShareAWS-User-3586868 a year agoSame Issue.  It works in my root account but not in the IAM user account even though i have attached AWSCloudShellFullAccess policy to the user group. And i have checked in policy simulator there i see no errors. I even switched browsers, switched regions and restarted the environment but still same error. 'Unable to start the environment. To retry, refresh the browser or restart by selecting Actions, Restart AWS CloudShell.'ShareMaulik_Makadiya a year agoCan you see any exception in browser? Did you check with full admin permission or by creating new ADMIN user just to isolate the problem?Also check if any DENY policy created for it ? this could also create an issue.ShareAWS-User-3586868 a year agoso i tried in different browser as IAM user, throws same error but no issues with root user.i created new IAM user and assigned 'AdministratorAccess' and 'AWSCloudShellFullAccess' policy basically admin which should work but it didn't. And no DENY policy is found. idk what i'm doing wrong... is there a policy that i'm missing out ?ShareMaulik_Makadiya a year agoI tried to replicate this issue but not able to replicate. things you can tryCheck in different regions..Check cloudtrail log of that user to see if you can find any useful logcheck AWSCloudShellFullAccess policy to ensure it has below JSON data.{"Version": "2012-10-17","Statement": [{"Action": ["cloudshell:"],"Effect": "Allow","Resource": ""}]}Check in different browser to see if it works in different browser or not.  - https://docs.aws.amazon.com/cloudshell/latest/userguide/troubleshooting.htmlDid you deleted cloudshell home directory or something? Try after resetting home directory. But it can DELETE all your data exists in home durectotyohttps://docs.aws.amazon.com/cloudshell/latest/userguide/vm-specs.html#deleting-home-directoryShareShow 5 more comments"

Answer: "-1So i was able to resolve this issue with the help of AWS repost user @Maulik_Makadiya.Few things to try to create CloudShell environment:Time Synchronization: Make sure Your machine time is accurate. It means its correct based on world time. did you try from another machine to see if its working there? may be any time sync related issue?Check in different regions..check AWSCloudShellFullAccess policy to ensure it has below JSON data.{    "Version": "2012-10-17",    "Statement": [        {            "Action": [                "cloudshell:*"            ],            "Effect": "Allow",            "Resource": "*"        }    ]}Check in different browser to see if it works in different browser or not. https://docs.aws.amazon.com/cloudshell/latest/userguide/troubleshooting.htmlDid you deleted cloudshell home directory or something? Try after resetting home directory. But it can DELETE all your data exists in home directory. https://docs.aws.amazon.com/cloudshell/latest/userguide/vm-specs.html#deleting-home-directorycheck if any DENY policy created for it. remove that.It is possible your account is not 100% verified. Try this: Create a CloudFront distribution if you get the below error it confirms your account is unverified or if you can create 2 distributions and can't create the 3rd one.Your account must be verified before you can add new CloudFrontresources. To verify your account, please contact AWS Support(https://console.aws.amazon.com/support/home#/ ) and include thiserror message.Click the support linkNavigate to:Support / New case / Service limit increaseLimit type:CloudFront DistributionsIn Requests select:Limit: Web Distributions per AccountNew limit value: <TYPE_YOUR_NEW_VALUE_HERE>MY CASE: In my case, I had 2 distributions, wanted to create 3rd, but couldn't. So I have put as <TYPE_YOUR_NEW_VALUE_HERE> a number 10.Note: If nothing works choose last option as your last resort to confirm your account is verified.hope it helps.CommentShareAWS-User-3586868answered a year ago"


Question: Domain setup on Route 53 + Lightsail Server

"Hi,I am very new in domain registration and setup but I am willing to learn. I have done the following and couldn’t make it work so far:I have transferred domain from Bluehost to Route53 without dns zone transfer.I have cancelled hosting from BluehostI have created a lightsail instance and created static ipI have created Hoste Zone on Route 53 with the following record:NS from LightsailSOAVerified domain on Route 53 using SES and published the records to Route 53 which added 3 CNAME record.Verification status Pending on SESWhen I check with DNS checker  for printpluscopycenter.comA record is not resolved everywhere, only 3 – 7 places and it keeps changing…What should I do next?Thank youFollowCommentYoungCTO_quibski a year agoHow is this so far? Hard to debug without seeing actual infoShareAlex a year agoUpdate:I have created a dns zone on lightsail.got those name serverscreated A record and CNAME record pointing at static ipOn Route 53copied those name servers from lightsail and created ns recordcreated A record and CNAME record (exact same one) - i think i need to delete them but i am not sure.created MX recordSOATXT records for google workspace mail.Share"

Answer: "0Hello Alex, Do you still need help with your project? Please let us know.Kind Regards,MonicaCommentShareSUPPORT ENGINEERMonica_Lluisanswered a year agoAlex a year agoYes PleaseShare"


Question: Assigning resources fails in AWS Backup

"Hi all,I've been trying to setup an AWS Backup plan, and when assigning a resource to the plan I've created, I get the spinning action wheel and nothing further happens.I've tried:Waiting to see if it's just taking a long time.Using a different brand of browser.Using a custom plan instead of the regular plan.Sending to the default vault, or a custom vault.Using a different computer to access the dashboard.Assigning both the EBS instance or the EC2 instance.In all cases, the result is the same.  I hit the final button to assign resources, and it just spins and spins.Am I missing something fundamental here, or is there a known issue?Cheers,CoullsFollowComment"

Answer: "0For those looking for the answer:There's a quirk of logic, where you can have the permission to create/destroy EC2 instances, create/destroy backup plans, create/destroy vaults, but even though you can select which ec2 instance to back up, that doesn't mean you have permission to hit the "Assign Resource" button... even though the UI lets you.The fix is to check your account has the "AWSBackupFullAccess" policy. It doesn't change what you have access to, but now clicking the button won't hang indefinitely.Cheers.CoullsCommentShareCoullsanswered 2 years ago"


Question: Is it possible to ingest data using Kinesis Data streams without creating an IAM user?

I was looking at ways in which we can ingest data using Kinesis data streams without creating an IAM user & generating access & security tokens.Possible alternatives I have found include:Let api gateway assume a role with correct permissions & use it to send data. I think this might be prohibitively expensive. Any insights?Generate temporary credentials using STS & send it to end user. Drawback would be needing to replace credentials every now and then.Maybe use anonymous users functionality in Cognito identity pool & allow access to Kinesis that way. Not sure if this is even viable.Any insight would be very valuable. Thanks in advance!FollowComment

Answer: "0using IoT CoreYou can use IoT Core rules to work with Kinesis. In this case, you need a device certificate.https://docs.aws.amazon.com/iot/latest/developerguide/kinesis-rule-action.htmluse device certificate to get STShttps://docs.aws.amazon.com/iot/latest/developerguide/authorizing-direct-aws.htmlThis also uses a device certificate, but you can get an STS token to access Kinesis directly.  　use Lambda function URLshttps://docs.aws.amazon.com/lambda/latest/dg/urls-auth.htmlLambda function URLs can be made without authentication, so it is possible to call Kinesis from Lambda. We do not know if it can withstand high loads or how much it will cost.Using AWS SigV4 Proxyhttps://github.com/awslabs/aws-sigv4-proxyNo authentication information is required for the application, but authentication information is required for the Proxy.Sorry, I couldn't come up with a good idea. 😥😥.CommentSharemoritalousanswered a year ago0Using AWS Lambda to process Kinesis Data Streams is a way to do this. You can specify the permissions in the IAM Role assigned to the Lambda function. See: https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.htmlCommentShareRodney Lesteranswered a year ago"


Question: Create an AWS organization with a production account with running workloads

"Hello,I want  to create an AWS organization but I'm a bit worried about my production services.I have an AWS account with all my workloads running in production.I decided to manage those workloads by splitting in multiple accounts, like dev, pre, pro; however in the meanwhile I want to keep my "legacy" workloads running.Is there any risk, when creating an organization, to loose any of the running services? Like EC2, RDS, EKS and so on.Thank you!FollowComment"

Answer: "0The AWS Organization management/payer account should not have any workloads on it. These should be separated into member accounts and OUs. With that being said the recommendation would be for you to create a new AWS Account and use that account as the management account for your AWS Organization. On the management account you can define your OU structure and them invite the existing accounts to join your organization. You can see additional information on how to do that here.Also important to point out that when you invite accounts to join your organization, you do not automatically have full administrator control over the account, unlike accounts created directly in AWS Organizations. If you want the management account to have full administrative control over an invited member account, you must create the OrganizationAccountAccessRole IAM role in the member account and grant permission to the management account to assume the role.Inviting accounts or removing them from your organization should not have any impact on workloads except if you have any SCPs enabled. If you are using SCPs these policies can block accounts from calling AWS APIs thus bringing down workloads running on the accounts. I would suggest you only leave the 'FullAWSAccess' policy attached to root. You can then create OUs with the SCPs attached that you think you will need. You can then move test accounts into these OUs to make sure you get the effect that you want. After that you can move production accounts into these OUs and change out the SCPs on root if you want. You can also use IAM policy simulator to view the effects of SCPs.CommentShareAWS-User-9543277answered 2 months agoEXPERTkentradreviewed 2 months agorePost-User-9050467 2 months agoThanks for your answer.Yes, I understand the implications of running workloads in a management account; however I'm not able due to business requeriments to risk a currently running workload, while migrating to a well-organized accounts topology.So, is there any risk, when creating an organization, to impact anyway in those running services like EC2, IAM users/roles/policies, and so on?Share"


Question: Single CI/CD pipeline to deploy application in Multiple region including China

"I am working for a customer for few workload. Earlier we were deploying application only in us-east-1 region. Now customer want to deploy same workload (with few geo specific changes) in  AWS China Beijing region. Customer want to deploy same application at same time and ask me explore option to deploy it from a single pipeline. I gone through various AWS document, but nothing is available for same as China is not available in AWS Global region name.FollowComment"

Answer: "2Accepted AnswerYou can build and deploy the application to both Regions using the AWS CI/CD services from the non-China Region.  You can setup a pipeline only in US region with deploy option in China as well.You can refer https://aws.amazon.com/blogs/architecture/field-notes-how-to-deploy-end-to-end-ci-cd-in-the-china-regions-using-aws-codepipeline/ for same.Disclaimer: This blog is published when AWS Code Pipeline was not available in China. As same is available now, solution can be fine tuned.CommentShareNirmalanswered a month agoMichel a month agoSuggested solution mentioned in the blog. Thanks for help.Share0What about using GitHub Actions for deployment?I think there is a way to use GitHub to manage code and deploy with CodeDeploy in an environment where CodePipeline is available, and use GitHub Actions in the China region.CommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: Cloudformation-stacks-X rollback_complete

"While working on a class exercise I ran into a x rollback_complete. Is it a lab that needs skipped I cannot tell if it is an error on me ,the .yaml or aws.the instructions for exercisecreation in progress events of creation top of list events of creation bottom of list I attempted stack creation with existing resourcesFollowCommentAWS-TimG 8 months agoThe error on your 4th screenshot shows that the table already exists.  Do you already have a DynamoDB table with the name 'Employees' in the region.  Open DynamoDB console and check for existing tables.Share"

Answer: "0Hi - The status reason mentioned in your screen shot says "Resource handler returned message: "Resource of type 'AWS::DynamoDB::Table with Identifier Employees already exists".Cross check your DynamoDB in the region where you are running this cloudformation or try to do this in another region. Not sure if your conflicting DynamoDB::Table with same identifier is a test or a real one. Please be careful before deleting anything.CommentShareEXPERTAWS-User-Nitinanswered 8 months ago595 8 months agohah yes, I didn't see past the exercise-containers and cloud9, I had taken a networking class subneting and firewalling assorted userIAMs and thought maybe the firewall. Never crossed my mind that I had to CSV the employee list.Thank youShare"


Question: Enable Cost Explorer service

"Hi,I followed the tutorial  for enabling the Cost Explorer service.But when I go to the Home page I have this message:"Please contact your payer account to enable Cost Management data services."I am signed-in with my root accountThanks,FollowComment"

Answer: "1Accepted AnswerSounds like you have more than one AWS account in an Organization where this is a member account.  Does that sound right?  You have to enable cost management in the Management AWS account.CommentShareEXPERTskinsmananswered 2 months ago0Thank you ! You were right, I had more than one account in an OrganizationCommentSharevmqtanswered 2 months agoEXPERTskinsmanreviewed 2 months agoskinsman EXPERT2 months agoThat's great, please Accept my answer if you get around to it, to make it more visible for other people with a similar issue.Share0Is there a way to know if I have another AWS account in my Organization ?CommentSharevmqtanswered 2 months ago0You can check in the "Organizations" service in the AWS console - it will tell you what your Organization ID is and show the management account ID and root user email address.CommentShareEXPERTskinsmananswered 2 months ago"


Question: Unable to create domain name

"Hi Friends,I am using AWS Free tier.May I know why I am not able to create Domain Name (besudomainpoc.com) in free tier account? Can you kindly check and let me know limitations if any on this please?Please refer to attached email notification from AWSFollowCommentMatt-B EXPERT5 months agoHi ThereIm not seeing any attachment, can you post the details of the error/email you received?Share"

Answer: "0Accepted AnswerYou need buy a domain, you can´t use a "free domain".https://d32ze2gidvkk54.cloudfront.net/Amazon_Route_53_Domain_Registration_Pricing_20140731.pdfCommentSharepinguinouyanswered 5 months ago0Thank you for the response.CommentShareGBanswered 5 months ago"


Question: Custom Identity Provider - Restricted

"If using a custom identity provider, can the lambda return a value in the user authentication response that indicates the user should be operating in 'restricted' mode? The built-in provider has a checkbox, but the custom identity provider documentation doesn't mention any return values that communicate that the user was stored as 'restricted' and therefore should only be allowed to access the home folder.I have yet to be able to create a working scope-down policy that performs the 'restricted' mode. All the examples continue to fail with 'Access Denied'. Setting the policy to allow read/write to the S3 directly works, but obviously gives the user access to navigate throughout the S3 bucket.Allowing the custom identity provider to specify 'Restricted' would eliminate the scope-down policy complexity.FollowComment"

Answer: "0I think I just realized the Logical home directory type with mapping of a top-level path to the S3 path IS the restricted mode.CommentSharejtdanswered 2 years ago0Hello jtd,To use Restricted mode with Custom Identity Provider, you would have your IDP or your Lambda function return the HomeDirectoryDetails field along with the HomeDirectoryType field.HomeDirectoryDetails field specifies your User configuration or landing directories within S3/EFS. HomeDirectoryType field specifies whether you want Logical Directories or Path based Directories. Logical is one that imitates the Restricted Option on AWS Console.Example:HomeDirectoryType: LOGICALHomeDirectoryDetails: [{"Entry": "/folder-a", "Target": "/my-bucket/folder-a"}]You can also find more details on Logical Directories in the following blog post - https://aws.amazon.com/blogs/storage/simplify-your-aws-sftp-structure-with-chroot-and-logical-directories/Let me know if you have further questions.SagarCommentShareEXPERTsagarb-awsanswered 2 years ago"


Question: AWS scan and query not working as intended

"Hi,I have a table in DynamoDB that has approximately 2.2 million entries. I am trying to use the AWS CLI to scan 10 thousand entries from the table. However, the following command:aws dynamodb scan --limit 10000 --table-name <table_name>Only returns around 4 thousand entries, with a LastEvaluatedKey. I also tried it with a query command, and I get similar results. Does anyone know why it does not return 10 thousand entries, and how I can fix it? Thanks.FollowCommentLeeroy Hannigan EXPERTa year agoCan you run the command with the --debug flag? Does it return all the entries when you remove the --limit param?ShareMLGuy a year agoWhy are you scanning for so many items? It is better to export the data to S3 and use Athena to query the data in a richer and more cost-effective way.Share"

Answer: "3When you Scan with the CLI pagination happens automatically as described here, however, when you introduce --limit this prevents the CLI from auto-paginating resulting in the request returning the first 1MB worth of data, as described here.This is further documented in the Scan CLI Docs:A single Scan operation reads up to the maximum number of items set (if using the Limit parameter) or a maximum of 1 MB of data and then apply any filtering to the results using FilterExpression . If LastEvaluatedKey is present in the response, you need to paginate the result set. For more information, see Paginating the Results in the Amazon DynamoDB Developer Guide .TLDR:CLI auto-paginates Scan/Query requests only if you do not provide --limit param, in which case it will return the first 1MB of data.CommentShareEXPERTLeeroy Hannigananswered a year ago2How much data was returned with that 4000 entries? If it exceeds 1 MB then the scan will return less than 1 MB and indicates the pagination with the LastEvaluatedKey.Quote from our documentation:DynamoDB paginates the results from Scan operations. With pagination, the Scan results are divided into "pages" of data that are 1 MB in size (or less). An application can process the first page of results, then the second page, and so on.A single Scan only returns a result set that fits within the 1 MB size limit.CommentShareEXPERTToni_Sanswered a year ago"


Question: Athena: Missing columns from DDB data source

"Hi,I'm using a DynamoDB connector in Athena to be able to query a DDB table and also use the data in QuickSight. I was able to set up the data source and query the table fine for the most part, but I've noticed that there are several columns missing in Athena. I've verified that they exist in DDB, but when I try to query in Athena (e.g. SELECT column_name FROM table_name), it says that the column cannot be resolved.I'd appreciate any tips/pointers -- thank you!FollowComment"

Answer: "0I have been struggling with this one myself. I achieved solving my problem by crawling the DynamoDB table with AWS Glue and let AWS Glue infer the schema.In AWS Glue, create a new database with its Location URI or Location set to the value dynamo-db-flag - use this exact value; otherwise, Athena won't see the future table.In AWS Glue, create a crawler:Select DynamoDB as the data source.For the table name, give the same table name as your dynamodb table.For the target database, choose the database you just created.Run the crawler.In AWS Glue, after the Crawler ran successfully, verify the table's schema, which the crawler just populated. Edit the table in Glue to add two additional table properties (Table > Edit Table Property > Table Properties):sourceTable is the exact name of your dynamodb table, matching case. E.g. if my dynamodb table is named DbUsersTableXDXDXDXDX-SZSZSZSZSZSZSZ, sourceTable property's value has to be DbUsersTableXDXDXDXDX-SZSZSZSZSZSZSZ.columnMapping defines column name mappings. In AWS Glue catalog, column names should be in lowercase. So, this entry is necessary.  E.g. if your table has 3 column: id, email, createdAt, the value of columnMapping is id=id,email=email,createdat=createdAt, (Glue column name) in the left side of each mapping (=).After saving the changes, go to Amazon Athena, for the DataSource DynamoDB (from the dynamodb connector), select the new database you created in (1), the table should be here.CommentShareHerveanswered 2 months ago-1Have you tried:https://docs.aws.amazon.com/quicksight/latest/user/troubleshoot-athena-column-not-found.htmlCommentShareAWS-Useranswered 10 months ago"