Question: cannot push Dockerimage to ECR

"I get an error on my EC2 with "Docker version 20.10.7, build f0df350" whiledocker push 0123456789.dkr.ecr.eu-central-1.amazonaws.com/myimage7c7d65e44641: Retrying in 1 secondb4ccc1f2e36b: Retrying in 1 secondcceec67921d6: Retrying in 1 second5530f13a133e: Retrying in 1 second22510f0870a6: Retrying in 1 secondEOFThe aws login beforeaws ecr get-login-password ...works fine: "Login succeeded" and ~/.docker/config.json is created.My ECR is created and my EC2 has a role with AmazonEC2ContainerRegistryFullAccess.Any suggestions?Many thanksFollowComment"

Answer: "0HelloVerify that you have the IAM role curl http://169.254.169.254/latest/meta-data/iam/security-credentials/examplerole use example policy Please use the policy below{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "ecr:PutLifecyclePolicy",                "ecr:PutImageTagMutability",                "ecr:StartImageScan",                "ecr:CreateRepository",                "ecr:PutImageScanningConfiguration",                "ecr:UploadLayerPart",                "ecr:BatchDeleteImage",                "ecr:DeleteLifecyclePolicy",                "ecr:DeleteRepository",                "ecr:PutImage",                "ecr:CompleteLayerUpload",                "ecr:StartLifecyclePolicyPreview",                "ecr:InitiateLayerUpload",                "ecr:DeleteRepositoryPolicy"            ],            "Resource": "arn:aws:ecr:us-east-1:<aws-account-id>:repository/ec2-ecr-test"        },        {            "Effect": "Allow",            "Action": "ecr:GetAuthorizationToken",            "Resource": "*"        },        {            "Effect": "Allow",            "Action": "ecr:BatchCheckLayerAvailability",            "Resource": "arn:aws:ecr:us-east-1:<aws-account-id>:repository/ec2-ecr-test"        }    ]}The loginaws ecr get-login-password --region region | docker login --username AWS --password-stdin aws_account_id.dkr.ecr.region.amazonaws.comCommentShareGKanswered a year ago0not, this works not.My IAM role has these rigths > the same error.CommentShareAWS-User-7095317answered a year ago"


Question: An error occurred while calling o187.pyWriteDynamicFrame. Unable to execute HTTP request:

"Dear communityThis is happening to me when I´m running an ETL job trying to transform an Oracle database table to parquet format and store it in a S3 bucket. I´ve been checking permissions and everything that I could imagine but I´m not able to figure out where does the error comes from.I highly apreciate if anyone can give me some lights about it.Regards,FollowComment"


Question: AWS iot core -greengrass issue

"I am using IOT grengrass to deploy lamda function for my IOT core device - Raspberry Pi 3. I have completed all the necessary steps regarding the same. While starting Daemon from raspbery pi 3 and deploying from AWS greengrass console (using group V1), i am getting this below error,"Deployment 6cc8251b-f006-44f6-bebc-050da8d84bd7 of type NewDeployment for group 4fd1b5be-8b43-4734-a805-266d7482b81a failed error: process start failed: failed to run container sandbox: container_linux.go:380: starting container process caused: exec: "/lambda/greengrassSystemComponents": stat /lambda/greengrassSystemComponents: no such file or directory"I using AWS IOTfor first time, so not sure why this error is comimg. Please help me. ThanksFollowComment"

Answer: "0I using AWS IOTfor first timeIf that is the case, we would strongly recommended you not use GG V1. It's a deprecated service: https://docs.aws.amazon.com/greengrass/v1/developerguide/maintenance-policy.htmlCommentShareEXPERTGreg_Banswered a year agoMichaelDombrowski-AWS EXPERTa year ago+1, get started using Greengrass V2: https://docs.aws.amazon.com/greengrass/v2/developerguide/getting-started.htmlShare"


Question: DMS Requirement to Disable Foreign Keys

"A number of DMS documents seem to indicate that it is a requirement to disable foreign key constraints when performing a full load \[1,2,3,4]. However, in my initial tests, I've found that this doesn't seem to be necessary, despite the fact that I am migrating data with foreign key relationships.Specifically, I'm migrating an on-premise Oracle database to an RDS Oracle database, using the full-load-and-cdc option. My complete schema has already been created on the target as a prerequisite to the migration (therefore, I'm using the DO_NOTHING table preparation mode), including all foreign key constraints. I have successfully migrated the data from all 16 tables, which have related data constrained by foreign keys, without having to disable the foreign key constraints (nor make any other changes to my target schema).Can someone elaborate on the conditions in which foreign keys must/should be disabled for migration?[1] https://d0.awsstatic.com/whitepapers/RDS/AWS_Database_Migration_Service_Best_Practices.pdf[2] http://docs.aws.amazon.com/dms/latest/sbs/CHAP_On-PremOracle2Aurora.Steps.CreateTask.html[3] http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Introduction.html[4] https://d0.awsstatic.com/whitepapers/strategies-for-migrating-oracle-database-to-aws.pdfFollowComment"

Answer: "0I've confirmed that foreign keys are not always required to be disabled; they only need to be disabled under certain conditions. For example, per the above when using the direct path load [1] along with the "do nothing" table preparation mode [2], foreign keys need not be disabled. However, when using the conventional load or other table preparation modes, they must be disabled. There may be other conditions to consider as well.[1] http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Introduction.ConnectionAttributes.html#CHAP_Introduction.ConnectionAttributes.Oracle[2] http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.FullLoad.htmlCommentShareshelley-bakeranswered 6 years ago"


"Error:HIVE_PARTITION_SCHEMA_MISMATCH: There is a mismatch between the table and partition schemas. The types are incompatible and cannot be coerced. The column 'isfallbackkey' in table 'analytics.events' is declared as type 'boolean', but partition 'dt=2022-08-22/appid=jovo-game-starter' declared column 'translationkey' as type 'string'.Data was passed as JSON in this format:{"type":"device_capabilities","supportScreen":true,"supportAudio":true,"supportLongformAudio":false,"supportVideo":false,"eventId":"668c9479-9eee-4025-8b9a-1323db06b21f","appId":"jovo-game-starter","eventDate":"2022-08-22T17:26:36.376Z","timestamp":1661189196,"locale":"en","timeZone":"America/Phoenix","userId":"a8ad82ba-bfac-4f93-a46d-aae37e842a7b","sessionId":"139163c0-fcf2-4bcc-9ece-a8e6ab5c322e"}{"type":"session_start","userId":"a8ad82ba-bfac-4f93-a46d-aae37e842a7b","sessionId":"139163c0-fcf2-4bcc-9ece-a8e6ab5c322e","eventId":"411e3abf-07fc-453c-9edd-a0a84f29b75f","appId":"jovo-game-starter","eventDate":"2022-08-22T17:26:36.383Z","timestamp":1661189196,"locale":"en","timeZone":"America/Phoenix"}{"type":"intent","userId":"a8ad82ba-bfac-4f93-a46d-aae37e842a7b","sessionId":"139163c0-fcf2-4bcc-9ece-a8e6ab5c322e","intent":"LAUNCH","eventId":"09287f39-e487-474b-bafc-c0c1b9f59959","appId":"jovo-game-starter","eventDate":"2022-08-22T17:26:36.387Z","timestamp":1661189196,"locale":"en","timeZone":"America/Phoenix"}{"type":"translation","translationKey":"start","isFallbackKey":false,"translationLanguage":"en","translationPlatform":"core","eventId":"15b87be7-5349-4a9e-b950-76bd76b63972","appId":"jovo-game-starter","eventDate":"2022-08-22T17:26:37.889Z","timestamp":1661189198,"locale":"en","timeZone":"America/Phoenix","userId":"a8ad82ba-bfac-4f93-a46d-aae37e842a7b","sessionId":"139163c0-fcf2-4bcc-9ece-a8e6ab5c322e"}Using Kinesis Firehose dynamic partitioning:events/dt=!{partitionKeyFromQuery:dt}/appid=!{partitionKeyFromQuery:appid}/FollowComment"


Question: EB Worker deployment error Var/Pid

"I'm trying to deploy a python script in a worker env in Elastic Beanstalk. The code runs fine on my local environment, and has run on a couple of occasions in EB. The problem is that now when I try to create and deploy a new worker, or update one, I get this error : ERROR] An error occurred during execution of command [app-deploy] - [Track pids in healthd]. Stop running the command. Error: "update processes [worker nginx cfn-hup healthd sqsd] pid symlinks failed with error read pid source file /var/pids/worker.pid failed with error:open /var/pids/worker.pid: no such file or directory". Any ideas on why I'm getting this error? As I mention earlier my code has worked as is in AWS EB before. Thank you.FollowComment"

Answer: "3Double-check that the worker configuration file (.ebextensions/01-worker.config) contains the correct command to start the worker process, and that the pidfile option is set to /var/pids/worker.pid.option_settings:  aws:elasticbeanstalk:worker:python:    command: "worker.py"    pidfile: "/var/pids/worker.pid"Check the worker logs (located at /var/log/eb-worker.log) to see if there are any errors or exceptions being raised that could prevent the worker process from starting or writing to the pid file. Ensure that the worker process has write permissions to the /var/pids directory.container_commands:  01_change_pids_permission:    command: "chmod 777 /var/pids"If none of the above steps work, try restarting the environment to see if that resolves the issue.eb restartCommentShareEXPERTsedat_salmananswered a month agopaganof a month agoThank you sdtslmn for the answer. My config file didn't had the pidfile parameter. I will add that, set the permissions  and restart to see if it solves the issue.Share"


Question: Lightsail VPC in other Region Connect to Default VPC

I've enabled the VPC on my Lightsail which is under the same account where my default VPC is. However Lightsail and the default VPC are in different regions. When I attempt to create a Peering connection I chose the other region but the VPC ID (Accepter) is blank.So the question is where to I find the VPC ID of the Lightsail VPC?FollowComment

Answer: 0For those that come across this question the easiest way is to initiate the peering from within AWS Lightsail once the default VPC is created.Details on this can be found in the lightsail docs.https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-set-up-vpc-peering-with-aws-resourcesCommentShareRobin Fordanswered a month agorePost-User-4375398 a month agoThat was the document I started with. But it wasn't clear to me that you have to find VPC ID in the other region. I hope that helps others doing this for the first time.Share-1Accepted AnswerI found it. I just had to look at the VPC Peering in the other Region.CommentSharerePost-User-4375398answered a month ago


Question: Github code pipeline to Elastic Beanstalk (EBS)

"I want to automate the deployment of the spring boot application from GitHub to AWS elastic beanstalk (ebs). I tried both the AWS code pipeline and code star. But I keep facing permission and policy requirement errors. Not sure what the required permissions are. I will really appreciate any guidance on how to do this, with examples if possible.The background to this question is that I am trying to move my application from Heroku to AWS. I use Guthub as my repository.Thanks!FollowComment"

Answer: "0To automate deployment of spring boot application, you will be needing three stages in codepipeline.Source (Github: Version 2 recommended)Build ( Include the commands in buildspec.yml to build)Deploy ( AWS Elastic Beanstalk as action).When we create codepipeline, there is an option to select the Artifact Store bucket and KMS key for encryption.By default, codepipeline uses the bucket codepipeline-Aws_Region-Account_ID and default kms key. All the permissions are added by default to the both the service roles that are created by default.Please, make sure that both the codepipeline and codebuild service role should have permission to the s3 and kms for custom configurations. S3 bucket should have permission to allow codepipeline and codebuild service role to read and write to S3. If using custom KMS, key resource policy should also allow the access to CodeBuild and CodePipeline service role. Please refer the documentation [1] that uses CodePipeline to run CodeBuild and deploy to Elastic Beanstalk.In the codebuild buildspec.yml you need to create the artifacts that will be used by the next stage Deploy with action AWS Elastic Beanstalk. You can refer [2] for the the buildspec.yml syntax.artifacts:files:- "**/*"References:[1] https://docs.aws.amazon.com/codebuild/latest/userguide/sample-elastic-beanstalk.html#sample-elastic-beanstalk-codepipeline[2] https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#build-spec-ref-syntaxCommentSharerePost-User-8797155answered 5 months ago"


Question: "Network connection issue, to ec2 and FTP inside of VPC"

"Hello I created this instance https://us-east-1.console.aws.amazon.com/ec2/home?region=us-east-1#InstanceDetails:instanceId=i-0ca9edd25728c4f62The goal is trying to create AD user from that instance, therefore both the AD and EC2 are under the same VPC.Question 1: I couldn't connect to the EC2 instance with RDP. I configured both the subnet and EC2 to accept RPC calls with ACL, no effect.Question 2: eventually, I'd like to use this https://us-east-1.console.aws.amazon.com/transfer/home?region=us-east-1#/servers/s-d0e008162fc04aa1a to recieve FTP file drops from the AD's user.Is the network correctly configured?Thank you!FollowComment"

Answer: "0If you've configured the ACL to accept RDP inbound, have you configured outbound for ephemeral ports?Did you configure an inbound rule on your instance's Security Group?Is routing set up correctly?  If you're trying to RDP in over the internet your instance needs a Public IP address and your default routing needs to be to the VPC's Internet Gateway.CommentShareEXPERTskinsmananswered 2 months ago"


Question: Static Website S3 not resolving - DNS Provider is not AWS

"Hi,Been battling with this for 24 hours.I have set up a static website in an S3 bucket that as a Coudfront distribution. The domain name is registered by Namecheap.If I paste in the cloudfront address this resolves. If I drop in the S3 namespace this resolves. If I type in mywebsite.com or www.mywebsite.com this results in the IP address not found page in the browser.I have set up a CNAME record in Namecheap pointing to the values generated when I requested the web certificate.I am really struggling with where to find the records that need to be set up in Route 53. Namecheap just point me back to AWS.If someone can give me some pointers I would be grateful. Or am happy to provide any information. I already have a Route 53 registered domain running with Cloudfront from an S3 bucket which was easy to set up. It is the external provider that is causing me the problem.ThanksSevFollowComment"

Answer: "0Did you point the nameserver records at the Namecheap registrar to the Route53 hosted zone?It sounds like maybe you haven't.Once you do that, it could take up to a couple of days for everything to propogate.CommentSharecloudbuttonanswered 2 years ago0Thanks - I had copied those in and they were essential. I hope that answer helps someone as I discovered it by accident.The answer to my particular problem is that Namecheap use @ and www in the Host field for the apex domain and subdomain respectively. When I added the DNS ALIAS records in Namecheap's console I had entered the domain name (mydomain.com and www.mydomain.com ) rather than those placeholders.Thanks though.Edited by: sevcon on Aug 3, 2021 8:51 AMCommentSharesevconanswered 2 years ago"


Question: Make aws-fpga repository Ubuntu and Python3 friendly?

"I ran into a couple of issues with the python script below in the aws-fpga repository on Ubuntu 16.04$./SDAccel/examples/xilinx_2018.3/utility/parsexpmf.pyIt uses #!/bin/env, which doesn't exist on Ubuntu by default.It uses Python2 print syntaxprint vbnv(root)^SyntaxError: invalid syntaxIs there a plan to make it compatible with Ubuntu and Python3 friendly?Thanks,JimFollowComment"

Answer: "0Hi Jim, for the parsexpmf.py header, it looks like the incorrect pathing was used for this file. In the other Python scripts, /usr/bin/env is used, which does exist in Ubuntu 16.04.For the Python 2.x syntax, currently there isn't any plan to update these files to be compatible with Python 3.x, however I have created a request with development to discuss potentially updating these scripts along with updating parsexpmf.py to use the correct location in the header.CommentSharekmorrisXilinxanswered 4 years ago0Thanks @kmorris!CommentSharejimwu-sumupanswered 4 years ago"


Question: CORS Access-Control-Allow-Origin not displayed in API Gateway console

"Hi all,I set up the CORS Access-Control-Allow-Origin to allow my domain in the API Gateway console for my API resources and redeploy the API.It worked. But when I bring up the "Enable CORS" menu again, the field Access-Control-Allow-Origin always display the default '*'.Though I could test to see that the previous setting still works, I wonder if this is a bug of the API Gateway console?Or where am I supposed to see my CORS settings again in the console?Or the only way is to execute Test and look at the response header???FollowComment"

Answer: 0I've found the CORS settings under: Method Execution --> Integration Response --> Header Mappings.CommentShareMakoanswered 2 years ago


Question: cyberduck access to bucket

"when i try to add this permission to allow cyberduck to list the files from a bucket. cyberduck list all the buckets in my account, but only have access to the bucket i entered the key for. what i would like it to do is only list the bucket that i entered the key to and only have access to that bucket . this is the JSON script{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Stmt1480515305000",      "Effect": "Allow",      "Action": [        "s3:ListAllMyBuckets",        "s3:GetBucketLocation"      ],      "Resource": [        "arn:aws:s3:::*"      ]    },    {      "Sid": "Stmt1480515305002",      "Effect": "Allow",      "Action": [        "s3:List*",        "s3:GetObject",        "s3:PutObject",        "s3:DeleteObject"      ],      "Resource": [        "arn:aws:s3:::allowed-bucket",        "arn:aws:s3:::allowed-bucket/*"      ]    }  ]}thank youFollowComment"

Answer: "1Hi, in reviewing the JSON policy document that you provided, what you are seeing is expected.The first Sid (Stmt1480515305000) allows the IAM user/role to list all of your buckets in the account and get their locations (e.g., AWS region). If you add the specific resource block that you use for the second Sid (Stmt1480515305002), you will restrict the bucket list to the one bucket that you want cyberduck to access. I've included my example below.{      "Sid": "Stmt1480515305000",      "Effect": "Allow",      "Action": [        "s3:ListAllMyBuckets",        "s3:GetBucketLocation"      ],      "Resource": [        "arn:aws:s3:::allowed-bucket"      ]    }CommentShareawsendoanswered 8 months ago0Hello . thank you for your answer . i wasn't able to apply what you said . lets suppose the bucket i want to list is called bucket1 . how would the code look for that bucket . thank youCommentSharerePost-User-8236664answered 8 months ago"


Question: Upload data to S3 using lambda

"I am currently working on a mobile app on which we have implemented data storage in S3 bucket. What we are currently doing is that we are generating presigned url from lambda and then sending it to the react native app on  front end from where we upload the data.The difficulty we are facing is that as we can have upto 10-15 files at a given time and it will affect the user experience of the mobile app. So, is there any way we can upload the files to S3 bucket from lambda instead of doing from front end?FollowComment"

Answer: "1This may not be what you're looking for, but I use python and you may be using the same functions on your front end, so this may help you.  Not sure.Here's what I'm doing:mb = 1024 ** 2config = TransferConfig(multipart_threshold=1024 * 25, max_concurrency=int(psutil.cpu_count() / 2),                        multipart_chunksize=1024 * 25, use_threads=False)try:    upload_file_response = s3.upload_file(source, destination, key, Config=config)There's an article that mentions you can limit the bandwidth of the connection you're using in the TransferConfig class options.  Here's that article:Again, this may or may not help you.  Sorry if it doesn't.https://boto3.amazonaws.com/v1/documentation/api/latest/reference/customizations/s3.html#boto3.s3.transfer.TransferConfigCommentSharejschwar313answered 9 months agoBrettski-AWS EXPERT9 months agoAdding: The only thing to watch out for here is the size of the payload in API Gateway - it's around 10MB.Share0Not sure what you are concerned about. Is it the fact that you need to generate 10-15 pre-signed URLs? What about it? The time it takes?You can always generate all the URLs in a single API call. Also, if you are using Cognito user pools to authenticate the users, you can also associate an Identity pool, obtain AWS credentials on the client and generate the pre-signed URLs there, saving on the network round trip.Finally, you can upload the files to Lambda that will save to S3. Not sure it will be quicker. Note that Lambda has a 6MB payload size limit.CommentShareEXPERTUrianswered 9 months ago"


Question: AWS training starting point

"Hello, is it possible to do the AWS Solution Architect and AWS Developer without doing the AWS Cloud Practitioner?Thanks in advance for your reply.FollowComment"

Answer: "2Accepted AnswerYes. While completing the AWS Certified Cloud Practitioner exam is a good foundation for both the  AWS Certified Solutions Architect or AWS Certified Developer exams, you are not required to do so.CommentShareAWS-User-4728013answered a year ago0Yes you can. You can also go for a professional level examination directly.Link https://aws.amazon.com/about-aws/whats-new/2018/10/announcing-more-flexibility-for-aws-certification-exams/#:~:text=You%20can%20now%20choose%20the,a%20Professional%20or%20Specialty%20certification.Earlier there was a requirement however it was waived off. :)CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year ago"


Question: Ingesting data into AWS Data Lake using APIs

"I have an AWS Data Lake that is ready to be used at the moment.My use case for the Data Lake is to be able to, ingest data from different API connectors (coming from other data vendors and service providers).There are at least three different services such as CRM tools, data vendors and etc which I need to ingest data into AWS Data Lake.All these services provide an API which can be used to connect to the data lake. The challenge is however to ensure that the process of ingesting/transformingand loading (ETL), must be automated and doesn't need manual interventions. Which means once connected, with every new data point that the vendors provide,it must automatically be loaded into the data lake.My question is, what AWS services do I need to use to accomplish this ?(1) Building an API connector from different data providers to Data lake ?(2) Be able to do some ETL (or transform) the data before loading it into the Data Lake. Potentially this ETL service can sit between the API and the Data lake.Thanks,FollowComment"

Answer: "1Hi,Depending on the services you are looking to extract data form, there could be easier method to extract your data from.For example Amazon AppFlow can directly extract data from some Services and it is directly integrated with AWS Glue DataBrew for Data Preparation and transformation.Alternatively if the SDK for the service is available in Python you could use AWS Glue to create the connector and also run the ETL and Finally write to S3. AWS Glue Studio has a marketplace that allows you to source pre-built connectors from AWS and third parties.hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Lambda upload timeouts

"I usually upload my lambda like this:aws lambda update-function-code \--function-name TulipApiTestV1 \--zip-file fileb://out/aws-tulip-test-linux-amd64.zip \--no-paginatebut it has been super slow.  Just now I got this:Connection was closed before we received a valid response from endpoint URL: "https://lambda.us-east-1.amazonaws.com/2015-03-31/functions/TulipApiTestV1/code".I decided to try it from the console and got something even worse:Signature expired: 20220525T144001Z is now earlier than 20220525T144103Z (20220525T144603Z - 5 min.)(I'm in development, there's no signature at all).I tried it again a few times, then stepped away for a while and came back and now it's working, but it's absurdly slow.Is this just a glitch?FollowComment"

Answer: "0I am not sure why it happened to you and now it works. Could it be that the zip file is large? If the file is larger than 50MB it must be uploaded to S3 first and then update the function code from there. I would recommend using SAM to deploy. It will package the code and upload it to S3 on your behalf.CommentShareEXPERTUrianswered a year ago0Nope my ZIP file is really small, it's about 7 megabytes.CommentSharewz2banswered a year ago"


Question: AWS MGN & KeyPair

"Hello,I been messing around with AWS Application Migration Service and I noticed that when Cutover/Test server is launched there is no KeyPair. I checked the launch template and there is no option to create keypair. Any idea on this?Thank youAmanuel.FollowComment"

Answer: "0Accepted AnswerThanks for your question.  Follow these steps:From the source servers screen in the MGN console, click on the source servers.From the server details --> Select the Launch Settings tabScroll down until you see the EC2 Launch Template settingsClick on Modify.  That will launch the EC2 Launch Template in a new windowScroll down until you see the Key Pair section (select or create new).Be sure to set your modified version as defaultHope this helps.CommentShareMichael_Sanswered 3 months ago"


Question: I am unable to connect to my instance through any means after enabling Cloudflare Warp.

"I installed Cloudflare Warp on my instance, but I forgot to add my IP address when enabling it, which resulted in me being unable to connect to my server via SSH. I thought I could connect using EC2 Instance Connect, but that also failed. Now, I have no way to connect to my instance. Other than changing the public IP or creating a new instance, is there any other way for me to re-establish the connection?FollowComment"

Answer: "0Accepted AnswerPerform the following steps to get access to the files for troubleshooting and fixing.Take a snapshot of the Broken Instance (BI) root volumeStop BIDetach root volume from BIStart a New Instance (NI)Attach BI root volume to NIMount the BI root volume on NI at the OS levelTroubleshoot and fix.Detach BI root volume from NIAttach BI root volume to BIStart BI, now Fixed Instance (FI). :)Set up a Data Lifecycle Policy to automate snapshot of the FI.CommentShareEXPERTkentradanswered a month agoJiang a month agoThis sounds feasible, let me give it a try.Share"


Question: AWS Amplify 404 issue

"Hi there,I want to deploy my Hugo site on AWS Amplify, I set up all the settings, but I finally got this:This domain was once hosted on GitHub, and I have completed the migration.My build config:version: 1frontend:  phases:    build:      commands:        - rm -rf /usr/bin/hugo        - wget -q https://github.com/gohugoio/hugo/releases/download/v${VERSION_HUGO_NEW}/hugo_extended_${VERSION_HUGO_NEW}_Linux-64bit.tar.gz        - tar -xvf hugo_extended_${VERSION_HUGO_NEW}_Linux-64bit.tar.gz        - mv hugo /usr/bin/hugo        - rm -rf hugo_extended_${VERSION_HUGO_NEW}_Linux-64bit.tar.gz        - hugo  artifacts:    baseDirectory: public    files:      - '**/*'  cache:    paths: []Amplify:Thanks for your help.FollowCommentburhan 7 months agoAre you sure the domain (allyonsygama.com) is correct? It is not resolving using public DNS servers.Share"


Question: AWS Batch: Is there any AWS Batch API to retrieve the job by tag?

"Following was my code:var jobRequest = new SubmitJobRequest();jobRequest.Tags = new Dictionary<string, string> {{"test", "testTagValue"}};response = client.SubmitJobAsync(jobRequest).Result;var response = client.ListJobsAsync(listJobsRequest).Result;//can't read by tags, only can by JobIDIs there any AWS Batch API to retrieve the job by tag?FollowComment"

Answer: "0If you can provide the job queue, list-jobs will do it when you add a --query-filter with your tag(s) https://docs.aws.amazon.com/cli/latest/reference/batch/list-jobs.htmlFor query filters, see for example https://opensourceconnections.com/blog/2015/07/27/advanced-aws-cli-jmespath-query/ or https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-filter.htmlCommentShareDidier_AWSanswered a year ago"


Question: Website not reachable

"Hi,I created and launched a t2.micro with centOS7 and tried to host a forum. I have installed httpd, with nmap port 80 open. I also set AWS security group like HTTP TCP 80/443 0.0.0.0/0.After reaching some post all day, I tried to set Firewalld topublic (active)target: defaulticmp-block-inversion: nointerfaces: eth0sources: 3.136.56.96services: dhcpv6-client http sshports: 80/tcpprotocols:masquerade: noforward-ports:source-ports:icmp-blocks:rich rules:SSH to ec2-IP.us-east-2.compute.amazonaws.com is ok. But I just could not browser it via browser. The portal show that there are inbound packages. Please kindly let me know what I should do.My instance id is i-03e985c9f65b98bd0.FollowComment"

Answer: "0aws security group got a default rule overriding, set it with http,https 80 is alright.CommentSharebennybeinganswered 3 years ago0aws security group got a default rule overriding, set it with http,https 80 is alright.CommentSharebennybeinganswered 3 years ago"


Question: How can I get the Image ID after importing a disk image?

"Hello,I am writing a program that imports a disk image in my S3 bucket as an AMI, and then creates an EC2 instance with that AMI.I succeeded in using the AWS SDK for Java to do each task separately, but I struggle with going from the first step to the second step.Specifically, I struggle with getting the Image ID of the AMI after the import task is complete. I need the Image ID of the AMI to make an EC2 instance. I was trying to use an ImportImageResult to get the information, but calling getImageID() would return null.After sending an ImportImageRequest, I want to wait until the import is complete and the new AMI is available. Then, I want to get the Image ID of the new AMI. How can I do this programmatically, and is there a best way to do it?FollowComment"

Answer: "0The trick is to regularly call DescribeImportImageTasks, find the specific task, call getStatus on it to see if it is "completed", and if not, wait a bit before calling DescribeImportImageTasks again, etc., until the task is finally complete. Then, calling getImageID on that task would not return null. In order to make the task findable, I gave it a specific description, but I suppose giving it a specific tag could also work.CommentShareemul8ranswered 2 years ago"


Question: Reject unmapped method request in aws API gateway

"Hi,I have a lambda running with bunch of APIs. For example consider the below details,Sample API example,PATH: /aws/test/save**METHOD **: POSTMy API gateway has the above path with POST method and if I make a API call with POST method the lambda will initialize and the data will be posted into the database.Problem Statement: If I make same API call with GET method  I am getting 405 as expected but it's spinning up the lambda server, which I don't want.What I am expecting: Is it possible to reject the GET request which is not at all mapped in the API gate for the above path.**NOTE **: Basically only the mapped Path with assigned method should start the lambda all other unmapped path or method should be rejected and should not start the lambda.FollowComment"

Answer: "1How are you determining that the Lambda function is being invoked when a GET is sent to API Gateway?I've got a test API Gateway here; in my case GET is mapped to a Lambda function and I get an expected value returned and I also see an invocation happening in CloudWatch Logs. But if I send a POST request API Gateway responds with 403.Are you using specific methods in API Gateway? Or using "ANY"? If "ANY" Then yes, Lambda will be invoked for all methods. But if API Gateway is configured with specific methods anything which is not mapped will not invoke the back-end function (Lambda in this case).CommentShareEXPERTBrettski-AWSanswered 2 months agorePost-User-8292609 2 months ago@Brettski-AWS thank you for your explanation. The issue has been resolved now. I had a greedy proxy which was invoking the backend code.Share"


Question: assume-role-with-web-identity gets invalid credentials

"I am trying to use OpenID Connect authentication. I created my identity provider and am able to retrieve credentials using aws sts assume-role-with-web-identity, but when I try making requests with the token that comes back, I just get this error: An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid.SetupIdentity Providername: gitlab.comaudience: https://gitlab.comTrust Relationship{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "Federated": "arn:aws:iam::{account id}:oidc-provider/gitlab.com"            },            "Action": [                "sts:AssumeRoleWithWebIdentity",                "sts:TagSession"            ],            "Condition": {                "StringLike": {                    "gitlab.com:sub": "project_path:{redacted}/*:ref_type:branch:ref:*"                }            }        }    ]}Role Policy{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "sts:GetCallerIdentity"            ],            "Resource": [                "*"            ]        },        {...excluded}    ]}Stepsaws sts assume-role-with-web-identity \--role-arn arn:aws:iam::{account id}:role/app-deploy \--role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}" \--web-identity-token $CI_JOB_JWT_V2 \--duration-seconds 3600 >> secretsexport AWS_ACCESS_KEY_ID="$(cat secrets | jq '.Credentials.AccessKeyId')"export AWS_SECRET_ACCESS_KEY="$(cat secrets | jq '.Credentials.SecretAccessKey')"export AWS_SESSION_TOKEN="$(cat secrets | jq '.Credentials.SessionToken')"export AWS_SECURITY_TOKEN="$AWS_SESSION_TOKEN"export AWS_DEFAULT_REGION="us-east-2"The error is then thrown when running aws sts get-caller-identityFollowComment"

Answer: "0Accepted AnswerHello,The problem is the jq config, you need to add --raw-output flag like this:export AWS_ACCESS_KEY_ID="$(cat secrets | jq '.Credentials.AccessKeyId' --raw-output)"export AWS_SECRET_ACCESS_KEY="$(cat secrets | jq '.Credentials.SecretAccessKey' --raw-output)"export AWS_SESSION_TOKEN="$(cat secrets | jq '.Credentials.SessionToken' --raw-output)"Otherwise, the environment variables get wrapped in "" which does not work.Hope it helps!//CarlCommentShareCarl Ostrandanswered 10 months ago0Hello,Errors like these could be due to issues with things like environment variables or ~/.aws/credentials conflicting in weird ways with IAM instance profiles. The cleanest test would be to unset the relevant environment variables first:$ for var in AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN AWS_SECURITY_TOKEN ; do eval unset $var ; doneand also ensure that you have nothing in ~/.aws/config or ~/.aws/credentials, then rerun the test.Let me know if this helps and what was the result by clicking Accept answer.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months agowf-chansen 10 months agoSorry I should clarify. This is running in a CI build so it always starts from a clean slate. I've tried using both the environment variables, and using aws configure set key value to set them, and both give the same results.Share"


Question: ECS game servers are lagging. Where should I be looking for the issue?

"I am running my Unity (2021.3.1f1) servers on ECS using Fargate. When I test the game, I run a single task with 1vCPU and 2GB of memory and I connect 2 clients to the server. The server tends to lag about every 3 seconds, making the game far less enjoyable. I have enabled Container Insights and I found that the CPU and memory usage was nowhere near the 50% mark and the task's network usage seemed fine to me as well.I am now wondering if this issue could be related to the AWS services I use and the way I have set them up or if I should be looking for the issue inside my network code.FollowComment"

Answer: "0We run a lot of containers on ECS + Fargate and haven't seen anything like this. Granted, these aren't gaming servers, but we have fairly continuous network connections happening and never noticed anything like that.Do you use other AWS Services? Do you perform synchronous sync to S3 or other storage systems that could lock your service until completion of the round trip?CommentShareJohnPrestonanswered a year ago409 a year agoI do not interact with any AWS service on the game servers. I'll take this as a sign to start looking into the server's netcode.Thanks for the answer.Share"


Question: api alert only for waf

is there a way to receive an email about any api.message only using wafFollowComment

Answer: 0Hello!It is possible to monitor API messages via CloudWatch and then send a SNS notification via email. Please see the available WAF metrics for CloudWatch: https://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.htmlHere are instructions for setting up SNS email notifications: https://docs.aws.amazon.com/sns/latest/dg/sns-email-notifications.htmlCommentSharemasseanswered 7 months ago


Question: Unable to Activate GuardDuty Malware Protection in an Organization from a Delegated Account

"We have an AWS Organization, designated an account for Security where we have enable GuardDuty and works fine. Today we wanted to enable the new capability of Malware Protection but when trying to enable via the Delegated Account is fails with the following message:"The request failed because you do not have required AWS Organization master permission."I'm a user with Administrator policy, don't know what master permission means ?Any though ?Kind Regards.FollowComment"

Answer: "1Accepted AnswerPlease enable malware protection in the management account.aws organizations enable-aws-service-access --service-principal malware-protection.guardduty.amazonaws.comFrom then on, malware protection can be enabled for member accounts from a delegated administrator account.https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html#configure-malware-protection-multi-accountCommentSharehayao-kanswered 10 months agoHigher 10 months agoThank you very much, it worked, about the documentation the CLI command has a type, it says "organization" instead of the correct service "organizations" as your example says. Thanks again.ShareArjun Goel a month agoWhen I am trying to run this command I am getting Access Denied error. I have checked the IAM permissions and this access is present but I don't understand why it is still erroring? Can you help @hayao-k?Share"


Question: Private-Zone Route53 Health Checks

"My customer is interested in monitoring and creating alerts for private-zone Route53 health checks. Their goal is to verify that internal DNS resolution remains available and working in AWS.Looking at the documentation, we would need to have exposed instance (Public IP for the Route53 health checkers).Is there a way to monitor Private-Zone Route53 health checks?Does the SLA below include private-zone Route53 as well?Is there a way to monitor/alert with CloudWatch on private-zone Route53 within a VPC?https://aws.amazon.com/route53/sla/FollowComment"

Answer: "0Accepted AnswerMy customer is interested in monitoring and creating alerts for private-zone Route53 health checks. Their goal is to verify that internal DNS resolution remains available and working in AWS.I think you perhaps misunderstand what Route 53 Health Checks are for.   They do not verify that DNS resolution is available.  They verify that tcp/http/https endpoints (usually IPs) are answering.  In many cases, this allows Route 53 DNS records to be dynamically updated to include health endpoints only.Is there a way to monitor Private-Zone Route53 health checks?Health checks do not monitor DNS zones, they monitor tcp/http/https service endpoints.If you mean to ask "is there is a way to health check endpoints privately inside a VPC?", the answer is "not directly today, but there are workarounds".   Some customers do this by giving their VPC service a public IP and restricting connectivity to it exclusively to the health checker's public IPs (which are published).   You can then use that health check to dynamically update a DNS entry in a private hosted zone.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-route53-healthcheck.html"Route 53 health checkers are outside the VPC. To check the health of an endpoint within a VPC by IP address, you must assign a public IP address to the instance in the VPC."There are other ways this can be done indirectly also, e.g.:https://aws.amazon.com/blogs/networking-and-content-delivery/performing-route-53-health-checks-on-private-resources-in-a-vpc-with-aws-lambda-and-amazon-cloudwatch/All health checks get CloudWatch metrics, so you can set alarms on them.Does the SLA below include private-zone Route53 as well?  https://aws.amazon.com/route53/sla/The SLA explicitly includes Private DNS.  "This Amazon Route 53 Service Level Agreement (“SLA”) is a policy governing the use of Amazon Route 53 (including Private DNS) "CommentShareEXPERTgavinmcanswered 4 years agokav9 a year agoIs private zone health-checks a feature being developed for the future?Share"


Question: Build a REST API with API Gateway private integration: Tutorial

"I am trying to work through the tutorial : Build a REST API with API Gateway private integrationThe question I have is about this point 5.eType a URL, for example, http://myApi.example.com, for Endpoint URL.Here, the host name (for example, myApi.example.com) is used to set the Host header of the integration request.Given that an NLB with a targetgroup has been setup and a VPC link points at it. Its not clear if the endpoint here is the hostname of the EC2 that is pointed to by the NLB. Wondering if I can get a clarification on this.FollowCommentSri a year agoHi, I suggest you to provide feedback on the documentation page with this question and you might get an answer from the documentation team.SriShare"

Answer: 0Accepted AnswerIt would appear that the endpoint URL needs to be the DNS name of the NLB.CommentShareAWS-User-9282743answered a year ago00ACCEPTED ANSWERIt would appear that the endpoint URL needs to be the DNS name of the NLB.CommentShareMelanieanswered a month ago


Question: Elasticsearch delete all my documents?

"On 2/4, it seems that all my searchable documents in Elasticsearch got deleted automatically by itself [1]. Was AWS doing some upgrading/migration at the time that causing it? Is there any ways I could do to recover all the documents?[1] Link to screenshotFollowComment"

Answer: "1Accepted AnswerOn a separate note, your immediate course of action should be to restore lost data from the latest available SUCCESSfull automated snapshot. Steps documented here. Note that the automated snapshots are retained for a maximum of 14 days only.If you're running a single node domain and the node is replaced, you are likely to experience this. Follow Best Practices to reduce such chances.CommentShareAjay Nanswered a year agoEXPERTFabrizio@AWSreviewed a year agoAWS-User-1714860 a year agoI restored my snapshot in time and it works now. Thanks a lot!Share0Hi,to understand what happened in your account you could:check the cloudtrail logs for any Opensearch related activityContact support to understand what happenedThis is a specific case in which AWS Support should be able to help you, because no general answer may apply and something contextual to your account might be causing the issue.Your best next steps would be to open a Support case, in case you have not yet a Support subscription, consider to upgrade to Developer Support or Business support depending on the urgency of your case.Without looking at the internal logs or having more detailed information on the situation it is not possible to provide guidance, sorry.hope this helpCommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Reading SQS Message via Listener

"Currently SQS provides way to read messages using listener (https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/getting-started.html - Receiving messages asynchronously section). It is only implemented in JAVA. Is there corresponding .net implementation? I mean instead of polling SQS queue, listener should trigger event once message is received in queue.FollowComment"

Answer: "1That section corresponds to a JMS interface for SQS that allows existing JMS applications to work with SQS instead of a different JMS compatible product. JMS stands for Java Message Service and as such I do not think there is an implementation in other languages. The implementation of the SQS Java Messaging Library most probably includes a thread that polls the queue and when it receives messages, calls the listener. It can be easy to implement yourself.Saying that, One way for achieving the asynchronous invocation without writing your own poller would be to use a Lambda function. In that case, the Lambda service does the polling, and it invokes your function when it receives new messages.CommentShareEXPERTUrianswered a year ago0There are some examples of receiving SQS messages in the SDK developer guide.If you go to the SQS introduction page and look at the topics, you'll see one for Sending messages and one for Receiving messages. The example for receiving messages uses an async method to wait for and return any messages that are placed into the queue. Perhaps this would be interesting for you to look at.A fun exercise: If you use the examples cited above to create console apps to both send and receive messages, you can run them both at the same time and send yourself messages. :-)In addition to the SQS examples cited above, there are also examples in the AWS Docs SDK Examples repo on GitHub. Specifically, in the dotnetv3/SQS folder.Hope this helps.CommentSharePaul-B-AWSanswered a year ago"


Question: S3 trigger vs synchronous integrations for IoT->cloud requests

"I see the "Track Coffee Consumption" DeepLens recipe (which runs an object detection model at edge but calls Rekognition for face comparison) works by:Uploading an image from the device to S3, andTriggering a cloud Lambda function from the S3 upload - which calls Rekognition and does something with the result.Assuming that:The results of the cloud inference needed to be used on device (rather than just powering a Cloud dashboard as in the recipe), andLatency-when-available was more important to the use case than queuing-when-unavailable...Are there any big reasons not to call the cloud Lambda (or Rekognition) direct from device - using botocore just like the recipe does with S3?Perhaps the S3 pattern is preferred because there are more restricted deployment cases where access to S3 is available via some IoT services, but general Lambda/etc isn't?It seems from a quick search like there are not many examples around that (synchronously) invoke cloud services from GreenGrass devices: I'm trying to get a grasp of whether this is driven by expected network connectivity, device support, IoT integration availability, or something else.FollowComment"

Answer: "0Accepted AnswerHi,One reason for posting to S3 or IOT is to minimize the blocking on the process that's running the inference. If you wait for the round trip request to return results to DeepLens, the application might miss a new frame. You can certainly run a queue or state machine on the device, but I think the authors wanted to keep it simple.CommentShareAWS-User-6762945answered 3 years ago"


Question: Updating AMI of a EC2 Fleet

"Is there a way to update the AMI ID used by a EC2 Fleet or Spot Fleet?I've been reading about Launch Templates, Systems Manager and so on, but it seems to me that for one to change it, we have to terminate the fleet and start a new one.Edited by: Jorge Oliveira on Feb 22, 2019 6:04 PMFollowComment"

Answer: "0I've managed to overcome it by using an Auto Scaling Group attached to a Launch Template, instead of using EC2/Spot Fleet.Whenever I need to update the AMI, I just create a new version of Launch Template, set it to be the Default one. Since the Auto Scaling Group is set to use the Default version, it will pick up the changes.CommentSharejorgeanswered 4 years ago"


Question: AWS Pinpoint Sessions per endpoint lower than 1

"Hi,I'm using Pinpoint to track mobile app events and send push notification.For the Android app only I'm experiencing a strange value lower than 1 for the metric "Sessions per endpoint".How this could be possible?Thank youFollowComment"


Question: DNS_PROBE_FINISHED_NXDOMAIN error from ARecord to S3 static website

"Hi. I have set up a hosted zone for domain yoloyoloyolo.com. And I made an A Record of the root, forwarding to alias S3 static website access point.I got error DNS_PROBE_FINISHED_NXDOMAIN from chrome. curl: (6) Could not resolve host from terminal.I have tried resetting the hosted zone multiple times. And waited for 2 days. The issue still persists. Any help will be appreciated.FollowComment"

Answer: "0Accepted AnswerHi,Name servers appear in three places, and typically they should all be in synch:~ The name servers that Route 53 assigns to a hosted zone when you create it. These are the "master" name servers and cannot be changed. Name servers in the other locations usually match these.~ The name servers in the NS record in the hosted zone.~ The name servers that are associated with the domain registration. These are the name servers that control which DNS configuration is in use.For yoloyoloyolo.com, the "master" name servers match the name servers in the NS record, but the name servers in the domain registration are different.To fix that, do the following:Get the name servers that Route 53 assigned to the hosted zone when you created it. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the domain registration to use the four name servers that you got in step 1. See "Adding or Changing Name Servers and Glue Records for a Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlAfter you finish, it will take a couple of days for you to be able to see your website again because DNS resolvers typically cache the names of name servers for two days. (Folks who use different DNS resolvers will be able to see your website as soon as you make the change. You might also be able to see your website from your phone.) For an overview of how DNS works, including the part about resolver caching, see "How Amazon Route 53 routes traffic for your domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/welcome-dns-service.html#welcome-dns-service-how-route-53-routes-trafficFor more information about using an S3 bucket for a static website, see "Getting Started":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/getting-started.htmlScottCommentShareEXPERTAWS-User-6179575answered 3 years ago"


Question: Line numbers missing in workdocs work.doc

"Line numbers are missing in the uploaded work.doc in workdocs. Please suggest how to add line numbers, it's visible in local copy in print layout mode.FollowComment"

Answer: 0Thank you for reporting this issue. Can you please create a ticket via customer support so we can investigate the issue further? CTI - AWS | WorkDocs | PM TeamCommentShareShrutianswered 6 months agorePost-User-4588656 6 months ago@Shruti Please provide CTI to cut a ticketShare


Question: InvalidLambdaResponseException for PreSignUp Trigger

"I keep getting the following errorInvalidLambdaResponseException: An error occurred (InvalidLambdaResponseException) when calling the SignUp operation: Unrecognizable lambda outputwhether I use boto3's sign_up or the JS signUp function. My trigger lambda is implemented in python and I autoconfirm and verify the userevent['response']['autoConfirmUser'] = Trueevent['response']['autoVerifyEmail'] = Trueand return the event with return event .The lambda works without any errors but I cannot figure out why I keep getting this error.FollowCommentrePost-User-5144371 4 months agoI followed this up by splitting my presign up lambda to just do auto confirm user and verify the email, the rest of the logic (which creates some user related stuff in our backend via an internal POST call) is in the post confirmation lambda.The user is getting created, the post confirmation lambda is running... BUT I still get the error. This is very frustrating, given the lack of documentation by AWS.Share"

Answer: "0Accepted AnswerFound the error. We were using the event["request"] values for some internal logic in a separate function and that was modifying the values (forgot that dictionaries are passed by reference since they are mutable). Solved this by making a deep copy (using copy.deepcopy(event["request"])) before passing it on to the function.Basically looks like the followingfrom copy import deepcopydef function_handler(event, context):    # create a deep copy of the event request    request = deepcopy(event['request'])    # do something in our custom function, for us it returns a boolean    response = do_something(request)    if not response:        # since our function did not work as expected, we cannot create the user, raising an exception        raise Exception('do_something failed, here is an error message that makes sense...')       # since do_something worked, let's confirm the user    event['response']['autoConfirmUser'] = True    event['response']['autoVerifyEmail'] = True        return eventThis worked. In retrospect, the error Unrecognizable lambda output is not really helpful, if it had more information on the request being modified it would have taken us much less time to figure this out.CommentSharerePost-User-5144371answered 4 months ago"


Question: Can you use CloudWatch Agent on Windows to create a measure which is the number of files in a directory

"I don't want to collect the files in the directory, just monitor the number of files in it. Is this possible?FollowComment"

Answer: 0You can publish a custom metric to CloudWatch in the form of a script output doing a simple file count in your windows directory.Have a small script running via task scheduler that checks the number of files in the directly and makes a put-metric-data call to CloudWatch and publishes the file count.See here for how to publish a custom metric: http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/publishingMetrics.htmlCommentShareAWS-User-6621777answered a month ago


Question: AWS EBS Cost reduction

"My question is For my instance i have chosen io2 IOPS 64000 with 200 GiB, and am being hit between 65,000 - 83,000 IOPS, so what measures can i take to reduce it OR how can i find the root cause for this 65000-83000 iops that is being generated.FollowComment"

Answer: "1IOPS is a number of I/O operation per second, which means the amount of read or write operations that could be done in one seconds time.Depending on the operating system and the application/service that needs disk access it will issue a request to read or write a certain amount of data at the same time. This is called the IO size and could be for example 4 KB, 8 KB, 32 KB and so on.There is a relation between the IO size and the IOPS, as in if the IO size is small we could get higher amounts of IOPS and reach a certain amounts of throughput (MB/s).So, the throughput is calculated using, Throughput = Number of IOPS * IOSIZEAbove steps can be reviewed to reduce the cost.For the root cause you should analyse the patterns of access1 )Look at the CloudTrail for API events2)Analyzing your costs with AWS Cost Explorerhttps://docs.aws.amazon.com/cost-management/latest/userguide/ce-what-is.html3)Analyze your billing dashboard for the charges4)How are charges for Amazon EBS volumes calculated on my bill?https://aws.amazon.com/premiumsupport/knowledge-center/ebs-volume-charges/5)https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.htmlCommentShareAneesh_Vanswered a month ago0Hello,For the root cause you should analyse the patterns of access and what type / size of data is being read in the disk. So, keep in mind that the size of an I/O operation determines the throughput the EBS volume provides. Amazon EBS calculates throughput using the equation: Throughput = Number of IOPS * size per I/O operation.More information in this guide.CommentShareIbrahim Cesaranswered a month ago"


Question: Grafana Twin Maker Scene plugin shows  "Error Access Denied"

"I'm using Grafana Bitname image from catalog aws ec2 and I  have configured Grafana and roles, policies to access Twinmaker and vizualize fetures. But I have this error on the screen below. Someone would have idea how figure out this?FollowComment"

Answer: "0Hi Izaias, Are you still facing this issue? If yes, please go to the browser Developer Tools -> Network tab and share the details of the error being reported there.CommentShareMukesh_Sahay-AWSanswered 5 months ago"


Question: Bridge to AXI 4

"Hi,Is there ant common solution for a bridge from APB in Xilinx IP lib ( or other simple parallels bus) to AXI 4?I am asking it because I need to implement bridge from the APB bus to the DDR Controller's AXI 4 interface.RegardsGilFollowComment"

Answer: "0Hi,Unfortunately AWS does not offer an example IP for APB - to - AXI bridge. Also, I noticed that Vivado IP catalog offers AXI-to-APB bridge, but not the other way around:https://www.xilinx.com/support/documentation/ip_documentation/axi_apb_bridge/v3_0/pg073-axi-apb-bridge.pdfThanks!ChakraCommentShareawschakraanswered 2 years ago0Chakra, thanks a lot for your response!Just to make it clear; any bridge to AXI4 (from any parallel bus) will help me. maybe there is something like it in the IP Catalog ? ( I also looked for it but couldn't find any. I am double checking it because I assumed this component is commonly used and therefore there is a fixed solution).So, I guess I will have to design some "parallel bus" to AXI bridge.RegardsGilCommentSharegilmosekanswered 2 years ago0Chakra, thanks a lot for your response!Just to make it clear; any bridge to AXI4 (from any parallel bus) will help me. maybe there is something like it in the IP Catalog ? ( I also looked for it but couldn't find any. I am double checking it because I assumed this component is commonly used and therefore there is a fixed solution).So, I guess I will have to design some "parallel bus" to AXI bridge.RegardsGilCommentSharegilmosekanswered 2 years ago"


Question: Redshift :STV_PARTITIONS

"Hi All,I was doing some reading related to stv_partitions. (https://docs.aws.amazon.com/redshift/latest/dg/r_STV_PARTITIONS.html). The example in the link states that the pct_used is evenly distributed across the disk partitions.I tired the same against the instance I work and see that we have 8 node cluster with 2 disk partions per node. Within each node, only one disk space per node has pct used of 70 while the other show it as 0. Is this something we should be concerned about?FollowComment"

Answer: "1Accepted AnswerNot necessarily something to be concerned about, but it's worth digging into.  Take a look at the query provided here: https://docs.aws.amazon.com/redshift/latest/dg/diagnostic-queries-for-query-tuning.html#identify-tables-with-data-skew-or-unsorted-rowsThis will help identify tables that have uneven distribution or a high percentage of rows unsorted and the description on that page tells you the thresholds to look for in your query results.CommentShareDon_Danswered 7 months agoEXPERTFabrizio@AWSreviewed 7 months agoAWS-User-8821482 7 months agoThank you @Don_D. I will review your suggestions and revert back in case I need your inputs.Share"


Question: "How to package an implementation for a client using Lambda, SNS, SES and dynamoDB"

"Hi!I'm working on an implementation for a client that involves creating a few Lambda functions, SNS, SES, a dynamoDB datastore and the relevant IAM users the application will need to function. I'm building and testing on my own AWS account.Once I have working software, I'd like to package this implementation in a way that will allow the client to install what I've built in their own AWS account.Is there a recommended way to get this done smoothly and seamlessly? Like, are there any AWS services, configuration manifest files, deployment workflows, etc. that I could use so that the client could follow a minimum of steps to recreate the services and their configuration in their environment easily?Thanks!FollowComment"

Answer: "1You can use Infrastructure as Code to package all your code and services configuration. AWS SAM is a good way to package serverless components.If you need an example, you can look at the first or second example in this workshop - https://catalog.us-east-1.prod.workshops.aws/workshops/e8738cf6-6eb0-4d1d-9e98-ae240d229535/en-USAt each of the steps such as https://catalog.us-east-1.prod.workshops.aws/workshops/e8738cf6-6eb0-4d1d-9e98-ae240d229535/en-US/fan-out-and-message-filtering/create-sns-topic, choose AWS SAM tab instead of the consoleSAM documentation is here - https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-reference.htmlIf you need to build an automated CI/CD pipeline using AWS tools, you can look at this workshop - https://cicd.serverlessworkshops.io/CommentShareEXPERTIndranil Banerjee AWSanswered 9 months ago"


Question: "S3 video upload: works from FTP, fails from browser"

"hi all,I am truly desperate.Started working on a VOD platform, using AWS lambda workflow.It is GREAT but I have a weird unidentifiable problem.$file_Path = $filenames; //filename correctyl inherited via jquery POST ajax$key = basename($file_Path);try {    $result = $s3Client->putObject([    'Bucket' => $bucket,    'Key' => $key,    'SourceFile' => $file_Path,    ]);} catch(S3 $e) {    $output['error'] = $e->getMessage(); }this code WORKS like a charm and the entire VOD worflow as well, if I stab a file from and FTP file in the same folder than this upload.php file$file_Path = 'demo.mp4' //$filenames;$key = basename($file_Path);...but fails with a generic 500 error code if I upload it via AJAX form call...error logs are foggy...there's only this "info" which is strange:2020/04/24 11:20:40 [info] 2453970#2453970: *5787 client closed connection while waiting for request, client: 151.24.114.127, server: 62.94.34.21:443as the rest are just [debug] notices..2020/04/24 11:20:38 [debug] 2453970#2453970: *5786 http write filter 00000000000000002020/04/24 11:20:38 [debug] 2453970#2453970: *5786 http copy filter: 0 "/avod/upload.php?"2020/04/24 11:20:38 [debug] 2453970#2453970: *5786 http finalize request: 0, "/avod/upload.php?" a:1, c:12020/04/24 11:20:38 [debug] 2453970#2453970: *5786 set http keepalive handler2020/04/24 11:20:38 [debug] 2453970#2453970: *5786 http close request2020/04/24 11:20:38 [debug] 2453970#2453970: *5786 http log handler2020/04/24 11:20:38 [debug] 2453970#2453970: *5786 free: 00000000000000002020/04/24 11:20:38 [debug] 2453970#2453970: *5786 free: 000055B5D702C6102020/04/24 11:20:38 [debug] 2453970#2453970: *5786 free: 000055B5D704F7D0, unused: 32020/04/24 11:20:38 [debug] 2453970#2453970: *5786 free: 000055B5D704E410, unused: 02020/04/24 11:20:38 [debug] 2453970#2453970: *5786 free: 000055B5D6ABD430, unused: 02020/04/24 11:20:38 [debug] 2453970#2453970: *5786 free: 000055B5D6FD2830, unused: 82020/04/24 11:20:38 [debug] 2453970#2453970: *5786 free: 000055B5D6ABF3D0, unused: 34292020/04/24 11:20:38 [debug] 2453970#2453970: *5786 free: 000055B5D70BCB502020/04/24 11:20:38 [debug] 2453970#2453970: *5786 hc free: 00000000000000002020/04/24 11:20:38 [debug] 2453970#2453970: *5786 hc busy: 000055B5D6FB6B50 12020/04/24 11:20:38 [debug] 2453970#2453970: *5786 free: 000055B5D7062C102020/04/24 11:20:38 [debug] 2453970#2453970: *5786 free: 000055B5D7078D402020/04/24 11:20:38 [debug] 2453970#2453970: *5786 reusable connection: 12020/04/24 11:20:38 [debug] 2453970#2453970: *5786 event timer add: 116: 65000:44036033072020/04/24 11:20:38 [debug] 2453970#2453970: *5786 post event 000055B5D6F8A2902020/04/24 11:20:38 [debug] 2453970#2453970: *5786 delete posted event 000055B5D6F8A2902020/04/24 11:20:38 [debug] 2453970#2453970: *5786 http keepalive handler2020/04/24 11:20:38 [debug] 2453970#2453970: *5786 malloc: 000055B5D70BCB50:10242020/04/24 11:20:38 [debug] 2453970#2453970: *5786 SSL_read: -12020/04/24 11:20:38 [debug] 2453970#2453970: *5786 SSL_get_error: 22020/04/24 11:20:38 [debug] 2453970#2453970: *5786 free: 000055B5D70BCB502020/04/24 11:20:40 [debug] 2453970#2453970: *5787 http wait request handler2020/04/24 11:20:40 [debug] 2453970#2453970: *5787 malloc: 000055B5D6FB7B80:10242020/04/24 11:20:40 [debug] 2453970#2453970: *5787 SSL_read: 02020/04/24 11:20:40 [debug] 2453970#2453970: *5787 SSL_get_error: 52020/04/24 11:20:40 [debug] 2453970#2453970: *5787 peer shutdown SSL cleanly2020/04/24 11:20:40 [info] 2453970#2453970: *5787 client closed connection while waiting for request, client: 151.24.114.127, server: 62.94.34.21:4432020/04/24 11:20:40 [debug] 2453970#2453970: *5787 close http connection: 1232020/04/24 11:20:40 [debug] 2453970#2453970: *5787 SSL_shutdown: 12020/04/24 11:20:40 [debug] 2453970#2453970: *5787 event timer del: 123: 44035898432020/04/24 11:20:40 [debug] 2453970#2453970: *5787 reusable connection: 02020/04/24 11:20:40 [debug] 2453970#2453970: *5787 free: 000055B5D6FB7B802020/04/24 11:20:40 [debug] 2453970#2453970: *5787 free: 000055B5D6FBA190, unused: 8how could I inspect what is causing the failure?Edited by: Arkage on Apr 24, 2020 2:29 AMFollowComment"

Answer: 0It was a PHP error: used $_FILE['name'] rather than ['tmp_name'] variableCommentShareArkageanswered 3 years ago


Question: Port 25 open please

Please open my port 25 aws EC2 instance in my account my account Gmail is abrormuxtorov394@gmail.comMy Elastic IP Information 13.48.51.229FollowComment

Answer: 0See SMTP (port 25) outgoing connections blockedCommentShareRodney Lesteranswered 2 months ago


Question: Announcement: Amazon RDS for SQL Server ending support for Microsoft SQL Server 2012

"Microsoft announced they will end support for SQL Server 2012 on July 12, 2022. On that date, Microsoft will stop critical patch updates for SQL Server 2012. We strongly recommend that you upgrade your RDS for SQL Server 2012 database instance to a different major version at your earliest convenience [1].Starting September 1, 2021, we will begin disabling the creation of new Amazon RDS for SQL Server database instances using Microsoft SQL Server 2012. Starting June 1, 2022, we plan to end support of Microsoft SQL Server 2012 on Amazon RDS SQL Server. At that time, any remaining instances will be scheduled to migrate to SQL Server 2014 (latest minor version available) as described below. We recommend that you upgrade your Microsoft SQL Server 2012 instances to Microsoft SQL Server 2014 or later at a time convenient to you.You can schedule an upgrade to a different major version by going to the instance modify page in the AWS Management Console and changing the database version to a desired value. If you choose the "Apply Immediately" option, the upgrade will be initiated immediately after exiting the modify page. If you choose not to apply the change immediately, the upgrade will be scheduled during your maintenance window.Upgrade Options:We support five (or four on some regions) different major/minor version combinations of SQL Server 2012. These database instances can be upgraded to the latest minor version of SQL Server 2014, 2016, 2017, and 2019 directly. To find out more information on upgrading please reference this document [2].You will still be able to restore a SQL Server 2012 database to any major version supported instance on Amazon RDS SQL Server, even after the deprecation. For more information on restoring a database in RDS see here [3].Should you have any questions or concerns, the AWS Support Team is available via AWS Premium Support [4].[1] https://docs.microsoft.com/en-us/lifecycle/products/microsoft-sql-server-2012[2] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.SQLServer.html[3] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.html[4] https://aws.amazon.com/supportFollowComment"

Answer: 0[Announcement] Does not require an answer.CommentShareEXPERTIsraa-Nanswered 23 days ago


Question: How can I restrict S3 bucket access to allow only VPC Flow logs from within an organization?

"Hello,I have a landing zone created with Control Tower (Audit and Logging account and so on) In the logging account I have an S3 bucket in which I want to receive the VPC Flow logs from all current and future accounts from that organization. So, I want to create a bucket policy that only allows receiving VPC Flow logs as long as the source account is in the organization. The new accounts are created with Control Tower account factory by other teams in a self service fashion so I need to filter by organization, not account ids or specific ARNs.According to the VPC Flow logs user guide, you have to add the following statement (and another similar one but let's simplify things) to the S3 bucket policy to the destination bucket:{            "Sid": "AWSLogDeliveryWrite",            "Effect": "Allow",            "Principal": {"Service": "delivery.logs.amazonaws.com"},            "Action": "s3:PutObject",            "Resource": "my-s3-arn",            "Condition": {                "StringEquals": {                    "s3:x-amz-acl": "bucket-owner-full-control",                    "aws:SourceAccount": account_id                },                "ArnLike": {                    "aws:SourceArn": "arn:aws:logs:region:account_id:*"                }            }        }As I need to filter by organization and not by account, I tried using the aws:PrincipalOrgID condition key instead of the SourceAccount and SourceArn. However, I get an error saying that the aws:PrincipalOrgID does not support service principals and I cannot create the policy.I also tried with the aws:PrincipalOrgPaths condition key. Then, it lets me create the policy but when I try to create the Flow log it says "Access Denied for LogDestination: bucket_name. Please check LogDestination permissions."I have also tried keeping the principal as "*" and adding the "aws:PrincipalServiceName": "delivery.logs.amazonaws.com" to the condition but I get the same error when trying to create the Flow logs.Does anyone have any idea on how can I do that?Thanks in advanceFollowCommentAWS-User-shashank-1729 a year agoWere you able to figure this one out? I tested the solution of the following but that puts the principal to be over permissive: https://aws.amazon.com/blogs/security/control-access-to-aws-resources-by-using-the-aws-organization-of-iam-principals/if you have any idea however ideally we'd prevent one account overwriting another account's data, how can i make more cahnges to the following policy to be able to follow principle of least privilege ?Share"

Answer: "1Accepted AnswerYou cannot use any conditions related with organization, because the service principal is not a member of your organization.Just delete all conditions related to Account ID is a simple stupid solution. And keep S3 bucket name as secret. I believe that delivery.logs.amazonaws.com service is safe enough.{   "Sid":"AWSLogDeliveryWrite",   "Effect":"Allow",   "Principal":{      "Service":"delivery.logs.amazonaws.com"   },   "Action":"s3:PutObject",   "Resource":"my-s3-arn",   "Condition":{      "StringEquals":{         "s3:x-amz-acl":"bucket-owner-full-control"      }   }}I know it is not best, but simple! :)CommentShareEXPERTposquit0answered a year agoAWS-User-3850534 a year agoThanks for your answer @posquit0. That was my concern, that the delivery service principal is not member of my organization. There should be a way to restrict access to service principals within an organization as you cannot keep a bucket name as secret from a malicious ex employee.Share0I am creating central S3 bucket to get all VPC flow logs from many accounts within my org.. I using the principal org ID as the condition, however ideally we'd prevent one account overwriting another account's data, how can i make more cahnges to the following policy to be able to follow principle of least privilege ?S3BucketPolicy:Type: AWS::S3::BucketPolicyProperties:Bucket: !Ref S3BucketPolicyDocument:Version: '2012-10-17'Statement:Effect: AllowPrincipal:AWS: '*'Action:s3:ListBuckets3:PutObjects3:GetBucketAclResource:'arn:aws:s3:::testpolicycfns3vpc''arn:aws:s3:::testpolicycfns3vpc/*'Condition:StringEquals:aws:PrincipalOrgID: x-xxxxxxxRefrence links :https://aws.amazon.com/blogs/security/control-access-to-aws-resources-by-using-the-aws-organization-of-iam-principals/CommentShareAWS-User-shashank-1729answered a year agoAWS-CIA-Robert-C 10 months agoYou might be better off using this Centralized Flow Logs solution:  https://aws.amazon.com/blogs/mt/vpc-flow-log-with-aws-control-tower-lifecycle/Share-1Just get rid of the service principal:{    "Version": "2012-10-17",    "Statement": [        {            "Principal": "*",            "Action": "s3:PutObject",            "Resource": [                "arn:aws:s3:::flow-logs-bucket/*"            ],            "Effect": "Allow",            "Condition": {                "StringEquals": {                    "aws:PrincipalOrgID": "o-aaa123bbb456",                    "s3:x-amz-acl":"bucket-owner-full-control"                }            }        }    ]}CommentShareAWS-CIA-Robert-Canswered 10 months agoGary Mclean 3 months agoI wouldnt use Principal * as this grants all users and accounts within your Organisiation PutObject to the bucket.Nor does it follow least privilegeShare-1Hello,You can use "aws:ResourceOrgID" condition statement with the same and that should be working with your usecase. This lets the service related principals to only do mentioned actions when the resource org equals to the org id of the organization. You can use a condition as this -> "aws:ResourceOrgID": "${aws:PrincipalOrgID}"Here is the documentation -> https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceorgidCommentShareEXPERTrePost-User-2832841answered 17 days agoGary Mclean 17 days agoService principals are not part of your org.Share"


Question: Sagemaker training job successful but model not uploaded to s3

"Ok I've been dealing with this issue in Sagemaker for almost a week and I'm ready to pull my hair out. I've got a custom training script paired with a data processing script in a BYO algorithm Docker deployment type scenario. It's a Pytorch model built with Python 3.x, and the BYO Docker file was originally built for Python 2, but I can't see an issue with the problem that I am having.....which is that after a successful training run Sagemaker doesn't save the model to the target S3 bucket.I've searched far and wide and can't seem to find an applicable answer anywhere. This is all done inside a Notebook instance. Note: I am using this as a contractor and don't have full permissions to the rest of AWS, including downloading the Docker image.Dockerfile:FROM ubuntu:18.04MAINTAINER Amazon AI <sage-learner@amazon.com>RUN apt-get -y update && apt-get install -y --no-install-recommends \         wget \         python-pip \         python3-pip3         nginx \         ca-certificates \    && rm -rf /var/lib/apt/lists/*RUN wget https://bootstrap.pypa.io/get-pip.py && python3 get-pip.py && \    pip3 install future numpy torch scipy scikit-learn pandas flask gevent gunicorn && \        rm -rf /root/.cacheENV PYTHONUNBUFFERED=TRUEENV PYTHONDONTWRITEBYTECODE=TRUEENV PATH="/opt/program:${PATH}"COPY decision_trees /opt/programWORKDIR /opt/programDocker Image Build:%%shalgorithm_name="name-this-algo"cd containerchmod +x decision_trees/trainchmod +x decision_trees/serveaccount=$(aws sts get-caller-identity --query Account --output text)region=$(aws configure get region)region=${region:-us-east-2}fullname="${account}.dkr.ecr.${region}.amazonaws.com/${algorithm_name}:latest"aws ecr describe-repositories --repository-names "${algorithm_name}" > /dev/null 2>&1if [ $? -ne 0 ]then    aws ecr create-repository --repository-name "${algorithm_name}" > /dev/nullfi# Get the login command from ECR and execute it directly$(aws ecr get-login --region ${region} --no-include-email)# Build the docker image locally with the image name and then push it to ECR# with the full name.docker build  -t ${algorithm_name} .docker tag ${algorithm_name} ${fullname}docker push ${fullname}Env setup and session start:common_prefix = "pytorch-lstm"training_input_prefix = common_prefix + "/training-input-data"batch_inference_input_prefix = common_prefix + "/batch-inference-input-data"import osfrom sagemaker import get_execution_roleimport sagemaker as sagesess = sage.Session()role = get_execution_role()print(role)Training Directory, Image, and Estimator Setup, then a fit call:TRAINING_WORKDIR = "a/local/directory"training_input = sess.upload_data(TRAINING_WORKDIR, key_prefix=training_input_prefix)print ("Training Data Location " + training_input)account = sess.boto_session.client('sts').get_caller_identity()['Account']region = sess.boto_session.region_nameimage = '{}.dkr.ecr.{}.amazonaws.com/image-that-works:working'.format(account, region)tree = sage.estimator.Estimator(image,                       role, 1, 'ml.p2.xlarge',                       output_path="s3://sagemaker-directory-that-definitely/exists",                       sagemaker_session=sess)tree.fit(training_input)The above script is working, for sure. I have print statements in my script and they are printing the expected results to the console. This runs as it's supposed to, finishes up, and says that it's deploying model artifacts when IT DEFINITELY DOES NOT.Model Deployment:model = tree.create_model()predictor = tree.deploy(1, 'ml.m4.xlarge')This throws an error that the model can't be found. A call to aws sagemaker describe-training-job shows that the training was completed but I found that the time it took to upload the model was super fast, so obviously there's an error somewhere and it's not telling me. Thankfully it's not just uploading it to the aether.{            "Status": "Uploading",            "StartTime": 1595982984.068,            "EndTime": 1595982989.994,            "StatusMessage": "Uploading generated training model"        },Here's what I've tried so far:I've tried uploading it to a different bucket. I figured my permissions were the problem so I pointed it to one that I new allowed me to upload as I had done it before to that bucket. No dice.I tried backporting the script to Python 2.x, but that caused more problems than it probably would have solved, and I don't really see how that would be the problem anyways.I made sure the Notebook's IAM role has sufficient permissions, and it does have a SagemakerFullAccess policyWhat bothers me is that there's no error log I can see. If I could be directed to that I would be happy too, but if there's some hidden Sagemaker kungfu that I don't know about I would be forever grateful.FollowComment"

Answer: "0I fixed it! My training script was not actually saving to the proper folder in /opt/ml/model.CommentShareFuriouStylesanswered 3 years ago0Hello,As mentioned here https://docs.aws.amazon.com/sagemaker/latest/dg/your-algorithms-training-algo-output.html the final model should be written to /opt/ml/model by the algorithm in order to successfully upload it to S3 as a single object in compressed tar format.CommentShareKaushikM-AWSanswered 3 years ago"


Question: Lightsail DNS Zone doesn't allow to add A registers without Subdomains

"Hello,I'm trying to add an "A Record" for my main domain (i.e. domain.com) to my Lightsail DNS zone, however the field check forces me to add a subdomain (i.e. www.domain.com). Can anyone help me to do this?FollowComment"

Answer: "1Ok I found myself the answer, I just had to add @ as subdomainCommentShareAWS-User-5234593answered a year ago"


Question: Unassigned ticket for more than 72 hours

"Hi everyone, Has anyone had experience with AWS not responding for more than 72 hours (and counting) on SES production access request? Do you have suggestions on what to do in such a case?Our current support plan is basic, as we are evaluating possible migration to AWS.In case the AWS team sees this question, the number of my case is xxxxxxxxxx. Please help.Edit: Removed case ID — Thomas E.FollowComment"

Answer: "0Hello,There's a doc describing how to get access to production: Moving out of the Amazon SES sandbox. Did you tried it?Important:AWS Basic Support offers support for account and billing questions and service quota increases. There are other plans offering a number of technical support cases with pay-by-the-month pricing and no long-term contracts.All AWS customers automatically have 24x7 access to these features of Basic Support:One-on-one responses to account and billing questionsSupport forumsService health checksDocumentation, technical papers, and best practice guidesMaybe, if you need tech support consider upgrade to other plans like Developer Plan.CommentShareNightCrawleranswered 2 months agorePost-User-4252866 2 months agoHi, thanks for sharing.Yes, I have seen the guide before submitting my request for moving out of the SES sandbox. Currently, my SES display the following message:We’re in the process of reviewing your request for production access. To view the details of your request, see case ID 12390207841Based on the same guide, I assume the request is also available to all accounts, regardless of the support tier.The strange part is I have not received any initial response, and the guide clearly stated...Once you submit a review of your account details, you can’t edit your details until the review is complete. The AWS Support team provides an initial response to your request within 24 hours.Share0Just an update, AWS support has responded to my request :)CommentSharerePost-User-4252866answered 2 months ago"


Question: ECS Fargate Task Logs Empty When Using a Entrypoint Shell Script

"Scenario:Using ECS Fargate to launch Tasks from a Task Definition ( the container is a Python Django container, running a management command if this matters)Problem: Logs were empty in Cloudwatch for the task run (completely - no data at all, but the log groups and stream were created).When running the container locally, stdout outputted the expected dataAfter much research and trial and error, I found that using a ENTRYPOINT command with a shell script is the problem.  If I were to switch this to run the container with just the raw cli command as the ENTRYPOINT, the logs show in CW as expected.  What is the reasoning/problem for this, and is there a different/better way to find out what was going on here besides trial and error?This Doesn't Work (in docker)ENTRYPOINT [ "/app/docker-entrypoint.sh" ]CMD ["run_management_command"]# docker-entrypoint.sh# code shortened for a little brevity, may have syntax errorsshiftexec python manage.py "$@"This Works ( in docker)CMD ["python", "manage.py", "run_management_command"]Does the shell script / exec cause the AWS std out logger to become disassociated somehow?FollowCommentAWS-User-5726074 a year agoIn both scenarios, the container runs as expected and does it's job.  Just the logging is missing from the docker-entrypoint runShare"

Answer: "0I understand that when you are running a shell script as your Entrypoint in the Docker file. When deploying the image in ECS Fargate, you observed that the logs are no longer pushed to cloudwatch. As you might already know,  The awslogs log driver simply passes the container logs that are the STDOUT and STDERR I/O streams from Docker to CloudWatch Logs. Now, I understand that you were able to see the logs when running the command directly instead of running as an “exec” in a shell script.So, since you are running the container on ECS Fargate, you would not be able to access the underlying host where the task is running.  Hence, I would suggest that you try launching the same container on EC2 launch type with the same Network configuration as your Fargate tasks. Doing this, once the task gets scheduled on an EC2 worker nodes, you can SSH in to the EC2 worker node and then check if “docker logs <container-name>” shows expected data in the output. Verifying that you are able to run the ECS Task on EC2 container instance would be the next step after verifying that your container runs fine in your local maching.  When you run docker logs from within the worker node, you are essentially pulling the STDOUT/STDERR log streams captured from the container. If the docker logs command does not return any output then you can further troubleshoot the issue by trying to exec in to the container to see if the application is running in the container as expected and verify if the application is able to write logs out to the STDOUT.Considering that we need additional information to be able to completely understand what the issue is, I would suggest that you raise a support ticket with AWS Premium Support to get assistance with this issue.CommentShareSUPPORT ENGINEERPraneel_Manswered a year ago"


Question: How to run AWS CONFIG advanced queries using Lambda Function

My requirement is to generate a report  to list all AWS resource by executing AWS Config advanced queries  using Lambda function on regular basis . Could you please assist how to achieve itFollowComment

Answer: "1You can query the AWS Config API for advanced queries with the SelectResourceConfig API call. See the AWS documentation for an (CLI) example.CommentShareSoenke Ruempleranswered a year agorePost-User-6295019 a year agoI created lambda function and invoking the SelectResourceConfig API using aws cli using below query and it is failing with "Syntax error in module 'lambda_function': invalid syntax (lambda_function.py, line 23)".import subprocessimport loggingimport boto3logger = logging.getLogger()logger.setLevel(logging.INFO)def run_command(command):command_list = command.split(' ')#print(command_list)try:logger.info("Running shell command: "{}"".format(command))result = subprocess.run(command_list, stderr=subprocess.STDOUT, stdout=subprocess.PIPE);#print(result)logger.info("Command output:\n---\n{}\n---".format(result.stdout.decode('UTF-8')))except Exception as e:logger.error("Exception: {}".format(e))return Falsereturn resultdef lambda_handler(event, context):run_command('/opt/aws configservice select-resource-config --expression "SELECT resourceId,resourceName,resourceType,configuration.tags.value,configuration.vpcId,configuration.subnetId,configuration.publicDnsName,configuration.privateIpAddress,configuration.imageId,configuration.iamInstanceProfile.arn,configuration.instanceId,configuration.instanceType,configuration.securityGroups,configuration.platform,configuration.architecture,configuration.availabilityZone,configuration.state.nameWHEREresourceType = 'AWS::EC2::Instance'order byresourceId,resourceName,resourceType,configuration.state.name"')Share1You could use AWS Eventbridge (what used to be called Cloudwatch Events earlier) to create a Scheduler rule that will trigger at periodic intervals. You can define a lambda function as the target of the Lambda function.Inside the lambda function you can call the relevant API that will give you what you want. For example, if you want to use the AWS Config API ListDiscoveredResources, then you can call the API from inside your lambda function. There are samples provided in the documentation for supported languages - https://docs.aws.amazon.com/config/latest/APIReference/API_ListDiscoveredResources.html. You could write the output to a file and save it on S3.CommentShareEXPERTIndranil Banerjee AWSanswered a year ago"


Question: "Import from VMware to AMI successful, but instance not displaying in EC2"

"I successfully converted an image from OVA to AMI:$ aws ec2 describe-import-image-tasks --import-task-ids import-ami-0094af0aff9aaxxxx{"ImportImageTasks": [{"Architecture": "x86_64","Description": "PlayoffPredictor VM","ImageId": "ami-002a51456b92bxxxx","ImportTaskId": "import-ami-0094af0aff9aaxxxx","LicenseType": "BYOL","Platform": "Linux","SnapshotDetails": [{"DeviceName": "/dev/sda1","DiskImageSize": 7515369984.0,"Format": "VMDK","SnapshotId": "snap-0ce29118c6e01xxxx","Status": "completed","UserBucket": {"S3Bucket": "aws-bucket-asda","S3Key": "PlayoffPredictor.com_5.ova"}}],"Status": "completed","Tags": []}]}However, no image shows in my EC2 console.  Where is the imported image exactly?FollowComment"

Answer: 0Figured it out.  Have to find the image under snapshotsCommentShareCiscoNevilleanswered 2 years ago


Question: Server has wrong security certificate attached

"Hi,I have a domain name registered with Route53 (say its X.com). The hosted zone has CNAME records for my SSL certificate for the same domain from ACM. However, when I launch my Elastic Beanstalk instance (I have a A record pointing to my EB environment) and go to my domain name I initially get the following error:Your connection is not privateAttackers might be trying to steal your information from X.com (for example, passwords, messages or credit cards). Learn moreNET::ERR_CERT_COMMON_NAME_INVALIDThis server could not prove that it is X.com; its security certificate is from *.Y.com. This may be caused by a misconfiguration or an attacker intercepting your connection.After a few mins I can reload the page and everything is fine. Is this to do with delays in propagating the certificate? Or is something else going on?ThanksFollowComment"

Answer: "0Hi,I am assuming you see the NET::ERR_CERT_COMMON_NAME_INVALID error from a web browser such as Google Chrome.  I believe this error usually means that the browser sees the domain in the subject (or SAN list) of the cert as not a match for the domain in the browser's address bar.I suggest comparing the domain in your browser address bar (ex: www.X.com) with the subject (or SAN list) of the cert.  Specifically, use the browser to view the cert in case the browser is for some reason not seeing the cert you expect.  Usually you can click the padlock in a browser address bar and drill in to see the details of the certificate.For example, maybe your browser is encountering a local proxy server with non-matching certificate instead of reaching your ElasitcBeanstalk instance that is otherwise configured correctly with your certificate.  Or, maybe the CNAME you are using with your browser does not match the subject on the cert you provisioned through ACM (ex: CNAME is "www.X.com" but cert is for "X.com").You can also also try using a tool such as "curl -v https://www.X.com" to access your ElasticBeanstalk instance and see if it gives you more information about the connection security, etc.  Although note a command like curl may do something different than your browser such as not abide by Windows proxy settings (and therefore work whereas your browser still fails).I am not certain, but it may also be that if your web site loads resources (i.e., contains HTTPS links to other sites) and one of those links produces this error condition then the browser will report the error you see even if your address bar domain and certificate subject match?  Just bringing up another possible explanation.Regards,RyanCommentShareRyan_Manswered 4 months ago"


Question: cloudwatch agent timestamp freezes after some time.

"Cloudwatch at some point starts posting with a  frozen timestamp.  https://github.com/aws/amazon-cloudwatch-agent/issues/198 .If we restart the agent, the problem goes away, at least for a bit of time.I am wondering if anybody else is seeing this issue and if there is any known work around.On a whim, I tried sending logs  larger thank 250k  but those logs are correctly suppressed and the next logs work fine.  I've attempted to look for patterns for when the anomaly begins, but so far no luck.FollowComment"

Answer: 0The attached github bug defines the problem and fix.CommentSharezsoltszaboanswered 2 years ago0The attached github bug defines the problem and fix.CommentSharezsoltszaboanswered 2 years ago


Question: Streaming Video Optimization

"Hello everybody, I'll have a two days event, with 1/2k participants connected simultaneosly.I'll do the streaming with vMix and following this tutorial:https://aws.amazon.com/it/blogs/media/connecting-obs-studio-to-aws-media-services-in-the-cloud/My questions are:-) all the process described is optimized or there are settings that I could change?-) anyone used this service with success for 10 hours straight?-) a Lightsail instance with 16 GB Memory, 4 Core Processor, 320 GB SSD Disk and 6 TB Transfer will be enough to insert the player?-) which player do you suggest?Thanks in advance!FollowComment"

Answer: "0MeeTec-AWSThe blog post you referenced is great to show the process of setting up the upstream streaming device, MediaLive and MediaPackage. It does however not go into detail on optimization of the workflow. As an example, it does not address the HLS stack configuration, i.e. the number of renditions in the stack, nor does it touch on the bit rate and resolution of these renditions. This is left to the individual user, since this may differ greatly based on the individual needs/requirements. Having said that, MediaLive has a few templates that are available on the Channel and Input Details page, Channel Template section. Specifically, take a look at the templates called "HTTP Live Streaming - MediaPackage" or "Live Event - MediaPackage". Either of these would be a good starting point.  Note that the "HTTP Live Streaming - MediaPackage" template does contain a WebVTT rendition as well, which you may have to delete if your source does not contain captions.Additionally, with +- 500 viewers I would strongly suggest to have your MediaPackage channel spin up a CloudFront distribution for the channel as well. When you create the MediaPackage instance, there is a section called CloudFront distribution details. In this section select the option called Create a CloudFront distribution for this channel. This will then allow MediaPackage to create the CloudFront distribution optimized for live video streaming.As for the Lightsail instance, the specification you had raised should be sufficient, but it would depend on the player used. I can't suggest a specific player that you should be using. Perhaps customers on this forum may have some suggestions based on what they have used in the past.  In section 4 of https://github.com/aws-samples/aws-media-services-simple-live-workflow, I do see a few players referenced.CommentShareAWS-User-5437070answered 3 years ago0Thanks a lot for your answer and sorry for my late replay!One detail about the tempates:which is the difference between HLS and MediaPackage for the same template type?CommentShareMeeTec-AWSanswered 3 years ago0MeeTec-AWSThe HLS templates create an HLS Output Group for you, while the MediaPackage template creates an MediaPackage Output group.  The MediaPackage Output Group has been simplified, to make the creation of such an output group very easy. Think of it as an HLS output group in which most of the settings have been already been set to good defaults for MediaPackage.CommentShareAWS-User-5437070answered 3 years ago0Thanks a lot!! Have a nice weekend!CommentShareMeeTec-AWSanswered 3 years ago"


Question: DynamoDB updateItem: validation errors in params definition (novice here)

"I defined a DynamoDB updateItem params variable like this:   params0 = {               TableName: 'FHCRoomCounts',               Key: {                     timeSlot: '0830',                     room: 'chapel',                    },               UpdateExpression: 'ADD registrants :n',               ExpressionAttributeValues: {                                           ':n' : 1,                                          },  // end ExpressionAttributeValues               ReturnValues: 'ALL_NEW'              };  // end params0 = { ... }Logged to the console in response was a message noting 13 validation errors. That message is reproduced below.This is a minimal case for purposes here. Ultimately, what I want to do is capture the form data on a form submit event (done that) and programmatically update the table using that data. But first, I have to master a simple updateItem using a params definition written by hand.Can anyone direct a novice to the error(s) in the params0 definition? Any help sure would be appreciated.--The Error Message Logged To The Console--The AnswerNote:Edit: 2019.06.127:After spending seemingly a decade immersed in the DynamoDB API documentation, I finally figured out the answer. I have deleted the error messages originally appearing here and instead I enter the answer. params0 = {    'TableName': 'FHCRoomCounts',    'Key': {             'timeSlot': {                           'S': '0830'                         },              'room': { 'S': 'chapel'                      }                                      },    'ExpressionAttributeValues': {                                  ':n': {'N': '1'},                                 },    'UpdateExpression':'ADD registrants :n',    'ReturnValues': 'ALL_NEW',   };Edited by: alxfyv on Jun 17, 2019 12:22 AMFollowComment"

Answer: "0As noted in the Edit, I discovered the answer. Rather than delete the question, I thought to let it stand with the answer in it in case it might be useful to someone else.CommentSharealxfyvanswered 4 years ago"