Question: Unable to Import Custom slot type from a zip file

"Hello everyone.I am trying to create a translator chatbot. I have a compressed json file in zip format and I want to use the zip file to create a slot type. The zip file contains 100 enumeration values. However, I do not see the option to create a slot type from an import on my aws interface. I am stucked. I need help please.FollowComment"

Answer: "0Hi,In Lex V2, we currently only support Import/Export feature for Bot and BotLocale resource. If you want to add a slotType to one of the locales, you can use our CreateSlotType API instead: https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateSlotType.html.Feel free to reach out if you have questions.CommentShareShreyBanswered a year ago"


Question: CPU Credit Balance Getting Zero

"We have the Jenkins Server on EC2 instance, the CPU Credit Balance is automatically going to zero without any load on the instance.What are the alternatives for this issue so that CPU Credit Balance stays above zero?Instance Size is 8gb,Instance Type is t3.mediumFollowComment"

Answer: "0here are some key concepts about burstable instancesother than that, check if you are seeing the right metric aggregation is set to average or maximum, see the screenshot belowhere is some documentation about how to monitor the credit usagefinally, if you want to continue providing CPU credit even if you are running out of credits you can enable Unlimited modeCommentShareEXPERTDamian Olguinanswered 19 days agoAWS-ADolganov 17 days agoJust a small addition on the "unlimited mode" - it can be less cost effective than running a normal non-burstable instance type, it's worth looking into the m, r or c instance types insteadShare"


Question: OAuth Scope based Authorization in AppSync

"Assume we have Cognito user pools with one application (ex: photos app) with custom scopes defined (ex: photos.read). In https API GW, we can restrict the access using the scope and audience. This article is explains using group claims -  https://aws.amazon.com/blogs/mobile/graphql-security-appsync-amplify/.  Can we do similar authorization based on OAuth scope ?FollowComment"

Answer: "1Hello!I was taking a peek at your question and conversing with some colleagues, and I think I may have found an example CDK (AWS Cloud Development Kit) example that you may be able to test this with:https://serverlessland.com/patterns/eventbridge-api-appsync-cdkThe serverlessland.com website is a site that our serverless developer advocates curate serverless patterns on, and after taking a peek at the page and corresponding GitHub page, I think this may be able to get you a head start on testing this.Note it may spin up some infrastructure you don't need, but it will give you start on automating your deployments.CommentShareSUPPORT ENGINEERTim_Panswered a year ago"


Question: SES DMARC Google fail

"Hi everyone,We are using SES to send our emails from ec2 servers, we had already setup the DKIM / SPF, however the google is still failing the DMARCHere is the google raw message dkim=pass header.i=@amazonses.com header.s=7v7vs6w47njt4pimodk5mmttbegzsi6n header.b=j5RPkmox;       spf=pass (google.com: domain of 010101667a5912cb-e91361bf-4377-49b3-88b9-8397f33f8425-000000@us-west-2.amazonses.com designates 54.240.27.53 as permitted sender) smtp.mailfrom=010101667a5912cb-e91361bf-4377-49b3-88b9-8397f33f8425-000000@us-west-2.amazonses.com;       dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=showpo.comThe DMARC report from google is failed as well<record><row><source_ip>54.240.27.19</source_ip><count>2468</count><policy_evaluated><disposition>none</disposition><dkim>fail</dkim><spf>fail</spf></policy_evaluated></row><identifiers><header_from>domain.com</header_from></identifiers><auth_results><dkim><domain>amazonses.com</domain><result>pass</result><selector>7v7vs6w47njt4pimodk5mmttbegzsi6n</selector></dkim><spf><domain>us-west-2.amazonses.com</domain><result>pass</result></spf></auth_results></record>Any advise will be appreciated here. Thanks in advancedCheersFollowComment"

Answer: "0Hi,We have how to comply with DMARC described here https://docs.aws.amazon.com/ses/latest/DeveloperGuide/dmarc.html, you can follow the instruction to set up everything.CommentShareYiwei-AWSanswered 5 years ago"


Question: Find old Forum Thread ID for migrating our Simple AD to a new AWS Managed Microsoft AD

I'm looking for the info formerly included in an old forum thread that has disappeared with the migration to the new AWS re:Post forum.Is it possible to find the info in this thread? https://forums.aws.amazon.com/thread.jspa?threadID=261247I'm looking for info on migrating our existing Simple AD directory to a new AWS Managed Microsoft AD directory.FollowComment

Answer: "0Hi Mr PRSTO,Unfortunately, AWS forum has been deprecated and only select threads were migrated into re:Post.For information about migrating SimpleAD, you can look that this blog post:How to Migrate Your Microsoft Active Directory Users to Simple AD or AWS Managed Microsoft ADCommentShareEXPERTDzung_Nanswered a year ago"


Question: GameLift Server SDK5 WebSocket returning throttling errors on InitSDK() call

"I am using GameLift through the Go version of Server SDK5. When I instantiante the fleet with 50 game server processes on an instance (there is only one instance), I get this error in game server process logs :2023/05/03 09:56:02.812774 websocket.go:55: [DEBUG]:Response header is: map[Content-Length:[113] Content-Type:[application/json; charset=UTF-8] Date:[Wed, 03 May 2023 09:56:02 GMT] Via:[1.1 ffe68b4a5d64737b8a3ccde75553a7ac.cloudfront.net (CloudFront)] X-Amz-Apigw-Id:[EVxj9F6WjoEFufA=] X-Amz-Cf-Id:[TYcHtwXIHyFPVlBRLHFuptYeLk7tueWkCyUj7Iuyqf20C2eK2u2lNQ==] X-Amz-Cf-Pop:[DUB56-P1] X-Cache:[Error from cloudfront]]2023/05/03 09:56:02.812782 websocket.go:56: [DEBUG]:Response body is: {"Action":"$connect","RequestId":"$connect","StatusCode":429,"ErrorMessage":"ThrottlingException: Rate exceeded"}2023/05/03 09:56:02.812795 gamelift.go:61: GameLift InitSDK failed with error : [GameLiftError: ErrorType={19}, ErrorName={Local connection failed.}, ErrorMessage={[GameLiftError: ErrorType={24}, ErrorName={WebSocket Connection Failed}, ErrorMessage={connection error 429 Too Many Requests:websocket: bad handshake}]}]It seems that the WebSocket server is throttling the connections because there are too many at a time. GameLift creates and runs all 50 processes of game servers within a timeframe of 50 milliseconds , each process then calls the SDK function gameLiftServer.InitSDK(), and so throttling happens. As a result, we have to do random sleeps to avoid the processes calling InitSDK() at the same time, and retrying if the call still fails with a 429 error.Is that normal behavior ? With SDK4, we did the same thing, same number of calls, and no errors happened. Is there a way to increase the throttling maximums on the GameLift WebSocket server side ?FollowComment"

Answer: "0Thanks for bringing this to our attention. This is something we're looking into currently, but in the meantime I would suggest implementing a backoff and retry strategy with jitter to ensure your calls aren't getting throttled. If you'd like to track this with the service team please make sure to cut a customer support case.Thanks!CommentShareShashankJ_AWSanswered 25 days ago"


Question: data type converstion in DocumentDB using aggregation pipelines

"I have a MongoDB aggregation pipeline that converts a string to a double.  I just realized that DocumentDB doesn't support the $convert or $toDouble operators.  Is there any workaround for this problem while still using an aggregation pipeline?Below is an extract from my pipeline that works in MongoDB Atlas:...{    $convert:{        input:$subDoc.stringVar,        to:'double',        'onError':0,        'onNull':0    }}, ...FollowComment"

Answer: "0Hello. You could use the Javascript parseFloat() method and programmatically update those strings to double in the existing collection.  Or use an $out stage in the aggregation and update the results afterwards.Something like this will loop through all documents in the collection and update the string:db.collection.find({}).forEach( function(doc) {  doc.subDoc.stringVar = parseFloat( doc.subDoc.stringVar );  db.collection.update( { _id: doc._id }, {$set: { "subDoc.stringVar": doc.subDoc.stringVar } } ) });CommentShareMihai Aanswered a year ago"


Question: Amplify and Google Search

"Hi, I hope I can explain this succinctly! I have a Docusaurus site hosted on AWS Amplify. I have the domain set up and it resolves correctly to https://docs.cavalry.scenegroup.co/The problem I'm facing is that the url that shows up in Google Search is the original amplify url. e.g. https://main.d1fnr9j76bdr39.amplifyapp.com/I'm no expert (!) but it looks like the canonical metadata is the bit I need to change. Is there anything I can do via the console (or otherwise) to resolve this?Thanks.FollowComment"

Answer: "0Since your website can be accessed by multiple urls, you need to tell the search engine which URL is the canonical URL. One way to do it is to add a link tag in your pages <head> to point to the canonical url.example: <link rel="canonical" href="https://docs.cavalry.scenegroup.co" />More info can be here: https://developers.google.com/search/docs/advanced/crawling/consolidate-duplicate-urlsCommentShareMODERATORMohamed_Banswered a year agoChris Hardcastle a year agoThanks Mohamed. When I do a URL inspection in Google Search the Amplify link is the 'User-declared canonical'. I have not explicitly/ intentionally declared this so was hoping there might be something in the Console to allow me to specify this (e.g. it seems AWS is setting it). This site is for documentation so we've got 100s of pages - I'm hoping not to need to do this for each page individually!ShareMohamed_B MODERATORa year agoI inspected your website and see that you have <link data-react-helmet="true" rel="canonical" href="https://main.d1fnr9j76bdr39.amplifyapp.com/"> in your website. You need to edit that.ShareMohamed_B MODERATORa year agoI am not a Docusaurus expert but I think you are defining the url https://main.d1fnr9j76bdr39.amplifyapp.com somewhere in your config, and Docusaurus is automatically injecting the canonical tag link for you https://docusaurus.io/docs/next/seo#single-page-metadataShare"


Question: AWS not responding within 24 hours on System impaired

"Hi everyone,Has anyone had experience with AWS not responding within 24 hours on System impaired case ?Do you have suggestions on what to do in such a case?In case the AWS team sees this question, the number of my case is xxxxxxxxxx.Please help.Edit: Removed case ID — Chrissy B.FollowComment"

Answer: "0Hello,I'm so sorry for the delay you experienced in receiving assistance. I have reviewed your case and can see that one of our support engineers has followed up with you. Thank you for your patience!Best regards,Kita B.CommentShareEXPERTAWS Support - Kitaanswered a year ago"


Question: vscode builder id fails to connect

"I setup a dev environment in codecatalyst yesterday and it would trigger vscode when I connected.Today, tried to use it again, but when vscode is launched it fails to connect and checking the AWS Toolkit logs, I see2023-01-12 17:33:44 [ERROR]: log level: info2023-01-12 17:33:45 [INFO]: Retrieving AWS endpoint data2023-01-12 17:33:45 [INFO]: OS: Darwin x64 22.1.02023-01-12 17:33:45 [INFO]: Visual Studio Code extension host:  1.74.32023-01-12 17:33:45 [INFO]: AWS Toolkit:  1.60.02023-01-12 17:33:45 [INFO]: node: 16.14.22023-01-12 17:33:45 [INFO]: electron: 19.1.82023-01-12 17:33:45 [WARN]: AwsContext: no default region in credentials profile, falling back to us-east-1: 2023-01-12 17:33:45 [WARN]: CloudFormationTemplateRegistry: addWatchPattern(**/*.{yaml,yml}): no workspace2023-01-12 17:33:45 [WARN]: CodelensRootRegistry: addWatchPattern(**/requirements.txt): no workspace2023-01-12 17:33:45 [WARN]: CodelensRootRegistry: addWatchPattern(**/package.json): no workspace2023-01-12 17:33:45 [WARN]: CodelensRootRegistry: addWatchPattern(**/*.csproj): no workspace2023-01-12 17:33:45 [WARN]: CodelensRootRegistry: addWatchPattern(**/go.mod): no workspace2023-01-12 17:33:45 [WARN]: CodelensRootRegistry: addWatchPattern(**/build.gradle): no workspace2023-01-12 17:33:45 [WARN]: CodelensRootRegistry: addWatchPattern(**/pom.xml): no workspace2023-01-12 17:33:52 [WARN]: auth (codecatalyst): removing saved connection "codecatalyst.savedConnectionId" as it no longer exists2023-01-12 17:33:52 [ERROR]: aws.codecatalyst.openDevEnv: Error: Connection is invalid or expired. Try logging in again. [InvalidConnection]2023-01-12 17:36:21 [ERROR]: aws.codecatalyst.openDevEnv: Error: Connection is invalid or expired. Try logging in again. [InvalidConnection]2023-01-12 17:38:46 [INFO]: telemetry: sent batch (size=20)2023-01-12 17:38:46 [INFO]: telemetry: sent batch (size=14)2023-01-12 17:41:23 [ERROR]: aws.codecatalyst.createDevEnv: Error: Connection is invalid or expired. Try logging in again. [InvalidConnection]2023-01-12 17:43:46 [INFO]: telemetry: sent batch (size=13)I've trieduninstalling and re-installing the AWS Toolkit extension,creating a new dev environment in codecatalystclicking on the builder ID icon in AWS Toolkit extensionLogging out and back in to codecatalyst.aws with builder idand none of them worked. Any suggestions?FollowComment"

Answer: "1Accepted AnswerHi there,Based on the error message, it looks like your session was expired. Could you please try logging into CodeCatalyst from the Toolkit ? Please feel free to reach out if the error still occurs.CommentShareMODERATORSundaresh_Ianswered 5 months ago1For anyone who couldn't find how to do this -Click on the AWS extension icon in the left hand tab of VSCode -Choose CodeCatalyst > Start from the developer tools extensionFollow any prompts from VSCode about allowing Code to open an external websiteIn your browser, allow aws-toolkit to access your dataIn VSCode, you should now have an option Open Dev Environment - click thisAfter a short delay, you should get a list of the available dev environments for your Builder ID - choose the appropriate environment.CommentShareSimon Hanmeranswered 5 months ago"


Question: "Is it possible for Amplify DataStore to skip a table on client, but to create a DynamoDB table for a scheme type"

"Hi, In our amplify app we have a table that can contain huge text fields, so we would prefer to work with this data on AppSync/QraphQL  level without DataStore.Is it possible to declare the scheme in such a way so the DataStore doesn't even try to sync that model?If I get it right from the docs [1] @model directive is required for Amplify to generate DynamoDB table (and for the @searchable to work).So we currently added an DataStore config on syncExpressions to prevent the sync, but that approach seems odd, so I hope it's possible to exclude the table from DataStore altogether?for the example:type Document @model(subscriptions: { level: off }) @auth(rules: [{ allow: owner}]) @searchable {    id: ID! @primaryKey    content: AWSJSON!}Amplify.configure({    ...awsExports,    DataStore: {        syncExpressions: [            syncExpression(Document, doc => doc?.id('eq', '0'))        ],We still receive warnings with this approach, I guess they are caused by the subscription off param in @model derectiverecoverable error {error: {…}}error: cause: {provider: AWSAppSyncRealTimeProvider, error: {…}}errorType: "Unknown"localModel: nullmessage: "Connection failed: {\"errors\":[{\"message\":\"Validation error of type FieldUndefined: Field 'onUpdateDocument' in type 'Subscription' is undefined @ 'onUpdateDocument'\"}]}"model: "Document"operation: "Update"process: "subscribe"recoverySuggestion: "Ensure app code is up to date, auth directives exist and are correct on each model, and that server-side data has not been invalidated by a schema change. If the problem persists, search for or create an issue: https://github.com/aws-amplify/amplify-js/issues"remoteModel: null[[Prototype]]: Object[[Prototype]]: ObjectoverrideMethod @ react_devtools_backend_compact.js:2367errorHandler @ index.tsx:39(anonymous) @ subscription.ts:450step @ mutation.ts:574...there are similar errors for onCreateDocument and onDeleteDocument[1] - https://docs.amplify.aws/cli-legacy/graphql-transformer/model/FollowComment"

Answer: "1Accepted AnswerHello,From your query, I understand that you would like to use the Document table directly without configuring the DataStore for it. You have tried to configure the DataStore configuration for syncExpression on the table to prevent the syncing of the data. However, you are observing the error on subscription for the generated schema.Please note that, unfortunately, at the moment, the disabling of DataStore for a specific model is not supported in Amplify applications. DataStore can be enabled or disabled for the entire Amplify project at once using the amplify update api command. There is an active feature request with Amplify service team on this issue. You can track this FR on the same GitHub issue. It also mentions the workaround of disabling the sync as you mentioned. We can leverage the same workaround to prevent the DataStore sync of the table.Having said that, for the error you are observing, this is being returned as the subscriptions are not being generated for the Document model. I tried replicating this warning in my sample application however, I did not received this error. To further investigate on this, we would need to check if there is no subscription connection being established for the Document model. For more information, please refer subscribing to data.I hope you find above information helpful. In case you require further assistance specific to the above error being observed, please share if the subscription connection is being established from the application. You may also reach out to us via a Support case.Have a nice day ahead!CommentShareSUPPORT ENGINEERShadab_Aanswered a month ago0Hi @Shadab_A, I was thinking today, that what if I don't even need the GraphQL API for that model. All work with it is done through custom backend code on Node.js. I save the data through AWS SDK DynamoDB API, and query it on client only through my custom NodeJS endpoints and the OpenSearch AppSync API generated from the @searchable.Can I than skip the table on front-end  by the workaround I mentioned at the github  issue[1]?(in short, simply by removing the model from the scheme before running amplify codegen models)Or will it have some other impact that I don't see at the moment?[1] - https://github.com/aws-amplify/amplify-js/issues/10062#issuecomment-1531139785CommentShareArsenanswered a month agoShadab_A SUPPORT ENGINEERa month agoHello,Thank you for writing back.In case you generate the models using the method defined in the GitHub issue, it may work until the changes are not being make to the GraphQL API or the command amplify codegen model. These would generate the models again and might cause issues in future. This has been addressed by Amplify service team on the GitHub comment: https://github.com/aws-amplify/amplify-js/issues/10062#issuecomment-1531636954Let me know in case you have any follow up questions!Share"


Question: AMS Windows 2012 server...failed to authenticate with service

Service successfully installed on source.   "How to solve this?" does not appear to have anything relevant on this particular error.Why am I getting this error in AWS and how do I solve it?FollowComment

Answer: "1We had this same problem - Data replication stalled: Failed to authenticate with Service.In our case the problem was that the Replication Server was unable to access the management service from the custom Subnet we had created for the migration.Apart from the authentication failure error message, we also noticed that Replication EC2 instances were being created, then terminated after about 10 minutes of inactivity.To diagnose this we created a new EC2 instance and edited the Network settings to use the same VPC and Subnet as used by the Replication Server. From an SSH terminal we were able to confirm that the instance could not reach the management API when running the following commandcurl https://mgn.{region}.amazonaws.com/On the Replication VPC this command would timeout,  but on servers in a different VPC this command would return a response immediately.In our case the problem was that we had modified the Network ACL rules to restrict traffic inbound, and response traffic from the outbound http request was being blocked (as Network ACLs are stateless).To fix it we needed to add a Network ACL allowing all Inbound TCP traffic on the ephemeral ports 32768 - 65535.CommentShareJoeanswered 10 months ago0Hello,From the information provided, I am able to determine that this could be an issue with the Service Linked role not created with the right permissions.Application Migration Service uses AWS Identity and Access Management (IAM) service-linked roles. A service-linked role is a unique type of IAM role that is linked directly to Application Migration Service. Service-linked roles are predefined by Application Migration Service and include all the permissions that the service requires to call other AWS services on your behalf.A service-linked role makes setting up Application Migration Service easier because you don’t have to manually add the necessary permissions. Application Migration Service defines the permissions of its service-linked roles, and unless defined otherwise, only Application Migration Service can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity.Link- https://docs.aws.amazon.com/mgn/latest/ug/using-service-linked-roles.htmlCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months agojake 10 months agoThank you for the prompt reply.  Sorry to say that I'm not really sure where this was supposed to lead.I deleted the server from AMS, uninstalled/deleted from my source machine, and deleted the IAM user.I then tried it all again, letting AMS recreate the user.I then went to the AMS settings and 'reinitialized' the permissions.Got a little further, but this issue is at least resolved.Still no idea why it happened or what the error even meant.Share0I am having the same issue, trying to migrate on-prem windows 2016 and  this syncing won't start I see EC2 instance started and intializing, then it shuts-down and gets terminated. I get this error "Data replication stalled. Failed to authenticate with service"I deleted the source server, I created new account for migration, and I tried to use global admin, I tried public vs private ip, nothing is passing this error, logs are not really helpful unless I am missing specific log that can help?When I add a server in AMS, I am able to download the installer and use the powershell command-line on the source server it runs with no errors and it completes installing the AWS replication agent.I tried deleting the server from AMS and creating again with no luck.CommentSharesamsalamaanswered 4 months ago"


Question: API Gateway -> Kinesis Mapping Issue

Changing the value of the integration mapping results in bad kinesis input.FollowComment

Answer: "0Accepted Answerthis request works fine for me. I simulated the same settings in my acc and i'm able to successfully the receive the payload in the lambda.Attaching the screenshot of my api request, api gateway mapping template and lambda logs:so it should work with 'payload' key also. Please check if your api request body is correct.API Gateway Mapping Template (Same as your's)API Request Body:Lambda Logs:CommentSharerePost-User-6922853answered 10 months agorePost-User-3647664 10 months agoThank you for your confirmation, this helped. It ended up being the case that the terraform version I was using was unevenly applying/refreshing API gateway resources and this was messing things up.Share"


Question: Secrets Manager PHP caching

Hello.I'm trying to find a good way to cache secrets from Secrets Manager in PHP to avoid calling the SM constantly.Can anyone suggest a good and easy cache for PHP 8 in Elastic Beanstalk.Thank you.FollowComment

Answer: "0Apparently, there are no official examples of caching in PHP. [1] [2][1] Retrieve secrets from AWS Secrets Manager - AWS Secrets Managerhttps://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets.html[2] Caching mechanism for PHP - Issue #15 - aws/aws-secretsmanager-caching-pythonhttps://github.com/aws/aws-secretsmanager-caching-python/issues/15I found an example of caching in PHP on Stack Overflow, but I'm not familiar with PHP, so I'm not sure if this will meet your requirements. [3][3] php - F3 Framework: how to make sure that caching is working correctly?https://stackoverflow.com/questions/69310949/f3-framework-how-to-make-sure-that-caching-is-working-correctlyI hope this is helpful.CommentSharemn87answered 8 months ago"


Question: Cluster created with ParallelCluster will not run jobs

"UPDATE: I answered this question for myself. I re-created the AMI but manually (following these docs: https://docs.aws.amazon.com/parallelcluster/latest/ug/pcluster.update-cluster-v3.html#modify-an-aws-parallelcluster-ami )  this time and it worked.Odd because the documentation cautions against this but it worked better than creating the AMI using pcluster.Can't delete the question so here it is for the record.I created a slurm cluster using AWS ParallelCluster (the pcluster tool). Creation works fine and I can ssh to the head node. But when I submit jobs they do not run. Using srun:$ srun echo hello worldsrun: error: Node failure on queue1-dy-t2micro-1srun: Force Terminated job 1srun: error: Job allocation 1 has been revokedUsing sbatch:$ sbatch t.shSubmitted batch job 2$ squeueJOBID PARTITION     NAME     USER ST       TIME  NODES NODELIST(REASON)    2    queue1     t.sh   ubuntu CF       0:02      1 queue1-dy-t2micro-2Above it looks like it is going to start a job on host queue1-dy-t2micro-2 but that host never comes up, or at least does not stay up, and after a little bit, I see this:$ squeueJOBID PARTITION     NAME     USER ST       TIME  NODES NODELIST(REASON)    2    queue1     t.sh   ubuntu PD       0:00      1 (BeginTime)And then subsequently, the job is never run.Anyone know what is going on? I did use a custom AMI which I also built with pcluster, but I am not sure if that is the issue, because the head node comes up just fine and it is using the same AMI.FollowComment"

Answer: "0Hi!pcluster build-image should work as well, it would be interesting to understand the reason because it seems that the compute nodes were not able to bootstrap correctly.The logs of the cluster are preserved in CloudWatch Logs for 2 weeks so you could try to check in the cfn-init and cloud-init* log files of one of the failed compute instances (more info in Integration with Amazon CloudWatch Logs doc).The next time you're facing issues and you have a running cluster, it is possible to investigate the root cause of the bootstrap failure by following the troubleshooting guide and checking the logs of one of the failing instances.Anyway glad to know that you've been able to find a working solution.EnricoCommentShareenrico-awsanswered a year ago"


Question: Deactivate or delete access keys for root user

"In the IAM console I see the message:Deactivate or delete access keys for root userDeactivate or delete the access keys for the root user. Instead, use access keys attached to an IAM user to improve security.I'm concerned that if I do this I'll be unable to log into my account.FollowComment"

Answer: "1As a security best practice, it is not recommended for the root user to have an access key. Per the AWS documentation https://docs.aws.amazon.com/accounts/latest/reference/credentials-access-keys-best-practices.html,One of the best ways to protect your account is to not have access keys for your AWS account root user. Unless you must have root user access keys (which is rare), it is best not to generate them. Instead, the recommended best practice is to create one or more AWS Identity and Access Management (IAM) users. Grant those IAM users the necessary permissions, and use them for everyday interaction with AWS.You'll still have access to your AWS account by using an IAM user. And, if you really need to access the AWS console using your root user, you can still do so by using your root user credentials (email and password). As a security best practice as well, ensure that you have an MFA configured for your root user credentials.CommentSharejoahnaanswered 10 months agoEXPERTkentradreviewed 10 months ago"


Question: How do you use the local shadow service from a connected device in GG v2?

"How do I interact with local shadows from a connected device? I see information about configuring the Shadow component to sync various IoT Things' shadows to a core device, and I can see that from a GG v2 component running on that same core I would be able to access the shadow, but I'm hoping that there's a way to have a connected device interact with its local shadow. Thanks!Edited by: jjvic on Sep 22, 2021 11:21 AMFollowComment"

Answer: "0Hi,Thank you very much for using Greengrass V2. The integration between client devices and shadow is being worked on right now. It will be available to use in a couple of months.Until then, we advise the customers to create a new GG v2 component which will act as a bridge between the Client device and Shadow manager. This new component can convert the local MQTT message into the shadow operation using the GG v2 SDK. When deploying the new component, the customer should add some configuration in the MQTT bridge to translate the local MQTT messages to local PubSub messages (on which the new component is listening on). The customers should also add the specific configurations in MQTT bridge to translate the local PubSub messages to local MQTT messages.eg MQTT Bridge configuration:{"mqttTopicMapping": {"ClientDevice1Mapping": {"topic": "$aws/things/MyThingName/shadow/update/accepted","source": "Pubsub","target": "LocalMqtt"},"ClientDevice2Mapping": {"topic": "$aws/things/MyThingName/shadow/update/rejected","source": "Pubsub","target": "LocalMqtt"}}}Cheers,NikkhilEdited by: nikkhilataws on Sep 29, 2021 10:36 AMCommentSharenikkhilatawsanswered 2 years ago"


Question: transfer of the domain name

"my domain name will expire in the beginning of June,please let me know how to transfer it to AWS and what is the priceFollowComment"

Answer: "2When you transfer the registration of a domain to Route 53, the transfer fee applied to your AWS account depends on the top-level domain, such as .com or .org. For more information, see Route 53 Pricing.Steps to transfer the domain: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-transfer-to-route-53.htmlCommentShareFranke-AWSanswered a month agoEXPERTkentradreviewed a month ago"


Question: Problem connecting to AWS IOT using M2Mqtt

"I am having issues connecting to AWS IOT using the following code:            try            {                X509Certificate caCert = X509Certificate.CreateFromCertFile(AWSRootCertPath.Text);                X509Certificate clientCert = X509Certificate.CreateFromCertFile(thingCertPath.Text);                var client = new MqttClient(awsEndpoint.Text, brokerPort, true, caCert, clientCert, MqttSslProtocols.TLSv1_2);                client.Connect(clientId.Text);            }            catch (Exception exception)            {                Debug.WriteLine(exception);            }I get the exception:uPLibrary.Networking.M2Mqtt.Exceptions.MqttConnectionException: Exception connecting to the broker ---> System.IO.IOException: Authentication failed because the remote party has closed the transport stream.I suspect that it is the wrong cert file for the thing. My caCert file is the AmazonRootCA1.pem file. I have tried all three crt files that can be downloaded when the thing is created:[bunch of number removed]-certificate.pem.crt[bunch of number removed]-public.pem.key[bunch of number removed]-private.pem.keyI know that there are ways to use the key files that AWS provides (listed above). We have used them in the past on IOT Gateway hardware using NodeRed. This project has to be c# though.Any help would be appreciated.FollowCommentGavin_A a year agoCan you confirm you are using the XXXXXX-ats.iot.REGION.amazonaws.com endpoint? Also, is your certificate activated in IoT Core and does it have an IoT policy allowing the iot:Connect action?Shareflycast a year agoGood thoughts.Yes, I have the correct endpoint and it is being used by my connect command.The certificate attached to that thing is active.The policy allows publish and subscribe to any topic.Share"

Answer: "0Hi,Thanks for reaching out. Can you kindly send a link of the documentation that you are following to connect to AWS IoT using M2Mqtt? I've tried checking it in github but I cannot seem to find a similar constructor as the one in the above code. Though please note that I am not familiar with M2Mqtt.Based on the below code, the private key file seems to be missing when trying to connect to AWS IoTvar client = new MqttClient(awsEndpoint.Text, brokerPort, true, caCert, clientCert, MqttSslProtocols.TLSv1_2);In terms of certificates, you would need normally need to specify the following:The cafile which is the path to the trusted CA certificate. This is AmazonRootCA1.pemThe cert file which is client certificate. This is [bunch of number removed]-certificate.pem.crt when creating the device via the AWS IoT consoleThe key file which is the client private key. This is [bunch of number removed]-private.pem.key when creating the device via the AWS IoT consoleHere is an example when using mosquitto_pub:$ mosquitto_pub -t 'topic_1' -m "Hello from Mosquitto" --id "basicPubSub" --cert [bunch of number removed]-certificate.pem.crt --key [bunch of number removed]-private.pem.key --cafile AmazonRootCA1.pem -h [ATS_ENDPOINT] -p 8883 You can use the above command with mosquitto_pub to confirm if your certificates can connect to IoT. You can use the IoT console to subscribe to topic_1 and then run the above snippet. Please do note that the policy should allow publishing to topic_1 and the clientid to be "basicPubSub".Here is another sample publish example(In Python) that can be seen from our documentation -> https://docs.aws.amazon.com/iot/latest/developerguide/sdk-tutorials.html#sdk-tutorials-experiment. Again, we can see the above 3 files are required.Please review the M2Mqtt documentation and check why it seems there are only 2 files  provide in the arguments, specifically caCert and clientCert.CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago0Hi,here is a working sample to connect to AWS IoT using the C# M2MQTT library:https://github.com/aws-samples/iot-dotnet-publisher-consumerThe main difference compared to your code is that the client credentials (certificate and private key) must be bundled in a PFX file.Check also that you are NOT using the .NET micro framework since it only supports TLSv1.CommentShareEXPERTMassimilianoAWSanswered a year ago"


Question: I've subscribed to the EC2 linux AMI update SNS topic but i didn't get a notification for the most recent update

"Hi,I want to be notified by mail whenever there are new package updates available for amazon linux 2. To do this i've used AWS SNS to subscribe to these notifications. I've subscribed to the following topic:arn:aws:sns:us-east-1:137112412989:amazon-linux-2023-ami-updatesI've received one notification so far, but for the latest package update i didn't get any notification. This update is minor and concerns only two packages of which neither are security related.Does amazon-linux-2023-ami-updates only send out notifications for large updates? If so is there another subscription i can subscribe to that allows me to get a notification for both minor and large updates? All i could find was this documentation.FollowComment"

Answer: "0I have read the documentation and I believe that the SNS here only notifies when a new AMI is available.In other words, I don't think the package update will notify me.https://docs.aws.amazon.com/ja_jp/linux/al2023/ug/receive-update-notification.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months agoViridios 2 months agoYes i understand this, but my question is if there is another SNS that does notify you of other available updates?ShareRiku_Kobayashi EXPERT2 months agoI don't think there are any other social networking sites that notify you of other updates.Share"


Question: "(resolved, see my last comment on this post) Problem in installing AWS CLI (using the AWS documentation)"

"I am following the AWS documentation to install AWS CLI in local, this one: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html#install-tshootbut at the last command I encountered a problem with the installation of AWS CLI ( the last command "sudo ./aws/install": did not succeed and here (attached) is the problem in a screenshot. What do I do in this case?  should I remove the folder /usr/local/aws-cli/v2/2.11.21 ? and thanksFollowComment"

Answer: "0Accepted AnswerTry adding --update to the install command.If that fails, delete the /usr/local/aws-cli directory. Then rerun sudo aws/install.CommentShareEXPERTkentradanswered 10 days agorePost-User-2403365 10 days agostill the same problemsudo aws/install --updateresult: Found same AWS CLI version: /usr/local/aws-cli/v2/2.11.21. Skipping install.SharerePost-User-2403365 10 days agothanks for your response, here the steps I did:In fact, what made me think that the installation didn't work was that when I did the command "$ aws --version", it did not work.So I redid "sudo ./aws/install" (and got the result that I sent you in my scrrenshot)==> But I understood that the installation was OK (since I have usr/local/aws-cli/v2/2.11.21, what I did was focus on resolving the problem of "aws --version."Below, the steps:$ aws --versionResult:Command 'aws' not found, but can be installed withsudo apt  install awscli$sudo apt  install awscliResult:Reading package lists... DoneBuilding dependency treeReading state information... DonePackage awscli is not available, but is referred to by another package.This may mean that the package is missing, has been obsoleted, oris only available from another sourceE: Package 'awscli' has no installation candidateSolution (I did a search on the net, and according to this link : https://unix.stackexchange.com/questions/561236/how-to-install-awscli-on-ubuntu-18-04)$sudo apt-get update$sudo apt-get install awscliIt took me a lot of time (particularly for the second command), but it is Ok nowwhen I do:$ aws --versionResult:aws-cli/1.22.34 Python/3.10.6 Linux/4.4.0-19041-Microsoft botocore/1.23.34Sharekentrad EXPERT10 days agoOK. Just know that you have V1 of the CLI instead of V2. Both are being maintained, but you will want to make sure if you consult the reference manual, you look at V1.SharerePost-User-2403365 9 days agoOK, thanks for the information.Share"


Question: An error occurred while calling o79.getDynamicFrame. java.lang.reflect.InvocationTargetException

"I'm getting the error in the title while running a Glue Job to transform a CSV file to Parquet format. The code is below (unedited from the AWS recommendation):import sysfrom awsglue.transforms import *from awsglue.utils import getResolvedOptionsfrom pyspark.context import SparkContextfrom awsglue.context import GlueContextfrom awsglue.job import Job## @params: [JOB_NAME]args = getResolvedOptions(sys.argv, ['JOB_NAME'])sc = SparkContext()glueContext = GlueContext(sc)spark = glueContext.spark_sessionjob = Job(glueContext)job.init(args['JOB_NAME'], args)## @type: DataSource## @args: [database = "appdata", table_name = "payment_csv", transformation_ctx = "datasource0"]## @return: datasource0## @inputs: []datasource0 = glueContext.create_dynamic_frame.from_catalog(database = "appdata", table_name = "payment_csv", transformation_ctx = "datasource0")## @type: ApplyMapping## @args: [mapping = [("_id", "string", "_id", "string"), ("amountpaidcents", "long", "amountpaidcents", "long"), ("_p_establishment", "string", "_p_establishment", "string"), ("type", "string", "type", "string"), ("ispaid", "boolean", "ispaid", "boolean"), ("for", "string", "for", "string"), ("_created_at", "string", "_created_at", "string"), ("_updated_at", "string", "_updated_at", "string"), ("formailingorder", "string", "formailingorder", "string"), ("formailinglistorder", "string", "formailinglistorder", "string"), ("_p_user", "string", "_p_user", "string"), ("`spcharge.created`", "long", "`spcharge.created`", "long"), ("`spcharge.data.object.billing_details.address.postal_code`", "long", "`spcharge.data.object.billing_details.address.postal_code`", "long"), ("`spcharge.data.object.payment_method_details.card.brand`", "string", "`spcharge.data.object.payment_method_details.card.brand`", "string"), ("`spcharge.data.object.payment_method_details.card.funding`", "string", "`spcharge.data.object.payment_method_details.card.funding`", "string")], transformation_ctx = "applymapping1"]## @return: applymapping1## @inputs: [frame = datasource0]applymapping1 = ApplyMapping.apply(frame = datasource0, mappings = [("_id", "string", "_id", "string"), ("amountpaidcents", "long", "amountpaidcents", "long"), ("_p_establishment", "string", "_p_establishment", "string"), ("type", "string", "type", "string"), ("ispaid", "boolean", "ispaid", "boolean"), ("for", "string", "for", "string"), ("_created_at", "string", "_created_at", "string"), ("_updated_at", "string", "_updated_at", "string"), ("formailingorder", "string", "formailingorder", "string"), ("formailinglistorder", "string", "formailinglistorder", "string"), ("_p_user", "string", "_p_user", "string"), ("`spcharge.created`", "long", "`spcharge.created`", "long"), ("`spcharge.data.object.billing_details.address.postal_code`", "long", "`spcharge.data.object.billing_details.address.postal_code`", "long"), ("`spcharge.data.object.payment_method_details.card.brand`", "string", "`spcharge.data.object.payment_method_details.card.brand`", "string"), ("`spcharge.data.object.payment_method_details.card.funding`", "string", "`spcharge.data.object.payment_method_details.card.funding`", "string")], transformation_ctx = "applymapping1")## @type: ResolveChoice## @args: [choice = "make_struct", transformation_ctx = "resolvechoice2"]## @return: resolvechoice2## @inputs: [frame = applymapping1]resolvechoice2 = ResolveChoice.apply(frame = applymapping1, choice = "make_struct", transformation_ctx = "resolvechoice2")## @type: DropNullFields## @args: [transformation_ctx = "dropnullfields3"]## @return: dropnullfields3## @inputs: [frame = resolvechoice2]dropnullfields3 = DropNullFields.apply(frame = resolvechoice2, transformation_ctx = "dropnullfields3")## @type: DataSink## @args: [connection_type = "s3", connection_options = {"path": "s3://wp-datalake-v1/zohoexport"}, format = "parquet", transformation_ctx = "datasink4"]## @return: datasink4## @inputs: [frame = dropnullfields3]datasink4 = glueContext.write_dynamic_frame.from_options(frame = dropnullfields3, connection_type = "s3", connection_options = {"path": "s3://wp-datalake-v1/zohoexport"}, format = "parquet", transformation_ctx = "datasink4")job.commit()Does anyone know what this error means and how I can resolve?FollowCommentAnanth Tirumanur 9 months agoThere is not enough information to resolve this. It would help if you could paste the complete stack trace.The best guess would be related to permissions to write into S3(Lake formation or S3 permisions, etc) OR and issue with flattening your struct. See if you can do it using Spark instead:resolvechoice3 = resolvechoice3.toDF()#convert to data frameresolvechoice3 = resolvechoice3.select(flatten(resolvechoice3.schema))#flattenresolvechoice3 = DynamicFrame.fromDF(resolvechoice3, glue_context, "final_convert")Sharejweyenberg 9 months agoThank you! I posted the full trace as an answer below; no luck with the Spark additions unfortunately.ShareJannP 9 months agoHello jweyenberg,Can you post the stack trace before and after the exact error message "An error occurred while calling o79.getDynamicFrame. java.lang.reflect.InvocationTargetException"?Sharejweyenberg 9 months agoAh, sorry - misunderstood. Please see that also in an Answer response below.Share"

Answer: "1Hello jweyenberg,Below is the key error message:An error occurred while calling o79.getDynamicFrame.\n: java.lang.RuntimeException: class com.amazonaws.services.gluejobexecutor.model.AccessDeniedException:User: arn:aws:sts::390172919295:assumed-role/AWSGlueServiceRole-zohodatacrawl/GlueJobRunnerSession is not authorized to perform: lakeformation:GetDataAccess on resource: arn:aws:glue:us-east-2:390172919295:table/appdata/payment_csv because no identity-based policy allows the lakeformation:GetDataAccess action which indicates the role (AWSGlueServiceRole-zohodatacrawl) you are using to run the Glue job does not have "GetDataAccess" action permission on the table "arn:aws:glue:us-east-2:390172919295:table/appdata/payment_csv".You can add below policy into your role to fix this:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "LakeFormationDataAccess",            "Effect": "Allow",            "Action": [                "lakeformation:GetDataAccess"            ],            "Resource": "*"        }    ]}Reference: https://docs.aws.amazon.com/lake-formation/latest/dg/upgrade-glue-lake-formation-step3.htmlAs Lake Formation is known for multi-layer security, if you meet other Lake Formation related permission errors, you can have a check on this page: https://docs.aws.amazon.com/lake-formation/latest/dg/troubleshooting.htmlCommentShareJannPanswered 9 months ago0OP posting the full error logs for additional detail:Aug 26, 2022, 5:44:08 AM Pending execution2022-08-26 12:44:21,934 main WARN JNDI lookup class is not available because this JRE does not support JNDI. JNDI string lookups will not be available, continuing configuration. java.lang.ClassNotFoundException: org.apache.logging.log4j.core.lookup.JndiLookup at java.net.URLClassLoader.findClass(URLClassLoader.java:387) at java.lang.ClassLoader.loadClass(ClassLoader.java:418) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:352) at java.lang.ClassLoader.loadClass(ClassLoader.java:351) at java.lang.Class.forName0(Native Method) at java.lang.Class.forName(Class.java:264) at org.apache.logging.log4j.util.LoaderUtil.loadClass(LoaderUtil.java:173) at org.apache.logging.log4j.util.LoaderUtil.newInstanceOf(LoaderUtil.java:211) at org.apache.logging.log4j.util.LoaderUtil.newCheckedInstanceOf(LoaderUtil.java:232) at org.apache.logging.log4j.core.util.Loader.newCheckedInstanceOf(Loader.java:301) at org.apache.logging.log4j.core.lookup.Interpolator.<init>(Interpolator.java:95) at org.apache.logging.log4j.core.config.AbstractConfiguration.<init>(AbstractConfiguration.java:114) at org.apache.logging.log4j.core.config.DefaultConfiguration.<init>(DefaultConfiguration.java:55) at org.apache.logging.log4j.core.layout.PatternLayout$Builder.build(PatternLayout.java:430) at org.apache.logging.log4j.core.layout.PatternLayout.createDefaultLayout(PatternLayout.java:324) at org.apache.logging.log4j.core.appender.ConsoleAppender$Builder.<init>(ConsoleAppender.java:121) at org.apache.logging.log4j.core.appender.ConsoleAppender.newBuilder(ConsoleAppender.java:111) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.logging.log4j.core.config.plugins.util.PluginBuilder.createBuilder(PluginBuilder.java:158) at org.apache.logging.log4j.core.config.plugins.util.PluginBuilder.build(PluginBuilder.java:119) at org.apache.logging.log4j.core.config.AbstractConfiguration.createPluginObject(AbstractConfiguration.java:813) at org.apache.logging.log4j.core.config.AbstractConfiguration.createConfiguration(AbstractConfiguration.java:753) at org.apache.logging.log4j.core.config.AbstractConfiguration.createConfiguration(AbstractConfiguration.java:745) at org.apache.logging.log4j.core.config.AbstractConfiguration.doConfigure(AbstractConfiguration.java:389) at org.apache.logging.log4j.core.config.AbstractConfiguration.initialize(AbstractConfiguration.java:169) at org.apache.logging.log4j.core.config.AbstractConfiguration.start(AbstractConfiguration.java:181) at org.apache.logging.log4j.core.LoggerContext.setConfiguration(LoggerContext.java:446) at org.apache.logging.log4j.core.LoggerContext.reconfigure(LoggerContext.java:520) at org.apache.logging.log4j.core.LoggerContext.reconfigure(LoggerContext.java:536) at org.apache.logging.log4j.core.LoggerContext.start(LoggerContext.java:214) at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:146) at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:41) at org.apache.logging.log4j.LogManager.getContext(LogManager.java:194) at org.apache.logging.log4j.LogManager.getLogger(LogManager.java:597) at org.apache.spark.metrics.sink.MetricsConfigUtils.<clinit>(MetricsConfigUtils.java:12) at org.apache.spark.metrics.sink.MetricsProxyInfo.fromConfig(MetricsProxyInfo.java:17) at com.amazonaws.services.glue.cloudwatch.CloudWatchLogsAppenderCommon.<init>(CloudWatchLogsAppenderCommon.java:62) at com.amazonaws.services.glue.cloudwatch.CloudWatchLogsAppenderCommon$CloudWatchLogsAppenderCommonBuilder.build(CloudWatchLogsAppenderCommon.java:79) at com.amazonaws.services.glue.cloudwatch.CloudWatchAppender.activateOptions(CloudWatchAppender.java:73) at org.apache.log4j.config.PropertySetter.activate(PropertySetter.java:307) at org.apache.log4j.config.PropertySetter.setProperties(PropertySetter.java:172) at org.apache.log4j.config.PropertySetter.setProperties(PropertySetter.java:104) at org.apache.log4j.PropertyConfigurator.parseAppender(PropertyConfigurator.java:842) at org.apache.log4j.PropertyConfigurator.parseCategory(PropertyConfigurator.java:768) at org.apache.log4j.PropertyConfigurator.parseCatsAndRenderers(PropertyConfigurator.java:672) at org.apache.log4j.PropertyConfigurator.doConfigure(PropertyConfigurator.java:516) at org.apache.log4j.PropertyConfigurator.doConfigure(PropertyConfigurator.java:580) at org.apache.log4j.helpers.OptionConverter.selectAndConfigure(OptionConverter.java:526) at org.apache.log4j.LogManager.<clinit>(LogManager.java:127) at org.slf4j.impl.Log4jLoggerFactory.getLogger(Log4jLoggerFactory.java:81) at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:358) at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:383) at org.apache.spark.network.util.JavaUtils.<clinit>(JavaUtils.java:41) at org.apache.spark.internal.config.ConfigHelpers$.byteFromString(ConfigBuilder.scala:67) at org.apache.spark.internal.config.ConfigBuilder$$anonfun$bytesConf$1.apply(ConfigBuilder.scala:235) at org.apache.spark.internal.config.ConfigBuilder$$anonfun$bytesConf$1.apply(ConfigBuilder.scala:235) at org.apache.spark.internal.config.TypedConfigBuilder$$anonfun$transform$1.apply(ConfigBuilder.scala:101) at org.apache.spark.internal.config.TypedConfigBuilder$$anonfun$transform$1.apply(ConfigBuilder.scala:101) at org.apache.spark.internal.config.TypedConfigBuilder.createWithDefault(ConfigBuilder.scala:143) at org.apache.spark.internal.config.package$.<init>(package.scala:121) at org.apache.spark.internal.config.package$.<clinit>(package.scala) at org.apache.spark.SparkConf$.<init>(SparkConf.scala:716) at org.apache.spark.SparkConf$.<clinit>(SparkConf.scala) at org.apache.spark.SparkConf.set(SparkConf.scala:95) at org.apache.spark.SparkConf$$anonfun$loadFromSystemProperties$3.apply(SparkConf.scala:77) at org.apache.spark.SparkConf$$anonfun$loadFromSystemProperties$3.apply(SparkConf.scala:76) at scala.collection.TraversableLike$WithFilter$$anonfun$foreach$1.apply(TraversableLike.scala:733) at scala.collection.immutable.HashMap$HashMap1.foreach(HashMap.scala:221) at scala.collection.immutable.HashMap$HashTrieMap.foreach(HashMap.scala:428) at scala.collection.immutable.HashMap$HashTrieMap.foreach(HashMap.scala:428) at scala.collection.TraversableLike$WithFilter.foreach(TraversableLike.scala:732) at org.apache.spark.SparkConf.loadFromSystemProperties(SparkConf.scala:76) at org.apache.spark.SparkConf.<init>(SparkConf.scala:71) at org.apache.spark.SparkConf.<init>(SparkConf.scala:58) at com.amazonaws.services.glue.SparkProcessLauncherPlugin$class.getSparkConf(ProcessLauncher.scala:41) at com.amazonaws.services.glue.ProcessLauncher$$anon$1.getSparkConf(ProcessLauncher.scala:78) at com.amazonaws.services.glue.ProcessLauncher.<init>(ProcessLauncher.scala:84) at com.amazonaws.services.glue.ProcessLauncher.<init>(ProcessLauncher.scala:78) at com.amazonaws.services.glue.ProcessLauncher$.main(ProcessLauncher.scala:29) at com.amazonaws.services.glue.ProcessLauncher.main(ProcessLauncher.scala)2022-08-26 12:44:21,938 main INFO Log4j appears to be running in a Servlet environment, but there's no log4j-web module available. If you want better web container support, please add the log4j-web JAR to your web archive or server lib directory.GlueTelmty1*,SM,GAUGE,2022-08-26T12:44:26Z,,jr_2201071918b9e489e76f8ab97876e7ba3a757354740fb454ff6f706dbbe16a63,glue.spark-application-CommentSharejweyenberganswered 9 months ago0Here is the stack trace from the run here:22/08/24 15:24:40 ERROR GlueExceptionAnalysisListener: [Glue Exception Analysis] {    "Event": "GlueETLJobExceptionEvent",    "Timestamp": 1661354680434,    "Failure Reason": "Traceback (most recent call last):\n  File \"/tmp/wp-zoho-parquet-transform\", line 20, in <module>\n    datasource0 = glueContext.create_dynamic_frame.from_catalog(database = \"appdata\", table_name = \"payment_csv\", transformation_ctx = \"datasource0\")\n  File \"/opt/amazon/lib/python3.6/site-packages/awsglue/dynamicframe.py\", line 642, in from_catalog\n    return self._glue_context.create_dynamic_frame_from_catalog(db, table_name, redshift_tmp_dir, transformation_ctx, push_down_predicate, additional_options, catalog_id, **kwargs)\n  File \"/opt/amazon/lib/python3.6/site-packages/awsglue/context.py\", line 186, in create_dynamic_frame_from_catalog\n    return source.getFrame(**kwargs)\n  File \"/opt/amazon/lib/python3.6/site-packages/awsglue/data_source.py\", line 36, in getFrame\n    jframe = self._jsource.getDynamicFrame()\n  File \"/opt/amazon/spark/python/lib/py4j-0.10.7-src.zip/py4j/java_gateway.py\", line 1257, in __call__\n    answer, self.gateway_client, self.target_id, self.name)\n  File \"/opt/amazon/spark/python/lib/pyspark.zip/pyspark/sql/utils.py\", line 63, in deco\n    return f(*a, **kw)\n  File \"/opt/amazon/spark/python/lib/py4j-0.10.7-src.zip/py4j/protocol.py\", line 328, in get_return_value\n    format(target_id, \".\", name), value)\npy4j.protocol.Py4JJavaError: An error occurred while calling o79.getDynamicFrame.\n: java.lang.RuntimeException: class com.amazonaws.services.gluejobexecutor.model.AccessDeniedException:User: arn:aws:sts::390172919295:assumed-role/AWSGlueServiceRole-zohodatacrawl/GlueJobRunnerSession is not authorized to perform: lakeformation:GetDataAccess on resource: arn:aws:glue:us-east-2:390172919295:table/appdata/payment_csv because no identity-based policy allows the lakeformation:GetDataAccess action (Service: AWSLakeFormation; Status Code: 400; Error Code: AccessDeniedException; Request ID: 4813cf44-7a93-4f9e-b833-88ba1f383457; Proxy: null) (Service: AWSGlueJobExecutor; Status Code: 400; Error Code: AccessDeniedException; Request ID: 253e2ef8-35e6-46f9-9a63-3300136a7ead; Proxy: null)\n\tat com.amazonaws.services.glue.remote.LakeformationCredentialsProvider.refresh(LakeformationCredentialsProvider.scala:51)\n\tat com.amazonaws.services.glue.remote.LakeformationCredentialsProvider.<init>(LakeformationCredentialsProvider.scala:78)\n\tat sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)\n\tat sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)\n\tat sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)\n\tat java.lang.reflect.Constructor.newInstance(Constructor.java:423)\n\tat com.amazonaws.services.glue.remote.MichiganAWSCredentialProviderProxy$.get(MichiganAWSCredentialProviderProxy.scala:14)\n\tat com.amazonaws.services.glue.util.FileSchemeWrapper.setHadoopConfiguration(FileSchemeWrapper.scala:50)\n\tat com.amazonaws.services.glue.util.FileSchemeWrapper.executeWith(FileSchemeWrapper.scala:81)\n\tat com.amazonaws.services.glue.util.FileSchemeWrapper.executeWithQualifiedScheme(FileSchemeWrapper.scala:89)\n\tat com.amazonaws.services.glue.HadoopDataSource.getDynamicFrame(DataSource.scala:543)\n\tat com.amazonaws.services.glue.DataSource$class.getDynamicFrame(DataSource.scala:97)\n\tat com.amazonaws.services.glue.HadoopDataSource.getDynamicFrame(DataSource.scala:240)\n\tat sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\n\tat sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\n\tat sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\n\tat java.lang.reflect.Method.invoke(Method.java:498)\n\tat py4j.reflection.MethodInvoker.invoke(MethodInvoker.java:244)\n\tat py4j.reflection.ReflectionEngine.invoke(ReflectionEngine.java:357)\n\tat py4j.Gateway.invoke(Gateway.java:282)\n\tat py4j.commands.AbstractCommand.invokeMethod(AbstractCommand.java:132)\n\tat py4j.commands.CallCommand.execute(CallCommand.java:79)\n\tat py4j.GatewayConnection.run(GatewayConnection.java:238)\n\tat java.lang.Thread.run(Thread.java:750)\n",    "Stack Trace": [        {            "Declaring Class": "get_return_value",            "Method Name": "format(target_id, \".\", name), value)",            "File Name": "/opt/amazon/spark/python/lib/py4j-0.10.7-src.zip/py4j/protocol.py",            "Line Number": 328        },        {            "Declaring Class": "deco",            "Method Name": "return f(*a, **kw)",            "File Name": "/opt/amazon/spark/python/lib/pyspark.zip/pyspark/sql/utils.py",            "Line Number": 63        },        {            "Declaring Class": "__call__",            "Method Name": "answer, self.gateway_client, self.target_id, self.name)",            "File Name": "/opt/amazon/spark/python/lib/py4j-0.10.7-src.zip/py4j/java_gateway.py",            "Line Number": 1257        },        {            "Declaring Class": "getFrame",            "Method Name": "jframe = self._jsource.getDynamicFrame()",            "File Name": "/opt/amazon/lib/python3.6/site-packages/awsglue/data_source.py",            "Line Number": 36        },        {            "Declaring Class": "create_dynamic_frame_from_catalog",            "Method Name": "return source.getFrame(**kwargs)",            "File Name": "/opt/amazon/lib/python3.6/site-packages/awsglue/context.py",            "Line Number": 186        },        {            "Declaring Class": "from_catalog",            "Method Name": "return self._glue_context.create_dynamic_frame_from_catalog(db, table_name, redshift_tmp_dir, transformation_ctx, push_down_predicate, additional_options, catalog_id, **kwargs)",            "File Name": "/opt/amazon/lib/python3.6/site-packages/awsglue/dynamicframe.py",            "Line Number": 642        },        {            "Declaring Class": "<module>",            "Method Name": "datasource0 = glueContext.create_dynamic_frame.from_catalog(database = \"appdata\", table_name = \"payment_csv\", transformation_ctx = \"datasource0\")",            "File Name": "/tmp/wp-zoho-parquet-transform",            "Line Number": 20        }    ],    "Last Executed Line number": 20,    "script": "wp-zoho-parquet-transform"}CommentSharejweyenberganswered 9 months ago"


Question: AWS Security Hub <--> ServiceNow integration fields mapping

"Hello guys,Is it possible somehow to map AWS 'Account ID' to 'Assignment Group' in ServiceNow when we automatically create an Incident from AWS Security Hub?So the idea is to use AWS Service Management Connector for ServiceNow and when some finding appears in AWS Security Hub it should create an incident in ServiceNow with predefined 'Assignment Group' mapped to 'Account ID' taken from particular AWS account:Here on the screenshot from ServiceNow instead of 'AWS Security Hub' group should be the name of the responsible group based on the  'Account ID' from which 'AWS Security Hub' finding comes from.Thanks in advanceFollowComment"

Answer: "0Hi there,I understand that you would like to know whether it is possible to map AWS 'Account ID' to 'Assignment Group' in ServiceNow when automatically creating an Incident from AWS Security Hub.I would like to kindly request you to create a Technical Support case with AWS Premium Support as this specific use-case would require some investigation on both ends - AWS Security Hub team and ServiceNow - so as to confirm the interaction/behavior of AWS Security Hub and ServiceNow with a predefined 'Assignment Group' mapped to 'Account ID'.Please do also attach the relevant screenshots to your case for better visibility into your request.CommentShareSUPPORT ENGINEERrePost-User-4413894answered 7 months ago0Hello,Yes it is possible to assign the assignment group automatically.Create a mapping table between Assignment Group (sys_user_group) and AWS Account ID in ServiceNowWhen AWS Service Management Connector is creating an incident, you can create a business rule (onBefore or OnAfter) to lookup the mapping table and assign the Assignment Group to the incident based on the AWS Account ID.Hope this helps !!CommentSharerePost-User-1576592answered 4 months ago"


Question: Amazon WorkMail going under Promotions Tab in GMAIL

"Hi, We recently set up our organization's email system in Amazon Workmail on a test basis and has noticed that the emails from all the mail ids under amazon workmail including those of the HR are being delivered under the Promotions Tab in Gmail which is not at all good for our business. So sould like to know a way around to resolve this.Regards,ArjunFollowComment"

Answer: "0Hi,I'm sorry to hear you're experiencing problems with sending mail to Gmail accounts. This can have 2 problems:Are you using the complementary .awsapps.com domain? Its not recommended to use this domain in production as its a domain to be used for testing. This domain is limited in volume and does not have all deliverabilty records.Have you completed the domain configuration with all the recommended domain records for mail deliverability? Please check that the DKIM, DMARC, SPF and Mail From are correctly configured. (More details can be found on this documentation page)Kind regards,RobinCommentShareMODERATORrobinkawsanswered 8 months ago"


Question: AWS SNS Not sending notifications every time

"Hello AWS community,We are using SNS push notification service for iOS. We are sending push notifications for a live game score update to users who have subscribed for that match. For example if 100 users have subscribed for live score of a game then we are sending notification every 10 seconds to 100 devices. We are logging these events to Amazon cloud watch for monitoring.We are facing an issue that after few minutes of game, cloud watch is not showing logs for every 10 seconds. Some times it shows 1 or 2 notifications only per minute. That means frequency of sending push notification is not stable as 10 seconds. Also it is not sending to all 100 devices. Sometimes it is sending 80 devices, some times it is sending 50-60 devices like that.So overall two issues:Frequency for sending notification gets slower as time passes after game is started.Not every time it is sending to all subscribers (100 devices as an example). It is only sending to random few devices.Let us know if any one has faced similar issue.Thanks,Jhavtech Studios.FollowComment"

Answer: "0It appears that you're encountering issues related to throttling and potentially unstable delivery of push notifications. Here are some steps to help diagnose and resolve the issues:Inspect CloudWatch Metrics: First, review the CloudWatch metrics for your SNS topic to check for any throttling or delivery failures. You can do this by navigating to the CloudWatch console and selecting "Metrics," then choosing the "SNS" namespace. Look for the NumberOfMessagesPublished, NumberOfNotificationsDelivered, NumberOfNotificationsFailed, and PublishSize metrics.Review SNS retry policies: SNS has a default retry policy for message delivery. In case of delivery failures, SNS will retry sending the message according to the policy. However, if the failure persists, the message might not be delivered to all subscribers. Review the retry policy for your topic and make adjustments if necessary: https://docs.aws.amazon.com/sns/latest/dg/sns-message-delivery-retries.htmlCheck the message size: The payload size limit for SNS push notifications is 256KB for iOS. If the payload exceeds this limit, the notification will be rejected. Ensure that your message size is within the limit.Rate limiting: If you're sending a high volume of notifications in a short period, you might hit rate limits on the SNS or APNs side. Ensure that you're adhering to the rate limits imposed by both services. You can also consider implementing a backoff strategy to prevent hitting these limits.CommentShareJorgeanswered a month ago"


Question: How can I resolve issues with ESA Snap on my AWS EC2 Windows Instance?

I have been trying to run ESA Snap on my EC2 Windows instance and I'm having some errors when trying to open files/products in the Snap program. I contacted ESA via their STEP forums to try and resolve the issue to which I was asked to contact Amazon or AW support to see why am I able to use Snap on my local machine without issues but the same program on the instance is unable to open the files I need. The link to the STEP forum post is as follows for context: https://forum.step.esa.int/t/no-appropriate-product-reader-found-for-nc-file-on-aws-windows/38066/4FollowComment


Question: AWS IoT Greengrass (V2) and Video Streaming

"Hello,The use case I have is this -There are two types of AWS IoT Greengrass V2 core devices that are implemented, which are connected (in the same private LAN network) in hub and spoke architecture. None of them are connected to client devices (Greengrass is being used because of its IPC and orchestration benefits):[Spoke] AWS IoT Greengrass V2 core device is directly attached to a camera. The Video stream is sent to an Hub AWS IoT Greengrass V2 core device for ML processing (inference) that must be near-real time.[Hub] AWS IoT Greengrass V2 core device that is processing and Fan-Out video streams: A) to ML inference interface (local component of the hub) B) to Kinesis Firehose (S3; to re-train the model) C) AWS Kinesis Video Stream (for human to view the video online)I have a couple of questions:Is the architecture feasible? Make sense?What is the best (performance and security wise) technology (open source, AWS component, protocol) to use in Spoke and Hub devices to send the video stream from the spokes to the hub (the video has to be high quality with minimal/no compression to keep the inference accuracy high)?Can the Stream Manager component of AWS IoT Greengrass V2 core send (Hub) streams in fun-out mode (e.g., to two different destinations concurrently, AWS Kinesis Firehose and AWS Kinesis Video Streams)?Thank you,YossiFollowComment"

Answer: "0Hi,The Hub and Spoke architecture is feasible and makes sense. Have a look at https://aws.amazon.com/greengrass/  - AWS IoT Greengrass device connectivity.The protocols should be selected according to the video feeds you have and the HW you use. Review https://www.youtube.com/watch?v=uKPiOkaF-Sw and https://aws.amazon.com/panorama/ for additional ideas.It's possible to run multiple components that will do the requested tasks. However, suggest to use the pattern of sending to AWS and fan-out from there. This will address the upload bandwidth, the resources on the hub device and ease with consistency of the delivered data.CommentShareVladanswered a year agoyossico a year agoThank you Vlad.Please note that question #1 is about Hub-and-Spoke of Greengrass Core devices, they are all running on-premise.I could not find any reference to a similar configuration, hence my question. For example, is there an out-of-the-box method to connect (network-wise) multiple Greengrass V2 Core devices? I will implement discovery API if there is none.Regarding question #2 - the Panorama design is interesting but slightly different than mine. The 'client-device' in my case is a smart device with multiple input channels and logic. How can I effectively stream video (e.g., H264) from one Greengrass Core device  to another?Regarding question #3 - just to clarify - the idea is to use one component, the Greengrass V2 Core Device stream manager, to stream to multiple destinations at the same time, does the stream manager supports that?Thanks a lot!YossiShare"


Question: Make Bucket URL HTTPS

I want to use my bucket URL but HTTPS.Here my bucket address: http://mutantboi.xyz.s3-us-west-1.amazonaws.com/and I wanna use like that: https://mutantboi.xyz.s3-us-west-1.amazonaws.com/Yesterday I setup cloud front + amazon SSL but not. How can I do that?FollowComment

Answer: "1You're almost there! Follow these instructions to finish setting up CloudFront. You can request a certificate from AWS Certificate Manager which is free.CommentShareEXPERTBrettski-AWSanswered 7 months agooguzhank 7 months agoHey,Thank u for your answer. I did that also but still not working on my bucket URL :/ShareBrettski-AWS EXPERT7 months agoAre you getting an error message? I'd like to help troubleshoot but "not working" doesn't give me much to go on.Share0Amazon S3 website endpoints do not support HTTPS. If you want to use HTTPS, you can use Amazon CloudFront to serve a static website hosted on Amazon S3.CommentShareGautam Kumaranswered 7 months ago"


Question: Property Topics cannot be empty - Cloudformation CREATE_FAILED on SNS TopicPolicy

"I'm trying to build a Cloudformation template using examples I find online. I ran into a dependency issue between S3 and SNS resources which led me to this AWS article:How do I avoid the "Unable to validate the following destination configurations" error in AWS CloudFormationUsing that as an example I created a parameterized S3 bucket name and SNS TopicPolicy, however on creating the Cloudformation stack I see CREATE_FAILED for the TopicPolicy with status Property Topics cannot be empty. My only attempt at a resolution was to add DependsOn to the TopicPolicy, a property that did not appear in the linked article above.My best guess is that {"Ref": "TransactionUploadTopic"} in the Topics array is not resolving to the ARN for TransactionUploadTopic, despite it being successfully created in the CF stack (so I don't know why this would be the case.)My template is below, I'm learning from the AMediaManager Tutorial (GitHub Repo) and other online resources (since my architecture is quite different from the AMM tutorial.){  "AWSTemplateFormatVersion": "2010-09-09",  "Description": "Provision resource dependencies for the app (e.g., RDS, S3, DynamoDB, etc..).",  "Parameters": {    "AppBucketNameSuffix": {      "Description": "The S3 bucket for user uploads",      "Type": "String"    }  },  "Resources": {    "InstanceSecurityGroup": {      "Type": "AWS::EC2::SecurityGroup",      "Properties": {        "GroupDescription": "RDS allows ingress from EC2 instances in this group.",        "SecurityGroupIngress": []      }    },    "TransactionUploadQueue": {      "Type": "AWS::SQS::Queue"    },    "TransactionUploadTopic": {      "Type": "AWS::SNS::Topic",      "Properties": {        "Subscription": [{          "Endpoint": {            "Fn::GetAtt": ["TransactionUploadQueue", "Arn"]          },          "Protocol": "sqs"        }]      }    },    "AppBucket2SNSPolicy": {      "Type": "AWS::SNS::TopicPolicy",      "DependsOn": ["TransactionUploadTopic"],      "Properties": {        "PolicyDocument": {          "Id": "S3NotificationPolicy",          "Version": "2012-10-17",          "Statement": [            {              "Sid": "Statement-id",              "Effect": "Allow",              "Principal": {"Service": "s3.amazonaws.com"},              "Action": "sns:Publish",              "Resource": {"Ref": "TransactionUploadTopic"},              "Condition": {                "ArnLike": {                  "aws:SourceArn": {"Fn::Join": [ "", [ "arn:aws:s3:::", {"Ref": "AWS::StackName"}, "-", {"Ref": "AppBucketNameSuffix"} ]]}                }              }            }          ],          "Topics": [ {"Ref": "TransactionUploadTopic"} ]        }      }    },    "AppBucket": {      "Type": "AWS::S3::Bucket",      "DependsOn": ["AppBucket2SNSPolicy"],      "Properties": {        "BucketName": {"Fn::Join": ["-", [{"Ref": "AWS::StackName"}, {"Ref": "AppBucketNameSuffix"}]]},        "NotificationConfiguration": {          "TopicConfigurations": [            {              "Event": "s3:ObjectCreated:*",              "Topic": {"Ref": "TransactionUploadTopic"}            }          ]        }      }    },    "TransactionUploadTopic2QueuePolicy": {      "Type": "AWS::SQS::QueuePolicy",      "Properties": {        "Queues": [{          "Ref": "TransactionUploadQueue"        }],        "PolicyDocument": {          "Version": "2012-10-17",          "Id": "PublicationPolicy",          "Statement": [{            "Sid": "Allow-SNS-SendMessage",            "Effect": "Allow",            "Principal": {              "AWS": "*"            },            "Action": ["sqs:SendMessage"],            "Resource": {              "Fn::GetAtt": ["TransactionUploadQueue", "Arn"]            },            "Condition": {              "ArnEquals": {                "aws:SourceArn": {                  "Ref": "TransactionUploadTopic"                }              }            }          }]        }      }    },    "TransactionUploadRole": {      "Type": "AWS::IAM::Role",      "Properties": {        "AssumeRolePolicyDocument": {          "Version": "2012-10-17",          "Statement": [            {              "Effect": "Allow",              "Principal": {                "Service": [                  "ec2.amazonaws.com"                ]              },              "Action": [                "sts:AssumeRole"              ]            }          ]        },        "Path": "/",        "Policies": [{          "PolicyName": "TransactionUploadPolicy",          "PolicyDocument": {            "Version": "2012-10-17",            "Statement": [{              "Sid": "1",              "Effect": "Allow",              "Action": [                "s3:Get*",                "s3:ListBucket",                "s3:Put*",                "s3:*MultipartUpload*"              ],              "Resource": [{                "Fn::Join": ["", ["arn:aws:s3:::", {                  "Ref": "AppBucket"                }, "/*"]]              }, {                "Fn::Join": ["", ["arn:aws:s3:::", {                  "Ref": "AppBucket"                }]]              }]            }, {              "Sid": "2",              "Effect": "Allow",              "Action": "sns:Publish",              "Resource": {                "Ref": "TransactionUploadTopic"              }            }, {              "Sid": "3",              "Effect": "Deny",              "Action": [                "sns:*Permission*",                "sns:*Delete*",                "sns:*Remove*",                "s3:*Policy*",                "s3:*Delete*"              ],              "Resource": "*"            }]          }        }]      }    }  },  "Outputs": {    "InstanceSecurityGroup": {      "Value": {"Ref": "InstanceSecurityGroup"}    },    "AppBucket": {      "Value": { "Ref" : "AppBucket"}    },    "TransactionUploadTopic": {      "Value": { "Ref" : "TransactionUploadTopic" }    },    "TransactionUploadQueue": {      "Value": { "Ref" : "TransactionUploadQueue" }    },    "TransactionUploadRoleArn": {      "Value": { "Fn::GetAtt": ["TransactionUploadRole", "Arn"]}    }  }}FollowComment"

Answer: "1Accepted AnswerHi, your nesting is a bit out of whack - "Topics" is inside your policy document unstead of being directly under Properties.BTW I strongly advise using YAML instead of JSON.  It's far more readable and supports comments!Cheers.CommentShareEXPERTskinsmananswered a year agomattdeluco a year agoGood eye on the document structure, thank you!Share"


Question: How can i connect to simulation job using ros_bridge?

"We have a web app which we are using to show details of robot on including video, position and feeds like lidar feed.We are using  http://wiki.ros.org/rosbridge_suite Rosbridge for this successfully on our development systems using gazebo simulations.How can I do the same using simulation jobs on robomaker? How can I connect to simulation job using my dev system?FollowComment"

Answer: "0Hi ruchit,You can configure a VPC for your simulation job which enables out bound network access to your VPC from the simulation host.https://docs.aws.amazon.com/robomaker/latest/dg/vpc.htmlCurrently, we don’t allow inbound network traffic to the simulation host.One solution for communicating with your ROS code in simulation using rosbridge is to run rosbridge in the simulation host as part of the simulation or robot applications and opening a reverse SSH tunnel from the simulation host to an EC2 host in your VPC.You can run rosbridge modifying your package.xml and launch file.Add a dependency on rosbridge_suite to your package.xml:<depend>rosbridge_suite</depend>```2) Add the following to your .launch file: <include file="$(find rosbridge_server)/launch/rosbridge_websocket.launch" >      <arg name="port" value="8080"/>  </include>```Lastly, you can modify your launch file to open a reverse tunnel to an EC2 host in your VPC. Once this is established you can communicate with rosbridge from your EC2 host. Note: you’ll need to include ssh as a dependency like we did for rosbridge_suite above.A non-rosbridge option for connecting to the simulation from your dev system is a pub/sub mechanism like MQTT. The AWS IoT Bridge Example is a good example of this approach: https://github.com/aws-robotics/aws-iot-bridge-example/blob/master/README.mdCommentShareAWS-User-1271166answered 4 years ago"


Question: How can I resolve a CORS POLICY error ( error code 400)

"Hello!I am trying to do a process where I have client-side code(stored in my s3 bucket) that would call the API endpoint of an API gateway that I have created that would then invoke the lambda function and carry out the requested method. In this case its the POST method. The client side code is triggered from an html form submission. Everytime I try to submit the form, I get an error that says that my access to fetch from my API endpoint from the origin is blocked by the CORS policy.I've configured all the CORS policies pertaining to my API Gateway, S3 Bucket, and even my Cloudfront distribution to allow origins from everywhere in addition to where it really comes from which is https://s3.amazonaws.com. The error still happens. If anyone as any insight that would be awesome. Thank you!FollowCommentManu a month agoWhat is the Integration Request you have configured in API Gateway? Is it a proxy integration?Share"

Answer: "1As you indicate, the problem seems to be related to the existing CORS policies in your API gateway. This ones should be configured to allow CORS request from your browser to the API via the S3 website. For that, the proper HTTP headers have to be sent by the browser in the preflight request (Detailed info in Mozilla CORS reference).Please check the CORS documentation for API Gateway.Specifically look at this two options (depend on the type of integration that you are using for your lambda), to ensure that you have properly set up your CORS configuration:Enabling CORS support for Lambda or HTTP non-proxy integrations and AWS service integrationsFor a Lambda custom (non-proxy) integration, HTTP custom (non-proxy) integration, or AWS service integration, you can set up the required headers by using API Gateway method response and integration response settings. When you enable CORS by using the AWS Management Console, API Gateway creates an OPTIONS method and attempts to add the Access-Control-Allow-Origin header to your existing method integration responses. This doesn’t always work, and sometimes you need to manually modify the integration response to properly enable CORS. Usually this just means manually modifying the integration response to return the Access-Control-Allow-Origin header.Enabling CORS support for Lambda or HTTP proxy integrationsFor a Lambda proxy integration or HTTP proxy integration, you can still set up the required OPTIONS response headers in API Gateway. However, your backend is responsible for returning the Access-Control-Allow-Origin and Access-Control-Allow-Headers headers, because a proxy integration doesn't return an integration response. Example code here.If you need extra help, you can also check this CORS Troubleshooting guide.CommentShareigsalvaranswered a month ago"


Question: How configure Channel (MQTT) topic filter using CloudFormation?

"I want to replicate using CloudFormation the IOTA environment configured by following the steps in the 'AWS IoT Analytics Console Quickstart Guide'. Problem is I can't find out how to configure the IoT Core (MQTT) topic filter for the channel (step 6). How can I do this?The docs for AWS::IoTAnalytics::Channel did not help, neither do the tempates in https://aws.amazon.com/blogs/iot/introducing-aws-cloudformation-support-for-aws-iot-analytics/I think I might be missing something fundamental here (e.g. should I be looking for a MQTT 'Message Broker' component to which I should connect my channel??)Related question, is there a way to dynamically (i.e. programmatically) update this type of infrastructure setup for a live configuration?Thanks in advance!Edited by: fpet on May 2, 2020 12:08 PMEdited by: fpet on May 2, 2020 2:24 PMFollowComment"

Answer: 0Connect is via an IoT Core Rule.CommentSharefpetanswered 3 years ago


Question: Risks of joining an account to an organization

"I have a basic organization set up with a handful of OUs. These OUs only have one SCP to restrict member account root users. I also have an AWS account that's not part of the organization which runs production and critical workloads. Currently, users login with IAM users but the organization has SSO enabled.My assumption is that the risks associated with joining the account to the organization are almost non-existent. Meaning the workloads will remain unaffected and existing IAM users will continue to work as they do now. Of course, the root user of the account will stop working because of the SCP.Can anyone think of any other risks I should account for? Has anyone experienced issued?FollowComment"

Answer: "1If the only SCP you have enabled is to disable root for member accounts then no non-root functionality inside the account should stop working. Joining an Organization is also a two way door. You can remove the account from the Organization if there are unintended issues. Is the SCP at the root level of the Org or at each OU? One best practice is to have a transitional OU with limited controls for bringing in new accounts. Once the account is in the Org without issues and everything is working, you can move it to its permanent OU with the SCP(s) in place.CommentShareGrantAWSanswered 4 months agorePost-User-9358417 4 months agoThanks for posting! The SCP is applied at the individual OUs and not at the root. This was on purpose so that when the account joins, it will initially join without the SCP taking effect. The plan is to move the account into the OU once it has joined without issues. I like the idea of a transitional OU, can you invite an account into an initial OU? So far I've only seen them join the root.ShareGrantAWS 4 months agoYou are correct. However that should not be a concern since root SCPs are inherited regardless. Once the account is added just move it to the Transitional OU. This way any additional OU level policies for standard accounts won't apply to the new account until you are ready.Share"


Question: Inter-region multicast routing using transit gateway peering

"Is it possible to do inter-region (inter-vpc) multicast routing using transit gateway peering connections? If not natively supported, can the result be achieved using specific routing rules (i.e. forward packets with destination 224.0.0.1 to transit gateway peering attachment)? I'm not very familiar with both AWS networking and multicast, so any pointers would help.FollowCommentyoni a month agoalso struggling with this, did it solved yet? do we have any other optionsShare"

Answer: "2Accepted AnswerHello,Unfortunately Multicast over TGW peering is not supported, see the below comment from the documentation:Multicast routing is not supported over AWS Direct Connect, Site-to-Site VPN, peering attachments, or transit gateway Connect attachments.See the complete list of considerations for Multicast on transit gateways hereAs an FYI, see Multicast Reference Architectures with AWS Transit Gateway, here.CommentShareEXPERTTushar_Janswered 8 months agomempirate 8 months agoIs there a plan to implement this in the future?ShareTushar_J EXPERT8 months agoHi, AWS does not publicize the roadmap items, I would suggest to keep an eye on https://aws.amazon.com/about-aws/whats-new, then filter by 'Networking and Content Delivery' and choose 'AWS Transit Gateway' I also modified my answer and included the reference architecture for Multicast on AWS, hope this helps.Share"


Question: Monitoring RDS IAM Authentication in Cloudtrail

"Hello,I woul like to get more information on how to monitor the RDS authentication request using Cloudtrail. As from the documentation, Cloudtrail events records all those activities happening in the cloud either via console of via API. When we enable IAM authentication for the database in RDS, we would be able to generate a token that can be used to access db. To generate the token, I am using aws-cli generate-db-auth-token command.How the event in Cloudtrail will look like for such a request? Does that event includes any details about the requester?FollowComment"

Answer: "0Hi. We had exactly the same question and the response we received from AWS support was that Cloudtrail tracks API calls but generate-db-auth-token works locally and does not make any API calls, so Cloudtrail can't track it. Apparently this capability is on the backlog of feature requests but no ETA at present.CommentShareMarkKDanswered a year ago0While the generation of a token (essentially pre-signing a URL) is purely client side, the verification of the token that happens inside the RDS service is not. Logging the generation of the token does not really make sense while logging the actual authentications with it does. The rdsauthproxy running in postgresql instances (or the PAM module calling it), for example could and should log (send to cloud trail?) the public part of the attributes from the token (database, host, db user and the access key).CommentSharejjppanswered 3 months ago"


Question: Unsubscribe option is not showing under Manage Subscription menu in AWS Managment Console for a purchased SaaS subscription

"Hi,I have accidentally created a contract for a SaaS offer in AWS Marketplace. The seller of the offer has also received a subscribe-success notification. Now I want to cancel the subscription. But Cancel Subscription option is not showing.Please help!FollowComment"

Answer: "0This is a blog in Japanese, but please follow these steps.https://gyori.hatenablog.com/entry/2013/05/19/213151https://docs.aws.amazon.com/ja_jp/marketplace/latest/buyerguide/cancel-subscription.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months agoPD 2 months agoI have already tried this method but in the Manage Subscription page, when I select the subscription, I did not see any Cancel Subscription option. I have already provided the screenshot in question for this.ShareRiku_Kobayashi EXPERT2 months agoCan you access the marketplace from this page and sign in with your AWS account to cancel?https://aws.amazon.com/marketplace/Share"


Question: Suspicious Account Breach

"I know I ll get the same generic response as everyone else - but two weeks ago AWS forced me to change my password because it was the same as my regular Amazon account. I logged in with that password for two weeks. Then last night I got an email my account was compromised and my email root username was changed. I ve had an AWS account for 7+ years, never a problem and then all of a sudden this happens. Very suspicious Amazon…still waiting to hear back from AWS and I am sure my account will rack up charges while just being told to fill out a formFollowComment"


Question: How to send iot jobs like Amazon managed restart template to a greengrass core device

"Hello,I recently onboarded one of 30 rpi's which acts like a streaming device using KVS ont aws iot Greengrass v2. I have tried with custom components and deploying them and all works fine but when i create a custom job like Amazon managed templates for rebooting the device, the greengrass is not recieving anything and the job stays in Queued State forever. I am trying to post a Snapshot type job. Any help is appreciated.FollowComment"

Answer: "0Accepted AnswerHi Subham. Unfortunately, Greengrass doesn't currently support AWS Managed Templates for IoT Jobs out of the box. They have been made with AWS IoT Device Client in mind.https://aws.amazon.com/about-aws/whats-new/2021/11/aws-managed-templates-iot-jobs-deploy-operations-iot-fleets/Jobs created with AWS Managed Templates currently work by default on all hardware/software platforms running the AWS IoT Device Clienthttps://docs.aws.amazon.com/iot/latest/developerguide/job-templates-managed.html#job-template-managed-prereqWe recommend that you install and run the AWS IoT Device Client on your devices because it supports using all managed templates directly from the console by default.You can see the AWS IoT Device Client managed template handers here: https://github.com/awslabs/aws-iot-device-client/tree/main/sample-job-handlersYou could certainly develop a GGv2 component to work with these templates. Another alternative to consider, that can provide similar management capabilities, is the Greengrass Systems Manager Agent:https://docs.aws.amazon.com/greengrass/v2/developerguide/systems-manager-agent-component.htmlhttps://docs.aws.amazon.com/greengrass/v2/developerguide/manage-with-systems-manager.htmlCommentShareEXPERTGreg_Banswered a year agoSubham Agrawal a year agoHello Greg_B, thank you for the response. I did try with amazon-device-client but the simple reboot.sh handler didn't seem to work, the device didn't get rebooted.Regarding aws system manager i will definitely go through it sometime later.Thanks in advanceShare"


Question: is it possible change the scrape time when importing Cloudwatch metrics from Grafana?

"https://grafana.com/docs/grafana-cloud/data-configuration/integrations/integration-reference/integration-cloudwatch/EC2 (scraped every 5 minutes)CPUUtilization (Maximum)When importing EC2 metrics such as CPUUtilization from Grafana, the default scrape time seems to be set to 5 minutes, but I want to change this to 1 minute. Is there a way?FollowComment"

Answer: "1Accepted AnswerGo to edit dashboard and adjust the period. Be careful, scraping Cloudwach too hard will be expensive!CommentShareCarl Ostrandanswered 7 months agorePost-User-1726705 7 months agohttps://imgur.com/a/NC2hV9wThanks for the answer. By the way, if you change the Period part to 60, I thought that Data Points would be created every 1 minute, but if you look at the image, it's still created every 5 minutes. Is there anything else I need to change? (In Period, both 60s and 60 gave the same result)-- the image could not be uploaded, so I uploaded it to imgur.ShareCarl Ostrand 7 months agoHave you turned on detailed monitoring for the EC2? The standard metric only gets reported every 5 minutes, so it does not matter if Grafana scraped every minute.SharerePost-User-1726705 7 months agoIt has been resolved Thank you very much Have a nice day !!!Share"


Question: "WordPress Admin from the 3rd day of using got very slow, worked first 2 days perfectly, what could be the issue?"

"Hello Community,I am a beginner in using AWS Services, I found an Tutorial how to set up WordPress and how to Transfer my Domain to AWS and I managed to setup everything as wanted.Tutorial Source: https://onepagezen.com/install-wordpress-aws-bitnami/I connected an API that I am using for my Data Service with a dedicated Plugin and the first 3 days everything went without any issues and very fast. But from yesterday evening the WP Admin is very slow loading and even sometimes the connection get lost.I didn´t changed any settings, so the question is why the WP Admin is working so slow now?For setting up the EC2 instance I choose:Amazon Linux 2 AMI (HVM) - Kernel 5.10, SSD Volume Typet2.medium 2vCPU 4GiBMy performance Dashboard even suggest to downgrade the Package.If anyone has an advice I would be very happy, already bookmarked some "Online Tutorials" to learn more about AWS.CheersSaisonplanerFollowComment"

Answer: "1t2 type is burstable oneBurstable performance instances provide a baseline level of CPU utilization with the ability to burst CPU utilization above the baseline level. The baseline utilization and ability to burst are governed by CPU credits. Burstable performance instances are the only instance types that use credits for CPU usage.Each burstable performance instance continuously earns credits when it stays below the CPU baseline, and continuously spends credits when it bursts above the baseline. The amount of credits earned or spent depends on the CPU utilization of the instance:If the CPU utilization is below baseline, then credits earned are greater than credits spent.If the CPU utilization is equal to baseline, then credits earned are equal to credits spent.If the CPU utilization is higher than baseline, then credits spent are higher than credits earned.For the t2.mediumCPU credits earned per hour: 24Maximum earned credits that can be accrued*: 576vCPUs***: 2Baseline utilization per vCPU: 20%**The number of credits that can be accrued is equivalent to the number of credits that can be earned in a 24-hour period.** The percentage baseline utilization in the table is per vCPU. In CloudWatch, CPU utilization is shown per vCPU. For example, the CPU utilization for a t3.large instance operating at the baseline level is shown as 30% in CloudWatch CPU metrics. For information about how to calculate the baseline utilization, see Baseline utilization.You can use CloudWatch to monitor your CreditsCPUCreditUsage – The number of CPU credits spent during the measurement period.CPUCreditBalance – The number of CPU credits that an instance has accrued. This balance is depleted when the -CPU bursts and CPU credits are spent more quickly than they are earned.If the instance is running low on accrued credits, CPU utilization is gradually lowered to the baseline level, maybe this is a reason of your app slowness.CommentShareOleksii Bebychanswered 4 months ago0Hi @Oleksi, thank you very much for your support. I checked the CPUCredit Infos that you have suggested. On the first view I can´t see an issue there, but will check and observ the development of the Numbers there.The WordPress Admin is running today again normal and fast, maybe it was an temporary issue. I will check some tutorials for AWS where they explain everything from scratch and check where I can optimize the whole structure.Will keep the Topic up to date when the issue pops up again or I find some optimization info that can be useful for others.Have a good week.CheersSaisonplanerCommentShareSaisonplaneranswered 4 months ago"


Question: Inspector2  permissions missing from AWS Managed SecurityAudit role

When we started looking at AWS inspector2 our security staff noticed they could not access the finding reports. Upon inspection of the arn:aws:iam::aws:policy/SecurityAudit it seems it wasn't updated to allow access to the Inspector2  api calls. As the same policy includes permissions for inspector (v1) I believe this to be an error from AWS.  Is this something which we will be fixed soon?FollowCommentLeonB a year agoAlso the inspector2 RO permissions are also missing from the arn:aws:iam::aws:policy/ReadOnlyAccess policy.Share

Answer: 0+1 +1 +1 +1 Plus one!This new service is huge step back from the old forums.  It won't allow a simple "+1" of a question to signify the same question applies to another customer.   I sure do hope AWS reverts back to the old forums or customers will created their own and leave this venue to rot.CommentShareklarsonanswered a year ago


Question: Locked out of S3 Bucket due to Bucket Policy in GovCloud

"Hello, I have an S3 bucket in a GovCloud account that is locked to everyone and everything due to its bucket policy. Normally, in a commercial account I'd be able to delete the bucket/policy with the root account, however, GovCloud accounts don't seem to have root users. Using an IAM Admin Role doesn't seem to work either. I was wondering what other options I had in order to remove the bucket and/or the bucket policy.FollowComment"

Answer: "2Accepted AnswerYou will need to contact AWS Support for them to disable the bucket policy for buckets in GovCloud. As you indicated, there is no root account for you to login to do it yourself.CommentShareMichael_Kanswered a year ago2You will need to open up a support ticket from the linked account in the standard partition. See:AWS GovCloud (US) Administrator Account Password ResetandHow IAM Differs for AWS GovCloud (US)CommentShareEXPERTkentradanswered a year ago"


Question: [1.9] Wwise Dynamic Dialogue Events

"Hi folks,In the full version (non-LTX) of wwise, there is a special type of event called a dynamic dialogue event. It has some extra behaviours that can be used compared to normal events.However, Lumberyard's Audio Controls Editor doesn't seem to pick up on dynamic dialogue events! It gets the normal ones just fine. I have included the dynamic dialogue work unit in my soundbank export and everything otherwise appears to be working.Any ideas? Is dynamic dialogue supported?See: imageFollow"

Answer: "0Accepted AnswerHey @REDACTEDUSERUnfortunately, we don't currently support Dynamic Dialogue Events. However, I've added it to as a feature request.Thank you for your suggestion!SharerePost-User-5162062answered 6 years ago0Hi @REDACTEDUSERSharerePost-User-8353690answered 6 years ago0Okay, thanks for the quick response!SharerePost-User-6042511answered 6 years ago"