Question: Python script runs exactly for 1 hour when I send a run command to EC2 through lambda function when it supposed to run more than 1 hour

"Hello, communit guys!I have a simple test.py Python script (see below) inside EC2 (t2.xlarge, Amazon Linux 2). I'm using VSCode to connect to EC2 for testing/debuging.When I run this code through VSCode or through linux terminal (sudo python3 /home/ec2-user/tmp/test.py) , this code runs until the endBut when I use the lambda to send the same execution command, after exactly 1 hour this code stops running (no python3 task running)!And I want it to keep running longer than 1 hour!My objective is to send a command line  to run my python script through lambda to EC2 and ensure that script run untill the endtest.pyimport loggingfrom time import sleeplogging.basicConfig(filename="/home/ec2-user/tmp/test.log",                    format='%(asctime)s %(message)s',                    filemode='w')logger = logging.getLogger()logger.setLevel(logging.INFO)var= Truecount = 0while var==True:    logger.info('=)')    sleep(1)    count+=1    if count>100000:        var=Falselambda functionimport jsonimport boto3comand_shell    = 'sudo python3 /home/ec2-user/tmp/test.py' instance_id_ec2  = 'my_ec2_instance_id'def lambda_handler(event, context):    client = boto3.client("ec2")    ssm = boto3.client("ssm")        try:        describeInstance = client.describe_instances()        for r in describeInstance['Reservations']:            for inst in r['Instances']:                if inst['InstanceId'] == instance_id_ec2:                    status = inst['State']['Name']        if status == 'running':             response = ssm.send_command(                InstanceIds=[instance_id_ec2],                DocumentName="AWS-RunShellScript",                Parameters={"commands": [comand_shell]},                )            print(f'{comand_shell } has sent to {instance_id_ec2} successfuly')        else:            print(f'Failed')    except Exception as e:        print("Unexpected Exception: %s" % str(e))      return NoneFirst/last 5 lines' log file2022-12-21 00:39:48,379 =)2022-12-21 00:39:49,381 =)2022-12-21 00:39:50,382 =)2022-12-21 00:39:51,383 =)2022-12-21 00:39:52,385 =).........2022-12-21 01:39:30,908 =)2022-12-21 01:39:31,765 =)2022-12-21 01:39:32,302 =)2022-12-21 01:39:33,286 =)2022-12-21 01:39:34,853 =)ThanksFollowComment"

Answer: 1Accepted AnswerI think you're hitting the default timeout for Run Command as per the documentation. You can change the default when you submit the request. There's a short discussion of this on re:Post as well.CommentShareEXPERTBrettski-AWSanswered 5 months ago


Question: Inconsistent keras model.summary() output shapes on AWS SageMaker and EC2

"I have the following model in a jupyter notebook:import tensorflow as tffrom tensorflow.keras.models import Modelfrom tensorflow.keras.optimizers import Adamfrom tensorflow.keras import layersphysical_devices = tf.config.list_physical_devices('GPU')tf.config.experimental.set_memory_growth(physical_devices[0], True)SIZE = (549, 549)SHUFFLE = False BATCH = 32EPOCHS = 20train_datagen =  DataGenerator(train_files, batch_size=BATCH, dim=SIZE, n_channels=1, shuffle=SHUFFLE)test_datagen =  DataGenerator(test_files, batch_size=BATCH, dim=SIZE, n_channels=1, shuffle=SHUFFLE)inp = layers.Input(shape=(*SIZE, 1))x = layers.Conv2D(filters=549, kernel_size=(5,5), padding="same", activation="relu")(inp)x = layers.BatchNormalization()(x)x = layers.Conv2D(filters=549, kernel_size=(3, 3), padding="same", activation="relu")(x)x = layers.BatchNormalization()(x)x = layers.Conv2D(filters=549, kernel_size=(1, 1), padding="same", activation="relu")(x)x = layers.BatchNormalization()(x)x = layers.Conv2D(filters=549, kernel_size=(3, 3), padding="same", activation="sigmoid")(x)model = Model(inp, x)model.compile(loss=tf.keras.losses.binary_crossentropy, optimizer=Adam())model.summary()Sagemaker and EC2 are running tensorflow 2.7.1. The EC2 instance is p3.2xlarge with Deep Learning AMI GPU TensorFlow 2.7.0 (Amazon Linux 2) 20220607. The SageMaker notebook is using ml.p3.2xlarge and I am using the conda_tensorflow2_p38 kernel. The notebook is in an FSx Lustre file system that is mounted to both SageMaker and EC2 so it is definitely the same code running on both machines.nvidia-smi output on SageMaker:+-----------------------------------------------------------------------------+| NVIDIA-SMI 510.47.03    Driver Version: 510.47.03    CUDA Version: 11.6     ||-------------------------------+----------------------+----------------------+| GPU  Name        Persistence-M| Bus-Id        Disp.A | Volatile Uncorr. ECC || Fan  Temp  Perf  Pwr:Usage/Cap|         Memory-Usage | GPU-Util  Compute M. ||                               |                      |               MIG M. ||===============================+======================+======================||   0  Tesla V100-SXM2...  On   | 00000000:00:1E.0 Off |                    0 || N/A   37C    P0    24W / 300W |      0MiB / 16384MiB |      0%      Default ||                               |                      |                  N/A |+-------------------------------+----------------------+----------------------++-----------------------------------------------------------------------------+| Processes:                                                                  ||  GPU   GI   CI        PID   Type   Process name                  GPU Memory ||        ID   ID                                                   Usage      ||=============================================================================||  No running processes found                                                 |+-----------------------------------------------------------------------------+nvidia-smi output on EC2:+-----------------------------------------------------------------------------+| NVIDIA-SMI 510.47.03    Driver Version: 510.47.03    CUDA Version: 11.6     ||-------------------------------+----------------------+----------------------+| GPU  Name        Persistence-M| Bus-Id        Disp.A | Volatile Uncorr. ECC || Fan  Temp  Perf  Pwr:Usage/Cap|         Memory-Usage | GPU-Util  Compute M. ||                               |                      |               MIG M. ||===============================+======================+======================||   0  Tesla V100-SXM2...  On   | 00000000:00:1E.0 Off |                    0 || N/A   42C    P0    51W / 300W |   2460MiB / 16384MiB |      0%      Default ||                               |                      |                  N/A |+-------------------------------+----------------------+----------------------+                                                                               +-----------------------------------------------------------------------------+| Processes:                                                                  ||  GPU   GI   CI        PID   Type   Process name                  GPU Memory ||        ID   ID                                                   Usage      ||=============================================================================||    0   N/A  N/A     11802      C   /bin/python3.8                    537MiB ||    0   N/A  N/A     26391      C   python3.8                        1921MiB |+-----------------------------------------------------------------------------+The model.summary() output on SageMaker is:Model: "model"_________________________________________________________________ Layer (type)                Output Shape              Param #   ================================================================= input_1 (InputLayer)        [(None, 549, 549, 1)]     0                                                                           conv2d (Conv2D)             (None, 549, 549, 1)       7535574                                                                     batch_normalization (BatchN  (None, 549, 549, 1)      4          ormalization)                                                                                conv2d_1 (Conv2D)           (None, 549, 549, 1)       2713158                                                                     batch_normalization_1 (Batc  (None, 549, 549, 1)      4          hNormalization)                                                                                conv2d_2 (Conv2D)           (None, 549, 549, 1)       301950                                                                      batch_normalization_2 (Batc  (None, 549, 549, 1)      4          hNormalization)                                                                                conv2d_3 (Conv2D)           (None, 549, 549, 1)       2713158                                                                    =================================================================Total params: 13,263,852Trainable params: 13,263,846Non-trainable params: 6The model.summary() output on EC2 is (notice the shape change):Model: "model"_________________________________________________________________ Layer (type)                Output Shape              Param #   ================================================================= input_1 (InputLayer)        [(None, 549, 549, 1)]     0                                                                           conv2d (Conv2D)             (None, 549, 549, 549)     14274                                                                       batch_normalization (BatchN  (None, 549, 549, 549)    2196       ormalization)                                                                                conv2d_1 (Conv2D)           (None, 549, 549, 549)     2713158                                                                     batch_normalization_1 (Batc  (None, 549, 549, 549)    2196       hNormalization)                                                                                conv2d_2 (Conv2D)           (None, 549, 549, 549)     301950                                                                      batch_normalization_2 (Batc  (None, 549, 549, 549)    2196       hNormalization)                                                                                conv2d_3 (Conv2D)           (None, 549, 549, 549)     2713158                                                                    =================================================================Total params: 5,749,128Trainable params: 5,745,834Non-trainable params: 3,294_________________________________________________________________One other thing that is interesting, if I change my model on the EC2 instance to:inp = layers.Input(shape=(*SIZE, 1))x = layers.Conv2D(filters=1, kernel_size=(5,5), padding="same", activation="relu")(inp)x = layers.BatchNormalization()(x)x = layers.Conv2D(filters=1, kernel_size=(3, 3), padding="same", activation="relu")(x)x = layers.BatchNormalization()(x)x = layers.Conv2D(filters=1, kernel_size=(1, 1), padding="same", activation="relu")(x)x = layers.BatchNormalization()(x)x = layers.Conv2D(filters=1, kernel_size=(3, 3), padding="same", activation="sigmoid")(x)model = Model(inp, x)model.compile(loss=tf.keras.losses.binary_crossentropy, optimizer=Adam())My model.summary() output becomes:Model: "model_2"_________________________________________________________________ Layer (type)                Output Shape              Param #   ================================================================= input_3 (InputLayer)        [(None, 549, 549, 1)]     0                                                                           conv2d_8 (Conv2D)           (None, 549, 549, 1)       26                                                                          batch_normalization_6 (Batc  (None, 549, 549, 1)      4          hNormalization)                                                                                conv2d_9 (Conv2D)           (None, 549, 549, 1)       10                                                                          batch_normalization_7 (Batc  (None, 549, 549, 1)      4          hNormalization)                                                                                conv2d_10 (Conv2D)          (None, 549, 549, 1)       2                                                                           batch_normalization_8 (Batc  (None, 549, 549, 1)      4          hNormalization)                                                                                conv2d_11 (Conv2D)          (None, 549, 549, 1)       10                                                                         =================================================================Total params: 60Trainable params: 54Non-trainable params: 6_________________________________________________________________In the last model the shape is similar to SageMaker but the trainable parameters are very low.Any ideas as to why the output shape is different and why this is happening with the filters? When I run this model on my personal computer, the shape is the same as EC2. I think there might be an issue with SageMaker.FollowComment"

Answer: "0Hello,I am checking the versions you mentioned and in my notebook instance , using conda_tensorflow2_p38 I get Tensorflow version 2.5. Is it the same for you or have you upgraded it to tensorflow 2.7?:import tensorflow as tfprint(tf.version)2.5.0CommentShareEXPERTLorea-AWSanswered 10 months ago"


Question: How to scale an aws ecs service based on multiple alarms

I would like to create a scale in policy that uses both cpu utilization and RequestCountPerTarget.for example scale in the task when cpu-utilization < 40% AND RequestCountPerTarget < 100.FollowComment

Answer: 0Hi -You will need to utilize custom metrics for this.Please refer to this blog post for some high level ideas.CommentShareJason_Sanswered a year ago


Question: "AWS Certified Cloud Practitioner Exam - finished the test, the screen showed "PASS" status the screen but it wrote "test ended - left room""

"Hi All ,I have a query in regards with the online proctored exam for AWS certified cloud practitioner. I appeared for the exam today -July 25, 2022 at 1PM Jerusalem time. I answered all the 65 questions and reviewed all My answers and ended the test, I even got to see that i have passed the test. the test was done so i left the window open and went out of the room to get a glass of water, when i got back the screed stated "exam ended - left the room". I don't know if My answers/score were recorded or not. I haven't received any email confirmation after completion of the exam. My AWS certification account dashboard shows that Test Schedule Completed. I dont know if by leaving the room i somehow forfeited the exam. Any insights on this would be really helpful.thanksMy Details :Exam : AWS Certified Cloud PractitionerExam date : July 25, 2022EXAM TIME: 01:00 PMTIME ZONE: Asia/JerusalemCandidate ID: AWS02886858CONFIRMATION NUMBER: A107904167FollowComment"

Answer: "0hello, im having the same issue,may i ask have you heard anything back from them?CommentSharerePost-User-9022926answered 10 months agorePost-User-3281549 10 months agojust got an answer 5 minutes ago. all good, I finally have the pass credentialsShare0Give it 24 hours and then check your Cert account. After the results are reported at the end of the test you're basically in a state of limbo for roughly a day where there's no evidence that you took the exam at all. It usually resolves itself within a day, so your results were almost definitely recorded. Congratulations, Cloud Practitioner :)CommentShareSteven_Ganswered 10 months ago0unfortunately nothing yet, I've been cheeking the PSI site every 4-6 hours and still no updatesCommentSharerePost-User-3281549answered 10 months ago"


Question: Elastic Beanstalk ASG scaling instance from 0 to 1

"I'm new to Elastic BeanstalkI want to achieve the following using Beanstalk's EC2 ASGThe number of instances is 0 when there is no request, and the number of instances is automatically expanded to 1 when there is a requestHowever, when there is no surviving EC2 instance, the commonly used indicators preset in the console (such as disk read and write network IO, number of requests, CPU usage, etc.) cannot collect data points, resulting in the failure of automatic scaling.Is there any way to achieve this goal?FollowComment"

Answer: "1Accepted AnswerI thought it was too late to start EC2 after a request occurred.This means that if there are zero EC2s, the very first request will fail.So I thought it would be a good idea to activate at least one of them.From the following documentation, I found it difficult to scale when there are no values in the metrics.https://repost.aws/knowledge-center/elastic-beanstalk-scaling-triggershttps://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environments-cfg-autoscaling-triggers.htmlI'm not sure if this is possible, but I was wondering if there is a way to create a mechanism to output ALB access logs to CloudWatch Logs, and then create a script to create a metrics filter to determine the number of accesses from that and scale it if it is more than 0.CommentShareEXPERTRiku_Kobayashianswered 14 days agoHOUSEI-wujinyi 14 days agoThanks a lot for your early reply!I checked documents that including the document you recommended, and found it's difficult to scale if the metrics has no data.I think your proposal: using a custom metrics filter is a solution that seems to work.In addition:I was inspired from this following guide: It is possible to create a message queue and autoscale at CloudWatch based on the available message depth of the queue. Use a Lambda function at API Gateway authentication or a Lambda@Edge function at CloudFront to add a message to the queue to trigger a CloudWatch alarm.This will trigger autoscaling. But I haven't figured out how to delete messages to reduce the message depth in the queue.https://catalog.us-east-1.prod.workshops.aws/workshops/b317e4f5-cb38-4587-afb1-2f75be25b2c0/en-US/06-custommetricLooking forward to an in-depth discussion with you on this topic.ShareRiku_Kobayashi EXPERT13 days agoFor example, but consider the use case of implementing scaling with AutoScaling and SQS.The advantage of using SQS is that asynchronous processing is possible, in which messages are stored for later processing.So, if you do not need to process synchronously when someone using your service accesses it, I think this solution can be used.After the messages in the queue are deleted by AutoScaling, it is recommended to delete the processed messages in the SQS queue by using "delete_message" after the necessary processing is done.For more information on "delete_message", please refer to the following document.https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sqs/client/delete_message.htmlShare"


Question: Creating AMI from snapshot won't accept paravirtual virtualization type

"I have a snapshot I need to restore that was created the day before. I typically do this by creating an image from the snapshot and then launching an ec2 from the AMI using a launch template.  The ec2 that the snapshot is created from has a virtualization type of paravirtual. When I create the image I select paravirtual. However, the image always creates with a virtualization type of hvm.  Is there any reason why this would be happening? (I have tried older snapshots as well as with snapshots from other instances, but this keeps happening).FollowCommentRodney Lester 8 months agoI don't have any paravirtual instances, but according to the documentation, you have to specify the Kernel ID that matches the source OS. You may also have to enter a RAM Disk ID if you are using that feature. Are you specifying those options?Share"

Answer: "0Accepted AnswerI also tried: ec2-register -n pvami -s snap-0ffe4a3cb9932b167 --virtualization-type paravirtualto see if I could force the ami to paravirtual, but this didn't work either. The ami is still listed as hvm.CommentShareGremlinanswered 8 months agoRodney Lester 8 months agoYou need to specify --kernel-id <kernel> on aws ec2 register-image, but I don't know what your kernel ID is. Try uname -a on the command line of the original instanceShareGremlin 8 months agoThank you! That was it!Share0Thanks for getting back to me, Rodney. I checked and when I create the AMI I cannot select a kernel. It just says it is going to use the default.  I never selected one before, honestly.  I've checked a few other snapshots, both from the same ec2 I am using and others from different ec2's (All using paravirtual).CommentShareGremlinanswered 8 months ago"


Question: When will we be able to delete an IoT Greengrass v2 deployment?

"We're starting to put our IoT Greengrass v2 devices into the field. Managing deployments using the AWS console has quickly become difficult with the overwhelming number of old deployments.development deploymentstesting deploymentsinactive production deploymentsThere is no way to filter or delete deployments. Even when the IoT thing had been deleted, we can't delete its associated deployment.Are AWS customers expected to have to build their own deployment management console for even the most basic filtering?When will we be able to delete an IoT Greengrass v2 deployment?FollowComment"

Answer: "1Accepted AnswerHello,You are able to delete deployments from the console by clicking "Delete revision": You can also use the API/CLI: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/greengrassv2/delete-deployment.htmlCheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 8 months agoEXPERTGreg_Breviewed 8 months ago0Well that worked like a charm.Wow, I would never have guessed that in a million years. I was completely focused on looking for a delete deployment in the console and in the awscli. I'll have to revisit the awscli command. It wasn't working for me. I suspect it was due to the thing being deleted earlier.Thank you!CommentShareDavid Kyleanswered 8 months agoDavid Kyle 8 months agoThe aws greengrassv2 delete-deployment --deployment-id www-xxx-yyy-zzzz works. I had a deployment with 12 revisions. I missed the fact that I had to delete each revision. I had deleted one revision and then gave up in frustration. lolShare"


Question: Multiple images per HIT

"Hello everyone,I'm trying to design an image classification survey on Mturk. The only issue is that I would like to display multiple images in a single HIT (and get responses from each of those images). Is there any resource - HTML template - out there that could help me design such a survey? Is it possible to do such a survey on Mturk?PS: I am also trying to sample the images randomly from a large corpus of images. So, manually creating columns like image_1 and image_2 won't help.ThanksFollowComment"

Answer: "0Hello,This is a great question. You can include multiple images in a single HIT. You can do this by copying the code for the crowd-image-classifier element and placing each iteration of it within the crowd-form tag. You would just need to make sure that each instance of that code is unique, by changing the variable and the name.<crowd-image-classifier         src="${image2_url}"        categories="['Cat', 'Dog', 'Bird', 'None of the Above']"        header="Choose the correct category"        name="category2">             </crowd-image-classifier>```From there, you would add a second column into your CSV input file, corresponding to the new variable. To add more images, you would repeat this process.    The system will create a HIT that has individual, separate image classification selections within itself. Each section will have its own submit button, but don't worry - if a Worker were to select one and not any of the others, the HIT wouldn't let them submit until there was a selection for each image classifier. Regardless of which submit button they choose, your results will reflect each of their selections.     Unfortunately, if you wanted to just have multiple images displayed in the format of a single crowd-image-classifier element, it can't currently support that function.     An alternative approach would be using the survey-link template as a starting point. This template still uses standard HTML, but you would need to build a custom HIT from the ground up to include multiple image references. In either case, you would still need to format your CSV input file with multiple columns corresponding to your image variables - you might be able to semi-automate the process of organizing those images by using Microsoft Excel to concatenate a list.    I hope that helps! If you have any other questions or concerns please don't hesitate to contact us at mturk-requester-support@amazon.com.    -Adam JCommentShareSammieJ-AWSanswered 4 years ago"


Question: Using AWS as a replacement to Shared Hosting for Multiple Sites

"I have a question. I have multiple domains that I don't really use, but have static webpages on them which are hosted on a really cheap shared hosting plan with Hostinger. My subscription with hostinger is set to renew in December, and I am looking to find other options.(I know that there is lightsail, but it is not cost effective, so I am not interested in lightsail as a replacement.)My question is, would it be possible to create something like the hostinger shared hosting account where I can host multiple domains on a single EC2 resource or use some other service. Would it be more cost effective? Has anyone done something like this?FollowComment"

Answer: "0What I would do in this case is use S3 as a static website: https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.htmlFor custom domain names and for TLS support you can add CloudFront: https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-serve-static-website/All up, very cost effective and automatically scalable should you have your website go viral.CommentShareEXPERTBrettski-AWSanswered 7 months ago"


Question: Input switch not behaving as expected

"I wonder if anyone can please help.I have a MediaLive channel with two file inputs: a 2-minute Countdown video and a 40-minute Main video.  Upon start, I want the channel to play the Countdown video first, followed by the Main video.  My schedule is as follows (set up from scratch with each test):- 1. Start type: Immediate; Action: Input Switch; Input attachment: "Countdown" input  - 2. Start type: Follow "Countdown" input switch; Follow point: END; Action: Input Switch; File: "Main video"  My problem is that the channel goes directly to the Main video and does not play the Countdown.I am viewing the output the moment it becomes available - well within 2 minutes of the channel starting - and I see the opening frames of the Main video each time [I did try swapping schedule around, so it should start with Main and follow with Countdown - again, it started with Main].  Both videos are identical format (mp4/1080/8Mbps/25fps).  For the record, the Countdown input is the first input attachment listed is channel settings.  Output is to MediaStore/CloudFront (new URL with each channel start, so not cached).Any ideas where I might be going wrong here?  How I can make it play Countdown first?  Very much appreciate anyone's expert assistance!Many thanks.FollowComment"

Answer: "0Accepted AnswerHi Silverink,If I understand correctly it sounds like you are looking to start the channel but not have the first input run for some time after the channel starts.  If this is correct then when the channel starts it will use the first input or the action that is scheduled to run at the time of the channel start and the channel will not switch to the next input without a scheduled action.  So when you start your channel it will always start with the first input.  You could set a black slate as your first input, then use the scheduled action to move to the Countdown at the specified time and follow it with the followed scheduled action to play the main video once the countodwn ends.  Or you could start the channel with a scheduled action to start paused set for immediate, then create another scheduled action to unpause at the time you want the countdown to start, then create another scheduled Fixed action to start the main video at a specified time, or two minutes after the unpause which would be the time the Countdown should end.ZachCommentShareZacharyb-AWSanswered 2 years ago0So just as an experiment, I tried using a Fixed input switch schedule for the Countdown video (instead of Immediate), with a Follow switch to the Main video.  It was 11:11 UTC here, so I scheduled the Fixed input switch to begin at 13:00 UTC:- 1. Start type: Fixed : today, 13:00:00; Action: Input Switch; Input attachment: "Countdown" input  - 2. Start type: Follow "Countdown" input switch; Follow point: END; Action: Input Switch; File: "Main video"  And now when I start the channel, the Countdown video plays immediately - not in the future!  And Main video does not play at all!  I have tried this with several times with different Fixed future times - including tomorrow afternoon.  Always with the same result: Countdown plays immediately, Main video does not Follow.Where am I going wrong with MediaLive channel Schedule actions!?Thanks for your help.CommentSharesilverinkanswered 2 years ago0Hi Silverink,Thank you for asking this question on the AWS Elemental MediaLive forums, I pulled the logs for your channel and reviewed them and I am seeing we are failing to probe and do the HTTP transfer for the main video, can you verify that the video is in the S3 bucket.  Also can you PM me with the specific channel ARN you are using along with the dates and times of the tests just so I can verify that I am looking at the correct channel ARN logs and the correct times.  This is showing in the logs I have around 2021-06-09 15:56:35 UTC.ZachCommentShareZacharyb-AWSanswered 2 years ago0Hi Zach,Thank you for this.  Both videos are in S3 and play fine locally; I PM'd you the Channel ARN.I did try a different Main MP4 file and this has fixed the Immediate Switch problem below!  The channel now starts with Countdown and Follows with the Main video, as planned.  There must indeed have been some anomaly with the Main video, as you suggested.  It does seems strange that MediaLive fails the play the good file - and instead goes direct to the file it doesn't like!  But I'm happy it's working as planned, so thank you for that.The second issue remains however: I have set the Fixed Input Switch to 2am June 16 (2 days in the future).  But once started, the channel plays Countdown video immediately.  And the Main video does not Follow the Countdown video.Could you please let me know where I'm going wrong here?Thank you Zach.CommentSharegDk7answered 2 years ago0Hi Zach, thank you so much for your response.You have answered my questions entirely: I now understand better how scheduling works in MediaLive.5 Stars!GavinCommentSharesilverinkanswered 2 years ago"


Question: Any difference in using 169.254.169.253 vs net_addr+2 for DNS?

"A customer is looking into some DNS resolution issues. While reading  AWS DNS documentation, I noticed that we could use either 169.254.169.253 or net_addr+2 as DNS server for EC2 instances.This leads me to two questions:If you have a network path to the 169.254.169.253 address and yourOS allows for its usage, is there any difference in using it insteadof the net_addr+2 server?Specifically, would using 169.254.169.253 affect DNS resolution that factors in AZ locality (e.g., EFS DNS name for file systems)?FollowComment"

Answer: "0Accepted AnswerEssentially using net_cidr_base+2 or 169.254..169.253 for DNS resolution with in VPC leads to the same recursive DNS resolution service. However 169.254.x.x address space (Link Local address space )  may be reserved or not allowed with in some OS (e,g Win server 2008 use case mentioned  in AWS DNS documentCommentSharemehrajkanswered 6 years ago"


Question: Architecture: Glue DataBrew for product catalog preperation/cleansing before import to magento?

"Each supplier provides me with their product data in their own format, so I need to map them in order to import the data into Magento.As the product data needs to be updated frequently, I'm wondering if AWS Glue (Databrew) would be a suitable service to map these different Excel files into the same unified Magento format. I would configure it once and once I get an updated file, I can just use the glue job again.Would you recommend Glue (Databrew) for this or is it just for data analysis preparation?FollowComment"


Question: Cognito authenticateUser() very slow on lambda

"Hello,i'm developing a web app with Api Gateway, Lambda and Cognito (all in the same region).My users can login in the app through the Api Gateway, that execute a nodejs lambda function.The lambda make calls to Cognito User Pool and Cognito Identity and return the tokens.The problem is the authenticateUser() function of Cognito user pool.It takes about 10-12 seconds to execute in the lambda function, but i have tested also in local and it takes only 2-3 seconds.Why is this so slow?? I'm missing something?It's better to integrate directly the cognito sdk in the browser?Any help would be appreciated.Edited by: toto on Jun 20, 2017 4:14 AMFollowComment"

Answer: "0There could be multiple reasons why this happens. Some are configuration related similar to the issue below:https://github.com/aws/amazon-cognito-identity-js/issues/247CommentShareAWS-User-0691748answered 6 years ago0Hi totoDid you get a solution to this issue?We are also using API Gateway, Lambda/Node, Cognito (same region) and amazon-cognito-identity-js-node to call cognitoUser.authenticateUser passing the AWS.CognitoIdentityServiceProvider.AuthenticationDetails with the username and password.It's taking a crazy 5/6 seconds to complete the authentication which is unacceptable and not what we used to experience. It is much faster when we use the in-browser Javascript SDK.I'm concerned that by using the Javascript SDK we will expose our AWS credentials - so have opted to move this code to Node.I'd expect the documentation and support for Cognito on Lamda / Node to be first class, it's so poor with few examples.Any pointers or help would be greatly appreciated.ThanksCommentSharePeterOrdanswered 5 years ago0I my case, it takes about 4-5 seconds to complete getUser (accessToken) cognito procedure.My user pool and lambda function all in the same region too.Using nodeJs api inside lambda function.Why does it very slow ?https://docs.aws.amazon.com/pt_br/cognito-user-identity-pools/latest/APIReference/API_GetUser.htmlCommentSharefopnetanswered 5 years ago0I am also experiencing very slow speeds with AuthenticateUser. 5-7 seconds on average but only on lambda. Locally it is very fast.CommentShareMattChristiananswered 5 years ago0Same here. 6-7 seconds on lambda. Both cognito user pool and lambda function are in the same region. Any news?Edited by: Ahi on Aug 6, 2018 1:07 PMCommentShareAhianswered 5 years ago0After switching from cognitoUser.authenticateUser() to cognitoIdentityServiceProvider.adminInitiateAuth() execution time is reduced to 300-500 ms(using ADMIN_NO_SRP_AUTH).CommentShareAhianswered 5 years ago0Same here. Take me 6s to login to system. All my source is in AWS LamdbaCommentSharezcmgyuanswered 4 years ago0Hi everyone,Coming back to this question since I had the same issue and it took me a while to understand what's happening.The thing is authentication with SRP.SRP (Secure Remote Password protocol) is a cryptographic protocol that allows the client to prove to the server that it knows the password without actually sending the password, however it is computationally intense.When running locally, your laptop will crunch the numbers and then send the results, which appears fast because your laptop has powerful CPU and GPU. The lambda however, not so much.The javascript SDK that is intended to run on the client side, selects the appropriate way of authentication and it appears that if SRP is enabled it will use SRP.In short, if you are using SRP, use it on the client, not on lambda. If you don't have a client, you don't have to use SRP.CommentSharealexanswered 2 months ago"


Question: Cognito: Key Rotation

"Please confirm if Cognito rotates the keys used to sign ID and Access tokens. The docs do not specify.If they are rotated, how often?FollowComment"

Answer: "0Yes the document does not specify whether the keys are rotated. However, Cognito service may need to rotate the keys if required.Hence, we recommend you to cache each key present in JWKS URI [1] against "kid". When you have a token to validate, then first check the "kid" present in the header of that JWT token. If you have a key with that "kid" in your cache then use that key. Otherwise, query the JWKS URI to fetch recent keys and update your local cache with the new "kid". This will help to make the application more robust and you will be able to handle the scenario if the public key is rotated in unforeseen future.--References--[1] The format of the JWKS URI is following (replace {region} with AWS region and replace {userPoolId} with the ID of your user pool): https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/jwks.jsonCommentShareSUPPORT ENGINEERTarit_Ganswered 9 months agojamessouth 8 months agoWhere should we cache them? Users can find the region and user pool ID with a bit of snooping, so the JWKS is essentially public. Would hardcoding them be ill-advised?ShareTarit_G SUPPORT ENGINEER8 months agoYou need to cache it in server side of your resource server (means where you are performing JWT validation before providing access to your secured resources).Sharejamessouth 8 months agoThank you but I meant what caching method/service? Right now I'm trying S3 but it is convoluted compared to just downloading the JWKS each time as I have been doing. This is in a Lambda authorizer for APIGW written in Go. What did you have in mind for caching?Share"


Question: EC2 Snapshot attaches to SQL Server License

"Good day, I have an EC2 instance that was launched using Ubuntu 20 with SQL Server Standard. It was supposed to be launched as Ubuntu 20 WITHOUT SQL. We reached out to AWS support and resolved this by uninstalling the SQL Server software and created a snapshot, which we used to launch an instance without the license attached to it. Now, we have launched another instance from a new snapshot from the new instance and the new instance comes up with the SQL Server Standard license and we have been billed for this license. Please help!FollowComment"

Answer: "1HI,I suggest you to make a backup for your information inside your EC2 and then you have tosend to S3 to save it after that you will have to delete your EC2 instance Ubuntu Server with SQL Standard instance and then you have to create a new EC2 Instance Ubuntu Server without SQL Server label to avoid charges for last step you will have to download your information from s3 to new EC2 Ubuntu server.CommentShareJorgeanswered 6 months ago"


Question: Find/Delete Glacier archives

"I discovered archives must be deleted before vaults can be deleted. Looks like I first have to download vault inventory, then write code to delete archives since they can't be deleted in the console. I can't figure out how to create/download the inventory and I don't code, so I'm at a loss. I'm just a simple home user (fairly technical IT guy, but don't code) who uses Arq for backups and I just want to close my account. Any help is appreciated.FollowComment"

Answer: "0Hello, here is the overall documentation. There you will find several different ways to remove what you want. Here are the command line interface instructions, you may find those more useful. CLI InstructionsCommentSharerjbolesanswered 5 months ago"


Question: Pulling multiple helm charts from ECR  returns "signal: killed"

"Using ECR as helm chart registry with helm and helmfileI can pull one helm chart without problem, but if I add another, I get the error "signal killed"in ./helmfile.yaml: in .helmfiles[6]: in helmfiles/jx-staging/helmfile.yaml: [release "subscription": command "/usr/bin/helm" exited with non-zero status:PATH:  /usr/bin/helmARGS:  0: helm (4 bytes)  1: pull (4 bytes)  2: oci://123456.dkr.ecr.us-west-1.amazonaws.com/subscription (63 bytes)  3: --version (9 bytes)  4: 0.13.7 (6 bytes)  5: --destination (13 bytes)  6: /tmp/helmfile2419301357/subscription/subscription/0.13.7 (56 bytes)  7: --untar (7 bytes)ERROR:  signal: killedI read that "Authentication tokens must be obtained for each registry used, and the tokens are valid for 12 hours" however for this scenario, the documented way to login to helm does not include the chart name.https://docs.aws.amazon.com/AmazonECR/latest/userguide/ECR_on_EKS.html#using-helm-charts-eksaws ecr get-login-password \     --region us-west-2 | helm registry login \     --username AWS \     --password-stdin aws_account_id.dkr.ecr.region.amazonaws.comIs it really the case that it is necessary to get a new login token for each helm chart pulled? Or is it a bug somewhere?FollowCommentbabadofar 6 months agoI figured that I can make it work by setting helmfile to fetch only one chart at a time (setting flag --concurrency=1).Not sure where the error comes from but it may be in helmfile.Share"


Question: DNS Resolution Route53

"Hello,Regardless how deep I go with AWS DNS resolution, seems that I still can't grasp the whole concept.I created a VPC end point for CW-Logs in Account-1 VPC A in us-east-1. When I do nslookup to the domain name of the AWS service endpoint DNS name from an EC2 of the same account but different VPC and region (VPCB in eu-west-1) it resolves the private IP address of the interface endpoint. (the interface is in a private subnet). On top of that I did an nslookup from a different account and still resolves it.I would also like to point out all VPCs I am testing are not connected in anyway.Should it do that? I am looking to understand how it works.Thank you.FollowCommentBrettski-AWS EXPERTa year agoWhen you say "from a different account and still resolves it" could you be more specific? Do you mean you get a private address? Or a public address?ShareAman a year agoHi Brettski, It resolves the private IP. Sorry for the late response.was supposed to comment here. sorryShare"

Answer: "0DNS records for endpoints are public; you've noted that it resolves the private IP of the endpoint - that's not reachable from the Internet nor does it tell you which VPC the private IP address belongs to. This is normal behaviour.CommentShareEXPERTBrettski-AWSanswered a year agoAman a year agoI understand its like creating an A record of private IP to a public DNS name, you can see the mapping of name and IP and that pretty much it.Thank you very muchShare"


Question: Does neptune db support APOC library from cypher?

My use case requires using neptune db for hitting cypher queries which gets converted to gremlin queries(automatically) and fetching the data. My question is does neptune db support APOC library given by cypherFollowComment

Answer: "1Hello and thanks for the question. The Amazon Neptune openCypher support does not currently support APOC directly. Which APOC functions are you interested in using? Note also, that with Neptune, both Gremlin and openCypher queries can be used on the same data. Is your question about the potential to not have to convert Cypher to Gremlin and to use openCypher directly?CommentShareAWS-KRLanswered a year agorudrakhsha a year agoI need to use parse() to convert string to date type. I even found a workaround from this query, where I use duration. But that also throws an error saying Date and time functions are not supported in this release. To answer your question, I want to enter my queries in openCypher format, my only concern is that it should get converted to gremlin query and fetch the data.ShareAWS-KRL a year agoJust by way of clarification, Amazon Neptune supports openCypher natively as a first class query language. The openCypher queries are not first converted to Gremlin.Share"


Question: ALB Migration Best Practices

"Hi - My customer is planning for a large app migration to EKS with ALB taking the traffic. Customer is likes to understand the ALB service quotas, Performance benchmarking reports , best practices, optimizations etc.. to consider. Please so share if there any blogs or references which i can share it with customer team.FollowComment"

Answer: "1Accepted AnswerThanks for reaching out. It depends upon type of application, requirements etc. but below are some good links and references to start with.Quotas for your Application Load Balancers - https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-limits.htmlElastic Load Balancing features - https://aws.amazon.com/elasticloadbalancing/features/Architecture Considerations for Migrating Load Balancers to AWS - https://d1.awsstatic.com/whitepapers/architecture-considerations-for-migrating-load-balancers-to-aws.pdfApplication load balancing on Amazon EKS - https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.htmlHow do I create an ALB Ingress in Amazon EKS and associate the ALB Ingress with AWS WAF? - https://aws.amazon.com/premiumsupport/knowledge-center/eks-alb-ingress-aws-waf/How do I set up an Application Load Balancer using the AWS Load Balancer Controller on an Amazon EC2 node group in Amazon EKS? - https://aws.amazon.com/premiumsupport/knowledge-center/eks-alb-ingress-controller-setup/Kubernetes Ingress with AWS ALB Ingress Controller - https://aws.amazon.com/blogs/opensource/kubernetes-ingress-aws-alb-ingress-controller/How To Expose Multiple Applications on Amazon EKS Using a Single Application Load Balancer - https://aws.amazon.com/blogs/containers/how-to-expose-multiple-applications-on-amazon-eks-using-a-single-application-load-balancer/Operating a multi-regional stateless application using Amazon EKS - https://aws.amazon.com/blogs/containers/operating-a-multi-regional-stateless-application-using-amazon-eks/Ingress controller ALB - https://www.eksworkshop.com/beginner/130_exposing-service/ingress_controller_alb/Network load balancing on Amazon EKS - https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.htmlCommentShareEXPERTAWS-User-Nitinanswered 8 months ago0Also, i am looking for reference on prewarming ALB topic? Please do let me know.CommentShareBoopathyanswered 8 months ago"


Question: DNS Validation problem

"Since 2019-06-26 my certificates are taking days to approuve. The worst is that it's not constant.Let me explain a little more.I have 2 cases, certificates where the domains are in Route53 or directly in the domain host. On both cases the validation is made by DNS.The dns are configured and can be tested via applications like: https://mxtoolbox.com/CNAMELookup.aspxOn both cases the certificate end up approved, but I have cases that it took more than 4 days and I had to recreate the certificate others are still waiting and nothing happens.If someone from aws read this here are two exemples:Domain 1: primeenergie.online -> arn:aws:acm:us-east-1:545370662045:certificate/d320b89b-64f6-4587-b55c-831c0576cb8cDomain 2: dessinemoiunerose.com -> arn:aws:acm:us-east-1:545370662045:certificate/1035c81d-4bb0-4a96-bc09-6d4ec1ab8745I can see this is recurring problem on aws. I just wish they show the DNS verification for certificates are intermittent via https://status.aws.amazon.com/ so I can explain my clients that the certificate approval is taking more time to get approved.I don't know what to do now, can someone help?thank you very much :-)Edited by: victorayub on Jul 30, 2019 10:59 AMFollowComment"

Answer: "0Found the problem.It ended to be a matter of account limits. There'a a limit for the quantity of certificates for region. Which is nice.But when you have more than 300 certificates things get very complicated. The ACM dashboard is not capable to load all the certificates not even give the quantity of certificates issued. It's hard to keep track when you have nothing to mesure the quantity of certificates.Another annoying thing, there's no message telling me I'm at the account limit, it just start working in a weird way, approving some certificates and forgetting others, there's no message, no nothing. It's hard to solve a problem like this.Anyway, the problem is solved and if anyone have the same experience try to raise your ACM limit in your account.Have a nice day.CommentSharevictorayubanswered 4 years ago"


Question: How I can increase the Integration association limit for the Amazon Connect instance?

"I have enabled Connect Wisdom in my AWS Connect Instance. The Connect Wisdom is enabled, now I am trying to ingest data that will be displayed in Wisdom when an agent will search there. I am following an AWS tutorial to achieve my intention. You can see the tutorial https://aws.amazon.com/blogs/contact-center/ingesting-content-to-power-real-time-recommendations-and-search-with-amazon-connect-wisdom/#:~:text=Use%20the%20AWS%20CLI%20to,the%20content%20you%20just%20uploadedProblemEverything was going smooth but when I run the following AWS CLI command, it throws an error.Commandaws connect create-integration-association --instance-id 84ec56489-554a-422f-babf-3288d7c8fd04 --integration-type WISDOM_ASSISTANT --integration-arn arn:aws:wisdom:us-east-1:747998786930:assistant/42d03bed-25d2-ee85-a3236-00031ef345345ErrorAn error occurred (InvalidRequestException) when calling the CreateIntegrationAssociation operation: Reached Integration association limit for the Amazon Connect instance.Can someone please guide me? I don't know, how to solve or increase the Integration association limit for the Amazon Connect instance.FollowComment"

Answer: "0HelloI can see there is Quota Limit from the Docs Can you try request AWS support for the limit increase and Checkhttps://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-service-limits.htmlAPIDefault TPS throttling limitsCreateIntegrationAssociation, DeleteIntegrationAssociation, ListIntegrationAssociation2CommentShareGKanswered a year ago0Did you get this figured out? I'm having the same issue.CommentSharedmaciasanswered 7 months ago0There are a number of service quotas for different integrations that you can see here: https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-service-limits.htmlSome of these can be adjusted. Some cannot.You can only have one domain associated with an Amazon Connect instance https://docs.aws.amazon.com/connect/latest/adminguide/enable-wisdom.htmlRun https://docs.aws.amazon.com/connect/latest/APIReference/API_ListIntegrationAssociations.html to see your current integration associations and remove any you don't need.CommentShareGilliananswered 7 months ago"


Question: System verilog generate warnings in DDR controller of AWS FPGA shell

"Hi,I see the following system verilog warnings from the DDR controller when running a test on my design. I am including the directory and command below:directory=aws-fpga/hdk/cl/developer_designs/cl_xxx/verif/scriptscommand=make TEST=<testname>Here are the warnings. Has anyone seen these before and do they prevent you from running an FPGA AMI image on an F1 instance later?WARNING: [VRFC 10-2821] generate block is allowed only inside loop and conditional generate in SystemVerilog mode [/home/centos/src/project_data/aws-fpga/hdk/common/shell_v04261818/design/ip/ddr4_core/rtl/controller/ddr4_v2_2_mc_ecc_fi_xor.sv:125]WARNING: [VRFC 10-2821] generate block is allowed only inside loop and conditional generate in SystemVerilog mode [/home/centos/src/project_data/aws-fpga/hdk/common/shell_v04261818/design/ip/ddr4_core/rtl/controller/ddr4_v2_2_mc_ecc_fi_xor.sv:125]Thanks!KelvinFollowComment"

Answer: "0Accepted AnswerHello,Looking into the details, the warning message indicates that a generate block is being used outside of a loop or conditional generate statement in the System Verilog code. To troubleshoot this warning you can either move the generate block inside a loop or a conditional generate statement or remove the generate block if it is not necessary.To troubleshoot the warning, could you please try the following steps:Check the line number mentioned in the warning message to locate the generate block in the code.Determine whether the generate block is required for the functionality of the code. If not, you can remove it.If the generate block is necessary, identify the loop or conditional generate statement where it can be placed.Move the generate block inside the loop or conditional generate statement.Save the changes to the code and recompile to verify that the warning message has been resolved.Let me know if you have any further queries. Thank you for your interest in re:Post community.Best Regards, AshishCommentShareSUPPORT ENGINEERAshish Bharadwajanswered a month agoazimuth-tech a month agoThank you, Ashish! The warning went away when I removed the generate. The generate seems harmless though. I have used it outside a loop in other system verilog code without any warnings from the compiler, which was Mentor questa. In fact, the loop is placed inside the generate similar to the DDR4 PHY code. I will just ignore the warnings for now. KelvinShare"


Question: Help. Lumberyard does not recognize visual studio 15

So I have visual studio 2015 installed on my PC. But ly does not seem to detect it for some reason. (user_settings.options file already has msvs_version = 14 ).Edit : I have also installed Windows 10 SDK hoping that it would solve the issue. But that didn't help either.REMOVEDUPLOADFollow

Answer: "0Accepted AnswerHi j27vivek ,Yes when you are installing Lumberyard you need to select "Visual Studio 2015" (Visual Studio Version - Select One or More) when you are installing Lumberyard (in the Lumberyard Setup Assistant).Also when you are installing Visual Studio 2015/2017, make sure to "customize" your Visual Studio 2015 installation (select "custom") and then make sure you select "Programming Languages" -> Visual C++ -> Common Tools for Visual C++ 2015" and also select "Programming Languages" -> Visual C++ -> Microsoft Foundation Classes for C++"After installing all the required software and the required SDKs (in Lumberyard Installer / Lumberyard Setup Assistant), go to the summary section and launch the "Configure Project".A nice tutorial on setting up the environment in Lumberyard can be found here:https://lumberyardtutor.me/2017/08/14/getting-the-environment-setup-in-lumberyard-for-c/I hope this helps!MarkSharerePost-User-9149768answered 5 years ago0Hey @REDACTEDUSERSorry for the troubles. Curious to know if you installed VS2015 through the customize option in the installer. This would give you access to the features list where you can select Microsoft Foundation Classes for C++ and Common Tools for Visual C++ 2015 like so:REMOVEDUPLOADSharerePost-User-5738838answered 6 years ago0Sooo.. well I fell into the same trap with the exact same problem. So is it OK if I just uninstall VS 2017 ?Thanks for the help ;)SharerePost-User-4807048answered 5 years ago0Also, on a sidenote, if you are installing BOTH Visual Studio 2015, and Visual Studio 2017 on the same machine, you MUST install Visual Studio 2015 first (and then after VS2015 is installed, then you can install VS2017 later). Even though 2017 can include 2015's compiler, Lumberyard requires certain registry entries to be set up correctly, and this doesn't seem to happen if you have VS2017 installed first.Lumberyard Setup Assistant (and Installer) is currently "messed up" and doesn't support Visual Studio 2017 (yet) in Lumberyard, and the easiest (and only) way to get Visual Studio 2015 setup (and working) is to install Visual Studio 2015 first.So next run lmbr_waf build_win_x64_vs2015_debug -p all in your command prompt. This will take awhile. If you want more "detailed" instructions, please see the following blog post here:https://lumberyardtutor.me/2017/08/14/getting-the-environment-setup-in-lumberyard-for-c/It's currently a bit "difficult" trying to get the environment setup/configured in the latest version of Lumberyard (v1.12.0.0) but hopefully this is something that will get resolved fairly soon (or so I hope). It's been a problem for several months/years now, and I keep pushing for the "devs" to get these "issues" (problems) resolved, and add support for Visual Studio 2017 (so we don't need to install legacy VS2015 tools anymore) but unfortunately it's been extremely difficult trying to get Visual Studio 2017 support added to the latest Lumberyard.Hope this helps!SharerePost-User-9149768answered 5 years ago"


Question: Rate Limit Timestream Queries For IAM User

"Is there a way to place any sort of rate limit on timestream queries?Right now I have a cloudwatch alert set up for "CumulativeBytesMetered" over a period of time which works fine if im available to see it. Instead, I would like start rejecting queries if a certain quota is reached.I'm sure i could get something in lambda working to remove permissions from the IAM user or similar, but id rather use a built-in option if it is available.FollowComment"

Answer: "0Hi,I have checked with our Timestream engineer and currently we do not have such quota available to reject queries. The lambda seems to be the way to move forward.CommentShareSUPPORT ENGINEERKevin_Zanswered 3 months ago0If you know the limit you want to set at a query level, you could try cancelling the query upon reaching the desired BytesMeteredSoFar limit - example code can be seen here - https://docs.aws.amazon.com/timestream/latest/developerguide/code-samples.run-query.html#code-samples.run-query.query-statusCommentShareShravanthi Rajagopalanswered 3 months ago"


Question: S3 Objects count vs Metrics "Total number of objects"

"I have an AWS S3 Bucket. The "Objects" tab of the S3 web console shows 77 objects, and the items are what I expect. The "Metrics" tab of the S3 web console shows a "Total number of objects" graph having the latest data point of 7,480 "AllStorageTypes." Bucket Versioning is disabled on this Bucket.What are the 7,403 additional objects in the Bucket that are hidden from the "Objects" tab?FollowComment"

Answer: "0Accepted AnswerIn my case, the massive object count difference appears to be due to incomplete multipart upload objects hidden from the Objects tab. For details, see: https://aws.amazon.com/blogs/aws-cloud-financial-management/discovering-and-deleting-incomplete-multipart-uploads-to-lower-amazon-s3-costs/CommentSharerePost-User-8683112answered a year ago"


Question: Calling User Pool endpoint has any quotas?

"Does calling the endpoint (e.g. GET /oauth2/userInfo) has any limit quotas?Example, GetUser api call has a limit of 120 requests per second. Does GET /oauth2/userInfo also counts as a request?FollowComment"

Answer: "0Hi,Yes, calling UserInfo endpoint will count as a request to GetUser and will be subject to UserRead category limits. Depends on your use-case, you can get user profile information from the id-token without calling userInfo endpoint.CommentShareEXPERTMahmoud Matoukanswered a year ago"


Question: "How can I test 'StatusCheckFailed_System', 'StatusCheckFailed_Instance' in Grafana Cloudwatch Alert?"

"It seems to return 0 if there is no problem in the two metrics 'StatusCheckFailed_System' and 'StatusCheckFailed_Instance' in cloudwatch.I want to check the Alert function in Grafana by returning 1 for testing purposesIs there any way to return 1 from both metrics, and after testing, I want to normalize it by returning 0 again, I'm curious about this method tooFollowComment"


Question: "How to check the download process status during Amazon WorkDocs Companion work? (macOS, M1)"

"I need to download a huge folder from WorkDocs.I can't do it through browser, because web UI forces me to do it through Amazon WorkDocs Companion.I've installed it, and it's only notifed me, that it started the dowload.I want to know:how long will it take?are there any errors during the download?etc.FollowComment"

Answer: "1To check the download process status during Amazon WorkDocs Companion work on macOS M1, you can follow these steps:Click on the Amazon WorkDocs Companion icon in the menu bar and select "Downloads" from the drop-down menu.In the Downloads window, you will see a list of all the files that are currently being downloaded by Amazon WorkDocs Companion.Click on the file that you want to check the download progress for.You will see the download progress bar and the estimated time remaining for the download.If there are any errors during the download, you will see a notification with the error message in the Downloads window.You can also click on the "More Info" button next to the download progress bar to see more details about the download, such as the download speed and the total size of the file.Keep in mind that the download speed will depend on your internet connection speed, and the estimated time remaining may change as the download progresses.CommentShareAWS_Guyanswered 3 months ago"


Question: How to update systemd to version >219 on Amazon Linux 2

"I have an EC2 running Amazon Linux 2 with systemd version 219 installed.I want to update to newer version but after using sudo yum update systemd, the answer is "No packages marked for update".Is there systemd version >219 available for Amazon Linux 2? If so how to get it updated?FollowComment"

Answer: 1Accepted AnswerI checked the following release notes and "219" is the latest.https://docs.aws.amazon.com/AL2/latest/relnotes/relnotes-20221216.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months agoK676 2 months agoThat means we don't have latest systemd versions as per https://github.com/systemd/systemd/releases for Amazon Linux 2 then.I was hoping to set one of my systemd services to auto restart using RuntimeMaxSec property but that's supported by systemd v >=229.Share


Question: Did we use AWS Organizations wrong?

"Rather than sharing a single "root" login for account A on a 3rd party service it's often preferable to invite other account (B, C, D, etc.)  and assign permissions to each of these accounts (admin, viewer, etc.)The "owner" of AWS account A invited the owner of account B into their "organization" by using owner B's email address associated with B's AWS root account.Assumption: B would remain independent but be able to switch into a management (admin) role of account A as authorized. A should not have ANY access to account B.Now it would appear Account A has consumed Account B?!?!   What does "Organization" mean in AWS parlance (read: layman's speak)? IAM role is what should have been done but now I'm trying to understand what happened and help them back out of this…if possible?FollowComment"

Answer: "1When an account is invited to join an AWS Organization and becomes a member, the Organization management account is liable for all charges accrued by the new member account. Payment methods attached to the member account are no longer used.Additionally, when an invited account (in this case) joins your organization, you do not automatically have full administrator control over the account. If you want the management account to have full administrative control over the invited member account, you must create OrganizationAccountAccessRole IAM role.The following document details steps in removing a member account from an Organization.CommentShareMKanswered 7 months ago"


Question: Charge for 77hs for attached elastic ip

"Last month I signed up for the free tier and I just got an invoice for only $0.39:South America (Sao Paulo)Amazon Elastic Compute Cloud running Windows $0.00$0.00 per Windows t2.micro instance-hour (or partial hour) under monthly free tier193 Hrs - $0.00EBS $0.00$0.00 per GB-month of General Purpose (SSD) provisioned storage under monthly free tier10.899 GB-Mo - $0.00Elastic IP Addresses $0.39$0.00 per Elastic IP address not attached to a running instance for the first hour1 Hrs - $0.00$0.005 per Elastic IP address not attached to a running instance per hour (prorated)77.400 Hrs - $0.39I had the ip detached to EC2 instance for like 5 minutes maximum.In any case, I had it attached to a Stopped EC2, but I dont see any charges for that.I had the EC2 off for like a few days, but then turned on every since after that.The charges show up on the only region i been working with, i have no other elastic ips.Anybody can explain why i got charged if the ip has been attached to an EC2 running for 95% of its life time?Edited by: KevinH89 on Aug 4, 2019 1:30 PMEdited by: KevinH89 on Aug 4, 2019 1:31 PMFollowComment"

Answer: "0Hi Kevin,It appears that the Elastic IP charges for an EIP attached to a Stopped EC2 instance is the same as an EIP not attached to anything. Thus, is it possible that your EC2 was in the Stopped state for 77 hours?From the AWS docs:"To ensure efficient use of Elastic IP addresses, we impose a small hourly charge when these IP addresses are not associated with a running instance or when they are associated with a stopped instance or unattached network interface."Link: https://aws.amazon.com/ec2/pricing/on-demand/-randyCommentShareRandyTakeshitaanswered 4 years ago"


Question: What is the best AWS service for sending SMS via REST WEB API calls?

"I would like to use an AWS service as it is possible to do with Twillio. I have an application that manages customers (so I have several thousand phone numbers). This application must be able to send WEB REST API calls to a service (AWS) to send SMS. I had thought of SNS, but that doesn't seem like the right service to me because the phone number won't be in AWS. I thought of Pinpoint. Is this the right service for you? Thank youFollowComment"

Answer: "2Accepted AnswerIt depends what you're trying to do.   You're on the right track, Pinpoint and SNS are both options for mobile messaging.Pinpoint: https://docs.aws.amazon.com/pinpoint/latest/apireference/operations.htmlSNS (without subscribing the phone number to a topic): https://docs.aws.amazon.com/sns/latest/dg/sms_publish-to-phone.htmlKeep in mind there is a SNS "sandbox" mode for SMS to protect reputation and not spam: https://docs.aws.amazon.com/sns/latest/dg/sns-sms-sandbox.html.  Once out of the sandbox mode, you can send SMS messages to any recipient and not just verified ones.CommentSharejsoncanswered a year ago"


Question: DMS- I am trying to migrate 3 tables from a schema

"I am trying to migrate 3 tables and my selection rule looks like this and I get an errorwhere schema name is like 'EEOP_INTEG' and Source table name is like '[EEOP_USER, EEOP_ORG, EEOP_USER_ORG]', includeWhen I migrate only one table , I do not get any error, how do I get multiple tables from a schemaSelection ruleswhere schema name is like 'EEOP_INTEG' and Source table name is like 'EEOP_USER', includeFollowComment"

Answer: "1Accepted AnswerPlease review the following linkhttps://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.SelectionTransformation.Selections.htmlas you can see, you can use the "%" percent sign as a wildcard for all or part of the value for the schema-name and table-name parameter.like{    "rules": [        {            "rule-type": "selection",            "rule-id": "1",            "rule-name": "1",            "object-locator": {                "schema-name": "Test",                "table-name": "EEOP_%"            },            "rule-action": "include"        }    ]}CommentShareEXPERTsdtslmnanswered 14 days agorePost-User-1211029 12 days agoThanks! that was helpfullShare0you cannot include multiple tables in single ruleyou can either use multiple selection rules separate for each tableor use wildcards to include and/or exclude tables.wildcards are _ for single character% for multiple charactersfor more details refer to examples athttps://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.SelectionTransformation.Selections.htmlhttps://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.SelectionTransformation.Wildcards.htmlCommentShareAWS-User-8174525-subhashanswered 14 days agorePost-User-1211029 12 days agoThanks for the information, that was really helpfulShare"


Question: Does AWS Transit Gateway peering supports Jumbo frames (MTU)?

"I am not able to find any reference for TGW Peering Jumbo MTU support, can you please confirm if this is supported?I can see in the VPC docs, that inter-region VPC peering doesn't support Jumbo frames, since TGW Peering also uses the same architecture (I believe) it should also not support Jumbo MTU.I tried a test (EC2 to EC2 across TGW Peering with DF bit set) and it works up to 8500 MTU. Apologies if I am missing something very obvious here.h-4.2$ ping -M do -s 8472 10.2.1.167.  PING 10.2.1.167 (10.2.1.167) 8472(8500) bytes of data.  8480 bytes from 10.2.1.167: icmp_seq=1 ttl=253 time=73.3 ms.  8480 bytes from 10.2.1.167: icmp_seq=2 ttl=253 time=72.4 ms.  8480 bytes from 10.2.1.167: icmp_seq=3 ttl=253 time=72.5 ms.  8480 bytes from 10.2.1.167: icmp_seq=4 ttl=253 time=72.3 ms.  ^C.   --- 10.2.1.167 ping statistics ---  4 packets transmitted, 4 received, 0% packet loss, time 3005ms.FollowComment"

Answer: "0Accepted AnswerTGW does support Jumbo MTU (although at 8500) for all attachments except VPN. See below link:https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html"Transit Gateway Maximum Transmission Unit (MTU) — The maximum transmission unit (MTU) of a network connection is the size, in bytes, of the largest permissible packet that can be passed over the connection. The larger the MTU of a connection, the more data can be passed in a single packet. A transit gateway supports an MTU of 8500 bytes for traffic between VPCs, Direct Connect and peering attachments. Traffic over VPN connections can have an MTU of 1500 bytes."CommentShareEXPERTVKanswered 3 years ago"


Question: pinpoint unsubscribe link

"Hello, i have a query how to add working unsubscribe link in pinpoint email capaignsFollowComment"

Answer: "0Hi @AWS-User-1407359,Used sesev2 instead of ses and it works.**Refer **JSON file format : https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendEmail.htmlaws sesv2 send-email --cli-input-json file://email.jsonRefer- https://stackoverflow.com/questions/66216048/aws-pinpoint-transactional-emails-how-to-include-an-unsubscribe-linkIf the Answer is helpful, please click Mark as answered, this can be beneficial to other community members.CommentSharelearn2skillsanswered a year ago"


Question: Customer would like to migrate CLB to NLB/ALB.

A customer would like to migrate CLB to NLB/ALB. (This customer used the persistent connection to EC2 instances so that they are very sensitive to dis- and re-connection of it at bulk size.)Do we have any recommendation steps or best practice for this?I just found that below link and pdf file which described You can shift traffic all at once or you can do a weighted distribution under "Update DNS Routing with Amazon Route 53." However this is not enough for guiding or instructing them to do.Blue/Green Deployments on AWS.pdf(https://d1.awsstatic.com/whitepapers/AWS_Blue_Green_Deployments.pdf)FollowComment

Answer: 0Accepted AnswerYou can use the Migration Wizard for CLB->ALB/NLB and then gradually shift traffic using weighting (Step 2 in the migration wizard link)CommentShareEXPERTRizwan_Manswered 5 years ago


Question: AWS Backup VSS snapshot fails

"I am backing up about 45 Windows Server EC2 instances with AWS Backup.  One of the AWS Backup jobs, for about 35 of those instances does a VSS snapshot as part of the backup.  I get a lot of VSS failure messages.  Some of them are VSS timeouts, which I understand is a Windows issue that occurs because of an unconfigurable 10 second max time for the snapshot to complete.  Some are related to the AWS VSS provider.  In AWS Backup the error is "Windows VSS Backup Job Error encountered, trying for regular backup".  The job then completes, but without a VSS snapshot. In SSM, the Run Command error for this task is:Encountered unexpected error. Please see error details belowMessage : The process cannot access the file 'C:\ProgramFiles\Amazon\AwsVssComponents\vsserr.log' because it is being used by another process.I tried to rename this file (just as a test, to see if it was in use) and says it is in use by the ec2-vss-agent.exe. So I stopped the EC2 VSS Windows service but that did not stop the ec2-vss-agent.exe process and the error remained. I did an 'end task' on the ec2-vss-agent.exe process and I then manually ran the VSS Run Command from SSM.  It re-started the process, and it ran for awhile before timing out, which is the other (unrelated?) issue we see too.  I can not find anything online about this issue or error and I'm at a loss as far as where to look from here.  I need VSS snapshots of these servers.  If anyone has any ideas about how to troubleshoot this or what else to look for, please let me know!FollowComment"

Answer: "0Hello,Few of the items you can look at; some may seem obvious and you probably already checked them out, but I will list them just for scrutiny:Please validate if the latest versions are installed for both SSM and AWS PowerShell modules in the EC2 Instances (1-2).Can you please confirm if there are no AntiVirus/Security Software which may be scanning the folders and thus the process?If the system is too busy when taking the snapshot, the VSS backup may also time out. Is there a maintenance window to execute the same process off hours in case this is not the case?Check the SSM logs from the instance during the execution of the Snapshot, under "C:\ProgramData\Amazon\SSM\Logs" to see if something is outstanding around the time the Backups is being executed.I hope the above information can led to a path of troubleshooting to find new clues.ReferencesAmazon SSM Agent Releases - https://github.com/aws/amazon-ssm-agent/releasesInstalling the AWS Tools for PowerShell on Windows - https://docs.aws.amazon.com/powershell/latest/userguide/pstools-getting-set-up-windows.htmlCommentShareSUPPORT ENGINEERJosueAWSanswered a year agojhallock a year agoThanks for the suggestions.We do have up to date versions of the agents.We are checking A/V exclusions.  However, the process that is locking the file is ec2-vss-agent.exe so I don't think it would be an A/V issue, but we are having the security team check the configuration to be sure.The systems are not too busy when the backups run, which is in the middle of the night.The SSM logs on the server don't show any issues other than the same error message that shows up in the SSM GUI console.  About an hour and 15 minutes before the backup job there is a SSM job that does time synchronization and that job completes successfully.Sharejhallock a year agoThe initial error I posted is the first few lines of the error.  I have copied the entire error below:Encountered unexpected error. Please see error details belowMessage : The process cannot access the file 'C:\ProgramFiles\Amazon\AwsVssComponents\vsserr.log' because it is being used by another process.Data : {}InnerException :TargetSite : Void WinIOError(Int32, System.String)StackTrace : at System.IO.__Error.WinIOError(Int32 errorCode, StringmaybeFullPath)at System.IO.FileInfo.Delete()at Microsoft.PowerShell.Commands.FileSystemProvider.RemoveFileSystemItem(FileSystemInfo fileSystemInfo, Boolean force)HelpLink :Source : mscorlibHResult : -2147024864MyCommand : Remove-ItemBoundParameters : {}UnboundArguments : {}ScriptLineNumber : 740OffsetInLine : 9HistoryId : 1ScriptName : C:\ProgramData\Amazon\SSM\InstanceData<instance-id>\document\orchestration\d8987ebd-b404-4fd3-90d8-5729d9a39426\runPowerShellScript_script.ps1Line : del $vssStdErrPositionMessage : At C:\ProgramData\Amazon\SSM\InstanceData<instance-id>\document\orchestration\d8987ebd-b404-4fd3-90d8-5729d9a39426\runPowerShellScript_script.ps1:740 char:9del $vssStdErrPSScriptRoot : C:\ProgramData\Amazon\SSM\InstanceData<instance-id>\document\orchestration\d8987ebd-b404-4fd3-90d8-5729d9a39426\runPowerShellScriptPSCommandPath : C:\ProgramData\Amazon\SSM\InstanceData<instance-id>\document\orchestration\d8987ebd-b404-4fd3-90d8-5729d9a39426\runPowerShellScript_script.ps1InvocationSharejhallock a year agoWe've checked all of the items above. The last thing that we did was exclude the folder from A/V but that did not make a difference. It seems like the issue is as stated above, that the ec2-vss-agent.exe process is causing the issue. Any other ideas as to why that process would be keeping the vsserr.log open even after the VSS Run Command completes?Share"


Question: RDS instance stuck in Deleting state

Any advise for blowing away an Aurora RDS instance stuck in a "deleting" state.I was doing some experimenting trying to upgrade a test RDS Cluster which was making no progress.  When I looked further the instance had other issues where it wasn't fully started and stuck in a state of "Configuring-enhanced-monitoring" so in hindsight I should have checked this and not tried to upgrade the instance.As it is just a test database I tried to delete the instance but now it is stuck in a state of "deleting".  Is there anything I can do to forcibly blow it away?FollowComment

Answer: "0Update: I left it overnight and the resource had deleted by morning.  I can't see anything in Cloudtrail to see when they were dropped.  I'd been waiting around 3 hours with a db instance in a deleting state before I gave up and logged off.  Anyway, I'm just happy they've gone.  Good riddance!CommentShareonukanswered 3 years ago"


Question: Web app working in an EC2 instance but not in another

"I have built a Python web app that accepts requests through GatewayAPI and sieves them via Lambda functions and SQS. The app also uses Redis and is deployed using an EC2 instance connected to Lambda functions via Load Balancers and Target Groups. Currently, the app is working perfectly as expected. However, when I deploy the same app into a different EC2 instance with the same specs and connect them to the same Lambda functions via different instances  Load Balancer and Target Group, it fails to work properly despite having received the correct requests. The two EC2 instances use the same Redis server although with a different key. I have debugged every line of my code and still can't seem to find what or where the bug is. I am almost sure that I am doing something wrong on the AWS end. Could anyone help with where things might have gone wrong?FollowComment"

Answer: "0Hi - I would recommend to do the following and find what is happening at each layer based on how you have set up your logs.Look into your application logs and resources logs. Some of these logs may be your custom logs and some of them would be in cloudwatchFor your lambda functions you can check cloudwatch logs for the same. Reference : https://docs.aws.amazon.com/lambda/latest/dg/monitoring-cloudwatchlogs.htmlIf you are using API gateway then you can also look into cloudwatch logs Reference : https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cloudwatch-logs/You can also access logs for your Application Load Balancer. Reference : https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.htmlEssentially look at the logs should provide where the issue is happening like any network timeout, data error, internal error, system exception etc.CommentShareEXPERTAWS-User-Nitinanswered 7 months ago"


Question: 504 error when Cloudfront send https-only request to ALB with specific security group

"I got our CloudFront with ALB as origin, and configured origin as HTTPS ONLY which means CloudFront uses only HTTPS to access the origin.And for this ALB, we tried following inbound rules under its security group:Allow all TCP request from 0.0.0.0/0 for 443Allow all TCP request from 10...0/16 for 80 (character * is replacement for actual private ip)It seems like cloudfront will send 443 requests to ALB, and pass the security group. However, it doesn't, cloudfront return 504 for my HTTPS request. And weird things are:if we split the ALB into two ALB (one for 443, one for 80), it works as we expected;if we change the source of the security group rule for 80 port to 0.0.0.0/0, it works, but we want to limit the access for 80 port(only accessible by private ip address).Anyone has any thoughts on it?FollowComment"

Answer: "0Do you have valid  and non-self-signed certificate associated with ALB?Do you have valid ALB listener associated with target for port 443?CommentShareA-Shevchenkoanswered a year agoAWS-User-4501366 a year agoThanks for reply!Yes, we have SSL certificates from ACM both in CloudFront and ALB side.Yes, it has. As I said above, it works in two weird situations.Share"


Question: Problem on aws skill builder login

"Hello everyone i have having problem on AWS skill builder not login error message say "SOMETHING WENT TO BE WRONG" i have create next amzon account also,tried different browser and version.is there any problem on aws site or what else??? i have informed customer support also but no reply!!!Plz help me to solve problems!!!!FollowComment"

Answer: "0Hi,either refer to this https://repost.aws/questions/QUr70PxTFkTgKM2AsJWFRVgw/amazon-login-not-working-for-aws-skill-builder or it could be that platform is experiencing general issues. I recall that last week, the site stayed in maintenance mode for a while, so this may likely be still related to taht situation.Hope it helps ;)CommentShareEXPERTalatechanswered a month ago"


Question: Correct is schema ?

What are the shortcomings in the scheme?FollowCommentChris_G EXPERTa year agoIt would help if you shared the schema so that we can help you with the shortcomings.Share


Question: How to remove replication status

Is there any way to remove all the replication statuses from all objects from a bucket?FollowComment

Answer: "0https://aws.amazon.com/premiumsupport/knowledge-center/s3-large-transfer-between-buckets/Answer is no after emailing AWS.I worked around this by doing an in place copy, either via cp command or batch jobs.CommentShareqaxanswered 2 years ago"


Question: AWS SNS delivery to multi region

"I have a SNS topic in AWS east which is used by consumer to publish messages. I want to give a resiliency or fail-over solution in another region.   When SNS in aws east is down then consumer should rerouted automatically to aws west . Consumer side changes is not possible for failover .I am looking for solution like Route 53 to do a routing . Is this possible to have Route 53 to deliver to SNS? The usecase is very latency specific so the solution should not add more latency .FollowCommentsetheliot a year agoBy "consumer" do you mean "subscriber"?    By "When SNS in aws east is down then consumer should rerouted automatically to aws west" do you mean you have other means to switch publishing to the new region, and am only worried how your subscribers will receive notification in the new region?ShareAWS-User-6133563 a year ago@setheliot , thanks for reply .In my project , consumer means the system/process who produce the SNS events ( I.e. SNS producers ) .Yes I want my SNS producers to failover to us-west when we have any issue in us-East ( region failover ) without any change in URL.SNS subscription side … let’s say I have SQS subscribers on our side . I have all SNS topic and SQS queue configured in both regions but it’s like cold standby mode .Can I use Route 53 —> VPC interface end point for SNS ( in each region ) where I can adjust/control routing policies ?During failover I can manually update rioting or can automate that via cloud watch + Lambda ( as there are many ways to automate this routing )Share"

Answer: "0Hello AWS-User-6133563,Do you still need help with your project? Please let us know.Kind Regards,MonicaCommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: Upload files to S3 through desktop client

"Hi Experts,Is there any easy solution to upload/download files to/from S3 bucket through desktop client ?Scenario: User who doesn't have access to management console and need to upload file to S3.User authentication through federation (Identity provider), so user will be part of required role to read/write required bucket.Please advise.Thanks,FollowComment"

Answer: "0WinSCP can be used to access S3 from the desktop client.However, WinSCP is supported on Windows, but I don't think it is supported on MacOS.https://winscp.net/eng/docs/guide_amazon_s3Other options include ExpanDrive, which, unlike WinSCP, I believe incurs a fee.https://www.expandrive.com/s3-browser-for-mac/CommentShareEXPERTRiku_Kobayashianswered 4 days agoEXPERTsdtslmnreviewed 4 days agorePost-User-1427154 4 days agoThanks for response, Yes WinScp is one option as Windows client but it need secret key to connect. is there anyway we can avoid secret key ?ShareRiku_Kobayashi EXPERT4 days agoWhat about using the AWS Transfer Family if you have a requirement that you don't want to use an access key and a secret access key?This allows you to access S3 from your desktop client via SCP or other means.If you use the AWS Transfer Family, you can access S3 without using an access key or secret access key.https://docs.aws.amazon.com/transfer/latest/userguide/what-is-aws-transfer-family.htmlOtherwise, it would be difficult to access S3 without an access key or secret access key.Share0Another great option would be Cyberduck -> https://cyberduck.ioThis supports both Windows and Mac and does support AWS S3.CommentShareBisinaanswered 4 days agorePost-User-1427154 4 days agoThanks for response, cyberduck need secret key to connect. is there anyway we can avoid secret key through identity provider role ? pls adviseShare0You can also use Storage Gateway which allows you to mount S3 in EC2 instances or on-prem servers, you can use Storage gateway file gateway to upload files and access files from S3 without having to use your AWS credentials.  For more information please check the following link:What is Amazon S3 File Gateway - https://docs.aws.amazon.com/filegateway/latest/files3/what-is-file-s3.htmlCommentShareJamesson_Banswered 4 days ago"


Question: Can't delete network interface despite there is no instance using it

"Hello I'm using kops and trying to delete a cluster but whenever I try it returns:subnet:subnet-08ce41d54ac8013bb still has dependencies, will retrysecurity-group:sg-058dc5e078d91f60e     still has dependencies, will retryI try to delete security group and subnet manually from aws console and with aws cli but when I try to delete the security group it returns that it has associated a network interface and when I try to delete the network interface it returns that is in use despite there is no instance using it. The network interface Id is the next: eni-0de17b728039af773.Hopefully you can help me.FollowComment"

Answer: 2Network interfaces are not just attached to instances - they could be other VPC endpoints or load balancers. Try running aws ec2 describe-network-interfaces to see the network interfaces and what is using them.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: AWS Fargate Increase Concurrent Running tasks

"When creating a service in AWS Fargate, that runs 1000 tasks, if I create a second one, then it stops scaling at 1000 concurrent tasks between both. The service quota is 5000 but it seems that the limit is imposed by  the "DiscoverInstances" Quota which is set at 1000.So if I understood correctly, if I request an increase of the DiscoverInstances quota to 3000, Fargate will be able to scale up to 3000? Or do I need to request an increase for other quotas?What is a reasonable number to request for that quota? I would like to run 100.000 concurrent tasks but don't know if it is too much to ask.Thank you.FollowComment"

Answer: "0You should able to check the quota here: https://console.aws.amazon.com/servicequotas/#!/services/fargate/quotasThe quota name is: Fargate On-Demand resource countThe default quote is 1,000. Please try increase this quote if needed.CommentShareAlickanswered a year ago"


Question: What risks should I expect when applying WAF to Classic Load Balancer with CloudFront?

"Hello,I'm creating a question to ask what risks should I expect when applying WAF to Classic Load Balancer with CloudFront.I'm considering how to protect my services consisting of the Classic Load Balancer service.The best way is to convert CLB to ALB, so that WAF can be associated without any additional layer like CloudFront.However, some of my services have a restriction that the legacy devices have troubles in connecting via Application Load Balancer.Converting to Application Load Balancer itself needs service verification, which takes a long time to complete.Therefore, I think adding CloudFront and WAF can be a quicker way than converting to ALB.In this regard, let me ask some questions.What risks should I expect when applying WAF to Classic Load Balancer with CloudFront?It comes to me that if the service domain names are mapped to the Clooud Front endpoint, there is no big issue to consider.However, there might be some risks I am not aware of. For example, any other protocols that HTTP, HTTPS are no longer supported after CloudFront and WAF are applied.What side-effect can CloudFront and WAF on CLB incur?For example, as I mentioned earlier, are some protocols no longer supported?If there are some folks having experience in adopting WAF for CLB, please give me suggestions.Best Regards,Keonwoong.FollowComment"

Answer: "2Accepted AnswerHi Keonwoong!To address your main concern regarding protocols other than HTTP and HTTPS, you are correct. Implementing CloudFront with a Classic Load Balancer as the origin will limit communication between clients and your Distribution, and between your Distribution and Classic Load Balancer to only HTTP and HTTPS. You do have the option of specifying a custom HTTP/HTTPS port for communication between your Distribution and CLB origin [1] [2].Adding WAF to the mix, you may find that some application verification is still needed to ensure that any rules you put in place do not inadvertently block valid requests. The rules you implement, whether they are custom rule groups or the AWS Managed Rules rule groups, will depend on your applications needs, but in either case, we advise following our Web ACL testing guidelines [4] to ensure your implemented WebACL meets your needs. We advise that the rules in a Web ACL be set to count and the default action of the Web ACL to allow requests. As well, enabling logging [5] for the Web ACL gives further detailed information about traffic analyzed by the Web ACL, which can help you in making decisions about how your rules may need to be modified for your specific application.[1] Values That You Specify When You Create or Update a Distribution - Origin Protocol Policy - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html?icmpid=docs_cf_help_panel#DownloadDistValuesOriginProtocolPolicy[2] Values That You Specify When You Create or Update a Distribution - Viewer Protocol Policy - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html?icmpid=docs_cf_help_panel#DownloadDistValuesViewerProtocolPolicy[3] How AWS WAF works with Amazon CloudFront features - Using AWS WAF with CloudFront for applications running on your own HTTP server  - https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html#cloudfront-features-your-own-http-server[4] Testing web ACLs - https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-testing.html[5] Logging and monitoring web ACL traffic - https://docs.aws.amazon.com/waf/latest/developerguide/logging.htmlCommentShareSUPPORT ENGINEERJustin_Banswered a year agoEXPERTalatechreviewed 21 days agoKeonwoong Ho a year agoThank you Justin.Let me ask another one that relates to the original question.Have you ever heard a report from other clients that when the request with too many parameters is sent by HTTP/HTTPs, ALB can't handle it properly?I'm reluctant to convert CLB to ALB since we had the issue that some requests were not processed correctly and that they had common in having many parameters.I can't tell you how many parameters they had exactly, nor am I sure whether some parts of the parameters were passed or the parameters were entirely dropped as the issue had happened before I joined my organization.Therefore, we are now running our services on CLB that can support TCP. However, it feels weird since I've never heard about some limitations in the parameter number of the HTTP request.ShareJustin_B SUPPORT ENGINEERa year agoWell, there are some limitations that could potentially have been reached while using an ALB and the HTTP requests sent to it for your application, leading to certain HTTP errors. It's possible that they could have hit header limitations, resulting an HTTP400 error. Or possibly an HTTP414 error was received from the URI and/or query string parameters sent to the ALB were too large.If you haven't already, you may consider looking in to utilizing a Network Load Balancer. NLBs also operate at Layer 4, and offer a number of benefits for migrating from a Classic Load Balancer, with pricing similar to that of an Application Load Balancer.A downside here would be if you wish to utilize CloudFront/WAF with the NLB as an origin, you may still find yourself limited by request size and URL length quotas.Share2Justin's answer is excellent - I'd only add this:If I was in your position I would create an automated test suite - it would allow you to evaluate not only moving from CLB to ALB but also any future changes you might make to your entire application. Yes, it's a lot of work. But it's far better to be able to test changes before applying them to production. And automating those tests saves your future self time and effort. It also allows you to test more than just ALB/WAF.CommentShareEXPERTBrettski-AWSanswered a year ago1Thank you Justin, Brettski.Your explanation and experience are helpful to consider how to transition from CLB to ALB.However, there are still so many traps and burdens that I should think about other alternatives that focus on the primary purpose of security.It was a good discussion.Thank both of you.CommentShareKeonwoong Hoanswered a year ago"


Question: Patching with no internet - Linux 2

"Hello all.I couldn't find solid information on the AWS site, but I am making an assumption I want clarified on please.I am deploying some Linux 2 Instances and understand they can be patched using Patch Manager. It appears that the standard repos are amazon based and accessible regardless of whether the instance has access to internet. Is this correct, or does the instance need access to internet to download patches, like any other machine ?Many thanks.FollowComment"

Answer: "0HiAccording to this link,https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-how-it-works-linux-rules.htmlThe AWS Systems Patch Manager will use one of these equivalent commands to patch Amazon Linux 2 depending on the security option:sudo yum update-minimal --sec-severity=critical,important --bugfixsudo yum update --security --bugfixThese commands will require Internet access to patch your EC2 Instance.Hope this helps,-randyCommentShareRandyTakeshitaanswered 4 years ago"


Question: GoDaddy Domain Propagation from old AWS to new AWS

"Hi Team,Please clarify below as I fail to search suitable answers in documentations / Knowledge center -how to Move AWS Environment to a new AWS Environmenthow to Migrate servers own VPC and accounthow to create DC Controller (new domain) in AWS ?how to create brand new servers in the new AWS account  (further to Q1)hot to Create images and move them to the new account (further toQ4)how to do DNS change for new account?If I create a new domain on GoDaddy and want to move to AWS new account (created in Q1) , how to move the registered domain?How to ensure that  all users (from old AWS / from Godaddy) are in the new domain?How to ensure successful migration from old AWS to new AWS ?FollowComment"


Question: DNS MX settings not propagating

"I entered MX records for my Google Workspaces emails yesterday and they still haven't propagated. AWS touts 60 second propagation worldwide, right? Is there anything I can do to push this through?My domain is swartztrailer.com and it is registered at Godaddy pointing to AWS nameservers. I set up a Route 53 hosted zone.Edited by: Swartz on Mar 24, 2021 11:57 AMEdited by: Swartz on Mar 24, 2021 11:58 AMFollowComment"

Answer: "0Hello,The MX records are not created in the Route 53 hosted zone associated with domain, as we can see in dig output no answer is returned.$ dig swartztrailer.com MX; <<>> DiG 9.11.18 <<>> swartztrailer.com MX;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40101;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1;swartztrailer.com.INMX;; AUTHORITY SECTION:swartztrailer.com.300INSOAns-1410.awsdns-48.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400Make sure you create the MX record in the hosted zone associated with the AWS NS (below) you specified in the domain registration.$ dig swartztrailer.com NS +shortns-1410.awsdns-48.org.ns-1680.awsdns-18.co.uk.ns-412.awsdns-51.com.ns-953.awsdns-55.net.You can refer to instructions mentioned in this post - https://forums.aws.amazon.com/thread.jspa?messageID=978618CommentShareSUPPORT ENGINEERPeter_Nanswered 2 years ago0As far as I know, I did. I created the record as follows in Route 53:Domain name: swartztrailer.comType: PublicCreated by: Route 53Record count: 4Description: -Hosted zone ID: Z07035111EILH7AXWJ70FWhen I click into the domain link above it shows the record I entered:Record name: swartztrailer.comType: MXRouting policy: SimpleDifferentiator -Value/Route traffic to:1 ASPMX.L.GOOGLE.COM.5 ALT1.ASPMX.L.GOOGLE.COM.5 ALT2.ASPMX.L.GOOGLE.COM.10 ALT3.ASPMX.L.GOOGLE.COM.10 ALT4.ASPMX.L.GOOGLE.COM.15 ******************************.mx-verification.google.com.I'm using godaddy, and I don't see any place to add an MX record. It tells me the domain is managed by AWS.I think it might be due to the fact that Route 53 has it's own nameservers for the created hosted zone. The ones I entered were before I started using Route 53. I'm going to change them now and see if that works. See step 7:1 here: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/migrate-dns-domain-in-use.htmlEDIT: Yep. That was the problem.Edited by: Swartz on Mar 25, 2021 6:46 AMCommentShareSwartzanswered 2 years ago0I needed to change my Nameservers to the ones listed in the Route 53 hosted zone (click arrow to expand top bar).CommentShareSwartzanswered 2 years ago"