Question: AWS Lex V2 Closing Response not working

"Hi Team,I have a lex V2 bot invoking a lambda function to get QnA response from Open search, I need to append / or show a closing response after the lambda fulfillment, I tried using closing response and even the success response with Fulfillment options and nothing seems to be working, every time bot returns the response from the Lambda the closing responses are not shown.Please suggest.FollowCommentSaket a year agoHi, we will be able to help you better if you can share more details abot your experience? Are you seeing an error from Lex or you are getting a response which is not expected? It can be heplful if you can share the JSON reponse that Lambda function is returning to Lex and the message configured in Closing Response.ShareAWS-User-6597632 a year agoHi Saket, I am not getting any error, I am looking to append a content type message group, Currently after lambda invocation I am only getting one message and the configured closing response is not getting added.Current :"messages": [{"content": "Answer.","contentType": "PlainText"}Expected :"messages": [{"content": "Answer.","contentType": "PlainText"},{"content": "Closing Response.","contentType": "PlainText"}ShareSaket a year agoHey, without having sufficient information of your setup. I am guessing the fulfillment Lambda function is returning a message back and bot is only responding with that message. If you are doing so then Lex bot will only respond with the message set by the lambda. You cannot use both the message in Lambda and Closing repsonse together.ShareAjayM-AWS a year agoHello, just wanted to follow up and see if you are still working through surfacing the closing response correctly?As Saket mentioned it would be good to know the below information to better help answer your questions:Where is the API response being returned? Are you testing on console, have an integration with another service that consumes the response?When you say you are invoking a lambda function to get QnA response is this a CodeHook Lambda or a Fulfillment Lambda?Are you explicitly adding both the "Answer" and "Closing Response" in the same Lambda response? - If your Lambda execution updates the "messages" field Lex will honor the value you provided and not append/change any additional messages to it.Thank you for your time, please let me know if I can provide any additional clarification questions.Share"

Answer: "0Hello AWS-User-6597632,Let us know if you still need help with your Lex V2 issue.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: Lambda powertool not working properly

"Hello,I configured an Eclipse project with AWS Toolkit installed, to use AWS Powertools package like specified at this link: https://awslabs.github.io/aws-lambda-powertools-java/there was a Maven error in Eclipse Version: 2021-09 (4.21.0) Build id: 20210910-1417 that run on Java 11:Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:aspectj-maven-plugin:1.14.0:compile (execution: default, phase: process-classes)the error was in pom.xml, at line with ERROR :<build>    <plugins>        ...        <plugin>             <groupId>org.codehaus.mojo</groupId>             <artifactId>aspectj-maven-plugin</artifactId>             <version>1.14.0</version>             <configuration>                 <source>1.8</source>                 <target>1.8</target>                 <complianceLevel>1.8</complianceLevel>                 <aspectLibraries>                     <aspectLibrary>                         <groupId>software.amazon.lambda</groupId>                         <artifactId>powertools-tracing</artifactId>                     </aspectLibrary>                     <aspectLibrary>                         <groupId>software.amazon.lambda</groupId>                         <artifactId>powertools-logging</artifactId>                     </aspectLibrary>                     <aspectLibrary>                         <groupId>software.amazon.lambda</groupId>                         <artifactId>powertools-metrics</artifactId>                     </aspectLibrary>                 </aspectLibraries>             </configuration>             <executions> <!--  ERROR at this line -->                 <execution>                     <goals>                         <goal>compile</goal>                     </goals>                 </execution>             </executions>        </plugin>        ...    </plugins></build>the error disappeared with new element (<pluginManagement>) added in below configuration:<build><pluginManagement> <!--  this element fixed above ERROR -->    <plugins>        ...        <plugin>             <groupId>org.codehaus.mojo</groupId>             <artifactId>aspectj-maven-plugin</artifactId>             <version>1.14.0</version>             <configuration>                 <source>1.8</source>                 <target>1.8</target>                 <complianceLevel>1.8</complianceLevel>                 <aspectLibraries>                     <aspectLibrary>                         <groupId>software.amazon.lambda</groupId>                         <artifactId>powertools-tracing</artifactId>                     </aspectLibrary>                     <aspectLibrary>                         <groupId>software.amazon.lambda</groupId>                         <artifactId>powertools-logging</artifactId>                     </aspectLibrary>                     <aspectLibrary>                         <groupId>software.amazon.lambda</groupId>                         <artifactId>powertools-metrics</artifactId>                     </aspectLibrary>                 </aspectLibraries>             </configuration>             <executions>                 <execution>                     <goals>                         <goal>compile</goal>                     </goals>                 </execution>             </executions>        </plugin>        ...    </plugins></pluginManagement> <!--  this element fixed above ERROR --></build>but even so, seams that the plugin is not making weaving (does not generate the classes according to annotations)below annotation does not log the event automatically:    @Logging(logEvent = true,clearState = true)    @Override    public String handleRequest(S3Event event, Context context) {If Eclipse has Version: 2018-12 (4.10.0) Build id: 20181214-0600 that ran on Java 8, the error from  pom.xml does not appear, but the plugin is not making weaving also: there is no event logged automatically.What configuration should I make, so that the event to be logged ?Thank you,MihaiFollowComment"

Answer: "0Try changing compiler version to 11 from 1.8.<source>${maven.compiler.source}</source><target>${maven.compiler.target}</target><complianceLevel>${maven.compiler.target}</complianceLevel>Compare your pom with below, which is a working examples.https://github.com/aws-samples/aws-lambda-powertools-examples/blob/main/java/CoreUtilities/Function/pom.xmlCommentShareRahul Popatanswered 6 months agorePost-User-1318468 5 months agoHello,Thank you for your indication.After making the changes, I could not make the deploy using AWS Toolkit, due to the fact that AWS Lambda function is not detected in the upload wizard during the upload into AWS Lambda. This happen because of the AWS Runtime that I have to change to Java 11 while AWS Toolkit detects only Java8.I made the build using Eclipse Maven plugin and the deploy using web console from Lambda service. This time the weaving worked, but it still does not log the event. Do you have a solution for this, please ? Please see below a stack trace with a good business-error, that shows that the weaving is done:java.lang.RuntimeException: AmazonDynamoDBv2 requestId: HGUSV59QMGHP9HP5V9VI5CHVH7VV4KQNSO5AEMVJF66Q9ASUAAJG for putItem has ExceptionCode: ConditionalCheckFailedException, with Lambda cause: attribute_not_exists(UserPictureNamePK)at com.amazonaws.lambda.mihai.rekonusers.dao.DynamoDao.putRecord(DynamoDao.java:83)at com.amazonaws.lambda.mihai.rekonusers.LambdaFunctionHandler.handleRequest_aroundBody0(LambdaFunctionHandler.java:37)at com.amazonaws.lambda.mihai.rekonusers.LambdaFunctionHandler$AjcClosure1.run(LambdaFunctionHandler.java:1)at org.aspectj.runtime.reflect.JoinPointImpl.proceed(JoinPointImpl.java:257)at software.amazon.lambda.powertools.logging.internal.LambdaLoggingAspect.around(LambdaLoggingAspect.java:109)at com.amazonaws.lambda.mihai.rekonusers.LambdaFunctionHandler.handleRequest(LambdaFunctionHandler.java:27)Thank you,MihaiShare0The Lambda Power Tools Java is an open source project and with this type of use case it would be best to create an issue on the GitHub page so that the owners and contributors of the project would have visibility and also provide guidance or workaround as there may be other persons who have experienced the same.https://github.com/awslabs/aws-lambda-powertools-java/issuesCommentSharerePost-User-0749626answered 5 months ago"


Question: RangeError: Array buffer allocation failed

Hello AWSome folks! I am trying to do the "Build a serverless web application" workshop and I'm on the User Management part. I am on to initialize Amplify CLI by executing the command "amplify init" and it is supposed to initialize the project but I am getting this error:RangeError: Array buffer allocation failed          at new ArrayBuffer (<anonymous>)          at new Uint8Array (<anonymous>)          at new FastBuffer (node:internal/buffer:959:5)          at createUnsafeBuffer (node:internal/buffer:1062:12)          at allocate (node:buffer:410:10)          at Function.allocUnsafe (node:buffer:375:10)          at Function.concat (node:buffer:553:25)          at Extract.<anonymous> (/home/ec2- user/.nvm/versions/node/v16.15.0/lib/node_modules/@aws-amplify/cli/lib/binary.js:127:37)          at Extract.emit (node:events:539:35)          at finishMaybe (/home/ec2-user/.nvm/versions/node/v16.15.0/lib/node_modules/@aws-amplify/cli/node_modules/readable-stream/lib/_stream_writable.js:624:14)What could be causing this?FollowComment


Question: RDS S3 integration

"My RDS has S3_INTEGRATION in option group, still I am receiving below error when I try to download files in RDS Data_Pump_dir.The DB instance doesn't have credentials to access the specified Amazon S3 bucket.To grant access, add the S3_INTEGRATION role to the DB instance.Thanks.FollowComment"

Answer: "1Hi there,Enabling the new S3 Integration feature involves two actions against your RDS Oracle instance:attach an IAM role containing a policy that allows access to your S3 bucket(s), andadd the S3_INTEGRATION option to your option group.If you have only added the S3_INTEGRATION option, you will still need to create an IAM policy with S3 access privileges, create an IAM role that includes the policy, and then add the IAM role to your RDS instance. Instructions for doing this using the AWS console or CLI can be found in the "Prerequisites for Amazon RDS Oracle Integration with Amazon S3" section of the RDS user guide.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-s3-integration.html#oracle-s3-integration.preparingHope that helps. Thanks!MichaelCommentShareAWS-User-9938760answered 4 years ago0Hello,We are using an RDS Oracle instance in GovCloud.The existing roles are Service-Linked Roles.According to the documentation on the following page, AWS creates the service-linked role for you when you create a DB instance and RDS does not allow you to edit the service-linked role.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.ServiceLinkedRoles.htmlSo, I was able to create the IAM policy as described earlier in this thread, but cannot attach that policy to the existing role.  How is this supposed to be done with a service-linked role?ThanksMorganEdited by: MorganNajjar on Aug 2, 2019 6:07 AMCommentShareMorganNajjaranswered 4 years ago"


Question: Test all AWS WAF managed rules

"Hi guys!I'm looking for a lab guide that instruct me to test all AWS WAF Managed rules.If you know any resource, please introduce to me.FollowComment"

Answer: "1Hi ,Please look for AWS WorkshopsAWS WAF WorkshopProtecting workloads on AWS from the Instance to the EdgeWorkshop2CommentShareAWS-User-7653869answered 7 months agoEXPERTIndranil Banerjee AWSreviewed 7 months ago"


Question: Setting up DCV connection gateway and a Session Resolver with the url that is not at the root?

"I am setting up the resolver for the DCV Connection gateway and in the documentation for the URL, can I specify a path as part of the url?So that it can use https://myhostname/api/resolveSession or does it have to be https://myhostname/resolveSession ?For example can I specify in the dcv-connection-gateway.conf:[resolver]url = "https://myhostname/api/"FollowComment"

Answer: "0Accepted AnswerHello, you simply have to ensure that the URL in the [resolver] section of the dcv-connection-gateway.conf configuration file[1] matches what you specify when you implement the session resolver[2].References:https://docs.aws.amazon.com/dcv/latest/gw-admin/session-resolver.htmlhttps://docs.aws.amazon.com/dcv/latest/gw-admin/setting-up-configuring.htmlCommentShareSUPPORT ENGINEERAWS_SamManswered a year ago"


Question: "mturk sandbox creates project, but production environment does not"

"I am new to mturk and I have been following the documentation for using the API to create HITs. I created a HITType and a group of HITs using the API with the sandbox. This created a project which I could view and interact with in the Sandbox, and I could retrieve results via the API and everything worked as expected.I then moved from the sandbox API endpoint to the production API endpoint, and expected the same behaviour (ie that it would create a project.) However when I log in as a requestor, I cannot see any sign of the HITs I created, and I cannot see a new project. If I try to create a project, it expects me to provide a CSV file and not the HITs that I have already created via the API. How do I get a project with the HITs I created, so that I can make it available to workers? Can I create a new project based on the HITType I created when I created my HITs?Edited by: hanzodatasci on Feb 23, 2021 2:56 PMFollowComment"

Answer: "0Accepted AnswerI create HITs via the API in production, but I don't think I ever see them using the mturk UI.   I have to use the API to see the status of submitted assignments.CommentShareuserbobanswered 2 years ago0Thanks for the reply, that's helped me understand how it works. Overnight, all of my HITs reached their maximum assignments. I was expecting an immediate confirmation that the HITs were created on the UI, and found it alarming that there was no confirmation. In the end, the HITs reached the workers and got the assignments. I'm currently downloading the results via the API.CommentSharehanzodatascianswered 2 years ago"


Question: Not all DMS events are coming through with Event Bridge

"If you go into DMS service there is a tab for Event Subscription.  if you register a topic, then you will get notification of every event that happens in the event tab.  For example, then you reboot a DMS instance, there will be two events (replication application shutdown followed by replication application restarted.)  if on the other hand, you use EventBridge, then you will only get a single event from CloudTrail called "RebootReplicationInstance".    The same holds true with events surrounding tasks.  We intentionally caused an issue with a task by deleting the source database.  within the DMS application, we can see the following:Replication task has startedReplication task has failed. Reason: Last Error ODBC general error. Stop Reason RECOVERABLE_ERROR Error Level RECOVERABLE.But if you look at the events emitted by EventBridge, you only see the StartReplicationTask coming from CloudTrails.  Sorry for the long question, but why does EventBridge not provide the same sequence of events that you can see within the Application.FollowComment"


Question: Need assistance with parsing data and creating Athena table

"Hi I am trying to create an Athena table from S3 bucket that contains access logs from API Gw. The format of the data is as follows:2022-06-24T17:09:01.037Z { 'requestId’:’341122-4312-4311-9989-b837438748', 'ip': ’127.0.0.1, 'caller':'-', 'user':'-','requestTime':'24/Jun/2022:17:09:01 +0000', 'xrayTraceId':'-', 'wafResponseCode':'-', 'httpMethod':'GET','resourcePath’:’/items/list’, 'status':'200','protocol':'HTTP/1.1', 'responseLength':'238' }I tried with and without row input serde  to identify or process the data but nothing seems to be working. Without any input configuration I do the content in the table but its formatted incorrectly. I used RegEx, and tested my results on online resources and though the regex looks good online I cannot seem achieve the same result once the table is created. Either I will get a empty response or following message:HIVE_CURSOR_ERROR: Number of matching groups doesn't match the number of columnsAny help is appreciated.I am expecting the result to be in this format:timestamprequestIdipcalleruserrequestTimexrayTraceIdwafResponseCodehttpMethodresourcePathstatusprotocolresponseLength2022-06-24T17:09:01.037Z341122-4312-4311-9989-b837438748127.0.0.1----------FollowCommentTasio EXPERTa year agoCould you kindly share the pattern you're using? Also, did you check this article? https://aws.amazon.com/premiumsupport/knowledge-center/regexserde-error-athena-matching-groups/Share"

Answer: "0After checking the article mentioned by @Tasio I found out that the data that's coming to cloud watch is not formated properly (un-even spaces). Further digging I found the root cause to be cloudformation template, the format string for API Gw access logs had un-even spaces. While sorting out the un-even space issue I stumble upon another option to have API GW send access logs as csv. SO, I made that change and on Athena I set up the table with following properties: InputFormat: "org.apache.hadoop.mapred.TextInputFormat"  OutputFormat: "org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat"  SerdeInfo:  Parameters: { "separatorChar" : "," }  SerializationLibrary: "org.apache.hadoop.hive.serde2.OpenCSVSerde"Now everything is working and I can query the logs using AthenaCommentSharejg_dhanswered a year agoTasio EXPERTa year agoGlad you could fix it.Share"


Question: How to remove instances when using the crowd-instance-segmentation widget?

"I am trying to use the crowd-instance-segmentation widget for getting instance segmentations.Users can add additional instances of a label using "Add instance." However, if the user selects too many instances, how can instances be removed? There seems to be no functionality for removing extraneous instances.Here is the CodePen corresponding to this widget: https://codepen.io/sagemaker_crowd_html_elements/pen/PoWwvwGFollowComment"


Question: Cannot save new version upon editing an Amazon Document

"I just wanted to ask, what is the error in this one. I am editing an Amazon document using Companion App, it shows an excel where I can put the changes. I saved it, then close the excel file and refresh the amazon docs, but it did not capture a new version that shows the changes. Can someone help me with this?FollowComment"


Question: How to correctly quote task command / entrypoint ?

"I am trying to replicate the advice for running Nginx and Certbot in containers in an Amazon ECS environment.  The advice I have been following can be found https://medium.com/@pentacent/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71.This has been great but I am struggling with the last step which is to ensure the certificates are updated in the future.  For example the recommended command for Nginx is:command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"'"On a local container this worked but ECS Neds this in the string array format so I used the following command (which worked locally):command: \["/bin/sh","-c","while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;""]I added the same to the ACS console. However, the task fails to start and in the output I get:/bin/sh: 1: wait: Illegal number: 1{!}nginx: invalid option: "off"/bin/sh: 1: ": not foundThe command in the Task JSON looks like this:"command": \["/bin/sh","-c","while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;""],It looks like this is failing to interpret correctly but I am not sure how I should be quoting (or escaping) this for it to work correctly?Edited by: JSDev on Sep 22, 2020 3:00 PMEdited by: JSDev on Sep 22, 2020 3:00 PMEdited by: JSDev on Sep 22, 2020 3:02 PMEdited by: JSDev on Sep 22, 2020 3:03 PMEdited by: JSDev on Sep 22, 2020 3:03 PMEdited by: JSDev on Sep 22, 2020 3:22 PMFollowComment"

Answer: "0It turns out the correct stanza needed in the console was:/bin/sh,-c,while :; do sleep 6h & wait $!; nginx -s reload; done & nginx -g 'daemon off'This let the JSON generator wrap everything in ".." quotes and it worked.  Also in this environment I had to use $! for the child PID, not the $${!} needed for the docker-compose version.CommentShareJSDevanswered 3 years ago"


Question: How to create this event filter in AWS SQS in this case

"This is the real data structure of my current json data, it contains [] in the data in the first place.{"events":[{"type":"message","message":{"type":"text"}}]}So, basically I just want text message type data from SQS, but now I don't know what should the filter be.Any help will be appreciatedFollowComment"


Question: IoT Core Message Ordering

"I am working on IoT project which require message order. Example I am monitoring elevator in the building. So when elevator moves from floor 1 to 10, I will receive MQTT message for each floor.My problem is: if Broker is not guarantee message sequence based on ACK, my simulation/consumer might get flor number as 1,2,3,[9],4,5,6,7,8,10. So this is kind of not real time monitoring. If this is the case what will be good solution to use instead of IoT Core? Should I go directly with AWS Kinesis Data Stream or any other alternative?FollowComment"

Answer: "0Accepted AnswerHi Ozy, the solution depends on how long your consumer is willing to wait for out-of-order messages. E.g in your elevator example, if your elevator moves from floor 1 to 5 and your consumer  receives events 1,2,3,5 .... 1h ...  4.  Are you ok to wait for 1h before message 4 is unstuck and continue processing message 5?I advise to develop a consumer that can handle out-of-order messages, it makes the solution more robust.That said, if you use a QoS1 on your client  and the events are spaced (in the elevator example several seconds), the chance to get a message out-of-order from one elevator are very low. And if you add some kind of sequence number to the message payload {floor:one , seq:100} , {floor:two, seq:101},{floor:three, seq:102},{floor:five, seq:104}  on the device side, you can detect an out-of-order message at the consumer side and trigger exception logic.CommentShareEXPERTJan_Banswered 7 months agoOzy smile 7 months agoJan_B, thanks for the explanation and no 1h even 10 sec delay is not acceptable. I have same kind of solution in mind to cover the unordered message as you explained perfectly(message is going to be QoS1 and will have timestamp and sequence number).Now I should either go with some custom handling : this depends on how often this problem will happen, is it %1 or less or %10 or more. Because I will have many moving targets and real time is very crucial.Or I can go with streaming to from device directly and get everything in order.I do have a question on the broker message delivery to subscriber but will ask that as separate question to keep the scope here, thank you for your timeAnd thank you for explanation instead of just copy/pasting the document link :) AWS should know when we ask question here we already know where to find these docs, question is when we have done all these and need some experts idea instead of being broker to documents :)Share"


Question: Is there a way to transfer a file from one EC2 instance to another EC2 instance using AWS cli on the first EC2 instance?

I know that its possible to upload/download a file from EC2 to/from s3 using the cp command. But is it also possible to use the AWS cli to transfer a file from an EC2 instance to another EC2 instance? The EC2 instance that does the uploading has an IAM role attached with permission 'EC2FullAccess'.FollowComment

Answer: "1Hi there,Here are the steps you can try:Login to the first EC2 instance using SSH.Use the scp command to transfer the file to the second EC2 instance. The command should be in the following format:rubyscp /path/to/local/file ec2-user@<second-ec2-instance-public-ip>:/path/on/remote/serverReplace /path/to/local/file with the path of the file you want to transfer from the first EC2 instance. Replace <second-ec2-instance-public-ip> with the public IP address of the second EC2 instance. Replace /path/on/remote/server with the path of the directory where you want to store the file on the second EC2 instance.Enter the password for the ec2-user account on the second EC2 instance when prompted.Once the file transfer is complete, you should be able to access the file on the second EC2 instanceLet us know if it works.CommentShareTiagoanswered a month agoViridios a month agoIs there any way to do this without entering a password? For instance by using a IAM role that has EC2FullAccess permission?ShareSyd a month agoscp is not aware of IAM policies. But you can surely use SSH key pairs for passwordless login / file transfer using scp.Share0It's not possible to use the AWS CLI commands for this.As you've already identified, you can use aws s3 cp .... and treat an S3 bucket as an intermediate object store to achieve this. But there isn't an equivalent aws ec2 cp [source] [target] command, which sounds like what your question is about (see aws ec2 help for the full options).Tiago's answer here, of using the Linux scp command, is your best option, assuming that port 22 is open between source and target.CommentShareRWCanswered a month ago"


Question: "EDITED" Expresslink messages not being seen in IOT core

"I have an Espressif Expresslink Dev board connected to an Arduino running the example sketch. I solved the original Issue I had and it started sending messages to AWS and I could see them arrive in the test client. However, after a period of time, which varies from seconds to a few hours, it just stops being able to connect and I see no messages. The code is designed to try and reconnect when a connection is lost, but once it has failed to send a message, or the message is not recieved, it never starts again unless I restart the Arduino Uno. Its hard to debug because opening the serial monitor seems to kick it back into life. Any help appreciated as this is a real pain.FollowComment"

Answer: "0Are you using the same IoT policy for the faulty device and the 2 other devices for which you observe messages in the test client?To check whether this is permissions issues, please enable logging , and look for an error on message publish for the device.Any logs you can share from the device side?CommentShareDoron-AWSanswered 10 months ago0Hi, same policy is attached but. i can't find any logging for this thing except for its shadow.CommentSharerePost-User-2026831answered 10 months ago0Welcome to Re:Post and thanks for your question. This issue sounds like the ExpressLink device is being disconnected from the network. This could be due to inactivity (aka a TLS timeout) or several other reasons. Can you provide ExpressLink device logs from when the disconnect happens? This would help me in debugging your issue.Also regarding...The code is designed to try and reconnect when a connection is lost..You mean the Arduino code/sketch, right? An AWS ExpressLink device will never automatically reconnect on your behalf. This is done on purpose as network traffic for IoT devices can be very expensive and maintaining a network connection means sending traffic.CommentShareKodyAWSanswered 6 months ago0Have you updated the board's firmware? You can get information about the version from AT+CONF? Version and AT+CONF? TechSpec.Updated firmware for the Espressif board is available at https://github.com/espressif/esp-aws-expresslink-eval.CommentShareArchitanswered 4 months ago0I haven't for some time. I stopped using the boards as it became clear that I was sold a product that was not actually ready for release to the public. I had wasted a lot of time trying to make it work and in the end it was easier to run an ethernet cable in my case.I may have another use case soon and will try with the upgrade.CommentSharerePost-User-2026831answered 4 months ago"


Question: What is the storage limit for the AWS Lightsail container service?

"I have developed a python flask api, dockerized it and deployed into the AWS Lightsail container service (1 Micro).The API has got a POST endpoint using which user can POST file. The API will store the file in a temporary folder, process the file (extract keywords) and respond back with JSON response.I know that - if the container instance crashes, then a new instance will be spun up by AWS and therefore I will loose any files stored by the API's POST endpoint.I want to ask regarding the instance that is running:Whether there is any max file size limit?What is the maximum disk space?FollowComment"

Answer: "2Lightsail Containers receive a minimum of 20 GiB of ephemeral storage for each node.CommentShareAlexanswered a year ago0Hey Folks,AWS Lightsail FAQ have this info, related to entirely service, and not only to Containers. The same quotas applies.Docs not says about "max individual file size".Q: How large can I make my attached disk? A: Each attached disk can be up to 16 TB, and the total amount of attached block storage in a Lightsail account must not exceed 20 TB. Q: How many disks can I attach per Lightsail instance? A: You can attach up to 15 disks to a Lightsail instance.Refer: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-frequently-asked-questions-faq#amazon-lightsail-faq-block-storageCommentShareBruno Lopesanswered a year agoAWS-User-2948322 a year agoThe section from where you have copied the text is Block Storage. But Lightsail container service doesn't support block storage or attaching disks. So how can you say that this quota applies to light sail container service?Share"


Question: How do I associate a WAF with an API Gateway?

"I set up an API Gateway route, which works. I now want to protect it with a WAF.I found https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html, which refers to a "Settings" tab inside the stage editor in API Gateway; this doesn't exist for me. All that I see associated with the stage are stage variables and tags.Likewise, from the WAF, it looks like I should be able to associate an API Gateway resource with the WAF; however, my route/stage isn't findable in any of the dialogs.What gives? I am on free tier for both, if that is a factor.FollowComment"

Answer: "2WAF is only available for REST APIs, not HTTP. https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html#waf-introCommentShareEXPERTkentradanswered a month agoEXPERTRiku_Kobayashireviewed a month ago2Hi, WAF is available for Rest api type as mentioned above.If you have http api type, you can either front your api Gateway with CloudFront and associate WAF with CloudFront, or add an Application Load Balancer (ALB) after the api gateway, and associate WAF with the ALB.Hope it helps ;)CommentShareEXPERTalatechanswered a month agoEXPERTRiku_Kobayashireviewed a month ago0Ah yes, you are right. Sorry, was confused by the region in the top bar, which is set to global when I click to ACLs. However, I have the same view as you for the actual creation; and, my ACL is created in US-east-1, as is the API gateway. Here's what I see:CommentSharerePost-User-7220584answered a month agoRiku_Kobayashi EXPERTa month agoAlthough the protocol is HTTP, WAF can only be configured for Rest API.Are you creating an API Gateway with Rest API?Share0The following steps in AWS WAF will help you to set up the system.When linking AWS WAF Web ACLs, create a Web ACL in the same region as the API Gateway.https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.htmlCommentShareEXPERTRiku_Kobayashianswered a month ago0Yeah, that doesn't work either because the API Gateway resource is not listed in the Add AWS Resources tab.The region might be the issue - I can only create ACLs in "Global" (they others are grayed out), whereas the API Gateway is us-east-1.CommentSharerePost-User-7220584answered a month ago0My screen allows me to choose a region on the Web ACL screen.When creating the Web ACL, did you select "Regional resources"?CommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: SNOWBALL Export transfer progress has been stopped going on 36 hours!

I have been watching a Snowball job as the data is exported within AWS... The transfer has been stuck at 83% for the last 36 hours. How do you contact AWS to tell them they need to look at their device in their datacenter? The job id: JID86e589b3-db7c-4186-b67d-b416934cf5f7FollowComment

Answer: 0It took reaching out to the Snowball GM to get the issue resolved.CommentShareAWSDWILSysanswered 4 years ago


Question: "Using AWS Lambda to run Python script, how can I save data?"

"I have a script that gathers data from an API, and running this manually on my local machine I can save the data to a CSV or SQLite .db file.If I put this on AWS lambda how can I store and retrieve data?FollowComment"

Answer: 0Accepted Answerwith aws lambda you can use database like dynamo db which is not sql database and from there you can download csv file.with lambda to dynamo bd integration is so easy lambda is serverless and dynamo db is nosql database.so you can save data into dynamo db also you can use RDS(Mysql) and use man other service but best way will be dynamo db.CommentShareharshmanvaranswered 4 years ago


Question: ebs volume - can't read data

"hi guys, so i have this volume: vol-0f057741ae7be8974 - this worked till today. today my instance stopped working and when i attached this volume to another instance, i can't read the data off it. is there any chance we could recover the data? i forgot to take a snapshot of it :/i have also tried taking a snapshot of the volume and creating another volume but still no dice on mounting it:mount: wrong fs type, bad option, bad superblock on /dev/xvdg,missing codepage or helper program, or other error   _In some cases useful info is found in syslog - try_     _dmesg | tail or so._  [ 3074.328710] XFS (xvdg): Invalid superblock magic numberthanks in advanceEdited by: katmai on May 11, 2018 11:20 AMFollowComment"

Answer: "0Was the volume encrypted?I would suggest take a snapshot, create a volume, attach to a new Linux machine and then:Check the output offdisk -l /dev/xvdgRunxfs_check /dev/xvdg1Check what you getsudo xfsdump -f /dev/xvdg1 | grep -i superblockStill no luck then trysudo mkfs.xfs -N /dev/xvdg1. If you see some numbers there, you may be able to recover the device using a tool like http://www.ufsexplorer.com/If nothing works, you are probably out of luck.CommentSharetmt-awsanswered 5 years ago"


Question: Controlling Frequency of Writes to S3 Target With DMS

"Hey All,I am trying to use DMS for a CDC task (PostgreSQL RDS -> S3). I want to control how often updates are written to the S3 target. I tested a number of settings by changing the “Task Settings” param.BatchApplyEnabled: true, BatchApplyTimeoutMin/BatchApplyTimeoutMax: 3BatchApplyEnabled: true, BatchApplyTimeoutMin/BatchApplyTimeoutMax: 3, MinTransactionSize: 0BatchApplyEnabled: false, MinTransactionSize: 0None of these seemed to have any impact on the time for a change record to appear in S3. All were tested via a single insert. Regardless of setting, it took ~1 minute for the new parquet file to appear in S3.Any ideas on how to control this kind of thing with an S3 target? Thanks.Edited by: Weves on May 4, 2020 3:37 PMFollowComment"

Answer: "0Hello Weves,Thanks for reaching out and it seems you are trying to control CDC with S3 target. Please note that batch apply mode is not applicable or supported with S3 target.You can use below internal parameters ( as target endpoint extra connection attributes) to control the way changes are applied on target during replication.cdcMaxBatchInterval default value 60 secondscdcMinFileSize default value 32 MBPlease change values for above parameters and it will help you change how csv file is generated during CDC.I hope this information helps... I will try to get this parameter documented on our public docs..Thanks,Mahesh KansaraEdited by: MaheshKansara on May 4, 2020 4:58 PMCommentShareMaheshKansaraanswered 3 years ago0Thanks. The cdcMaxBatchInterval param worked pretty well for us.CommentShareWevesanswered 3 years ago0What are the measurement units for these params? And are they documented anywhere in AWS docs yet?? Can't find them.cdcMaxBatchInterval - Is this in seconds?cdcMinFileSize - Is this in MB? KB?CommentSharepcguy166answered 2 years ago0Hi pcguy166,You're correct, cdcMaxBatchInterval is in seconds, and cdcMinFileSize is in MB. This is documented in the "Extra connection attributes when using Amazon S3 as a target for AWS DMS" section of the User Guide, which you can access via the link below.https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.S3.html#CHAP_Target.S3.ConfiguringBest,SeanCommentShareSean-AWSanswered 2 years ago"


Question: S3 MRAP using Laravel PHP - AWS SDK v 3

"I am using Laravel and AWS SDK V3.While implementing MRAP for S3, It is asking me to install AWS Common Runtime. Few articles suggest that this is not required.What needs to be done as even AWS Common Runtime has few issues regarding installationFollowComment"


Question: X-Ray Python SDK - threading

"Hello everyone,I have wrote an application which opens threads and distributes jobs via a queue (python, subprocess).From reading the docs, which for Java call out this use-case specifically, but not for python, I can't figure out how to make sure that traces created in threads inherit the segments, even if they create they own subsegment, in python. I found some GitHub issues and PRs, all of them closed with no obvious (to me anyways) solutions for people to pick this up.Hoping someone has found a solution they are happy to solve this issue.No segment found, cannot begin subsegment localhost.cannot find the current segment/subsegment, please make sure you have a segment openAlso, follow-up question: there seem to be a big push for using the ADOT libraries. Is that accurate?FollowComment"

Answer: "0The Python SDK has some documentation on how to set the trace entity in worker threads, have you tried following this example?The ADOT libraries use OpenTelemetry which contains a large variety of library instrumentations which are listed here. If you are trying to instrument any of the libraries in this list that may not have instrumentation support in the X-Ray SDK, then ADOT would be a great option to look into!CommentShareCarol_Aanswered a month ago0X-Ray data model is service-oriented, that drives XRay SDK design: Segment represents a service, is rendered as a node in X-Ray console. So X-Ray sdk user has to wrap subsegment with a segment.OTel data model is operartion-oriented, OTel SDK is designed as vendor-agnostic, it does not rely on service UX, so it does not force user wrap a span with a service span.That is just different design philosophy, not the big reason XRay is going to move to OTel. The reason X-Ray support OTel because OTel is a powerful open source project, user can get more contributors' support from community.CommentSharerePost-User-8410719answered a month ago"


Question: AWS Redshift query editor v2 - Run button is inactive for all saved queries

"Hi,All of a sudden, I cannot run any saved query in AWS Redshift query editor v2 as Run button became inactive for unknown reasons.If i create a new query, it works fine until i save it.What is happening and how to fix it?Closing and re-opening browser and tab did not help.I use MS Edge, latest version, and do not want to switch or try anything else.FollowComment"

Answer: "1CommentSharerePost-User-6875974answered 14 days ago0Accepted AnswerIt is back to normalCommentSharerePost-User-6875974answered 14 days ago0I have the same problem today.  It seems a bug was introduced into a new version release perhaps.  I have to copy saved queries into a new session window.  If I save that one then the run button gets disabled.  I tried a variety of things, like changing the connection, cluster, database, etc, and nothing worked.CommentSharejonculp85answered 14 days ago"


Question: Cloudwatch monitor linux server load vs CPU

"Afternoon all, CPU is good but sometimes not the issue, so trying to see how we can monitor the load on our linux servers (both Ubuntu and Amazon AMI)  I haven't seen anything in my search, so I am guessing a custom metric, but not sure if anyone has already done this and can help out the best way.Thanks.FollowComment"

Answer: "0After holding off and doing other things, I have figured it out.   So what I did was a simple bash script to get the load and push that as a custom metric that runs every minute.Here is the basic script if anyone wants/needs but having the load vs the CPU is a much better representation to the box as there are so many factors that can slow a server down;#!/usr/bin/env bashPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin#Grab the load (and only the first 1 minute average)load=$( cat /proc/loadavg | awk '{print $1;}' )#to get the instance-IDid=`cat /var/lib/cloud/data/instance-id`#echo $id #echo $loadaws cloudwatch put-metric-data --metric-name="load"  --namespace "ServerLoad"  --dimensions Instance=$id --value $loadThanksCommentSharelraymondanswered a year ago"


Question: "Set correct Table level, Include Path and Exclude path."

"Hello all,I have a s3 bucket with this following path: s3://a/b/c/productsInside the products folder I have one folder for each version (each version is a database snapshot of the products table, obtained on a weekly basis by a workflow)./version_0_temporary0_$folder$part-00000-c5... ...c000.snappy.parquet/version_1_temporary0_$folder$part-00000-29... ...c000.snappy.parquetI have created a crawler (Include Path is set to the same path mentioned above -s3://a/b/c/products) with the intention of merging all the versions together into 1 table. The schemas of the different partitions are always the same. The structure of the different partitions is also always the same. I have tried with different Table Levels (4, 5 and 6) in the "Grouping Behaviour for S3 Data" section on the Crawler Settings but it always created multiple tables (one table for each version).The _temporary folder is something automatically generated by the workflow so it seems. I don't know if I have to include this in the exclude path in order for it to work.What should be the correct Include path, exclude path and table levels in order for me to create only ONE table merging all versions together?I have checked all your general documentation links about this issue but could you please provide an actual solution for this issue?FollowComment"

Answer: "0Accepted AnswerThe exclude pattern could be of special help here:try using the  version*/_temporary**  as the exclude pattern.This would exclude all the unwanted files other than the parquet files.For the include pattern, use  s3://a/b/c/products/'you would not need to provide a level for this case.Check "Create single schema for each S3 path"This would create one table with "version*" as partitions.Reference: https://docs.aws.amazon.com/glue/latest/dg/crawler-s3-folder-table-partition.htmlCommentShareAnanth Tirumanuranswered 9 months agoEXPERTFabrizio@AWSreviewed 9 months ago"


Question: Custom deep racer neural network

Is it possible to create my own neural network instead of using the built in ppo or sacFollowComment

Answer: "1So for when using the console for training your AWS DeepRacer model you are limited to PPO and SAC as well as the hyperparameters and action space definitions, if you want to be able to tinker with more then you are better off looking at DeepRacer for Cloud which is tooling that has been built by the DeepRacer Community.  If you're not already a member of this slack then I would recommend joining.  Plenty of the top racers in the global league are active within the Slack and pretty generous with help and advice to help you improve your models.  Good luck with your training and hopefully see you at the track at one of the global AWS Summits.CommentShareDavidFSmithanswered a year agoTayd3ll a year agoThanks! I appreciate the response and I'm planning on joining the slack here soon. I have looked over DeepRacer for Cloud and Sagemaker and a few other Githubs and but everything seems to work relatively similarly when it comes to using Amazons Neural Net. I was hoping that I could actually make my Neural Net from scratch and select my own layers and weights and more than just the hyperparameters that are given.Share"


Question: Does the IP address created for PrivateLink Interface Endpoint can change?

A customer is interested in adding the IP addresses assigned to a VPC Interface Endpoint to an ALB target group. They have tested and it is working fine.  They are concerned tough that the Interface Endpoint IP address might eventually be changed by AWS.FollowComment

Answer: 0Accepted AnswerIP addresses assigned to ENIs of a PrivateLink VPCE do not change during the lifetime of the ENI.CommentShareAWS-User-3069002answered 5 years ago


Question: AWS SES Sending Email

"Hello,I am using the sandboxed version of SES.I have an email that has been verified.Yet when I send an email from or to that email address, AWS keeps saying:Message rejected: Email address is not verified. The following identities failed the check in region EU-NORTH-1: .**@gmail.com SMTP code: 554I have deleted and re-verified the address many times but to no avail..Any idea why this is happening?Thanks!FollowCommentrePost-User-5999592 2 months agoi have same problem.Share"


Question: SSL certificate verification is failed.

"I requested ssl certificate and choosen email verification as I have email with that specific domain. When I requested for certificate initially my certificate verification is successfully completed and got ssl certificate. But mistakenly i deleted it. Again I tried to request new certificate. I am getting verification mail and after completion of verification, status is showing as failed instead of success. What can I do now to get ssl certificate.FollowComment"

Answer: "0Are there any error messages?If you are out, you must follow the instructions in the following document.https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-failed.htmlCommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: Is there a way to generate the network diagram to increase the visibility

"I have created many instance A, B ,C - these 3 are under the same public subnet and the security groupInstance D is under the same subnet but understand security group.Is there a a way to automatically generate an AWS perspective or AWS Architecture Diagram so that we can visualised them easily?2ndly, is it possible starting drawing the perspective and getting generate the instance straight away from what we have drawn? Is it elastic beanstalk?Edited( 30/12/2021 11:21pm)The network diagram generated can be more verbose. For example:Show the internet gate wayShow the NAT gatewayShow the routing tableFollowCommentAlan-Blackmore 10 months agoYou can connect to hava.io using a cross account role and have all the VPCs within the connected AWS account visualised as diagrams. Will show you the VPC, gateways, subnets and the resources in the subnets like EC2 instances, database instances, load balancers and so forth. They also have a security view that will show you the security groups, open ports and traffic ingress/egress points.Share"

Answer: "1This may get you part of the way there. https://aws.amazon.com/solutions/implementations/aws-perspective/CommentShareEXPERTkentradanswered a year agoMaulik_Makadiya a year agoDoes it means, we must need to create cloud formation for that right?  suppose we have created Ec2 instance or any other services without cloudformation then can i create such graph?ShareAWS-User-8231125 a year agoHi I have updated my questions, does it support? The network diagram generated can be more verbose. For example: 1) Show the internet gate way 2) Show the NAT gateway 3) Show the routing tableShare1There are a couple different options available:From AWS: https://aws.amazon.com/solutions/implementations/aws-perspective/ and https://aws.amazon.com/about-aws/whats-new/2020/09/introducing-aws-perspective/.Other available options:Duo Labs's CloudMapper: https://github.com/duo-labs/cloudmapper.  The Network Visualization functionary is no longer maintaned.There are non-free options available as well (non-exhaustive list):LucidChart: https://lucidscale.com/CloudCraft: https://www.cloudcraft.co/Keep in mind that any non-AWS solutions will typically require you to deploy an IAM role that has access to view/read resources and possibly other infrastructure.CommentSharejsoncanswered a year ago"


Question: Spark Stream on EMR Serverless with Kinesis as source does not update DynamoDb Lease Table

"QuestionIs there a limitation in EMR Serverless that prevents the spark-streaming-kinesis-asl_2.12 library from reading / writing to the DynamoDb lease table? When running a kinesis streaming spark job locally or on a EMR Cluster the DynamoDb lease table is created and syncs properly. Its only on EMR serverless where the table gets created but is never written to.If not, where am I going wrong with my approach to streaming? (detailed below)What I'm trying to achieve:I want to run a very simple Spark streaming job that counts the number of records added to a Kinesis stream every second and prints the count out to in the logs. Nothing fancy.I am using the Spark Streaming + Kinesis Integration approach.I am using the spark-streaming-kinesis-asl_2.12 library.The issueNew records are not detected by my streaming job.The library (built on top of the KCL) is supposed to create a DynamoDb table to keep track of the checkpoint. The table is created by the library but never written to / updated. I think an error in the checkpointing with Dynamodb is resulting in the stream not picking up new records in Kinesis.-->DynamoDb lease table not updatingMy approach (resulting in the issue):Create a Kinesis stream with one shard.Create a VPC with private subnetsCreate VPC endpoints for DynamoDb and integration endpoint for KinesisCreate a security groups that allows all TCP traffic from anywhere (not secure, but simple for the sake of testing)Create an EMR Serverless applicationSpark & emr-6.10Deployed in VPC private subnet and security group aboveSubmit job--packages org.apache.spark:spark-streaming-kinesis-asl_2.13:3.3.2 main.pythe execution role has admin permission (not secure, but simple for the sake of testing)Publish records to Kinesis from local scriptmain.pyfrom pyspark import SparkContextfrom pyspark.streaming import StreamingContextfrom pyspark.streaming.kinesis import KinesisUtils, InitialPositionInStreamimport logginglogger = logging.getLogger(__name__)logging.basicConfig(level=logging.INFO, format='%(levelname)s: %(message)s')if __name__ == "__main__":    logger.info("Testing spark streaming")    sparkContext = SparkContext()    sparkStreamingContext = StreamingContext(sparkContext, 1)    applicationName = 'kinesisApp01'    kinesisStreamName = 'raw-data-ingestion-stream'    endpointUrl = 'https://kinesis.eu-west-1.amazonaws.com'    regionName = 'eu-west-1'    stream = KinesisUtils.createStream(        ssc=sparkStreamingContext,        kinesisAppName=applicationName,        streamName=kinesisStreamName,        endpointUrl=endpointUrl,        regionName=regionName,        initialPositionInStream=InitialPositionInStream.LATEST,        checkpointInterval=2,    )    stream.pprint()    sparkStreamingContext.start()    sparkStreamingContext.awaitTermination()    sparkStreamingContext.stop()    sparkContext.stop()Alternative approaches (that work):I ran the same script from my local machine, as well as trying it on an EMR Cluster. In both scenarios it worked as expected and the DynamoDb Checkpoint table was updated correctly, resulting in the most recent records being picked up by the streaming job.FollowComment"


Question: How are S3 keys calculated for the SES S3 action?

"Hi, I was wondering, if there is a logic behind how the keys for the stored emails in S3 are created when using the S3 action. The documentation only says that they consist of letters and numbers.FollowComment"

Answer: "0The keys are generated from the SMTP ID and unique, according to AWS Support.CommentShareBastianZimanswered 3 years ago"


Question: AWS Console website fails on re-login

"Hello,I've been seeing this console related issue for a while now where I'll have 20 AWS tabs open, then after the session expires I'll login again (with MFA). For some reason when I try refreshing all the tabs to restart the sessions it will sometimes log me out again (Forcing me to reauth for a second time).This may have something to do with how the session is stored in the browser, but I'm wondering if you all are aware of any recommendations or fixes for this problem. It makes it exceptionally difficult to continue the session where I left off if I get logged back out almost every time.I try hard refreshing, pressing the reload button, etc. Most the of the time it will force a relog on a different tab, only sometimes will it accept my first login.Been facing this problem for months and wanted to surface this concern.For reference I'm running Google Chrome on a Windows machineIts really more a case of having difficulties logging back in after the session has expired.Usually after 12 hours aws will end the session and the console will show signed out. If multiple tabs are open after re-authenticating on one tab it is possible the console will just reject on refresh or reload and log out all sessions again.I've been able to work around this for a while with hard refreshing, but have found it annoying and wondered if anyone was aware of a way to avoid this problem on re-loginFollowCommentvtjean a month agoCan you confirm if you're accessing to AWS via Identity Center?SharerePost-User-5423498 a month agoUsually its the console for whatever the old tab was on.For example https://us-east-1.console.aws.amazon.com/cloudwatchThe window will be greyed out with a pop up sayingYou were signed out of your account. Please press ‘Reload’ to sign in to the AWS Management Console again.I've found clicking the Reload or even just soft refreshing will cause me to re-log outShare"


Question: RDP Internal Error

I am unable to connect with my RDP. Whenever i click to connect it shows an error "an Internal error has occurred"there is nothing else. what is the solution ???FollowComment

Answer: "1Hi , there can be multiple reason, if CloudWatch alarms configured, check if any alarms of cpu/memory or disk,also as per link suggested Indranil, please check telnet is working  and also check system log and instance screenshots of your instance status from Monitoring & troubleshooting under Action drop down.Lastly , if you still has no clue, troubleshoot with serial console.https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-serial-console.htmlCommentSharesouravanswered a year ago0Can you please take a look at this troubleshooting guide to see if it helps - https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-remote-desktop-connection-ec2-windows/CommentShareEXPERTIndranil Banerjee AWSanswered a year ago"


Question: Aurora Serverless - ACU utilisation is high when no active database connection

"I have migrated from Aurora Provisioned (t3.medium) to Aurora Serverless (0.5 to 4 ACU) to save cost since our load is scheduled.I was trying in the dev environment to know whether this is working fine for our use case and is cost-effective. But this costs us a lot when compared to Aurora provisioned t3.medium instance.Refer to the diagram. The metric shows the average taken for 1 hour.Even though there are no database connections, ACU utilization is high.Could anyone explain to me why utilization is high?FollowComment"

Answer: "1Please note, each ACU is a combination of approximately 2 gibibytes (GiB) of memory, corresponding CPU, and networking.Aurora continuously tracks utilization of resources such as CPU, memory, and network. These measurements collectively are called the load. The load includes the database operations performed by your application. Additionally, it also includes background processing for the database server and Aurora administrative tasks. Hence, when capacity is constrained by any of these, Aurora Serverless v2 scales up.Currently, Aurora Serverless v2 writers and readers don't scale all the way down to zero ACUs. Idle Aurora Serverless v2 writers and readers can scale down to the minimum ACU value that you specified for the cluster. However, considering the background processing & administrative tasks running at back end may cause serverless instance not scale down to the minimum ACU of 0.5. Additionally, if the cluster is enabled with performance insight, then we recommend to configure minimum capacity to 2 ACUs. Therefore, the observation of ACUUtilization being utilized with no database connections is an expected behavior, as Aurora needs to perform the administrative tasks.CommentShareSUPPORT ENGINEERSanketh Saliananswered 8 months ago1Yes, Aurora serveless is expensive compared to provisioned configuration. Also note that it is not a cost effective solution for scheduled workloads.Aurora Serverless v2 is intended for variable or "spiky" workloads. With such unpredictable workloads, you might have difficulty planning when to change your database capacity. You might also have trouble making capacity changes quickly enough using the familiar mechanisms such as adding DB instances or changing DB instance classes.So for your use case I suggest use the provisioned configuration and setup a scheduled startup script to start the instance before your workload start time and another script to shutdown the instance after your workload ends. While the instance is stopped state you don't get charged for compute usage. For additional savings you can consider using reserved instances; https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_WorkingWithReservedDBInstances.htmlCommentShareJosephanswered 8 months ago"


Question: Unable to specify bucket with custom identity provider

"I've customized my identity provider using the template and instructions available here:https://docs.aws.amazon.com/transfer/latest/userguide/authenticating-users.htmlI'm able to get a correct response from my API and successfully log while testing in AWS Transfer and with FileZilla. However, it's not actually allowing a user to view existing files or upload new files. Here is the response from the identity provider API:{    "Policy": "<policy granting full access to bucket>",    "Role": "<role with full access to S3>",    "HomeDirectory": "/<my bucket>/test"}I'm assuming this is acceptable based off the information on these pages:https://aws.amazon.com/blogs/storage/simplify-your-aws-sftp-structure-with-chroot-and-logical-directories/https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-transfer-user.htmlHowever, FileZilla gives me the following log:Status:Connecting to sftp.mydomain.com...Status:Using username "test". Status:Connected to 123456.server.transfer.us-east-1.amazonaws.comStatus:Retrieving directory listing...Status:Listing directory /<my bucket>/testError:Unknown eventType 37Error:Failed to retrieve directory listingSo I tried using logical directories instead using the information in the previous links. This is an example response from the API:{    "Policy": "<policy granting full access to bucket>",    "Role": "<role with full access to S3>",    "HomeDirectoryType": "LOGICAL",    "HomeDirectoryDetails": [        {            "Entry": "/",            "Target": "/<my bucket>/test"        }    ]}I updated my UserConfigResponseModel in the API Gateway to this:{    "$schema":"http://json-schema.org/draft-04/schema#",    "title":"UserUserConfig",    "type":"object",    "properties":    {        "Role":{"type":"string"},        "Policy":{"type":"string"},        "HomeDirectory":{"type":"string"},        "HomeDirectoryType":{"type":"string"},        "HomeDirectoryDetails":        {          "type":"array",          "items":          {              "type":"object",              "properties":              {                  "Entry":{"type":"string"},                  "Target":{"type":"string"}              }          }        },        "PublicKeys":        {            "type":"array",            "items":{"type":"string"}        }    }}When I test this in AWS Transfer, I get the following response:Unable to call identity provider: Unable to unmarshall response (We expected a VALUE token but got: START_ARRAY). Response Code: 200, Response Text: OKAll of this is very frustrating because the responses I am getting do not match what I would expect to see after reading the documentation. My question is this: how do I specify a bucket when using a custom identity provider in AWS Transfer.Edited by: paul_hatcher on May 19, 2020 9:26 AMFollowComment"

Answer: "0Hi paul_hatcher,For logical directories to work, the HomeDirectoryDetails field needs to be a JSON string, not an array. The following link will give you a better idea on what the field should be.https://aws.amazon.com/blogs/storage/using-aws-sftp-logical-directories-to-build-a-simple-data-distribution-service/You should use the following schema for “HomeDirectoryDetails” to make it work:“HomeDirectoryDetails”:{“type”:”string”}If you have other issues, please let us know.Thanks.CommentShareAWS-User-5249188answered 3 years ago"


Question: Use your own synthesis implementation strategy and constraints

"Hi,I am using aws-fpga vitis flow synth;I would like to add my synthesis/implemntation strategy and also placement constraints to package_kernel.tclIs it possible ? do you have any example ?for instance to add user synthesis constraints  for this example  on aws-fpga; rtl_vadd?https://github.com/Xilinx/Vitis_Accel_Examples/tree/f640bc8db1a9ffa8b09ae7b47ecca8b706132f75ThanksFollowComment"

Answer: "0Accepted AnswerHello,You should be able to pass flags to v++ for your custom strategy and constraints. Xilinx provides the documentation here: https://docs.xilinx.com/r/en-US/ug1393-vitis-application-acceleration/Managing-Vivado-Synthesis-and-Implementation-ResultsIn the Vitis examples, you should be able to add them to VPP_FLAGS.Please let us know if that doesn't work for you.-DeepCommentShareDeep_Panswered a year agoAWS-User-6407709 a year agoHey Deep,Thanks for your help; I create file which was added into the v++ synthesis path; The file contains the folloiwng:vivado prop=run.synth_1.STRATEGY=Flow_PerfOptimized_high prop=run.impl_1.STRATEGY=Performance_ExplorePostRoutePhysOptI synthesis the entire flow and v++ later on exit with error:What I see is relevant that the error: caught error: problem implementing dynamic region Is it becuase I am using PhysOpt strategy ?Please advise ThanksERROR: VPL_TCL 101-2 design did not meet timing - hold violation ERROR: VPL_TCL 101-3 sourcing script /home/centos/src/project_data/aws-fpga/Vitis/examples/xilinx_2021.1/rtl_kernels/rtl_rna/_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/link/vivado/vpl/scripts/_full_post_route_phys_opt_post.tcl failed INFO: Common 17-206 Exiting Vivado at Sun Feb 20 05:15:59 2022...01:51:45 Starting bitstream generation.. Starting optional post-route physical design optimization. 02:15:36 Phase 1 Physical Synthesis Initialization 02:23:12 Phase 2 Critical Path Optimization 05:15:59 Run vpl: Step impl: Failed 05:16:01 Run vpl: FINISHED. Run Status: impl ERRORPlease adviseThanksShare0Hey Deep,Thanks for your help; I create file which was added into the v++ synthesis path;The file contains the folloiwng:[vivado]prop=run.synth_1.STRATEGY=Flow_PerfOptimized_highprop=run.impl_1.STRATEGY=Performance_ExplorePostRoutePhysOptI synthesis the entire flow and v++ later on exit with error:What I see is relevant that the error: caught error: problem implementing dynamic regionIs it becuase I am using PhysOpt strategy ?Please adviseThanksERROR: [VPL_TCL 101-2] design did not meet timing - hold violationERROR: [VPL_TCL 101-3] sourcing script /home/centos/src/project_data/aws-fpga/Vitis/examples/xilinx_2021.1/rtl_kernels/rtl_rna/_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/link/vivado/vpl/scripts/_full_post_route_phys_opt_post.tcl failedINFO: [Common 17-206] Exiting Vivado at Sun Feb 20 05:15:59 2022...[01:51:45] Starting bitstream generation..Starting optional post-route physical design optimization.[02:15:36] Phase 1 Physical Synthesis Initialization[02:23:12] Phase 2 Critical Path Optimization[05:15:59] Run vpl: Step impl: Failed[05:16:01] Run vpl: FINISHED. Run Status: impl ERROR===>The following messages were generated while  Compiling (bitstream) accelerator binary: rna.link Log file: /home/centos/src/project_data/aws-fpga/Vitis/examples/xilinx_2021.1/rtl_kernels/rtl_rna/_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/link/vivado/vpl/prj/prj.runs/impl_1/runme.log  :**ERROR: [VPL 101-2] design did not meet timing - hold violationERROR: [VPL 101-3] sourcing script /home/centos/src/project_data/aws-fpga/Vitis/examples/xilinx_2021.1/rtl_kernels/rtl_rna/_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/link/vivado/vpl/scripts/_full_post_route_phys_opt_post.tcl failed**ERROR: [VPL 60-773] In '/home/centos/src/project_data/aws-fpga/Vitis/examples/xilinx_2021.1/rtl_kernels/rtl_rna/_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/link/vivado/vpl/runme.log', caught Tcl error:  problem implementing dynamic region, impl_1: phys_opt_design (Post-Route) ERROR, please look at the run log file '/home/centos/src/project_data/aws-fpga/Vitis/examples/xilinx_2021.1/rtl_kernels/rtl_rna/_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/link/vivado/vpl/prj/prj.runs/impl_1/runme.log' for more informationWARNING: [VPL 60-732] Link warning: No monitor points found for BD automation.ERROR: [VPL 60-704] Integration error, problem implementing dynamic region, impl_1: phys_opt_design (Post-Route) ERROR, please look at the run log file '/home/centos/src/project_data/aws-fpga/Vitis/examples/xilinx_2021.1/rtl_kernels/rtl_rna/_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/link/vivado/vpl/prj/prj.runs/impl_1/runme.log' for more informationERROR: [VPL 60-1328] Vpl run 'vpl' failedERROR: [VPL 60-806] Failed to finish platform linkerINFO: [v++ 60-1442] [05:16:01] Run run_link: Step vpl: FailedTime (s): cpu = 00:09:19 ; elapsed = 12:21:22 . Memory (MB): peak = 2006.000 ; gain = 0.000 ; free physical = 33820 ; free virtual = 66867ERROR: [v++ 60-661] v++ link run 'run_link' failedERROR: [v++ 60-626] Kernel link failed to completeERROR: [v++ 60-703] Failed to finish linkingINFO: [v++ 60-1653] Closing dispatch client.make: *** [build_dir.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/rna.xclbin] Error 1ERROR: caught error: problem implementing dynamic region, impl_1: phys_opt_design (Post-Route) ERROR, please look at the run log file '/home/centos/src/project_data/aws-fpga/Vitis/examples/xilinx_2021.1/rtl_kernels/rtl_rna/_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/link/vivado/vpl/prj/prj.runs/impl_1/runme.log' for more information[05:15:59] Run vpl: Step impl: FailedINFO: [OCL_UTIL] current step: vpl.impl failed. To rerun the existing project please use --from_step vpl.implproblem implementing dynamic region, impl_1: phys_opt_design (Post-Route) ERROR, please look at the run log file '/home/centos/src/project_data/aws-fCommentShareAWS-User-6407709answered a year ago"


Question: arm64 lambda in ap-southeast-4

I have a python 3.9 lambda in ap-southeast-4 but I don't see an architecture option for arm64.Is there any ETA for arm64 functions in ap-southeast-4?FollowComment

Answer: "0To my knowledge, arm64 architecture for AWS Lambda functions in the ap-southeast-4 region is not supported.I'm not very sure about the ETA for its availability in the region.kindly check the latest status on the AWS service health dashboard: https://status.aws.amazon.com/ or the AWS Lambda documentation for updates.CommentShareGabriel Olaleyeanswered 4 months ago"


Question: EC2 m5.2xlarge CPU speed query

"I've launched an EC2 m5.2xlarge instance and Windows says the CPU specification is:C:\Users\Administrator>wmic cpu get name, maxclockspeed, currentclockspeedCurrentClockSpeed  MaxClockSpeed  Name2500               2500           Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz But the AWS EC2 instance type page via the AWS console for a m5.2xlarge says:Sustained clock speed (GHz)3.1Which is correct?Thanks?FollowComment"

Answer: "0Accepted AnswerThe specs for M5 instances at https://aws.amazon.com/ec2/instance-types/ say "Up to 3.1 GHz Intel Xeon Platinum Processor" - so you may or may not get one at that speed.CommentShareEXPERTskinsmananswered 4 months agorePost-User-3204556 4 months agoThanks for your reply. Do you know how I can actually get a AWS EC2 instance with a CPU clock speed greater than 2.5GHz?Shareskinsman EXPERT4 months agoYou could check specs of different processors.  For example M6i says "Up to 3.5 GHz 3rd generation Intel Xeon Scalable processors (Ice Lake 8375C)", and looking up 8375C on https://en.wikipedia.org/wiki/List_of_Intel_Xeon_processors_(Ice_Lake-based) shows it's 2.9 GHz, Turbo Boost to 3.5 GHz.SharerePost-User-3204556 4 months agoThanks for the direction!Share"


Question: AWS Certificate Manager always return status Failed for verification domain

"AWS Certificate Manager always return status "Failed" for verification domain, then Validation method is "DNS validation". When I copying "CNAME name" or "CNAME value" I see "undefined" in clipboard.related question: https://repost.aws/questions/QUHheVIBBLRPiFQXiaYouLlQ/aws-certificate-manager-additional-verification-requiredbut is NOT notmal answered. In answered: going to https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-failed.html#failed-additional-verification-required. - In this manual says: ask question on this current page.FollowComment"

Answer: "0Hello ,Thank you for posting your question on the AWS Repost, my name is Rochak and it will be a pleasure assisting you with this today.I understand you are getting “Pending Validation” when requesting ACM Certificate. Please, let me know if my understanding is incorrect.Please kindly note that this happens when ACM requires additional information to process this certificate request. This happens as a fraud-protection measure if your domain ranks within the Alexa top 1000 websites. [1][2]We also might need to whitelist your domain if it indeed falls within Alexa's top 1000 websites list, for which you would need to reach out via a support case. To do this, you would need to subscribe to a proper support plan for us to troubleshoot this issue much further to dive deeper into the root cause of it. So, please open a support case with our AWS Support team. AWS support includes various tier that you can select from depending on your business needs.Your case will be directed to ACM team and ACM support engineer will be able to help you resolve this issue. [3][4]I hope this helps. If you need further info, let me know in the comments; otherwise I'd appreciate if you mark my answer as "accepted".Kind regards,Rochak from AWSReferences:[1] Error message: Additional Verification Requiredhttps://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-failed.html#failed-additional-verification-required[2] Alexa top 1000 websiteshttps://docs.aws.amazon.com/AlexaTopSites/latest/index.html[3] Sign Up for an Aws Support Planhttps://aws.amazon.com/premiumsupport/knowledge-center/sign-up-support/[4] AWS Premium Supporthttps://aws.amazon.com/premiumsupport/CommentShareAWS-Rochakanswered 3 months ago"


Question: Amazon Workspaces copy / paste does not work

"Amazon Workspaces copy / paste does not work. I've updated the client a number of times and the copy paste function use to work and now it does not. I've repaired/uninstalled/re-installed, tried GPEdit.msc and I cannot get it to work.  Can anyone help with this?I'm on Windows 10 using the Amazon Workspace client, unable to copy from my computer to the remote computer (but can the other way around).Thanks!FollowComment"

Answer: "0Can you post both the client logs and the server side logs?The client side logs should be in something like %localappdata%\Amazon Web Services\Amazon Workspaces\1.0\Logs\TRANSMITTEDOn the workstation side they'd be on %ProgramData%\Teradici\Logs**\ , looking for the most recent file with the pattern "*pcoip_server-Your username and registration code will be in these logs somewhere.  It's not a problem to let people see them, but if you want to scrub them from the logs before you post them here, that's fine too.What exactly are the GPO settings on the server side?  It would be useful to confirm those values here as well.CommentShareDonawaAtTeradicianswered 6 years ago0I just started experiencing this too. Copying from inside the WorkSpaces client and then pasting outside to the host computer is seamless. However copying from the host computer and then pasting inside WorkSpaces will not immediately work. The clipboard on the WorkSpace needs some time to grab what's on the clipboard from the host computer.CommentSharemglennjpanswered 6 years ago0Sorry for the delay in getting back to you guys. I'm not receiving an email when a response is left.That was the trick. I had to wait about a minute for the data to become available in Workspaces and then the paste will work.  In previous versions, I could copy/paste instantly.  Waiting about a minute is sometimes painful.  Is there any way this can be accelerated?CommentSharebobberino1answered 6 years ago0Can you post an example of the spreadsheet you are manipulating?  You can send it to me privately if you wish, just send me a private message to coordinate.CommentShareDonawaAtTeradicianswered 6 years ago0Hi,Do we have a solution for this?I still can't copy and paste between my host MacBook and Amazon Workspace.Thanks.CommentSharecleeanswered 5 years ago0The problems of delays you experience when you try to copy from the host to AWS Workspace could be due to the large distance between your location and WS Region.CommentShareidumlupinaranswered a year ago"


Question: I have lots of tables that are stuck in the "Pending Records" Validation state and I can't get them to progress

"I have a migration from MySQL ---> MariaDB that is pretty straightforward and is generally working well.  However, I have several tables that have a Validation State of "Pending records".  This task has been running for several days and the validation state never changes.The problem doesn't seem to be caused by the number of records in the table.  Some of the tables have a small total number of records (~900) and a small number of records in the "pending" state (<10). Some of the tables have a large total number of records (~1.5MM) and several thousand in the "pending" state.  And other tables have 0 validated records and various numbers of total records.  I've have noticed that if I "Reload table data" for some of the tables it works and they become 100% validated.  However, it doesn't work every time and reloading data seems like a bad way to resolve the problem.I've read through the support documents and have an open case with AWS support for this issue, but I thought I would reach out to see if anyone has had this problem and how they solved it.Tips:You're going to need a much larger migration instance than you think; these migration tasks are very RAM intensive!Increase the ThreadCount property of the Validation portion of the migration task; it seems to help somewhatFollowComment"

Answer: "0Hello,Thank you for reaching us. I understand that you have noticed that a small number of records to remain in "pending" state after full load completion and sometimes reloading the table will resolve the issue. While the specific issue needs to be investigated upon by the Premium Support Engineer, a probable reason can be due to the presence of rows which are being continuously modified at the source during validation; then AWS DMS can't validate those rows.Besides, we also have an option to manually validate the tables again by clicking on the 'Validate again' button on the task console. This will work for a full load and cdc dms task and a cdc only dms task but not for a full load only dms task.I will also recommend you to let the task run with these pending records for a while to see if they are marked as 'Mismatched records' and then you can make use of the 'awsdms_validation_failures_v1' control table at the target to look them up:[+] AWS DMS data validation - Troubleshooting -https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Validating.html#CHAP_Validating.TroubleshootingCommentShareSUPPORT ENGINEERMano_Sanswered 10 months ago"


Question: How to get email addresses sent failed by AWS SES?

"Hi,I need to figure out which email addresses could not be delivered by AWS SES (for example, those email do not exist). How do I get that?Thanks.FollowComment"

Answer: "0Hi,You can configure Amazon SES to send  notifications for bounces, complaints and deliveries through Amazon Simple Notification Service (Amazon SNS).These notifications will give you all the information you need to be able to see what happened and allow you to programmatically take any actions required (Like remove them from your mailing list)The following documentation provides all the information for how to configure these notifications through SNS and gives some examples of the notifications: https://docs.aws.amazon.com/ses/latest/dg/monitor-sending-activity-using-notifications-sns.htmlCommentShareRian Brooks-Kaneanswered 5 months ago"


Question: What are the minimum permission needed to start an EC2 instance

What are the least privileged needed to start an EC2 instance:Can get to work with ec2:*but when try to limit the policy with the following  the creation fails:        - Sid: EC2GuardRail                Effect: Allow                Action:                   - 'ec2:RunInstance'                   - 'iam:PassRole'                   - 'ec2:DescribeSubnets'                   - 'ec2:DescribeSecurityGroups'                   - 'ec2:DescribeInstances'                   - 'ec2:DescribeInstancesTypes'                   - 'ec2:CreateTags'                   - 'ec2:DescribeImages'                   - 'ec2:DescribeKeyPairs'                   - 'ec2:DescribeVpcs'                   - 'ec2:CreateSecurityGroup'                   - 'ec2:AuthorizeSecurityGroupIngress'                   - 'ec2:CreateKeyPair'                   - 'ec2:RunInstance'                   - 'ec2:TerminateInstance'                Resource:                 - '*'FollowComment

Answer: "0Hello,To start an EC2 instance, the only Action I see that you're missing is ec2:StartInstances.In regards to minimum permissions for starting an instance, I would recommend allowing:ec2:StartInstancesec2:DescribeInstancesYou may also want to grant ec2:StopInstances if you want to allow a user to also stop the instance.You could also limit the scope to only the user who created the instance or instances that match a specific tag.  See here for additional documentation on that:https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_ec2_tag-owner.htmlCommentShareEXPERTChris_Ganswered a year ago"


Question: My friend Root mail Id got compromised. We cannot login to the account. What can we do

"Hi,My friend root user Id got hacked. We cannot login into our AWS account. We didn't authorized any email updates as well, but it got updated. My card details were linked to the account. I am terrified If I gonna be charged for something I didn't use. The new mail Id it got updated to was: b.ayuhehanusa77@proton.meI raised the cases but no one contacted me.  My Case Id: 10370293431.Someone Please help me out. I am so scared if this gonna effect my career.FollowComment"

Answer: "0The most immediate thing you can do is to cancel the credit card being used against that account in order to prevent any excessive charges. If the email account has been updated there is no way to tell that you are the not the unauthorized user. You will receive a response from support but being able to get access again, if at all, will take time.CommentShareIRMachucaanswered a year agorePost-User-9262521 a year agoI have cancelled my credit card, How can I block my aws account?Share"


Question: Lambda Layers not supported with SAM/CloudFormation in eu-north-1?

"Have a serverless-template with "AWS::Serverless::LayerVersion", when trying to deploy in eu-north-1 I get "FAILED. Reason: Template format error: Unrecognized resource types: [AWS::Lambda::LayerVersion]"When trying in eu-west-1 it deploys OK.Bug or just not supported in Stockholm?FollowComment"

Answer: "0Accepted AnswerHi all,This should now be supported. Thank you.CommentShareTrishikaP-AWSanswered 4 years ago0I've noticed the same problem with eu-north-1. Have not been able to find any documentation regarding this. This forum post was the only relevant search result on Google.CommentShareDavidAtMynewsdeskanswered 4 years ago0I got a message from someone saying that the support for Layers/Serverless in CF is deployed by the Lambda-team (not CF-team), and that latest version hopefully would come soon... I have not tested rcentlyCommentShareEXPERTAndersBanswered 4 years ago"


Question: Send from Workmail as alias via Outlook

"Hi,I'd like to send mails as alias via Outlook.According to this topic, it should be possible with Outlook, but it doesn't seem to work.First I've set up the alias for the WorkMail user. Sending as alias via WorkMail worked after that. Then I've tried to send as alias via Outlook by setting the defined alias with "From". When I set up the WorkMail account as default (Exchange), the "From" Field doesn't change and the mail doesn't get sent as alias. It neither gets sent, when I set up the WorkMail account via IMAP/SMTP, but at least the "From" field changes to the alias. Setting up the alias mail as an separate Outlook account also doesn't work, since the mail gets send as the main user either way.Best regardsFollowComment"

Answer: "0Hi Robin,I use Microsoft® Outlook® for Microsoft 365 MSO (Version 2207 Build 16.0.15427.20166) 32 Bit.Best RegardsCommentSharerePost-User-5702061answered 9 months agorobinkaws MODERATOR9 months agoHi,In that case it should work. Can you see the correct From address in the sent items? Also are you sending the email back to yourself or to another user in the same WorkMail organization? It seem that in that case the alias is resolved to the primary email address.I will check with the service team is that is intended behavior.Kind regards,RobinSharerePost-User-5702061 9 months agoHi,I can only see the correct From address in the sent items, if I connect via Exchange and use a non-registered alias. This mail gets bounced of course, but at least the sent item says "main mail on behalf of alias mail". If I try to use a registered alias, the change doesn't apply in the From field before even sending the mail and the sent mail also doesn't reflect the change. I'm sending the mails to another domain, which is not part of a WorkMail organization.Does it matter which way I set up the account (IMAP, Exchange or Exchange 2013 or earlier)?Do I need to grant permissions for the WorkMail user besides registering the alias?Best RegardsShare0Hi,I'm sorry to hear you're experiencing problems with sending mails using a alias. Are you using Windows Outlook? This feature is not supported in Mac Outlook.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 9 months ago"


Question: Unable to use DynamoDB update API with signed/encrypted records

"Hi, we are unable to use DynamoDB's update API because our records are encrypted and signed. To maintain a valid encryption signature, our service has to first GET the record from DynamoDB, update it, then PUT it back. We are using client side encryption.From AWS docs:Because your DynamoDB Mapper is configured to use the PUT save behavior, the item replaces any item with the same primary keys, instead of updating it. This ensures that the signatures match and you can decrypt the item when you get it from the table.This opens up our application to race conditions, I.E. the record could be updated by another process sometime between the GET and PUT. We have looked into other solutions for this, such as using a conditional expression or version attribute that would throw a ConditionalCheckFailedException if the record has been modified by another process and retrying. There are disadvantages to this -- for example if we have a lot of processes accessing the same record in a small amount of time, there could be a lot of retries and overall latency increase.Is there some way to use DynamoDB's update API on a record with encrypted and signed attributes?FollowComment"

Answer: "0According to the docs, the answer is 'No'.If you use the default save behavior, which updates only the attributes that are modeled in the table item, attributes that are not modeled are not included in the signature, and are not changed by table writes. As a result, on later reads of all attributes, the signature will not validate, because it doesn't include un-modeled attributes.CommentShareEXPERTkentradanswered 3 months ago"


Question: Scale AWS OpenSearch

"Hi,How can you scale AWS OpenSearch  e.g. to switch off the cluster at night and cut some costs? I see that Step Functions does not have this ability.FollowComment"

Answer: "1Accepted AnswerYou cannot shutdown a Amazon OpenSearch domain and bring it back on. You can down scale (e.g., change node type), but i would not recommend it, as it will trigger a blue green deployment as all data will need to be moved to the new instances. You can delete the domain and restore it from a manual snapshot.CommentShareRoianswered a year agomyronix88 a year agoI thought there is another way. But, anyway. Thank you.Sharers-user 7 months ago@Roi Does scale-in/scale-down follow the same Blue Green Deployment approach?Share"


Question: Is there a bulk way of updating a contact address across multiple domains?

"I have many domains and I'm moving. There doesn't appear to be a way to update all addresses, or am I missing something?https://twitter.com/kaihendry/status/1599618923389145088FollowComment"

Answer: "0No native way in AWS.But you can write boto3 script and loop around a file picking one domain at a time.Better to test out with 2 to 3 test domains before doing bulk change.You may also face some throttling, so make sure to add some wait time.[1] update-domain-contact - https://docs.aws.amazon.com/cli/latest/reference/route53domains/update-domain-contact.html[2] UpdateDomainContact - https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_UpdateDomainContact.htmlCommentShareMuhammadanswered 5 months ago"


Question: getTemporaryPassword from Cognito for a specific user

"Hi team,I have a validation flow of a cognito user that happen in tow steps:step11 - add a new user in Cognito user pool using adminCreateUser API call2 - add RELATED user info inside a dynamoDB table3 - send an invitation link to the user (valid for 2 days) => when the user clicks the link he will be asked to provide only a new passwordwhile creating the user with  adminCreateUser I assign to him a TemporaryPassword (generated by my code or let Cognito generate it)Step21-  When the user clicks the invitation link, gives his new password and confirm2-   on the backend I will call adminInitiateAuth to get NEW_PASSWORD_REQUIRED challenge3-  the call respondToAuthChallenge and provide NEW_PASSWORD that the user provided4-  user is confirmed in Cognitolet's say the user will click on the invitation link 1.5 days after receiving it, provide his new password and confirm.then  I call adminInitiateAuth ( point 2 of step 2) ==> for this, I need to provide the TemporaryPassword that I set in step 1 during adminCreateUser call.as step 2 is separate from step 1 and they can have a few days between them,is there an API method that allows me to get the TemporaryPassword from Cognito, so in Step 2 I can adminInitiateAuth and continue with NEW_PASSWORD_REQUIRED challenge.if I store the password temporarily in the Redis cache, the key can expire and I will lose the password (since if the first link is expired I can Resend the invitation link again and again always for the same user created in Step 1 with adminCreateUser API call, but I still need the TemporaryPassword for that user).how can I get the TemporaryPassword from Cognito for a specific user so that I can finalize step 2 and confirm the user (by doing adminInitiateAuth + respondToAuthChallenge)is it a bad practice if I set the TemporaryPassword hard coded  during user creation adminCreateUser so I will always know it for adminInitiateAuth, then update the user's password with respondToAuthChallengeif I use Redis should the password be stored in encrypted form?can I store the password as is in DynamoDB user table along with the user's info without further encryption? (as the DDB user table itself is already encrypted with KMS)appreciate your Help!FollowComment"

Answer: "0Hello,As per the design of Cognito service, when you create an user using AdminCreateUser API, then admin need to send the password to user via email/phone number and the user should provide the temporary password during first sign-in.There is no API in Cognito to fetch the temporary password again which was set during creating the user profile.However, if you do not want your users to provide the temporary password, then you need to store the temporary passwords securely. You should never hard-code same password for all users. Because if anyone get the password by any chance, then he can use the same password to login to any newly created user profile. You need to generate random temporary password and store it until the user sign-in for first time.When the user signing-in for first time then you can fetch the record to have the temporary password of the user and then you can delete the entry from the database once the user has successfully set their new password.The password should always be stored in encrypted form and you need to configure proper fine-grained permission to restrict access for decryption of the password.Note: As per the Shared responsibility model it is customer's responsibility to maintain the "security in cloud".I hope the information is helpful to you. In case you have any further queries/concerns regarding AWS services then please let us know. We are always here to assist you.--Reference--Client-side and server-side encryption in DynamoDB:https://docs.aws.amazon.com/dynamodb-encryption-client/latest/devguide/client-server-side.htmlDynamoDB encryption at rest: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.htmlCommentShareSUPPORT ENGINEERTarit_Ganswered 7 months ago"


Question: Does the Redshift Data API support Redshift serverless?

"Does the Redshift Data API support Redshift serverless? If so, please share a few examples of CLI or API commands of Data API accessing Redshift serverlessFollowComment"

Answer: "0Hi,Yes Redshift Data API works on Redshift Serverless but the commands and their parameters differ from the Redshift provisioned cluster Data API ones. Here are some useful links:CLI commands for Redshift Serverless: https://docs.aws.amazon.com/cli/latest/reference/redshift-serverless/index.htmlAPI operations for Redshift Serverless: https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_Operations.htmlThanks,CommentShareZiadanswered 7 months agoEXPERTFabrizio@AWSreviewed 7 months ago0Hey ,can you please provide links for using "redshift data api" with redshift serverless  , the links provided are for redshift serverless apis .. i'm asking because i'm encountering  a problem executing any redshift data api client method to execute statements on redshift serverless , i provided secret arn with database and workgroup as arguments  , but always leads to no credentials error . thxxCommentShareziedanswered 3 months ago"


Question: "how to resolve "site not reached, <ip address of ec2 instance> refused to connect" error when trying to create s3 file gateway?"

I'm trying to create file gateway so I can set up file share. For host platform I'm using EC2 instance but when I give the ip address of my EC2 instance I get error "This site can't be reached" "<ec2 ip address> refused to connect". I've followed this guide to make sure that I've configured everything correctly and it doesn't look like I've missed anything. Any help with what I'm doing wrong? https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.html#TroubleshootingInstancesConnectionTimeoutFollowComment

Answer: "0Hi, please check if you are able to connect to the gateway IP address on port 80 from your workstation where you are trying to activate the gateway. For gateway EC2 instance, please check whether its security group rule allows ingress port 80 from your workstation client IP address. Port 80 is needed only for activation, you can remove the rule after the activation is completed.https://docs.aws.amazon.com/filegateway/latest/files3/Requirements.html#requirements-networkAlternative method to activate is, to fetch the activation key from the gateway VM/EC2 local console, using option 0: Get Activation Key and provide that during the activation wizard. Below are the instructions for DataSync console to get the activation key, but these should be almost similar to gateway VM as well.https://docs.aws.amazon.com/datasync/latest/userguide/local-console-vm.html#get-activation-keyhttps://docs.aws.amazon.com/filegateway/latest/files3/create-gateway-file.html#connect-to-amazon-s3-fileCommentShareSuryaanswered a year agoAWS-User-9414321 a year agoHello, I've checked that port 80 is present in the inbound ports for ec2 security group however when i test connection in powershell using following command: tnc <ec2 public ip address> -port 80, the connection fails. What can I do to solve it?ShareSurya a year agoI am assuming that you may not be using the correct or latest AMI that is required to host the storage gateway instance. I would suggest checking that you are using the latest storage gateway AMI in your region and meets the hardware configuration. If you are still encountering issues after using the recent gateway AMI, please private message me the EC2 instance ID.https://docs.aws.amazon.com/storagegateway/latest/userguide/ec2-gateway-file.htmlSharerahm0277 a year agoThis still isn't working for me. What is the latest AMI we should be using?Share"


Question: health is severe after I listen only on https

"I'm new to web development, and I've set up an Elastic Beanstalk environment with SSL certificate on my instance using Route 53. However, when I listen only on port 443 for HTTPS, the health of my server becomes severe. It works fine when I listen on both ports 80 and 443, but I can't connect using HTTPS. I'm not sure if the issue is with my configuration or with my Django project on the Elastic Beanstalk environment. Can someone help me with this? Thank you.FollowComment"

Answer: "0Hi,Please check whether you have configured security group rule for port 443. As mentioned in the bloghttps://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-singleinstance.htmlResources:  sslSecurityGroupIngress:     Type: AWS::EC2::SecurityGroupIngress    Properties:      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}      IpProtocol: tcp      ToPort: 443      FromPort: 443      CidrIp: 0.0.0.0/0Some of the related topics exists here.CommentShareJustin Mathew Bijianswered 3 months ago"


Question: Root Path Pattern

How can I create a pattern only for the default page i.e. https://example.com or https://example.com/I created a path pattern /But everytime it just falls through to the default bucket. What am I doing wrong? Thanks!FollowComment

Answer: "0For just root, "/" should do it.Did you wait for it to fully propagate before testing with a cleared cached? Any CF changes can take 20+ minutes to take effect.CommentSharecloudbuttonanswered 4 years ago0Yes I did wait for it to propagate. But I figured out the issue if anyone else runs into this!Specify a Default Root Object is the culprit. If you specify a default root object for your cloudfront distribution, that supersedes any path pattern you have, and I'm pretty sure immediately executes through the default bin. So if you have a lambda @ edge function for the default bin it will still call that one.What I did was remove the default root object, then in my Path Pattern '/' behavior, I redirected to '/index.html' (or whatever your default root object was) once I performed my needed functions in my lambda function. Hope this helps!CommentShareDSBanswered 4 years ago"


Question: SSL Name Mismatch with API Gateway Custom Domain

I have a Regional API Gateway (WebSocket flavor) with a custom domain name and am seeing intermittent SSL domain name mismatch errors.  When checking with a tool like https://www.leaderssl.com/tools/ssl_checker it shows that sometimes a cert for *.execute-api.us-west-2.amazonaws.com is being returned instead of the custom domain name.  I have verified the following:Certificate is in the us-west-2 regionAPI Gateway is in the us-west-2 regionRoute 53 domain name points to the URL of the custom domain name and not the APINote that the custom domain name URL shows d-{id}.execute-api.us-west-2.amazonaws.com and not a something.cloudfront.net URLAny other thoughts as to why this might be happening?FollowComment