Question: System Manager Baseline fails trying to search for updates

"Starting this week we received the following when SSM ran our monthly patch baselines. The only change to the servers since the baseline starting failing is the servers were joined to our simple AD directory via the SSM domain join command. I can login to the server an manually run windows update and it completes and finds the missing KBs, but the System manager documents generate this error. Any assistance is appreciated.[PatchNow Application Log Output]2017-12-17T19:36:06.950 [INFO] - Install-WindowsUpdates -UpdateLevel Important2017-12-17T19:36:06.964 [INFO] - includeRecommendedUpdates = False2017-12-17T19:36:06.969 [INFO] - Creating state file directory C:\ProgramData\Amazon\PatchNow\State\2017-12-17T19:36:06.977 [INFO] - Started collecting Windows Update Log information.2017-12-17T19:36:06.977 [INFO] - Beginning operation.2017-12-17T19:36:06.991 [INFO] - Checking for state files.2017-12-17T19:36:06.998 [INFO] - Set up file based logging to: C:\ProgramData\Amazon\PatchNow\Logs\Install-WindowsUpdates-2017-12-17-19-36-06.log2017-12-17T19:36:06.999 [INFO] - ResumeFromReboot = False2017-12-17T19:36:06.999 [INFO] - Creating the state file C:\ProgramData\Amazon\PatchNow\State\1e3f1ce0-c964-4876-a3b3-bad42714726e.json2017-12-17T19:36:07.002 [INFO] - Searching for updates.2017-12-17T19:37:14.320 [INFO] - Releasing the file lock on the state file C:\ProgramData\Amazon\PatchNow\State\1e3f1ce0-c964-4876-a3b3-bad42714726e.json2017-12-17T19:37:14.321 [INFO] - Deleting state file C:\ProgramData\Amazon\PatchNow\State\1e3f1ce0-c964-4876-a3b3-bad42714726e---Output truncated-------------ERROR-------failed to run commands: exit status 4294967295Install-WindowsUpdates : Exception Details: An error occurred when attemptingto search Windows Update.Exception Level 1:Error Message: Exception from HRESULT: 0x8024401CStack Trace:    at WUApiLib.IUpdateSearcher.Search(String criteria)at PatchNow.Implementations.WindowsUpdateAgent.Search()At line:1 char:1Install-WindowsUpdates -UpdateLevel Important  + CategoryInfo          : OperationStopped: (PatchNow.Implem...UpdateOpera    tion:InstallWindowsUpdateOperation) \[Install-WindowsUpdates], Exception    + FullyQualifiedErrorId : Exception Level 1:    Error Message: Exception Details: An error occurred when attempting to se    arch Windows Update.    Exception Level 1:    Error Message: Exception from HRESULT: 0x8024401C    Stack Trace:    at WUApiLib.IUpdateSearcher.Search(String criteria)       at PatchNow.Implementations.WindowsUpdateAgent.Search()            Stack Trace:    at PatchNow.Implementations.InstallWindowsUpdateOperation    .DoWindowsUpdateOperation()       at PatchNow.Implementations.WindowsUpdateOper  ---Error truncated----FollowComment"

Answer: "0Hi,Sorry to hear you're having problems patching your instances. Just to clarify, what document are you using to patch? From the output you posted, it looks as if you're using the AWS-InstallWindowsUpdates (as opposed to AWS-RunPatchBaseline which would be using a patch baseline), is that correct?Could you also share the version of Windows you are using?Thanks!CommentShareMatsanswered 5 years ago0Thanks the response, I apologize I uploaded the logs from my manual run to see if I got a different result from the InstallMissingWindowsUpdates document. For our automated patching we are using the RunPatchBaseline, here is the output for the automated run. This is on a Windows 2012 R2 instance.----------ERROR-------failed to run commands: exit status 4294967295Invoke-PatchBaselineOperation : Exception Details: An error occurred whenattempting to search Windows Update.Exception Level 1:Error Message: Exception from HRESULT: 0x8024401CStack Trace:    at WUApiLib.IUpdateSearcher.Search(String criteria)at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateAgent.Search()At C:\ProgramData\Amazon\SSM\InstanceData\i-0ac5ab3dbe4318e82\document\orchestration\0e73b1e6-ec2b-4197-b629-39368de53fbd\PatchWindows_script.ps1:187 char:13$response = Invoke-PatchBaselineOperation -Operation Install -Snapsho ...        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  CategoryInfo          : OperationStopped: (Amazon.Patch.Ba...UpdateOperation:InstallWindowsUpdateOperation) [Invoke-PatchBaselineOperation], ExceptionFullyQualifiedErrorId : Exception Level 1:Error Message: Exception Details: An error occurred when attempting to search Windows Update.Exception Level 1:Error Message: Exception from HRESULT: 0x8024401CStack Trace:    at WUApiLib.IUpdateSearcher.Search(String criteria)at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateAgent.Search()Stack Trace:    at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.InstallWindowsUpdateOperation.DoWindowsUpdateOperation()at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateOperation.DoBeginProcessing(),Amazon.Patch.Baseline.Operations.PowerShellCmdlets.InvokePatchBaselineOperationCommentSharechockeranswered 5 years ago0According to https://answers.microsoft.com/en-us/windows/forum/windows_10-update/windows-10-update-error-0x8024401c/130e1025-9207-44aa-a730-950dd5a69bcb, this error code (0x8024401C) indicates the instance isn't able to connect to the Windows Update service. Microsoft recommends running the Windows Update troubleshooter in these cases.Patch Manager needs to be able to connect to the Windows Update service in order to download and install the required updates.Could you please try this and see if it helps in your case?Thanks!CommentShareMatsanswered 5 years ago0The issue was I had some WSUS settings left from prior to moving to System Manager Patch Baselines.In particular:HKEY_LOCAL_MACHINE > Software > Policies > Microsoft > Windows > WindowsUpdate > UseWUServer was set to 1 and our WSUS server was no longer online.Thanks for the help it lead me in the right direction.CommentSharechockeranswered 5 years ago0Glad to hear it's working now, please let us know how Patch Manager works out for you./MatsCommentShareMatsanswered 5 years ago"


Question: Automated Data Cleaning and Visualization

"I have an API from which I can retrieve data and upload it to my s3 buckets. I plan to clean this data for missing values, duplicates, invalid values, and also remove outliers. After the data is cleaned, I want to visualize this data and use it as an API so the users can access my visualized charts.I have tried different tools for cleaning processes such as AWS Glue DataBrew, Sagemaker Data Wrangler, and using python (pandas). However, I am unaware of what's the best method to go about especially if I want to automate the entire process so that the cleaning and visualization works as soon as I add a CSV file into the S3 bucket.FollowComment"


Question: How to invoke Lambda using S3 Report Config file

I'm looking to use S3 Batch Operations to load historical log data that is stored in a single S3 bucket into a Redshift table. I created a report config file for the S3 bucket and have questions about how to do the following:How to query the S3 inventory configuration file for specific S3 objects and only send those specific objects to a Lambda which then puts the objects into a Datastream. Can I send the results of Athena query to the Lambda?Can the S3 Batch Operations send objects into a Datastream which will then forward them to Redshift?FollowComment

Answer: "0Q1. You can follow below steps to achieve your query of "query the S3 inventory configuration file for specific S3 objects and only send those specific objects to a Lambda which then puts the objects into a Datastream."To create an inventory for a S3 bucket and store that inventory in a destination S3 bucket, please follow the steps mentioned in the document below https://linuxhint.com/create-inventory-configuration-s3-bucket/In order to query the inventory file for specific S3 objects from destination S3 bucket using Athena, you may refer the following https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-inventory-athena-query.htmlOnce you have queried the desired objects store the resulting output file from Athena in a S3 bucket as described in below reference document https://docs.aws.amazon.com/athena/latest/ug/querying.htmlAfter you have stored the results file of Athena to a S3 bucket, you can use that file to invoke your Lambda function, please refer to the below reference document https://docs.aws.amazon.com/lambda/latest/dg/with-s3-example.htmlTo send the data to data stream from Lambda you can follow the documentation https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.htmlQ2. To send S3 Batch Operations objects into a Data stream which will then forward them to RedshiftYou may use S3 batch operations to invoke a Lambda function which will send it to the Data stream or Redshift based on your requirement. https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-invoke-lambda.htmlCommentShareDhanyashree_Sanswered 7 months ago"


Question: Error when deploying docker image to ECR by aws_cdk.DefaultStackSynthesizer

"I try to deploy a docker image to ECR with the following code.import osimport aws_cdk as cdkfrom aws_cdk import (    Stack,    DefaultStackSynthesizer,)from constructs import Constructdirname=os.getcwd();class HelloStack(Stack):    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:        super().__init__(scope, construct_id, **kwargs)        ecr=DefaultStackSynthesizer(          image_assets_repository_name="rep-test"        );        ecr.add_docker_image_asset(          source_hash="test",          directory_name=dirname,          docker_build_target="img_test"        );app = cdk.App()HelloStack(app, "HelloStack")app.synth()But I got the following error. What is wrong? How can I solve this problem?Traceback (most recent call last):  File "app.py", line 26, in <module>    HelloStack(app, "HelloStack")  File "/home/bitnami/env/lib/python3.7/site-packages/jsii/_runtime.py", line 86, in __call__    inst = super().__call__(*args, **kwargs)  File "app.py", line 22, in __init__    docker_build_target="img_test"  File "/home/bitnami/env/lib/python3.7/site-packages/aws_cdk/__init__.py", line 23050, in add_docker_image_asset    return typing.cast(DockerImageAssetLocation, jsii.invoke(self, "addDockerImageAsset", [asset]))  File "/home/bitnami/env/lib/python3.7/site-packages/jsii/_kernel/__init__.py", line 143, in wrapped    return _recursize_dereference(kernel, fn(kernel, *args, **kwargs))  File "/home/bitnami/env/lib/python3.7/site-packages/jsii/_kernel/__init__.py", line 359, in invoke    args=_make_reference_for_native(self, args),  File "/home/bitnami/env/lib/python3.7/site-packages/jsii/_kernel/providers/process.py", line 359, in invoke    return self._process.send(request, InvokeResponse)  File "/home/bitnami/env/lib/python3.7/site-packages/jsii/_kernel/providers/process.py", line 326, in send    raise JSIIError(resp.error) from JavaScriptError(resp.stack)jsii.errors.JSIIError: Cannot read properties of undefined (reading 'account')FollowComment"


Question: gzip compression with Lambda function URL?

"HiIs there a way to enable gzip compression with the lambda function url, I have set the following in the actual function code but it doesnt seem to work?let response = {statusCode: 200,headers: {'Access-Control-Allow-Headers': 'Content-Type','Access-Control-Allow-Origin': '*','Accept-Encoding': 'gzip'},body: JSON.stringify(responseBody)};FollowComment"

Answer: "0What are you trying to do? Send compressed content to the function or receive compressed content from the function? In either case, the content is binary, so it will be base64 encoded.If you want to return from the function to the client, you need to compress the body yourself, encode it using base64, and set the content-type appropriately.CommentShareEXPERTUrianswered 9 months ago"


Question: RDS Proxy RO Endpoint fallback to writer instance?

"Hello, I would like to know if its possible to configure a RDS Proxy RO Endpoint to fallback to the writer instance if there are no read replicas in the cluster?My software is configured to use both RDS Proxy Endpoints (writer and read-only) but if I delete the RDS read replica instance (because there is not enough load to justify the cost) I am getting connections errors to the Proxy RO endpoint.Thanks for help, I hope this is clear.FollowComment"


Question: "EBS Snapshots Delayed, Not Starting for few minutes after API Call"

My customer is concerned that EBS Snapshots seem to start at their leisure after the API is invoked.Is this a delay in the snapshot actually starting? Or is it a delay in our reporting of snapshot status?FollowComment

Answer: 0Accepted AnswerSnapshot do start immediately upon API call. The status "completed" will only be reported several minutes after.CommentShareMODERATORAWS-User-2926778answered 2 years ago


Question: Fetching Certificate fails in dry run build

I am trying to read a certificate from www.amazontrust.com/repository/AmazonRootCA1.pem via creating a URL and opening a inputStream.Local builds succesfully passes but on Dry Run build it gives exception  [junit]      Caused by: java.net.UnknownHostException: www.amazontrust.comWhat can be done to avoid this error or cam we hardcode the CA in our code directlyFollowComment

Answer: "0Hello,UnknownHostException indicates that the IP address of a hostname could not be determined. It can happen because of a typo in the hostname. Another possible reason for UnknownHostException is DNS propagation delay or DNS misconfiguration.Here's the below link for details regarding the UnknownHostexceptionerror and its various reasons and steps to resolving the same. All the steps are mentioned in details for you to perform & check on what end the issue is.Link- https://aws.amazon.com/premiumsupport/knowledge-center/route-53-fix-unknownhostexception-error/ -- [1]Hope this helps. I would request you to click Accept answer if it did.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 8 months ago"


Question: Iot Core: problem to connect my device

"Hello,I am starting with AWS Iot Core.  I use the MQTT protocol.I did create my Device on the account, as well as its shadow and embedded the 3 certificates: AmazonRootCA1.pem, <MyDeviceName>.cert.pem, and <MyDeviceName>.private.keyWhen I try to connect, each of these certificates seems to be well recognized by my API functions, (I'm not using the AWS SDK, I'm using the Azure RTOS APIs... provided by my device's microcontroller manufacturer)However the TLS session seems to start correctly, the "ClientHello" transaction seems to start well with a successful first handshake, but the connection breaks without me being able to find the reason.Namely, my code was adapted for AWS IOT Core, because it originally worked for Azure IT Hub...I hope someone here can help me?Thanks in advance,Best Regards,Eric F.FollowComment"

Answer: "2Accepted AnswerYou need to check whether the policy attached to that certificate allows the device to perform the operation your code is doing on the necessary resources. Assuming you're publishing into a specific topic, the policy needs to allow an iot:Publish action on that topic (or covered by a wildcard).CommentShareEXPERTTasioanswered 7 months agoEXPERTAWS-User-Nitinreviewed 7 months ago1Hello Eric,you should enable logging for IoT Core. Then you might find information about what happens in CloudWatch logs.You should also validate the IoT policy attached to your device certificate. If the MQTT client violates this policy, for example by sending a not permitted client ID it will be disconnected.Cheers,PhilippCommentSharePhilipp Sanswered 7 months ago0Thank you both for your quick answers.I had not actually attached my certificates to the policy I created...Regards,EricCommentShareClairitec_AWSanswered 7 months ago"


Question: Kinesis Video Service API request putMedia times out with no HTTP code depending on camera

"Hi, we're having some issues with sending up an RTSP stream to KVS.We have a few cameras on site: One camera (model AXIS M3206-LVE) works and the other (model AXIS P1448-LE) does not. Both of them are updated to latest LTM firmware. Cameras are on timezone GMT+1.Both are on the same network and under the same firewall rules, the RTSP link is the same.I am using the example kvs_gstreamer_sample from the CPP producer SDK with no modifications.Running this sample application on an EC2 instance of type t2.micro on us-east-1.Streaming to a KVS instance on us-west-2.This application setup works with a public RTSP test stream (rtsp://wowzaec2demo.streamlock.net/vod/mp4:BigBuckBunny_115k.mp4).The RTSP stream works on VLC no matter what camera.The core problem appears to be the API request putMedia which times out after 30 seconds with HTTP code 0.I've tried lowering factors like resolution and bitrate to minimums but get the same behavior everytime.Could we be hitting a KVS limit of some kind? Is there a significant camera setting that may be different between the two?[INFO ] [01-03-2023 00:21:03:643.863 GMT] Using region: us-west-2[INFO ] [01-03-2023 00:21:03:643.903 GMT] Using aws credentials for Kinesis Video Streams[INFO ] [01-03-2023 00:21:03:643.911 GMT] Session token detected.[INFO ] [01-03-2023 00:21:03:645.027 GMT] createKinesisVideoClient(): Creating Kinesis Video Client[INFO ] [01-03-2023 00:21:03:645.081 GMT] heapInitialize(): Initializing native heap with limit size 134217728, spill ratio 0% and flags 0x00000001[INFO ] [01-03-2023 00:21:03:645.091 GMT] heapInitialize(): Creating AIV heap.[INFO ] [01-03-2023 00:21:03:645.109 GMT] heapInitialize(): Heap is initialized OK[DEBUG] [01-03-2023 00:21:03:645.260 GMT] getSecurityTokenHandler invoked[DEBUG] [01-03-2023 00:21:03:645.294 GMT] Refreshing credentials. Force refreshing: 0 Now time is: 1677630063645278575 Expiration: 0[INFO ] [01-03-2023 00:21:03:645.308 GMT] New credentials expiration is 1677633663[INFO ] [01-03-2023 00:21:03:645.329 GMT] createDeviceResultEvent(): Create device result event.[DEBUG] [01-03-2023 00:21:03:645.342 GMT] clientReadyHandler invoked[DEBUG] [01-03-2023 00:21:03:645.370 GMT] Client is ready[INFO ] [01-03-2023 00:21:03:645.426 GMT] Creating Kinesis Video Stream KVS_Test[INFO ] [01-03-2023 00:21:03:645.452 GMT] createKinesisVideoStream(): Creating Kinesis Video Stream.[INFO ] [01-03-2023 00:21:03:645.461 GMT] logStreamInfo(): SDK version: 8867047d8d8f56645009ed73788a57f0a6107772[DEBUG] [01-03-2023 00:21:03:645.477 GMT] logStreamInfo(): Kinesis Video Stream Info[DEBUG] [01-03-2023 00:21:03:645.483 GMT] logStreamInfo():      Stream name: KVS_Test[DEBUG] [01-03-2023 00:21:03:645.488 GMT] logStreamInfo():      Streaming type: STREAMING_TYPE_REALTIME[DEBUG] [01-03-2023 00:21:03:645.494 GMT] logStreamInfo():      Content type: video/h264[DEBUG] [01-03-2023 00:21:03:645.499 GMT] logStreamInfo():      Max latency (100ns): 600000000[DEBUG] [01-03-2023 00:21:03:645.505 GMT] logStreamInfo():      Fragment duration (100ns): 20000000[DEBUG] [01-03-2023 00:21:03:645.510 GMT] logStreamInfo():      Key frame fragmentation: Yes[DEBUG] [01-03-2023 00:21:03:645.515 GMT] logStreamInfo():      Use frame timecode: Yes[DEBUG] [01-03-2023 00:21:03:645.520 GMT] logStreamInfo():      Absolute frame timecode: Yes[DEBUG] [01-03-2023 00:21:03:645.525 GMT] logStreamInfo():      Nal adaptation flags: 0[DEBUG] [01-03-2023 00:21:03:645.531 GMT] logStreamInfo():      Average bandwith (bps): 4194304[DEBUG] [01-03-2023 00:21:03:645.536 GMT] logStreamInfo():      Framerate: 25[DEBUG] [01-03-2023 00:21:03:645.541 GMT] logStreamInfo():      Buffer duration (100ns): 1200000000[DEBUG] [01-03-2023 00:21:03:645.546 GMT] logStreamInfo():      Replay duration (100ns): 400000000[DEBUG] [01-03-2023 00:21:03:645.552 GMT] logStreamInfo():      Connection Staleness duration (100ns): 600000000[DEBUG] [01-03-2023 00:21:03:645.557 GMT] logStreamInfo():      Store Pressure Policy: 1[DEBUG] [01-03-2023 00:21:03:645.562 GMT] logStreamInfo():      View Overflow Policy: 1[DEBUG] [01-03-2023 00:21:03:645.567 GMT] logStreamInfo():      Segment UUID: NULL[DEBUG] [01-03-2023 00:21:03:645.572 GMT] logStreamInfo():      Frame ordering mode: 0[DEBUG] [01-03-2023 00:21:03:645.578 GMT] logStreamInfo(): Track list[DEBUG] [01-03-2023 00:21:03:645.583 GMT] logStreamInfo():      Track id: 1[DEBUG] [01-03-2023 00:21:03:645.588 GMT] logStreamInfo():      Track name: kinesis_video[DEBUG] [01-03-2023 00:21:03:645.593 GMT] logStreamInfo():      Codec id: V_MPEG4/ISO/AVC[DEBUG] [01-03-2023 00:21:03:645.598 GMT] logStreamInfo():      Track type: TRACK_INFO_TYPE_VIDEO[DEBUG] [01-03-2023 00:21:03:645.603 GMT] logStreamInfo():      Track cpd: NULL[INFO ] [01-03-2023 00:21:03:971.626 GMT] writeHeaderCallback(): RequestId: e3964ea7-515e-44d0-bd35-d1e512013200[DEBUG] [01-03-2023 00:21:03:971.705 GMT] describeStreamCurlHandler(): DescribeStream API response: {"StreamInfo":{"CreationTime":1.xxx,"DataRetentionInHours":2,"DeviceName":null,"IngestionConfiguration":null,"KmsKeyId":"arn:aws:kms:us-west-2:xxx:alias/aws/kinesisvideo","MediaType":null,"Status":"ACTIVE","StreamARN":"arn:aws:kinesisvideo:us-west-2:xxx:stream/KVS_Test/xxx","StreamName":"KVS_Test","Version":"gUDmvDqhXD2UvN2LfaKg"}}[INFO ] [01-03-2023 00:21:03:972.581 GMT] describeStreamResultEvent(): Describe stream result event.[WARN ] [01-03-2023 00:21:03:972.606 GMT] describeStreamResult(): Content type returned from the DescribeStream call doesn't match the one specified in the StreamInfo[INFO ] [01-03-2023 00:21:04:268.965 GMT] writeHeaderCallback(): RequestId: ---[DEBUG] [01-03-2023 00:21:04:269.035 GMT] getStreamingEndpointCurlHandler(): GetStreamingEndpoint API response: {"DataEndpoint":"https://s-xxx.kinesisvideo.us-west-2.amazonaws.com"}[INFO ] [01-03-2023 00:21:04:269.873 GMT] getStreamingEndpointResultEvent(): Get streaming endpoint result event.[DEBUG] [01-03-2023 00:21:04:269.905 GMT] getStreamingTokenHandler invoked[DEBUG] [01-03-2023 00:21:04:269.920 GMT] Refreshing credentials. Force refreshing: 1 Now time is: 1677630064269916059 Expiration: 1677633663[INFO ] [01-03-2023 00:21:04:269.930 GMT] New credentials expiration is 1677633664[INFO ] [01-03-2023 00:21:04:270.137 GMT] getStreamingTokenResultEvent(): Get streaming token result event.[DEBUG] [01-03-2023 00:21:04:270.168 GMT] streamReadyHandler invoked[DEBUG] [01-03-2023 00:21:04:270.253 GMT] Stream is ready[INFO ] [01-03-2023 00:21:04:279.121 GMT] Streaming from rtsp sourceNew pad found: recv_rtp_src_0_2969680287_96[INFO ] [01-03-2023 00:21:06:109.477 GMT] Pad link successful[INFO ] [01-03-2023 00:21:06:121.515 GMT] kinesisVideoStreamFormatChanged(): Stream format changed.[INFO ] [01-03-2023 00:21:06:142.011 GMT] putStreamResultEvent(): Put stream result event. New upload handle 0[INFO ] [01-03-2023 00:21:06:498.228 GMT] writeHeaderCallback(): RequestId: ---[DEBUG] [01-03-2023 00:21:07:118.992 GMT] postReadCallback(): Pausing CURL read for upload handle: 0[WARN ] [01-03-2023 00:21:36:499.120 GMT] curlCompleteSync(): curl perform failed for url https://s-xxx.kinesisvideo.us-west-2.amazonaws.com/putMedia with result Timeout was reached: Operation too slow. Less than 30 bytes/sec transferred the last 30 seconds[WARN ] [01-03-2023 00:21:36:499.363 GMT] curlCompleteSync(): HTTP Error 0 : Response: (null)Request URL: https://s-xxx.kinesisvideo.us-west-2.amazonaws.com/putMediaRequest Headers:    Authorization: AWS4-HMAC-SHA256 Credential=99999999999999999999/99999999/us-west-2/kinesisvideo/aws4_request, SignedHeaders=connection;host;transfer-encoding;user-agent;x-amz-date;x-amzn-fragment-acknowledgment-required;x-amzn-fragment-timecode-type;x-amzn-producer-start-timestamp;x-amzn-stream-name, Signature=xxx[DEBUG] [01-03-2023 00:21:36:499.376 GMT] putStreamCurlHandler(): Network thread for Kinesis Video stream: KVS_Test with upload handle: 0 exited. http status: 0[WARN ] [01-03-2023 00:21:36:499.480 GMT] putStreamCurlHandler(): Stream with streamHandle 94552842981056 uploadHandle 0 has exited without triggering end-of-stream. Service call result: 599[INFO ] [01-03-2023 00:21:36:499.495 GMT] kinesisVideoStreamTerminated(): Stream 0x55fecc9e4ec0 terminated upload handle 0 with service call result 599.[DEBUG] [01-03-2023 00:21:36:499.514 GMT] defaultStreamStateTransitionHook(): Stream state machine retry count: 0[DEBUG] [01-03-2023 00:21:36:499.520 GMT] defaultStreamStateTransitionHook(): KinesisVideoStream base result is [599]. Executing KVS retry handler of retry strategy type [1][DEBUG] [01-03-2023 00:21:36:502.335 GMT] defaultStreamStateTransitionHook(): Stream state machine retry count: 1[DEBUG] [01-03-2023 00:21:36:502.355 GMT] defaultStreamStateTransitionHook(): KinesisVideoStream base result is [599]. Executing KVS retry handler of retry strategy type [1][DEBUG] [01-03-2023 00:21:36:502.367 GMT] streamReadyHandler invoked[DEBUG] [01-03-2023 00:21:36:502.378 GMT] defaultStreamStateTransitionHook(): Stream state machine retry count: 2[DEBUG] [01-03-2023 00:21:36:502.384 GMT] defaultStreamStateTransitionHook(): KinesisVideoStream base result is [599]. Executing KVS retry handler of retry strategy type [1][INFO ] [01-03-2023 00:21:36:502.453 GMT] putStreamResultEvent(): Put stream result event. New upload handle 1[INFO ] [01-03-2023 00:21:37:443.049 GMT] writeHeaderCallback(): RequestId: ---[DEBUG] [01-03-2023 00:21:38:063.675 GMT] postReadCallback(): Pausing CURL read for upload handle: 1[WARN ] [01-03-2023 00:22:07:443.940 GMT] curlCompleteSync(): curl perform failed for url https://s-99999999.kinesisvideo.us-west-2.amazonaws.com/putMedia with result Timeout was reached: Operation too slow. Less than 30 bytes/sec transferred the last 30 seconds[WARN ] [01-03-2023 00:22:07:444.182 GMT] curlCompleteSync(): HTTP Error 0 : Response: (null)Request URL: https://s-99999999.kinesisvideo.us-west-2.amazonaws.com/putMediaRequest Headers:    Authorization: AWS4-HMAC-SHA256 Credential=99999999999999999999/99999999/us-west-2/kinesisvideo/aws4_request, SignedHeaders=connection;host;transfer-encoding;user-agent;x-amz-date;x-amzn-fragment-acknowledgment-required;x-amzn-fragment-timecode-type;x-amzn-producer-start-timestamp;x-amzn-stream-name, Signature=67977716665ec43998572003f4e7a07c3bae43c95b1fd4a[DEBUG] [01-03-2023 00:22:07:444.195 GMT] putStreamCurlHandler(): Network thread for Kinesis Video stream: KVS_Test with upload handle: 1 exited. http status: 0[WARN ] [01-03-2023 00:22:07:444.291 GMT] putStreamCurlHandler(): Stream with streamHandle 94552842981056 uploadHandle 1 has exited without triggering end-of-stream. Service call result: 599FollowComment"

Answer: "0Hi, The video track of each fragment must contain codec private data in the Advanced Video Coding (AVC) for H.264 format or HEVC for H.265 format (MPEG-4 specification ISO/IEC 14496-15). For information about adapting stream data to a given format, see NAL Adaptation Flags.I would start with extracting the camera settings that work and make a comparison with the setting of the camera which does not work (in the encoding section). you are using two different models and each might very well use a different encoder.Then I will look into the networking: your second camera is connected to the same circuit? You might have networking issues - did you try to use the nonworking camera on the same port instead of the working one?If identical, you might have issues with fragmentation; check the gstreamer. You might have to modify gstreamer parameters to get it working with your rtsp cameraCommentShareAndy Shahbazianswered 3 months ago0To answer your question, we require details that are non-public information. Please open a support case with AWS using the following https://console.aws.amazon.com/support/home#/case/createCommentShareSUPPORT ENGINEERrePost-User-9998216answered 3 months ago"


Question: "Not my region, but services available?"

"If I don't have anything configured in a specific region, would there be any information in that space? Or is this the default?FollowComment"

Answer: "0Looks pretty normal - each region contains by default a VPC, subnets per AZ and maybe a security group from memory.  Nothing that incurs costs.CommentShareEXPERTskinsmananswered 2 months ago"


Question: Is Lambda invocation = 0 is a guaranteed metric that proves the Lambda function was unused during the period I provide to metric?

"Hey everyone,I am doing a general cleanup on Lambda functions.As I don't want to ruin the production environment, I want to make sure that Lambda is not used at all before deleting it.I am using Lambda monitor tab > CloudWatch metrics -> Invocation metricCan we say that when invocation count is 0 the Lambda is not used at all for the time interval I provide?Thank you all in advance for your time and help!FollowComment"

Answer: "1Accepted AnswerInvocations counts the number of times the function was invoked. So yes, if it 0, it means it was not invoked. I do recommend that you use the Sum option in the dashboard  to make sure you do not miss some small numbers.CommentShareEXPERTUrianswered a year agoalperyildiz a year agoI will check out the Sum option, thank you Uri.Share"


Question: Why are AWS Lambda Function URL cold starts 10X slower?

I have a Lambda function written in Go that has a cold start of 150msWhen I invoke the function via the function url the function executes in > 1.5sWhy are cold starts 10X worst when using a function url?FollowCommentHarshavardhan_G SUPPORT ENGINEER2 months agoCan you please include more information as to how you are measuring the cold start durations?ShareAWS-User-6060748 2 months agoI just tried a custom runtime with a similar result. Here is the function log:REPORT RequestId: dc459ec7-f341-45e1-a757-8a61e57ad245Duration: 53.82 msBilled Duration: 969 msMemory Size: 128 MBMax Memory Used: 107 MBInit Duration: 915.04 msThe function URL responded to the browser request in almost 5 seconds.Share

Answer: "0There's not much advice I can offer here other than to take a look at this blog post. I'm not familiar (enough) with Go to provide specific advice but for most runtimes in Lambda I'd encourage "lazy invocation" of various libraries and startup components; or look at using provisioned concurrency (more information in the blog post).CommentShareEXPERTBrettski-AWSanswered 2 months agoAWS-User-6060748 2 months agoThanks for trying to help. I'm familiar with that blog post and I've also tried other runtimes. It seems like Function URLS have much slower cold starts regardless of language.Share-1When you invoke a Lambda function directly, the request is sent straight to the Lambda service. However, when you use a function URL, the request typically goes through API Gateway or an Application Load Balancer before it reaches the Lambda function. This extra hop adds an additional layer of processing and network latency, which can contribute to the increased cold start time.There maybe some workarounds about thisMake sure the API Gateway or Application Load Balancer and the Lambda function are in the same region to reduce network latency.Use provisioned concurrency for your Lambda function to reduce the cold start time.Optimize your API Gateway settings, such as caching and logging, to reduce the latency introduced by API Gateway.Review and optimize the configuration of the Application Load Balancer, such as target group settings and health checks, to reduce latency.CommentShareEXPERTsedat_salmananswered 2 months agoalatech EXPERT2 months agoCan you mention an official resource about lambda function urls being based on api gateway and/or application load balancer, as information seems incorrect?ShareAWS-User-6060748 2 months agoI don't believe Lambda Function URLs use API Gateway or Application Load Balancer. It is a feature managed by AWS so it is probably some sort of load balanced service that they have setup. After the cold start the Function URL is faster than API Gateway and it is free. No brainer for my use case. However, the longer cold start times don't really make sense.ShareCarlos Garces 2 months agoIt's not using API Gateway or Application Load Balancer, everything is wrong in this answer.Share"


Question: Route53 losing settings

"For the second time in a certain amount of time, only some Route53 configuration records are simply removed, such as some aliases or cnames.Is anyone else facing this kind of problem?It causes a lot of problems, as it shuts systems down, stops APIs, etc.FollowComment"

Answer: "0Accepted AnswerI would start by looking into CloudTrail logs for the who/what/when of the API calls causing this. See:Logging Amazon Route 53 API calls with AWS CloudTrailQuerying AWS CloudTrail logsAnalyze Security, Compliance, and Operational Activity Using AWS CloudTrail and Amazon AthenaCommentShareEXPERTkentradanswered 2 months agoEXPERTBrettski-AWSreviewed 2 months ago"


Question: Not able to deploy daemon java process in Lightsail Container Service

"I have a daemon java process runs ok on my local machine with Docker. But failed the deployment on Lightsail Container Service. The error message seems indicate the deployment "took too long" but the process was actually started correctly,  just because the java process hangs in the terminal due to it is a daemon and is supposed to hangs and waiting for new jobs but Lightsail thought it is still trying to spin up and failed the deployment after x mins.I wonder how could I fix it? Maybe does Lightsail container support detached mode? will that help?thanks for any insight!FollowCommentAlex 9 months agoHello, does this service expose a public endpoint? If so, then the health check needs to be configured to prevent Lightsail from thinking the deployment has failed. If there's no public endpoint, then you might want to make sure that the process that the container binds to does not exit prematurely.Share"


Question: Minimal Privilege MSK SCRAM KMS Key policy

"We are using MSK SCRAM which registers Secrets Manager secrets for authentication. This does require a separate symmetric KMS key to be used with the secrets. The secrets are required to be of the form 'AmazonMSK_*'. Our Security is asking to get the access to this KMS key down to the minimum privilege in the associated KMS key policy.It seems the recommendation is to use Condition variables. Link : https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.htmlI have tried to use this in this manner:Effect: AllowAction: - kms:CreateGrant- kms:EncryptResource: "*"Principal: "*"Condition:      StringLike:         kms:EncryptionContext:aws:secretsmanager:arn:           - "arn.aws.secretsmanager:us-west-2:*:secret:AmazonMSK_*" but i get : "Access to KMS is not allowed"a condition such as : Condition:      StringEquals:         kms:ViaService: "secretsmanager.us-west-2.amazonaws.com"works, but is not specific enough. Does someone know what EncryptionContext could be used forsecretsmanager conditions?FollowComment"

Answer: "0Accepted AnswerI believe the primary problem with the key policy above is the key context that you are specifying. The key context used by AWS Secrets Manager to specify the specific secret is kms:EncryptionContext:SecretARN, as described here -> https://docs.aws.amazon.com/secretsmanager/latest/userguide/security-encryption.html#security-encryption-encryption-context. Use extreme caution when updating the key policies so they don't become unmanageable -> https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html. Make sure you have a statement for key administration, in addition to, the key user policy that you are customizing. The policy statement for Amazon MSK should look something like this:{    "Sid": "AllowUseOfTheKeyForSecretsManager",    "Effect": "Allow",    "Principal": {        "AWS": "arn:aws:iam::<YourAccount>:role/<MSKRoleName>"    },    "Action": [        "kms:Encrypt",        "kms:Decrypt",        "kms:ReEncrypt*",        "kms:GenerateDataKey*",        "kms:DescribeKey"    ],    "Resource": "*",    "Condition": {        "StringLike": {            "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:<YourRegion>:<YourAccount>:secret:AmazonMSK_*"        }    }}CommentShareAWS-Everettanswered 6 months agocb 6 months agoThat one works. Thanks!Share"


Question: Requester: crowd-entity-annotation example from guideline not working

"Hello,I am developing an interface in the requester sandbox (interface, not API). I need an interface that uses the crowd-entity-annotation element: https://docs.aws.amazon.com/sagemaker/latest/dg/sms-ui-template-crowd-entity-annotation.html.However, when I copy the example in the "design layout" tab and try to publish it I get the error:Layout does not contain any fields for Workers to provide responses. Please include at least one field (input, select, or textarea).It looks like this element online works inside <crowd-form> </crowd-form> but it is specifically written in the guidelines that this should not be used.Does anyone know how I can make use of the crowd-entity-annotation element?FollowComment"


Question: fsx with eks rights error

"pvc showskdpvc fsx-claim                                                                          ✔  admin@rdqa-k8s.us-east-2.eksctl.io/kube-system ⎈  10:24:30 AM Name:          fsx-claimNamespace:     kube-systemStorageClass:  fsx-sc-ssdStatus:        PendingVolume:Labels:        <none>Annotations:   volume.beta.kubernetes.io/storage-provisioner: fsx.csi.aws.comFinalizers:    [kubernetes.io/pvc-protection]Capacity:Access Modes:VolumeMode:    FilesystemUsed By:       <none>Events:  Type     Reason              Age   From                                                                                Message  ----     ------              ----  ----                                                                                -------  Warning  ProvisioningFailed  15s   fsx.csi.aws.com_ip-192-168-49-104.us-east-2.compute.internal_bdda4953-e9b1-4e1f-bd89-42b1e73c731f  failed to provision volume with StorageClass "fsx-sc-ssd": rpc error: code = Internal desc = Could not create volume "pvc-60824d3c-f1c1-4c78-bea0-ff9c8387fd7a": CreateFileSystem failed: AccessDeniedException: User: arn:aws:sts::xxxxxxxxxxx:assumed-role/AmazonEKSFSxLustreCSIDriverRDQA/1653963866481056780 is not authorized to perform: fsx:CreateFileSystem on resource: arn:aws:fsx:us-east-2:802625923695:file-system/* because no identity-based policy allows the fsx:CreateFileSystem action           status code: 400, request id: d9829a30-d680-4d1a-9638-74368de38e63  Normal   ExternalProvisioning  13s (x2 over 15s)  persistentvolume-controller                                                                        waiting for a volume to be created, either by external provisioner "fsx.csi.aws.com" or manually created by system administrator FollowComment"

Answer: "0Accepted Answerreplace resource from s3xxxx to *, solve this problem....CommentSharevsnlanswered a year ago"


Question: Cost Explorer: How to know which Usage Types go with which Usage Type Groups?

"I'm trying to see VPC usage in Cost Explorer.I've selected "USW2-VpcEndpoint-Bytes (GB)" as "Usage Type".  Cost Explorer shows me the VPC total cost, but no usage (GB).  I'm guessing it is because I need to select the appropriate "Usage Type Group" to go with it, but I don't know which one it is.  If I guess multiple Usage Type Groups, then my VPC cost disappears (probably an invalid combination).  And picking one at a time is very time consuming.Is there a list of which Usage Type Groups are applicable for each Usage Type?  I'm sure this is common knowledge for some people, but I'm not there yet.  I have other usage types I'll want to analyze as well, but VPC is just the first I'm looking at.Thanks!FollowComment"

Answer: "1Hello,Usage type groups are available for DynamoDB, Amazon EC2, ElastiCache, Amazon RDS, Amazon Redshift, and Amazon S3. Kindly refer the following documentation to get the list of available Usage Type Groups.[+] AWS Cost Management - Filter and group options -https://docs.aws.amazon.com/cost-management/latest/userguide/ce-filtering.html#filtergrouptypesYou can check the "BytesProcessed" metric in CloudWatch metrics that represents the number of bytes exchanged between endpoints and endpoint services, aggregated in both directions. This is the number of bytes billed to the owner of the endpoint. The bill displays this value in GB.CloudWatch metrics - Endpoint metrics and dimensions -https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-cloudwatch-metrics.html#endpoint-metrics-dimensionsTo get in-detailed report of the usage, you can use the Cost and Usage (CUR) report and analyze the report using Athena query and QuickSight. Kindly refer following documentation to learn more.[+] What are AWS Cost and Usage Reports?https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.html[+] Understand AWS Data transfer details in depth from cost and usage report using Athena query and QuickSighthttps://aws.amazon.com/blogs/networking-and-content-delivery/understand-aws-data-transfer-details-in-depth-from-cost-and-usage-report-using-athena-query-and-quicksight/Let me know if you have any further queries. Thank you for your interest in re:Post community.Best Regards,AshishCommentShareSUPPORT ENGINEERAshish Bharadwajanswered 4 months ago"


Question: codecommit pricing question (multiple roles for each IAM User)

"my client has around 400 repositories, there are 2 roles for each repository (so around 800 roles), the client has 700 users (so 700 IAM users) that access these repos, on average each user access around 7-8 repos, so each user reach these repos with around 15 different roles. it's unclear to me how the pricing apply.. is my client going to pay for 700 users, or is going to pay for 700 users * 15 average roles = 10,500 ??thanks.FollowComment"

Answer: "0Accepted AnswerDear Corey, My client (I'm an AWS SA) went live and after a deep dive with the service team we clarified the cost.The bottom line:if they use IAM they pay for Users not by rolefor federated users, If the customer is using these APIs to obtain credentials, then is one user per role:assume-roleget-federation-tokenIf the customer is using any of these APIs to obtain credentials, then the number of users depends on attributes made within their API request.assume-role-with-samlassume-role-with-web-identityin this case if the Saml data contains a subject which contains a name identifier (e.g., name.lastname@myclient.com). this means that the bill would be based on the number of unique SAML users who assume roles and use CodeCommit (not based on the number of roles they assume).Bottom line, the last case is the most common one and my customer is paying for each user, despite the number of roles they assume.AntonioCommentShareAntonio Aga Rossianswered 7 months ago0The bad answer ($10,500), and it also gets worse: if other identities (EC2 instances via instance roles, other AWS services integrated with CodeCommit, etc) are making git / CLI / API requests to CodeCommit, they count as an active user for that month.As per the pricing docs:An active user is any unique AWS identity (IAM user/role, federated user, or root account) that accesses AWS CodeCommit repositories during the month, either through Git requests or by using the AWS Management Console, AWS CLI or AWS SDKs. AWS identities that are created through your use of other AWS Services, such as AWS CodeBuild and AWS CodePipeline, as well as servers accessing CodeCommit using a unique AWS identity, count as active users. There is no charge for a user if that user does not access AWS CodeCommit during the month. Storage includes the full space required to retain the repository data.CommentShareQuinnyPiganswered 7 months ago"


Question: Implement Security on the Web Application Without Touching the Web Application

"Hi there,Is there any services or Web application firewall that can improve the security of the application without touch the web app itself.So far I only know Cloudfront is able to generate a custom error response.I want to hide the following type of error message:500 – Internal Server ErrorHTTP 403.14 - ForbiddenHTTP 403.14 - ForbiddenI want to change the cookie setting of the application:requireSSL="true" sameSite="Lax" -> Not Set in ASPSessionIDMisconfigured security headers:Cache-control: no-cache, no-store, must-revalidate.X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadUsage of Weak Cipher Suites:For example, any Cipher suites, we would like to upgrade all cipher suites are modern compatibility on the application:https://wiki.mozilla.org/Security/Server_Side_TLSHiding of Server banner:Server: Microsoft-IIS/8.0X-Powered-By: ASP-NETFollowComment"

Answer: "3AWS WAF is a great service to stop attack traffic from reaching your application in the first place.The Network Firewall also allows you to apply traffic controls to your application server(s) network traffic.CommentShareDaniel Craigieanswered a year ago0You can useCloudFront and CloudFront Functions to edit response headers, cookies etc.Or HeaderResponsePolicy on CloudFront.I would say that it's better to use HeaderResponsePolicy to edit headers because it's free and you don't need to write and maintain any code, but for other things like cookies, you need to apply CF Functions.CommentShareMGanswered a year ago0In some web apps, not only  the simplest one but even more completed (what can be treated as basic/last  or first line of defense-protection in case of other protection failure or even useful for detecting potential slow security pen tests made by bad people before main 'ATTACK") is to change standard ports of services that you use and after ensuring that things like firewall or monitoring service don't generate any warnings , by changing standard ports first of all you will reduce server scans passed by security software and also reduce critical  situations probability. In single server app when for example SQL (MySQL) is used, many of standard Linux installations leave database ports opened for world while your app  use db locally, on small servers in most situations changing SSH port (no matter that keys and passwords are used) dramatically reduces CPU load and if any firewall or banning system is used it can reduce memory usage dramatically. Even is you use sophisticated protection on the route to your app any basic additional protections will provide extra layer of security (basic, simple but light and giving extra time before bad things happen).Depending on web apps you need consider what do do with  services ports that requires incoming connections. In this example lets assume simple WordPress installation with high user traffic.  Changing SSH, FTP (if apply), SQL (closing from world or changing ports)l if proxy like ngnix is used its ports also can be changed to non standard, access VPN ports and in my experience making fast check of own server and providing little changes always help but requires more frequent monitoring. Of course it can't make collision with other software.Another aproach is to protect web app without touching it, I am not specialist but enabling and reading server logs clarifies many questions and help in security.Please treat my advise as super basic.CommentShareAWS-User-6810247answered a year ago"


Question: SSM Agency Amazon running CPU high load near 100%

"I just started a t3a.nano instance it's normal at stat up but it's not stable later. The ssm agent service ran as cron and made my server crashed almost. Right now I can not connect to SSH.I have tried Stop and Start also, nothing help to solve it up to now.Anyone meet this issue?P/s: I have tried read old topic and wait 1-2 hours to ssm update but no change. For AWS Support you can check my instance i-0d8bcd6234b2d9ac6FollowComment"


Question: "Error, AWS Step Function DynamoDB Put Item, Map and List inside Map"

"Hello,I'm having troubles inserting an item in DynamoDB with this Structure from Step Functions.{    "id":{        "S":""    },    "state_machine_execution_id":{        "S":""    },    "timestamp":{        "S":""    },    "map_param1":{        "M":{            "sub_map1":{                "M":{ }            },            "sub_map2":{                "S":""            },            "sub_map3":{                "M":{ }            },            "sub_mapN":{                "M":{ }            },            "List_1":{                "L":[ ]            },            "List_2":{                "L":[ ]            }        }    }}This is the statement that I am trying to make it work without success{    "DynamoDB Save Item":{        "Type":"Task",        "Resource":"arn:aws:states:::dynamodb:putItem",        "Parameters":{            "TableName.$":"$.TableName",            "Item":{                "id.$":"$.id",                "state_machine_execution_id.$":"$$.Execution.Id",                "timestamp.$":"$.timestamp",                "map_param1":{                    "M":{                        "M.$":"$.var_for_map_params",                        "List_1":{                            "L.$":"$.List_1"                        },                        "List_2":{                            "L.$":"$.List_2"                        }                    }                }            }        }    }}I'm getting this errorThe Parameters "{A lot of data flow} "could not be used to start the Task: [The field \"foo\" is not supported by Step Functions]"This "foo" field, has nothing to do, if make changes to the Parameters: map_param1 statement in Step Function worksexampleThis works ok"map_param1":{        "M.$":"$.var_for_map_params"}And This works ok too"map_param1":{    "M":{        "List_1":{            "L.$":"$.List_1"        },        "List_2":{            "L.$":"$.List_2"        }    }}But not  this (the combination)"map_param1":{    "M":{        "M.$":"$.var_for_map_params",        "List_1":{            "L.$":"$.List_1"        },        "List_2":{            "L.$":"$.List_2"        }    }}Can someone help me?thanks a lotRegardsFollowComment"

Answer: "0Your exact definition worked for me with the following input:{  "TableName": "Table",  "id": "id",  "timestamp": "timestamp",  "var_for_map_params": "var_for_map_params",  "List_1": [    "item1",    "item2"  ],  "List_2": [    "item1",    "item2"  ]}Maybe something with the payload itself. Can you share the input?CommentShareEXPERTUrianswered a year ago"


Question: Why is my S3 lifecycle configuration isn't working as expected?

"Hi,I have a versioned bucket where I want deleted and other non-current objects to be moved to Glacier after some period of time. I configured a bucket policy that should move non-current versions after 1 day to test this:{    "Rules": [        {            "ID": "Move deleted to Glacier",            "Filter": {},            "Status": "Enabled",            "NoncurrentVersionTransitions": [                {                    "NoncurrentDays": 1,                    "StorageClass": "GLACIER_IR"                }            ]        }    ]}But the object is still there with the "Standard" storage class more than 10 days after it was deleted:Why is this, and how can I move all non-current and deleted objects to another storage class (Glacier)?FollowComment"

Answer: "0Thanks for posting.First, a "Delete" marker is a placeholder for a versioned file in the "s3" bucket, and it will only allow performing the "Delete" action into this. Because "Delete" marked files or objects are not coupled with any data or access control list (ACL) value.Furthermore, it cannot retrieve anything from "GET" requests due to free for any data association. and even cant performed any API calls except "Delete".As per definition, the only action that can be performed is "Delete", Therefore "Delete" markers will not be able to transition or move from the standard bucket to any other storage class bucket or vice-versa.CommentShareVISIanswered 10 months ago"


Question: Cloudfront Multiple Distributions Automatic Directs

"Hello,I have a question, I have 2 cloudfront distributions with 2 different certificates / domains that point to the same S3 Bucket# main distribution is 123456789.cloudfront.net, with alternate domain + certificate: main.mydomain.com# second distribution is 987654321.cloudfront.net, with alternate domain + certificate: sub1.otherdomain.comOn DNS (I use cloudflare) I have a CNAME for the main distribution domain:# main.mydomain.com cname to 123456789.cloudfront.netand I add other subdomains pointing to this other CNAME (for better management as I have many subdomains):# sub1.mydomain.com cname to main.mydomain.combut I also do point subdomain from the other domain to this (again because of management and some hardcoded links, so I can't point it to it's own distribution):# sub1.otherdomain.com cname to main.mydomain.comOn theory I would need to use cloudfront function to redirect the sub1.otherdomain.com to it's distribution (987654321.cloudfront.net), but it works without it and I don't know why (it shouldn't or there is some universal property of cloudfront I'm not aware about), because there is no pointing / redirect from first distribution to the second one configured, the only DNS pointing to cloudfront is from main.mydomain.com (cname to 123456789.cloudfront.net), and the certificates are different.Is it expected? Need to be sure for not having headaches on the future with production stuff.FollowComment"

Answer: "1Accepted AnswerThis is actually expected behaviour, but I wouldn't recommend continuing with it set up in this way.Firstly, remember that using CNAME records in DNS doesn't change the value of the Host header used by clients when making HTTPS requests, it's simply a way of referring to another DNS record in order to ultimately get an IP address to connnect to.DNS has no bearing on what content is returned by CloudFront - it simply returns valid IP addresses for nearby cache hosts. The actual content delivered by the cache host is determined by the value of the Host header in the request. Note that there are some exceptions to this, but for the purposes of your query, assume this to be the case.When your clients connect to sub1.otherdomain.com, here's what will happen:The client will make a DNS query for sub1.otherdomain.com. DNS will follow the CNAMEs and in turn query main.mydomain.com and then 123456789.cloudfront.net, and will finally return the A records associated with 123456789.cloudfront.netThe client will connect to one of the IP addresses returned by the DNS query.During the TLS handshake, the client will specify the domain name that the request is for (sub1.otherdomain.com) and CloudFront will return the associated certificate and content (SNI) for sub1.otherdomain.com.The main problem with this is that if you ever remove 123456789.cloudfront.net, CloudFront will no longer respond to DNS requests for that address, and sub1.otherdomain.com will stop working.I don't really understand why you can't CNAME sub1.otherdomain.com to 987654321.cloudfront.net - DNS is just translating names to IP addresses, so I can't work out how or why this would impact your "management and some hardcoded links"CommentSharePaul_Lanswered a year agoEmerson Junior a year agoYes, I'm aware that DNS CNAME is only the "learning path" to the destination IP, but that is why I use it to concentrate names and only point 1 DNS CNAME to real destination."3. During the TLS handshake, the client will specify the domain name that the request is for (sub1.otherdomain.com) and CloudFront will return the associated certificate and content (SNI) for sub1.otherdomain.com."So cloudfront uses the same IPs for different distributions?Our application requires more than 1 distribution on cloudfront because we have multiple domains (and certificates), but it is transparent for clients, so they all go for the same link (main.mydomain.com and some have lots of integrations with it) but need to "hit" different distributions on cloudfront (because the certificates), that why the example sub1.otherdomain.com (other client) need to hit the main.mydomain.com.SharePaul_L a year agoYes, CloudFront uses SNI by default, unless you configure a dedicated IP (this incurs an additional charge) - see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-https-dedicated-ip-or-sni.html for details.If the content is different between the two distributions, I recommend you update the DNS record for sub1.otherdomain.com to be CNAME d987654321.cloudfront.net to avoid any potential future problems.However, if the content is the same across both distributions then I recommend you use a single distribution with multiple alternate domains. You will of course need a single SSL certificate which covers all the alternate domains to do this.Share"


Question: Connecting remote FTPS server from EC2 instance

"Hello. I have a PHP script which downloads some files from my EC2 instance using cURL.I connect to a remote FTPS server on port 990 and range port 50000-50010 is also used to download the files.When I run the script in local or in my Plesk production server, the script runs without problems but from EC2 I only get the message "Failed to connect to aaa.bbb.ccc port 990: Connection refused".I checked inbound and outbound rules for the security group, created new rules, allowed all traffic, tested different combinations, etc. I even created a new security group exclusively with rules for allowing inbound and outbound traffic, but it's not working.I don't know if besides the security group rules there is something else that I have to configure. I don't know what else can I check.Normally, when I wanted to access through SSH to my EC2 instance I only have to configure the inbound rule with my IP and that all, but with this I'm a bit lost.Thanks in advance for your help!FollowCommentChris_W a year agoI'm sorry, I'm not following your question... So your PHP script is running on EC2 and attempting to cURL to some remote server on port 990 and ports 50000-50010 to download files. This script works locally and on another production server, but not on your EC2 instance, correct? Are other sites accessible from your EC2 instance (meaning your EC2 instance can access the internet)?Share"

Answer: "0Hello Dear Customer,It seems like your EC2 Instance doesn’t have the capability to connect to a remote server, that is why when you try to run the scripts locally, they work but not through your instance in the cloud. You need to make sure, your EC2 instance can talk to remote servers on the internet, either through giving the instance itself a Public IP address or by using a NAT gateway. Additionally, you can also utilize the LFTP tool in order to determine what is causing the connection failure. You can use the debug option -T or -o when connecting to your ftp server though the command line. Here are some resources you can utilize. Hope they will be of help.Resources:https://aws.amazon.com/premiumsupport/knowledge-center/nat-gateway-vpc-private-subnet/https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.htmlhttps://lftp.yar.ru/lftp-man.htmlCommentShareHanzla_Yanswered a year agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: 503 Service Temporarily Unavailable

"Randomly (some times) when I send a post to the service I get this 503, the service is light, I don't believe it's a performance problem, probably something related to the network, but I don't know what. I'm using an alb on top of an ec2, does anyone have any troubleshooting.~~~~this return isn't from my microservice running on ec2~~~~                  <title>503 Service Temporarily Unavailable</title>
503 Service Temporarily Unavailable
                  FollowComment"

Answer: "0Accepted AnswerMy bad ... it was health check ... (Unfortunately it is not possible to delete this question)CommentShareAWS-User-4499202answered a year agoVenkat Penmetsa SUPPORT ENGINEERa year agoThank you for the update!Share0Hello,It is likely that the error message you are receiving is being sent by the Application Load Balancer.Generally, 503 Service Unavailable server error response code indicates that the server is not ready to handle the request.In your case, it could mean that the targets behind the ALB are either not responding to the requests, or the ALB does not have registered targets.You can follow this ALB troubleshooting guide to figure out the problem.Enabling access logs for your ALB by following this guide can help you figure out the reasons for the failure.CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered a year agoAWS-User-4499202 a year agoThank you for the guide, will help me in the futureShare"


Question: Outposts General Inquiry

"I'm trying to get some additional information on exactly how Outposts work.We have a client who runs things very heavily on-premise and they are interested in doing a hybrid-cloud situation. They want to keep business critical stuff on-premise because they are concerned about the business impact of their network losing internet connection. Their on-premise is currently set up using a very large intranet, so the intranet losing internet connection is not exactly a show-stopper for them as far as running their business goes. My hope was that we could use Outposts in a way where we could deploy the bare minimum necessary infrastructure and scaling to keep their business hobbling along if the internet was cut out, but then properly scale in the cloud for the 99% of the time when that's not a problem. In ideal situations, the majority of the traffic would be routing to an AWS region.My first question is: is that even how Outposts work? Is that something that can be achieved using Outposts?That brings me to my second set of questions, which are: when an Outpost is set up, does the traffic get routed to AWS first, or to the Outpost first? Because, obviously, if an internet connection is required for Outposts to work, it doesn't solve our problem.Lastly, is there some list of services which are supported on Outpost? Are we able to run serverless applications using Lambda and Step Functions in Outpost?FollowComment"

Answer: "1There are three use cases Outposts is primarily used to meet, latency sensitivity, local data processing, and data sovereignty. Local data processing by providing services VIA AWS services that run on an Outposts could be possible. However, Outposts requires a stable connection back to the AWS Region for control plane functions over the Service Link. EX: IAM rule/policies to validate an S3 put request. Outposts is not meant to operate in a disconnected state. If the use case is to provide core services internally when the internet connection is down and Outposts would be impacted during that outage we would need to look at some ways to engineer around that case or use another solution. Engaging your SA and an Outposts specialist is what I would recommend here.As far as traffic routing, data plane traffic can route to the region or locally first, or various combinations, it's highly configurable using Layer 3 and BGP. Outposts has a construct called a Local Gateway (LGW) that is used for local network traffic to communicate to the Outposts instead of going to the region. But the control plane traffic does go to the Outposts first via the Service Link.Here is a link for the services supported on Outposts. Lambda and Step Functions are not currently supported.https://docs.aws.amazon.com/outposts/latest/userguide/what-is-outposts.htmlCommentShareDoug_Hanswered 4 months agoEXPERTTushar_Jreviewed 4 months ago"


Question: Bounce emails going to Unverified outside email id

"We have a verified identity to sent emails using SES and we do receive the bounce emails to the verified identity as it was used as sender email. But for one of the broadcast, some of the bounced emails went to a collogues Hotmail email id which is not a verified identity. We received and email from AWS that unacceptable levels of negative feedback about email sent from your account has been received from a provider.What would be the reason of the bounce emails sending to another email?FollowComment"


Question: Redshift Spectrum and tables with nested columns in Hive Metastore

"Hello,I managed to connect Redshift to my Hive Metastore using an external schema. But it seems I can only query the tables that does not contain nested columns otherwise Redshift Spectrum doesn't recognize the columns.Is there a way to fix this please? Or can I somehow create an external table in Redshift Spectrum and point it to the partitions from the Hive Metastore so that it will be in sync?The table in Hive is like that:CREATE TABLE `test`.`product_created` (`data` STRUCT<`id`: STRING, `type`: STRING>, `meta` STRUCT<`created_at`: BIGINT>, `year` INT, `month` INT, `day` INT, `hour` INT)USING jsonOPTIONS (  `serialization.format` '1',  path 's3a://my_bucket/product_created')PARTITIONED BY (year, month, day, hour)When I check in SVV_EXTERNAL_COLUMNS I see those columns:col: array<string>year: intmonth: intday: inthour: intAnd it gives an error if I try to query 'col' column.I have the same issue with data in Parquet.But it works for tables without nested columns like that:CREATE TABLE `test`.`users` (`id` INT, `object_id` STRING, `username` STRING, `user_type` INT)USING PARQUETOPTIONS (  `serialization.format` '1',  path 's3a://my_bucket/users')ThanksEdited by: mpierre on Mar 13, 2020 6:44 AMFollowComment"

Answer: "0I managed to fix the issues.The first one with JSON is because I was creating the table with Spark and it's using a different SerDe by default.I tried using this one instead and it works:CREATE EXTERNAL TABLE `test`.`product_created` (`data` STRUCT<`id`: STRING, `type`: STRING>, `meta` STRUCT<`created_at`: BIGINT>)ROW FORMAT SERDE 'org.openx.data.jsonserde.JsonSerDe' LOCATION 's3a://my_bucket/product_created'PARTITIONED BY (`year` INT, `month` INT, `day` INT, `hour` INT)More info: https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-data-catalog-hive.htmlFor the second error with Parquet files, it's strange, I just recreated the table in Hive with the same query and gave it a different name and it works well now.CommentSharempierreanswered 3 years ago"


Question: Numbers/Amount Reading Problem.

"Hi, I've been testing Textract for a few days and I found a very common behaviour when reading numbers/amount. I'm in Chile so money amount format is like this: (45.120.210,00) this is the equivalent to US Format for (45,120,210.00), in Chile is very rare to use decimals.  Now, when Textract reads any amount, if this amount is smaller than 7 digits then it goes well but when is bigger than 7 digits then it fails.Example 1: https://imgur.com/AnbbhgQExample 2: https://imgur.com/czRRPAPAlso, i found a problem that kind of duplicates the detected object. See the image below.Duplicated: https://imgur.com/e907k3uIn this case the amount 1.703.355.983 was a good detection, but textract added a 83 which are the last 2 digits of it, so this number went from 1.703.355.983 to 1.703.355.98383.This is what i've seen until today, i'll keep testing because i'm pretty sure that in the near future i'll be using Textract as my OCR solution. I hope this information/feedback became useful.FollowComment"

Answer: 0thank you for this feedback.  I have gone ahead and logged this feedback. I will also private message you directly next.CommentSharehumphreyAWSanswered 4 years ago0This problem was solved. Thank you very much.CommentShareEraranswered 4 years ago


Question: EventBridge pipes and DynamoDB streams

"The new EventBridge pipes can be used to consume stream records from DDB. If we already have a Lambda stream consumer, what would it mean to add a pipe? Would we now have two simultaneous stream consumers, or should we disable the Lambda consumer in favor of the pipe and then use Lambda as the pipe's target?FollowComment"

Answer: "0Accepted AnswerI would not use Pipes in this case as there is a direct integration between DynamoDB stream and Lambda. An exception might be if you need to transform the event before it gets to the Lambda function. Pipes also supports filtering and batching, but so does the direct integration.CommentShareEXPERTUrianswered 6 months ago"


Question: Unreal engine multiple dedicated server instances

"Hi. I'm trying to setup a game where the game uses steam, unreal engine and gamelift. Game uses ipnetdriver because game joining and matchmaking happens through gamelift and flexmatch. The problem is that the steam initializes correctly in gamelift only if 1 concurrent process is allowed to be used. If I try to use more than 1 concurrent process or add more concurrent processes after the initial successfull launch the new server instances fail to initialize steam and the clients can't join the gamesessions on those instances.The instances that fail to initialize have this error log in themLogSteamShared: Warning: Steam Dedicated Server API failed to initialize.LogOnline: STEAM: [AppId: 999920] Game Server API initialized 0LogOnline: Warning: STEAM: Failed to initialize Steam, this could be due to a Steam server and client running on the same machine. Try running with -NOSTEAM on the cmdline to disable.What must I do to be able to run multiple dedicated server instances on one fleet?FollowComment"

Answer: "0You may get a faster response on the Unreal/Steam forums.Have you made sure you are setting a different port for each server instance and registering that with correctly with steam?  ie--runtime-configuration ServerProcesses="[{LaunchPath="/local/game/Server",Parameters="port:1935",ConcurrentExecutions=1}, \{LaunchPath="/local/game/Server",Parameters="port:2401",ConcurrentExecutions=1}, \{LaunchPath="/local/game/Server",Parameters="port:5999",ConcurrentExecutions=1}, \{LaunchPath="/local/game/Server",Parameters="port:6251",ConcurrentExecutions=1}, \See https://docs.aws.amazon.com/gamelift/latest/developerguide/fleets-multiprocess.htmlCommentSharerePost-User-5332620answered 3 years ago"


Question: Minimum number of correct questions required to pass CLF-C01

The exam documentation states:Unscored contentThe exam includes 15 unscored questions that do not affect your score. AWS collects information about candidate performance on these unscored questions to evaluate these questions for future use as scored questions. These unscored questions are not identified on the exam."If there are 65 questions on the exam and the pass rate is 70% is it correct to say that we only need to get 70% of 50 questions correct (since it doesn't matter if we get the other 15 right or wrong)?FollowComment

Answer: 0You can find the information about each exam here: https://aws.amazon.com/certification/?hp=tile&tile=crtCommentShareNelliT-AWSanswered 3 months ago


Question: API Gateway get_usage API doesn't return results until quota limit is reached

"I have an API deployed in the API Gateway.  I also have an API Key and a Usage Plan with a quota associated with the API. When executing the API, the get_usage API returns no results initially. There is no usage shown in the API or in the console where Usage can be selected.it isn't until I run enough tests to max out the quota and get the "Limit Exceeded" message that the get_usage API returns results. Has anyone seen this?FollowCommentbrodjeski 9 months agoThe get_usage API is eventually returning usage data, although it's been taking longer than 30 minutes. Reaching the quota limit returns usage almost immediately.Share"

Answer: "0Accepted AnswerThe get_usage API is eventually returning usage data, although it's been taking longer than 30 minutes. Reaching the quota limit returns usage almost immediately.CommentSharebrodjeskianswered 9 months ago"


Question: Millions of NS queries for simple website

"I've published a simple website on AWS Amplify, and I'm using AWS Route 53 for DNS as my domain registrar (IONOS) doesn't support ALIAS records. So I created a hosted zone for my domain and took those 4 NS entries and configured in IONOS for this domain to use these nameservers.The same 4 were configured in IONOS, matching the hosted zone details and hosted zone ns entry:ns-365.awsdns-45.comns-1213.awsdns-23.orgns-867.awsdns-44.netns-1892.awsdns-44.co.ukEverything was working fine for a while, and then I started seeing half a million NS record lookups per hour, costing me hundreds of dollars for what supposed to be a simple front end:https://foxy-roxy-public-bucket.s3.amazonaws.com/Screenshot_from_2021-02-26+13-07-56.pngYesterday I reset the IONOS names servers and repointed my domain to my pre-prod environment, deleted the hosted zone and re-deployed it in a different region. I then re-implemented the AWS NS entries and the issue started up again, so for now I've re-pointed back to my server at home and I'm still seeing all of these mysterious lookups (no A or CNAME or anything, just NS queries).Does anybody have any insight on what could be causing this and how to resolve? I'm at a loss at this point.Thanks in advance for any advise.FollowComment"

Answer: "0The reverse DNS for that IP is dnsregistrygw01.1and1.org. Maybe they have some sort of monitoring system that went haywire.(The TTL wasn't set to 0 or something, was it?)CommentSharemnordhoffanswered 2 years ago0Thanks for the reply.I thought it may have been something like that, but wouldn't the issue stop once I reversed the NS entries in IONOS? I did check and it appears to be propagated worldwide.Which TTLs are you refering to?Here are my AWS TTLs, it doesn't appear I can change it for that A record:https://foxy-roxy-public-bucket.s3.amazonaws.com/Screenshot_from_2021-02-26+14-47-35.pngDoesn't look like IONOS has this exposed to their customers. They say changes may take up to 48 hours so perhaps the typical 172800 for NS entries?CommentShareFoxyRoxyanswered 2 years ago0FoxyRoxy wrote:I thought it may have been something like that, but wouldn't the issue stop once I reversed the NS entries in IONOS? I did check and it appears to be propagated worldwide.Maybe. There's no way for us to know how the software -- whatever it is -- on 82.165.226.228 is supposed to work.Which TTLs are you refering to?Here are my AWS TTLs, it doesn't appear I can change it for that A record:https://foxy-roxy-public-bucket.s3.amazonaws.com/Screenshot_from_2021-02-26+14-47-35.pngI meant the response to www.roxanalifshitz.com NS on AWS. The negative TTL in your screenshot would be 900 seconds, so assuming AWS isn't buggy, a normal resolver should cache the response and shouldn't make so many queries.CommentSharemnordhoffanswered 2 years ago0Aww well I didn't realize that IP was the source of these calls, I didn't even look it before. I think the "resolverIP" label confused me.Anyways, like you mentioned before it's definitely coming from my registrar, probably not an AWS issue. Time to get on the phone with IONOS again....Thanks for being a sounding board, I'll mark this as answered.CommentShareFoxyRoxyanswered 2 years ago"


Question: SageMaker ValidationException

"Hi AllI am brand new to AWS and find it all very overwhelming and confusing.I am trying to use SageMaker and Forecast - however I am having issues with trying to get into SageMaker Studio. I am getting the following error:ValidationException1 validation error detectedValue '[]' at 'subnetIds' failed to satisfy constraint: Member must have length greater than or equal to 1I have asked out internal team and they are not sure, and opened a support ticket. The support person said that I should be using the Standard setup rather than the Quick setup. However, this is still giving the same issue. To which he said that this is an advanced problem and he can't assist with it.Is anyone able to help me? give me an idea of what is wrong?FollowComment"

Answer: "0Helloyou can go for standard and then fill the VPC and  subnet in the Network and Storage blockCommentShareArturoTanswered 2 years ago0I can get the same error (Value '[]' at 'subnetIds' failed to satisfy constraint: Member must have length greater than or equal to 1) if:I start with an AWS account which has been customized (for example, no default VPC)Choose "Quick Setup" when setting up SageMaker studioAs @ArturoT mentioned, choosing "Standard" when setting up SageMaker Studio and selecting VPC and subnets does work for me.CommentShareojaanswered a year ago"


Question: QuickSight calculated field: How to get sum of last values of timestream measures

"Hi,I have a TimeStream table containing power consumed by IoT devices. I would like to create a calculated field in QuickSight which computes the sum of last power values reported by all devices?FollowComment"

Answer: "0If I understand correctly, the query result is a single value which represents the aggregate power of all devices. The device values to aggregate is the latest power of each device. For e.g. if there are 3 devices with the following power valuesdevice1: 00:00:00 val=20, 00:00:05 val=25, 00:00:10 val=20device2: 00:00:00 val=19, 00:00:05 val=72, 00:00:10 val=81device3: 00:00:00 val=00, 00:00:05 val=22, 00:00:10 val=100The result will be (20 + 81 + 100) = 201A sample query for this is belowWITH cte1 AS (    SELECT device, first_value(measure_value::bigint) OVER (PARTITION BY device ORDER BY time DESC) as value FROM <db>.<table> WHERE time > ago(1m)), cte2 AS (   SELECT device, min(value) as value FROM cte1 GROUP BY device) SELECT sum(value) FROM cte2The time predicate e.g. ago(1m) is necessary to ensure that the whole table is not scanned. It can be set to any time window that will give the latest power values of all devices.CommentShareRajesh Iyer - AWSanswered a year agoRavi Jadhav - AWS a year agoThanks Rajesh! I was thinking of doing this via introducing a calculated fields on quicksight? Is this use case supported?Share"


Question: IAM Policy to access "Resource Group" using tags failing

"Hi,I'm trying to give access for tagged resources to IAM users.I've tagged a few resources with "cs-namespace":"test1" and have created a "Resource Group" tagged with the same key value pair too.The listing works but when my IAM user tried to access the tagged "Resource Group", it gives me a "Forbidden".Could anyone suggest what I've missed?{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "ResourceGroupList",            "Effect": "Allow",            "Action": [                "resource-groups:ListGroupResources",                "resource-groups:ListGroups",                "resource-groups:GetGroupQuery",                "resource-groups:GetTags"            ],            "Resource": "*"        },        {            "Sid": "ResourceGroupView",            "Effect": "Allow",            "Action": [                "resource-groups:GetGroup",                "resource-groups:SearchResources"            ],            "Resource": "*",            "Condition": {                "StringEqualsIgnoreCase": {                    "aws:ResourceTag/cs-namespace": "test1"                }            }        }    ]}Edited by: Yi Sheng Yap on Sep 30, 2019 6:21 PMFollowComment"

Answer: "0Accepted AnswerHi,if you add"tag:GetResources"The Resource Group will get displayed without any errors.Here is the full policy:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "ResourceGroupList",            "Effect": "Allow",            "Action": [                "resource-groups:ListGroupResources",                "resource-groups:ListGroups",                "resource-groups:GetGroupQuery",                "resource-groups:GetTags",                "tag:GetResources"            ],            "Resource": "*"        },        {            "Sid": "ResourceGroupView",            "Effect": "Allow",            "Action": [                "resource-groups:GetGroup",                "resource-groups:SearchResources"            ],            "Resource": "*",            "Condition": {                "StringEqualsIgnoreCase": {                    "aws:ResourceTag/cs-namespace": "test1"                }            }        }    ]}Hope this helps!-randyCommentShareRandyTakeshitaanswered 4 years ago0Thanks Randy,I managed to achieve my goal with your help.Here's my final policy:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "ResourceGroupList",            "Effect": "Allow",            "Action": [                "resource-groups:ListGroups",                "tag:GetResources"            ],            "Resource": "*"        },        {            "Sid": "ResourceGroupView",            "Effect": "Allow",            "Action": [                "resource-groups:ListGroupResources",                "resource-groups:GetGroup",                "resource-groups:SearchResources",                "resource-groups:GetGroupQuery",                "resource-groups:GetTags"            ],            "Resource": "*",            "Condition": {                "StringEqualsIgnoreCase": {                    "aws:ResourceTag/cs-namespace": "test1"                }            }        }    ]}Cheers.CommentShareYi Sheng Yapanswered 4 years ago"


Question: Can't delete Enviroment or Application

"Hi,One morning my environment had 0 instances running, I created a new enviroment and reDeploy my application to it and now I have my application running fine, But when I'm trying to delete the old environment that has zero instances I'm getting errors:Stack deletion failed: The following resource(s) failed to delete: [AWSEBSecurityGroup, AWSEBLoadBalancerSecurityGroup].Deleting security group named: sg-8d849bf4 failed Reason: resource sg-8d849bf4 has a dependent object (Service: AmazonEC2; Status Code: 400; Error Code: DependencyViolation; Request ID: 92ac8aa2-2fbd-480f-9fe2-e6d0f56a5c2d)Deleting security group named: awseb-e-xcxnatm49p-stack-AWSEBSecurityGroup-1SI6SGG0HPPWT failed Reason: resource sg-35839c4c has a dependent object (Service: AmazonEC2; Status Code: 400; Error Code: DependencyViolation; Request ID: 504ecd86-ec3c-428e-b99a-55510cb0d807)what is wrong ?Thanks,Edited by: JRozz on Jun 3, 2018 1:34 AMFollowComment"

Answer: "0Issue could be that you might have associated the security group sg-8d849bf4 to another resource, for example if a new instance is launched with this security group, in that case stack deletion fails. You can find the resource and manually remove the association or you can skip the resource and try deleting it again.Just a quick note:Modify the resources in your environment only by using Elastic Beanstalk. If you modify resources using another service's console, CLI commands, or SDKs, Elastic Beanstalk won't be able to accurately monitor the state of those resources, and you won't be able to save the configuration or reliably recreate the environment. Out-of band-changes can also cause issues when terminating an environment.Ref - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.managing.htmlCommentShareAWS-User-5157529answered 5 years ago"


Question: Can you access SES mail from a IPAD?

I am trying to understand if you can access SES from a IPad to get and send email?FollowComment

Answer: "1Hi, @JohnathanSmith.Are you trying to send and receive emails using Amazon SES from your regular iPad email client?If so, you cannot do it.If you want to use such a phone-mail SaaS, you can use Amazon WorkMail instead of Amazon SES.WorkMail is available for iOS.See the following document.https://docs.aws.amazon.com/workmail/latest/userguide/mobile-client.html#connect_ios_deviceCommentShareEXPERTiwasaanswered 5 months ago"


Question: Successive Snapshots Have Same Size of Original Snapshot and Volume

"Points of My Scenario:1. AWS documentation says snapshots are incremental backups: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html (2nd sentence).2. I created 3 snapshots of an EC2 instance (in-between changes), using AWS procedures in https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html.3. After each snapshot I created small changes: change-1 = create a user; change-2 = create a group and place user in the group.4. However, each snapshot had the same size as the EC2 instance's volume.**Question: **why are my successive snapshots all the same size as the EC2 instance's volume?FollowComment"

Answer: "2Accepted AnswerHi ThereThe size of the snapshot that you see in the console is the size of the EBS volume.  The actual amount of the data that you are billed for is not shown, and there is no simple way to see the actual size.  However you are only billed for the incremental blocks stored in each snapshot.From https://aws.amazon.com/ebs/pricing/Snapshot storage is based on the amount of space your data consumes in Amazon Simple Storage Service (Amazon S3). Because Amazon EBS does not save empty blocks, it is likely that the snapshot size will be considerably less than your volume size. For the first snapshot of a volume, Amazon EBS saves a full copy of your data to Amazon S3. For each incremental snapshot, only the changed part of your Amazon EBS volume is saved.Also see this article for a graphical depiction on how incremental snapshots work: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html#how_snapshots_workCommentShareEXPERTMatt-Banswered 6 months agoEXPERTTushar_Jreviewed 6 months ago"


Question: Blog Topic Suggestion on AWS

"Dear Team,I want to write a Blog on AWS please suggest on which topic i should start my research.ThankMalikFollowCommentiwasa EXPERT4 months agoHi. Tell me more about what you want to hear.Are you looking for a way to build his blog system on AWS?Or are you looking for a tech subject to blog about?Share"

Answer: "1Hi Imtiaza,I was under the same path and started writing blogs on Medium: https://alatech.medium.com/.As the company I worked was into micro-frontends, I started diving into  subjects such as Amplify, Cloudfront and so on.From there I deep dived into serverless and now I write articles for anything that interests me and can be useful for my company, such RDS, secret manager, certifications path, etc..I would suggest to pick something that you have passion about or that bring value to your company. Given the info above, one example could be to write about best practice for a secure  deployment  and creation of an EKS cluster in AWS, in your case.You can look at my blog and take inspiration so you find your interests and what inspires yourself ;)I hope it helps :)CommentShareEXPERTalatechanswered 4 months ago0Thanks iwasa for your reply.My company wants me to write some blog on tech subject, so that they can get it published on monthly mag.I have never written any blog on any topic. so i am curious what topic i should choose.AWS, Azure, Kubernetes is my subject (i am not expert in all of them).i am in IT for 20+ years but still  student.CommentShareimtiazaanswered 4 months ago"


Question: "Active VPCs, subnets and security groups in aws regions I don't use"

"Looking at the Resource summary page for EC2, I just find out that I have VPCs, subnets and security groups active in various AWS regions. I honestly don't remember how I created them so I wonder if they gets created automatically in some way?Do I need them? I only have EC2 instances in us-east-1.Am I going to be charged for them? If so, how can I do some clean-up?ThanksFollowComment"

Answer: "1Yes, default VPCs get created in the regions.Do you need them. No, not really. You can always recreated them if you delete them.Do they cost anything? No.You can Delete your default subnets and default VPCCommentShareEXPERTkentradanswered 3 months agoEXPERTBrettski-AWSreviewed 3 months ago"


Question: Trouble with Custom Module in Lambda PowerShell

"Hi - I've been successful with basic PS1 uploads to Lambda, but when I try and include a module with it, I'm getting errors when executing it.  Here is what I see in CloudWatch:2021-03-26T19:57:31.871-04:00LOGS Name: cloudwatch_lambda_agent State: Subscribed Types: [platform]2021-03-26T19:57:34.429-04:00Importing module ./Modules/AWS.Tools.Common/4.1.10.0/AWS.Tools.Common.psd12021-03-26T19:57:34.429-04:00Importing module ./Modules/MyModuleName/0.1/MyModuleName.psd12021-03-26T19:57:34.429-04:00[Error] - Could not find a part of the path '/var/runtime/ref'.[Error] - Could not find a part of the path '/var/runtime/ref'.I've deleted and rebuilt, and I've confirmed the PSM1 and PSD1 are in the ZIP in my staging folder, but beyond that I'm not sure where to go with this error messages and would appreciate any help anyone has.Thanks,ChrisFollowComment"

Answer: "0Through process of elimination, I found the issue was with an Add-Type that created an ENUM. This doesn't appear to work when running in Lambda.  Sample code:Add-Type -TypeDefinition @"public enum MySeasons{Spring,Summer,Autumn,Winter}"@CommentSharechrisboston83answered 2 years ago"


Question: Connecting from awsiotsdk to Greengrass Core over LocalMQTT TLS problems

"I try and connect from a client device over localMQTT to the broker on the greengrass core. However, when I connect, I get this error on the awsiotsdk side. I ran an almost identical script to this a couple months ago and I don't think it had the same problems.Traceback (most recent call last):  File "client_v2.py", line 76, in <module>    connect_future.result()  File "/Users/username/.pyenv/versions/3.8.11/lib/python3.8/concurrent/futures/_base.py", line 444, in result    return self.__get_result()  File "/Users/username/.pyenv/versions/3.8.11/lib/python3.8/concurrent/futures/_base.py", line 389, in __get_result    raise self._exceptionawscrt.exceptions.AwsCrtError: AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE: TLS (SSL) negotiation failedOn the Core side, I have just the Moquette broker and the bridge and a component that subscribes to the messages coming off of LocalMqtt and through the bridge. This is the message in greengrass.log2022-04-05T07:00:56.397Z [ERROR] (nioEventLoopGroup-7-10) io.moquette.broker.NewNettyMQTTHandler: Unexpected exception while processing MQTT message. Closing Netty channel. CId=null. {}io.netty.handler.codec.DecoderException: javax.net.ssl.SSLProtocolException: Received close_notify during handshake        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:478)        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276)        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)        at io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)        at io.moquette.broker.metrics.BytesMetricsHandler.channelRead(BytesMetricsHandler.java:51)        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)        at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)        at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)        at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)        at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:719)        at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:655)        at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:581)        at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493)        at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989)        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)        at java.base/java.lang.Thread.run(Thread.java:829)Caused by: javax.net.ssl.SSLProtocolException: Received close_notify during handshake        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:129)        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:339)        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:295)        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:286)        at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:250)        at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:185)        at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)        at java.base/sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:681)        at java.base/sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:636)        at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:454)        at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:433)        at java.base/javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:637)        at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:282)        at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1387)        at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1282)        at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1329)        at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:508)        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:447)        ... 25 more2022-04-05T07:00:56.399Z [INFO] (nioEventLoopGroup-7-10) io.moquette.broker.metrics.MQTTMessageLogger: Channel Inactive. {}I'm using the mqtt_connection_builder.mtls_from_path function to create my connection setup between the client and the core, but obviously during the connect function itself it breaks because of the TLS handshake.FollowCommentsushantAtAWS a year agoHi,I suspect that the CA used by the client is not valid.Can you show me how you are performing the cloud discovery and how you are connecting to the server in code (the code using mqtt_connection_builder.mtls_from_path)?Also, if you have logs from the cloud discovery code, please share that as well.ShareAWS-User-7945247 a year agoYep you were correct, splicing with the discovery code I was able to connect and send the data.ShareGreg_B EXPERTa year agosushantAtAWS can you please repeat your comment in the answer section so this no longer appears as an unanswered question?Share"

Answer: "1<reposting from the comments section>Hi,I suspect that the CA used by the client is not valid.Can you show me how you are performing the cloud discovery and how you are connecting to the server in code (the code using mqtt_connection_builder.mtls_from_path)?Also, if you have logs from the cloud discovery code, please share that as well.CommentSharesushantAtAWSanswered a year ago"


Question: TLD support for .cx

Can you please add top level domain support for .cx ?FollowComment

Answer: "0Greetings from AWS..!!I understand that you are requesting to add top level domain support for .cx.Route 53 Domains is currently directly accredited with .com, .net, and .org registries. All other TLDs are provided via third party registrar associates. To improve our level of service and support, we are actively working to become directly accredited with all other TLDs. In addition to improving our existing offering, we will become accredited with other registries to expand our TLD catalog. This work is currently in progress. We currently do not  have dates to share for adding new TLDs.You can also reach out to your Technical Account Manager to add this to our list of TLDs to be supported by Route 53.You can monitor the updates here at AWS Blogs - https://aws.amazon.com/blogs/aws/ and what's new on AWS - https://aws.amazon.com/new/CommentSharerePost-User-1196895answered a year ago"