Question: "AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys <username> SHA256:<long hex string> failed, status 22"

"We use Ubuntu 20.04 (ami-0c8858c090152d291) as the basis for a production ecommerce stack, and I need to move users around as part of a handover. In order to do this I am trying to ssh in to the instance using the original ami-configured instance user and AWS generated key, so I can move the user I normally log in as. This fails with the subject error in /var/log/auth.log. I have reconfirmed keys and user many times obviously.This appears to be related to AuthorizedKeysCommand fails on Ubuntu 20.04, which blames the package ec2-instance-connect. We keep instances up to date, so I suspect this package was installed as part of a post-install security update. The above-linked GitHub thread suggests:# rm /usr/lib/systemd/system/ssh.service.d/ec2-instance-connect.conf# systemctl daemon-reloadI have tried the above unsuccessfully. Even after removing ec2-instance-connect.conf and issuing either systemctl daemon-reload or kill -s HUP <sshd pid> the sshd process is still running using the ec2-instance-connect.conf settings:sshd: /usr/sbin/sshd -D -o AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys %u %f -o AuthorizedKeysCommandUser ec2-instance-connect [listener] 0 of 10-100 startupsFor obvious reasons I am reluctant to tinker more extensively with the sshd configuration on a production server without hearing from the community.It seems rather questionable (to put it mildly) for a "security update package" to hijack the normal sshd auth process, especially with no well publicized info, only to come to light when I actually have to work on it. The package listing saysConfigures ssh daemon to accept EC2 Instance Connect ssh keys-but what it fails to add is "... and may disable other keys".We surely cannot be the first ones to encounter this problem??FollowCommentrePost-User-8514694 10 months agoUpdate: adding a new user (ubuntu adduser) with a valid public key, and then running eic_harvest_hostkeys does at least allow a brand new user to ssh in to the instance. But the original ami-provided user still does not work, still with the subject error.I will not tag this as 'Answered', since although this helps me to work around the issue, it is not a resolution.Share"


Question: Not able to create an endpoint

"I am able to train and tune the model. But at the time of model deployment, the endpoint is not getting created, and it fails after some time. It gives the error as "FileNotFoundError: [Errno 2] No such file or directory: '/opt/ml/input/data/train/train_features.csv'". The question is: at the time of model deployment, if it is not picking the train_features.csv file because the path is not correct, then how does the model training and tuning happen? The training and tuning also happen on the same train_features.csv file, and the path is same.FollowComment"

Answer: "0For training and tuning, you provide the train_features.csv file to the container through the input channel when you call the .fit() method. The file is downloaded from S3 and put into the /opt/ml/input/data/train/train_features.csv location. After training is completed, only /opt/ml/model will be exported to S3 as model artificats.During model deployment, a brand new host is provisioned and model artifacts are downloaded to /opt/ml/model . However, your train_features.csv file will not be available to the host because it does not know about it. You will need to get it from S3 and put in the expected location /opt/ml/input/data/train/train_features.csv .  You can use an inference.py script to write a function that downloads the file from S3 before your model is loaded. Please have a look at this example for XGBoost.Hope it helps.CommentShareChristian_Kanswered 5 days ago"


Question: Issues while triggering lambda destinations from event bridge event

I am using AWS Event bridge to trigger lambda function and I have set AWS queue as one of the destinations to lambda function but I am not getting the messages there.Can you please help with this?FollowComment

Answer: "0Hi, there is no SQS queue involved in EventBridge to Lambda. The triggering of Lambda by events is direct: see https://docs.aws.amazon.com/lambda/latest/dg/services-cloudwatchevents.htmlCommentShareDidier_AWSanswered 12 days agorePost-User-3088224 12 days agoApology for poor explanation, my problem is around aws lambda destinations, they are not working after complete execution of lambda , which is receiving events from aws event bridge schedulerShare"


Question: Am I billed while a RDS instance is starting/backing up?

"I'm taking the Developer pathway on AWS Skill Builder, and the db.t2.micro instance has been starting up and backing up for over 20 minutes. Will I be billed for this time, or does the billing only start once the DB is usable?FollowComment"

Answer: "1Accepted AnswerHello SpartanhooahI am assuming you are using AWS free tier. If so, RDS is part of the free tier and you are allowed 750 hours of Amazon RDS Single-AZ db.t2.micro Instance usage. It also includes 20 GB of General Purpose (SSD) DB Storage and 20 GB of backup storage for your automated database backups and any user-initiated DB Snapshots. Backup storage is free up to 20 GB or the size of your DB storage, whichever is less, and requires you to have at least one DB instance running in your account. If you exceed these limits, or if you terminate all DB instances in your account, backup storage will be charged at standard RDS rates.ThanksCommentShareKamalanswered a year ago1The RDS billing details is here. Since you did not mentioned which RDS engine, i am not sure what would be the cost for particular instance as it depends upon many factor like region, instance class, engine, MAZ/SAZ etc which you can find below. As far as your question on "billing while RDS Instance is backing up? The answer is yes. As RDS will be accessible for your usage to make any DDL/DML operation. You can not modify the RDS when it is in backing-up state but you can pretty much use it for your read/write workload as normal.https://aws.amazon.com/rds/pricing/For Single-AZ Deployments, Multi-AZ Deployment (one standby instance), and Multi-AZ Deployment (two readable standby instances), pricing is per DB instance-hour consumed, from the time a DB instance is launched until it is stopped or deleted. Partial DB instance-hours are billed in one-second increments with a 10 minute minimum charge following a billable status change such as creating, starting, or modifying the DB instance class.https://aws.amazon.com/rds/mysql/pricing/CommentShareBakul_Ranswered a year ago1In addition to what was already said, this documentation page lists, for each possible status of an RDS instance, whether it will be billed or not.CommentShareValter_Ranswered a year ago"


Question: How to include functions and procedures when importing a MySql database from another server using mysqldump?

"I am moving my application to AWS.  I have a mysqldump file of my database from the original server that includes table, views, functions and procedures.  When I try to import the file into the RDS, only the tables and views are imported.  I get an error about needing super privileges and the functions and procedures are not imported.  I followed the instructions found in the article: https://repost.aws/knowledge-center/rds-mysql-functions.  I set the  log_bin_trust_function_creators=1 and I am now able to create new function and procedures but I still get the same error trying to import them.I have tried using the command line and My SQL Workbench and get the same error.How can get a complete database import.  I verified that everything is included in the mysqldump file by importing it back into a new database on the same existing server and everything is there.FollowComment"

Answer: "0Accepted AnswerI don't have experience with this, but is this something the Schema Conversion Tool would recreate for you? Just a thought.CommentShareEXPERTkentradanswered a month agoGary Mclean a month agoGood suggestion. However That tool is used when moving from day MS SQL to MySQLSharerePost-User-EMS a month agoThanks for the info but in my case the schemas are the same.Share0Afraid you have to do this manuallyMake sure to create any stored procedures, triggers, functions, or events manually in your Amazon RDS database. If you have any of these objects in the database that you are copying, exclude them when you run mysqldump. To do so, include the following arguments with your mysqldump command: --routines=0 --triggers=0 --events=0.CommentShareGary Mcleananswered a month ago"


Question: Lake Formation Column-based access on a resource link

"First, what I see in the very last screenshot image of the Granting resource link permissions page is that the 'column based permissions' option is disabled  ......, but in our account, for a resource link I have a different presentation with different options, no super.  Not blocker : I wonder if the difference between the two images is only a recent change in the interface.Blocker: Why it isn't possible to grant column-bassed permissions on a resource link?Our use case is the following.Producer account : Sharing 'tableA' with an external account (Consumer) with Alter, Describe, Insert & Select permissions with all columns. Done with both cross account versionsConsumer account:Create resource link tableA_producer from the Producer.tableA shared table.Trying to grant access to some users to tableA_producer, but to only some columns ... But what I see now is that it is not possible, why ? We don't want to do multiple resource sharings from Prod for the same resource.Bonus question : What are the differences between the 'cross account version settings' version 1 and 2 ?FollowComment"

Answer: 0The resource link to a shared database or for a table allows for that database or table to appear in the Amazon Athena and Amazon Redshift Spectrum query editors. That is different from providing Table access. You can still provide access an individual table (with optional column filtering)  as the next step.CommentShareAnanth Tirumanuranswered 8 months ago


Question: Add server side rendering to Angular/Amplify app

"Hello everyone,i'm currently testing the Amplify console to deploy an Angular 7 and Amplify framework webapp.The webapp needs to be partially server side rendered. I know how i could do it with other means on AWS (E.G. using Angular Universal, the Serverless framework and deploying the whole app straight to AWS Lambda), but I really like the convenience of the Amplify console and I'd like to give it a try.Is there any "easy" and easily maintainable way to do it?FollowComment"

Answer: "0Thanks for reaching out. Unfortunately, we only support static hosting currently.CommentShareAWS-User-0568200answered 4 years ago0Is there any update on Angular SSR with Amplify. Please do let me know.CommentShareVinodhZamstarsanswered 2 years ago"


Question: How to tag unlimited CpuCredits for Cost Explorer?

"I have a T3 Unlimited EC2 instance tagged with some tag project:xyz. The cost of "regular" CPU credits is being correctly shown tagged as project:xyz in Cost Explorer, so I know for a fact that the tag is correctly is applied. However, when the instance uses the "unlimited" CPU credit portion this cost is shown in Cost Explorer as USE2-CPUCredits:t3a without any tags.What am I missing?FollowComment"

Answer: "0Hello, the normal CPU usage is tagged with the user-defined tag, but unfortunately surplus CPU credits used with a T3 Unlimited instance cannot be allocated with a tag. "Any charges that cannot be grouped by tags in your cost allocation report default to the standard billing aggregation"[1]. Please let me know if you have any questions or concerns.[1] https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/configurecostallocreport.html#allocation-viewingCommentShareSUPPORT ENGINEERAWS_SamManswered a year ago"


Question: Issue with access lightsail server because of ssh service.

"We have one server in lightsail. The server firewall is enabled after that this issue comes, not able to ssh, I need to stop the server firewall for that I need to access the console. When we click console from aws console it shows timeout. Kindly help us to get the ssh access to server from console.I have opened the firewall ports in AWS but in the server level I need to update the firewall rules for the console access is need. Kindly help to get the console access.FollowComment"

Answer: "0There could be be a few possible issues:Is your instance firewall configured correctly? When SSH'ing from the Lightsail console, Linux instances need TCP port 22 open for SSH to work.Is the instance in a running state? It's also possible that your instance is scheduled for retirement, in which case you'll have received an email about this and you'll need to stop then start your instance (note: rebooting/restarting will not work).Is your instance attached to a static IP? If not and you're using a dynamic IP with an external SSH tool to connect, is it possible that the dynamic IP of your instance has since changed?It's sometimes possible for heavy CPU usage on the instance to prevent SSH connections from happening; please take a look at your instance's CPU metrics to confirm whether this is the case.CommentSharetanbriananswered 8 months agodhinil 8 months agoThe OS level firewall is enabled and started after that the ssh access is restricted.I need to get the console of the light sail server. To update the OS level firewall for ssh access.Share"


Question: unable to access my instance

"I created an instance in 2018... its been running ..I had an app that accessed it, but the user stopped using the app sometime in late 2018.I figured I would shut it down after saving two files..but I cant access the systemI shut it down and restarted, and got a new ipi can nslookup to get the address  but cant ssh to it. which I used to be able to do.i checked the VPC rules and they were allow anyone.I have the keyfile.I tried over vpn, thinking maybe it was my  providers network address or some filter..  no differenceFollowComment"

Answer: "0dupolicate.. forum said failed to post!CommentSharesamdanswered 2 years ago0what?   how did it post to the other?Edited by: samd on Jun 3, 2021 1:48 PMCommentSharesamdanswered 2 years ago"


Question: Querying a DynamoDB table gives "Cannot read properties of undefined (reading 'id')" by changing the ExpressionAttributeValues

"My query Params looks like this:const params = {  TableName: 'Todo-xxxxxxxxxxxxxxxxx-dev',  IndexName: 'title-createdAt-index',  KeyConditionExpression: '#title =:value',  ExpressionAttributeValues: { ':value':  "hi", },  ExpressionAttributeNames: { '#title': 'title', }  };When I'm changing the ExpressionAttributeValues from hi to hii it is throwing an error:{  "errorType": "TypeError",  "errorMessage": "Cannot read properties of undefined (reading 'id')",  "trace": [    "TypeError: Cannot read properties of undefined (reading 'id')",    "    at Runtime.exports.handler (/var/task/index.js:76:29)",    "    at processTicksAndRejections (node:internal/process/task_queues:96:5)"  ]}It is only working for hi and h if I put any value like abc,xyz it is giving above error.FollowCommentLeeroy Hannigan EXPERT5 months agoPlease provide the entire code snippet, what you have shared is not enough to help.Share"


Question: How to delete user account in Workdocs.

I would like to know how to delete user account in workdocs.FollowComment

Answer: "0From your WorkDocs Site (example: example.awsapps.com/workdocs/), you will need to click on the account icon next to the "Support" button. Then, from the available options, click on the "Open admin control panel" button.In the next window, scroll down until you find the users. Next to the user you want to delete, on the right hand side, you will find a "thrash can" icon. If there are no other users, you will need to delete the full site.I used this article to find the answer:https://docs.aws.amazon.com/workdocs/latest/adminguide/inactive-user.htmlCommentShareJonathananswered 10 months agoFrancisco_L SUPPORT ENGINEER5 months agoyou can only delete users that never confirmed their account with Workdocs (their state is Pending). If the user ever accepted the invitation, it can't be deleted. In this case, you can only disable the account instead of deleting it.If you really want to delete the user, then you can do so in Active Directory as long as you are using Simple AD, AD Connector or Managed AD but this isn't recommended for auditing and accountability reasons. After deleting the user from AD, you can logout/login to Workdocs and the user will be gone and can be reinvited. It's recommended to disable the account first and transfer ownership of existing files to a different user in case the files need to be accessed.Share"


Question: Dedicated Mac1.metal is in pending state after instance terminated

"Dear Team,My host id h-089d540666550a517 a dedicated mac1.metal is in pending state since last 30 mins and i am not able to launch a new instance on that.can some one guide me what should i do next.FollowComment"

Answer: "1It takes around 45 to 50 mins to get the instance back to available state.Only thing i can concur is to wait.Any other suggestions or proper way to start stop instances.CommentShareprabhuvikasanswered 2 years agoOded Arbel 2 months agoI've seen cases that as low as 12 minutes to recover from "Pending", but around 50 minutes is the more common case. One thing to note, is that after the host becomes "Available" - trying to launch immediately will also fail (or create another host, if you use resource groups). I found that waiting another minute after the host is "Available" will most often work.Share"


Question: JavaScript SDK - DynamoDB - Error - "Unexpected key 'KeyConditionExpression' found in params"

"I'm trying to query a DynamoDB table using the JavaScript SDK from my backend, but I'm receiving the following error:Error UnexpectedParameter: Unexpected key 'KeyConditionExpression' found in paramsI'm not sure what the issue is as I've checked the syntax multiple times. The few anwers found online did not help.My code:const dynamoDB = new AWS.DynamoDB();const params = {    TableName: tableName,    KeyConditionExpression: `#P = :projectname`,    ExpressionAttributeNames: {      "#P": "project",      "#B": "bucket"    },    ExpressionAttributeValues: {      ":projectname": {        S: "projectName",      },      ":bucket": {        S: "bucketName"      }    },    FilterExpression: "#B = :bucket",  };const response = await dynamoDB.query(params).promise();return responseHas anybody had this issue before?FollowComment"

Answer: "-1Error UnexpectedParameter: Unexpected key 'KeyConditionExpression' found in params`#P = :projectname`,This issue is due to the single quotes.Please remove that type it manually after pasting the code in the target place.'#P = :projectname',It should look like the above.If this answer has led to a solution, please approve the answer for the betterment of the community.CommentShareVetrivelanswered 2 months ago"


Question: No space left on device when deploy ECS Fargate Service with CDK

"I try to deploy my node application with ecs fargate service using cdk and after I added some packages in my application, get this error during the build process (yarn install) of my dockerfile: error An unexpected error occurred: "ENOSPC: no space left on device, copyfile.....Do you have some idea?PS. in CDK I use: ApplicationLoadBalancedFargateServiceFollowComment"

Answer: "3Accepted AnswerIt sounds like you are building your app as a Docker image.  If so, the CDK is using Docker on your local machine to build the image. The Docker sub-system on your local machine may have run out of space.  You can cleanup your local Docker system with prune commands.  Try:docker system prune --allThis will remove all unused Docker objects (containers, images, networks, volumes, etc...)Here is some more information on the topic:https://docs.docker.com/config/pruning/CommentShareDavid_Manswered a year ago"


Question: T2 Unlimited for RDS instances

"Hi,I recently hit a CPUCreditBalance of 0 on my t2.micro RDS instance which was not so great.For regular EC2 t2 instances you can change the "credit type" to T2 Unlimited which disables throttling when the balance is depleted. However, I can't seem to find this option for RDS instances.Is T2 Unlimited not supported for RDS instances?-ziihrsFollowComment"

Answer: "0Accepted AnswerRDS has not announced support for Unlimited versions of the db.t2 instance family.  Hopefully that is something that is coming soon, but I haven't seen anything to confirm it.Note that in general RDS offers a separate set of instance types than EC2, although the naming (db.t2. db.m4, db.r4, etc.) does imply they are based on underlying EC2 instance types.  But the RDS types may have unique characteristics, and should not be considered identical in all regards to the EC2 instances.CommentShareHalTempanswered 5 years ago0Also see https://forums.aws.amazon.com/thread.jspa?messageID=881930the pricing page https://aws.amazon.com/rds/mysql/pricing/ states:Amazon RDS T3 DB instances run in Unlimited mode, which means that you will be charged if your average CPU utilization over a rolling 24-hour period exceeds the baseline of the instance. CPU Credits are charged at $0.075 per vCPU-Hour. The CPU Credit pricing is the same for all T3 instance sizes across all regions and is not covered by Reserved Instances.CommentShareMenno H.answered 4 years ago"


Question: Cognito user pool - Add user to groups in bulk

"Cognito user pool console has a bulk user import operation, but I see no way there to add users to groups.Is there a tool (aws/community) for that?Thanks,JDFollowComment"


Question: Can't find old access key in IAM users list

"I have an API which is working with S3. There is an access key which I can't find in the list of IAM users, that key created about 4 years ago. It means I can't delete/disable it. Where I can find all my actual access keys and disable some old keys?Thank you!FollowComment"

Answer: "1Using the access keys, run this CLI command:aws sts get-caller-identityThat will show the account number and IAM user for those keys.CommentShareEXPERTkentradanswered 3 months ago0This key was created by root user long ago - that was the reason.CommentSharekhsmaximanswered 3 months agokentrad EXPERT3 months agoBest to not use root user access keys, especially when IAM user keys will work.Share"


Question: Appflow snowflake connection issue

"Hi Team,I faced an issue with Appflow to snowflake connection issue. We have raised an issue in the snowflake support and they are also facing the same and couldn't identify the JDBC version.  Could you please share us with the JDBC trace log and the JDBC driver version used from that log?Thanks,NivyaFollowComment"


Question: Where is Game Server Group tab in new gamelift console?

I have been integrating my backend game server with Gamelift Fleet IQ using the old console experience. I decided to give the new console a try and I am not seeing the option to view the GameServerGroups I create. Is this because it is a work in progress or is GameServerGroup/fleetIq going away?FollowComment

Answer: "0Hi,Amazon GameLift has also extended the integration into Amazon CloudWatch so customers can create their own dashboards and custom views of GameLift resources (source). One of those resources are your server groups, here is how. This will allow you to create a better dashboards to monitor all your GameLift resources along side all your AWS resourcesCommentShareGabriel_Manswered 5 months ago"


Question: Data transfer speeds from S3 bucket -> EC2 SLURM cluster are slower than S3 bucket -> Google SLURM cluster

"Hello, I am currently benchmarking big data multi-cloud transfer speeds at a range of parallel reads using a cluster of EC2 instances & similar Google machines. I first detected an issue when using a c5n.2xlarge EC2 instance for my worker nodes reading a 7 GB dataset in multiple formats from an S3 bucket. I have verified that the bucket is in the same cloud region as the EC2 nodes, but the data transfer executed far slower to EC2 instances than it did for GCP. The data is not going into EBS, rather being read in-memory, where the data chunks are then removed from memory when the process is complete. Here are a list of things I have tried to diagnose the problem:Upgrading to a bigger instance type. I am aware that there is a network bandwidth limit to each instance type, and I saw a read speed increase when I changed to a c5n.9xlarge (From your documentation, there should be 50 Gpbs of bandwidth), but it was still slower than reading from S3 to a Google VM with larger network proximity. I also upgraded instance type again, but there little to no speed increase. Note that hyperthreading is turned off for each EC2 instance.Changing the S3 bucket parameter max_concurrent_requests to 100. I am using python to benchmark these speeds, so this parameter was passed into a storage_options dictionary that is used in different remote data access APIs (see the Dask documentation for more info). Editing this parameter had absolutely no effect on the transfer speeds.Verified that enhanced networking is active on all worker nodes & controller node.Performed the data transfer directly from a worker node command line for both AWS and GCP machines. This was done to rule out my testing code being at fault, and the results were the same: S3 -> EC2 was slower than S3-> GCP.Varying how many cores of each EC2 instance were used in each SLURM job. For the Google machines, each worker node has 4 cores and 16 GB memory, so each job that I submit there takes up an entire node. However, when I had to upgrade my EC2 worker node instances, there are clearly more cores than just 4 per node. To try and maintain a fair comparison, I configured each SLURM job to only access 8 cores per node in my EC2 cluster (I am performing 40 parallel reads at maximum, so if my understanding is correct each node will have 8 separate data stream connections, with 5 total nodes being active at a time with c5n.9xlarge instances). I also tried seeing if allocating all of a node's resources for my 40 parallel reads would speed things up (2 instances with all 18 cores in each active, and a third worker instance with only 4 cores active), but there was no effect.I'm fairly confident there is a solution to this, but I am having an extremely difficult time figuring out what it is. I know that setting an endpoint shouldn't be the problem, because GCP is faster than EC2 and there is egress occurring there. Any help would be appreciated, because I want to make sure I get an accurate picture of S3->EC2 before presenting my work. Please let me know if more information is needed!FollowComment"

Answer: "1Have you considered setting up an S3 Gateway endpoint (https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html) or a private link endpoint (https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html) to optimize the networking? Gateway endpoints are no cost where private link has a cost.CommentShareChris Pollardanswered 10 months agojgreen 10 months agoThanks for the response! I have not set those up yet, but that was something that I was looking at. Would I have to create a separate endpoint for each instance in my cluster?ShareChris Pollard 10 months agoNope! You would set it up to have one gateway or endpoint for the entire VPC.Sharejgreen 10 months agoJust set up the gateway endpoint yesterday, and I saw a very minimal speed increase (basically nonexistent); I will double check all of the setup steps to make sure something wasn't missed. Is there anything else I could try? I will be shocked if GCP is truly faster from S3 than an EC2 cluster.Share"


Question: Monitron volume registry

"Connecting Monitron with Kinesis, what is the dimension of the registry generated from a Monitron sensors?FollowCommentBishr_T EXPERT7 months agoCan you clarify what you mean by dimension?  And registry?Are you referring to the structural format of the data exported by Monitron via Kinesis?Share"

Answer: "0Hello,I believe you are looking to export the monitron data to kinesis or  export streams live data to Kinesis.If not can you please explain more about the issue.Please refer Amazon Monitron Kinesis data exportCommentShareAWS-User-7653869answered 7 months ago"


Question: Comprehend CER Internal server error

"Hi, I'm trying to train a custom entity recognition model with comprehend using annotations. However I keep having a 500 interval server error, any ideas why this happens?ThanksFollowCommentgeorgios_s a year agoWould you be able to give a few more details around this? What is the exact error message you are getting? is there a way for us to recreate it? etc.Share"


Question: CloudFront: InvalidHeadersForS3OriginException in Edit Behavior

"HiI just got this error:InvalidHeadersForS3OriginException: Your request contains forwarded Header Name Host that is not allowed by S3I have had this header forwarded for months on multiple distributions (and update them a lot previously), this error just appeared today when I tried to update a distribution.Now I can't update the distributions, remove the Host header(or all of them) or just save without modifications.I had this exception on a behavior that does not forwards the Host header (but the sibling behaviors do contain it)Have you seen this issue as well?Thank you!FollowComment"

Answer: 0I just end up removing the Host header (using the API because I can't over the UI) and adding a viewer request handler to forward the X-Forwarded-Host headerCommentSharevicjicamaanswered 2 years ago


Question: Stuck in UPDATE_ROLLBACK_IN_PROGRESS

"My stack is stuck in UPDATE_ROLLBACK_IN_PROGRESS and I've tried everything to get it to keep going. The last event is for "fargateserviceService16837280" and it's status is UPDATE_IN_PROGRESS.I've tried recreating it but I must be not getting everything right.Since this stack is stuck, I'm unable to delete the stack that this service depends on.If this stack could be "force deleted" that would be awesome. The ARN is:arn:aws:cloudformation:ap-southeast-2:324253005158:stack/DEV-auth-service/e618ce10-f3bb-11e9-b2cf-0a564743ac36FollowComment"

Answer: 0This stack eventually went to DELETE_FAILED state and then I was able to delete the stack. It just takes a while...CommentShareAnthonyAutoGuruanswered 4 years ago


Question: How to visualization data from AWS Learner Lab.

"I am using AWS Learner Lab. I want use dashboard on AWS for easy visualization data from device IoT core, but use AWS Learner Lab and I don't have acess to quicksight service, Grafana e OpenSearch  because, my account is not admin.FollowComment"

Answer: "1Accepted AnswerIn that case you can use the DynamoDB Web Console to view data, which I understand is not quite the data visualization you require. However, without the necessary access to visualization services such as QuickSight or OpenSearch your options are limited without having to build something yourself on the client side.CommentShareEXPERTLeeroy Hannigananswered 2 months agorePost-Joao a month agoI wanted to visualize my information like a dashboard like a service quicksight, but I don't have access a quicksight, I wanted to know if exist another services for that, but with base your answer probably not.Thank for your answer.Share"


Question: Can't log in as root user to avoid charges on account i don't use.

"I am very disappointed with AWS at this point.  I only opened this account because I was applying for a job.  I had an appointment set and interviewer never showed up or responded.  When I sent notification I was told I would be contacted and never was.  Now I'm being told I may be charged for something I don't use.  I have over 40 years of technology experience, yet cannot log in to clear my account.  Granted I have not attempted login for a very long time, but I have captured enough screen shots to show this is not USER ERROR.  I cannot log into account as root user even though I have the correct credentials.  Hopefully you can respond before 3/31/23 avoiding any charges.  I have exhausted way too much time on this so far.  Any timely help would be appreciated.  When logging in as root user, it accepts my  password but does not send code.  When I attempt captcha it fails after multiple attempts from mutliple devices.FollowComment"

Answer: "0Use this form to contact support, I'm an AWS customer and I'm looking for billing or account support.CommentShareEXPERTkentradanswered 2 months ago"


Question: How can I find what S3 buckets are required by a service?

"I'm using WorkSpaces Web (not WorkSpaces!) with an S3 VPC endpoint. I would like to be able to restrict S3 access via the S3 endpoint policy to only the buckets required by WorkSpaces Web. I cannot find any documentation with the answers, and AWS support does not seem to know what these buckets are. How can I find out what buckets the service is talking to? I see the requests in VPC flow logs, but that obviously doesn't show what URL or bucket it is trying to talk to. I have tried the same policy used for WorkSpaces (below), but it was not correct (or possibly not enough). I have confirmed that s3:GetObject is the only action needed.{"Version": "2008-10-17","Statement": [{"Sid": "Access-to-specific-bucket-only","Effect": "Allow","Principal": "*","Action": "s3:GetObject","Resource": ["arn:aws:s3:::aws-windows-downloads-us-east-1/*","arn:aws:s3:::amazon-ssm-us-east-1/*","arn:aws:s3:::amazon-ssm-packages-us-east-1/*","arn:aws:s3:::us-east-1-birdwatcher-prod/*","arn:aws:s3:::aws-ssm-distributor-file-us-east-1/*","arn:aws:s3:::aws-ssm-document-attachments-us-east-1/*","arn:aws:s3:::patch-baseline-snapshot-us-east-1/*","arn:aws:s3:::amazonlinux.*.amazonaws.com/*","arn:aws:s3:::repo.*.amazonaws.com/*","arn:aws:s3:::packages.*.amazonaws.com/*"]}]}FollowComment"


Question: "Unable to Delete ACM Certificate - No API Gateway, Custom Domain or Cloud Front Distribution Exists"

"I am attempting to delete an ACM certificate from my AWS Account. This is not able to happen because it has some associated resources. Upon doing some research I found that this can happen because API Gateway or CloudFront will associate the certificate with its own Load Balancer. However, I do not have an API Gateway, Custom Domain, or CloudFront distribution active on this account.Arns Look like:arn:aws:elasticloadbalancing:us-east-1:250044486744:loadbalancer/app/prod-iad-1-az1-1-0/9c18104fa6102224arn:aws:elasticloadbalancing:us-east-1:250044486744:loadbalancer/app/prod-iad-1-az2-1-103/b0fab4aa61af247aarn:aws:elasticloadbalancing:us-east-1:250044486744:loadbalancer/app/prod-iad-1-az5-1-8/af057e0e069b45d2arn:aws:elasticloadbalancing:us-east-1:392220576650:loadbalancer/app/prod-iad-1-cdws-71/3ef2e951b96d90d1arn:aws:elasticloadbalancing:us-east-1:392220576650:loadbalancer/app/prod-iad-1-cdws-84/fa5b5f00887fe6f1arn:aws:elasticloadbalancing:us-east-1:392220576650:loadbalancer/app/prod-iad-1-cdws-88/0fcd61b701b03141What is the best way to resolve this? Are there other managed services that may associate my certificate with a load balancer that I am not thinking of? Will they eventually be deleted?FollowCommentQuincycs a year agoIt'll eventually be deleted.  Wait a couple hours before submitting a support ticket.Share"

Answer: "0Edit: Just read your comment that those ARNs are from deleted API gateways, just double check one more time in us-east-1 if you have any API GW left, if not you can open a support case that you are not able to remove the ACM because of these ARNs.The ARNs in your questions look like an API Gateway regional endpoint ARN. I have seen similar naming patterns for regional endpoints ALB ARNs.I am sure you already know this but would like clarify for anyone reading in future, Deploying a Regional API endpoint creates an Application Load Balancer by API Gateway. The CloudFront distribution or Application Load Balancer is owned by API Gateway, not your account. The ACM certificate provided to deploy API Gateway is associated with the CloudFront distribution or Application Load Balancer.Please follow the steps documented at: https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-resources/CommentSharehameedullahanswered a year agosunblade16 a year agoHi,I have seen those steps in my troubleshooting process and have attempted to follow them.The problem is, I do not currently have an API Gateway or Custom Domain provisioned in my account. They were deleted. Yet the ACM association persists.ShareMG a year agoThen you can ask Support for diagnose :)Share0All services which can use ACM you can find here.As I remember certificate should show where is it used, but I can't confirm it right now.Last advice :) you should avoid showing your account number because it's very sensitive data.CommentShareMGanswered a year agosunblade16 a year agoHi, thanks for the advice.I currently have nothing provisioned from that list.None of the account numbers in the Arns I showed are my account. They are the Arns of the Load Balancers that are associated presumably with a deleted API gateway, causing the issue.Share0Use the AWS Config service. For resource type select AWS ACM Certificate and then either select your certificate or enter the ARN of your certificate. Select Resource Timeline and focus on the configuration changes listed. Here you should be able to view the change details and you would be interested in the ones that call out Configuration.InUseBy.CommentShareRoBanswered a year ago0Everyone, wait a couple hours before submitting a support ticket.I had the same issue today.  I was in the middle of writing up a support ticket and I was able to delete my cert by the time I was done writing it.  It probably took about 30-60 minutes for it to be disassociated.CommentShareQuincycsanswered a year ago"


Question: AMAZON SES - use of dedicated IPs causing undelivered mails

"We started using 2 dedicated IP addresses last week (becaouse we were getting classified as spam by a few of our clients servers), with automatic warm up enabled. Ever since that moment, a great amount of mails to Microsoft 365 accounts stopped being delivered. A couple of examples of bounces we are getting (I have bolded what I consider the important bits):{"notificationType":"Bounce","bounce":{"feedbackId":"01000183ec4e858b-23653b95-dc32-4bc5-8c79-c5576c654ab1-000000","bounceType":"Transient","bounceSubType":"General","bouncedRecipients":[{"emailAddress":"ALVARO.MOLLINEDO@TIENDAAMIGA.COM.BO","action":"failed","status":"4.4.7","diagnosticCode":"smtp; 550 4.4.7 Message expired: unable to deliver in 840 minutes.<451 4.0.0 Unknown>"}],"timestamp":"2022-10-18T18:15:12.000Z","remoteMtaIp":"104.47.51.110","reportingMTA":"dns; a121-81.smtp-out.amazonses.com"},"mail":{"timestamp":"2022-10-18T04:15:07.803Z","source":"avisos.tiendaamiga@salar10.net","sourceArn":"arn:aws:ses:us-east-1:119356527540:identity/salar10.net","sourceIp":"18.214.19.61","callerIdentity":"ses-smtp-user.20210113-144245","sendingAccountId":"119356527540","messageId":"01000183e94d681b-347c8244-c7b1-4435-a54a-e78082cb671a-000000","destination":["karen.cespedes@tiendaamiga.com.bo","favio.quisbert@tiendaamiga.com.bo","merly.ramirez@tiendaamiga.com.bo","javier.pelaez@iqus.com.bo","nicole.calderon@tiendaamiga.com.bo","ALVARO.MOLLINEDO@TIENDAAMIGA.COM.BO"]}}{"notificationType":"Bounce","bounce":{"feedbackId":"01000183ec57b5a3-5fa6bf1e-4969-47e1-9a2c-9b1da6abdfa4-000000","bounceType":"Transient","bounceSubType":"General","bouncedRecipients":[{"emailAddress":"ACACERES@CLINICADELASAMERICAS.COM.BO","action":"failed","status":"4.4.7","diagnosticCode":"smtp; 554 4.4.7 Message expired: unable to deliver in 840 minutes.<451 4.7.500 Server busy. Please try again later from [54.240.121.82]. (S77719) [BN1NAM02FT058.eop-nam02.prod.protection.outlook.com]>"}],"timestamp":"2022-10-18T18:25:14.000Z","remoteMtaIp":"104.47.51.110","reportingMTA":"dns; a121-82.smtp-out.amazonses.com"},"mail":{"timestamp":"2022-10-18T04:03:25.674Z","source":"avisos.clinicaamericas@salar10.net","sourceArn":"arn:aws:ses:us-east-1:119356527540:identity/salar10.net","sourceIp":"18.214.19.61","callerIdentity":"ses-smtp-user.20210113-144245","sendingAccountId":"119356527540","messageId":"01000183e942b16a-c9696617-8145-411f-b1bb-f898d07685c1-000000","destination":["ACACERES@CLINICADELASAMERICAS.COM.BO"]}}Some useful information:Before using the dedicated IPs, we weren't getting any of these bounces.Message count and rate has not changed.In addition to adding the dedicated IPs, we also configured a custom MAIL FROM for the subdomain, following AWS instructions to the letter.Messages are NOT being directed to spam folders in MS 365 accounts, they do not reach destination.We have tested our mails with a couple of online mail testers, and we get very good scores (>=90%).We have w h i t e l i s t - e d both the domain and the IPs in MS 365 exchange admin center, to no avail.Reverse DNS works fine.¿What can we do? ¿If we relinquish the dedicated IP addresses currently being warmed up, should everyting go back to normal? ¿Contact Microsoft support and hope they can provide a reason for those bounces, so we know what to do in order to solve the issue?Thank you very much in advance for any help.FollowComment"


Question: aws ses receipt rules for routing email to an existing email address

"I have a domain registered with amazon route 53 (imagine example.com), and a workmail email based on that domain (imagine hello@example.com). I'm trying to create extra email addresses for this domain (imagine support@example.com and info@example.com). I came across this article which explains that the way to do this is by using SES' receipt rules. In SES my domain (example.com) is verified and has the appropriate SES MX record, and I've added the workmail email (hello@example.com) as a verified email address. I've followed the steps to create the receipt rule, specify support@example.com and info@example.com as the receipt conditions, create the sns topic, and I've successfully subscribed hello@example.com to the sns topic. However, when I send emails to support@example.com and info@example.com, nothing arrives in my workmail mailbox. What else do I need to do? How can I debug this?FollowComment"

Answer: "0Hi,If you want to receive mail in WorkMail you do not have to do anything in other services. You can all manage this from the WorkMail console. If you want to create multiple mailboxes for the support and info email addresses you can add extra users. You can also add extra email addresses to the user that uses hello@. Check this documentation page for more information on email addresses for users.Kind regards,RobinCommentShareMODERATORrobinkawsanswered a year agoAWS-User-8778696 a year agoThanks Robin. The problem is that workmail is expensive, that's why I"m considering other options. Any ideas for ways to fix the lack of delivery to the forwarding email as described in my post? I've tried using a non-workmail email too without any luck.Sharerobinkaws MODERATORa year agoHi,If you want a single mailbox to receive mail on multiple email addresses you can use email aliases. In the WorkMail console you can add this to any user you have enabled. You can also create resource mailboxes for these users as resource mailboxes are free.Kind regards,RobinShare"


Question: How do you specify which data an Amazon Personalize model trains off of?

"I have an interaction dataset that contains the following attributes: USER_ID, ITEM_ID, TIMESTAMP, COUNTRY, and DEVICE. I also have an event collection policy that collects the following attributes: USER_ID, ITEM_ID, SESSION_ID, EVENT_TYPE, COUNTRY, DEVICE, and WIDGET.Is it possible to create an Amazon Personalize model using a smaller combination of these attributes only? For example: USER_ID, ITEM_ID, TIMESTAMP, and DEVICE.FollowComment"

Answer: "0Accepted AnswerYes, you can define the specific attributes that you want an Amazon Personalize model to train off by adding metadata fields to your dataset's schema.Make sure that if you add your own metadata field of type string, it must include the categorical attribute or the textual attribute (only Items schemas support fields with the textual attribute). Otherwise, Amazon Personalize won't use the field when training a model.For more information, see Datasets and schemas in the Amazon Personalize developer guide.CommentShareAleksandr_Panswered 3 years ago"


Question: Asynchronous tracing using Xray

"Is there a way to enable tracing for my ECS services that connects each other via Amazon MQ ?I have two services which running in ECS cluster. Service A receives incoming requests via ALB. It does.something and post message to Queue (Lets say it is QueueA). Listener that listens message from QueueA is part of service B. It recieves message from QueueA , process it and sends to another Queue/some other services.I know that currently Amazon MQ doesn't support Xray. Is there anyway to trace the complete flow?I have lots of micro services that is integrated via Amazon MQ.FollowComment"

Answer: "0Hi,It seems like it could be possible, although bear with me as I'm not too familiar with Amazon MQ. If you are able to customize headers that are propagated for messages in MQ, then it should be possible. The process would be something like this:You should be able to enable ALB to generate a trace header following this documentation: https://docs.aws.amazon.com/xray/latest/devguide/xray-services-elb.htmlNext, you'll need to attach that X-Ray trace header to Amazon MQ messages so that service A and B will be part of the same trace. To learn more about the trace header see:  https://docs.aws.amazon.com/xray/latest/devguide/xray-concepts.html#xray-concepts-tracingheaderSo, a header will be passed into Service A from ALB, then service A can propagate the header over Amazon MQ to service B. You should instrument both services with the X-Ray SDK (available in 6 languages) to parse the trace header and create a segment for each service:  https://docs.aws.amazon.com/xray/latest/devguide/xray-sdk-java.htmlAnd you'll also need to set up the daemon in your ECS environments to send segments from your services to the X-Ray backend:  https://docs.aws.amazon.com/xray/latest/devguide/xray-daemon-ecs.htmlHope this helps as a workaround!CommentShareAWS-User-2079090answered 3 years ago0Thanks William.CommentSharesathyaaws3answered 3 years ago"


Question: https traffic slower in Western Australia compared to Queensland

"Hi all, we have recently opened an office in Western Australia, we have EC2 instances in Sydney region, our Head office is located in Queensland.Our application speed is significantly slower in Western Australia compared to our QLD office. i have done a tracert and both appears good, actually WA had less MS responses compared to our QLD office.No VPN connection involved. it is just HTTPS traffic.any ideas as to where to go from here, and has anyone else experienced this?FollowComment"

Answer: "0Is there a problem with the network environment from which you are accessing the site?Not sure what kind of application, but how about checking the response time from access logs, etc.?If you can configure the web server access log to record response time, you can check it.If these results were similar for WA and QLD, I thought it was safe to assume that there was a problem with the access source.Also, depending on the application, it may be possible to have CloudFront cache the data to speed up the response time.CommentShareEXPERTRiku_Kobayashianswered 24 days ago0Here I'd normally say the answer is latency - I'm extremely surprised that you're seeing lower latency in WA than in QLD. WA should be around 45-50 ms; QLD significantly less. Every round trip packet or transaction (at an application level) is greatly affected by the latency.My rule of thumb is that for every additional millisecond of latency it takes an additional second to transfer one megabyte of data. That sounds over the top and for optimised protocols (like the AWS SDK communicating with S3) it's excessive; but for "chattier" protocols it is a pretty good measure. HTTP is normally ok but it can be offset by many connections to download small components - it takes time to establish each session; then to negotiate TLS; then to download.As Riku mentioned: If you can use CloudFront and the content can be cached then it will absolutely help the WA users (there is a CloudFront point of present in Perth).Another alternative is to put some of the application components in the Perth Local Zone. I've had customers see very low latency when using it; but it entirely depends on application architecture and whether it is easy to split up the components and run them in both Sydney (for the QLD users) and Perth (for the WA users).We have AWS teams in both locations - reach out to them and also to the support team to help troubleshoot.CommentShareEXPERTBrettski-AWSanswered 23 days ago"


Question: Unreal Engine 4.23 Networking not ready in GameMode

In 4.23 IpNetDriver is starting after Gamemode it seems and I am unable to run more then 1 server on an instance since I don't have the port available in GameMode to send to Gamelift.  Has Anyone figured out a work around for this.  I.e. a place to call the Gamelift Server SDK code instead of GameMode that runs after the Networking is setup?FollowComment

Answer: "0I am sorry you are having problems. Have pinged a few people to see if they have any thoughts but I am not sure anyone has encountered this.I would suggest asking on the Unreal forums as this is specific to Unreal start up order.You can separate the InitSDK and ProcessReady calls in the GameLift Server SDK/Unreal Plugin, so it should be possible to wait for IpNetDriver to complete its set-up. You may need to implement an event or similar to listen for.CommentSharerePost-User-5332620answered 3 years ago0@REDACTEDUSERTry to create gameInstanceSubsystem, and onMapLoadedFinished initialize gameLiftSDK:Something like this:/**Author: Tahir Slezovic*/#include "UMyGameInstanceSubsystem.h"#include "AwsFunctionLibrary.h"#include "Engine/World.h"void UMyGameInstanceSubsystem::Initialize(FSubsystemCollectionBase& Collection){Super::Initialize(Collection);FCoreUObjectDelegates::PreLoadMap.AddUObject(this, &UFBGameInstanceSubsystem::OnMapLoadStarted);FCoreUObjectDelegates::PostLoadMapWithWorld.AddUObject(this, &UFBGameInstanceSubsystem::OnMapLoadFinished);GLog->Log("Initialize GameInstance Subsystem");}void UMyGameInstanceSubsystem::Deinitialize(){Super::Deinitialize();FCoreUObjectDelegates::PreLoadMap.RemoveAll(this);FCoreUObjectDelegates::PostLoadMapWithWorld.RemoveAll(this);GLog->Log("SUBSYSTEM Deinitialize GameInstance Subsystem");}void UMyGameInstanceSubsystem::OnMapLoadStarted(const FString & MapName){GLog->Log("SUBSYSTEM GameInstance Subsystem Map Load Started " + MapName);}void UMyGameInstanceSubsystem::OnMapLoadFinished(UWorld * LoadedWorld){GLog->Log("SUBSYSTEM GameInstance Subsystem Map Load Finished, RUNNING ON PORT: " + FString::FromInt(LoadedWorld->URL.Port));if (LoadedWorld->IsServer()) {UAwsFunctionLibrary::InitializeGameLift(LoadedWorld->URL.Port);}}CommentSharerePost-User-0847331answered 3 years ago"


Question: AWS SDK for apigateway: GetDocumentationParts Path issue(aws-sdk-go-v2/service/apigateway/api-op-GetDocumentationParts)

"Describe the bugwe should get the documentation info of the resources/methods for the specified path strictly.Expected Behaviorin the input parameters for GetDocumentationParts in apigateway service, we should get the documentation details strictly for the path specified.Current Behaviorin the input parameters for GetDocumentationParts in apigateway service, when we are providing the path of the api entity, we are getting the documentation details of all the child resources of the path specified too.Reproduction Stepsjust run this query on AWS CLIaws apigateway get-documentation-parts --rest-api-id --path --location-status DOCUMENTED --type METHOD --no-cli-pagermake sure that the path provided has child resources and all the resources have method documentation in themexample:create api alphaadd resources abc, abc/def, abc/def/xyzadd methods to these 3 resourcesadd documentation in these methodsrun thisaws apigateway get-documentation-parts --rest-api-id <api id of alpha> --path </abc> --location-status DOCUMENTED --type METHOD --no-cli-pagerexpected behaviour:it should give documentation details of /abc onlycurrent behaviour:it is giving documentation details of /abc, /abc/def, /abc/def/xyzAWS Go SDK V2 Module Versions Usedgo 1.18require (github.com/aws/aws-sdk-go v1.40.54github.com/aws/aws-sdk-go-v2/config v1.15.11github.com/aws/aws-sdk-go-v2/service/apigateway v1.15.7github.com/aws/aws-sdk-go-v2/service/sqs v1.19.0github.com/bxcodec/faker/v3 v3.8.0github.com/dgrijalva/jwt-go v3.2.0+incompatiblegithub.com/gin-gonic/gin v1.7.4github.com/go-playground/validator/v10 v10.4.1github.com/go-redis/redis/v8 v8.11.4github.com/golang-migrate/migrate/v4 v4.15.2github.com/newrelic/go-agent/v3 v3.3.0github.com/newrelic/go-agent/v3/integrations/logcontext/nrlogrusplugin v1.0.1github.com/newrelic/go-agent/v3/integrations/nrgin v1.1.2github.com/sirupsen/logrus v1.8.1github.com/spf13/viper v1.9.0go.mongodb.org/mongo-driver v1.9.1golang.org/x/exp v0.0.0-20220706164943-b4a6d9510983)require (github.com/aws/aws-sdk-go-v2 v1.16.7 // indirectgithub.com/aws/aws-sdk-go-v2/credentials v1.12.6 // indirectgithub.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.6 // indirectgithub.com/aws/aws-sdk-go-v2/internal/configsources v1.1.14 // indirectgithub.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.8 // indirectgithub.com/aws/aws-sdk-go-v2/internal/ini v1.3.13 // indirectgithub.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.6 // indirectgithub.com/aws/aws-sdk-go-v2/service/sso v1.11.9 // indirectgithub.com/aws/aws-sdk-go-v2/service/sts v1.16.7 // indirectgithub.com/aws/smithy-go v1.12.0 // indirectgithub.com/cenkalti/backoff/v4 v4.1.2 // indirectgithub.com/cespare/xxhash/v2 v2.1.2 // indirectgithub.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirectgithub.com/fsnotify/fsnotify v1.5.1 // indirectgithub.com/gin-contrib/sse v0.1.0 // indirectgithub.com/go-playground/locales v0.13.0 // indirectgithub.com/go-playground/universal-translator v0.17.0 // indirectgithub.com/go-stack/stack v1.8.0 // indirectgithub.com/golang/protobuf v1.5.2 // indirectgithub.com/golang/snappy v0.0.4 // indirectgithub.com/hashicorp/errwrap v1.1.0 // indirectgithub.com/hashicorp/go-multierror v1.1.1 // indirectgithub.com/hashicorp/hcl v1.0.0 // indirectgithub.com/jmespath/go-jmespath v0.4.0 // indirectgithub.com/json-iterator/go v1.1.12 // indirectgithub.com/klauspost/compress v1.13.6 // indirectgithub.com/leodido/go-urn v1.2.0 // indirectgithub.com/magiconair/properties v1.8.5 // indirectgithub.com/mattn/go-isatty v0.0.12 // indirectgithub.com/mitchellh/mapstructure v1.4.2 // indirectgithub.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirectgithub.com/modern-go/reflect2 v1.0.2 // indirectgithub.com/pelletier/go-toml v1.9.4 // indirectgithub.com/pkg/errors v0.9.1 // indirectgithub.com/spf13/afero v1.6.0 // indirectgithub.com/spf13/cast v1.4.1 // indirectgithub.com/spf13/jwalterweatherman v1.1.0 // indirectgithub.com/spf13/pflag v1.0.5 // indirectgithub.com/subosito/gotenv v1.2.0 // indirectgithub.com/ugorji/go/codec v1.1.7 // indirectgithub.com/xdg-go/pbkdf2 v1.0.0 // indirectgithub.com/xdg-go/scram v1.0.2 // indirectgithub.com/xdg-go/stringprep v1.0.2 // indirectgithub.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d // indirectgo.uber.org/atomic v1.7.0 // indirectgolang.org/x/crypto v0.0.0-20210921155107-089bfa567519 // indirectgolang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirectgolang.org/x/sys v0.0.0-20220317061510-51cd9980dadf // indirectgolang.org/x/text v0.3.7 // indirectgoogle.golang.org/protobuf v1.27.1 // indirectgopkg.in/ini.v1 v1.63.2 // indirectgopkg.in/yaml.v2 v2.4.0 // indirect)Compiler and Version usedgo version go1.18.3 darwin/amd64Operating System and versionmacOS Monterey, version 12.4FollowComment"


Question: Is it possible to give AWS SSO users Lake Formation data access?

"Is it possible to assign data permissions to an AWS SSO user by using their federated user arn?If so, please can you advise of the format.It's possible to assign an AWS SSO created role (permission set) data permission in Lake Formation as it is available as a drop down from IAM, but the user is not available in that list.The top right drop down gives is labelled as a federated user in the pattern of: <IAM_ROLE_FROM_SSO>/<USER>but baking that into an arn like: arn:aws:iam:ACCOUNTID:federated-user/<IAM_ROLE_FROM_SSO>/<USER>is unfortunately not recognised by Lake Formation ui.Could anyone provide any pointers how we could give single users data permissions when they are AWS SSO users please?FollowComment"

Answer: "0Yes, it is possible (I've just tried it in a test account).Even though the ARN that you see as an SSO federated user ens in federated-user/role_name/user you would still use the ARN of the role used by SSO.Once you've added it in, on the Data Lake administrative is should show up as Type: SSO User.arn:aws:iam::<account-id>:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_<permission-set-based-role-name>CommentShareStewart Wallaceanswered a year agoAWS-User-4286208 a year agowouldn't that still just be the role?I am looking to see if it is possible to have user level permissions.ShareStewart Wallace a year agoAh. I see, sorry I misunderstood the actual ask of the question.So in this situation what I would suggest as an approach would be to use the ARN of the role as the trusted principle, but then using SSO session attributes to restrict the IAM policy of the federated users.So for example, From the data lakes perspective, the role is a trusted principal, but the role only grants permissions to federated users who have a certain session attribute. (That could be a custom field, or a username depending on the level of fine grained control that you want)You're effectively pushing the user level permissions into your IAM policy.Share"


Question: How to grant s3 access to cloudfront using the CDK?

"I'm confused within the CDK how I can set up CloudFront only permissions on an S3 bucket.  I crated the bucket, with publicReadAccess: false then am trying to grant cloudformation permissions like this:import * as s3 from "aws-cdk-lib/aws-s3";import * as cf from "aws-cdk-lib/aws-cloudfront";import * as iam from "aws-cdk-lib/aws-iam";export function grantCloudFrontAccessToBucket(stack: cdk.Stack, cfInstance: cf.CloudFrontWebDistribution, bucket: s3.Bucket) {    const bucketObjects = `${bucket.bucketArn}:*`;    const cfArn =`arn:aws:cloudfront::${stack.account}:distribution/${cfInstance.distributionId}`;    const policy = new iam.PolicyStatement({            actions: ["s3:GetObject"],            resources: [bucketObjects],            principals: [                new iam.ServicePrincipal('cloudfront.amazonaws.com')            ],            conditions: [                {                    "StringEquals": {                        "AWS:SourceArn": cfArn                    }                }            ]        });    bucket.addToResourcePolicy(policy);}It complains that it is an invalid condition type, but I think StringEquals should be okay?  The only other thing I can think of is I built the ARNs wrong?Update: I found This Article that explains how to do what I was trying to do using OIN.  But, the console help seems to suggest OAC is better.  Can you use OAC in a similar way from the CDK?FollowComment"

Answer: "0Accepted AnswerI'm closing this for now.  I settled on just using the old way first until the CDK catches up.const oin = new OriginAccessIdentity(stack, 'washnet-cf-origin-access-identity');sourceBucket.grantRead(oin);then in the cloudfront config:s3OriginSource: {    s3BucketSource: source,    originAccessIdentity: oin},Good enough for now.CommentSharewz2banswered 7 months ago"


Question: Sagemaker training instance

I have a doubt with choosing instance for training job in sagemaker. Is ml.m5.2xlarge with count as 2 and ml.m5.4xlarge are same ?I would like to know if there is any best practice guide to choose the instance for training in sagemaker.Thank you 🙂FollowComment

Answer: "0Hello,The question is quite broad since there will be multiple factors to consider.Here is the pricing range provided. You can calculate the same and find out if using 2ml.m5.2xlarge with count as 2 OR ml.m5.4xlarge would be better for your use-case.Pricing- https://aws.amazon.com/sagemaker/pricing/You can refer to the training best practice #6 and find out what is the specification and which instance would you choose from Compute/Memory Optimized image or the Standard one.Here is a 3rd party link provided that would could be helpful, however it is not verified by AWS and is based on the research that I found on the internet based on what to consider while choosing a training instance.Link- https://datachef.co/blog/how-to-choose-the-best-training-instance-on-sagemaker/CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months agoSanthosh_m31 10 months agoThank you for your responce.I tried optimization while performing a training job I used ml.m5.12xlarge which clearly underused the machine capacity. (Log : https://drive.google.com/file/d/1dhV8PQdLELho8o2dVWOhyatmBWNOLE8l/view?usp=sharing) When I used ml.c5.4xlarge this instance failed with the following error.Error : numpy.core._exceptions.MemoryError: Unable to allocate 5.19 GiB for an array with shape (83, 8398169) and data type float64So for this particular job, how would you choose the instance?Crunching ~6 GB data with data shape  (83, 8398169) in CSVI'm not time boundNo GPU is required as I'm performing SKLearn RFRegressionShare0Hello, to help on the experimentation, you can create a pipeline and run multiple training jobs simultaneously with different instance configurations https://github.com/aws/amazon-sagemaker-examples/tree/main/sagemaker-pipeline-multi-model. Hope this helps!CommentShareAWS-User-9634033answered 10 months ago"


Question: "Too many redirects" error for some users

"Some users are receiving an error message when attempting to access our admin page, i.e. xxxx.com/admin. Others are able to access it easily. We have tried clearing caches, removing cross-tracking, etc for the individual users and it continues to be a problem. The entire error is: "Too many redirects occurred trying to open https://xxxxx.com/admin/index.php. This might occur if you open a page that is redirected to open another page which then is redirected to open the original page"Any ideas? I assume I need to change a configuration in my record set, but have no idea what caused this suddenly, or how to fix it.FollowComment"

Answer: "0Doesn't sound DNS-related. Probably something in either your web server or your Wordpress configuration.CommentShareRobMManswered 4 years ago0Hello,The error "Too many redirects" occurs when your website is stuck in a redirect loop. Kindly check your server configuration for any redirection rules that could result in a loop.The error could also be caused due to an HTML/PHP/JS page which redirects to another page which inturn redirects again to previous pageThe redirection configuration will need to be done on the server itself. Route 53 is a DNS service and it only resolves your Domain name and returns the IP address of your server.CommentShareAWS-User-3842999answered 4 years ago0The "Some users" makes this a bit confusing.  Agreed that this is likely something either in the httpd/nginx config or in the application.  A common scenario is http-->https redirects when dealing with a load balancer, and not having the traffic flow/apache configs setup correctly.Are you restricting the /admin page to specific subnets/ips..e.g. based on whether they are on a vpn or not?  that would also (likely) be something in the apache config somewhere.CommentSharecloudbuttonanswered 4 years ago"


Question: Python Fast Api deploy in AWS lambda

I have create the python fast api and I build docker image . now I want  to host in aws lambda and aws api gatway . can you please help me to find the way.FollowComment

Answer: 0Accepted AnswerI'm not sure I understand why you want to use API Gateway with FastAPI - in my mind there is a lot of redundant functionality there that means you're building/paying/using two things to do the job of one. What benefits does using FastAPI give you that you don't get using API Gateway?If you're looking for a lightweight way to host containers then I suggest that App Runner might be a better solution here.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: Connect to AWS Simple Queue Service using JMS (jndi context)

"Hi everyone,We are using JMS to connect to our queues using a .bindings file to configure the jndi context to connect. We are still using non AWS queues, and we are trying to migrate it to AWS SQS.Is it possible to use a .bindings file to configure the connection to AWS Simple Queue Service configuring the region, using a profile as parameters, all configured inside the .bindings file?If yes do you have any example on how to do that?FollowComment"

Answer: 0Have not seen anything in the documentation about migrating a JNDI configuration for JMS to work with SQS. There is however a library called "Amazon SQS Java Messaging Library" that lets clients working on a JMS queue to switch to using an SQS queue - https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-java-message-service-jms-client.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago


Question: MediaTailor server side tracking

"I have a question regarding how the tracking events are fired at the server side (start,  first quartile, midpoint, third quartile, and ad completion ).Namely, if i have a preroll with a duration of 10 seconds, i would expect that the midpoint event gets trigger at 5 second mark, and the completed event at 10 second mark. For example : start event is fired at 11:51:40, midpoint event at 11:51:45 and completed event at 11:51:50.What actually happens is, all tracking events are fired at the pretty much the same time, where the difference between the start and the completed events is maybe a second or two. For example : start event is fired at 11:51:40, midpoint event at 11:51:41 and completed event at 11:51:42.All of the available events are triggered, with no regards to how many seconds of the ad the user has actually watched. This does not provide correct tracking information.Am i missing something? Is this how server side tracking is supposed to work? Maybe initial video buffering is triggering all of this events at once?Any information you can provide is useful. Thanks in advance.FollowComment"

Answer: "0Hi Djole91, thanks for posting this question!Client-side reporting allows for very granular reporting as it's the player that responds with what the user has actually watched. If you review the examples at https://docs.aws.amazon.com/mediatailor/latest/ug/ad-reporting-client-side.html you'll note that each beacon event can report against a specific 'startTime' or 'startTimeInSeconds' - so the reporting can be quite detailed.For Server-side reporting however, the server doesn't have the same granularity and has to make a best judgement based on what segments have been egressed. The reporting accuracy is therefore dependent on the full length of the Ad, as well as the segment length of that Ad, which in this case MediaTailor defaults to 2 seconds. To give you an example:To serve a 10 second Ad where the segment length is also 10 seconds, you would only need to pull one segment for the server to assume that the Ad had been played in its entirety. The server would get all the reporting beacons in one go. Please note this is just an example - MediaTailor doesn't serve Ads with 10s segment lengths using the dynamic transcode profile.To serve a 10 second Ad where the segment length is 2 seconds, the start beacon would be fired with the first segment; the midpoint would be with the third segment, and the complete beacon with the fifth segment. You would see a beacon timestamp with ~2s accuracy.To serve a 30 second Ad where the segment length is 2 seconds, the start beacon would be with the first segment; the midpoint with the 8th segment; and the complete beacon on the 15th segment. You would see a better timestamp representation because the ad content is longer, but still up to 2s accuracy determined by the ad segment length. If the client only egressed segments 1-8 then you would receive the start and midpoint beacon, but not the third quartile or complete beacon.In summary, dynamic transcode profiles will create 2 second ad segments and therefore the accuracy for server-side beacons will only ever be accurate to 2s. You will see better beacon timestamp accuracy in longer Ad content because it is made up of more segments which can be reported against. If you require more detailed beacon reporting I would consider using client-side reporting.I hope this answers your question but please let me know if you have any outstanding questions!CommentShareAWS-User-0287910answered 2 years ago0Hey bmarshallataws, thank you for a very thorough response. It was very helpful.I do have one follow-up question.Since HLS is native on IOS, i cannot control the amount of segments that are going to be buffered. It will do it's own thing.How would you tackle this specific situation? Are there maybe configuration settings that could be useful?CommentShareDjole91answered 2 years ago0Hi Djole91, you're very welcome. That is a great question... this is largely out of our control. Different players will have different logic for how many segments to buffer relative to the play head. DASH has the concept of suggestedPresentationDelay which can influence the presentation delay and how many segments the player will buffer - but this assumes the player in question is designed to look at this value and use it.In this case server-side reporting reports purely on what the server is doing. If the player downloaded those segments to its buffer, but the user closed the browser before the ad actually played, server-side reporting would still report the Ad as viewed. From the server's perspective the segments have been downloaded and therefore the ad was viewed. For reasons mentioned above, shorter Ads will be more susceptible to this as an entire short Ad could theoretically fit in the player's buffer.In short, to guarantee accuracy it is best to implement client-side reporting so the client can directly send accurate impression beacons based on how much of the Ad was actually viewed.CommentShareAWS-User-0287910answered 2 years ago0Hey bmarshallataws. Thanks for your feedback, it helped me a lot. Take care.CommentShareDjole91answered 2 years ago0Glad I could help! You take care too. Best regards.CommentShareAWS-User-0287910answered 2 years ago"


Question: Getting started with MQTT client in Java SDK?

"Hi,I'm working with IOT services using the Java SDK. I'm able to instantiate an IotClient (software.amazon.awssdk.services.iot.IotClient) and perform some basic functions like listThings() or describeEndpoint(). So I know my integration and credentials are working as expected.The next thing I need to do is work with the message queues (MQTT) associated with my IOT things. I'm a bit confused here. I see that there is a package called mq, which contains an MqClient; I've imported that package into my project and I can create the MqClient (and I've also made sure my credentials have full access to MQ). I'm not sure what to do next. The MqClient doesn't appear to have any functions related to sending or receiving messages. I'm also not sure how to configure it to work with the message queues used by IOT services, as opposed to others.Do I need some kind of third-party MQTT client? I've noticed that some are available and I think MQ is a non-proprietary protocol, but I'd definitely prefer to steer clear of random third-party pacakges if the functionality I need is available from the AWS Java SDK.Thanks,FrankFollowComment"

Answer: "1The main AWS SDK for Java includes a client for interacting with the control plane APIs of AWS IoT Core, such as ListThings and DescribeEndpoint as you have found. It also includes some limited functionality for the data plane, such as publishing a new message over the HTTP API and GET/POST APIs for interacting with the device shadow service. If you are looking for full bi-directional pubsub, you may want to use the AWS IoT Device SDK for Java: https://github.com/aws/aws-iot-device-sdk-java-v2CommentShareRyan_Banswered a year agoFrank a year agoWhich functions allow me to interact with the device shadow service? Are these functions of IotClient, or something else?ShareRyan_B a year agoJava SDK separates the data plane commands into a separate client: https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/iotdataplane/IotDataPlaneClient.htmlShare0I'm confused as to how to construct the AwsIotMqttConnectionBuilder. It seems to require a certificate and a private key. I have an AWS access key and secret key. How do I convert that into the credentials that this class requires?CommentShareFrankanswered a year agoFrank a year agoI should add that what I'm trying to do is create a Java server application that can access all of my devices simultaneously. I know that individual devices have certificates, but I'm not trying to emulate a device, I'm trying to build a supervisor application that can receive and send messages from and to any device. Is this even possible?ShareRyan_B a year agoYes, that is supported. If your server app has AWS IAM AK/SK to use, you want to connect your app using MQTT over websockets instead of x509 certificate. If you use the withWebsockets() flag on AwsIotMqttConnectionBuilder, I believe it will default the CredentialsProvider to use system env AK/SK. You can override and provide your own CredentialsProvider using withWebsocketCredentialsProvider().Share0Thanks for the response. I'm lookin at the AWS IoT Device SDK, but immediately running into the issue that the classes it uses, such as "software.amazon.awssdk.crt.CRT", are not recongized when I try to import them into my project. Do you know which Gradle packages I need to include to get them?CommentShareFrankanswered a year ago"


Question: Is there a limit on the number of QuickSight dashboards?

Is there is a limit on the number of dashboards customers can have when using QuickSight?FollowComment

Answer: "0Accepted AnswerCurrently, there are no limits on the number of dashboards you can publish.CommentShareAWS-User-6113306answered 4 years ago0But one dashboard gives only 20 Tabs/Menu/report in a one dashboard.We can you use multiple graphs on one report.CommentShareNaveed Hashmianswered a year ago"


Question: What’s your experience with content writing and Creative writing?

What’s your experience with content writing and Creative writiFollowComment

Answer: "1I assume this refers to using NLP models like GPT-2/3/J for content writing? If so, then my experience is that these models are very promising. That being said, it will require either some thoughtful prompt engineering or some fine-tuning as well as some experimentation to get the desired results. But all in all, I saw some good results from using GPT-J. See also this related blog post.CommentShareHeikoanswered 10 months ago0Accepted AnswerIt requires loads of creativity, patience and devotion to learn. At the same time, flunking deadlines is not an option. Further, the finished job needs to be crisp, informative and interesting. So, content writing is a gigantic job but is extremely fulfilling if you enjoy what you writeCommentSharerePost-User-7125045answered 10 months agoEXPERTAWS Support - Kraigreviewed 10 months ago0It requires loads of creativity, patience and devotion to learn. At the same time, flunking deadlines is not an option. Further, the finished job needs to be crisp, informative and interesting. So, content writing is a gigantic job but is extremely fulfilling if you enjoy what you writeCommentSharerePost-User-7125045answered 10 months ago"


Question: Calls not completed

"In the last days, we've been experiencing issues more than usual when calling to random numbers in UK, France, Norway, and Ireland. After dialing the number, we don't hear anything and then in a few seconds the call is disconnected with no message error. In logs, we see "Customer disconnect". This is so fast that I doubt that they actually reject the call. I don't think it's a connection issue, because then I call other numbers from the same country and it works fine. Any other users experiencing same problem or any idea why this could be happening?FollowComment"

Answer: "0Hi,Can i ask couple of questions:1- was this working fine previously?2- Mentioning that you are trying to call UK, France, Norway and Ireland. are you dialing Amazon connect line or you are dialing from Amazon Connect ?3- Are you dialing Landlines or Toll free lines?Best Regards,Ramy HusseinCommentShareRamyHanswered 2 months agoThiagoR 2 months agoThanks for your answer, Ramy.This probably happened before, but since last Thursday we noticed this has been happening with many outbound calls. No issues with inbound calls. We use CCP to call our customers from the same UK number that I purchased in Amazon Connect. We're dialing landlines and mobile numbers.I think that is very weird that the calls lasts 2 seconds, it doesn't ring, no error message and then the logs says "customer disconnect".Share"


Question: Inquiries about how to refresh MFA settings again

"Previously, I set up an MFA and used it to log in, but I couldn't log in all of a sudden, so I contacted your company and solved it. However, the previous MFA setting has disappeared. I want to set up MFA again and use it, so please tell me how to do it. Thank you.FollowComment"

Answer: "0Here is a document link to setup MFAhttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.htmlTo avoid the issue that you faced above, you can try to re synchronize your devices.https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_sync.htmlCommentSharerePost-User-1487707answered 8 months ago"


Question: SMTP Server Timeout when Configuring IMAP Client

"We use Amazon Workmail service in eu-west-1 region (Ireland) to send/receive email. However, we cannot use our IMAP software to read/send email locally because of timeout at the SMTP server.$ telnet imap.mail.eu-west-1.awsapps.com 993-> works fine$ telnet smtp.mail.eu-west-1.awsapps.com 465-> timeoutThis article is used as reference for the configuration: https://docs.aws.amazon.com/workmail/latest/userguide/using_IMAP.htmlSeemingly other users were facing the same problem in other region (ref: https://forums.aws.amazon.com/thread.jspa?threadID=329851&tstart=0 ). Would it be possible that there is a problem with the SMTP server / configuration reference page leading to this timeout error?FollowComment"

Answer: "0Hi,I'm sorry to hear you're experiencing problems connecting to SMTP over telnet. I am not sure if that works so I will check in with the service team for that.What does work for me is using open_ssl:openssl s_client -connect smtp.mail.eu-west-1.awsapps.com:465 -servername smtp.mail.eu-west-1.awsapps.comKind regards,RobinCommentShareMODERATORrobinkawsanswered 2 years ago0Hi Robin,Thanks for the answer. It helps narrow down the real issue. Outbound port 465 was blocked by the infra provider. We have requested to unblock the port. The issue has been resolved.CommentSharemalopsanswered 2 years ago"


Question: Average of values for Pivot table

"Hey, I would need to replicate to a Pivot table I have created in Quicksight, the "Summarize value field by AVERAGE" that is easily done in Excel. How can I do it?FollowComment"


Question: AWS Workspaces desktop with Windows 11

When is Windows 11 expected to be offered as a AWS Workspaces bundle? Currently the bundles offered are limited to Windows 10 with Office 2010 through 2019.FollowComment

Answer: "1As of this writing, Amazon WorkSpaces default bundles supports Windows 10 desktop experience powered by Windows Server 2016 or Windows Server 2019.If your organization is eligible to bring its own Windows Desktop licenses (BYOL), you can run the Windows 10 Enterprise operating system on your Amazon WorkSpaces. You will need to meet requirements for BYOL to run in this mode. The only Windows versions supported for BYOL are specific version of Windows 10 listed here.Windows 11 versions are not supported for BYOL at this time. There are currently no published timeline for the support of Windows 11 Amazon WorkSpaces. AWS is constantly adding new capabilities so you can leverage the latest technologies and also looking at specific customer product feature enhancement requests.Could you share what are the specific use cases and requirements you have for Amazon WorkSpaces with Windows 11? I would encourage you to contact your AWS representative for your organization for more specific discussions around your business needs for the new version. ThanksCommentShareEXPERTDzung_Nanswered a year agoHanno Meiring 7 months agoThanks, can you advise when Windows 10 22h2 will be supported. I need to plan in place upgrades for current 20h2 workspaces which has End of Life May 2023Share0Hi, please see this recent announcement re Bring Your Own License (BYOL) for Windows 11 on Amazon WorkSpaceshttps://aws.amazon.com/about-aws/whats-new/2023/03/aws-windows-11-licenses-workspaces/Thank you!CommentShareadubyascanoanswered 2 months ago"


Question: UPLOAD_ARTIFACTS State: FAILED

"I pushed below buildspec.yml in the TestRepo via codecommitversion: 0.2phases:  install:    runtime-versions:      java: corretto8   build:    commands:      - echo Build started on `date`      - mvn test      - mvn package      - echo Build completed on `date`artifacts:  files:    - target/spring-petclinic-2.3.0.BUILD-SNAPSHOT.jarin the Codebuild execution process i am getting below error in the console:[Container] Skipping invalid file path target/spring-petclinic-2.3.0.BUILD-SNAPSHOT.jar[Container] Phase complete: UPLOAD_ARTIFACTS State: FAILED[Container] Phase context status code: CLIENT_ERROR Message: no matching artifact paths foundFollowCommentalatech EXPERT2 months agoIt must be related to the files artifact. Where is located?ShareNihar 2 months ago@alatech, files artifact is under D:/ drive and below file structureD:--Project|TestRepo--gradle|--src|--build.gradle|--buildspec.yml|--docker-compose.yml|--gradlew|--gradlew.bat|--LICENSE.txt|--mvnw|--mvnw.cmd|--pom.xml|--readme.md|--settings.gradleShare"

Answer: "0Hello,I hope you're doing well! I understand that you encountered UPLOAD_ARTIFACTS State: FAILED in your CodeBuild project.So, please add dir command before artifacts (build or post_build phase).Here is an example.version: 0.2phases:  install:    runtime-versions:      java: corretto8   build:    commands:      - echo Build started on `date`      - mvn test      - mvn package      - echo Build completed on `date`      - dir targetartifacts:  files:    - target/spring-petclinic-2.3.0.BUILD-SNAPSHOT.jarCommentShareDaein_Canswered 2 months agoNihar 2 months ago@Daein_C, Thanks for your quick response. I used buildspec as suggested by you and re-run the build but again hopeless. While debugging the "Phase Detail" tab, error occured at two phasesBUILDFailedCOMMAND_EXECUTION_ERROR: Error while executing command: mvn test. Reason: exit status 1UPLOAD_ARTIFACTS     FailedCLIENT_ERROR: no matching artifact paths foundEven after installing to "correctto11" in local machine (in CMD java -version pointing to 11), i am getting below error[ERROR] Failed to execute goal org.springframework.boot:spring-boot-maven-plugin:3.0.4:build-info (default) on project spring-petclinic: Execution default of goal org.springframework.boot:spring-boot-maven-plugin:3.0.4:build-info failed: Unable to load the mojo 'build-info' in the plugin 'org.springframework.boot:spring-boot-maven-plugin:3.0.4' due to an API incompatibility: org.codehaus.plexus.component.repository.exception.ComponentLookupException: org/springframework/boot/maven/BuildInfoMojo has been compiled by a more recent version of the Java Runtime (class file version 61.0), this version of the Java Runtime only recognizes class file versions up to 55.0ShareDaein_C 2 months ago@Nihar,Could you try correntto17? Java 17 is the default compiler of Spring Boot Maven PluginYou can use Amazon Linux 2 x86_64 standard:4.0 or Ubuntu standard:6.0. CodeBuild Available runtimesShareNihar 2 months ago@Daein_C, Still i am facing issue in uploading artifacts files to S3 bucket. Below is error log snippet capture for your reference[Container] 2023/03/30 19:29:25 Running command echo $CODEBUILD_SRC_DIR/codebuild/output/src327652445/src/git-codecommit.ap-south-1.amazonaws.com/v1/repos/TestRepo[Container] 2023/03/30 19:29:25 Running command echo Build completed on `date`Build completed on Thu Mar 30 19:29:25 UTC 2023[Container] 2023/03/30 19:29:25 Phase complete: BUILD State: SUCCEEDED[Container] 2023/03/30 19:29:25 Phase context status code:  Message: [Container] 2023/03/30 19:29:25 Entering phase POST_BUILD[Container] 2023/03/30 19:29:25 Phase complete: POST_BUILD State: SUCCEEDED[Container] 2023/03/30 19:29:25 Phase context status code:  Message: [Container] 2023/03/30 19:29:25 Expanding base directory path: .[Container] 2023/03/30 19:29:25 Assembling file list[Container] 2023/03/30 19:29:25 Expanding .[Container] 2023/03/30 19:29:25 Expanding file paths for base directory .[Container] 2023/03/30 19:29:25 Assembling file list[Container] 2023/03/30 19:29:25 Expanding target/spring-petclinic-3.0.0.BUILD-SNAPSHOT.jar[Container] 2023/03/30 19:29:26 Skipping invalid file path target/spring-petclinic-3.0.0.BUILD-SNAPSHOT.jar[Container] 2023/03/30 19:29:26 Phase complete: UPLOAD_ARTIFACTS State: FAILED[Container] 2023/03/30 19:29:26 Phase context status code: CLIENT_ERROR Message: no matching artifact paths foundShareDaein_C 2 months agoHi @Nihar,have you checked the file (target/spring-petclinic-3.0.0.BUILD-SNAPSHOT.jar) exists?ShareNihar 2 months agoHi @Daein_C,I have checked the codecommit "TestRepo" the main Repo and there is no directory called "Target"Please let me know, if i am going wrong somewhere in builcode and codecommit and user permission, since no where in console error any permission violation.ShareShow 1 more comment0Hi Daein_C,Thanks for your support. After long hours of try in weekend i could able to get the root cause and want to highlight hereI can't understand why you are trying to find from the codecommit repo ==>Codebuild Source is selected as "AWS CodeCommit", so basically what ever code build command are available in builspec.yml will directly apply on-cloud Repo rather to local copy in the systemIn project both pom and buildspec files are out of sync for the given JAR file name, for which codebuild is not able to locate the files. After fixing the JAR file name it directly uploaded the JAR file to S3 bucketHere in buildspec, no need to add extra build command -dir target. Maven will take care automatically (from file command) when uploading the JAR file.CommentShareNiharanswered 2 months agoDaein_C 2 months agoHi Nihar,Good to hear you fixed the issue.Share"


Question: [kinesisvideo] Specify the bucket for kvs sampling

run:aws kinesisvideo update-image-generation-configuration --cli-input-json file://./update-image-generation-input.json err:An error occurred (AccessDeniedException) when calling the UpdateImageGenerationConfiguration operation: User: arn:aws:iam::******:user/GG-Provisioning-GreengrassProvisioningUser-1FH7GYMO63SCZ is not authorized to perform: kinesisvideo:UpdateImageGenerationConfiguration on resource: "kvsStreamName"permission policy:what should i do to solve the problem?thanks!FollowComment


Question: Appstream 2.0 Public IP ranges

"Hi,Customer who has a large Amazon Appstream 2.0 fleet wants to optimize outbound proxy/firewall configuration for access from their corporate network. Is there is please a way to identify Appstream 2.0 IP public ranges in Amazon IP ranges?I do not see any specific service for Appstream 2.0 in Amazon Public IP ranges here.Valid values: AMAZON | AMAZON_APPFLOW |AMAZON_CONNECT | API_GATEWAY | CHIME_MEETINGS | CHIME_VOICECONNECTOR |CLOUD9 | CLOUDFRONT | CODEBUILD | DYNAMODB | EC2 |EC2_INSTANCE_CONNECT | GLOBALACCELERATOR | KINESIS_VIDEO_STREAMS |ROUTE53 | ROUTE53_HEALTHCHECKS | S3 | WORKSPACES_GATEWAYSShould the customer use "WORKSPACES_GATEWAYS" ? Or, how can they find the public IPs corresponding to streaming endpoints on Appstream 2.0?Note: customer is aware they could also stream from an Interface VPC endpoint, but they also want to keep the internet access open for other use cases.FollowComment"

Answer: "1Accepted AnswerThe public IP address ranges for AppStream come out of the public address space for EC2 and CloudFront predominately.The best bet is for the customer to allowlist the traffic to the FQDN endpoints, defined here:https://docs.aws.amazon.com/appstream2/latest/developerguide/allowed-domains.htmlKeep in mind that the traffic is web based traffic on HTTPs, so the allowlisting would likely need to occur on their web proxies.The workspaces_gateways in the JSON file are specific to the WorkSpaces service only (and not relevant to AppStream).Hope that helps!CommentSharePhil_Panswered 3 years ago"


Question: Duplicate timestamps are not allowed in a timeseries error when using Timestream INTERPOLATE_LOCF function

"Hi team,We have been using the INTERPOLATE_LOCF to be able to sample a data between a time range so we don't pull too many data points. It automatically selects N records based on a time range. For our case we get the difference between two selected dates and device that by 30. So when we run the query we always get max of 30 data points returned no matter what the date range is. We have not had any issues for a while. However recently we added some new IoT sensors that sometimes lose connection briefly and it actually ends up sending two data points to  timestream with exact time stamp. So now when I try to run the INTERPOLATE_LOCF  it returns the error "Duplicate timestamps are not allowed in a timeseries." . I have looked at the records in timestream and yes sometimes two of the records have the exact time stamp such as "2023-01-10 19:34:41.668000000" and "2023-01-10 19:34:41.668000000". Is there anyway we can use the INTERPOLATE_LOCF function with having duplicated timestamp in timestream table?Below is a sample query for splitting the date range into 30 data points that are 1.7 seconds apartSELECT INTERPOLATE_LOCF(CREATE_TIME_SERIES(time, measure_value::varchar),SEQUENCE(min(time), max(time), 1.7s)) AS interpolated_temp FROM TimeStreamTableThank you for your timeFollowComment"

Answer: "0Accepted AnswerFor anyone having similar issue. After some investigation I found that the error was being thrown by the CREATE_TIME_SERIES function. It does not allows duplicated time stamps. So I fixed the issue by writing a nested query to first filter out the duplicated timestamps by using group by, Distinct on the time and selecting only of the values for the measure_value. You can use MAX, AVG or MIN function to achieve this. Below is my final query :WITH DistinctTimeDatePoints AS (SELECT distinct time, max(measure_value::varchar) as measure_valueFROM MITimeStreamDB.Table1WHERE  time  BETWEEN '2022-12-1 19:31:20.000000000' AND '2023-01-10 19:31:50.000000000'GROUP BY time)SELECT INTERPOLATE_LOCF(CREATE_TIME_SERIES(DISTINCT time, measure_value),SEQUENCE(min(time), max(time), 115201s)) AS InterpolatedSeriesFROM DistinctTimeDatePointsCommentShareshervinmirsaeidianswered 5 months ago"


Question: Error scheduling backup every ten minutes in AWS Backup

"I'm trying to schedule an EBS backup every ten minutes. Lifecycle Manager only allows you to go down to an hour. Same story for AWS Backup, but it gives you the the ability to write a cron expression. So I put in a cron for every ten minutes that looks like this:cron(* 0/10 * * * *)But I receive the following error:"Support for specifying both a day-of-week AND a day-of-month parameter is not implemented."I'm far from a cron job guru but it looks like I can't have an asterisk for both the day of week and day of month parameter in the cron job, but I'm not sure how else to set it to every ten minutes without specifying both. Is that a problem with my cron expression or just a lack of capability on AWS Backup?FollowComment"

Answer: "0Accepted AnswerPlease look at this document for cron expressions used by Cloudwatch Events (same is also used in AWS backups) - https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.htmlThere is an example of every 15 minutes which is 0/15 * * * ? *So in your case 0/10 * * * ? * should work as per the documentCommentShareEXPERTIndranil Banerjee AWSanswered a year agoAWSJoe a year agoAhh makes sense. The cron you wrote out was correct, I see my mistake. That being said, it popped an error that said "The interval between backup jobs shouldn't be less than 60 minutes." Looks like AWS Backup doesn't have the capability to run backups for jobs that are less than 60 minutes apart. Thanks!Share"


Question: Pinpoint Voice channel cannot be enabled

"Hello.Was trying to use Pinpoint Voice channel but no success.  When I try to send something via it I get:PERMANENT_FAILUREVOICE channel not found. Please enable the VOICE channel for this application XXXXand in the AWS UI I see it disabled.The AWS support recommended to enable it using API as it, somewhy, can't be done in the UI (thanks to AWS developers). But when I try to do so using Java Amazon SDK I get this error:com.amazonaws.AmazonServiceException: Unable to unmarshall exception response with the unmarshallers provided (Service: AmazonPinpoint; Status Code: 403; Error Code: AccessDeniedException; Request ID: XXXX; Proxy: null)Please, help to enable the Voice channel,RegardsFollowComment"

Answer: 0Have you tried enabling the voice channel using the AWS CLI? I was able to enable it for one of my Pinpoint projects by using the following command:aws pinpoint update-voice-channel \  --application-id <appId> \  --voice-channel-request Enabled=trueCommentShareEXPERTBrentAtAWSanswered 4 months ago


Question: Restore deleted nested stack

"Hi,I need to restore a nested stack that I deleted manually, I don't need the resources but the parent stack is stuck and I can't updated, there is a way that I can fix this?Best regardsVictorFollowComment"

Answer: 0I don't think a deleted stack can ever be restored.  My advice would be to contact AWS Support to have them "un-stick" the parent CFN stack.CommentShareKangarooBoxanswered a year ago


Question: Amazon Connect Queues

We are having issues with Amazon Connect callback queues sending contacts to agents outside of the queue's hours of operation  We are trying to mitigate this problem by capturing the callback request and creating a record in a Dynamo table with the intent of programmatically controlling when the callback happens.  The problem is that we can't seem to figure out how to create a contact in code.  Perhaps we are not approaching the problem correctly.  Any guidance is much appreciated.FollowComment

Answer: "0There is no out of the box way to programmatically schedule a callback.  But there are two other options:https://github.com/aws-samples/amazon-connect-callback-helper follow this to do a schedule callback.  It uses a schedule outbound call with information to request a callback at a specified timeWithout using a schedule outbound call to, you can create various branch to execute the transfer to queue with callback with a different initial delay in the parameter.  Although the initial delay cannot be dynamic, you can have multiple xfer to q with 1 hr, 2 hr.... 10 hr initial delay separately, and figure out what is the current time (using a Lambda function) and use Check Contact Attribute to branch to different initial delay.When Initial Delay is use, the contact is put into a "scheduled" state and even with agent available, they will not be reached until the delay is finished and move into the queue.https://docs.aws.amazon.com/connect/latest/adminguide/transfer-to-queue.html#transfer-to-queue-propertiesCommentShareClarenceChoianswered 4 months ago"


Question: Killing a hung Sagemaker Job

"After running 'stop_training_job', the job is not stopping. Happy to provide the full processing name and job arn if needed. Thanks!FollowComment"


Question: Best RMM Tool for Cloud

"Dear Team,Please see that we are searching for RMM tool (Remote monitoring and management) to apply on all the cloud managed services.e.g the RMM tool which we are looking should integrate with Azure, AWS and GCP.ThanksMalik Adeel ImtiazFollowComment"

Answer: "0Hi Malik Adeel Imtiaz ,Thanks for posting your question!You can check AWS market place [1] for third party RMM tool.[1] https://aws.amazon.com/marketplace/ThanksCommentShareAWS-User-3915987answered 5 months ago0Thanks for your reply.Actually i am interested to get the suggestion from people who had already assessed the RMM tool.ThanksAdeel ImtiazCommentShareimtiazaanswered 5 months ago0Hi Adeel,There are several RMM tools that can integrate with Azure, AWS, and GCP, such as:Atera: a cloud-based RMM solution that supports Windows, Mac, Linux, iOS, and Android devices.SolarWinds RMM: This is a cloud-based RMM solution that supports Windows, Mac, and Linux devices.Continuum: This is a cloud-based RMM solution that supports Windows, Mac, and Linux devices.Kaseya VSA: This is a cloud-based RMM solution that supports Windows, Mac, and Linux devices.ConnectWise Automate: This is a cloud-based RMM solution that supports Windows, Mac, and Linux devices.It's recommended to try the free trial version for each tool and compare the features, pricing, scalability and ease of use to find the best fit for your organization.CommentShareAhmad Ul Islamanswered 5 months ago"