Question: Allow AWS Amplify access a restricted site for npm builds

"SetupI am using AWS Amplify to host my NextJS app. My backend is a headless CMS called Craft CMS (PHP). The NextJS app is using the GraphQL endpoint from Craft CMS for data fetching. The CMS is in EC2 server. It is connected to an Application Load Balancer.RequirementI want to be the only one who can access the CMS since I'm the only one using it. So the EC2 security group's source for HTTP and HTTPs is the ELB security group ID. The ELB security group has my IP for the HTTP and HTTPS traffic. This configuration works. I'm the only one who can access the site.The issueThe problem is that when Amplify tries to build my frontend app, it's always build error. It seems that the Amplify can not reach the GraphQL endpoint when it tries to build the app.Action takenI tried adding AmazonEC2FullAccess to the Amplify Service role and it didn't work.Temporary workaroundI turned on the access logs of the CMS and found the AWS IP of the Amplify app. I then added the IP to the ELB security group to allow access. This works but I don't know how often AWS changes the IP address and I know at point some point it'll break down.QuestionHow do we allow Amplify to access the GraphQL endpoint for npm builds? Any ideas is greatly appreciated. Thank you.FollowComment"

Answer: 0I think you can consider AWS custom CDK for Amplify.https://docs.amplify.aws/cli/custom/cdk/CommentShareHoan Phamanswered a year ago


Question: Can Sagemaker Git Repositories use ssh secrets (no name and password)?

Can Sagemaker Git Repositories use ssh secrets (no name and password)?FollowComment

Answer: "0Accepted AnswerYes, Sagemaker can use SSH for private repos. There are multiple options on how to connect to a repo in Sagemaker.** Option 1**: Using SSH to work with a private repoYou can follow the same steps you do in your local machine to connect to a private repo through SSH, steps to follow:Open Terminal and type ssh-keygen to create an SSH key in your Amazon Sagemaker instance.Add the public key to your Git account (Github or Gitlab)Get the SSH url of your repo and git cloneOption 2: Using AWS Secret ManagerYou can follow the steps in AWS official documentation here.Option 3: Using GitHub with Personal Access Tokens RecommendedLet’s assume you have already generated an Access Tokens through the GitHub’s Settings / Developer Settings / Personal Access Tokens page.You can just simply go ahead and clone the repository using Studio UI. When it asks your username and password, you can provide your GitHub username and the Personal Access Token. If you want to cache your credentials avoiding to type it every time when you’re interacting with the GitHub server, you can cache or store it on your home folder with the following command issued in the Terminal:$ git config --global git credential.helper [cache|store]If you choose to store your credentials, it will be written to the ~/.git-credentials file located in your home folder. The “cache” helper stores the credential in-memory only and never lands on disk. It also accepts the --timeout <seconds> option, which changes the amount of time its daemon is kept running (the default is “900”, or 15 minutes)Before you make your first commit, you still need to configure the git client to use your identity when we’re checking in some new code into the repository. You need to run the following two commands from the terminal:$ git config --global user.email “user@email.com”$ git config --global user.name “User Name”Sagemaker Studio is fully integrated with git and you can do it through the UI.CommentShareZmnakoanswered a year ago"


Question: "AWS EC2: restarted instance, got assigned a new IP, now IP is redirecting to old IP via response headers Location."

"Hi, I've restarted my EC2 instance, I got assigned a new IP and now everytime I access that IP I am being redirecting to the old IP via response headers Location. browser(s) have clean no cookie/no cache.I can enter my machine via SSH, checking my Apache logs and not seeing any new lines in both access and error.My security groups are working fine and access is open to me (as previously to restart).Not sure how this happened and would be happy to know how to resolve this.FollowComment"

Answer: "0Hi, @ereztYou haven't placed ALB or CloudFront in front of your EC2 instance, right?If so, you're probably redirected by the Apache settings on your EC2 instance or the code in your web application.Please review the description of httpd.conf or .htaccess first.If there is no problem, check if the website or web application running on Apache is executing the redirect process.CommentShareEXPERTiwasaanswered a year ago"


Question: Create SCP exemptions

"Hi I am trying to create a policy that restrict uploading objects without encryption, also want to create an exemption for certain buckets tagged with reserved tag exempted this doesn't seem to work, i think the reason probably is that tags at the bucket level are not checked when object resource is being added.Is there an alternative to create SCP exemptions at bucket level?    {      "Sid": "DenyNoEncryption",      "Effect": "Deny",      "Action": "s3:PutObject",      "Resource": "*",      "Condition": {        "StringNotEquals": {          "s3:x-amz-server-side-encryption": "AES256",          "aws:ResourceTag/exempted": "yes"        }      }    }FollowComment"

Answer: "0Try this, let me know if this resolves your issue.Curated SCPs and Config RulesSCP: Restrict S3 uploadsPrevent uploads of unencrypted S3 objects.{            "Sid": "DenyUnencryptedS3Uploads",            "Effect": "Deny",            "Action": "s3:PutObject",            "Resource": "*",            "Condition": {                "StringNotLike": {                    "s3:x-amz-server-side-encryption": ["aws:kms", "AES256"]                },                "Null": {                    "s3:x-amz-server-side-encryption": "false"                }            }        }    ]}CommentShareabemusaanswered a month agorePost-User-2714351 a month agoNo this is not what i asked, i want to add an exemption when a bucket has a tag "exempted": "yes". When the tag is added to bucket i would like to NOT enforce this SCPSharerePost-User-2714351 a month agoYes the policy itself is working and preventing any non-encrypted uploads, but now i am trying to see if i can add an exemptionShare"


Question: How to pass data to an endpoint

"Hello,I have followed the DeepAR Chicago Traffic violations notebook example. The Model and Endpoint has been created and the forecasting is working.https://github.com/aws/amazon-sagemaker-examples/blob/master/introduction_to_applying_machine_learning/deepar_chicago_traffic_violations/deepar_chicago_traffic_violations.ipynbHowevr, I haven't deleted the model nor the endpoint in order to use it externally. I have created a Python script on an EC2 that tries to load the endpoint and passes the data to it to get a prediction, and here is what I am doing:Loading the CSV exactly the way I did it on the notebookParsing the CSV the same way I did on the notebook for the "predictor.predict" commandInstead of using the "predictor.predict", I am using "invoke_endpoint" to load the endpoint and passing the data from the previous pointInstead of getting the same response I got on the notebook, I am getting the following message:"type: <class 'list'>, valid types: <class 'bytes'>, <class 'bytearray'>, file-like object"Not sure what the issue is, seems that it requires a byte data... I guess I cannot send the data as a list to the endpoint and I need to serialize it or to encode it? convert to to JSON? to Bytes?Any help will be appreciated.RegardsFollowComment"

Answer: "0Accepted AnswerHello,So the issue here is the predictor.predict command converts the data to the format necessary for the endpoint to understand, thus you need to serialize or encode the payload by yourself. To do this you can work with something like json.dumps(payload) or for a byte array json.dumps(payload).encode().If you want to use the predictor class this is taken care of by the serializer option. The serializer encodes/decodes the data for us and lets you simply call the endpoint through the predictor class. An example of this is the following code snippet:from sagemaker.serializers import IdentitySerializerfrom sagemaker.deserializers import JSONDeserializerserializer=IdentitySerializer(content_type="application/json")Hope this helps!To check out the various serializer options that can work for your different use cases check the following link.Serializers: https://sagemaker.readthedocs.io/en/stable/api/inference/serializers.htmlEdited by: rvegira-aws on Jul 22, 2021 9:22 AMEdited by: rvegira-aws on Jul 22, 2021 9:24 AMCommentSharervegira-awsanswered 2 years ago0Thanks rvegira-aws,I changed the approach, instead of using the "invoke_endpoint" method, I have used the predictor class as you suggested and this has fixed the issue.Regards.CommentSharehugofloresanswered 2 years ago0I faced the exact problem when building models for my website, thanks for the questionCommentShareAWS-User-8103096answered a year ago"


Question: Need help in upgrading the aurora MYSQL 5.7 to MYSQL 8 [URGENT]

"we are facing an issue in upgrading our aurora MySQL 5.7 instance to MYSQL 8 instance.The procedure we follow is as follows.We created a snapshot of Mysql aurora instance through the AWS console.Then we restore this snapshot to a new Aurora MYSQL 8 instance.In this process, we are getting the following errors that we are not able to resolve and these are from the internal table structure of the Aurora.mysql.rds_monitor table present in INFORMATION_SCHEMA's INNODB_SYS_TABLES table but missing from TABLES tablemysql.general_log_backup recognized by the InnoDB engine but belongs to CSV.Thanks in advanceFollowCommentJaccoPK a year agoMaybe you were using custom cluster or instance-level parameter groups for the 5.7 cluster and you did not add these during the restore. Make sure you create new custom parameter groups for Aurora MySQL 3 and select them in the Database options under Additional configuration on the Aurora console on the Restore DB cluster configuration page. https://aws.amazon.com/blogs/database/amazon-aurora-mysql-3-with-mysql-8-0-compatibility-is-now-generally-available/Sharedozenyommer a year agoFWIW - I'm running into this issue as well.  I tried what @JaccoPK suggested: created a non-default cluster parameter group and enabled slow/general logs, but that didn't help.  You can see the issue if you look at both of those tables:select * from information_schema.innodb_sys_tables where name like '%general_log_template';select table_schema,table_name,engine,row_format,update_time from information_schema.tables where table_schema like '%general_log_template';You can see it exists in the information_schema.innodb_sys_tables, but not in information_schema.tables.  I'm trying to find a way around it, but doing a simple CREATE TABLE IF NOT EXISTS mysql.general_log_template LIKE mysql.general_log; errors out with a permissions issue on mysql.   I'm still trying to find a workaround.   I'll post an answer if I find one.Sharedozenyommer a year agoHeads up - I think that second query is wrong. table_schema should be table_name.  But, I'm still unsure if it's a valid check or not.ShareAnkur Jain a year agoHi @JaccoPK, Thanks for the quick response. I tried the same but still got the same errors. Any further suggestions will be helpfullShare"

Answer: "1I have a problem very similar to the one reported in this topic. I am upgrading from Aurora 2 for MySQL to Aurora 3 and during the Aurora 2 snapshot restore process with 5.7.x the errors reported in upgrade-prechecks.log and also util.checkForServerUpgrade() ; which are preventing the upgrade process.mysql.rds_heartbeat2 - present in INFORMATION_SCHEMA's INNODB_SYS_TABLES     table but missing from TABLES tableAnd also Orphan Intermediate Tables. I tried to do the process mentioned in the documentation but I was not successful. Aurora for MySQL is database managed and for that reason I don't have access to physical files. If there is any way to solve this problem I would be very grateful. I have many database instances needing to update and we have this pending.Regards,CommentSharealdoribeirojranswered a year ago0I'm also having this issue when attempting to upgrade from Aurora 2 for MySQL to Aurora 3.  These must be remnants of past migrations since the entries in information_schema.innodb_sys_tables were also present in Aurora 1, but didn't prevent migrating to Aurora 2.Schema inconsistencies resulting from file removal or corruption   Error: Following tables show signs that either table datadir directory or frm     file was removed/corrupted. Please check server logs, examine datadir to     detect the issue and fix it before upgrademysql.rds_heartbeat2 - present in INFORMATION_SCHEMA's INNODB_SYS_TABLES     table but missing from TABLES table   mysql.table_migration_info - present in INFORMATION_SCHEMA's     INNODB_SYS_TABLES table but missing from TABLES tableCommentShareAWS-User-8230637answered a year ago"


Question: How to reserve the consecutive EIP?

"Looking for an answer for my AWS implementation,  does anyone have experience to reserve the Elastic IP range? for example 52.2.2.1 - 52.2.2.8.  If yes, does it charge more?I would assign my AWS instance with consecutive public IP addresses for easy management.  ThanksFollowComment"

Answer: "4Hi,You can request a contiguous block of Elastic IP addresses by cutting a ticket to VPC team.  You can open a case with Premium support and they can work with internal team to get assigned the contiguous EIPs for your account in desired region. You can request for IP address up to /24 subnet size. I hope this information helps.Thanks,CommentShareSUPPORT ENGINEERWilsina_Ranswered a year agoEXPERTToni_Sreviewed a year agoAWS-User-8431016 a year agoThanks, i am newbie still, how can I cut the ticket to VPC team? I am in US-East1, I don't have premium support subscribed.ShareBrettski-AWS EXPERTa year agoYou will need to subscribe to support to open a case; there are various pricing levels - any level is sufficient for this request. https://aws.amazon.com/premiumsupport/pricing/Share"


Question: CloudFormation is expecting JSONObject but it finds a string

"Hi all,I'm trying to follow this guide on setting up AWS Cognito -> Sendgrid instead of AWS Cognito -> SES as we are having issues with comcast domain with SES.Guide: https://www.maxivanov.io/send-aws-cognito-emails-with-3rd-party-esps/However, following the guide, it hits an error with the LambdaTrigger resource, specifically throwing:"ResourceType": "AWS::CloudFormation::Stack",            "Timestamp": "2022-12-07T21:53:49.981000+00:00",            "ResourceStatus": "UPDATE_ROLLBACK_COMPLETE"        },        {            "StackId": "arn:aws:cloudformation:us-west-2:654225271480:stack/simplehuman-iot-sendgrid/bb0cfdc0-74ca-11ed-bf3b-0247adce45f9",            "EventId": "LambdaTriggeI even tried returning a random JSON object but that doesnt change anything either. I added this at the end of the index.js file:return {        statusCode: 200,        body: "body of JSON response",        headers: {            'Content-Type': `application/json`,            'Access-Control-Allow-Origin': `*`,            'Access-Control-Allow-Headers': `Origin, X-Requested-With, Content-Type, Accept, Authorization`        },        isBase64Encoded: false    }Any advice on how I could send it as a JSONObject?FollowComment"

Answer: 0Hi.Why should you return a JSONObject?I think the target function is for sending emails to SendGrid.Could you please elaborate why you're trying to return a JSONObject ?I don't understand the relationship between the error of the LambdaTrigger resource and the return value of the function.CommentShareEXPERTiwasaanswered 6 months ago


Question: How delete a CFN stack (DELETE_FAILED: Internal Error)

"I have a stack ( AWS Cloudformer) of 2013.  No resources exists anymore. But deletion of the stacks fails with Internal error.There is also no option when retrying to skip resources ( no resources are displayed overthere).Also the CLI command ( with the all the logical ids in the --retain option) fails.I have only basic support, so I cannot ask  support to delete the stack.Anyone any idea how to get rid of this annoying old stack? :-)FollowComment"

Answer: "0Have you found a solution to the problem?Almost the same situation, only the stack was created yesterday, with disable rollback = true. It did not rise with a custom resource timeout error. . After that, I tried to delete it, and it didn't even start deleting already created resources. There are no API errors in CloudTrail, just DELETE_FAILED Internal Error. I tried skipping a resources, just like you tried skipping all resources through the cli. I deleted all the resources manually and tried again. And I always got:DELETE_IN_PROGRESS initiated by the userand after 40 - 60 minutesDELETE_FAILED Internal failureMoreover, I decided "well, let the stack remain in the DELETE_FAILED state". I will create a new one, since I deleted all the resources. But no, I can't create a stack with the same logical names and the same values because "{resource name} already exists in the stack (old stack arn)"I also don't want to pay for support when the problem is not on my side and there doesn't seem to be any way to fix it on my side.CommentSharerePost-User-4192252answered 10 months agorePost-User-4183690 8 months agoDid you ever find a solution?Share0Hi!  Good question and interesting case.A couple options:If you can see the stack and the resources, you could recreate the resources with the same logical resources and then try deleting again.  This may give you more options than what you're seeing above.For technical support from AWS, you could sign up and then cancel when the case is closed - this may be a prorated charge as well.  However, there is a minimum of 1 month for the charge.https://aws.amazon.com/premiumsupport/faqs/CommentSharejsoncanswered a year ago-1Hello!I would advise you to contact Support teams through your AWS accounts. They can help with potential resources dependencies and help you further.ThanksCommentShareNabilanswered a year agoeviman a year agoHi Nabil, with only Basic Support you cannot contact "Tech support".  Account support cannot help me. Switching to another support plan will cost me at least $29 a month.  To do this for a "malfunction"in AWS cloudformation, I think is a bit "over-done". But thanks for the advice.Share"


Question: Amazon mq - rabbit broker - enabling Oath 2.0 Auth Backend plugin

Is it possible to enable the oath2 backend for rabbit - https://www.rabbitmq.com/oauth2.html - within the Amazon MQ managed service?FollowComment

Answer: "0Hello,I understand that you would like to know about the possibility to enable the OAuth2 Authentication Backend(https://www.rabbitmq.com/oauth2.html) for Rabbit MQ within the Amazon MQ managed service.Unfortunately at present It is not possible to enable the OAuth2 authentication for rabbit within the Amazon MQ managed service. Amazon MQ only supports authentication based on traditional username/password authentication.[+] https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/rabbitmq-basic-elements-user.htmlFurther, Only plugins supported as of now are the plugins specified in the below documentation:[+] https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/rabbitmq-basic-elements-plugins.htmlCommentShareAws_user171999answered 3 months ago"


Question: Postgres export to S3

"I'm trying to export a snapshot to S3, but nothing actually gets exported and the export metadata file shows a PERMISSIONS_DO_NOT_EXIST skip error on every table. The docs say this is a permission error that can be resolved by granting permissions to the tables:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ExportSnapshot.html#USER_ExportSnapshot.postgres-permissionsHowever, I've done just that with my master user multiple times and nothing has changed.Basically the whole export metadata file looks like this:{"perTableStatus":[{"tableStatistics":{"extractionStartTime":"Apr 17, 2021 10:27:49 AM","partitioningInfo":{"numberOfPartitions":1,"numberOfCompletedPartitions":0}},"warningMessage":{"skippedTable":[{"reason":"PERMISSIONS_DO_NOT_EXIST"}]},"status":"SKIPPED","sizeGB":1.8310546875E-4,"target":"mailserver.public.account"}Am I doing something wrong?Any help would be appreciated.FollowComment"

Answer: "0A friend has suggested that it's the permissions at the time of backup that matter, so my efforts to export to S3 will remain forever fruitless. It'd be nice if the docs noted this.CommentShareFelzanswered 2 years ago"


Question: Connection refused in Lambda

"Hi all.  I have a Lambda question.  I am trying to use the SERP API for some scholar data with a Lambda function.   My function is working mostly for the first pull but am getting a connection refused for the follow up loop in my test.  should i split up the function into multiple (or put an API gateway)?It's the commented out line for const additionalcitations and getCitationsFromPaginationUrls that is getting the connection refused.  Why is it refusing connection on the second attempt (I can manually go there in my browser…there are no service blocks either)?(Note I ultimately want to add additionalcitations to citations and return that combined list.  What you see here doesn't take that into account as I am trying to debug).import * as https from 'https'; // Importing the 'https' packageexport const handler = async (event) => {  const serpapiKey = process.env.serpapikey; // Get the SerpAPI key from environment variables  const url = event.article_cited_by_serapi_link + '&api_key=' + serpapiKey; // Create the URL to make the SerpAPI request with the article_cited_by_serapi_link and API key  const response = await getPage(url); // Call the getPage function with the URL and wait for a response  const {paginationUrls,citations} = await getPaginationUrls(response, url); // Call the getPaginationUrls function with the response and URL to get an array of pagination URLs  //const additionalCitations = await getCitationsFromPaginationUrls(paginationUrls);        //return paginationUrls; // Return the pagination URLs array  return {citations,paginationUrls};}const getPage = async (url) => {  return new Promise((resolve, reject) => {    https.get(url, (res) => { // Make an HTTPS GET request to the specified URL using the 'https' package      let data = '';      res.on('data', (chunk) => {        data += chunk; // As data comes in, add it to the data variable      });      res.on('end', () => {        resolve(JSON.parse(data)); // When the response ends, parse the data and resolve the promise with the result      });    }).on('error', (err) => {      reject(err); // If there is an error, reject the promise with the error    });  });};//get the list of pagination URLs to later loop throughconst getPaginationUrls = async (response, url) => {  let paginationUrls = []; // Create an empty array to hold the pagination URLs  let citations = [];  if (response.serpapi_pagination) { // If the response includes pagination information    const otherPages = response.serpapi_pagination.other_pages; // Get the 'other_pages' object from the pagination information    const numPages = Math.ceil(response.search_information.total_results / 10); // Calculate the number of pages based on the total number of results and the fact that each page shows 10 results    for (let i = 1; i <= numPages; i++) {      paginationUrls.push(`${url}&start=${10*(i-1)}`); // Add a URL to the paginationUrls array for each page, with the appropriate start parameter    }  }  // Extract citations from organic results  if (response.organic_results) {    citations = extractCitations(response);  }    return {paginationUrls,citations}; // Return the paginationUrls array};FollowComment"

Answer: "0Hi - Thanks for reaching out. You may want to review Troubleshoot networking issues in Lambda https://docs.aws.amazon.com/lambda/latest/dg/troubleshooting-networking.html and see if this helps to troubleshootCommentShareEXPERTAWS-User-Nitinanswered 3 months ago0Hi Josh.The main doubt is whether your Lambda located in  a customer VPC created explicitly by you, or not?If not, Lambda  (which live in Amazon managed Lambda VPC) will have access to internet by default.If they are inside a VPC, there may be a need to have an Internet Gateway (IGW) and NAT Gateway as part of your setup, so that egress/outbound) traffic towards internet is allowed. Check this guide if your Lambda is in vpc: https://aws.amazon.com/premiumsupport/knowledge-center/internet-access-lambda-function/CommentShareEXPERTalatechanswered 3 months ago"


Question: StartDocumentTextDetectionRequest : Request has invalid parameters

"I am attempting to StartDocumentTextDetectionRequest but am getting the error of "Exception: Request has invalid parameters, Document: 2019/1/2/Document Name.pdf". Below is the code and the result. Any thoughts on what I am doing wrong? I am getting the correct file with path in the output while only providing root bucket and file name. I also have tried multiple variations of bucket, file name and path.using (AmazonTextractClient client = new AmazonTextractClient(RegionEndpoint.USEast1)){    var bucket = doc.Bucket;    var name = Path.GetFileName(doc.Path);        context.Logger.LogLine($"Bucket: {bucket}");    context.Logger.LogLine($"Name: {name}");        StartDocumentTextDetectionRequest request = new StartDocumentTextDetectionRequest    {        DocumentLocation = new DocumentLocation        {            S3Object = new S3Object            {                Bucket = bucket,                Name = name            }        },        NotificationChannel = new NotificationChannel        {             SNSTopicArn = "arn:aws:sns:us-east-1:RemovedForPublicPost"        }    };    StartDocumentTextDetectionResponse response = await client.StartDocumentTextDetectionAsync(request);    if ((int)response.HttpStatusCode < 200 || (int)response.HttpStatusCode > 299)        throw new Exception($"Failed to Queue Text Detection: {response.JobId}, with status: {response.HttpStatusCode.ToString()}");} Bucket: companyName.docs Name: Document Name.pdfException: Request has invalid parameters, Document: 2019/1/2/Document Name.pdf FollowComment"

Answer: "0I had this exact same issue yesterday with both StartDocumentTextDetection and StartDocumentAlaysis.  I'm pretty sure i tried this yesterday, but this morning, i removed the Notification block and it was accepted and is being analyzed.  Which leads me to think the role/assume-role is not configured correctly, or there is a bug in that portion of the api.So for now i'm just writing a parser to pull all pages based on NextToken.  Which i would need to do anyway.Hope this helps.JeffCommentShareRowJimmyanswered 4 years ago0Interesting, I am not sure I would have found that on my own. Sure enough though removing the NotificationChannel revealed another permissions error. Back to IAm I guess. Thank you.CommentShareSkylaranswered 4 years ago0I missed passing the RolARN to the NotificationChannel object. I am getting a successful post to StartDocumentTextDetectionAsync now. Now I get to figure out why my SNS Topic is never getting anything. But at least it's progress.CommentShareSkylaranswered 4 years ago"


Question: log4j issue with dynamodb-local - looking for release info and a date for what would be 1.17.3 with log4j 2.17

"This is regarding the recent (2021-12) issues with log4j (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228).The AWS page on setting up DynamoDB Local at https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.DownloadingAndRunning.html links to the most current version which shows at 1.17.2 in the README file. There's doesn't seem to be any listing of versions except for the XML file at https://s3.us-west-2.amazonaws.com/dynamodb-local/ and I can't find any resource indicating if there will be a release that bumps the log4j version up to 2.17, which fixes the latest issue found in that module.Is there a public resource indicating when we can expect a new version or even a public repo for the source code that we can watch for changes? I can't find anything indicating when we might expect a new version or where we can track releases.Should we stick with 1.17.1 which patches the issue (equivalent to using log4j 2.13.3, if I'm reading correctly) until there's a new version of dynamodb-local that upgrades to log4j 2.17?FollowComment"

Answer: "1DynamoDB Local recently patched version 1.17.1 which includes custom binary that patches Log4j v2.13.x to remove JndiLookup class. They have also released 1.17.2 which uses Log4j 2.16.x, which does not include the vulnerability CVE-2021-44228:From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removedFrom the download of version 1.17.2 you can assert that is uses this library:ls DynamoDBLocal_lib | grep Log4j-core.Furthermore, you can assert that this package does not contain the JndiLookup class:unzip -l DynamoDBLocal_lib/Log4j-core-2.16.jar | grep -i JndiLookupDynamoDB Local does not have a public facing repository, however, you can stay up to date with updates on the latest releases here.CommentShareEXPERTLeeroy Hannigananswered a year agoplumlee a year agoThank you sir. My concern with version dynamodb- local 1.17.2. is that there's an additional CVE for log4j 2.16.x - see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105. I think we will probably go with 1.17.1 until there's a newer release. Thank you for the info!ShareLeeroy Hannigan EXPERTa year ago@plumlee DynamoDB team intend to roll out updates which will bump the Log4J version to 2.17.X in the next 1-2 weeks. As soon as I am informed of the newest release, I will comment on here.Share"


Question: Direct Query - Data Referesh Tab : AWS Quicksight

HiPlease let know if there is any option to display last data referesh on AWS Quicksight Dashboard/report - its using direct query. It can be Tab or just kept displayed on top of the report.Source Data is in Redshift (Datasource)FollowComment

Answer: "1You can refer to the following article about your problemhttps://docs.aws.amazon.com/quicksight/latest/user/refreshing-data.htmlYou can use SPICE Data instead and you can refresh SPICEoryou could create a workaround by adding an additional field to your Redshift table that contains the timestamp of the last update. This could be a single row table that you update with the current timestamp whenever you update the rest of your data. Then, you could include this field somewhere on your QuickSight dashboard.CREATE TABLE last_update (update_time TIMESTAMP);-- Then, whenever you update your data:UPDATE last_update SET update_time = CURRENT_TIMESTAMP;Then, in your QuickSight analysis, you could add a visual that pulls in this update_time value and displays it as a KPI or in a single-value visualization.CommentShareEXPERTsedat_salmananswered 19 days ago"


Question: 502 Bad Gateway

"Hello, I have a problem and I don't know how to solve it, I don't have much experience with aws, I haven't done the configuration and neither has the web, I tell you, when creating an image of an ec2 the web returns 502 bad gateway, the web uses s3 could it be that when creating the image the s3 bucket was unlinked from ec2? the ec2 instance appears to have been rebooted while creating the image. Now the free space is larger than before the image was created.FollowComment"

Answer: 0does this question refer to the EC2 console or EC2 Image Builder console.?CommentShareAWS-User-0704110answered a year ago


Question: Creating ALB  : Why do we need to select multiple subnets when creating ALB ? We are going map the ALB to Target group anyways.

"Why do we need to select multiple subnets when creating ALB ? We are going map the ALB to Target group anyways.  The target group will have EC2 instances from different subnet , so why this additional step of selecting Subnets when creating ALB ?FollowComment"

Answer: "0Accepted AnswerHello,Subnets are tied to an Availability Zones, reason to choose 2 subnets is to actually select 2 Availability Zones, although you create 1 ALB it actually creates ENIs in each of the subnets/AZs you select. This is for the resiliency purposes, in the event that 1 AZ goes down you would still have ALB available via the 2nd AZ.Specific wording from the official documentationSelect two or more Availability Zones and corresponding subnets. Enabling multiple Availability Zones increases the fault tolerance of your applications.CommentShareEXPERTTushar_Janswered 7 months agoVPCloud 7 months agoBut when I am selecting a 'Target group', that target group will also have instances from different subnets and AZs. So if ALB is linked to the Target Group , shouldn't ALB be able to get the AZs + Subnets of the instances from the Target group ?   I understand the reason why we need multiple AZ but don't understand why we need to explicitly select them while configuring ALB. The ALB should be able to get that from the Target group EC2 instances.ShareTushar_J EXPERT7 months agoALB does not inherit AZs from the Target groups, these are 2 different entities. You could technically have ALB in 2 AZs talking to Targets in 3 different AZs.ShareVPCloud 7 months agoThank you !!Share"


Question: "Is it possible to use CloudFront Functions with CloudFormation, and have the source code in an external file?"

As the title. It looks from https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-function.html like FunctionCode must be inline in AWS::CloudFront::Function which … isn’t ideal for anything non trivial. Maybe just something missing in the docs though?FollowComment

Answer: "1The short answer to your question is that you cannot reference a CF2 as an external file. It needs to be inlined. As Franky mentioned, you can consider using Lambda@Edge instead. However, if you do want to use CF2, here are a few ways that I have accomplished what you are looking for.Consider using CDK to dynamically generate your CloudFormation template. This won't allow you to reference your CF2 js code externally in the template, but it will allow you to package your js code into a template at the time of template creation with CDK.My preferred option is to use CodePipeline + Lambda to insert the updated CF2 js code directly into the CloudFormation template. Using this approach you would setup your repo as a source in CodePipeline, so that any time you commit changes the pipeline invokes. The second stage is a Lambda that looks at the changed files in the commit, and if it includes a CF2 js file change, then take the entire contents of the js file, and replace the FunctionCode block in the CloudFormation template with the updated js file. It is a lot of work, and a little clunky, but if you have a pipeline running anyways then this can fit in nicely. Tbh, you don't even need to use CodePipeline, you could write your own scripts to manually do the same thing. CodePipeline just automates it.CommentShareJeremyAWSanswered a year ago0Thanks Franky and Jeremy.The situation here is that I was using a L@E function, but wanted to switch to CFF because (a) it's a little easier in the CloudFormation / tighter integration with CloudFront and (b) I have no idea what's going on with L@E longer term - CFF is the new hotness!The function itself is operationally very lightweight - it's just a redirect function based on the original path. But the source code is about 100 lines long (about 2/3 of which is a map of redirect locations) . So in this case being able to edit the code as an actual .js file would be much more convenient, AND I'd be able to unit test it. But I can't do that with inline code.Your option #2 Jeremy is ... ummm ... clever? But as you say a lot of work! :) For me this is just a one-js-file function, with a 2-resource CloudFormation template (the distribution, and the CFF function) . I really don't want to do anything to deploy other than sam deploy or aws cloudformation deploy.This is a situation where I don't want to use CDK because it's a piece of infrastructure that doesn't change very often, and IMO CDK apps require more "tending" over the long term than a vanilla CloudFormation / SAM app (see more on my thoughts on CDK here if you're interested: https://blog.symphonia.io/posts/2022-06-07_cdk_good_bad_scary).Can this become a feature request for CloudFront, in which case does anyone know how I request that?MikeCommentShareMike Robertsanswered a year agoJeremyAWS a year agoMike, see my other answer. I tried to leave a comment so you get a notification, but the comments are limited to 600 chars.Share0Hello,CloudFront functions should be small and light.If you got a large piece of code, please consider using Lambda@Edge which does support other sources of code.Comparison between CloudFront functions and Lambda function is available in this blog post: https://aws.amazon.com/blogs/aws/introducing-cloudfront-functions-run-your-code-at-the-edge-with-low-latency-at-any-scale/Please see if this documents helps:CloudFront distribution association with Lambda function: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-lambdafunctionassociation.htmlLambda function: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.htmlLambda function code: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-codeThank you.Regards,FrankyCommentShareFranky Chenanswered a year ago0Hi Mike, thanks for the context! Posting a new answer since the comment option limited my response to 600 characters.I agree, the ideal option is to support an operation similar to how Lambda@Edge is packaged using sam package/deploy. It might be possible to do this with aws cloudformation package, but I am not sure if it supports AWS::CloudFront::Function as a supported resource type. To my knowledge it does not, but I would be happy to be wrong in this instance!Re-thinking my option 2 above, I use that workflow as part of a much larger CodePipeline deploy workflow, but in this use-case it is un-neccessarily complex. I would instead just create a simple node app that performs some simple logic. Something like:node cf2packager --viewerReq viewer-req-function.js --viewerResp viewer-resp-function.js --template cf-distro-template.jsonThis would take the viewerReq and viewerResp js files which can be edited and version controlled independently, and then replaces the appropriate FunctionCode block(s) in the CloudFormation template and spits out a new template file. Then you can just run your aws cloudformation deploy.CommentShareJeremyAWSanswered a year ago"


Question: Glue incremental load

I am loading the data from Amazon RDS(mysql database) to Redshift using AWS Glue ETL and data catolgue. But I can't figure out how to do incremental loading(upsert)? Is there a way to create a filter/parameter on date while reading from source database to load only yesterday's data without using bookmarks?FollowComment

Answer: "0Using Bookmarks is recommended way when using Glue, however nothing stops you from passing a parameter to glue script [https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-pyspark-extensions-get-resolved-options.html]  and then generaly the query dynamically based on that parameter if you want.The other question is why you wanted to use Glue and not Redshift federated query instead which might be an easier option?CommentShareAlex_Tanswered 8 months agorePost-User-2747121 8 months agoCause i use Redshift Serverless which still have no Query  schedule , so even if i used federated query to run MV i will have to schedule using step function to be able to refresh and monitor extraction workflow.the issue of using the bookmark that i need only the data that is loaded yesterday and by default running the jobs after 12 AM will cause some unneeded data to be loaded by using bookmark which might affect my extraction logicShare0One option is to use DMS to incrementally load Redshift using MySQL as a source.  Here's a whitepaper on the topic: https://docs.aws.amazon.com/whitepapers/latest/optimizing-dms-with-amazon-redshift/optimizing-dms-with-amazon-redshift.htmlCommentShareEXPERTRajiv_Ganswered 8 months ago"


Question: IoT Analytics > Dataset from Service Managed Store

"Hello, I can't figure out how to create a dataset from a channel whose storage is a Service Managed Store.May you explain it to me?RegardsFollowComment"

Answer: "0Hi,to create a dataset you first use the CreateDataset API and to get your dataset content you use GetDatasetContent API. The latter API call returns a URL from which you can download your dataset content. Please take a look also at the Creating a dataset documentation.KR,PhilippCommentSharePhilipp Sanswered 10 months ago"


Question: FSx never connects

"Hello,I have been stuck on trying to mount FSx on ec2 instances and workspaces. Both are joined in the AWS managed active directory. The security group associated with FSx is the default wide open one. I've attempted this as the domain admin but always get network path not found. Any help would be greatly appreciated.Thank you.FollowComment"

Answer: "0Hi bank2600,Please review this troubleshooting guide: https://docs.aws.amazon.com/fsx/latest/WindowsGuide/unable-to-access.html. It provides a list of potential causes why you may not be able to mount your FSx for Windows file system, and how you can resolve the issues.Specifically, we recommend you make sure that the security group you’ve specified for your FSx file system has the required the inbound rules specified in Amazon VPC Security Groups: https://docs.aws.amazon.com/fsx/latest/WindowsGuide/limit-access-security-groups.html#fsx-vpc-security-groups.  Also make sure your client EC2 instances and WorkSpaces instances have the required outbound rules.Make sure that the file system DNS name and the share name are correctly specified. To manage your file shares, see Managing File Shares: https://docs.aws.amazon.com/fsx/latest/WindowsGuide/using-file-shares.html#managing-file-sharesMake sure that your VPC Network ACLs allow communication on the required network ports between your client instances and your Amazon FSx file system.CommentShareAWS-User-7221721answered 4 years ago0Hello,After I added the ports in the security group associated with fsx it's now working.Thank youCommentSharebank2600answered 4 years ago"


Question: Adding SSL certificate

"I'm new to AWS ,I have my ec2 instance and loadbalancer setup outside lightsail and my domain careerboat.io is inside lightsail now i am unable to choose loadbalancer for A record (no options available)So frontend guys getting ssl error on login page :)FollowComment"

Answer: "0Hi Sharath,To make sure I understand your setup correctly. You have a one EC2 instance and an ELB outside of Lightsail. Then you are using Lightsail DNS to manage the DNS of your domain.You will want to switch your DNS hosting to Route 53. Once that's done, you can set your ELB load balancer as an alias record. The following links can help you with switching your DNS hosting to Route 53:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/MigratingDNS.htmlhttps://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-routing-traffic-to-resources.htmlhttps://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer.html#routing-to-elb-load-balancer-configuringLightsail DNS is mainly used for managing your resources within the Lightsail environment. Whereas Route 53 is used for DNS routing for all other AWS services (though it can also be used to point to Lightsail resources).Regards,Eric BCommentShareEric_Banswered a year agoSUPPORT ENGINEERSumukhi_Previewed 10 months ago"


Question: AWS Marketplace SaaS Product Integration Testing - SNS subscriptions

"I am an engineer designing a product integration with AWS Marketplace so that we can be sellers.  I'm finding some of the documentation around what would pass testing in order for the product to be published a bit vague.  It seems testing can take a while, so I'd like to minimize the back and forth during that phase by getting clarity now.AWS docs only ever mention SQS as a potential subscription to the SNS topics created around AWS Marketplace entitlements and subscriptions.  Is this required for the product to be published?  Why not allow any of the other kinds of subscriptions available to SNS topics? I'm specifically interested in Lambda.https://docs.aws.amazon.com/marketplace/latest/userguide/aws-marketplace-integration-checklist.html here is one example of the language used making it seem like SQS is the only allowed (and therefore required) SNS topic subscription.Thanks in advanceFollowComment"

Answer: "0Accepted AnswerDuring the product creation process, you'll receive the actual Amazon Resource Name (ARN) to the SNS topic. For example: arn:aws:sns:us-east-1:123456789012:aws-mp-subscription-notification-PRODUCTCODE [+] and this SNS topic is created by AWS for marketplace notifications automatically. Please note that, the SNS topic is created and managed by AWS marketplace and doesn’t belong to your AWS account.The reason why AWS docs mentions SQS as a potential subscription to the SNS topics created around AWS Marketplace entitlements and subscriptions is because you can subscribe SQS to the SNS topic that was created in the AWS marketplace account because SQS supports cross account subscriptions from SQS console while a Lambda subscription needs to be created from SNS console to which you will not have access as the SNS topic resides in an AWS managed account. Furthermore, as a workaround you can use Lambda to poll SQS for your use case and the message flow will be as follow:SNS -> SQS -> Lambda[+] https://docs.aws.amazon.com/marketplace/latest/userguide/saas-notification.htmlCommentShareSUPPORT ENGINEERrePost-User-3624199answered 2 months agoJT 2 months agoI see now.  Thank you for your answer.Sharecc_clement 3 days agoHello,Thanks for that answer. I have created an AMI which is currently on private visibility, and I did not receive any ARN for the SNS Topic.The documentation mentions the same thing:"During the product creation process, you'll receive the actual Amazon Resource Name (ARN) to the SNS topic. For example: arn:aws:sns:us-east-1:123456789012:aws-mp-subscription-notification-PRODUCTCODE"So when exactly do I get this ARN SNS Topic, and how? I tried replacing this ARN with my account ID and product code but it doesnt work :(Thanks a lot for your help!Share"


Question: SimpleAD and CDK: How to reference IP addresses?

"A SimpleAD has two IP addresses. We want to set up two A-records in a hosted zone that point to those IP addresses.In the A-record code we tried this (simpleAD is the constructed SimpleAD):target: route53.RecordTarget.fromIpAddresses(simpleAd.attrDnsIpAddresses[0], simpleAd.attrDnsIpAddresses[1]),.. but got "Error: Resolution error: Resolution error: Cannot add elements to list token, got: #{Token[TOKEN.163]},.."We tried adding a dependency (aRecord is the constructed A-record):aRecord.node.addDependency(simpleAd) ;... but no change.So how do we refer to those addresses in a way that lets them be used in the A-record construction?Any ideas gratefully accepted.Regards, K.FollowComment"

Answer: "0With the help of this post:https://github.com/aws/aws-cdk/issues/6475I ended up with this (working) solution:  target: route53.RecordTarget.fromIpAddresses(      cdk.Fn.select(0, simpleAd.attrDnsIpAddresses),      cdk.Fn.select(1, simpleAd.attrDnsIpAddresses),    ),  Thanks, K.CommentSharekaueranswered 2 years ago"


Question: Textract did not Read very clearly the Color of Eyes and  Gender in Driver License But Azure Form Rec. CAN? Why? Excel sheet also show fields not used in some driver license.  FORMS R was OOB!

Iloaded my direr license from new jersey and it was very high quality cliear -- Textract failed to get the Eye color and gender  that was at the botton of teh licemseFollowComment

Answer: 0Please refer to the list of normalized keys which Analyze ID can support https://docs.aws.amazon.com/textract/latest/dg/identitydocumentfields.htmlCommentShareaws-doshsanswered 4 months ago


Question: HTTP APIGW with VPCLINK

"Hi All,I have built an HTTP APIGW with VPC LINK to connect to ALB in VPC. Now I want to understand the use of security groups in VPC LINK. It doesn't matter what inbound rules I put in the SG, I can connect to backend resources from the internet. I was under the impression that I will be able to control the access via security groups in the vpc link but it doesn't seem to work like that.I am looking to open access to a list of IP's only. As HTTP API GW doesn't support the resource policy or waf, I was hoping to leverage VPC Link SG for this.Any ideas?FollowCommentagustin 7 months agoHello there, were you able to find out how to solve it? facing the same issue here :)Share"

Answer: "0You can use this chart to determine whether to choose HTTP or REST APIs - https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-vs-rest.htmlIf WAF capabilities are important to you, then definitely go with REST APIs.Is there any particular feature in HTTP that you care about, that's not present in REST APIs?CommentShareEXPERTIndranil Banerjee AWSanswered a year ago"


Question: datasync transfer and verification errors to S3 fails with verification failed to S3 Put Object

"I am seeing an error that the execution failed with "Complete errorLogs with verification error, Tranfer and verification completed. verification detected mismatches. Files with mismatched are listed in cloudwatch Logs" Furtherchecking the cloudwatch logs we do see the following error."[ERROR] Deferred error: s0:c58 close (""s3://test//yesh/test.txt""): 40978 (s3 Put Object Failed)"Any input on this error?FollowComment"

Answer: "1Accepted AnswerThis error occurs because the destination S3 bucket is encrypted with customer managed KMS keys and the IAM role and KMS policy do not have sufficient permissions to perform the Put object action. Though some customers added limited KMS keys it still fails as "kms:GenerateDataKey" is not present on both IAM role policy and KMS policy.ResolutionCheck the following:Check whether the S3 bucket is encryption enabled and the type of KMS.Make sure the IAM role policy and KMS key policy with this role has the following minimum permissions:"kms:Encrypt","kms:Decrypt","kms:ReEncrypt*","kms:DescribeKey","kms:GetPublicKey","kms:ReEncrypt*","kms:GenerateDataKey",Make sure the IAM role Trust policy is as per the Example 1: in this documentation:https://docs.aws.amazon.com/datasync/latest/userguide/using-identity-based-policies.htmlCommentSharemadhuri_danswered a month agoEXPERTalatechreviewed a month ago"


Question: Amplify reached app limit

"#Amplify#CLII have only one app in my account, only one region eu-central-1When I run command amplify init, I received error  You have reached the Amplify App limit for this account and region.Limit is 25 apps Per region, but I have only one.User credentials was valid.FollowComment"

Answer: "0Are you use the NEW AWS Account? If yes, then the new Account might have lower quota in the beginning and raised up automatically based on your usage. You can check the service quotas by the link (https://eu-central-1.console.aws.amazon.com/servicequotas/home/services/amplify/quotas) to confirm the quotas and then issue a quota increase ticket which is/are adjustable.Reference: https://docs.aws.amazon.com/general/latest/gr/amplify.html#service-quotas-amplifyCommentShareBard Lananswered 10 days ago"


Question: How to route HTTP traffic from external internet to an AppMesh ECS Fargate service

"Our traffic is coming from the public internet to WAF then to external ALB then to ECS service in Fargate via a Target Group. This TG IP address target is updated by ECS every time a service is redeployed.But the new microservice is in AppMesh, and microservice traffic routing is done by Service Discovery rather than ALB.We tried to route traffic from external ALB to ECS Fargate AppMesh service but found literally zero examples of how to do it properly with no downtimes during redeployments.When AppMesh microservice is deployed it does not update IP address in the above mentioned TG, but only in the Service Discovery.We can't point our Target Group to an AppMesh service! If we point to an IP address it will change with next deployment.How to route HTTP traffic from external internet to an AppMesh ECS Fargate service in a maintainable way, so that we can reconfigure or redeploy or reroute our services at will with zero downtime?FollowComment"

Answer: "1Hello,I had done just that in the past, haven't used much of AppMesh for a little while, and really wish I had documented it !But in a nutshell, you can do it in at least 2 ways:the service(s) that is behind the ALB, have the Listener Rules send the traffic to the containers, regardless of whether they use AppMesh or not. Then for the rest of the traffic between the services, it will work of its own accord, following the Mesh rules (services, routers etc.) that are defined.Second option could be to use an AppMesh gateway, have the LB send all the traffic to that service, and then again, AppMesh will take over for the rest of the traffic to follow.I will try to dig out the examples I had. I did all that using x-appmesh in ECS Compose-X but due to very little use-cases / need coming the AppMesh way, I haven't given it much love for a little while.Just get the traffic from your ALB to your containers, it will work just fine (says he not touching it in a year).CommentShareJohnPrestonanswered a year agoVasyl a year agoHello John. Thanks for the answer!way 1) You say "have the Listener Rules send the traffic to the containers". That is easy via TG as IP address. But after service redeploys in AppMesh the IP will change, the TG won't be updated with the new IP, so the traffic won't go any more. Or I didn't understand what you mean.way 2) I looked up "AppMesh gateway" and found nothing in the internet. What do you mean exactly? NGINX or something?ShareJohnPreston a year agoHey @VasylSo, here is what I meant by gateways: https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_gateways.htmlAnd for your first comment, I am not too sure to follow. Sure your TG will update the target to send traffic to the container, if you configured your ECS service to automatically use a target group, ECS will take care of updating the TG Targets IP as they go.ShareVasyl a year agoThank you John! We're digging further both your recommendations.ShareVasyl a year agoI did some digging John. Basically, it was never implemented for AppMesh: https://github.com/aws/aws-cdk/issues/19842Share0Hello again @Vasyl,I just reworked/re-enabled x-appmesh this weekend and updated my demo apps to test/showcase.python3 -m venv venvsource venv/bin/activatepip install pip -U; pip install "ecs-composex>=0.22.0"git clone https://github.com/compose-x/composex-testing-appscd composex-testing-apps# Optionally use image specific tag#export IMAGE_TAG=2022-06-13# Render the templates ecs-compose-x render -d templates --format yaml -f docker-compose.yaml -f x-appmesh.yaml  -n demo-appmesh# Deploy to AWS # will create VPC/DNS/CloudMap/IAM/Services - basically everything it needs ecs-compose-x up -d templates --format yaml -f docker-compose.yaml -f x-appmesh.yaml  -n demo-appmeshThe ingress from the "internet" is done via the ALB that will send the traffic to app01 which is our ingress service.Hope this helps in your ECS + AppMesh journey.CommentShareJohnPrestonanswered a year ago"


Question: Get AssetId of Dynamic Slice

"Hello!I'm having problem getting an assetId back from the AssetCatalogRequestBus:AZ::Data::AssetId defaultSliceAssetId;AZ::Data::Asset<AZ::DynamicPrefabAsset>defaultSliceAsset;EBUS_EVENT_RESULT(defaultSliceAssetId, AZ::Data::AssetCatalogRequestBus, GetAssetIdByPath, "slices/defaultcharacter.dynamicslice", AZ::AzTypeInfo<AZ::DynamicPrefabAsset>::Uuid(), false);if (defaultSliceAssetId.IsValid()){defaultSliceAsset.Create(defaultSliceAssetId, true);EBUS_EVENT_ID(GetEntityId(), SpawnDirectorBus, SetDefaultAsset, defaultSliceAsset);}AZ_Assert(defaultSliceAssetId.IsValid(), "**Character Manager** defaultSliceAssetId is invalid.");I have "slices/defaultcharacter.slice" in the main asset directory. And "slices/defaultcharacter.dynamicslice" is generated in the Cache directory by the Asset Processor.I feel like I've gone through every permutation, trying different things. I've run out of ideas.Does anyone have a code snippet they can share; or know what the problem is?Follow"

Answer: "0Accepted AnswerMoved above code out of a system component. Instead I'm sending an Init EBUS_EVENT from GameStartup. It was trying to find assets too soon; and I couldn't find a suitable "RequiredServices" component to order my system component after. It works now.SharerePost-User-3220036answered 6 years ago0"Should the asset processor be creating a dynamic slice in the main asset folder as well?" How i know no *.dinamicslice created only in cache folder. But you can try use spawner component in editor to spawn your dynamiclslice. Create it hands and see whats happening.SharerePost-User-0150549answered 6 years ago0I've tried autoRegisterIfNotFound and didn't work.It get's through AZ::Data::AssetRegistry::GetAssetIdByPathauto entry = m_assetPathToId.find(CreateUUIDForName(assetPath));...and just doesn't find it in m_assetPathToId.REMOVEDUPLOADREMOVEDUPLOADI'm not sure what else I can try. Should the asset processor be creating a dynamic slice in the main asset folder as well?SharerePost-User-3220036answered 6 years ago0Hi Kyai all looking good. You shore is file path correct ? And try set true (registers the asset if not already in the catalog.)GetAssetIdByPath, "slices/defaultcharacter.dynamicslice", AZ::AzTypeInfo<AZ::DynamicPrefabAsset>::Uuid(), true);p.s.This is from my code, not dynamical asset, but pipeline is similar.AZ::Data::AssetId meshAssetId;const string meshName = "objects/cube.cgf";EBUS_EVENT_RESULT(meshAssetId, AZ::Data::AssetCatalogRequestBus, GetAssetIdByPath, meshName, AZ::AzTypeInfo<AZ::Data::AssetData>::Uuid(), true);if (meshAssetId.IsValid()){// assign a the mesh asset (.cgf)EBUS_EVENT_ID(m_voxelBrushShapeEntity->GetId(), LmbrCentral::MeshComponentRequestBus, SetMeshAsset, meshAssetId);}SharerePost-User-0150549answered 6 years ago0@REDACTEDUSERstatic void GetRequiredServices(AZ::ComponentDescriptor::DependencyArrayType& required){required.push_back(AZ_CRC("AssetDatabaseService", 0x3abf5601));required.push_back(AZ_CRC("AssetCatalogService", 0xc68ffc57));required.push_back(AZ_CRC("AssetProcessorConnection", 0xf0cd75cd));}But that didn't work either.Edit: I'm going to try moving this Entity out of the system component; and load it after the core game stuff. We'll see if it's actually getting enough time to load assets into the database. To be fair, even with the "required" system components registered, this is error-ing out super early on load.SharerePost-User-3220036answered 6 years ago"


Question: User not receiving any email after workspace creation

"I am testing out Amazon's workspaces and went through the process to create my first one (standard Linux from the free trial). After creating the workspace, and then checking on its status via the Workspace management UI, I could see that the workspace had been created; it took about 15 minutes to transition from "PENDING" to "STOPPED". From the management UI I can start/stop the workspace and it's status reflects it's current state ("STARTING" to "AVAILABLE" and "STOPPING" to "STOPPED").This issue is my user (me) never received the invitation email, so I can't actually log into it. I tried to get into it since I could see the registration code in the management UI, but I'm guessing that the initial creation must have some random default password for that first login, which clearly I don't have. I have tried to use the "Invite User" and "Edit User" options from the management UI in an attempt to re-send the email, but every time I select one of those options I get an error that simply states:"An Error Has OccurredIf you continue to experience an issue contact the AWS Support Team on the community forums and via AWS Premium Support at: https://us-west-2.console.aws.amazon.com/support/home"And so here I am. At this point I'm thinking I just delete the workspace and start the process all over, but I'm not sure how that affects the free-trial. After all, I don't know if this workspace thing will work for my needs, so I definitely want the free trial time in order to test it out.Any suggestions?Thanks!ChrisFollowComment"

Answer: 0Ultimately I solved my own problem by deleting the workspace and re-creating it. Seems that didn’t impact my free trial (I was initially hesitant to do that for fear of losing out on the try out period).CommentSharehulabearanswered 4 years ago


Question: Connecting to instance in private subnet through Network Load Balancer

"I have a NLB in public subnet with a static ip address and an EC2 instance in private subnet. Connection to EC2 is not working for TCP protocol on port 6000. I have a NAT gateway in public subnet and route table of private subnet is pointing to 0.0.0.0/0 and NAT gateway. EC2 security group, inbound connection is open for 0.0.0.0/0 on port 6000. NACL for both subnets  allows inbound and outbound connections. Route table of public subnet has an IGW. What might be missing in the configuration to make it work?FollowComment"

Answer: "0https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancer-getting-started.htmlhttps://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-troubleshooting.htmlCommentSharerePost-User-5208427answered 2 months ago0Does the route table for the private subnet have a default rule of <VPC-CIDR>->Local? If not, you should add that back.CommentShareEXPERTkentradanswered 2 months ago"


Question: SMS Patching Fails for ALL Windows Server 2019 EC2 Instances

"I just starting using SMS to manage Windows 2019 Server EC2 instance patching (security updates). I noticed that by default, AWS prevents Windows OS to automatically run Windows Update. I followed the instructions for SMS Quick Setup and the Patching of my servers are failing with the following error message: (I have been searching ALL day for a resolution to this. Modifying registry settings, running DSIM commands, etc. Nothing helps. Seems like some type of certificate issue but I can't resolve it).Has anyone else had issues with getting SMS to patch AWS Windows Server 2019 EC2 instances?Invoke-PatchBaselineOperation : Exception Details: An error occurred when attempting to search Windows Update.Exception Level 1:Error Message: A certificate chain processed, but terminated in a root certificate which is not trusted by the trustprovider. (Exception from HRESULT: 0x800B0109)Stack Trace:    at WUApiLib.IUpdateSearcher.Search(String criteria)at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateAgent.SearchForUpdates(StringsearchCriteria)At C:\ProgramData\Amazon\SSM\InstanceData\i-03638bdca902ef8fd\document\orchestration\86ed2eda-065a-49d3-b084-69bfc89c143d\PatchWindows_script.ps1:233 char:13$response = Invoke-PatchBaselineOperation -Operation Scan -SnapshotId ...        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~CategoryInfo          : OperationStopped: (Amazon.Patch.Ba...UpdateOperation:FindWindowsUpdateOperation) [Invoke-PatchBaselineOperation], ExceptionFullyQualifiedErrorId : Exception Level 1:Error Message: Exception Details: An error occurred when attempting to search Windows Update.Exception Level 1:Error Message: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. (Exception from HRESULT: 0x800B0109)Stack Trace:    at WUApiLib.IUpdateSearcher.Search(String criteria)at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateAgent.SearchForUpdates(String searchCriteria)Stack Trace:    at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateAgent.SearchForUpdates(String searchCriteria)at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateOperation.SearchAndProcessResult(List1 kbGuids)      at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateOperation.SearchByGuidsPaginated(Lis   t1 kbGuids, Int32 maxPageSize)at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateOperation.FilterWindowsUpdateSearch(List`1 filteringMethods)at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.FindWindowsUpdateOperation.DoWindowsUpdateOperation()at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateOperation.DoBeginProcessing(),Amazon.Patch.Baseline.Operations.PowerShellCmdlets.InvokePatchBaselineOperationfailed to run commands: exit status 4294967295FollowComment"

Answer: "0Accepted AnswerHello! SSM uses the Windows Update APIs to install updates. This means that any issues reported by Windows Update are sent back to SSM. Manually using Windows Update would produce the same result, as you are currently experiencing.The way Windows Update works, it downloads updates in the .CAB format. These updates are signed with a certificate. On a very high level, the certificate is evaluated to make sure it's not expired and that it has been emitted by a CA (certification authority).This is part of the certificate chaining process. Under normal conditions, the CA will be from Microsoft. The Windows OS must trust the CA used, so the root CA certificate should be present under the Trusted Root and Trusted Publishers certificate store, which you can see when running mmc (Microsoft Management Console) and adding the Certificate snap in tool.A common issue for the 0x800B0109 message happens when you use WSUS. WSUS is a service that can be installed on Windows Servers to allow downloading and installing updates. It's useful if you have multiple machines and you want to save on some internet bandwidth, or if you want granularity  when controlling the installation of patches.  WSUS needs a self signed certificate tied to the WSUS server, and this certificate needs to be deployed via Group Policy. Therefore, here are some questions that might help pinpoint the issue:Are the instances joined to a domain?Are you using WSUS or any mechanism that would change the source of the Windows Update download location? If so, make sure that your WSUS certificate is not expired and that you have a group policy in place that installs this certificate on every machine that wants to install updates.Do you have any group policies in place to configure Windows Update? You can see this by opening the Local Group Policy Editor (if not joined to a domain) or by going to the Group Policy management option on a machine that is joined to the domain and has this tool installed.  The group policy is located under Computer Configuration > Administrative Templates > Windows components > Windows Update. You can also run the command "rsop.msc" in any of the affected instances to view all group policies applied to the instance.Do the instances have direct access to the internet, via an Internet Gateway or NAT Gateway? Ensure that the security group and Network ACL used by the instances have outbound rules to allow the traffic.If you are not using WSUS or the instances are not joined to a domain, this suggests that the OS doesn't trust the Microsoft certificate, which is less common. You might want to run Get-WindowsUpdateLog as explained in the Microsoft documentation https://docs.microsoft.com/en-us/powershell/module/windowsupdate/get-windowsupdatelog?view=windowsserver2022-ps to troubleshoot. There are multiple tutorials that explain how to reset all Windows Update components, which you might have tried already. Due to the AWS Shared Responsibility Model https://aws.amazon.com/compliance/shared-responsibility-model/ this is a Windows OS issue and AWS has no visibility inside the running OS for your own security and privacy. However, I trust that the above information leads you into the right direction. Let me know if you have any questions. Have a great day!CommentShareSUPPORT ENGINEERFrancisco_Lanswered a year agoKevinM_BMW a year agoFrancisco! Thank you for this detailed explanation. Here is my response:All these servers were provisioned from an AWS Windows 2019 DC AMI. Nothing was changed regarding certificates or installation of 3rd party software. In fact, AWS disables any windows automatic updates by default.These servers are NOT part of a Windows AD domain structureI am not using a WSUS server.All these servers have internet access via a web proxy that our central IT department manages for us.Out of 6 AWS EC2 instances, only 2 are able to run the Windows Update Service. I also have that working using AWS SMS. I compared the Certs from the working servers to the non-working servers. All Microsoft Trusted Certs, Intermediate, etc match. I'm baffled.I will check the Group Policies next.Thanks again for the insigths FranciscoShare0Hello Kevin, here are some additional things you might try:Check that all instances have configured the Proxy you are using. Particularly, check the instances that are working and check their proxy configuration, as well as the Windows route table with the route -n command. Some proxies have their own certificate, particularly to access HTTPS content. If the proxy has its own certificate, ensure that the instances trust it. You can also check the proxy logs. You can confirm the proxy configuration at the instance level with the netsh winhttp show proxy command.Consider disabling the proxy and have the instance connect to the internet directly for testing purposes (with an Internet Gateway if launched on a public subnet, or via a NAT Gateway if launched on a private subnet).Ensure that they have the same networking configuration at the AWS level (security group, network ACL, route table). If the instances are on different subnets or even VPCs/Regions confirm that the instances are able to the Proxy.After running the Get-WindowsUpdateLog PowerShell command, find out any individual patch shown in the logs and attempt to download and install manually from the Microsoft Update Catalog https://www.catalog.update.microsoft.com/Regards,CommentShareSUPPORT ENGINEERFrancisco_Lanswered a year agoKevinM_BMW a year agoWill do. Great recommendations. I will try that. I will also try to spin up a new Windows 2019 EC2 instance and see if that also has any issues.ShareKevinM_BMW a year agoSo, been spending way too much time on this issue. So I decided to launch a brand new Windows 2019 instance from the EC2 Console. Once it was running I connected to it and immediately tried to execute the Windows Update again. Failed.I understand your comments about the proxy. The same proxy is being used for all the EC2 instances on my private VPC. 2 of them work, the other 4 (and including the new instance) do not.I will try to contact my internal proxy support team to see if they can help.The next test I will do is to launch a new Windows Server in a Public VPC and see if the windows update runs there. If so, then I would tend to think this has something to do with the proxy server.ShareKevinM_BMW a year agoIt was a misconfigured proxy server!!! Windows update is working again.ShareFrancisco_L SUPPORT ENGINEERa year agoKevin, I'm glad you were able to solve this! Since some machines were working with the proxy, it would be useful to have an idea what type of proxy issue was causing this, as this would help other customers. Have a great day!Share0Questions that might help find an answer:what version of SSM agent is running?Is it based on an AWS AMI?Is AWS CLI loaded?Do manual windows updates work?Have you run patch baseline with success?With so many variable it can be hard to troubleshoot but looks like either windows cert or aws cert is missing.For AWS cert latest agent and CLI should resolve.For Windows cert this would cause manual update to fail but windows guide should show how to resolve that.CommentShareRobin Fordanswered a year agoKevinM_BMW a year agoFollow up:I am running latest version of SSM agentYes, they are all Windows Server 2019 AWS AMIIs the AWS CLI required to be installed on ALL the EC2 instances?Manual windows updates do not work.Nom patch baseline fails tooI am leaning toward a certificate chain issue with Microsoft. I am getting loads of CAPI2 error messages. I did find one server in my group that is working properly, so I checked all the Certificates there and exported them. Then I imported the Certs into the server that will not run Window update. No luck. Strange thing is that the servers have not been modified since AWS launched them 3 months ago. This is a tough one!Thanks for the reply RobinShare"


Question: Use a MMCM to generate arbitrary frequencies in CL?

"Hi,for our project, we have a toolchain that tries to find the optimal frequency for a design. It does so by configuring a Clocking Wizard, building a bitstream and then evaluate the timing report. This works perfectly on our on-premise hardware, but not on the F1 instances.Placing a Clockwiz/MMCM in the CL leads to an error about sub-optimal placement of a MMCM-BUFGCE-MMCM cascade. This error can be demoted to a warning. But unless the output of the MMCM is a multiple of the input clock (like 62.5 MHz from the clk_extra_a1 -> 250 MHz output), there are timing violations. While the design works for 250 Mhz, using 225 MHz causes a WNS of of about -0.976.I tried changing the buffer settings, or even a PLL instead of the MMCM, but none of this works.I understand that I'm limited with my options, as I have no access to the Shell reconfiguration area, so I cannot place my MMCM in the recommended way ("The MMCM-BUFGCE-MMCM cascade pair can use the dedicated path between them if they are placed in vertically adjacent clock regions and in the same column (LEFT/RIGHT) of the device.").Is there any other supported way?Why doesn't the shell just expose a differential clock to the CL?FollowComment"

Answer: "0Hello,Please refer to:https://github.com/aws/aws-fpga/blob/master/hdk/docs/dynamic_clock_config.mdFor details on finer control of the Shell sourced clocks.  Also note the interfaces to the Shell are synchronous to clk_main_a0, so if you generate your own clock in the CL, you must synchronize the interfaces to the Shell to clk_main_a0.  This may be the cause of your timing violations.Thanks,-AsifCommentShareawsasifanswered 4 years ago0Thanks, but I already know that document. The most important statement being "This will still not permit any clock value to rise above its ingested value.". I get violations as soon as my clock cannot be generated by multiplying the shell clock with an even number. So while 250 MHz does work, 225 MHz and 275 Mhz both do not work. And I cannot reach 275 MHz when building with 250 MHz.Please see this screenshot:http://img.ober-mail.de/2019-06-08_17-24-33-8c9613ad-fcb1-44b4-b658-d2fca9fa4425.pngI know communication with the shell must be sync to clk_main_a0. I'm using AXI Interconnects to ensure this. But as you can see, the timing violation is not from CDC.CommentSharemiobanswered 4 years ago0clk_extra_b0 max frequency in the clock recipes is 450MHz.  Does that give you the range you need with the configurable clock frequencies?Thanks,-AsifCommentShareawsasifanswered 4 years ago0I don't see yet how that would help me.Let's say I have a given design. I now want to find the maximum frequency for it. Our toolchain starts multiple runs with different frequencies and finds the highest. It does so by changing the parameters of the MMCM and evaluating the timing report.So you suppose I just use a 450 MHz clock for my design and build it without MMCM in the CL? Most likely this will result in timing violations. Ok, I can build an AFI anyway and load it. But now how do I know how far I have to downclock it?CommentSharemiobanswered 4 years ago0What you can do is time the design at 450 and see what is your worst slack. Then you can back off the clock by that amount.Thanks,-AsifCommentShareawsasifanswered 4 years ago0Hi,thanks for this suggestion, but I think this would not be feasible, because P&R stops after it determines the timing cannot be met. So the WNS is worse than it could possibly be. I found that for ISE there was an option to set the effort to "continue on impossible", which would try to find the best timing even if constraints cannot be met. It looks like there is no such setting for Vivado.Nevertheless, it turned out the "Safe Clock Startup" setting of my clocking wizard was to blame for the timing failure, because this inserted another BUFGCE into the design. I have now disabled this option and can build my designs with all frequencies. Hopefully I will not run into other issues now.CommentSharemiobanswered 4 years ago0Disabling "Safe Clock Startup" in the Clkwiz was the solution.CommentSharemiobanswered 4 years ago0Hi Miob,I'm attempting to do something along these lines.Once you generate a clocking wizard how do you point sdaccel to the IP? Right now I get a compile error that the IP is not found and I haven't figured out how to properly pull it into the build. Any help or pointers would be appreciated.ThanksCommentSharesimonSNanswered 4 years ago0Hi,sorry, but I'm not using SDAccel - unfortunately I can't help you with this :(CommentSharemiobanswered 4 years ago"


Question: TGW Multicast scalability

"A customer has asked the following question:"What is the scalability of Transit Gateway based multicast?  For example, when 10 VMs are created within a single Placement Group Cluster, can we have 5 multicast sessions, each transmitting at 12Gbps?"I'm assuming that the EC2 acting as the multicast source would be limited to the normal 5Gbps bandwidth for single-flow traffic, which would be the limiting factor here, but wanted to check that multicast traffic wasn't treated differently in some way and hence subject to different limits. I'm also assuming that the multicast group address wouldn't be counted as being within the cluster placement group and so wouldn't get the 10Gbps limit instead.Could someone more knowledgeable validate my assumptions please!Thanks!FollowComment"

Answer: "0Accepted AnswerMulticast is implemented by TGW, which means that all packets are first forwarded to the TGW service and then copied and forwarded out from there on a unicast basis. Therefore, this is not a multicast service that should be thought of as a very high bandwidth or very low latency service. It's not slow but it has some overhead. The customer should test to see if it meets the customer's throughput and latency requirement, but it will not be nearly as fast as direct communication within a cluster placement group.CommentShareMark Ryland (AWS Security)answered 3 years ago"


Question: Lambda API Calls duration

"I have a lambda function that makes calls to different aws services. For example: DynamoDB, CodeCommit, SES.My problem is the one call's duration. codecommit.getMergeOptions() for some reason ( I want to know which )  this call last too much compared with others.For example codecommit.getDifferences last 300 ms but codecommit.getMergeOptions() 900 ms.Why that happen?FollowComment"

Answer: 0Accepted AnswerDifferent services and different API calls within services do different tasks. How long the API call takes to return is going to depend on how that particular API is implemented; the task it is performing; dependencies it has on other services that it has to call. So it's not surprising that some things take longer and that some calls take longer than others.Is there a problem you're trying to solve here that we can help with?CommentShareEXPERTBrettski-AWSanswered a year ago


Question: Strange event for in Aurora RDS

I found this message in  Event section of Aurora Panel"The database activity stream for this instance is experiencing unexpected issues. Activity records may be lost until connection is restored"Anyone know what this means?FollowComment

Answer: "1Accepted AnswerDatabase Activity Streams (DAS) is a feature available in Aurora that generates streams into Kinesis for any database activity. You can find details here - https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/DBActivityStreams.htmlFrom the error message, it appears that during the period this problem lasts, records won't get generated into the Kinesis Data Stream created by the Aurora DAS, for any activity on the database, which could be DDL, DML or DQL commands.CommentShareEXPERTIndranil Banerjee AWSanswered 10 months ago"


Question: "ReferenceError: require is not defined in ES module scope, you can use import instead"

"Trying to follow a DynamoDB + Lambda + API Gateway tutorial: http-api-dynamo-db.const AWS = require("aws-sdk");const dynamo = new AWS.DynamoDB.DocumentClient();These above lines in the lambda function result in a "ReferenceError":{  "errorType": "ReferenceError",  "errorMessage": "require is not defined in ES module scope, you can use import instead",  "trace": [    "ReferenceError: require is not defined in ES module scope, you can use import instead",    "    at file:///var/task/index.mjs:1:13",    "    at ModuleJob.run (node:internal/modules/esm/module_job:193:25)",    "    at async Promise.all (index 0)",    "    at async ESMLoader.import (node:internal/modules/esm/loader:530:24)",    "    at async _tryAwaitImport (file:///var/runtime/index.mjs:921:16)",    "    at async _tryRequire (file:///var/runtime/index.mjs:970:86)",    "    at async _loadUserApp (file:///var/runtime/index.mjs:994:16)",    "    at async UserFunction.js.module.exports.load (file:///var/runtime/index.mjs:1035:21)",    "    at async start (file:///var/runtime/index.mjs:1200:23)",    "    at async file:///var/runtime/index.mjs:1206:1"  ]}How to resolve it? and what is causing this issue? Thanks.FollowCommentBSPNas 6 months agoYup, same thing here. I can confirm that the tutorial seems to be incorrect.Share"

Answer: "1Accepted AnswerThis is seen if you are using NodeJS 14 or above which no longer has require by default. See https://nodejs.org/api/esm.html#no-require-exports-or-moduleexportsYou can fix this by adding these two lines at the top of your file.import { createRequire } from 'module';const require = createRequire(import.meta.url);CommentSharedspanswered 6 months agoBSPNas 6 months agoI followed the same tutorial and ran into the same error.The solution doesn't solve it for me unfortunately. If I paste it literally at the top of the file, the new error is:"errorType": "Runtime.ImportModuleError", "errorMessage": "Error: Cannot find module 'aws-sdk'\nRequire stack:\n- /var/task/index.mjs",But if respect that it first should say const AWS = require("aws-sdk"); and I paste it anywhere under that line, then the error changes into:"errorType": "ReferenceError", "errorMessage": "Cannot access 'require' before initialization",Any ideas on how to move on?Thanks!Sharedsp 6 months ago@BSPNas Are you using Node 18.x runtime? If so, the aws-sdk module isn't shipped with that runtime today (See https://github.com/aws/aws-lambda-base-images/issues/47#issuecomment-1292011841). To fix this, you can either change runtime to Node 16.x or add a layer that contains the required SDK. Also, the fix in my original answer is required if your index file extension is ".mjs". If you rename the file to ".js" and change runtime to Node 16.x then the code given in the blog link should work as is.ShareArt 5 months agoI found this solution and it worked for me:import { createRequire } from 'module';const require = createRequire(import.meta.url);const { DynamoDB } = require("@aws-sdk/client-dynamodb");const dynamodb = new DynamoDB({apiVersion: '2012-08-10', region: 'us-east-1'})Hope it will help anybody.Share"


Question: Can't open AWS-CLI in Windows 10

"I have installed the latest version of AWS CLI. While I am trying to open the installed CLI, it's popping up windows for a second and disappearing instantly. I don't know what is the possible reason for that.Here is the output while I am entering the command: aws --versionaws-cli/2.11.8 Python/3.11.2 Windows/10 exe/AMD64 prompt/offN:B: I am using Windows 10 Pro Education (64-bit)FollowComment"

Answer: "0So you open a Command Prompt and type aws --version, and get:aws-cli/2.11.8 Python/3.11.2 Windows/10 exe/AMD64 prompt/offDoes that all work normally with no other windows popping up?Then what command have you tried that doesn't work right - how does something simple like aws s3 ls go?  If your credentials are set up does it list buckets OK?  Does it also pop up other windows?Does Python behave OK when you run it directly?CommentShareEXPERTskinsmananswered 2 months agorePost-User-4339415 2 months agoI am running this command aws --version using my windows CLI but the issue is installed AWS CLI isn't popping up. While I am clicking to open the AWS CLI it's opening for 1/2 seconds and disappearing instantly.It's all working fine with my windows CLI.Shareskinsman EXPERT2 months agoI'm making a guess here but possibly there's some confusion about how the AWS CLI works?  It's designed to be run from a shell like the Windows Command Prompt (I guess that's what you mean by "windows CLI"?), and it runs briefly, outputs something and terminates.  It's not interactive - everything you want it to do needs to be passed as parameters.If you're clicking on something to run the AWS CLI then yes it will probably briefly bring up a text window to output something and close the window when it terminates.Share"


Question: inspector2 API list_findings: cannot filter by updatedAt

"Hello,I am using the list-findings API  of AWS Inspector v2, and trying to filter findings after a given updatedAt. However, no findings are returned.More details including HTTP requests and responses are in the corresponding Github ticket for boto3 that I used to query the API. In a nutshell:Without the updatedAt searchCriteria, at least one finding with a value of updatedAt in March 2022 is returned;Performing the same query but with a updatedAt searchCriteria added asking for findings with a startInclusive in January 2022, no findings are returned.Best regards,FollowComment"


Question: Connection error from QuickSight to Athena under Lake Formation environment

"I encounter the error when I try to create a new Athena dataset on QuickSight (click on [Validate connection] button);Error Code: ACCESS_DENIED_TO_RESULT_STAGING_AREAError Message: [Simba]AthenaJDBC An error has been thrown from the AWS Athena client. Access denied when writing to location: s3://<Athena-query-result-bucket-name>/xxxx [Execution ID: xxxxx]Environment:there're 2 s3 buckets; one is "s3://<Source-data-bucket-name>" for query target, and another one is"s3://<Athena-query-result-bucket-name>" for Athena query workgroup.Using Lake Formation, and both buckets are registered as datalake location.After create QuickSight account, I allow access to 2 s3 buckets and Athena via QuickSight account managementOn Lake Formation console, I did grant;QuickSight execution role (aws-quicksight-service-role-v0) access to 2 s3 bucketsQuickSight Group ARN (arn:aws:quicksight:region:accountId:group/default/groupName) access to the raw data access bucketWhat else should I do to make enable to create Athena data set on QuickSight console?Thank you for your help.FollowComment"


Question: RE : AWS SES Account

"Hai Users,i have a requirement , to use aws ses service on production application by using Djangowhere my aws ses account is out of sandbox too...but my issue is , it is asking to verify emails while i used to send emails from different login users to different emails on my application .where i noticed that if aws ses account is out of sandbox , we dont need to verify sender , recipients  emails , but i am facing to verify emails .can anyone help me about my issue.Thanks & RegardsArun KumarFollowComment"

Answer: "0Hello,When your sending access is out of the sandbox, then you do not need to verify the recipient, however the source or the FROM has to be verified.This is mentioned here:https://docs.aws.amazon.com/ses/latest/dg/request-production-access.htmlBR,MoCommentShareMoanswered 2 months ago"


Question: RDS Encryption questions

"A customer sent me the questions below:As part of out vendor approval with a major bank, we detailed that we encrypt the DB using RDS encryptions. They asked us the following questions, and we couldn't find a specific answer in the AWS documentation. Can you please help?What are the Enumeration protocol and supported versionsWhat is the Certificate key size (i.e: RSA 2048) ----- Adir: AES-256Which Cipher suites are supported?Do we have this information to provide him?FollowComment"

Answer: "0Accepted AnswerThe AWS RDS platform uses the same encryption at rest technology that EBS utilizes to encrypt full volumes. We utilize AES-256 encryption, detailed here: https://docs.aws.amazon.com/kms/latest/developerguide/services-rds.htmlWith regards specifically to Postgres RDS, most of your questions related to encryption in transit are here:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_PostgreSQL.html#PostgreSQL.Concepts.General.SSLCommentShareAWS-User-5294568answered 5 years ago"


Question: CloudWatch  dashboard snapshot

I wanted to take the backup of my whole dashboard and send it via email. is there a way to achieve thisFollowComment

Answer: "0Accepted AnswerHi, it would be great to understand whether the previous answers correspond to your question or if we didn't understand your question.As the title of your post mentions "snapshot" and this term can also designate an image, I wonder whether what you meant is you're looking for a way to generate a picture representing your dashboard at a given point in time? If that's the case, there's no API to export a whole dashboard, you can export a specific widget though with https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricWidgetImage.html.CommentShareJscanswered 8 months agorePost-User-2738569 8 months agoThanks for your answer @Jsc. You understood my requirement properly.Share0I did not understand about backups, but it is possible to share the dashboard via email. [1][1] Sharing CloudWatch dashboards - Amazon CloudWatchhttps://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-dashboard-sharing.htmlCommentSharemn87answered 8 months agoShelly_Dar 8 months agoDo you mean a backup of the dashboard configuration, or a backup of the metrics in the dashboard?SharerePost-User-2738569 8 months agoThanks @mn87 for answering. But my requirement is to take image of the dashboard and email the imageShare0If you click Actions > View/edit source, it will give you the JSON code which you can email. Also works as a good backup in a version control system.CommentShareSiTheAWSGuyanswered 8 months agorePost-User-2738569 8 months agoThanks @SiTheAWSGuyShare"


Question: Add PHP 8.2 to amazon-linux-extras

"Currently supported PHP versions within amazon-linux-extras are either out of support or have fewer than 11 months left before their end of life.In order to enable developers ample time to upgrade applications, test and deploy, can we please get PHP 8.2 supported added as soon as possible?For reference, here are PHP's current versions and their support timelines:https://www.php.net/supported-versions.phpThere are also 3rd party packages (such as Bref) which use the amazon-linux-extras repos for compiling Lambda layers to allow PHP applications to run on ARM/Graviton:https://github.com/brefphp/bref/tree/v2/docs/runtimes#arm-runtimesFollowComment"


Question: Accessing a RDS database in another account using AWS PrivateLink

A customer wants to access a DB Instance in a VPC from an EC2 Instance in a different VPC. They are currently using VPC Peering for this as documented here: USER_VPC.ScenariosThey would like to know if they could instead use a VPC endpoint as documented here: endpoint-serviceIs it possible to make the RDS database available in the other VPC using a NLB and a PrivateLink?What would be the impacts? The limits?FollowComment

Answer: "0Accepted AnswerIt would work BUT maybe not the best way to go (because of following drawbacks):You can setup Private Links currently only with NLB and NLB only supports IPs or instances as targets.But as RDS only provides DNS endpoints you can not connect a NLB directly with RDS  (of course you could get the IP of the RDS endpoint but as the IP may change at any time you should NOT consider this option unless you are Ok manually updating it or want to build auotmation to do so)Possible workaround: put a proxy behind the NLB and let the proxy forward connection to RDS endpoint FQDN.Additional comment: NLB does continuously health checks towards the targets, this will result in a blocked IP of the NLB (and so the whole Endpoint/Private Link) inside Mysql depending on the configuration of max_connect_errors.CommentShareAWS-User-3679487answered 5 years ago"


Question: Aurora MySQL Upgrade From 2.10.1 to 3.01.0 (MySQL 5.7 to 8) failing

"I have two clusters I would like to upgrade. I am restoring from snapshot. After creating the new cluster it falls back to V2, I have 5 errors in the precheck log:Aurora Fast Online DDL is not supported from 3.x onwards.This check verifies that the database do not have artifacts realted to the featureTable information_schema.INNODB_SYS_INDEXES_HISTORY is not empty. Your database has pending Aurora Fast online DDL operations. Reachout to AWS support for assistanceTable information_schema.INNODB_SYS_FIELDS_HISTORY is not empty. Your database has pending Aurora Fast online DDL operations. Reachout to AWS support for assistanceTable information_schema.INNODB_SYS_SCHEMA_HISTORY is not empty. Your database has pending Aurora Fast online DDL operations. Reachout to AWS support for assistanceTable information_schema.INNODB_SYS_COLUMNS_HISTORY is not empty. Your database has pending Aurora Fast online DDL operations. Reachout to AWS support for assistanceTable information_schema.INNODB_SYS_TABLES_HISTORY is not empty. Your database has pending Aurora Fast online DDL operations. Reachout to AWS support for assistanceI had turned labmode on both clusters. Meanwhile the sererFollowComment"

Answer: "1Hi,I understand you faced precheck errors when trying to upgrade Aurora version from 2.x to 3.x. The errors messages you shared here is related to known issue that due to pending DDL updates corresponding to Fast DDL operations listed below. [+] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Managing.FastDDL.html#AuroraMySQL.Managing.FastDDL-v2This feature is depreciated in all Mysql 8.0 compatible Aurora versions. Hence, it is necessary to apply these pending DDL updates to be able to upgrade to 3.<> version.Please try to run optimize table command on all the tables in 5.7 source cluster (on which DDL queries were executed) and then took the snapshot again. Running optimize table will basically empty all the 5 history tables mentioned above which were erroring out. You can then restore the snapshot to aurora mysql 8.0.Note: I would suggest to test on a test environment by restoring a cluster from 5.7 snapshot and run commands before applying to production environment.mysql>optimize table <table name>;[+] https://dev.mysql.com/doc/refman/5.7/en/optimize-table.htmlCommentShareSUPPORT ENGINEERKevin_Zanswered a year ago"


Question: Need command to read  and fetch data from secpol.msc (local security policy ) --> windows firewall defender to command prompt in windows server 2019

"Hi,We are working on windows HardeningOS as per CIS benchmark guidelines for AWS EC2 instance. We are using Windows server 2019.when I use this command netsh advfirewall show allprofiles in command prompt for fetch values from secpol.msc local security policy but not getting proper output. Can you please suggest some other command.FollowComment"


Question: How to create s3 bucket using AWS-SDK without enabling cors for created bucket?

Access to XMLHttpRequest at 'https://bunchy1.s3.ap-south-1.amazonaws.com/' from origin 'null' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.FollowComment

Answer: "0You can create an S3 with the following code.Cors is not set in this code.import boto3AWS_REGION ="ap-northeast-1"client = boto3.client('s3',region_name=AWS_REGION)bucket_name = "bucket_name"response = client.create_bucket(Bucket=bucket_name,                                CreateBucketConfiguration={'LocationConstraint': AWS_REGION})CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: Global Accelerator -  Dual Stack Endpoints

"Hi,does anyone know if there is a plan to support the "Network Load Balancer" as a dual stack endpoint for Global Accelerator in the future? Currently the "Application Load Balancer" is the only possible dual stack endpoint.FollowComment"

Answer: "1HelloYou are correct, currently with Global accelerator only ALB is supported for dual stack.Please note AWS does not publicize the roadmap items, I would suggest to keep an eye on https://aws.amazon.com/about-aws/whats-new, then filter by 'Networking and Content Delivery' and choose 'AWS Global Accelerator', also check the Blog pages for any new feature announcements.It is likely there is already a feature request for this; if you have an Account manager you can request to add your influence.CommentShareEXPERTTushar_Janswered 8 months agoEXPERTToni_Sreviewed 8 months agorePost-User-6972953 8 months agoThanks, good hint.Share"