Question: After restarting instance This account is currently blocked and not recognized as a valid account.

I just restarted my instance now my state is stuck on stopped and getting an error (This account is currently blocked and not recognized as a valid account.) I created a case also now more than 20 hours but still no response my business totally relay on this please help me to solve this ASAPFollowComment

Answer: "0Hi there...So for this, “I just restarted my instance now my state is stuck on stopped and getting an error (This account is currently blocked and not recognized as a valid account.) I created a case also now more than 20 hours but still no response my business totally relay on this please help me to solve this ASAP”,I strongly lean towards the resource/account being blocked or suspended.They can check with the Account verification team to confirm any issues that are account related at - aws-verification@amazon.com or contact AWS Billing & Accounts team here - https://support.aws.amazon.com/#/contacts/aws-account-support/Here is another useful doc they can refer to to address these kinds of issue - https://aws.amazon.com/premiumsupport/knowledge-center/sign-in-account/CommentShareNonkululekoanswered a year ago"


Question: CloudFormation WAFv2 association

How do I associate a CloudFormation AWS::WAFv2::WebACL with an ALB?https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.htmlClassic WAF had AWS::WAFRegional::WebACLAssociation but I don't see anything for WAFv2.I've had a support ticket open for over a week asking this but so far noone has a clue. Any ideas?FollowComment

Answer: "0Running into the same issue, WAF v2 works with other resource types but not cloudfront. Wish there was an easier way to report bugs.CommentShareaschmoisanswered 3 years ago0I got this back from support. So WAFv2 for ALB and API Gateway is not supported by CloudFormation.The WAFv2 Resource Type Reference:AWS::WAFv2::RegexPatternSetAWS::WAFv2::RuleGroupAWS::WAFv2::WebACLAWS::WAFv2::IPSetThe above resources support the below return values :!GetAtt Resource.Arn!GetAtt Resource.IdThe !GetAtt Resource.Arn returns the ARN of the resource.Referencing the AWS::WAFv2::WebACL resource:For ALB and API Gateway: Association of WebACL for WAFv2 through CloudFormation is not supported currently. Our service team is working on this feature.For CloudFront: Pass the ARN of WebACL for WAFv2 to the WebACLId property of AWS::CloudFront::Distribution resource [1].I tested the association of WebACL for WAFv2 to CloudFront as stated below and it works.MyWebACL:     Type: AWS::WAFv2::WebACL    Properties:       Name: "WAF"      Scope: "CLOUDFRONT"      ......myDistribution:     Type: "AWS::CloudFront::Distribution"    Properties:       DistributionConfig:         WebACLId: !GetAtt MyWebACL.Arn      ......I have also asked the service team to update the documentation. Please let me know if the above works in your use case.Documentation:[1] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.htmlCommentSharerectalogicanswered 3 years ago0Hello!Regional web ACL association through CloudFormation is currently not available, but we expect to fix this by the end of next week.Regarding CloudFront web ACL association, as you already found out, you can associate a web ACL using AWS::CloudFront::Distribution  by simply providing ARN of web ACL.Also, you might notice that although association is successful, the change is not reflected in other service’s console (e.g., CloudFront, Application Load Balancer, API Gateway). You can confirm the association on WAF console for now. We are currently working on addressing this issue as well.CommentSharekumo-hiyorianswered 3 years ago0KevinL-AWS wrote:Regional web ACL association through CloudFormation is currently not available, but we expect to fix this by the end of next week.I see Cloudformation had a bunch of announcements yesterday (Dec 16)https://aws.amazon.com/about-aws/whats-new/2019/12/aws-cloudformation-updates-for-api-gateway-codepipeline-s3-iam-ecs-rds-es-lambda-and-more/One of the announcements isUse the latest version of AWS WAF, a web application firewall that lets users monitor HTTP(S) requests that are forwarded to an Amazon API Gateway API, Amazon CloudFront, or an Application Load Balancer.But I still don't see how to use WAFv2 with ALB via Cloudformation. So what is this announcement referring to?CommentSharerectalogicanswered 3 years ago0We are nearing the end of "next week". Any updates you can share?CommentShare94VFxFiYanswered 3 years ago0It made it to the release notes, but not in the docs yethttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/ReleaseHistory.htmlThe following resource was added: AWS::WAFv2::WebACLAssociation.AWS WAFv2Use the web ACL association to define an association between a Web ACL and a regional application resource, to protect the resource. A regional application can be an Application Load Balancer (ALB) or an API Gateway stage. For CloudFront distributions, you use AWS::CloudFront::Distribution to manage the association.CommentSharerectalogicanswered 3 years ago0Are there any updates on this? Just raised a ticket into the Cloudformation Roadmap GitHub project but found this forum thread.CommentSharejamiemanswered 3 years ago0Yes, I heard from support yesterday that they fix this by removing the premature announcement about AWS::WAFv2::WebACLAssociation:Meanwhile, I have asked the team to modify the announcement on the release history page [1] as there is no documentation available to justify the announcement.[1] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/ReleaseHistory.htmlCommentSharerectalogicanswered 3 years ago0I have raised the ticket in the Cloudformation GitHub project... Been advised we need a lot of +1's to try and gain enough traction to get progressed:https://github.com/aws-cloudformation/aws-cloudformation-coverage-roadmap/issues/344CommentSharejamiemanswered 3 years ago0Assume they didn't mention any timescales?Edited by: jamiem on Jan 16, 2020 12:03 AMCommentSharejamiemanswered 3 years ago0This appears to have been release on the 16th Jan, according to the release notes:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/ReleaseHistory.htmlHowever, when trying to use it, I getAn error occurred (ValidationError) when calling the CreateChangeSet operation: Template format error: Unrecognized resource types: [AWS::WAFv2::WebACLAssociation]Waited a few days in case, but still appears to be an issue.Edit:Documentation for it here:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webaclassociation.htmlEdited by: RalphLawrence on Jan 20, 2020 2:58 AMCommentShareRalphLawrenceanswered 3 years ago0This is interesting, will attach to the GitHub feature request.CommentSharejamiemanswered 3 years ago0The web ACL association for WAFv2 through CloudFormation is now available:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webaclassociation.htmlHere's a sample code for associating to ALB:## Associate WAFv2 Web ACL with a load balancer## Alb = AWS::ElasticLoadBalancingV2::LoadBalancer## wafACL = AWS::WAFv2::WebACL  wafALBAssociation:    Type: AWS::WAFv2::WebACLAssociation    Properties:      ResourceArn:         !Sub           - 'arn:aws:elasticloadbalancing:${AWS::Region}:${AWS::AccountId}:loadbalancer/${TargetALB}'          - TargetALB: !GetAtt Alb.LoadBalancerFullName      WebACLArn: !GetAtt wafACL.ArnWe do apologize for the delay as this have caused. Thank you!CommentSharekumo-hiyorianswered 3 years ago"


Question: I have question on KCL(Kinesis Customer Library)

A customer currently use Kinesis (I guess data stream) in their own IoT service.Customer do believe that KCL recorded how handling data when EC2 is being scaled in or terminated.(There is a possibility of terminating EC2 when the data has been handled)Q1) They wonder how does this record handle?OrQ2) They have to set lifecycle hook when EC2 is being scaled in or there is something that KCL managed this record by itself?Customer would like to have any example or practice.FollowComment

Answer: "0Accepted AnswerYou can think of the KCL as a micro-batch system.  An instance of the KCL will take a micro-batch of records from a single shard in a Kinesis Stream and then one of two things happens: either it is successful in processing those records or it is not. If it is successful, it will move on and get the next micro-batch of records from the stream.  If it is not successful, the system will attempt to re-process the same micro-batch.If the KCL is interrupted for some reason (eg an EC2 scale event, EC2 failure etc), then it will not be successful in processing the current micro-batch.  The micro-batch will therefore be re-processed by another EC2 instance that is running the KCL.When you start the KCL, it creates a table in DynamoDB that tracks the state of the processing against each shard in the Kinesis Stream.  This includes a lease system, so the overall system can know if an agent that is processing records from a shard has stopped responding and the batch needs to be reassigned to another agent.CommentShareNickanswered 4 years ago"


Question: how to extend the total processing time for Asynchronous endpoint upto 60 minutes?

"I'm facing the below error when asynchronous endpoint is invoked in sagemaker for batch processing:"Your invocation timed out while waiting for a response from container primary. Review the latency metrics for each container in Amazon CloudWatch, resolve the issue, and try again."I found that the issue is due to the total processing time exceeds the default 15min window.So, I would like to know how to extend the total processing time for Asynchronous endpoint upto 60 minutes as mentioned in aws docs: https://docs.aws.amazon.com/sagemaker/latest/dg/async-inference.htmlThank you.FollowComment"

Answer: "0Accepted AnswerHi, I found the solution to extend the total processing time for Asynchronous endpoint upto 60 minutes.Use this parameter "InvocationTimeoutSeconds=3600" when invoking the async endpoint.code looks like below:response = sm_client.invoke_endpoint_async(EndpointName=endpoint_name,InputLocation=input_file_s3_path,ContentType='text/csv',Accept='application/json',InvocationTimeoutSeconds=3600    )Thank you.CommentShareSampathanswered 3 months ago"


Question: Cannot bring db "online" after taking offline

"So, I took MS SQL Server DB offline. Now I am trying to bring it online and get error:TITLE: Microsoft.SqlServer.SmoSet offline failed for Database 'zzz'.For help, click: https://go.microsoft.com/fwlink?ProdName=Microsoft_SQL_Server&ProdVer=16.100.46041.41_(SMO-master-A)&EvtSrc=Microsoft.SqlServer.Management.Smo.ExceptionTemplates.FailedOperationExceptionText&EvtID=Set_offline+Database&LinkId=20476ADDITIONAL INFORMATION:An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.ConnectionInfo)User does not have permission to alter database 'zzz', the database does not exist, or the database is not in a state that allows access checks.ALTER DATABASE statement failed. (Microsoft SQL Server, Error: 5011)FollowComment"

Answer: "0Found. Should run special command, SSMS won't do:EXEC rdsadmin.dbo.rds_set_database_online <Name of database>CommentSharekatit2answered 2 years ago"


Question: Does IVS support rewinding?

"Hi all!I'm looking into using the Amazon Interactive Video Service.The context:I'm making a service for managing some live streams. The live stream creation flow is as follows.Initially I start a live stream, and send the playback URL one remote viewer (an admin of sorts), and then some time later, when the admin is ready, the same playback URL is sent to the public viewers.It is to enable a preview for an admin, before letting the rest of the world join in, without having to stop, configure, and then restart, the stream.My question:Are the public (who joined the live stream later) able to rewind and watch the stream from the beginning?I definitely do NOT want them to be able to rewind and watch video from before they started streaming from the playback URL.I'm not super familiar with the protocol of RTMPS, but it does not look like rewinding to before joining the stream is possible, but I only tested with VLC and video.js. But I have to make sure that the public viewers cannot just pull older streaming packages somehow.FollowComment"

Answer: "0Accepted AnswerHi there,By default, it is not possible to scrub/rewind a live stream of IVS video.This being said, it is possible to implement DVR functionality with IVS, as demonstrated with our sample at https://github.com/aws-samples/amazon-ivs-dvr-web-demo.It is important to note, however, that using the above functionality (or streaming a VOD that was recorded to S3, as described in https://docs.aws.amazon.com/ivs/latest/userguide/record-to-s3.html) would allow the viewers to scrub/rewind back, even before the playback URL was pushed to your public viewers.Please let us know if you have any further questions or concerns, as we'd be happy to assist!CommentSharecbagdonanswered 10 months agorePost-User-9610914 10 months agoThanks for confirming this!Share"


Question: "Can Not Acess Asia Pacific (Mumbai) server from US but able to access from Asia. Also sites down in US, but not in Asai"

The title pretty much explains the issue. Sites are down in the US. We can access AWS but when we select Asia Pacific (Mumbai) in EC2 we get a timed out notice. Yet when we access it in Asia it is fine. Our sites hosted in Mumbai are not displaying in the US as well. Can someone tell me who I reach out to for this? It sounds like an AWS glitch.FollowCommentRHESUSethDAPPRADARweb 7 months agoDB2 OHIO EAST THERE IS 2T CLOUD CO CONTAINER.Share

Answer: 0Problem solvedCommentSharerePost-User-2303090answered 10 months ago


Question: SES DKIM TXT records with empty value

"Hi,When downloading the DNS records file from SES, I get a line with empty value. In my DNS setup empty TXT values are not allowed.Type,Name,ValueTXT,_amazonses.kas@xxxxxx.dk,How do I solve this?Thank you.FollowComment"

Answer: "0I figured I could do it a domain level, so that must be the answer.CommentShareKasperSanswered 2 months ago"


Question: AWS Cognito User Pool SAML - SCIM support

Does AWS Cognito User Pool SAML has SCIM support (ADFS)?Any example of how it can be implemented?FollowComment

Answer: "0In this blog post walkthrough, we show you how to federate identities from Windows Server Active Directory to authenticate users into your web app by leveraging AWS services. The main AWS service that we’ll use for this purpose is Amazon Cognito.ADFS integration with Cognitohttps://aws.amazon.com/blogs/mobile/building-adfs-federation-for-your-web-app-using-amazon-cognito-user-pools/https://aws.amazon.com/premiumsupport/knowledge-center/cognito-ad-fs-saml/CommentSharePravoanswered 9 months ago"


Question: s3-dist-cp expected performance

"I am trying to evaluate whether s3-dist-cp tool would be helpful for the following use case: I have several millions of small text files (with size of tens of KB each) in an S3 bucket that I need to concatenate to bigger files before processing them further with Spark.To test s3-dist-cp, I tried it first on a smaller bucket with ~550000 files (~6.8GB total size). I launched an EMR cluster with 15 core nodes (m6g.xlarge instance type, 4 VCPUs / 16GB RAM) and ran the tool with a command like the following:s3-dist-cp --src s3://mybucket/data/ --dest hdfs:///my_data --outputCodec=gz --targetSize=128 --groupBy='.*(celery-task-meta).*'This took 1hr and 38m to complete.. is this kind of duration expected / normal? Is there anything I could do to speed it up?Thanks in advance!FollowComment"

Answer: "0Accepted Answers3-dist-cp uses Hadoop Map Reduce to do the copy job. when reading or writing to s3, it would use EMRFS to make GET / PUT / LIST calls to S3.So, to tune performance  of your job runtime,you have to be aware of how Hadoop works and how it integrates with YARN.Also tuning can be performed  on the File System(S3 and HDFS) to improve Read / Write / Listing performance.benchmarking need to be done to really understand if  1hr and 38m is normal time for this cluster size.You can monitor the Mapreduce job using YARN  Resource Manager UI &  MR Job history server logs to identify where bulk of the time is being spent.Are any containers(Mappers or Reducers) in PENDING state waiting for resources to be assigned by YARN  ? Is Mapper / reducers running into memory Issues ?in which case you need bigger cluster or tune Map Reduce memory settings )is s3-dist-cp spending too much time Listing S3 objects before even running Mappers / Reducers ?Increase s3-dist-cp client heap space so that it can handle listing many s3 objects on your source s3 bucketexport HADOOP_OPTS="-Xmx5000m -verbose:gc -XX:+UseMembar -XX:+PrintGCDetails -Xloggc:/tmp/gc.log" ; s3-dist-cp --src s3://bucket/object/ --dest s3://dest-bucket/object/To improve performance to S3, you can use "fs.s3.*" parameters which will alter EMRFS behavior.some parameters you can consider tuning :fs.s3.maxConnectionsfs.s3.maxRetries (to deal with Throttling from S3)Please note that some of EMRFS parameters may not be existent of not publicly documented. For example how to modify Listing behavior of EMRFS  etc.So,You might try using s3a:// prefix in your s3-dist-cp command which will invoke S3A File System(which is part of open source Hadoop) instead of EMRFS.s3-dist-cp --src s3a://mybucket/data / --dest hdfs:///my_data --outputCodec=gz --targetSize=128 --groupBy='.*(celery-task-meta).*'S3A File System parameters are well documented and explained in this article :https://hadoop.apache.org/docs/stable/hadoop-aws/tools/hadoop-aws/performance.htmlThis allows to additionally tune File System related parameters to speed up your Job.Additionally, HDFS Write performance tuning can be considered if needed. But we rarely see performance issues with HDFS.CommentShareMannem Ranswered 5 months ago"


Question: DNS Management Issue

"I need to manage a DNS, but I cannot find my hosted zone.  I have several accounts and I do not know which account to try.  I have tried all of the ones I can think of, but I cannot find this particular zone.  colemanrodeo.comFollowComment"

Answer: 0I found it.CommentShareAWS-User-4947520answered a year ago


Question: Questions about CORS on HTTP (Api Gateway V2) APIs: HTTP_PROXY integrations

"The V2 Api Gateway documentation says: "You can enable CORS and configure authorization for any route of an HTTP API." Yet the command to set up CORS only operates on the API ID (aws apigatewayv2 update-api --api-id api-id --cors-configuration...) which seems counter to the statement?Also, I don't quite understand how CORS applies to HTTP_PROXY integrations. It would make sense that CORS would be handled by the destination route. Indeed that seems to be the case. I route my proxy to http://httpbin.org and call it (through my ApiEndpoint) without setting up CORS. Given that, why would you want to set CORS on the proxy API? To handle cases where the destination doesn't support CORS?Is there any more detailed documentation/examples on how this actually works? Or, examples of why your would want to apply your own CORS handling to proxy integrations?FollowComment"

Answer: "0Accepted AnswerHi ThereLooking at your documentation provided, it says:When you enable CORS and authorization for the $default route, there are some special considerations. The $default route catches requests for all methods and routes that you haven't explicitly defined, including OPTIONS requests.Now, the CLI example provided is the basic for enabling CORS on the $default route, which takes care of all the other routes.Looking at the documentation for the APIv2 CLI, you can use the --route-selection-expression parameter.The route selection expression for the API. For HTTP APIs, the routeSelectionExpression must be ${request.method} ${request.path}. If not provided, this will be the default for HTTP APIs. This property is required for WebSocket APIs.So if you would like to add CORS to a specific route, your CLI would look something like this:aws apigatewayv2 update-api --api-id api-id  --route-selection-expression ${request.method} ${request.path} --cors-configuration AllowOrigins="https://www.example.com"Hope that helps.CommentShareSUPPORT ENGINEERBazzieB_AWSanswered a year agoLos Alamos Al a year agoThanks for taking the time to answer this. I'll make this the accepted answer as it's easy to test the two versions of aws apigatewayv2 update-api on an existing API.Share"


Question: Lightsail | The instance appears to be hung and cannot be used

"The status lasted for an afternoon, and it always showed the pending status.Ssh cannot connect and static address cannot be bound.FollowComment"

Answer: "0Hi there,If your instance continues to be unresponsive, you may want to attempt to stop and start the host. A start is required to migrate the instance to healthy hardware.For more troubleshooting options, please look here:https://aws.amazon.com/premiumsupport/knowledge-center/lightsail-instance-failed-status-check/All the best,StevenCommentShareyensteveAWSanswered 7 months ago"


Question: Use of multiple custom SQL queries in QuickSight dataset

"Hi,I created a new Dataset in QuickSight and added a custom SQL query.  The query adds some fields to my dataset.  Now I like to execute a second query which uses those fields.   Is it possible to execute multiple queries after each other while creating a Dataset?When I add multiple queries I get an errror.Thanks CeesFollowCommentAaron Edell 10 months agoWhere are you writing and executing these SQL queries?Share"

Answer: "1Hello,Thank you for reaching out to us.If I understand it correctly, you would like to add multiple sqls to Quicksight SPICE dataset so that you can use the columns available in one sql into another sql.I would like to confirm that, as of now we dont have this feature available in Quicksight. If we try to add multiple sqls to SPICE dataset ,then it will throw an error saying "One query is expected".However, as a wrok-around you can consider using CTE ->Original SQLs :-select tran_id as id,store_id as store, store_city as city, store_city as new_cityfrom retail_transactions;select store_city as new_city from retail_transactions;CTE :-with test_cte as(select tran_id as id,store_id as store, store_city as city, store_city as new_cityfrom retail_transactions)select new_city from test_cte;Thank you and have a great day !CommentSharePriyaAWS2020answered 10 months agoEXPERTFabrizio@AWSreviewed 9 months ago"


Question: Upgrade Path for Control Tower Python 3.6 Lambdas?

"So, does anyone know what the upgrade path is for the Control Tower Python 3.6 lambdas? Did AWS publish any way to resolve these issues before CT breaks in a couple months?FollowComment"

Answer: "1You are receiving this communication because the AWS Control Tower service contains a notification Lambda Function using Python version 3.6 which is planned for deprecation in July 2022. A new version of the Control Tower notification Lambda will be updated prior to deprecation in July. We will provide periodic updates in the Control Tower management console regarding the updates and any actions we may need you to take.We are aware that some Control Tower customers have received a number of emails regarding the Python 3.6 deprecation for Lambda functions, and we apologize for any confusion that these messages may have caused. We are working with the Lambda team to limit any future notifications.CommentShareSUPPORT ENGINEERWayne_Ganswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: No resources are being used but AWS Free tier limit for EC2 is getting exhausted.

"I am not using any instances of EC2. I am not using any service in AWS. I have verified all other resources that have connection with EC2 like Elastic Bean stalk and so on. The only service that was active on my account is AWS Budget for free tier limit. Every month, I am getting a message saying that 85% of my usage limit got exhausted. How do I further check on this. If i leave this as it is, I might get a bill with some decent amount once my free tier tenure gets completed.Can someone help me in this regards?FollowComment"

Answer: "0Have a look in Cost Explorer in the AWS Console, especially for any resources that are in a Region you don't normally use.CommentShareEXPERTskinsmananswered 3 months ago0Verify your EBS volumes.AWS > EC2 > Elastic Block Store > VolumesMaybe a ec2 that terminated, is not erased the volumes EBS.CommentShareAlberto Fernandesanswered 3 months ago"


Question: Verified senders API stopped working after I requested to increase my quote e-mail to 20 mb

"After increased my quota e-mail to 20 mb, verified senders API permission stopped working. And it seems I need to pay in order to get that fixed, which I do not think it is fair, since it is a basic thing that is supposed to work alright, and it was before quota e-mail was increased. How can I get it working again? Tks.FollowComment"

Answer: "0So, if no one answered. Can I pay the monthly fee for just one month in order to get it solved? Tks.CommentSharediegplanswered a year ago"


Question: How to deploy ECR private image to Lightsail containers

"Hello all, I want ask about Lightsail. I have one ECR private image and want to deploy to Lightsail containers but I am confused how to. How to deploy ECR private image to Lightsail containers?Thank you.FollowComment"

Answer: 0You may want to check this guide: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-container-service-ecr-private-repo-accessCommentShareapradanaanswered 9 months agobudionosan 9 months agoAfter read "Choose Continue when the activation is completed." I still confused how to because the Lightsail documentation is not explain how to deploy ECR private image.Share


Question: "A website with PHP and laravel, what do you recommend?"

"Hello, I have a question for you, I have decided that my website will have PHP as a backend, probably on Laravel and later on my own CMS system. I have purchased a domain, what other services would you recommend for my requirements? I also need an SSL certificateThank you very much for your reply, it would help me a lot. Have a nice eveningFollowComment"

Answer: "1Accepted AnswerI would recommend the following:1)Elastic Beanstalk. See this reference on how to deploy Laravel apps: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/php-laravel-tutorial.html.This would also support you in dockerizing  your custom app and deploy there too in future.(https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/create_deploy_docker.html)2) You’ll most likely need a database, so RDS is a good choice.3) for certificates, you can issue them via ACM: https://docs.aws.amazon.com/acm/latest/userguide/gs.html4)Optionally you may need to use Route53, as DNS tool, just to have it well integrated with the above components.CommentShareEXPERTalatechanswered 4 months ago0I use a macbook, I don't have good experience with docker, is there another option? I forgot that I want the storage to be automatically growingCommentSharerePost-User-7695513answered 4 months agoalatech EXPERT4 months agoThe article I referenced above: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/php-laravel-tutorial.html does not require you docket knowledge. Have you checked it out?An alternative is otherwise to look at Lightsail. Here is a tutorial about how to deploy: https://blog.harun.dev/deploy-laravel-application-to-amazon-lightsailAbout storage you have possibility to increase db space automatically: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIOPS.StorageTypes.html with a feature called Rds storage autoscaling enabledShare"


Question: "Weird DMS Error: "Replication Task Settings document error: Array element's unique identifier was not found, please provide Id for each and every element""

"Trying to set up DMS between RDS MySQL and Redshift.  If I try to edit the the Table Mappings from the GUI, I always get a weird error (that has zero Google results, except 1 spam page)Replication Task Settings document error: Array element's unique identifier was not found, please provide Id for each and every element.No idea what that means.  Every rule has a unique name and ID.Not the biggest issue in the world, as it's usually okay if I make a new one, but it does make it hard to iterate.  Any idea what the issue here could be?  Thanks!FollowComment"

Answer: "0Hi,I understand that you are observing the below error on your trying to set up DMS between RDS MySQL and Redshift. :ERROR : Replication Task Settings document error: Array element's unique identifier was not found, please provide Id for each and every element.I found out that it is related to an issue because of modifying (even if using the same values) the character set, when you remove the character settings in task setting, when you save and modify again, the character setting section appears:"CharacterSetSettings": {    "CharacterSetSupport": {      "CharacterSet": "    ",    },    "CharacterReplacements": [      {        "SourceCharacterCodePoint": "  ",        "TargetCharacterCodePoint": "  "      },The modification on existing "CharacterSetSettings" is not supported, To fix this issue you will need to create a new task with the required settings of "CharacterSetSettings" or new task without any setting for "CharacterSetSettings"[+] https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.CharacterSubstitution.htmlI hope this helpsCommentShareAsisiphoanswered 6 months ago"


Question: Is the Engine still alive

Does this community see AmazonLU going any ware should I spend the time and energy to learn this Engine.Follow

Answer: "0Accepted AnswerLots of news and updates coming this year for Lumberyard. And @REDACTEDUSERSharerePost-User-1735886answered 2 years ago0Thank You that is all i needed.SharerePost-User-4907628answered 2 years ago0Hi r2ks, yes development is still on going for Lumberyard and there will be lot's of news/updates to come this year.Thanks for your interest!SharerePost-User-8164888answered 2 years ago0[quote="r2ks, post:1, topic:10170, full:true"]Does this community see AmazonLU going any ware should I spend the time and energy to learn this Engine.[/quote]I think the very fact that you need to ask the question demonstrates the problems with the way Amazon has failed to promote Lumberyard as a serious AAA competitor.Personally, I've always been interested in the potential of Lumberyard, but the reality has been less than thrilling. I remain skeptical of the future of the engine, especially when we consider what a mess Amazon's gaming efforts have been. I don't think anyone around here really knows whether the big bosses will pull the plug on their next whim.My position is to keep an eye on Lumberyard, and see what happens, but no way I'd bet on it for a serious project until I see what looks like a much greater show of commitment from Amazon, and some serious attempts to push the engine.SharerePost-User-5431342answered 2 years ago0Thanks, @REDACTEDUSERI was Looking at cryengine but it looks like they are moving away from LUA to c#Thank you, allSharerePost-User-4907628answered 2 years ago0cry engine is finished in 2014cry engine seems to be a private engine right nowSharerePost-User-5217853answered 2 years ago0when date lumberyard 1.28 ?SharerePost-User-5217853answered 2 years ago0LY 1.28 does not have a set date, they get updates out every 3 months or so so I would say give it up to another month to a month and a half.SharerePost-User-7556027answered 2 years ago0It is up to you, no community member can tell you a complete yes or no to spend time on this engine, because this engine meets peoples requirements in a lot of different ways. This engine has easy multiplayer, and aws service integration. But for you question is it still alive, yes it is and there is a discord server with plenty of people willing to help you if you need help on anything. Is the engine going anywhere, I myself would say yes it is, just not at a massive pace. Every update there is new tools, and additions added to this engine, but if you look at something like UE they are going at a much larger pace, but they are also looking at another audience. So all in all you would have to make the decision on your own, but I can say LY is not going to be dropped any time soon from my knowledge.SharerePost-User-7556027answered 2 years ago"


Question: Amplify and MTLS - How?

"Hello, ive gone through these AWS docs regarding securing API gatways using MTLS which have you create your own CA, cert, key, etc, sign it and then create the PEM that is used alongside the truststore for MTLS - https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/That all works great... between my development laptop and my api gateway... Now im trying to get Amplify involved in the scenario.I've read elsewhere in the AWS docs on a deep hunt one night Amplify is a service that MTLS can be used with.  The end goal is to protect a critical API that absolutely cannot withstand abuse.  MTLS seems like a good way to do this.How excatly do I go about replicating the development machine steps that worked to lock down the gateway with Amplify instead of just my local machine?Is the path through using this pem/key I created with my Amplify sites code(this is self signed isnt it?) or do I need to gather the Amplify sites truststore/key and use that? Not really clear on how to proceed. Thanks!FollowCommentoggie 4 months agoBump........Share"

Answer: "0Considering your use case is to protect a critical API that absolutely cannot withstand abuse, you may want to take a look at integrating AWS WAF with Amplify. Sample code can be found here -->  https://github.com/aws-samples/aws-cdk-amplify-with-waf.However, you can override the API resources that are created by Amplify, you should be able to configure with mTLS but not 100% certain. Amplify uses AWS CDK to create resources.  --> https://docs.amplify.aws/cli/restapi/override/.Hopes this helps.CommentShareaaron_lanswered 4 months ago"


Question: Problems with verification

"I received an email stating "We were unable to validate important details about your Amazon Web Services (AWS) account so your account has been placed on hold pending additional verification. At this time, we need you to confirm your address information so we can remove the hold."I have uploaded a copy of a utility bill with my address on it, but my account is still suspended.I'm not even generating much activity on the account.  I'm using it for training purposes for the AWS Architect Certification.  The problems seem to start when I did the Control Tower training at which I was flagged.I would really like to continue my training.  I don't care if you delete everything and I start over again, I just want to keep going in the training sessions.FollowComment"

Answer: "0Hello,If you've supplied the relevant documentation, please give the AWS support team some time to respond.I do not have visibility into why your account is on hold, but if you are experimenting with Control Tower, keep in mind that it will create multiple new accounts as part of the Control Tower deployment.  I don't know if that raised any flags, but a new AWS account provisioning multiple new accounts may look malicious to automated systems.CommentShareEXPERTChris_Ganswered 10 months agoWarthog 10 months agoYou are telling me that AWS automatically created new accounts from Control Tower, then flagged me as suspicious due to the accounts AWS itself created?  That seems like a pretty big bug to me.  The first thing the detector should do is know the difference between Control Tower creating a landing zone and an outside script.ShareChris_G EXPERT10 months ago@Warthog again I cannot say for sure that is the reason why, I'm just speculating based on what you've mentioned.Share"


Question: Need more details on an RDS Customer Reachout...

"Hi,I'm evaluating Aurora Global Databases for a new application, and it seems I managed to find a bug/crash in the MySQL write forwarding feature during my testing yesterday, as I received a "RDS Customer Reachout" email from AWS support stating:Your Amazon Aurora cluster '[REDACTED]' in the 'ap-southeast-2 Region experienced a restart at 2022-12-15T02:07:56 UTC.Based on our investigation, the root cause of the issue is a defect in global database write forwarding when a connection's session variables are reset.To prevent this issue from reoccurring, we advise to not use any api call that may switch the current user, e.g. mysql_change_user(). Detailed documentation is  available here [1] .We apologize for the inconvenience caused and continue to strive to improve our customer experience with Amazon RDS.If you have any further questions or require any guidance, please do not hesitate to contact the AWS Support team. We are available on AWS Developer Community [2] or by contacting AWS Premium Support [3].[1] https://dev.mysql.com/doc/c-api/8.0/en/mysql-change-user.html[2] https://repost.aws/[3] https://console.aws.amazon.com/support/On the one hand, this level of proactive notification is very impressive and welcome from AWS. On the other, hand, given that I'm not paying for support yet, the lack of any further detail or follow-up on precisely what I triggered is frustrating - so I'm taking the requested course of action and asking for more information on the nature of the "defect".In particular, I need to know the specific command/query that triggered the session variable reset - I only have a single database user configured in my test database, so the mysql_change_user() method mentioned in the email is almost certainly not the cause, and I'm not doing anything that would trigger a user change either.How do I get more info from AWS in this situation? For now, I'm going to try and reproduce the issue on my own... not ideal, but it's the only option I have.FollowComment"

Answer: "0I haven't heard anything further back from AWS on any of the (multiple) "reach out" cases that have been opened for this issue yet, or here, but I have figured out what's triggering the bug in Aurora.Steps to Reproduce:Configure a Aurora MySQL global database, with write forwarding enabled from secondary to primary region.Create a basic Entity Framework Core app that performs 2 writes against the secondary region via Dapper direct SQL statements.Expected BehaviourBoth writes succeed and are forwarded and committed in the primary region.Actual Behaviour:The second write triggers an assertion error on the secondary instance, causing an instance restart - the write, and all subsequent reads fail for a period of time until the instance restarts. Enabling error logging on the secondary cluster, the following assertion error is observed in the secondary instance log:2022-12-19T03:45:38.970437Z 137 [ERROR] [MY-013183] [InnoDB] Assertion failure: fwd_cmd.cc:2266:thd->variables.aurora_using_thread_pool_connection_handler == true thread 70368986431216 (ut0dbg.cc:57)On the application side, the write fails with a MySQL protocol error:MySqlConnector.MySqlException (0x80004005): Failed to read the result set.  ---> System.IO.EndOfStreamException: Expected to read 4 header bytes but only received 0.Suspected Issue:Entity Framework core uses https://mysqlconnector.net/ under the hood, which provides a connection pool to the application, and crucially per the documentation at https://mysqlconnector.net/connection-options/ - the Pooling, and ConnnectionReset options are both defaulted to true, this triggers the following sequence of events:First write requests a connectionA new connection is opened to Aurora.The first write sets the aurora_replica_read_consistency session variable successfully and performs its write.The first write completes and the connection is returned to the idle pool.The second write requests a connectionEF/MySqlConnector return the existing idle connection from the pool, issuing a Reset instruction to AuroraThis triggers the Aurora bug and the secondary instance asserts, crashes and rebootsThe subsequent Write fails as shown aboveThe issue can be worked around by disabling either Pooling or ConnectionReset in the connection string, however both of these are desired options in general, and even with this bug avoided, we are still hitting the subsequent issues below.It would be great to get confirmation from AWS that you agree this is an Aurora issue, and an ETA for when it will be fixed?CommentShareMatt Brownanswered 5 months ago"


Question: SNS subscribe HTTPS endpoint

"I'm attempting to integrate a Google Chat webhook with the SNS https protocol but am having difficulty.command1:aws sns subscribe --topic-arn arn:aws:sns:us-east-1:123456789012:MyTopic --protocol https --notification-endpoint 'https://chat.googleapis.com/v1/spaces/AAAAaikfLEo/messages?key=<your-key>&token=<your-token>'output:{"SubscriptionArn": "pending confirmation"}Here are the cloud monitoring logs.{"notification": {"messageId": "0b72f18b-4267-4766-9196-58sckdsjwswf","topicArn": "arn:aws:sns:us-east-1:123456789012:MyTopic","timestamp": "2023-03-11 05:57:32.278"},"delivery": {"deliveryId": "0b72f18b-4267-4766-9196-58sckdsjwswf","destination": "https://chat.googleapis.com/v1/spaces/AAAAaikfLEo/messages?key=<your-key>&token=<your-token>","providerResponse": "Bad Request","dwellTimeMs": 62,"statusCode": 400},"status": "SUCCESS"}I tried other commands as well, but they were ineffective.command2:aws sns subscribe --topic-arn arn:aws:sns:us-east-1:123456789012:MyTopic --protocol https --notification-endpoint 'https://chat.googleapis.com/v1/spaces/AAAAaikfLEo/messages?key=<your-key>&token=<your-token>' --attributes '{"http":{"defaultContentEncoding":"UTF-8","headers":{"Content-Type":"application/json"}}}'error:Parameter validation failed:Invalid type for parameter Attributes.http, value: OrderedDict([('defaultContentEncoding', 'UTF-8'), ('headers', OrderedDict([('Content-Type', 'application/json')]))]), type: <class 'collections.OrderedDict'>, valid types: <class 'str'>not greeting the error in command1 but receiving no responseHowever, the status code in the logs is 400, so I'm not sure what the error is; it could be about the header or something else.FollowComment"

Answer: "1I think your first attempt was successful. However, you need to get the token that was sent to the URL and run the confirm-subscription. That might not be available to you.You can also set this up following the instructions here: How do I use webhooks to publish Amazon SNS messages to Amazon Chime, Slack, or Microsoft Teams?.CommentShareEXPERTkentradanswered 3 months agoNoaman Saiyed 3 months agoIs it possible to do without lambda?Sharekentrad EXPERT3 months agoYes, if you can get to the logs of the endpoint to submit the token. Otherwise you will need some proxy that subscribes to the topic. You can host that proxy on other things besides Lambda.Share"


Question: DMS task is creating full row duplicates in target

"Hi,I have a DMS task to move data from Oracle CDC to Redshift. (Full Load and ongoing changes). During the full load, the task just keeps on running and is not reaching a 100%.  In the target, I can see the row count is already 4 times the row count in the source. There are 4x full row duplicates in the target. Can anyone please guide what could be the issue here and how to debug?thnx.FollowComment"

Answer: "0Hi ,have you looked at the DMS logs for the task?AWS DMS restarts table loading from the beginning when it hasn't finished the initial load of a table. When a task is restarted, AWS DMS reloads tables from the beginning when the initial load didn't complete.As described here.The recoverable error count  is by default -1 (restart indefinitely) so if any error happens the task might restart and reload all the tables. With no PK enforcing (as in Redshift) you will see the duplicates.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: AWS S3 File picker

I need an AWS S3 file picker for integration. We have an user window from that user can open access their s3 Bucket details (like Google or DropBox File Picker) and from that user can select an files and add that file or file URL in our window.FollowComment

Answer: "0Hi,assuming vanilla JavaScript (not sure if is a JS framework), you should look into AWS SDK fir browser as foundation.https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/s3-browser-examples.htmlHope it helps ;)CommentShareEXPERTalatechanswered 2 months agoDhaval 2 months agoNo, This one is for personal s3 bucket access. But how user can access there bucket with just login into console. User just need to login to their console and they can access their s3 bucket files within project window and see all the details related to files name, URL, date and all.Share"


Question: How to get a new solution version using only recent records?

"How to generate a solution version(USER_PERSONALIZATION recipes) using only recent records when importing records incrementally?I’m importing records(interactions, items) incrementally since new items are created every time.Since importing records incrementally makes training time(price) very high and the integrated records contains unnecessary old items, I want to generate a new solution version using only recent records(interaction, items). Is there any ways to do this?As far as i know, there is no way to remove old records when generating a new solution version.Currently, i’m generating a new solution version on all items(old and new) and remove the old items using filter when recommending items.Q1. If I want to get a new solution version using only recent records, Do I have to create a new DatasetGroup?Q2. If new items are created every time and old items are unnecessary(e.g. news article recommendations), what is a proper personalize architecture?(The "architecture" means a pipeline managing recent dataset)Thanks for reading.Edited by: hdseo on Aug 1, 2021 12:09 AMEdited by: hdseo on Aug 1, 2021 12:22 AMEdited by: hdseo on Aug 1, 2021 12:26 AMFollowComment"

Answer: "0Accepted AnswerHey hdseo,I have a little experience with this, we had a similar issue.Q1. If I want to get a new solution version using only recent records, Do I have to create a new DatasetGroup?: In our experience, yes. You would need to reimport a dataset only with the new data.Q2. If new items are created every time and old items are unnecessary(e.g. news article recommendations), what is a proper personalize architecture?: The proper way to do this is as you described, by re-importing the dateset with only the relevant data.We found that there was no way to remove old records without importing a completely new dataset. The only way to remove old items "quickly" was to use a filter expression to filter them out of recommendations (they were still, however, in the model). Essentially, you can create a status field for each of your items/users, and update it with a putItems or putUsers call and set the status to deleted or inactive, then use a filter expression to filter these out (e.g. filter out items with STATUS = INACTIVE).This does not actually remove the item from your dataset, rather, just filters them out. This was a major issue for us with personalize because the model was still trying to recommend these now irrelevant items to users, but was just being filtered out of the recommendations.This is how i understand it, I could be wrong, however. It would be great if there was new functionality added to actually remove items from a model, i hope it comes soon.CommentSharelaw-dwganswered 2 years ago0Hi law-dwg,Thank you for the reply. It's very helpful for me.I'm using filter expression now. i hope the new functionality comes soon.Thanks again :)CommentSharehdseoanswered 2 years ago"


Question: Greengrass Stream Manager payload size

"According to Stream Manager SDK, the segment size can be between 1KB and 2GB. However, IoT Analytics and Kinesis support payloads of up to 128KB and 1MB respectively. Does Stream Manager chunk the data when exporting to a destination and if so, is this done in a predictable manner?FollowComment"

Answer: 0Accepted AnswerAs far as I understand the segment size has nothing to do with the amount of data that is exported to an endpoint. The stream manager itself respects the limit of the endpoints. For Kinesis for example it has a max payload size of 1MB and batch size of 500.I don't know if stream exporter splits up larger messages or if the will result in an export error.CommentSharePhilipp Sanswered 3 years ago


Question: Snowflake Pipe creation with SNS topic fails with the following error : Invalid Parameter

"Hi All- I am trying to create a snowflake pipe and it fails with the following error090040 (XX000): Pipe Notifications bind failure "Invalid parameter: TopicArn (Service: Sns, Status Code: 400, Request ID: d7fbc360-1faf-5216-bfab-9f037f6ac63d): AwsErrorDetails(errorMessage=Invalid parameter: TopicArn, errorCode=InvalidParameter, serviceName=Sns)"Here is a documentation for reference https://docs.snowflake.com/en/user-guide/data-load-snowpipe-auto-s3.html#prerequisite-create-an-amazon-sns-topic-and-subscriptionCan someone shed light on how to resolve this. Though this is a snowflake error but I believe it has to do with configs on AWS which is causing this errorFollowComment"


Question: How to check email logs using message ID

"I am using Amazon SES service so when I trigger any email to SES then in response I get a message-id now I want to check logs for that particular messageId whether the email got bounced, dropped, or successfully sent.FollowComment"

Answer: "0SES logs can be obtained according to the following documentation.The log contains a "messageId" and can be found by searching for the corresponding ID.https://repost.aws/knowledge-center/ses-email-sending-historyIn this document, the OpenSearch Service is set up, but if the Kinesis destination is set to S3, logs will be output to S3.CommentShareEXPERTRiku_Kobayashianswered a month ago0Hey!Thanks, @riku for your response.CommentShareRitik Jainanswered a month ago"


Question: Not able to read S3 Parquet file

"Hi Team,I'm trying to read Parquet files in S3, but I get the following error.Please help.I'm not sure if the data inside the parquet file is corrupt or I'm unable to read the file due to datatype mismatch.Any help would be much appreciated.df = spark.read.parquet("s3://xxxxxxx/edo_sms_replica_us_stg/event_t/TESTFILES/LOAD00000CAD.parquet")An error was encountered:Invalid status code '404' from http://ip-xx.xx.xx..awscorp.siriusxm.com:8998/sessions/168 with error payload: {"msg":"Session '168' not found."}FollowComment"

Answer: "0Hi - You can either use "Query with S3 Select" option from the S3 console if the compressed file size is less than 140 MB Or use the s3api (https://docs.aws.amazon.com/cli/latest/reference/s3api/select-object-content.html) CLI to validate if the parquet file is a valid one.aws s3api select-object-content \    --bucket my-bucket \    --key my-data-file.parquet \    --expression "select * from s3object limit 100" \    --expression-type 'SQL' \    --input-serialization '{"Parquet": {}, "CompressionType": "NONE"}' \    --output-serialization '{"JSON": {}}' "output.json"Another option is to use AWS Glue Crawler to load the parquet file and query via Athena - https://docs.aws.amazon.com/glue/latest/ug/tutorial-add-crawler.htmlCommentShareEXPERTGokulanswered a year agoMayura a year agoThanks Gokul. But, I'm not able to read the parquet file using S3 select in the coonsole or form API. In S3 select - it says "Successfully returned 0 records" (the file size is 40MB). In AWS CLI, the output is always "aws command usage option", no output or error. No error is displayed in both cases. How do I figure out if the file is invalid? Why is the file not being read?.ShareMayura a year agoThis is the error we get -An error was encountered:An error occurred while calling o91.parquet.: org.apache.spark.SparkException: Job aborted due to stage failure: Task 0 in stage 1.0 failed 4 times, most recent failure: Lost task 0.3 in stage 1.0 (TID 7) (ip-xx.xx.xxx.awscorp.siriusxm.com executor 11): org.apache.spark.sql.AnalysisException: Parquet type not yet supported: INT32 (TIME_MILLIS)at org.apache.spark.sql.execution.datasources.parquet.ParquetToSparkSchemaConverter.typeNotImplemented$1(ParquetSchemaConverter.scala:104)Share"


Question: Can not access Cloud9 - Hangs on connecting

"For several days I was unable to connect to any Cloud9 instance, even instances shared with my colleagues that they could still access. It would start the instance, but then hang on "Connecting", eventually giving me a message that it was taking too long and that I should contact support.In the browser console I had a lot of errors about "CORS request did not succeed".Support helped me figure out that there was nothing wrong with the VPCs or any other settings. We came to the conclusion that there's something wrong with my network, since using another internet connection worked fine.After a bit of debugging I found out that my ISP had an issue with their DNS lookup. Switching from their default lookup to 1.1.1.1 solved the problem.Posting this here so that it becomes searchable for anyone else that might have similar problems.FollowComment"

Answer: 0DNS lookup was the problem. Switching to 1.1.1.1 (Cloudflare's lookup service) solved the problem.CommentShareleonljanswered 3 years ago


Question: "You can't have two CIDR ranges and two private IPs with a NAT Gateway, right?"

"I assume the answer is "no" based on the following documentation, but just wanted to make sure:You can pick the private IP address to assign to the NAT gateway or have it automatically assigned from the IP address range of the subnet. The assigned private IP address persists until you delete the private NAT gateway. You cannot detach the private IP address and you cannot attach additional private IP addresses.Source: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html#nat-gateway-basicsFollowComment"

Answer: 1Short Answer is:NoLong Answer is:VPCs can have multiple CIDR ranges but a Subnet can only have a single IPv4 and IPv6 range assigned.As NAT devices have endpoints in the Subnet they can only be allocated a single IP per Subnet.Alternate Solution is:You could create multiple public subnets.The first set of subnets could be out of the primary CIDR and the second set of subnets with IPs out of the secondary CIDR(s).Then when creating the NAT have endpoints created in all subnets.The question is why would you want a NAT Gateway to have 2 IPs?As both IPs would be considered "VPC Local" you would route to both IPs the same.The would be no real reason to want 2 IPs on the NAT device.CommentShareRobin Fordanswered 6 months ago


Question: How to use instance metadata from within Cloudwatch agent config

"I would like to add a dimension to several metrics using "append_dimensions" into Cloudwatch agent config.As specified here, it says "If you specify a value that depends on Amazon EC2 metadata". How do I specify a value, of a specific instance tags from instance metadata, for example?Is it "append_dimensions": { "Environment": <how to reach an instance tag called Environment> }?FollowComment"


Question: Documentation bug report for rds

This doc says default value for forcessl is 0 but for postgres 15 default param group it’s 1FollowComment

Answer: "0Hi,If you believe is incorrect, you can submit a PR to modify that page here: https://github.com/awsdocs/amazon-rds-user-guide/blob/main/doc_source/PostgreSQL.Concepts.General.SSL.mdHope it helpsCommentShareEXPERTalatechanswered 3 months ago"


Question: AWS Backup- EC2- Backup job expired before completion.

AWS Backup job is expiring Without completions. What can be the reasons? What are are the possible resolutions.I see the following informationBackup job expired before completion for some 10 jobs to backup EC2I see some backup jobs are taking more than 24 hours to complete even though size of EC2 instances in GB for example10-20 GB from most EC2 instancesBackup job failed because there was a running job for the same resource for  for some 20 jobs to backup EC2. This makes sense because the previous job may not have been completeFollowComment

Answer: "0On a general note, the error “Backup job expired before completion” occurs when the backup of the instance is not completed within the backup window. You have an option to define the backup window “Completed within” in the backup rule configuration.“Complete within” value defines the period of time during which your backup must complete. If the data transfer for backing up your resource does not complete during this period of time, AWS Backup will display the status Expired. Otherwise, the data transfer portion of your backup job completed successfully.Backup of an instance is dependent on various factors including but not limited to the size of the volumes attached to the instance:() Last Snapshot - Since the snapshots of EC2 instances are incremental in nature, the more the changes since the previous snapshot the more time will be taken to finish the backup.() I/O Operations - If the number of I/O operations are high during the time the instance is being backed up, then it will take longer for the instance to be backed up.Additionally, since there is no SLA for the time taken to backup an EC2 instance, it is not possible to predict how much time it will take for the backup to finish as there are many variables that might come into play during the backup which is the reason why the backup fails sometimes.I advise you to verify the time value defined at the “completed within” in your backup configuration. To resolve / avoid this error, I advise you to increase the backup window by navigating through the below path:AWS Backup -> Backup plans -> [Bakcup plan NAME] -> SELECT [BACKUP RULE] -> click on “Edit” -> Choose “Customize backup window” -> “Complete within”References:=> https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup-plan.html?icmpid=docs_console_unmapped#backup-rules=> https://docs.aws.amazon.com/aws-backup/latest/devguide/updating-a-backup-plan.htmlCommentShareGanesh_Canswered 6 months ago"


Question: IPv6 not working on Linux EC2 instance

"New EC2 instance.  IPv4 connectivity works fine.Added IPv6 to SecurityGroup, Subnet, and made sure it's enabled on eth0.Linux sees Global IPv6 address in ifconfig.IPv6 routing looks good. (netstat -nr6)ping6 resolves name to IPv6 address, but remote sites do not respond.SG permits all ICMP ipv6 in, ssh ipv6 in,  All ipv6 outinet6 2600:1f16:8cf:d105:2c0f:2059:d33c:c494  prefixlen 128  scopeid 0x0<global>ThanksFollowComment"

Answer: "1Accepted AnswerHi, when you said "but remote sites do not respond" do you mean ping is not successful? Can you clarity this part please. Do you have:an Egress Only Internet Gateway set up in your VPC?, and configured it as gateway for ::/0 in the route table?Any possible Network ACLs permit for incoming and outgoing IPv6 traffic?Within your instance, could you check that an IPv6 default route is set as per the "default via … proto ra": #ip -6 route showCommentShareVicky Gracianoanswered 5 months agoEXPERTTushar_Jreviewed 5 months agoJohn Schauer 5 months agoThanks!  My VPC was missing a default IP6 route.[ec2-user@amber ~]$ ping6 google.comPING google.com(ord38s29-in-x0e.1e100.net (2607:f8b0:4009:818::200e)) 56 data bytes64 bytes from ord38s29-in-x0e.1e100.net (2607:f8b0:4009:818::200e): icmp_seq=1 ttl=95 time=17.9 ms64 bytes from ord38s29-in-x0e.1e100.net (2607:f8b0:4009:818::200e): icmp_seq=2 ttl=95 time=17.8 ms^C--- google.com ping statistics ---2 packets transmitted, 2 received, 0% packet loss, time 1000msrtt min/avg/max/mdev = 17.889/17.898/17.907/0.009 msShare"


Question: Amplify PubSub without cognito

"I have a simple react app running on fargate that uses pubsub to publish/subscribe to mqtt topics in iot core. I am using cognito for permissions as described in the docs. https://docs.amplify.aws/lib/pubsub/getting-started/q/platform/js/I'd like to set something up that instead uses the iam role of the container. Is this possible with amplify pubusb? If not, what alternative would you recommend?I've looked into the v3 javascript sdk a bit, but I'm having trouble figuring out how to publish/subscribe to topics, and to be honest am not even sure if the javascript sdk is meant for what I want to do.FollowComment"

Answer: 0Hi rujoesmith. Apologies that you didn't get an answer sooner after asking.The AWS SDK JS V3 is for the HTTP APIs. It's not possible to subscribe over HTTP. Thus the IoT Data Plane API only has a publish operation.More information about AWS IoT protocol options here: https://docs.aws.amazon.com/iot/latest/developerguide/protocols.htmlOne alternative to Amplify pubsub is to use the AWS IoT Device SDK. JS V2 in this case: https://github.com/aws/aws-iot-device-sdk-js-v2You can use the device SDK to connect to the MQTT broker over websocket: https://github.com/aws/aws-iot-device-sdk-js-v2/blob/main/samples/node/websocket_connect/index.tsCommentShareEXPERTGreg_Banswered a year ago


Question: Sagemaker Ground truth pdf annotation tool not rendering anything

"Hello, I have followed these docs https://docs.aws.amazon.com/comprehend/latest/dg/cer-annotation-pdf.html  and have gotten to the point in which I have created the annotation task and I have uploaded several pdf's to a s3 bucket to be used for an annotation task so I can create a comprehend model. I put myself and a co-worker as annotators just so I can verify that I can set up the task properly and I only uploaded 37 pdf's. However when both of us log in and start the task, the webpage loads as the instructions tell us to however there is no pdf rendered (though I think I see it briefly flash on the screen before it goes blank) and there are also no entities to be selected as a part of the ui unlike how the documentation pictures the tool. I am trying to do named entity recognition and created this task with the full 25 entities I want to be able to label and Also another time with only 5 entities to label. However there seems to be something wrong with this native pdf annotation feature.FollowComment"

Answer:
"0Dear Customer,

Thank you so much for reaching to us. I understand that you followed our AWS Comprehend documentation for annotating PDF’s, in-order to annotate your training PDFs in SageMaker Ground Truth. Further yourself and your team is working as private annotators, in-order to facilitate the task appropriately. However when you and your co-workers login to the page for annotation in Sagemaker Ground truth, the webpage does not list any pdfs and the page is blank.
Hence you were looking for guidance in resolving this issue.

Thank you so much for providing the details.

To further better assist you on this issue, can you please create a Support Ticket to AWS. Below link will assist you to create the Support Ticket.[+]https://docs.aws.amazon.com/awssupport/latest/user/case-management.html

[+]https://console.aws.amazon.com/support/home#/case/create—While creating the support ticket, we kindly request you to provide the below informationUse-case description.Ground Truth Job ARN detailsScreen-shots of the issue you are facing.Log Files for the Ground truth Job(This logs from your labeling jobs appear in  Amazon CloudWatch under the /aws/sagemaker/LabelingJobs group.).The reason behind this ask is this would help us to understand your use-case in a better way, further if we might need to deep dive and access the job created from our internal tools, we will have more visibility through the support ticket.Rest assured we will do everything best in our abilities to assist you on this issue.

Thanks.CommentShareAWS-User-anuanswered a year ago0I have found out that when this tutorial is carried out on windows, you get an error after creating the job, which is the labeling portal UI is blank.This happens because for some reason in the s3 bucket created here, when you go here comprehend-semi-structured-docs-ui-template/ and then inside the folder of your job, you will see that the name of S3 folders is having some formatting issue. Instead of '/' that represents folder layer, the bucket name is using '' and making the request failed. Thus, it is recommended to rearrange or rename your s3 bucket folders accordingly and this solves the issue.CommentSharerePost-User-3066130answered 3 days ago"


Question: cloud9 environment not visible

I followed the c9 workspace migration steps from c9.io but I don't see any environments when I click on "Your Environments" in aws cloud9 menu. I saved the cloud9 environment direct link which looks like https://console.aws.amazon.com/cloud9/ide/alphanumerics and I am able to go to the direct link after I sign into my aws console.The link https://console.aws.amazon.com/cloud9/ doesn't have the environment. I checked under all the different regions and I don't see the environment I had created while migrating fom c9.ioEdit:I created a new cloud9 environment from AWS console and I can see it in the Your Environments page. But I still don't see my previous environment.FollowComment

Answer: 0Today I found my previously created environment in a different region. Had to click on each region and then on the menu bar to go to "Your Environments"I guess I will either delete it and recreate it in the desired region so that I can see all my environments in one place.CommentSharesam-khananswered 4 years ago


Question: How to use CloudFormaiton to create IOT Thing Group

I cannot find in the documentation on how to use cloudformation to create-thing-group. Is this possible?FollowComment

Answer: "1I couldn't find any update to the CDK spec on this or on adding things to thing groups. I had to go with custom resources, like below:   const myThingGroup = new cr.AwsCustomResource(this, 'my-thing-group', {      onCreate: {        service: 'Iot',        action: 'createThingGroup',        parameters: {          thingGroupName: 'my-tg-name'        },        physicalResourceId: cr.PhysicalResourceId.of(Date.now().toString()),      },      onDelete: {        service: 'Iot',        action: 'deleteThingGroup',        parameters: {          thingGroupName: 'my-tg-name'        },      },      policy: cr.AwsCustomResourcePolicy.fromSdkCalls({        resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,      }),    });When I added and removed things to/from thing groups, I needed to use addDependency otherwise cdk destroy failed, like this:    myThingThingGroupDetachment.node.addDependency(myThing)    myThingThingGroupDetachment.node.addDependency(myThingGroup)Hope this saves some time for someone.CommentSharegaryanswered 3 months ago0At this moment, we have to either create custom resources or use the APIs.CommentShareEXPERTAWS-User-Nitinanswered 9 months agoPhil Begg 9 months agoCan you have cloudformation trigger an API?I jus want to create the User group on creation and delete it if the stack is deletedShareAWS-User-Nitin EXPERT9 months agoYou can try it via custom resource, please refer https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-custom-resources.htmlShare"


Question: Aws Lightsail with word-press

now  Host Error website not open try to restart light sail but error not solve ip my address not ping what will doFollowCommentJoseph Gruber 6 months agoCan you post the exact error you're receiving?Share

Answer: "0Hello,Lightsail provides a variety of metrics to help monitor instance health status. It might be helpful to check these metrics to see if anything goes wrong. Here's a document in regards of instance metrics: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-viewing-instance-health-metrics#viewing-instance-metrics-consoleIf metrics does not help, could you please error logs here? So that we can take a look together to understand the root cause.Hope it helps!!CommentShareAWS-User-3437852answered 6 months ago"


Question: Issue when creating DMS endpoint to connect with MSK using Mutual TLS authentication

"I have setup DMS to connect to MySQL database as the source and Kafka as target.I tested the source and target flow without TLS authentication works fine.Now I want to setup DMS with Kafka endpoint using TLS authentication.I tried out this link to check if I am able to connect using TLS authentication to Kafka cluster using the certificates generated, which worked. I used this with Glue as well and the connectivity works.Now for DMS, I followed the steps provided here ( Section: Using SSL authentication ). But when I test the endpoint I get the error: Test failed due to KMS key Exception : No permission to access Key 'arn:aws:kms:ap-southeast-2:xxxxxxxxxxxx:key/xxxxxxxxxxxxx'. The KMS key here is the default key that DMS creates when we launch a replication instance.I tried using a CMK for DMS and created the endpoint using this KMS key. But it did not work. In this case, the endpoint errored out saying it could not connect to Kafka.Not really sure what the issue is. Has anyone come across this issue?FollowComment"

Answer: "0Hi,It's seems that your DMS instance is assuming an IAM Role with some missing authorization to access your KMS key. Did you already try to update your IAM role and allow access to your Key ARN ?Hope it helps.CommentShareaaagiusanswered a year ago"


Question: S3 CORS policy for " Access-Control-Allow-Private-Network"

I'm communicating with an MCU via SSE and need to be able to do this over http (mcu doesn't support ssl).  My react code is hosted in a static site on S3.   How can I set this preflight header in the S3 bucket permissions CORS policy ?  Please provide a working example if this is possible.FollowComment


Question: Not receiving traces sent by DAPR + Opentelmetry Xray exporter setup

"To collect traces from DAPR we are using Opentelemetry collector and using Zipkin receiver since that's supported by DAPR and using awsxray exporter in open telemetry configuration. We see the traces generated in Opentelemetry log, however we do not see traces collected in AWS Xray. Please let us know what could be the issueOpen telemetry configuration:receivers:zipkin:endpoint: 0.0.0.0:9411otlp:protocols:grpc:endpoint: 0.0.0.0:4317http:endpoint: 0.0.0.0:4318awsxray:awsxray/udp_endpoint:endpoint: "0.0.0.0:5678"transport: udpawsxray/proxy_server:proxy_server:endpoint: "0.0.0.0:1234"tls:insecure: trueregion: ap-south-1Exporter configuration:  awsxray:    region: ap-south-1    index_all_attributes: true    resource_arn: "arn:aws:iam::215977048474:role/EKS-NodeGroup"    #role_arn: "arn:aws:iam::215977048474:role/MastBazaar-EKS"    no_verify_ssl: trueService configuration:service:  extensions: [pprof, zpages, health_check]  pipelines:    traces:      receivers: [zipkin]      # List your exporter here.      exporters: [awsxray,logging]Also added environment variable OTEL_PROPAGATORS: "xray" in deployment as seen below  containers:  - name: otel-collector    image: otel/opentelemetry-collector-contrib-dev:latest    env:    - name: OTEL_PROPAGATORS      value: "xray"Sample log in open telemetry2022-09-13T18:15:46.106Z        INFO    loggingexporter/logging_exporter.go:42  TracesExporter  {"#spans": 1}2022-09-13T18:15:46.106Z        DEBUG   loggingexporter/logging_exporter.go:51  ResourceSpans #0Resource SchemaURL:Resource labels:-> service.name: STRING(multiplyapp)ScopeSpans #0ScopeSpans SchemaURL:InstrumentationScopeSpan #0Trace ID       : 5db6a8eb0ade84a251ca547034b13c5fParent ID      : 9987294085d81f24ID             : f88d24f02301bf28Name           : CallLocal/multiplyapp/multiplyKind           : SPAN_KIND_SERVERStart time     : 2022-09-13 18:15:44.031751 +0000 UTCEnd time       : 2022-09-13 18:15:45.034974 +0000 UTCStatus code    : STATUS_CODE_UNSETStatus message :Attributes:-> dapr.api: STRING(/dapr.proto.internals.v1.ServiceInvocation/CallLocal)-> dapr.invoke_method: STRING(multiply)-> dapr.protocol: STRING(grpc)-> rpc.service: STRING(ServiceInvocation)-> net.host.ip: STRING(10.0.195.115)2022-09-13T18:15:54.505Z        INFO    loggingexporter/logging_exporter.go:42  TracesExporter  {"#spans": 1}2022-09-13T18:15:54.505Z        DEBUG   loggingexporter/logging_exporter.go:51  ResourceSpans #0Resource SchemaURL:Resource labels:-> service.name: STRING(multiplyapp)ScopeSpans #0ScopeSpans SchemaURL:InstrumentationScopeSpan #0Trace ID       : c3f98c14589d4618899f4581503e4c3fParent ID      : 642dd665bbc6c3ddID             : 014fec0dfb862b5cName           : CallLocal/multiplyapp/multiplyKind           : SPAN_KIND_SERVERStart time     : 2022-09-13 18:15:53.489635 +0000 UTCEnd time       : 2022-09-13 18:15:54.492579 +0000 UTCStatus code    : STATUS_CODE_UNSETStatus message :Attributes:-> dapr.api: STRING(/dapr.proto.internals.v1.ServiceInvocation/CallLocal)-> dapr.invoke_method: STRING(multiply)-> dapr.protocol: STRING(grpc)-> rpc.service: STRING(ServiceInvocation)-> net.host.ip: STRING(10.0.195.115)Any guidance will be very much appreciatedFollowComment"

Answer: "0Hi,Please check whether you have aws credentials configured on OTel collector host? For example, by environment variable https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials_environment.htmlAnd because XRay does not accept random 128-bits trace id, please ensure configure xray id generator in root service.The env variable OTEL_PROPAGATORS=xray is for OTel SDKs. OTel collector does not need it.CommentShareAWS-User-3368379answered 8 months ago"


Question: How can I serve a webflow.com blog under a subdirectory of my site using cloudfront/lambda@edge?

I have a website served by cloudfront athttps://mysite.com using S3 origin.I have a webflow blog project using a custom domain pointing to http://blog.mysite.com via CNAME in route53.How can I serve the webflow blog project directly under https://mysite.com/blog ?Using the subdomain https://blog.mysite.com is not preferable for SEO reasons (but the subdomain is live and operational pointing to the webflow project)Can I achieve this using lambda@edge?FollowComment

Answer: "0You should be able to do this in CloudFront using multiple CacheBehaviors and Origins.  The default CacheBehavior stays as now, pointing to your S3 Origin.  Add a 2nd CacheBehavior with a PathPattern "blog/*" pointing to the Custom Origin URL for your webflow blog.CommentShareEXPERTskinsmananswered a year agoborg a year agoHey @skinsman, thank you for the suggestion! I tried implementing this however when I visit https://mysite.com/blog, it redirects to https://blog.mysite.com/blog. What I want to do is have the blog actually render under mysite.com/blog but maybe that's not possible unless I'm self hosting the assets?To get the above working I created a CacheBehavior with PathPattern: blog/* and custom origin with domain blog.mysite.comShareMG a year agoBorg, you did well and it should rewrite, not redirect. So the user should still see https://mysite.com/blog.This is a standard CloudFront feature.Share"


Question: Cross-account Route 53 access using IAM Identity Center permissions

"I'm trying to make changes to a Route 53 hosted zone in one account (Account A), from a different AWS account (yep – Account B). The two accounts are enrolled in the same Organisation. We use IAM Identity Center to sign in (so not vanilla IAM).I have edited the permission set for the Identity Center user, with an inline policy to allow access to the Route 53 hosted zone:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "route53:GetHostedZone",                "route53:ChangeResourceRecordSets",                "route53:ListResourceRecordSets"            ],            "Resource": [                "arn:aws:route53:::hostedzone/<zoneid>"            ]        }    ]}However, I keep getting permission denied errors:% aws route53 get-hosted-zone --profile staging --id <zoneid>An error occurred (AccessDenied) when calling the GetHostedZone operation: User: arn:aws:sts::<account-b>:assumed-role/AWSReservedSSO_AdministratorAccess_<etc>/<identity-center-user> is not authorized to access this resourceI've checked the user is correct with aws sts get-caller-identity --profile staging.The same request from my Identity Center user signed in to Account A (aws route53 get-hosted-zone --profile develop --id <zoneid>) works as it normally would, with a description of the zone.As a sanity-check I also made a role in Account A to allow a trust relationship with the Identity Center user, and group, and account root, but still get the same error.… which makes me wonder if there are some Route 53 wrinkles that make x-account access a bit trickier. AWS seems to think it should be doable though!Will appreciate any guidance, thank you.FollowComment"

Answer: "0I don't see in the documentation where it says that you can do what you're trying to do.To clarify:You have a Route 53 zone created in account A.You want a user in account B to manage the zone in account A.The way to do this is:Create a role in account A that has the required permissions.Give permission to the role in account B to assume the role in account A.When authenticated as the role in account B (which it appears you are); assume the role in account A.Use the new credentials to perform the Route 53 actions in account A.The documentation you've linked to does mention this in the section that starts with Attach a permissions policy to a role (grant cross-account permissions).CommentShareEXPERTBrettski-AWSanswered 2 months agoEXPERTkentradreviewed 2 months agoMC a month agoThanks Brettski-AWS … makes sense and this is how I've done it in the past for a normal IAM user.I'm clearly missing something, but the reason I went this way is that I don't see anyway to associate a role with an IAM Identity Center user. That's why I was trying to set up the permissions using an inline policy on the Permission Set.You had this bullet point:When authenticated as the role in account B (which it appears you are); assume the role in account A.I'm authenticated as an Identity Centre user, belonging to the admins group, which through AWS Accounts has permissions for the Administrator Access permission set. I can apply policies to the permission set, but not roles.Again, I'm clearly missing something – you may be able to enlighten me.ShareMC a month agoOh, it's probably relevant to mention that I am trying to this as part of updating a Cloudformation template. So I can't completely switch roles.I update the stack with an updated version of the Cloudformation templateThe stack is modified within the current AWS account, Account BSome changes require changes to DNS, which is hosted in Account ASo I want the current user, running a Cloudformation template in Account B, to be able to modify DNS settings in a zone in Account A.ShareBrettski-AWS EXPERTa month agoOk - so because you're trying to do this as part of CloudFormation, the answer is to use a custom resource although it might be possible with a StackSet. Personally, I think a custom resource is better because you're trying to update DNS which is usually something that requires a little more logic.Share"


Question: Sharing files between VPCs

"My customer wants to share the CI/CD artifacts that they generate in their build environment to be shared in DEV/UAT/PROD and other environments. They are looking at using EFS for this file share, but they don't like the need to do VPC peering in order to make the EFS available across VPCs. They also dont want to use S3 as they are looking for a traditional file system which can be mounted and used during the build process.One option I could think of is to setup a EFS file system in every VPC and sync from the build environment to the target VPC using AWS DataSync. It would not be an automatic sync, so they will have have to call "StartTaskExecution" the source file system changes.Are there any other solutions which they can consider?FollowComment"

Answer: "0Accepted AnswerSome options:Use EFS with VPC Peering and/or Transit Gateway - I would explore why the customer doesn't want to do this, since it seems to make the most sense, is the easiest to manage, most cost-effective, (and can be tightly locked down with routing, security groups, NACLs, etc.)Use File Storage Gateway in each VPC, connected to a single S3 bucket; have the build environment write to it, and have the others in "read-only" mode that would access the files from their File Storage Gateway.  Does what you want, but would incur additional costs (File Storage Gateway plus EC2 instance in each VPC).Use S3 and mount it using something like S3FS.  Typically works for low volumes and change rates, but can have performance and reliability issues at scale.CommentShareEXPERTmhjworkanswered 4 years ago"


Question: Multiple Labels for the Same Object

"Hello,For a model that has two different classes, rust and scratches, and there happened to be a rusty scratch, would it confuse the model to annotate the same spot with both classes?Let me know if you need more clarification.I appreciate the thoughts!MattFollowComment"

Answer: "0What API or feature is this referring to? Is the label referring to Rekognition Custom Labels?CommentShareAWS-User-3408220answered 3 years ago0Hi MattSolarVox,Our models are capable of handling the situation of multiple labels being assigned to the same region where multiple labels apply. As a practical matter, for your example, ideally the region would be a good example of both labels, i.e. it looks like rust, and looks like scratches, when considered separately. In that case the model should learn the relevant information for both. It would depend on your data though.Thanks,ChristianDAtAWSCommentShareaws-cdunnanswered 3 years ago"


Question: SELECT query on pg_catalog.pg_largeobject fails with a permission error

"Hi,A framework I use requires access to pg_catalog.pg_largeobject, but the master user doesn't seem to have access to the table.GRANT SELECT ON pg_catalog.pg_largeobject TO $MASTER_USER also fails with "ERROR: role $MASTER_USER does not exist"Is there any way to access the table?I know there are some tables the master user can't access, such as pg_authid, but I want to confirm the table is one of them.RDS: Aurora Serverless v1 PostgreSQL10ThanksFollowComment"

Answer: "1Accepted AnswerUnfortunately, Aurora Serverless v1 PostgreSQL 10 does not support access to the pg_largeobject table. This table is only available on Aurora PostgreSQL v11 and above, and Aurora Serverless does not support v11 or higher. You'll need to upgrade to Aurora Serverless v2 or use Aurora PostgreSQL v11 if you need access to this table.CommentShareDivyam Chauhananswered 4 months agoamrael 4 months agoThank you for clarifying the limitation. I'll consider the database migration then.Share"


Question: How to tell which web server software my ec2 instance is using?

"I've inherited maintenance of some ec2 instances, one of which I'm trying to enable certbot on to automatically renew the SSL, I've previously been using certbot certonly to manually make a new SSL when needed. It's installed via snap, however it's not able to automatically renew the SSL due to not detecting the server's config, and I'm not sure what web server software is being used so that I can provide the config to certbot, as I'm not very familiar with linux server configurations & the server was originally setup by someone else.The server is running Ubuntu 18.04.5 LTS, I've tried running these commands, neither apache nor nginx seem to be running:which nginx & which apache2ctl - returns nothingps aux | grep apache & ps aux | grep nginx - returns only the grep process itselfsudo netstat -tuln | grep -E '80|443' - returns 8080, 80, 8443, & 443 ports as tcp6       0      0 :::8080                 :::*                    LISTEN for each point, swapping 8080 for the relevant portls /etc/apache2/ & ls /etc/nginx/ &  ls /etc/httpd/- returns 'no such file or directory'However the server is actively serving content, and the web page(s) it's serving are reachable on the web, so something is serving the content.I have full ssh access to the server, and I'm performing these actions on a cloned image on a new ec2 instance that I've pointed the original domain to with Route53 so that I'm seeing the cloned server's content, but I'm able to switch back to the previous working instance/image if needed. If any additional info is needed let me know & I can provide it ASAP.FollowCommentHigher 11 days agoWhat is the full ouput of the netstat | grep  -E '80|443', it should say the process that is using those ports, that way you could see what program is running.SharerePost-User-5556571 11 days ago@Higher running  sudo netstat -tulnp | grep -E '80|443' (added -p to show PIDs) gives:tcp6   0   0 :::8080   :::*    LISTEN   1139/javatcp6   0   0 :::80    :::*    LISTEN   1139/javatcp6   0   0 :::8443    :::*   LISTEN  1139/javatcp6   0   0 :::443   :::*   LISTEN   1139/javaand the PID 1139 currently belongs to /root/.javax/x30.jarThe content being served has it's code at /root/JavaX-Code/ & transpiles on reboot.Could the Java app be acting as it's own web service? I'm not at all familiar with Java, I apologizeShareRWC 11 days agoI'll say in advance that i have my doubts this will provide anything useful, but there's no harm in trying it.What do you get from "curl --head http://localhost:80" (and retry for all the other ports above), does it return a "Server:" entry in its output?Share"

Answer: "1Accepted AnswerHello @rePost-User-5556571, yes the Java process /root/.javax/x30.jar is running its own HTTP service, it does not look as any know J2EE server like weblogic, tomcat, glassfish, etc. It looks like a custom bundle app. Try to look in the following directories  /root/JavaX-Code/ and  /root/.javax/ and look for a jks o keystore file, maybe they left there the keystore where the current SSL certificate is.If so, you can create a new keystore and replace the existing one with your new cert.Hope this helps.CommentShareHigheranswered 10 days agorePost-User-5556571 10 days agoThank you very much for your help, Yes it's definitely an embedded web service in the java app, I've been poking around the transpiled & non-transpiled code. I do have access to the keystore (.p12) file.Previously, I've been updating the SSL when needed by re-running letsencrypt-renew, updating the DNS txt record & making a new validation.txt file containing Certbot's validation string.Does it sound like it will be possible to get Certbot to automatically renew the SSL if I make a new keystore, or will the embedded java server prevent it from renewing automatically?ShareHigher 10 days ago@rePost-User-5556571 you should be able to renew it, and just replace the cert in the keystore as long as you have the request and the cert is generated from the same request, thing that I think is not possible with letsencrypt, that's why you will have to create a new keystore as is going to have a new certShare0Hi, you may alternatively try wget --save-headers <url> from a desktop remote from the server to get the external viewCommentShareDidier_AWSanswered 10 days ago"


Question: Why do I need Ephemeral ports open for http 80 (website to work)?

Why do I need Ephemeral ports open for http 80 (website to work)?Can someone please help me understand if I am creating a NACL why do I need Ephemeral ports on the outgoing for a http request to work?FollowComment

Answer: "0NACLs are stateless, the response is not implicitly allowed therefore you need to explicitly allow the Ephemeral ports. On the other hand Security groups are stateful, you only would need to allow inbound access, return response would be allowed implicitly.CommentShareEXPERTTushar_Janswered 4 months ago0yea.. I am understand that that I have port 80 up inbound and also outbound..... just dont understand why I need the ephemeral ports open for http.. I would think if I have port 80 allow on the in and out it would workCommentShareJohnathanSmithanswered 4 months ago0For http the Request traffic is on port 80.  Response traffic isn't on port 80, it's on one of the ephemeral ports.  So for inbound connections your NACL needs to allow port 80 inbound but NOT outbound!  Just the ephemeral ports outbound.CommentShareEXPERTskinsmananswered 4 months ago0Let's say I connect to your webserver, which is listening on port 80.The TCP connection originates from a socket on my device, which is bound to an ephemeral port. It'll connect, say, TCP port 54785 on my Mac to port 80 on your webserver.Stateful firewalls understand that the traffic sent from port 80 on your webserver to port 54785 on my machine represents a connection / conversation, so they don't need explicit rules to permit the traffic.NACLs on the other hand are completely stateless, and have no concept of what has happened at any other point in time, much like an AWS service team building a way to run containers, oblivious of the countless other services that do the same thing. As a result, the traffic from port 80 to the ephemeral ports has to be explicitly permitted.All of that said, the default best practice guidance on NACLs is "avoid them if at all possible." They're annoying to troubleshoot, and easy to forget they're there...CommentShareQuinnyPiganswered 4 months ago"


Question: Is there a way to rename an Elastic Beanstalk Environment?

"Hi,Is there a manual way to rename an EBS environment (other than cloning)?I have to keep the first successful Elastic Beanstalk environment that I create for a purpose, and usually it is not easily replicable as I add external services manually and configure networking settings.Once the environment works, I use it, but since they cannot be renamed I have to stick with the current name. (Forget about cloning since it won't work, it won't clone everything I need) Currently my production and test environments are named something like xyz-test4 and xyz-test5ThanksFollowComment"

Answer: "0Hello,It's not possible tio change an environment name.Extract of AWS documentation :Environment informationSet the environment's name and domain, and create a description for your environment. Be aware that these environment settings cannot change after the environment is created.link to documentation : https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environments-create-wizard.htmlCommentShareSylvain_BRUAS_TeamWorkanswered 2 months ago"


Question: Greengrass component deployment question

"HelloI'm going to deploy a component with AWS Greengrass v2.I will deploy the recipe I wrote to Raspberry Pi4.The artifacts in the recipe are associated with a face recognition inference code in the S3 bucket.I'm curious.Can you make the component deployment run automatically whenever I request it? Like it's triggered like a lambda. Or it doesn't have to be this. If this is possible, I would like to know what the command to do it in boto3 is.Or is it possible to have the deployment run only at a certain time?Please let me know. Thank you.FollowComment"

Answer: 0You can look into Trigger AWS IoT Greengrass component deployments from AWS CodeCommit - https://aws.amazon.com/blogs/iot/trigger-aws-iot-greengrass-component-deployments-from-aws-codecommit/CommentShareEXPERTAWS-User-Nitinanswered 7 months ago


Question: Does each AWS account in an organization has its own root account user?

Points of My Scenario:I'm an AWS newbieI have created an organization structure 2 levels deepI have created a second account and placed it in one of my two second-level OUsI want to know whether the second account I created has its own root account user.FollowComment

Answer: "0Accepted AnswerYes, for each AWS account you created in a AWS Organizations has its own root user. The Email address of the account's owner that you specified is the root user access.CommentSharejcvipanswered 7 months agoEXPERTTushar_Jreviewed 7 months agowaltforbes 7 months agoAhhh yesss! It works! That's exactly what I needed to know & understand! Many thanks, "jcvip"!Share"


Question: Unable to Post HITs due to Credit Limit Exceeded error

"Hello,I have recently joined Amazon MTurk to post my survey. I created an AWS account, linked it to the MTurk account, and added a payment during registration. I want to post the survey on an urgent basis as this is part of my research, but when I tried publishing the survey, the MTurk gave me an error saying that the Credit Limit was Exceeded. I submitted a support request but haven't received any follow-up or response. Can someone please help me here? I  need to host the survey asap.FollowCommentrePost-User-9687991 4 months agoSame. I'm new and my limit says it's 2,500 already yet I couldn't publish something for 1,008. I dropped it to 2 and that exceeded the limit too. So I'm pretty sure when you're new the limit is 0. We are forced into AWS billing and can't use pre-paid HITS or pay upfront in any way and then they don't give you a workable account. I've been waiting for 5 days and this is after being told 3 times my case is being expedited. I cannot wait a month because I need this batch for doctoral research to graduate.Share"


Question: Greengrass deployment failed

I am getting error {ErrorSet(errorSet=[ErrorModel(errorCode=THING_CERT_NOT_FOUND_ERROR after changing the certificates of the remaining devices. It is taking previous certificates of the device instead of the current certificates.FollowComment

Answer: "0Hi,From the error and the description you provided, I would like to mention that, if you're rotating certificates, then you'd need to replace the certificate and key file at your path in the Greengrass root directory on the device. Additionally, you would need to attach that certificate to the IoT Thing resource in the AWS account and attach the IoT policy/role alias etc to the cert.Further, kindly note that the file paths for the cert and key where these files need to be replaced can be found in the config.tlog or effectiveConfig.yaml files in the <greengrass_root>/config directory. Either you can replace the files there or you can change the paths in a config.yaml file and reinstall greengrass with that config file as input and doing the former would be easier.In case you are still experience the issue then please open a support case with the Greengrass team and we can further inspect your Greengrass logs and the configurations to assist you further on the same.CommentShareSUPPORT ENGINEERUser-4748418answered 11 days ago"


Question: Federated login invalidates existing session.

"I'm working on a CLI tool that will open AWS console URLs without needing authentication.  User credentials are already available via ~/.aws/credentials.I've mainly been following the steps in this article:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.htmlThe guide works for generating URLs that contain credentials that automatically log you in (either as a role or as a federate identity).  Unfortunately, subsequent invocations of the tool log you out of earlier sessions.  All existing tabs in browser popup a message asking user to refresh page.Is there a way to prevent the "/federaton?Action=login" endpoint from invalidating earlier sessions to AWS console?  Or a way to instruct this endpoint to re-use an existing session, rather than create a new one?FollowComment"


Question: How do I use Amazon SES v2 on an SMTP relay MTA?

"how do I use Amazon SES v2 on an SMTP relay MTA?we couldn't find the SMTP endpoint for V2.In your docs it only describes for API V2, Not SMPT.we also attached a screenshot of our SMTP Settings Page.FollowComment"

Answer: "0There is only one set of SMTP endpoints. In other words, there isn't a separate set of v2 SMTP endpoints.See Amazon SES endpoints and quotas for a list of SMTP endpoints.CommentShareEXPERTBrentAtAWSanswered 4 months agorePost-User-5380470 4 months agoI'm having the problem "522 message is too long", oh yeah here I'm using the smtp endpoint, is there a solution for sending files over 25mb, can it only be done via api?Share"


Question: MediaConvert HLS manifest error

"Hey there,I'm despairing... I want to create a MediaConvert job with an HLS output group but without any video input, two audioselectors. My current manifest looks like this:#EXTM3U#EXT-X-VERSION:4#EXT-X-INDEPENDENT-SEGMENTS#EXT-X-MEDIA:TYPE=AUDIO,GROUP-ID="program_audio",LANGUAGE="eng",NAME="BEsAsDes",AUTOSELECT=YES,DEFAULT=YES,URI="indexB-Es-As-Des.m3u8"#EXT-X-MEDIA:TYPE=AUDIO,GROUP-ID="program_audio",LANGUAGE="eng",NAME="ADGC",AUTOSELECT=YES,DEFAULT=YES,URI="indexA-D-G-C.m3u8"It isn't working on any player I'm getting errors like manifest invalid.Any help is much appreciated!FollowComment"

Answer: 1Try using a different GROUP-ID for each output.CommentSharemanny-par1answered 10 months ago


Question: EC2 instance stuck stopping

"I have an EC2 instance that is stuck in the Stopping state. I rebooted it and it failed to come up. Per https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.html I tried stopping the instance. Now it is stuck in Stopping. Per https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesStopping.html I am requesting assistance.The instance ID is i-702bfe08Thanks,Mike CremerFollowComment"

Answer: "0I managed to finally stop it, and restart it. Crisis averted.CommentShareMichael W. Cremeranswered 3 years ago"


Question: Access Linux based storage gateway ec2 instance

"Hi,I have deployed aws recommended storage gateway that is linux based ec2 instance. I am trying to connect with it using ec2 instance connect, that didn't work. Now I am trying to connect with it via putty like normally for any ec2 instance. Importing the key, entering username but it results in network time out.All the required ports are open in security group assigned.Anyone have idea how to access if we can access it?FollowComment"

Answer: "0Hi, based on the network time out error you are receiving, it seems there is a network connectivity issue. I would recommend troubleshooting using this article. I would recommend verifying the first five items from the article under section "For the “Connection timed out” error, verify the following".Once the connectivity errors resolved, please also ensure using Admin username when connecting to storage gateway EC2 instance. Thank you.CommentShareSuryaanswered 4 months ago"