Question: Paused : SES ACCOUNT

"Hello, my SES account is paused after internal review.I tried to reply the case but i wont get the point.After a carefull re-view of my account, i found and solved all the problems. Replied the case but no one answered it and case seems to be solved.Everyday i tried to re-open it with information but case seems to be solved.I really need the SES account back as normally.I tried to open a technical support case and all my support cases will be declined and directing to INTERNAL REVIEW case which is no one helping me.Here's some information about the case:**sep 1: **Hello,There's an issue related to your Amazon SES account that requires your attention. This message contains more information about these issues, and some information that might help you resolve them.We only change your sending status in order to protect your reputation as a sender, and to ensure that other SES customers' ability to send email isn't impacted. We may pause your account's ability to send email so that you have time to address these issues. When you fix these issues, we'll restore your account's ability to send email.IMPORTANT CHANGE IN YOUR SENDING STATUSYou're listed as the primary contact for AWS account XXXXXXXXXXXX. We've paused your account's ability to send email using SES in the US East (N. Virginia) Region, effective immediately.DETAILSWe recently performed a manual review of your account's email-sending practices. During our review, we identified characteristics that could cause email providers or anti-spam organizations to classify your messages as spam.The methods we use to make this decision are proprietary, so unfortunately we can't provide specific details. In general, we only perform manual reviews when our automated systems indicate that an account is sending unsolicited email.Please review your email-sending practices and procedures to determine the causes of this issue. Common factors that could cause this issue include, but aren't limited to, the following:Messages that are flagged by commercial anti-spam filtersMessage content that implies that the recipient didn't explicitly ask to receive this type of message from youA mismatch between the branding in the messages and the sending email addressMessages that contain content that's commonly associated with unsolicited sendingEmail-sending patterns that are associated with unsolicited sendingSending from or linking to domains that have poor reputations with online reputation monitoring systemsThe actual cause of this issue might be a combination of these factors, or it might be something not listed here. You're responsible for determining the cause of the issue, and for developing a plan to fix it. You should begin your investigation by reviewing the items in this list, and by considering your current bounce and complaint rates.Sep 6Hello,I'm xxxx with the AWS Digital Messaging Team, your case was escalated to me for a Senior Level Review.I have carefully reviewed your account and the information you have provided. We appreciate your efforts to use Amazon SES. However unfortunately, we are unable to grant your request to use Amazon SES.We understand that you may not agree with the outcome however your email-sending patterns resemble those of businesses that email providers and anti-spam organizations consider problematic.We made this decision to ensure that other customers can continue to use Amazon SES without experiencing service interruptions.We cannot assist you further with this issue, and we will not respond to additional messages on this subject.Sep 6Hello,This is Batuhan, the owner of the account.I'm using SES nearly 5 months and im pretty happy to use SeS. I switched Amazon from Mailchimp.Since SES is much more easy and cheap, i have a serious problem.My SES account ( XXXXXXXXXXXX ) is paused.I got a notification that about manual review.I try to solve the problem but still XXXXXXXXXXXX is paused.I'm using Sendy the 3p mail app for sending mails using SeS.Sendy is also handling the bounces and compls.I have a very low bounce rate. Even all the recipents are GDRP free and expecting to hear from me, i will use Bouncer to clear the mailing lists before sending them. As you can see, the bounce rate of mine is very low.All the recipents are waiting to check their mails from me, you can see the compl. rate is under %1.After i got the notification for manual review, i clearly check the whole system from A to Z.I found that we have no problem on the system. Because bounces and compl. are way too low.Support team let me know that the mail sending patterns are the main problem.I checked previous sent mail campaigns and found 2 customers are using nearly the same mail pattern..I told you before that im using Sendy the 3p app for sending mails. Also all of my customers are using Sendy for sending their emails.I added a new security feature to evalutate mail patterns before sending them.I'm very concerned about my SeS account ( XXXXXXXXXXXX)If i can not able to use SES, i will start thinking about using AWS.Because SeS is the only main feature im using on AWS.Please help me to restore my sending ability back. This is an urgent problem for me.Sep 6Hello,This is Batuhan, the owner of the account.I'm using SES nearly 5 months and im pretty happy to use SeS. I switched Amazon from Mailchimp.Since SES is much more easy and cheap, i have a serious problem.My SES account (XXXXXXXXXXXX ) is paused.I got a notification that about manual review.I try to solve the problem but still XXXXXXXXXXXX is paused.I'm using Sendy the 3p mail app for sending mails using SeS.Sendy is also handling the bounces and compls.I have a very low bounce rate. Even all the recipents are GDRP free and expecting to hear from me, i will use Bouncer to clear the mailing lists before sending them. As you can see, the bounce rate of mine is very low.All the recipents are waiting to check their mails from me, you can see the compl. rate is under %1.After i got the notification for manual review, i clearly check the whole system from A to Z.I found that we have no problem on the system. Because bounces and compl. are way too low.Support team let me know that the mail sending patterns are the main problem.I checked previous sent mail campaigns and found 2 customers are using nearly the same mail pattern..I told you before that im using Sendy the 3p app for sending mails. Also all of my customers are using Sendy for sending their emails.I added a new security feature to evalutate mail patterns before sending them.I'm very concerned about my SeS account ( XXXXXXXXXXXX)If i can not able to use SES, i will start thinking about using AWS.Because SeS is the only main feature im using on AWS.Please help me to restore my sending ability back. This is an urgent problem for me.Sep 10Hello,On 01.07.2022, my accounts SES ability is paused.I try to solve the problem after your support case but i didnt managed it.I was using Sendy, to handle bounces and compls. Also i was using opt-in and opt-out options on my mails.After the support case, i found the problem. In your support case, you told me that anti-spam providers have classified my mails as spam.Please find the below information for new changes :-I found that 2 of my customers are using the same e-mail pattern. They sent their mail campaigns afterwards of each other.-I deleted all the identities on SES console. ( incl that 2 accounts )I deleted all the Sendy files for a brand new start and i cleaned all the suspension lists for my account.I deleted the all files related to all customers even on Sendy app and my SES Account.-To avoid this kind of spam patterns we are now allowing email campaigns  without reviewing it.-We also had a low bounce rates and low compliance rate. to make it much more clear we will use mail250 and usebouncer.com   for mail list cleaning before sending any mails.-All the lists will maintain on Sendy app and we automate them to clear twice in month.-We permanently banned those 2 mail accounts and customers from our mailing system.Could you please help me to re- activate my sending ability on SES? I clearly solved all the problems and i wont let it happen again.I know that you have to protect your other customers on the shared ip, thats why after getting my sending ability back, i will swap to dedicated ip and this could solve all the problems at once.Please, help me to get my sending ability back, i dont want to face some other problems with my customers.I wont let it happen once again. You can check the attachments for fresh starts.I'm really in need of getting my AWS SES ability back, all of my customers are waiting to get their invoices and product catalogues after the fair. Please help me to solve the problem.All of my group companies are paused right now. I have 6 different companies which are sending their monthly and weekly newsletter mails and customer are trying to reach us if there is any problem or not.You can lower my sending limits back to 50.000 even it will work for you.We are now using our forms on double opt-ins.This double opt in forms will let us to reduce spam traps and will remain our reputation as high as we can.Now user will go and double opt-in to sign in to my mailing list.We also clear our list twice a month using 3p bounce providers.We always try to send solicited and high Quality mails. All of our Customer are waiting to read our monthly newsletters, unsolicited or low-quality content is never ever sent from our adresses.Our customers are never ever contacted AWS for complaing. Because we have  our compliance forms and links . After a review, we found nothing on our compliance, because our comp rate is below %1( 0.07%)We never change our mail patterns and we are not allowing to send same or similiar patterns on our next mail campaigns. Because we found that 2 of our customers send almost the same pattern and we deleted those two accounts.We never have unsolicited mails. All of our customers are replying to us and ask more about related the mail campaigns. Wen ever advertise our products from our newsletters. Because all of the customers are willing to have more information regards to our products and they want to hear more features from our products and services.So i clearly solved the problems and system is now fully activated, please let my SES account ability to send mails.All i need is my SES abilty back. Please help...Hello all of my support cases will reverting back to this support case.It seems to be resolved.But my problem is still going on.Could you please review the case?FollowCommentExportminers 9 months agoUPDATE:I've reached the 2nd time to AWS Chat.2nd time , they told me about they sent an internal ticket to SES team.Still no sound from SES team..Here's the mail i got:"Hello there.I understand that you would like to enable your SES account, I'll be happy to assist.In order to fulfill your request, I will collaborate with our specialized team.Rest assured I will update you as soon as they respond to my internal ticket.You are welcome to reach out at any time with further questions or concerns.Thank you for your patience while we work to resolve your query."ShareExportminers 9 months agoUPDATE:Have a live chat with support.I've been told that the additional information which i've provided is not enough for SES team, so they remain my account as paused.I have nothing to do, there is no do's or dont's from SES team; i will try to reach them with new information ( I have nothing to do new, but i will try to cover my file up )So on this update, we can see; there is no contact ability for SES Team, They are untouchables... There is no way to reach them.I'll try my luck for a brand new case + replying to the old case. I'm %100 sure i have nothing to do.But i'll try my luck.ShareExportminers 9 months agoUPDATE:They reached me for another ticket regards to the topic.Result is terrible.They never checked the new information.They just copy paste the following :Hello,Thank you for contacting the Simple Email Service team.It looks like you have already opened a case for this request: xxxxxxxxx. For more information about this issue, please refer to that case.This duplicate case will be closed to make it easier to keep track of the issue.We appreciate your cooperation in this matter.almost a week, still no solution.*Edit removed Account ID - Randi S.ShareExportminers 9 months agoUPDATE:I've finally reachto AWS Premium Support. We had an online meeting via Chime.I told them that i've provided some new additional info about my ticket.I also follow their own document which is located here => https://aws.amazon.com/tr/premiumsupport/knowledge-center/ses-resolve-account-review-pause/I wrote down maybe 2 papers of MS Word, stil nothing.SES team is keep ignoring me and my cases..ShareExportminers 9 months agoUPDATE :I keep opening new cases until they reply me.The below one is the main case , the rest cases are all related to the main onehttps://ibb.co/qgJ5ZsYShare"

Answer: "-1Hello,I understand that your SES account was paused after an internal review by the SES team.Requests pertaining to moving SES Accounts out of sandbox, and granting with production access/Limit Increase are handled by the SES team. This is a different team to AWS Premium Support and this is a team dedicated to handling requests such as - increasing sending limits, lifting sandbox restrictions, granting production access, etc.From Premium Support side, we are able to assist with technical queries related to the SES service; but granting/denying production access for SES Accounts is solely based on the decision of the SES team. AWS Premium Support does not have the ability to influence that decision, and/or grant production access for SES Accounts.So, if you would still like to obtain production access for your SES Account, then I would request that you reply back on the currently active Support case and mention the following :Issues you have identified that caused the sending pauseSteps taken at your end to address the issuesYou can request for a re-review of your production access request on the Support case, or you can also submit a new Production Access request - https://docs.aws.amazon.com/ses/latest/dg/request-production-access.htmlHowever, please note it is possible that the SES team may or may not be able to provide further information/update regarding your request to move your SES Account out of sandbox and grant production access.If your query is still not addressed or routed to the concerned team, please create a new Support case and share the case number here with us.CommentSharerePost-AWS-Supportanswered 9 months agoExportminers 9 months agoHello thank you for kind info's.But i experience what you told and im sure that they are keep ignoring my new additional information:On ticket 10683105311 which is the main case, i added some new information for them.Case seems to be resolved and i got nothing.On ticket 10753888311, i asked AWS support to help me regards to the topic 10683105311 ( main case )Everytime i got an live support, i asked them to transfer my case as internal ticket to SES team.Every time i got nothing.So should i start thinking move to Alibaba cloud ?Because my ses account is paused, i got nothing to do. I have provided all information and i got nothing but ignorance..Share"


Question: Terminate each Site-to-Site VPN Tunnels to Multiple Customer Gateways

"A customer needs to establish a site-to-site VPN connection with a provider that does not allow both VPN tunnels that AWS generates, to terminate on the same customer gateway.Does the native AWS VPN solution allow Tunnel 1 from a site-to-site VPN connection to terminate on customer gateway 1 and Tunnel 2 to customer gateway 2 for example?FollowComment"

Answer: "1Accepted AnswerTechnically, this is possible. Customer will have to use Cert Based VPN connection. They cannot use PSK VPNs to achieve this.Create CGW with cert based VPN with no CGW IPCreate BGP Based VPN connection using this new CGW. Don't use Static VPNs (While it will work but not recommended).Install Certs and configure VPN on each CGW deviceCGW 1 (Cert1) - Tunnel1-                        |- vpn-<id>CGW 2 (Cert2) - Tunnel2-I wouldn't recommend this approach if customer isn't technical + Nobody likes Cert VPNs :)CommentSharejkapsanswered 3 years ago"


Question: ELI5: AWS CLI and SSO

"I like to use the AWS PowerShell and CLI tools from my workstation for quick ad-hoc activities. I have these configured to use an IAM account I created for myself that has API keys.In this modern world of "SSO for all the things", I'd like to understand my best route to change to using my existing SSO account (via Azure AD w/ MFA) for command line activities instead. Is there an AWS native solution?FollowCommentckas10 a year agoFor those confused, "ELI5" means "Explain Like I'm 5". :-)Share"

Answer: "4Take a look at the aws configure sso command for the AWS CLI v2.  This command can set up named profiles for IAM roles that you have access to.CommentShareMattanswered a year agockas10 a year agoSo the theme here seems to be: "First, you must switch to AWS SSO," right?ShareMatt a year agoYes, but you can still use Azure AD as your identity source.  Some instructions here: https://docs.aws.amazon.com/singlesignon/latest/userguide/azure-ad-idp.html.  If that's not an option for you, there does exist some open source tooling for various IdPs that the community has built to get CLI credentials.Share0AWS SSO can be used with your IdP of choice. Here is a good lab which describes how to set it up with Azure AD. AWS SSO will manage short term rotation of API Access and Secret key along with a session token.CommentShareJarrid_Kanswered a year agockas10 a year agoYou may have missed the "ELI5" and "CLI" portions of my question?I do, of course, use SSO every day for console access. This question, to be painfully clear, is about CLI though.ShareJarrid_K a year agoAWS SSO gives your role both console and CLI access. You can just copy / paste your access, secret, & session keys from the AWS SSO sign-in page. Alternatively, this doc may help you set up the CLI: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.htmlShare0Hello Eli5, an AWS native solution would be for you enable AWS SSO and integrate it with your Azure AD [https://docs.aws.amazon.com/singlesignon/latest/userguide/azure-ad-idp.html]. Once this is done, you can authenticate to the AWS SSO console (using your Azure AD creds) and then select the Command Line from dashboard and get the temp credentials for CLI access.Without the AWS SSO, you may want to use third-party tools such as:https://blog.migrationking.com/2020/09/how-to-login-to-aws-using-cli-with.htmlhttps://github.com/sportradar/aws-azure-loginCommentShareitisobenanswered a year ago0Hi,for sure you have to check out aws configure sso command of the AWS CLI.My point is, that seeing how AWS manages the sso directory in a plain text file inside the ~/.aws/ folder, as posted here, I prefer to manage these credentials with an open-source tool: LeappBtw, with Leapp I can also manage multiple AWS Single-Sign-On access at the same time, and at the same time, it manage Azure credentials tooCommentShareAndrea Cavagnaanswered a year ago"


Question: BlockedTransaction CloudWatch alarm always in INSUFFICIENT DATA state.

"Hi,I want to setup an alarm for AWS RDS mysql database. Whenever there is blocking in database sent a mail notification. I set-up it like below. But the alarm is always in INSUFFICIENT DATA state. i simulated blocking in database but no effect.Does anyone know what this BlockedTransaction metrics is evaluating?FollowComment"

Answer: "0Blockedtransactions is a cloudwatch metrics applicable for Aurora MySQL only.It gives average number of transactions in the database that are blocked per secondthis metric is based on innodb metricIt is # of transactions currently waiting on row locksit is evaluated usingSELECT name, subsystem, status, count FROM INFORMATION_SCHEMA.INNODB_METRICS where NAME like 'LOCK_ROW_LOCK_CURRENT_WAITS';+-----------------------------+-----------+---------+-------+| name | subsystem | status | count |+-----------------------------+-----------+---------+-------+| lock_row_lock_current_waits | lock | enabled | 0 |+-----------------------------+-----------+---------+-------+1 row in set (0.08 sec)CommentShareAWS-User-8174525-subhashanswered 3 months ago"


Question: Can't set 'access_logs.s3.bucket' back to 'false' for ALB using CloudFormation

"I'm trying to turn on ALB access logs conditionally using CloudFormation as follows:  LoadBalancer:    Type: AWS::ElasticLoadBalancingV2::LoadBalancer    Properties:      Name: !Join ['-', [!Ref 'AWS::StackName', ALB]]      Type: application      IpAddressType: !If [DoEnableIPv6Support, dualstack, ipv4]      Scheme: internet-facing      Subnets:        - !Ref PublicSubnet1        - !Ref PublicSubnet2        - !Ref PublicSubnet3        - !Ref PublicSubnet4        - !Ref PublicSubnet5        - !Ref PublicSubnet6      SecurityGroups:        - !Ref ALBSecurityGroup      LoadBalancerAttributes:        - Key: access_logs.s3.enabled          Value: !If [EnableLoadBalancerAccessLogs, "true", "false"]        - Key: access_logs.s3.bucket          Value: !If [EnableLoadBalancerAccessLogs, !Ref AccessLogsBucket, ""]        - Key: access_logs.s3.prefix          Value: !If [EnableLoadBalancerAccessLogs, !Sub "${AWS::StackName}-ALB", ""]      Tags:        - Key: 'Stack'          Value: !Ref 'AWS::StackName'However, when EnableLoadBalancerAccessLogs is false, I'm running into this error:The value of 'access_logs.s3.bucket' cannot be empty (Service: AmazonElasticLoadBalancing; Status Code: 400; Error Code: ValidationError; Request ID: REDACTED; Proxy: null)The condition EnableLoadBalancerAccessLogs was defined as follows:EnableLoadBalancerAccessLogs: !Not [!Equals [AccessLogsBucket, ""]]I've also tried some potential workarounds for LoadBalancerAttributes, like      LoadBalancerAttributes:        - Key: access_logs.s3.enabled          Value: !If [EnableLoadBalancerAccessLogs, "true", "false"]        - !If          - EnableLoadBalancerAccessLogs          - Key: access_logs.s3.bucket            Value: !Ref AccessLogsBucket          - !Ref AWS::NoValue        - !If          - EnableLoadBalancerAccessLogs          - Key: access_logs.s3.prefix            Value: !Sub "${AWS::StackName}-ALB"          - !Ref AWS::NoValueor      LoadBalancerAttributes: !If        - EnableLoadBalancerAccessLogs        - - Key: access_logs.s3.enabled            Value: "true"          - Key: access_logs.s3.bucket            Value: !Ref AccessLogsBucket          - Key: access_logs.s3.prefix            Value: !Sub "${AWS::StackName}-ALB"        - !Ref AWS::NoValuebut none of them worked.CloudFormation docs saysaccess_logs.s3.bucket - The name of the S3 bucket for the access logs. This attribute is required if access logs are enabled. The bucket must exist in the same region as the load balancer and have a bucket policy that grants Elastic Load Balancing permissions to write to the bucket.Is this a bug in AWS API?FollowComment"

Answer: "0This is intended behavior from AWS.  What you'll want to do is completely remove access_logs.s3.bucket as a property when not doing ALB logging as leaving the property empty will throw an error.It looks like the nesting is weird, you may need to break out each property completely with using AWS::NoValue to ensure that if false, there is not an empty property.  The bug you're seeing is because CloudFormation still has the access_logs.s3.bucket property somehow.CommentSharejsoncanswered a year agoAWS-User-1495875 a year agoThanks @jsonc. Actually there was a bug in my template -- I forgot to call !Ref to get the parameter value.So instead of EnableLoadBalancerAccessLogs: !Not [!Equals [AccessLogsBucket, ""]], it should be EnableLoadBalancerAccessLogs: !Not [!Equals [!Ref AccessLogsBucket, ""]]Share"


Question: Step-by-Step Guides for Amazon Connect Agent Workspace

How to implement Step-by-Step Guides for Amazon Connect Agent Workspacein the Amazon connect contact flowFollowComment

Answer: 1The following AWS blog post contains instructions on how to deploy a sample step-by-step guide:https://aws.amazon.com/blogs/contact-center/getting-started-with-step-by-step-guides-for-the-amazon-connect-agent-workspace/CommentSharejoahnaanswered 2 months agoEXPERTalatechreviewed 2 months ago0The admin guide also has a couple places to help with this:https://docs.aws.amazon.com/connect/latest/adminguide/agent-workspace.htmlAnd make sure to raise your service limit regarding this note about raising "concurrent active chats" when using Agent Guided experience:Increase your service quota for concurrent active chats per instanceThe workflows that agents interact with run as chat contacts in Amazon Connect. We recommend that you increase your concurrent active chats per instance quota by the number of concurrent contacts you expect to have this feature enabled for.CommentShareClarenceChoianswered 2 months ago


Question: How can I distinguish incoming data using certificates in AWS IoT Core?

"Hello,I am using multiple devices in AWS IoT Core and each device has a unique certificate. How can I distinguish incoming data using these certificates? I want to parse and customize the data between different devices. Which methods can I use and how can I perform this process?Thank you in advance for your help.FollowComment"

Answer: "2Accepted AnswerHi there!Once a message is published to AWS IoT Core, there is no metadata in the message itself. One way to accomplish this is to give each unique thing (and the attached certificate) it's own topic structure to publish. For instance, things Foo and Bar could have an IoT policy that allows them to publish on dt/{iot:Connection.Thing.ThingName}/*, where Connection.Thing.ThingName must match thignName (see these examples for why this helps with clientId matching thingName). Then depending upon what will parse and customize you can extract the MQTT topic. With the example above, Foo publishes a message on dt/Foo/telemetry, and any subscribers or the rule engine can then parse the second level of the topic to get the thing name.If using rules to transform data, use the topic function to obtain the thingName.Please let me know if this helps!CommentShareGavin_Aanswered a month agoGreg_B EXPERTa month agoThis whitepaper is also useful: https://docs.aws.amazon.com/whitepapers/latest/designing-mqtt-topics-aws-iot-core/mqtt-design-best-practices.html.SharerePost-User-8080264 a month agoThanks for your helpsShare"


Question: Custom domain configuration & LoRa gateway LNS

"I have some running gateways that I'd rather not experiment with until I've asked this question.Current the gateways are connected to the standard pre-provisioned CUPS and LNS address (e.g. https://ABCD12345678.cups.lorawan.us-east-1.amazonaws.com:443I've configured a custom domain:core.mydomain.comcore.mydomain.com EnabledDATAAugust 29, 2021, 13:38:46 (UTC-0400)Will pointing to the custom domain work for LoRa gateways?  I've used the custom domain for connect MQTT clients to IoT Core, but I'm unsure if this would also work for the CUPS and LNS addresses.And if so, what is the correct URI structure for a custom domain? wss://core.mydomain.com:443 and https://core.mydomain.com:443?FollowComment"

Answer: "0Accepted AnswerHi and good to see your progress ;) Custom domains are supported for AWS IoT Core MQTT/HTTPS protocols: https://docs.aws.amazon.com/iot/latest/developerguide/iot-custom-endpoints-configurable-custom.html.There is currently not support for the Custom Domains for AWS IoT Core for LoRaWAN. Could you talk more about the motivaton why you would want to use a custom domain here? Thanks!CommentShareAndrei Sanswered a year agoAWS-User-9404308 a year agoThanks Andrei.  Two reasons, 1) Custom domains are nice for branding (even if only used internally), and 2) I think the same use case as MQTT/HTTPS, custom domains for LoRa gateways makes migration easier. ie. you have a bunch of gateways pre-deployed and pointing to Chirpstack or TTS The things stack with the same custom domain.  Migration would be changing a DNS setting and some certs, not changing each gateway's LNS url one by one.Share"


Question: "At the Business Support Plan tier, how do you escalate?"

"We're on the Business support tier because "Enterprise On-Ramp" would be about a 50% increase in our monthly costs. And we've had a support ticket open for 6 months (related to Global Accelerator). They've agreed it's a problem, but it's "engineering is working on it". Support said that engineering would provide an estimated timeline and ETA last week, but that didn't happen. First level support seems to be trying, but they apparently can't get anything done either. Meanwhile I have a customer eagerly awaiting the fix.So the question is, do we have any recourse such as talking to some sort of account rep or some such? Or is it simply, "sorry no additional help for you without more money"? (Not that I know that an account rep could make engineering fix the problem but in my experience in past jobs with dealing with large vendors, the account managers were generally of some help with at least finding a real status on such problems.)FollowComment"

Answer: "1If you do not have contact details for your designated Account Manager or Solutions Architect you can ask via the open support case; the CSE should be able to answer that.  Not knowing the details of the problem I can't comment on the escalation path.  It's possible that the issue is related to functionality that is not supported or is on the roadmap for development.  In those cases you should probably work with your SA to come up with a workaround.CommentSharealekse_wanswered a year ago1So following up on my own question:Submitting the question of "who is my AWS rep?" through the sales support page was useless. The answer that came back was "we can't tell you that you have to open a support case".So I opened a support case. That was answered, and they did give me an email address, after, according to them, they obtained permission to do so from the purported account rep. So I emailed them. I never heard back. (It's now been over a week, which seems like sufficient time.)So my conclusion is that if you're not paying for at least the "Enterprise On-ramp" level (minimum cost of $5500/month) you're not likely to be able to get any assistance other than what you can get out of support themselves. Which is generally not bad, but if they're having trouble with the next level it doesn't seem like the customer has any way to bring any additional resources to bear. At least that seems to be my experience.CommentShareEPS_Scottanswered a year ago0This is definitely a case where you should engage with your local AWS account team to talk about what other options are available to you. In general, account teams are composed of an Account Manager and a Solutions Architect who can (together) help you with the administrative and account ownership questions and also go deep into the technical challenges which include interfacing with the service teams.CommentShareEXPERTBrettski-AWSanswered a year agoEPS_Scott a year agoAnd so how do you find your "local AWS account team"?ShareNataliya_G EXPERTa year agoIf you don't have a contact with your Account Manager or local SA, you can use a Contact Us form on the portal here https://aws.amazon.com/contact-us/ and use "Sales Support" option. Though, it's possible it may take a few days until your request is routed to the correct AM/SA team.Share"


Question: Please tell me about SSL connection to RDS.

"Please tell me about SSL connection to RDS.In a case where a Go application in EC2 (Amazon Linux) accesses a database via SSL to RDS (PostgreSQL) in the same regionI am planning to follow the procedure below, but I would like to confirm something.https://docs.aws.amazon.com/ja_jp/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.SSL.html#PostgreSQL.Concepts.General.SSL.ConnectingIn the "Connecting to a PostgreSQL DB instance via SSL" step "Import the certificate into the operating system. In the "Connecting to a PostgreSQL DB instance via SSL" section, it states that the certificate needs to be imported into the trust store.In fact, by specifying sslrootcert and sslmode in the psql command without this step, the SSL connection status (ssl_is_used) returns "t" and it looks like an SSL connection is established.I would like to know if this procedure is necessary for this connection from the Go application.How does it work?For the public key (rds-ca-2019) specified in the sslrootcertI assume that a common key is required for a normal SSL connection, but is this generated by RDS or a driver such as libpq?Also, is it correct that the server certificate and private key are installed in the DB when the RDS (PostgreSQL) is created?FollowComment"


Question: Request: Amazon SQS FIFO  support in AWS GovCloud (US)

Could not create SQS FIFO queue in AWS Govcloud(US) PDT . Can you please help out on following asks?1/ Pls check diff documentation captures this feature gap in PDT region - https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-sqs.html#govcloud-sqs-diffs2/ Expected timeline when this feature will be available in AWS Govcloud(US)FollowComment


Question: Not able to clone a specific AWS CodeCommit repository locally.

"Not able to clone a specific codecommit repository, getting below error:fatal: unable to access 'URL': The requested URL returned error: 403DoneFollowComment"

Answer: 0Please ensure you have followed this instruction here https://docs.aws.amazon.com/codecommit/latest/userguide/setting-up-gc.html#setting-up-gc-iamYou should be prompted to provide your generated username and password when running the git clone for the first time.CommentShareSivaramananswered 2 months ago


Question: How to fix the error Failed to connect to your instance?

"Unable to connect the instance after restarting the server by using the command sudo systemctl reboot. When I'm trying to login into the instance using EC2 Instance Connect it is failing to make the connection to the instance and throwing an errorWe were unable to connect to your instance. Make sure that your instance network settings are configured correctly for EC2 Instance Connect. For more information, check Task 1 under the Setup EC2 Instance Connect AWS documentation.After following the doc I have added an Inbound rule that allows inbound SSH traffic on port 22 from your IP address to the security group attached to my instance. But still, it shows the same error and also fails the Instance reachability check.Any help in guiding me that how can I make a connection to my instance will be much appreciated.ThanksFollowComment"

Answer: "0Hello,I am assuming this is a new instance. Did you try to check the Routing settings ? From where are you trying to access the instance ? Does it have an internet gateway attached and the routing set correctly. I am assuming NACL/SG settings are correctly set ?Refer the link below for the pre-requisites required.Link- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connection-prereqs.htmlCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago"


Question: How would I find out if Reserved Instance is being used?

I just ordered a RI and confused on it's being used or not.I have a t2.micro on-demand instance running and a t2.micro RI running as well. Both are on same availability zone.How would I tell if my new RI is being used or not?FollowComment

Answer: "0Hi,You can check whether your reserved instance is being used by going to the AWS Management console, click on Services, in the search bar type in “Billing” click on billing, this will take you to the Billing and Cost Management Dashboard.  Once there on the left navigation pane click “Bills” under the Elastic Cloud Compute drop down list, select the region which your Reserved and On Demand instance’s are. You will then be able to see which instances are being used and the cost associated with that use [1].Hope this helps!/MrKReferences[1] https://aws.amazon.com/premiumsupport/knowledge-center/ec2-reserved-instances-being-used/CommentShareMrKanswered 4 years ago"


Question: Is there a Lobby system?

"Hi,Is there a "Lobby" system in GameLift for players to be added in before they are assigned a game session? Similar to the Lobby service in PlayFab?Thanks,BhavFollowComment"

Answer: "1Yeah! FlexMatch with backfill will work for that case. Here's how the flow would work for players using a matchmaking configuration with backfill:First player joins matchmaking and that ticket creates a game session with 4 open slots - this game session acts as the lobby for other players to joinAnother player joins matchmaking - they get matched with player 1 and joins the match in the backfilled spotGame server updates FlexMatch with updated game statusRepeat 2-3 until the game session is fullStart the match in your game!CommentShareAlanZ_AWSanswered 9 months agoND Bhav 9 months agoSweet! Thanks for details on FlexMatch. I shall be speaking to a member of the game tech team this week so we'll discuss it further. Thank you again :-)Share1Hi Bhav,Can you tell me what lobby features you are looking for specifically? Currently, GameLift offers FlexMatch as a matchmaking system that could be used to implement lobbies using backfill to find other players: https://docs.aws.amazon.com/gamelift/latest/flexmatchguide/match-backfill.htmlCommentShareAlanZ_AWSanswered 9 months agoEXPERTToni_Sreviewed 9 months ago0Hi Alan,A lobby area would act as a waiting room for players who are waiting for a match or have been matched but are waiting for the team they are part of to be filled. For example, I wish to play as a member of team X and X requires 5 players before they can all join and play the join.Does that make sense?CommentShareND Bhavanswered 9 months ago"


Question: session manager error exit status 1

"Your session has been terminated for the following reasons:  ----------ERROR------- Unable to start command: exit status 1This is the error I am facing, the node is online and the session manager is showing connect option, I did reboot the instance but no use. Kindly help.FollowCommentD G 18 days ago@rePost-User-6067514 Let me know if you have any issues with this, or if it helps you then please accept my answer after you've tried it out - it would be much appreciated! Good luck :)Share"

Answer: "0I would look to leverage this guidance within re:post to fully troubleshoot run command failures.https://repost.aws/knowledge-center/ssm-run-command-failuresIt looks as though your session hasn't been completely established or there could be a problem with timeout settings depending on the command you are sending.Let me know if you have any issues with this, or if it helps you then please accept my answer after you've tried it out - it would be much appreciated! Good luck :)CommentShareD Ganswered 20 days ago"


Question: DOMAIN NAME NOT REFLECTING HOSTED ON ROUTE 53

"i HAVE REGISTERED MY DOMAIN ON AWS AND ALSO MAPPEND EIP WITH THE FORWARD RECORD 'A', WHEN I TYPE EIP IT WORKS ON BROWSER INSTEAD OF WHEN I TYPE MY DOMAIN NAME .RECORD A AND PTR NOT REFLECTING WHEN CHECKED ON DNS PROPAGATION SITE. BUT ON USING DIG COMMAND IT ANSWER PTR AND A QUERY... PLEASE HELP ME IN THIS REGARD.FollowComment"

Answer: "0Hello rePost-User-7580137,When you are using the dig command, what DNS servers are you querying?It sounds like there may be a name server (NS) mismatch between the domain registrar and your hosted zone.Please try the following:Get the name servers for a public hosted zone.Search for your website's domain name using your preferred WHOIS utility (domain registration lookup tool).Verify if the NS for your domain in the WHOIS output matches the same NS records in your Route 53 public hosted zone.If the NS records don't match and your domain registrar is Route 53, then update the name servers for your domain at the registrar to the four authoritative NS records assigned to your Route 53 public hosted zone.Note: For domains registered with third-party registrars, follow your registrar's documentation to change the domain's NS.Note: It might take until the TTL (up to 48 hours) for the previous registrar's NS to expire from the top-level domain (TLD). During this period, DNS queries for the domain might be sent to both Route 53 and the prior registrar's NS. Route 53 immediately responds to DNS queries for the domain from resolvers that haven't cached the prior registrar's NS.Here is a troubleshooting article if the above does not resolve your issue.I hope this information is helpful.CommentShareNickanswered a year agorePost-User-7580137 a year agoThanks Nick ! In fact i had check these parameters before sharing my query. Here is the NS details maintained with registrar which is AWS 53 AND dig command outputRestrar NS serversns-2028.awsdns-61.co.ukns-917.awsdns-50.netns-164.awsdns-20.comns-1500.awsdns-59.orgns-578.awsdns-08.netns-1427.awsdns-50.orgns-578.awsdns-08.net.ns-1427.awsdns-50.org.ns-475.awsdns-59.com.ns-1927.awsdns-48.co.uk.ns-2028.awsdns-61.co.ukns-917.awsdns-50.netns-164.awsdns-20.comdig outputglobalservices.com. 3600INNSns-475.awsdns-59.com.globalservices.com. 3600INNSns-578.awsdns-08.net.globalservices.com. 3600INNSns-917.awsdns-50.net.globalservices.com. 3600INNSns-1427.awsdns-50.org.globalservices.com. 3600INNSns-164.awsdns-20.com.globalservices.com. 3600INNSns-1927.awsdns-48.co.uk.globalservices.com. 3600INNSns-2028.awsdns-61.co.uk.The NS servers are almost same as per the registrar NS list.regardsPritamShare"


Question: No Options to migrate from RDS Postgres to Aurora

"I'm trying ensure migrating from Postgres to Aurora works on my account using methods 1. snapshots and 2. read replicas here:https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Migrating.htmlI have tried various versions of postgres from 10.x, 11.x, 13.4 but"Migrate Snapshot" option is greyed out under snapshot > actions"create aurora replica" not showing under actionsI don't believe there is an issue with my account because I can "Migrate  Snapshot" of other public postgres snapshots fine. it's just my own instances I cannot migrate from.FollowComment"

Answer: "0Can you please try with the CLI option instead of console to see if that works? If CLI works, then it should be something to do with the console.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Migrating.html#AuroraPostgreSQL.Migrating.RDSPostgreSQL.Import.ConsoleCommentShareEXPERTGokulanswered a year ago"


Question: Glue: Change point detection

In time series data in AWS Glue I would like to detect the times when statistically significant and sustained changes happen to the data.  I then would like to break this time series up into segments.This is known as "change point detection".Is there already something built-into Glue that I can use from the shelf?Or do I have to use libraries like "ruptures" ? Or implement on my on with sliding windows in PySpark?FollowComment

Answer: 1Glue doesn't provide at this time special features for time series.To use rupture you probably would need to do it on some aggregated points (lower granularity) if you want to be able to scale to high volume distributed data.The other option as you say is building your own logic using moving windows in PySpark.CommentShareGonzalo Herrerosanswered 3 months ago


Question: Experience with Cloudformation Plugin for Jenkins

A customer plans to do all infrastructure development with cloudFormation via Jenkins.There is a cloudFormation plugin for Jenkins (https://wiki.jenkins-ci.org/display/JENKINS/AWS+Cloudformation+Plugin).Can you recommend to use this?Do you have any experience?ThanksFollowComment

Answer: "1Accepted AnswerI do not have an experience with the above plug-in but I did wrote few Jenkins projects in the past which used cloudformation personally I try to avoid using plug-ins mainly because there is always a chance that they might cease to exist.For jenkins I would recommend to use the native AWS CLI (Install AWS CLI on the Jenkins instance) , you will make your customer happy as they will able to deploy cloudformation stacks pre and delete them post build  , using our native API as well as use services such as S3 into the build cycleCommentShareAWS-User-7679274answered 7 years agoEXPERTsedat_salmanreviewed 13 days ago"


Question: Where to view the K code(K28.5) for Aurora64B66B?

I’m using AMI/1.8.1 and vitis/2019.2. And I’m using myself dut. Now I’m using aurora_64b66b. I want to use k code(K28.5). Where to view the K code(K28.5) for Aurora64B66B?FollowComment

Answer: "0Hi zqsteve, could you give us more details about what you are requesting? The protocol spec documentation is below, and page 40 shows a table relating to block codes, is this what you are looking for?https://www.xilinx.com/support/documentation/ip_documentation/aurora_64b66b_protocol_spec_sp011.pdfCommentSharekmorrisXilinxanswered 2 years ago"


Question: https response times out; http delivers content though

"Hello,I am having trouble delivering a website using an alternate domain name and https.I am hosting the static web files in an s3 bucket with the name example-com (using  example as example). I do not have this bucket enabled for static website hosting. I read somewhere that if you are using s3 with cloudfront, you should have Static website hosting disabled on the s3 bucket that is hosting the web files, because it is really your cloudfront distribution that is 'acting as the website.'I also read somewhere that you cant have periods in your s3 bucket name if you link it to cloudfront, so that's why I use example-com and not example.com.I am using a cloudfront distribution with the Origin domain as example-com.s3.us-east-1.amazonaws.com, Origin access is public, viewer protocol policy is Redirect http to https, alternate domain CNAME are example.com and www.example.com, and I have a valid SSL certificate for this domain in cloudfront. Apparently SNI is implemented by default.example-com.s3.us-east-1.amazonaws.com/index.html is my Default root object.When I go to http://www.example.com  the website loads fine, with all my files displayed correctly. However, when I go to https://www.example.com the page just spins, and after about 2-3 min. it says can't establish a connection with the site; example.com took too long to respond.F12 doesn't display the server error.I have a route 53 hosted zone under example.com with all the CNAME records, iewww.example.com with value/route to being example.comrandomcharacters1.example.com routing to randomcharacters2.tftwdmzmwn.acm-validation.aws.randomcharacters3.www.example.com routing to randomcharacters4.tftwdmzmwn.acm-validation.aws.FollowComment"

Answer: "0In Route 53, example.com and www.example.com should be A records/Aliases with a value to your CloudFront distribution host, something like: d1234567890.cloudfront.net.From a command prompt, try this command to see what SSL/TLS is seeing:openssl s_client -connect www.example.com:443 -prexitAlso, for Origin access, it is best to use Origin access control settings.Make sure that the slash is not included in the root object:Enter only the object name, for example, index.html. Do not add a / before the object name.Also, you can turn on access logging on the bucket to see the requests that are coming in to help troubleshoot.CommentShareEXPERTkentradanswered a month agoJeff F a month agoOk, I changed the records in Route 53 and now https://www.example.com/index.html & https://example.com/index.html work.The result of openssl s_client -connect www.example.com:443 -prexit isCONNECTED(0000028C)12392:error:140773E8:SSL routines:SSL23_GET_SERVER_HELLO:reason(1000):.\ssl\s23_clnt.c:596:---no peer certificate available---No client certificate CA names sent---SSL handshake has read 7 bytes and written 124 bytes---New, (NONE), Cipher is (NONE)Compression: NONEExpansion: NONE---I fixed my Origin access to Origin access control settings and updated the s3 Bucket policy with the policy that cloudfront suggested under Origin access > Bucket policy > Copy policy.Now, when I go https://www.example.com and https://example.com I receive a 403 error on f12 on the www.example.com and example.com files. So the complete summary of the browser response is as follows -https://www.example.com - 403 errorhttps://example.com - 403 errorhttps://www.example.com/index.html - displays correctlyhttps://example.com/index.html - displays correctlyhttp://www.example.com - redirects to https://example.com - 403 errorhttp://example.com - redirects to https://example.com - 403 errorhttp://www.example.com/index.html - redirects to https://www.example.com/index.html - displays correctlyhttp://example.com/index.html - redirects to https://example.com/index.html - displays correctlyShare"


Question: Mechanical Turk - Cannot see my published Batch in the Worker sandbox

"HelloI've also asked my question in StackOverflowI'm trying to publish a new Image Classification batch, but the task is not published.I didn't ask for any qualification for the workers.Yet, I don't see the task in the worker sandbox: https://workersandbox.mturk.com/projects I'm searching by my name: "huji nlp lab" and the title "Visual Analogies".When I observe the task, I see "0% published", which is believe is a problem.How can I solve it?Thanks.FollowComment"

Answer: "0Hello,For Mechanical Turk assistance, please reach out to our experts by following this link. Once an issue is created, our Mechanical Turk experts would be happy to assist you.CommentShareUgochukwu_Ianswered a year ago"


Question: No such file or directory: '/opt/ml/input/data/test/revenue_train.csv' Sagemaker [SM_CHANNEL_TRAIN]

"I am trying to deploy my RandomForestClassifier on Amazon Sagemaker using Python SDK. I have been following this example https://github.com/aws/amazon-sagemaker-examples/blob/main/sagemaker-script-mode/sagemaker-script-mode.ipynb but keep getting an error that the train file was not found. I think the file were not uploaded to the correct channel. When I run the script as follows it works fine.! python script_rf.py --model-dir ./ \                   --train ./ \                   --test ./ \This is my script code:# inference functions ---------------def model_fn(model_dir):    clf = joblib.load(os.path.join(model_dir, "model.joblib"))    return clfif __name__ =='__main__':    print('extracting arguments')    parser = argparse.ArgumentParser()    # hyperparameters sent by the client are passed as command-line arguments to the script.    parser.add_argument('--max_depth', type=int, default=2)    parser.add_argument('--n_estimators', type=int, default=100)    parser.add_argument('--random_state', type=int, default=0)        # Data, model, and output directories    parser.add_argument('--model-dir', type=str, default=os.environ.get('SM_MODEL_DIR'))    parser.add_argument('--train', type=str, default=os.environ.get('SM_CHANNEL_TEST'))    parser.add_argument('--test', type=str, default=os.environ.get('SM_CHANNEL_TEST'))    parser.add_argument('--train-file', type=str, default='revenue_train.csv')    parser.add_argument('--test-file', type=str, default='revenue_test.csv')        args, _ = parser.parse_known_args()        print('reading data')    train_df = pd.read_csv(os.path.join(args.train, args.train_file))    test_df = pd.read_csv(os.path.join(args.test, args.test_file))        if len(train_df) == 0:        raise ValueError(('There are no files in {}.\n').format(args.train, "train"))    print('building training and testing datasets')    attributes = ['available_minutes_100','ampido_slots_amount','ampido_slots_amount_100','ampido_slots_amount_200','ampido_slots_amount_300','min_dist_loc','count_event','min_dist_phouses','count_phouses','min_dist_stops','count_stops','min_dist_tickets','count_tickets','min_dist_google','min_dist_psa','count_psa']    X_train = train_df[attributes]    X_test = test_df[attributes]    y_train = train_df['target']    y_test = test_df['target']        # train    print('training model')    model = RandomForestClassifier(        max_depth =args.max_depth, n_estimators = args.n_estimators)        model.fit(X_train, y_train)         # persist model    path = os.path.join(args.model_dir, "model_rf.joblib")    joblib.dump(model, path)    print('model persisted at ' + path)        # print accuracy and confusion matrix     print('validating model')    y_pred=model.predict(X_test)     print('Confusion Matrix:')    result = confusion_matrix(y_test, y_pred)    print(result)    print('Accuracy:')    result2 = accuracy_score(y_test, y_pred)    print(result2)the error is raised in the train_df line of the script (FileNotFoundError: [Errno 2] No such file or directory: '/opt/ml/input/data/test/revenue_train.csv').I tried specifying the input parameters:# change channel input dirs inputs = {    "train": "ampido-exports/production/revenue_train",    "test": "ampido-exports/production/revenue_test",}from sagemaker.sklearn.estimator import SKLearnenable_local_mode_training = Falsehyperparameters = {"max_depth": 2, 'random_state':0, "n_estimators": 100}if enable_local_mode_training:    train_instance_type = "local"    inputs = {"train": trainpath, "test": testpath}else:    train_instance_type = "ml.c5.xlarge"    inputs = {"train": trainpath, "test": testpath}estimator_parameters = {    "entry_point": "script_rf.py",    "framework_version": "1.0-1",    "py_version": "py3",    "instance_type": train_instance_type,    "instance_count": 1,    "hyperparameters": hyperparameters,    "role": role,    "base_job_name": "randomforestclassifier-model",    'channel_input_dirs' : inputs}estimator = SKLearn(**estimator_parameters)estimator.fit(inputs)but i still get the error FileNotFoundError: [Errno 2] No such file or directory: '/opt/ml/input/data/test/revenue_train.csvFollowComment"

Answer: "1Your code has a typo that results in the issue, maybe caused by copy-pasting. Note that instead of a training path you're passing a test path location as the default to args.train:    parser.add_argument('--train', type=str, default=os.environ.get('SM_CHANNEL_TEST'))                           ^^^^^                                                ^^^^    parser.add_argument('--test', type=str, default=os.environ.get('SM_CHANNEL_TEST'))Later, when you try to access the training file from the test location, the file is obviously not there:No such file or directory: '/opt/ml/input/data/test/revenue_train.csv                                               ^^^^         ^^^^^Changing the default argument for the args.train to SM_CHANNEL_TRAIN should resolve the issue,CommentShareIvananswered 9 months agoEXPERTAlex_Treviewed 9 months ago"


Question: Beanstalk Issue

what is the meaning of the attached logFollowComment

Answer: "0Same here. There is a Stack Overflow question about that as well: https://stackoverflow.com/questions/76049421/elastic-beanstalk-environment-creation-error-due-to-disabled-acls-in-s3-bucketI have tried uploading code from the eb CLI. Even if I upload the code to the environment from the console, it fails. I have also tried to delete the beanstalk S3 bucket, but it gets created again with ACLS disabled.If you enable ACLs in the beanstalk bucket, it starts working. But as the StackOverflow question says, is it the recommended way to do it? I don't think so... And also, the official documentation does not say anything about that: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/GettingStarted.DeployApp.htmlIt may be related to the changes introduced this April: new S3 buckets get created with ACLs disabled by default. https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-s3-automatically-enable-block-public-access-disable-access-control-lists-buckets-april-2023/?nc1=h_lsCommentSharePedro Prietoanswered a month ago"


Question: How to build a mechanism to govern multiple AWS data locking features?

"BackgroundThere is identified need to govern multiple data locking features that AWS Provides in a context of multi-account environment with independent teams. If there is no governance - data locking might be enabled in various AWS accounts (in various regions) causing potential compliance nightmare and related challenges to rollback if data is accidentally locked for multiple years.It seems the only way to exit from compliance mode data locking is to fully close the related AWS account ( data seems then to be deleted after 90 days, even when locked).Optimally the use of AWS locking features would be allowed only by exception (after human review of each use-case). Governance mode could be by default allowed for all accounts/resources, but it should be possible to prevent the use of compliance mode (in any AWS service that provide data locking) with SCPs in AWS Organization.It has been identified at least these three are  related operations for data locking:backup:PutBackupVaultLockConfigurationglacier:CompleteVaultLocks3:PutBucketObjectLockConfigurationQuestionsTo deny all AWS data locking features - what IAM actions need to be denied with SCP - in addition to to the ones above?Is the only way to exit the Backup Vault lock is to close the related AWS account  (with 90 days grace period)?How can one confirm the deletion of data related to question above. The assumption is that data remains until grace period has passed (90 days).  Does AWS emit some logs (when account is being closed) that prove that data has been actually wiped?How one can list what various data locks are currently in use? Is Cloudtrail the only option?Are there any other best practise to share - to centrally govern the various AWS data locking features?FollowComment"


Question: Where can I see custom metadata or tags in WorkDocs?

"While researching how to organize our transactional documents using WorkDocs, I saw this article stating that we can use the SDK to tag documents and folders and also that we can add custom metadata: https://aws.amazon.com/about-aws/whats-new/2017/06/amazon-workdocs-administrative-sdk-adds-apis-to-access-and-update-metadata-tags-and-comments/However, I don't see any of this information inside the WorkDocs web app itself and I don't see any options to turn it on.Suppose I used the SDK to tag two documents with 'Customer: Acme Corp' - how would I be able to search for them in WorkDocs?FollowComment"


Question: Will having EC2/ECS/Fargate in the same availability zone as Lambda decrease latency?

"I've been thinking about this article that mentions Availability Zone Affinity as a means to improve performance and reduce costs:https://aws.amazon.com/blogs/architecture/improving-performance-and-reducing-cost-using-availability-zone-affinityIf compute resources are in the same availability zone as a Lambda function, will that decrease latency?FollowComment"

Answer: "1Accepted AnswerYes. Availability zones are close enough to each other to allow for synchronous replication of data; but the facilities within an availability zone are even closer. All other things being equal, less distance equals less latency.CommentShareEXPERTBrettski-AWSanswered 9 months agorePost-User-9616054 9 months agoThanks! Do you know if the Lambda Service API is also going to process the function within the availability zone? Like does it operate in the same availability zone as where the Lambda runtime environment is operating?ShareBrettski-AWS EXPERT9 months agoLambda is a "regional" services which means that it runs across multiple availability zones. In general that means that you don't get to select which AZ the Lambda function is actually executing in.Share1Yes, but your Lambda Functions do not run within your VPC, they execute within the Lambda services account. Connectivity to your VPC is established by Configuring a Lambda function to access resources in a VPC. This creates an ENI within your defined Availability Zones that the Lambda Function utilizes to reach VPC resources:A Lambda function always runs inside a VPC owned by the Lambda service. Lambda applies network access and security rules to this VPC and Lambda maintains and monitors the VPC automatically. If your Lambda function needs to access the resources in your account VPC, configure the function to access the VPC. Lambda provides managed resources named Hyperplane ENIs, which your Lambda function uses to connect from the Lambda VPC to an ENI (Elastic network interface) in your account VPC.from VPC networking for LambdaThere is no configuration item for specifying which Availability Zone in the Lambda service's VPC to use, and the Lambda service will run your Functions across Availability Zones for resiliency, so even if you can determine that, on one invocation, a Function ran in a particular AZ, it may not on the next run.This article has a good description of how Lambda Function networking works, both before and after enhancements made in 2020.If you have a workload that must have compute deployed together for the lowest latency, then with EC2 you can use placement groups to define how close (or far apart) to spread the instances; with ECS you can similarly define task placement, but you'll need to align EC2 and ECS configurations if your EC2 and ECS must be in the same AZ for certain traffic patterns.CommentShareAaron Doddanswered 9 months agorePost-User-9616054 9 months agoThanks for the insightful response. I remember reading about Lambda running in a VPC owned by the Lambda service but seemed to have forgotten. Unfortunately, the goal is to reduce latency between Fargate and Lambda so I cannot use something like placement groups.SharerePost-User-9616054 9 months agoI've noticed that while placing a Lambda function in a VPC with only 1 subnet that this message is displayed:"We recommend that you choose at least 2 subnets for Lambda to run your functions in high availability mode."So if a Lambda function is placed in one AZ does this mean that Lambda runs the function only in that AZ? If so, this would help me accomplish targeting the right AZ from Fargate.SharerePost-User-9616054 9 months agoThis appears to be the case as stated here: https://docs.aws.amazon.com/lambda/latest/operatorguide/networking-vpc.htmlShare0If you implement API client-side service discovery, which might add some milliseconds, yes, but allow you to implement a very simple logic to always favor same-AZ traffic and only if not an option, fallback onto the next one. Wanting to do same-AZ traffic only is obviously not optimal if that AZ were to become unavailable. For me, the major benefit of the same AZ traffic is no traffic costs within that AZ.CommentShareJohnPrestonanswered 9 months agorePost-User-9616054 9 months agoThanks for the insight. I agree this should reduce costs.Share"


Question: AWS Glue Job schedule missing

"I have several scheduled Glue jobs, and now half of them have missing schedules.   When I try to add a schedule back, a message in red flashes at the top of the browser, but the site refreshes to create schedule form again.How do I find out what happened to the schedules, so they are not removed again, and how to I identify what is the error when adding a schedule back to the job?Edit:  Overnight, the schedule create failure has resolved itself.  I was able to recreate the missing schedules.   However, I need to know why the schedules were removed.FollowComment"


Question: Additional AWS Activate Credits

Can I apply for additional AWS credits from a different service provider if I haven't spent the credits I received earlier?FollowComment

Answer: "0Hello Inara,The AWS Activate FAQs touch on this questions. Visit AWS Activate FAQ.CommentShareBriNasAWSanswered 24 days ago"


Question: AccessDedied Error on trying to exec athena quey from python/boto3

"Error detailscom.amazonaws.services.s3.model.AmazonS3Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied;I'm starting a query execution in python (boto3) and checking whether it finishes. But I'm always getting a FAILED status message. On the other hand, when I check the recent queries in Athena I can see the message above. My intention is to start the query, check completion and download the result file from S3 bucket. Can anyone help? Thanks!FollowCommentvtjean 14 days agoWhere is your python (boto3) code being executed? Lambda? EC2? Fargate?Share"

Answer: "0Accepted AnswerWhen calling Athena from a Lambda function, you need to ensure the Lambda function's execution role has permission to access your Amazon S3 buckets. That same logic applies to other ways you can run your code, such as Amazon EC2 or Amazon ECS, and includes both the source bucket and the destination bucket. For example, take a look at the AWS Managed Rule AmazonAthenaFullAccess below. Note that this includes actions like s3:PutObject and s3:AbortMultipartUpload that Athena may use to create temporary files, not just read actions like S3:GetObject or S3:ListBucket.Relevant Links:https://docs.aws.amazon.com/athena/latest/ug/security-iam-athena.htmlhttps://docs.aws.amazon.com/athena/latest/ug/managed-policies.htmlCommentShareDavidanswered 13 days ago0Thanks! It was a matter of adding the right permissions to the user's role.CommentSharemathdonadioanswered 12 days ago"


Question: Lambda event filter dynamodb TTL deletions

"I'm trying to trigger a Lambda from a DynamodDB stream, but only if the change is not a deletion due to TTL. I know that TTL deletes have 'userIdentity': {'principalId': 'dynamodb.amazonaws.com', 'type': 'Service'} in their events, while other events do not have useridentity at all, so I tried this filter: {"userIdentity": [ { "exists": false } ]}. This passes validation, but all events trigger the Lambda, including TTL deletes.Any idea how I can filter the TTLs out? The reason I want to do that is I have a phase where no changes to the database should be made, and I'd like to verify that the Lambda is not triggered. Therefore I want to block TTL deletions before the Lambda invocation.FollowComment"

Answer: "-1To filter out TTL deletions, you can't directly set up a filter on the event source mapping in Lambda. Instead, you can add a conditional check within your Lambda function to filter out TTL deletions based on the userIdentity field in the event record.Here's an example of how you can modify your Lambda function to filter out TTL deletions:import jsondef lambda_handler(event, context):    for record in event['Records']:        if ('userIdentity' not in record['dynamodb']['NewImage']) or (record['dynamodb']['NewImage']['userIdentity']['principalId'] != 'dynamodb.amazonaws.com'):            # Process the non-TTL deletion event            print("Non-TTL event:", json.dumps(record, indent=2))This code snippet checks each record in the event to see if the userIdentity field is present and if its principalId is equal to 'dynamodb.amazonaws.com'. If the condition is false, it processes the non-TTL event. By doing so, your Lambda function only processes events that are not TTL deletions.CommentShareEXPERTsedat_salmananswered 2 months agoShahar Mosek 2 months agoI've never seen a DDB streams event with eventName DELETE. According to AWS documentation, it is not a valid value: https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_streams_Record.htmlShare"


Question: How to Delete Manual Snapshot?

"Greetings,I have a manual instance snapshot I created a few months ago. I have deleted the instance and see no way to delete the snapshot. Which I would now like to do.Going from Home >Snapshots > Instance Snapshots > the snapshot menu gives me 3 options. Create, copy, or export. There is no option to delete, and I no longer want/need it.How do I delete it? I've searched the forum and Googled, but can't seem to find any direction.Thanks!FollowComment"

Answer: "0Hello,Thank you for using Lightsail.Is it possible the bottom of the snapshot actions menu on Home > Snapshots is behind the footer? I looked through the code for the menu and there does not appear to be any case where all the other actions would be available without delete as the last item in the list.Regards,GabrielCommentShareGabriel - AWSanswered 4 years ago0Thank you!Yes, you are right. The bottom of the menu was hidden behind the footer. I really should have noticed that since you can see the bottom outline of the menu box disappear.CommentShareElleJanswered 4 years ago"


Question: Connect s3 bucket with arcGIS Pro

"I try to connect my S3 bucket with arcGIS Pro but fail to establish the connection. I assume my S3 is not configured properly. I tried to follow all the necessary steps for creating a proper S3 accesspoint from the docs, but still am not able to get access. Any help is highly appreciated.Many thanks and best regardsMichaelFollowComment"


Question: FFMpeg with lavfi on AWS lambda fails

"I'm having an issue using lavfi in FFMpeg running on a lambda function.  I've followed the directions here to install the John Van Sickle ffmpeg layer.  I am able to do a simple convert command from python 3.9 via subprocess.  So something like ffmpeg -i /tmp/in.mov /tmp/out.mp4 works fine.Whenever I run a lavfi command via python3 subprocess/opt/bin/ffmpeg -f lavfi -i movie=/tmp/test.ts[out0+subcc] -map 0:1 -f webvtt /tmp/test.vttThe Lambda does not timeout but it does not create the /tmp/test.vtt file. If I list the tmp directory after the ffmpeg command but before the lambda finishes, I see that it creates an ffmpeg.core.## file where ## is a random number. I did a cat of that file and got a bunch of garbage. Is this a core dump because of a segmentation fault?I can run the lavfi command above on an Amazon Linux ec2 with the same build of ffmpeg.  Any thoughts on why this might be? Does lavfi require permissions to write a temp file to a directory other than tmp and that causes a write error? Trying to figure if there is any way I can get lavfi to work on lambda.FollowComment"

Answer: "0Hello,Are you using the defaults for the lambda that you are creating?  By default a lambda only allows 512 MB of space in the /tmp directory.  https://docs.aws.amazon.com/lambda/latest/dg/configuration-function-common.html  And only allocates 128MB of ram for your lambda function.  https://docs.aws.amazon.com/lambda/latest/operatorguide/computing-power.htmlI could easily see you over running those limits and causing ffmpeg to core dump.Hope this helps!CraigCommentShareCraig Simonanswered 3 months ago"


Question: Greengrass v2: 'Forbidden' (403) to get a file from S3

"Hi,we are using AWS Greengrass v2 and have successfully running a core device with code provided via a lambda function. We are already successfully retrieving secrets via the secret manager and stream our data via kinesis to the cloud.But we still struggle to access/read a configuration file we have stored in a s3 bucket.We tried two ways, both without success.It would be great to get some advice to make at least one work.As this solution has beem migrated from GreenGrass v1 to v2 we had the following piece of code working fine:{noformat}try:    s3 = boto3.client('s3')    obj = s3.get_object(Bucket="OurBucketName", Key="OurFile1.csv")    csv_file = obj['Body'].read().decode('utf-8-sig')    print(csv_file)except botocore.exceptions.ClientError as error:    print('Error long: ', error.response){noformat}But since migrating to Greengrass v2 we get a botocore exception (Failed due to: ClientError('An error occurred (403) when calling the GetObject operation: Forbidden'))or as prompted by the code example:...lambda_function.py:12,Error long: . {serviceInstance=0, serviceName=boto3_s3_test, currentState=RUNNING}...lambda_function.py:12, . {serviceInstance=0, serviceName=boto3_s3_test, currentState=RUNNING}...lambda_function.py:12,{'Error': {'Code': '403', 'Message': 'Forbidden'}, 'ResponseMetadata': {'RequestId': '', 'HostId': '', 'HTTPStatusCode': 403, 'HTTPHeaders': {'connection': 'Keep-Alive', 'content-type': 'text/html', 'cache-control': 'no-cache', 'content-length': '5748', 'x-frame-options': 'deny'}, 'RetryAttempts': 1}}. {serviceInstance=0, serviceName=boto3_s3_test, currentState=RUNNING}Does anyone have an idea why we still get an error 403 (forbidden)?We also tried to deploy our configuration files using the Artifacts feature, but without success.We configured it in the "Configuration update" of the AWS component in the deployment configuration.{  "reset": [],  "merge": {    "Artifacts": [      {        "URI": "s3://OurBucketName/OurFile1.csv"      },      {        "URI": "s3://OurBucketName/OurFile2.csv"      }    ]  }}After the deployment we can't find our files on the greengrass core device, neither any hint in any of the log files.The documentation come with this example for the Artifact URI:"s3://DOC-EXAMPLE-BUCKET/artifacts/MyGreengrassComponent/1.0.0/artifact.py"Is that folder structure .../artifacts/<ComponentName>/<ComponentVersion>/... required?Does anyone have an idea why we don't get the artifacts on our greengrass core device?BTW for both attempts we followed the documentation and adjusted our version of the "GreengrassV2TokenExchangeRoleAccess" policy to allow (meanwhile) all s3 actions on all resources.{"Sid": "VisualEditor0","Effect": "Allow","Action": ["greengrass:*","iot:Receive","logs:CreateLogStream","iot:Subscribe","secretsmanager:*","s3:*","iot:Connect","logs:DescribeLogStreams","iot:DescribeCertificate","logs:CreateLogGroup","logs:PutLogEvents","iot:Publish"],"Resource": "*"}Thanks in adance!Regards,Dirk_RP.S.: Editing a post to get a proper result is definitely a pain in neck!FollowComment"

Answer: "0Hi Dirk-R,The folder structure in the S3 bucket does not matter for the Artifacts parameter, you can choose any location accessible by the role policy used by greengrass. But in this case, you cannot add artifacts by merging configuration, they have to be specified in the component recipe.Can you confirm the role that is being used by Greengrass is using the policy you have mentioned below?Are you seeing errors or warnings in the Greengrass log during the deployment ?Hope this helps,DavidEdited to add clarifications about the "artifacts" section and when it can be used.Edited by: davidpAWS on Apr 22, 2021 11:23 AMCommentSharedavidpAWSanswered 2 years ago0Hi David,thanks for this important clarification that it's not possible to add artifacts by merging the configuration. (although I think I have see that somewhere in documentation examples, but I can't find it ;) )It is not suitable for us to the artifacts feature in our use case, because we want different files on the different cores.So we will continue with the option to read our configuration file from an s3 bucket.Yes, we're sure that this role gets used, because its policy also contains the settings for the secrets manager what successfully works on our machine.We had a look in the greengrass*.log file, as well as in our component's log files, but did find any further hint.Today we investigated a little further in the code and it seems our request has been blocked by our company proxy (which worked fine with greengrass v1). After adding the related setting to the code we get a little further:{noformat}s3 = boto3.client('s3', config=Config(proxies={'http': os.environ["HTTP_PROXY"]})){noformat}Now it seems we need to add the access_key_id and its secret!Do you know a way to get both via the configured "GreengrassV2TokenExchangeRoleAccess". The IPC components, like the secret manager seems to do that behind the scene, but what do we have to code in python to do the same for the s3 access?Thanks in advanceKind regards,DirkEdited by: Dirk-R on Apr 26, 2021 4:06 PMCommentShareDirk-Ranswered 2 years ago0Hello,In order to use AWS credentials, please see https://docs.aws.amazon.com/greengrass/v2/developerguide/token-exchange-service-component.html. You must add aws.greengrass.TokenExchangeService as a dependency of your service. Then it will vend credentials to your AWS client using standard means. The credentials will have the permissions of the IAM Role which is aliased by the IoT Role alias that you've setup.Cheers,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hello Michael,yes, we studied this and I would say we're fine with that.For your information, we have set up this GG v2 Component using the aws console by choosing the "Import Lambda function".This automatically created the recipe below in the end of this message.It automatically created a dependency to the aws.greengrass.TokenExchangeService, but with VersionRequirement >=1.0.0.When checking the deployment configuration I find the "aws.greengrass.TokenExchangeService" component listed in version 2.0.3.Our core device has assigned a certificate that has our "PSNGreengrassCoreTokenExchangeRoleAliasPolicy" attached.This policy says{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "iot:AssumeRoleWithCertificate",      "Resource": "arn:aws:iot:eu-west-1:111934086604:rolealias/PSNGreengrassCoreTokenExchangeRoleAlias"    }  ]}This role alias points to the IAM role "PSNGreengrassV2TokenExchangeRole" where we frustratingly allowed all s3 actions on all ressources in our attached policy "PSNGreengrassV2TokenExchangeRoleAccess" and ensured the trusts "The identity provider(s) credentials.iot.amazonaws.comarn:aws:iam::111934086604:role/cloudops"What are we missing here to read s3 from our IoT component?BTW - maybe this relates: I just tried to follow the "Hello world" example from the documentation, to get a minimum running. I created a "artifacts" folder in s3, added my hello_world.py to that folder, used aws console (GG v2) to create a new component choosing "Enter recipe as JSON", changed the example artifact uri to my recently uploaded hello_world.py. When clicking "Create Component" i get the error "Invalid Input: Encountered following errors in Artifacts: {s3://dil-sc-lev-s3-d8c4cbf1/artifacts/hello_world.py = Specified artifact resource cannot be accessed}". Does that relate to my initial issue?added P.S.: I just realized that out IoT configuration is in region "Ireland eu-west-1" while the s3 bucket is create in region "Frankfurt eu-central-1". Can this be the root cause for our issue?{  "RecipeFormatVersion": "2020-01-25",  "ComponentName": "boto3_s3_test",  "ComponentVersion": "1.1.2",  "ComponentType": "aws.greengrass.lambda",  "ComponentDescription": "missing \"import sys\" added",  "ComponentPublisher": "AWS Lambda",  "ComponentSource": "arn:aws:lambda:eu-west-1:111934086604:function:boto3_s3_test:4",  "ComponentConfiguration": {    "DefaultConfiguration": {      "lambdaExecutionParameters": {        "EnvironmentVariables": {}      },      "containerParams": {        "memorySize": 16000,        "mountROSysfs": false,        "volumes": {},        "devices": {}      },      "containerMode": "GreengrassContainer",      "timeoutInSeconds": 3,      "maxInstancesCount": 100,      "inputPayloadEncodingType": "json",      "maxQueueSize": 1000,      "pinned": true,      "maxIdleTimeInSeconds": 60,      "statusTimeoutInSeconds": 60,      "pubsubTopics": {}    }  },  "ComponentDependencies": {    "aws.greengrass.LambdaLauncher": {      "VersionRequirement": ">=1.0.0",      "DependencyType": "HARD"    },    "aws.greengrass.TokenExchangeService": {      "VersionRequirement": ">=1.0.0",      "DependencyType": "HARD"    },    "aws.greengrass.LambdaRuntimes": {      "VersionRequirement": ">=1.0.0",      "DependencyType": "SOFT"    }  },  "Manifests": [    {      "Platform": {},      "Lifecycle": {},      "Artifacts": [        {          "Uri": "greengrass:lambda-artifact.zip",          "Digest": "fx7d3M30aF/y5Q/8F0N2qpJjJK7HAAZGvZ/kXo7Apjc=",          "Algorithm": "SHA-256",          "Unarchive": "ZIP",          "Permission": {            "Read": "OWNER",            "Execute": "NONE"          }        }      ]    }  ],  "Lifecycle": {    "startup": {      "requiresPrivilege": true,      "script": "{aws.greengrass.LambdaLauncher:artifacts:path}/lambda-launcher start"    },    "setenv": {      "AWS_GREENGRASS_LAMBDA_CONTAINER_MODE": "{configuration:/containerMode}",      "AWS_GREENGRASS_LAMBDA_ARN": "arn:aws:lambda:eu-west-1:111934086604:function:boto3_s3_test:4",      "AWS_GREENGRASS_LAMBDA_FUNCTION_HANDLER": "lambda_function.lambda_handler",      "AWS_GREENGRASS_LAMBDA_ARTIFACT_PATH": "{artifacts:decompressedPath}/lambda-artifact",      "AWS_GREENGRASS_LAMBDA_CONTAINER_PARAMS": "{configuration:/containerParams}",      "AWS_GREENGRASS_LAMBDA_STATUS_TIMEOUT_SECONDS": "{configuration:/statusTimeoutInSeconds}",      "AWS_GREENGRASS_LAMBDA_ENCODING_TYPE": "{configuration:/inputPayloadEncodingType}",      "AWS_GREENGRASS_LAMBDA_PARAMS": "{configuration:/lambdaExecutionParameters}",      "AWS_GREENGRASS_LAMBDA_RUNTIME_PATH": "{aws.greengrass.LambdaRuntimes:artifacts:decompressedPath}/runtime/",      "AWS_GREENGRASS_LAMBDA_EXEC_ARGS": "[\"python3.7\",\"-u\",\"/runtime/python/lambda_runtime.py\",\"--handler=lambda_function.lambda_handler\"]",      "AWS_GREENGRASS_LAMBDA_RUNTIME": "python3.7"    },    "shutdown": {      "requiresPrivilege": true,      "script": "{aws.greengrass.LambdaLauncher:artifacts:path}/lambda-launcher stop; {aws.greengrass.LambdaLauncher:artifacts:path}/lambda-launcher clean"    }  }}Edited by: Dirk-R on May 3, 2021 12:43 PMCommentShareDirk-Ranswered 2 years ago0Dear all,thank for the support!Meanwhile I figured out that our problem was that the AWS IoT Service is located in region "Ireland (eu-west-1)" while the s3 bucket is located in region "Frankfurt (eu-central-1)".It seems that this cross region access is not supported!Reading file from an s3 Bucket located in region "Ireland (eu-west-1)" worked fine! (both bucket have the same permission settings)Kind regards,DirkCommentShareDirk-Ranswered 2 years ago"


Question: ACM certificate for subdomain in different aws account validation stuck in pending validation

"We have a main account that holds route 53 info(DNS and all for the main domain), We have certificates for the main domain and wild card domain in ACM of the main account.I am trying to request a certificate in a test account (this AWS account is separate by itself), and this request is staying at Pending Validations status for a very long time. Am I missing some steps? How can I fix this issue? Help!FollowComment"

Answer: "0Hi, have you followed the User Guide on DNS validation to make sure you did not miss a step? https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html There is also a support article that explains step-by-step how to do DNS validation using Route 53 here: https://aws.amazon.com/premiumsupport/knowledge-center/route-53-validate-acm-certificates/ Also, to help you troubleshoot any issues you may have with DNS validation, see here: https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-DNS-validation.htmlI hope this helps!CommentShareVincent_Ranswered a year ago"


Question: How can I create a new Admin User in Redshift without access to any SuperUser accounts

"I have accidentally removed the SUPER USER account that I use to run admin tasks with.  This is the only admin user for the Redshift cluster, apart from the default rdsdb user.Logged in as this admin account - I ran the following statement:ALTER USER {admin_user} NOCREATEUSER;And now I cannot add new Super Users - as this admin user no longer has this permission.So - Whats the best solution?  I do have snapshot backups from before my mistake, and I can restore one of those to another Cluster, but I would prefer to get back into the existing cluster if possible!FollowComment"

Answer: "0Only super users can create super users as described in the following document.https://docs.aws.amazon.com/redshift/latest/dg/r_superusers.htmlYou must be a superuser to create a superuser.I think the only way to restore users is to restore Redshift from backup.If this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-4411835 2 months agoThanks - yes, I know that only super users can create other super users from the Docs.  I was wondering if it might be possible to restore the underlying users tables / permissions without restoring to a new Cluster...Or perhaps - can AWS Support add a new user in for me / fix this issue from their side?ShareRiku_Kobayashi EXPERT2 months agoYou can check with AWS support, but I don't think AWS support will create it for you, as user management is solely the responsibility of the AWS user.Share"


Question: Missing Instance

"I created an EC2 instance ~80 days ago and set up a web server on it.  I logged in today, and the instance is missing.  The instance is still running, my website is up, and I can SSH into it.How do I get my EC2 instance back into my AWS Console?FollowComment"

Answer: "0Since I was on the free tier, Tech Support was not available, which is why I posted this question here.  I later found that I was able to contact Account and Billing support.  They were able to help find my instance.CommentShareMartyWanswered 3 years ago"


Question: Savings plan negation greater than savings plan covered usage

As a CSP savings plan are bought at payee account level and shared with all individual sub-accountswe have two sub accounts where savings plan negation is greater than savings plan covered usage86678188xxxxNegation      : -1485.4091014317987Covered Usage : 1434.392157978399887620327xxxxNegation      : -8393.888197400727Covered Usage : 7714.54739607721I want to understand what is the reason for this behaviour? Because ideally sum of these two numbers should be zero.FollowComment

Answer: "0Hi there,Our Account & Billing support team will gladly discuss this matter with you.Please reach out to them via your Support Center. To speed up their response time, please don't hesitate to make use of our chat / phone support option: https://aws.amazon.com/premiumsupport/knowledge-center/aws-phone-support/.Kind regards,- Rafeeq C.CommentShareEXPERTAWS Support - Rafeeqanswered 10 months ago0Generally, you're right in saying that the SUM of "covered usage" and "negation" should equal to $0. You can reach out to support, so they'll be able to investigate better, but in the meantime - I suggest you can also provide them answers to the questions like:Are those 2 linked accounts the only linked accounts in your Organization (i.e. you have one Payer account and 2 linked accounts)?Do you run any resources on the Payer account? Does Payer account benefit from the Compute SP discount, too?How exactly you are monitoring how your SP are applying? In billing dashboard, in Cost Explorer, in Cost and Usage Report, or in any other third-party tool?Do you apply any filters when you track this cost? e.g. you only look at EC2, however you also have Fargate & Lambda usage, and you filter them out?There are a few variables to your question that could help us provide a better answer :)CommentShareEXPERTNataliya_Ganswered 10 months ago"


Question: How to create Quicksight Analysis & Template in CDK

"I would like to create new Quicksight Analysis & Template in CDK (python):I'm trying to do it with CfnAnalysis class & CfnTemplate the problem is with SourceEntity parameter in both classes.Both of them required to provide arn of each other, but during CREATE_IN_PROGRESS only one of them is ready, so I get an error "Resource of type 'AWS::QuickSight::Analysis' with identifier 'CfnAnalysisId' was not found."I can skip in CfnTemplate parameter SourceAnalysis and give instead SourceTemplate with arn of existing template but then when I try to use this template to create a Dashboard I receive another error: "Given placeholders [placeholder] are not part of template". This is correct but placeholder parameter is part of "SourceAnalysis" parameter so back to the original problem.In conclusion, I would like to use CDK to create a new template and a new analysis, both objects need each other, so how can this be done?FollowComment"

Answer: "1Accepted AnswerIn the end, a workaround was found. A manual step is still needed, but only as a prerequisite.1.Create manually quicksight template by CLI "aws quicksight create-template --aws-account-id 0123456789 --region region --template-id template --source-entity file://template.json"2.Use this template ARN as SourceTemplate in new CfnTemplate3.Create new CfnAnalysis with new CfnTemplate arn as SourceEntity.CommentShareAWS-User-0821016answered a year ago0Hi.In order to create Analisys with QuickSight, you need the original Analisys.So create Analisys manually or by another CloudFormation. It's another base analysis for input to the stack.In this case, the ARN that the template should reference is the ARN of the analysis passed in the input parameters, not the Analisys you are about to create.CommentShareEXPERTiwasaanswered a year ago0Thank you for your reply, but unfortunately it is insufficient because it focuses on solving one problem and creates another. To create the Analysis, a DataSet is required, which in my case is also built dynamically like Template and Analysis.If I specify in CfnTemplate an ARN from a manually created Analysis in which a different DataSet is specified, I get the error "Given data sets [arn] are not part of analysis". So if I followed this approach, I would have to manually create half the stackIt looks like a bug in CloudFormation here is reported issue.CommentShareAWS-User-0821016answered a year ago0Another customer is facing this very same issue that they are creating analysis via template. Any suggestions and working are welcome?CommentShareTanaya Badveanswered 2 months ago0Has anyone found a solution for this problem?  The error provided in the prior comment persists, "Given data sets [arn] are not part of analysis" for both Dashboards and Analysis creation using a manually created Analysis as the SourceEntity for the templates. You can also create an Analysis via a Definition, I see describe_analysis_definition in the available Quicksight functions but it does not appear to work even after upgrading to AWS CLI v2.CommentSharePat Ganswered a month ago"


Question: How to prevent Cognito sign up from exposing user email existence?

"I am using Cognito for authentication. In the user pool configuration, I have "PreventUserExistenceErrors" enabled. However, this only affects sign-in and does not affect sign-up. For security and user identity protection, I need to prevent the "account already exists" response. For example, here is a response that I receive on sign up:{"__type": "UsernameExistsException","message": "An account with the given email already exists."}According to the documentation, the above result is expected behavior:*The SignUp operation returns UsernameExistsException when a user name is already taken. To prevent the UsernameExistsException error for email or phone number during SignUp, you can use verification based aliases. For more information, see AliasAttributes Amazon Cognito API Reference guide. For more information about aliases see Overview of Aliases.  *(https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-managing-errors.html)I looked at "AliasAttributes" and cannot find any more detail in the documentation on how these could be used to prevent the "UsernameExistsException" response. It sounds like I would need to make users create both a username AND an email, which is not ideal.How can I get around this without writing custom handlers? (which is the entire reason I am using Cognito in the first place)ThanksFollowComment"


Question: The EC2 instance fails to start after reattached the new volume.

I am facing issues while trying to re-start the stopped instance after I reattached the new volume. It's could not start.The EC2 instance is automatically getting moved to stopped state due to the instance getting shutdown from OS level.Any solution please......FollowComment

Answer: "0Accepted AnswerHello,Need more information to answer your question. I would suggest you to raise a case with ec2 team in AWS Support who will be having more visibility on your environment.CommentShareVetrivelanswered 2 months ago"


Question: Logic for determining which Kinesis shard a partition key goes to

"Hi there,I am currently working with Kinesis shards and I would like to make sure that the hashing function is identical to another message bus I am using. What this entails is I need to write a custom hash function for that other message bus.I have read the following documentation for Kinesis:  https://docs.aws.amazon.com/kinesis/latest/APIReference/API_PutRecord.htmlhttps://docs.aws.amazon.com/cli/latest/reference/kinesis/describe-stream.htmlMy understanding from reading the documents is that each shard out of n shards starting from 0 will have a range of keys 2^128/n and each event's partition key will be hashed out to a 128-bit integer via md5 hashing. Eg.For n partitions (starting from 0):Partition0 key range:Starting Hash: 0Ending Hash:   (2^128 / n) - 1Partition1 key range:Starting Hash: (2^128 / n)Ending Hash:   2*(2^128 / n) - 1......Partition(n-2) key range:Starting Hash: (n-2)(2^128 / n)Ending Hash:   (n-1)(2^128 / n) - 1Partition(n-1) key range:Starting Hash: (n-1)*(2^128 / n)Ending Hash:   2^128 - 1Is there any official documentation or references around this method? I want to make sure my understanding above is correct so I can ensure that the custom method I implement is identical to the Kinesis partitioning mechanism.Edited by: VictorL85 on Apr 23, 2020 5:12 PMFollowComment"

Answer: "0Your understanding is correct, and you can validate the key ranges yourself via the DescribeStream or ListShards output. However, one thing to note is that the number of shards/partitions in Kinesis is not immutable, and Kinesis does not enforce equal sized shards either. In other words, be mindful of the following casesUpdateShardCount can be used to change the number of shards, which can cause the key ranges to changeSplitShard or MergeShards can be used to split/merge key ranges, so shards can be responsible for unequal key ranges.Edited by: rohitnataws on Apr 25, 2020 11:09 AMEdited by: rohitnataws on Apr 25, 2020 11:12 AMCommentSharerohit_awsanswered 3 years ago0Thank you very much!Good call on the shard splitting. I read through that as well.Cheers,VictorCommentShareVictorL85answered 3 years ago"


Question: SES Complaint from....myself???

"Today, I receives an "Email Feedback Report (Complaint)" alert email that shows the complaining email as my own GMail address:Subject: Email Feedback Report (Complaint)This is an email abuse report for an email message with the message-id of 0100018404b7036b-b0c135e9-6859-4840-b783-a96726252b69-000000 received from IP address 34.206.206.127 on Sun, 23 Oct 22 12:00:13 UTC.This is the list of the complaint emails:xxx.xxx@gmail.com<---my email addressThe to email in the attached eml file is also mine. I did not complain or even open the email. This past week I have noticed an alarmingly high number of abuse complaint feedback emails. However, my stats in the Reputation Dashboard are still the same.FollowComment"

Answer: "1If the uptick in complaints are coming from Google, you can subscribe to Gmail Postmaster Tools for additional visibility.CommentShareJesse_Tanswered 7 months ago-1Here's a note on blocking spam.  You might want to be sure you change your password and enable two factor authentication, too, if you don't have it enabled.https://support.google.com/mail/answer/8151?hl=en&co=GENIE.Platform%3DDesktop#zippy=%2Cremove-block-spam-from-my-inboxhttps://support.google.com/accounts/answer/185839?hl=en&co=GENIE.Platform%3DDesktopCommentSharejschwar313answered 7 months ago"


Question: cloudsearch  from cli

"Good afternoon, please tell me how to upload a c json document through aws cli in cloudsearch, how to do it?FollowComment"

Answer: 0Hi thereI understand you want to know how to upload a c json document through aws cli in cloudsearch.Please check the link below to see how to upload a json document CLI in cloudserach.I hope this helps.References:https://docs.aws.amazon.com/cli/latest/reference/cloudsearchdomain/upload-documents.htmlCommentShareNonkululekoanswered a year ago


Question: moving a SES identity from one account to another account

"Hi, as I'm still learning aws, I though this would be a good place for me to keep learning.  So, I have a task coming up where we need to move/migrate a ses identity/account from one aws account to another aws account.  Is this something that is possible? or do we just need to delete source/create new?thanksFollowComment"

Answer: 0Accepted AnswerIdentities on SES both email and domain could be verified in a multiple accounts just the way you did it in initially but in every account that you verify for sending emails it may have to be moved out of Sandbox environment to production.CommentSharezachjonesnoelanswered a year ago


Question: grouping aws lex bot by category

"I'm managing many lex bot in my account, is there any specific way to group my lex bots by category like this below :restaurant bots : contains 2 botscar bots : contains 3 botsFollowComment"

Answer: "0Hi,Unfortunately there is no grouped view for the LEX bot from the console. However, it supports resource tagging. You can add tags to your bot or bot alias to simplify searching/filtering resources.Here is the instruction to tag via console.https://docs.aws.amazon.com/lex/latest/dg/tags-console.htmlThanks,CommentShareJadyanswered 5 months agoayoub 5 months agothank you for your responseShareJady 5 months agoPlease consider to accept this answer if it is useful, thank you!Share"


Question: Elastic Beanstalk Switches Between Ok and Warning with no Cause

"I have an Elastic Beanstalk environment which sends me a notification at random points - usually around 10 times a day - stating only:"Environment health has transitioned from Ok to Warning."This issue always lasts exactly 1 minute before it switches back to Ok again.There is no further information I can see on the reason for this - normally other degradation messages I receive include an explanation of the cause of the status change. I have checked my platform logs and can also see no obvious issue that is occurring any time around the status changes.It is a staging server so activity on the server is also minimal. The monitoring shows things like CPU utilization and Network Out to be all very reasonable. I've tried streaming environment and instance monitoring to CloudWatch but only get the same basic error message.I'm at a complete loss how I can determine the cause of the continuing status issue. I've even tried to sit there logged in on the AWS console ready for when it happens to see if the 'Causes' button becomes active! But as the issue always lasts under a minute, I've never been able to catch it in this state in time.Any tips or advice about how I can determine the cause would be greatly appreciated as I am at a dead-end, and quite confused why AWS doesn't include the reason it's transitioned status in the message.Many thanks!Edited by: P000001 on Apr 23, 2021 1:23 AMFollowComment"

Answer: "0Managed to finally catch the environment in the console when it was down. It was a momentary spike in CPU usage for just a second, but I hadn't seen it in monitoring as by default it shows average CPU usage.CommentShareP000001answered 2 years ago"