Question: Unexpected 403 response (Unable to initialize s3 client for bucket myBucket)

"I have two roles (ECS execution role and an EC2 instance role) that I have configured to read myBucket. I have confirmed that both roles have read access via the policy simulator. Everything is within a single account.However, my deploy tasks (from updating my cluster service) fail due to a 403 error, which puzzles me given the above.Unable to initialize s3 client for bucket myBucket, error: AccessDenied: Access Denied status code: 403, request id: <request-id>, host id: <host-id>CloudTrail seems to be suggesting that my EC2 instance role is the one initiating the rejected request, so to double check I opened a shell on the instance and successfully read the bucket contents via aws cli.I've done a lot of role and policy tweaking trying to solve this, but here's what I have for the moment:EC2 instance role contains:AmazonS3ReadOnlyAccessAmazonEC2ContainerServiceforEC2RoleECS execution task role contains:AmazonECSTaskExecutionRolePolicyCustom s3 read-only policy:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "s3:GetObject",                "s3:ListBucket"            ],            "Resource": [                "arn:aws:s3:::myBucket/*",                "arn:aws:s3:::myBucket"            ]        }    ]}S3 bucket policies:Public access is blockedBucket is encrypted, but not KMS encrypted (it uses the default SSE-S3)Bucket policy:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::370058150712:role/ec2InstanceRole"            },            "Action": [                "s3:GetObject",                "s3:ListBucket"            ],            "Resource": [                "arn:aws:s3:::myBucket/*",                "arn:aws:s3:::myBucket"            ]        }    ]}Note: Because of the CloudTrail log, earlier today I changed the Principal from my ECS execution role to my EC2 instance role (as seen above) with no effect.I even tried:Opening up a VPC endpointOpening up an access point from my VPC to my bucketCan anyone see what is wrong?And can anyone explain why the deploy task (from updating my cluster service) disagrees with the policy simulator?FollowComment"

Answer: "0Assuming you have attached correct permissions on relevant role and even S3 bucket allows access, the best way to figure out the issue is to configure S3 server access logs:[+] https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.htmlHowever, in addition to enabling the S3 server access logs, try to debug your workflow and stage at which this "Access Denied" error occur. This will help out in isolating the API action that is getting rejected.With this API action, check the Request ID and Extended Request ID for the respective API in S3 server access logs. Also verify these areas where action can be denied:Identity based policy (permission present and checked)Resource based policy (bucket in same account so checked)Any permission boundary on IAM roleVPC endpoint policySCP on accountIf nothing helps, gather all the details and contact AWS Support.CommentShareSUPPORT ENGINEERAWS-User-6402083answered 23 days ago"


Question: Notification for snapshot creation at email everyday

"{"source": ["aws.ec2"],"detail-type": ["EBS Snapshot Notification"],"detail": {"event": ["createSnapshot"],"source": ["arn:aws:ec2:us-east-1:233274203099:volume/vol-07da647d1709c19b4"]}}This event bridge rule creates an issue with multiple snapshots, but even after the target is on sns topic subscription, no emails were there in the subscribed email address. I need an email that my lifecycle rule for volume has created a snapshot for success. What can be the way how to get it.FollowComment"

Answer: "0In my environment I receive emails with the same event pattern as yours.If the ARN of the specified EBS is different, the rule will not be executed.Check "Invocations" and "TriggeredRules" in CloudWatch metrics.If there are no metrics, the rule may not have been executed.If the rule is running, check all your email inboxes.For reference, this is the event pattern used in my environment.Volume ID is masked.{  "source": ["aws.ec2"],  "detail-type": ["EBS Snapshot Notification"],  "detail": {    "event": ["createSnapshot"],    "source": ["arn:aws:ec2::ap-northeast-1:volume/vol-xxxxxxxxxxx"]  }}CommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: EC2 instance Status Check failed and server stopped working

"I am using an AWS EC2 instance (t3.xlarge) running on Ubuntu server 18.04.6 LTS, which was working fine. But suddenly I encountered an error where the instance status check failed "Instance reachability check failed" and I was not able to connect to my instance through ssh also the website attached to this server also stopped working. I don't see any storage or Ram issue during this time.I had to force stop and start the instance from the AWS EC2 Console to fix this issue.Later after connecting to the server, I checked the syslog where some of the services were killed as shown in below image around the same time when the instance status check failed.I would like to know what is the route cause or trigger for this issue and the steps I can take to avoid such issues in the future.Please comment if more information is required.Your help in solving this issue is much appreciated.Thanks in advance.FollowComment"

Answer: "1Accepted AnswerHello Surya,Please review this article https://repost.aws/knowledge-center/ec2-linux-status-check-failure/ in troubleshooting this issue.It's difficult to say for certain what caused the instance status check failure without the specific details about EC2 machine and its logs. I would encourage you to open a Technical case with AWS Support by choosing topic Elastic Compute Cloud (EC2 - Linux) and AWS support team should be able to deep dive into instance logs and provide your better insights.I hope this helps, if it does it would be greatly appreciated if you can accept the answer so that community can benefit for clarity.Thank you,NiharCommentShareNIHAR-AWSanswered 2 months agoEXPERTalatechreviewed a month ago"


Question: "DMS : Replication Task is in 100% running state, but stopped replicating data in between. Source - RDS, Destination - S3."

"DMS replication task, which has source as RDS - MySQL and destination as S3, it is ongoing cdc replication task and is showing status as runnning 100%,for 4 hours it was not replicating any data, when we checked RDS, it was having new data of those 4 hours, so why did DMS didn't and also didn't put error status.Later we just stopped and resumed, 3-4 times and then after 3rd attempt data started coming from 4 hours before checkpoint.This issue has happended for our omnifin database (comparitively big Db, issue happened for the first time) and for knab database (very small Db, on every 27th day of the month this issue happens)So why does DMS without showing any error, stops performing its replication task, and in status it is green with runnning 100% display.Please look into this issue.Thanks.FollowComment"


Question: Is it possible to restrict AppStream session users access to my application folder in S3

"Is there a way to restrict/hide a folder/S3 prefix for session users?We have persistent storage configured. Our app will be saving some breadcrumbs during the session but to not confuse our users we would like to restrict access to that folder/S3 prefix from user's perspective. At the same time, the application needs to be able to write and read to the users' bucket, that data is user-session specific. Is that even possible?FollowCommentrePost-User-5267178 8 months agoI created a simple session-context-test.bat file in C:\Scripts folder:@ECHO OFFCD "C:\Users\PhotonUser\My Files\Home Folder"attrib +h hiddenfolderThen I changed the config.json file to use that script:{"SessionStart": {"executables": [...{"context": "user","filename": "C:\Scripts\session-context-test.bat","arguments": "","s3LogEnabled": true...So my question is why that hasn't worked?Share"

Answer: "0Not sure i understand your question.S3 home folders are mounted into AppStream session as "My Files". You want to hide them. Correct?From inside the session, the users browse these files from Windows File Explorer. You may use Windows commands to hide the file. You could try writing a BAT file to change the attribute of the file or folders to be hidden.attrib +h filenameCheckout the two screenshots of using attrib +h on home folders.BeforeAfter running the commandCommentShareArun_PCanswered 8 months agorePost-User-5267178 8 months agoI don't understand how to apply your tips though. I created a simple session-context-test.bat file in C:\Scripts folder:@ECHO OFFCD "C:\Users\PhotonUser\My Files\Home Folder"attrib +h hiddenfolderThen I changed the config.json file to use that script:{"SessionStart": {"executables": [...{"context": "user","filename": "C:\Scripts\session-context-test.bat","arguments": "","s3LogEnabled": true...So my question is why that hasn't worked?Share"


Question: Cloud9 Tmux/Ncurses/nlibrary error not able to update.

"ran sudo apt-get update && sudo apt-get upgrade with no issues.Error when opening cloud9 isYour AWS Cloud9 environment failed to install recommended updates: tmux, ncurses, and libevent. This may be caused by disk space, network, or permissions issues. If the updates continue to fail, we recommend that you create a new environment to stay up to date with the latest AWS Cloud9 features and security patches, or to update them manually. You can report any feedback by choosing Support > Submit Feedback.Also unable to submit feedback to report the issue.FollowComment"


Question: How to securely pass secrets from step to step in step functions

"I'd like to define a step that extracts secrets from secrets manager and then passes those secrets to another step.  With logging enabled the secrets are logged as input to the next step.  If I disable logging payloads, then other step's payload are also not logged.  Is there a way to protect secrets between steps and still log other information?FollowComment"

Answer: "0Could you pass the secret-id(s) and let the next step pull them from Secrets Manager?CommentShareEXPERTkentradanswered a year agoJammor a year agoThe step is a call to CallAwsService with secretsManager as the service.  Its not a lambda.  I'm mostly curious if AWS has solved this issue via the step function infrastructure to pass secrets between steps; and that I had missed how to do it.  Without that functionality its not really a sate machine its just a call stack.Share0I would recommend to retrieve the secrets in the steps you need them, or, encrypt the secrets where you retrieve them and then decrypt where needed. You will need to have some shared encryption key between these steps, so I am not sure it gets you anything.CommentShareEXPERTUrianswered a year agoJammor a year agoAs I mentioned to kentrad: The step is a call to CallAwsService with secretsManager as the service.  Its not a lambda.  I'm mostly curious if AWS has solved this issue via the step function infrastructure to pass secrets between steps; and that I had missed how to do it.  Without that functionality its not really a sate machine its just a call stack.Share"


Question: Scheduled Reserved Instances for dedicated hosts?

"Hi,Is it possible to use scheduled reserved instances for Dedicated Hosts?I do not see this listed as an option, however I wanted to double check before informing my customer:https://aws.amazon.com/ec2/dedicated-hosts/pricing/FollowComment"

Answer: "1Accepted AnswerHi,Instead of the EC2 instances running, the underlying dedicated host can be reserved. Customer can purchase a reservation and assign it to a host after that host has been allocated to their account. This is reserving the host rather than the reserving instance.regards,CommentShareAWS-User-0631429answered 7 years agoEXPERTsedat_salmanreviewed 13 days agoEXPERTNataliya_Greviewed 2 years ago"


Question: S3 Inventory Folder Size

"Hi,There is an S3 Inventory I can access only using Redshift. I cannot access it from S3.All the records from this Inventory follow the same pattern:If the Key has this structure (which I understand it's a folder structure): Folder1/Folder2/, then the size is 0.There are 2 exceptions, though, when size is not 0:These 2 keys look like this:There are also files in the folder123/:There is no file/folder in the folder1/folder2/folder3/ folder. But its size is not 0.My question is why all the folders have size 0, except the ones above?Thank you,LuminitaFollowComment"

Answer: "1Accepted AnswerAs per the Object key naming guidelines "/" is not supported for either Filename or Folder/Prefix name. Only exception is objects with a prefix of "./" must uploaded or downloaded with the AWS Command Line Interface (AWS CLI), AWS SDKs, or REST API. You cannot use the Amazon S3 console. If you are already seeing this behavior in your bucket then I would encourage you to open a ticket with AWS support so this can be checked further.CommentShareSUPPORT ENGINEERHarsh_Panswered 10 months agoLuminitaStan 10 months agoThank you, Harsh_P.Have a great day,LuminitaShare1It seems that your S3 bucket has versioning  enabled or suspended. The reason you are seeing the object bytes from the S3 inventory report may be due to the versioned objects, which means that the object is deleted from bucket and a versioned object is present under prefix folder1/folder2/folder3. To check this from S3 console you can enable the show version toggle button on your S3 bucket after navigating to folder1/folder2/folder3 prefix as follows. If you would like to know the resource specific details then you can open a support ticket with AWS .CommentShareSUPPORT ENGINEERHarsh_Panswered 10 months agoLuminitaStan 10 months agoHi Harsh_P,Thank you so much for your answer.One of my colleagues who has access to S3 directly checked for me what is inside that folder. And they found out that there is a file named / inside folder1/folder2/folder3.So, if I have a file named /, then the key should be =  folder1/folder2/folder3// and needs to have size <> 0 (the key should have 2 slashes at the end - the first one means that folder3  is a folder and the second one means there is a file named  /  inside  folder3).And there should also be another key = folder1/folder2/folder3/  with size = 0, that represents the folder.But there is only one key = folder1/folder2/folder3/  with the same size as my colleague saw that the folder / has.This seems to be a bug.Please advise.Thank you,LuminitaShare"


Question: RDS public snapshots

"When I browse on Snapshots for RDS, I see a lot of public snapshots around 216 . Are these the snapshots that other accounts shared with me ? Will I be charged for them?Is it safe to use them and how can I secure them ?FollowComment"

Answer: "0Accepted AnswerYou aren't billed for snapshots that another AWS account owns and shares with your account or all AWS accounts. You're billed only when you copy the shared snapshot to your account. You're also billed for EBS volumes that you create from the shared snapshot.Those public snapshots are available to every AWS accounts. You will also see public snapshots when they are shared with you.It is your responsibility to configure your RDS instance in a secure way.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ShareSnapshot.htmlCommentSharemojtothanswered 3 months agoEXPERTTushar_Jreviewed 3 months ago0No, there is no additional cost to you for these public snapshots.You aren't billed for the backup storage of public snapshots owned by other accounts. You're billed only for snapshots that you own.You can always copy the snapshots to your account and control them as your own.CommentShareEXPERTkentradanswered 3 months ago"


Question: lost access to FSx share

"Our FSx shares have been unaccessible for 26 minutes today (April 28 from 15:00 to 15:26 CET)no warningwe tried access from VPN access and from Workspacesno setting change/activity done at all done on our end that could affectno notification from AWS of any scheduled maintenanceno "open issue" on AWS dashboardnone of the dashboard indicates any issue (in the FSx panel the fileshare showed as available,etc..)The only hint of an issue was the blank on the lines of the CloudWatch monitoring graphics...I suspect a network modification by AWS folks,  but 26 minutes is a long time for a business to not been access the files in the middle of a workday.That was the first time we noticed but this is worrisome. Anybody has a similar issue and suggestion on how to address this with AWS since support is not automatically an option with them?FollowComment"

Answer: "0Hello,I understand any outages in the FSx service can be frustrating, and that is why AWS communicates events, both planned and unplanned to you as quickly as we can.Any planned events from the AWS team will be communicated beforehand on the AWS Health Dashboard’s scheduled changes section.AWS will also communicate any unplanned events on the Health dashboard, and if necessary a post event summary will also be provided.Scheduled (Future) Changes: https://phd.aws.amazon.com/phd/home#/account/dashboard/scheduled-changesAWS Health Dashboard: https://health.aws.amazon.com/health/statusPost Event Summaries: https://aws.amazon.com/premiumsupport/technology/pes/CommentShareAnthony_Lanswered 10 months ago"


Question: Ground Truth label - a word at the end of the sentence getting split into 2 parts

"We are annotating the pdf for extrating NER, The targetted entity word at the end of the sentence getting split into 2 parts. First part stay at the end of the first line and second part coming in second line. While annotating the tool doesn't allow the dragging to next line.Are there any work arounds available ?FollowCommentZjeraar a month agoI have the exact same question. Did you figure this out?Share"

Answer: 0You have to select the complete 2 lines and then with the sllider that appears on the right you can drag until you have selected the exact text that you want. Sometimes it's difficult with a mouse (because it goes to fast). You can use the arrow keys on your keyboard to make the slider go letter by letter.CommentShareZjeraaranswered 23 days ago


Question: Added AZ to a Load balancer and it does not generate an EIN

"We added a third AZ to the load balancer today at 1:30 but the new ENI has not been generated yet. I noticed last night, I was only getting on A record back initially but by this morning it was returning both. Do you know how long this normally takes?FollowComment"

Answer: "1Hi,By default the LB FQDN resolves to two IP's. When you add the third AZ, the ENI and IP assignments would be immediate provided you have an instance being launched in the third AZ. Till then you would see the LB resolving to two IP's only--SydCommentShareSydanswered a year ago"


Question: AWS Batch - jobs in RUNNABLE for several hours

"I'm trying to understand what could cause AWS Batch jobs (using EC2 spot instances) to be at times seemingly stuck in "RUNNABLE" state for several hours, before finally getting picked up.This annoying behaviour seems to come and go over time. Some days, the very same jobs, configured in the very same way, using the same queues and compute environments are almost immediately picked up and processed, and some days they will be in RUNNABLE status for a long time (recently I experienced 3 to 6 hours).The usual troubleshooting documents don't help, as they seem to only cover cases where the job never gets picked up (due to configuration issue, or mismatch of vCPU/memory between job and compute environments).What I observe when I hit these issues is that there doesn't seem to be any spot request shown in the EC2 dashboard. The Spot instance pricing at that time, for the type of instance I need (32 vCPU, 64Gb memory) is not spiking (and I've set it to a limit of 100% of on-demand anyway). So one theory is that there is no spot instance available at all at that time but 1) that seems unlikely (I use eu-west-1) and 2) I can't find any way to validate that theory.My account limits on M and R instance types (the ones typically be used when the jobs are running) is very high (1000+), so that's also not the reason as far as I can tell.Anyone with any theory and suggestion?For now, my solution is to change the queue to add a compute environment with on-demand instances, but that more than doubles the price...FollowComment"


Question: Default Lambda concurrent executions value only 50

"Hey,I have created new AWS Org and some sub-accounts, and noticed that each account, by default, only had 50 concurrent executions applied. I was under impression that default quota is 1000https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-limits.htmlWhy only 50 was applied?Thanks.FollowComment"

Answer: "1"A few new" is interesting amount, as in pass few months I have setup 10+ new accounts, and ALL OF THEM have 50 by default.I now asked support increase to 100 on one of the accounts.I still can't edit Lambda's Reserve concurrency, it just says "The unreserved account concurrency can't go below 100."Before, error was "The unreserved account concurrency can't go below 50."I tried defining concurrency on account,where value is 1000, no any error comes.Am I right, that actually minimum available unreserved account concurrency is 100?If 100 is minimum, why in first place only 50 was applied on accounts?CommentSharekasperanswered a year agohai a year agoI experience the same issue with 3 different accounts from 3 different companies/employersSharebob 3 months agoI hit this and several other limits which are well below the default limits on dozens of new accounts all within the same AWS Org over the past year. It really impedes our development since we need to request and wait up to a week for these increases to standard levels to be processed. This is really a pain... why are the account defaults not the standards?Share0Per documentations, "A few new AWS accounts might start out with limits that are lower than these defaults. AWS monitors usage and raises your limits automatically based on your usage.".CommentShareEthan Ferdosianswered a year agobob 3 months agoThe auto-increase limit logic seems broken/buggy. I'm unable to configure lambda provisioned concurrency since the limit is set to 50 and the UnreservedConcurrentExecution is also set to 50. This is on two accounts that are ~9 months old and have been very active. Have experience weird limits with every single account we have created in our AWS Org (45 total accounts).Waiting on support to increase limits now....Fixing this issue would have eliminated the need for dozens of AWS support requests from my org alone. Can we get this fixed somehow?Share"


Question: EMR cluster create error:  "Failed to authorize instance profile arn:aws:iam::011476750252:instance-profile/EMR_EC2_DefaultRole"

"I have created EMR default roles by aws emr create-default-roles and then want to create an EMR cluster.But when I click the "create cluster" button, it says: An error occurred (AccessDeniedException) when calling the RunJobFlow operation: Failed to authorize instance profile arn:aws:iam::011476750252:instance-profile/EMR_EC2_DefaultRoleDo I miss some permissions or did anything else cause this?Thanks very much.FollowComment"

Answer: "0Hi Duwan,I see you're getting an error while creating a cluster using the default role. There seems to be an issue relating to instance profile. To resolve it, you can try the following:If you have modified AmazonElasticMapReduceRole or AmazonElasticMapReduceforEC2Role, make sure you review the change as that could be preventing the authorization.If you weren't able to detect the problem in the roles, I suggest you delete and recreate the roles and instance profile either in the console by deleting the role in IAM console which automatically deletes the instance profile or by using the following commands in AWS cli available in https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_delete.htmlDo keep in mind that deleting an instance profile can affect applications on instances using the roles. I hope this helps!CommentShareShreya_Bhattaanswered 10 months ago"


Question: Please add support for .app and .ai TLDs

"I have domains I would like to transfer into AWS, but I can't because my TLD is not currently supported.FollowComment"

Answer: "0The Route 53 product team is aware of both of the TLDs you are requesting. If you happen to work with an account manager at AWS you can have them or the solutions architect add your customer influence to the existing request. Features are added and worked based on the amount of customer influence a feature has, so every +1 that we can add will help it get more visibility. Unfortunately, AWS doesn't publicize roadmap items, so there is no date of planned support.CommentShareAWSJoeanswered a year ago"


Question: AWS SES email not received by recipient

"Hi,I am trying to send an email using a template. When I try to send the email AWS CLI I get a MessageId in response, which I assume means there was no problem with the command, but I don't receive the email in my inbox. I have checked the spam. The sender email is verified and SES is in production mode. Even though I don't get an error the email is not even counted in the Daily email usage counter.$ aws ses send-templated-email --cli-input-json file://myemail.jsonResponse:{    "MessageId": "0108017eb764e317-3e9252f2-690f-4070-9da0-3a783df5f46d-000000"}ThanksFollowComment"

Answer: 0do you have template helper used? ( conditional scripts)I am having a similar issue and scratching my head for a week now. One way to test it is to try the same template from console and see email getting delivered.Following is the link to my post.https://repost.aws/questions/QUPL5Sdx4fRU6tdnAGt6K69A/pinpoint-template-helperCommentShareAWS-User-3791511answered a year ago


Question: "use amazon connect to set a specific date (April 12, 2022) to receive calls"

"I want to use amazon connect to set a specific date (April 12, 2022) to receive calls, anyone help me how to do, I'm a beginnerFollowComment"

Answer: 0You would need to invoke a lambda function (that checks the required date) in your contact flow.https://docs.aws.amazon.com/connect/latest/adminguide/connect-lambda-functions.htmlCommentSharejoahnaanswered a year ago0I think that you could use this https://github.com/aws-samples/amazon-honeycode-connect-integration-sample/tree/main/docs and change it just a bit to play with the date that you want your Contact Center to be available and not.Hope this help.CommentShareLuc Paquetanswered a year ago


Question: Trigger stored procedure upon glue job succe

"Hi Team,I have a web service triggered by lambda every time my glue job succeeded.This web service runs a bulk raw SQL query against MySQL RDS DB.I want to replace the web service with a stored procedure.This stored procedure should be triggered every time my AWS glue job succeeds in order to do some insert/update...what would be the best practice/way to architecture this?where should my stored procedure live?run AWS glue job => job succeded? => trigger my stored procedure to request against MYSQL RDS DB.FollowComment"

Answer: "0Hi there, there's a few ways you can do this and the following are some of the considerations factors:Upon job succeed, do you need to trigger any other workflows apart from the stored procedureDuration of stored procedureFrequency of the job runningAssuming you aren't triggering any other workflows and the duration + frequency of the jobs isn't high, you can stick to the lambda approach since it's serverless and can scale together with your glue job . Stored procedure wise, you can store them directly within the MySQL RDS DB by making some config changes to your DB - you can follow this guide here .If your considerations are different and you might require to trigger additional workflows etc, high duration etc. You can consider the use of event bridge(enabling fan out architecture upon glue job completion) and other AWS services (i.e code build) for your solution.Here is a technical guide that demonstrates how to use the combination of CodeBuild and EventBridge rules to schedule and run functions or stored procedures on an RDS for PostgreSQL database instance.Hope it helps. Cheers.CommentShareAWS-Vincentanswered a year agoJess a year agoThanks a lot for your answer;here are some facts about my job :Upon job success, do you need to trigger any other workflows apart from the stored procedure => no only stored proceduresDuration of stored procedure => is about upsert requests against 15 tables average row by table 12k rowsFrequency of the job running => the glue job might run twice a day and can take about 14 minWhich scenario is better for these facts from the above?if lambda what would be the responsibility of lambda here? only connect to my rds DB and invoke the stored procedure?if lambda? => if lambda invokes my stored procedure and may stored procedure take say 10 min to finish in this case lambda remain blockedfor 10 min until it gets a response back from the stored procedure ? or it invokes the stored procedure and stops?Thanks a lot.Share"


Question: AWS Eventbridge | Step Functions monitoring tips & advice?

"What is the best way to collect EB events and Step Function State Machines status, preferably in one place and on a shoestring budget?My scenario:Working on an MVP whereby Eventbridge launches a bunch of Step Function State Machines.  These grab data from DDB, do some text processing, post results back to the table then put the status of the completed job to SNS (the topic emails me although I might switch to Slack) and lastly back to EB. Of course everything is logged in Cloudwatch in (mostly) individual logs.Clearly this is a flood of notifications but as this is my first MVP with serverless, and soon to launch, I want to stay on top of things.Are there better solutions?FollowComment"

Answer: "0Accepted AnswerThe first question? What are the Points you want tom monitor? The look if it is available in CloudWatch Metrics, if not look at CloudWatch Log Filters https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.html.Then you can create a Dashboard in CloudWatch.An alternative is to use OpenSearch and create the Dashboard with Kibana. Or if you are more familiar with Grafana then use the managed Grafana https://aws.amazon.com/de/grafana/features/?nc=sn&loc=2 you can also combine this with Prometheus https://aws.amazon.com/prometheus/This will add additional Services and costs to your infrastructure.So my recommendation is to go with CloudWatch and CloudWatch Dashboards first and have a look on the alternatives if you are missing functionality or if you already familiar with Kibana or Grafana.CommentShareMarcoanswered a year agoVinceFulco-Bighire-io a year agoYes, I want to be able to quickly assess that each (sub-)workflow was completed correctly.  I will look into your suggestions.  Thank you.Share"


Question: Appsync  GraphQL query does not return all DynamoDB rows?

"I have a DynamoDB table and I noticed I was getting inconsistent results (in my web app) as I added more data to the table.I added 200 test rows to the table. The data includes a date.I entered 4 rows for a specific date. I can use the DynamoDB console to filter these items and see the 4 records that match the date as expected.When I issue a GraphQL query in the Appsync console filtered on the same date, I only get 2 items returned.Hopefully, these images show both the DynamoDB and the Appsync consolesAny ideas?ThanksKevinFollowComment"

Answer: "1I can see that there are default limits applied to the query as it is performing a scan.Details are provided here: https://aws.amazon.com/premiumsupport/knowledge-center/appsync-wrong-query-item-number-dynamodb/I updated the Appsync console query to include an updated limit and this now works fine.query MyQuery {listActivities(limit: 1000, filter: {date: {eq: "2023-02-25T13:45+00:00"}}) {items {dateowner}}}CommentSharerePost-User-KevDevanswered 3 months ago"


Question: Lightsail Container Services with an apex domain in Route 53

"I have just read and followed these docs: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-route-53-alias-record-for-container-serviceCreating the record with the @.example.com syntax does not work. The CLI successfully creates the record, the record is visible in Route 53, but my apex domain example.com does NOT route to my container service.However, if I do not use @. it works. For example:{  "Comment": "Comment",  "Changes": [    {      "Action": "CREATE",      "ResourceRecordSet": {        "Name": "@.example.com", // <----------------- DOES NOT WORK! TRAFFIC DOES NOT ROUTE TO MY CONTAINER SERVICE.        "Type": "A",        "AliasTarget": {          "HostedZoneId": "Z10362273VJ548563IY84",          "DNSName": "tokklr.2caj0m80cnf9q.us-east-2.cs.amazonlightsail.com",          "EvaluateTargetHealth": true        }      }    }  ]}{  "Comment": "Comment",  "Changes": [    {      "Action": "CREATE",      "ResourceRecordSet": {        "Name": "example.com", // <----------------- WORKS!        "Type": "A",        "AliasTarget": {          "HostedZoneId": "Z10362273VJ548563IY84",          "DNSName": "tokklr.2caj0m80cnf9q.us-east-2.cs.amazonlightsail.com",          "EvaluateTargetHealth": true        }      }    }  ]}when using the @. in Route 53 I see this:So are the docs wrong? Outdated? Why does it mention the @.? And why does that do nothing when I create it via the CLI? How is that supposed to work?FollowComment"


Question: Greengrass V2 fleet provision cant connect to IoT - CLIENT ERROR

"Hi there,I have setup everything according to this guide https://docs.aws.amazon.com/greengrass/v2/developerguide/fleet-provisioning.htmlbut when it runsudo -E java -Droot="/greengrass/v2" -Dlog.store=FILE \  -jar ./GreengrassInstaller/lib/Greengrass.jar \  --trusted-plugin ./GreengrassInstaller/aws.greengrass.FleetProvisioningByClaim.jar \  --init-config ./GreengrassInstaller/config.yaml \  --component-default-user ggc_user:ggc_group \  --setup-system-service trueiot returns CLIENT ERROR in $aws/events/presence/connected/4df1e0dd-c0ab-4fae-8642-f5c30so i check the ip, which is the ip of my device{  "clientId": "4df1e0dd-c0ab-4fae-8642-f5c307",  "timestamp": 1646954873555,  "eventType": "connected",  "sessionIdentifier": "da85a477-c309-4ed6-92e0-ccdf1fa",  "principalIdentifier": "de56ae093b3d75481acf40b3d30e38053ad2e8219fa925e8b9ecc",  "ipAddress": "",  "versionNumber": 0}{  "clientId": "4df1e0dd-c0ab-4fae-8642-f5c307",  "timestamp": 1646954873704,  "eventType": "disconnected",  "clientInitiatedDisconnect": false,  "sessionIdentifier": "da85a477-c309-4ed6-92e0-ccdf1fa",  "principalIdentifier": "de56ae093b3d75481acf40b3d30e38053ad2e8219fa925e8b9ecc",  "disconnectReason": "CLIENT_ERROR",  "versionNumber": 0}Thanks for your helpsFollowComment"

Answer: "0Accepted Answerit is the IoT policy, for the claim certCommentShareAWS-User-6797102answered a year ago"


Question: glue job - Issues when reading from the glue catalog table using dynamic frame

"Hi All,I have some issues when running my glue job, I landed my pipe delimited csv file in a s3 bucket and after running the crawler pointing to the folder where the file is placed, a glue catalog table is created.However when I tried to read the data(code below) from the catalog table in a glue job for additional processing and converting to parquet, its not picking all the records.dyf = glueContext.create_dynamic_frame.from_catalog(            database=DATABASE,            table_name=table_name,            transformation_ctx="dyf-" + table_name,    )    rows = dyf.count()    print(f"DataFrame records count : {rows}")Please can someone suggest what could  be the reason for the missing records? I see that there are three columns in the catalog table with incorrect data type( bigint in place of string). I went and manually corrected the data type and set the infer_schema = True in the above code. job is still not picking up the correct number of records.FollowCommentGonzalo Herreros 3 months agoHow much is the difference? Is possible you have bookmarks enabled? How many do you get if you do spark.table(f"{DATABASE}.{table_name}").count()ShareMelfani a month agoHi,Th Glue data Catalog is not a constraint, it is for information. You can force the schema using the glue resolve function. you have to manually force the schemaShare"

Answer: "0Sounds your CSV has formatting issues, I would try to parse/validate it some other way to identify what's wrong, sometimes invisible characters can break the parsing but if it's missing records my guess is that some quote is not properly closed/escaped.CommentShareGonzalo Herrerosanswered a month ago"


Question: Cloud Adoption for work from home user

"Under the outbreak of COVID19, we are encouraging work from home model. We are migrating the intranet web servers, and application servers to the AWS EC2. For best protection, I would like to know if there is any solution for WFH user to have remote access (such as VPN) to AWS? If possible, is there any AWS native remote access VPN available rather then using third party Cloud base Firewall?FollowComment"

Answer: 2Accepted AnswerGiven your question you're probably looking for AWS Client VPN.But depending on what you need to do you might also consider Workspaces or AppStream 2.0 - neither of which are VPN solutions but still are great as remote user access solutions.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: "Auto Scaling Groups, Launch Template and EC2 instance with multiple ENIs with different configurations."

Is there a way to add a launch template that defines EC2 instances with multiple ENIs that have different configurations (for each ENI) to an Auto Scaling Group? or is it a limitation in ASGs?FollowComment

Answer: "0It depends on the setting, for example, you can't select multiple different subnets (since AutoScaling ignores the subnet setting).  But you can select different security groups.  Can you give some more details on what your usecase is?Specifically for the multiple subnets issue, you can workaround it with this methodCommentShareShahad_Canswered 9 months ago"


Question: Help with Auth0 using SAML2 to AWS Managed Grafana missing UID in Relaystate

"Hello, I have successfully gotten Auth0 to work directly with AWS MG via the login flow below:1.Click Sign In with SAML from the Welcome to Amazon Managed Grafana screen.2. Redirected to login using Auth03. Enter credentials and redirect back to the workspace.HOWEVER, I do not want to direct my users to the "Welcome to Amazon Managed Grafana" screen..I want customers to use Auth0 where i have my companies branding.Enter credentials in Auth0redirected to Grafana workspace.The error i get is "Missing UID in RelayState"FollowComment"


Question: How to validate request path parameters for API Gateway in OpenAPI definition

"Currently, there is a way to validate headers, query parameters, and the request body using a validator. But there isn't a way to do this validation for request path parameters.The same question has been asked in the thread https://forums.aws.amazon.com/thread.jspa?threadID=267060 from 2017.However, there hasn't been an answer in that thread. So my question would be: is there a way to validate request path parameters in API Gateway similar to how we validate headers, query parameters, and the request body?Thank youFollowCommentPollyblankincnetwork a year agoGood question PierShare"

Answer: "0Accepted AnswerIt is still not possible to validate the format of path parameters, only their existence. You will need to validate the format in the integration.CommentShareEXPERTUrianswered a year ago0Hi there, perhaps I'm not fully understanding your question, however if there path is incorrect, there won't be an API Gateway resource on the back end to hit so any validation on that path would need to happen client side.  I'm not aware of any option in the OpenApi definition to add validation on the path parameters.CommentShareAWS-User-1931269answered a year ago"


Question: Cloudwatch Rule Failed Invocation

"Hi All,I am new to the AWS services. I am trying to invoke a lambda through a cloudwatch event rule. The rule gets triggered in the specified time; but it fails to invoke the function. I understand that there are several criteria that could cause this. But where can I find which particular reason that caused the invocation failure. Is there a log somewhere or any other means? All I can see now is that the rule failed to invoke the lambda in the specified time.Having said that, I create both the cloudwatch event and lambda using ansible. The invocation used to work sometimes. But when it fails, I want to know why it did. When the lambda is invoked and there is a failure within the lambda, I can go into the logs to get the reason. But the invocation failure is clueless.And after creation, when I click on the target (from the cloudwatch event rule), it takes me to the right lambda and the lambda lists the cloudwatch event rule that (is supposed to) trigger(s) the lambda . As far as I can see the lambda policy includes the cloudwatch event rule in question.Please let me know if I am missing anything or you need more information in this regard.ThanksFollowComment"

Answer: 0Were you able to solve this issue? I am having the exact same problem.CommentShareck-yhanswered 6 years ago0Try this one guys...https://stackoverflow.com/a/46365438/3362The AWS:SourceAccount condition can't be used with AWS events for some reason.CommentShareCluggasanswered 6 years ago


Question: My Account Got Hacked and someone has changed my Email

My Account got hacked and someone changed my root email how to get back my accountFollowComment

Answer: "2Reach out to AWS Support immediately - http://go.aws/account-supportCommentShareAshish_Panswered 10 months agorePost-User-7829217 10 months agoalready reach there 3 days back no response what to do nextShare0Hi there,I'm terribly sorry to hear about this, it's not the experience we strive for. I can understand your need for getting this resolved, which is why I've reached out internally to the team handling your case to communicate the feedback and concerns you've shared here.For your privacy, we're unable to discuss account or case details via this platform. Rest assured, our team has full visibility and will follow up with you in your open support case as soon as possible.In the meantime, please continue to keep an eye out for email correspondence from our team and continue to communicate any issues or questions within your case.We appreciate your patience while we work on this for you.Best regards,— Aimee K.CommentShareEXPERTAWS Support - Aimeeanswered 10 months ago0Hi there,Your case has been updated, please review the next steps our team has provided to you. Kindly communicate any concerns or questions directly through your email correspondence.Kind regards,— Aimee K.CommentShareEXPERTAWS Support - Aimeeanswered 10 months ago"


Question: Cannot terminate EC2

"Hi,I cannot terminate EC2 instance i-09a137b930abd32b9. It has be been in the shutting down state for 1 days.The status message is "Server.InternalError: Internal error on launch".Could you please help?Regards,FollowComment"

Answer: "0When I checked the EC2 again, I found this issue resolved.CommentSharePlusNoanswered 2 years ago"


Question: My ECS tasks (VPC A) can't connect to my RDS (VPC B) even though the VPCs are peered and networking is configured correctly

"Hi,As mentioned in the question, my ECS tasks cannot connect to my RDS. The ECS tasks try to resolve the rds by name, and it resolves to the RDS public IP (RDS has public and private IPs). However, the security group on RDS doesn't allow open access from all IPs so the connection fails. I temporarily allowed all connections and could see that the ECS tasks are routing through the open internet to access the RDS.Reachability Analyzer checking specific tasks' Elastic Network Interface to the RDI ENI is successful, using internal routing through the peering connection.At the same time I have another server on VPC C that can connect to the RDS. All the config is similar between these two apps, including the peering connection, security group policies and routing tables. Any help is appreciatedHere are some details about the VPCsVPC A - 15.2.0.0/16 [three subnets]VPC B - 111.30.0.0/16 [three subnets]VPC C - 15.0.0.0/16 [three subnets]Peering Connection 1 between A and BPeering Connection 2 between C and BRoute table for VPC A:111.30.0.0/16 : Peering Connection 115.2.0.0/16: Local0.0.0.0/0: Internet GatewayRoute table for VPC C:111.30.0.0/16: Peering Connection 215.2.0.0/16: Local0.0.0.0/0: Internet GatewaySecurity groups allow traffic to RDS:Ingress:15.0.0.0/16: Allow DB Port15.2.0.0/16: Allow DB PortEgress:0.0.0.0/0: Allow all portsWhen I add the rule: 0.0.0.0/0 Allow DB Port to the RDS, then ECS can connect to my RDS through its public IP.FollowComment"

Answer: "2The issue seems to be because of this - "The ECS tasks try to resolve the rds by name, and it resolves to the RDS public IP (RDS has public and private IPs)"Refer below section in linkTo ensure that queries from the peer VPC resolve to private IP addresses in your local VPC, choose the option to enable DNS resolution for queries from the peer VPC. This option is Requester DNS resolution or Accepter DNS resolution, depending on whether the VPC is the requester or accepter VPC.Refer below section in linkYou can resolve the public domain name to the private IP address of the EC2 instance. To do this, turn on one of the following options on the VPC peering connection:Requester DNS resolution-or-Accepter DNS resolutionAfter turning on DNS resolution, you can resolve the public DNS to the private IP address of the instanceCommentShareEXPERTTushar_Janswered a year agoEXPERTBrettski-AWSreviewed a year agoManavDa a year agoThanks for that! That solved the issue.ShareTushar_J EXPERTa year agoHi, If the Answer was helpful, please click 'Mark as answered', this can be beneficial to other community members.Share"


Question: nvidia-smi not working on Amazon's DeepLearning AMI

"Greetings,I have set up an instance of "Deep Learning AMI (Ubuntu)" (https://aws.amazon.com/marketplace/pp/B077GCH38C)expecting it to have functioning NVIDIA GPUs.However, when I write nvidia-smi in the command line ,I get:NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver. Make sure that the latest NVIDIA driver is installed and running.And when I try to execute Python code that uses PyTorch 0.4 (I did install that version as required) I get:THCudaCheck FAIL file=/opt/conda/conda-bld/pytorch_1532579245307/work/aten/src/THC/THCGeneral.cpp line=74 error=38 : no CUDA-capable device is detectedTraceback (most recent call last):  File "main.py", line 105, in <module>    train_data = batchify(corpus.train, args.batch_size, args)  File "/home/ubuntu/awd-lstm-lm/utils.py", line 21, in batchify    data = data.cuda()RuntimeError: cuda runtime error (38) : no CUDA-capable device is detected at /opt/conda/conda-bld/pytorch_1532579245307/work/aten/src/THC/THCGeneral.cpp:74Has anyone experienced something similar? Any way to fix this?FollowComment"

Answer: 0Answered: I did not choose a GPU instance when setting up the machineCommentShareAndreaLanswered 4 years ago


Question: Cost Explorer for Lambda@Edge

A customer is trying to see the total cost for Lambda@Edge functions. The assigned cost tags for Lambda@Edge isn't showing on cost explorer. He can only see the cost of Lambda@Edge per region. Is there a way to see the cost for Lambda@Edge either per function or all functions across all regions instead of per region?FollowComment

Answer: "0Accepted AnswerAs to documentation, tags cannot be applied to Lambda@Edge resources, which I take it to be that tags are not applicable once Lambda@Edge functions are deployed.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-requirements-limits.html#lambda-requirements-taggingThe only viable way to show cost per Lamba@Edge function is to use Cost and Usage Report, with query like below. Please note that both Lambda-Edge-GB-Second and Lambda-Edge-Request usage types are included.`SELECTline_item_resource_id as Resource,SUM(CAST(line_item_unblended_cost AS decimal(16,8))) AS TotalSpendFROM  <table name>WHERE   (year='2021') AND (month='01')   AND line_item_product_code = 'AmazonCloudFront'   AND line_item_usage_type LIKE '%Lambda-Edge%'   AND line_item_line_item_type = 'Usage'GROUP BY  line_item_resource_idORDER By  TotalSpend DESC;`I would also remind that you need to consider CloudWatch log cost for Lambda@Edge function as well, which you would have to use CUR to analyze cost per log group for each function.CommentSharepengfeshanswered 2 years ago"


Question: CDK - How to remove API gateway methods with deploy stacks ?

"Hello,As stated in the cdk documentation here (https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_apigateway-readme.html#breaking-up-methods-and-resources-across-stacks), it is fairly common for REST APIs with a large number of Resources and Methods to hit the CloudFormation limit of 500 resources per stack.We followed the documentation and implemented NestedStacks as well as a DeployStask. Everything seems to work as expected except that we did not find how to properly remove an API Gateway method.The deployment.node.addDependency(method) pushes all new or updated methods but we don't know how to deal with deleted methods.I expected that cdk would try to compute the diff between the methods in the new deployments compared with the last deployment but it does not seem to be the case.The only workaround we found is to manually redeploy the whole stage from cli or from the console.How can we remove a method with a deploy stack using cdk only ?Thanks for your help,Best Regards,BrunoFollowComment"

Answer: "0As you already mentioned that for REST APIs with a large number of Resources and Methods which hits the CloudFormation limit of 500 resources per stack, it is suggested to implement nested stacks in order to divide the resources among the multiple child stacksNow, in order to get the new or updated methods deployed in additon to the deletion of the older or deprecated methods, it is required to update the definition of the cdk application to allow the deletion of the older versions of method deleted during cleanup of the stack resources once the new resources have been deployed successfully.However, in case these methods have been deleted manually as an out of band change to the cdk application, it is suggested to update the definition of the resource to avoid the drift among the resources. With this, we can ensure that cdk will try to compare the difference between the methods in the new deployments compared with the last deployment.CommentShareSUPPORT ENGINEERArpit Choudharyanswered 10 months agoBruno Roussel 10 months agoThank you for your reply.I am not sure to understand exactly what you mean by "it is required to update the definition of the cdk application"I understand the remove or deprecated methods can be removed during the cleanup phase.Let's take the exemple from the documentation with books and pets API. Let's say I want to remove the books API. I would remove the code regarding BooksStack and I would writenew DeployStack(this, {restApiId: restApi.restApiId,methods: petsStack.methods,});Then I redeploy. The books method are removed from the resource tab in the aws gateway console but not from the stage tab.What do I need to do in addition to update the definition of the cdk application ?Share"


Question: How many DRAM channels are needed to saturate the PCIe bandwidth on F1?

"Hello,I'm an image processing researcher and I am interested in using Vitis on the F1 to accelerate some applications. All of these applications will read in streams of 1920 x 1080 images and write out 1920 x 1080 images. The total amount of data read will be the same as the total amount of data written, and the images will be loaded in raster-scan order (one row at a time). The applications are easy to parallelize and can be fully pipelined, so that in their steady state they can accept new data every cycle and write finished data every cycle.My understanding is that the connection between the FPGA and its memory is PCIe 3.0 x16, and that the peak bidirectional bandwidth is approximately 32 GB / sec (16 GB / sec of writes and reads respectively).From reading other questions / documentation I gather that there are four DRAM channels, each with a peak bandwidth of 17 GB / sec (https://forums.aws.amazon.com/thread.jspa?threadID=269319).Am I understanding the PCI and DRAM bandwidth correctly? And if so can a Vitis application reach the peak bandwidth of the PCIe connection by using only 2 of the 4 DRAM channels (one for reads and one for writes).Thanks in advance!FollowComment"

Answer: "0Accepted AnswerHi,Yes, F1 Instances have PCIe gen3 x16 Link between the FPGA and the Host, with FPGA as PCIe endpoint. So theoretically PCIe link should supports max bandwidth of 16GB/s per direction. However due to system latencies and other overheads, the design may not be able to hit the theoretical max. In F1, max achievable bandwidth is also dependent on the Custom Design (CL) as well.You will still be able to achieve max bandwidth using only one DRAM channel. Following are few other posts that may help you:https://forums.aws.amazon.com/thread.jspa?messageID=818846&#818846https://forums.aws.amazon.com/thread.jspa?messageID=812716&#812716https://forums.aws.amazon.com/thread.jspa?messageID=940247&#940247https://forums.aws.amazon.com/thread.jspa?messageID=897261&#897261https://forums.aws.amazon.com/thread.jspa?messageID=846147&#846147Please contact us if you need any additional details.Thanks!ChakraCommentShareawschakraanswered 3 years ago0Thanks Chakra!You mentioned that it will be possible to reach peak bandwidth with only 1 DRAM channel. So is it correct to say that the unidirectional bandwidth of one DRAM channel is ~17 GB/sec, and that each channel supports 17 GB/sec per direction?CommentSharedillonhuffanswered 3 years ago0Hello,The DDR data pins are shared between read and write accesses. Therefore, the max available DDR bandwidth of ~17GB/s is shared between reads and writes. You can potentially achieve maximum performance when your accesses are either write-only or read-only.Please let us know if you seek additional details.Thanks!ChakraCommentShareawschakraanswered 3 years ago"


Question: TLS for EFS mounts in 2 different regions on a single instance

"There seems to be a limitation on the helper in amazon-efs-utils that configures stunnel for EFS for you.  It doesn't appear as though it supports 2 different regions simultaneously so that it is not possible to mount two different EFS stores using TLS in two different regions on the same EC2 instance.   It appears as though the config file at /etc/amazon/efs/amazon-efs-utils.conf is only configurable for a single region Is that right? Is there a workaround for it?  Do I have to manually configure stunnel for it to work?Edited by: proca on Feb 17, 2019 9:39 PMFollowComment"

Answer: "0Ok - just FYI for your roadmap, the reason I am trying to do this is cross-region backup for EFS.  Its basically a custom implementation of AWS's recommended approach by using cloudformation to do cross-region EFS backups where it spins up an EC2 instance and copies between the EFS stores.So you are saying that I am going to have to configure stunnel myself to get this working.  I'll take a look at that github repo to see how hard it would be to add support for my use case first.  Thanks for the info.CommentShareprocaanswered 4 years ago0The EFS mount helper currently supports mounting EFS file systems located in the same region as your EC2 instance.  Mounting file systems in other regions is not currently supported by the mount helper - please note that you are responsible for network charges when mounting EFS file systems across AWS regions.Thanks for the feedback - we'll consider it as part of our roadmap.  In the meanwhile, the mount helper is open-source (https://github.com/aws/efs-utils) if you'd like to submit a pull request to enable this functionality.  The area of the code that defines region lookup is found here: https://github.com/aws/efs-utils/blob/master/src/mount_efs/init.py#L119Edited by: JoeTatAWS on Feb 18, 2019 12:15 PMCommentShareAWS-User-2481325answered 4 years ago"


Question: SSH connection refused - M6G instance (ARM) aws linux 2 issue -

"We launch an m6g instance from Amazon Linux 2 LTS Arm64 AMI 2.0.20200722.0 arm64 HVM gp2 (ami-0c5bf07e510b75b11). We change /etc/ssh/sshd_config to add below 3 lines to it to change default port etc. We reload ssh service, restart ssh service, even reboot this server and are able to SSH to the server perfectly fine.Now we take an AMI from the machine ami-xxxxxxx and start a new instance from this ami and instance comes up but SSH connection says connection refused right away. We repeated this ami process on another instance with just port change in sshd_config (and not the other 2 lines) and it still fails. We tried rebooting these servers and console log shows everything is normal but all we get is SSH connection refused right away.Port 30000PasswordAuthentication yesAuthenticationMethods publickey,passwordThis is not a sec group issue as the source server and target server are in the same sec group and 30000/22 are both open to ssh client ip.We cannot use the new m6g instances as we cannot customize the server, esp sshd. WE have done 100s of ami's in past and not sure why AMz Lnux 2 with ARM is having this issue and other non-arm instances have no issue.Anyone have a clue?FollowComment"

Answer: 0cloud init is resetting password auth to no for sshdCommentShareefawsanswered 3 years ago


Question: What causes a "CLIENT_UNAUTHORIZED [769]" login error?

"I can log into my Lightsail instance using Putty with SSH. But when I try to login using the browser-based SSH terminal, I get:Log in failed. If this instance has just started up, try again in a minute or two.CLIENT_UNAUTHORIZED [769]I tried stopping and restarting the instance, and waiting 15 min, but I got the same error. What causes it? I only have one SSH key for this instance, so I don't know why it would still work for putty and not work from the browser-based terminal.FollowCommentLenin Rivas 3 months agoIn my case is because I updated ssh, to solved it  I created a new instance from snapshot.Share"

Answer: "1To fix it, add following 2 lines to /etc/ssh/sshd_configTrustedUserCAKeys /etc/ssh/lightsail_instance_ca.pub    CASignatureAlgorithms +ssh-rsa  Restart/etc/init.d/ssh restart  ProblemLog in failed. If this instance has just started up, try again in a minute or two.CLIENT_UNAUTHORIZED [769]CommentShareziegelanswered 2 years agoMartin-NB 5 months agoMy /etc/ssh/sshd_config file was missing "CASignatureAlgorithms +ssh-rsa". Adding it fixed the connection problem.Share1I too was facing this issue and found the exact steps to fix it (comparing a lightsail instanced that was working)This is without opening the other settingsStep 1) Download the default keyStep 2) Connect using a terminal app with that keyStep 3) sudo nano /etc/ssh/sshd_configStep 4) Add  Include /etc/ssh/sshd_config.d/*.confI put it around line 10 - there is a gap there between a bunch of commented itemsStep 5) At the very bottom you should see TrustedUserCAKeys /etc/ssh/lightsail_instance_ca.pubAdd CASignatureAlgorithms +ssh-rsa on the next lineStep 6) Ctrl + X to save and exitStep 7) sudo service ssh restartThe web terminal should now workCommentShareSFLWAanswered 2 years ago0One possible reason for this error is the system clock on your instance being out of sync with reality. If that's the case, https://forums.aws.amazon.com/thread.jspa?messageID=812946 is a similar issue.If you can login into your instance using PuTTY, please try checking the system clock. If it drifted too much, Lightsail in-browser SSH will not be able to connect.If this keeps happening, please consider setting up https://en.wikipedia.org/wiki/Ntpd on your instances.CommentSharePavel - AWSanswered 4 years ago0Over a year later, I know. I am having the same error, on a brand new Lightsail instance. The timezone, date, and time are set to mine, which is the same as the instance region. I am also running chrony to keep time in synchronisation.CommentSharemrfastidiousanswered 3 years ago0Same Problem here. Any ideas?Thanks a lot!CommentShareJoost123answered 3 years ago0I had the same issue after I upgraded Ubuntu from 18.04 to 20.04.I believe this is due to recent changes on ssh that stopped supporting RSA/SHA1 CA algorithm.Although there is a risk, you can allow it explicitly for now. Maybe it's better to upload another public key.https://sarunas-krisciukaitis.medium.com/hashicorp-vault-ssh-secret-engine-with-openssh-8-2-and-later-f7405ee55d19CommentSharechogeanswered 2 years ago0This solved it for me. Thanks for the info.CommentShareInNoParticularOrderanswered 2 years ago0This solved it for me too, after an upgrade from Ubuntu 18 to Ubuntu 20. Thanks!Edited by: RigaDorje on Apr 7, 2021 11:26 AMCommentShareRigaDorjeanswered 2 years ago0Thanks,helpfulCommentShareAnupBalharpureanswered 2 years ago0Hello,I have lost my default key and my browser-based SSH also not working. What can I do in this case?CommentShareSaadanswered 5 months ago"


Question: Cursor position in Cloud9

"Hi, I would like to display the cursor position in CLoud9 editor. Previously, it was displayed at the bottom right of my editor, but since a few time, the cursor coordinates is no longer available. Could you help me showing the cursor coordinates in the Cloud9 editor ?FollowComment"

Answer: "1Accepted AnswerThanks for reaching out! It seems to be an issue on Cloud9 side and we're currently working on fixing this. I'll keep this thread updated.UPD: the issue has been fixedCommentShareanester-awsanswered a year agoAWS-User-8150822 a year agoGreat, cursor position is back, thank you !Share"


Question: How do I grant DescribeAvailabilityZones permission to an Admin?

"I am new to AWS and I am the sole admin in my subscription. I am a member of the Admins group, and have the AdministratorAccess policy.Yet, when I try to use the Apache Superset reference deployment (https://aws.amazon.com/quickstart/architecture/apache-superset/), I am getting the following error:AccessDenied. User doesn't have permission to call ec2:DescribeAvailabilityZones.I have tried to create a new Policy with specific EC2 permissions, but it has not helped.Please help!FollowComment"

Answer: "0Hello,As I understand it you are having difficulty following the the Apache Superset reference deployment found here https://aws.amazon.com/quickstart/architecture/apache-superset/You say you are getting the AccessDenied error. User doesn't have permission to call ec2:DescribeAvailabilityZones.error when attempting to deploy to CloudFormation.I tried recreating your situation by creating a user in a user group with AdministratorAccess permissions. I went through the apache-superset guide you linked and did not run into the ec2:DescribeAvailabilityZones accessed denied error.Could you confirm that you are logged in on a user whose user group has AdministratorAccess permissions. You can use the command 'aws sts get-caller-identity' to get details on your IAM User or Role.Could you confirm what step of the apache-superset guide you are experiencing this error?Could you check if your AWS account is under AWS Organizations. If this is the case, there could be a Service Control Policy (SCP) that is preventing you access to ec2:DescribeAvailabilityZones. You can read more about SCPs here https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.htmlYou can read more about IAM permission access here https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/Also, it is recommended that you include any command outputs in a support ticket instead of here to keep your information secure. re:Post is a public platform and it is best to keep any information that could expose the architecture of your account in a more private setting like a support ticket.I hope I could help, if you are still having problems you may need to open a support ticket.CommentShareZach_Fanswered a year agoSUPPORT ENGINEERSumukhi_Previewed 10 months ago"


Question: Rekognition face analysis for videos get stuck at finding the job or sending the message

"I followed the same exact steps from https://docs.aws.amazon.com/rekognition/latest/dg/faces-sqs-video.html The code prints out the job id but gets stuck at printing dot lines. I can send and receive messages using SQS. Thank you for your help. Please see the code below.import boto3import jsonimport sysimport timeimport boto3class VideoDetect:    jobId = ''    rek = boto3.client('rekognition', region_name='us-east-1')    sqs = boto3.client('sqs', region_name='us-east-1')    sns = boto3.client('sns', region_name='us-east-1')    roleArn = ''    bucket = ''    video = ''    startJobId = ''    sqsQueueUrl = ''    snsTopicArn = ''    processType = ''    def __init__(self, role, bucket, video):        self.roleArn = role        self.bucket = bucket        self.video = video    def GetSQSMessageSuccess(self):        jobFound = False        succeeded = False        dotLine=0        while jobFound == False:            sqsResponse = self.sqs.receive_message(QueueUrl=self.sqsQueueUrl, MessageAttributeNames=['ALL'],                                          MaxNumberOfMessages=10)            print(sqsResponse)            if sqsResponse:                if 'Messages' not in sqsResponse:                    if dotLine<40:                        print('.', end='')                        dotLine=dotLine+1                    else:                        print()                        dotLine=0                    sys.stdout.flush()                    time.sleep(5)                    continue                for message in sqsResponse['Messages']:                    notification = json.loads(message['Body'])                    rekMessage = json.loads(notification['Message'])                    print(rekMessage['JobId'])                    print(rekMessage['Status'])                    if rekMessage['JobId'] == self.startJobId:                        print('Matching Job Found:' + rekMessage['JobId'])                        jobFound = True                        if (rekMessage['Status']=='SUCCEEDED'):                            succeeded=True                        self.sqs.delete_message(QueueUrl=self.sqsQueueUrl,                                       ReceiptHandle=message['ReceiptHandle'])                    else:                        print("Job didn't match:" +                              str(rekMessage['JobId']) + ' : ' + self.startJobId)                    # Delete the unknown message. Consider sending to dead letter queue                    self.sqs.delete_message(QueueUrl=self.sqsQueueUrl,                                   ReceiptHandle=message['ReceiptHandle'])        return succeeded    def StartLabelDetection(self):        response=self.rek.start_label_detection(Video={'S3Object': {'Bucket': self.bucket, 'Name': self.video}},            NotificationChannel={'RoleArn': self.roleArn, 'SNSTopicArn': self.snsTopicArn})        self.startJobId=response['JobId']        print('Start Job Id: ' + self.startJobId)    def GetLabelDetectionResults(self):        maxResults = 10        paginationToken = ''        finished = False        while finished == False:            response = self.rek.get_label_detection(JobId=self.startJobId,                                            MaxResults=maxResults,                                            NextToken=paginationToken,                                            SortBy='TIMESTAMP')            print('Codec: ' + response['VideoMetadata']['Codec'])            print('Duration: ' + str(response['VideoMetadata']['DurationMillis']))            print('Format: ' + response['VideoMetadata']['Format'])            print('Frame rate: ' + str(response['VideoMetadata']['FrameRate']))            print()            for labelDetection in response['Labels']:                label=labelDetection['Label']                print("Timestamp: " + str(labelDetection['Timestamp']))                print("   Label: " + label['Name'])                print("   Confidence: " +  str(label['Confidence']))                print("   Instances:")                for instance in label['Instances']:                    print ("      Confidence: " + str(instance['Confidence']))                    print ("      Bounding box")                    print ("        Top: " + str(instance['BoundingBox']['Top']))                    print ("        Left: " + str(instance['BoundingBox']['Left']))                    print ("        Width: " +  str(instance['BoundingBox']['Width']))                    print ("        Height: " +  str(instance['BoundingBox']['Height']))                    print()                print()                print ("   Parents:")                for parent in label['Parents']:                    print ("      " + parent['Name'])                print ()                if 'NextToken' in response:                    paginationToken = response['NextToken']                else:                    finished = True    def CreateTopicandQueue(self):        millis = str(int(round(time.time() * 1000)))        #Create SNS topic        snsTopicName="AmazonRekognitionExample" + millis        topicResponse=self.sns.create_topic(Name=snsTopicName)        self.snsTopicArn = topicResponse['TopicArn']        #create SQS queue        sqsQueueName="AmazonRekognitionQueue" + millis        self.sqs.create_queue(QueueName=sqsQueueName)        self.sqsQueueUrl = self.sqs.get_queue_url(QueueName=sqsQueueName)['QueueUrl']        attribs = self.sqs.get_queue_attributes(QueueUrl=self.sqsQueueUrl,                                                    AttributeNames=['QueueArn'])['Attributes']        sqsQueueArn = attribs['QueueArn']        # Subscribe SQS queue to SNS topic        self.sns.subscribe(            TopicArn=self.snsTopicArn,            Protocol='sqs',            Endpoint=sqsQueueArn)        #Authorize SNS to write SQS queue        policy = """{{  "Version":"2012-10-17",  "Statement":[    {{      "Sid":"MyPolicy",      "Effect":"Allow",      "Principal" : {{"AWS" : "*"}},      "Action":"SQS:SendMessage",      "Resource": "{}",      "Condition":{{        "ArnEquals":{{          "aws:SourceArn": "{}"        }}      }}    }}  ]}}""".format(sqsQueueArn, self.snsTopicArn)        response = self.sqs.set_queue_attributes(            QueueUrl = self.sqsQueueUrl,            Attributes = {                'Policy' : policy            })    def DeleteTopicandQueue(self):        self.sqs.delete_queue(QueueUrl=self.sqsQueueUrl)        self.sns.delete_topic(TopicArn=self.snsTopicArn)    def StartFaceDetection(self):        response=self.rek.start_face_detection(Video={'S3Object': {'Bucket': self.bucket, 'Name': self.video}},            NotificationChannel={'RoleArn': self.roleArn, 'SNSTopicArn': self.snsTopicArn})        self.startJobId=response['JobId']        print('Start Job Id: ' + self.startJobId)    def GetFaceDetectionResults(self):        maxResults = 10        paginationToken = ''        finished = False        print(bucket)        while finished == False:            response = self.rek.get_face_detection(JobId=self.startJobId,                                            MaxResults=maxResults,                                            NextToken=paginationToken)            print('Codec: ' + response['VideoMetadata']['Codec'])            print('Duration: ' + str(response['VideoMetadata']['DurationMillis']))            print('Format: ' + response['VideoMetadata']['Format'])            print('Frame rate: ' + str(response['VideoMetadata']['FrameRate']))            print()            for faceDetection in response['Faces']:                print('Face: ' + str(faceDetection['Face']))                print('Confidence: ' + str(faceDetection['Face']['Confidence']))                print('Timestamp: ' + str(faceDetection['Timestamp']))                print()            if 'NextToken' in response:                paginationToken = response['NextToken']            else:                finished = Truedef main():    roleArn = 'arn:aws:iam::581675531545:role/aws-service-role/trustedadvisor.amazonaws.com/AWSServiceRoleForTrustedAdvisor'    bucket = 'teamdecisionvideos'    video = 'testvideoshort.mp4'    analyzer=VideoDetect(roleArn, bucket,video)    analyzer.CreateTopicandQueue()    analyzer.StartFaceDetection()    if analyzer.GetSQSMessageSuccess()==True:        analyzer.GetFaceDetectionResults()    analyzer.DeleteTopicandQueue()if __name__ == "__main__":    main()FollowComment"

Answer: "0Hi ngurkan,There are couple of debugging steps you can do:Using the job id, can you use AWS CLI with GetLabelDetection and ensure you can get the job status and results?If step 1 works, can you refer to this troubleshooting guide and ensure that you have followed all the steps to setup SNS: https://docs.aws.amazon.com/rekognition/latest/dg/video-troubleshooting.html?If you still have issues, can you open a support case with us using this link and provide details about: your account id, job id, region and time window that you submitted your job?Rekognition Video APIs are asynchronous and can take variable duration to complete a job. Once above details are provided, I can check on the status of your job.Thanks.CommentShareSwamiRek-AWSanswered a year agongurkan a year agoHi,AWS CLI comments work and I can print out the results, however, SDK is problematic for me. I am going to send the details of my job as you stated.A question about face analysis; does the video analysis provide emotion labels? I see that Rekognition offers emotion labels for images but I couldn't see the emotion label for face in the video.Thank you very much,NecdetShare0For Face Detection, all attributes (including emotion) are provided when you specify FaceAttributes as "ALL" during Start API call.Please see documentation here: https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StartFaceDetection.html#rekognition-StartFaceDetection-request-FaceAttributesCommentShareSwamiRek-AWSanswered a year agongurkan a year agoHi, I just submitted it the issue at the link you provided but I forgot to give the details. here is the info: Account ID: 5816-7553-1545, Start Job Id: 190f44cc195590b6a951e6bcc3d1aec74c477b619b772bc6224a6cbcf688b4a3, --region us-east-1Share0Hi,Our logs indicate that permissions for the SNS role are not specified correctly and we cannot assume this role. Can you please refer to steps 7-9 here and the SNS troubleshooting guide above for setup?The SNS role needs allow Rekognition to assume it and this role has to be attached to the IAM user calling Rekognition APIs.CommentShareSwamiRek-AWSanswered a year agongurkan a year agoThank you very much for your help. it is working perfectly fine now!Share"


Question: ImageId requried when launching instance via a Launch Template

"The documentation (https://docs.aws.amazon.com/aws-sdk-php/v3/api/api-ec2-2016-11-15.html#runinstances) claims that I can either specify ImageId directly or via a launch template. But if I specify it in a launch template, the request fails validation. The SDK doesn't even make an outbound connection, just errors out immediately.How can I make EC2 use the ImageId specified in my launch template?I'm using the following code to launch an EC2 instance using a launch template:        $result = $ec2->runInstances([            'DryRun' => false,            'LaunchTemplate' => [                'LaunchTemplateName' => 'test-template',                'Version' => 1            ],            'MinCount' => 1,            'MaxCount' => 1        ]);The template ("test-template" Version 1) has an AMI specified (ami-086b3de06dafe36c5 - Amazon Linux 2). When I run the code above, I immediatelly get the following:Found 1 error while validating the input provided for the RunInstances operation: [ImageId] is missing and is a required parameter FollowComment"

Answer: "0I resolved the issue, for some reason "composer require aws/aws-sdk-php" installed an ancient version of the SDKCommentSharerePost-User-7476678answered 3 months ago"


Question: Are 'direct' derivative works of the recordings allowed?

"I was trying to add voice for my game and I found Amazon Polly, and I'd like to use the voice that the service outputs. However, after reading documents such as ToS, I cannot find a definitive answer on what you can do with the recordings.Suppose that I generated a voice recording using Amazon Polly and downloaded it as an audio file.What I want to do with this recording is:to add audio effects to the voice recording andto merge Polly recordings with other audio to reduce file count.Is it allowed to make 'direct' derivative works (I'm not sure if that is the right word) from the recording I made with Polly like this?Or do we always have to use the recording exactly as what Polly generated?(Note: I have all the required licenses/copyright to use the text itself to generate the recording and the audio I want to merge with the recording.)FollowComment"

Answer: "0Hi,You can use Polly to fit any use case including adding audio effects, in a game, etc.Thanks,AnkitCommentShareAnkitD-AWSanswered 3 years ago"


Question: VPC NetworkOUT metric on Cloudwatch

"Hi,how can i monitor Network Out byte of my VPC ? is there a metric?If not, is possible to SUM NAT Network metric and Internet Gateway Netowork Out metric? But i not fount IG metrics.FollowComment"

Answer: "0There is no traffic metrics for internet gateway. You could use Cloudwatch metric math to sum all out-going traffic of your NAT gateways. This would be the same as traffic to internet IF you don't have anything but NAT GWs in your public subnets. It wouldn't include traffic out from other instances, load balancers etc from public subnets. If you absolutely must know traffic out to internet in near real-time you could enable VPC Flow Logs and then parse and sum lines where target is not within your VPC or any other internet networks. Without knowing the use-case this feels bit a bit overkill.https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/using-metric-math.htmlhttps://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.htmlhttps://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.htmlPs. Cloudwatch metric math would allow you follow NAT utilisation and alert if your NAT gateway(s) are becoming a bottle-neck. Here is a Cloudnonaut's blog about monitoring NAT performance https://cloudonaut.io/nat-gateway-monitoring-with-cloudwatch-metrics-and-alarms/CommentShareKalluanswered 3 months ago"


Question: CICD Pipeline error finding package.json

"Hi team,I'm trying to do a CICD pipeline with CDK code for AWS infra,In my code commit repository, I have a parent folder that contains 2 subdirectories one for my spring boot app and the second for the type script CDK project,when I created the pipeline with CDK I did cd my-cdk-projectconst myrepository = codecommit.Repository.fromRepositoryName(      this,      "myrepository",      "my-repository-name"    );const pipeline = new pipelines.CodePipeline(this, "Pipeline", {      crossAccountKeys: true,      pipelineName: "cdk-pipeline",      synth: new pipelines.CodeBuildStep("Synth", {        buildEnvironment: { privileged: true },        input: pipelines.CodePipelineSource.codeCommit(          myrepository,          "mybranchname"        ),        commands: [          "cd my-cdk-project",          "npm ci",          "npm run build",          "npx cdk synth",        ],        primaryOutputDirectory: "my-cdk-project/cdk.out",      }),    });but when the pipeline execute I have the impression that it ignore all commands before the npm ci, so I have this errorI tried to do cd ./my-cdk-project, but still have the same errorI also tried with pipelines.ShellStep... but the error is still the same :I recommit the package-lock.json but this did not solve the issueRunning command npm cinpm ERR! code ENOENTnpm ERR! syscall opennpm ERR! path /codebuild/output/src123456789/src/package.jsonnpm ERR! errno -2npm ERR! enoent ENOENT: no such file or directory, open '/codebuild/output/src123456789/src/package.json'npm ERR! enoent This is related to npm not being able to find a file.npm ERR! enoent npm ERR! A complete log of this run can be found in:npm ERR!     /root/.npm/_logs/xfdgjgfghghjghg-debug.logdid I miss something?Thank you for your help!FollowComment"

Answer: "0Accepted AnswerI fixed it by redeploying the CDK pipeline itself,I was adding the cd mysubDir and pushing, and the pipeline ran upon push but doesn't seem to take into account my modif (cd mySubDir)so I redeployed the CDK pipeline and it works, now the command cd mySubDir is executed.Thank youCommentShareJessanswered 4 months ago0Have you generated and committed your package.json file already? If that is not present, the npm ci command cannot run.CommentSharerowanuanswered 4 months ago0Hello,The code ENOENT means that npm fails to open a file or directory that’s required for executing the command.I believe that mostly the package.json file is not committed to the CodeCommit Repo and now when CodeBuild Runs, it is not able to find the file.One thing you can do is check your .gitignore file for package.json. Please note that if package.json is present in the .gitignore file then it will be ignored during the commit. So please remove package.json from the gitignore file if you find it.If this doesn’t help then, please feel free to refer these third party links for more information:[+] https://sebhastian.com/npm-err-enoent/[+] https://www.codejourney.net/how-to-fix-npm-err-enoent-enoent-no-such-file-or-directory-rename/[+] https://community.n8n.io/t/npm-not-able-to-find-file/2859[+] https://you.com/search?q=this%20is%20related%20to%20npm%20not%20being%20able%20to%20find%20a%20fileCommentShareAbhishek_Tanswered 4 months ago"


Question: 1/2 checks passed

"Hello, I'm facing a problem regarding the "1/2 Checks passed" problem, when this problem happens I can't connect over ssh anymore. What could be causing this problem?https://ibb.co/DtLStm0FollowComment"

Answer: "1Accepted AnswerWhen you see an instance failing status checks, try stopping and starting the instance. If the source of the problem was something like the underlying hardware, this approach will typically fix those transient issues. If you see this problem consistently, then it's likely something that you're running inside the instance that is causing it to be unreachable. More details on what the status checks are actually checking here.CommentSharemikeanswered a year agoAWS-User-4623868 a year agoThanks for the link, I'm checking out the possibilities. I've already started it 4 times during 8 days, and the problem returns, I'm not running anything abnormal from ec2, it uses 1/3 of the resources (cpu, memory, disk), maybe I'll pay a support to have a more service enlightening, after all I'm testing between aws and gcp. I worry about support in cases like this, after all I'm looking to migrate more than 100 services. This same service is running on gcp , without any failures.Share1It's difficult to say what is happening to your instance; but I would suggest using the EC2 Serial Console to troubleshoot.CommentShareEXPERTBrettski-AWSanswered a year ago0Thanks for the reply, but even I can't connect. the strange thing that the status says "System Accessibility Check Passed", but I can't access it, the application is stopped. When I boot, it goes back to normal. I've already reported it to aws, but no one returns. As this service is a test to migrate my company's services, I worry about the level of support if I have a bigger problem. Because of this, maybe they are losing a great future customer.CommentShareAWS-User-4623868answered a year agoBrettski-AWS EXPERTa year agoIf (when you reboot) everything goes back to normal then it points to "something" on the instance that is running amok. Start collecting operating system and application logs; looking at metrics (particularly CPU/memory/swap) - all the things that are going to cause the instance to have processes that stop or crash or otherwise are constrained because something else is consuming all resources.Share"


Question: Can I keep existing IAM users and add SSO to our accounts

"Hi,We currently have several accounts all using IAM - users, roles policies. We would like to improve how we manage our users by using SSO with our active directory account so that we have a centralised location for our users.We also have users that are for external service providers (people) and applications that are not in our active directory.Are we able to use the SSO for our users and then manage our other users in IAM or is having both SSO users and IAM users incompatible?What happens to our existing IAM users if we active the SSO?Kind RegardsDavidFollowComment"

Answer: "1SSO and IAM users can coexist. Nothing happens to your existing IAM users, groups, roles or policies when you provision SSO into your accounts.SSO appears as a new identity provider in your IAM config and manages its own roles (permission sets) alongside your normal IAM roles. Users coming in via SSO roles can also assume other IAM roles (with the right permissions), though watch out for condition strings in policies as things like MFA constraints don't work for SSO users.Overall AWS SSO is a benefit, but be prepared for a small learning curve and extra work on the governance side as AWS SSO is less mature than IAM and seems to be taking a while to catch up.CommentShareKrisHanswered 3 years ago"


Question: RDS with multiAz enabled not deleting automated backups according to backup retention

ProblemMy RDS instance's automated backups are not deleting after 1 day (the configured backup retention period). In my account I see 3 automated backups for the database. one backup for each of the past 3 days.What I expectedMy RDS instance to only have 1 automated backup at any given time. Because I've specified backup retention of 1 day it should delete the previous days backup right after creating a new backup.My instanceMultiAZ: enabledEngine: Postgres 14.3Backup Retention: 1 dayFollowComment

Answer: "1Accepted AnswerHi,It is expected for PITR requirements. Please see below explanation from RDS FAQs page.https://aws.amazon.com/rds/faqs/Q. Why do I have more automated DB snapshots than the number of days in the retention period for my DB instance?A. It is normal to have 1 or 2 more automated DB snapshots than the number of days in your retention period. One extra automated snapshot is retained to ensure the ability to perform a point in time restore to any time during the retention period. For example, if your backup window is set to 1 day, you will require 2 automated snapshots to support restores to any within previous 24 hours. You may also see an additional automated snapshot as a new automated snapshot is always created before the oldest automated snapshot is deleted.CommentShareJosephanswered 8 months agoryparker 8 months agoThank you for the explanation and link. Do you know if we're charged for these extra backups?Share"


Question: Directory Service directory migration between accounts

"Hello to anyone reading,I have a question about the following, imagine that an AWS customer creates their account and chooses to use the Directory Service service for their Microsoft AD.Over the years, this company was purchased by a company and its account became a daughter account.Is it possible to migrate as a replica the Directory service with all the records of groups, users and everything else? Taking into account that after migration the Directory has to be deleted from the child account.Thank you very much.FollowComment"

Answer: "-1Good day, thereYes, you can now use the Active Directory Migration Toolkit (ADMT) along with the Password Export Service (PES) to migrate your self-managed AD to AWS Directory Service for Microsoft Active Directory, also known as AWS Managed Microsoft AD, since the company was purchased and running their AD's on premises.This makes it easier for you to move AD objects and encrypted passwords for your users.Please see the attached document for more information.Resource:https://aws.amazon.com/blogs/security/how-to-migrate-your-on-premises-domain-to-aws-managed-microsoft-ad-using-admt/CommentShareNosiphiwoanswered a year agoRob_H EXPERT2 months agoThis answer is incorrect, you cannot migrate password out of AWS Managed AD, you could migrate the users themselves from one directory to another but SID history and passwords would not be synced to the new managed Active Directory environment.Share"


Question: Blocking SG Rule

"Is it possible to have a rule like a SCP rule to block people adding route 0.0.0.0/0 in SGs in an AWS Organization?FollowCommentAyse Vlok a year agoHi, please test this yourself as well, as i cannot guarantee. But I wanted to do this for a specific group of SGs. I had tested below and it worked. Have not tried a blanket policy for all SGs, but this  definitely worked for me.{"Version": "2012-10-17","Statement": [{"Sid": "Statement1","Effect": "Deny","Action": ["ec2:UpdateSecurityGroupRuleDescriptionsIngress","ec2:ModifySecurityGroupRules","ec2:CreateSecurityGroup","ec2:RevokeSecurityGroupIngress"],"Resource": ["arn:aws:ec2:eu-west-1:123456789111:security-group/sg-.............."],"Condition": {"StringEquals": {"aws:SecurityGroupRule": ["fromPort: 22, 3389","cidrIpv4: 0.0.0.0/0"]}}}]}Share"

Answer: "2Here is a blog that explains how you can achieve what you are trying to using a Config Rule - https://aws.amazon.com/blogs/security/how-to-auto-remediate-internet-accessible-ports-with-aws-config-and-aws-system-manager/If you find my answer useful, please accept my answer. ThanksCommentShareEXPERTIndranil Banerjee AWSanswered a year ago0Unfortunately, it is not possible at the moment. Although many different actions, resources, and condition keys are available to be used in IAM, the content of the Security Group is not one of them.References:Supported Services — https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.htmlActions, resources, and condition keys for Amazon EC2 — https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.htmlCommentSharevasylenkoanswered a year ago"


Question: Deploy Lambda Function and API Gateway using Terraform

"I'm trying to create a Lambda/API Gateway proxy via Terraform. When I apply it throws error. Any help would be appreciated.Error: error creating Lambda Function (1): AccessDeniedException:status code: 403, request id: eeab48d2-0b96-4717-bc4a-8fb2ff0d4f15resource "aws_iam_role" "lambda_role" {   name = "role_lambda"   assume_role_policy = <<EOF{  "Version": "2012-10-17",  "Statement": [    {      "Action": "sts:AssumeRole",      "Principal": {        "Service": "lambda.amazonaws.com"      },      "Effect": "Allow",      "Sid": ""    }  ]}EOFFollowComment"

Answer: "0As per the error message, you are getting an AccessDeniedException. Please make sure you have sufficient AWS permissions to create a Lambda function and IAM role, including access to attach a role to Lambda.CommentSharejoahnaanswered a year agoAWS-User-5291433 a year agoI'm running it as ec2-user. I added the role (as in the above code) Lambda creation permission. EC2 instance has all the permission to read S3 etc.Share0You could setup the debug for terraform that would give you more information and you could try to check on cloudtrail who is the actor (user or role) trying to run the action that is failing.Here you can find documentation on how to search in cloudtrailCommentShareMikianswered a year agoAWS-User-5291433 a year agoI used the below commands to debug. But, no use it has the same message as the apply command shown.  export TF_LOG=TRACEand terraform apply 2>&1 | apply.txtShare0Hello AWS-User-4124479, let us know if any of the answers provides solves your question. If so, please remember to click on the "Accept" button to let the community know that your question is resolved. This helps everyone. Thank you in advance.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year agoAWS-User-5291433 a year agoNo, I tried using the user arn in the Lambda resource definition instead of a custom policy. That's resolved 403 error, but throwing 400 error. It looks like a well-known error based on this git page. https://github.com/hashicorp/terraform-provider-aws/issues/13709Share"


Question: Does auto scale-in policy remove instances below desired capacity ?

"I am facing a problem related to 'Desired Capacity' and 'Minimum Capacity'.My ASG has desired capacity as 2, minimum capacity as 1 and maximum capacity as 6. There is a scale-in policy (and CloudWatch alarm) to remove 1 instance when 'CPU Utilization' is below 20%.The alarm is getting triggered and I can see that in both cloudwatch dashboard plus EC2 dashboard against the instance.However the problem is the auto-scale in policy is not getting trigged and the instance is not terminated. In EC2 dashboard the status becomes 'No data' and in CloudWatch dashboard the state becomes 'Insufficient Data'.Can you please let me know why 1 instance is not getting terminated ? Is it because my desired capacity is 2 ??My minimum capacity is 1 so isn't it that after alarm is triggered 1 instance will be terminated ?FollowComment"

Answer: "0Have you looked at the autoscale group in the EC2 console?  check the activity history tab...e.g.https://console.aws.amazon.com/ec2autoscaling/home?region=us-east-1#/details..if your alarm is properly hooked up to the ASG action, you should see something there that would help.Also on the details tab for the ASG, be sure there are no:Suspended processesCommentSharecloudbuttonanswered 2 years ago0thank youCommentShareSomrajanswered 2 years ago"


Question: How to resolve net::ERR_CONTENT_LENGTH_MISMATCH error

"Running an EC2 app. The site started to show a net::ERR_CONTENT_LENGTH_MISMATCH error for a couple of javascript files.https://sqlplusplus-tutorial.couchbase.com/tutorial/#1Any guidance on how to troubleshoot or resolve this would help.Thank you,JamesFollowComment"

Answer: "4The net::ERR_CONTENT_LENGTH_MISMATCH error typically occurs when the actual size of the transferred content doesn't match the value specified in the Content-Length header.we need a lot more detail about this errorby this much information i can just say the followingIf you are using gzip compression on your server, try temporarily disabling it to see if the issue persists. Sometimes, issues with gzip compression may cause the content length mismatch error.Clear your browser cache and try reloading the page. Cached files may sometimes cause issues like content length mismatch.Examine your web server configuration to ensure that it's set up correctly. If you are using Apache, check the httpd.conf file, and if you are using Nginx, check the nginx.conf file for any issues related to content length or compression settings.CommentShareEXPERTsedat_salmananswered 2 months ago"