Question: Failed to create RSA key Pair in CloudHSM

"I am creating an RSA 2048 keypair using CloudHsm JCE provider.KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA", Security.getProvider(CloudHsmProvider.PROVIDER_NAME));final KeyAttributesMap publicKeyAttrsMap = new KeyAttributesMap();publicKeyAttrsMap.put(KeyAttribute.LABEL, "test:public");publicKeyAttrsMap.put(KeyAttribute.MODULUS_BITS, 2048);publicKeyAttrsMap.put(KeyAttribute.PUBLIC_EXPONENT, new BigInteger("65537").toByteArray()); publicKeyAttrsMap.put(KeyAttribute.TOKEN, Boolean.TRUE);publicKeyAttrsMap.put(KeyAttribute.VERIFY, Boolean.TRUE);final KeyAttributesMap privateKeyAttrsMap = new KeyAttributesMap();privateKeyAttrsMap.put(KeyAttribute.LABEL, "test:private");privateKeyAttrsMap.put(KeyAttribute.TOKEN, Boolean.TRUE);privateKeyAttrsMap.put(KeyAttribute.SIGN, Boolean.TRUE);privateKeyAttrsMap.putAll(getSignaturePrivateKeyTemplate());KeyPairAttributesMap keyPairSpec = new KeyPairAttributesMapBuilder().withPublic(publicKeyAttrsMap).withPrivate(privateKeyAttrsMap).build();keyPairGen.initialize(keyPairSpec);KeyPair keypair = keyPairGen.generateKeyPair();I'm able to create key in sample program but when use the same code in my web application getting the following exceptionjava.security.InvalidAlgorithmParameterException: Expected KeySpec to be instance of KeyPairAttributesMap or KeyAttributesMap. Please provide a valid KeySpec for this operation.at com.amazonaws.cloudhsm.jce.provider.CloudHsmKeyPairGeneratorBase.initialize(CloudHsmKeyPairGeneratorBase.java:84) ~[cloudhsm-5.8.0.jar:?]at com.amazonaws.cloudhsm.jce.provider.RsaKeyPairGenerator.initialize(RsaKeyPairGenerator.java:24) ~[cloudhsm-5.8.0.jar:?]at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:691) ~[?:?]at java.security.KeyPairGenerator.initialize(KeyPairGenerator.java:436) ~[?:?]Strange thing is I am usingcom.amazonaws.cloudhsm.jce.provider.attributes.KeyPairAttributesMapbut still its throwing exception. The same code is running as stand alone application.FollowCommentrePost-User-0096215 18 days agoIn start couple of keys generated but failing to get publicKey bytes from generated keypair object. The return Keypair object have null public and private bytes. After running multiple time suddenly start throwing this exception. Even after deleting and creating new HSM cluster not effecting the result.Share"


Question: SPF neutral after setting up a custom MAIL FROM header

"After setting up a custom MAIL FROM header to mail.mydomain.com the SPF status of my emails has become neutral.When inspecting an email, I can see this:spf=neutral (google.com: 69.169.224.2 is neither permitted nor denied by best guess record for domain of 01070183be9ac4f5-9e55550f-9eb0-465d-93a3-06902380d9f7-000000@mail.mydomain.com) smtp.mailfrom=01070183be9ac4f5-9e55550f-9eb0-465d-93a3-06902380d9f7-000000@mail.mydomain.com;My DNS records are as follows:MX 10 mail.mydomain.com feedback-smtp.eu-central-1.amazonses.comTXT mydomain.com v=spf1 include:mx.ovh.com include:amazonses.com ~allWhat can I do to be able to have a PASS mark on SPF while also using a custom MAIL FROM header?FollowComment"


Question: Availability of source for AWS Sagemaker Object2Vec framework

Most of the sagemaker frameworks based on open source frameworks such as PyTorch / scikit-learn etc are available in github (i.e. search for org:aws sagemaker-*-container). Is the source for "in-house" algorithms such as Obejct2Vec (https://docs.aws.amazon.com/sagemaker/latest/dg/object2vec.html) also available somewhere?FollowComment

Answer: "0Good dayAs you correctly pointed out, the SageMaker prebuilt Docker images for opensource frameworks are available on github (https://github.com/aws/deep-learning-containers/blob/master/available_images.md). The SageMaker built-in algorithms like Obejct2Vec are propriety and are thus not available publicly.Kind regardsCommentShareSUPPORT ENGINEERNjabsanswered 3 months ago"


Question: FSxLustre FileSystemInput in Sagemaker TrainingJob leads to: InternalServerError

We are submitting a Sagemaker Training job with Sagemaker SDK with a custom docker image. The job finishes successfully for EFS FileSystemInput or TrainingInput. Trying to use the FIleSystemInput with FSxLustre configuration leads to the training job dying during the Preparing the instances for training stage:InternalServerError: We encountered an internal error. Please try again.This error is persistent upon re-submission.What we figured out until now:the job errors before the training image is downloaded.specifying an invalid mount point leads to a proper error: ClientError: Unable to mount file system: xxx directory path: yyy. Incorrect mount path. Please ensure the mount path specified exists on the filesystem.the job finishes successfully when running locally with docker-compose (Estimator with instance_type="local").we can mount the FSx file system on an EC2 instance with the TrainingJob's VPC and security group.How can we narrow the problem down further and get more information about the failure reason? Can you suggest likely problems that could cause this behavior?FollowCommentrePost-User-1665594 5 months agowondering if you've found a way to resolve this issue?Share

Answer: "0InternalServerError means that was an unforeseen error, during training job orchestration, that wasn't mapped to a known user facing error.You should create an AWS Support case to uncover the root cause.CommentShareGili Nachumanswered a year ago"


Question: Setting up Own MQTT broker (using Mosquitto) -  not authorized to perform: iot:CreatePolicy

"I am setting own mqtt broker using aws workshop:https://catalog.us-east-1.prod.workshops.aws/workshops/5ecc2416-f956-4273-b729-d0d30556013f/en-US/chapter6-mqtt-broker/10-step1In startup.sh script execution step getting errors:not authorized to perform: iot:CreatePolicynot authorized to perform: iot:CreateKeysAndCertificateUser account having all below access permissions:IAMFullAccessAmazonS3FullAccessAWSIoTFullAccessAWSGreengrassFullAccessGreengrassV2TokenExchangeRoleAcessAdministratorAccessI am trying to resolve this couple of days, but not yet succeeded . It very urgent need resolve for current projectFollowComment"

Answer: 0The aws credentials you are running with don't have access to the given actions. Please configure you CLI - https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.htmlCommentSharesushantAtAWSanswered a year agoRajaram Murali a year ago@sushantAtAWS it is already configured on AWS CLIShare


Question: Notifications on Comments Answers on Email | re:post Features

"HiI am Supporting Questions in the Community, I answered 30+ Questions but I do not find some missing features,When I answer Question, If the Questioner comments or asks something or someone answers the same questions, I am not getting an Email notification but only if the questioner accepts the Answer - IS this the right behavior of the repost, or does you have to do something on it?From FAQ I found that AWS Expert will review your answer to get more points --> but what would be the timeline for the AWS Expert to review it?IF I answer a question and the Owner of the question is not able to respond so what happens? AWS Team will review it? what would be the expected timelines for this review it?Attachments are missing here --> Do you have any roadmap for this ?For Example i have logged in from ABC AWS account created profile and answered some questions got badges etc later if i am logged in as XYZ account now whats happing re:post recognize as a new user but with the same Email lost all history -- Is this the correct behavior or you need work on this?Please let me know if you have any questions, Thanks GKFollowComment"

Answer: "0Accepted AnswerHello GK,Thank you for answering questions and sharing your technical expertise. We highly appreciate your time and efforts to help others. Here are answers to your questions:Q: When I answer Question, If the Questioner comments or asks something or someone answers the same questions, I am not getting an Email notification but only if the questioner accepts the Answer - IS this the right behavior of the repost, or does you have to do something on it?**A: **Thank your for notifying this. For the time being, the workaround is to follow the questions to answer to. This will guaranty you get a notification when somebody responds.Q:  From FAQ I found that AWS Expert will review your answer to get more points --> but what would be the timeline for the AWS Expert to review it?A: There are no specific SLAs for this.Q:  IF I answer a question and the Owner of the question is not able to respond so what happens? AWS Team will review it? what would be the expected timelines for this review it?A:  When you answer a question, an email notification goes to the person that asked the question asking them to review and if the answer solved their question to mark it as Accepted Answers. If they don't do that, the question is routed to experts for experts reviewsQ  Attachments are missing here --> Do you have any roadmap for this ?A: Yes, this is in our roadmap. We understand the importance of this featureFor Example i have logged in from ABC AWS account created profile and answered some questions got badges etc later if i am logged in as XYZ account now whats happening re:post recognize as a new user but with the same Email lost all history -- Is this the correct behavior or you need work on this? A: Thank you for input here. We recommend to use a single account when replying to users. We're working on an integration that will enhance this situation.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year agoGK a year agoThanks for the kind information, good to hear from the Team. i hope everything will be done asapShare"


Question: unknown slowdown in parallelcluster

"I've noticed that the amount of time to complete the jobs in my task array varies dramatically. Any idea what is causing it? The speed of the jobs seems very acceptable for the first jobs, but then something goes wrong ... ?I'm using the slurm scheduler 20.11.8 and aws parallelcluster 3.0.2.Below are 2 examples showing the variation in time/job. I plot the time (in seconds) it takes for each job/task (each job is a dot).  (I couldn't see how to attach an image, so I'm providing links.)example 1: 800 jobs https://ibb.co/KrrwhXnYou can see that the first ~400 tasks complete in roughly 400 seconds per job, and then jobs 400 to 750 take about 6000 seconds.example 2: 300 jobs: https://ibb.co/4RdTpzgYou can see that the first 50 jobs run slower than jobs 50-150, and then jobs 150-200 are slowest.In both cases I'm running 50 nodes at a time. It seems like the duration of the job is related to the number of jobs each instance has run. In other words, the speed of the task often changes considerably at each multiple of 50. When I change the number of nodes running at a time, I still observe this pattern. Each job is basically equal in the amount of "work" there is to do (within 5%), so it's not the case, for example, that jobs 150-200 in example 2 are "harder" than the other jobs. Actually the 2 examples above are the exact same jobs (but in example 2 I only ran the first 300 of 800 jobs).What I've tried:I've used different instance types, but I observe this slowdown across all instance typesI've used different number of nodes, but whether I use 20, 40, or 50, I observe this slowdown.I've observed the CPU and memory usage in both the head node and nodes in the compute fleet, and it seems reasonable. when I use -top- to monitor, the highest usage process generally is using less than 1% of memory and 1% of CPU.I've explored these logs in the head node, but I haven't found anything that's clearly wrong:/var/log/cfn-init.log/var/log/chef-client.log/var/log/parallelcluster/slurm_resume.log/var/log/parallelcluster/slurm_suspend.log/var/log/parallelcluster/clustermgtd/var/log/slurmctld.logI've explored these logs in the compute node, but I haven't found anything that's clearly wrong:/var/log/cloud-init-output.log/var/log/parallelcluster/computemgtd/var/log/slurmd.logHere's my configuration file:Region: us-east-1Image:  Os: alinux2HeadNode:  CustomActions:    OnNodeConfigured:      Script: s3://my-bucket/head.sh    InstanceType: t2.medium  Networking:    SubnetId: [snip]  Ssh:    KeyName: [snip]Scheduling:  Scheduler: slurm  SlurmQueues:  - Name: queue1    ComputeResources:    - Name: t2medium      InstanceType: t2.medium      MinCount: 0      MaxCount: 101    Networking:      SubnetIds:      - subnet-[snip]    CustomActions:        OnNodeConfigured:        Script: s3://my-bucket/node.shI'm limiting the number of nodes running (50) in the following way:#!/bin/sh#SBATCH --partition     queue1#SBATCH --array=1-800%50                #SBATCH --nice=100FollowCommentChris Pollard a year agoThere is a potential log4j patcher agent issue that can impact performance. Here is the article on that:  https://github.com/aws/aws-parallelcluster/wiki/Possible-performance-degradation-due-to-log4j-cve-2021-44228-hotpatch-service-on-Amazon-Linux-2. There are a few optional mitigations in there so that you can pick the one that is right for your environment.ShareAWS-User-1494532 a year agoThanks a lot for your idea, @Chris Pollard.In order to verify if the patcher service is running , I ran this command:sudo systemctl status log4j-cve-2021-44228-hotpatchthis was the output:● log4j-cve-2021-44228-hotpatch.serviceLoaded: masked (/dev/null; bad)Active: inactive (dead)I'm not very familiar with the sudo systemctl status commands, but it seems like the patcher is not running? If so, that might be because I'm not running any Java applications that I know of.If this patcher was actually the cause, I would expect the effect to be somewhat constant. For example, slow all the time. But what I observe is that the speed is fine for some period and then there's a sudden spike in run times.ShareChris Pollard a year agoHmmm...If you can share, what exactly is the job doing? From where is it pulling the data that you're processing? Where are results being stored? I think what Xin Xin means by disable thread is to set the DisableSimultaneousMultithreading to true (https://docs.aws.amazon.com/parallelcluster/latest/ug/Scheduling-v3.html#yaml-Scheduling-SlurmQueues-ComputeResources-DisableSimultaneousMultithreading)ShareAWS-User-1494532 a year agoHey Chris, sorry for the delay in replying!I’m running a proprietary software that solves various simulations.I store my scripts in $HOME/PROJECT1/scripts/output is saved in $HOME/PROJECT1/ouput/Initially I had the software saved in $HOME. When I was troubleshooting this issue I had wondered if the problem was the nodes having some conflict accessing this shared directory. So I copy the software from $HOME to /usr using a when the node configuration is completed (bootstrap action; OnNodeConfigured).I’ve tried to figure out what “fixes” the issue after it’s occurred. These things do not work:simply stop the job and restart job with the same nodesdelete all the output and restart  job with the same nodesto kill all the nodes, delete all the output, and restart job with new nodes... but if I wait for some period of time (not sure how long it must be), then the slowdown goes away.Share"

Answer: "1I guess it because of using T-family instance as compute node. T-family is burstable instance, and provides a baseline CPU performance with the ability to burst above the baseline at any time for as long as required. It spend CPU credit to do bursting,  If there are no accrued credits remaining, then the instance gradually comes down to baseline CPU utilization and cannot burst above baseline until it accrues more credits. So I guess when you submit first 50 jobs, it use up the credit, and then CPU had to be limited in second 50 jobs to earn credit.Moreover, a job is a process in OS, and a CPU core is independent execution unit, so the number of process must match the number of the CPU core to achieve the highest performance to avoid process switching. So I suggest you can re-test this case with C or M family instance and disable thread.CommentShareXin Xinanswered a year agoAWS-User-1494532 a year agoThanks for your thoughts @Xin Xin. I've also observed  the same behavior using c5xlarge and m5large instances.Can you explain what you mean by "disable thread"?I've noticed that the CPU usage goes down when the jobs slow down.Here's a graph of the CPU activity in a recent test I ran: https://ibb.co/KbXYdcHCould there be some sort of account limit that I'm hitting? If so, how could I check for that?Share0bump! Any ideas for things I can try?CommentShareAWS-User-1494532answered a year ago0Another reason maybe is OpenSlurm scheduler performance issues, Default config of scheduler does not meet High-Through jobs schedule requirement. You may adjust scheduler's config.You can check scheduler's performance information by command "sdiag", and refer to :https://slurm.schedmd.com/high_throughput.htmlCommentShareXin Xinanswered a year ago"


Question: Project Run Time does not start on Sagemaker Studio Lab

"That is the case as of two days ago. This does not work for neither CPU nor GPU "compute type".Basically, after pressing the "Start runtime" button, it says "Preparing project runtime..." for about ten minutes and then stops. It shows the following error, "There was a problem when starting the project runtime. This should be resolved shortly. Please try again later."I have now tried it about a dozen or more  times throughout the period.There is no way to even access the work that is saved there. The "project" will not boot up.Basically it is a dud at this point.Is anyone else experiencing similar issues? What does one do? Is there a way to reset the environment to original and restart (e.g., a factory reboot)?FollowCommentAWS-User-0823707 a year agoIn order to resolve this issue we will need to know your user id, please share that through this secure form - https://pages.awscloud.com/GLOBAL_PM_PA_amazon-sagemaker_20211116_7014z000000rjq2-registration.html.In addition, please create a support ticket so your issue can be investigated.Share"

Answer: "0I know this is an old question, but hopefully you got this resolved.  A factory reset is to delete your account and recreate it.  If you use the same email address then you will not have to wait for a new approval.CommentShareMichele Monclovaanswered 11 days ago"


Question: Are SAML + OIDC Cognito identity providers supported by Amplify on the web?

"The Amplify Authentication docs for IOS outline support for the following types of identity federation:Facebook, Google, Apple here https://docs.amplify.aws/sdk/auth/federated-identities/q/platform/ios/SAML:  https://docs.amplify.aws/sdk/auth/federated-identities/q/platform/ios/#saml-with-cognito-identityOIDC: https://docs.amplify.aws/sdk/auth/hosted-ui/q/platform/ios/The Amplify Authentication docs for web browsers only outline federated identity support for Facebook, Google (+ Auth0) here: https://docs.amplify.aws/lib/auth/advanced/q/platform/js/By digging into the Auth module codebase it's become apparent it's possible to invoke either a SAML/OIDC user pool iDP as follows:Amplify.Auth.federatedSign({ customProvider: USER_POOL_IDENTITY_PROVIDER_NAME })See: https://github.com/aws-amplify/amplify-js/blob/6c4d4b5fc737652f88dcdfa26bdb02a1defdfa2e/packages/auth/src/Auth.ts#L1924QuestionsIs this approach supported when using Amplify in a web browser? Looking purely at the docs would suggest it's not supported.Amplify's PKCE support isn't documented anywhere. Similar question, it this something that will remain supported on web too?FollowComment"


Question: IPAM service usage

"Hi community,My question is regarding new AWS IPAM service. Is it possible to manage external CIDR not used on AWS tenant (like a CIDR used on a LAN for a site) ?FollowComment"

Answer: "1Yes, it is possible to manage external CIDRs. The only constraint is that they cannot overlap with the AWS public ip ranges.You can find the details in the IPAM user guide: https://docs.aws.amazon.com/vpc/latest/ipam/manually-allocate-ipam.htmlCommentShareEXPERTAndreas Seemuelleranswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: Upgrade from MySQL 5.6 to 5.7 failed

"Trying to upgrade from MySQL 5.6 to 5.7 on RDS.PrePatchCompatibility.log includes:1) MySQL 5.7 preupgrade check to catch orphan table issuesFor the following tables, either the datadir directory or frm file was removed or corrupted.More Information:https://dev.mysql.com/doc/refman/5.6/en/innodb-troubleshooting-datadict.html[table_schema, table_name]name123, - Check the server logs or examine datadir to determine the issue and correct it before upgrading.Per link provided:SELECT * FROM INFORMATION_SCHEMA.INNODB_SYS_TABLES WHERE NAME LIKE '%#sql%';There are three tables with names:'tmp/#sql2d63_22106882_6''tmp/#sql2d63_22106882_7''name123/#sql-19eb_123727b27'Per that link the process should be to manipulate .frm files in the file system - clearly that's not available in RDS though.From other reading, tried to drop the table using:USE name123;DROP TABLE  `#mysql50##sql-19eb_123727b27`;But that fails with:Error Code: 1051. Unknown table 'name123.#mysql50##sql-19eb_123727b27'Any ideas how to resolve?FollowComment"


Question: "Amazon Linux 2, Apache and Open SSL 1.1.x"

"I've attempted to enable TLSv1.3 on a Lightsail instance with Apache 2.4.52 and I receive "SSLProtocol: Illegal protocol 'TLSv1.3'"I have OpenSSL version 1.0.2k installed.  When I run yum update, it does not update OpenSSL.  Any thoughts on how you can enable TLSv1.3 on Amazon Linux 2 with Apache?FollowComment"

Answer: 0Check out https://www.ssl.support/blog/steps-to-enable-tls-1-3-on-servers/CommentShareDavid Ganswered a year agoPendo a year agoI've already done that and that is why I'm receiving the error "Illegal protocol TLSv1.3"Share0Still no solution after 9 months? The latest AMI with Amazon Linux 2 2022 is still stuck with OpenSSL 1.0.2 fips. Any way to re-compile HTTPD to work with OpenSSL 1.1.1c?CommentSharerePost-User-9436320answered 6 months ago


Question: CodeCommit: What would be the way to get change count for a Commit?

"Get Commit API does not return any information on change count for a commit say added/modified/deleted lines.https://docs.aws.amazon.com/codecommit/latest/APIReference/API_Commit.htmlI see there is a getDifference API which returns only before and after BLOBs and changeType only and a getBlob API that returns base64 encoded file.https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetDifferences.htmlhttps://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetBlob.htmlThe only way i can think of to get change count is use GetDifferences API to get Blobs and use GetBlob API to get files and do a decode and use any filecompare util API to get change count which is too much to achieve a very simple thing easily available in response for a commit detail in other providers like git/azure repos.Is there anything i am missing, can you give me pointers?FollowComment"

Answer: "0I would suggest using git commands to pull this information.The git diff subcommand supports a --stat argument which will give you the summary of changes, with the number of changed files, along with the number of lines added, modified, or deleted.Here are some examples, using the aws-cdk repo:Changes between most recent commit and previous commit:$ git diff --stat HEAD^1..HEAD packages/@aws-cdk/aws-customerprofiles/package.json | 1 + packages/@aws-cdk/aws-groundstation/package.json    | 1 + packages/@aws-cdk/aws-lookoutmetrics/package.json   | 1 + 3 files changed, 3 insertions(+)Changes between two tagged releases:$ git diff --stat v2.68.0..v2.69.0(I have omitted the first bit of the output here for brevity) packages/cdk-assets/test/docker-images.test.ts                                       |  139 +++++ tools/@aws-cdk/eslint-plugin/lib/rules/invalid-cfn-imports.ts                        |    2 +- tools/@aws-cdk/individual-pkg-gen/transform-packages.ts                              |    6 +- tools/@aws-cdk/pkglint/lib/rules.ts                                                  |   24 - tools/@aws-cdk/prlint/test/module.test.ts                                            |    3 - version.v2.json                                                                      |    4 +- 400 files changed, 10821 insertions(+), 7443 deletions(-)As you can see, this gives you the total changes in summary, and also shows you a breakdown per file.[1] https://git-scm.com/docs/git-diff#Documentation/git-diff.txt---statltwidthgtltname-widthgtltcountgtCommentShareSUPPORT ENGINEERWayne_Ganswered 2 months agorePost-User-4143735 2 months agoThanks for response. But i'm looking for a solution with which i can get the diff info from REST APIs.Share"


Question: Best Security Practices

"What are some of the best security practices, so far I know of:Use MFA for root acountUse a key pair for any instanceSetup HTTPS version of the siteIs there any pages that can let me to proper setup?FollowComment"

Answer: "2Please review Security Pillar of AWS Well-Architected Framework - The focus of this paper is the security pillar of the AWS Well-Architected Framework. It provides guidance to help you apply best practices, current recommendations in the design, delivery, and maintenance of secure AWS workloads. https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.htmlCommentShareDeep_Kanswered a year ago2https://aws.amazon.com/blogs/security/top-10-security-items-to-improve-in-your-aws-account/CommentShareEric_Fanswered a year ago0Very important,  Always create EC2 instance privately, meaning in inbound, it should be accessible from interval server only within AWS and no one should be abled to access it directly.Plus, Always use proper security for bucket and never keep it public unless its required.If you are an Admin user and want to create another user then never give full permission to that user and give only required permissionApart from security group inbound rules, you can also use Network ACLs  which is high level of security to control traffic so incase if security group missed any filter then Network ACLs  can again filter out the traffic.CommentShareMaulik_Makadiyaanswered a year agoAWS-User-8231125 a year agoI understand, only web server can be accessed from outside. The rest should be accessed from the webcliShare0There are many things to describe security for AWS console and AWS well architecture frame work some are listedVPC must b privateSubnet with private and public multi AZ with using NAT gatewayif using RDS it should be private and only can accessible with private VPC or linked resources with private VPV and if you want to connect it remotely so use open vpnAlways user and make roles and policy to use any AWS service in side of any other Aws serviceAnd many more you can see in this given linkhttps://docs.aws.amazon.com/wellarchitected/latest/security-pillar/security.htmlCommentShareAWS-User-0319350answered a year ago0Hi!  Great question.This is a long and complex answer as there are many best security practices for operating securely in AWS.  Keep in mind there's no comprehensive checklist, more recommendations and best practices that will help you in your secure cloud journey!This AWS Whitepaper is a great read on security responsibility and the shared responsibility model: https://docs.aws.amazon.com/whitepapers/latest/aws-overview/security-and-compliance.htmlFor starters (and the well-architected framework,https://aws.amazon.com/architecture/security-identity-compliance/This covers security categories such as Identity and Access Management, Detection, Infrastructure Protection, Data Protection, Compliance, and Incident Response.Furthermore, each service should have a security section that's worth a read.  For example, Lambda: https://docs.aws.amazon.com/lambda/latest/dg/lambda-security.htmlCommentSharejsoncanswered a year ago"


Question: Upload large file with multiupload for cross s3 accounts using Boto3

"I'm trying to upload a file that is greater than 100gb with boto3 file_uploadobj with the multiupload option. The code will run for about 30 mins and then throw the following error:ClientError: An error occurred (InvalidArgument) when calling the UploadPart operation: Part number must be an integer between 1 and 10000, inclusiveHere is my code:import boto3from boto3.s3.transfer import TransferConfig# s3 client for current accounts3_dst = boto3.client('s3')# assume role to access s3 client in another accounts3_src = boto3.client(    's3',    aws_access_key_id    aws_secret_access_key    aws_session_token)                        src_resp = s3_src.get_object(Bucket = 'old-bucket',Key = 'src.csv')config = TransferConfig(multipart_threshold=1024*250, max_concurrency=10,                        multipart_chunksize=1024*250, use_threads=True)s3_dst.upload_fileobj(src_resp['Body'], 'new-bucket', key='src.csv', Config=config)What do I have to do to get this to work? Are there other options besides upload_file?FollowComment"

Answer: "1Accepted AnswerI've done exactly what you are trying to do and the issue is that your parts are large enough.  Specify a part like multipart_chunksize=10241024250.  The chunksize I believe is in bytes and you are limited to 10,000 parts, so that's what is going on here.CommentSharejschwar313answered a year agorePost-User-1410626 a year agothis was the issue. thank you!Share0Since you are using mulipart uploads, I want to be sure you know about this.  I recently found out that failed multipart uploads are saved in S3 and I pay for them.  Here's how you can get rid of them.  You will see that the metrics shows more objects and more storage than you can see in your bucket if this is happening.  I would ask for a refund of those costs if you have them.  Here's an article on how to create a lifecycle policy to automatically delete these failed parts.  https://aws.amazon.com/blogs/aws/s3-lifecycle-management-update-support-for-multipart-uploads-and-delete-markers/CommentSharejschwar313answered 10 months ago"


Question: Unable to launch a P3 instance

"EC2FullAccess permission was granted to the IAM user, and it can launch any other type of EC2 instance except p3 instance.I increased limit of running on-demand all p instance and i am sure this new instance does not reach the limit.The error code is:You are not authorized to perform this operation. Encoded authorization failure messageWhat should i do to get the authorization?FollowComment"

Answer: "0Can you try to decode the authorization failure message so we can further troubleshoot?https://aws.amazon.com/premiumsupport/knowledge-center/ec2-not-auth-launch/CommentShareJeremy_Sanswered 4 months agoJeremy_S 4 months agoHave you checked for service control polices blocking you? Here is an example https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_ec2.htmlSharerePost-User-3352625 4 months agoOf course, see the following message:"DecodedMessage": "{"allowed":false,"explicitDeny":true,"matchedStatements":{"items":[{"statementId":"","effect":"DENY","principals":{"items":[{"value":"xxx"}]},"principalGroups":{"items":[]},"actions":{"items":[{"value":"ec2:RunInstances"}]},"resources":{"items":[{"value":"arn:aws:ec2:::instance/"}]},"conditions":{"items":[{"key":"ec2:InstanceType","values":{"items":[{"value":".10xlarge"},{"value":".12xlarge"}]}},{"key":"ec2:InstanceType","values":{"items":[{"value":".??xlarge"},{"value":".???xlarge"},{"value":"p."},{"value":".metal"}]}}]}}]},"failures":{"items":[]},"context":{"principal":{"id":"xxx","name":"initial-admin-user-xxxxxxxxxxxx","arn":"arn:aws:iam::xxxxxxxxxxxx:user/initial-admin-user-xxxxxxxxxxxx"},"action":"ec2:RunInstances","resource":"arn:aws:ec2:ap-northeast-1:xxxxxxxxxxxx:instance/","conditions":{"items":[{"key":"ec2:MetadataHttpPutResponseHopLimit","values":{"items":[{"value":"1"}]}},{"key":"ec2:InstanceMarketType","values":{"items":[{"value":"on-demand"}]}},{"key":"aws:Resource","values":{"items":[{"value":"instance/"}]}},{"key":"aws:Account","values":{"items":[{"value":"xxxxxxxxxxx"}]}},{"key":"ec2:AvailabilityZone","values":{"items":[{"value":"ap-northeast-1c"}]}},{"key":"ec2:ebsOptimizeShare"


Question: AWS AI/ML integration with Power BI

"Customer wants to know if AWS AI/ML services integrate with Power BI. The customer currently uses Power BI that integrates with Azure ML for sentiment analysis, opinion mining, etc. Customer is looking for a push button solution where the business analyst can do text analytics on the response from the model. Is there a way to do this on AWS or a marketplace solution?FollowComment"

Answer: 0Accepted AnswerPowerBI can connect to Amazon Redshift and leverage the new SQL based ML capability in Redshift that uses Sagemaker under the hood.As an alternative thought the customer can integrate Amazon Sagemaker Model with Amazon Quicksight to achieve functionality very similar to PowerBI with Azure ML. Quicksight does have some embedded ML capability like forecasting and anomaly detection but Opinion mining is not one of them yet.You should be able to leverage Blazing Text Algorithm in Sagemaker or some market place solution like Twinword sentiment model in sagemaker for sentiment analysis for Text mining after the integration.CommentShareAWS-User-5862030answered 2 years ago0Please take a look at this AWS solution - https://aws.amazon.com/solutions/implementations/text-analysis-with-amazon-opensearch-service-and-amazon-comprehend/Comprehend also has an integration with AWS Aurora - https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/mysql-ml.htmlCommentShareAWS-User-8841074answered a year ago


Question: Split one table into multiple tables using AWS DMS?

"Giving an example to explain my scenario -FileA has 100 attributes. FileB has 300 attributes. The attributes in Files A and B can be from multiple tables. These files are present in S3. We are going to import Files A and B into RDS Postgres. Now this Postgres will haveTable A --> generated from File A (100 attributes) andTable B --> generated from File B (300 attributes)We now want to split Tables A & B into multiple smaller tables using AWS DMS.Source Postgres (Tables A & B) --> AWS DMS --> Target Postgres (Tables C, D, E, F)Is this possible?Any advice to implement this scenario? Please helpFollowComment"

Answer: 1It may be possible to use AWS DMS for your case but you may be better off using a Stored Procedure or an ETL tool (if you are already using one) instead.The ideal tool will depend on factors such asIs the source and target PostgreSQL instance the same?Is this a one-time or an ongoing process?Are the smaller tables a subset of the rows of the larger tables? Or is it a subset of the columns? Or is it a more complex logic?Are you already using AWS DMS for something else or are you planning to introduce DMS just for this activity?CommentShareAWS-VGanswered 7 months ago


Question: EC2 crashes a few time a week last month

In the last month my EC2 which hosts my blog went down 2 or 3 times every week. I have no idea why because it has running totally normally before that. I checked my blog frequently so I usually restarted it pretty fast but I am trying to solve the issue completely. Just wondering how I can see the reason for the crash of my EC2? ThanksFollowComment

Answer: "0First of all, you can view the system log to see if there are any errors on the instance: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.html#troubleshooting-retrieve-system-logsSecondly, you can view the detailed system log files to troubleshoot the issueFor Linux systems, you can search files under /var/log (e.g. /var/log/syslog)For Windows systems, you can search the Windows Logs from Event Viewer (https://docs.microsoft.com/en-us/shows/inside/event-viewer)CommentShareRichardFananswered a year ago"


Question: Setting current time as attribute in a Contact

"We have an application that we are looking to use Connect for that requires us to update a premise database with events throughout a customer telephone call. I was looking to just set an attribute and then use a lambda to write to the database, but I cannot find a way to pull the current time, or call start time, or really any time related to the Contact and save it as a call attribute. Has anyone else tried to do this?FollowComment"

Answer: 0You're using the wrong tool for the job. You want to use a data stream specifically the contact trace records to get that kind of information and figure out what to do with it.davidCommentSharedmaciasanswered 2 years ago0Thanks David. I suspected as much but it is good to get confirmation.CommentSharetonyC5060answered 2 years ago0If you look at EventBridge for Connect this will trigger certain events from the interaction and can trigger a lambda function to perform an action to update the database.It has been recently releasedhttps://forums.aws.amazon.com/ann.jspa?annID=8696CommentSharem66rusanswered 2 years ago


Question: What is Validation set adjustment while the system is auto labeling

"How is it works, and what is the purpose?INFO:samurai_science_object_detection.cli:Running validation set adjustment.FollowComment"

Answer: "0When an auto labeling job is initiated by Ground Truth, a random sample of input data is selected and sent to Human workers for labeling. Upon the return of this data, a training set and a validation set are created. Ground Truth uses these datasets to  train and validate the model used for auto labeling.Much like with ML models,  cross-validation is done by using a complementary subset of the data from the input data to evaluate the model. In Ground Truth auto labeling, this Validation set of data is periodically adjusted ( at every iteration of the labeling job) to improve the accuracy of the automated labels.If you have further specific questions around your workflows or require a deep dive on your logs in this regard,  you may open a support case using this link , as we  may require details that are non-public information, and we will be happy to assist you further.How it works - https://docs.aws.amazon.com/sagemaker/latest/dg/sms-automated-labeling.html#sms-automated-labeling-how-it-worksCross-Validation - https://docs.aws.amazon.com/machine-learning/latest/dg/cross-validation.htmlCommentShareTshepi_Manswered 7 months agorePost-User-9607372 7 months agoThe number of validation set was reducing at each round, and this missing data was moving to the traning set.On the 1st round of traning, there was 1000 traning set and 501 validation set.On the 2nd round of traning there was 2202 traning set and 299 validation set.On the 3rd round of traning there was 3381 traning set and 120 validation set.I am curious about the machanism behind this.Thank you!Share"


Question: Cannot find HTTP API by name in Cloudwatch metrics

"I have an HTTP API (API Gateway v2) and I have enabled the metrics.Now, when I go to Cloudwatch and create a dashboard widget, I can't find this HTTP API in metrics by NAME. I can only find it by ID, but that's not what I want. I would like to find it by name.Any chance you could point me to what went wrong, please?FollowComment"

Answer: "2According to the API Gateway documentation, the HTTP APIs CloudWatch metrics use their ApiId dimension as API ID. This is different from v1 REST API which uses ApiName for ApiName dimension.A workaround I can think of within CloudWatch is to set a custom name for each graph in the dashboard to specify an API name. Another way would be using a REST API instead of HTTP API.CommentShareTaka_Manswered a year agorePost-User-1751894 a year agoThank you for answer. Is there any chance you can provide more info about this part "set a custom name for each graph in the dashboard to specify an API name."? Also, is this doable using CloudFormation? Thank you againShareTaka_M a year agoYou can name your graph or rename existing ones. Please see this documentation. For CloudFormation, when creating a AWS::CloudWatch::Dashboard resource, you specify the DashboardBody for the dashboard structure. You can leverage the title field for each widget to define the graph name.SharerePost-User-1751894 10 months agoTaka_M, the real issue is that I am deploying using serverless and sometimes I have to delete the CloudFormation stack which means the API Gateway gets deployed with a different ID. The real question is how do I keep the dashboard in sync with this Api ID that can change sometimes?Share"


Question: Possible to stitch multiple inputs together via console?

"Hello, we were hoping to append an endcard to some of our videos. I believe this is possible via CLI & API with multiple inputs however I was curious if it was possible to add multiple inputs via the web console? Currently I can't find a way to add more than one and would be nice for some of our team members that are not savvy with the CLI.Thanks,Jason----EDIT-----ANSWEREDRe-reading the documentation I believe I found it. I was looking at the job template and not the individual job where the option to add an input becomes available.Link: https://docs.aws.amazon.com/mediaconvert/latest/ug/specify-input-settings.htmlEdited by: jasontheeditor on May 15, 2019 4:35 PMFollowComment"

Answer: "0Hi Jason,Glad you were able to find the link to the documentation and sort this out. Please let us know if you have any other questions or run into any issues.Thanks!-JaredCommentShareAWS-User-8981142answered 4 years ago"


Question: instance stuck in "stopping" state

"This morning (12-22) our instance become unreachable. We tried a reboot, but this did not fix. When we tried to stop the instance we are now stuck in the "Stopping" state.  We have tried to "Force stop" the instance but it is still not working/in the "Stopping" state.Can we please get someone to look it over and assist?Instance ID: i-ab2a4d56Thank you,TheTurkFollowComment"

Answer: 0Accepted AnswerThere seems to be a power issue effecting connectivity to EC2 instances within USE1-AZ4.The issue should has been resolved by now and your instance(s) should now be able to be stopped.CommentShareJason_Sanswered a year ago0https://status.aws.amazon.com/CommentShareEXPERTkentradanswered a year ago


Question: How to pass a SecureString parameter to a command in State Manager association

"I created a SecureString parameter in AWS Systems Manager Parameter Store. It uses the default KMS key for encryption/decryption. I also created an association in State Manager to run "AWS-RunPowerShellScript" using the command "Net.exe user administrator {{ssh:<name of my parameter>}}" to have State Manager update the password across all of my associated Windows EC2 instances. However, the update only works when I reference a String parameter but does NOT work when I reference a SecureString parameter.Any ideas why I can't reference a SecureString parameter? How do I reference a SecureString parameter in this State Manager association?FollowComment"

Answer: "1Accepted Answerhttps://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-param-runcommand.htmlSSM documents don't support references to SecureString parameters. This means that to use SecureString parameters with, for example, Run Command, you have to retrieve the parameter value before passing it to Run Command.CommentShareMaciej Malekanswered 5 months ago"


Question: Connecting a bot to a Lambda

"Fairly new to Lex bots and Lambda so please forgive my utter lack of understandingI'm following this blog https://aws.amazon.com/blogs/contact-center/updating-your-addresses-with-amazon-connect-and-amazon-lex/ and built out a lex bot along with the lambda, but what isnt clear to me is how i connect the bot up to the lambdaI've managed to publish it and link up the bot alias to the lambda alias, i can see it gets called but the responses i get in the bot dont align with what they should be.eg:me: Update Addressbot: Intent UpdateAddress is fulfilledme: 90210 (this flows through to the zipcode slot)bot: Intent UpdateAddress is fulfilledIs this all because i used a v2 bot? and if so, what changes do i need to make to make it work?FollowComment"

Answer: "0If you're not being prompted for the slot value when you provide an utterance of 'Update Address', I suspect it's because you haven't marked the slot as 'Required for this intent' (under the slot configuration in the Lex UI). The 'Intent <intent-name> is fulfilled' message means that the bot has completed its processing for that intent.To learn more about Lex v2 I'd suggest looking at the workshop at https://catalog.us-east-1.prod.workshops.aws/workshops/94f60d43-15b7-45f4-bbbc-17889ae64ea0/en-USCommentSharelukwarneanswered 5 months agodcarbonetti 5 months agoHi Luke, The slot is required but yeah the lambda is coded for a V1 bot so it doesn't know what to do. will keep diggingSharelukwarne 5 months agoAh, gotcha. The input & response formats are different between Lex v1 and v2, so the Lambda needs to be modified to handle the different formats.Lex v1: https://docs.aws.amazon.com/lex/latest/dg/lambda-input-response-format.htmlLex v2: https://docs.aws.amazon.com/lexv2/latest/dg/lambda.html#lambda-input-formatSharedcarbonetti 5 months agothanks for the workshop, I think Ive got the bot interacting with the lambda now but when it should be reading out the balance i get "Invalid Bot Configuration: Access denied while invoking lambda function arn:aws:lambda:ap-southeast-2:XXXXXXXXXXXX:function:SDP-Goldie-Bot from arn:aws:lex:ap-southeast-2:XXXXXXXXXXXX:bot-alias/F5912H9GI0/TSTALIASID. Please check the policy on this function." - ive tried recreating the lambda and repointing it, along with a few attempts at adding policies to no avail. any thoughts?Share0To verify if it is a v1 versus v2 issue at the Lambda level, just create a v1 bot and test it out.  As mentioned, Lambda written for v1 (which is what this blog post did) does not work for Lex v2.I suggest you start with this workshop https://catalog.us-east-1.prod.workshops.aws/workshops/638d00f5-2248-488f-b7ca-903e8b966bf8/en-US  that uses Lex v2 as an example with Amazon ConnectCommentShareClarenceChoianswered 5 months ago"


Question: Thing won't get shadow update from sensor

"I have repo code that I'm working with at my company as part of my inernship. When I upload my sketch on arduino I don't seem to have any issues other than my shadow if never updated on AWS. I'm fairly new to all of this so to say I'm lost is an understatement. Can anyone please review what I have and see if they can spot where my issue is? I would really appreciate it.#include <EEPROM.h>#include <time.h>#include "adp5350.h"#include "certs.h"#include <WiFiClientSecure.h>#include <MQTTClient.h>#include "ESPAsyncWebServer.h"#include <ESPmDNS.h>#include <Arduino.h>#include <Adafruit_BME280.h>// This include is for the AWS IOT library that we installed// This include is for Wifi functionality#include <WiFi.h>#define AWS_IOT_PUBLISH_TOPIC   "esp32/pub"#define AWS_IOT_SUBSCRIBE_TOPIC "esp32/sub"// Wifi credentialschar WIFI_SSID[]="CO2-Secure";char WIFI_PASSWORD[]="K33pM3S3cUR3Plz";const char AWS_IOT_ENDPOINT[] = "a1qphq4dovfqf6-ats.iot.us-east-1.amazonaws.com"// Connection status;int status = WL_IDLE_STATUS;// Payload array to store thing shadow JSON documentchar payload[512];// Counter for iterationint counter = 0;// Definitions for BME280#define BME_SCL 4#define BME_SDA 19TwoWire I2CBME = TwoWire(0);Adafruit_BME280 bme;// Definition for ADP5350 PMICADP5350 adp;// Definitions for how long the process will sleep#define uS_TO_S_FACTOR 1000000ULL  /* Conversion factor for micro seconds to seconds /#define TIME_TO_SLEEP  30 * 60        / Time ESP32 will go to sleep (in seconds) */#define WAKEUP_PIN 35// Definition for the ready pin and its interrupt routinestruct READY_PIN {const uint8_t PIN;bool pressed;};READY_PIN ready_pin = { 16, false };void IRAM_ATTR isr() {ready_pin.pressed = true;}void IRAM_ATTR wakeup_isr() {Serial.println("wakeup pin pressed");}int startTimeMicros;int endTimeMicros;// The name of the device. This MUST match up with the name defined in the AWS console#define DEVICE_NAME "co2-sensor"// The MQTTT endpoint for the device (unique for each AWS account but shared amongst devices within the account)#define AWS_IOT_ENDPOINT "a1qphq4dovfqf6-ats.iot.us-east-1.amazonaws.com"  //"a1qphq4dovfqf6-ats.iot.us-east-2.amazonaws.com"// The MQTT topic that this device should publish to#define AWS_IOT_TOPIC "$aws/things/co2-sensor/shadow/name/NewCO2Shadow/get"//#define AWS_IOT_TOPIC "my/topic"// How many times we should attempt to connect to AWS#define AWS_MAX_RECONNECT_TRIES 50WiFiClientSecure net = WiFiClientSecure();MQTTClient client = MQTTClient(512);hw_timer_t * timer = NULL;portMUX_TYPE timerMux = portMUX_INITIALIZER_UNLOCKED;AsyncWebServer server(80);bool sleepFlag = false;void IRAM_ATTR timerExpired() {//portENTER_CRITICAL_ISR(&timerMux);Serial.println("Timer Expired");detachInterrupt(digitalPinToInterrupt(35));sleepFlag = true;//portEXIT_CRITICAL_ISR(&timerMux);}// Getting CO2 from Blinkint getco2() {ready_pin.pressed = false;adp.enableLDO(2, 1);int timeout = 0;while (ready_pin.pressed == false) {delay(1);timeout++;if (timeout > 5000) {Serial.println("nready timed out at 5 sec");adp.enableLDO(2, 0);return 0;}}Serial2.flush();Serial2.print('Z', 1);timeout = 0;while (Serial2.available() <= 0) {delay(1);timeout++;if (timeout > 3000) {Serial.println("timed out");adp.enableLDO(2, 0);return 0;}}byte co2array[Serial2.available()];int i = 0;while (Serial2.peek() != -1) {co2array[i] = Serial2.read();i++;}if (sizeof(co2array) < 3) {Serial.println("response is incomplete");adp.enableLDO(2, 0);return 0;}if (co2array[2] != 0x55) {Serial.println("response is not reliable");adp.enableLDO(2, 0);return 0;}int co2 = (co2array[0] << 8) | co2array[1];digitalWrite(15, HIGH);ready_pin.pressed = false;adp.enableLDO(2, 0);return co2;}void connectToAWS(){// Configure WiFiClientSecure to use the AWS certificates we generatednet.setCACert(AWS_CERT_CA);net.setCertificate(AWS_CERT_CRT);net.setPrivateKey(AWS_CERT_PRIVATE);// Connect to the MQTT broker on the AWS endpoint we defined earlierclient.begin(AWS_IOT_ENDPOINT, 8883, net);// Try to connect to AWS and count how many times we retried.int retries = 0;Serial.print("Connecting to AWS IOT");while (!client.connect(DEVICE_NAME) && retries < AWS_MAX_RECONNECT_TRIES) {Serial.print(".");delay(100);retries++;}// Make sure that we did indeed successfully connect to the MQTT broker// If not we just end the function and wait for the next loop.if(!client.connected()){Serial.println(" Timeout!");return;}// If we land here, we have successfully connected to AWS!// And we can subscribe to topics and send messages.Serial.println("Connected!");}// Go to sleep routinevoid goToSleep() {//Deep SleepWiFi.disconnect(true);Serial.println("Going to sleep now");Serial.flush();//Get the processing time and subtract it from the sleep time so we can try and data log at more exact intervalsendTimeMicros = micros();esp_sleep_enable_timer_wakeup(TIME_TO_SLEEP * uS_TO_S_FACTOR - (endTimeMicros - startTimeMicros));esp_sleep_enable_ext0_wakeup(GPIO_NUM_35, 0);esp_deep_sleep_start();}void updateShadow() {// Connecting to AWSconnectToAWS();Serial.println("Sending data...");// Turning on the LEDdigitalWrite(18, HIGH);// Getting valuesfloat temperature = bme.readTemperature();float humidity = bme.readHumidity();float pressure = bme.readPressure();int co2 = getco2();uint16_t battery = adp.batteryVoltage();// We want to make sure we're getting a CO2 Valueif (co2 == 0) {adp.enableLDO(2,0);delay(3000);return;}char rule_payload[512];time_t now = time(nullptr);time_t delete_time = now + (5 * 24 * 60 * 60);sprintf(rule_payload, "{"state":{"reported":{"co2":" %d ", "temperature":" %f ", "humidity":" %f ", "pressure":" %f ", "battery":" %d ", "name":" co2-sensor ", "timestamp":" %d ", "ttl": " %d " }}}",co2,temperature,humidity,pressure,battery,now,delete_time);Serial.println(rule_payload);int err = client.publish(AWS_IOT_TOPIC, rule_payload);if (err == 0) {Serial.println("publish success");} else {Serial.println("publish fail");Serial.print(err);Serial.println("");}digitalWrite(18, LOW);goToSleep();}void enableSleepTimer() {Serial.println("Enabling Timer");timer = timerBegin(0,80,true);timerAttachInterrupt(timer, &timerExpired, true);timerAlarmWrite(timer, 30000000, true);timerAlarmEnable(timer);}void disableSleepTimer() {Serial.println("Disabling Timer");timerAlarmDisable(timer);timerDetachInterrupt(timer);timerEnd(timer);}void enterServerMode() {Serial.println("Entering Server Mode for Measurements and Calibration");if (!MDNS.begin("esp32")) {Serial.println("Error setting up MDNS responder!");goToSleep();}enableSleepTimer();disableCore0WDT();disableCore1WDT();disableLoopWDT();server.on("/values/co2", HTTP_GET, [](AsyncWebServerRequest *request) {Serial.println("Getting CO2");disableSleepTimer();enableSleepTimer();digitalWrite(18, HIGH);adp.enableLDO(2,0);int co2 = getco2();adp.enableLDO(2,0);char payload[512];time_t now = time(nullptr);sprintf(payload, "{"co2":" %d ", "timestamp":" %d " }",co2,now);Serial.println(payload);request->send(200, "text/plain", payload);digitalWrite(18, LOW);});server.on("/values/temperature", HTTP_GET   , [](AsyncWebServerRequest *request){Serial.println("Getting Temperature");disableSleepTimer();enableSleepTimer();digitalWrite(18, HIGH);float temperature = bme.readTemperature();char payload[512];time_t now = time(nullptr);sprintf(payload, "{"temperature":" %f ", "timestamp":" %d " }",temperature,now);Serial.println(payload);request->send(200, "text/plain", payload);digitalWrite(18, LOW);});server.on("/values/humidity", HTTP_GET, [](AsyncWebServerRequest *request){Serial.println("Getting Humidity");disableSleepTimer();enableSleepTimer();digitalWrite(18, HIGH);float humidity = bme.readHumidity();char payload[512];time_t now = time(nullptr);sprintf(payload, "{"humidity":" %f ", "timestamp":" %d " }",humidity,now);Serial.println(payload);request->send(200, "text/plain", payload);digitalWrite(18, LOW);});server.on("/values/pressure", HTTP_GET, [](AsyncWebServerRequest *request){Serial.println("Getting Pressure");disableSleepTimer();enableSleepTimer();digitalWrite(18, HIGH);float pressure = bme.readPressure();char payload[512];time_t now = time(nullptr);sprintf(payload, "{"pressure":" %f ", "timestamp":" %d " }",pressure,now);Serial.println(payload);request->send(200, "text/plain", payload);digitalWrite(18, LOW);});server.on("/values/battery", HTTP_GET, [](AsyncWebServerRequest *request){Serial.println("Getting Battery");disableSleepTimer();enableSleepTimer();digitalWrite(18, HIGH);uint16_t battery = adp.batteryVoltage();char payload[512];time_t now = time(nullptr);sprintf(payload, "{"battery":" %d ", "timestamp":" %d " }",battery,now);Serial.println(payload);request->send(200, "text/plain", payload);digitalWrite(18, LOW);});server.on("/values/all", HTTP_GET, [](AsyncWebServerRequest *request){Serial.println("Getting All");disableSleepTimer();enableSleepTimer();digitalWrite(18, HIGH);int co2 = getco2();float temperature = bme.readTemperature();float humidity = bme.readHumidity();float pressure = bme.readPressure();uint16_t battery = adp.batteryVoltage();char payload[512];time_t now = time(nullptr);sprintf(payload, "{"co2":" %d ", "temperature":" %f ", "humidity":" %f ", "pressure":" %f ", "timestamp":" %d ", "battery":" %d "  }",co2,temperature,humidity,pressure,now,battery);Serial.println(payload);request->send(200, "text/plain", payload);digitalWrite(18, LOW);});server.on("/values/calibrate", HTTP_GET, [](AsyncWebServerRequest *request) {Serial.println("Calibrating to Target");disableSleepTimer();enableSleepTimer();digitalWrite(18, HIGH);const char * calibrationPoint = request->getParam("cal")->value().c_str();adp.enableLDO(2,1);int timeout = 0;while (ready_pin.pressed == false) {delay(1);timeout++;if (timeout > 5000) {Serial.println("nready timed out at 5 sec");adp.enableLDO(2, 0);return 0;}}Serial2.print('Z',1);delay(100);if (Serial2.available() > 0) {byte co2[Serial2.available()];Serial2.readBytes(co2, Serial2.available());}delay(100);char * cal_command = (char *)malloc(16);sprintf(cal_command, "X %s\r\n", calibrationPoint);Serial.print(cal_command);Serial2.print(cal_command);delay(100);if (Serial2.available() > 0) {byte cal_ret[Serial2.available()];Serial2.readBytes(cal_ret, Serial2.available());}adp.enableLDO(2,0);digitalWrite(18, LOW);});server.on("/values/zero", HTTP_GET, [](AsyncWebServerRequest *request) {Serial.println("Zero Calibrating");disableSleepTimer();enableSleepTimer();digitalWrite(18, HIGH);adp.enableLDO(2,1);int timeout = 0;while (ready_pin.pressed == false) {delay(1);timeout++;if (timeout > 5000) {Serial.println("nready timed out at 5 sec");adp.enableLDO(2, 0);return 0;}}Serial2.print('Z',1);delay(100);if (Serial2.available() > 0) {byte co2[Serial2.available()];Serial2.readBytes(co2, Serial2.available());}delay(100);Serial2.print("U\r\n");delay(100);if (Serial2.available() > 0) {byte cal_ret[Serial2.available()];Serial2.readBytes(cal_ret, Serial2.available());}adp.enableLDO(2,0);digitalWrite(18, LOW);});server.on("/values/ambient", HTTP_GET, [](AsyncWebServerRequest *request) {Serial.println("Ambient Calibrating");disableSleepTimer();enableSleepTimer();digitalWrite(18, HIGH);adp.enableLDO(2,1);int timeout = 0;while (ready_pin.pressed == false) {delay(1);timeout++;if (timeout > 5000) {Serial.println("nready timed out at 5 sec");adp.enableLDO(2, 0);return 0;}}Serial2.print('Z',1);delay(100);if (Serial2.available() > 0) {byte co2[Serial2.available()];Serial2.readBytes(co2, Serial2.available());}delay(100);Serial2.print("G\r\n");delay(100);if (Serial2.available() > 0) {byte cal_ret[Serial2.available()];Serial2.readBytes(cal_ret, Serial2.available());}adp.enableLDO(2,0);digitalWrite(18, LOW);});server.begin();MDNS.addService("co2sensor", "_tcp", 80);}void setup() {// put your setup code here, to run once:// Since we're using WiFi, we need to turn on the second LDO for extra currentadp.enableLDO(3, 1);adp.setCharger(1);adp.enableFuelGauge(1);startTimeMicros = micros();delay(1000);// Reducing the CPU Frequency is better for power consumption, helping to extend battery lifesetCpuFrequencyMhz(80);// Serial for debuggingSerial.begin(115200);Serial.println("starting aws iot application");// Weird bug with Arduino Library, need to disconnect from WiFi before attempting to connectWiFi.disconnect(true);// initialise WiFi connectionint attempts = 0;while (status != WL_CONNECTED) {// After 5 failed attempts of trying to connect to the WiFI just go to sleep to conserve batteryif (attempts > 5) {goToSleep();}Serial.print("Attempting to connect to Wifi network: ");status = WiFi.begin(WIFI_SSID, WIFI_PASSWORD);delay(5000);}Serial.println("Connected to Wifi!");Serial.print("IP address: ");Serial.println(WiFi.localIP());// Getting the current time in GMTconfigTime(3 * 3600, 0, "pool.ntp.org", "time.nist.gov");while (!time(nullptr)) {delay(1000);}// Setting up the LEDpinMode(18, OUTPUT);digitalWrite(18, LOW);// Enable Charging and Fuel Gauge so we can see how much battery is leftadp.setCharger(1);adp.enableFuelGauge(1);// Turn off the LDO to the sensor as a precautionary measure to make sure we are able to readadp.enableLDO(2, 0);// Setting uFollowCommentGreg_B EXPERT4 months agoCould you please take the time to format your code. It may also be useful to post the serial terminal output.Share"


Question: Workmail + Mautic

"I'm trying to set up Mautic with my WorkMail.All the connection is good (SMTP, IMAP), but when I send a Test Mail I receive this email in my inbox in the workmail"Unfortunately, the system was unable to deliver your mail.The error given was:2023-03-21 08:58:33 : You are not allowed to send as user or group info+bounce@domain.comYou may need to contact your e-mail administrator to solve this problem."What could it be?FollowComment"

Answer: "0Hi,The error you received is telling you that you're using a email address in the from that you do now own or have permissions to use. You can fix this by giving your user this email address or removing the +bounce part from the email. You will need to make the email address your tool uses your primary email address as SMTP does not support sending from aliases.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 2 months ago"


Question: i-09de46aabfa67aba6 - Stuck in Pending

"I have been having an issue  for the last couple of months where this server gets stuck in Pending when requested to start.  This morning I terminated the old instance and created a new one, but I'm seeing the same issue.  Can someone please assist?FollowComment"

Answer: "0Have you tried the EC2 Serial Console to diagnose?Released in Mar-2021, for Windows & Linux Nitro instances. It's a way to troubleshoot boot and network connectivity issues by establishing a connection to the serial port of an instance. It provides a one-click, text-based access to an instances’ serial port as though a monitor and keyboard were attached to it. The serial console does not require your instance to have any networking capabilities. The serial console session lasts during instance reboot and stop.  Accessed from EC2 console or from CLI.CommentShareEXPERTskinsmananswered 4 months ago"


Question: NLB IP preservation over peering target group

"Dear Experts,is this supported options by AWS  to preserve source IP addresses over peering target group? can you please also talk about couple of use cases for IP preservation. In my understanding, one of the use case is simple audit purpose and another one can be direct server return but i do not think if DSR is supported by AWS.Appreciate all your help.FollowComment"

Answer: "1Currently Client IP preservation is only supported when NLB and targets are in the same VPC, not for targets in peered VPC or on-premises.There is no DSR as you correctly mentioned, the AWS SDN handles the connection in such a way that the Client IP is preserved and traffic is still (symmetrically) routed via NLB."When client IP preservation is enabled, targets must be in the same VPC as the Network Load Balancer, and traffic must flow directly from the Network Load Balancer to the target."Reference: https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#client-ip-preservationCommentShareEXPERTTushar_Janswered 10 months agorePost-User-1687975 10 months agoFirst of all thanks for responding, let me explain you in detail about the lab i was trying to build and my observation.1- LB and target group in same VPC, target are configured with IP address. IP preservation is not on by default but once turn on i can see client IP's making connections from internet.2- Target IP moved over peering VPC,  health check comes green, with IP preservation which is still on it breaks application.3- In 2nd option with default setting when proxy and IP preservation off application works, I see connections coming from private IP of LB.4- In 2nd option when only proxy protocol on, application still works and LB IP is visible in connection.My question is target IP's can be anywhere in same VPC, on-Prem, over peered connection  hence technically this combination fails with IP preservation options (only same VPC host will respond). Even after enabling proxy protocol i do not see connection make from public IP address, that's expected also else that may break routing for return traffic. I was just wondering about use cases works in production.ShareTushar_J EXPERT10 months agoThank you for the additional explanation. You are correct see this note "When client IP preservation is enabled, targets must be in the same VPC as the Network Load Balancer, and traffic must flow directly from the Network Load Balancer to the target." from this link: https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#client-ip-preservationSharerePost-User-1687975 10 months agoEven this point make me bit confused, For example NLB and target host both are part of same VPC, client 1.1.1.1 request to LB 2.2.2.2 when client see request coming from 1.1.1.1 and try to respond back, it will use PIP 3.3.3.3, hence technically application should fail until it goes from LB using same IP 2.22.2 with some NAT functionality.ShareTushar_J EXPERT10 months agoI edited the answer. Thanks for the clarifications.Share"


Question: SES's suppression list misses many bounces that otherwise get emailed to me via Email Feedback Forwarding. Do I need to worry about these? It would be nice if there was an option to catch these extras

"I noticed that Amazon SES's suppression list misses many bounces that otherwise get emailed to me via SES -> Verified identities -> notifications -> Email feedback forwarding. For example, I get 30 email notifications, but only 20 emails get added to the suppression list.Do I need to worry about these extra "missed bounces"? I'm saving the email notifications from them for now. Is there some way for me to process those into a block list?Also, contrary to google's bounce notification emails, SES's give very little detail about why the email bounced.Amazon's docs aren't very good and don't mention soft bounces https://docs.aws.amazon.com/ses/latest/dg/lists-and-subscriptions.html#3-suppression-overview, so I'm wondering if soft bounces are excluded from the suppression list. If so, it would be nice to have an option to include them.FollowComment"

Answer: "0Soft bounces are temporary, they can be resolved by attempting to re-deliver the mail after a delay.  An example might be a full mailbox, the user may empty the mailbox and then the bounce will go away. (https://aws.amazon.com/premiumsupport/knowledge-center/ses-understand-soft-bounces/)Hard bounces are permanent and should be suppressed, they should not be re-attempted.Assuming the "missed bounces" are soft, it should be fine.  I don't believe soft bounces can be included in suppression lists automatically today.CommentShareEXPERTChris_Ganswered 6 months ago0Thanks Chris. Is the "send feedback" option on the "suppression list" page the best way for me to request that soft bounces be optionally included?If I am using a webhook to report bounces to a 3rd party client (IE https://docs.mautic.org/en/channels/emails/bounce-management#amazon-webhook), soft bounces won't be recorded there either?Also, I think I verified that the issue is not simply soft bounces being excluded. Here's some examples of emails that should be hard bounces that are not getting included:jsjsjs@icooud.comexample@ufl.edi (should be .edu).UPDATE: I confirmed that when using a webhook, SES will send all the "extra" bounces there. So example@ufl.edi gets blocked by my 3rd party app, but doesn't get registered on SES's suppression list. Same for soft bounces.Basically, SES reports soft bounces & domain errors via email notifications and webhooks, but only logs hard bounces on their suppression list.CommentShareUser-2125294answered 6 months ago"


Question: Site to Site IPSec VPN to multiple on-prem firewalls

"I was told that to establish the above IPSec VPN over Internet, the AWS firewall can't achieve the above, and will require to buy some NGNBN on the marketplace to establish the IPSec VPN.Is that true?FollowComment"

Answer: "1Not sure exactly what you are trying to achieve, but here are some example architecture that may be of use: https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-redundant-connection.htmlhttps://docs.aws.amazon.com/vpn/latest/s2svpn/your-cgw.htmlCommentSharePaul_Canswered a year ago1It would be good to know why you want to establish multiple VPN sessions. It could be for redundancy; or you might want to do it to connect to multiple different locations/offices.In either case, the site-to-site VPN service only supports connecting to a single "location". Each connection can have two customer-side endpoints (so you can use two firewalls for redundancy) but the destination (from a network perspective) for both tunnels must be the same - you can't use one tunnel to connect to office A and another to connect to office B.If you do have multiple destinations/locations/offices then you will need to create multiple connections in the site-to-site VPN service - this is totally supported. In that case they would all need to have unique network ranges that you are routing to - but that would generally be the case anyway.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: aws data provider for sap

"We have S/4 HANA on AWS1.) Is AWS Data provider for SAP required only for production environment and optional for dev and quality2.) Is AWS data provider required to be installed on only HANA DB and application server and optional for components like SAP conductor, web dispatcher3.) Estimated pricing per EC2 instance per month for instance with only one EBS attachedThanks in advanceFollowComment"

Answer: "1Hello,AWS Data provider is a prerequisite from support perspective to ensure that utilization and configuration information from the underlying AWS infrastructure is available for the analysis of SAP support teams. Any environment (production or non-production) where SAP support/analysis needed, should have AWS data provider installed. But, because AWS Data provider needs detailed monitoring and may involve additional cost, it is not uncommon to enable the AWS Data Provider in non-production landscapes only when SAP support and analysis are required.Every Amazon EC2 instance that hosts SAP software must have AWS data provider installed. (Refer SAP note-1656250) But due to the additional cost involved, please consider the information provided above in point #1.I'm assuming you are looking for pricing when AWS Data Provider is installed. The additional cost would be due to enabling CloudWatchdetailed monitoring. Pricing information for CloudWatch can be found here - https://aws.amazon.com/cloudwatch/pricing/ . You can use AWS Pricing Calculator (https://calculator.aws/#/) to check the pricing based on your requirement.Let us know if you have any additional clarifications. Thanks.Regards,Venkat.CommentShareVenkat Tatavarthyanswered 8 months agoAWS-User-8898010 8 months agoHi Venkat,  thanks for the explanation.1.) Can you suggest from your experience how many metrics should be considered for detailed monitoring per EC22.) Indirect cost associated with AWS data provider looks very high 21 USD, link below,  per EC2.  Is there a may we can reduce ithttps://docs.aws.amazon.com/sap/latest/general/data-provider-intro.htmlShareEneko 8 months agoHi AWS-User-8898010 -> in regards to your comment questions:The number of metrics is dependent on how many volumes attached to the instance. Number of metrics will be 3 + (8*(EBS Volume Count)). So in your example with a single volume this will be 11 detailed metrics (3+ (8*1)).  These metrics (11) will be called once a minute by the Data Provider or approximately 475,200 times per month (11 * 60minutes * 24hours * 30days).For your example the approximate cost is $8 per month. See this estimate here: https://calculator.aws/#/estimate?id=3ffe7a1d6b76dac8074b20b25fa6b98ac4c5fdc1. You cannot configure the # of detailed metrics used by the SAP Data Provider as these are required by SAP support and are fixed. If you are concerned about this cost, you can consider turning off CloudWatch detailed monitoring with the caveats on lack of SAP support explained above.Share1***Updated 14/10/22 *** to clearly outline that the Data Provider is required for SAP Support on AWS.As context for the answers below: "The AWS Data Provider for SAP is an agent which collects performance-related metrics from AWS services and provides them to the SAP internal application monitoring system." Source: The SAP Lens for Well-Architected - Best Practice 1.1 – Implement prerequisites for monitoring SAP on AWSIf you do not have the Data Provider installed, the SAP application (e.g. S/4HANA) is not receiving the correct AWS metrics for performance monitoring (e.g. CPU, memory usage, network, others etc.). This can mean that if you open a case for support with SAP, and they require this information to resolve the case, then they cannot provide support until you set it up (thus the requirement for the Data Provider in SAP note 1656250 -  SAP on AWS: Support prerequisites).Answers:No, the data provider is required for all SAP environments for SAP Support. If you choose to not use it or temporarily suspend it in Non-Production systems then you may have problems with SAP Support.The Data Provider is only required for SAP Netweaver-based environments for the reasons given above. From the SAP Lens: "The AWS Data Provider for SAP is a required installation on each of your EC2 instances supporting SAP NetWeaver workloads."The exact price is dependent on your specific architecture and set-up. General guidance is provided here: SAP on AWS Data Provider - Pricing and states "approximately from $20.00 to $40.00 per month per system."NOTE: This answer is provided by the SAP on AWS specialty team and is accurate at the time of publish. Please check comments as the answer may have changed/services evolved.CommentShareEnekoanswered 8 months ago"


Question: Kinesis data Firehose Data Transformation and Compression

"Hi all,We are working on a solution based on CloudWatch Logs Destinations and Kinesis Firehose to be able to centralize CloudWatch Logs coming from multiple Application Accounts inside our Organization  in a Centralized Log Account as shown in the attached image below and described also here :We are using a Lambda function triggered by the Firehose Stream for Data Transformation before sending data to the final destination S3 Bucket.The Lambda should unzip the recieved data, process it and send it back to the Firehose Stream "Based on Firehose Lambda Blueprint"Everything is working as expected, except for the Kinesis Firehose Compression,On the Firehose Destination Settings, We've already enabled Compression of data records in GZIP format but what we are recieving on the S3 Bucket are uncompressed files with .gz extension !!any idea on how to resolve this issue ?should the Lambda compress the data records after processing them and before sending them back to the Firehose Stream and how ?Thanks in advanceFollowComment"

Answer: "0Accepted AnswerI managed to figure out what wase the issue,Kinesis Firehose while writing objects to S3, it adds a key/value pair, "Content-Encoding=gzip” to the metadata of the objects.When we request to download the object from S3 on a browser(UI), this key/value is added to the response header which causes the browser to automatically decompress the object. Latest browsers come with this built-in feature to decompress such files upon download.Hence, the files stored in the S3 bucket are in correct format with compressed values but when we download it, browser automatically decompresses it and it is an expected behaviour for Kinesis Firehose delivery to S3 with GZIP compression enabled.CommentSharePeter Eskandaranswered 3 months ago"


Question: SPF misalignment

"Using SES for email. SPF records in domain DNS include amazonses.com. However the IP that SES uses to send email is not included in the amazonses.com. Amazonses includes199.255.192.0/22199.127.232.0/2254.240.0.0/1869.169.224.0/2023.249.208.0/2023.251.224.0/1976.223.176.0/2054.240.64.0/1954.240.96.0/1952.82.172.0/22however mails are sent from:54.240.7.42 and54.240.7.44 and54.240.7.48resulting in SPF failures.Unfortunately many providers use strong spam filters and reject, even with DKIM pass.Can AWS update the include file?FollowComment"

Answer: 054.240.7.4254.240.7.4454.240.7.48These IPs are covered under 54.240.0.0/18 (highlighted below).  Can you share any of the SPF errors you're seeing and which providers are seeing the errors?amazonses.com descriptive text "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ip4:69.169.224.0/20 ip4:23.249.208.0/20 ip4:23.251.224.0/19 ip4:76.223.176.0/20 ip4:54.240.64.0/19 ip4:54.240.96.0/19 ip4:52.82.172.0/22 -all"CommentShareEXPERTChris_Ganswered a year agoJohan a year agoBoth Microsoft and Google (the only ones who send me DMARC reports) are reporting SPF Fail.Share


Question: [1.9.0.1] No classes could be found that derive from "InputSubComponent"?

"Don't know why I am getting this but I am trying to get input working and everytime I hit the "+" on the Event Generators, it pops up with that error.Tutorials don't really go into detail on HOW to set up input from scratch except to just load one that is already created.Any information on the proper way to get input up and running?EDIT: Ok, retract my statement that the tuts dont go into detail. This does go into detail but I am not getting the "Class to create" prompt.Follow"

Answer: "0Accepted AnswerHey @REDACTEDUSERREMOVEDUPLOADSharerePost-User-5738838answered 6 years ago0Nope, fresh start of the editor to hitting the "+" on the event generator causes the error above.Edit:Should also note that clicking the game controller icon to create a new input bindings doesnt create a new input binding file, or even prompt to create a new one, and the input bindings editor, when provided an input bindings file, doesnt save the file.SharerePost-User-8564951answered 6 years ago0Yep, that was it.Thank you.SharerePost-User-8564951answered 6 years ago0@REDACTEDUSERREMOVEDUPLOADOnce the Gem is enabled, "Input" should be the only option.SharerePost-User-3220036answered 6 years ago"


Question: Ghost integration with s3 is not working

"I'm using ghost-s3-adapter for the integration of s3 and ghost, below is the code snippet of config.develpoment.json  "storage": {  "active": "s3",  "s3": {    "accessKeyId": "your key",    "secretAccessKey": "secretAccessKey",    "region": "location",    "bucket": "bucket name",    "acl":"private"  }}and my bucket policy is{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Principal": "*",            "Action": "s3:ListBucket",            "Resource": "arn:aws:s3:::bucket-name"        },        {            "Sid": "VisualEditor1",            "Effect": "Allow",            "Principal": "*",            "Action": [                "s3:PutObject",                "s3:GetObject",                "s3:PutObjectVersionAcl",                "s3:DeleteObject",                "s3:PutObjectAcl"            ],            "Resource": "arn:aws:s3:::bucket-name/*"        }    ]}Object is properly stored in the s3 bucket but when I need to get it gives me 403 forbidden errorCan Anyone helps me with the sameFollowComment"

Answer: 0Make sure that the role or principal that you are using to read the objects from S3 has a policy that contains s3:GetObject.I would recommend that you don't use bucket policies. They make this much harder. Prefer to use only IAM.Please read the following documentation S3 access managementCommentShareYair Carelanswered 5 months ago


Question: Cloudformation Tags for ECS resources

"I see that I can create tags in the AWS web console for my ECS resources: Cluster, Service and Task Definition, but I can't create them through Cloudformation.When this feature will be enabled in Cloudformation?AWS::ECS::Cluster https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-cluster.htmlAWS::ECS::Service https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-service.htmlAWS::ECS::TaskDefinition https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.htmlFollowComment"

Answer: "0Thank you for your feedback.Our ECS, Fargate Teams are working with CloudFormation team to get this feature out. As soon as it gets released, it should be publicly announced in either one of the following links:-- AWS blogs: https://aws.amazon.com/blogs/aws/-- Whats New: http://aws.amazon.com/new/For better tracking of this features with timelines, kindly refer the following links:https://github.com/aws/containers-roadmap/projects/1https://github.com/aws/containers-roadmap/issues/93CommentShareAshwin Ramanswered 4 years ago"


Question: Change name of server after adding it in application migration service

I did a test before actual moving production server vm from on prem to aws. Everything went well. Our servers have DNS entries and joined to AD. Now after decommissioning the on prem server I can't connect to aws server too because helpdesk team removed entries from DNS and AD. These both servers had same name. Our environment restricts us about connecting with IP. We can only connect with name.I was thinking of changing names after adding source server if that is possible? Or if there are any other solutions available to do?FollowComment

Answer: "0It is possible to change the name of a server after it has been added to the Application Migration Service in AWS, but it can be a bit complicated and requires some additional steps.Here's what you can do:Stop the replication job for the server that you want to rename in the Application Migration Service.Create a new server in the Application Migration Service with the desired name.Restart the replication job for the new server.Once the new server is fully replicated and running in AWS, you can decommission the old server.Update any necessary DNS entries or other references to the server with the new name.Note that changing the name of a server can also have implications for any applications or services that rely on the server's name, so be sure to thoroughly test and validate any changes before making them in a production environment.Another potential solution could be to use a DNS alias or CNAME record to point to the new server with the updated name, instead of changing the name of the server itself. This may be a simpler solution, especially if there are other applications or services that rely on the original server name.CommentSharehashanswered a month ago"


Question: Existing FARGATE_SPOT provider cannot provide Fargate platform upgr. to 1.4

"Hi there,Thank you for the new version of Fargate platform, 1.4. It brings EFS integration, which is tremendously helpful for cloud-ish applications. This will relieve our EC2 management.We are now doing upgrade tests in our clusters and services. Below is the explanation of what's happening:Existing cluster has an EC2 AutoScaling capacity provider and a FARGATE_SPOT provider. There is a Fargate service that uses the Fargate platform LATEST, which is still 1.3. We updated the service to use 1.4 explicitly. Service says, "Capacity is unavailable at this time. Please try again later or in a different availability zone.".We see similar behaviors in various places of ECS, where you cannot really update some of the features once you create them. I suspect the capacity provider was fixed to version 1.3 when it was created and cannot provide 1.4 anymore. We see the same situation even if we create a service from scratch with platformVersion 1.4 and FARGATE_SPOT provider.Do you have any guidance?Thank you,OytunFollowComment"

Answer: "0There is no limit with capacity providers and using Fargate Spot with platform version 1.4, what you are seeing is instead that there is relatively little Spot capacity for platform version 1.4 at the moment as we have focused on platform version 1.3 capacity for Fargate Spot, driven by customer demand. You will see this change shortly and can expect increased Spot capacity for platform version 1.4.Also, please do keep in mind that there is inherently no guarantee that Spot capacity will be available for any platform version. If you are running a service it would be appropriate to have a mix of Spot and on-demand capacity configured to ensure you can run tasks for the service.CommentShareMatsanswered 3 years ago"


Question: DynamoDB streams filter with nested fields not working

"I have a Lambda hooked up to my DynamoDB stream. It is configured to trigger if both criteria are met:eventName = "MODIFY"status > 10My filter looks as follows:{"eventName": ["MODIFY"], "dynamodb": {"NewImage": {"status": [{"numeric": [">", 10]}]}}}If the filter is configured to only trigger if the event name is MODIFY it works, however anything more complicated than that does not trigger my Lambda. The event looks as follows:{    "eventID": "ba1cff0bb53fbd7605b7773fdb4320a8",    "eventName": "MODIFY",    "eventVersion": "1.1",    "eventSource": "aws:dynamodb",    "awsRegion": "us-east-1",    "dynamodb":    {        "ApproximateCreationDateTime": 1643637766,        "Keys":        {            "org":            {                "S": "test"            },            "id":            {                "S": "61f7ebff17afad170f98e046"            }        },        "NewImage":        {            "status":            {                "N": "20"            }        }    }}When using the test_event_pattern endpoint it confirms the filter is valid:filter = {    "eventName":  ["MODIFY"],    "dynamodb": {        "NewImage": {            "status":  [ { "numeric": [ ">", 10 ] } ]        }    }}response = client.test_event_pattern(    EventPattern=json.dumps(filter),    Event="{\"id\": \"e00c66cb-fe7a-4fcc-81ad-58eb60f5d96b\", \"eventName\": \"MODIFY\", \"dynamodb\": {\"NewImage\":{\"status\": 20}}, \"detail-type\": \"myDetailType\", \"source\": \"com.mycompany.myapp\", \"account\": \"123456789012\", \"time\": \"2016-01-10T01:29:23Z\", \"region\": \"us-east-1\"}")print(response) >> {'Result': True, 'ResponseMetadata': {'RequestId':...}Is there something that I'm overlooking? Do DynamoDB filters not work on the actual new image?---UPDATE---Still haven't made much progress. I can confirm that the following works:{"dynamodb":{"NewImage":{"status":{"N":["11","12","13","14","15"]}}}}{"dynamodb":{"NewImage":{"status":{"N":["11","12","13","14","15"]},"progress":{"S":["not_done","done"]}}}}proving that you can filter on on nested and multiple fields. However I can't for the life of me get the more advanced filters to work (in any variation from documentation: https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-syntax):{"eventName":["MODIFY"],"dynamodb":{"NewImage":{"status":{"N":[{"numeric":[">",10]}]}}}}{"eventName":["MODIFY"],"dynamodb":{"NewImage":{"status":{"N":{"numeric":[">",10]}}}}}{"eventName":["MODIFY"],"dynamodb":{"NewImage":{"status":{"N":["numeric",">",10]}}}}These do not work.FollowComment"

Answer: "1Before digging into this further, let me confirm one thing:How is your DynamoDB Stream configured, ensure it produces NEW_AND_OLD_IMAGES. DocsCommentShareEXPERTLeeroy Hannigananswered a year agoNicoDL a year agoIt is configured to produce the new image: stream: StreamViewType.NEW_IMAGE. In the meantime I made some progress. I was able to get an exact match on the status field working by using the following filter: {"dynamodb":{"NewImage":{"status":{"N":["20"]}}}}. It seems that the data type needs to be included in the filter and the value needs to be quoted (even though the documentation specifies otherwise). However I can't get more advanced filters to work for the life of me, e.g. (from the documentation):"Price": [ { "numeric": [ ">", 10, "<=", 20 ] } ]Share0Your pattern should look like this:{"eventName": ["MODIFY"], "dynamodb": {"NewImage": {"status": { "N": [{"numeric": [">", 10]}]}}}}Note the "N" which is part of the object.CommentShareEXPERTUrianswered a year agoNicoDL a year agoThat doesn't work sadly so and is one of the countless possibilities I tried. The Lambda shows the following configured pattern:{  "filters": [    {      "pattern": "{\"eventName\": [\"MODIFY\"], \"dynamodb\": {\"NewImage\": {\"status\": { \"N\": [{\"numeric\": [\">\", 10]}]}}}}"    }  ]}but after modifying a record in the database (both by editing inline using the console and updating the record's status by code) the last processing result on the table still states "No records processed", and I can confirm that the Lambda does not trigger.Share0I have had the same problem using dynamodb kinesis stream.Also I had removed the filterCriteria after dealing with this issue, and the events were still filtering. Confirmed there was no filter in place with the cli, and in the console. Seems like some weird behavior from the filterCriteria. I had to delete the entire stack to remove the filter. Interested to see what your outcome is.CommentShareAWS-User-4552343answered a year ago"


Question: Planned Outage - Ubuntu-2 (eu-west-2)

"I am administering a lightsail instance for a client and I received the message below.We have detected a degradation of the underlying hardware hosting your instance: Ubuntu-2 (eu-west-2) in your AWS Account with ID: 123456789. Due to this degradation, we will have to perform necessary maintenance to the underlying hardware. Your instance may already be unreachable. Maintenance activity will result in your Lightsail instance stopping after Mon, 10 May 2021 00:00:00 GMT. After your instance is stopped, you can restart it at any time.I have two instances in eu-west-2 Zones A and C. Will both availability zones go down?How can I avoid an outage?FollowComment"

Answer: "0Accepted AnswerJust stop & start your instance and it will be fine.The warning you got was telling you that the instance would be shutdown ... if you stop & start it yourself, the instance will restart on undegraded hardware.CommentShareDavid Ganswered 2 years ago0Many thanks David.CommentSharelwfukanswered 2 years ago"


Question: SSM Automation Document aws:executeAwsApi - CreateTags does not run inside with SSM Maintenace window

"Hello together,I have a somewhat strange phenomenon with SSM Automation and Maintenance Windows.The Automation Document run under SSM -> Automation -> Execute Automationor direct from the Document it self perfectly.But if the document is scheduled in the SSM "Maintenace Windows" and the targets are definedfor example as a ResourceGroup. Than the function aws:executeAwsApi CreateTags fails with the message:"Step fails when it is Execute/Cancelling action. An error occurred (InvalidParameterValue) when calling the CreateTags operation: Value ( null ) for parameter resourceId is invalid. Null/empty value for resourceId is invalid. "I am guessing that there is a bug in the SSM Windows Maintenace function, and the parameter passing or mapping for aws:executeAwsApi is working incorrect.So here the Code in YAML :description: Start einer EC2 Instanz and set Tag.schemaVersion: '0.3'assumeRole: '{{ AutomationAssumeRole }}'parameters:  TagKey:    type: String    description: Set Tag Name    default: SY-AutoPatch  TagValue:    type: String    description: Value for the Tag    default: '1'  InstanceId:    type: StringList  AutomationAssumeRole:    type: String    description: 'Optional ARN Rolle '    default: ""mainSteps:  - name: CreateTags    action: 'aws:executeAwsApi'    inputs:      Service: EC2      Api: CreateTags      DryRun: false      Resources:        - '{{ InstanceId }}'      Tags:        - Key: '{{ TagKey }}'          Value: '{{ TagValue }}'  - name: startInstances    action: 'aws:changeInstanceState'    inputs:      InstanceIds: '{{ InstanceId }}'      DesiredState: runningFollowComment"


Question: What is the number of deivces in the public device list?

"I found there are around 100 devices in my public device list. However, I am using a free service with basic edition. What if i pay for subscription? Will the public device list become larger or remain the same?FollowComment"

Answer: "0Hi,are you using AWS IoT Core? You have the control how many devices your are creating. There is also no subscription model for AWS IoT Core. You are charged based on usage.Cheers,PhilippCommentSharePhilipp Sanswered 6 months agorePost-User-1198254 6 months agohttps://awsdevicefarm.info/You can find the sample in this link. I mean the public device list.If i can create the device that not in the list, then how to create the device that is not in the public device list?Share0AWS Device Farm is not an AWS IoT service. You can use AWS Device Farm to test your applications on real mobile devices.I just checked the public device list page and it includes 116 devices. There is also an option to use private devices.In case you want to see a device that is not in the public list you can find more information at https://aws.amazon.com/device-farm/device-list/.Cheers,PhilippCommentSharePhilipp Sanswered 6 months ago"


Question: AMAZON.LastName not able to recognise last name given in Prompt in AWS LEX V2

"I am using Prompt with built in slot type AMAZON.LastName to get last name , but given last names is not recognised by  in AWS Lex v2, and it keep asking to enter it.How to handle this?E.g.: "Khamooshi"Apart from this, I am unable to find a type like AMAZON.STRING that takes any string without any validation.FollowComment"

Answer: "0If you already have a list of last names that you expect, you can create a custom slot type then use "Expand values (default)" in the custom slot to add all of the last names you expect. This will be used as a training data for the custom slot type.As for the built-in slot type, there is no AMAZON.STRING slot type but you can use AMAZON.AlphaNumeric and specify regular expression to limit the field to only stringsCommentShareWill_Banswered a year ago"


Question: Routing internal and external traffic using the same public subdomain name

"I have a Windows 2019 server running a database application that is accessible by public users and private users from another Windows 2019 instance.I wish to use the same subdomain name for external and internal access, but find that traffic between the 2 AWS instances gets routed externally, which is less secure and slower, when I use the subdomain name for the connection.How do I configure VPC/Route 53 to ensure that traffic between instances remains private while public traffic is directed correctly using the same subdomain name?FollowComment"

Answer: "1The answer from AC is good; I'd add (based on the further response):If your web users are connecting to web.sub.domain.com and your database users are conencting to database.sub.domain.com then it's easy to have different IP addresses for those different records - particularly where the web users go to a public IP and database goes to a private IP.But: If the hostname is the same for both then it's far more difficult because the DNS server has to look at where the query is coming from (private or public) and return a different IP address based on that. And then it's even more difficult because the DNS server doesn't know whether the query is coming from the database application or the web browser - there's no way to tell. So it can only return a single IP address.Therefore: If you are using the same hostname for both purposes (web/database) then you can't do what you want. Instead, use two hostnames and the PHZ as AC suggests above.CommentShareEXPERTBrettski-AWSanswered a year ago0Hi, you can create a Private Hosted Zone (PHZ) in Route 53, add the corresponding internal entries (A/AAAA), and associate this PHZ with the said VPC.Here's the landing page that explains the steps/considerations: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.htmlCommentShareACanswered a year ago0Thanks, AC. I was able to create a private zone as indicated and it worked for the database apps. It led me to a new problem.While I want the database traffic to sub.domain.com to go to the other instance, I need the browser traffic to domain.com to go to the external website. When the hosted zone is active, the browser is unable to resolve DNS.Is there a setting to resolve that?CommentShareTomGanswered a year ago"


Question: Cannot authenticate into Grafana workspace with message "Looks like this code isn't right"

"I have a Grafana workspace using AWS IAM Identity Center as the authentication protocol and have assigned self as the admin of the workspace. However, when I try to login to the Grafana workspace, I got an error as shown below after signing in with my org's Okta.Something went wrongLooks like this code isn't right. Please try again.I'm not sure how to interpret this error and would appreciate some guidance, as this is different from the "login failed" prompt that I've gotten before with another account.FollowComment"


Question: HTTP Strict Transport Security not set

Is the HSTS policy controlled by ALB? I don't see any option. How to fix this? I'm not using API gateway.FollowCommentbwhaley EXPERT4 months agoThere is a good answer for this on stackoverflow: https://stackoverflow.com/a/51906978/2430241Share

Answer: "0Hello,I would suggest to introduce CloudFront and put the LB behind it.CloudFront allows you to set that headerhttps://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-http-security-headers/Other benefits from CF is edge locations + low latency bare backbone AWS network, caching and last but not least could help in case of you are under DDoS attack.CommentShareTodor Todorovanswered 4 months agorePost-User-9219791 4 months agoAs per the definition of HSTS, "HTTP Strict Transport Security (HSTS) is an HTTP header that notifies user agents to only connect to a given site over HTTPS, even if the scheme chosen was HTTP." I already redirect http request to https with 301 code in the ELB hence http is literally not possible. Isn't that suffice?Share"