Question: Access Denied

"Hello AWS,I setup a vpc endpoint for code commit that allows access to a 10.x.x.x/16 subnet and followed your instructions on setting up an ssh user.  I have a policy attached to my user group "Code Commit Power User" and I am getting the following error -- "Access denied: User: arn:aws:iam:::user/ is not authorized to perform: codecommit:GitPull on resource: arn:aws:codecommit:us-east-1:: with an explicit deny" (I ommited for obvious reasons).I can login just fine as I'm getting this message -- "You have successfully authenticated over SSH. You can use Git to interact with AWS CodeCommit. Interactive shells are not supported.Connection to git-codecommit.us-east-1.amazonaws.com closed by remote host.Connection to git-codecommit.us-east-1.amazonaws.com closed."Any help on further troubleshooting?FollowComment"

Answer: "0Nevermind, Extra policy on the endpoint was unnecessary.  All traffic seems to go through vpn just fine and the endpoint is inaccessible externally.CommentSharedhernandez_13_33answered 4 years ago0Hi dhernandez_13_33,Would you be able to share here or via private message what your VPC endpoint policy is?You are seeing "You have successfully authenticated over SSH. You can use Git to interact with AWS CodeCommit. Interactive shells are not supported" because you have successfully, authenticated and we've found and validated your credentials (SSH Key and ID)You are seeing this "Access denied: User: arn:aws:iam:::user/ is not authorized to perform: codecommit:GitPull on resource: arn:aws:codecommit:us-east-1:: with an explicit deny" because something is configured that does not authorize your user (or any user) to do a git pull.Looking at your IAM policies, it looks like there is nothing that would explicitly deny access. We suspect that there is something in your VPC endpoint policy that is not authorizing the request.CommentShareAWS-User-1928028answered 4 years ago"


Question: Importing Vegetation

"EDIT: I was initially trying to import touch blending vegetation, but now I can't seem to get any foliage I import to stay on screen. I am able to add a few instances of it in the Vegetation panel, but then all of it disappears when adding more. I was only able to solves this by ticking the "Automerged" option, but then that disabled my detail bending I made for it. Any help?ThanksFollow"

Answer: "0Accepted AnswerFigured it out: Vegetation imported via the FBX importer doesn't work properly when placed on terrain with the Vegetation system. Exporitng it from Maya/3DS max works flawlessly.I also just got touch bending working by creating branches using the BCRY add-on for Blender, then exporting that to Maya for final export with LODs.SharerePost-User-1269214answered 5 years ago0What difference would that make? Why did exporting from maya/3ds max worked or you but not FBX?SharerePost-User-9359627answered 3 years ago0I know why. The vegetation mesh needs an armature and touch bending for the wind to work with automerge.However, I did notice that you can't have the weight paint on for the armature. Then automerge vegetation won't appear for some reason. but as long as it has touch bending, the armature, and no weight painting, wind bending seems to work with automerge on.SharerePost-User-9359627answered 3 years ago"


Question: MWAA UI Private Webserver can't be accessed through internal ALB

"I am attempting to setup an MWAA environment inside of a private subnet and using an internal ALB to allow users to access the VPC endpoint that is tied to the web server IP addresses in the subnets that were chosen during environment creation. I am currently coming across an issue where if I access the MWAA UI through the console hyperlink I get sent to a page that say This site can't be reached. If I update the URL to include the ALB A-record and MWAA web login token I am able to access the proper page. If I access just the ALB A-record I am sent to a login page for MWAA and sent to the same page where it says This site can't be reached.Additional information is here in my stackoverflow question. To me it is almost as if there is some sort of re-direction issue occurring here. As for being able to access the internal ALB I read that users need access to the VPC, what do this mean exactly?https://stackoverflow.com/questions/71798790/aws-internal-alb-is-unable-to-re-direct-to-private-mwaa-webserverFollowComment"

Answer: "1Hi,Thankyou for using AWS MWAA.With the details provided, MWAA going over ALB/custom DNS record will be redirected for SSO authentication and then to the VPC endpoint. So, in your case the redirection behaviour is working as expected. Because currently MWAA does not support webserver aliases although custom DNS/ALB is setup successfully.To give some context here, Web UI in Managed Airflow (MWAA) is designed to be accessed using SSO authentication via IAM user/role. This is because the SSO tends to redirect to the webserver URL defined in the environment rather than the referrer custom domain. So, after login, it goes back to default web-server domain. However, you can bypass the SSO authentication page and access Web UI directly using MWAA web-token feature, please see belowhttps://docs.aws.amazon.com/mwaa/latest/userguide/call-mwaa-apis-web.htmlBasically, the web-token feature allows you to authenticate access externally by using IAM credentials to generate web token(which are valid for 60 seconds) which can be inserted into the URL of your Airflow UI URL.CommentShareSasidhar_Panswered a year agoAWS-User-6552506 a year agoHi, thanks for the help. Our company currently only allows users to assume roles and we do use a custom SAML federation method to gain access to AWS. I am also fairly new to AWS and the networking aspect so I have a few questions.So when I access the UI through the link provided in the MWAA console it is taking me directly to the VPC endpoint DNS is that correct? This is a custom domain? We didn't setup anything custom and from my understanding MWAA setup a VPC endpoint that is associated to the IP address for the web server in each subnet (2 total). Why exactly do I receive an error stating This site can't be reached at this point?When I access the ALB A-record it forwards the request to the target group (MWAA Webserver VPC endpoint IPs)? Here it asks me to authenticate via AWS Management Console SSO. We only use assume IAM role capabilities at this stage but the role I am assuming prior to accessing the ALB has the ability to generate the web token with the IAM permission for airflow:CreateWebLoginToken. After authenticating the browser URL changes to ####-vpce.c71.us-east-1.airflow.amazonaws.com/aws_mwaa/aws-console-sso?login=true#<WEB_TOKEN> so it seems like I am able to get the web token and I am re-directed to the VPC endpoint DNS. I guess I just don't understand here why this also fails.In what use-case then would the ALB be needed? We would ideally like to have the ALB/link in the MWAA console as our access method for end users.ShareAWS-User-6552506 a year agoIs there anyway we can still use the UI link from the MWAA console to generate the token but then forward users to the proper location?ShareXamarin Guru 9 months agoI am able to use the AWS CLI and generate a web token for MWAA.  I then build the URL as described in the MWAA docs with my generated token. The airflow UI starts to load and then it says Forbidden.  I inspected my token in a JWT browser and it shows:{"aud": "web","roles": "Admin","exp": 1662135243,"user": "assumed-role/AWSReservedSSO_AWSAdministratorAcceaz5WEAHXskQftf7p"}So what am I doing wrong?Share0Although this is a different scenario, please check this technical guide that explains in detail how to use public facing ALB + Amazon Cognito + AWS Lambda to build a solution that handles this scenario.CommentShareEXPERTTasioanswered 6 months ago"


Question: How do I find my QuickSight dashboard and analysis IDs?

"I'm trying to figure out how to find the dashboard and analysis IDs for QuickSight dashboards and analyses that I am working on.  My ultimate goal is to port them over to another account.I found this article which references a dashboard ID, but I can't figure out how to actually find it.  I see some stuff on StackOverflow that involves creating a Cognito instance and I'm wondering if that's really the only way?This seems like something that should be pretty easily accessible without needing to write a script or creating new resources.JulianFollowComment"

Answer: "0Hi,you can use the QuickSight CLI command list-dashboards or the APIs (example for python)then you search for the Dashboard name and you find the associated dashboard ID, the same apply to analysis.hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year ago0To add, in addition to getting the ID from URL in browser, you can use SearchDashboards or SearchAnalyses APIs with  a filter on QUICKSIGHT_USER. Resulting dashboards/analyses are all the dashboards/analyses the user has access to.CommentShareVijayanswered a year ago"


Question: How can I send audio from a JavaScript client to an Amazon Kinesis Video Stream?

I want to capture microphone input on a website and then send it through Amazon Kinesis Video Streams to the server to save the audio as well as process it through Amazon Transcribe for a transcription.FollowComment

Answer: "0Thought I never tried this out, I would suggest the following:Leverage JS api such as MediaDevices (https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/getUserMedia). You can refer to this tutorial to refer on how to use it in your browser: https://dobrian.github.io/cmp/topics/sample-recording-and-playback-with-web-audio-api/3.microphone-input-and-recording.html.Kinesis Video Streaming Javascript SDK(https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-kinesis-video-signaling/index.html). Send audio to the stream and store it there and or in a separate database (DynamoDB), for later use if needed.Finally use Transcribe APIs. (https://docs.aws.amazon.com/transcribe/latest/dg/getting-started-sdk.html). You can take inspiration from this repo, specific for AmazonConnect, but still using a similar architecture: https://github.com/amazon-connect/amazon-connect-realtime-transcription which uses a Lambda function as glue between Kinesis stream and Transcribe serviceCommentShareEXPERTalatechanswered 4 months agorain-mtucker 4 months agoCan you provide more details on which commands to use from Kinesis Video Streaming Javascript SDK to PUT_MEDIA onto a KVS stream?Sharealatech EXPERT4 months agoI believe that there is no direct putMedia support for JS. There is only for C++ and Java. Nevertheless I found this which may inspire you. It bypasses this limitation by issuing a rest call instead of using a putMedia method, which doesn’t exist in the Js sdk. https://gist.github.com/roccomuso/e65e80aecbe700db2576e751fa1a22c4.Hope it helpsShare0Here is code that accepts a WAV file path as input and sends it to a Kinesis Video Streams stream:// upload.jsconst { KinesisVideoClient, GetDataEndpointCommand } = require("@aws-sdk/client-kinesis-video");const ffmpeg = require('fluent-ffmpeg')const aws4 = require('aws4')const axios = require('axios')const CancelToken = axios.CancelTokenconst fs = require('fs')const PipeViewer = require('pv')function noop() { }const HANGING_TIMEOUT = 20 * 1000function getMkvStream(uri, onStart, onFinished) {    let processHanging = null    const audio = ffmpeg(uri)        .format('matroska')        .outputOptions(['-ar 8000', '-acodec pcm_s16le'        ])                .on('progress', function (progress) {            console.log('Processing:', progress)            clearTimeout(processHanging)            processHanging = setTimeout(function () {                console.error('Hanging for more than 20 sec.')                audio.kill()            }, HANGING_TIMEOUT) // hanging for more than x sec        })        .on('start', function (commandLine) {            console.log('Spawned Ffmpeg with command: ' + commandLine)            onStart && onStart()        })        .on('end', function () {            console.log('Finished processing')            onFinished && onFinished()        })        .on('error', function (err, stdout, stderr) {            console.log('Cannot process video: ' + err.message)            clearTimeout(processHanging)            onFinished && onFinished(err) // eventually restart        })    return audio}function sendStream({ mkvFile, streamName, dataEndpoint, pwd }, onStart, onFinish) {    onFinish = onFinish || noop    const opts = {        service: 'kinesisvideo',        host: dataEndpoint,        path: '/putMedia',        method: 'POST', // NB. required!        headers: {            'Content-Type': 'application/json',            'x-amzn-stream-name': streamName,            "x-amzn-fragment-timecode-type": "ABSOLUTE",            "x-amz-content-sha256": "UNSIGNED-PAYLOAD"        }    }    const signed = aws4.sign(opts, pwd)    console.log(signed)    const reqUri = 'https://' + opts.host + opts.path    let cancel;    axios({        method: 'POST',        timeout: 40 * 1000,        url: reqUri,        headers: signed.headers,        data: mkvFile,        responseType: 'stream',        maxContentLength: Infinity, // required for stream!        cancelToken: new CancelToken(function executor(c) {            // An executor function receives a cancel function as a parameter            cancel = c        })    }).then(function (res) {        onStart && onStart(cancel)        res.data.on('data', function (fragRes) {            console.log(fragRes.toString())            fragRes = JSON.parse(fragRes.toString())            const EventType = fragRes.EventType            const ErrorCode = fragRes.ErrorCode            if (EventType === 'ERROR') {                // request aborted                onFinish(new Error('Fragment event type: ERROR - ' + ErrorCode))            }        })    }).catch(onFinish)}function startUpload({ audioUri, streamName, dataEndpoint, pwd }) {    // get stream    const ffmpegAudio = getMkvStream(audioUri, null, function (err) {        if (err) {            startUpload({ audioUri, streamName, dataEndpoint }) // start again        }    })    const pv = PipeViewer()    pv.on('info', function (str) {        console.log('Speed: ' + str.speed + ' - Transferred: ' + str.transferred)    })    // start send stream    sendStream({ mkvFile: ffmpegAudio.pipe(pv), streamName, dataEndpoint, pwd }, function started(cancel) {        setTimeout(function () {            cancel() // stop upload            ffmpegAudio.kill() // stop stream and raise err cb above        }, 40 * 60 * 1000) // 40 min    }, function finished(err) {        if (err) console.error(err)    })}// mainasync function main() {    // node upload.js ./samples/input.wav    const args = process.argv.slice(2);    console.log(args)    // getMkvStream(args[0]).pipe().pipe(require('fs').createWriteStream('./test.mkv'), null, console.error)    const STREAM_NAME = 'my-kvs-stream';    const config = { region: 'us-east-1' };    const input = {        APIName: 'PUT_MEDIA',        StreamName: STREAM_NAME    }    const client = new KinesisVideoClient(config);    const command = new GetDataEndpointCommand(input);    const response = await client.send(command);    console.log({ response });    startUpload({        audioUri: args[0],        streamName: STREAM_NAME,        dataEndpoint: response.DataEndpoint.split('://')[1],        pwd: {            endpoint: 'kinesisvideo.us-east-1.amazonaws.com',            region: 'us-east-1',            accessKeyId: "xxx",            secretAccessKey: "xxx",        }    })}main();To send the file, execute: node upload.js ./samples/input.wavCommentSharerain-mtuckeranswered 4 months ago"


Question: AWS DataSync NFS mount

"Hi, we are planning to use DataSync for transferring files from On-prem to AWS S3 on a daily basiswe have done the followingInstalled DataSync Agent VM On-Prem and have all network connections to NFS server and AWSCreated the agent in AWS console and its showing activeNow for our admin to share the required directory from NFS server(Application server IBM iSeries), I am asked to provide the directory details in the agent VM to mount the share, I am not sure about how to create directory in the Datasync agent VM for mountingPlease can you adviceFollowComment"

Answer: "0Hi,When configuring an NFS location you provide the NFS server and path of the mount point you targeting from your on-prem storage system.  The directory is not created on the agent itself, the mount path of your NFS server export is provided as the path for the location.You can find additional details on configuring an NFS location here:https://docs.aws.amazon.com/datasync/latest/userguide/create-nfs-location.htmlCommentShareDarryl_Dioanswered 6 months ago0Thanks Darryl, your suggestion helped, our tasks are getting successfully completed but no files are getting transferred.It does look like an issue with Datasync. we are using IBM iSeries as our NFS server, NFS sharing works at the user id level in my company, NFS will not allow access to clients unless a valid user id is provided. there is no provision to create a user id in Datasync which I can share with NFS server team for providing me the access.We are looking at other options to transfer filesThank you for your inputsCommentSharePradeepanswered 5 months ago"


Question: AWS Glue create_dynamic_frame.from_catalog Failed to find data source: UNKNOWN

"Here is my code snippet:[transaction_DyF = glueContext.create_dynamic_frame.from_catalog(database = source_db,table_name = source_tbl,push_down_predicate = pushDownPredicate,transformation_ctx = source_tbl)Error Message:Error: An error occurred while calling o103.getDynamicFrame.\n: java.lang.ClassNotFoundException: Failed to find data source: UNKNOWNFollowCommentFayaz 5 months agoHello - can you please explain from where you trying to read? You can also try from_options if you are trying to read from s3, rds and other sources.Share"

Answer: "0Calling the create_dynamic_frame.from_catalog is supposed to return a dynamic frame that is created using a Data Catalog database and table provided. However, in this case it is likely that the table input classification is UNKNOWN, when the crawler detects no pattern in files to classify it, a table with a classification UNKNOWN is created.Check the table properties in Data Catalog for classification. See below link on creating a custom classifier.https://aws.amazon.com/premiumsupport/knowledge-center/glue-crawler-unknown-classification/https://docs.aws.amazon.com/glue/latest/dg/console-classifiers.htmlCommentShareJohn_Manswered 5 months ago"


Question: ApiGatewayV2 - HttpApi - Cannot use a custom domain

"Hello,I can use auto-deploy on both the $default or custom "prod" stage to get a working link for my API.E.g. The $default deploys to https://\[ApiId].execute-api.eu-west-1.amazonaws.comI can add a custom domain (test.\[domain].com) with a valid certificate, where I receive the "API Gateway domain name".E.g. d-\[RandomChars].execute-api.eu-west-1.amazonaws.comI add the a Route53 Alias from my test.\[domain].com to the above "API Gateway domain name".test.\[domain].com. A ALIAS d-\[RandomChars].execute-api.eu-west-1.amazonaws.comI add the API mapping of the custom domain to "My Http Api" on stage "$default", I do not specify path, as simply "/" is not supported.Neither https://d-\[RandomChars].execute-api.eu-west-1.amazonaws.com nor my custom domain navigates to my API (ERR_CONNECTION_REFUSED). But https://\[ApiId].execute-api.eu-west-1.amazonaws.com does.What am I doing wrong? Is this a bug?FollowComment"

Answer: "0I fixed the problem,These steps are correct, I was being foolish, Chrome was trying to access it with http, it of course requires https.CommentShareDemoWearinganswered 3 years ago0Hey!  I am wondering about your Step 2 -- the "with a valid certificate" part.I added a custom domain, and get a "d-\[RandomChars].execute-api.us-east-1.amazonaws.com" as well.However, I noticed in this "Endpoint configuration" window that it does not show a "Certificate upload date" -- we have 2 other custom domains that do show a "Certificate upload date" just below the "Hosted zone ID" info, but they are "Edge" and mine is "Regional".Does your custom domain "Endpoint configuration" show a certificate upload date?I am searching fiendishly for why my custom domain remains "Forbidden"!!!Edited by: warrenstephens on Nov 18, 2020 3:27 PMCommentSharewarrenstephensanswered 3 years ago0I found the problem, and it was not with that certificate stuff.  Another "foolish" mistake actually.The issue was actually within the authorizer lambda, which returns an APIGatewayCustomAuthorizerResponse (the name of the struct in Go) which contains a policy to permit the execute lambda to then run.The authorizer lambda was able to pull the region ("us-east-1") from the host name when it was like "zzzyyxx123.execute-api.us-east-1.amazonaws.com", but when the custom domain request comes in the "host" value in the header does not have the region embedded -- so the policy it created and returned had garbage for the region part of the ARN, and so the execute lambda would not run, i.e. "Forbidden".CommentSharewarrenstephensanswered 3 years ago"


Question: Potentially degraded RDS volume - Latency & I/O spikes

"Similar to this thread https://forums.aws.amazon.com/thread.jspa?messageID=905866 , we are experiencing sudden spikes in read/write latency and queue depth on a production multi-az db.r3.4xlarge mysql instance in us-east-1.  The spike lasts for a few hours and then returns to normal.  This has been occurring every day for the past week now, around the same time of day (+- a few hours).  There is no increase in connections, workloads, web layer traffic, cronjobs, etc.  It's just queries start crawling which leads to a huge back up of active connections and ultimately results in timed out web requests.We've turned on Enhanced Monitoring and see the physical device read/write IOs plummet.  Physical device xvdi is the only physical device which has a huge jump in Avg Queue Size, Avg Request Size, Disk I/O Await, Disk I/O Util, Read Total, and Write Total.We believe there to be a degradation issue with volume xvdi.  This is for maindb in 939284280993.  DM for more identifying info if needed.Can someone from AWS please look into this ASAP?Edited by: csscif on Jul 7, 2019 11:18 AMEdited by: csscif on Jul 7, 2019 11:19 AMEdited by: csscif on Jul 7, 2019 11:19 AMFollowComment"

Answer: "0Hi,I took a look at your instance, there is no issue with the storage volumes on your instance. Rather, you have 2t gp2 allocated storage and your baseline performance in this case is 6000.Your workload is consistently using higher IOPS than baseline.Currently your burst balance is completely depleted, so you are getting throttled at the baseline IOPS of 6000.Here is a blog with more info about burst verus baseline:https://aws.amazon.com/blogs/database/understanding-burst-vs-baseline-performance-with-amazon-rds-and-gp2/You could increase IOPS by allocating a larger gp2 volume.In your case, because you have a legacy volume layout, the conversion to larger storage will occur online but will take about 24 hours.Alternatively you are using a lot of READ IOPS, you might be able to tune your workload to do fewer reads.hth,PhilCommentShareMODERATORphilawsanswered 4 years ago"


Question: Deprovisioning SimpleDB

"I am not a technical individual that inherited a AWS leftover environment that I am trying to deprovision. Most deprovisioning tasks are intuitive and I can handle through the GUI. However, I cant figure out how to deprovision SimpleDB. Does anyone have any straightforward steps a non-techie layman like myself can follow?TIA!FollowComment"

Answer: "0Hi,in theory you should just delete a domain. The problem is that simpleDB cannot be accessed by AWS Console as it is a very outdated AWS offering.The only practical ways to do that are:Use api https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/WorkingWithDomainsDelete.htmlTry this plugin out: https://chrome.google.com/webstore/detail/sdbnavigator/ddhigekdfabonefhiildaiccafacphgg and verify if possible to delete it from there.Hope it helps.CommentShareEXPERTalatechanswered 3 months ago"


Question: Higher CPU usage than usual db.t2.large Postgresql

"Hello,Since Wednesday, 26.05., we are experiencing higher CPU usage than usual on our db.t2.large Postgresql instance in eu-west-1a region. The usage is always above the 30% threshold and our CPU credits are almost over since they are reaching critical levels. The database is servicing a website which is not really that heavy and even during the night there are no visitors, just crawlers. For the first month and a half we didn't have any issues and now suddenly even if there are no connections the CPU usage is 26-28% and our credit usage is constantly above 3.There is no increase in the users of the website, no problem with the EC2 server, no difference at all. It's even a weekend and there is even less writing on the DB, but still we are 300 credits down since yesterday. We are expecting to reach 0 credit balance at the end of today and the next week hasn't even started yet, when the people are actually active on the site.What can we do? I have rebooted the instance, turned on Enhanced monitoring which proved that during the night there are 0 connections most of the time.FollowComment"

Answer: 0Apparently bots can cause this even if their crawling triggers one of the quickest requests. Quantity over quality here. Please delete the thread.CommentSharenuHaKoJIagaanswered 4 years ago0What version of PostgreSQL is this?Have you tried Performance Insights to see where the load is coming from?https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.htmlKyleCommentShareAWS-User-1731424answered 4 years ago


Question: RDS MYSQL 8.0 parameter group value is not updating

"I have recently launched a RDS instance MYSQL 8.0 and When I modify the parameter explicit_defaults_for_timestamp = 0, In AWS console values shows updated. But in MYSQL console values are still not getting updated, Have tried rebooting, start/stop of the instance but still facing this issue.When I try the same with MySQL 5.7 able to update the same parameter, Lookslike issues with AWS RDS.  Need help on this.FollowComment"

Answer: 2Probably it is because "explicit_defaults_for_timestamp" is deprecated in MYSQL 8.0 here is the reference from MYSQL website.https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_explicit_defaults_for_timestampCommentShareCarlos Cejaanswered a year ago


Question: Textract AnalyzeExpense: Standard Fields not detected

"Hello, I am using the sdk for java. Particularly the AnalyzeExpenses service. The result that I obtained in all my tests almost does not contain standard labels, that is, they have type "OTHER".In the documentation they mention tags like TOTAL, RECEIVER_ADDRESS, INVOICE_RECEIPT_DATE.I am only getting VENDOR_NAME and EXPENSE_ROW.I didn't find implementation examples in java to see if I'm doing something wrong.For example I have labels like "Total", "Date:", "Quantity" that are not being returned mapped to the standard.From already thank you very muchFollowComment"

Answer: "0To better assist you, we will need to look at the document and gather a few details. Please create a support ticket, and we will have our support engineer look into this for you.CommentShareMarkoceAtAWSanswered a year ago"


Question: nodejs10.x Lambda Env != Amazon Linux 2 AMI Env

"The shared libraries available in /lib64 are not the same when using a live lambda, compared to testing with the Amazon Linux 2 AMI provided in the docs: amzn2-ami-hvm-2.0.20190313-x86_64-gp2For example, /lib64/libcrypt.so.1 exists in the AMI, but not in a live lambda environment.How can we compile binaries without an accurate testing environment?FollowComment"

Answer: "0Accepted AnswerThe AMIs have a lot of differences from the Lambda environment in our experience. Try testing/compiling on the lambci Docker images, they're created from real Lambda environments and have always worked in our experience.https://github.com/lambci/docker-lambdaCommentShareJaikDeananswered 4 years ago"


Question: Cloudformation not supporting Full Clone in Output artifact format for codepipeline

"I am working on CFT which pulls code from GitHub with 2.0 OAuth app version and my buildspec needs git metadata to work with.if my requirement is unclear, look at this feature in aws docs for better understanding.Below is the code I have for CFT  CodePipelineGitHub:    Type: AWS::CodePipeline::Pipeline    Properties:      RoleArn: !Ref CodePipelineServiceRole      ArtifactStore:        Type: S3        Location: !Ref CodePipelineArtifactBucket      Stages:        - Name: source          Actions:            - Name: aa-source              ActionTypeId:                Category: Source                Owner: AWS                Version: 1                Provider: CodeStarSourceConnection              Configuration:                 ConnectionArn: !Ref ConnectionArn                FullRepositoryId: !Ref GitSourceRepo #"some-user/my-repo"                BranchName: !Ref GitBranch              OutputArtifacts:                - Name: SourceArtifact              RunOrder: 1But from GUI, we have option to get the .git metadata into the source output artifact.Please provide a solution to get the git metadata into the build stage.FollowComment"

Answer: "0You can try adding:OutputArtifactFormat: CODEBUILD_CLONE_REFTo the action's Configuration, that should address the full clone.CommentShareEXPERTRaphaelanswered a year ago"


Question: How to access StackSet instances outputs

"Hi all! I'm trying to create a CloudFormation template for a multi-region setup, which would create a load balancer in each region and a global accelerator pointing to them. In order to do so, I wanted to have a main CloudFormation template with a AWS::CloudFormation::StackSet resource that would create the load balancers across the desired regions, and a AWS::GlobalAccelerator::Accelerator linking them up. The ARNs of the load balancers are needed to create the latter. However, there doesn't seem to be a way to access the outputs of StackSet instances from the parent CloudFormation template. Is it possible to achieve something like that natively with CloudFormation?FollowComment"

Answer: "0Accepted AnswerAccessing the Output values is limited to the region of the stack.You can't create cross-stack references across regions. You can use the intrinsic function Fn::ImportValue to import only values that have been exported within the same region.However,  I think the solution to your issue is to approach it from another angle. Create the AWS::GlobalAccelerator::Accelerator and AWS::GlobalAccelerator::Listener in your parent template, then pass the ListenerArn to the StackInstances as a parameter. In the template for the StackInstances, create the AWS::GlobalAccelerator::EndpointGroup referencing the locally created ALB ARN and the ListenerARN parameter.There is a reference to this in this blog post.When you use a CloudFormation template to create or update an accelerator, you can specify your resources in any AWS Region.  For example, you can define your accelerator and listener in a CloudFormation template in us-west-2.  You can then define your endpoint groups in different CloudFormation templates in the Regions where your endpoints are.  This simplifies setup, but the tradeoff is that your CloudFormation templates in various Regions aren’t related to each other.  Because these cross-Region stacks are not related, make sure that, when you need to tear down the stacks, that you do so in the correct order. That is, delete the stack with the application before you delete the accelerator stack.CommentShareEXPERTkentradanswered 4 months agoDavid 4 months agoThis is exactly what I was looking for, thank you very much!Share"


Question: Create new project results in error now

"So. New problem. Also last problem.I am out of ideas and also out of energy.I reinstalled EVEYTHING so, there shouldn't be anything missing.I will NOT reinstall LY completely again. Not for a 4th time,absolutely not.The last one I managed to get builds but nothing did run.(See other post about "log", I am even to pissed right now to linkit properly...)So I started again from scratch. (3rd time... and also for the last time.) and now I got this:"C:\Amazon\Lumberyard\1.26.0.0\dev\lmbr_waf.bat" configure --generate-vs2017-projects-automatically=False --generate-vs2019-projects-automatically=False --enabled-game-projects=emptyLastTry[WAF] Engine Root: C:\Amazon\Lumberyard\1.26.0.0\dev\invalid lock file in c:\Amazon\Lumberyard\1.26.0.0\dev\BinTemp[WAF] Executing 'configure'[WARN] Missing JDK path from Setup Assistant detected. Target platforms that require java will be disabled. Please re-run Setup Assistant with "Compile For Android" enabled and run the configure command again.[SETTINGS] msvs_version = 16 (default 15) [SETTINGS] enable_android_armv8_clang = False (default True) [SETTINGS] enable_win_x64_vs2017 = False (default True) [SETTINGS] generate_vs2017_projects_automatically = False (default True) [SETTINGS] generate_vs2019_projects_automatically = False (default True) [WARN] Unable to process 3rd party config file 'angle.json': Invalid/missing LIBPATH value 'c:\Amazon\Lumberyard\1.26.0.0\dev\Tools\Redistributables\ANGLE\win32': (c:\Amazon\Lumberyard\1.26.0.0\dev\_WAF_\3rdParty\angle.json, platform win_x64_vs2019)[WARN] Unable to configure uselibs 'ANGLE' for platform 'win_x64_vs2019'. This may cause build errors for modules that depend on those uselibs for that platform[WARN] Unable to process 3rd party config file 'benchmark.json': Invalid/missing SYSTEM_INCLUDES value 'C:\Amazon\Lumberyard\1.26.0.0\3rdParty\benchmark\1.4.1\include': (c:\Amazon\Lumberyard\1.26.0.0\dev\_WAF_\3rdParty\benchmark.json, platform win_x64_vs2019)[WARN] Unable to configure uselibs 'BENCHMARK' for platform 'win_x64_vs2019'. This may cause build errors for modules that depend on those uselibs for that platform[WARN] Unable to process 3rd party config file 'crashpad.json': Invalid/missing INCLUDES value 'c:\Amazon\Lumberyard\1.26.0.0\dev\Tools\Crashpad\include': (c:\Amazon\Lumberyard\1.26.0.0\dev\_WAF_\3rdParty\crashpad.json, platform win_x64_vs2019)[WARN] Unable to configure uselibs 'CRASHPAD,CRASHPAD_HANDLER' for platform 'win_x64_vs2019'. This may cause build errors for modules that depend on those uselibs for that platform[WARN] Unable to process 3rd party config file 'd3d_compiler.json': Invalid/missing LIBPATH value 'c:\Amazon\Lumberyard\1.26.0.0\dev\Tools\Redistributables\D3DCompiler\win32': (c:\Amazon\Lumberyard\1.26.0.0\dev\_WAF_\3rdParty\d3d_compiler.json, platform win_x64_vs2019)[WARN] Unable to configure uselibs 'D3D_COMPILER,D3D_COMPILER_43,D3D_COMPILER_46,D3D_COMPILER_47' for platform 'win_x64_vs2019'. This may cause build errors for modules that depend on those uselibs for that platform[WARN] Unable to process 3rd party config file 'dbg_help.json': Invalid/missing LIBPATH value 'c:\Amazon\Lumberyard\1.26.0.0\dev\Tools\Redistributables\DbgHelp\win32': (c:\Amazon\Lumberyard\1.26.0.0\dev\_WAF_\3rdParty\dbg_help.json, platform win_x64_vs2019)[WARN] Unable to configure uselibs 'DBG_HELP' for platform 'win_x64_vs2019'. This may cause build errors for modules that depend on those uselibs for that platform[WARN] Unable to process 3rd party config file 'libav.json': Invalid/missing SYSTEM_INCLUDES value 'C:\Amazon\Lumberyard\1.26.0.0\3rdParty\libav\11.7\usr\include': (c:\Amazon\Lumberyard\1.26.0.0\dev\_WAF_\3rdParty\libav.json, platform win_x64_vs2019)[WARN] Unable to configure uselibs 'LIBAV' for platform 'win_x64_vs2019'. This may cause build errors for modules that depend on those uselibs for that platform[WARN] Unable to process 3rd party config file 'msvc90.json': Invalid/missing LIBPATH value 'c:\Amazon\Lumberyard\1.26.0.0\dev\Tools\Redistributables\MSVC90': (c:\Amazon\Lumberyard\1.26.0.0\dev\_WAF_\3rdParty\msvc90.json, platform win_x64_vs2019)[WARN] Unable to configure uselibs 'MSVC90' for platform 'win_x64_vs2019'. This may cause build errors for modules that depend on those uselibs for that platform[WARN] Unable to process 3rd party config file 'opengl32.json': Invalid/missing LIBPATH value 'c:\Amazon\Lumberyard\1.26.0.0\dev\Tools\Redistributables\OpenGL32': (c:\Amazon\Lumberyard\1.26.0.0\dev\_WAF_\3rdParty\opengl32.json, platform win_x64_vs2019)[WARN] Unable to configure uselibs 'OPENGL32' for platform 'win_x64_vs2019'. This may cause build errors for modules that depend on those uselibs for that platform[WARN] Unable to process 3rd party config file 'ssleay.json': Invalid/missing LIBPATH value 'c:\Amazon\Lumberyard\1.26.0.0\dev\Tools\Redistributables\SSLEAY\win32': (c:\Amazon\Lumberyard\1.26.0.0\dev\_WAF_\3rdParty\ssleay.json, platform win_x64_vs2019)[WARN] Unable to configure uselibs 'SSLEAY' for platform 'win_x64_vs2019'. This may cause build errors for modules that depend on those uselibs for that platform[WARN] Unable to process 3rd party config file 'wwise.json': Invalid/missing SYSTEM_INCLUDES value 'C:\Amazon\Lumberyard\1.26.0.0\3rdParty\Wwise\2018.1.4.6807\SDK\include': (c:\Amazon\Lumberyard\1.26.0.0\dev\_WAF_\3rdParty\wwise.json, platform win_x64_vs2019)[WARN] Unable to configure uselibs 'WWISE' for platform 'win_x64_vs2019'. This may cause build errors for modules that depend on those uselibs for that platform[WARN] Unable to process 3rd party config file 'wwise2017.json': Invalid/missing SYSTEM_INCLUDES value 'C:\Amazon\Lumberyard\1.26.0.0\3rdParty\Wwise\2018.1.4.6807\SDK\include': (c:\Amazon\Lumberyard\1.26.0.0\dev\_WAF_\3rdParty\wwise2017.json, platform win_x64_vs2019)[WARN] Unable to configure uselibs 'WWISE2017' for platform 'win_x64_vs2019'. This may cause build errors for modules that depend on those uselibs for that platform[WAF] 'Initialize Build Variants' starting...[WAF] Configure "win_x64_vs2019 - [debug,debug_dedicated,debug_test,debug_test_dedicated,profile,profile_dedicated,profile_test,profile_test_dedicated,performance,performance_dedicated,release,release_dedicated]"[WAF] 'Initialize Build Variants' successful (1.593s)[WAF] 'Configure Projects' starting...[WAF] 'Configure Projects' successful (5.202s)Traceback (most recent call last):  File "C:\Amazon\Lumberyard\1.26.0.0\dev\Tools\build\waf-1.7.13\waflib\Utils.py", line 263, in writef_win32    fd = os.open(f, flags)PermissionError: [Errno 13] Permission denied: 'c:\\Amazon\\Lumberyard\\1.26.0.0\\dev\\BinTemp\\.lock-waf_win32_build'During handling of the above exception, another exception occurred:Traceback (most recent call last):  File "C:\Amazon\Lumberyard\1.26.0.0\dev\Tools\build\waf-1.7.13\waflib\Scripting.py", line 226, in waf_entry_point    run_commands()  File "C:\Amazon\Lumberyard\1.26.0.0\dev\Tools\build\waf-1.7.13\waflib\Scripting.py", line 342, in run_commands    ctx = run_command(cmd_name)  File "C:\Amazon\Lumberyard\1.26.0.0\dev\Tools\build\waf-1.7.13\waflib\Scripting.py", line 319, in run_command    ctx.execute()  File "C:\Amazon\Lumberyard\1.26.0.0\dev\Tools\build\waf-1.7.13\lmbrwaflib\build_configurations.py", line 1507, in execute    return execute_method(self)  File "C:\Amazon\Lumberyard\1.26.0.0\dev\Tools\build\waf-1.7.13\lmbrwaflib\build_configurations.py", line 1507, in execute    return execute_method(self)  File "C:\Amazon\Lumberyard\1.26.0.0\dev\Tools\build\waf-1.7.13\waflib\Configure.py", line 277, in execute    env.store(Context.lock_dir + os.sep + Options.lockfile)  File "C:\Amazon\Lumberyard\1.26.0.0\dev\Tools\build\waf-1.7.13\waflib\ConfigSet.py", line 291, in store    Utils.writef(filename, ''.join(buf))  File "C:\Amazon\Lumberyard\1.26.0.0\dev\Tools\build\waf-1.7.13\waflib\Utils.py", line 265, in writef_win32    raise IOError('Cannot write to %r' % f)OSError: Cannot write to 'c:\\Amazon\\Lumberyard\\1.26.0.0\\dev\\BinTemp\\.lock-waf_win32_build'Process failed with return code: 1Any idea?Follow"

Answer: "0Accepted AnswerSoooo. For now, I am finally up and running...Managed a clean install without errors and all SDKs.It runs, and more importantly, I also managed to create and build a new project and a still fine working full rebuild.What a tour de force... Never thought that one day I would consider these two steps an achievement in a game engine... :slight_smile:But always like it when my stubbornness and persistence prevails.So consider this solved. Now I can finally start totake a serious look at this thing. Need a break now anyway... Pretty exhausting stuff man. Hooooly ****.SharerePost-User-5016482answered 3 years ago0@REDACTEDUSERI've created a ticket for you so our devs can take a look at the issue. Keep an eye out on the forums in the thread.Thanks for your support.SharerePost-User-8164888answered 3 years ago0[quote="Lytz1, post:1, topic:9782"]PermissionError: [Errno 13] Permission denied: 'c:\\Amazon\\Lumberyard\\1.26.0.0\\dev\\BinTemp\\.lock-waf_win32_build'[/quote]I've never seen this before...  it looks like BinTemp is permission locked.  BinTemp is generated when running lmbr_waf configure.  What happens if you right click BinTemp/.lock-waf_win32_build and click properties?  Is it read only?  Mine is not read-only, so you'll want to change it read-only=offREMOVEDUPLOADIf changing file permission doesn't work, what's the new commandline output say?SharerePost-User-7158712answered 3 years ago0Do you happen to have antivirus enabled. If so, try temporarily disabling and see if that fixes the lock issue.SharerePost-User-5018585answered 3 years ago0Hey there.I thought I give it another shot and I uninstalled everything and I am now in the process of reinstalling everything completely from scratch.(Yeah, I am quite resilient, I know. )I am "only" a couple of hours in since I did that.So I can't say anything right now, this will stilltake quite a while until I am up and running again.(Good thing is I have 2 Systems running so I am not stuck waiting and can do something else in the meantime.)However, as soon as that is done I will report back.Hopefully without any errors, if not there should be the same. If that's the case I will try your suggestions.Thanks a lot,tL.(Btw: What is it with this strange double slashes, i.e.:c:\\is this normal? I mainly work on my Mac, not so much on PC, so I am not sure but this looks kinda odd to me... Aren't normally network drives quoted like that?)SharerePost-User-5016482answered 3 years ago0[quote="Lytz1, post:1, topic:9782"]I will NOT reinstall LY completely again. Not for a 4th time,absolutely not.[/quote]Lol to myself, haha... :) But in the end I am just not the guy for throwing the towel...SharerePost-User-5016482answered 3 years ago0I'm so glad you were able to build without any errors this time, nicely done!  Sounds like you reinstalled completely? Did you need to turn off anti-virus, or did it just work?SharerePost-User-7158712answered 3 years ago0Interestingly it worked right out of the box onthe complete reinstall. So I am not sure what went wrong the other times.  Didn't touch anti-virus, so that can be ruled out.Maybe some left over from the try/installation before the other one. Maybe some data got messed up. Doesn't matter now though, looks like everything is smooth sailing. 👍SharerePost-User-5016482answered 3 years ago"


Question: Is AWS shield Standard automatically applied?

"We're using route53 in front of cloudfront and Application Loadbalancer.Now, we have plan to apply AWS Shield Standard to prevent DDOS attacks.But there is no functions on AWS Console to apply AWS Shield Standard (Only there be Advanced)Is the AWS Shield Standard automatically set up on route53, application loadbalancer(ELB), Cloudfront distributions?There is no more tasks to apply AWS Shield Standard for our applications. right?(We are also using WAF to prevent L7 layer ddos with rate-based rules)FollowComment"

Answer: "3Accepted AnswerYes, Shield Standard is built-in to the AWS service. This means that it is applied transparently to all internet-facing AWS services.It automatically mitigates standard Layer 3/4 attacks—no work required on the user side.CommentSharehayao-kanswered 9 months agoEXPERTChris_Greviewed 9 months agorePost-User-5175846 9 months agoreally thanks!Share"


Question: java-11-openjdk-devel for Amazon Linux 2

Does anyone when the java-11-openjdk-devel will be available in the Amazon Linux 2 yum repo?FollowComment

Answer: "0Hello,We are working to make this package available for Amazon Linux 2. I'm afraid I do not have a date when this will be available. The plan at this point is to make the package available in the Amazon Linux extras repositories.-HeathCommentShareAWS-User-2400882answered 4 years ago0Hello,The java-11-openjdk package is now available in the Amazon Linux 2 extras repositories. To install the java-11-openjdk packages on an Amazon Linux 2 instance run: sudo amazon-linux-extras install java-openjdk11Thanks for your request.-HeathCommentShareAWS-User-2400882answered 4 years ago0Any word on when this will be available on beanstalk? As of now I only see JDK 7 and 8 as options when creating new Java environments.CommentShareelvtnanswered 4 years ago0Hello, I run following and got error.sudo amazon-linux-extras install java-openjdk11Could not retrieve mirrorlist http://amazonlinux.ap-east-1.amazonaws.com/2/extras/java-openjdk11/latest/x86_64/mirror.list error was14: HTTP Error 404 - Not FoundCommentShareZolbooanswered 4 years ago0Thanks for the report. I can confirm that this is an issue we need to address. Apologies for the inconvenience that this may have caused. We are working to fix this issue. The java-11-openjdk repository should be available in ap-east-1 within the next few days. Thanks for using the Amazon Linux 2 AMI.-HeathCommentShareAWS-User-2400882answered 4 years ago0Hello Heath,I was able to install the java-openjdk11 from amazon-linux-extras. But how do I switch to OpenJDK11 on an Amazon Linux 2 instance? sudo update-alternatives --config javacdoesn't list OpenJDK11 as an option. Please advise.SaqibCommentSharesaqibali2answered 4 years ago"


Question: Root account hacked and Email updated

"Hi ,My root account hacked where he updated email and continuous using services,Have created multiple CASE on support ,but still not getting resolution.any help to speed up this?FollowCommentAWS-User-8986118 a year agoPlease see my comments below. However did you ever get access back to your account? The support we are getting (or lack thereof) is appalling. I have reached out via LinkedIn to the Head of Customer Support in ANZ and provided 80 pages of email and correspondence between AWS and ourselves.  AWS say its fixed but its not and they have taken it upon themselves to close the ticket. Seriously. WHAT HAPPENS NOW?ShareArticle89 a year agoMay I ask how this turned out for you? Same thing happened to me and I am struggling.ShareF_UCKYOUAWS 2 months agoI recently have the same issue.April 11, 2023 5:14AM My time. I recieved an email saying that AWS has detected an unusual log in activity.April 11, 2023 5:16AM My time. I recieved an email saying that my account email was changed to be new weird email.I did not noticed this acitivity untilI found that there is a transaction in my credit card one day later that is charged from AWS.They not even ask for verification code for changing the email. It looks so easy when someone just took my account.When trying to restore password. It said my account (with my email) does not exist.Share"

Answer: "2We have had the same issue here. There are 3 people in the world who have access with an extremely complex password that is not recorded anywhere and yet the Email address attached to our account was changed without our consent or knowledge. So how could anyone break the user name and complex passwords?When I ask AWS this we get nothing. We are a very security conscious organization with procedures in place for password protection. As I said the account details are not recorded anywhere except with AWS. And noting some other posts on various forums are saying the same thing occurred with them on the same day. Possible security breach AWS?Now we have been locked out for 5 days with all services down and bluntly nothing but lip service from AWS. They run around like headless chooks and al you get is "stock standard responses" without any real action occurring. So far my bill from my client is $48,000 for the SLA we have in place. At the rate this is going and lack of genuine concern (Other than stock standard replies) it will take weeks to fix.I expect in view of the legal letters we have from the client the $100,000 a year contract is about to be terminated. At the rate of responses from AWS the SLA will be over $100,000 in any event.Lots of polite talk from AWS but no action.Appalling behavior without consequence. Well AWS, 2 people have already been laid off 7 days before Xmas because you can't bother to fix this. A business is about to lose everything because you refuse to deal with this promptly and efficiently.I will not be able to take legal action because I don't have the money to fight this giant and they know this. Disgraceful.I should also point out that as our mail server was hosted on our account and hacked we did not have access to the account email so they refused to answer despite providing both legal information and a Stat Dec to prove our identity. We were then forced to quickly build a new mail server (on Azure) and recreate our accounts just so they would listen to us. Again more money out the door.With the AWS system it appears easier to hack the solution than prove you are the actual owner. It is shame they did not take the question of changing email addresses and password as seriously as they do to prove you actually own the account!CommentShareAWS-User-8986118answered a year agorePost-User-7554746 4 months agoI am facing the same and dont know how many people facing the same issue. My ticket is not yet closed and for resolution they asking me to add payment method.ShareF_UCKYOUAWS 2 months agoI recently have the same issue.April 11, 2023 5:14AM My time. I recieved an email saying that AWS has detected an unusual log in activity.April 11, 2023 5:16AM My time. I recieved an email saying that my account email was changed to be new weird email.I did not noticed this acitivity untilI found that there is a transaction in my credit card one day later that is charged from AWS.They not even ask for verification code for changing the email. It looks so easy when someone just took my account.When trying to restore password. It said my account (with my email) does not exist.ShareF_UCKYOUAWS 2 months agoAnd my password is not too simpleShare2I have a similar issue , the support center conveniently closes your case without resolving it. So fed up with them.CommentShareAWS-User-4240157answered a year ago2I have the same problem, almost a month ago, I already filled out the form, I've exchanged more than 30 emails with support and they can't solve my problem, I've never seen such bad support in my life. Please someone help me.I had to create another account putting another credit card, to be able to write in this topic. And I'm afraid they'll clone this account too. What a sad service you guys provide with support.CommentShareLeonardo Zanettanswered 10 months ago2Hi,i receive the mail "Your Amazon Web Services Account Email Has Been Updated" but i don't ask to change my mail!! My account is hacked! I just provide to lock the credit card assocatiated to my aws account. I write to support 2 times but i don't receive any feedback.Plese provide to restore the correct account acccess with temporary password.CommentShareDanieleanswered 3 months ago1It all started with mail received from Amazon web Services with Subject "Your AWS account compromise". I simply ignored bearing rhe fact that, I am not using the account from last 4 years and thought it might be a spam/phising mail. At the start of next month, I received another mail with bill amount $87.41 approximately 263790.24 INR. When i tried to login I found my password goy changed along with MFA mobile number. Thats raises a question, AWS mfa is as good as account without MFA. I raised support ticket and aws team disabled MFA temporarily and asked me to reset my password and try. Thankfully able to login again to see, unauthorized resources been triggered (ECS containers in 3 different regions) which costed this heft bill amount. From cludwatch taril logs it is quite evident that it was via root account ( question is AWS root account is not secure with MFA then what other security option one is having). I replied to support case after deleting all unauthorised resources. Support team insisting me to add payment method since my credit card trough which I registered my account expired (Question is luckily it got expired else the unknown aws hacker might have debited amount from my credit card).  In every reply they forcing me to add payment method to keep my account active and assist further and then settling the bill amount. Luckily, there system not allowing me to add update credit/debit card but only netbanking with few registered bank. I added the same. The response was shocking, you either to to edit the payment method and match existing one. Trust me - you peole understand it yourself who is the culprit.CommentSharerePost-User-7554746answered 4 months ago1I am in exactly the same situation as Daniele. My account has been hacked and the email address associated with it has been changed. The support team is not able to help me, and they don't even seem to understand the situation. I have opened at least 10 tickets regarding this issue.CommentShareegehananswered 2 months ago0I recently have the same issue.April 11, 2023 5:14AM My time. I recieved an email saying that AWS has detected an unusual log in activity.April 11, 2023 5:16AM My time. I recieved an email saying that my account email was changed to be new weird email.I did not noticed this acitivity untilI found that there is a transaction in my credit card one day later that is charged from AWS.They not even ask for verification code for changing the email. It looks so easy when someone just took my account.When trying to restore password. It said my account (with my email) does not exist.Submitted ticket to Compliance team and did not even recieved any email confirmation or ticket number to say that my case is being taken care of.I need to register my new account with the same email to comment here.CommentShareF_UCKYOUAWSanswered 2 months ago-3I'm sorry to read this.  The only thing I can think of would be to contact your card company to try to block further charges against your card?I know this is too late but if you have any other accounts I would strongly advise configuring MFA and following other steps highlighted on the IAM best practices page: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.htmlGood Luck!CommentShareDaniel Craigieanswered a year ago-4Hello,I'm sorry to hear this! It sounds like you've already filled out the following contact form to reach our Support team: http://go.aws/account-support.I recommend refraining from creating additional cases to prevent any confusion or delay in receiving assistance. Our Support team has the proper tools to help recover your account. They will also be able to assist with any account or billing questions you may have.As we take security very seriously, this process may take some time to investigate and resolve. Thank you so much for your patience while our agents work on your case.Best regards,Kita B.CommentShareEXPERTAWS Support - Kitaanswered a year agoAWS-Sales-Jennifer a year agoIs there a time to response, for customer to have an answer or confirmation that their request was received and is under review?Thank youShare-4Good day.I am sorry to hear the issue you are having.First, if your root account was compromised then please:As was stated earlier, if you have already opened an AWS support account, then please refrain from opening additional cases as this may cause a delay in response.If you do not have access to the account, then please create a NEW account and open a ticket to AWS Support using Support Center, referencing the account that was compromised and providing the e-mail address that was compromised.If this was a linked account, or an account within AWS organizations, then please open a ticket via support center from the payer account.Once access to the account (root user access) has been restored, please ensure you follow practices in this guide: https://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/Again, please correspond on the initial support case opened so our internal teams can rapidly support you during this issue. Ensure all details specific to your account, yourself, and the security event are kept within the Support ticket.Sincerely,Jason H.CommentShareJason_Hanswered a year agoArticle89 a year agoHi Jason, I have this exact same issue. Support ticket 9435149501. I got an email from AWS saying that the email associated with my account had been changed. I did not authorize this, so I had to create a new account like step #2  above, and opened a ticket, and called support. They wouldn't help me because I could not recall the account number!! Surely there has to be some kind of log showing that this happened. Then over the weekend I see a $7600 USD charge on my credit card from AWS. So I opened Support ticket 9435149501. Support doesn't seem to understand the issue and I am really stressing out over this. I've cancelled the card so they can't do anymore damage. I've provided the transaction ID on the ticket. It should be glaringly obvious that the account generating that charge is the hacker and needs to be shut down immediately.Share"


Question: Add an email endpoint using CLI

"Hi,I'm trying to "add a new" email endpoint using the aws cli and I run into this error:An error occurred (NotFoundException) when calling the UpdateEndpoint operation: Resource not foundAny help is appreciated.Below is my command and payload. The endpoint-id below is a guid which I generated.$ cat cmd aws pinpoint update-endpoint \ --application-id testProject \ --endpoint-id "43498e83-9dae-4ce6-bb12-8e08e3699776" \ --endpoint-request file://newemailuser.json$ cat newemailuser.json {  "ChannelType": "EMAIL",  "Address": "user@example.com",  "OptOut": "NONE",  "Attributes": {    "interests": [      "technology",      "music",      "travel"    ]  },  "Metrics": {    "technology_interest_level": 9.0,    "music_interest_level": 6.0,    "travel_interest_level": 4.0  },  "Demographic": {    "AppVersion": "1.0",    "Make": "apple",    "Model": "iPhone",    "ModelVersion": "8",    "Platform": "ios",    "PlatformVersion": "11.3.1",    "Timezone": "America/Los_Angeles"  },  "Location": {    "Country": "US",    "City": "Seattle",    "PostalCode": "98121",    "Latitude": 47.61,    "Longitude": -122.33  },  "User": {    "UserAttributes": {      "name": [        "John",        "Doe"      ],      "gender": [        "male"      ],      "age": [        "39"      ]    },    "UserId": "john_doe"  }}Edited by: kmyn on May 28, 2019 9:44 AMFollowComment"

Answer: "0Hi kmyn,It looks like you're passing the name of the Pinpoint project for the application-id parameter. You need to pass the alphanumeric ID.You can find the ID by using the get-apps command in the AWS CLI.Hope that helps!Brent @ AWSCommentShareAWS-User-4207280answered 4 years ago0Hi Brent,This worked perfectly thanks. Some followup questions:How do I verify recipient endpoints? So as to send emails to them.How do I create an unsubscribe like for a recipient when I send the email?If an email is verified in SES, can the same be used in Pinpoint ?Thanks.CommentSharekmynanswered 4 years ago0Glad to hear it worked!If you're planning to send emails to external recipients, you have to submit a request to have your account removed from the Pinpoint sandbox. When your account is out of the sandbox, you can send email to any recipient without having to verify the address first. For more information, see https://docs.aws.amazon.com/pinpoint/latest/userguide/channels-email-setup-production-access.html.Currently, you have to create a system to handle unsubscribe requests. Our Developer Guide contains a tutorial that you can follow to set up an unsubscribe/preference management system. For more information, see https://docs.aws.amazon.com/pinpoint/latest/developerguide/tutorials-email-prefs.html.If you previously verified an email address or domain in Amazon SES, you can use that address or domain to send email through Amazon Pinpoint.Thanks,BrentCommentShareAWS-User-4207280answered 4 years ago"


Question: EIP locked to my account and unable to be released

"Hi, i'm having a spot of trouble releasing an EIP from my account. It's not associated with anything (neither instances nor nat gateways), and it's had it's reverse DNS record already removed by following the below article.https://aws.amazon.com/premiumsupport/knowledge-center/ec2-address-errors/I've also tried spinning up an instance, associating the EIP with the new instance and then disassociating it as suggested elsewhere on this forum but that didn't work either.This is the error that the console displays when I try to release the EIP-54.79.76.74: The address with allocation id [eipalloc-07ede6f954050e3d5] cannot be released because it is locked to your account. Please contact AWS Support to unlock it.I've tried everything I can think of and am out of ideas, and would greatly appreciate any help I can get.Many thanks in advance.FollowCommentMunkhbat_T SUPPORT ENGINEERa year agoHave you received any confirmation of rDNS removal?Share"

Answer: "1An EIP is locked to an account as per customer request in two situations 1) You want to configure and rDNS record for the EIP or 2) You want to disable accidental release of the EIP from your account. A quick look at the EIP indicates that there is no reverse DNS record set for the EIP, so it looks like the latter case. You need to create a support ticket to unlock the EIP from your account. Once the EIP is unlocked, you can release it (provided it is not associated with any resource)CommentSharesumitawsanswered a year agoAWS-User-7782468 a year agoHi, I have this problem also, and I already removed the rDNS record, so I think I am in case #2.May I ask, how to "create a support ticket to unlock the EIP from my account"?Thanks.host 18.138.215.68   <-- This is my EIP68.215.138.18.in-addr.arpa domain name pointer ec2-18-138-215-68.ap-southeast-1.compute.amazonaws.com.Share"


Question: Workmail Dissifulties Sending SMTP Based Email

"I am trying to set up WorkMail to use for my personal email domain.I have my organization set up and working. I can send email to the domain fine. If I log into the WorkMail web interface I can send emails from work mail. However if I set up my mail client to connect via IMAP and SMTP, emails get sent from the email client, but are never received.FollowComment"

Answer: "1Funny enough, after about three days of trying to figure this out... and turning on logging.. it all seems to be working!Thanks Robin, your advice was magic. :-)CommentShareTomanswered a year agorobinkaws MODERATORa year agoHi Tom,That is good to hear that it now works.Kind regards,RobinShare0HI,I'm sorry to hear you're experiencing problem sending mails via WorkMail SMTP. Do you receive any error message via a bounce? You can enable WorkMail message tracking to see if any error message is logged: Documentation. Could you also share the SMTP settings you have used?Kind regards,RobinCommentShareMODERATORrobinkawsanswered a year ago0Hi.The outgoing email server is: smtp.mail.us-east-1.awsapps.com:465:1Requires Authentication EnabledRequires SSL is enabledUse the same credentials for sending as receiving is enabled.The emails appear to send correctly from the client, no errors reported. They just never get delivered.CommentShareTomanswered a year ago"


Question: Space in Amazon Codecatalyst

Can I have multiple spaces under the Amazon Codecatalyst standard tier?FollowComment

Answer: "10Your AWS Builder ID allows you to have up to 5 spaces created each month and they can all be set to their own tier setting, but they have to be associated with their own unique AWS Account ID. Currently, each space has to have its own individual AWS account ID for billing purposes.Link to docs with more details: https://docs.aws.amazon.com/codecatalyst/latest/userguide/ipa-billing.htmlCommentShareMODERATOReiananswered 6 months agoMODERATORSundaresh_Ireviewed 6 months ago2Today you can have up to 5 spaces per User in CodeCatalyst. Each space can then have up to 1000 projects.This is something I learned in a Chalk Talk at re:Invent 2022.CommentShareLockheadanswered 6 months ago"


Question: Custom ecs-optimized Amazon Linux 2 for Batch

"Following https://docs.aws.amazon.com/batch/latest/userguide/create-batch-ami.html, it says to stop the Amazon ECS container agent w/ "sudo stop ecs". That throws an error, i assume you meant "sudo systemctl stop ecs"?I need the image to do some setup before it starts accepting containers. I understand that User Data is suggested for this (https://docs.aws.amazon.com/AmazonECS/latest/developerguide/example_user_data_scripts.html). However i found creating a custom systemd service and installing/enabling it before creating the custom AMI is a much cleaner solution. I haven't found much documentation on creating custom systemd on ecs-optimized Amazon Linux 2. The created image does correctly run the custom systemd service. Is there any potential problems with this approach instead of using User Data?FollowComment"

Answer: "0The documentation was updated to show how to stop the ECS servicesudo stop ecswas for SysV init systems whilesudo systemctl stop ecswas for systemd systems.Custom systemd service continues to work well and is portable, so i stuck with that. It basically sets up some tmpfs/ramfs file systems to avoid EBS charges (traffic, storage and IO charges) during compute and sharing large input files across containers on the same instance.CommentShareparker9answered 4 years ago"


Question: "my EC2 instance pem key file is lost, how to connect to EC2 instance from my linux terminal"

"Hi my EC2 instance pem key file is lost,I can not access to my instance without key pem filehow to connect to EC2 instance from my linux terminal ?ssh -i "sx.pem" ubuntu@ec2-xx50-240-2xx.ap-northeast-1.compute.amazonaws.comThanksFollowComment"

Answer: "1Accepted AnswerI have used the following method to solve my issue:(1) create a new instance which is same zone as the old one that the key file is lost with new pem key file named file2(2) stop the old instance(3) Detach volume of old instance(4) attach the volume of old instance to the new instance(5) Log in the new instance with ssh and new key file from terminal , do the following linux command:--sudo mkdir /mnt/tempvol-- sudo mount -t ext4 /dev/xvdf1 /mnt/tempvol--cp .ssh/authorized_keys/mnt/tempvol/home/ubuntu/.ssh/authorized_keys--sudo ls -l /mnt/tempvol/home/ubuntu/.ssh--sudo umount /mnt/tempvol(6) attach the volume of old instance with old volume dirt path like: /dev/sda1(7) access to old instance with the new key file from terminalCommentSharerePost-User-4153445answered 2 months ago1https://repost.aws/knowledge-center/user-data-replace-key-pair-ec2CommentSharetedtrentanswered 2 months agoEXPERTalatechreviewed 2 months agorePost-User-4153445 2 months agoHi thanks. But method1 did not work. The video related to the above method has been posted to YouTube. Others have same conclusion that method 1 did not work. I hope AWS could give more details or take seriously to solve this issue.Share1The first responder gives a great set of answers.Given different use-cases, it is often more secure to use Systems Manager Session Manager instead of SSH keys.For your viewing pleasure…Introducing Session ManagerUsing Session Manager to replace SSHFor my purposes, and assuming you have a recent EC2 version, I often use session manager to recover (or replace) SSH access.FirstCreate an IAM instance profile that enables Session Manager access and update the EC2 instance with this instance profile.In IAM, create a role with this policy - AmazonSSMManagedInstanceCoreIn your EC2 console pane, select your instance, select the ‘Actions’ button on the top right and select the Security option, then choose the ‘Modify IAM role’.  It will provide you the list of available roles for this action.Once all is setup, it may take a few minutes for the agent on the instance to ‘connect’ and identify with Systems Manager…The Above ^^^^^ steps are sufficient for an instance provisioned in a Public Subnet…—However, IF your instance is in a PRIVATE SUBNET...you will need to create VPC endpoint services attached to the instance - subnet to allow direct access from your private network to the ssm services that enable the session manager connection.in the console select the VPC serviceon the left pane select the ‘endpoint’ option (aka ‘privatelink’ services )configure 3 endpoints and attach to the subnet your instance is in…ec2messagesssmssmmessagesfor recovery purposes, the cost is minimal.  But understand there is some cost.endpoint costsIt’s best to think of the above as private NAT’s that allow the routing of requests between your VPC and the AWS Public Network where Systems Manager livesIF YOU ARE IN A PRODUCTION NETWORK, ESP WITH OTHER SYSTEMS, THIS CAN AFFECT NETWORKING PATHS FOR EVERYONE, these create.  If you are working in an isolated environment, then this will only apply to your private instance.Now, your private network instance will be accessible via session manager.  GIve the system a few minutes to identify and connect internally and you will be able to access via the console ‘Connect’ option, or via CLI from your command line—This is a fantastic pattern for short term recovery efforts.This method does NOT use SSH keys.Once you have regained access to your instance, you will be able to re-create new SSH keys and update the public key on the instance.  This public key will be placed in the ~/.ssh/authorized_keys file.Good luck!CommentShareCamBeeleranswered 2 months ago"


Question: AWS Direct Connect vs Public/Private peering at IXP

"Consider a company present at an IXP at which also AWS is present. Similar to the 3 methods of connecting to AWS mentioned on https://aws.amazon.com/peering/, this specific IXP provides a document describing different ways of connecting to AWS, three of them being: (1) Settlement-free BGP peering with Amazon directly (Private Network Interconnect - PNI), (2) Settlement-free BGP peering through an IXP (I assume they mean public peering), and (3) AWS Direct Connect at the IXP.To my mind, the major selling points of DX, namely (i) (potentially) reduced path length (afforded by going through AWS's WAN rather than the public internet), and (ii) not being susceptible to any routing outages in the public internet, also apply to the peering connections (1) and (2) mentioned above.Question: Is is true that both BGP peering options (1) and (2), i.e. PNI and peering at an IXP, give the same path quality and independence of public internet routing because the company network directly peers with AWS and thus (assuming proper BGP configuration) routes through the "public internet" are not used.The only benefits I could see from DX over options (1) and (2) are that: (i) I can access my VPC without a VPN, and (ii) I can get bandwitdth guarantees between my company network and the AWS WAN.Question: What are the actual benefits from DX over peering options (1) and (2)?FollowComment"

Answer: "0The short answer to the first question is "yes". It's arguable that option (1) is "better" in the sense that peering directly with AWS means that the IXP network is taken out of the equation; and you're also not sharing the bandwidth from the IXP to AWS with anyone else. However, the setup time is longer and it's likely to have other costs associated with it.To the second and third questions: Yes, Direct Connect is a dedicated connection for you. Yes, it does deliver private access to VPCs (and Transit Gateway) rather than public access (which as you mention, means a VPN is required). Note that Direct Connect Public VIF provides for public connections as well.Why would you use Direct Connect? Because most customers are not set up to handle peering arrangements and they want private connections. It makes sense for large network providers to peer with AWS; but for most customers (not all, but definitely in the vast majority), Direct Connect is the best way forward.It's also offered as a service with many network partners meaning that hosted connections can be up and running in minutes (assuming the customer has some sort of existing connectivity with the network partner); or days (if they haven't or need to do cross-connects in points of presence).CommentShareEXPERTBrettski-AWSanswered 2 months agoEXPERTTushar_Jreviewed 2 months ago0Do take a look at this very recent blog that touches upon some of these concepts, see the 2 relevant sections from the blog:https://aws.amazon.com/blogs/networking-and-content-delivery/growing-aws-internet-peering-with-400-gbe/AWS peers with Internet Service Providers (ISP) either over an Internet Exchange (IX) or with private network interconnects (PNIs) directly in our border routers. The AWS Network has been built out over the course of more than a decade. Our goal is to peer with ISPs that operate infrastructure connecting end-users in every country in the world as locally and closely to their market as possible to reduce latency and increase capacity to the end-users. One of the primary internal users of our global network backbone is Amazon CloudFrontIn contrast to peering and the peering points described here, Direct Connect has a global footprint as well, operating in over 115 different locations around the world and offering connection speeds starting at 50 Mbps and scaling up to 100 Gbps. When AWS customers require the reliability and predictability of a private connection, Direct Connect is the answer. AWS customers that also operate peering networks are discouraged from transferring significant volumes of their own data over peering connections. This is because we acknowledge that peering connections aren’t individually maintained in the same robust manner as the Direct Connect service. Instead, they achieve resiliency through a meshed collection of direct and indirect peering paths.Direct Connect also offers features that peering simply doesn’t. Importantly, Direct Connect offers three different types of virtual interfaces. Private and Transit virtual interfaces allow direct access to customer VPCs. This means that there is no need to expose their AWS resources to the public internet if you don’t want to. A Public virtual interface provides access to public endpoints such as Amazon Simple Storage Service (Amazon S3), but customers are in control of the AWS Regions that they allow access. This last point is where there is a key and distinct difference between internet peering and Direct Connect.CommentShareEXPERTTushar_Janswered 2 months ago"


Question: TCP health check with NLB

"Hi All, I have a situation, where the service A (spring cloud application on Tomcat) to be deployed on EC2 (auto scaling group) using CHEF (deployment time ~10 mins). The servers are behind the NLB (cross zone load balancing enabled, sticky session disabled).Now the issue is, as soon as a server is brought in-service, the NLB passes the health check before the CHEF build completes; which means, the target becomes healthy but the service A deployment still in progress. This is causing an issue to other service B (running on different EC2 on diff ASG) which is trying to connect to service A.The Service B connection to service A fails if the request from NLB landed on the EC2 of service A in question.Since there is no option with TCP health check to set the health check path, one of the root causes I could think of is, as soon as Tomcat gets deployed, the NLB gets the health check response, which is sufficient to make the target healthy, whereas the service is still getting deployed on tomcat.Is there a way to handle this situation? Except replacing NLB with ALB.(*PS: application uses Spring Cloud Netflix patterns - Eureka, Config, zuul etc)FollowComment"

Answer: "0Is there a way to delay registration until the build/deployment has completed? Alternately, is there a way to avoid starting Tomcat until the build/deployment has completed?CommentShareEXPERTBrettski-AWSanswered a year agoSomesh a year agoYes, I'll give it a try but the issue is we use some cookbooks which are managed centrally by the chef engg. team however, as I said let me try this approach if that works. Thanks.Share0Hello,You'll want to delay the instances in ASG-A from being registered to the NLB until the application is done being installed.  You can do this by adding a Lifecycle Hook (LCH) to the ASG.  The last step if your CHEF cookbook should be to complete the lifecycle action with the CONTINUE action so AutoScaling registers the instance to the NLB's target group and moves the instance to InService.Also, since you mentioned it takes ~10 minutes, you may want to look into using a Warm Pool on the ASG if their isn't frequent changes to the application/data to be loaded on the instance.  A warm pool lets you pre-launch instances into an ASG, configure them (via a LCH), and then they're stopped.  When the desired capacity goes up, the pre-configured instances in the warm pool will be started, saving you lots of time.  Keep in mind that the launching LCH will run again when the instance is being moved to InService, so you'll either need to run the UserData again to apply any new updates + complete the hook, or trigger another process (like a lambda function) to complete the LCH, otherwise the instance will sit there in Pending:Wait and you'll lose all the time savingsCommentShareShahad_Canswered a year agoSomesh a year agoThanks. It helps. I'll be trying warm pool as well. The chef client runs automatically every 2 hrs to pull the latest changes from user-data, will what approach I need to take for completing the LCH.Share"


Question: Application Loadbalancer Ip

"Hi, I see While creating Loadbalancer, We need minimum two public subnets. Once LB is created, it shows me two IPs of LB Dns URL. Ex -non-authoritative answer:Name:   Lb1LoadBalancer-405154402.eu-west-1.elb.amazonaws.comAddress: 54.228.29.194Name:   Lb1LoadBalancer-405154402.eu-west-1.elb.amazonaws.comAddress: 52.30.70.94Does it mean these Public Ips are one from each Public Subnet ( or Availability zones) . I also tried using three Availability zones ( Each zone has Public Subnet) . But still DNS only shows Two Public Ips of LB Url. I was expecting it to show 3 Addresses. But it doesn't show that way. Is anything wrong with my understanding ? What will happen if one AZ goes down, Will the DNS still show two Ips ? I am confused.Any  one knows ?FollowComment"

Answer: "2Hi, for each AZ you configured the ALB will provision an Elastic Network Interface (ENI) in the corresponding subnet you've selected, and it will assign a private IP as well as a public IP address for the ENI.You could find all the ALB ENI and its public/private IP information at "EC2" > "Network & Security"  > "Network Interfaces". However please note that for the ALB to provision an ENI in a particular AZ, you need at least one instance (belongs to that AZ) configured in the ALB target group. I suspect you didn't have an instance in the 3rd AZ or was not configured in the target group, and so ALB didn't provision an ENI in that AZ and hence you are not getting the 3rd IP in the DNS response.CommentShareEXPERTSheng Chenanswered a year ago"


Question: Every active directory user lands on account settings of QuickSight

"I have integrated AWS Managed AD with QuickSight using AWS Identity Center.The problem I am facing now is, whenever I login using admin, author or reader user stored in AWS Managed AD, I can see the QuickSight application as shown below.When I click on the QuickSight application I land on the Account Settings page instead of going to QS dashboard.How can I configure it so that every user (admin, author or reader) logged in via SSO  lands on QS dashboard?FollowCommentIhtesham 4 days agoJust found the answer from stackoverflow:If you subscribe QuickSight with an active directory, you cannot use an IAM user or assume-role session to log in the product to access the dashboards or other assets. For an AD account, an IAM user with necessary permissions can only access the QuickSight console pages to manage the account settings, such as role-group mapping and unsubscription.Share"


Question: EC2 instance - multiple unexpected reboots

"HiInstance i-09fe0975866d2a733 in region eu-central-1 unexpectedly rebooted 3 times on 16Dec (approx 12:08, 17:13 and 17:30 UTC). I see occasional restarts due to hardware, but 3 times seems excessive. Can AWS see more details as to the cause of the reboots?ThanksFollowComment"

Answer: "0Hello,I looked into the logs of the instance i-09fe0975866d2a733 for December 16th. I noticed that we started observing issues with the underlying host around 12:02 UTC, we tried to perform recovery actions on the host and it did seem to respond. But the failures kept on re-appearing causing you to notice another reboot on 17:13. At 17:30 we marked the host as unhealthy and migrated the instance to a new host. I hope this clarifies the reason behind these 3 reboots.I understand that this failure is a great inconvenience for you as an AWS user. Please accept my apologies for this. I want to assure you that we make every commercially available effort to make sure Amazon Web Services is secure and resilient to provide you high reliability and massive scale.Regards,shubh-AWSCommentShareSUPPORT ENGINEERshubh-AWSanswered 3 years ago"


Question: Copy or share RDS Custom Snapshot from one region or account to another one

"I´ve been doing some research and tests in order to copy or share a snapshot of a RDS Custom SQL Server database, but to no avail.I got the next error when trying to copy the snapshot with AWS Backup:You can't copy a DB snapshot for an instance in RDS Custom.It does not work for cross-region or cross-account backups.And if I try to share a manual snapshot, I got the next error:You can't modify a DB snapshot attribute for an instance in RDS Custom.There's no way to share the CVE either, so I'm thinking that maybe I will need to create everything from scratch in the second region or second account, and then restore the SQL Server database with a native tool or something along the lines.Please advise, thanks!FollowComment"

Answer: 0as a workaround you can export the snapshot so S3 and share with your second account thenhttps://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ExportSnapshot.htmlor another methot use SSMS like tools to create and restore backup of your SQL Database instanceCommentShareEXPERTsedat_salmananswered 4 days ago


Question: "How do we correctly link the DC Gateway into the VPC, is a VG required?"

"I'm struggling to get my head around a lot of the AWS information.We have a Direct Connection and it's half working.  The DC Gateway has a virtual interface that links to my onsite hardware.Ping works.  BGP works.The DC has no other associated gateways.I think what I'm supposed to do is create a Virtual Private gateway that links to a VPC.  I can do this, and it sort of works, to the extent that the subnets that are in the VPC can be successfully advertised over the BGP session to my hardware.However, it doesn't actually work because I can't exchange traffic with IP addresses inside the VPC from my onsite hardware anyway.So what gives me pause here is when I try to create the Private gateway, the string appears:"A virtual private gateway is the router on the Amazon side of the VPN tunnel."but I don't want AWS to setup a VPN tunnel.  Also that VPG wants an AS configured, which implies that it wants to do BGP peering into the VPC with some device that's talking BGP back to it, which doesn't seem right to me.So how and where do I configure the VPC side of the DC gateway? Where do I type in a static IP that will be the default gateway for my VPC's subnet, so that the instances can send packets to that IP which will arrive at the hardware end of my AWS DC?Also -- with no traditional console access to the "router" that forms the AWS side of the DC, how do we do packet captures and other debugging to find out where packets are being lost?Edited by: DC-Client on Sep 1, 2021 4:25 PMFollowComment"

Answer: 0Accepted AnswerVirtual private gateway (VGW) is part of a VPC that provides edge routing for AWS managed VPN connections and Direct Connect connections. You associate a Direct Connect gateway with the virtual private gateway for the VPC.Use AWS Direct Connect gateway to connect your VPCs. You associate an AWS Direct Connect gateway with either of the following gateways:A transit gateway when you have multiple VPCs in the same RegionA virtual private gatewayYou can also use a virtual private gateway to extend your Local Zone. This configuration allows the VPC associated with the Local Zone to connect to a Direct Connect gateway. The Direct Connect gateway connects to an AWS Direct Connect location in a Region.refer-  https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.htmlCommentSharelearn2skillsanswered 2 years ago


Question: How to migrate my "m1.small" reserved instances to "t3.small"?

"I have an "m1.small" 3-year reserved instances which will be expired on July 31, 2023.The EC2-classic will be retired after Aug. 2022, so I have to migrate my EC2 classic instance to VPC by the deadline. Unfortunately, It looks like the "m1.small" instance type is no more available in the VPC.If I'd like to migrate my EC2 instance to "t3.small", how do I modify my "m1.small" reserved instances to "t3.small"?PS: I tried to modify the reserved instances, but no "t3.small" option in the available list.FollowComment"

Answer: "1Accepted AnswerIs your reserved instance Standard or Convertible? If it's convertible - you can use the exchange feature to change the instance family & generation, and select any instance family within the same region. However, if it's Standard, there's no way to change the instance family or generation, that's just the way Standard RIs are designed.Generally, RIs cannot be cancelled, or you cannot change the family or generation if it's Standard RI, however I still recommend opening a support case (billing support case) from the account where you purchased your RI. You can provide the region of RI and its lease ID (alphanumeric reservation ID) to support team, and ask them how they can help with replacement, considering that Classic platform is deprecated and you have to modernize your instance to run it in VPC.As a general rule, it is best practice to modernize your infrastructure and use most recent generation instances before you reserve. Newest generation instances always offer better performance for better cost.CommentShareEXPERTNataliya_Ganswered a year agoAWS-User-4230166 a year agoIt's a Standard RI. Thank you for the detailed explanation and suggestion. I will submit a support ticket to see if they can help.Share0Here are a couple of resources to help migrate from EC2-Classic and older generation instances:Migrate from EC2-Classic to a VPCPrevious Generation InstancesCommentShareEXPERTkentradanswered a year agoAWS-User-4230166 a year agoI have read these documents but I cannot find the answer to my question.My question is:How do I migrate my "m1.small" reserved instances to "t3.small" due to the "m1.small" is no more available in VPC?Share"


Question: S3 Bucket policy - not accessible by anyone anymore

"Hi, this morning logged in my admin account I inserted a bucket policy like this one:{"Version": "2012-10-17","Id": "Policy1415115909153","Statement": [{"Sid": "Access-to-specific-VPC-only","Principal": "","Action": "s3:","Effect": "Deny","Resource": ["arn:aws:s3:::awsexamplebucket1","arn:aws:s3:::awsexamplebucket1/*"],"Condition": {"StringNotEquals": {"aws:SourceVpc": "vpc-111bbb22"}}}]}for my bucket and my vpc. Now I'm not able to access the bucket nor remove the policy, the same for the root user. Is it possible to do something? I don't want to delete the bucket....Many thanks!Sebastiano RotaFollowComment"

Answer: "0Accepted AnswerHi all,thanks you all for the support. Yesterday I clarified with the customer and there was probably a misunderstanding.Yesterday he was able to delete the policy using the root account.One more time, thank you all for your time.SebastianoCommentSharerePost-User-7809399answered 19 days ago0You can remove bucket policy using root account.please take a look below steps.https://repost.aws/knowledge-center/s3-accidentally-denied-accessCommentShareHyeonanswered 22 days agoEXPERTBrettski-AWSreviewed 22 days agorePost-User-7809399 22 days agoAlready tried....didn't work, same error we have with a non-root usersShare0If you have denied access to all principals including the root user, you may need to use another IAM user or role that has the necessary permissions to remove the bucket policy.Firstly, check if there is any IAM user or role that has permissions to remove the bucket policy. If there is none, then you will need to create a new IAM user or role with the necessary permissions to remove the policy.To create a new IAM user with the necessary permissions, follow these steps:Sign in to the AWS Management Console using an IAM user or role that has the necessary permissions to create new IAM users.In the AWS Management Console, navigate to the IAM console and create a new IAM user.After creating the IAM user, attach an appropriate policy that allows the user to remove the bucket policy.Sign out of the AWS Management Console and sign in as the newly created IAM user.Navigate to the S3 console and remove the bucket policy.Once the bucket policy is removed, detach the policy from the IAM user.If you don't have the necessary permissions to create an IAM user, you may need to contact AWS Support for assistance. Additionally, AWS support can help you troubleshoot and recover from issues like this.CommentShareYasseranswered 22 days agorePost-User-7809399 22 days agoJust tried, created a new User with AmazonS3FullAccess +"Action": ["s3:PutAccessPointPolicyForObjectLambda","s3:PutAccountPublicAccessBlock","s3:PutBucketPublicAccessBlock","s3:PutMultiRegionAccessPointPolicy","s3:DeleteBucketPolicy","s3:BypassGovernanceRetention","s3:ObjectOwnerOverrideToBucketOwner","s3:DeleteAccessPointPolicyForObjectLambda","s3:PutAccessPointPublicAccessBlock","s3:PutObjectVersionAcl","s3:PutBucketAcl","s3:PutBucketPolicy","s3:DeleteAccessPointPolicy","s3:PutAccessPointPolicy","s3:PutObjectAcl","s3:GetAccountPublicAccessBlock","s3:GetBucketPolicy","s3:GetBucketPolicyStatus","s3:GetBucketOwnershipControls","s3:GetBucketAcl","s3:GetBucketCORS","s3:ListBucket"but no way....In the Buckets home page under Access -> Error message, when I go in the bucket -> Insufficient permissions to list objects, when I consult Permission tab -> You don't have permission to view the Block public access (bucket settings) configuration, You don’t have permission to get bucket policy, You don't have permission to view Object ownership (bucket settings) configuration, etc....What can I do? Thanks.Share0You have a condition for source VPC.Do you have an s3 gateway setup? If not, create one and then try accessing the bucket so long as the vpc equals the one in your policy.CommentShareGary Mcleananswered 22 days agorePost-User-7809399 20 days agoDo you mean, try to access to S3 bucket not from the internet but from for example a EC2 instance from the internal VPC by using a Gateway endpoint?Share0The policy above contains a lot of issues. While it is excellent to have an explicit deny, you must also put an explicit allow for the VPC from where it should be allowed.The denied S3 actions also do not contain a wildcard - probably AWS does not cover this case to warn the user that this policy blocks everything.I recommend to you to connect to AWS Support on it (Go to AWS Support in the AWS Console)CommentShareJ Frankeanswered 21 days agorePost-User-7809399 20 days agoHi, thanks for the answer. We have only the basic support, do you suggest the Support to have the issue reselved by them? Do you know if it's free?Share"


Question: Monitron Gateway Connection Issue

"I am trying to connect the gateway to my project using the Amazon monitron mobile app. After setting the gateway into commissioning mode, the app locates the gateway and attempts to connect via Bluetooth. It fails at this stage of the registration each time. Any ideas?FollowComment"

Answer: "0Have you checked the troubleshooting page for the Gateway documentation - it might have hints that allow you to identify the problem.If the issue still persists, I recommend resetting the gateway to factory settings and trying again.CommentShareJohann Fuechslanswered 17 days ago"


Question: Are i3 NVMe SSD drives encrypted by default?

I have a customer exploring the i3 and encryption at rest is a requirement.  Are i3 NVMe SSD drives encrypted by default or will customers need to implement their own encryption?FollowComment

Answer: 0Accepted AnswerThe public documentation has been updated for EC2 Linux and Windows:The data on NVMe instance storage is encrypted using an XTS-AES-256 block cipher implemented in a hardware module on the instance. The encryption keys are generated using the hardware module and are unique to each NVMe instance storage device. All encryption keys are destroyed when the instance is stopped or terminated and cannot be recovered. You cannot disable this encryption and you cannot provide your own encryption key.CommentShareAWS-User-2813056answered 5 years ago


Question: SES 'Invalid domain' error message

"Hi everyone,I´m a heavy user of the SES, and since yesterday, I started to receive a lot of errors like the one below:Reporting-MTA: dns; amazonses.comAction: failedFinal-Recipient: rfc822; xxx.xxx@sulamerica.com.brDiagnostic-Code: smtp; 550 5.4.4 Invalid domainStatus: 5.4.4sulamerica.com.br is a valid domain, and it works when I send an email from my Gmail account.I receive that same error sending messages to different domains.Looks like a DNS problem on SES/AWS.Is anybody suffering from this same issue?Kind regards,GustavoFollowComment"

Answer: "0Good afternoon Gustavo, did you manage to solve it? I have the same problem. I didn't find anything abnormal, because it worked and it started from nothing. I use CloudFlare.CommentSharevzanellatoanswered 5 months agogubatuba 5 months agoHi vzanellato, no, it is still heppening. I hope someone from aws support read this post, and manage to solve the issue.Kind regards,GustavoShare0Did you find out anything about this issue?I have the same problem for several domains.CommentSharefcoelhoanswered 5 months ago0Hi all,I had to signup for support, and open a case to solve it.I receive feedback today saying the issue was solved.Today, I received no errors so far.Kind regards,GustavoCommentSharegubatubaanswered 5 months ago"


Question: How can I put JDBC or ODBC queries into a workgroup?

"How can I put JDBC queries into an Athena workgroup other than "primary"?The docs describe a way to allow an IAM user to use the Athena workgroup, but it seems that the user then needs to select the workgroup explicitly e.g. in the Athena dashboard, but I don't see how to do that via JDBC.FollowComment"

Answer: 0Found it in the JDBC driver docs pdf from Simba: there's a property called "Workgroup"CommentSharemikepii3answered 4 years ago


Question: How to fix nginx error logs

"Hi,We need urgent help. We are getting the following nginx error logs while running our Android app which is keeping the app loading time too high. And very frequently app is getting down. The logs are mentioned here.[error] 4537#0: *140191 recv() failed (104: Connection reset by peer) whilereading response header from upstream,[error] 4538#0: *140575 recv() failed (104: Connection reset by peer) whilereading response header from upstream,[error] 4537#0: *140520 recv() failed (104: Connection reset by peer) whilereading response header from upstream,[error] 4538#0: *140587 recv() failed (104: Connection reset by peer) whilereading response header from upstream,[error] 4539#0: *140944 recv() failed (104: Connection reset by peer) whilereading response header from upstream,[error] 4540#0: *140942 recv() failed (104: Connection reset by peer) whilereading response header from upstream,[error] 4538#0: *141259 recv() failed (104: Connection reset by peer) whilereading response header from upstream,[error] 4538#0: *141241 recv() failed (104: Connection reset by peer) whilereading response header from upstream,Appreciate your urgent attention on above errors.Thank in advance,FollowComment"

Answer: "0What language do you use for your backend? If it's PHP, you may be able to fix the problem by reading this https://serverfault.com/questions/543999/104-connection-reset-by-peer-while-reading-response-header-from-upstream-nginxusually it's about nginx not being able to connect to the upstream (your backend application)try to restart your backend, if the problem persists, look at the logs of those with whom you launched your backend, this one may not have enough RAM, in which case you will have an error 137Did I help you?CommentSharerePost-User-9258623answered 8 days ago"