Question: DeepLense cannot deploy sample model anymore

"I got a DeepLens v1.1 with Software version 1.4.9 running. I used to have the Object detection sample model deployed what worked fine. I never deployed any other model.Now I removed it and wanted to deploy the Head-Pose-detection model.However, it keep downloading forever and after several retries downloads up to 52% and then fails with error"Deployment of project Head-Pose-detection, version 0 failed.11/8/2022, 3:25:37 PM: An error occurred during deployment. Greengrass deployment failed".Same happens when I try to re-deploy the previous model.I connected my Windows 11 computer via Registration USB port and tried to access device settings but Windows tells me the device cannot be used. Then I tried same on Windows 10 computer. This time I was told that "the device can be used" but still I cannot connect, it keeps spinning forever without detecting the cam.I logged on via HDMI and tried update manually but looks like 1.4.9 is up to date.Also in cloudwatch I see no error in the logs.Any idea what I can do?FollowComment"

Answer: "0Accepted Answersince deeplense is officially decommissioned, I think we can close this.CommentShareMarcoanswered 2 months ago0Check the cause in AWS IoT, Manage, GreenGrass Devices, Groups(V1), then your deeplens. Hover over to "failed" in Deployments tab.CommentShareJoohonganswered 2 months ago"


Question: AWS Inspector to scan local VM on-premise

"Hello,I would like to ask about the possibility to run Inspector Scan from AWS account to scan VMs which are existing in on-premise network.If that doable, any step by step documents will be highly appreciated .ThanksFollowComment"

Answer: "1Accepted AnswerAt this stage, Inspector (newer version) does not support scan on prem servers. It is only works for EC2 instances. There is an existing feature request for this already. I have no ETA on it but I can see that there is a lot of interest in it.HTHCommentShareAdeshGanswered a year ago"


Question: Can I use AWS Credit to purchase Reserved Istances?

"I've already looked for it in any email and Q&A/Faq all over the AWS environment but I can't find if it is possible to use my AWS Credit to purchase a Reserved Instances and/or a Reserved Amazon RDS. Does anybody know if I buy one, the billing system will use this credit or if it's not intended for this purpose? Thank you very much in advance to everybody who will help me!FollowComment"

Answer: "1AWS credits can't be applied to the upfront costs associated with Reserved Instances. If your credits include Amazon EC2 as an applicable service, they're applied to the discounted hourly rate for any Reserved Instances- https://aws.amazon.com/premiumsupport/knowledge-center/purchase-ec2-ri/CommentShareAWS-User-0520919answered a year ago-2No. Reserved Instances require an upfront payment, with one to three years of commitment based on estimated usage, which AWS Promotional Credit are not designed to support. https://aws.amazon.com/vi/premiumsupport/knowledge-center/credits-ri/CommentShareVan Hoang Khaanswered 10 months ago"


Question: php 7.4 for Linux AMI 1

Is it possible to upgrade php to version 7.4 running Linux AMI 1?FollowComment

Answer: "0I doubt it, considering Linux 1 is approaching EOL.CommentShareDavid Ganswered 2 years ago0In the current phase of its life (Maintenance Support - see https://aws.amazon.com/blogs/aws/update-on-amazon-linux-ami-end-of-life/ ), we won't be bringing new versions of language runtimes to Amazon Linux 1.There is PHP 7.3, which is supported until December 6th 2021 (see https://amazonlinux.github.io/al1-support-statements/support_info_by_support_statement.html#eol_php73-common which is linked from the FAQ here https://aws.amazon.com/amazon-linux-ami/faqs/ ).CommentShareAWS-User-1004892answered 2 years ago0Hi Stewart,Many thanks for the confirmation.Cheers,IngerCommentShareingeranswered 2 years ago"


Question: Cannot get developer authenticated identities to work

"We have setup an Identity Pool with our own Custom provider. On our backend (node sdk v2), we are calling .getOpenIdTokenForDeveloperIdentity() and we are successfully getting back OpenID tokens for our users.But then, both with iOS SDK (using AWSCore from Mobile SDK) and with a JS Client, we are receiving this error when calling .getCredentialsForIdentity():Invalid identity pool configuration. Check assigned IAM roles for this poolHere is the code:await Cognito.getCredentialsForIdentity({      IdentityId: identity,  // received from our backend      Logins: {        'cognito-identity.amazonaws.com': openIdToken, // received from our backend      },    }).promise();Role assumed by authenticated users has this Trust Relationship set:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "Federated": "cognito-identity.amazonaws.com"      },      "Action": "sts:AssumeRoleWithWebIdentity",      "Condition": {        "StringEquals": {          "cognito-identity.amazonaws.com:aud": "<Identity Pool ID>"        },        "ForAnyValue:StringLike": {          "cognito-identity.amazonaws.com:amr": "authenticated"        }      }    }  ]}And the OpenID Token generated with the .getOpenIdTokenForDeveloperIdentity() API looks like this:{  "sub": "<User Identity ID>",  "aud": "<Identity Pool ID>",  "amr": [    "authenticated",    "<our custom Provider Name, e.g. example.com>",    "<Custom Provider Name>:<Region>:<Identity Pool ID>:<User ID of our backend>"  ],  "https://aws.amazon.com/tags": {    "principal_tags": {      "userType": ["client"]    }  },  "iss": "https://cognito-identity.amazonaws.com",  "https://cognito-identity.amazonaws.com/identity-pool-arn": "<Identity Pool ARN>",  "exp": 1615736591,  "iat": 1615650191}We can't figure out what we are doing wrong. We believe to have done all steps as they are documented...FollowComment"

Answer: "0After almost a day.... the problem turned out to be "PrincipalTags".const cognitoResponse = await Cognito.getOpenIdTokenForDeveloperIdentity({    IdentityPoolId: '<Identity Pool ID>',    IdentityId: '<Identity ID>',    Logins: {      '<provider name>': userId,    },    PrincipalTags: { // THIS IS THE ISSUE      'userType': 'client',    },    TokenDuration: 86400,  }).promise();I don't know why, but I got it working by removing it ...CommentSharevacumanswered 2 years ago0I also faced the same issue.It seems that sts:TagSession must be allowed to getCredentialsForIdentity.There are details in the document below.https://docs.aws.amazon.com/en_us/IAM/latest/UserGuide/id_session-tags.htmlCommentSharearstknanswered 2 months ago"


Question: MFA for AWS Managed Microsoft AD

"Here https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_getting_started_prereqs.html , in Multi-factor authentication prerequisites it is said that :To support multi-factor authentication with your AWS Managed Microsoft AD directory, you must configure either your on-premises or cloud-based Remote Authentication Dial-In User Service (RADIUS) server in the following way so that it can accept requests from your AWS Managed Microsoft AD directory in AWS.Does the AWS provide "cloud-based Remote Authentication Dial-In User Service (RADIUS) server" service? Or we really need to setup something our own? Cant we have the same MFA solution, as in the default for AWS SSO "Aws sso identity store"?FollowComment"

Answer: "1Accepted AnswerFor Managed AD you must deploy a RADIUS server, you can do so on an EC2 instance in your environment if you'd like but it doesn't have a native solution built in.CommentShareEXPERTRob_Hanswered a year ago"


Question: Opensearch VPC endpoint

"Hi,We have an elasticsearch runs in Acc: A withiin VPC access. Application runs on acc:B need to connect this elasticseach(Two dfferent acc), using the latest feature VPC endpoint(verifed the acc:b in Authorized principals) the  trying to connect but still failed to connect.FollowComment"

Answer: "0Please refer this article for referencehttps://docs.aws.amazon.com/opensearch-service/latest/developerguide/vpc-interface-endpoints.htmlPlease make sure on the autorize principal, you have given the correct AWS account number.CommentShareAWS-User-7653869answered 6 months ago"


Question: How to protect EC2 against intermittent DDos attack

"Hi, I currently have 4x EC2 instances, each host around 70-80 websites. They each run WHM/cPanel software so that I can split accounts between customers.I am having an issue with one of those instances, whereby 2 specific websites on 1 account keep getting targeted and a DDOS type attack increases the server load to 100+ to the point that services crash and forces other websites offline. I have dealt with this for about 6 months but my customers are now getting annoyed.The attack occurs 3-4 times per day, last for around 1 hour (unless I notice first and deny the IP in the WHM firewall software) and it is multiple POST requests per second on each of the 2 websites.I cannot use Cloudflare for these websites, because the domain names use the .scot.nhs.uk suffix which cloudflare sees as a subdomain and Enterprise account is required which is $1000+/year which is well above what these 2 customers pay for their account.I am wondering if AWS had any solution that would help me to protect my instance from these attacks, or prevent them from happening.Thank you.FollowComment"

Answer: "0We can make use of ALB (Application Load Balancer) and/or CloudFront to mitigate DDoS.Please refers the the whitepaper for more details: https://d1.awsstatic.com/whitepapers/Security/DDoS_White_Paper.pdfCommentShareronald_lanswered 7 months ago0Suggest looking to front your application with CloudFront or AWS Global Accelerator or Amazon Route 53 as applicable. Some important points when you leverage these services:Benefits of using CloudFront, AWS Global Accelerator, and Amazon Route 53 include:• Access to internet and DDoS mitigation capacity across the AWS Global Edge Network. This is useful in mitigating larger volumetric attacks, which can reach terabit scale.• AWS Shield DDoS mitigation systems are integrated with AWS edge services, reducing time-to-mitigate from minutes to sub second.• Stateless SYN Flood mitigation techniques proxy and verify incoming connections before passing them to the protected service. This ensures that only valid connections reach your application while protecting your legitimate end users against false positives drops.• Automatic traffic engineering systems that disperse or isolate the impact of large volumetric DDoS attacks. All of these services isolate attacks at the source before they reach your origin, which means less impact on systems protected by these services.• Application layer defense when combined with AWS WAF that does not require changing current application architecture (for example, in an AWS Region or on-premises data center).There is no charge for inbound data transfer on AWS and you do not pay for DDoS attack traffic that is mitigated by AWS ShieldCommentShareEXPERTTushar_Janswered 7 months ago"


Question: Cannot connect my EC2 instance via SSH in several minutes after starting it

I have a pretty much the same issue described here https://repost.aws/questions/QUTwS7cqANQva66REgiaxENA/ec-2-instance-rejecting-connections-after-7-minutes and here https://repost.aws/questions/QUIrlxErTGSxesqwaawWBb-g/ssh-into-ec-2-stops-accepting-connections-after-about-8-minutesMy account was suspended in the past and re-opened so I suspect that this is the case.Nothing from here https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-resolve-ssh-connection-errors/ helped me.FollowComment

Answer: "1Make sure that the security group is not allowing traffic from 0.0.0.0/0. That could indicate that you are getting brute forced and the instance has a hard time keeping up with all connection requests. If you are using Linux, you can install a tool like fail2ban which will automatically create firewall rules to block traffic from ip's that attempt to authenticate with invalid credentials.If you truly believe that there is something wrong with your account, then you can open a ticket to the billing team as your repost link you referenced says.CommentShareSUPPORT ENGINEERFrancisco_Lanswered 5 months agoivorobioff 5 months agothis is a good point but it's unlikely that I am being brute forced every time after EC2 is up for about the same time.Share"


Question: Mounting EBS or EFS as File System in on Premise Instances

"I have used the open source s3fs for mounting s3 buckets in a local directory. Are there similar open source solutions for EBS or EFS? Most of the guides I see seem to assume that I am using an EC2 with the appropriate security group setting, but I need it to be on my own VM or laptop (running Ubuntu).FollowComment"

Answer: 0This walkthrough uses the AWS Management Console to create and mount a file system on an on-premises client. You do so using either an AWS Direct Connect connection or a connection on an AWS Virtual Private Network (AWS VPN).You can mount your Amazon EFS file systems on your on-premises data center servers when connected to your Amazon VPC with AWS Direct Connect or VPN. Mounting your Amazon EFS file systems with amazon-efs-utils also makes mounting simpler with the mount helper and allows you to enable encryption of data in transit. See reference hereEBS cannot be mounted on-premises but can be used to take back up of data as EBS snapshotsCommentShareEXPERTAWS-User-Nitinanswered 6 months ago


Question: Instance SSH not working

Hello AllOur instance not working properly.Our account have 3 instance. One is perfectly fine working 2nd which is active isn’t.Its SSH not working. We are using in web browser ssh but not working and pem file but both are not working.We are unable to do work due to this condition.ThanksFollowComment

Answer: "0Hello,I am sorry to hear that you are having issues with SSH on your business workload.AWS cannot "reset your instance" and you will need to troubleshoot the issue to resolve it. If you can include more information about the error message and configuration, this will help the community to provide a solution. Have you check the security groups?I recommend you follow this guidance to troubleshoot this further: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-ssh-troubleshooting/If you are using EC2 Instance Connect, see this link instead: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-connect-troubleshooting/Finally, the documentation lists resolution for several error messages you might get: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.htmlHope it helps,JonCommentShareEXPERTJonathan_Danswered 4 months ago0Hello,Please ensure your instance's firewall settings are correct for SSH: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/understanding-firewall-and-port-mappings-in-amazon-lightsailHere is information on connecting to your instance via terminal SSH: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-ssh-using-terminalI would also recommend creating an instance snapshot and creating a new instance from that snapshot then attempting to connect to the new instance.If you are still facing trouble, please reach out to AWS Support.CommentSharejsctaanswered 4 months ago"


Question: TRUNCATE DynamoDB table

"Hi there,I have a DynamoDB configured with GSI. And there is my table info.Item countTable sizeAverage item size11,02344.4 megabytes4,028.76 bytesI want to truncate the table and is looking for the simplest and minimal impact way.Here are my research so far, but some articles do mention "truncate" operation on UI to be able to empty the data of a table, but I cannot find it myself in the AWS console UI.solution 1. delete + re-create table will do the work,solution 2. would be batch scan and delete using bash + CLIThanks for your time!LeoFollowComment"

Answer: "1Accepted AnswerHi Leo,Let me give you an overview of the options you've mentioned:Delete and Re-Create Table:This option is cheapest, and possibly the easiest approach. There is no cost involved when dropping a table, likewise for creating one. However, keep in mind that this option could provide additional work in the case you use Infra as Code such as CFN or CDK. Also, you would have to recreate all of your additional settings such as Streams, AutoScaling, IAM Roles etc....FastCheapMay add additional operational overheadScan and Delete: For 11k items this will be relatively fast and easy to do, but there is a cost associated with it. You must pay for the capacity used from both the Scan and the BatchWrite Deletes. With AVG item size being just over 4kb, you will be charged 5WCU per item. However, for a one off that may be minimal: $1.25 per million write request units.Relatively fast but not scalableCan cost at scaleRequires you to write the code logic and provision compute to executeTruncate via the console is possible, however, it will only do up to a maximum of 300 items per go which can be time consuming. You would also be paying for the Scan operations and the DeleteItem operations being carried out on your behalf.CommentShareEXPERTLeeroy Hannigananswered a year ago"


Question: RDS snapshot export task does not work from Starting status

"Hi, I'd like to ask a question about RDS snapshot export task.(Here is the document of this feature.)I use RDS snapshot export as daily batch job since last year, and it had been worked so far.From yesterday, however, the export task does not work from 'Starting' status, and there is no information more than status about that working task.I've tried to cancel current working export task and tried to re-run the export task, but nothing had changed.Are there anyone who have the same issue? And how to resolve about this issue?Thanks.FollowComment"

Answer: "0Please check this knowledge center article on "Export a snapshot from Amazon RDS MySQL to Amazon S3".I think, in your case, looks like Export task is stuck in "STARTING" status.Please read to know more about resolution:https://aws.amazon.com/premiumsupport/knowledge-center/rds-mysql-export-snapshot/Hope it helps.CommentShareSwwapnilanswered a year ago"


Question: How to calculate player ping/latency for matchmaking?

"I noticed that for matchmaking requests, for each player in the ticket, you have to specify a latency map field. However, I am wondering how twe should calculate these values. I have stumbled across these sites:https://www.cloudping.info/https://cloudpingtest.com/awsAnd I was wondering how these sites calculated these values?Also, I wanted to know if StartMatchmaking behaved similarly to StartGameSessionPlacement with regards to placing players on fleets in regions with better connection speeds relative to the players. In the documentation for StartGameSessionPlacement,When placing a game session, by default Amazon GameLift tries each fleet in the order they are listed in the queue configuration. Ideally, a queue's destinations are listed in preference order.Alternatively, when requesting a game session with players, you can also provide latency data for each player in relevant Regions. Latency data indicates the performance lag a player experiences when connected to a fleet in the Region. Amazon GameLift uses latency data to reorder the list of destinations to place the game session in a Region with minimal lag. If latency data is provided for multiple players, Amazon GameLift calculates each Region's average lag for all players and reorders to get the best game play across all players.I wanted to know if this logic applied to how FlexMatch matches players even if you don't specify a rule in the matchmaker's rule set that is directly related to latency.FollowComment"

Answer: "0Accepted AnswerMatchmaking groups players into a sesssion and then basically goes to create that session by using StartGameSessionPlacement on your queue.If you provide the latency data, matchmaking will use it when making matches with players and then the session will be placed according to latency rules on the queue.Quite a few forum posts related to this ie:https://forums.awsgametech.com/t/matchmaking-rule-including-latency/7355/2https://forums.awsgametech.com/t/how-players-with-latency-will-be-matched-with-players-without-latency/6506/2To get the ping data, the recommended ways is to ping the GameLift regional endpoint of the region that you are calculating latency to from the game client and then include that information in the request to StartGameSessionPlacement.You can find a list of the regional endpoints for GameLift here: http://docs.aws.amazon.com/general/latest/gr/rande.html#gamelift_regionDoes that cover your question?CommentSharerePost-User-5332620answered 3 years ago0Thank you Pip, that absolutely does cover my question!CommentSharerePost-User-5100160answered 3 years ago0Gamelift god for unreal engine community is chrisgong and flopperam teamCommentSharerePost-User-2517056answered a year ago0Hello chris.I am getting an error when i try to enter this url in postmanhttps://gamelift.ap-south-1.amazonaws.comCan you find an alternative url to get ping for different aws servicesCommentSharerePost-User-2517056answered a year ago0I was able to ping on CLI:> ping gamelift.us-west-2.amazonaws.comPING gamelift.us-west-2.amazonaws.com (52.119.161.68): 56 data bytes> ping gamelift.ap-south-1.amazonaws.comPING gamelift.ap-south-1.amazonaws.com (52.95.80.229): 56 data bytesCommentSharerePost-User-7108006answered a year ago0Hello.Yeah i can get them in ping but when i am doing a get request it is giving error.What should i do to get Ping in json formatCommentSharerePost-User-2517056answered a year ago"


Question: An error has occurred: The server encountered an error processing the Lambda response

"Using Lex V1 Console and python 3.7 (for studying purposes), trying to build a bot with Lambda. Successfully tested all events along with python codes but can't seems to work. Bot was successfully build too but when I try to test it, as soon as I input the 1st utterance, it responded "An error has occurred: The server encountered an error processing the Lambda response."FollowComment"

Answer: "0Hi,please check that your Lambda function response matches the expected format: https://docs.aws.amazon.com/lex/latest/dg/lambda-input-response-format.html#using-lambda-response-format.You can also look at the following gist that provides a sample implementation and some utility functions https://gist.github.com/alexcasalboni/3ea2d8dda11c6b73bbf98adf2dd6a214Feel free to post a sample response in case you still cannot solve the issue, taking care of removing any sensitive information.Cheers,MassimilianoCommentShareEXPERTMassimilianoAWSanswered 9 months ago"


Question: Slave Nodes Unable to Talk to Master in Spark Application

"I'm attempting to run a basic word count program on an EMR cluster as a PoC using Spark and Yarn. The step immediately fails, it seems due to the fact that the slave nodes cannot contact the master in some form. Yarn fails to create any containers, and the slave nodes fail to connect to the master node.I'm running the below scala code as a spark-submit step in the EMR cluster with the class name provided as an argument.object App {  def main(args: Array[String]): Unit = {    //Set logging level to ERROR    Logger.getLogger("org.apache.spark").setLevel(Level.ERROR)    //Reading a local file on HDFS    val myInput = "s3://texfile.txt" // Should be some file on your local HDFS    val conf = new SparkConf().setAppName("Word Count")    val sc = new SparkContext(conf)    val inputData = sc.textFile(myInput, 2).cache()    //Find words having words 'island' and 'the'    val wordA = inputData.filter(line => line.contains("islands")).count()    val wordB = inputData.filter(line => line.contains("the")).count    println("Number of lines with word 'islands'  %s".format(wordA))    println("Number of lines with word 'the'  %s".format(wordB))  }}LOGS:YARN RESOURCE MANAGER2018-07-17 12:40:21,188 INFO org.apache.hadoop.yarn.server.resourcemanager.rmapp.RMAppImpl (AsyncDispatcher event handler): Application application_1531831066208_0001 failed 2 times due to AM Container for appattempt_1531831066208_0001_000002 exited with  exitCode: 13Failing this attempt.Diagnostics: Exception from container-launch.Container id: container_1531831066208_0001_02_000001Exit code: 13Stack trace: ExitCodeException exitCode=13:        at org.apache.hadoop.util.Shell.runCommand(Shell.java:972)        at org.apache.hadoop.util.Shell.run(Shell.java:869)        at org.apache.hadoop.util.Shell$ShellCommandExecutor.execute(Shell.java:1170)        at org.apache.hadoop.yarn.server.nodemanager.DefaultContainerExecutor.launchContainer(DefaultContainerExecutor.java:236)        at org.apache.hadoop.yarn.server.nodemanager.containermanager.launcher.ContainerLaunch.call(ContainerLaunch.java:305)        at org.apache.hadoop.yarn.server.nodemanager.containermanager.launcher.ContainerLaunch.call(ContainerLaunch.java:84)        at java.util.concurrent.FutureTask.run(FutureTask.java:266)        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)        at java.lang.Thread.run(Thread.java:748)Container exited with a non-zero exit code 13For more detailed output, check the application tracking page: http://ip-10-162-1-222.ec2.internal:8088/cluster/app/application_1531831066208_0001 Then click on links to logs of each attempt.. Failing the application.SLAVE NODE2018-07-17 12:37:29,827 INFO org.apache.hadoop.ipc.Client (main): Retrying connect to server: ip-10-162-1-222.ec2.internal/10.162.1.222:8025. Already tried 0 time(s); retry policy is RetryUpToMaximumCountWithFixedSleep(maxRetries=10, sleepTime=1000 MILLISECONDS)2018-07-17 12:37:30,828 INFO org.apache.hadoop.ipc.Client (main): Retrying connect to server: ip-10-162-1-222.ec2.internal/10.162.1.222:8025. Already tried 1 time(s); retry policy is RetryUpToMaximumCountWithFixedSleep(maxRetries=10, sleepTime=1000 MILLISECONDS)2018-07-17 12:37:31,829 INFO org.apache.hadoop.ipc.Client (main): Retrying connect to server: ip-10-162-1-222.ec2.internal/10.162.1.222:8025. Already tried 2 time(s); retry policy is RetryUpToMaximumCountWithFixedSleep(maxRetries=10, sleepTime=1000 MILLISECONDS)2018-07-17 12:37:32,830 INFO org.apache.hadoop.ipc.Client (main): Retrying connect to server: ip-10-162-1-222.ec2.internal/10.162.1.222:8025. Already tried 3 time(s); retry policy is RetryUpToMaximumCountWithFixedSleep(maxRetries=10, sleepTime=1000 MILLISECONDS)2018-07-17 12:37:33,831 INFO org.apache.hadoop.ipc.Client (main): Retrying connect to server: ip-10-162-1-222.ec2.internal/10.162.1.222:8025. Already tried 4 time(s); retry policy is RetryUpToMaximumCountWithFixedSleep(maxRetries=10, sleepTime=1000 MILLISECONDS)2018-07-17 12:37:34,832 INFO org.apache.hadoop.ipc.Client (main): Retrying connect to server: ip-10-162-1-222.ec2.internal/10.162.1.222:8025. Already tried 5 time(s); retry policy is RetryUpToMaximumCountWithFixedSleep(maxRetries=10, sleepTime=1000 MILLISECONDS)2018-07-17 12:37:35,832 INFO org.apache.hadoop.ipc.Client (main): Retrying connect to server: ip-10-162-1-222.ec2.internal/10.162.1.222:8025. Already tried 6 time(s); retry policy is RetryUpToMaximumCountWithFixedSleep(maxRetries=10, sleepTime=1000 MILLISECONDS)2018-07-17 12:37:36,833 INFO org.apache.hadoop.ipc.Client (main): Retrying connect to server: ip-10-162-1-222.ec2.internal/10.162.1.222:8025. Already tried 7 time(s); retry policy is RetryUpToMaximumCountWithFixedSleep(maxRetries=10, sleepTime=1000 MILLISECONDS)2018-07-17 12:37:37,834 INFO org.apache.hadoop.ipc.Client (main): Retrying connect to server: ip-10-162-1-222.ec2.internal/10.162.1.222:8025. Already tried 8 time(s); retry policy is RetryUpToMaximumCountWithFixedSleep(maxRetries=10, sleepTime=1000 MILLISECONDS)2018-07-17 12:37:38,835 INFO org.apache.hadoop.ipc.Client (main): Retrying connect to server: ip-10-162-1-222.ec2.internal/10.162.1.222:8025. Already tried 9 time(s); retry policy is RetryUpToMaximumCountWithFixedSleep(maxRetries=10, sleepTime=1000 MILLISECONDS)2018-07-17 12:37:38,836 WARN org.apache.hadoop.ipc.Client (main): Failed to connect to server: ip-10-162-1-222.ec2.internal/10.162.1.222:8025: retries get failed due to exceeded maximum allowed retries number: 10java.net.ConnectException: Connection refused        at sun.nio.ch.SocketChannelImpl.checkConnect(Native Method)        at sun.nio.ch.SocketChannelImpl.finishConnect(SocketChannelImpl.java:717)        at org.apache.hadoop.net.SocketIOWithTimeout.connect(SocketIOWithTimeout.java:206)        at org.apache.hadoop.net.NetUtils.connect(NetUtils.java:531)        at org.apache.hadoop.ipc.Client$Connection.setupConnection(Client.java:685)        at org.apache.hadoop.ipc.Client$Connection.setupIOstreams(Client.java:788)        at org.apache.hadoop.ipc.Client$Connection.access$3500(Client.java:410)        at org.apache.hadoop.ipc.Client.getConnection(Client.java:1550)        at org.apache.hadoop.ipc.Client.call(Client.java:1381)        at org.apache.hadoop.ipc.Client.call(Client.java:1345)        at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:227)        at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:116)        at com.sun.proxy.$Proxy75.registerNodeManager(Unknown Source)        at org.apache.hadoop.yarn.server.api.impl.pb.client.ResourceTrackerPBClientImpl.registerNodeManager(ResourceTrackerPBClientImpl.java:73)        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)        at java.lang.reflect.Method.invoke(Method.java:498)        at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:409)        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeMethod(RetryInvocationHandler.java:163)        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invoke(RetryInvocationHandler.java:155)        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeOnce(RetryInvocationHandler.java:95)        at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:346)        at com.sun.proxy.$Proxy76.registerNodeManager(Unknown Source)I can ping the slave nodes fine from the master, and vice versa, when using strictly the IP addresses. I suspect the issue might have to do with DNS lookups going wonky, but am unsure how to debug this any further, and can seem to find no relevant settings in creating the EMR cluster. Any time spent helping me on this issue is greatly appreciated.FollowComment"

Answer: "0So turns out the error message for this was bad. I had a typo in my argument that specified the main class for my jar. Instead of giving me an error pointing me in that direction, YARN decided to just blow up. If you run into this, it's worth checking the little things if nothing else makes sense.CommentSharekalverraanswered 5 years ago"


Question: Redirect Uri in Cognito's "confirmUser" endpoint

"Why doesn't Cognito provide a redirect_uri argument / querystring in confirmUser's endpoint? Most of the other ones already have it, and would make it easier to customise the message, without offering any extra options out of Cognito itself.Would that be possible?More info:https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-userpools-server-contract-reference.htmlFollowComment"

Answer: "0This element has been identified and is on our roadmap but not supported for the moment.As a mitigation, you can deploy your own API Endpoint that will perform the confirmation at Cognito and redirect you to a specific page.CommentShareJeff Lombardo-AWSanswered 4 months ago"


Question: Task networking in aws Fargate

"There is an older article on IP addresses for a Fargate task in a public subnet https://aws.amazon.com/blogs/compute/task-networking-in-aws-fargate/Is this still valid and working feature? I.e. a Fargate task in a public subnet is provided with an external IP (in ENI/Elastic Network interface), is that accessible from the internet without load balancer, NAT or else? I can't connect to or ping my Fargate task's external (ENI) IP in the out-of-the-box network set-up with all traffic allowed in Security guard and ACL. What can I do for trouble-shooting?FollowComment"

Answer: "0Accepted AnswerHello,Yes, you can enable the auto-assign public IP for Fargate task.According to the ECS document [1]， you can optionally assign a public IP address to the task's ENI when using a public subnet. This could be configured during the ECS task creation or ECS service creation. Hence, for troubleshooting the connection issue, there have multiple points you can check:1) Do you enable the auto-assign public IP during ECS task creation or ECS service creation?2) Is the Fargate task deployed in the subnet which contain a route to an internet gateway. ? If the subnet already have internet gateway, but didn't contain a route to an internet gateway, please follow this document to configure it [2] (Begin from Step 5). 3) Confirm the security group that Fargate task use allow the correct IP address and port to access.4) Confirm the VPC NACL has allow the correct IP address and port to access [3].5) If the traffic from outside-VPC, make sure you access the task with Fargate task's public IP instead of Fargate task's private IP.Hope above information helps.[1] Fargate task networking - https://docs.aws.amazon.com/AmazonECS/latest/userguide/fargate-task-networking.html[2] Connect to the internet using an internet gateway - Create a custom route table - https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html#Add_IGW_Routing[3] Control traffic to subnets using Network ACLs - Default network ACL - https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#default-network-aclCommentShareSypher_Sanswered 8 months agoJanerikz 7 months agoFrom your instructions I solved it, thanks!Share"


Question: 403 ERROR The request could not be satisfied.

"Hello,I want to visit a website and I get the following message:403 ERRORThe request could not be satisfied.The Amazon CloudFront distribution is configured to block access from your country. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.Generated by cloudfront (CloudFront)Request ID: 9uRI13FwSDykUqOnCfezuM-FkTXqIGgzxdB3aRzGwhF_0pRaaxDwnA==how can i fix it???I need a step by step guide because I have no idea how to do itFollowComment"

Answer: "0Is this a website that you have configured? If so, the error message is clear: It's been configured not to allow access from where you are; you need to change that setting.If it is a third-party website you need to contact them to change that setting.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: How to stay on the local network ?

"Hello,I am using KepeserverEx (PC A) to send data on a greengrass device (PC B). Both are in the same room.I would like that the communication stay on the local network but it doesn't seem to be that way.When I send the data to the topic/kepserver (with the right subscription and policy), I cannot send it to a local lambda function (greengrass).Typically, I need to add the subscription  IoT Cloud -> myLambda.But it means the data goes through the network am I right ?So I trie to add a device to my greengrass, and allow communication between the 2 of them, but same issue.Also how is it possible that I see the data in the "test" section, without the subscription to my topic/kepserver ?I never allowed the device on PC A to communication to the IoT Cloud on any topic (only in the pac A's device policy). Did I miss something ?Any idea would be awesome,Thank you, JEdited by: jerome123210 on Mar 11, 2020 1:33 AMFollowComment"

Answer: "0My mistake was to put my endpoint into the kepserverEx client, instead of  the ip adress of my greengrass device...CommentSharejerome123210answered 3 years ago"


Question: How to reactivate a suspended member account within an organization from the management account?

"In this post https://repost.aws/knowledge-center/reactivate-suspended-account it says: If the suspended account is a member account in an organization, then contact the owner of the management account. I am the owner of the management account but I did not find any way to reactivate the account. How can I reactivate an account that has been suspended?FollowComment"

Answer: 0Please contact AWS Support within 90 days to request resumption as described in this document.https://repost.aws/knowledge-center/reopen-aws-accountCommentShareEXPERTRiku_Kobayashianswered 2 months ago


Question: "Support for RedHat Enterprise Linux RHEL 6 after November 30, 2020"

"A customer is on Enterprise Support who wants to know what the support situation is for their RHEL 6 EC2 instances after Nov 2020.  I see that RedHat has the following posted on their site.End of Maintenance Support or Maintenance Support 2 (Product retirement) for RHEL 6 is November 30, 2020https://access.redhat.com/support/policy/updates/errata#Life_Cycle_Dates"ELS will be available for Red Hat Enterprise Linux 6 starting with its retirement (November 30, 2020) until June 30, 2024"https://access.redhat.com/solutions/690063Is Extended Life Cycle Support something the customer will need to purchase separately, or does AWS provide ongoing support as part of Enterprise Support?I'm not certain, but I think they have RHEL images by AWS from the marketplace.Thanks!FollowComment"

Answer: "0Accepted AnswerELS is a separate support channel and our on-demand images are standard server entitlements only, without the ability to use additional paid support channels, like ELS. Customers who intend to continue using RHEL 6 after the product retirement with full product support from Red Hat must migrate to RHEL 6 using the Red Hat Cloud Access program in order to support the add-on for ELS.If the customer just wants to run RHEL 6, without the full add-on support, the standard server entitlement for the on-demand images is sufficient entitlement to run RHEL 6  without the add-on for ELS. Without ELS, there will be no access to the Red Hat Update Infrastructure RHEL 6 repositories, so customers who choose to do continue to use the images will need to sync the repositories prior to retirement to continue to have access to the binaries.CommentSharedavduncanswered 3 years ago"


Question: Container service stuck in pending blocks usage of lightsail

"18 hours still pending.  I created my first container service on US-East-1 yesterday while services were failing.  Lucky me.  It is on step 3 copying certificate.  Can't delete, not sure where to find a log or force stop it.  Can't create a new one until this one is out of the way.  Most likely the same issue as AWS-User-1888013 "Delete pending LightSail container service" .  We created around the same time during the AWS partial outage.Tried to delete, but error says can't delete in pendingHere some of the details:aws lightsail get-container-services --service-name=......            "resourceType": "ContainerService",            "tags": [],            "power": "nano",            "powerId": "nano-1",            "state": "PENDING",            "stateDetail": {                "code": "PROVISIONING_CERTIFICATE",                "message": ""FollowComment"

Answer: "0Thanks for using Amazon Lightsail!If you are still having trouble deleting the container service, please reach out to AWS Support and file a billing support ticket. They will be able to route you to someone that can help.CommentSharedonleyatawsanswered a year ago"


Question: Stack deletion stuck as DELETE_IN_PROGRESS

"I have a stack that has been stuck as DELETE_IN_PROGRESS for over 2 hours despite the underlying DynamoDB table having been deleted.I have tried to manually create the table again and delete that to no avail. Is there a way to get that stack marked as DELETED or could someone from AWS support help with that please?Additionally, will setting the TimeoutInMinutes parameter when creating the stack using the Node SDK help to avoid this in the future or does that only apply for creation of the stack?Thank youFollowComment"

Answer: "0As an additional aside, I went through the cloudtrail logs during the time period the Cloudformation stack was to be deleted as shown in the "Why is my AWS CloudFormation stack stuck in progress?" AWS youtube video. Sadly, in this case I did not see any errors in the log events.CommentSharebeefychickenanswered 3 years ago0After some experimentation on another account and being able to recreate it, it looks like it is because programmatically detached and deleted the policy from the user that was used to kick off the teardown of the stack. I was able to recreate/attach the policy on the other account to the user and the cloud formation DELETE_IN_PROGRESS was able to resolve and finish out.However, on the account I had the issue in the first place on, I have already deleted the user. I have tried to create a user with the same name and same policy attached but it looks like cloudformation is going off of the User ARN since this doesn't work. So it looks like I will still need someone to go in and possibly change that status on the AWS support side.CommentSharebeefychickenanswered 3 years ago0Just in case someone runs across this in the future, it finally timed out after about 8 hours of being stuck DELETE_IN_PROGRESS.CommentSharebeefychickenanswered 3 years ago"


Question: OpenJDK JRE vs HotSpot JVM?  ObjectSizeCalculator only works with HotSpot

There is a class in the java ext classes that computes object sizes but it only works with the HotSpot JVM.  jdk.nashorn.internal.ir.debug.ObjectSizeCalculatorhttps://stackoverflow.com/a/39406536https://stackoverflow.com/questions/52353/in-java-what-is-the-best-way-to-determine-the-size-of-an-object#comment84178865_39406536What is the status of HotSpot?  It took me a while to figure out that the error mesage was due to the JVM version:java.lang.NoClassDefFoundError: Could not initialize class jdk.nashorn.internal.ir.debug.ObjectSizeCalculator$CurrentLayoutThis would be very useful with spark RDDs during debug...FollowComment

Answer: "0I'm still curious about HotSpot but a different way to solve this is something like this using openjdk jol project:import org.openjdk.jolval l = List(1,2,3)// Convert Any into AnyRef: https://stackoverflow.com/a/23892913val jo = l.asInstanceOf[AnyRef]val gl = jol.info.GraphLayout.parseInstance(jo)gl.totalSize()CommentShareTraveler422answered 5 years ago"


Question: AWS Step Function ECS StartedBy parameter support

"Currently, the StartedBy parameter is not supported for ECS RunTask calls defined in AWS Step Function states as mentioned here: https://docs.aws.amazon.com/step-functions/latest/dg/connect-ecs.html. Just wondering if there's anything in the works for supporting this parameter. It would useful for defining a filter when collecting tasks that are started by step function executions within ECS ListTasks API calls. It would be great if it also supported passing Step Function variables and intrinsic functions (e.g. "StartedBy.$": "States.Format('{}-foo', $.some_input)".FollowComment"


Question: Windows Server image migration in appstream from Windows Server 2012 R2 to 2016 or 2019.

"currently, Appstream is running with Windows Server 2012 R2 image. We all know, that the Windows Server 2012 R2 is in End of Life.  should we consider to migrate the image from windows Server 2012 R2 to newer versions like Windows Server 2016 or Windows Server 2019.FollowComment"

Answer: "1Accepted AnswerYes. You will have to create a new image builder and install your applications on the new OS.We also introduced Elastic fleets. Elastic fleets lets you stream applications to your end users without managing images or configuring scaling. If your applications are portable, this could be a good fit.CommentShareJeremy_Sanswered a year ago1Yes, given that Server 2012 R2 is going on ten years old. Is there a reason you've remained on 2012 R2?CommentShareEXPERTStevieStetsanswered a year ago"


Question: I am unable to delete my RDS instance.

"It is not allowing me to delete the instance. Once I type the delete in the field, delete button is not working. And the same case with Modify button. It is not working is well. FollowComment"

Answer: "1Accepted AnswerHi,you need to type "delete me" this should enable the buttonSimoneCommentShareSimone Tallevianswered a month agorePost-User-0258379 a month agoThank you, its worked.Share"


Question: how to add event monitoring in s3 ?

"I have set up a dvc (https://dvc.org/doc/user-guide/data-management/managing-external-data)  , such that (sample commands below), when i run this command dvc add --external s3://mybucket/existing-data, it copies the data in this bucket to the cache folder (s3://mybucket/cache) . this set up worked for me , but at times the data is not copied to cache folder. I want to know if i can set up any cloudwatch alarms that get triggered, if the copying of data is failing because of any permissions/access isssue in certain bucket .also, currently , i generate access/secret keys to issue these dvc commands from my local machine, is there another way to get access to these s3 bucket, like setting up access points. i need to be able to get and create objects access.dvc remote add s3cache s3://mybucket/cachedvc config cache.s3 s3cacheFollowCommentSimone Tallevi 2 months agoHi clouduser, if you think my answer cover your requests can I please ask you to consider to accept my answer?Share"

Answer: "1Hi,to answer your first questions:I want to know if i can set up any cloudwatch alarms that get triggered, if the copying of data is failing because of any permissions/access isssue in certain bucket .To monitor S3 you could setup the following elements:Logging API call using AWS Cloud Trail: this will give you information on the API call that are made to your bucket and the objects into your bucket (https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html)Amazon S3 Server Access Logging: this will access the operations happening on your bucket/object including "Authentication failures" as explained here https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html. (https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html)also, currently , i generate access/secret keys to issue these dvc commands from my local machine, is there another way to get access to these s3 bucket, like setting up access pointsThe S3 Access Point feature might be used to better refine your authorization mechanism (https://aws.amazon.com/s3/features/access-points/), however you will still be required to perform some authentication either via:Access/Secret Key: this is the option you are currently using where you need to store the credential in you local machine.IAM Role Anywhere: this option is going to use certificate authentication to obtain temporary credential that can be used to authenticate your workload running on your local machine https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.htmlhttps://aws.amazon.com/about-aws/whats-new/2022/07/aws-identity-access-management-iam-roles-anywhere-workloads-outside-aws/CommentShareSimone Tallevianswered 2 months ago0You can set up alarms by sending CloudTrail logs to CloudWatch logs and setting a filter in the metrics filter with a string for permission errors.https://docs.aws.amazon.com/awscloudtrail/latest/userguide/monitor-cloudtrail-log-files-with-cloudwatch-logs.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months ago0To add the required CloudTrail policy to an Amazon S3 bucketOpen the Amazon S3 console at https://console.aws.amazon.com/s3/.Choose the bucket where you want CloudTrail to deliver your log files, and then choose Permissions.Choose Edit.Copy the S3 bucket policy to the Bucket Policy Editor window. Replace the placeholders in italics with the names of your bucket, prefix, and account number. If you specified a prefix when you created your trail, include it here. The prefix is an optional addition to the S3 object key that creates a folder-like organization in your bucket.https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-event-notifications.htmlhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/NotificationHowTo.htmlCommentShareHemant Chughanswered 2 months ago"


Question: S3 download large files (.Net)

We are trying to download large files(>2 GB) through a C#.Net web application(AWS .Net SDK) from S3 to browser's(user/local) machine.This is getting memory out of flow exception when using belowAmazon.S3.Transfer.TransferUtility.OpenStreamAsync().Please suggest the best approach to download large(>2 GB) S3 file using .Net SDK?FollowComment

Answer: "0Hello! As a workaround, you could try installing the AWS CLI on the same machine and calling the "aws s3 cp" commands from .NetCommentShareSUPPORT ENGINEERFrancisco_Lanswered a year ago0The .NET SDK is just returning back the Stream from S3. It doesn't buffer the the object into memory. I suspect depending on how you are returning the stream back through your web stack it is attempting to read the entire stream before sending it down to the client.CommentShareNormanswered a year ago"


Question: DMS Job Error. from mongodb to documentdb

"2021-01-14T23:00:59.000+08:002021-01-14T15:00:59 [AT_GLOBAL ]I: Task Server Log - 3DD5OUFBJIVNLDZTIWAKBVENSW3SDHDKLOXO7YA (V3.4.3.R1 localhost.localdomain Linux 4.14.59-64.43.amzn1.x86_64 #1 SMP Thu Aug 2 21:29:33 UTC 2018 x86_64 64-bit, PID: 26697) started at Thu Jan 14 15:00:59 2021 (at_logger.c:2700)2021-01-14T23:00:59.000+08:002021-01-14T15:00:59 [DATA_STRUCTURE ]I: SQLite version is 3.31.1 (at_sqlite.c:174)2021-01-14T23:00:59.000+08:002021-01-14T15:00:59 [VALIDATOR ]I: validation_util_class_initialize (validation_util.c:70)2021-01-14T23:00:59.000+08:002021-01-14T15:00:59 [VALIDATOR ]I: Creating Table Def Mutex (validation_util.c:74)2021-01-14T23:00:59.000+08:002021-01-14T15:00:59 [VALIDATOR ]I: ==> Success Creating Table Def Mutex (validation_util.c:82)2021-01-14T23:00:59.000+08:002021-01-14T15:00:59 [COMMON ]D: at_common_is_supported: load_common_wrapper( common_load_locker ) failed (at_common.c:69)2021-01-14T23:01:00.000+08:002021-01-14T15:01:00 [TASK_MANAGER ]I: Execute Request Task '3DD5OUFBJIVNLDZTIWAKBVENSW3SDHDKLOXO7YA' running full load and CDC with flags fresh start with cdcPosition null and stop_at null (replicationtask.c:753)2021-01-14T23:01:00.000+08:002021-01-14T15:01:00 [TASK_MANAGER ]I: BatchApplyPreserveTransaction is set to false, because BatchApplyEnabled is false (replicationtask.c:1100)2021-01-14T23:01:00.000+08:002021-01-14T15:01:00 [TASK_MANAGER ]I: Task '3DD5OUFBJIVNLDZTIWAKBVENSW3SDHDKLOXO7YA' starting full load and CDC in fresh start mode (replicationtask.c:1312)2021-01-14T23:01:00.000+08:002021-01-14T15:01:00 [TASK_MANAGER ]W: The "Transactional apply" option is not available when MongoDB is the target endpoint. The "Batch optimized apply" option will be used instead. (replicationtask.c:1541)2021-01-14T23:01:00.000+08:002021-01-14T15:01:00 [TASK_MANAGER ]I: Task Id: 1df77829-2a03-4d26-ba83-941e13de6edb (replicationtask.c:3279)2021-01-14T23:01:00.000+08:002021-01-14T15:01:00 [TASK_MANAGER ]I: LOB support on the task has been enabled (endpointshell.c:1792)2021-01-14T23:01:00.000+08:002021-01-14T15:01:00 [TASK_MANAGER ]I: Task is running in Limited LOB Mode. MaxLobSize is set to '32768' Bytes (endpointshell.c:1795)2021-01-14T23:01:00.000+08:002021-01-14T15:01:00 [METADATA_MANAGE ]I: Source endpoint 'mongoDB' is using provider syntax 'MongoDB' (provider_syntax_manager.c:622)2021-01-14T23:01:00.000+08:002021-01-14T15:01:00 [METADATA_MANAGE ]I: Connection string: 'mongodb://172.16.3.147:27017/?retryWrites=false' (mongodb_imp.c:408)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [METADATA_MANAGE ]I: MongoDB version: 4.0.1 (mongodb_imp.c:210)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [METADATA_MANAGE ]I: Target endpoint 'mongoDB' is using provider syntax 'MongoDB' (provider_syntax_manager.c:628)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [METADATA_MANAGE ]I: Connection string: 'mongodb://mongo:****@inventorydb.cluster-c3jaqp3qyz8v.us-east-2.docdb.amazonaws.com:27017/?retryWrites=false&authSource=admin&authMechanism=SCRAM-SHA-1' (mongodb_imp.c:408)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [METADATA_MANAGE ]I: MongoDB version: 4.0.0 (mongodb_imp.c:210)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [TASK_MANAGER ]I: Preparing all components (replicationtask.c:1935)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [TASK_MANAGER ]I: Task - 3DD5OUFBJIVNLDZTIWAKBVENSW3SDHDKLOXO7YA is in STARTING state, updating starting status to AR_PREPARING_COMPONENTS (repository.c:5111)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [TASK_MANAGER ]I: Creating threads for all components (replicationtask.c:1968)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [TASK_MANAGER ]I: Task - 3DD5OUFBJIVNLDZTIWAKBVENSW3SDHDKLOXO7YA is in STARTING state, updating starting status to AR_CREATING_TREADS (repository.c:5111)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [TASK_MANAGER ]I: Task - 3DD5OUFBJIVNLDZTIWAKBVENSW3SDHDKLOXO7YA is in STARTING state, updating starting status to AR_CREATING_TABLES_LIST (repository.c:5111)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [TABLES_MANAGER ]I: Calling for get capture table list from the Metadata Manager started. (tasktablesmanager.c:928)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [TABLES_MANAGER ]I: Calling for get capture table list from the Metadata Manager ended. (tasktablesmanager.c:935)2021-01-14T23:01:01.000+08:00复制2021-01-14T15:01:01 [TASK_MANAGER    ]E:  No tables were found at task initialization. Either the selected table(s) no longer exist or no match was found for the table selection pattern(s). [1021707]  (replicationtask.c:2107)2021-01-14T15:01:01 [TASK_MANAGER ]E: No tables were found at task initialization. Either the selected table(s) no longer exist or no match was found for the table selection pattern(s). [1021707] (replicationtask.c:2107)2021-01-14T23:01:01.000+08:002021-01-14T15:01:01 [TASK_MANAGER ]E: Task '3DD5OUFBJIVNLDZTIWAKBVENSW3SDHDKLOXO7YA' failed [1021707] (replicationtask.c:3316)2021-01-14T23:01:30.000+08:002021-01-14T15:01:30 [TASK_MANAGER ]I: Task - 3DD5OUFBJIVNLDZTIWAKBVENSW3SDHDKLOXO7YA is in ERROR state, updating starting status to AR_NOT_APPLICABLE (repository.c:5103)2021-01-14T23:01:30.000+08:002021-01-14T15:01:30 [TASK_MANAGER ]E: Task '3DD5OUFBJIVNLDZTIWAKBVENSW3SDHDKLOXO7YA' encountered a fatal error (repository.c:5196)2021-01-14T23:01:33.000+08:002021-01-14T15:01:33 [METADATA_MANAGE ]I: Destroying mongoc client: '23271072968192' (mongodb_imp.c:1153)2021-01-14T23:01:33.000+08:002021-01-14T15:01:33 [METADATA_MANAGE ]I: Destroying mongoc client: '23271073330768' (mongodb_imp.c:1153)2021-01-14T23:01:40.000+08:002021-01-14T15:01:40 [TASK_MANAGER ]I: Task Management thread terminated abnormally (replicationtask.c:3969)2021-01-14T23:01:40.000+08:002021-01-14T15:01:40 [AT_GLOBAL ]I: Closing log file at Thu Jan 14 15:01:40 2021 (at_logger.c:2548)FollowComment"

Answer: "0Source : MariaDBDestination : Kinesis StreamBehavior : Worked first time only.Same Error subsequently :Last Error No tables were found at task initialization. Either the selected table(s) or schemas(s) no longer exist or no match was found for the table selection pattern(s). If you would like to start a Task that does not initially capture any tables, set Task Setting FailOnNoTablesCaptured to false and restart task. Stop Reason FATAL_ERROR Error Level FATALAlso fails with wild card (%).No response from AWS Premium Support.CommentShareASK1answered 2 years ago0Hi,I was also facing the same issue when I tried to do the same with Oracle DB as the source and S3 buckets as the target. But I was able to figure out the issue after a long time. The issue is due to privileges that are mandatory for the respective DMS user in which one of the main privileges was missed out initially during my migration task, I think you can try replicating that in your case also. I hope it might solve it. I have mentioned below the necessary privilege that has to enabled apart from the ones that are common.For the migration of tables, it is mandatory that you enable the following privilege on each table.GRANT SELECT on <schema>.<table> to <dms_user>;I believe you were getting the error because the privilege is not enabled on the table that you are trying to migrate, I hope this is helpful.ThanksVishnu NCommentSharevishnun5answered 2 years ago"


Question: Rest API  access limit about WAF(through Cloudfront)

"1.The access rate limit of WAF is based on 5 minutes. Can it be based on one day or one week or one month?2.Can WAF restrict network traffic? If WAF can't do it,  is there any other service that can do it?For example, the network traffic generated by all API accesses cannot exceed 100GB in one month.3.If it is necessary to restrict the network traffic of specific users or companies accessing the API, can WAF not do so? What can I do?4.Is there any way to limit the number of API calls for different usersFollowComment"

Answer: "0Thank you for contacting AWS Re:post .Below are answers to your questions relating to  using AWS WAF (associated to CloudFront) to limit access of your Rest API1.The access rate limit of WAF is based on 5 minutes. Can it be based on one day or one week or one month?No, the WAF rate limit rule evaluation period of 5 minutes cannot be increased [1]. 2.Can WAF restrict network traffic? If WAF can't do it, is there any other service that can do it? For example, the network traffic generated by all API accesses cannot exceed 100GB in one month.No, AWS WAF  is a web application firewall that operates at the application layer (7), this means it only monitors HTTP/S request by evaluating  HTTP request methods, headers,  URI path, query strings, source IP, request body size,  among other fields depending on the rule configuration. It will either allow or block  a request forwarded to the AWS resource (e.g. CloudFront Distribution or Application Load balancer or Amazon API Gateway, etc) associated with WAF. [2] Using WAF SizeConstraintStatement  statement WAF an inspect first 8192 bytes (8 KB) of a request, this allows you to create condition to block request that may exceed a certain size [3].Hence, WAF  cannot restrict based on the volume of data e.g only allow 100GB in one month.Within AWS, there's no service to restrict traffic based on the volume data e.g   100GB in one month. 3.If it is necessary to restrict the network traffic of specific users or companies accessing the API, can WAF not do so? What can I do?As mentioned in answer to questions 2, WAF cannot be used to restrict the network traffic  as it only evaluates HTTP/S requests. Although, using WAF rate based rules you can limit the number of HTTP/S requests request a particular source IP can make for a period of 5 minutes.4.Is there any way to limit the number of API calls for different usersNo, there's no way of achieving this with an AWS service. This could be controlled on the application to limit the number of request a user can make once they have been authenticated.  In concert with controls in your application you can again use WAF rate based rules  and narrow down the request that match the rule  by adding conditional statements.  For example, if the user pass a certain HTTP headers when making the API call, you can add a statement in the rate based rule to match the specific header [1].PS:Whilst it's not possible to increase the evaluation period to rate based rule. If you deploy your WAF using the AWS WAF Automatic deployment solution [4],  you can use the Amazon Athena log parser option if you have familiarity with SQL language to implement customizations.  Essentially, log parser uses Amazon Athena to query the WAF logs stored in S3 every 5 minutes, you can increase this period b by changing QueryScheduledRunTime in aws-waf-security-automations.template. The log parser uses a Lambda function to update AWS WAF IP Set condition to block those IP addresses for a customer-defined period of time [5/6].[1] Rate-based rule statement - https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html[2] What are AWS WAF, AWS Shield  - https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html[3] SizeConstraintStatement - https://docs.aws.amazon.com/waf/latest/APIReference/API_SizeConstraintStatement.html[4] Automatically deploy a single web access control list that filters web-based attacks with WAF Automation on AWS - https://docs.aws.amazon.com/solutions/latest/waf-automation-on-aws/welcome.html[5] Component details - https://docs.aws.amazon.com/solutions/latest/waf-automation-on-aws/appendix-b.html[6] https://docs.aws.amazon.com/solutions/latest/waf-automation-on-aws/appendix-a.html#athena-log-parserCommentShareSUPPORT ENGINEERPeter_Nanswered a year ago"


Question: Can I query Kendra from Lex without AMAZON.KendraSearchIntent ?

I've a spanish Lex v2 bot and AMAZON.KendraSearchIntent is only available in english.There is any other way to integrate this bot with Kendra?ThanksFollowComment

Answer: "0Hi,Thank you for reaching out!AMAZON.KendraSearchIntent is a native integration with Lex, however you can always invoke Kendra within your Lambda function.In your custom intent, you can use your Lambda to call the Kendra index, then the Lambda response can populate the request attributes like this:https://docs.aws.amazon.com/lexv2/latest/dg/built-in-intent-kendra-search.html#kendra-search-responsewith the response from your Kendra query.These request attributes will be come available to be picked up in Closing Response. :)I hope this helps!MathildaCommentShareMathildaAWSanswered a year ago"


Question: How to debug invocation timeouts for Redshift ML BYOM remote inferences

"I have an existing SageMaker inference endpoint that I'm successfully calling from Aurora PostgreSQL using the aws_ml extension's invoke_endpoint function. I'm now trying to use the same endpoint from Redshift.Based on Getting started with Amazon Redshift ML, I've set up the necessary IAM policies, created a model for the endpoint in Redshift, and called it via the model's registered function. However, I'm getting an error after 370 seconds no matter what I try.Query 1 ERROR: ERROR:  Received server error (0) from primary with message "Your invocation timed out while waiting for a response from container primary. Review the latency metrics for each container in Amazon CloudWatch, resolve the issue, and try again.". See https://us-east-DETAIL:    -----------------------------------------------  error:  Received server error (0) from primary with message "Your invocation timed out while waiting for a response from container primary. Review the latency metrics for each container in Amazon CloudWatch, resolve the issue, and try again.". See https://us-east-  code:      32207  context:     query:     4076  location:  exfunc_client.cpp:136  process:   query1_125_4076 [pid=29885]  -----------------------------------------------I can see work being performed in the endpoint containers, and there's no errors reported. One major difference between Aurora PostgreSQL and Redshift is that there's no controls for batch size from Redshift. In Aurora PostgreSQL, I typically pass a batch size of around 1000 to invoke_endpoint. Redshift is sending 50000 to 220000 rows per batch, which can take a couple minutes to complete.Does anyone have any suggestions on how I can debug this? The query failure is always at 370 seconds. I'm not sure what the significance of that number is.FollowComment"

Answer: "0Hello,To answer your question, we would require details that are non-public information. Please open a support case with AWS using the following linkhttps://console.aws.amazon.com/support/home#/case/createIf a support case has already been created please be assured that we will get back to you and assist you in the best way possible.CommentShareManjushree_Kanswered 2 months ago"


Question: AWS services in us-east-1 are unresponsive

AWS services in us-east-1 are unresponsiveFollowCommentBruno_M a year agore:Post should be utilized as a medium to ask questions.Share

Answer: "4Hello,Please follow along https://status.aws.amazon.com/ for the latest update on the event. The AWS teams are working to mitigate the issue as quickly as possible and will continue to provide updates.CommentShareEXPERTShree_Canswered a year agoMODERATORAdeebreviewed a year ago1Hello, When you have problems I recommend you check:https://status.aws.amazon.com/But I recommend you use "Personal health dashboard""While the Service Health Dashboard shows the general status of AWS services, the Personal Health Dashboard provides proactive and transparent notifications about your specific AWS environment."CommentShareMaxCloudanswered a year ago0Hi, yes, there is an ongoing outage that hopefully will be resolved soon.CommentShareAWS-Julieanswered a year ago-1We are seeing impact to multiple AWS APIs in the US-EAST-1 Region. This issue is also affecting some of our monitoring and incident response tooling, which is delaying our ability to provide updates. Services impacted include: EC2, Connect, DynamoDB, Glue, Athena, Timestream, and Chime and other AWS Services in US-EAST-1. The root cause of this issue is an impairment of several network devices in the US-EAST-1 Region. We are pursuing multiple mitigation paths in parallel, and have seen some signs of recovery, but we do not have an ETA for full recovery at this time. Root logins for consoles in all AWS regions are affected by this issue, however customers can login to consoles other than US-EAST-1 by using an IAM role for authentication.CommentShareSofiAWSanswered a year ago"


Question: Sagemaker - ValidationException

"Hello,I am trying to experiment with sagemaker and one of the built-in notebooks.I got to the notebook by:JumpStart > Huggingface > Question AnsweringWhenever I run the notebook I get the following error.'ClientError: An error occurred (ValidationException) when calling the CreateEndpointConfig operation: Instance type ml.p2.xlarge is not supported for the chosen region. Please choose some other instance type."As best as I can tell, I need to set up my domain in a region that supports the above instance type.Where can I find out the support for Sagemaker operations by region? (By the way, I have tried various instance types, and none work.)Thanks for any help!FollowCommentjunkai 4 months agoMay i know which region are you using currently?Share"

Answer: "1Check the default quota from offical doc, (search 'ml.p2.xlarge for endpoint usage', you will find default is 0, which is a soft limit to each account)https://docs.aws.amazon.com/general/latest/gr/sagemaker.htmlCheck current specific quota set for your accounthttps://console.aws.amazon.com/servicequotas/home/services/sagemaker/quotas/L-FD469689Raise a ticket from AWS console self-service to raise the quotaIf that's something you can't confirm, you can directly raise a ticket to AWS support to get the confirmed answer (which instance is availabe for you in spcific region)CommentShareRachelanswered a month ago"


Question: Sagemaker Debugger and forecasting

How to detect overfitting with Amazon Forecast. Does SageMaker Debugger work with Amazon Forecast?FollowComment

Answer: "0Accepted AnswerAnswer #1:  Based on the same technology used for time-series forecasting at Amazon.com, Forecast provides state-of-the-art algorithms to predict future time-series data based on historical data, and requires no machine learning experience. Amazon SageMaker Debugger profiles and debugs your training jobs to improve the performance of machine learning models on compute resource utilization and model predictions. So Debugger is available for your SageMaker training jobs but not for Amazon Forecast which is a fully managed service of its own.Answer #2 -The way to detect overfitting with forecasting is using "backtests", which are the "train/valid" equivalent of traditional machine learning.  The reason Backtesting is used in forecasting is to keep the time order of the train/valid data.  With careful analysis of backtest windows, you can have more confidence the model will generalize well with unseen data.Amazon Forecast now supports export of backtest forecasts as .csv files.  Customer can take the backtest forecasts and calculate whatever metric they want and/or visualize.Link to documentation:  https://docs.aws.amazon.com/forecast/latest/dg/metrics.htmlLink to blog and notebook about using Backtests in Amazon Forecast:  https://aws.amazon.com/blogs/machine-learning/amazon-forecast-now-supports-accuracy-measurements-for-individual-items/One common fear is backtesting will increase overfitting - it does not since each validation dataset is different from the previous backtest validation dataset.  To have more certainty about robustness of the model, use more than 1 backtest window.  If the Forecast Horizon is long, you may get by with just 1-2 backtest windows; otherwise use the maximum which is 5 backtest windows.Another concern is the increased training time since each backtest window is in fact another train/forecast iteration.  It's a trade-off, if you want more model validation or not.Ideally, the wQL's of each backtest window are similar.  If you see all backtest forecasts with similar metrics (except maybe a few windows where underlying data had anomalies), that is good sign your model is not overfit.Both under-fitting and over-fitting for now are left to human judgement to examine backtest forecasts and decide whether model is acceptable or not.CommentShareAWS-User-1214989answered 2 years ago"


Question: Cannot type password for codecommit from an EC2 instance

"Hello,I'm trying to push a repository from an EC2 instance to codecommit. Everything seems to go well until the actual pushing (git push XXXXX://git-codecommit.us-east-2.amazonaws.com/v1/repos/my_repository --all) when it asks for the username (that is fine) but it kind of freezes when trying to copy or type the password. I can regain control with CTRL+c and keep working. Not a clue what might be wrong and all I can say is that the OS is Ubuntu22.04.Thanks.FollowComment"

Answer: 1Accepted AnswerAre you sure the password isnt being hashed and not actually locking up. Unlikely you will have echo to the screen when typing a password..Have you tried typing the password and pressing enter when done or enter after you pasted it?CommentShareGary Mcleananswered a month agoafody 9 days agoSorry about the delay as there were several issues going on but I was finally able to make it work. It doesn't echo anything or even hashtags so it was a bit confusing (at least to me). Thanks.Share


Question: Ec2 Launching an Instance.

"Hi everyone.Just got a quick question about AWS.In any Region I can launch an instance and have a dummy hello world website with basic code get it to work.yum update -yyum install -y httpdsystemctl start httpdsystemctl enable httpdecho "
Hello World from $(hostname -f)
" > /var/www/html/index.htmlIt works in all regions except for Africa ( cape town - af south 1 ). When I create it, it just tries to load. So I assumed it's a security group issue.I have checked security groups ( even with new security group ) and have allowed http in allowed inbound list and have tried to compare to other regions security group  but only thing I can think of is that I have to manually change it to have a public IP ( other regions this is set to public ip as default ) and then it needs a subnet. No other regions need subnets.What else can I check?ThanksLionelFollowComment"

Answer: "1I would change the inbound and outbound rules. If that doesn't work, create a support ticket with AWSCommentShareAWS_Guyanswered 3 months ago0Hi, Niko.The Instance starts fine without any errors. But it's when I put the public IP address in the web browser that I get no web page loading from it.When I launch the same instance from another region with the same html code it launches fine. I can launch an instance from any region besides for south africa.But will keep on trying to figure it out.CommentShareLeoanswered 5 months agoNiko 5 months agoI thought the instance doesn't lunch. OK then. Do you get no page after sometime(timeout) or right away?Did you try CloudWatch to see the error in apache? Alternatively you can check the apache log on the instance itself /var/log/apache2 OR /var/log/httpd . Also, I'd check var/log/messages...is apache even running?Share0I would not assume its a security group.You can try using describe-instances CLI like so - https://aws.amazon.com/premiumsupport/knowledge-center/ec2-launch-issue/ to see if you can understand the error in more details.Let us know how it goesCommentShareNikoanswered 5 months ago"


Question: How to configure an API Destination enrichment with multiple Path Parameters in Eventbridge Pipes

"Most probably a bug ?When configuring an API Destination as an Eventbridge Pipe enrichment with multiple PathParameters, a validation error is returned when creating said pipe:[array is too long: must have at most 1 elements but instance has 2 elements]e.g.,Consider the following API Destination:https://data.economie.gouv.fr/api/v2/catalog/datasets/*/exports/*/This API Destination expects two path parameters to be templated in. However, configuring the integration as such will return said error:The error occurs both when trying to create a Pipe via the AWS Management Console and via CLI / CloudFormation.FollowCommentPaul 3 months agoI have the same issue.  I assume it's a bug with the service but hoping someone has an answer.Share"


Question: "AWS Storage Gateway: access control, authentication and clients"

"A customer has just started using AWS Storage Gateway (File Gateway - NFS), and they have some specific questions:How can you restrict access to specific files / folders when using NFS?I am aware of this mechanism: are there any alternatives?Are there any clients or web UIs that you could use to interact with file stored in the file share, or is mounting the file share on an OS the only option?Are there any ways to restrict the possibility of mounting/accessing the file share in addition to IP-based filtering?  Can you enable any sort of authentication mechanism?FollowComment"

Answer: "0Accepted AnswerAWS Storage Gateway (File Gateway - NFS) provides a standard NFS filesystem and it relies on standard unix permissions as mentioned here: https://docs.aws.amazon.com/storagegateway/latest/userguide/managing-gateway-file.html#edit-metadata-defaultsThere is no web UI to go through the file share. One option would be to use the S3 console or any other S3-compatible GUI, but beware such GUI would not maintain file metadata that File Gateway uses to store UNIX permissions (as mentioned in 1.) and could break desired permissions.AWS Storage Gateway (File Gateway - NFS) only provided IP based filtering for NFS accesses, as mentioned here: https://docs.aws.amazon.com/storagegateway/latest/userguide/managing-gateway-file.html#edit-nfs-clientAWS Storage Gateway (File Gateway - SMB) has more possibilities on these topics, it may be worth considering it depending on the type of file share clients they have.CommentShareNicolasanswered 3 years ago"


Question: AWS::Amplify::App AppId is too long to reference on AWS::Amplify::Branch and AWS::Amplify::Domain

"Hello,I'm trying to create an AWS Amplify resource through CloudFormation and I'm stuck in the following situation:When creating the AWS::Amplify::App resource it returns the AppId "arn:aws:amplify:us-east-1:000000000000:apps/xxxxxxxxxxxxx"But when trying to create an AWS::Amplify::Branch or AWS::Amplify::Domain the character limit for the AppId is 20 characters.Result in console:CREATE_FAILED: LootzAppProductionBranch (AWS::Amplify::Branch)Properties validation failed for resource LootzAppProductionBranch with message:#/AppId: expected maxLength: 20, actual: 58Is there any way to force a smaller AppId for AWS::Amplify::App?How should I proceed?Thanks!FollowComment"

Answer: "0Amplify App ARN is of the form arn:aws:amplify:us-east-1:000000000000:apps/xxxxxxxxxxxxx however AppID that you are referring to is just the xxxxxxxxxxxxx unique string and not the complete ARN.You may refer Amplify's service authorization reference for the syntax.CommentShareSUPPORT ENGINEERVishal_Nanswered 2 months ago0I think there may be a problem with the Cloudformation output.the AppId output of AWS::Amplify::App is being completed with complete Arn information..I opened an issue on github for this case, but I haven't had a response yet.https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-amplify/issues/16CommentShareLuis Miguel Piresanswered 2 months ago"


Question: Aws lightsail keep freezing.

"Hello,My Aws Lightsail instance is keep crashing and freezing almost 10-12 times a day. I am losing my website ranking and visitors because of this. Can anyone help to fix this?FollowCommentbwhaley EXPERTa year agoYou'll need to share more details if you want help with this issue. Relevant log snippets with errors, software stack, what's happening when the instance crashes, what you have tried so far, etc.ShareDavid G a year agoYes, more details are. crucial. How is it crashing? What blueprint are you using? What size is the instance?Share"

Answer: "0This can be due to a multitude of issues, but generally, a check on your instance metrics would be a good start:https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-viewing-instance-health-metricsCommentShareAWS-Leslieanswered a year ago0Another thing to look into is whether you're exhausting your instance's burst capacity: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-viewing-instance-burst-capacity#identifying-instance-burstCommentShareAlexanswered a year ago"


Question: What happens to rogue domain users when SSO is enabled?

"My organization has a few users who were using AWS before we officially began managing it. Their accounts are using the same domain as us, but we're unable to see which users these are. Is there a way to see these users? What happens to these users login when we enable SSO?FollowComment"

Answer: "0By rogue domains users you mean they had IAM users (credentials for login in the Console) using the domain before using the SSO? You will able to see this user on IAM console, and delete it.They will be able to login both ways. One using the SSO and other directly through the console. Because while they have the email as username, it could be just another string. And it will be better for management, security and compliance that anyone logs under the SSO.CommentShareIbrahim Cesaranswered 3 months ago0You can find the login events in CloudTrail and use Athena to find these events.CommentShareEXPERTkentradanswered 3 months ago"


Question: Remove package components after updating component

"Hi,my greengrass custom component is a docker container hosted on S3.After I update a version of one of my custom components, I noticed that the previous component is lingering here,/greengrass/v2/packages/artifacts/my_component/old_versionis this expected behaviour?Since this is a large docker container (~few gigs) after a few updates I will run out of space on my device.I'm using greengrass 2.4.0.Thanks for the help in advance!Edited by: m0sf3tz11 on Aug 18, 2021 12:10 AMFollowComment"

Answer: "0Hi everyone, I solved my own problem:I added this line to my component manifest:"Install": {"RequiresPrivilege": true,"script": "docker load -i {artifacts:path}/my_package.tar; rm {artifacts:path}/my_package.tar"},CommentSharem0sf3tz11answered 2 years ago"


Question: How associate one alarm with multiple instances?

"I need to create a single alarm for cpu utilization >70%, memory utilization >80%  and disk utilization > 60% for all my EC2's. How to achieve this using a single lambda function and this function need to use ec2 tags to associate instances.FollowComment"

Answer: "0You can accomplish this with a composite alarm.CommentShareRodney Lesteranswered 8 months agorePost-User-2738569 8 months agoHi @Rodney,Thanks for answering. I did try composite alarm but what i understand is it will reduce noise of alarms. But i want to create a single alarm for cpu-utilization for x number of serversShareRodney Lester 8 months agoTry using the metric math functionality: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create-alarm-on-metric-math-expression.htmlShare"


Question: How can I direct kubelet on EKS to contact private VPC endpoints?

"I am setting up an EKS cluster without internet access. I have created private VPC endpoints for the necessary services (EC2, S3, ...), but kubelet on the worker nodes insist contacting the public EC2 endpoint instead:kubelet: F1116 10:08:20.929730   19335 server.go:273] failed to run Kubelet: could not init cloud provider "aws": error finding instance i-0xxxxxxxxx: "error listing AWS instances: \"RequestError: send request failedncaused by: Post https://ec2.eu-north-1.amazonaws.com/: dial tcp 52.46.192.128:443: i/o timeout\""  From the worker, I can reach the private endpoints on port 443. How can I instruct the kubelet AWS cloud provider to contact them instead? I suppose I should change something in the kubelet config file, but I cannot find the relevant documentation. I have found the relevant config reading code, but I don't read Go well enough to figure out how to tweak the config: https://github.com/kubernetes/legacy-cloud-providers/blob/243362b8233f05202b5facfe85921f5a3a87461e/aws/aws.go#L649Or is this supposed to work via a DNS override? In that case, what is missing? I have gone through the docs at https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html and https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html, and cannot find anything that I have missed.Grateful for support. IIUC, we have an enterprise support agreement. If I need to do something to trigger that, let me know.Regards,LarsFollowComment"

Answer: "0In case someone else has this problem, the missing piece was the flag "Private DNS names enabled" when creating VPC endpoints. It defaults to true in the console and with 'aws' CLI tool, but to false with Terraform, which I used.The need for the flag to be set is missing in the documentation mentioned above.CommentShareLarsAlbertssonSinchanswered 3 years ago"


Question: Seems my core device is not receiving shadow update

"On my core I have ShadowManager and a custom component. I am trying to get the latest shadow test in my custom component. My python code **does ** retrieve a shadow, it's just outdated. I have admittedly been struggling with learning Greengrass and permissions. Hopefully one of you experts can help as I've been looking at this a day and a half now.These configurations are all copied from Local Debug Console so I am assuming that they are what is actually being used.My shadowManager configuration---componentType: "PLUGIN"configuration:  rateLimits: {}  shadowDocumentSizeLimitBytes: 8192  strategy:    type: "realTime"  synchronize:    coreThing:      classic: true    direction: "betweenDeviceAndCloud"    namedShadows:    - "test"dependencies:- "aws.greengrass.Nucleus:SOFT"lifecycle: {}version: "2.2.1"My component configuration:---componentType: "GENERIC"configuration:  accessControl:    aws.greengrass.ipc.mqttproxy:      com.xxxxxxxx.productivity.cycle_count:mqttproxy:1:        operations:        - "aws.greengrass#PublishToIoTCore"        policyDescription: ""        resources:        - "*"    aws.greengrass.ipc.pubsub:      com.xxxxxxxx.productivity.cycle_count:pubsub:1:        operations:        - "aws.greengrass#SubscribeToTopic"        - "aws.greengrass#PublishToTopic"        policyDescription: ""        resources:        - "*"    aws.greengrass.ShadowManager:      com.xxxxxxxx.productivity.cycle_count:shadow:1:        operations:        - "aws.greengrass#GetThingShadow"        - "aws.greengrass#UpdateThingShadow"        - "aws.greengrass#DeleteThingShadow"        - "aws.greengrass#ListNamedShadowsForThing"        policyDescription: ""        resources:        - "$aws/things/*"        - "*"dependencies: []lifecycle:  Run: "python3 -u /greengrass/v2/packages/artifacts/com.xxxxxxxx.productivity.cycle_count/1.0.138/cycle_count.py"previousVersion: "1.0.137"version: "1.0.138"The policy attached to the cert looks like this:Policy effectPolicy actionPolicy resourceAllow**Allowiot:DeleteThingShadow*Allowiot:GetThingShadow*Allowiot:UpdateThingShadow*Allowiot:Connect*Allowiot:Publish*Allowiot:Receive*Allowiot:Subscribe*Allowiot:ListNamedShadowsForThing*If I change my python code to get a named shadow that doesn't exist I do get a shadow doesn't exist error message.Any thoughts as to why updating a shadow does not sync with my thing?EDITWhat shadow are you updating in the cloud, and what specifically are you updating?I am editing the shadow called test. I have tried others as well.How are you checking the shadow on the device? Are you sending multiple requests to getThingShadow, or are you subscribed to shadow changes?I am retrieving the shadow when a switch is triggered on the RaspberryPi. The code is:def sample_get_thing_shadow_request(thingName, shadowName):        try:        # set up IPC client to connect to the IPC server        shadow_ipc_client = awsiot.greengrasscoreipc.connect()                        # create the GetThingShadow request        get_thing_shadow_request = GetThingShadowRequest()        get_thing_shadow_request.thing_name = thingName        get_thing_shadow_request.shadow_name = shadowName                # retrieve the GetThingShadow response after sending the request to the IPC server        op = shadow_ipc_client.new_get_thing_shadow()        op.activate(get_thing_shadow_request)        fut = op.get_response()                result = fut.result(5)        ret = json.loads(result.payload)        print(ret)        return result.payload    except  BaseException as err:        print(f"Shadow retrieval exception: {err=}, {type(err)=}")            return result.payloadBefore I try this I edit the shadow and put a different value in for ["state"]["desired"]["topic"]. The edit is accepted in the web console. I always get a value from about two days ago when my code runs though. I do not see any log entries from shadowManager unless I ask for a shadow other then test.I did try creating a new shadow and adding the permission using Local Debug Console. When I request that new shadow I get:2022-09-29T21:58:51.884Z [INFO] (Copier) com.xxxxxxxx.productivity.cycle_count: stdout. Shadow retrieval exception: err=ResourceNotFoundError(message='No shadow found', resource_type='shadow'), type(err)=<class 'awsiot.greengrasscoreipc.model.ResourceNotFoundError'>. {scriptName=services.com.xxxxxxxx.productivity.cycle_count.lifecycle.Run, serviceName=com.xxxxxxxx.productivity.cycle_count, currentState=RUNNING}It seems from my noobie end that the shadows are getting updated but the updates are not making it to the core thing.FollowCommentMichaelDombrowski-AWS EXPERT8 months agoWhat shadow are you updating in the cloud, and what specifically are you updating?How are you checking the shadow on the device? Are you sending multiple requests to getThingShadow, or are you subscribed to shadow changes?Shareflycast 8 months agoI added answers to your questions above in my post edit.Shareochoanel 8 months agohey @flycast. We are still looking into this, thanks for your patience.Share"

Answer: "0Hi,I see that your custom component running on the core device is unable to receive the latest shadow update. Looking at the policy attached to the certificate, it seems correct to me, as permission for the the iot:GetThingShadow is provided for all resources.To further investigate the issue, I would need to take a look at the greengrass logs generated pertaining to this specific issue. You can create a technical case using AWS Support console and share us all the logs generated under /greengrass/v2/logs directory[1].References:[1] https://docs.aws.amazon.com/greengrass/v2/developerguide/monitor-logs.html#access-local-logsCommentShareSUPPORT ENGINEERUser-4748418answered 8 months agoflycast 8 months agoI DID start a tech support question. I also tested further by testing a different core device. That performed the same. I also tested named shadows vs classic shadows. It would appear that the classic shadow syncs but named shadows do not. I think it looks like some kind of bug.Share0Hi @flycast,Sorry, we couldn`t reporduce the error from our side. Could you provide more logs before the error, especially the greengrass.log? We want to double check if the deployment and sync success.Also, to better reporduce it, could you also provide the OS, nucleus version,  and shadow manager version?CommentShareDaojinganswered 8 months agoflycast 8 months agoI have had a support ticket open for 18 days at AWS now. I will post an "answer" on this thread as I can't fit it all in a comment.Share0Hi @flycast,Thanks for providing this info, and sorry for taking so long to handle it. It seems like some communication issues happen between the support engineer and our team.Back to this issue, I remember this support ticket. In this ticket, the related teams already follow up and provide some further requests to the support engineer. I believe the support engineer will reach out to you ASAP.CommentShareDaojinganswered 8 months agoflycast 8 months agoCan I include you in the support ticket somehow? Reading the support ticket it looks like all the communications are being funneled through one first tier support engineer to yourselves (I'm calling you second tier support) and me. There seems to be a few days lag every time that happens. I can't tell if that is because of first tier or second tier support. At any rate I supplied ALL the configurations, code, shadow names in my very first support request on 9/30. I was just asked last Friday 10/14 for the EXACT same information again as if I had never supplied it. Getting frustrated waiting.Share0As mentioned I have had a support ticket open for 17 or 18 days now and it is getting nowhere slowly. I just did some troubleshooting this morning.  I created a named shadow named "Sussing" on the core called "PrecoGG1" and then edited the shadow. No information showed up in the PrecoGG1 greengrass.log file.I then edited the classic shadow and I do see the following entries showing up:2022-10-17T13:56:16.017Z [INFO] (pool-2-thread-25) com.aws.greengrass.shadowmanager.sync.strategy.BaseSyncStrategy: sync. Executing sync request. {Type=LocalUpdateSyncRequest, thing name=PrecoGG1, shadow name=}2022-10-17T13:56:16.071Z [INFO] (pool-2-thread-25) com.aws.greengrass.shadowmanager.ipc.UpdateThingShadowRequestHandler: Successfully updated shadow. {service-name=aws.greengrass.ShadowManager, thing name=PrecoGG1, shadow name=, local-version=2}2So we know that the classic shadow is syncing.I went back and edited the named shadow and nothing showed up in the greengrass.log file at all.My shadowManager configuration looks like this:Shadow Manager:{  "reset": [],  "merge": {    "strategy": {      "type": "realTime"    },    "synchronize": {      "coreThing": {        "classic": true      },      "namedShadows": [        "test",        "Sussing"      ],      "direction": "betweenDeviceAndCloud"    }  }}CommentShareflycastanswered 8 months ago"


Question: Our request for production access is getting denied.

"We read all of documentation from AWS about how to get out of a sandbox, answered for all of their questions, but still getting denied. 9467053381 This is the id of this case, hope someone will help us to resolve this problem. Or we want to be informed why we're getting denied, because we answered on all of their questions.FollowCommentRachelCrook a year agoWithout any reasons we get denied too, so we also want to get some reasons, or just review our case one time: 9471812541ShareCaribeagencia a year agoI also want to be helped with this question, because the same situation with us. We provided all of needed information, but get denied. the id 9476851261Share"

Answer: "-4Hi,Sorry to hear about that your request has been denied.But that is all depending upon the request you sent.The domain you have used inside the request.and the use case you have mentioned in the request.Depending upon the request they review and they see that if everything seems fine to them with different internal check list (which they do not provide us), then only they approve the domain.Another reason can be if any of the linking information you have used earlier? like...If your previous account is closed / suspended (history)..Your Email / Domain has any spam check list.Your Credit Card information / company name .. or any other information you might have used earlier in another AWS account..Then also that can be a case where they do not approve the account.CommentShareJigar Shahanswered a year agoConorLewis1985 a year agoThanks for your answer, but even with your answer we can't understand the real reason. For example, we checked on the many "check" sites for the spamlist, and we have 0 cases. So that case is excluded. Also card history is clean, im the only one user of this card. And about closed accounts that excluded same. Hope someone from the amazon staff can answer on our question, or rereview our caseShare"


Question: App Runner Health Check fails although Application logs show already receiving the request.

"I am trying to deploy a new App Runner service. I am using aws cli such that I can configure the health check to use HTTP. I make it to use HTTP and port 8080, and a custom path "health-check/".In my application logs, I will print the request received on this path and I am able to see it being printed, meaning I successfully received the request. The response I return is plain text "OK".But the service creation always fails with error12-07-2022 01:04:51 AM [AppRunner] Health check on port '8080' failed. Service is rolling back. Check your configured port number. For more information, read the application logs.12-07-2022 12:58:38 AM [AppRunner] Performing health check on path 'health-check/' and port '8080'.12-07-2022 12:58:28 AM [AppRunner] Provisioning instances and deploying image for publicly accessible service.12-07-2022 12:58:15 AM [AppRunner] Successfully pulled image from ECR.12-07-2022 12:55:38 AM [AppRunner] Service status is set to OPERATION_IN_PROGRESS.12-07-2022 12:55:38 AM [AppRunner] Service creation started.FollowComment"

Answer: "0Hi @rePost-User-3387005,I work for App Runner service team, can you please share the App Runner service ARN so we can look into it and share you some insights. ThanksCommentShareHarianswered 6 months agorePost-User-3387005 6 months agoHi @Hari, thanks for responding. I don't want to share the ARN here in public for security concern. If you can provide an email address or private chat, I can share the ARN.Share0Hi @Hari, to provide more information, I managed to fix this issue by only doing one thing, that is changing my port from 8080 to 80. This plus that I can confirm my application can receive requests at 8080, making me think the 8080 port is blocked for egress data. Can you check with the AppRunner team whether that is the case and if yes why? thanksCommentSharerePost-User-3387005answered 6 months agoHari 6 months agoHi, I work for App Runner service team and I can confirm we dont reserve any port. I think probably health check would have failed in 8080, after switching to right port (80) everything would have started working.Share0I am having the similar issue .  Is this resolved . I tried both 8080 and 80 ports but no luckCommentSharerePost-User-2683600answered 2 months ago"