Question: Private MWAA - Snowflake Connection Issue - Amazon Managed Workflows for Apache Airflow

"I set up a private Airflow environment in AWS -v2.2.2-. Environment and plugins are up and running, I want to connect to Snowflake but I am getting the error below . -whl files in plugins.zip using requirements.txt-snowflake.connector.vendored.urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='......snowflakecomputing.com', port=443): Max retries exceeded with url: /session/v1/login-request?request_id=....... (Caused by ConnectTimeoutError(<snowflake.connector.vendored.urllib3.connection.HTTPSConnection object at >, 'Connection to ........snowflakecomputing.com timed out. (connect timeout=60)'))Same connection works in public mwaa. I am adding connection informations into admin-connections tab from the UI. I know private env does not have connection to internetIf i want to connect to any api also i get a timeout since subnets not connected to internetAlso private mwaa environment is running on an existing vpc that has igw attachment, but the subnets that mwaa is running doesn't have any igw or nat attachment -as documentation suggests-I checked all the documentations but there are no information for connectivity via private environment, how can i solve my issue ?FollowComment"

Answer: "0Private MWAA environment refers to the web server access.  Regardless of web server access configuration, the workers and scheduler reside on your VPC as provided when creating your MWAA environment.Those workers on your VPC need access to the downstream services.  In the case of Snowflake, the private subnets that MWAA is using must have access to snowflakecomputing.com, typically via IGW.  See example VPC at https://docs.aws.amazon.com/mwaa/latest/userguide/vpc-create.html#vpc-create-template-private-or-public .CommentShareJohn_Janswered 4 months ago"


Question: EC2 UDP Network Loadbalancer does not forward client IP

HiIssue:using a UDP network loadbalancer with eks terminated at a mqttsn server does not show up the client ip but remoteaddr is within the ip range of the subnets.Expected Behavior:The client IP as described in https://aws.amazon.com/de/about-aws/whats-new/2019/06/network-load-balancer-now-supports-udp-protocol/is preserved.Any pointers how to fix / hanldethis issue?ThanksFollowComment

Answer: 0this was solved by addingexternalTrafficPolicy: LocalBestUlrichCommentShareuneidelanswered 3 years ago


Question: Do machine learning models run within an AWS IoT Greengrass group or on an AWS IoT Greengrass core?

"According to the AWS IoT Greengrass developer guide, you need to configure ML inference at the AWS IoT Greengrass group level. In the sample at GitHub, I see that an AWS Lambda function and an ML model are exported to an AWS IoT Greengrass core.Do ML models run within an AWS IoT Greengrass group or on an AWS IoT Greengrass core?FollowComment"

Answer: "0Accepted AnswerAWS IoT Greengrass ML inferences run on AWS IoT Greengrass core edge devices, not in the cloud. AWS IoT Greengrass ML inference configuration is done within the cloud at the AWS IoT Greengrass group level. Then, the ML inference is run on an AWS IoT Greengrass core edge device.For more information, see Setting up AWS IoT Greengrass core devices.CommentShareAWS-User-6599220answered 3 years ago"


Question: Database in Amazon Glue

"Hi,I would like to know, when crawling the data from s3 in order to create a database; does the database must be a relational database ? It can have tables that no relation with other tables ?FollowComment"

Answer: "0The "database" in your question is the Glue Data Catalog database. By crawling data files in S3, you are discovering the schema (metadata) from the data files and creating table(s) in a database as relational representation of the data. So, the answer is "no". It will not be a truly relational database. It is a Glue Data Catalog database object. You do not even need to pre-create the database, you may let crawler create it for you if not exist.CommentSharejputroanswered a year agoposix a year agoIf i undestand, it will not neither a truly relational database on Athena ?ShareMLGuy a year agoWhat is a truly relational database? This is not an Oracle or MySQL, etc. Athena is an SQL engine that allows you to write SQL statements and retrieve data from files in S3 (and many other data sources), including the ability to join "tables", similar to what you can do with a "true" RDBMS.Share"


Question: RDS Postgres + MySQL low read iops

"I'm performance testing some tables in both RDS Postgres and MySQL with the following configurations:Tested each on db.m6g.4xlarge and db.m6g.xlarge instance type1024 GiB storage eachRunning a SELECT * FROM very_large_table, all tables tested are ~80gbMySQL:For the db.m6g.4xlarge instance type,  I was getting variable results on 2 similar tables (exact same schema + same row count + ~same size), one table could be read at >10k iops consistently and the other table lagged behind at <3k iops, this variability was very confusing. Since switching to the db.m6g.xlarge instance type, I've been consistently capped at 1.8k read iops and a max read throughput of 26Mbs. This article says that I should be getting up to 4750 Mbs but I'm getting no where near that.Postgres: Testing on the db.m6g.4xlarge instance type, reading from a table would give me just over 3k iops, 140Mbs throughput. On a db.m6g.xlarge, Im getting at most 2k iops, 100Mbs throughput.Is there a way to guarantee a set number of iops per SELECT * query? It feels like my databases aren't being utilized properly with such intensive workloads. I've tried setting up an RDS MySQL cluster with 10k provisioned iops but my read queries were still capping at ~2k iops.FollowCommentAWS-ADolganov a year agoWhere are you reading from? If EC2, what instance type is it and is it in the same VPC?Sharehwrdw a year agoEc2 c5.4xlarge and same VPCShare"


Question: Determine Identity of IAM user executing the CDK deploy

I would like to get the identity of the IAM user that is executing the CDK deploy so that I can make that user one of the admins for the KMS Key the CDK app creates.When using the AWS CLI we can run "$ aws sts get-caller-identity" to determine what IAM user is executing the command. What is the equivalent of doing that in the CDK?Thank you.FollowComment

Answer: "0From https://docs.aws.amazon.com/cdk/v2/guide/cli.html#cli-environment: "CDK uses credentials from the same sources files as other AWS tools and SDKs, including the AWS Command Line Interface" so that  same command will get what you need.  Note that you can also specify a role by passing it with -rCommentShareSeanManswered a year ago"


Question: dns server configuration

i add the records in my  hosted zone like:my reocrd1 with type A and value d2beyogucyrc8h.cloudfront.net.andrecord2 with type CNAME and value d2beyogucyrc8h.cloudfront.net.i have this error:403 ERRORThe request could not be satisfied.Bad request. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration errorFollowComment

Answer: 0We assume that you are configuring CloudFront based on the contents of the domain.The following document shows how to troubleshoot a 403 error in CloudFront.https://repost.aws/knowledge-center/resolve-cloudfront-bad-request-errorCheck to see if the "Behaviors" settings are correct.CommentShareEXPERTRiku_Kobayashianswered 16 days ago0my Distribution domain name work but my domain name noCommentShareAchemlalanswered 15 days ago0we have a problem with adding DNS recorders. we tried a confirmation message to add is displayed on the screen but at the record level nothing has been added please we need to add this record urgently.Host Name : fse.matype:Avalue :d2beyogucyrc8h.cloudfront.netHost Name : wwww.fse.matype:CNAMEvalue :d2beyogucyrc8h.cloudfront.netcordialementCommentShareAchemlalanswered 15 days ago


Question: Greengress IoT Deployment while deploying docker container from ECR doesn't stop previous run

"I have my docker container hosted in ECR, my component recipe is:{  "RecipeFormatVersion": "2020-01-25",  "ComponentName": <component-name>,  "ComponentVersion": "1.0.46",  "ComponentType": "aws.greengrass.generic",  "ComponentDescription": "A component that runs a Docker container from a private Amazon ECR image.",  "ComponentPublisher": "Amazon",  "ComponentDependencies": {    "aws.greengrass.DockerApplicationManager": {      "VersionRequirement": ">=2.0.0 <2.1.0",      "DependencyType": "HARD"    },    "aws.greengrass.TokenExchangeService": {      "VersionRequirement": ">=2.0.0 <2.1.0",      "DependencyType": "HARD"    }  },  "Manifests": [    {      "Platform": {        "os": "all"      },      "Lifecycle": {        "Run": "docker run --rm --net=host <image_name>",        "Shutdown": "docker stop $(docker ps -a -q --filter ancestor=<image_name> --format=\"{{.ID}}\")"      },      "Artifacts": [        {          "Uri": <image_uri>,          "Unarchive": "NONE",          "Permission": {            "Read": "OWNER",            "Execute": "NONE"          }        }      ]    }  ],  "Lifecycle": {}}My question is, sometimes when the internet connection is slow, the previous deployment's docker run doesn't stop, so I end up having 2 running docker containers. How can I ensure the previous one stops, I have added -rm and a SHUTDOWN command.FollowComment"

Answer: "0Hi, can you try forwarding signals to the container itself?Add --sig-proxy=true to your run command. You can remove the shutdown phase.CommentShareJoeAtAWSanswered 10 months agorePost-User-5878770 10 months agoThanks for the response. Doesn't work unfortunately, I still have 2 containers running. I realized this happens when a new version of the docker container is published to ECR and then deployed.ShareJoeAtAWS 10 months agoIs your process able to process the SIGTERM which is sent by Greengrass? What happens when docker stop is run during shutdown?Share0Hi!You're on the right approach. In the recipe file above, you are mixing Run with Shutdown. Run stands on its own and is good for foreground processes. But in that case, you must honor and process the SIGTERM received.With Shutdown you would use Startup instead of Run. For that, Startup would do a docker run -d --name CONTAINER_NAME and name the container, while Shutdown would do a docker stop CONTAINER_NAME.In summary, Run requires you to run the component in foreground and process SIGTERMs when Greengrass issues a stop to the component. Startup and Shutdown require a exit code of 0 for each, and your Shutdown process would need to know the running container (or process).HTH!CommentShareGavin_Aanswered 10 months ago"


Question: Network traffic within a VPC

"What would cause intermittent network disruptions between servers in the same VPC?For testing purposes I setup a Windows Active Directory server (10.0.0.190) and Web Server (10.0.0.133) in the same VPC (for testing purposes).  The web server has joined the AD domain.  I real all internal traffic is by default disabled in a VPN and so I allowed all inbound traffic on the intranet (10.0.0.0/16) with this security group rule:IP version = IPv4;Type = All Traffic;Protocol = All;Port Range = All;Source = 10.0.0.0/16Windows Firewall is turned off on both servers.DNS server is installed on the AD server.  Web server has its DNS set to the IP of the AD Server.  It is set manually in the network adapter for IPv4.  IPv6 is disabled on both servers.Sometimes the web server can not ping the AD server by name or by IP address.  Sometimes the web server can ping by name (in domain's DNS) and by IP address.What am I missing?Thanks,MikeFollowComment"

Answer: "0I can't think of a good reason why you'd be seeing intermittent network connectivity here. I'd strongly recommend that you raise a support ticket to investigate as the support team can delve into the instances and network services that you're using in order to troubleshoot. On re:Post we have no visibility into your account, services or anything so the support team is best positioned to help.That said: You haven't mentioned which region you're running in nor which instance types you're using. The first is just for interest; but the second might have an impact - smaller instances have less bandwidth available to them - if there is a lot of other traffic between the two instances then that might cause some issues.CommentShareEXPERTBrettski-AWSanswered 7 months ago0+1 to what @Brettski mentioned. Additionally, to rule out OS (windows) specific issues you can spin up Linux EC2 instances in the same exact subnet and see if exhibits same ping/packet loss also? This will help you narrow down the troubleshooting scope. It sounds like both your source and destination servers are windows currently.Secondly, refer this KB article I know this is not VPN related issue but there is 1 Windows related setting (See the section: Explicit Congestion Notification (ECN)) that is suggested to toggle. You may want to give it a try, if it does not resolve the issue you can simply toggle it back.CommentShareEXPERTTushar_Janswered 7 months ago"


Question: Gamelift Matchmaking ticket status flow

"Hey community,We are launching a game with lots ofexpected players rather soon and during our latest tests we found someconfusing information.I have a question about the matchmaking status flow described here and here.Here are the descriptions of thepossible ticket states:Current status of the matchmakingrequest.QUEUED*     -- The matchmaking request has been received and is currently waiting tobe processed.*SEARCHING*-- The matchmaking request is currently being processed.*REQUIRES_ACCEPTANCE *     -- A match has been proposed and the players mustaccept the match (see AcceptMatch     ). This status is used only withrequests that use a matchmaking configuration with a player acceptancerequirement.*PLACING*     -- The FlexMatch engine has matched players and is in the process ofplacing a new game session for the match.*COMPLETED*     -- Players have been matched and a game session is ready to host theplayers. A ticket in this state contains the necessary connectioninformation for players.*FAILED*     -- The matchmaking request was not completed. Tickets with players whofail to accept a proposed match are placed in* FAILED**status.CANCELLED*-- The matchmaking request was canceled with a call to StopMatchmaking.*TIMED_OUT*     -- The matchmaking request was not successful within the durationspecified in the matchmaking configuration.*NoteMatchmaking requests that fail tosuccessfully complete (statuses FAILED, CANCELLED, TIMED_OUT) can beresubmitted as new requests with new ticket IDs.The other source actually describesthe AcceptMatch flow:When FlexMatch builds a match, allthe matchmaking tickets involved in the proposed match are placed into status REQUIRES_ACCEPTANCE*. This is a trigger for your game to get acceptance from allplayers in the ticket. Acceptances are only valid for tickets when they are inthis status; all other acceptances result in an error.*To register acceptance, specify theticket ID, a response, and one or more players. Once all players haveregistered acceptance, the matchmaking tickets advance to status PLACING*, where a new game session is created for the match.*If any player rejects the match, orif acceptances are not received before a specified timeout, the proposed matchis dropped. The matchmaking tickets are then handled in one of two ways: Fortickets where all players accepted the match, the ticket status is returned to SEARCHING to find a new match. For tickets where one or more playersfailed to accept the match, the ticket status is set to FAILED*, and processing is terminated. A new matchmaking requestfor these players can be submitted as needed.*From that I get, that the status theticket will be in after accepting a match will either be PLACING, SEARCHING, orFAILED.Now my problem is, that after aticket was accepted by me as a client, the status I get on it is CANCELLED andit's reason is "FAILURE_TO_ACCEPT" with the message "Matchmakingcanceled due to failure to accept a match within the time out period."I am very sure that my acceptance of the ticket did go through, and theMatchmaking Configuration on AWS does not show any Acceptance timeouts.Is there anywhere a correctdocumentation about the actual flow of states on a ticket? Maybe even a graph?What else could have gone wrong?I appreciate all answers! Thank you.Kind regards,StefanFollow"

Answer: "0Hi Stefan,Thanks for reaching out for this issue. Sounds like there was something went wrong since if you accepted the match, the ticket shouldn't be in CANCELLED. Can you give us the ticketId and region so we can investigate what was wrong there?Best regards,LumingSharerePost-User-5416867answered 4 years ago0Here are the infos:TicketId: 594307a6-adf1-4c94-ad2b-0dd56f49cfc1Region: eu-central-1Approximate Timestamp: 2019.03.11-14.06.13Thanks for looking into it!SharerePost-User-4525948answered 4 years ago0Any news on the ticket status? Is this a possible outcome I have to implement in my client?SharerePost-User-4525948answered 4 years ago0Hey @REDACTEDUSERHow is it looking so far?SharerePost-User-4525948answered 4 years ago"


Question: About using AWS Data Pipeline

"Good afternoon.I would like to know SE when we send a snapshoot of mysql 5.7 rds allocated storage size of 8tb.When I restore from S3 to a new RDS instance, it can only consume the instance that has only 2.4tb?FollowComment"

Answer: "1In your case, if you've taken a snapshot of an RDS instance with 8TB of allocated storage, the new RDS instance created from that snapshot should also have 8TB of allocated storage.However, it's important to note that the actual consumed storage of the new instance depends on the data in the snapshot. If the actual data size in the snapshot is 2.4TB, that would be the consumed storage in the new instance, even though the allocated storage size is 8TB.CommentShareEXPERTsedat_salmananswered 18 days ago"


Question: LexV2 Rest api error Credential should be scoped

"Hello  I'm kinda new in AWS I read a lot and I can't figure out what's going on.when I try to use the lexv2{    "message": "Credential should be scoped to correct service: 'lex'. "}I did the following:Create a CLI aws account (test user)I added the permissions: AmazonLexReadOnly and AmazonLexRunBotsOnly I even added another that I read in another website ( I Created a new policy) with this json:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "lex:GetSession",                "lex:RecognizeText",                "lex:PutSession",                "lex:DeleteSession",                "lex:StartConversation",                "lex:RecognizeUtterance"            ],            "Resource": "*"        }    ]}I created an access api key/secret keyAdded to postman as AWS identification and hitting this urlhttps://runtime-v2-lex.us-east-1.amazonaws.com/bots/KVI5WI1AAA/botAliases/UZA1JMDAAA/botLocales/en_US/sessions/random/text (the last letters I replaced with AAA just to hide the complete url and check if is the name or the ID)I got the botId from lex website, the alias I think is the correct (same from lex but I'm not sure if is the name or this ID), the (access key 1 is the one I'm using, and says Access key last usedNeverI can't figure out what's wrong, I tried to read a lot of tutorials but I have no luck. How I can setup this correctly?FollowComment"

Answer: 0Can you make sure that the Credential scope in your request header has "lex" set as its service name?You can refer the document for more information.https://docs.aws.amazon.com/general/latest/gr/signing-elements.htmlCommentShareSanjay Aggarwalanswered 2 months ago


Question: Alarm on EC2 metrics without specifying instanceID dimension

"I'd like to attach a single "catch all" CPUUtilization metric alarm to all EC2 instances currently or in future deployed to an account. The use case would be something like "tell me if any running instance exceeds 90% CPU". I don't think this is possible, but would like to rule it out before implementing something more complex.I recall reading somewhere that there is a minimum set of dimensions required on an EC2 alarm but can't find that document again. The answer to https://repost.aws/questions/QU5oxWWfePRF-FCJ3UvoeN2Q/create-one-cloudwatch-alarm-for-multiple-instances also suggests this isn't possible, but is a slightly different question in that it's asking about a) on-prem and b) a defined subset of instances rather than all.When deploying alarms through the console it is necessary to select an instance since CPUUtilization is an instance level metric. It is possible though to deploy a CPUUtilization alarm without any dimensions using CloudFormation (dimensions is not a mandatory field), but the alarm then remains in a perpetual state of INSUFFICIENT_DATA.Thanks in advance for any insight you're able to offer.FollowComment"

Answer: "2Accepted AnswerI just created an alarm where I choose "Across All Instances", CPUUtilization, Maximum >= 90. It created an alarm with an empty Dimension array. Getting metrics and status set to OK.CommentShareEXPERTkentradanswered 10 months agoedeastwood 10 months agoThank you. Perhaps I did something wrong. Will check.Shareedeastwood 10 months agoSorry, probably a dumb question, but where are you finding "Across All Instances"? I'm most likely looking in the wrong place (Console > CloudWatch > Alarms > Create Alarm > Browse > EC2).Shareedeastwood 10 months agoFound it. Needs detailed monitoring enabling on the instances: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/GetSingleMetricAllDimensions.htmlShare"


Question: aws.greengrass.Cloudwatch - Broken when network disconnects

"Hello,I am currently trying the 'aws.greengrass.Cloudwatch' component in order to save various metrics to Cloudwatch. The Metrics are getting written as expected, and I am able to view them using my AWS Console.However, when the device is disconnected from the Internet for few minutes, the 'aws.greengrass.Cloudwatch' ceases to work and exits unsuccessfully. After three attempts, this causes the component to go to the 'BROKEN' state, causing no more metrics to be uploaded, thus rendering the whole deployment non-functional.A minimum working example on how to reproduce this issue follows:Cloudwatch=2.0.7Nucleus=2.0.4Consider the following component written in Python. Let us call it 'Thermometer', this component has 'aws.greengrass.Cloudwatch' as one of its dependencies, and is configured as suggested by  https://docs.aws.amazon.com/greengrass/v2/developerguide/cloudwatch-metrics-component.html. This component publishes a message with the Temperature info to the default Cloudwatch topic. The code can be found below:def _break_cloudwatch():      def _publish_one_message(metric_name, value, unit):          request = PublishToTopicRequest(topic='cloudwatch/metric/put')          publish_message = PublishMessage()          publish_message.binary_message = BinaryMessage()          publish_message.binary_message.message = bytes(json.dumps({              "request": {                  "namespace": "Greengrass",                  "metricData": {"metricName": f"{metric_name}",                                 "value": float(value),                                 "unit": f"{unit}"}}}),              'utf-8')            request.publish_message = publish_message          operation = client.new_publish_to_topic()          operation.activate(request)          return operation.get_response()        while True:          client = ipc.connect()          try:              _publish_one_message('Temp', 30, 'Count')          except Exception as e:              logger.warning(f'caught {e}')          time.sleep(5)  Now all we need to do it so disconnect the device from the Internet. After a while, the Cloudwatch component will fail three times in a row, causing it to enter a BROKEN state, which hinders the proper functionality of the deployment as a whole. A log from the Cloudwatch component can be found below:2021-10-22T11:09:43.903Z \[WARN] (pool-2-thread-222) aws.greengrass.Cloudwatch: ipc_client.py:163,deprecated arg port=8000 will be ignored. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING}  2021-10-22T11:09:57.846Z \[ERROR] (pool-2-thread-291) aws.greengrass.Cloudwatch: client.py:21,Error was encountered publishing to cloudwatch:. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING}  2021-10-22T11:10:11.803Z \[ERROR] (pool-2-thread-291) aws.greengrass.Cloudwatch: client.py:21,Error was encountered publishing to cloudwatch:. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING}  2021-10-22T11:10:21.055Z \[ERROR] (pool-2-thread-291) aws.greengrass.Cloudwatch: client.py:21,Error was encountered publishing to cloudwatch:. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING}  2021-10-22T11:10:28.772Z \[ERROR] (pool-2-thread-291) aws.greengrass.Cloudwatch: client.py:21,Error was encountered publishing to cloudwatch:. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING}  2021-10-22T11:10:38.629Z \[ERROR] (pool-2-thread-291) aws.greengrass.Cloudwatch: client.py:21,Error was encountered publishing to cloudwatch:. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING}  2021-10-22T11:10:55.368Z \[ERROR] (pool-2-thread-291) aws.greengrass.Cloudwatch: client.py:21,Error was encountered publishing to cloudwatch:. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING}  2021-10-22T11:11:06.687Z \[ERROR] (pool-2-thread-291) aws.greengrass.Cloudwatch: client.py:21,Error was encountered publishing to cloudwatch:. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING}  2021-10-22T11:11:08.172Z \[ERROR] (pool-2-thread-291) aws.greengrass.Cloudwatch: client.py:21,Error was encountered publishing to cloudwatch:. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING}  2021-10-22T11:11:12.734Z \[INFO] (pool-2-thread-28) aws.greengrass.Cloudwatch: shell-runner-start. {scriptName=services.aws.greengrass.Cloudwatch.lifecycle.shutdown.script, serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=BROKEN, command=\["/greengrass/v2/packages/artifacts/aws.greengrass.LambdaLauncher/2.0.8/lambda-l..."]}  2021-10-22T11:11:12.780Z \[INFO] (pool-2-thread-204) aws.greengrass.Cloudwatch: lambda_runtime.py:370,Caught signal 15. Stopping runtime.. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=BROKEN}  2021-10-22T11:11:20.708Z \[ERROR] (pool-2-thread-291) aws.greengrass.Cloudwatch: client.py:21,Error was encountered publishing to cloudwatch:. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=BROKEN}  As we can see, the component exits unsuccessfully, and enters BROKEN state after around 3 minutes.Is there something that I could have missed concerning the configuration of the deployment? Also, is there perhaps another way of publishing the metrics to AWS Cloundwatch which avoids breaking the 'Cloudwatch' component?Thank you,SimonEdited by: SimonManour on Oct 22, 2021 4:29 AMFollowComment"

Answer: "1Hi SimonManour,we noticed a support ticket was opened for you for this issue. We have replied and will be tracking there.To also update this thread, we have identified the root cause is that in no internet scenario put metric call, awssdk retries several times and sleeps in between retries resulting in lambda timeout for Cloudwatch which is 3 seconds. As a workaround you should be able to override the timeout by doing a new deployment increasing the timeoutInSeconds config parameter to 10-15 seconds here (https://us-west-2.console.aws.amazon.com/iot/home?region=us-west-2#/greengrass/v2/components/public/aws.greengrass.Cloudwatch/versions/2.0.7). This is a bug as there should not be any blocking code inside the function handler and we will be working on that.Thank you,zhaoylinCommentShareAWS-User-zhaoylinanswered 2 years ago0To elaborate a bit more, the following error message gets posted inside the main 'greengrass.log'2021-10-22T11:11:12.733Z \[ERROR] (pool-1-thread-3) com.aws.greengrass.lambdamanager.WorkManager: work-item-timeout. lambda work item timed out. {workItem=76bbb577-fe91-4fd4-a08c-35ea2cb7ab80, arn=arn:aws:lambda:eu-west-1:aws:function:aws-greengrass-cloudwatch:5}  2021-10-22T11:11:12.733Z \[ERROR] (pool-1-thread-3) com.aws.greengrass.lambdamanager.UserLambdaService: service-errored. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING}  com.aws.greengrass.lambdamanager.WorkItemTimeoutException: The work item with invocation id 76bbb577-fe91-4fd4-a08c-35ea2cb7ab80 has timed out, worker lambda arn: arn:aws:lambda:eu-west-1:aws:function:aws-greengrass-cloudwatch:5  at com.aws.greengrass.lambdamanager.WorkManager.lambda$getNextWork$12(WorkManager.java:332)  at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)  at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)  at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)  at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)  at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)  at java.base/java.lang.Thread.run(Thread.java:829)    2021-10-22T11:11:12.733Z \[INFO] (pool-1-thread-3) com.aws.greengrass.lambdamanager.UserLambdaService: service-report-state. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING, newState=ERRORED}  2021-10-22T11:11:12.734Z \[INFO] (aws.greengrass.Cloudwatch-lifecycle) com.aws.greengrass.lambdamanager.UserLambdaService: service-set-state. {serviceInstance=0, serviceName=aws.greengrass.Cloudwatch, currentState=RUNNING, newState=BROKEN}    CommentShareSimonanswered 2 years ago0Hello,thank you for the provided information. So far, I can confirm that by updating Cloudwatch component to version 3.0.0 and using the configuration you have recommended, the service has indeed started to work as expected. The component does not get BROKEN when the network is disconnected, and properly re-establishes the connection as soon as the network is reachable again and stays RUNNING even after a prolonged period of network downtime.Have a nice day,SimonCommentShareSimonanswered 2 years ago"


Question: Scaling cross-account AWS KMS-encrypted S3 access using ABAC

What is the best way to scale cross-account AWS KMS–encrypted Amazon S3 bucket access using ABAC?Tag Name – scaling-cross-account-kms-encrypted-s3-access-using-ABACFollowComment

Answer: 0Accepted AnswerIs this what you are looking for?https://aws.amazon.com/blogs/security/scaling-cross-account-aws-kms-encrypted-amazon-s3-bucket-access-using-abac/CommentShareAdeshGanswered a year agoAWS-User-3522091 a year agoLink is broken... (got 404)Share


Question: SSM - PatchBaseline - Windows update - The find operation did not complete successfully

"Hello,we currently face some failure during AWS-SSM-Patchbaseline operation, only on some servers such as this one :OS Name:                   Microsoft Windows Server 2019 StandardOS Version:                10.0.17763 N/A Build 17763OS Manufacturer:           Microsoft CorporationOS Configuration:          Member ServerOS Build Type:             Multiprocessor FreeSystem Model:              Virtual MachineSystem Type:               x64-based PCProcessor(s):              1 Processor(s) Installed.[01]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2095 MhzBIOS Version:              Microsoft Corporation Hyper-V UEFI Release v4.0, 12/17/2019Windows Directory:         C:\WindowsSystem Directory:          C:\Windows\system32Boot Device:               \Device\HarddiskVolume2System Locale:             fr;French (France)Input Locale:              en-us;English (United States)Time Zone:                 (UTC+01:00) Brussels, Copenhagen, Madrid, ParisTotal Physical Memory:     8,095 MBSSM patchbaseline is failing, Command description and status :Output :Invoke-PatchBaselineOperation : The find operation did not complete successfully.Additional failure information fromWindows Update:HResult: -2145107924 | Message:At C:\ProgramData\Amazon\SSM\InstanceData\mi-05e7367b9c83f5cad\document\orchestration\0be5a4ac-cd73-439a-a928-5917a61e8587\awsrunPowerShellScript\0.awsrunPowerShellScript_script.ps1:195 char:13$response = Invoke-PatchBaselineOperation -Operation Install -Snapsho ...        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~CategoryInfo          : OperationStopped: (Amazon.Patch.Ba...UpdateOperation:InstallWindowsUpdateOperation) [Invoke-PatchBaselineOperation], ExceptionFullyQualifiedErrorId : Exception Level 1:Error Message: The find operation did not complete successfully.Additional failure information from Windows Update:HResult: -2145107924 | Message:Stack Trace:    at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateOperation.OperationDidNotSucceed(String operation, IUpdateExceptionCollection exceptions)at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateOperation.FilterWindowsUpdateSearch(List`1 filteringMethods)at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.InstallWindowsUpdateOperation.GetBaselineFilteredUpdates()at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.InstallWindowsUpdateOperation.GetFilteredUpdates()at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.InstallWindowsUpdateOperation.InstallUpdates()at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.InstallWindowsUpdateOperation.DoWindowsUpdateOperation(),Amazon.Patch.Baseline.Operations.PowerShellCmdlets.InvokePatchBaselineOperationfailed to run commands: exit status 0xffffffffAny help is appreciated.FollowComment"

Answer: "0Hello There,Greetings of the day and I hope you are well!Thank you for reaching out to AWS Support. My name is Ankit and I will be assisting you today. I see you have a question in re:Post.I can see that your Windows Update via PatchBaseline failed with the following error :"Invoke-PatchBaselineOperation : The find operation did not complete successfully.Additional failure information from Windows Update: HResult: -2145107924"Converting HResult: -2145107924 to hex gives us error 0x8024402C [1]. This indicates that the native Windows Update API was unable to run the reach the servers, which the SSM patching process depends on [2], so the issue seems to be at the Windows level.Also note that the error message is "ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved". In case you're using a Proxy server for your Windows Server please ensure that SSM Agent is configured correctly to use it [3].Some general troubleshooting steps you can try include:Verify Date/Time is correct on the instance.Run the Background Intelligent Transfer Service and the Windows Update troubleshooter using the steps below:a. Access Control Panel.b. Select View by: Large iconsc. Click Troubleshooting.d. On the left pane, click View all.e. Choose Background Intelligent Transfer Service from the list.f. On the troubleshooter window, click Advanced.g. Make sure that the Apply repairs automatically check box is checked, and then click Click Next.h. Wait for the troubleshooter to finish running.i. After running the troubleshooter, take note of the results and close the window.j. Choose Windows Update from the troubleshooter list.k. Repeat steps f-i.l. Check if Patch Manager works now.If the issue is not resolved, you can try manually cleaning the SoftwareDistribution folder:a. Stop the following services:net stop wuauservnet stop appidsvcnet stop cryptsvcb. Copy the contents of the following folder to a backup location:C:\Windows\SoftwareDistributionc. Delete the contents of the folder:C:\Windows\SoftwareDistributiond. Start the services:net start wuauservnet start appidsvcnet start cryptsvcIf the above procedure fails, please ensure that there are no local or group policies that modify Windows Update functionality. If these policies are set locally, they would be visible on gpedit.msc under Computer Configuration>Administrative Tools>Windows Components>Windows Update. If these policies are set via Active Directory, they would be visible under the gpresult /r command.If you don't have any policies in place, please attempt to perform these commands to check the overall health of the Windows Operating System:NOTE: Before running below commands I would recommend to take AMI/Backup of your server and schedule downtime because it needs reboot.Dism /Online /Cleanup-Image /ScanHealthDism /Online /Cleanup-Image /CheckHealthDism /Online /Cleanup-Image /RestoreHealthsfc /scannowBelow I have also included some third party articles that might relate to this issue :[+] https://recoverit.wondershare.com/partition-tips/fix-windows-10-update-error-0x8024402c.html[+] https://answers.microsoft.com/en-us/windows/forum/all/microsoft-store-error-code-0x8024402c/2128d07d-b3de-4dca-9db1-f3d8cd250f34[+] https://www.thewindowsclub.com/fix-windows-update-error-0x8024402cI hope that the given information and action plan is helpful to you. If you feel we can provide any additional assistance with regard to this matter, please do not hesitate to let us know and we would be glad to continue working on this issue with you.Thank you and Have a great day ahead!==== REFERENCES ====[1] Windows error 0x8024402C, -2145107924https://windows-hexerror.linestarve.com/0x8024402C[2] About the AWS-RunPatchBaseline SSM documenthttps://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-about-aws-runpatchbaseline.html[3] Configure SSM Agent to use a proxy for Windows Server instanceshttps://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-install-ssm-proxy.htmlCommentShareSUPPORT ENGINEERAnkit_Panswered 4 months ago"


Question: Client AuthN in IoT Core using client certificate with aws-sdk v3

"I'm trying to call IoT Data Plane from a browser (only from localhost) and I'm trying to authenticate the client using a certificate registered in IoT Core. I found some code examples where it's implemented by setting requestHandler in clientConfig:        this.client = new IoTDataPlaneClient({            region: 'us-east-1',            endpoint: 'XXXXX.iot.us-east-1.amazonaws.com',            requestHandler: new NodeHttpHandler({                httpAgent: agent,                httpsAgent: agent            })        })NodeHttpHandler is for backend use and for browser there's FetchHttpHandler (from "@aws-sdk/fetch-http-handler"), which does not allow setting up the agent.What's the best approach to implement certificate+key based authN in IoT from browser?FollowComment"

Answer: "0The AWS SDKs don't support connecting to AWS IoT using the MQTT/mTLS protocol, so don't support certificate based authentication. With the AWS SDKs you can only publish messages to AWS IoT using the HTTPS protocol and AWS credentials as explained in the JS SDK v3 doc hereIf you want to use the MQTT protocol, you have several optionsThe PubSub component of the AWS amplify library support connecting to AWS IoT using MQTT over WebSocket  from a browser using Amazon Cognito/AWS STS token for authentication.If you want to connect to AWS IoT using MQTT and certificate based authentication, take a look at MQTT.jsCommentShareEXPERTJan_Banswered 8 months ago"


Question: AWS Client VPN with OKTA

"Authorization rules with OKTA groups basic setup following this exact setup :https://aws.amazon.com/blogs/networking-and-content-delivery/authenticate-aws-client-vpn-users-with-saml/Authorization rules are not restricting access when CIDR rule is not added , sometimes it allows access for everything regardless of there is a rule for it or not ( seems it uses the configured routes anyways) we are using TGW cross accounts to connect to other VPCsAppreciate confirming how to restrict specific CIDRs only to specific OKTA groups  (SAML ) ? is there anything I'm doing wrong here?FollowComment"

Answer: "0Hello,What you are seeing is expected behavior.Refer the below 2 sections from the link shared.NoteClient VPN uses longest prefix matching when evaluating authorization rules. See the troubleshooting topic Authorization rules for Active Directory groups not working as expected and Route priority in the Amazon VPC User Guide for more details.ProblemI have configured authorization rules for my Active Directory groups, but they are not working as I expected. I have added an authorization rule for 0.0.0.0/0 to authorize traffic for all networks, but traffic still fails for specific destination CIDRs.CauseAuthorization rules are indexed on network CIDRs. Authorization rules must grant Active Directory groups access to specific network CIDRs. Authorization rules for 0.0.0.0/0 are handled as a special case, and are therefore evaluated last, regardless of the order in which the authorization rules are created.For example, say that you create five authorization rules in the following order:Rule 1: Group 1 access to 10.1.0.0/16Rule 2: Group 1 access to 0.0.0.0/0Rule 3: Group 2 access to 0.0.0.0/0Rule 4: Group 3 access to 0.0.0.0/0Rule 5: Group 2 access to 172.131.0.0/16In this example, Rule 2, Rule 3, and Rule 4 are evaluated last. Group 1 has access to 10.1.0.0/16 only, and Group 2 has access to 172.131.0.0/16 only. Group 3 does not have access to 10.1.0.0/16 or 172.131.0.0/16, but it has access to all other networks. If you remove Rules 1 and 5, all three groups have access to all networks.Solution:Verify that you create authorization rules that explicitly grant Active Directory groups access to specific network CIDRs. For example If you add an authorization rule for 0.0.0.0/0, keep in mind that it will be evaluated last, and that previous authorization rules may limit the networks to which it grants access.Hope this helps !!Reference: https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/cvpn-working-rules.htmlCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago"


Question: Unable to Add Github Connection in CodeDeploy

"Hi,I am trying to connect Github with CodeDeploy:When trying to setup the connection, I authorize the application and can see that it is in fact authorized in Github:But the application hangs up after that point.I have cleared cache and cookies and all sort of things trying to get this to authorize.  I have had a successful authorization with CodePipeline.  The only thing that is different between the two auths, is that on the first auth for CodeDeploy, I cancelled the auth in the middle of the process, because I was looking to grant access to a specific repo on Github and the access looked global.  I didn't realize that was going to be the next step of the process.  At this point, it seems there may be something going on within the AWS system that is preventing the auth to go through.Any help on this issue is greatly appreciated.Best,BradFollowComment"


Question: PhycialTableMap value when creating a dataset of datasets using CreateDataSet API

I'm trying to think of a way to create a new dataset by joining existing datasets using CreateDataSet API in javascript.I will mention join and tranforms in LogicalTableMap.What should be the value for PhysicalTableMap be in this case?FollowComment

Answer: "0I don't know if it will be a reference for API key parameters, but it's an excerpt of the code I used to create a dataset with CloudFormation.  # QuickSight DataSet  RepDataSet:    Type: AWS::QuickSight::DataSet    Properties:      AwsAccountId: !Ref AWS::AccountId      Name: 'Join-Company'      DataSetId: 'Join-Company-Id'      ImportMode: SPICE      PhysicalTableMap:        rep-physical:          RelationalTable:            DataSourceArn: !GetAtt AthenaDataSource.Arn            # Set Database Name            Schema:               Fn::ImportValue:                !Sub "${Env}-GlueDatabase-Name"            # Set Table Name            Name: !Ref RepTable            InputColumns:              - Name: source                Type: STRING              - Name: destination                Type: STRING        id-physical:          RelationalTable:            DataSourceArn: !GetAtt AthenaDataSource.Arn            # Set Database Name            Schema:               Fn::ImportValue:                !Sub "${Env}-GlueDatabase-Name"            # Set Table Name            Name: !Ref IdTable            InputColumns:              - Name: id                Type: STRING              - Name: name                Type: STRING      LogicalTableMap:         rep-logical:          Alias: 'rep-Alias'          Source:            PhysicalTableId: rep-physical        id-logical:          Alias: 'id-Alias'          Source:            PhysicalTableId: id-physical        company-logical:           Alias: company-join-rep-id          Source:            JoinInstruction:               LeftOperand: rep-logical              RightOperand: id-logical              RightJoinKeyProperties:                UniqueKey: true              OnClause: 'destination = name'              Type: LEFT      Permissions:        - Actions:            - quicksight:UpdateDataSetPermissions            - quicksight:DescribeDataSet            - quicksight:DescribeDataSetPermissions            - quicksight:PassDataSet            - quicksight:DescribeIngestion            - quicksight:ListIngestions            - quicksight:UpdateDataSet            - quicksight:DeleteDataSet            - quicksight:CreateIngestion            - quicksight:CancelIngestion          Principal: !Sub arn:aws:quicksight:${AWS::Region}:${AWS::AccountId}:user/default/${QuickSightAdminUser}CommentShareARBRanswered a month ago"


Question: AWS EC2 no network

"My EC2 is used in China and has had issues since October 16th ping no longer respondingIn the past, I have configured EC2 to the router and used it normally.The current problem is that when I start the VPN connection of the EC2 on the router, the public IP of the EC2 is no longer responding (ping), if I close the connection, the ping responds fineOr, I configure the VPN of other providers on the router, and then connect the EC2 to the Android mobile phone through the open application, and the public IP (ping) of the EC2 responds normally but there is no network.I now suspect that the firewall of China is blocking my AWS, is there any solutionFollowComment"


Question: Kinesis Source Connector for Apache Spark Structured Streaming

What is the AWS recommended way for using Kinesis as a Source with Apache Spark Structured Streaming if running Spark jobs on EMR (not AWS Glue).There is a third party open source connector library on github that hasn't been updated for several years  and doesn't support Enhanced Fan Out (EFO).Databricks also provide a Kinesis source connector  but from what I can tell you can't use this outside of the Databricks ecosystem.The Apache Spark project also has native support for Kinesis in the older DStreams based Spark Streaming library. They don't appear to have built the equivalent for the newer Structured Streaming library.Is there a well supported option for a Kinesis source connector that I have missed?FollowComment


Question: Call AWS lambda service in Glue script

"Hello All,I am working on Glue pyspark script . In this script I read data from table and store it in pyspark dataframe. Now I want to add new column whose value will be calculated by passing existing columns to lambda and result will be returned.So is it possible to call lambda service in Glue script ?FollowComment"

Answer: "0Hello  Gonzalo, Yes I was thinking same to call lambda as part of UDF . Thanks for confirming this. Just one more thing I would like to ask , will these call to lambda be synchronous .Lets say if I have 100 rows in dataframe . Then lambda will called 100 times in parallel for each row  and whole process gets completed once we get result for each row ( be it correct result or failure ).CommentShareAWS-User-6494745answered 4 months agoGonzalo Herreros 3 months agoThe parallelism depends on the number of partitions in Spark. It won't complete the job until all are partitions and rows are completeShare0Yes, you can call lambda via boto3 inside your Glue code.The issue is that if you do it distributed on the data (if you mean Glue for Spark) is a bit more complicated and you are likely to get throttling errors and much higher cost than if you did that same lambda code inside a Glue udf (or even better SparkSQL)CommentShareGonzalo Herrerosanswered 4 months ago"


Question: ResourceInUseException: An error occurred (ResourceInUseException) when calling the DeleteDataset operation

"I am having trouble with the deletion of Interactions Dataset. I was trying to delete the existing Dataset in my Dataset Group, in order to create a new one, with the boto3 delete_dataset() function (from a Sagemaker Notebook) when I recieved the following error: "ResourceInUseException: An error occurred (ResourceInUseException) when calling the DeleteDataset operation: Please delete all filters before deleting the dataset". I have no filters in the datasets, that is why I was confused.I tried also to delete the same dataset using the CLI, but recieved the same error message. I stoped the ACTIVE recommender in case there was a problem with that but the same error occurred. Can you help me with a solution for this error? Thank you in advance.FollowComment"

Answer: "1Accepted AnswerSince recommenders transparently create a filter to exclude recently watched content (VOD domain recommenders) or recently purchased items (e-commerce domain recommenders), I suspect that is what is triggering the error. Stopping the recommender must not be deleting this internal filter. Therefore, you will probably have to delete the recommender before the dataset can be deleted.CommentShareJames_Janswered 9 months agorePost-User-0199177 9 months agoThank you for your quick response. I will be doing that.Share"


Question: Can Elasticsearch Service RIs be moved across accounts within an organization?

"A customer is using the Amazon Elasticsearch Service as a key part of their company's first major AWS project. The lead of the project using Elasticsearch has recently purchased some Reserved Instances (RIs) for both their Prod and Dev clusters.The customer is now looking into expanding their AWS deployment and using AWS Control Tower to set up a multi-account structure. This may lead them to separate their Prod and Dev Elasticsearch clusters into two different accounts. Once the org structure is set up in Control Tower, is it possible to migrate the RIs to a different account in the same Organization?FollowComment"

Answer: "0Accepted AnswerSuppose Bob and Susan each have an account in an organization. Susan has five Reserved Instances (RIs), and Bob has none. During one particular hour, Susan uses three instances and Bob uses six. This makes nine instances used on the consolidated bill.AWS bills five as RIs. AWS bills the remaining four as On-Demand instances. Bob receives the cost benefit from Susan's RIs only if he launches his On-Demand instances in the same region where Susan purchased her Reserved Instances.To receive the cost benefit of Susan’s RIs, Bob also must use the same instance type Susan reserved. For e.g., let's say Susan purchased m4.large.elasticsearch instances in us-west-2. Bob must launch his Amazon Elasticsearch Service domains in us-west-2 with the same instance type to get the cost benefit on the organization's consolidated billTo share an RI or Savings Plans discount with an account, both accounts must have sharing turned on.Reference:https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/ri-turn-off.htmlCommentShareAWS-User-4548001answered 3 years agoEXPERTNataliya_Greviewed 2 years ago0+1 to the above answer, though I'd like to add a bit more context. While Elasticsearch RIs themselves cannot be moved between accounts (within the service console), the discount customer gets from the RI is actually by default shared between accounts in the same AWS Organization. This means that, if the workloads are moved from one account to another, but the corresponding RIs remain on the old account, the default RI sharing behaviour allows the resources from new account to benefit from the RI discount accrued from the old account.With that said, there is no need to physically move the RIs between the accounts, as they are only relevant as a billing discount that can be still utilized as long as the resources on the new account match the attributes (e.g. region, instance type & size & generation) of the corresponding RI.CommentShareEXPERTNataliya_Ganswered 2 years ago"


Question: What is AWSIOTDataPlaneBuilder?

"Hi repost community,I'm looking to populate AWS IOT core device shadow in a lambda function. I'm looking to use Device Shadow REST API.After looking around, it looks like I need to add "Authorization" header myself.  Then I looked into documentation which suggested me to look into AWS SDK.Finally I found AWSIOTDataPlaneBuilder which does have a bunch of shadow methods I need. But there's no documentations or example for this.So what is AWSIOTDataPlaneBuilder? Is this supposed to be used?if not, is any example for REST API calling to device shadow(from cloud with auth header)? All I found is MQTT examples.FollowComment"

Answer: "1Accepted AnswerHi,when using a Lambda function to update the thing shadow you need to add permission to the Lambda execution role to update the thing shadow: "Action": "iot:UpdateThingShadow".When you use an AWS SDK to interact with the thing shadow you don't need to add an authorization header. You call the UpdateThingShadow API with the language of your choice. Assuming you are using Java because you mention AWSIOTDataPlaneBuilder the UpdateShadow method is documented at https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/services/iotdata/AWSIotData.html.AWS IoT Core provides a control plane and a data plane. The control plane is used to create/update/delete your IoT resources like things, policies, rules, etc. The data plane is used for data in your case sending data to the thing shadow.Cheers,PhilippCommentSharePhilipp Sanswered a year ago"


Question: Crontab is updated at every deplo

"HelloEvery time I do a deploy for one of my instance the crontab is edited and this line is added** ** ** ** * /home/ec2-user/aws-scripts-mon/mon-put-instance-data.pl --mem-util --mem-used --mem-availSo I end up with a crontab with 20 lines like this one which is problematic.It causes various problems, the main one is our instance's disk space is full after a dozen of deploy because of spool/mail/root and mails logs.Any idea why is this occurring ?Thank'sFollowComment"

Answer: "0Never mind, a command was adding this line because of script run after each deploy, I edited it and everythings is working.CommentShareCrashanswered 4 years ago"


Question: Is MediaLive able to handle 8K?

"Hey all, I am currently trying out AWS MediaLive under the free tier to see if it would fit our live stream use case. However, I see that the maximum resolution that the output groups can generate is 3840p (4K), whereas I'm trying to output 7680p (8K) with H265 encoding.Is this a limitation on the free tier or is the maximum that the AWS MediaLive can handle is only 4K? Or is there a setting that I can change to allow 8K output?Thank you!FollowCommentMike-ME a year agoAWS MediaLive is currently limited to encoding UHD/4K images in H.264 and H.265. Please refer to this link for the MediaLive limitation.https://docs.aws.amazon.com/medialive/latest/ug/eml-limitations-and-rules.htmlAlso, the input source type and bitrate may also need to be considered. Are the inputs live push, RTP, RTMP, or are they pull types, MP4, TS, HLS. Each of these inputs have their own practical limitations. 8K live sources could be quite high in bitrate and taxing for other parameters. You may also want to review this information.https://docs.aws.amazon.com/medialive/latest/ug/creating-input.htmlShare"

Answer: "1Accepted AnswerHello,Currently the maximum output resolution is 4K for MediaLive.CommentShareDirkjan_Banswered a year agoEDR a year agoHey, thanks for the answer!It seems I'll have to continue my journey to find a service that's capable of 8K then...Share"


Question: AWS SES: SPF shows none or NEUTRAL on email headers

"I recently setup my SES account to send email from my domain. I created and verified my domain identity adding the required records:DomainKeys Identified Mail (DKIM)Custom MAIL FROM domainStatus for both sections show green "Successful".I did add the MX and TXT records under my domain DNS zone configuration in cPanel.TXT aws.example.com "v=spf1 include:amazonses.com ~all"MX 10 feedback-smtp.us-east-1.amazonses.com(example.com is replaced by my actual domain of course)I do not use Amazon route 53.. whatever that is but maybe it is worth to mention.I am able to send test emails successfully from the Amazon SES >Configuration: Verified identities >mydomain.com section.But when i check the headers on the received emails. The SPF record shows "none". Gmail for example showsDKIM: PASSDMARC: PASSSPF: NEUTRAL with IP xx.xx.xx.xx (amazon SES sending IP addres)When i change records on my cPanel, propagation happens  immediately. I have waited 48 HS and SPF still shows none.The email tests i am sending to gmail seem to pass the checks and they land on the inbox, but with hotmail they are going to spam."Received-SPF: None (protection.outlook.com: aws.mydomain.com does not designatepermitted sender hosts) "My domain is clean, never sent bulk mail nor it is listed on any spam lists.Is there anyway to fix this?Thank youFollowComment"


Question: Building react web application on Lambda

Can I build a react web app on AWS Lambda? What should I configure so that I can host the web and see it on the web browser?FollowCommentDylan Souvage 6 months agoCan you elaborate a bit on what this react web app is? Is it rendered on the client side or does it need server side rendering? Can it be hosted in S3 instead of Lambda?Share

Answer: "2Trying to run an entire React web app on Lambda will make for complex code and will likely get out of hand quickly unless it's very basic. You'd also have to consider other aspects like cold starts and concurrency limits and how this affects performance.A more common and much more easier way is to host your frontend files on S3, and your backend/server-side rendering components on Lambda. Check out this blog post for a detailed example.CommentShareChamalanswered 6 months ago"


Question: RI/SavingsPlan share between AWS Organizations

"Hi Guys, does anyone know if it's possible to share RI/SavingPlans between different AWS Organizations? (someone told me that it's possible but I can't get documentation on that) - I am pretty sure that is not possible but I want to be sure. Thanks in advance! :)FollowComment"

Answer: "4Accepted AnswerRIs/Savings Plans are shared across multiple accounts by default that are part of the same AWS organization, but not ones that are part of different AWS Orgs.How is the pricing benefit of a Reserved Instance (RI) applied in an organization's consolidated billing family?CommentShareMichael_Kanswered a year agoEXPERTRob_Hreviewed a year ago"


Question: unable to delete RDS database cluster due to insufficient storage capacity issue

"when i tried to delete the instance, it showed an error to modify the database and disable delete protection, so i modified the instance by allocating more storage (due to insufficient storage capacity issue) and unchecked the delete protection , but still the database is not being deleted due to same insufficient storage capacity issue.FollowComment"

Answer: "0You should be able to delete it once the instance modification by allocating more storage and unchecked the delete protection is completed successfully.CommentShareVetrivelanswered a year agoAWS-User-4499512 a year agoI already tried multiple times by allocating more storage and unchecking the delete protection, but still am getting same "insufficient storage capacity issue".Share0I could delete putting "delete me" instead of "delete".CommentShareEduardo Offermann Palmaanswered a year ago"


Question: Inconsistent results from Textract

"Hello,I have a question about the inconsistent results coming from Textract for some images.I'm trying to extract handwritten text from images. The image has text with some words crossed out. In general, we have found in our tests that crossed-out words are problematic for Textract to recognize properly. When I did a couple of tests a few weeks ago, Textract was getting at least some of the words correctly, but now when I test it again with the same image, I'm getting some gibberish results.Here is the screenshot of that test:https://gyazo.com/162513b77655d016cbe1c2a1df41c92cInterestingly, when I break down the image into smaller chunks (just a single line), Textract does recognize many words fine.Here is a sample:https://gyazo.com/62b77f4a4ab4686d7748ca411b4330a7I'm not sure if there were any major updates pushed to Textract service recently, which is producing weird and inconsistent results for me. I'd really appreciate any suggestions or help in making Textract produce better and more consistent results.Thanks!FollowComment"

Answer: "0Thank you for providing customer feedback. Seeing the screenshot shown in the link is partially in shadow.To investigate what lead to the inconsistency, may we ask the sample image you used for testing to reproduce the same results?CommentShareAWS-User-3048769answered a year ago0Sure, here are the sample images that I have used in my tests:https://drive.google.com/drive/folders/17PPnmXvMpFAVXQwhhnpiU-OW5eLGXC9s?usp=sharingI understand your point about the images not being bright enough or having some sort of shadow as you said, but the thing is, I was getting better results with the same images a few weeks ago, plus, when I crop the big image into smaller ones, it does produce comparatively better results.Thanks for looking into this matter.CommentShareAWS-User-1509256answered a year ago0Thank you for providing feedback and the sample document(s). I did an investigation and found one of our pre-processing components mistakenly flips this image upside down which is the reason that we see bad results. Really sorry for the inconvenience, I have forwarded your feedback to the science team, and they are currently working on improvement.To get the best results from your documents, I recommend using the best practices provided in our documentation: https://docs.aws.amazon.com/textract/latest/dg/textract-best-practices.html.Thank you for your feedback!CommentShareWenzhuanswered a year ago"


Question: Heterogeneous database links on AWS RDS

Does AWS RDS support heterogeneous database links?Examples:Oracle running on RDS with a database link  to PostgresPostgres running on RDS using the oracle_fwd extension Not possible with RDSFollowComment

Answer: "1Accepted AnswerDatabase links in RDS Oracle are possible for homogeneous scenarios only. For heterogeneous scenarios you would need access in instance level in order to install drivers and configure Oracle Heterogeneous Services to do this, which is not possible in RDS.I have already configured HS (to mySQL) in a Oracle running in EC2, if it is really necessary. I don't recommend because it's hard to handle sessions, I would go deeper in the case and tech requirements, looking for alternatives.CommentShareAWS-User-2735259answered 2 years ago0To refresh the answer: since end of October 2021, AWS offers an additional deployment option, "RDS Custom for Oracle"  https://aws.amazon.com/about-aws/whats-new/2021/10/amazon-rds-custom-oracle/ , with this deployment option the user has access to the underlying host.RegardsCommentShareAWS-ADolganovanswered a year ago"


Question: Receiving renewal emails but already renewed

"My renewal status shows "Success" under Domains, and I manually renewed certificate a few weeks ago when first renewal email arrived. But I'm still getting renewal emails, only now without the second email containing the renewal link, and the Renewal Certificate status says "Pending Validation" when I log into certificate manager.It won't let me send renewal email since it shows it's already been renewed under Domains, so I'm not sure what to do next? Is it renewed or pending?FollowComment"

Answer: "0The solution appears to be simply deleting the old certificate and requesting a new one. That appears to have solved the issue, albeit not how I would have expected. If anyone knows what might have caused that issue, I'd greatly appreciate any insight so we can avoid that problem in the future. Thanks!CommentShareJCDerrickanswered a year ago"


Question: Saving Encrypted Data in Nitro Enclave

"Is it possible to save encrypted data from a Nitro Enclave? Here is my scenario:After performing some computation, I want my service in the enclave to encrypt the data and store it somewhere (perhaps in S3). In the future, when the enclave is terminated and a new one is created, I want my new enclave to be able to retrieve the data from S3 and decrypt my data. Is this possible?For this to work, the enclave will need a decryption key that only the enclave can have access to. I know that in Intel SGX, the manufacturer writes a special key directly into the chip so that nothing else can have access to it. I was wondering if the enclave have have access to a similar key on startup.Perhaps there is another solution to store encrypted data that I haven't thought of. My team and I are debating whether to use S2 or Azure because securely saving data is a really important feature for us. Thank you for reading!FollowComment"

Answer: "0here are some AWS docs that may be helpful:Nitro Enclaves documentation: https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.htmlS3 encryption documentation: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.htmlS3 server-side encryption with KMS documentation: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.htmlUsing AWS KMS with Nitro Enclaves: https://aws.amazon.com/blogs/security/how-to-use-aws-key-management-service-with-nitro-enclaves-for-secure-data-processing/AWS SDKs for encryption: https://aws.amazon.com/encryption/sdk/Example code for using Nitro Enclaves with S3: https://github.com/aws-samples/aws-nitro-enclaves-samples/tree/main/s3-end-to-end-encryptionCommentSharerePost-User-5208427answered 2 months ago0Yes this is possible, every Nitro Enclave at build time generates measurements PCR0, PCR1, PCR2 and optionally PCR8 (but highly recommended). PCR0 is a cryptographic measure of the entire enclave image file. So, in your case you would do something like the following.Store AWS KMS key encrypted data in Amazon S3 bucket.Build an enclave with your application that processes this sensitive data generating the PCR's and enclave image file (EIF).Capture the build time PCR0.Add a KMS key policy conditional to the key from step-1 that only allows decrypt from an enclave with the specific PCR0.In the example, where your current enclave terminates and a future enclave is spawned from the same EIF, it would be able to still decrypt the prior written data to S3.Highly encourage you to read through the PCR's and tighten down the conditional on the KMS key policy further to PCR3, so that you are not tied to particular EC2 instance. (If the usecase permits).CommentShareSudhiranswered 10 days ago"


Question: site to site VPN - Dynamic routes with BGP do not work.

"Hi,in one of our ofices we have Cisco ASA firewall connected to 2 providers.2 site to site VPNs with 2 tunnels on each were created.1 provider is working in active mode and firewall will only use 2 providers if 1 line goes down.If all tunnels are up, site to site VPN is not working.If I disable 2 tunnels on active connection traffic is flowing.If I disable 2 tunnels on passive connection and 1 tunnel on active connection traffic is passing.The only workaround I have found for now is to disable 1 tunnel on active connection and add static route which is sending traffic over the 2nd tunnel.Support case with cisco was created and they are telling me that it is AWS fault, traffic is going from the tunnel but not coming back.Has anyone had the same issue? I may suspect asymmetric routing in this case.FollowComment"

Answer: "0I have managed to find a solution for asynchronous routes over 4 tunnels after watching this video:https://www.youtube.com/watch?v=SMvom9QjkPk&feature=youtu.be&t=10m5susing  set local-preference(higher number is more preferable) and  set as-path prepend parameters on Cisco Asa firewall for prioritizing traffic in and out.router bgp 65000address-family ipv4 unicastneighbor x.x.x.x route-map LOCALPREF-400 inneighbor x.x.x.x route-map PREPEND-X1 outneighbor y.y.y.y route-map LOCALPREF-350 inneighbor y.y.y.y route-map PREPEND-X2 outneighbor z.z.z.z route-map LOCALPREF-300 inneighbor z.z.z.z route-map PREPEND-X3 outneighbor a.a.a.a route-map LOCALPREF-250 inneighbor a.a.a.a route-map PREPEND-X4 out! higher number is more preferableroute-map LOCALPREF-250 permit 10set local-preference 250!route-map LOCALPREF-300 permit 10set local-preference 300!route-map LOCALPREF-350 permit 10set local-preference 350route-map LOCALPREF-400 permit 10set local-preference 400route-map PREPEND-X1 permit 10set as-path prepend 65000route-map PREPEND-X2 permit 10set as-path prepend 65000 65000route-map PREPEND-X3 permit 10set as-path prepend 65000 65000 65000route-map PREPEND-X4 permit 10set as-path prepend 65000 65000 65000 65000I hope it may help to somebody.Edited by: Vasily on Jan 25, 2019 11:35 AMCommentShareVasilyanswered 4 years ago0it resolved my problem with 4 VPN tunnelsCommentShareVasilyanswered 4 years ago0Hi VasilyThis also helped me out a lot with my Transit Gateway VPN attachment to our Cisco ASA firewall. With the VPN ECMP option enabled. So thanks a bunch!Greetz LeonCommentShareleonblcanswered 4 years ago"


Question: EC2 instance in "Stopping" state

"i-07b82b921998944f0 is in stopping state, force stop multiple times doesn't help.in us-east-1c - shouldn't have been impacted by outage (different AZ)Been in stopping state for hoursForce stop doesn't stop itInstance reports "Volume impaired", but status of attached volumes in "EC2->Volumes" is "Okay"Console log is emptySerial connection isn't supported in instanceI tried to create an AMI of the EC2 but I ended up with an AMI with a "Failed" stateThoughts on how to proceed.  Thank you for your assistance.FollowComment"

Answer: "0Hello,Thank you for your question regarding instance stuck in Stopping state. At the time of writing this response, the instance had already stopped.However, moving on to the question of Instance stuck in stopping state, we require details that are non-public information. Please open a support case with AWS using the following link.You may also link this re:Post thread in your Support case.CommentShareSUPPORT ENGINEERAkshay_Banswered a year ago"


Question: error apt-get update no Ubuntu na AWS

"When I run apt-get update it gives the following error:Err:1 http://archive.ubuntu.com/ubuntu focal InReleaseCannot initiate the connection to archive.ubuntu.com:80 (2001:67c:1562::15). - connect (101: Network is unreachable) Cannot initiate the connection to archive.ubuntu.com:80 (2001:67c:1562::18). - connect (101: Network is unreachable) Cannot initiate the connection to archive.ubuntu.com:80 (2620:2d:4000:1::16). - connect (101: Network is unreachable) Cannot initiate the connection to archive.ubuntu.com:80 (2620:2d:4000:1::19). - connect (101: Network is unreachable) Could not connect to archive.ubuntu.com:80 (91.189.91.39), connection timed out Could not connect to archive.ubuntu.com:80 (185.125.190.36), connection timed out Could not connect to archive.ubuntu.com:80 (185.125.190.39), connection timed out Could not connect to archive.ubuntu.com:80 (91.189.91.38), connection timed outReading package lists... DoneW: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal/InRelease Cannot initiate the connection to archive.ubuntu.com:80 (2001:67c:1562::15). - connect (101: Network is unreachable) Cannot initiate the connection to archive.ubuntu.com:80 (2001:67c:1562::18). - connect (101: Network is unreachable) Cannot initiate the connection to archive.ubuntu.com:80 (2620:2d:4000:1::16). - connect (101: Network is unreachable) Cannot initiate the connection to archive.ubuntu.com:80 (2620:2d:4000:1::19). - connect (101: Network is unreachable) Could not connect to archive.ubuntu.com:80 (91.189.91.39), connection timed out Could not connect to archive.ubuntu.com:80 (185.125.190.36), connection timed out Could not connect to archive.ubuntu.com:80 (185.125.190.39), connection timed out Could not connect to archive.ubuntu.com:80 (91.189.91.38), connection timed outW: Some index files failed to download. They have been ignored, or old ones used instead.Please, I already checked all the security part and I didn't find anything that could be preventing the connection, I need help.FollowComment"

Answer: "1Based on your output it appears DNS is working. Have you tried this and used the suggestions to troubleshoot yet? If not I'd give that a shot.CommentShareAdam R - AWSanswered a month ago0I've already used the tips check the subnets route table and it's correct apparently I'm likely to ping websites meaning I have internet access, I'm only able to use apt-get updateCommentSharerePost-User-1665044answered a month agokentrad EXPERTa month agoCan you do a curl or wget on an external website over port 80?SharerePost-User-1665044 a month agoThis is what was generated using wget--2023-04-27 16:04:09--  http://www.google.com/Resolving www.google.com (www.google.com)... 172.253.115.99, 172.253.115.103, 172.253.115.104, ...Connecting to www.google.com (www.google.com)|172.253.115.99|:80...curl did not generate any results.However, port 80 is included in the input and output security rules for ipv4 and ipv6Sharekentrad EXPERTa month agoAre any NACLs assigned to the subnet? Can you post a screen shot of the SG rules as well as any NACLs?SharerePost-User-1665044 a month agoFollow the requested captures to verifySharekentrad EXPERTa month agoThe SGs and NACLs look as if they should allow your calls. At this point I would boot up another generic Ubuntu in the same subnet with a SG that allows all outbound traffic and see if it can download the patches. If successful, this eliminates any routing and NACL issues and points to SG or something local on the server.ShareShow 5 more comments0I would check the route table associated with the subnet hosting the instance. You will need a route to either an Internet Gateway or a NAT Gateway in your public subnet.CommentShareEXPERTkentradanswered a month ago0CommentSharerePost-User-1665044answered a month ago0CommentSharerePost-User-1665044answered a month ago0CommentSharerePost-User-1665044answered a month ago0CommentSharerePost-User-1665044answered a month ago"


Question: Django deployment with Elastic beanstalk (environment variables)

"I have a working EB environment when I'm setting environment variables in .config files. I'm deploying with eb cli. All the variables are also listed in the web interface (as they are automatically added). When I'm removing the environment.config file, which I would like to do because I'm want an extra environment with different variable values, deploy fails.I expose the variables through the terminal with:/opt/elasticbeanstalk/bin/get-config environment | jq -r 'to_entries | .[] | "export (.key)="(.value)""' > /etc/profile.d/sh.localand performing these migration commands:container_commands: 01_migrate: command: "source /var/app/venv//bin/activate && python3 manage.py migrate --noinput" leader_only: true 02_superuser: command: "source /var/app/venv//bin/activate && python3 manage.py createsuperuserifnotexists" leader_only: trueAre the web env variables available during the migration commands?Thanks in advance.FollowComment"


Question: handle SES  feedback loop

"Hi team,I'm looking for the best option to handle SES feedback loop in AWS? We have to handle bounces and complaints.if the user REPORT SPAM or if the email bounces (because you delete your email or the mailbox is full).**so we need to store  feedback loop somewhere **Thank you :)FollowComment"

Answer: 0Hi!There are different ways using which you can handle bounces and complaints in SES.Common methods to achieve this would be either via Notifications (Email feedback forwarding or SNS Notifications) Or Event Publishing (configuration set).Please refer this document to see how you can handle logs in SES: https://aws.amazon.com/premiumsupport/knowledge-center/ses-email-event-logs/You can also store the bounce/complaints in CloudWatch logs : https://aws.amazon.com/blogs/messaging-and-targeting/how-to-log-amazon-ses-details-using-amazon-cloudwatch/You can also refer this blog to see how to handle bounces and complaints : https://aws.amazon.com/blogs/messaging-and-targeting/handling-bounces-and-complaints/Please let us know if you have any questions on this. Thank you!CommentShareSUPPORT ENGINEERIsha_Panswered a year ago


Question: API Key injection for http API

"Hi Team,does the http API support API key ?I only sow examples for API key injection with REST API not HTTP APIFollowComment"

Answer: 0HTTP APIs do not support API Keys. Only REST APIs do. You can see the differences between the two here.CommentShareEXPERTUrianswered a year ago


Question: Status: 5.1.1 Amazon SES has suppressed sending

"I have a website kellystaxi.com and i have google suite email bookings@ekllystaxi.com and it is verified with aws ses with but domain and email but after few weeks my emails from the website and its bookings goes to spam with delivery email notificationThe exact error I got is:Reporting-MTA: dns; amazonses.comRemote-MTA: dns; amazonses.comFinal-Recipient: rfc822; bookings@kellystaxi.comAction: failedDiagnostic-Code: Amazon SES has suppressed sending to this address because it has a recent history of bouncing as an invalid address. For more information about how to remove an address from the suppression list, see the Amazon SES Developer Guide: http://docs.aws.amazon.com/ses/latest/DeveloperGuide/remove-from-suppressionlist.htmlStatus: 5.1.1Can any me help me to fix the issueFollowComment"

Answer: "0When this notification is returned:Amazon SES has suppressed sending to this address because it has a recent history of bouncing as an invalid address is returned when the address is on the SES Global Suppression ListThis happens when SES attempts to deliver a message and it bounces multiple timesCheck and make sure the email address is valid and the recipient mail server is able to receive mail at that addresshttps://aws.amazon.com/premiumsupport/knowledge-center/ses-suppression-list-sending-quota/https://docs.aws.amazon.com/ses/latest/dg/sending-email-global-suppression-list.htmlFor being placed in the spam folder make sure you are authenticating your email sent through SES with DKIM, SPF. and DMARC to help avoid being placed in the spam folderhttps://docs.aws.amazon.com/ses/latest/dg/email-authentication-methods.htmlCommentShareSUPPORT ENGINEERRichard Wanswered a year ago"


Question: How to register properly my custom component?

"Hi guys!I'm fairly new in LY, and I'm trying to figure out with registering of the components. Recently I tried to create my own component for an entity.It compiles finely without any errors.But something going wrong, during LumberyardEditor starting... and I got this errorREMOVEDUPLOADthis is my code :header - https://pastebin.com/6vd8v8zwcpp - https://pastebin.com/yAepvtDialso I add MyComponent in "module" for reginster with pushing in to descriptors;            MyProject123Module() : CryHooksModule(){// Push results of [MyComponent]::CreateDescriptor() into m_descriptors here.m_descriptors.push_back(MyProject123SystemComponent::CreateDescriptor());m_descriptors.push_back(MyComponent::CreateDescriptor());}Follow"

Answer: "0Accepted AnswerI found my mistakeIt's raise an error with original engine's binaries and silently "doing nothing" with my compiled engine binaries - because of the lineAZ::EditContext* edit = serialize->GetEditContext();need to be place in upper if-statment block (not out side it!). So working code now look like this -void MyComponent::Reflect(AZ::ReflectContext *context){AZ::SerializeContext* serialize = azrtti_cast<AZ::SerializeContext*>(context);if (serialize){serialize->Class<MyComponent, AZ::Component >()->Version(1)->Field("Value", &MyComponent::m_value);AZ::EditContext* edit = serialize->GetEditContext();if (edit){edit->Class<MyComponent>("My Component", "")->ClassElement(AZ::Edit::ClassElements::EditorData, "")->Attribute(AZ::Edit::Attributes::Category, "MyProject123")->Attribute(AZ::Edit::Attributes::AppearsInAddComponentMenu, AZ_CRC("Game"))->DataElement(AZ::Edit::UIHandlers::Default, &MyComponent::m_value, "Value", "How much value is big.");}}}SharerePost-User-2514050answered 5 years ago0Yep, there is various UUID because I tried to generate few times new UUID, I'm just thinking maybe something wrong with it. But error raise with any UUID. Moreover, now I compile whole engine and if I register my custom component in discriptors table The LY Editor just won't starting (without any errors). And if I comment the registration of component the LYEditor starts fine. So what a cause of this behaviour ? OoSharerePost-User-2514050answered 5 years ago0The UUID for MyComponent in your header file is{53C195D7-9D87-4B29-B964-16E08E728F36}, which is not what's appearing in your error message. Are you sure you're building the right file?SharerePost-User-6042511answered 5 years ago0I'm just using as a example code base in dir "Lumberyard\1.15.0.0\dev\MultiplayerSample\Gem\Code\Source\Components"my component almost have the same major code parts, to showapping in editor's pop-up menu with components, and I'm just curious why it's not working for me? With original engine's binaries it was raising some error(prev. pic), but now it just silently ignoreSharerePost-User-2514050answered 5 years ago"


Question: My Instances have dissapeared

"Hello All, My insstances have dissapeard for my SQL DB. Yesterday I could not connect to them and today they are gone? What do I do?ThanksPeter HoffmanFollowCommentiwasa EXPERTa year agoHi, Where are you hosting SQL Server? (EC2? RDS? On-premises?)And please tell us in detail what kind of problem we are having.Share"

Answer: 0Instances don't just disappear :)..   Refer this previous POST for more info to determine what happened.  https://repost.aws/questions/QUTF8xpuRFR-6DK5fhcT96Jg/one-of-my-ec-2-instance-was-disappearedCommentShareAlan-Cranfield-awsanswered a year ago


Question: Does an AWS spam scoring service exist?

I was wondering if an AWS service existed that would allow me to send an email to an API via POST and receive spam scoring information. I see that SES does something similar via Receipt Rules but this doesn't seem to fit the scenario I am targeting.Any thoughts on this? Does one exist?FollowComment


Question: Remove all unconfirmed users in a cognito user pool from the console?

"Is there a way to remove all unconfirmed users in a user pool from the web console? I mean all at once. If not, this would be a really nice feature to add.FollowComment"

Answer: "0Accepted AnswerGood question.This isn't possible right now - but what you could do is automate this by listing users and filter for the unconfirmed users, then delete the users.  Some posts I've seen have solutions doing this with a lambda - either via trigger or by a periodically scheduled lambda.CommentSharejsoncanswered a year agoAWS-User-3551753 a year agoThanks for the response. I did see a few other threads that talked about automating this with Lambda. But then I have to pull one of my engineers off his current project. It just seems like such an obvious feature. I actually have several feature requests for cognito. Any idea how to submit a feature request to AWS?Sharejsonc a year agoYou're welcome.  A few options - if you have a TAM, you can reach out via your AWS Account Management Team.  You can also open up feature requests via AWS Support.Share0Once you disable the user, the button "DELETE USER" will appear.CommentSharevad2deranswered 9 months ago"


Question: "SYNTAX_ERROR: line 12:49: '<=' cannot be applied to interval day to second, integer"

The following shows the error above:abs(CAST(PZD.FILLED_CANCELLED_DATE AS INTEGER) - CAST(PZD.ORDER_DATE AS INTEGER)   <= 9ITEM 596 for my referenceFollowComment

Answer: 0Accepted AnswerI think you're missing a closing parentheses. Try:abs(CAST(PZD.FILLED_CANCELLED_DATE AS INTEGER) - CAST(PZD.ORDER_DATE AS INTEGER)) <= 9CommentShareDon_Danswered 7 months agoEXPERTFabrizio@AWSreviewed 7 months agorePost-User-0008739 7 months agook thank you vey muchShare


Question: How do I configure an Amazon MQ instance that's in a VPC to invoke a Lambda function?

"I set up an Amazon MQ instance in a VPC and configured an MQ trigger to invoke a Lambda function. The function is assigned to the same VPC and Security Group as the Amazon MQ instance, but the MQ trigger keeps returning the following error:PROBLEM: Connection error. Please check your event source connection configuration.If I make the Amazon MQ instance publicly accessible, the MQ trigger invokes the function. However, I can't make the Amazon MQ instance publicly accessible because of security requirements.Is there a way to have the MQ trigger invoke the Lambda function without making the Amazon MQ instance public?FollowComment"

Answer: "0Accepted AnswerTo have an Amazon MQ instance that's in a VPC invoke a Lambda function, your broker must either use a public endpoint or provide access to the VPC. To provide access to the VPC, you must create an interface VPC endpoint. For more information, see Configuring interface VPC endpoints for Lambda.CommentShareEXPERTUrianswered 2 years agoAWS-User-9572072 a year agoI have a question to your answer: If the Lambda is within the same VPC as the MQ instance already as the OP said, why do I need to create an interface VPC endpoint? Shouldn't the Lambda already be able to access the MQ instance then?Share"


Question: AWS Parameters and Secrets Lambda Extension lifetime

"I came to know that AWS Parameters and Secrets Lambda Extension has been launched recently to improve the application performance as it decreases the latency and the cost of retrieving parameters and secrets. Source:- https://aws.amazon.com/about-aws/whats-new/2022/10/aws-parameters-secrets-lambda-extension/The above link also states that "This lightweight and easy-to-use extension caches parameters and secrets, and persists them throughout the lifecycle of the Lambda function".So does it mean that this extension creates 1 instance per 1 lambda instance. For e.g. say I have a lambda that has an input as customerid. Gets me the customer phone number from the back-end API which is authenticated via credentials stored in secret manager.if I receive 5 simultaneous requests to this lambda I would have 5 instances of lambda.Would I have 5 instances of the extensions or 1?And if no requests are received for the next 1 hour I believe all lambda instances and extension instances are de-allocated?if yes, what is the benefit of using this extension over storing the secrets in a global variable in the lambda? (read the secret onto the variable for the first time from the secret manager)ThanksHariFollowComment"

Answer: "0The extension runs in your execution environment, so if you're running 5 functions in parallel then you have 5 execution environments so 5 independent instances of the extension.Yes you could store a retreived secret in a global var rather than using the extension's caching - there's not much difference really.  But there's still an advantage to using the extension for that initial retrieval if it means you reduce SDK initialisation cost.CommentShareEXPERTskinsmananswered 2 months ago"


Question: Product experimentation - best practices?

What are your best practices for quickly running product experiments? What tools or services are do your teams use to execute A/B or multi-variate tests?  Any advice or resources for product managers just getting started with experimentation?FollowComment

Answer: "1Accepted AnswerHello - Thanks for posting on the AWS re:Post platform.Although I am not an expert in the field, I would like to provide my two cents on the matter here.For testing/experimentation most of the resources would depend on the "type" of resources that you need - for example EC2s or RDS instances etc.For EC2 - you can use spot instances with auto-scalingFor RDS - again it depends on your DB tech need. But let's say in Aurora - Serverless is a good choice as it can scale as neededFor the other services involved, I think use of configs that provide auto (and seamless) scaling - keeping in mind the cost of the usage should be a good place to start - Hope this helpsCommentShareEXPERTNIRUPAM_danswered 10 months ago"


Question: [1.7] Debugger not working [Win 10 x64][BUG]

"Hi,As I see lua debugger still not working in LY 1.7. It's the same as described:https://forums.awsgametech.com/t/luaremotedebugger-does-not-breaks-on-breakpoints/1585/1#answer-12006https://forums.awsgametech.com/t/lua-debugger-not-working-cannot-connect-to-editor/1586/1I observed that at documentation in GridHub you have different logs with different Qt libraries name. At my computer I have for e.g. (Qt5Core) but at your documentation I see (Qt5Cored). Maybe mismatch with libraries cause this problem ?Also I have this warning:13:46:58|GridMate : Trace::Warningd:\ly\workspace\PKG_v1_7\dev\Code\Framework\GridMate\GridMate\Replica\Replica.cpp(657): 'bool __cdecl GridMateForTools::Replica::Unmarshal(struct GridMateForTools::UnmarshalContext &)'13:46:58|GridMate : Received unknown replica chunk type 0x6f69ff36 at index 1, discarding 26 bytes.which as I see GridHub was not touched in LY 1.7 (is the same version as earlier).ps. Lua Remote Debugger not working as well.Do you provide source code for GridHub and LuaIde to try find solution by myself ? Do you have other ideas what can cause that LuaIde do not see any targets ?Follow"

Answer: "0Accepted AnswerHi @REDACTEDUSERREMOVEDUPLOADRe installation of Windows solve problem fore me :) Thanks for helping :)SharerePost-User-0352889answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-8353690answered 6 years ago0....and the problem went away. Not sure what the heck happened, but it's working now. Weird.SharerePost-User-2420102answered 6 years ago0I'm having a similar experience, though a bit different Error. I did a fresh install of Lumberyard, setup fine, added the Woodland asset package to the samples project, and none of the projects will run now. I keep getting"An error has occurred!d:\ly\workspace\PKG_v1_7\dev\Code\Framework\AzCore\AzCore\Memory\AllocationRecords.cpp(56):'__cdeclAZ::Debug::AllocationRecords::~AllocationRecords(void)'We still have 407 allocations on record! They must be freed prior to destroy!"Not sure where this is coming from, I don't even have a d: drive on the computer. Apologies if this is the wrong place to ask about this, I'm still very new to Lumberyard.SharerePost-User-2420102answered 6 years ago0That is weird... glad it worked itself out. Please start a new thread if that particular error happens again, that'll help us track the issue and get it resolved more quickly.SharerePost-User-8353690answered 6 years ago0Hi @REDACTEDUSERCould you provide dxdiag file (run c:\Windows\SysWOW64\dxdiag.exe then save information to file, compress it (to be able to upload file) and attach it to this thread, it's DirectX component which generate information about your computer and some software as mine: 3676-dxdiag6.zip|attachment (14.4 KB)dxdiag6.zip ). This could be usefull to find differences in our configuration to solve the problem.I hope that this will be fixed.SharerePost-User-0352889answered 6 years ago0Hi @REDACTEDUSERThe problem is some where at my side. I try it on a clean copy of Windows 10 at virtual machine and there is working. So I am going to reinstall my Windows at the moment. Thanks you for your helping, and sorry for problem from my side ;)SharerePost-User-0352889answered 6 years ago0@REDACTEDUSERSharerePost-User-9232254answered 6 years ago0Hey @Binky_LY, this is important because in LY 1.7 are big warning to not use Flow Graph because it will be deleted and ask to use Lua instead. But without debugging it's quite difficult and no one can downgrade their Windows 10 to earlier version to use it. So it's quite big problem for user or studios with new version of Windows (where currently you can buy only Windows 10). Do you reproduce this problem ? How can I help you to resolve it ?p.s.I am sorry for double my question, I will close other threads to stay active just this one.SharerePost-User-0352889answered 6 years ago"


Question: Double subdomain certificate issue.

"So, i have a working hosted zone in account "A", the primary domain name for it, looks like example.com.I have created another hosted zone in account "B", for domain name test.example.com, took generated NS records from there, using those, i created the NS record in account "A" - primary hosted zone (example.com).After that, i requested certificate from AWS ACM in account "B", for domain name *.test.example.com, and validated it by creating the "CNAME" record in hosted zone of account "B" (test.example.com).And now, the problem: i want to create an "A" record, to my ALB, which should look like lb.something.test.example.com (so basically i add 2 additional subdomains within the domain of the hosted-zone test.example.com). The redirection works, but browser is crying about the certificate domain name (which is *.test.example.com) and the url that im trying to request (which is lb.something.test.example.com) not being the same.Even thought, if i set the value for the same "A" record in account "B" hosted zone, to be just something.test.example.com redirection also works, and browser is happy (even thought, i request now url something.test.example.com and the certificate is *.test.example.com).I know it might not be fully connected to the AWS route 53 functionality, but to functionality of the DNS service as whole, but i would appreciate if someone would share any documentation or solution on how to achieve what i need.ThanksFollowComment"

Answer: "0Accepted AnswerWelp, apparently i was just able to use SAN's feature, and it did what i needed - with just 1 certificate (*.example.com) i covered both (*.something-1.example.com) and (*.something-2.example.com).To create via AWS CLI just use :--subject-alternative-names argument for command aws acm request-certificate, but it also is possible to do it via AWS web console.CommentShareJoann Babakanswered 3 months ago0The wildcard in the certificate will not cover multiple levels. You will need to create another subdomain of something.test.example.com and add *.something.test.example.com to the new certificate, if you want to do DNS verification. You could add the different multi-level subdomains to a certificate and use email verification without adding the various DNS subdomains.CommentShareEXPERTkentradanswered 3 months ago"