Question: How to stop CloudFront from redirecting to S3 bucket.

"I have an Amplify Hosting frontend that uses a rewrite redirect (200) to redirect to an S3 bucket. That worked out fine but then I created a CloudFront distribution and since then, the rewrite gives a timeout after 30 seconds serving a 504 error. That is why I disabled and then deleted the CloudFront distribution. However the timeout and 504 error (coming from CloudFront) is still there. Any ideas how to fully remove this CloudFront forwarding or do I have to delete the bucket/frontend?FollowComment"

Answer: "0Hi there,I understand you want to delete CloudFront distribution because of 504 error you keep on getting.Please correct me if I misunderstood.To further understand the issue when getting a 504 error or timeout it indicates that when Cloudfront forwarded a request to the origin ,one of the following might have happened:[1]The origin returned an HTTP 504 status code to CloudFront.[2]The origin didn’t respond before the request expired.Cloudfront will return an HTTP 504 status code if traffic is blocked to the origin by a firewall or security group if the origin isn’t accessible on the internet.Check for these issues first.If access isn’t the problem with your CloudFront check application delays and server timeouts, using link [3] to help you identify and fix the issue.I would also recommend changing the timeout value to 60 seconds.However if you no longer want to use a CloudFront distribution, you can delete it by using the CloudFront console or by using the CloudFront API.Please make sure that you have disabled distribution before deleting it.For more instructions on how to delete CloudFront distribution ,use this link for the console [4] and this link [5] for the CloudFront APII hope the above information is helpful.Reference[3]https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/http-504-gateway-timeout.html#http-504-gateway-timeout-configure-firewall[4]https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HowToDeleteDistribution.html[5]https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteDistribution.htmlCommentShareKaraboanswered a year ago"


Question: Fargate Emphemeral Technology

"Hi,I have been reading about adding extra ephemeral storage to your Fargate tasks:https://aws.amazon.com/about-aws/whats-new/2021/04/amazon-ecs-aws-fargate-configure-size-ephemeral-storage-tasks/My question is: is this actually ephemeral storage as you will find on your EC2 instances - that is backed by a local SSD, just like the instance store? Or is it backed by some other technology (e.g. EBS)?The reason I'm trying to find out is that we have a very IO heavy process that we want to run on Fargate - but we found out EFS is not fast enough, so we are considering alternatives.regards,RobertEdited by: RBakkerSping on Aug 25, 2021 8:52 AMEdited by: RBakkerSping on Aug 25, 2021 9:22 AMFollowComment"

Answer: "0Using EFS is a separate feature (https://docs.aws.amazon.com/AmazonECS/latest/developerguide/efs-volumes.html). Ephemeral storage for Fargate is not implemented using EFS (although please note that the EFS team has released substantial performance enhancements in the last few months). That said, the recommendation is for you to test with your workload to validate that you get the level of performance you need, it's hard to provide generic advice./MatsCommentShareMatsanswered 2 years ago0Hi Matz,Thanks for the answer; I'm aware that EFS is different from Ephemeral storage.Can you confirm that Fargate ephemeral storage is backed by a local SSD, just like the instance store of EC2?regards,RobertCommentShareRBakkerSpinganswered 2 years ago0Exactly what Fargate uses to provide extensible ephemeral storage is an implementation detail that may change over time. Customers should not take a dependency on how it's implemented. The feature is there, we continuously work to make it better in a variety of dimensions (capabilities, performance, etc.), and as a result of that the implementation may change under the covers./MatsCommentShareMatsanswered 2 years ago0Hi Matt,By some tests we did find out that the current implementation is apparently using local ssd disks, but it's good know that we should not rely on that; next step will be to use ECS/EC2 with bind mounts to ephemeral storage from the EC2 instance.regards,RobertEdited by: RBakkerSping on Aug 26, 2021 12:04 PMCommentShareRBakkerSpinganswered 2 years ago"


Question: Selectively exposing a REST endpoint publicly in an AWS EKS cluster in a private VPC

"Cluster information:Kubernetes version: 1.19Cloud being used: AWS EKSSo here is my configuration. I have a private VPC on AWS within which is hosted an AWS EKS cluster. Now this VPC has public facing load balancers which are only accessible from only specific IP addresses. On this EKS cluster are hosted a number of micro services running in their own pods. Each of these pods exposes a REST endpoint.Now here is my requirement. Out of all the REST endpoints that we have, i would like to make only one REST endpoint publicly available from the internet. The remainder of our REST endpoints should remain private accessible only from certain IP addresses.What would be the best approach to achieve this?So far,from what i have researched, here are my options:1)Have another instance of Ingress controller which deploys a public facing load balancer to handle requests to this public facing REST endpoint.This will work. However, i am concerned with the security aspects here. An attacker might just get into our VPC and create havoc.2)Have a completely new EKS cluster which is public facing where i deploy this single REST endpoint. This is something i would like to avoid.3)Use something like AWS API gateway to achieve this. I am not sure if this is possible as i have to research more about it.Anyone has any ideas on how this could be achieved securely?Any advice would be very much appreciated.Regards,Kiran HegdeFollowComment"

Answer: "0You can use ELB to expose the ingress controller to outside traffic. If you expose the public endpoint using AWS Load Balancer Controller, the load balancer in public subnet you created will handle the request as you expected while all other REST endpoints remain private accessible.Please refer to links below.https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.htmlhttps://aws.amazon.com/blogs/containers/introducing-aws-load-balancer-controller/CommentShareEunsu_Shinanswered a year ago0Hello @Eunsu_Shin,Thanks for responding back.So i would like to achieve all of this using Traefik as an ingress controller.  We already have an Ingress controller(Traefik) right now which is only accessible from certain IP addresses.Now, this was all fine up until now.What we would specifically like to do is to expose only one end point within our EKS cluster to the internet and the rest of the cluster should still be private.How would i go about doing this securely?Kindly request you to provide more details.Regards,Kiran HegdeCommentShareAWS-User-1971331answered a year ago0As different answer on this thread, you can try to use ALB Ingress Controller which is formally known as aws-load-balancer-controller.You can install aws-load-balancer-controller in the existing private subnet, and just create Ingress resource with alb.ingress.kubernetes.io/scheme: internal annotation. Then, it will create ALB in the public subnet.If you want to just use the existing public-facing ALB instance, then try TargetGroupBinding CRD feature of aws-load-balancer-controller. It will just link your running pods to the existing target group of the ALB.You can check the detail for TargetGroupBinding in here.CommentShareEXPERTposquit0answered a year ago0Hello @posquit0  Thanks for responding back.  I would like to know if there is a way to achieve this using Traefik as an Ingress controller.  I am new to Kubernetes, so excuse my limited knowledge of the same.Thanks,Kiran HegdeCommentShareAWS-User-1971331answered a year ago0Hi @AWS-User-1971331, you can use your Traffik Ingress controller in private node group without any changes. Just expose your traffik with LoadBalancer type Service object with public facing Network Load Balancer. Then, only NLB is exposed to public. :)CommentShareEXPERTposquit0answered a year ago"


Question: AWS Pinpoint is not working for some provider in Indonesia

"Hi AWS team,I tried using AWS pinpoint as my otp service. However no sms is received for number in telkomsel provider.It works though for other provider eg: xl.FollowComment"

Answer: "0Have you enabled logs and checked the logs? There might be some information there about why you are having problems.Also, Senders are required to use a pre-registered alphabetic sender ID. To request a sender ID from AWS Support, file a support request. Some countries require senders to meet specific requirements or abide by certain restrictions in order to obtain approval. In these cases, AWS Support might contact you for additional information after you submit your sender ID request. Please check the below link for more details.Also, it would be important to check on what you see in the logs. Another best practice would be for messages that are critical or time-sensitive, such as a one-time passwords, leveraging TRANSACTIONAL message type in Amazon Pinpoint is indeed the recommendation.Link-- https://docs.aws.amazon.com/sns/latest/dg/sns-supported-regions-countries.htmlCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago"


Question: Control Tower Setup Failed

"Hi,I was trying to setup Control Tower on personal account but it failed with below reason. In this account earlier I had OU and couple of accounts under OU. But all have been closed couple of days ago.ERROR:-AWS Control Tower failed to set up your landing zone completely: AWS Control Tower failed to update a stack instance. Reason: User: arn:aws:sts::<UNKNOWN_ACCOUNT_NUMBER>:assumed-role/AWSControlTowerExecution/e5c24f06-bc30-4429-8817-7659776eb838 is not authorized to perform: cloudformation:CreateStack on resource: arn:aws:cloudformation:us-east-2:<UNKNOWN_ACCOUNT_NUMBER>:stack/StackSet-AWSControlTowerLoggingResources-e20e52bb-b6a8-4463-b5f6-26c3bdf0f6be/* with an explicit deny in a service control policy Learn moreEND ERRORI am not sure what this 'UNKNOWN_ACCOUNT_NUMBER'(0355XXXXXXXX) is? it doesn't belong to any of my accounts(management or suspended).Does anyone have idea why ControlTower setup failed?Thanks in advance.FollowComment"

Answer: "0Hi,In case your account is not critical, I prefer that you could close and change your email on this AWS account. (Login to the root account)Then moving forward, create a new one to start from scratch because when deploying the Control Tower, it should follow the correct flow, or it will crash.Best regards,Minh LECommentShareMinh Leanswered 17 days ago"


Question: This account is currently blocked and not recognized as a valid account

I am not able to create instance while creating I am getting  This account is currently blocked and not recognized as a valid account. Please contact aws-verification@amazon.com if you have questions.FollowComment

Answer: "0This error comes up when there is some problem with your AWS account.It cannot be used until that issue is resolved.You should have received an email from AWS at the email address associated with your AWS account, so please check it and target the issue.You may also contact AWS Support or contact "aws-verification@amazon.com".CommentShareEXPERTRiku_Kobayashianswered a month ago0Hi,I would suggest to chase AWS Support directly, that is the only way to unblock. The verification team, according to previous answers, seems to reply with quite a bit of delays (a few days, weeks).Hope it helps ;)CommentShareEXPERTalatechanswered a month ago"


Question: ParallelCluster 2.10.1 and SLURM: What EC2 instance types are supported?

"The docs seems to say that you can use a t2.micro as a master_instance or a compute_resource, just for testing and playing around. But I get an an error in the /var/log/parallelcluster/slurm_resume log when I try to run a job using a t3a.xlarge. The compute node won't get started up:""[slurm_plugin.common:add_instances_for_nodes] - ERROR - Encountered exception when launching instances for nodes (x2) ['compute-dy-t3axlarge-1', 'compute-dy-t3axlarge-2']: An error occurred (InvalidParameterCombination) when calling the RunInstances operation: Cluster placement groups are not supported by the 't3a.xlarge' instance type. Specify a supported instance type or change the placement group strategy, and try again.""I looked through the EC2 cluster placement groups documentation and it says while t2 types aren't supported, plenty of other ones including t3 and t3a are. Is there a docs that says what exact kinds of EC2 instance types are supported as parallelcluster compute nodes when using SLURM? Of course I know I can use M4 and M5 but I'm just thinking for testing to use a cheaper instance type.Edited by: ChrisTaylorUSC on Dec 30, 2020 11:42 AMFollowComment"

Answer: "0Accepted AnswerHi,‘t3a.xlarge’ cannot be use here because it is a burstable performance instance.  Burstable performance instances are the only instance types that use credits for CPU usage.According to Cluster placement group rules and limitations in this doc:  https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html#concepts-placement-groups  Instances in a cluster placement group cannot be burstable performance instances.Here is a list of burstable performance instance types: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/burstable-credits-baseline-concepts.htmlLet us know if it helpsCommentSharewanyi-awsanswered 2 years ago"


Question: Intermittent health check timeouts causing ECS to kill tasks

"We have an ECS service running our API. Normally this service runs with ~12 tasks. The service is configured with an HTTP health check that returns a 200 if certain conditions are met - usually this returns within ~200ms. We have a scaling policy that starts new tasks based on the average CPU of our tasks.Recently we have seen that ECS is terminating a large chunk of tasks at a time (often ~50% of the tasks) and then our service drops requests as we don't have the capacity to handle the inbound requests. I have noticed, at least on the most recent occurrence, that we had a spike in traffic of about 40% of our current traffic around the time that ECS terminated a bunch of tasks, however, the capacity should be there in our API to handle this without any issue. This issue has happened ~5 times in the past week or so but is very intermittent and doesn't seem to affect the entire service - only certain tasks.I have checked all of our monitoring and logging and I can't see anything as to why the health check would be failing. The application logs for the tasks are completely normal. All I have to go on are the following messages in the ECS event log:service my-service (port 8000) is unhealthy in target-group my-target-group due to (reason Request timed out).Is there any further troubleshooting I can do to understand what is causing this? Also, if the issue is somehow triggered by an increase in load, is there a way we can prevent the ECS service from immediately terminating the tasks (which inevitably compounds the issue).FollowComment"


Question: AWS DAX Client promise() Error: Request object already used

"Thank you! for taking time to read this post.I am new to JS and stuck in a callback issue related to promise() when querying AWS DAX. There is a post (using the .promise() call on a dax-services dynamodb document client returns error:  Error: ValidationException: Request object already used) related to this issue but am not able to follow the answer.I also visited below page but got stuck as the page does not provide a sample for client.send(command) https://www.npmjs.com/package/@aws-sdk/client-daxI keep getting below error: DaxClientError: ValidationException: Request object already used.Can you please help correcting below code and with explanation to the solution?I will truly appreciate your help. I spent an entire day on this but did not make any progress.const express = require('express');const AWS = require('aws-sdk');const AmazonDaxClient = require('amazon-dax-client');var region = "us-west-2";AWS.config.update({  region: region});const myendpoint = "daxs://mydax.xxxx.dax-clusters.us-west-2.amazonaws.com";const dax = new AmazonDaxClient({endpoints: [myendpoint], region: region});// If using AWS.DynamoDB.DocumentClient ...const doc = new AWS.DynamoDB.DocumentClient({service: dax});// Constantsconst PORT = 8080;const HOST = '0.0.0.0';// Appconst app = express();app.get('/', (req, res) => {  res.send('Hello World');});app.get('/readreview', async (req, res) => {  try{var myresult='empty';    var params = {            TableName: 'test',            Key:{                "id": 'p12',                "key": 'description'            }        };await doc.get(params, function(err, data) {        if (err) {            console.error("Unable to read item. Error JSON:", JSON.stringify(err, null, 2));            } else {              myresult=data;           console.log("@@@@@@@@@"+data);        }    }).promise();    res.send(myresult);}catch (e) {  console.log(e);}});app.listen(PORT, HOST);console.log(`Running on http://${HOST}:${PORT}`);FollowComment"

Answer: "1This problem is caused by using both a callback and the .promise() method, like this:await doc.get(params, function(err, data) {        if (err) {            console.error("Unable to read item. Error JSON:", JSON.stringify(err, null, 2));            } else {              myresult=data;           console.log("@@@@@@@@@"+data);        }    }).promise();The problem is that every call in the DynamoDB API returns an object of type AWS.Request. The actual HTTP request gets sent only when you call the send() method. But passing a callback implicitly calls send(), and calling promise() implicitly calls it again. You can only call send() once.The callback has to be turned into a .then() call.await doc.get(params).promise()       .then(data=>{              myresult=data;        }).catch(err=>{             console.log(err);       });CommentShareEXPERTLeeroy Hannigananswered 8 months ago"


Question: [Kinesis to Amazon Rekogntion] error when running junit example

I am running the specific example  "KinesisVideoRekognitionIntegrationExampleTest" from https://github.com/aws/amazon-kinesis-video-streams-parser-library to produce a local "output" to display the bounding box results from amazon rekognition with reference to this set of steps:  https://aws.amazon.com/blogs/machine-learning/easily-perform-facial-analysis-on-live-feeds-by-creating-a-serverless-video-analytics-environment-with-amazon-rekognition-video-and-amazon-kinesis-video-streams/My video is fed properly to KVS ( able to be seen playing on web console)However i am getting this error when running the junit test with nothing displayed on jframeRunning rekognition-kds-stream-application to process stream RekognitionVideoBlog-Stream as worker host.docker.internal:9d3a6f88-50a1-4ab6-8b65-93594b7627ad...14:09:28.173 [pool-2-thread-2] ERROR com.amazonaws.kinesisvideo.parser.examples.GetMediaWorker - Failure in GetMediaWorker for streamName LiveRekognitionVideoAnalysisBlog java.lang.Error: Unresolved compilation problems:  6 The default case is already definedThe log4j is also triggering java.lang.ClassNotFoundException: com.amazonaws.services.lambda.runtime.log4j.LambdaAppender FollowComment

Answer: "0Hello, there was a patch on May 17th to fix the issue caused from the log4j update.https://github.com/aws/amazon-kinesis-video-streams-parser-library/commit/8e2a86a4d53be865e999c5497f077eb2c6f37e69Are you still experiencing this issue after the patch?CommentSharerePost-User-6497293answered 10 months agorePost-User-297 2 months agoYes I am facing issue as:[pool-2-thread-2] ERROR com.amazonaws.kinesisvideo.parser.examples.GetMediaWorker - Failure in GetMediaWorker for streamName kinesis-video-stream java.lang.RuntimeException: Exception while reading byte from input stream!Mar 29, 2023 12:01:46 PM com.amazonaws.kinesisvideo.parser.kinesis.KinesisRecordProcessor processRecordsINFO: Processing 1 records from shardId-000000000000Mar 29, 2023 12:01:47 PM com.amazonaws.kinesisvideo.parser.kinesis.KinesisRecordProcessor processRecordsINFO: Processing 1 records from shardId-000000000000Getting this  error on repeatShare"


Question: WebSocket API - Posting to connection - Route not found error

"Hi,I'm using AWS Lambda to build a basic chat app, however when trying to post a message back to a connection I get an error"No method found matching route test0/@connections/PxWP8cfSDoECFYw= for http method POST."This is the code....let api = new AWS.ApiGatewayManagementApi({apiVersion : '2018-11-29',endpoint   : event.requestContext.domainName _ '/' _ event.requestContext.stage});await api.postToConnection({ ConnectionId: event.requestContext.connectionId, Data: 'callback'}).promise();Many Thanks,AdyFollowComment"

Answer: "0endpoint : event.requestContext.domainName + '/' + event.requestContext.stage"No method found matching route test0/@connections/PxWP8cfSDoECFYw= for http method POST."Based on the error message and your code, I guess you're using a custom domain name with a base mapping to the API's "test0" stage. In the case,https://YOUR_DOMAIN/test0/@connections/PxWP8cfSDoECFYw=has a same effect to invoke:https://[apiId].execute-api.<region>.amazonaws.com/test0/test0/@connections/PxWP8cfSDoECFYw=(Note there is "test0" twice in the URI)This is the reason why the route was resolved to "test0/@connections/PxWP8cfSDoECFYw=" instead of "@connections/PxWP8cfSDoECFYw=".In the case, you should omit the stage name in the endpoint URI.CommentShareAWS-User-3921561answered 3 years ago0@jwaataws, thanks for the swift response.And yes, looks like you described this scenario exactly, and your suggestion of removing the stage name from the endpoint see this working well.Many Thanks,AdyCommentShareAdyanswered 3 years ago"


Question: AWS AppSync Query editor throws CSP error

"I am unable to login with a Cognito User Pool in the AppSync's Query editor from AWS console. After entering the Client ID, username and password a "Network error" dialog is shown. In the browser's console I can see that the following CSP error is thrown:main.js:263 Refused to connect to 'https://cognito-idp.eu-north-1.amazonaws.com/' because it violates the following Content Security Policy directive: "connect-src https://eu-north-...Any idea if this a bug on the AWS side or if I might be doing something wrong?FollowCommentjohan 7 months agoI'm experiencing this too. As far as I can tell it seems to be a bug in the AWS console. Would be great to see a solution or workaround.Share"


Question: Local Zip Files Transferred to S3

I have a number of local files sitting on a Windows 10 desktop in .Zip format that I am needing uploaded to a S3 bucket. I am comfortable with Python (preferred language) and would be open to learning Node.js or JS for a part of the solution. Guidance on this is appreciated.FollowComment

Answer: "0The AWS SDK for Python provides a pair of methods to upload a file to an S3 bucket. Here's the Boto3 documentation on using those two methods.If instead of using python, you want just a quick one liner using the AWS CLI, here's more info on that.  As an example, it'd look something like this:aws s3 cp filename.txt s3://bucket-nameLastly, don't forget you can just upload directly to S3 via the AWS Console without writing any code. Steps are listed out here.All three methods still require correct IAM permissions to upload to an S3 bucket, so ensure those exist too! Hope this helps!CommentShareAWSJoeanswered a year agognome1984 a year agoI can't upload the files in .Zip format to the S3 bucket is the catch. They must be transferred in .Zip format, unzipped, then transferred to the S3 bucket.ShareAWSJoe a year agoThen the S3-uncompressor @kentrad mentioned would likely be the best option. For large scale data migrations there's also DataSync, but that sounds like it may be overkill. One of the key features is compression during transfer so you could leave the data unzipped and DataSync could still quickly transfer it to S3. That being said an agent is required in the form of a virtual machine that actually migrates the data.Share0You can do this with a Lambda function to unzip the file once it transfers. Here is an example: s3-uncompressor.CommentShareEXPERTkentradanswered a year ago"


Question: Open Source .NET Framework that abstract out AWS CDK calls to EventBridge

"Is there an Open Source .NET Framework that abstract out AWS CDK calls like sending message to EventBridge, logging etc...? The purpose is to focus on the business logic and not on infrastructure. MassTransit is such a framework but does not work with EventBridge.FollowCommentDmitry Balabanov a year agoPlease note that AWS CDK (Cloud Development Kit) is not designed for integrating the AWS services into your applications, but it's rather an infrastructure-as-code toolkit. Did you mean AWS SDK (Software Development Kit) instead?Share"

Answer: "1Accepted AnswerCould you clarify what exactly you are looking to do? The existing open source AWS CDK library makes it very easy to create an EventBus in EventBridge that your application code can later use. For example, in one project I use the following to create one:LicensingEventBus = new EventBus(this, "LicensingEvents", new EventBusProps    {        EventBusName = "LicensingEvents"    });In my application code, I then use the AWS SDK for .NET to push events on to the EventBus:_ebClient = new AmazonEventBridgeClient();var transactionEvents = new PutEventsRequest();var busEntry = new PutEventsRequestEntry    {        Source = this.GetType().Namespace,        EventBusName = _eventBusName,        DetailType = "transaction",        Time = DateTime.Now,        Detail = myEventJson    };transactionEvents.Entries.Add(busEntry);await _ebClient.PutEventsAsync(transactionEvents);CommentShareperkesdpanswered a year agowonderful world a year agoIt is a noise when you use such code in the middle of business logic. These calls can be abstracted out so it will work well with business logic. nServiceBus, MassTransit are examples for libraries.Share"


Question: How to make an email address with custom domain using any of AWS free tier

"Hello,I'm new with AWS. im a bit confused with how to make an email address with a custom domain. I already have a domain hosted and running under ec2.Now, I want to make SES for email - but it asks for existing email for verification. we dont have the email address just yet and not sure how or where to make it. I'm aware of workmail - but its since its paid and we would be using SES further on, I would like to know if theres anyway I can make an email address with custom domain (eg : hello@xxx.com) using any of the AWS free tier.please and thank you for your help.FollowComment"

Answer: "0There should be1-Verify domain with SES2-Set up DNS records to allow SES to send and recieve your emails3-Create email address with custom domain4-Verify Email addressyou should be good to go!CommentShareAWS_Guyanswered 2 months agoPoison Ivy 2 months agohello, thank you. i can follow until step 2, but i cant find anywhere for step 3, only that asks me to put email address for verificationShare"


Question: Compute savings expired last month

If my compute savings plan got expired on last month and now i want to waive off the amount charged on demand on running EC2. Will purchase savings plan this month will help me anyhow ?FollowComment

Answer: "0Accepted AnswerAs waive off kind of things are taken care by Finance team of AWS. So we can raise a support case to AWS using root credential and they will get back on this with best solutionCommentShareRaj Kishoranswered 2 months ago0Thanks for your question..You can sign up for Compute Savings Plan, your compute usage will automatically be charged at the discounted Savings Plans prices. While purchasing you mention Set the start date and time (UTC) for your Savings Plan which indicates when savings plan will be in effect. This can be for same date. Please note you cannot  purchase savings plan for past date.CommentShareAWS-User-3915987answered 2 months agoRaj Kishor 2 months agoMy cost was increased by $4000 due to the format misunderstanding. As it was mentioned as 2023 03 07. I thought it was July 2023I will raise a support case for this. Thanks for your answer but my question was different askShare"


Question: How to debug why EKS nodes are pegging CPU at 100% and going to 'Not Ready' ?

"Configuration and Problem StatementOur org has an EKS deployment running v1.25 with 4 nodes. Every so often, a couple of the nodes will go to Not Ready at the same time. Describing the nodes shows that the kubelet stopped posting status and CloudWatch logs show that the previous statuses show no disk, memory, or PID pressure at the status update just before the node goes down.What We've ObservedWhen I look in the EC2 console at the instances that go to 'Not Ready' I see that the CPU suddenly spikes from ~30% to pegged at 100%, but we did not have a commensurate increase in application load that would cause that, nor did the pods on that node report any error or faults. At the time these nodes go Not Ready, it seems the system is running normally with nothing extraordinary happening. We cannot log into the affected nodes because there's not enough spare CPU cycles to support login (can't get past an initial banner).This seems to be happening more often since upgrading to 1.25 from 1.24, but that is just anecdotal at this point since we've just upgraded a couple weeks back.QuestionThe question is: how to diagnose what is causing these nodes to suddenly spike in CPU usage and become unresponsive?FollowComment"


Question: "Unable to SSH, http, or https to an instance"

"We have configured a floating IP, private IP, SG for the instance, and nacl for the subnet the instance is on but can't reach instance i-0788694f5dec6b823. We originally had a default public IP assigned and changed it to a floating IP as part of our troubleshooting.We have nacl similar to https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#default-network-aclFollowComment"

Answer: "0Helloyour floating ip is an elastic ip?the instance is on a vpc that has an internet gateway and has the right SG and routing tables?hope this helpsRTCommentSharerttanswered 4 years ago0Hi,The floating is an elastic.  We can now SSH which means routing is ok.  But, we are using the CIS Centos image and are having trouble with any other protocol, http/https/. sestatus  SELinux status:                 enabled  SELinuxfs mount:                /sys/fs/selinux  SELinux root directory:         /etc/selinux  Loaded policy name:             targeted  Current mode:                   enforcing  Mode from config file:          enforcing  Policy MLS status:              enabled  Policy deny_unknown status:     allowed  Max kernel policy version:      31    sudo setsebool httpd_can_network_connect on -P    This usually works for SE linux to let NGINX serve up content.CommentShareDTSJanswered 4 years ago0Thank you for taking the time to share this. This was right up the alley with what we needed.CommentShareDTSJanswered 4 years ago"


Question: EC2 Instance Not Connecting / Status Error

"My EC2 instance which hosts my server randomly went down recently. One of the status checks is flagging, and I have included the system log as well. The IAM rules and the security groups are all set and work with other instances. I can't connect to my instance to get the data so I can create a new instance to run our server. I cant even run the command from the log because I cannot SSH into my instance.... Rebooting didnt help either or using the snapshot / AMI image creation / using the volume.https://imgur.com/a/31bqXeIFollowComment"

Answer: "0Hi Iyvan,You could recover your data by launching a new EC2 instance and mounting the Elastic Block Store (EBS) volume from the first instance. This would let you browse the file system of the first instance and copy off any data you needed. You can find instructions for attaching the EBS volume to the new instance in the EC2 documentation. Be sure to first detatch the volume from the first instance..joelCommentShareJoel Knightanswered a year agoIyvan a year agoHey Joel,So I tried this and it causes this error: We were unable to connect to your instance. Make sure that your instance’s network settings are configured correctly for EC2 Instance Connect. For more information, see Task 1: Configure network access to an instance.I had this on my original instance as well, and the instance was able to connect before swapping volumes. Does this mean my data is corrupt and I cannot recover it?Appreciate all the help.Share"


Question: Can I register a new 10DLC number programmatically?

"I am attempting to help a business owner that is interested in switching from Twilio to AWS.  They want to know if there is a way to programmatically register a new customer with a new 10DLC number.  As I research the steps required to online a new customer, I am not seeing that this can be done programmatically.  Please correct me if I am missing something.https://docs.aws.amazon.com/sns/latest/dg/sns-settings-register-company.htmlhttps://docs.aws.amazon.com/sns/latest/dg/sns-settings-associate-long-code-10dlc.htmlFollowComment"

Answer: 0There is not currently a way to register a new customer with a new10DLC number programmatically. You have to register via the console.CommentShareAnaAtAWSanswered 2 months ago


Question: I have a cert showing InUseBy that has not been true for over a year.

"Both the web console and CLI show the same 3 resources are associated with a cert I have. I would like to delete this cert as it expired 351 days ago.Among other things the cert was used on an API Gateway, last year when I updated my certs and their resources I updated this one too and it is no longer used by any AWS resources.All other resources quickly evaporated from the list however the API Gateway resources have remained.aws acm describe-certificate --certificate-arn arn:aws:acm:us-east-1:accountnum:certificate/certid --query "Certificate.InUseBy"[    "arn:aws:elasticloadbalancing:us-east-1:392220576650:loadbalancer/app/prod-id1/otherid1",    "arn:aws:elasticloadbalancing:us-east-1:392220576650:loadbalancer/app/prod-id2/otherid2",    "arn:aws:elasticloadbalancing:us-east-1:392220576650:loadbalancer/app/prod-id3/otherid3"]This is a production API receiving between 50k and 300k requests per hour so deleting the custom domain and replacing it would not be ideal.Are there any known workarounds to get these resources to realize they are not using the cert so I can delete it and show I'm in compliance with my automated scripts.FollowComment"

Answer: "0It seems your certificate is in use on your EC2 load balancers not your api gateway.Check your load balancers in the us-east-1 and see if they are being referenced on any https listenersUnassign the old certificate from the listeners. You can have more than one certificate on a listener.https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#sni-certificate-listCommentShareGary Mcleananswered 12 days agomikegarde 11 days agoIt is an ELB however it is the ELB that exposes the API Gateway, see account number 392220576650 used for us-east-1https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-api-with-vpclink-accounts.htmlShareGary Mclean 11 days agoArh ok see now.. Im not an APi Gateway expert..Found the answer on ACM Problems page.. New answer addedShare0When you deploy a regional API endpoint, API Gateway creates an application load balancer (ALB) on your behalf. The load balancer is owned by API Gateway and is not visible to you. The ALB is bound to the ACM certificate that you used when deploying your API. To remove the binding and allow ACM to delete your certificate, you must remove the API Gateway custom domain that is associated with the certificate.https://docs.aws.amazon.com/acm/latest/userguide/troubleshoot-apigateway.htmlCommentShareGary Mcleananswered 11 days agomikegarde 10 days agoExactly, and I understand this, however this cert was originally used by said API Gateway (aka the ALB AWS owns) and no longer used by it. I updated it last year, and again this year. My problem is that AWS thinks it is still in use by the ALB. Utilizing the API Gateway results in the expected cert, viewing/editing the custom domain for the API Gateway shows the expected cert. Querying the current cert shows it is in use by the API Gateway. But querying the original cert shows it too is in use by the ALB.While typing this I realized a better explanation for my issue.Cert 1 - Issued 2 years ago (expired 1 year ago)Cert 2 - Issued 1 year ago (expired now)Cert 3 - Issued nowWhen the API Gateway was setup Cert 1 was used, one year later Cert 2 was used, and currently Cert 3 is being used. Currently I am attempting to delete Cert 1, however it is blocked because it is "In Use By" the API Gateway. It is not. I am able to delete Cert 2, because it is not "In Use By" the API Gateway.What I am hoping to solve is deleting the Cert 1 without deleting the Custom Domain in the API Gateway. If necessary I can update my internal endpoints to point to the AWS named endpoint and delete the Custom Domain, followed by creating a new Custom Domain with the same settings and reverting the endpoint update to my app.To further clarify, I believe this is an AWS issue and not a Me issue. I believe AWS is mistakenly reporting the "In Use By". I'm looking for a work-around.ShareGary Mclean 10 days agoYeah I think its not you and just how AWS manages these certs. Seems the FIRST cert you use you cant remove without removing the custom domain..Hope you manage to sort it.. Be intrested to know if you do...Share"


Question: Cost comparisons of DynamoDB: Provisioned vs On-demand

"Hi all, I'm trying to get my head around trying to use DynamoDB cost effectively.  I'll be a bit simplistic here, so forgetting any subtlety of sizes of data to read/write etc.  As I read it:  On-demand costs are $1.46 per 1m writes and $0.297 per 1m reads.  Whereas provisioned costs are $0.000772 per write and $0.0001544 per read.Normalising to cost per million units gives:On-demand Write $1.46 per 1mOn-demand Read $0.297 per 1mProvisioned Write $772 per 1mProvisioned Read $154.4 per 1mI must be missing something here, Anybody?Thanks, KEdited by: Kabaman on Jun 4, 2019 4:13 AMEdited by: Kabaman on Jun 4, 2019 4:13 AMFollowComment"

Answer: "0Yes I think you missed the points of the difference between the two.Provisioned means you have a max number of writes/reads per second your table can do, you do not pay per-read, you pay per hour, this is ideal if your table is going to have a predictable traffic, it gets better with the auto scaling, so let's say you have double the traffic during the night, that still is a predictable scenario and provisioned with auto scaling is the best solution.Now the on-demand is when you have no idea how your traffic is going to come, maybe you get a sudden surge of 1 million requests in one hour but no requests on the rest of the day, provisioning for this would end up too expensive or unreliable as it could throttle.Remember that provisioned will throttle if you don't have enough RCUs, and your request will fail.CommentSharemojimianswered 4 years ago0The provisioned throughput costs are for reads or writes per second for one hour. So given your example of $0.0001544 per read, if you use all of your provisioned throughput you can do 3600 reads at one per second over an hour, so the per read price is $0.000000042888889 ($0.0001544/3600), or about $0.043 per million reads.CommentShareAWS-User-9814670answered 4 years ago0Mis-read info, thanks.CommentShareKabamananswered 4 years ago"


Question: Please support domain registration for .gg domains

I'd like to consolidate all of my domain registration on AWS Route53. Please add support for registering/transferring .gg domains and take my money.FollowComment

Answer: "0Hi arcytech77From the note, I understand you would like to consolidate all of your .gg domain registration on AWS Route53.Amazon does support .gg (Guernsey) domain. See the link below on how to transfer registration for a domain to Amazon Route 53[1]. Please note if you skip a step, your domain might become unavailable on the internet.If you encounter issues while transferring a domain, you can contact AWS Support for free. For more information, see Contacting AWS Support about domain registration issues[2].I hope the above information is helpful.References:1.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar-tld-list-geographic.html2.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-contact-support.html3.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-transfer-to-route-53.htmlCommentShareNonkululekoanswered a year ago"


Question: AWS VPN Client: "VPN process quit unexpectedly"

"I can't use AWS VPN Client, as it fails with the error message in the title.The first time I uninstall & re-install the AWS VPN Client, it fails saying that "The VPN process failed to start. The port is already in use by another process." though. Subsequent clicks on the "Connect" button fails saying that "VPN process quit unexpectedly".I've restarted my laptop, thinking that whatever is using the port would stop, however it didn't resolve the issue either. It was working before by the way, I can't remember how long ago though.Platform: MacOSApp version: 3.2.0OS version: Unix 22.3.0.0When it says "port already in use" in the log file I see:2023-04-03 13:58:09.877 +02:00 [WRN] Acs did not stop correctly!2023-04-03 13:58:09.877 +02:00 [ERR] Process died signal sentACVC.Core.OpenVpn.OvpnPortTakenException: The VPN process failed to start. The port is already in use by another process.  at ACVC.Core.OpenVpn.OvpnOsxProcessManager.Start (System.String openVpnConfigPath, System.String managementPortPasswordFile, System.Int32 timeoutMilliseconds) [0x002fb] in <421df7becdc8450287ee7993b2ed23f8>:0   at ACVC.Core.OpenVpn.OvpnConnectionManager.Connect (ACVC.Core.Metadata.OvpnConnectionProfile configProfile, ACVC.Core.GetCredentialsCallback getCredentialsCallback, System.Int32 timeout) [0x0020f] in <421df7becdc8450287ee7993b2ed23f8>:0 When it says "VPN process quit unexpectedly", in the log file I see:2023-04-03 13:59:31.048 +02:00 [DBG] Helper app --start output: pid write failed2023-04-03 13:59:31.055 +02:00 [DBG] DeDupeProcessDiedSignals: The client failed to connect.2023-04-03 13:59:31.056 +02:00 [WRN] Acs did not stop correctly!2023-04-03 13:59:31.057 +02:00 [ERR] Process died signal sentACVC.Core.OpenVpn.OvpnProcessFailedToStartException: The client failed to connect.  at ACVC.Core.OpenVpn.OvpnOsxProcessManager.Start (System.String openVpnConfigPath, System.String managementPortPasswordFile, System.Int32 timeoutMilliseconds) [0x0035f] in <421df7becdc8450287ee7993b2ed23f8>:0   at ACVC.Core.OpenVpn.OvpnConnectionManager.Connect (ACVC.Core.Metadata.OvpnConnectionProfile configProfile, ACVC.Core.GetCredentialsCallback getCredentialsCallback, System.Int32 timeout) [0x0020f] in <421df7becdc8450287ee7993b2ed23f8>:0 FollowComment"

Answer: "0The error message you are seeing is related to the port being used. So it seems that the port used for the AWS Client VPN is already used by perhaps by another VPN process running on the client machine. Rebooting a laptop will usually stop any processes running in your machine. If another VPN ( e.g OpenVPN) process was using the port, then after rebooting, the port will become available for the AWS client to use and hence user will be able to connect again.When the issue happens and error message is displayed, can you please ask the user to list the available ports on the machine using the command prompt or terminal?.- For Mac run:sudo lsof -i -P -n | grep -i listen- For Windows run:netstat -abnetstat -aonThis will help to identify to which process is the port tied up to.Note: also, check the availibility of port 35001. The AWS provided client reserves TCP port 35001 on users' devices for the SAML response. The above will help you to find out the process using the port and ask the user to perform the necessary changes to reserve the port for the AWS Client.CommentSharebodepanswered 2 months ago"


Question: How to create a policy that shows only an especific security group

"Hello, i want to create a IAM policy that the user cans  only modify  outbound/inbound rules of an specific security group, I followed the steps of the documentation, but this policy permit modify all the security groups.I used the documentation:https://docs.aws.amazon.com/es_es/IAM/latest/UserGuide/reference_policies_examples_ec2_securitygroups-vpc.htmlpolicy:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["ec2:DescribeSecurityGroups","ec2:DescribeSecurityGroupRules","ec2:DescribeTags"],"Resource": ""},{"Effect": "Allow","Action": ["ec2:AuthorizeSecurityGroupIngress","ec2:RevokeSecurityGroupIngress","ec2:AuthorizeSecurityGroupEgress","ec2:RevokeSecurityGroupEgress","ec2:ModifySecurityGroupRules","ec2:UpdateSecurityGroupRuleDescriptionsIngress","ec2:UpdateSecurityGroupRuleDescriptionsEgress"],"Resource": ["arn:aws:ec2:region:111122223333:security-group/"],"Condition": {"StringEquals": {"aws:ResourceTag/Department": "Test"}}},{"Effect": "Allow","Action": ["ec2:ModifySecurityGroupRules"],"Resource": ["arn:aws:ec2:region:111122223333:security-group-rule/*"]}]}FollowComment"

Answer: "-1The second Allow is not required IMO{ "Effect": "Allow", "Action": [ "ec2:ModifySecurityGroupRules" ], "Resource": [ "arn:aws:ec2:region:111122223333:security-group-rule/*" ] } ] }Just use ..{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupRules", "ec2:DescribeTags" ], "Resource": "" }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupEgress", "ec2:ModifySecurityGroupRules", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:UpdateSecurityGroupRuleDescriptionsEgress" ], "Resource": [ "arn:aws:ec2:region:111122223333:security-group/" ], "Condition": { "StringEquals": { "aws:ResourceTag/Department": "Test" } } },CommentShareNirmal Rajananswered a month agorePost-User-6114547 a month agoI aplied your sugestion but the problem is still persist{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["ec2:DescribeSecurityGroups","ec2:DescribeSecurityGroupRules","ec2:DescribeTags"],"Resource": "*"},{"Effect": "Allow","Action": ["ec2:AuthorizeSecurityGroupIngress","ec2:RevokeSecurityGroupIngress","ec2:AuthorizeSecurityGroupEgress","ec2:RevokeSecurityGroupEgress","ec2:ModifySecurityGroupRules","ec2:UpdateSecurityGroupRuleDescriptionsIngress","ec2:UpdateSecurityGroupRuleDescriptionsEgress"],"Resource": ["arn:aws:ec2:us-east-1:112345678433:security-group/"],"Condition": {"StringEquals": {"aws:ResourceTag/Department": "Test"}}}]}Share"


Question: Lambda: Failed to create layer version: Unzipped size must be smaller than 262144000 bytes

"Please i need help creating a layer.I have previously done this, only this time my zip file that contains all dependencies is about 600+ mb, and Lambda has a limit of 250mb.What other options do i have, i am thinking docker but i don't know my way around that.But if there are other options i would love to hear thank you.The project is running completely using python.FollowComment"

Answer: "1Accepted AnswerI'd check that all the dependencies included in the zip file are required and if not exclude what can be removed. Like you can remove node_modules in NodeJs or venv in Python.The alternative solutions depend on the use case, for instance how often is your Lambda invoked?if it's invoked once per day or such, you can eventually load the dependencies from S3 on start.You can also mount an EFS network share to your lambda [2]A container image is a good solution for this and you can create an image up to 10Gb. The documentation describes the steps to follow to get started [2].[1] https://aws.amazon.com/blogs/compute/using-amazon-efs-for-aws-lambda-in-your-serverless-applications/[2] https://docs.aws.amazon.com/lambda/latest/dg/images-create.htmlCommentShareEXPERTJonathan_Danswered 4 months agoEXPERTBrettski-AWSreviewed 4 months ago"


Question: AWS Cloud-Shell - Connection on Private IP

Is it possible to connect to AWS service for e.g MySQL DB using private IP from AWS CloudShell on the console. It was in pipeline in 2020 to enable AWS Cloudshell to make connection to other services.FollowComment

Answer: "1No, this is not yet available, below are relevent questions and answers from the CloudShell FAQ around this topicQ: Can I access resources in a VPC with CloudShell?No, you cannot currently access resources that are in your private VPC in this release of CloudShell.Q: What is AWS CloudShell?AWS CloudShell is a browser-based shell that makes it easier to securely manage, explore, and interact with your AWS resources. CloudShell is pre-authenticated with your console credentials. Common development and operations tools are pre-installed, so there’s no need to install or configure software on your local machine. With CloudShell, you can quickly run scripts with the AWS Command Line Interface (AWS CLI), experiment with AWS service APIs using the AWS SDKs, or use a range of other tools to be more productive.Q: What can I do with CloudShell?CloudShell gets you started with the AWS CLI more quickly, so you can automate tasks, manage infrastructure, and interact with AWS services. You can use CloudShell to clone repositories containing commonly used scripts, make edits to those scripts, and store them for future use. You can use AWS SDKs to develop applications and use common CLIs, such as the Amazon Elastic Container Service (Amazon ECS) CLI and the AWS Serverless Application Model (AWS SAM) CLI, to manage your AWS resources. You can save your work at no cost in 1 GB of persistent storage available in your home directory.CommentShareEXPERTTushar_Janswered a year ago"


Question: Does IAM authentication works with Babelfish?

We are evaluating Babelfish migration from SQL Server but would like to know does IAM authentication works with Babelfish? Any guidance would be greatly appreciated.FollowComment

Answer: "1Right now, Babelfish doesn't support IAM authentication; the authentication token is larger than the limit for SQL Server passwords.CommentShareAWS-User-5379561answered a year agolight a year agoThis is the answer as of May 2022, on Babelfish 1.2.0. Babelfish is adding new capabilities all the time, so be sure to check version updates: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/babelfish-compatibility.supported-functionality-table.htmlShare"


Question: AWS Elastic Disaster Recovery onboarding Windows box issue

"Hello!I'm trying to configure protection of my Windows EC2 instance in Oregon to Tokyo region using AWS Elastic Disaster Recovery service.I'm following documentation and looks like almost everything went smooth with subnet and security groups setup, IAM user creation (no STS) and Agent installation. The problem is that now I have initial replication stuck on "Authenticate with service" item for this server in Source servers page.Looking for any suggesting to check please.FollowComment"

Answer: "0Got it running. Thank you for attention!CommentShareigornemyanswered a year agoDonnatamta a year agoHi, I'm stuck at the same place. would you please share how you resolved it? thanksShareigornemy a year agoIn my case "helper" instances needed access to the Internet to reach the DRS endpoint. I had no IGW on those subnets. Reach me on twitter @igornemy.Share"


Question: How do I enable a security framework for an account in AWS Control Tower?

"We've configured AWS Control Tower for our organization, and under AWS Control Tower -> Controls library: Categories -> Frameworks I see a number of frameworks we would like to apply.However, when I click on one of these, like 'CIS AWS Benchmark 1.4' for example, I only have the option to enable a single control at a time.  How can I enable all the controls?Is there a way to update my blueprint (hopefully im using the right terminology) to automatically apply one or more frameworks?FollowComment"

Answer: "0To apply all controls in a framework, you need to enable the framework control group.Here are the steps to enable all controls for a framework in AWS Control Tower:Go to AWS Control Tower console and select your landing zone.Navigate to the "Controls library" section in the left-hand menu.Click on the "Categories" tab and select the framework you want to enable.Click on the "Control Groups" tab, and then click on the control group that has the same name as the framework.Click on the "Enable" button in the top right corner of the screen.This will enable all the controls within the selected framework.To apply multiple frameworks, you can create a custom control set that includes all the controls you want to apply. Here are the steps to create a custom control set:Go to AWS Control Tower console and select your landing zone.Navigate to the "Controls library" section in the left-hand menu.Click on the "Custom control sets" tab, and then click on the "Create control set" button.Give your custom control set a name and description, and then click on the "Create" button.Click on the "Add control" button and select the controls you want to include in your control set.Once you have selected all the controls you want to include, click on the "Save" button.You can then apply your custom control set to all your accounts within your AWS Control Tower landing zone.CommentShareEXPERTsedat_salmananswered 2 months agorePost-User-8472021 2 months agoThanks for your reply.  On step 3 of the first option you say "Click on the "Categories" tab and select the framework you want to enable."  On the categories tab, I dont see a list of frameworks, I see 3 tabs: Control objectives, services and frameworks.When I click on frameworks, and I select one, the only option is to 'View Details'...or click on it.  When I do I see all the controls but now way to enable them beyond clicking each in turn.I also do not see "Custom control sets" under the controls library.SharerePost-User-4924539 13 days agoSeconding @rePost-User-8472021 's comment. There's no "Control Groups" tab and no way I can see to enable these controls in bulkShare"


Question: Datasync between s3 buckets failing "Ensure bucket access role has s3:ListBucket permission

"I'm following this tutorial: https://docs.aws.amazon.com/datasync/latest/userguide/tutorial_s3-s3-cross-account-transfer.html#s3-s3-cross-account-create-datasync-destincationThe steps have been completed accurately through step 3. When attempting step 4, I get the errorAn error occurred (InvalidRequestException) when calling the CreateLocationS3 operation: DataSync location access test failed: could not perform s3:HeadBucket on bucket name-of-my-bucket. Access denied. Ensure bucket access role has s3:ListBucket permission.I've ensured the bucket access role has the s3:ListBucket permission, and I don't know what to do next.FollowComment"

Answer: "1Hi,Please confirm that IAM role which configured with CLI in account A i.e, 'name-of-your-role' must have identity-based policy which has permission(s3:ListBucket) to access Account B bucket. IAM evaluates both identity & resource based policies to allow/deny request for cross-account access. The same 'name-of-datasync-role' also needs permissions in both places. If this is already present, it should work fine.Most likely your cli IAM role 'name-of-your-role' does not have ListBucket permission in Account A.https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic-cross-account.htmlCommentShareAritro Senanswered 3 months agorePost-User-6043349 3 months agoI have confirmed the IAM role in Account A does have s3:ListBucket.However, there is not the same IAM role in Account B. Should there be?ShareAritro Sen 2 months agoIt's just that Account B bucket access policy must give ListBucket permissions to both IAM roles(principles) of Account A. At the same time both IAM roles in Account A must have ListBucket permission for Account B bucket. There is no need to create any separate IAM role in Account B.Share0GreetingsThis error message indicates that there is an issue with the permissions of the AWS DataSync service when trying to access your S3 bucket. To troubleshoot this issue, follow these steps:Double-check the IAM role:Ensure that you have created an IAM role with the correct permissions as described in the tutorial.Verify that the IAM role has a trust relationship with the DataSync service.Review the IAM role policy:Verify that the IAM policy attached to the role has the required permissions, specifically s3:ListBucket and s3:HeadBucket for the specified bucket.Check if the policy has the correct "Resource" specified, which should be the ARN of your S3 bucket. Ensure there are no typos or missing characters in the ARN.Here's an example of a policy that grants the necessary permissions:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:ListBucket",        "s3:HeadBucket"      ],      "Resource": "arn:aws:s3:::name-of-my-bucket"    },    {      "Effect": "Allow",      "Action": [        "s3:GetObject",        "s3:PutObject",        "s3:DeleteObject"      ],      "Resource": "arn:aws:s3:::name-of-my-bucket/*"    }  ]}Verify bucket ownership and access:Confirm that you have ownership of the S3 bucket and that there are no bucket policies or Access Control Lists (ACLs) restricting access to the bucket.Check the bucket name:Make sure that the bucket name you're using in the CreateLocationS3 API call is correct and that it exists in your account.If you've verified all these steps and are still facing issues, try creating a new IAM role and policy with the required permissions, and use that new role in the CreateLocationS3 API call.Please let me know if I answered your questionCommentShareZJonanswered 2 months ago"


Question: AWS Toolkit SSO on Visual Studio 2022 - Assembly AWSSDK.SSOOIDC could not be found

"I've setup my AWS SSO profile on my windows PC and it's working fine in on AWS toolkit with VS Code.However the same profile is giving me the following error when I try AWS toolkit for Visual Studio 2022.I have tried adding AWSSDK.Core new nuget package but still keep failing with the same error. New nuget package is version 3.7. Not sure if AWS Toolkit is looking for the exact 3.3 version of awssdk.Core.I am wondering if anyone has had any success with SSO on AWS Toolkit-Visual Studio 2022?Assembly AWSSDK.SSOOIDC could not be found or loaded. This assembly must be available at runtime to use Amazon.Runtime.SSOAWSCredentials, AWSSDK.Core, Version=3.3.0.0, Culture=neutral, PublicKeyToken=885c28607f98e604.FollowComment"

Answer: "0Hi,From the post I understand that you are trying to set up AWS toolkit for Visual Studio but are getting the error "Assembly AWSSDK.SSOOIDC could not be found or loaded. This assembly must be available at runtime to use Amazon.Runtime.SSOAWSCredentials".After investigating I was able to find a thread that goes over this issue here (1). The likely fix is to update the the version of the tools that you are using. Per the thread that change fixed the issue.  I hope you have a great rest of your day!References(1)https://github.com/aws/aws-extensions-for-dotnet-cli/issues/172CommentShareSUPPORT ENGINEERPatrick_Vanswered a year agorePost-User-2825840 a year agoThanks for your reply. That's a fairly old post.This is a new issue that has been started recently with the latest version. https://github.com/aws/aws-toolkit-visual-studio/issues/267AWS toolkit older versions working fine with SSO, the latest one for 2022 is not working. It's apparently a bug.Share0This was a bug which has been fixed in v 1.34.0.0https://github.com/aws/aws-toolkit-visual-studio/issues/268CommentSharerePost-User-2825840answered a year ago"


Question: Please add TLD ".ai" to Route 53

Hi! We have an urgent requirement of transferring a domain from another registrar to Route53.The TLD is ".ai" but that TLD seems to be missing on the available TLD list. Please consider adding ".ai" to TLD list.Thanks a lot in advance.FollowComment

Answer: "0Hello, thank you for reaching out.I understand that you are requesting to allow .ai TLD Transfer to Route 53Registering .ai TLD within Route 53 is on the roadmap with no public ETAs.Having said that, you can create a Hosted Zone for .ai domain in Route53 to use it as your DNS service provider. This means you can point your name servers at your current registrar to Route 53 to manage your DNS.I recommend subscribing to https://aws.amazon.com/about-aws/whats-new/2022/ and filtering for "Networking & Content Delivery > Amazon Route 53" for updates specific to Route 53.Thanks!CommentShareSUPPORT ENGINEERJAY_Janswered a year ago"


Question: Glue Classifiers Custom datatypes Cloud formation parameter missing

"Unable to add Custom Data Types of a classifier through Cloud Formation Template. It is done throigh only Console, but there is no such parameter available in Cloud formation template.FollowCommentAritro Sen 2 months agoYes. I think this has been added as a feature request to CFhttps://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1542Share"


Question: Elastic Beanstalk failed to unzip source file with UTF-8 file name

"I was trying to deploy a NextJS application to Elastic Beanstalk via eb deploy. But the source bundle failed to unzip during deployment as the source bundle contained some pre-built .next page which the file name is in UTF-8 encoding.  The error is stated as below.2022/xx/xx xx:xx:xx.xxxxxx [INFO] Executing instruction: StageApplication2022/xx/xx xx:xx:xx.xxxxxx [INFO] extracting /opt/elasticbeanstalk/deployment/app_source_bundle to /var/app/staging/2022/01/31 04:56:44.300483 [INFO] Running command /bin/sh -c /usr/bin/unzip -q -o /opt/elasticbeanstalk/deployment/app_source_bundle -d /var/app/staging/2022/01/31 04:56:45.932820 [ERROR] An error occurred during execution of command [app-deploy] - [StageApplication]. Stop running the command. Error: Command /bin/sh -c /usr/bin/unzip -q -o /opt/elasticbeanstalk/deployment/app_source_bundle -d /var/app/staging/ failed with error exit status 50. Stderr:error:  cannot create /var/app/staging/.next/server/pages/\u6e2c\u8a66/\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66.html        File name too longerror:  cannot create /var/app/staging/.next/server/pages/\u6e2c\u8a66/\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66\u6e2c\u8a66.json        File name too longI was able to unzip the file with option -O UTF-8, is there any way I could add this flag to the eb deploy unzip process?edit 1. I am working with the Platform 64bit Amazon Linux 2/5.4.9FollowComment"


Question: AMP emails using AWS SES

What are the steps/procedure to send a dynamic email (AMP emails) using AWS SES.FollowComment

Answer: "0From a sending perspective, you can think of AMP as an advanced way to compose a message, which you can send just like any other message with the SES API. Your AMP content may link to web resources in your AWS account, via CloudFront, or however you choose to design it.From a receiving perspective, each mailbox provider will have requirements in order to receive and display your AMP-enhanced email. These requirements may include:Your domain's DMARC policy must be p=quarantine or p=rejectYour messages must pass SPF or DKIM, and the MAIL FROM domain or DKIM domain must be aligned to the domain in the From headerYou might need to have a multi-month history of sending a substantive volume of DMARC aligned email and have a low level of spam complaints from recipientsYou might need to subscribe to feedback loop processes for the provider (typically referred to as "Postmaster Tools")You need to have a List-unsubscribe header and efficiently honor requests to unsubscribe to keep spam complaints lowCommentShareJesse_Tanswered a year ago"


Question: Running AWS elasticbeanstalk single instance mode in a private VPC

"I tried to create an ElasticBeanstalk Single Instance in a private VPC (without internet) but failed with message like:The EC2 instances failed to communicate with AWS Elastic Beanstalk, either because of configuration problems with the VPC or a failed EC2 instance. Check your VPC configuration and try launching the environment againI have already created the VPC endpoints to various AWS services such as elasticbeanstalk, elasticbeanstalk-health and cloudformation etc. I have already added allow TLS 443 and 80 port from those VPCs inbound to those endpoints as well. Allow all outgoing traffic at the same time.Is it possible to create a single instance EB env in a private VPC?FollowComment"

Answer: "0According to docs it is possible to run in a private vpc. Double check your vpc has dns enabled (enableDnsSupport) and you have chosen the "Enable DNS name" option when creating the vpc endpoints (elasticbeanstalk and elasticbeanstalk-health)CommentShareEXPERTPeter_Ganswered a year agoxianlin_hcl a year agohmm, it seems no matter how I try, the error will always be "missing the internet gateway". I checked with AWS support and this is what they replied:unfortunately, it is not possible to create a single-instance Elastic Beanstalk application without attaching any Elastic IP addressReference: https://github.com/aws/elastic-beanstalk-roadmap/issues/47Anyone here actually created one successfully?Share"


Question: [Announcement] Amazon Redshift Maintenance (January 19th 2022 - March 25th 2022)

"Major Version (01/19/2022)We will be patching your Amazon Redshift clusters during your system maintenance window in the coming weeks. The timing of the patch will depend on your region and maintenance window settings. You can view or change your maintenance window settings from the AWS Management Console. After your cluster has been patched, the new cluster version will be Build 1.0.34934. Please contact us at redshift-feedback@amazon.com if you have any questions.This version includes the following new features and improvements:• Amazon Redshift: The database users that are automatically created when using GetClusterCredentials API to get temporary credentials will now be created with "IAM:" prefix in the database.• Amazon Redshift: User names from this version are treated as case sensitive when surrounded by double quotes irrespective of the value of the configuration parameter "enable_case_sensitive_identifier".• Amazon Redshift: Customers can use ST_Intersection to calculate the intersection of two geometries.• Amazon Redshift: Automatically discovering spatial reference system id (SRID) during COPY of shapefiles when .prj file next to .shp file exists.• Amazon Redshift: Customers can combine two sketches that appear in separate columns into one.• Amazon Redshift: Added support for AUTO table property for distribution style in CTAS.• Amazon Redshift: Customers can use St_GeoHash function to return the geohash value of an input point.• Amazon Redshift: Amazon Redshift ML now supports unsupervised training with K-Means clustering.• Amazon Redshift: Added support for converting interleaved sort keys to compound sort keys or no sort key with Alter Sortkey command.• Amazon Redshift: Added support for the COPY command to automatically split large CSV format files into smaller ranges and scan in parallel.• Amazon Redshift: Added new Redshift Advisor recommendation to switch to specialized column data types (SUPER, GEOMETRY) in beneficial use cases.Additionally, the following fixes are included:• With the performance improvement for the numeric datatype, this resolves a sig11 issue with all customers using drivers that send numeric to Redshift server in binary mode like .Net driver.Minor Version(s)(02/07/2022)We will be patching your Amazon Redshift clusters during your system maintenance window in the coming weeks. The timing of the patch will depend on your region and maintenance window settings. You can view or change your maintenance window settings from the AWS Management Console. After your cluster has been patched, the new cluster version will be Build 1.0.35480. Please contact us at redshift-feedback@amazon.com if you have any questions.This version includes the following new features and improvements in addition to what is available in the major version:• Amazon Redshift: Public Preview of Redshift Streaming Ingestion for Kinesis Data Streams (KDS) pulls data from a KDS stream into a Redshift Materialized View (MV) in near real-time with high throughput. Please note: Preview features are not to be used to run production workloads. To get started see the Redshift documentation.Additionally, the following fixes are included:• Fixed a rare situation where with Materialized View auto refresh enabled, external functions cause Redshift cluster instability.(02/15/2022)We will be patching your Amazon Redshift clusters during your system maintenance window in the coming weeks. The timing of the patch will depend on your region and maintenance window settings. You can view or change your maintenance window settings from the AWS Management Console. After your cluster has been patched, the new cluster version will be Build 1.0.35649. Please contact us at redshift-feedback@amazon.com if you have any questions.This version includes the following new features and improvements in addition to what is available in the major version:• Amazon Redshift: Public Preview of Redshift Streaming Ingestion for Kinesis Data Streams (KDS) pulls data from a KDS stream into a Redshift Materialized View (MV) in near real-time with high throughput. Please note: Preview features are not to be used to run production workloads. To get started see the Redshift documentation.Additionally, the following fixes are included:• Fixed a rare situation where with Materialized View auto refresh enabled, external functions cause Redshift cluster instability.(03/03/2022)We will be patching your Amazon Redshift clusters during your system maintenance window in the coming weeks. The timing of the patch will depend on your region and maintenance window settings. You can view or change your maintenance window settings from the AWS Management Console. After your cluster has been patched, the new cluster version will be Build 1.0.36224. Please contact us at redshift-feedback@amazon.com if you have any questions.This version includes the following fixes in addition to what is available in the major version:• Fixes an issue that causes some data sharing queries being stuck when running on Concurrency Scaling clusters.• Fixed a rare situation where with Materialized View auto refresh enabled, external functions cause Redshift cluster instability.(03/25/2022)We will be patching your Amazon Redshift clusters during your system maintenance window in the coming weeks. The timing of the patch will depend on your region and maintenance window settings. You can view or change your maintenance window settings from the AWS Management Console. After your cluster has been patched, the new cluster version will be Build 1.0.36905. Please contact us at redshift-feedback@amazon.com if you have any questions.This version includes the following fixes in addition to what is available in the major version:• Miscellaneous fixesFollowCommentSrikanth_N SUPPORT ENGINEERa year agoThis is an announcement migrated from AWS Forums that does not require an answer.Share"


Question: Health check is too frequently

"Hello. I run my instance using launching configuration and autoscaling group. On the details tab I see: Health check grace period = 300. Also, I have a load balancer with target group. I set up health checks in the target group: timeout - 5 seconds and interval - 10 seconds. So, I should get one health check request for every 10 seconds. When I visit a cloudwatch log events, I see, that health checks requests sends too frequently, even I filter it by IP's:2022-04-04T15:08:27.012+03:002022-04-04T15:08:31.690+03:002022-04-04T15:08:33.899+03:002022-04-04T15:08:34.061+03:002022-04-04T15:08:43.366+03:002022-04-04T15:08:43.898+03:002022-04-04T15:08:44.063+03:002022-04-04T15:08:45.473+03:002022-04-04T15:08:47.303+03:002022-04-04T15:08:49.343+03:002022-04-04T15:08:53.915+03:002022-04-04T15:08:54.067+03:002022-04-04T15:08:57.148+03:002022-04-04T15:09:02.237+03:002022-04-04T15:09:03.913+03:002022-04-04T15:09:04.067+03:002022-04-04T15:09:13.789+03:002022-04-04T15:09:13.920+03:002022-04-04T15:09:14.076+03:002022-04-04T15:09:15.833+03:002022-04-04T15:09:17.460+03:002022-04-04T15:09:19.721+03:00Sometimes I can see 2 health checks in one second. Why? what can I do to fix it?FollowComment"

Answer: "0Accepted AnswerIn my case, I need to create different target groups with different health checks configurations and attach them to the load balancer (instead of instance) to listen and forward the request to a specific target group behind the load balancer.CommentShareKonstantinZanswered a year ago0Each load balancer node independently checks your targets at the given rate. If you filter the healthcheck requests by just one node's IP, you should see it at a rate of once per 10s.If the frequency of the healthchecks is causing your application issues, you can either reduce the frequency (which may mean a longer delay before an unhealthy node is detected), or consider creating a specific healthcheck endpoint which the application can use to indicate its status but avoids any other expensive processing your current one may be incurring.CommentShareEXPERTJames_Sanswered a year agoKonstantinZ a year agoThank you for your answer. I checked, that even one IP has many health checks record:INFO - 2022-04-05 09:17:25 - tornado.access - 200 GET /userapi/healthcheck (10.0.3.121) 0.55msINFO - 2022-04-05 09:17:29 - tornado.access - 200 GET /userapi/healthcheck (10.0.3.121) 0.45msINFO - 2022-04-05 09:17:32 - tornado.access - 200 GET /userapi/healthcheck (10.0.3.121) 1.11msI even log into docker of application and using  docker logs --follow --since 5m f99ff94a0ff5 check log flow to confirm frequently requests. So my health check works fine, but too frequent. I made next experiment: I have this application with 2 revisions: "green" like active and "blue" like active and alternative. In the alternative "blue" cloudwatch I see correct log flow 1 request per 10 seconds but on the "green" cloudwatch I see frequent log flow like I provided above in this post. So application directly doesn't have an additional health check feature. I checked target group again - it healthy, works good, but I got many health check request which increase total price on my amazon account. Mybe any other idea what I need to check?ShareKonstantinZ a year agoAlso, I found an article on StackOverflow, which promised, that the bug was fixed, but it concerned NLB. I do not use NLB, just load balancer, maybe I need to check the update? any suggestions?https://stackoverflow.com/questions/48135471/nlb-target-group-health-checks-are-out-of-controlShareJames_S EXPERTa year agoThat is strange. I'd suggest opening a support ticket in that case so that the support and service teams can investigate your load balancer to see why it is performing health checks so frequently.ShareKonstantinZ a year agoJames, Support helped me to determine strange behavior: I use the Load balancer with 7 target groups attached to the one EC2 instance. Unfortunately, I do not know how to solve this issue, I can't create each Load Balancer for each target group because I use DNS name for Route 53. Maybe you can provide me with any solution?Share"


Question: GameLift adds support for new rule type ‘BatchDistance’ in FlexMatch

"Hello GameLift devs,Today, the GameLift team is excited to announce the launch of a new rule type called “BatchDistance”. When creating a rule set for FlexMatch matchmaking, this new rule type allows for a string or numeric attribute to be specified, giving you more flexibility and improving matchmaking quality for large matches (>40 players). There are also benefits to smaller matches (i.e., less than 40 players), with simplification of syntax.Previously, large match support in FlexMatch only allowed for balancing teams according to a single numeric attribute (with skill being the typical example). While this allowed for evenly-matched teams, your players could still end up in a match playing against players with varying skill variances. The following example demonstrates how this can happen:You are creating a match where teams are balanced by “skill”, where GameLift would try to ensure that the “skill” of each team is as close as possible to each other.Let’s say one team has two players with“skill” values of 1 and 99, and another has two players that have “skill” values of 49 and 51. In both cases, the two teams have an average skill value of 50, so they are evenly balanced.This results in one team with a high variance in ability (i.e., the team with skill values of 1 and 99), while the other team has a very low variance, leading to a potential mismatch.Now, with this new rule type “batchDistance”, you have the ability to create a large match with players with similar attributes. For numeric attributes, you can also specify a “maxDistance”, where all formed batches will contain players where that attribute is within a certain distance of each other. So using the above example, if you set a maxDistance of 25, you would end up with matches that contain players will skill 0-25, 15-40, etc.There are many other ways the new batchDistance rule type can help you create higher quality, balanced matches:For large matches (>40 players), you can also balance based on modes and maps. Ensure everyone in the match is in a skill band, band multiple numeric attributes like league or playstyle, and group according to string attributes like map or game mode.For small matches (up to 40), you can use a simpler syntax to express certain common rules.For both large and small matches, you can create expansions over time. For example, you can create an expansion to allow a greater skill level range to enter the match the longer the player is waiting.For more information, please refer to the following:Release NotesFlexMatch Docs UpdateMark Choi, GameLift PMFollowComment"


Question: SSLError on GET request from Chalice to IoT Core

"Hello,I am receiving an SSLError when trying to send a GET request from my Chalice backend (which runs as a lambda) to Iot Core Device Shadow service, via Boto3 client for IoT Core. Here is the workflow I am looking to achieve:GET --> Chalice Backend (Lambda) --> Helper Module (Boto3) --> GET --> IoT Core Device Shadow REST APIMore details: this Helper Module uses a boto3 iot-data client to make requests to the Device Shadow REST API. Using this module alone, if I provide AWS_SECRET_KEY and AWS_ACCESS_ID as env variables, as advised in the boto3 configuration docs, I can successfully make the requests. The trouble starts when I try introducing the Chalice Backend into this workflow. More details about the boto3 module: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iot-data.html.I import the Helper Module to the backend, and when I call something like Helper.get_thing_shadow(...), it no longer works and I get an SSLError, with the following logs:...1666806563116 Traceback (most recent call last):1666806563116 File "/var/task/urllib3/connectionpool.py", line 703, in urlopen1666806563116 httplib_response = self._make_request(1666806563116 File "/var/task/urllib3/connectionpool.py", line 386, in _make_request1666806563116 self._validate_conn(conn)1666806563116 File "/var/task/urllib3/connectionpool.py", line 1042, in _validate_conn1666806563116 conn.connect()1666806563116 File "/var/task/urllib3/connection.py", line 414, in connect1666806563116 self.sock = ssl_wrap_socket(1666806563116 File "/var/task/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket1666806563116 ssl_sock = _ssl_wrap_socket_impl(1666806563116 File "/var/task/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl1666806563116 return ssl_context.wrap_socket(sock, server_hostname=server_hostname)1666806563116 File "/var/lang/lib/python3.9/ssl.py", line 501, in wrap_socket1666806563116 return self.sslsocket_class._create(1666806563116 File "/var/lang/lib/python3.9/ssl.py", line 1041, in _create1666806563116 self.do_handshake()1666806563116 File "/var/lang/lib/python3.9/ssl.py", line 1310, in do_handshake1666806563116 self._sslobj.do_handshake()1666806563116 ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)...1666806621896 botocore.exceptions.SSLError: SSL validation failed for https://data.iot.<my-region>.amazonaws.com/things/<thing-name>/shadow [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)What is going wrong with the authentication here, and how can I complete this workflow? I would like to avoid having to provide my personal aws access tokens to provide authentication, the backend authenticates the initial request and I just want to post a request to the IoT Core service from the backend after that.Thank youFollowComment"

Answer: "1Accepted AnswerHi! The validation error is due to the data endpoint FQDN using the deprecated Symantec certificate. To resolve, you can provide the endpoint to use for the IoT Core data endpoint to your account specific one.client = boto3.client('iot-data', region_name='eu-central-1', endpoint_url='https://xxxxxxxxxxxxxx-ats.iot.eu-central-1.amazonaws.com')To remove the need for hard-coding the endpoint, you can use this snippet:iot_client = boto3.client('iot', region_name=os.environ['AWS_REGION'])endpoint_response = iot_client.describe_endpoint(endpointType='iot:Data-ATS')endpoint_url = f"https://{endpoint_response['endpointAddress']}"client = boto3.client('iot-data', region_name=os.environ['AWS_REGION'], endpoint_url=endpoint_url)Credit to this Stack Overflow post.Please let us know if this works!CommentShareGavin_Aanswered 7 months agoEXPERTAWS-User-Nitinreviewed 7 months agorePost-User-9327550 7 months agoOh wow, thank you so much this fixed the issue!Share"


Question: How do I provide a custom username for the Linux install?

"Hello,I want to use a different username instead of the one provided by default with the install. Can I create an instance which uses a name provided by me instead of using default ubuntu for Ubuntu OS.Regards,Sudhir.FollowComment"

Answer: "0Thanks for using Lightsail. The default user name can't be changed. However, you can add another user to the instance using 'sudo adduser new-user-name'. Please note that some of the functionalities on the Lightsail console will not apply to the new user name.CommentShareAWS-User-2776000answered 3 years ago0Thanks for your response SteveN-AWS.Please note that some of the functionalities on the Lightsail console will not apply to the new user name.Are the functionalities documented anywhere?CommentSharesudhirkhangeranswered 3 years ago0This functionality is not unique to Lightsail ... it's a basic Linux function.In fact, 95% of the functionality inside a Amazon Linux instance is unrelated to Lightsail, it's all basic system administration.Edited by: David G on Mar 18, 2020 10:08 AMCommentShareDavid Ganswered 3 years ago"


Question: AWS Athena Prepare Statements for Sub Query- SYNTAX_ERROR: line 1:1: Incorrect number of parameters: expected 1 but found 2

"I am using AWS Athena,I have a subquery like this.select * from (WITH dataset (json_str) AS (    VALUES (            json '{            "address":{               "streetAddress":"101",               "city":"abc",               "state":"",               "phoneNumbers":[                  {                     "type":"home",                     "number":"11"                  },                  {                     "type":"city",                     "number":"4"                  }               ]            }         }'        )) -- queryselect street_address,    cityfrom (        select JSON_EXTRACT_SCALAR(json_str, '$.address.streetAddress') as street_address,            JSON_EXTRACT_SCALAR(json_str, '$.address.city') as city,            cast(                JSON_EXTRACT(json_str, '$.address.phoneNumbers') as array(json)            ) phones        from dataset    )where    cardinality(        filter(            phones,            js->json_extract_scalar(js, '$.type') = ?    **-- Parameter 1**                and json_extract_scalar(js, '$.number') = '4'        )    ) > 0 ) as  t where t.city =?    **-- Parameter 2**When in AWS console, it gives me the error: Please find the screenshotError Message: SYNTAX_ERROR: line 1:1: Incorrect number of parameters: expected 1 but found 2FollowComment"


Question: Unable to set bucket accelerate configuration - Administrator Access

"I trying to deploy with the serverless framework and get this error for an S3 bucket where I want to enable S3 Transfer Acceleration.API s3:setBucketAccelerateConfiguration Access DeniedMy user and cli has AdministratorAccess  policy.Best,ArthurFollowComment"

Answer: "0Greetings Arthur,I have noticed that this issue occurred to many people before. I found a similar question here on re:post and was addressed by an AWS Support Engineer.Please check here.Apparently for this issue you'd need to provide information that is non-public which would make things easy to find the root cause of the problem.I hope this helps.CommentShareLungaanswered a year agoarthur a year agoYea, I found also this and created a Technical Support case. Let's see what they say.Share"


Question: How to add collision to exported FBX House?

"So I have exported a 3D House from Blender 3d, and made it so that the player could enter the house.I have tried to add the CryPhysics Proxy, but there is still no collision on my mesh...I also tried exporting my model with a duplicate Mesh in the same FBX, with the '_phys' suffix. But the character still walks through the walls...How do I add collision the proper way?Thanks.Follow"

Answer: "0Hi! Did you tried add Static Physics component + Mesh Collider component ?REMOVEDUPLOADThis is my pipeline for tree in few images.Mesh (LOD0)REMOVEDUPLOADLOD1REMOVEDUPLOADPhysREMOVEDUPLOADSharerePost-User-2514050answered 4 years ago0A simple convex (total enclosure of an object) collider is used rather than a complex concave (the mesh is the collider) collider. export the FBX form Blender then In lumberyard; in the asset browser double click on the FBX; add modifier CryPhysics Proxy; check update materials; click the arrow before the CryPhysics Proxy option to expand it; click the button after the Physics Meshes [0 of 1 physics meshes selected] & select the mesh; click Update; drag the FBX from the asset browser into the editor viewport; in the Entity Outliner, the entity generated from the FBX must have the Mesh Collider & Static Physics components. You still will not be able to enter the house because a convex mesh collider is created for it. You need to break apart the house in Blender piece by piece with each of their origins in the same position then export each piece as a separate FBX then just parent all of the pieces under one entity to be able to move all of it at the same time. Game engines no longer support concave colliders because of the extremely high demands it puts on the CPU/GPU & there is no way around it. If you build a game with concave colliders only super computers can run it.SharerePost-User-6748027answered 4 years ago0This is something which needs to think about it but somehow I have managed to do that with the help of dell printer error 016-302 and suggested me to have some requirements like Mesh Collider & Static Physics components.SharerePost-User-8432145answered 4 years ago0Cute scene, nice idea, but 170 planes ? OMGBTW 2.8 is prettty decent, but don't blame you yet, as its still not 'stable' :)Thx for sharing.SharerePost-User-2755327answered 4 years ago0I sure HOPE, this is just a beta behavior, love LY, but thats a nightmare, ue4 makes it so easy, in most cases last I checked it does it for you, lightmaps and all, depending ofc on complexity.SharerePost-User-2755327answered 4 years ago"


Question: Why is "cognito-idp:UpdateGroup" not included in the AdministratorAccess-Amplify Policy

I am curious as to why the "cognito-idp:UpdateGroup" is not included in the AdministratorAccess-Amplify policy. Upon inspection of the afore mentioned policy I see that "cognito-idp:CreateGroup" and "cognito-idp:DeleteGroup" are included. I am mostly trying to ascertain if there is a security or data risk associated with updating a cognito group via the Amplify CLI that is not apparent the average user. Any information is greatly appreciated.FollowComment


Question: EMR Serverless integration with Step Functions

I know Step Functions use AWS SDK and it gets updated regularly so my questions:What is the SDK update cycle for Step Functions?Do we know if EMR Serverless can be integrated without using Lambda or other compute in between?ThanksAtharvaFollowComment

Answer: "0Hi Atharva, please find the answer to your queries below:The SDK update cycle for Step Functions is not public. the service team updates the respective SDK for each sub-version release after performing thorough testing internally which can vary from time to time.currently, you would need to use compute services like Lambda or a worker to make EMR serverless API calls as currently AWS Step Functions do not support it. this is already a noted feature request to the service team. While I am unable to comment on if/when this feature may get released, I request you to keep an eye on our What's New[1] and Blog[2] pages for any new feature announcements.[1] https://aws.amazon.com/new/?wn-featured-announcements.sort-by=item.additionalFields.numericSort&wn-featured-announcements.sort-order=asc&whats-new-content-[2] https://aws.amazon.com/blogs/aws/CommentShareSUPPORT ENGINEERAWS-User-0774443answered 10 months agorandom-user 5 months agoIs there any location/channel where timeline for these updates can be tracked?Share"


Question: Share and use Dedicated Hosts among multiple IAM users

"Hi,Is it possible to share and use Dedicated Hosts among multiple IAM users?For example, IAM user A launches EC2 instance #A on some Dedicated Hosts.Can IAM User B run EC2 instance #B on the same Dedicated Hosts?I have read the FAQ below.https://aws.amazon.com/ec2/dedicated-hosts/faqs/At the beginning of this FAQ, it says "fully dedicated for your use."But I'm not sure if it can be dedicated by one IAM user.FollowComment"

Answer: "2Hi there,Yes, you can do what you are trying to do.  This dedicated host is available for your entire AWS account's use.  Anyone you give permission to run/control those instances applies whether you have a dedicated or shared host.  IAM policies should be the same as well.Hope this helps.CommentShareRob_Elanswered 9 months agoAWS-User-0459131 9 months agoThank you for your quick reply. my question is solved.Share2Hifully dedicated for your useMeans that the host is dedicated to your account.  To use a Dedicated Host, you first allocate hosts for use in your account. You then launch instances onto the hosts by specifying host tenancy for the instance.   See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/how-dedicated-hosts-work.htmlSo its not limited to one IAM user by default however you can use IAM policies to grant users permissions to view and work with specific resources in the Amazon EC2 console.  See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policies-ec2-console.htmlCommentShareEXPERTMatt-Banswered 9 months agoAWS-User-0459131 9 months agoThank you for your quick reply. my question is solved.Share"


Question: instance connection status is coming red for opensearch

"Hi,Instance connection status is coming red for open search domain and status is coming as Processing updates . How can I resolve this issue.FollowComment"

Answer: "0Hello Ranjeet,in your domain, check the tab Cluster Health. You will probably understand why you have this problem:https://aws.amazon.com/it/premiumsupport/knowledge-center/opensearch-red-yellow-status/ThanksJoelCommentShareJoelanswered a year ago"


Question: MWAA with latest Airflow 2.2+

When will the next Airflow Version be available.FollowComment

Answer: 0Accepted AnswerSupport for Apache Airflow 2.2 was just announced. You can read more about it on the announcement.CommentShareJosh_Fanswered a year agojayaram a year agoThanks Josh For the update. We are already testing. Thank YouShare