Question: Is there an index or API for icon set for programmatic use?

"In the icon set at https://aws.amazon.com/architecture/icons/, specifically the asset package, I would like to have some sort of programmatically-usable index or API where I can look up a resource (etc) type and get an icon.  Say I'm making a web page which lists a project's EC2 instances;  it might be nice to show an instance family icon next to them, sized according to instance size.  But with no JSON file (say) that says the EC2 r5 instance family icon is "Res_Amazon-EC2_R5-Instance_..." and the z1d instance family is "Res_Amazon-EC2_z1d-Instance_..." I'd need to build one myself, and that's likely to be incomplete, wrong, and never get updated when the icon set gets updated.  Is there an index somewhere, or an API to the icon set, or something like that?  Thanks!FollowComment"

Answer: "3This would definitely be a great idea and something I'd love - but I don't think anything similar (official or not) exists.Also, in my experience file naming is mostly consistent but there are a few outliers: capitalisation, abbreviations (EC2 is "Amazon-EC2" but S3 is "Amazon-Simple-Storage-Service") and split names don't seem to be consistent enough for a quick script to be made and index all available icons.A good would be enough to publish stuff in an S3 bucket with consistent paths ie https://s3.eu-west-2.amazonaws.com/[somebucket]/services/[servicename]_[resolution].png for services and similar for sub-service icons (such as instance families).I'll try and get hold of the branding team which owns the icon sets and see if they have ever gotten such a feature request already.CommentShareGiorgio@AWSanswered a year ago"


Question: Can not access SQS via VPC SQS endpoint

"Hi,I am struggling with connecting to SQS via endpoint in VPC.I can read messages from SQS from my EC2 instance that is connected to internet. Now I would like to access SQS without round trip to internet using SQS VPC endpoint.When I create an VPC endpoint for SQS service, assign it to the same VPC and subnet my ec2 instance is in, I can no longer read SQS messages from that instance. I have also enabled Private DNS name when creating endpoint.Request for reading a message gets timeout error:Connect timeout on endpoint URL: "https://eu-central-1.queue.amazonaws.com/"Any hints what might be wrong?Edited by: rslak on Mar 7, 2019 5:02 AMFollowComment"

Answer: "1I have identified the problem.It was security group. I have to to set up separate group where all traffic destination/source has range of internal subnet and not just everything.CommentSharerslakanswered 4 years agoTH 3 months agoNailed it for me! Great!Share0Hi rslak,Looks like you are using the legacy endpoint format and it is not supported in SQS VPC endpoint. Give https://sqs.eu-central-1.amazonaws.com a try. (detailed endpoint information per region can be found here: https://docs.aws.amazon.com/general/latest/gr/rande.html#sqs_region)It is also possible that you have restricted traffic and access in the security group assigned to your VPC endpoint. I would recommend you to follow our tutorial: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-sending-messages-from-vpc.html, setup a functional example, and then compare and constrast the differences.Hope this helps,JackieCommentShareAWS-User-0048821answered 4 years ago0Thanks for suggestions.I have tried with provided endpoint but without luck. I still get the same error, although I have changed the endpoint name:$ aws sqs receive-message --queue-url "https://sqs.eu-central-1.amazonaws.com/<my_queue_name>" --max-number-of-messages 1Connect timeout on endpoint URL: "https://eu-central-1.queue.amazonaws.com/"I am using default VPC security group with everything open.I will try with CloudFormation example.CommentSharerslakanswered 4 years ago"


Question: s3 inventory Atena query

I have s3 inventory service setup done.  I have imported data into Athena as CSV format.Is there a way that I can query number of objects in a particularly directory  in Athena ?FollowComment

Answer: 1YesYou can run something likeselect count(key) from <your_table>where key like 'your_prefix%'Lets say you have 3 objectsprefix1/prefix2/object1.txtprefix1/prefix2/object2.txtprefix1/prefix3/object3.txtselect count(key) from <your_table>where key like 'prefix1/prefix2/%'This would return 2Check out this blog post for more exampleshttps://aws.amazon.com/blogs/storage/manage-and-analyze-your-data-at-scale-using-amazon-s3-inventory-and-amazon-athena/CommentShareEXPERTMatt-Banswered 10 months ago


Question: Instance i-0ba962503d8413a3a is stuck on "Stopping"

Instance i-0ba962503d8413a3a is stuck on "Stopping"Help please.FollowComment

Answer: "0FixedThanksCommentSharejunit32answered 4 years ago0Hi junit32,I am glad that the issue has resolved. Please let us know if you need any further help.Regards,awstomasCommentShareAWS-User-3892169answered 4 years ago"


Question: Phone carrier has blocked this message

"Hi,I am facing issues when sending SMS via local route in India. Below are the steps that has been followed.DLT registration completed with Jio and created a unique headernameRaised a request to AWS to register the same as senderID.I am building a mobile app and the purpose of this is only OTP alone. Before senderID registration we were using the international route for SMS and it was working. The moment, ticket for local senderID was registered, we are getting an error in the logs as "“Phone carrier has blocked this message”. I have mailed Jio DLT on the error asking for support.Is there any other setup missing from my side? Any guidance / inputs given will be appreciated.Thanks,DhyaneshFollowComment"


Question: Replacing rel=canonical with a CloudFront Function

"I'm proxying my Adobe Portfolio to Cloudflare via CloudFront in the middle, as Portfolio does not allow CNAME and "orange cloud" proxying. It works just fine, but there is one thing that I want to change as the content leaves CloudFront: the rel=canonical line in the html head section. Right now it's the url of my Portfolio, which is not good for SEO, and I want to replace it with my own root domain from where it is supposed to be served to the internet.I already have the Security Headers function added, as advised by the example code in the Functions doc. I would like to add the rel=canonical replacement Function to that if possible, but fine if it's a separate one.Thanks in advance.PS: I'm not a big project user, so it's a personal web presence only.FollowComment"


Question: "Cognito Allow all 3 Aliases (Email, Phone, and Username)"

"I have a ReactJS app and am creating a user portal for that website, with user accounts managed by Cognito.  I am using amazon-cognito-identity-js in my ReactJS layer to register users with a User Pool.Specifically, I want to allow users the flexibility to log into their user accounts with phone number, email address, and preferred username as aliases.  In order to use email address and phone number as aliases, both must be verified using OTPs.In order to use the signUp API in amazon-cognito-identity-js, a username must be provided.  In this case, this username cannot be the email address or the phone number, since both are to be used as aliases.  This is per User Pool Attributes - Amazon Cognito,which states:If you select email address as an alias, Amazon Cognito doesn't accept a user name that matches a valid email address format. Similarly, if you select phone number as an alias, Amazon Cognito doesn't accept a user name for that user pool that matches a valid phone number format.Further, once the user's account is confirmed by verifying their phone number or email address, you can allow the user to set a preferred username.  You cannot establish their preferred username as a username when registering:Activate the preferred_username attribute so that your user can change the user name that they use to sign in while their username attribute value doesn't change. If you want to set up this user experience, submit the new username value as a preferred_username and choose preferred_username as an alias. Then users can sign in with the new value that they entered. If you select preferred_username as an alias, your user can provide the value only when they confirm an account. They can't provide the value during registration.So, what I'd like to get some assurance on is what to provide Cognito for the username when calling the signUp API.  When creating users using only their email addresses as a username, you provide the email address for the username parameter when calling the signUp API.  The username is then set to the supplied email address.  Something must be provided for the username parameter to Cognito's signUp API, and in this case it cannot be an email address or phone number.  I've tested this and whatever I provide for the username parameter can be used for logging into the user account, even after setting the preferred_username.  In essence, the account can then be accessed by TWO different usernames, plus the phone and email aliases.Is having this "original username" in addition to the other three username values considered legit and safe?  Should I generate a UUID myself in the javascript code for the username parameter, using a library such as UUID - npm?  Or is there a different way so that the only three user IDs are limited to the phone number, email address, and preferred_username?FollowComment"

Answer: 0I find it terrible that users of Cognito cannot contact the team that maintains the service to ask such simple questions which are not covered anywhere in their documentation.  Don't expect me to pay for tech support for a service that has been criticized heavily in forums for lacking sufficient documentation.CommentSharerePost-User-7357499answered 6 months ago


Question: Sagemaker linear learner: Cannot invoke endpoint - Problem with JSON format

"Below is my Lambda function that i used to invoke the endpoint, but I am facing the following error,import json import ioimport boto3  client = boto3.client('runtime.sagemaker') def lambda_handler(event, context):    print("Received event: " + json.dumps(event, indent=2))        #data = json.loads(json.dumps(event))    #payload = data['data']    print(json.dumps(event))        response = client.invoke_endpoint(EndpointName='linear-learner-2019-12-12-16-20-56-788',                                  ContentType='application/json',                                  Body=(json.dumps(event)))    return responseOUTPUT:Function Logs:START RequestId: 7f4c7589-b70f-4af8-834c-89a1a1fbe5e5 Version: $LATESTReceived event: {  "instances": [    {      "features": [        0.1,        0.2      ]    }  ]}{"instances": [{"features": [0.1, 0.2]}]}An error occurred during JSON serialization of response: <botocore.response.StreamingBody object at 0x7f53918e2828> is not JSON serializablePlease help me resolve the issue, you can see the JSON input passed to the function. Not sure what is going wrong here. I even checked the cloudwatch logs not able to identify the origin of the issue.Thanks in advance,ArunEdited by: NMAK on Dec 24, 2019 2:36 AMEdited by: NMAK on Dec 24, 2019 2:37 AMFollowComment"

Answer: "0import json import ioimport boto3 client = boto3.Session().client(service_name='sagemaker-runtime',region_name='us-east-1')def lambda_handler(event, context):    print("Received event: " + json.dumps(event, indent=2))    #data = json.loads(json.dumps(event))    #payload = data['data']    #print(payload)    response = client.invoke_endpoint(EndpointName='linear-learner-2019-12-12-16-20-56-788',                                  ContentType='application/json',                                  Body= json.dumps(event))                                      print(response)    result = response['Body']    res = result.read()    res = json.loads(res)    print(res)    print(res['predictions'][0])The error was in the response format and on how to read them. Above code resolve the issue.CommentShareNMAKanswered 3 years ago"


Question: Import existing resource into new cloudformation stack

"I have an existing S3 bucket that I would like to import into a new cloudformation stack. ExistingDestinationBucket already exists.The AWS docs I have found detail creating a new stack entirely from existing resources, or adding existing resources to an existing stack, neither of which do what I need. I need to include the S3 bucket in the stack so I can define a trigger for the lambda function. My cloudformation template is below.When running as an import, AWS asks me to identify the existing lambda function - which doesn't exist.When running as all new resources, I get an error that the bucket already exists.Is there any way to do what I'm trying to do?AWSTemplateFormatVersion: "2010-09-09"Description: "Lighthouse run infrastructure"Resources:    ExistingDestinationBucket:        Type: "AWS::S3::Bucket"        DeletionPolicy: "Retain"        Properties:            BucketName: !Sub "rapidspike-pages-lambda-${AWS::Region}"            NotificationConfiguration:                LambdaConfigurations:                    Event: "s3:ObjectCreated:*"                    Filter: "*/summary.json"                    Function: !Ref PostProcessingFunc    PostProcessingFunc:        Type: "AWS::Lambda::Function"        Properties:            Description: ""            FunctionName: "lighthouse-run-post-processing"            Handler: "src/handlers/handler.handler"            Code:                S3Bucket: !Sub "lighthouse-run-functions-ap-south-1"                S3Key: "postprocess.zip"            MemorySize: 512            Runtime: "nodejs16.x"            Timeout: 60            TracingConfig:                Mode: "PassThrough"            EphemeralStorage:                Size: 512FollowComment"

Answer: "1Accepted AnswerHi,Yes there is a way to do what you want to do but it would be done in multiple steps.Step 1: Update your template you have shown above to be JUST the S3 Bucket and no other resources in the stack. Create a new Stack using this template using the Import option.The result of step 1 will be a Stack that has a single resource which is an imported resource of the existing S3 bucketStep 2: Replace the resources back into the template that you removed in Step 1 and then perform a Stack Update on your existing stack (not an import)This will add the new resources (the Lambda function) to the stack and after the update is complete you should have the situation you wanted from the start.I hope this helps and makes sense.CommentSharedanjhdanswered 9 months ago"


Question: AWS SAM CLI: Deploy AWS Lambda with least privilege access

"I'm trying to deploy the hello world quickstart AWS Lambda function created by AWS SAM ClI template with least priviliege access. For this I have created an IAM Policy, and assigned this policy to a user whose access_key_id and aws_secret_access_key is being used by SAM CLI. Also, I have created an private S3 bucket.When I'm trying to use 'sam deploy --guided --s3-bucket 'name-of-already-created-bucket' command, I'm getting an error which says:`Error: Failed to create managed resources: Waiter StackCreateComplete failed: Waiter encountered a terminal failure state: For expression "Stacks[].StackStatus" we matched expected path: "ROLLBACK_COMPLETE" at least onceCan anyone please help me to understand, what can be the cause of this error, and how can it be resolved.IAM Permissions granted to SAM CLI:CloudFormation: DescribeStacks, DescribeChangeSet, GetTemplate, CreateChangeSet, DeleteStack, ExecuteChangeSetLambda: CreateFunctionS3: PutObjectFollowComment"

Answer: "0There are likely to be other permissions required. If you look at the CloudFormation console (or use the aws cloudformation describe-stack-events --stack-name <stackname> command) you will be able to see which resource failed to create and that should point to the permission that you require.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-0264105 a year agoI have tried to run the command  aws cloudformation describe-stack-events --stack-name <stackname>. Initially, I was getting a message that the SAM CLI does not have permission to describe stack events, so I added the permission of describe stack events in IAM Policy. After that when I tried to run the same command again, I got a error message that stack does not exist and also AWS Console is not showing any stack.ShareBrettski-AWS EXPERTa year agoWhen a new stack deployment fails and it rolls back (deleting all the resources) it only stays in the CloudFormation console for a short time. You'll need to try the deployment again then run that command immediately afterwards.Share"


Question: iOS - Appium Node.js: Unable to start WebDriverAgent session

"Hi support,All works very well for Android app but I still have issues about Appium Node.JS for iOS app :(I have the following error: "Unable to start WebDriverAgent session because of xcodebuild failure: "Could not proxy command to remote server. Original error: Error: read ECONNRESET". Make sure you follow the tutorial at https://github.com/appium/appium-xcuitest-driver/blob/master/docs/real-device-config.md. Try to remove the WebDriverAgentRunner application from the device if it is installed and reboot the device."In local, I was it too and I solved that by following that is explained here: https://support.tricentis.com/community/article.do?number=KB0013770But how can I do that in DeviceFarm? I cannot open WDA xcproject...!Thanks a lot for your helps!Edited by: LyraMobile on Aug 19, 2019 4:27 AMFollowComment"

Answer: "0Could you please provide your run url?CommentShareAWS-User-4181848answered 4 years ago0Of course: https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-west-2#/projects/0e375d90-acf2-4049-8d84-83c39eeedc24/runs/059d2cfb-96d5-4188-a03a-13b6289760c6/jobs/00000I tried a lot of things:By changing appium version usedBy providing a own DerivedDataPathBy providing a KeychainNothing was ok :(Thank you very much for your help!Best regards,CommentShareLyraMobileanswered 4 years ago0Hi,I tried again by coming back to default tests specs file and It works!!! --> https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-west-2#/projects/0e375d90-acf2-4049-8d84-83c39eeedc24/runs/94fd86b3-f9f9-4eb4-b54d-a47ca7310129/jobs/00000Another question, when appium server starts, device name, app path are provided in command line. However, platformVersion doesn't seem provided. In documentation, env var DEVICEFARM_DEVICE_PLATFORM_VERSION is not listed!There is a way to avoid to provide our-self platform version? Indeed, we don't know this version (that depends on device pool selected).Again, thanks!CommentShareLyraMobileanswered 4 years ago0By using the default tests specs file for iOS, it's work!CommentShareLyraMobileanswered 4 years ago"


Question: InternalFailure error from Pipeline Resolver

"Scenario:I've created a basic Amplify project and am adding additional configuration (specifically a Pipeline Resolver) via CloudFormation. After pushing, everything looks okay and I can view the resolver in the console.However, on executing a query, which invokes the resolver, I am getting an error of type "InternalFailure" and message "An internal failure occurred while resolving this field."Schematype Employee @model {id: ID!legacyId: IntfirstName: StringlastName: Stringrole: String}type Query {getEmployeeV2(id: ID!): Employee}Queryquery GetEmployee {getEmployeeV2(id: 123) {idfirstName,lastName}}The vtls contain the default settings for DynamoDB datasource.The logs show nothing but ExecutionSummary, RequestSummary and Req/Resp Headers - nothing pertinent to this issue (as far as I can see).Has anyone seen this sort of issue?ThanksFollowComment"

Answer: "1I've determined the cause of the error. The Pipeline Resolver 'Before mapping template' and 'After mapping template' were empty! They were being created from over-ride files in the project which were set as empty files (or rather, just comments).The fix, of course, if to set the 'before template' to {} and the 'After template' to $util.toJson($ctx.result)CommentSharejoebrianswered 3 years ago0Can you provide graphQlApiId and timestamp so that we can do further investigation?CommentShareAWS-User-1865959answered 4 years ago0Hello I am facing the same error even though I have set {} in Before Mapping Template.Before Mapping Template:{}Function Request Mapping Template:#set( $attribs = $util.dynamodb.toMapValues($context.args.input) ){"operation" : "PutItem","key" : {## If object "id" should come from GraphQL arguments, change to $util.dynamodb.toDynamoDBJson($ctx.args.id)"id": $util.dynamodb.toDynamoDBJson($util.autoId()),},"attributeValues" : $util.dynamodb.toMapValuesJson($attribs)}Function Response Mapping Template:#if($ctx.error)$util.error($ctx.error.message, $ctx.error.type)#endPass back the result from DynamoDB. **$util.toJson($ctx.result)After Mapping Template:$util.toJson($ctx)CommentSharejpbhavsaranswered 3 years ago"


Question: Cross-Account Connect Athena (account X) to Glue + S3 (account Y)

"Hello,This question https://repost.aws/questions/QUSdk1j9-FT02t91W3AU0Qng/cross-account-access-from-athena-to-s-3 from 3 years ago sims to be similar. I did all that is suggested appart from using Lake Formation. I wanted to try and create the permissions manually first.Account Y:I have JSON data in an S3 and used Glue to create the catalog in account Y.I configured this owner account such as Step 1.a https://docs.aws.amazon.com/athena/latest/ug/security-iam-cross-account-glue-catalog-access.htmlI also configured the S3 bucket according to "Apply a cross-account bucket policy" from https://tomgregory.com/s3-bucket-access-from-the-same-and-another-aws-account/Account X:I want to configure Athena to query S3 using the catalog created by GlueI configured this borrower account such as Step 1.b https://docs.aws.amazon.com/athena/latest/ug/security-iam-cross-account-glue-catalog-access.htmlI also configured the IAM Policies according to "Apply a cross-account bucket policy" from https://tomgregory.com/s3-bucket-access-from-the-same-and-another-aws-account/Both S3 and Glue Policies are attached to the concerned users in this account.Problem:In account X, Athena is capable of accessing Glue and it displays Database, Tables and the catalog.However when I run a query (a same successful query made in account Y) I get the errorPermission denied on S3 path: s3://asdfThis query ran against the "dbname" database, unless qualified by the query. Please post the error message on our forumor contact customer supportwith Query Id: a3a3a3a...Apparently, I'm missing a S3 permission but I can't find information about itAny help is much appreciated.Thanks,FollowComment"


Question: Using AWS Lambda with RDS Proxy: Socket Ended Error

"Some background:I have a Node 12 Lambda running an Apollo GraphQL server. It connects to a MySQL RDS database via RDS Proxy using IAM authentication.Problem:Since switching from direct DB connection to RDS Proxy via IAM auth, we get intermittent socket ended errors, seen below:Error: This socket has been ended by the other party at TLSSocket.writeAfterFIN [as write] (net.js:456:14) at PoolConnection.write (/var/task/node_modules/mysql2/lib/connection.js:363:20) at PoolConnection.writePacket (/var/task/node_modules/mysql2/lib/connection.js:294:12) at Query.start (/var/task/node_modules/mysql2/lib/commands/query.js:60:16) at Query.execute (/var/task/node_modules/mysql2/lib/commands/command.js:45:22) at PoolConnection.handlePacket (/var/task/node_modules/mysql2/lib/connection.js:456:32) at PoolConnection.addCommand (/var/task/node_modules/mysql2/lib/connection.js:478:12) at PoolConnection.query (/var/task/node_modules/mysql2/lib/connection.js:546:17) at MysqlQueryRunner.<anonymous> (/var/task/node_modules/typeorm/driver/mysql/MysqlQueryRunner.js:184:56) at step (/var/task/node_modules/typeorm/node_modules/tslib/tslib.js:143:27) { code: 'EPIPE', fatal: true }I know that this is far from enough info to debug, but in lieu of throwing up all possible config surrounding these services, I'll wait for more pointed questions. Happy to post settings, connection info and any other config as needed to debug.Thanks in advance for any help!FollowComment"

Answer: "0Thank you for reaching out. I understand you are facing issues with AWS Lambda while integrating the same with RDS proxy in the DB instance.As per the error logs, I understand he connection is success. Additionally we see there are Write packets coming in and Query to execute. However in the end, it terminates with code: 'EPIPE', fatal: true. This looks like the query is getting terminated while executing some load data or big write workloads.I will encourage you to decouple AWS Lambda and RDS Proxy. Please check the connectivity using the Command Line tools to connect to database using the respective proxy endpoint. Please ran some queries and see if that sessions sustains. Additionally, you can keep an eye on the RDS Proxy Connection Cloudwatch metrics as well to gain some insight on RDS proxy behavior.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-proxy.monitoring.htmlThe above information will provide you with details to triage the issue. However, Please note this is general guidance only. In order to understand the issue fully, we require details that are non-public information. Please open a support case with AWS using the following link.As always, Happy Cloud Computing.CommentShareSUPPORT ENGINEERArnab_Sanswered a year ago0Are you seeing this error across invocations? That is, you call a Lambda function and it works fine; then you call it again a few minutes later and then it fails?If so, you might be seeing the RDS Proxy checking to see if the TCP socket with the Lambda function is still active; and in between invocations the Lambda function won't respond so the RDS Proxy shuts the TCP socket down. On the next invocation the Lambda function assumes the socket is still active, sends data and then you'll see that error message.Because of the (for want of a better word) "transient" nature of Lambda functions this is something that can happen. So in your code you'll need to handle the condition where the remote end has closed the TCP socket and you will need to re-establish it.Just a guess on my part but worth looking into.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: Choosing of AMIs which suits for our project regarding

"We are working on Automation of CCTV camera videos (RTSP link) using image processing techniques such as back ground subtraction, contour detection, annotation using opencv-python for 80 sites.so we have to run 80 python scripts in parallel manner. I would like to know which AMI suits for this project without any drop in outputs. The outputs are images in jpg format. These code would run 24*7.kindly suggest best AMI for this so that we would suggest the same to our management for purchase.FollowComment"

Answer: "0Hi, it is not easy to answer which instance will be best suited. AWS provides many EC2 instances types.  I would suggest start with minimum i.e. 4CPU & 8GB RAM (xlarge) instance type then monitor the performance for both CPU & RAM for sometimes and increase the instance type if started observing the glitch in either CPU or RAM.Based on your questions, I assume the compute optimized instances type will be more suitable, but still before finalizing you need to go through multiple permutation & combination.Refer, AWS EC2 various instances type details:  https://aws.amazon.com/ec2/instance-types/Regards,Nikhil ShahCommentShareAWS-User-1576695answered a year ago"


Question: Replicate topics and messages between 2 MSK clusters using MirrorMaker2

"Hi,I have followed this blog post to set up MSK Connect Connectors, plugins and other configuration to replicate Kafka topics and messages between 2 MSK clusters set up in the same account but in 2 different VPCs. The Source cluster from which data needs to be replicated is configured with Plaintext, whereas the destination cluster is configured with IAM authentication. I have created IAM role and policy as recommended in the referenced post.Seeing this error in the MirrorSourceConnector and MirrorCheckpointConnector logs.org.apache.kafka.connect.errors.ConnectException: Could not look up partition metadata for offset backing store topic in allotted period. This could indicate a connectivity issue, unavailable topic partitions, or if this is your first use of the topic it may have taken too long to createMirrorSourceConnector configuration properties:connector.class=org.apache.kafka.connect.mirror.MirrorSourceConnectortasks.max=4clusters=source,targetsource.cluster.alias=sourcetarget.cluster.alias=target# private Plaintext bootstrap servers endpoints for source MSK clustersource.cluster.bootstrap.servers=b-1.source.gdgdfg.gdfg.com:9092,b-2.gdgdfg.gdfg.com:9092,b-3.gdgdfg.gdfg.com:9092# private IAM bootstrap servers endpoints for target MSK clustertarget.cluster.bootstrap.servers=b-3.dest.dfdfgdfg.sfdgfdg.amazonaws.com:9098,b-2.dest.dfdfgdfg.sfdgfdg.amazonaws.com:9098,b-1.dest.dfdfgdfg.sfdgfdg.amazonaws.com:9098target.cluster.security.protocol=SASL_SSLtarget.cluster.sasl.jaas.config=software.amazon.msk.auth.iam.IAMLoginModule required awsRoleArn="arn:aws:iam::1234567678:role/iam_role_4_msk_connect" awsDebugCreds=true;target.cluster.producer.sasl.mechanism=AWS_MSK_IAMtarget.cluster.producer.security.protocol=SASL_SSLtarget.cluster.producer.sasl.jaas.config=software.amazon.msk.auth.iam.IAMLoginModule required awsRoleArn="arn:aws:iam::1234567678:role/iam_role_4_msk_connect" awsDebugCreds=true;target.cluster.producer.sasl.client.callback.handler.class=software.amazon.msk.auth.iam.IAMClientCallbackHandlertarget.cluster.consumer.security.protocol=SASL_SSLtarget.cluster.consumer.sasl.mechanism=AWS_MSK_IAMtarget.cluster.consumer.sasl.client.callback.handler.class=software.amazon.msk.auth.iam.IAMClientCallbackHandlertarget.cluster.consumer.sasl.jaas.config=software.amazon.msk.auth.iam.IAMLoginModule required awsRoleArn="arn:aws:iam::1234567678:role/iam_role_4_msk_connect" awsDebugCreds=true;target.cluster.sasl.mechanism=AWS_MSK_IAMtarget.cluster.sasl.client.callback.handler.class=software.amazon.msk.auth.iam.IAMClientCallbackHandlerrefresh.groups.enabled=truerefresh.groups.interval.seconds=60refresh.topics.interval.seconds=60topics.exclude=.*[-.]internal,.*.replica,__.*,.*-config,.*-status,.*-offsetemit.checkpoints.enabled=truetopics=my-topic-1,my-topic-2,my-topic-3,my-topic-4value.converter=org.apache.kafka.connect.converters.ByteArrayConverterkey.converter=org.apache.kafka.connect.converters.ByteArrayConverterproducer.max.block.ms=10000producer.linger.ms=500producer.retry.backoff.ms=1000sync.topic.configs.enabled=truesync.topic.configs.interval.seconds=60refresh.topics.enabled=truegroups.exclude=console-consumer-.*,connect-.*,__.*consumer.auto.offset.reset=earliestreplication.factor=3I am sure I am missing something here, any help is really appreciated.Also is it not possible to edit the connector configuration after it's created?ThanksFollowComment"

Answer: "0check connectivity between VPCs and the security groups configuration:set up an ec2 instance in the target VPC, assign it security group of the target cluster, try to telnet to port 9092 of any of the source brokersif you get connection timeout:a. ensure you have outbound rules in target cluster to connect to port 9092 on SG of the source clusterb. ensure you have inbound rules in source cluster SG - port 9092 for target cluster SGif you can connect from ec2 instance and still getting connection time out, check if SG used for target MSK ENIs is the same as used for Connector ENI in target VPCif they are the same, check VPC peering or TGW, or other network related configurations between VPCs.Let us know the results, pleaseCommentShareEdbEanswered a month agorePost-User-7286222 a month agoThanks for the update. I believe you're the same Ed who wrote the blog post, thank you very much for that as I couldn't much information about configuring MSK connect to work with MirrorMaker2.Coming to the issue I noticed that I had an incorrect IAM policy attached to the role, now seeing below error after fixing the policy as below.{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["kafka-cluster:","kafka:",],"Resource": ["*"]}]}Error message when connecting to target cluster endpoint:[MirrorSourceConnectorWithFullAccess|worker] [AdminClient clientId=adminclient-10] Failed authentication with b-2.fgfhfghfhh.tryrtyrty.c3.kafka.ca-central-1.amazonaws.com/INTERNAL_IP (An error: (java.security.PrivilegedActionException: javax.security.sasl.SaslException: Failed to find AWS IAM Credentials [Caused by aws_msk_iam_auth_shadow.com.amazonaws.SdkClientException: Unable to execute HTTP request: Connect to sts.amazonaws.com:443 [sts.amazonaws.com/52.119.198.216] failed: connect timed out]) occurred when evaluating SASL token received from the Kafka Broker. Kafka Client will go to AUTHENTICATION_FAILED state.)Note that I have provided MSK IAM private endpoints in the target.cluster.bootstrap.servers list, or should this be public endpoint list since the target  cluster is configured with public access?SharerePost-User-7286222 a month agoForgot to mention that we do have VPC peering in place between the VPCs of the source and target clusters, so that's not an issue. I read about setting up a private STS interface endpoint for the target cluster VPC, I did that and still seeing the same error as it's using the global sts endpoint. I am not sure how and where to update the regional STS endpoint as I don't recall adding the endpoint information explicitly anywhere.SharerePost-User-7286222 a month agoI don't think it's working as I am still seeing this error even after fixing IAM role trust relationship policy which was an issue earlier.[Worker-031d6f985ad5997a5] org.apache.kafka.common.errors.SaslAuthenticationException: An error: (java.security.PrivilegedActionException: javax.security.sasl.SaslException: Failed to find AWS IAM Credentials [Caused by aws_msk_iam_auth_shadow.com.amazonaws.SdkClientException: Unable to execute HTTP request: Connect to sts.amazonaws.com:443 [sts.amazonaws.com/209.54.180.124] failed: connect timed out]) occurred when evaluating SASL token received from the Kafka Broker. Kafka Client will go to AUTHENTICATION_FAILED state.[Worker-031d6f985ad5997a5] Caused by: javax.security.sasl.SaslException: Failed to find AWS IAM Credentials [Caused by aws_msk_iam_auth_shadow.com.amazonaws.SdkClientException: Unable to execute HTTP request: Connect to sts.amazonaws.com:443 [sts.amazonaws.com] failed: connect timed out][Worker-031d6f985ad5997a5] at software.amazon.msk.auth.iam.internals.IAMSaslClient.generateClientMessage(IAMSaslClient.java:149)[Worker-031d6f985ad5997a5] at software.amazon.msk.auth.iam.internals.IAMSaslClient.evaluateChallenge(IAMSaslClient.java:96)[Worker-031d6f985ad5997a5] at org.apache.kafka.common.security.authenticator.SaslClientAuthenticator.lambda$createSaslToken$1(SaslClientAuthenticator.java:524)[Worker-031d6f985ad5997a5] at java.base/java.security.AccessController.doPrivileged(Native Method)Share0I have made some progress on Kafka topics replication. Noticed that running MirrorMaker2 in an EC2 instance with below configuration worked to replicate topics from source to the target MSK cluster but the same fails when tried with MSK Connect.Note that source cluster has no authentication configured whereas the target cluster is configured with IAM authentication/authorization.On a side note I could also remove the cluster name prefix for the replicated topics by adding replication.policy.class=com.amazonaws.kafka.samples.CustomMM2ReplicationPolicy as mentioned at mirrormaker2-msk-migration when running MirrorMaker2 in the EC2 instance.Another observation was that MSK Connect appears to expect the source cluster alias as 'source' since giving another string as 'my-source' didn't seem to work as the connector failed to start with an error for this field.Error:ERROR [MirrorSourceConnectorCustom|worker] Scheduler for MirrorSourceConnector caught exception in scheduled task: loading initial set of topic-partitions (org.apache.kafka.connect.mirror.Scheduler:102)[Worker-0ba8c4d265a06ee31] java.util.concurrent.ExecutionException: org.apache.kafka.common.errors.TimeoutException: Call(callName=listTopics, deadlineMs=1683240049825, tries=1, nextAllowedTryMs=1683240049926) timed out at 1683240049826 after 1 attempt(s)Configuration:connector.class=org.apache.kafka.connect.mirror.MirrorSourceConnector **-- this line is not used in EC2 MirrorMaker2 test since there we're using Kafka provided connect-mirror-maker.sh by pointing to this configuration**replication.factor=3target.cluster.sasl.jaas.config=software.amazon.msk.auth.iam.IAMLoginModule required awsRoleArn="arn:aws:iam::111111111:role/msk-full-access-role" awsDebugCreds=true awsStsRegion="ca-central-1";offset-sync.topic.replication.factor=3sync.topic.acls.enabled=falsetasks.max=2source->target.emit.checkpoints.enabled=truesource->target.enabled=truesource.cluster.alias=sourcetarget.cluster.security.protocol=SASL_SSLclusters=source,targettopics.exclude=.*[-.]internal,.*.replica,__.*,.*-config,.*-status,.*-offsetsource->target.emit.heartbeats.enabled=truetarget.cluster.sasl.mechanism=AWS_MSK_IAMtopics=my-topic-1,my-topic-2,my-topic-4,my-topic-3refresh.topics.enabled=truetarget.cluster.sasl.client.callback.handler.class=software.amazon.msk.auth.iam.IAMClientCallbackHandlergroups=.*source.cluster.bootstrap.servers=b-1.my-source-kafka.fhfghfgh.c3.kafka.ca-central-1.amazonaws.com:9092,b-2.my-source-kafka.fhfghfgh.c3.kafka.ca-central-1.amazonaws.com:9092,b-3.my-source-kafka.fhfghfgh.c3.kafka.ca-central-1.amazonaws.com:9092target.cluster.alias=targettarget.cluster.bootstrap.servers=b-3.my-target-kafka.fhfghfgh.c3.kafka.ca-central-1.amazonaws.com:9098,b-1.my-target-kafka.fhfghfgh.c3.kafka.ca-central-1.amazonaws.com:9098,b-2.my-target-kafka.fhfghfgh.c3.kafka.ca-central-1.amazonaws.com:9098heartbeat.topic.replication.factor=3sync.topic.configs.enabled=truecheckpoint.topic.replication.factor=3source.cluster.security.protocol=PLAINTEXToffset.flush.timeout.ms=50000buffer.memory=100CommentSharerePost-User-7286222answered a month agoEdbE a month agoyou can use different names in MSK Connect for MM2 cluster names. Please post here the configuration (and the error trace) that was failing, it could be related to the configuration.Another recommendation: if you are running on EC2 (meaning, you are free to choose a kafka version under MM2), you don't need to use CustomMM2ReplicationPolicy. Starting Kafka 3, MM2 has IdentityReplicationPolicy (https://github.com/apache/kafka/blob/trunk/connect/mirror-client/src/main/java/org/apache/kafka/connect/mirror/IdentityReplicationPolicy.java)SharerePost-User-7286222 a month agoThank you. I tried with IdentityReplicationPolicy and noticed that target topics still has the source cluster alias as the prefix. I will check and try again to see if it's something related to the configuration. Coming to MSK Connect, I have used exact configuration posted above except for the account and actual endpoint URLs.ShareEdbE 23 days ago@rePost-User-7286222, please post configuration you used with source and target names different than source and target. So it will be easy to spot possible misconfig.Share"


Question: Stored Procedure

"I have lookup table that contains databasename and tablename with indicators. I want to loop through each table first to check for duplicates and if found will have to do some clean up.Can someone help me with the sP?CREATE OR REPLACE PROCEDURE record_example()LANGUAGE plpgsqlAS $$DECLARErec RECORD;BEGINFOR rec IN select db_nm,tbl_nm from Tbl_Lookup where dupcheck_ind <> 'Y'LOOPDML1;DML2;DML3;END LOOP;END;$$;ThanksKNFollowComment"

Answer: "4Accepted AnswerHere's an exampleCREATE OR REPLACE PROCEDURE record_example()LANGUAGE plpgsqlAS $$DECLARE    rec RECORD;BEGIN    FOR rec IN SELECT db_nm, tbl_nm FROM Tbl_Lookup WHERE dupcheck_ind <> 'Y'    LOOP        -- Check for duplicates in the table        IF EXISTS (SELECT 1                   FROM (SELECT COUNT(*)                         FROM rec.db_nm || '.' || rec.tbl_nm                         GROUP BY your_unique_key_columns                         HAVING COUNT(*) > 1) AS duplicates)        THEN            -- DML1: Perform clean-up task 1, e.g., delete duplicates            EXECUTE format('DELETE FROM %I.%I WHERE ...;', rec.db_nm, rec.tbl_nm);            -- DML2: Perform clean-up task 2            EXECUTE format('UPDATE %I.%I SET ...;', rec.db_nm, rec.tbl_nm);            -- DML3: Perform clean-up task 3            EXECUTE format('INSERT INTO %I.%I (...) VALUES (...);', rec.db_nm, rec.tbl_nm);        END IF;    END LOOP;END;$$;replace your_unique_key_columns with the appropriate column names used to identify duplicatesCustomize the DML1, DML2, and DML3 statements as needed for your specific clean-up tasks.This stored procedure uses dynamic SQL with EXECUTE format() to perform the clean-up tasks on the tables specified in the lookup table.The IF EXISTS statement checks for duplicates based on the specified unique key columns.If duplicates are found, the procedure executes the clean-up tasks (DML1, DML2, and DML3) for that table.CommentShareEXPERTsdtslmnanswered 2 months ago"


Question: DynamoDb bug on python boto3 query with GSI

"Assume that there are 3 rows in dynamodb as belowcoin_transaction_idcoin_amountcustomer_idtransaction_time027072a5-fdf3-48ed-b36e-90a317d63c3180bfbd221a-bc1f-4e96-943f-d809bb5e5af32022-06-15T18:52:40.044239+00:00f074d831-5791-4ba1-a596-ab114d14eaac40bfbd221a-bc1f-4e96-943f-d809bb5e5af32022-06-15T17:42:36.830859+00:00adafd372-03de-437a-887e-9027007517a2160bfbd221a-bc1f-4e96-943f-d809bb5e5af32022-06-15T17:42:36.830859+00:00GSIPartition Key : customer_idSort key : transaction_timewhen query data by python boto 3 in lambda with below code, the row 2, which GSI is same as row 3, cannot be retrieved. Result return is only row 1 and 3 can be retrieved.      coinResp = coinTable.query(                IndexName = "customer_id-transaction_time-index",                KeyConditionExpression = 'customer_id = :ci and transaction_time between :date1 and :date2',                ExpressionAttributeValues = {                    ':ci' : customerID,                    ':date1' : startDate,                    ':date2' : endDate,                },                Limit = 1,                ExclusiveStartKey = receivedLastEvaluatedKey,                ScanIndexForward = False,            )Is this cosidered as a bug?FollowComment"

Answer: "1Accepted AnswerHere you are making an assumption that row 2 in your base table is going to be row 2 in your GSI, however that is not the case. Items in your base table are grouped by the partition key and ordered by the sort key. Whereas items in your GSI can have multiple items with the same partition/sort key combo, meaning the order cannot be guaranteed.As to your issue, you are setting the LEK to "" in your code, causing you to miss the last record in the response. Try the below code snippet:import boto3dynamodb = boto3.resource('dynamodb')table = dynamodb.Table('cust1')customerID = 'bfbd221a-bc1f-4e96-943f-d809bb5e5af3'startDate = '2022-06-14T17:42:36.830859+00:00'endDate = '2022-06-16T18:52:40.044239+00:00'def processItems(items):    print(items)kwargs = {    'IndexName' : "my-index",    'KeyConditionExpression' : 'customer_id = :ci and transaction_time between :date1 and :date2',    'ExpressionAttributeValues' : {        ':ci' : customerID,        ':date1' : startDate,        ':date2' : endDate,    },    'Limit' : 1,    'ScanIndexForward' : False}   while True:    response = table.query( **kwargs )    processItems( response[ u'Items' ] )    if 'LastEvaluatedKey' in response:        kwargs[ 'ExclusiveStartKey' ] = response[ 'LastEvaluatedKey' ]    else:        breakCommentShareEXPERTLeeroy Hannigananswered a year ago1I don't see a bug here, you are using Limit 1 and also an ExclusiveStartKey. Can you share the same code snippet with the values for your variables, that will help me determine the issue. Also, please share your Boto3 and Python version.CommentShareEXPERTLeeroy Hannigananswered a year agoxclbr a year agoThe code snippet  is in the below answer.Share0Here is the full code in lambda function (BOTO3 and Python 3.9)import simplejson as jsonimport boto3from boto3.dynamodb.conditions import Keydef lambda_handler(event, context):    # TODO implement            try:                dynamodb = boto3.resource('dynamodb')        customerID = event['pathParameters']['customer-id']        startDate = (event['queryStringParameters']).get('start_date')        endDate = (event['queryStringParameters']).get('end_date')        LKCTI = (event['queryStringParameters']).get('lkcti')        LKCI = (event['queryStringParameters']).get('lkci')        LKTT = (event['queryStringParameters']).get('lktt')                        receivedLastEvaluatedKey = {}                if LKCTI and LKCI and LKTT:            receivedLastEvaluatedKey['coin_transaction_id'] = LKCTI            receivedLastEvaluatedKey['customer_id'] = LKCI            receivedLastEvaluatedKey['transaction_time'] = LKTT                                        coinTable = dynamodb.Table('customer-coin-transaction')        coinResp = {}        if LKCTI and LKCI and LKTT:            #created date is needed for sorting by created date            coinResp = coinTable.query(                IndexName = "customer_id-transaction_time-index",                KeyConditionExpression = 'customer_id = :ci and transaction_time between :date1 and :date2',                ExpressionAttributeValues = {                    ':ci' : customerID,                    ':date1' : startDate,                    ':date2' : endDate,                },                Limit = 1,                ExclusiveStartKey = receivedLastEvaluatedKey,                ScanIndexForward = False,            )        else:            coinResp = coinTable.query(                IndexName = "customer_id-transaction_time-index",                KeyConditionExpression = 'customer_id = :ci and transaction_time between :date1 and :date2',                ExpressionAttributeValues = {                    ':ci' : customerID,                    ':date1' : startDate,                    ':date2' : endDate,                },                Limit = 1,                ScanIndexForward = False,            )                        if 'Items' in coinResp:            lastEvaluatedKey = ""                        if 'LastEvaluatedKey' in coinResp:                lastEvaluatedKey = coinResp['LastEvaluatedKey']                        result = {                "last_evaluated_key" : lastEvaluatedKey,                "last_evaluated_key_old" : receivedLastEvaluatedKey,                "items" : coinResp['Items'],            }                        return {                'statusCode': 200,                'body': json.dumps(result)            }                else:            return {                'statusCode': 200,                'body': json.dumps('')            }                    return {            'statusCode': 400,            'body': json.dumps('failed')        }    except Exception as e:        return {            "statusCode": 400,            "body": str(e),        }I call this service from a frontend, pagination only 1 row for each call with descending sorting, from first call with empty last evaluated key .The first call result is first row with last evaluated key which is the row #1 returned.and, when I make the second call with last evaluated key which is the row #1 (result from the first call), a result returned from the second call is row #3 with row #3 is last evalauted key returned.and, if I make the third call with last evalauted key from second call, which is the row #3, the third call result is row #4.Problem is the row #2 is skipped when customer_id and transaction_time is the same value as row #3. (Expected result for each call is 1->2->3->4->.... but given result for each call is 1->3->4->..... )Row #2 will not be skipped if its transaction_time, sorting key, is different from row #3.CommentSharexclbranswered a year ago"


Question: Is it possible to use an iOS device as a security key?

"I tried to setup a security key using my iPad & iPhone.I selected security key and then scanned the QR code displayed, it seemed to work on the iOS side, but AWS said “error registering security key”.Unfortunately, that’s all the information I have at the moment.Any suggestions on how to pursue?TiaDavidFollowComment"

Answer: "0Hi David,Are you referring to setting up Multi-factor Authentication (MFA) for Identity and Access Management (IAM)?Please refer to https://aws.amazon.com/iam/features/mfa/ for the supported methods.There are a list of supported iOS authenticator apps that are currently supported.Hope this helps.CommentSharesimonanswered 3 months ago"


Question: Verify OpenId Connect token generated by Cognito Identity pool

"I have a customer, that is using a Cognito Identity Pool in conjunction with a Cognito User Pool.He is using the Api Method GetOpenId token to generate a JWT token for an unauthenticated user and wants to verify the JWT token in the backend.https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetOpenIdToken.htmlHowever this seems to be possible only with tokens generated by the user pool, see:https://aws.amazon.com/premiumsupport/knowledge-center/decode-verify-cognito-json-token/Can the same be achieved with token from an identity pool? Where can i find the public keys used to verify the signature of the JWT?FollowComment"

Answer: "0Accepted AnswerI have not tried it myself, but if it is an OIDC compliant token, you should be able to verify it through the official verification process, getting the jwks url in the iss field of the tokenHere is how to do it:From the token get the iss valueIssue a GET on the URI built from  iss+/.well-know/openid-configuration https://cognito-identity.amazonaws.com/.well-known/openid-configurationFrom the JSON returned, get the jwks_uri fieldIssue a GET to the URI from the jwks_uri field to get the jwks https://cognito-identity.amazonaws.com/.well-known/jwks_uriUse the kid from the id token to select the right entry in the jwks to verify the signatureCommentShareEXPERTMassimilianoAWSanswered 5 years ago"


Question: How precise is API Gateway throttling?

"Our team has started to work with stage-based API Gateway throttling and noticed some irregular behavior. To prevent our system from being overrun with too many API requests, we've settled on a throttling limit of 20 requests per second. After enabling this limit we wanted to ensure that the throttling was actually working, so I build a simple JMeter suite to bombard the Invoke URL with requests:Start 100 test threadsSynchronize threads so that all 100 are running before a request is madeAll 100 make a simple POST to the gateway.Check for 200 vs 429 Responses on each threadBased on the documentation for the gateway, my expectation was that I would see 20 requests get "200 OK" Responses, then see 80 requests with 429 returned. Instead, I get an unpredictable amount of blocked requests that are vastly outside the set limit. Usually somewhere around 80 requests get through, and only 20 get blocked, but sometimes all 100 requests get through. The bucket-token model the gateway operates under also means that I shouldn't have to worry about hitting any 1-second timing window either, where I might possibly see 40 requests sneak through as a timer ticks over to a new second interval.Is our throttling limit just too tiny for the gateway to notice a difference? With default values in the few thousand, I can see how 20 might be too many orders of magnitude off. Or, are we simply misinterpreting how the gateway handles throttling?TL;DR:  Using a throttling limit of 20 on an API Gateway stage is not limiting API requests as precisely as we had expected.FollowCommentbwhaley EXPERT2 years agoWhat happens if you test with thousands of threads?Share"

Answer: "6Accepted AnswerAs is mentioned in the last message on this stackoverflow thread, it's likely due to AWS API Gateway being Well Architected and that it does not have a single back end endpoint servicing your requests.  As the author of this post mentions, when a delay is added to the request the throttle is applied more consistently.https://stackoverflow.com/questions/63141984/aws-api-gateway-throttling-not-working-as-expected/63156353#63156353The problems you highlight also exist for any service using a distributed Well Architected setup for throttling. Unless all the requests for the given throttling "key" land on the same host in the same moment, the system would not be able to provide perfectly consistent throttling.The scenario you've posited, assuming the requests are distributed across multiple backend hosts, will result in the these theoretical buckets going negative after the hosts in the throttle group distribute their known information, which likely takes a few seconds. The bucket would then be replenished with the rate as requests are handled or rejected, but while the bucket is negative, all requests for that key will result in a 429 response.CommentShareMatthew_Banswered 2 years agodano 2 years agoThanks, the Well Architected paradigm is something I've got to bake into my mental model of most AWS products.I'm curious to see how accurate the burst limiting is, given these facts. If it's almost guaranteed that the bucket will "go negative", I'll try and see how negative it goes at different magnitudes:LimitBurstTest Requests/s105301005030010005003000We had to push this work out to a future sprint, given the discovery of the throttling behavior, so I won't be able to fully experiment for a week or so. But I promise to come back with some test results!Share"


Question: AWS WorkSpace Problems When using Mac Keyboard

"AWS WorkSpace Problems When using Mac Keyboard,  so their are times when I run into UAC prompts on Windows 10, it prompts me to press Control + Alt + End.When I am using a Windows client and an external keyboard I simply press Control + Alt on the client PC then on AWS workspace I press delete then this works.Sometimes within AWS workspace I can use the menu option to send Control + Alt + DeleteHowever if I RDP to a Windows 10 client inside my Windows 10 Workspace that won't work.The Macbook. keyboard doesn't support Control + Alt + Delete command natively. ( Of course as it doesn't have the keys).I try to press Option and Command on my Mac keyboard then open up virtual keyboard on the AWS Workspace and press delete.  I know this should work as Control + Alt (turn blue) and the Del key turns white when I press it.So yes it should work but no it doesn't.  I am at a loss any ideas?I have already tried to follow this guide and run this command.https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-osx-client.htmldefaults delete com.amazon.workspaces SUSkippedVersionStill doesn't work what am I doing wrong?FollowCommentPhindi a year agoHi there, Please try to use this https://aws.amazon.com/premiumsupport/knowledge-center/workspaces-keyboard-issues/I hope it helpsShare"

Answer: 0Bumb any update on this?????CommentShareukmercenaryanswered a year ago0No this still wont work....CommentShareukmercenaryanswered a year ago


Question: How to integrate AWS comprehend with salesforce service cloud

We want to use AWS comprehend with salesforce for analysing the sentimental analysis. Please provide me any reference that would be helpful.FollowComment

Answer: "0A workshop detailing how to synchronize data from Salesforce into S3 using AppFlow can be found here. Once Salesforce data is successfully landed in S3, you can follow the steps detailed here in order to performance an analysis of the objects which you have extracted from Salesforce.In addition to the steps documented above, you will likely have two additional steps, written up below as (2) and (4).Salesforce into S3 (as above)Extracting the text specific to your sentiment analysis from Salesforce objects - I would suggest using Athena for this, as described herePerforming sentiment analysis of the selected text from extracted objects (as above)Visualising the resulting sentiment analysis, as described hereCommentShareforkforkanswered 7 months ago"


Question: ec-2 error (client_loop: send disconnect: Broken pipe)

"hello AWS users,im running ssh ec-2 instance, AMI name: (AMI-cloud-wrf)the model i work on should take some hours running but it stops suddenly after few minutes with this msg: (client_loop: send disconnect: Broken pipe)HOW to keep the program running even i disconnect my pc?thank you;FollowComment"

Answer: "1Accepted AnswerIn my experience this is usually caused by a connection that gets dropped after a certain amount of time.  Running ssh with a keep-alive option has helped a lot, something like:ssh -o ServerAliveInterval=60 myname@myhost.comCommentSharekyageranswered 9 months ago"


Question: MQTT based file delivery - requested file ID not found

"I am trying to set up MQTT based file delivery. See attached screenshot for details.Procedure:Publish DescribeStream request to describe-topic.Publish GetStream request to get-topic with fileID supplied by description topic.Request rejected based on fileID.Policies on device (italics are dummy values):Allow  - iot:Receive, Publish  - arn:aws:iot:myregion:123123123:topic/$aws/things/thingName/streams/*Allow  - iot:Subscribe - arn:aws:iot:myregion:123123123:topicfilter/$aws/things/thingName/streams/*Allow - iot:Connect - arn:aws:iot:myregion:123123123:client/clientNameOtherSensored thingnames on image are identicalRegion on device and bucket/file are identicalBehaviour on device is identical to MQTT test clientAll other MQTT operations I have tried work as expectedI cannot understand what I'm doing wrong here, and I was not able to find any information on the ResourceNotFound rejection in the docs. I know that the stream works on boto3. I have set up different streams, same error. I have tried altering the request JSON, but then I get different errors eg. json format error, value type error, wrong stream version etc.If anyone has any experience with this please share.EDIT: Listed wrong arn for subscribe for sub policy. Was topic, is topicfilter.FollowComment"

Answer: "1Hi,the resource arn in an IoT policy is different for publish/receive and subscribe:publish/receive: arn:aws:iot:region:123456789012:topic/YOUR_TOPICsubscribern:aws:iot:region:123456789012:topicfilter/YOUR_TOPICExample:Create a stream:stream.json:{  "streamId": "e571acbc-16db-11ec-bb3a-026f9576feb5",  "description": "This stream is used for MQTT-based file delivery.",  "files": [      {          "fileId": 123,          "s3Location": {              "bucket":"REPLACE_WITH_S3_BUCKET",              "key":"REPLACE_WITH_S3_OBJECT"          }      }  ],  "roleArn": "arn:aws:iam::123456789012:role/ROLE_WHICH_PROVIDES_IOT_ACCESS_TO_YOUR_S3_BUCKET"}aws iot create-stream --cli-input-json file://stream.jsonCode snippets (Python)Subscribesub_topic = f'$aws/things/{args.client_id}/streams/{args.stream_id}/#'    print("Subscribing to topic '{}'...".format(sub_topic))    subscribe_future, packet_id = mqtt_connection.subscribe(        topic=sub_topic,        qos=mqtt.QoS.AT_LEAST_ONCE,        callback=on_message_received)on_message_received handler:def on_message_received(topic, payload, dup, qos, retain, **kwargs):    global BLOCKS_RECEIVED, FILE_ID, FILE_SIZE    print("Received message from topic '{}': {}".format(topic, payload))    if topic.endswith('/description/json'):        print('stream description')        FILE_ID = json.loads(payload.decode())['r'][0]['f']        FILE_SIZE = json.loads(payload.decode())['r'][0]['z']    if topic.endswith('/data/json'):        BLOCKS_RECEIVED += 1        block = json.loads(payload.decode())['i']        decoded = json.loads(payload.decode())['p']        file_name = f'{args.client_id}-{block}.part'        f = open(f'{PARTIAL_DIR}/{file_name}', "w")        f.write(decoded)        f.close()        print(f'block: {block} file_name: {file_name}')        print(f'NUM_BLOCKS: {NUM_BLOCKS} BLOCKS_RECEIVED: {BLOCKS_RECEIVED}')        if NUM_BLOCKS == BLOCKS_RECEIVED:            print('ALL BLOCKS RECEIVED')            received_all_event.set()Cheers,PhilippCommentSharePhilipp Sanswered 8 months agoslycooper 8 months agoHi,Thanks a lot for your response.This was unfortunately just a typo on my part, the actual sub policy is topicfilter, not topic.rgdsShare0Accepted AnswerI found the issue.When creating the stream I did not specify the fileId. Default fileId is 0. This does not work.After creating a new stream and specifying a fileId it works as expected.CommentShareslycooperanswered 8 months ago"


Question: Elastic Graphics card EC2 Windows instance AUTOSCALING

"Hi,I have an Windows EC2 instance on which runs an graphical heavy load application so i created an AMI from the Windows instance and launched new W-EC2 from that AMI and attached the Elastic Graphical card(GPU) . I was trying to figure it out how to Autoscale that. I created a launch template/configuration but i don't have a field to introduce the Elastic Graphical Card.I know that the process of adding EGC is that you can only add it at launch, then you have to login , download EGC software and restart the EC2 in order to get the GPU added to the Windows EC2.My questions are:How can i automate this process?How can i achieve autoscaling for my application?Any answer, blog or documentation to read regarding this will be helpful. Thanks in advance!FollowComment"

Answer: "0Hi Daniel,I understand you want to auto scale your Elastic Graphic Card(GPU). Your Elastic Graphic Card will auto scale when the instancel aunched has been configured to auto scale, all you need is the AMI and select which instance you need to be launched. In addition, I have provided a documentation for the automation of AMI creation using Systems Manager [1].Refere to references[1] https://aws.amazon.com/premiumsupport/knowledge-center/ec2-systems-manager-ami-automation/CommentShareLwazianswered a year ago0I have the AMI and when i configure the autoscaling template/configuration(the settings of my "to be" Windows EC2) , it does not have a slot of configuring Elastic Graphical card.CommentShareDaniel Gainaanswered a year ago"


Question: Elastic IPs for internal private services

"Can someone please clarify if use an Elastic IP for load balancing/HA of internal services, does the traffic from internal clients (located on the private subnet) to the elastic IP end up being routed to the internet?Does the internet gateway avoid that traffic from being routed outside of AWS?No clients should access the elastic IP from outside the private subnet, at all.All traffic must be segregated from the internet, staying completely enclosed on the private side.Thanks.Edited by: jlerm on Jan 26, 2019 7:22 PMEdited by: jlerm on Jan 26, 2019 7:23 PMEdited by: jlerm on Jan 26, 2019 7:24 PMFollowComment"

Answer: "0Answer:https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.htmlUse INTERNAL load balancer.CommentSharejlermanswered 4 years ago0Hi,Thank you for reaching out to us on AWS Forums. Yes, you are correct. You can always use an internal Elastic Load Balancer if your clients are connecting privately and you do not want the traffic to be routed over the internet.Edited by: Charu-aws on Feb 17, 2019 11:01 PMCommentShareSUPPORT ENGINEERAWS-User-7840103answered 4 years ago"


Question: SQL Server on EC2 and FSx maintenance

"For SQL Server running on EC2 and using FSx, when the FSx maintenance window happens, will there be an interruption to SQL Server ?  Do the databases become disconnected?FollowComment"

Answer: "1Accepted AnswerShort answer: There will be no database interruption for SQL Server Always On deployments in the event of file system failover/failback as long as you're using continuously available (CA) shares on Amazon FSx multi-AZ file systems.https://docs.aws.amazon.com/fsx/latest/WindowsGuide/sql-server.htmlDetails: With file shares configured as CA on multi-AZ file systems, server applications like SQL Server will get uninterrupted access to the file share even in the event of a failover/failback (by transparently reconnecting to another file server node without interruption of the server applications). These server applications expect their storage to reliable and always available and they do not generally handle IO errors or unexpected closures of handles very well. If the server application cannot access its storage this often leads to databases going offline or virtual machines stopping or crashing because they can no longer write to their disk. This is why Amazon FSx supports SMB CA shares (aka SMB Transparent Failover) as one of the key features on multi-AZ file systems.CommentShareAWS-User-9252611answered 3 years ago"


Question: minimum object size of 128kb at One Zone Infrequent Access Storage Class?

"Hi there,I am planning on uploading a couple of hundreds TB file server data for archival into Glacier Deep Archive. I understand that there is a minimum object size von 128kb for any of the glacier storage classes. Additionally I found in the documentation there a 8kb and 32kb metadata will be created for every object stored in Glacier.Having that informationen, I decided to store smaller files in IA or one zone IA. I could not find any information in the AWS sites itself about a minimum object size on IA as well which then would lead me avoid this storage class as well. But what is confusing me is that a couple of external websites explaining the pricing of S3 do claim that there actually is a 128kb minimum object size on IA as well.Is that just outdated information? Or in other words: Beyond Glacier, is there any minimum object size (billing wise).ThanksMarkusFollowComment"

Answer: "0Accepted AnswerIt has the minimum object size too, you can find it here.From the page linked above:S3 Standard-IA and S3 One Zone-IA storage have a minimum billable object size of 128 KB. Smaller objects may be stored but will be charged for 128 KB of storage at the appropriate storage class rate.CommentShareMGanswered a year agoAWS-User-3301132 a year agoThanks MG. I cant believe that I did actually not see it right in the pricing info. I have been reading thias page like a hundred times, put hours of research into it and there it was all the time, shoot. Thanks for putting light on my blind spot.ShareMG a year agoDon't worry :) I'm glad that I could help.Share0The AWS S3 pricing below has relevant information about how it works with IA and Glacier  (see notes in ** and ***) section.https://aws.amazon.com/s3/pricing/The user guide outlines some best practices for this.https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-transition-general-considerations.htmlS3 intelligent tiering helps to optimize costs by automatically moving data to the most cost effective tier when access pattern change. One can opt-in to Archive Access Tier or Deep Archive Access Tier.https://aws.amazon.com/s3/storage-classes/intelligent-tiering/CommentSharerePostfanclubanswered a year ago"


Question: Cloudshell wont start

"Full Error:Unable to start the environment. To retry, refresh the browser or restart by selecting Actions, Restart AWS CloudShell.I have this permission attached to my IAM user. AWSCloudShellFullAccess. Here its JSON description:{"Version": "2012-10-17","Statement": [{"Action": ["cloudshell:"],"Effect": "Allow","Resource": ""}]}I tried to follow the 'Troubleshooting AWS CloudShell' guide. Nothing works. That generic error doesnt say anything. Please help.FollowComment"

Answer: "0I also have this problem.CommentSharechrisdoucetteanswered 2 years ago0I'm getting a similar error. Changing browsers, regions or switching to root account does not change anything. Any hint on where to look at?"Unable to start the environment. To retry, refresh the browser or restart by selecting Actions, Restart AWS CloudShell. System error: 4XX Gateway Response mapping was applied as 400 was returned by service"CommentShareDimi12answered 2 years ago0I am also getting the same error. I have also given full access.CommentShareBhavin1answered 2 years ago0I am also getting the same error.CommentShareJosepa3answered 2 years ago"


Question: Unexpected Response 403 today with no changes to my app.

"Today out of the blue my app stopped working and I receive 403 Unexpected Response when trying to connect to my AWS IoT custom endpoint (wss://staging.stream.mysite.com/mqtt).When I check the logs for both my IoT custom authorizer function and my IoT lamba topicrule handler, both are empty.I have made no changes to my app before this happened and am unsure of the cause so far.I connect to the websocket endpoint using async-mqtt js library with a custom iot authorizer that parses the username and clientId fields to determine authorization.https://github.com/mqttjs/async-mqtteffectively like this:const connection = yield mqtt.connectAsync('staging.stream.mysite.com/mqtt', {  username: '?SDK=BrowserJSv2&Version=1.1.3&token=<auth_token>',  clientId: 'ANONYMOUS::uuid',})Any ideas what could be wrong or why the sudden failure or how to debug?Edit: Resolved on it's own after hours of breakage.Edited by: phasetwo on May 11, 2020 1:19 PMEdited by: phasetwo on May 11, 2020 3:56 PMFollowComment"

Answer: 0Suddenly resolved without any indication as to what the problem was.CommentShareborganswered 3 years ago


Question: Route Calculator: Alternative Routes

"Using Amazon Location Services, is there a way to retrieve the alternative routes of getting from origin to destination. It appears that the best possible route is selected when calling the calculate route/calculate route matrix api's. However the routes chosen by the API are not preferable to the alternative routes you could find on a map directions application (e.g. google).FollowComment"

Answer: "0Unfortunately, the Routes API does not provide alternative routes at the moment. But I will pass on your feedback to the team.CommentShareabraham poorazizianswered a year ago"


Question: Amazon Connect - Outbound calls only

"hi everybody,some of our agents are tasked to make outbound calls only. they are not required to receive any inbound calls. but the softphone on CCP keeps ringing when they have the status as Available. they cannot make phone calls out until they missed the call.i'm wondering is there any solution to that? a certain group of agents who don't receive incoming calls.thank you!RocFollowComment"

Answer: "0It is my understanding that a Q is needed for inbound calls.  Have you tried removing queues from the routing profile?CommentShareMuaGSanswered 3 years ago0Is the inbound queue that is routing these calls in the Routing Profile for these outbound only agents?  If yes shouldn't it be removed?  Also, why are they in Available status if they are making outbound calls?  If they were in some other status they would not be a candidate for any inbound queue call so it wouldn't ring to them.CommentShareKristinLanswered 3 years ago0So there are a few things you will need to do is remove the queues from Routing Profile Queue as MuaGS mentioned. You need the outbound queue for reporting. Alot of contact centres go unavailable when making outbound calls when as KristinL has recommended.Obviously when you make outbound calls you will present a number to the customer so they will use that to call back if they have a missed call. What i do is provide a diffferent call back number (Outbound caller ID number on the queue) that has a contact flow that plays a messages saying you were call by Company X etc therefore it does not go to the agent, but lets the customer know who called them which in the UK is required but is also best practise. Therefore this will not reach any of the agents. You can then easily report on what customers call you back if needed.hope that helps?CommentSharem66rusanswered 3 years ago0thank you for your reply. that's exactly what I was going to do.CommentShareTDConnectanswered 3 years ago"


Question: AWS OpenSearch/OpenDistro Alerting Send Alert Email Content Writing

"How does kibana send the automatically generated report to my mailbox by email, my ElasticIt is "Amazon OpenSearch Service". Only the alarm set in the "Alerting" function has the function of sending emails. Can I add a PDF report attachment to the content of the email?The default email content isMonitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.Trigger: {{ctx.trigger.name}}Severity: {{ctx.trigger.severity}}@timestamp: {{ctx.results.0.hits.hits.0._source.@timestamp}}event.action: {{ctx.results.0.hits.hits.0._source.event.action}}error.message: {{ctx.results.0.hits.hits.0._source.error.message}}count: {{ctx.results.0.hits.total.value}}soure.ip: {{ctx.results.0.hits.hits.0._source.source.ip}}source.geo.country_name: {{ctx.results.0.hits.hits.0._source.source.geo.country_name}}how should I write to get the report of my dashboardFollowComment"

Answer: "0Dear AWS Customer,Thank you for your question.Currently there is no Amazon managed OpenSearch created solution for sending reports via email or SNS.Additionally Alerting Feature only allows the users to send email notifications for the Monitors and alerts, therefore it is not possible to attach reports to the content of the email.OpenSearch team is continuously working on to update the service with your suggestions and feedback. Therefore, in the meantime, I would kindly suggest that you keep an eye on the following resources for announcements about new features and improvements to our services:-- AWS News: https://aws.amazon.com/new/-- Blog: https://aws.amazon.com/blogs/big-data/Thank you!CommentSharerePost-User-7257420answered 6 months agoAWS-User-3563040 6 months agook thanks for your answerShareAWS-User-3563040 6 months agook thanks for your answerShare"


Question: Can we restrict the invited member must be of specific org? - CodeCatalyst

"Can we restrict that the invited member email must of be of an specific organization @organization.com to let them access to that project?Thanks,FollowComment"


Question: Supporting Glue testing data connection for MongoDB

"When I test Glue data connection in the new console, I can test the connection for JDBC connection type, but when I want to test the connection with MongoDB type, the Test connection button is disabled. So can you tell about the support of Glue data connection testing of MongoDB connection type up to now or for the time ahead? Or is there any mistakes in my connection setting so I can't test it? Thanks in advance.FollowComment"

Answer: "0You can create a connection for MongoDB and then use that connection in your AWS Glue job. The connection url, username and password are stored in the MongoDB connection. Other options can be specified in your ETL job script using the additionalOptions parameter of glueContext.getCatalogSource.  Reference : https://docs.aws.amazon.com/glue/latest/dg/integrate-with-mongo-db.htmlCommentShareEXPERTAWS-User-Nitinanswered a month agoNguyen Tien Dat 23 days agoThanks for your answer. I can create the connection with MongoDB but when I want to test the connection, the Test connection is dimmed and I can't click on it to test my connection. When I test the other types of connection such as JDBC, it works. So I wonder whether AWS support testing with MongoDB data connection type or not.Share"


Question: Query on upload to s3 bucket NodeJS

"Hello, I have one doubt about the s3 bucket; while uploading data to the s3 bucket using the upload function from aws-sdk in  NodeJS, is data uploaded securely using TLS?FollowComment"

Answer: "1Accepted AnswerYes, TLS is expected to be used.The following AWS official documentation and the AWS official blog state that TLS is used by default in the AWS SDK for JavaScript. [1] [2][1] Enforcing a minimum TLS version - AWS SDK for JavaScripthttps://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/enforcing-tls.html----- Excerpt -----AWS SDK for JavaScript v3 automatically negotiates the highest supported TLS version for a given AWS service endpoint.----- Excerpt -----[2] TLS 1.2 to become the minimum TLS protocol level for all AWS API endpoints | AWS Security Bloghttps://aws.amazon.com/jp/blogs/security/tls-1-2-required-for-aws-endpoints/----- Excerpt -----If you are one of the more than 95% of AWS customers who are already using TLS 1.2 or later, you will not be impacted by this change. If you are already using TLS 1.2 or later if your client software application was built after 2014 using an AWS Software Development Kit (AWS SDK), AWS Command Line Interface (AWS CLI), Java Development Kit (JDK) 8 or later, or another modern development environment.----- Excerpt -----I hope the above is helpful.CommentSharemn87answered 9 months agoEXPERTChris_Greviewed 9 months agorePost-User-9617035 9 months agoThank you for your responseShare"


Question: API reference create organization

I'm looking at the API reference and would like to know if it's possible toCreate an Organization (via SDK or CLI)Create a Domain and associate it with the Organization created in 1)Thanks & RegardsIanFollowComment

Answer: "0Hi Ian,I'm sorry to inform you that currently these API's are not available for WorkMail and only possible via the console. Expanding the SDK/CLI to contain these API's is on the WorkMail roadmap.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago0Hi Robin,Is it possible to view the WorkMail roadmap? I would really like to have an API to create/manage WorkMail organizations, it's very odd when you come across an AWS service that cannot be managed through the API/SDK one of the big selling points for me on AWS is that I would like to assume that any AWS service has an associated API that I can use to create and manage resources in that service.Could we get a timeline for the ability to create and manage organizations in WorkMail via the SDK/API?Thanks,KurtCommentShareKurtManswered 3 years ago0Hi Kurt,I'm sorry to inform you that WorkMail does not have a public roadmap. There for I can only tell you that this is on the WorkMail roadmap but cannot provide a timeline.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 3 years ago"


Question: "Re: Announcement: Deprecation of PostgreSQL, MySQL, and MariaDB databases in Amazon RDS running on M1, M2, M3, R3, and T1 instances"

"Hi, as per the announcement that these instance types are being deprecated, it is not clear what happens to remaining days already purchased for reserved instances of this older types. I have a db.r3.large instance, and a fully paid for Reserved Instance for that which has 462 days still remaining on it. The announcement email I received simply says "If you have Reserved Instances on M1, M2, M3, R3, or T1, you will be able to cancel them after you create new Reserved Instances for the same value or higher with M5, R5, or T3 respectively." However, what does that mean with respect to the loss of all of those already pre-paid for days on the existing Reserved Instance? Does canceling the Reserved Instance issue me a refund or credit towards the new Reserved Instance?FollowComment"

Answer: "0When you cancel a Reserved Instance, you will not receive a refund or credit towards a new Reserved Instance. Canceling a Reserved Instance simply means that the remaining days on the reservation will be forfeited, and you will no longer be able to use them. However, you will be able to create a new Reserved Instance for the same or higher value using the newer instance types (M5, R5, or T3) as mentioned in the announcement email. This will allow you to continue to benefit from the cost savings associated with Reserved Instances, but using the newer, more powerful instance types.CommentShareDivyam Chauhananswered 4 months ago"


Question: Definition: Greengrass Core vs Greengrass Group?

What is the conceptual difference between the definitions of a Greengrass Group and Greengrass Core?FollowComment

Answer: "1Accepted AnswerIn the IoT Greengrass 1.x version, a Greengrass group is an entity which includes a Greengrass core, devices connecting to the core, connectors, lambda functions, subscriptions, and related resources that you define.  You apply settings such as logging, monitoring, IAM role etc., to the Greengrass group. The Greengrass group is then deployed to the Greengrass core device.Think of Greengrass core as the physical device that runs the Greengrass software at the edge. Thus, for each Greengrass group, you need a GreenGrass core device that is registered in AWS IoT core as a thing. Greengrass core authenticates to AWS IoT core using a X.509 certificate and has a shadow like other devices that connect directly to AWS IoT Core. But additionally, it can manage the processes needed to run locally as part of the Greengrass group.For differences in the IoT Greengrass 2.x version, see https://docs.aws.amazon.com/greengrass/v2/developerguide/move-from-v1.html to learn how these concepts have evolved.CommentShareAWS-User-2520637answered 3 years ago"


Question: How to Download the object such as AMI from Seoul EC2 instance to an intermediate host such as an Beijing EC2 instance?

How to Download the object such as AMI from Seoul EC2 instance to an intermediate host such as an Beijing EC2 instance?Please test it and tell me all the details.FollowComment

Answer: "0Hello,I'm assuming that you already have an AMI that you created from your EC2, if not, this documentation explains how to create AMI from EC2 :[https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/creating-an-ami-ebs.html]And, if you are trying to copy an AMI from an AWS region to another AWS region, you can see this blog useful :[https://aws.amazon.com/premiumsupport/knowledge-center/copy-ami-region/].CommentShareFrankanswered 5 months ago"


Question: Deleting a CloudFront distribution

"I am just becoming familiar with AWS and I've used the AWS Toolkit for Visual Studio to deploy a simple Blazor Web Assembly to CloudFront. Now I want to delete the distribution and free up the associated resources. In order to do this I need to disable the distribution. However, when I uncheck Enabled and select "Apply Changes", I get the following error:"Error saving distribution: WebACLId is missing for the resource"Being new to AWS, I'm not 100% sure what the WebACLId is (I'm assuming some sort of access control list), or even which resource is missing the WebACLId, or how I go about setting it.Please help.FollowComment"

Answer: "0In order to delete a CloudFront distribution from AWS console, you first need to check the checkbox next to the desired distribution and then click on DISABLE. Once the distribution is disabled, then you can proceed to DELETE it. Are you following the the steps explained in the following document?Deleting a distributionCommentShareNima-AWSanswered 4 months ago0Yes, you are correct that a WebACLId (Web Access Control List) is a security feature in AWS that is used to control access to resources in CloudFront distributions.The error message you are seeing "WebACLId is missing for the resource" is indicating that the CloudFront distribution you are trying to disable is currently associated with a WebACLId, and this is required to make changes to the distribution. In order to disable the distribution, you will need to first remove the associated WebACLId.Here are the steps you can take to remove the WebACLId and disable the distribution:Go to the AWS Management Console and navigate to the CloudFront service.In the CloudFront Distributions section, select the distribution you want to disable.In the Distribution Settings section, click on the "Edit" button next to "Web ACL".Select "None" from the drop-down menu and click "Yes, Edit".Click on "Save" to save the changes.Now, you should be able to disable the distribution by unchecking the "Enabled" option and clicking "Apply Changes"After disabling the distribution, you can delete it. Be aware that CloudFront will take some time to fully delete the distribution and free up the associated resources.Keep in mind that removing a WebACLId from a CloudFront distribution will remove all the security rules associated to it, so make sure that the distribution is no longer needed, and that you have an alternative security solution in place before removing the WebACLIdCommentShareAhmad Ul Islamanswered 4 months ago0Hi, @Michael.I understand that you cannot disable CloudFront distribution from AWS Toolkit for Visual Studio after deploying Blazor Web Assembly to CloudFront + S3 using AWS Toolkit for Visual Studio.I tried the same scenario as you using Visual Studio.First of all, the AWS Toolkit for Visual Studio's CloudFront distribution management feature probably has a bug.I think you are getting the error message even though your CloudFront distribution does not have WebACL or AWS WAF applied. (I was the same)I tried editing several existing distributions, but none of them were able to commit the changes.And as the other answerer has answered, to disable the CloudFront distribution, you need to disable the distribution from his AWS Management Console, not his AWS Toolkit. I have verified that the distribution can also be removed from the AWS Toolkit for Visual Studio after deactivation from the management console.However, you may prefer not to remove the distribution directly.I assume your purpose is to remove the set of resources created by the Blazor Web Assembly deployment.Resources created by Publish to AWS include various resources other than CloudFront.So you can find his deployed stack from CloudFormation and by deleting the CloudFormation stack itself you can delete not only the CloudFront distribution but also related resources such as S3, Lambda and IAM.I have summarized my findings in the following article. please refer.https://dev.classmethod.jp/articles/aws-toolkit-for-visual-studio-blazor-web-assembly-cloudfront-disable/CommentShareEXPERTiwasaanswered 4 months ago"


Question: Using Lambda@Edge to alter HTML

A customer is hosting static HTML on S3 and is looking to user Lambda@Edge to add meta tags dynamically.Is this an appropriate use case for Lambda@Edge or do we have other tools that could be a good fit?Thanks!FollowComment

Answer: "0Accepted AnswerI do not believe it is feasible to modify the body of HTTP response in Lambda@Edge response triggers.  See the documentation below:https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-updating-http-responses.htmlWhen you’re working with the HTTP response, Lambda@Edge does not expose the HTML body that is returned by the origin server to the origin-response trigger.CommentShareAWS-User-9542239answered 3 years ago0I just want to provide an updated answer to this question. Using a Lambda@Edge origin response function, you can fetch the current html file from S3 and load it into a variable. From there you can modify the payload and then reset it as a new payload. Here is a simple example of fetching the file from S3, but you would still need to write something to modify the payload. https.get(`https://bucketname.s3.amazonaws.com/index.html`, (res) => {            res.on('data', (d) => {                let file = decoder.write(Buffer.from(d, 'base64'));                response.status = '200';                response.statusDescription = "OK";                response.body = file;                return response;            });        }).on('error', (e) => {            console.error(e);        });CommentShareJeremyAWSanswered a year ago"


Question: Create aws_secret_access_key for S3 bucket

"Hi all, I'm very new to this, and got very lost in the docs, so likely what I want is "obvious", but I'm afraid I must beg help with it, or at least with finding a document that describes the path I should take. See the tl;dr below if you don't think the background is helpful.background-------------------In the past, I have used an S3 bucket created and owned by  another company. I uploaded data to it using the "aws s3 sync" command line tool. This did a good job of retries (important since in a typical 200GB upload from a consumer-grade ISP connection, some things would inevitably fail and retries are important.As part of this, I the company had given me an aws_access_key_id and aws_secret_access_key to make the connection.Fast forward to the present day. I created a bucket of my own, and started copying data into it using the web page tool s3.console.aws.amazon.com/s3/<myBucket>/upload... this works tolerably well, but doesn't do the "sync" like operation, which leaves me trawling through a couple of hundred files in a directory structure trying to work out what needs a retry.tl;dr ----------------------------So, to my actual goal (I think). I need to access this using the "aws s3 sync:" command line tool, but for that I need to create a key. I cannot see how to do this. Can someone help, please?TIATobyFollowComment"

Answer: "0In case it helps others, the key is not created for the bucket, nor even for the S3 service. It's created for an IAM-user. So, of course, I was looking in all the wrong places. Then that user must be granted the appropriate permissions.CommentShareTobyEggittanswered 2 years ago"


Question: FPGA appear as not ready after first boot of AMI on AWS F1 instance

"Hi there, I am having an issue with the latest github version (RC_v1_4_12) of aws-fpga SW.My goal is to create an AMI that includes the Xilinx XRT from github branch 2019.2 and the aws-fpga version RC_v1_4_12 so thatI can run instances on AWS f1.In order to do that (using f1.2xlarge):I base my new AMI on ami-03746875d916becc0 (ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-20190628)I install all the requirements for the Xilinx XRT and aws-fpga .deb packagesInstall the Xilinx XRT and aws-fpga .deb packages*** At that point, the tool "xbutil scan" lists the FPGA as ready to be used ***I create the AMI using the aws CLI: "aws ec2 create-image"So far, so good, everything works and I can see my new AMI in the list of 'Owned by me' AMIs.The problem starts when I use this new AMI to launch an f1.2xlarge instance:The instance boots with no issues, but the tool "xbutil scan" lists the FPGA *** as not ready ***.At this point I cannot program/use the FPGA.After trying varius tricks, I found out that the solution was to restart the Xilinx MPD service which comeswith the aws-fpga package (or re-install the aws-fpga .deb, or just reboot the f1 instance).After that the FPGA is ready to be used.Is that MPD service a known issue and planned to fixed in the next versions of the aws-fpga?Is there something wrong in the steps which I execute in order to create my new AMI?This is the info that I get when I launch the new AMI:System INFO:System ConfigurationOS name:        LinuxRelease:        4.4.0-1098-awsVersion:        #109-Ubuntu SMP Fri Nov 8 09:30:18 UTC 2019Machine:        x86_64Glibc:          2.23Distribution:   Ubuntu 16.04.6 LTSXRT InformationVersion:        2.3.0Git Hash:       ed096afaa193de4c8b0176e9245992cc3a3e7296Git Branch:     2019.2Build Date:     2019-12-20 10:20:49XOCL:           2.3.0,ed096afaa193de4c8b0176e9245992cc3a3e7296XCLMGMT:        unknownMPD log as reported by the journalctl:a) During the AMI launch:Jan 08 07:18:20 ip-172-31-32-66 mpd[1247]: startedJan 08 07:18:20 ip-172-31-32-66 mpd[1247]: found mpd plugin: /opt/xilinx/xrt/lib/libmpd_plugin.soJan 08 07:18:20 ip-172-31-32-66 mpd[1247]: aws mpd plugin init called: 0Jan 08 07:18:20 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] write 56 bytes out of 56 bytes to fd 4Jan 08 07:18:20 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] msg arrived on mailbox fd 4Jan 08 07:18:20 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] retrieved msg size from mailbox: 40 bytesJan 08 07:18:20 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] read 72 bytes out of 72 bytes from fd 4, valid: 1Jan 08 07:18:20 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] mpd daemon: request 11 received(reqSize: 24)--> At this point xbutil scan reports: <----[0] 0000:00:1d.0 xilinx_aws-vu9p-f1_dynamic_5_0(ts=0xabcd) user(inst=128)WARNING: card(s) marked by '' are not ready, run xbmgmt flash --scan --verbose to further check the details.b) Restart the mpd.service - Xilinx Management Proxy Daemon (MPD):Jan 08 07:18:24 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] msg arrived on mailbox fd 4Jan 08 07:18:24 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] retrieved msg size from mailbox: 32 bytesJan 08 07:18:24 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] read 64 bytes out of 64 bytes from fd 4, valid: 1Jan 08 07:24:35 ip-172-31-32-66 mpd[1247]: mpd caught signal 15Jan 08 07:24:35 ip-172-31-32-66 systemd[1]: Stopping Xilinx Management Proxy Daemon (MPD)...Jan 08 07:24:37 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] write 56 bytes out of 56 bytes to fd 4Jan 08 07:24:37 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] mpd_getMsg thread 0 exit!!Jan 08 07:24:43 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] write 0 bytes out of 2104 bytes to fd 4Jan 08 07:24:43 ip-172-31-32-66 mpd[1247]: [0:0:1d.0] mpd_handleMsg thread 0 exit!!Jan 08 07:24:43 ip-172-31-32-66 mpd[1247]: aws mpd plugin fini calledJan 08 07:24:43 ip-172-31-32-66 mpd[1247]: endedJan 08 07:24:43 ip-172-31-32-66 mpd[2526]: startedJan 08 07:24:43 ip-172-31-32-66 mpd[2526]: found mpd plugin: /opt/xilinx/xrt/lib/libmpd_plugin.soJan 08 07:24:43 ip-172-31-32-66 mpd[2526]: aws mpd plugin init called: 0Jan 08 07:24:43 ip-172-31-32-66 mpd[2526]: [0:0:1d.0] write 56 bytes out of 56 bytes to fd 4Jan 08 07:24:43 ip-172-31-32-66 mpd[2526]: [0:0:1d.0] msg arrived on mailbox fd 4Jan 08 07:24:43 ip-172-31-32-66 mpd[2526]: [0:0:1d.0] retrieved msg size from mailbox: 40 bytesJan 08 07:24:43 ip-172-31-32-66 mpd[2526]: [0:0:1d.0] read 72 bytes out of 72 bytes from fd 4, valid: 1Jan 08 07:24:43 ip-172-31-32-66 mpd[2526]: [0:0:1d.0] mpd daemon: request 11 received(reqSize: 24)Jan 08 07:24:43 ip-172-31-32-66 mpd[2526]: [0:0:1d.0] write 2104 bytes out of 2104 bytes to fd 4Jan 08 07:24:43 ip-172-31-32-66 mpd[2526]: [0:0:1d.0] msg arrived on mailbox fd 4Jan 08 07:24:43 ip-172-31-32-66 mpd[2526]: [0:0:1d.0] retrieved msg size from mailbox: 48 bytesJan 08 07:24:43 ip-172-31-32-66 mpd[2526]: [0:0:1d.0] read 80 bytes out of 80 bytes from fd 4, valid: 1Jan 08 07:24:43 ip-172-31-32-66 mpd[2526]: [0:0:1d.0] mpd daemon: request 10 received(reqSize: 32)Jan 08 07:24:43 ip-172-31-32-66 mpd[2526]: [0:0:1d.0] write 524360 bytes out of 524360 bytes to fd 4--> At this point xbutil scan reports: <----[0] 0000:00:1d.0 xilinx_aws-vu9p-f1_dynamic_5_0(ts=0xabcd) user(inst=128)FollowComment"

Answer: "0Accepted AnswerHello,As of right now, we are working towards officially supporting 2019.2 Xilinx toolset(XRT, Vivado, Vitis).We are aware of the issue with mpd and are working with Xilinx on a workaround.You do not need to remove the packages in order to get it to work.To use the AWS fpga mgmt library with 2019.2 XRT, you need to run the following steps:Stop mpd firstsudo systemctl stop mpdLoad your image using the AWS F1 SDK:fpga-load-local-image -S<slot number> -I <AGFI>Start mpdsudo systemctl start mpdThe card should be usable now until you have to clear the FPGA image. You should be able to use xbutil to program any other AFI now.AWS uses different PCI Device ID's to differentiate between loaded AFI's and a Cleared slot and the bug is in contention between mpd and the aws managment library when we have to refresh Device ID's.I apologize for this churn and we will update here once we have a fix for this. Until then, please let us know if this workaround does not work for you.-DeepCommentShareDeep_Panswered 3 years ago"


Question: MWAA environment variables are not accessible in requirements.txt?

"Hi,when trying to install private python package as a dependency via requirements.txt, it looks like usual mwaa environment variables are not accessible in the requirements.txt.My requirements.txt file (does not work):--extra-index-url=https://${AIRFLOW__GEMFURY__TOKEN}:@pypi.fury.io/myusername/myprivatepackage==0.2However, if I don't use environment variables inside requirements.txt file, everything works fine, dependencies are installed:--extra-index-url=https://privatetoken:@pypi.fury.io/myusername/myprivatepackage==0.2One more thing to mention, if I try to print out this environment variable inside the DAG – it is accessible and has the defined value, without any problems.Example how to use mwaa environment variables inside requirements.txt file is here –https://docs.aws.amazon.com/mwaa/latest/userguide/best-practices-dependencies.html#best-practices-dependencies-different-ways(Option three: Python dependencies hosted on a private PyPi/PEP-503 Compliant Repo)Does anyone have/had similar issue?FollowComment"

Answer: 0From version Airflow 2.0 this problem no longer exist!CommentSharealgirdasanswered 2 years ago


Question: Is the API Gateway integration with S3 allow uploading larger files than 10MB?

I am trying to build an upload API where my user is able to upload large files up to 10 GBs. My initial thinking was to have ECS instances accept uploads behind an API gateway but quickly realised the API Gateway limits uploads to a max 10MB payload.I then found this article https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-upload-image-s3/ which suggests some kind of a API Gateway integeration with S3 but I can't imagine the technique in the article lifting the upload limit. Is my assumption here correct?FollowComment

Answer: "0Accepted AnswerHi,You are correct. That integration will not make the 10mb limit go away. That article only mentions an API GW ->S3 Integration type via AWS Service, instead of using a container/serverless in the middle.Instead, to upload larger files via an API gateway, you would:Create an api gateway with a lambda proxy integrationThe function generates a signed URL granting upload access to S3 bucket and gives back the url to the user, as api response.The user can now upload larger files using a combination of S3 presigned urls and multipart upload.https://docs.aws.amazon.com/AmazonS3/latest/userguide/PresignedUrlUploadObject.htmlhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/mpu-upload-object.htmlCommentShareEXPERTalatechanswered 4 months agoEXPERTBrettski-AWSreviewed 4 months agoAWS-User-Arman 4 months agoMany thanksShare"


Question: Certificate in Failed Status

My certificate shows in failed status and there is no detailed reason that I can see. I need help ASAP as my website is not working. My domain is currently managed by AWS.FollowComment

Answer: 0Thanks for these. I have looked at this earlier and those articles don't seem to help. It's also not showing detailed status.CommentSharerePost-User-4320088answered 10 months agoIndranil Banerjee AWS EXPERT10 months agoSo you are sure your certificate has not expired and you are still seeing this issue. Have you opened an AWS Support Case?Share0Take a look at this to see if any of these apply to you - https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-failed.htmlAlso this - https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-renewal.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 10 months ago