Question: Vitis host program has to be match with afi category

"Hello, I meet such an issue (or something that looks not straightforward for understanding)--post here if someone can help to explian..First of all, two factors:factor1: a typical Xilinx Vitis developed application can be executed  as below on AWS F1 machine:./host_exec ./(kernel).awsxclbinfactor2: there are two kinds of kernel on AWS F1 based on the tools that created it: a sdk developed kernel (name as sdk_krl ), or a hdk developed kernel (I name it as hdk_krl).OK, what I find is: when my application kernel file is a sdk_krl kernel, then on AWS F1 machine, I MUST have an sdk_krl kernel preloaded (by using sudo fpga-load-local-image -S 1 -I agfi-xxx, here agfi-xxx must be an sdk_krl kernel, but not necessary to be the exact kernel of the current application).In the above case, if I have an hdk_krl kernel, then when I run the application I will meet xrt ERROR as below:[XRT] ERROR: See dmesg log for details. err=-22[XRT] ERROR: Failed to load xclbin.This problem hurdle me for quite a while to debug..So my question:Why is that? as for local FPGA machine there is no such difference.is there some better way to handle that--I mean that means if I have two applications one is hdk kernel another is sdk kernel, I can not simply run the different host program to load them (as on a local FPGA machine) but need using "sudo fpga-load-local-image -S 1 -I agfi-xxx" command to switch over--that sound quite weird.FollowComment"

Answer: "0Hi macleonsh,When you start an F1 instance, the FPGA is in a cleared state. The cleared FPGA presents the Device ID 0x1042Two main things to remember here are:XRT(XOCL) driver does not bind with Device ID 0x1042.XRT MPD opens up a file descriptor on a mailbox subdevice when it binds to a Device ID listed in here: https://github.com/Xilinx/XRT/blob/master/src/runtime_src/core/pcie/driver/linux/xocl/devices.hIf you are using Vitis to run your application, whether it is using Vitis rtl kernel or an ocl kernel, you need the xocl driver to bind with the device. If the slot is in a cleared state, it will not bind to the slot.To get Xocl to bind to a slot, it needs to have a Device ID loaded that it can bind to.When you call "sudo fpga-load-local-image -S 1 -I agfi-xxx" or restart MPD, the Device ID loaded is such that it lets the XOCL driver bind.Note that restarting MPD will automatically load a default AFI(in GA regions only)In your case, are you switching between Vivado generated AFI's and Vitis generated AFI's? I want to try to understand your flow a bit more to see how we can make this easier for you.-DeepCommentShareDeep_Panswered 2 years ago0Thanks for the feedback, Deep,Yes I understand that xocl driver need to bind with the device.Something special in China region is the default AFI can not be accessed so I manually loaded hello-world afi (agfi-0fcf87119b8e97bf3, which is vivado afi--after loading did is f000).In such case when I launch up one of my applications, which is Vitis created afi, the XRT error as "ERROR: See dmesg log for details. err=-22" will be reported.It tooks me quite a while to find the reason as the same application runs well on my local FPGA machine. Later I realized if I must preload one whatever afi created by vitis (after loading did=f010) then my vitis application will run well.This limitation is not serious --but considering if someone who has two kernels (one from vitis, another from Vivado) then this will become a potential issue --through the workaround is also there (preload the relevant afi).maybe you shall put some reminder in help document, to prevent someone else from spending time to "debug it"..CommentSharemacleonshanswered 2 years ago0Hi,I believe this is due to the difference in Device ID.When when your program wants to load an AFI with a different Device ID the following steps happen:The udev monitor will trigger from a ‘remove’ event. It will cause the MPD main thread to close the 2 child threads for this slot.AWS fpga management library calls will load the new AFI, make system calls to remove the device from the PCI bus and rescan the PCI bus.This causes the XOCL driver to unbind.Now the slot is not programmable from the OpenCL application anymore. When that changes, mpd needs to close the file descriptors while the aws-fpga library makes the call to rescan sysfsSo to keep mpd running, it would be better to load an afi that has the device ID you want all your accelerators to run with. That would remove the need for a rescan and xocl will not unbind.I hope this helps. Let us know if you have more questions around this and we'd be happy to help.-DeepCommentShareDeep_Panswered 2 years ago0Hi Deep."It would be better to load an afi that has the device ID you want all your accelerators to run with. " I am not fully understand this statement..In another word, as soon as I have two different Dids (This will happen suppose I have two kernel, one from vitis and another from vivado)--and if I need switch over from one to another, I shall always preload the relevat afi before I run the application -- There is no alternative way, is that right?CommentSharemacleonshanswered 2 years ago0Hi,Due to the way the XRT MPD opens file descriptors into the sub-device, if the Device ID's change(basically a pcie remove and rescan), MPD will shut down as it detects a remove event and you would have to start MPD again after the new AFI is loaded.If you could use the same device id for both the Vitis and Vivado based kernels, it would not require a re-scan from the management libraries and could help. However, if you are using Vivado and Vitis generated kernels, what driver are you using with both? Are you using two different device id's as you are using two different drivers to bind to the different kernels?-DeepCommentShareDeep_Panswered 2 years ago0If you could use the same device id for both the Vitis and Vivado based kernels--> this is interesting to be known, what shall I do to get the same device id? I thought it was designed to be different..."However, if you are using Vivado and Vitis generated kernels, what driver are you using with both? Are you using two different device id's as you are using two different drivers to bind to the different kernels"I think the device id is generated during afi creation, to be specifically:for vitis, after fpga binary build, use the script : $VITIS_DIR/tools/create_vitis_afi.sh  to convert the xclbin to awsxclbin and generate afi/agfi, a design tar package will be uploaded to S3. check such afi the dvice id is f000for vivado, after fpga binary build, call "aws ec2 create-fpga-image" command to convert the design file to upload the design tar to S3 (I checked out it actually just the dcp file) and get the afi/agfi.  check such afi the dvice id is f010For both build, I did not use the different device driver I suppose? I shall use the same version AWS_FPGA release, same xrt/xocl version. target platform shall be same as well.Oh I just realized the vitis build was made on the Ubuntu machine and the vivado build was made on one Centos machine  -- will that cause any difference on device id?CommentSharemacleonshanswered 2 years ago0You could update the Device ID in the create_vitis_afi.sh script:https://github.com/aws/aws-fpga/blob/master/Vitis/tools/create_vitis_afi.sh We suggest keeping the Vitis Device ID F010You can update the Device ID for the HDK flow in an ID_defines files for eg: https://github.com/aws/aws-fpga/blob/master/hdk/cl/examples/cl_dram_dma/design/cl_id_defines.vhThat should be automatically picked up in the manifest created by this script here: https://github.com/aws/aws-fpga/blob/master/hdk/common/shell_v04261818/build/scripts/aws_build_dcp_from_cl.shThe XRT XOCL device driver should bind with either of these once you setup the same Device ID.I hope this helps! Let me know if you have any further questions!-DeepCommentShareDeep_Panswered 2 years ago0Thank a lot Deep,Just to double-check, from this definition:define CL_SH_ID0       32'hF001_1D0Fthis defines the device id=f001, correct? I wonder where the "f000" value of some my AFI came from? (I check out some different older branched, they all have the same value F001, not F000).If I want to have the same device id with Vitis, I can simple change this value to be 32'hF010_1D0F, correct?CommentSharemacleonshanswered 2 years ago0To change the device id for your Vivado created cl's,  changing the define will work.The Device ID's are picked up by the aws_build_dcp_from_cl.sh script from that file. If you created AFI's using cl_hello_world as the template, you might see them set to F000 in there: https://github.com/aws/aws-fpga/blob/master/hdk/cl/examples/cl_hello_world/design/cl_id_defines.vhThis is basically picked up from the id_defines file and added to the ingestion manifest by the script. So if you modify the file, the script will use that modification to create the manifest file used for AFI creation.For the Vitis flow, it is set to F010 by default.I hope that helps.-DeepCommentShareDeep_Panswered 2 years ago"


Question: Access to Dashboard denied

The (Leadership Competency Trainings Quicksight) is no longer accessible: https://us-east-1.quicksight.aws.amazon.com/sn/dashboards/446b45dc-55d5-4ba4-b128-80b995c0df33The message I'm receiving states this Dashboard cannot be open - Will this be page no longer be available for future viewing or will this data be completely removed?FollowComment


Question: Need advice on how to highlight objects

"Our project needs to highlight "selected" characters or objects. Ideally we could set a flag on an entity to cause it to be rendered with a silhouette outline or a glowing color or something like that. If there are multiple models in the scene that use the same material, the other instances of those models should not be affected.The most promising clues I've found are some functions in IComponentRender:SetCustomPostEffectSetHUDSilhouettesParamsBut so far I have not been able to get these to do anything.Any ideas how to get these features working or other ways to achieve what I'm trying to do?Follow"

Answer: "0Accepted AnswerI found the solution using the legacy entities. I had to edit my PostEffectGroup xml file in Engine\Libs\PostEffectGroups. In that file, find the effect named "HudSilhouettes" and enable it (Set 'Active' to 1) and also make sure the effect named "Post3DRenderer" is not active.Once those two settings are made in the xml file, calling SetHUDSilhouettesParams on a legacy IComponentRender works fine.Amazon could add this to the new component system pretty easily.SharerePost-User-7779371answered 6 years ago0@REDACTEDUSERDidn't you make something like this? I tried looking for your post and couldn't find it.SharerePost-User-5046793answered 6 years ago0Ideally, I would like something like this:SharerePost-User-7779371answered 6 years ago0Or similarly, something like this (this from the CryEngineV editor). I see parts of the code for this is present but I haven't been able to get it working yet.SharerePost-User-7779371answered 6 years ago0Mine was a shader to do glowing silhouettes. Sorry, but I just procrastinated on the release and still didn't tested in dept. I will try to release it in the current state and see what happens.SharerePost-User-7621041answered 6 years ago0Thanks for the feedback! We've contacted the team with a feature request for a non-legacy solution.SharerePost-User-4556816answered 6 years ago"


Question: Flatten the json file

"Hi all,My concern is I need to flatten the json file . When i am using glue visual studio it's flatten top level. I need to flatten deep.FollowComment"

Answer: "0Flatten applies to structs, arrays cannot be flattened (flattening an array just would just mean removing nested arrays) but exploded, which is a different operation that changes the table cardinality and should be used with care (you are not really flattening but denormalizing the data).You can explode an array and then flatten the objects inside if you want to.CommentShareGonzalo Herrerosanswered 8 days ago"


Question: "route53 new domain: unable to get authorization code  for transfer, privacy setting not updating on whois.com"

"Hi, I registered two domains recently with Route 53. On both of them, I enabled privacy settings. Only one of them worked, as shown by the last updated time of the record via whois.com.The other is not working, not matter what I tried. So I want to transfer this out of route53 to WordPress. However, it won't even give me a transfer code."Sorry, but an unexpected error has occurred while getting your auth code. Please retry again. See system status for more information on current system status."FollowComment"


Question: Advice on creating VPC for EC2 to use IPSec connection

"I am currently working on the integration of 2 platforms which need to communicate to each other via https requests. However one of these platforms' endpoints is only accessible via a VPN into their own network. I therefore want to use AWS to establish an intermediary app that will receive https communications from platform 1, and send it to platform 2, which is the one behind the VPN.To this end, I have been looking at documentation on AWS, and it looks like the best solution is to create a VPC on which I'd create a Site-to-Site VPN Connection using IPSec. Then I would create a new EC2 instance on this VPC which I will use to forward requests from platform 1 to platform 2.The questions I have are as follows:Once the IPSec Site to site connection is established, will my EC2 instance (deployed to the same VPC that hosts the Site-to-Site connection) immediately be able to communicate with platform 2 which is behind their VPN based solely on the fact that it is on the same VPC, or will there be further routing setup required to allow to communicate via the tunnel established?The VPN we wish to connect to has a process through which they must whitelist any given entities they connect with.A) They ask for an IPSec Gateway IP; I have looked at the documentation at https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html , and assume this is referring to the IP of what is in the document called the Virtual Private Gateway. I have created a VPG in my VPC but I cannot see an IP address associated with it. Is this something that only appears once the VPG is associated with site to site connection (and is no longer in a state of detached)?B) They require the IP addresses of the applications they will be interacting with, which in this case I assume will be my EC2 instance. However they require that subnet /29 or higher is required. How can I enforce that subnet on the EC2 public IPs? When creating a VPC I have the option of specifying the IPv4 CIDR block, however I cannot specify a netmask that is not between /16 and /28.I'm looking for advice on the above so I can make sure that the solution I wish to undertake with the VPC is not flawed, and that I am on the right track. Any guidance is appreciated.FollowComment"

Answer: "0You will need to update the route table on both ends of the connection to direct traffic over the VPN for appropriate IP ranges. See this doc for more detail: https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNRoutingTypes.htmlYou will be given two static IPs for your S2S VPN connection when you create it. You are correct - the AWS side of the connection is referred to as the Virtual Private Gateway (VPGW). However, the VPGW is just a logical construct that represents the VPN's entry point into your VPC. The static IPs for the VPN gateway are not assigned until you create a a S2S VPN Connection. Once you create it, you will have two IPs to provide to your network team, which they can then use to configure their devices. AWS provides automatically generated configuration files for many popular devices (available after creation of the connection).I'm not as clear on the requirement from your network team for a /29, but you are correct that the smallest subnet CIDR is /28. The network team may need to relax that requirement for this connection.CommentShareCameron Todanswered a year ago"


Question: VPN over Direct Connect with Transit Gateway

I have a customer that is trying to setup a Direct Connect into both a commercial account and a GovCloud account and associate it with a Transit Gateway.It looks like the recommended way to do this is to create a Direct Connect Gateway in the commercial account and that will get automatically propagated to the associated GovCloud account. From there you can associate a Transit Gateway to the corresponding Direct Connect Gateway.My question is how do you set this up if you need to have VPN over Direct Connect for the GovCloud account (and potentially not need it for the commercial account)? I see other posts that talk about configuring VPN over Direct Connect and then associating the VPN with the Transit Gateway. Would you use this method for the GovCloud account and then the DX -> DXGW -> TGW method for the commercial account?ThanksFollowComment

Answer: "1Accepted AnswerIn the end it's all about the virtual interfaces that you create on top of the DX connection:For your GovCloud account: As you want to run VPN over DX, you should create a Public VIF (https://docs.aws.amazon.com/directconnect/latest/UserGuide/create-vif.html#create-public-vif). This way VPN connectivity between the customer site and the AWS VPN endpoint in GovCloud will run over this Public VIF, as the CIDR with the AWS VPN endpoints is announced over this VIF.That VPN connection can then be connected to a TGW within GovCloud or you can leave it standalone. A Public VIF will not use DX Gateway.For your Commercial account: As you don't want to use VPN over DX here, but instead connect the DX Gateway directly to a TGW, you would create a Transit VIF (https://docs.aws.amazon.com/directconnect/latest/UserGuide/create-vif.html#create-transit-vif).Keep in mind that from an operational perspective, it's usually not a good idea to use the commercial account associated with a GovCloud account for anything. Usually you're better off using a completely separately commercial account, which can be part of an Organizations structure.CommentShareEXPERTChrisE-AWSanswered 4 years ago"


Question: Is there a way to get an on-demand price list for EC2 on .NET?

"Using the C# SDK, I can only find spot prices and not on-demand prices. Can this be done?FollowComment"

Answer: "1Have you tried using the pricing API. Link in .NET SDKCommentShareEXPERTPeter_Ganswered 4 months agoEXPERTiwasareviewed 4 months agocombii 4 months agoThank you for the response Peter. I tried looking into it with the following code, but I am getting a timeout when calling the GetProducts method. Added filters to make the request smaller as I thought the retrieval of information was too large and might be causing it to time out, but didn't seem to help.What is the cause of this?        // Create a request to get the price for the specified instance type        string instanceType = "t3.medium";        var request = new GetProductsRequest        {            ServiceCode = "AmazonEC2",            Filters = new List<Amazon.Pricing.Model.Filter>            {                new()                {                    Field = "instanceType",                    Type = FilterType.TERM_MATCH,                    Value = instanceType                },                new()                {                    Field = "location",                    Type = FilterType.TERM_MATCH,                    Value = "EU (Ireland)"                }            },            FormatVersion = "aws_v1"        };        // Make the request to get the price        var response = await pricingClient.GetProductsAsync(request);SharePeter_G EXPERT4 months agoNot exactly sure whats wrong with code (I am not .NET dev). Using AWS cli I got a response in < 2 secs using the same filters as you usedSharecombii 4 months agoCould you please send me the cli command you used?Share0As mentioned in the answer by @Peter_G, you can use the Pricing API which is also available in the .NET SDK.Make sure you configure the client to use a correct endpoint for calling the service.As mentioned in the documentation:The AWS Price List Query API provides the following two endpoints:https://api.pricing.us-east-1.amazonaws.comhttps://api.pricing.ap-south-1.amazonaws.comSo you have to ensure your client is configured for either us-east-1 or ap-south-1 as region. Here is an example:using Amazon.Pricing;using Amazon.Pricing.Model;using Amazon.Runtime.CredentialManagement;var credChain = new CredentialProfileStoreChain();credChain.TryGetAWSCredentials("your_profile_name", out var awsCredentials);var client = new AmazonPricingClient(awsCredentials, Amazon.RegionEndpoint.USEast1);var response = await client.GetProductsAsync(new GetProductsRequest{    ServiceCode = "AmazonEC2"});response.PriceList.ForEach(s => Console.WriteLine(s));CommentShareDmitry Balabanovanswered 4 months ago"


Question: How to configure ELB to allow outbound API calls from third-party SDKs

"I have an Elastic Beanstalk application in a custom VPC running a .NET Linux instance that has a endpoint that uses a third-party SDK. The SDK needs to make a separate API call when the endpoint is hit. As an experiment, when I put the instance in a public subnet, this works. However, once I configure a Classic Load Balancer in front of the instance, I get a 504 "GATEWAY_TIMEOUT" on this endpoint. Note that all my other endpoints still work behind the Classic Load Balancer. As another experiment, I opened up all the related security groups to allow all inbound/outbound traffic from all IPs but it still did not work.What could I be missing here?FollowComment"

Answer: "0HiError 504 Indicates that the load balancer closed a connection because a request did not complete within the idle timeout period. You can increase the idle timeout following guideline on this document[1]https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-idle-timeout.htmlTroubleshooting steps for API Gateway Network error communicating with endpointTry a curl request to your backend integration endpoint using the same parameters that you expect API   Gateway to pass. Confirm that the request completes and takes less than 29 seconds, which is the API Gateway Integration timeout.Investigate Logs:try calling the API via the Test facility in the API Gateway console and inspect the output to get more information.Confirm that API Gateway is calling the correct endpoint and is passing the header and body values that you expect. Also, observe any error messages from calling the integration endpoint.Sometimes the error can be caused if the backend NLB (if used) does not have Cross-Zone Load Balancing enabled and you do not have healthy resources in all AZs selected for the NLB. So, ensure that the “cross_zone.enabled” is set to “true” on the NLB. You can find this information on the ELBV2 toollinker tool → NLB → Load Balancer properties → cross_zone.enabledCommentSharerePost-User-9017359answered a year ago"


Question: Transit Gateway Direct Connect Gateway allowed prefix interactions

"A little talked about feature I found recently was this https://docs.aws.amazon.com/directconnect/latest/UserGuide/allowed-to-prefixes.htmlIf I read this correctly, this seems to act like policies on prefixes to advertise over DXGW back to on-premises, and that this is only available via Direct Connect Gateway. Am I interpreting the docs correctly? The docs are written pretty sparsely.FollowComment"

Answer: 0Accepted AnswerThis documentation is showing how you advertise routes from the Transit Gateway back to on-premises.The Transit Gateway does not send all of its routes to the Direct Connect Gateway (to advertise to on-premises). This is a place where the customer can decide what routes to advertise to on-premises.This blog has an explanation of the configuration and a screenshot of the screen which might help.https://aws.amazon.com/blogs/aws/use-aws-transit-gateway-direct-connect-to-centralize-and-streamline-your-network-connectivity/CommentShareScott_Hanswered 3 years ago


Question: AWS SSO - what OU/account to use?

"Hi,We have a greenfield environment and I am looking at the best way to set up AWS Organization and underlying OUs with accounts.We also use SSO. According to https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/organizing-your-aws-environment.pdf#benefits-of-using-multiple-aws-accounts , we should only have any services in management account.  I am trying to figure out OU/account should SSO go to according to that document. Should it go to Shared Infra? Or are there any limitations that I should know of and SSO must be part of Management account?FollowComment"

Answer: 1Easiest way to setup the landing zone is to use Control Tower.  The only caveat with SSO is that you need to deploy CT in the management account in the same region where the existing SSO is deployed.  Control Tower wont change the existing SSO.  SSO will live in the management account and is not considered a "workload".References:https://docs.aws.amazon.com/prescriptive-guidance/latest/designing-control-tower-landing-zone/account-structure-ous.htmlhttps://docs.aws.amazon.com/controltower/latest/userguide/existing-orgs.htmlhttps://docs.aws.amazon.com/controltower/latest/userguide/sso.htmlCommentShareEXPERTMatt-Banswered a year ago


Question: how to enable TLS v1.3 in ALB

"how to enable / implement TLS v1.3 in the HTTPS listener's security policy of an ALB?currently we uses the security policy - **ELBSecurityPolicy-TLS-1-2-Ext-2018-06   **but this only support protocol TLS v1.2,our security team require as to enable TLS v1.3 as wellFollowCommentRenier Lewis 7 months agoHiFor a network load balancer you can use TLS1.3https://aws.amazon.com/about-aws/whats-new/2021/10/aws-network-load-balancer-supports-tls-1-3/ALBs do not support 1.3 yet according to my understanding.The supported policies can be seen here: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#tls-security-policiesAlso, see this related article: https://stackoverflow.com/questions/68767674/does-aws-application-load-balancer-support-tls-1-3Share"

Answer: "1Note that you need to have the new experience slide set to on.  This took me forever to figure out.CommentShareSamanswered 2 months ago0Accepted AnswerHelloCurrently TLS v1.3 is only supported with NLB and not ALB.Please note AWS does not publicize the roadmap items, I would suggest to keep an eye on https://aws.amazon.com/about-aws/whats-new, then filter by 'Networking and Content Delivery' and choose 'Elastic Load Balancing (ELB)', also check the Networking Blog page for any new feature announcements.It is likely there is already a feature request for this; if you have an Account manager you can request to add your influence.CommentShareEXPERTTushar_Janswered 7 months ago0Application Load Balancer now supports TLS 1.3 after Mar 22, 2023https://aws.amazon.com/about-aws/whats-new/2023/03/application-load-balancer-tls-1-3/CommentShareBenzanswered 2 months agoEXPERTTushar_Jreviewed 2 months ago"


Question: s3 bucket accessing

"I want to know who all are accessing my s3 bucket(Like Application, AWS resources, user, and Administrator).And how to find whether my S3 bucket is accessed by the application or not.FollowComment"

Answer: 0Will this work - https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.htmlThe information provided in the server access logs can be found here - https://docs.aws.amazon.com/AmazonS3/latest/userguide/LogFormat.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 9 months ago


Question: Unable to get customer artefacts.(iOS)

"Hello AWS,I am running my scripts on AWS device farm(Automation testing) and I am using the java+testNG environment for automation. My requirement is, I need a "Cucumber.json" file that is generating after every successful execution of the script.I have tried out many things but unable to get this file. but the same thing it's generating locally. can you help me with this?sample Code:-public class ReportHelper {private static final String REPORT_OUTPUT_DIRECTORY = System.getenv("DEVICEFARM_LOG_DIR");public static void generateCucumberReport(String testfeature) {File reportOutputDirectory = new File(REPORT_OUTPUT_DIRECTORY);ArrayList<String> jsonFiles = new ArrayList<String>();jsonFiles.add("tmp/cucumber.json");String projectName = "ion-robot-app-automation";Configuration configuration = new Configuration(reportOutputDirectory, projectName);configuration.addClassifications("Platform", "iOS");ReportBuilder reportBuilder = new ReportBuilder(jsonFiles, configuration);try {reportBuilder.generateReports();} catch (Exception ex) {System.out.println("report generation failed" + ex.getMessage());}}Thanks,Abhishek GargEdited by: Tobe-AWS on Feb 22, 2021 5:03 PMFollowComment"

Answer: "0Hello abhishek1991,Is your ReportBuilder object moving your tmp/cucumber.json file to the path specified in DEVICEFARM_LOG_DIR ? If not, the file will not be zipped and available for download as an artifact.To troubleshoot, first check where the cucumber.json file is actually located at the end of your test and see if its in the directory specified by the DEVICEFARM_LOG_DIR environment variable.You can also move this file during the post test phase of your test spec .yml file.CommentShareTobe-AWSanswered 2 years ago0ThanksCommentShareabhishek1991answered 2 years ago"


Question: Direct Connect on-prem hardware recommendation

Is anyone able to recommend hardware for the on-prem end of a Direct Connect that I need to commission? Needs to support 10Gbps and MACsec. Needs to have at least 6 x 10Gbps SFP+ ports. Needs to be in stock and available for purchase in the UK despite ongoing supply chain issues for network equipment vendors. Thanks.FollowComment

Answer: "1Hello,AWS recommends connecting from multiple data centers for physical location redundancy. When designing remote connections, consider using redundant hardware and telecommunications providers.Additionally, it is a best practice to use dynamically routed, active/active connections for automatic load balancing and failover across redundant network connections.Provision sufficient network capacity to ensure that the failure of one network connection does not overwhelm and degrade redundant connections.There is no recommended or flagship hardware as per AWS !! Any hardware that suffices the minimum requirements, as you mention above can be connected using Direct Connect.Additionally, what you can do is, reach out to your Data Center/Lab team regarding the best hardware to use as per the on-premise requirements.Hope this helps !!CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 8 months agoEXPERTToni_Sreviewed 8 months ago"


Question: How to create a  custom step function state machine using the workflow

can we create a workflow state machine using stepfunctions like how we wantFollowComment

Answer: "0Yes, you can create your own workflows using Step Functions. This can be done using AWS Step Functions Workflow Studio. which is a visual editor, or using the Amazon States Language. A number of sample workflows and patterns can be found here: https://github.com/aws-samples/step-functions-workflows-collectionCommentSharedspanswered 3 months ago"


Question: I don't see Simple Mail Transfer Protocol (SMTP) settings container

"Hi,I'm newbie in AWS and I would like to send newsletter via Awazon SES service.I'm following this documentation : https://docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html and I completed the verification of a domain.Now I blocked on point number 3 (In the Simple Mail Transfer Protocol (SMTP) settings container, choose Create SMTP Credentials in the lower-left corner - the IAM console will open) because I don't see this cointainer.I'm logged in as root and not IAM user. I created it and neither logged as IAM user I don't see any SMTP area.Whato I'm doing wrong?How to create iam:ListUsers, iam:CreateUser, iam:CreateAccessKey, and iam:PutUserPolicy ?Thank you very muchFollowComment"

Answer: "0Accepted AnswerI have verified that I too do not see SMTP credential option from within the iam console but when I go to "Create SMTP Credentials" from the SES console I am prompted to provide a username to create an iam user and then I can download the SMTP credentials.The smtp credential is conversion from the secret access key so can be converted. The doc has some sample python code. In the past I used terraform to generate my iam user get the smtp credentials and store them in secrets manager for my application to use.CommentShareEXPERTPeter_Ganswered a year ago0Thank you very much Peter,but I understood why I didn't see SMTP credentials: because in Milan region SMTP is not allowed yet.Thanks for support.RegardsCommentShareMarcoZeusanswered a year agoAndrea Dallan a year agoHello Marco,I also had selected Milan and there were no Smtp options in the dashboard despite my email account being accepted for the standard limits.Now I have asked for authorization for the same address under the Irish servers, hopefully good.So thank you for this post :)Share"


Question: AWS cloudwatch cost issue

"How we can reduce aws cloudwatch cost which occur from only this "$0.30 per metric-month"   so I want to reduce number of metrics, for reduction of cost.Thanks!FollowComment"

Answer: "1By default, many services provide free CloudWatch metrics for resources (such as Amazon EC2 instances, Amazon EBS volumes, and Amazon RDS DB instances). You can also enable detailed monitoring for some resources, such as your Amazon EC2 instances, or publish your own application metrics for an additional fee.You could consider using the  get-metric-statistics command to retrieve and see statistics based on the custom data points that you published.More info on that is available at: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/publishingMetrics.htmlTo get a better estimate of CloudWatch custom metric pricing you can check out the AWS Pricing Calculator at https://calculator.aws/#/addService/CloudWatchFinally - If you determine there is a custom metric you would like to remove, there is the delete-custom-metric command from the CLI.https://docs.aws.amazon.com/cli/latest/reference/iot/delete-custom-metric.htmlCommentSharetedtrentanswered 6 months ago"


Question: Does Aurora PostgreSQL Serverless v2 support exporting snapshots to S3?

"I am trying to export a snapshot to an S3 bucket, from our Aurora Postgres Serverless v2 cluster. I keep getting the following error message: "The specified db snapshot engine mode isn't supported and can't be exported."AFAICT from the user guide, Serverless v2 does support exporting snapshots to S3: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-export-snapshot.htmlOur engine is Aurora PostgreSQL, version 10.21, region is eu-west-1, encrypted.FollowComment"

Answer: "1Accepted AnswerHello,You have mentioned that using postgreSQL version 10.21 but this is not a supported version for serverless v2.serverless v2 is supported on following postgreSQL versions as of now.13.6, 13.7, 13.8, 13.9, 14.3, 14.4, 14.5, 14.6Please check if you are using v2, if not then please upgrade to one of supported version as export snapshot to S3 is available only in V2 , not in serverless V1.CommentSharegokul_Ganswered 3 months ago"


Question: Cloudformation SNS subscription filterpolicy with "or" conditions of "and"  expressions

"I use AWS YAML cloudformation to create SNS subscription and need filter policy with multiple "or" conditions each having "and" expressions.Something like:{"creditAccountNumber": ["00001"], "status": ["OK", "CANCEL"] }or{"debitAccountNumber": ["00001"], "status": ["OK", "CANCEL"] }It would be something similar to cloudformation below(wich doesn't work).  ObjectTest:    Type: AWS::SNS::Subscription    Properties:      RawMessageDelivery: true      Protocol: sqs      Endpoint: ...      Region: ...      TopicArn: ...      FilterPolicy: !Or        - '{"creditAccountNumber": ["00001"], "status": ["OK", "CANCEL"] }'        - '{"debitAccountNumber": ["00001"], "status": ["OK", "CANCEL"] }'Does anyone know how to do it correctly?Thanks.FollowComment"

Answer: "1Seems you can't even do that kind of SNS subscription filter policy directly. As per the AWS documentation https://docs.aws.amazon.com/sns/latest/dg/and-or-logic.html:Currently, you can't use SNS filters to apply OR logic across different message attributes. Instead, you can use multiple SNS subscriptions with different endpoints to achieve the same effect. For example, assume that you have message attributes named customer_interests and customer_preferences. To apply OR logic across both attributes, create an SNS subscription to match each message attribute. Then, you can use your subscriber application to consume both types of messages through the different endpoints.CommentSharejoahnaanswered 10 months ago"


Question: How do I deactivate an AWS service?

"On May 4, I created an Amplify app just to try it out, because I decided I didn't need it so  deleted it. Soon after, when I checked the biling dashboard, I noticed I have 5 active services. I did my research and I discovered how to get rid of a service. In most services I didn't find a trace of anything created in there, except Lambda, so I deleted my Lambda functions. Later, I went back to the billing dashboard and I found and it still says I found 5 active services. The next day, it went up to 6 but I didn't do anything except double check my services, and today it went up to 7.What I'm really wondering is what does an active service mean?Is anyone else experiencing the activation of services without doing anything?FollowComment"

Answer: "0Cost explorer should help identify what services are incurring a charge (active).  On the billing dashboard, navigate to the the cost explorer and select the monthly spend by service view to see what services the charges are coming from.  You can then navigate to each service and remove the resources in use.CommentShareBitanswered a year agoAWS-User-8229718 a year agoThank you for replying! I will try that out.Share"


Question: Create a Post and Get API as an Amazon S3 proxy in API Gateway

"How to integrate API Gateway and S3 Bucket using CDK.  I have created in CDK endpoint in Kotlin. now I need to integrate s3 .** Kotlin Code :**public static void setupRoutes(HttpLambdaIntegration lambdaIntegration, HttpApi httpApi) {httpApi.addRoutes(AddRoutesOptions.builder().path("/{proxy+}").methods(Collections.singletonList(HttpMethod.ANY)).integration(lambdaIntegration).build());}**how to add s3 in above code. ****Propose : Need to store files in s3 using API Gateway**FollowComment"

Answer: 0Did you try looking at the serverlessland.com patterns? specifically: https://serverlessland.com/patterns/apigw-s3?CommentShareEXPERTUrianswered a year agorePost-User-9074506 a year agoCould you please suggest java based codeShare


Question: How to invistigate the source of BitCoinTool alerts

We are getting from time to guredduty alerts of BitCoinTool alertsI would like to investigate of what is the source of this alert.Any recommendation?Finding type: CryptoCurrency:EC2/BitcoinTool.B!DNSEC2 instance i-xxxxxxxxxxxx is querying a domain name that is associated with Bitcoin-related activity.FollowComment

Answer: "0On the finding type page here, it shows that this alert is generated from the DNS data source. Known findings, like Bitcoin mining domains, are detected via:ProofpointCrowdstrikeCustom threat lists (If you have any)If you go into the GuardDuty Console, click the finding, then scroll down to the Evidence section, you should be able to see what threat list from above it pulled from. I do want to draw your attention to the section on the page I linked above the section that says "If this activity is unexpected, your instance is likely compromised, see Remediating a compromised EC2 instance." What this means is GuardDuty findings are high fidelity, so if it thinks this is a finding, it's likely a finding (unless this machine is supposed to be mining bitcoin) and you should take action ASAP.I don't believe it shows you the exact IP/domain that your machine is reaching out to, but this is where general triage comes in. Like the page above says, your machine is likely compromised and you should take steps outlined in your organizations incident response. Amazon does have white papers on Incident Response and the AWS Marketplace has offerings you can use to get started on triaging your instance.Here's a guide on building a cloud-specific incident response plan. Regardless if your server is on premise or the cloud the steps generally involve:PreparationIdentificationContainmentInvestigationEradicationRecoveryFollow-UpFeel free to reach out to Support if you're running into issues.CommentShareAWSJoeanswered a year ago"


Question: Using ResourceTags or ThingAttributes for AWS IoT policy "conditions"

"I would like to lock down user access to the following operations on iot "Things":ListThingsInThingGroup,UpdateThingShadow,GetThingShadowI am aware that there are iot policy variables for the connected device, but I believe that only represents the attributes of the connecting device, not the device that is being accessed in the above operations.Never the less, I tried it and it did not work:    {      "Condition": {        "StringLike": {          "iot:Connection.Thing.Attributes[department_id]": "${aws:PrincipalTag/department}"        }      },      "Effect": "Allow",      "Action": "iot:ListNamedShadowsForThing",      "Resource": "arn:aws:iot:ap-southeast-2:<accountId>:*"    },I found a list with Condition keys for iot at this url . https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.htmlAn interesting one that I thought might be useful is iot:ThingGroupArn. As Things themselves can't have Tags to use with ResourceTag, ThingGroup could be used in the same way.However, this list of iot policy variables doesn't contain any condition keys for the operations above.Never the less, I tried it and it didn't work.  {      "Effect": "Allow",      "Action": "iot:ListNamedShadowsForThing",      "Resource": "arn:aws:iot:ap-southeast-2:<accountId>:*",      "Condition": {        "StringLike": {          "aws:ThingGroupArn": [            "arn:aws:iot:ap-southeast-2::thinggroup/department-id-${aws:PrincipalTag/deparpmentid}"          ]        }      }    }Has anyone found a successful strategy for implementing a policy as above?FollowComment"

Answer: "0Hi,Can you kindly clarify your use case and what you meant by "lock down user access?" What entities are you trying to lock down in this case?As you know, IAM and IoT policies are two separate systems. The features or mechanisms for each cannot be used interchangeably. IAM will be used by IAM users or roles which try to call IoT operations usually via the CLI or SDK. On the other hand, IoT policies are attached to device certificates which are used by IoT devices to communicate with IoT -> https://docs.aws.amazon.com/iot/latest/developerguide/client-authentication.htmlThe link that you have provided https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html is for IAM policies so this can only be used for IAM policies while iot:Connection.Thing.Attributes[department_id] is for IoT policies.From the table in the above documentation we can see the Condition Keys colument where we can see that only certain operations will allow ConditionKeys. For example, the iot:ThingGroupArn is only allowed for OpenTunnel and RotateTunnelAccessToken. This is most likely why the second IAM policy is not working as expectedAgain, can you clarify your use case here so that we can dive deep and try to figure out a solution? We are looking forward to your reply.CommentShareSUPPORT ENGINEERRyan_Aanswered 22 days ago0So the use case is that i have a multi-tenanted application where my users are grouped by departments. I am using the aws iot js sdk to use the operations mentioned in the OP to avoid needing to build an api around these operations.I need users in Department A to only have access to  execute these operations (e.g. iot:ListNamedShadowsForThing) on Things that they own in their department.The users are being authorised using Cognito, and I have successfully mapped their department into the identity pool making it available on the AssumeWebIdentityRole using TagSession action on the cognito_authenticated role. This becomes available in the iot policy as ${aws:PrincipalTag/deparpmentid}I can successfully ensure that users in Department A can only publish and receive from topics prefixed with department A's Id by using their department id tag mapped as above in the IoT policy for iot:Publish, iot:Subscribe actions. So this proves that ${aws:PrincipalTag/deparpmentid} indeed works in an IoT policy (if you click all the right buttons in the aws console.The issue, is as you say, those operations don't have any useful Condition Keys to use for this purpose. This seems like a big oversight in the design of iot policies. If you enabled the iot:ThingGroupArn Condition Key for any operation related to a Thing, not just tunnel operations, that would solve this problem.The only alternative solution I see is to move those operations behind my API and assert the proper permissions imperatively.Or might you be able to suggest another way.CommentShareAWS-User-3949958answered 22 days ago"


Question: Can't install pyarrow on AWS Glue python shell

"I want to import pyarrow in a Python shell Glue script because I need to export a dataframe as parquet (i.e. with DataFrame.to_parquet()).The way to add custom dependencies suggested in the AWS docs is to use .egg or .whl files (https://docs.aws.amazon.com/glue/latest/dg/add-job-python.html#create-python-extra-library).The library pyarrow has numpy and six as dependencies:numpy is already pre-installed on Glue, with version 1.16.2 as I checked with a simple print(numpy.version.version)six is not pre-installed so I downloaded six-1.14.0-py2.py3-none-any.whl from Pypi and uploaded it to S3.pyarrow is not pre-installed so I downloaded from Pypi the wheel file pyarrow-0.16.0-cp36-cp36m-manylinux2014_x86_64.whl and uploaded it to S3.The minimal script is this:import pandas as pdimport siximport numpyfrom pyarrow import *data = [['Alex',10],['Bob',12],['Clarke',13]]df = pd.DataFrame(data,columns=['Name','Age'],dtype=float)df.to_parquet('test.parquet')When I run the script adding as libraries the wheel files of six and pyarrow, I get the following message:Processing ./glue-python-libs-f8nyy9el/six-1.14.0-py2.py3-none-any.whlInstalling collected packages: sixSuccessfully installed six-1.14.0Processing ./glue-python-libs-f8nyy9el/pyarrow-0.16.0-cp36-cp36m-manylinux2014_x86_64.whland the following error:WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ConnectTimeoutError(<pip._vendor.urllib3.connection.VerifiedHTTPSConnection object at 0x7f7d78c96e10>, 'Connection to pypi.org timed out. (connect timeout=15)')': /simple/numpy/WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ConnectTimeoutError(<pip._vendor.urllib3.connection.VerifiedHTTPSConnection object at 0x7f7d78c96c88>, 'Connection to pypi.org timed out. (connect timeout=15)')': /simple/numpy/WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ConnectTimeoutError(<pip._vendor.urllib3.connection.VerifiedHTTPSConnection object at 0x7f7d78c96dd8>, 'Connection to pypi.org timed out. (connect timeout=15)')': /simple/numpy/WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ConnectTimeoutError(<pip._vendor.urllib3.connection.VerifiedHTTPSConnection object at 0x7f7d78c969b0>, 'Connection to pypi.org timed out. (connect timeout=15)')': /simple/numpy/WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ConnectTimeoutError(<pip._vendor.urllib3.connection.VerifiedHTTPSConnection object at 0x7f7d78c96898>, 'Connection to pypi.org timed out. (connect timeout=15)')': /simple/numpy/ERROR: Could not find a version that satisfies the requirement numpy>=1.14 (from pyarrow==0.16.0) (from versions: none)ERROR: No matching distribution found for numpy>=1.14 (from pyarrow==0.16.0)Traceback (most recent call last):  File "/tmp/runscript.py", line 112, in <module>    download_and_install(args.extra_py_files)  File "/tmp/runscript.py", line 62, in download_and_install    subprocess.check_call([sys.executable, "-m", "pip", "install", "--target={}".format(install_path), local_file_path])  File "/usr/local/lib/python3.6/subprocess.py", line 311, in check_call    raise CalledProcessError(retcode, cmd)subprocess.CalledProcessError: Command '['/usr/local/bin/python', '-m', 'pip', 'install', '--target=/glue/lib/installation', '/tmp/glue-python-libs-f8nyy9el/pyarrow-0.16.0-cp36-cp36m-manylinux2014_x86_64.whl']' returned non-zero exit status 1.So at first, it seems that six is installed correctly, but then it looks like the job does not realize that numpy is already present with a compatible version.Then I tried to upload to S3 also the wheel file s3://risultati-navigazione-wt-ga/libs/numpy-1.18.2-cp36-cp36m-manylinux1_x86_64.whl that I downloaded from Pypi. In this case I get the message:Processing ./glue-python-libs-xzfdvgzd/numpy-1.18.2-cp36-cp36m-manylinux1_x86_64.whlInstalling collected packages: numpySuccessfully installed numpy-1.18.2Processing ./glue-python-libs-xzfdvgzd/six-1.14.0-py2.py3-none-any.whlInstalling collected packages: sixSuccessfully installed six-1.14.0Processing ./glue-python-libs-xzfdvgzd/pyarrow-0.16.0-cp36-cp36m-manylinux2014_x86_64.whland the error:WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ConnectTimeoutError(<pip._vendor.urllib3.connection.VerifiedHTTPSConnection object at 0x7fca02861cc0>, 'Connection to pypi.org timed out. (connect timeout=15)')': /simple/six/WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ConnectTimeoutError(<pip._vendor.urllib3.connection.VerifiedHTTPSConnection object at 0x7fca02861cc0>, 'Connection to pypi.org timed out. (connect timeout=15)')': /simple/six/WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ConnectTimeoutError(<pip._vendor.urllib3.connection.VerifiedHTTPSConnection object at 0x7fca02861cc0>, 'Connection to pypi.org timed out. (connect timeout=15)')': /simple/six/WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ConnectTimeoutError(<pip._vendor.urllib3.connection.VerifiedHTTPSConnection object at 0x7fca02861cc0>, 'Connection to pypi.org timed out. (connect timeout=15)')': /simple/six/WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ConnectTimeoutError(<pip._vendor.urllib3.connection.VerifiedHTTPSConnection object at 0x7fca02861cc0>, 'Connection to pypi.org timed out. (connect timeout=15)')': /simple/six/ERROR: Could not find a version that satisfies the requirement six>=1.0.0 (from pyarrow==0.16.0) (from versions: none)ERROR: No matching distribution found for six>=1.0.0 (from pyarrow==0.16.0)Traceback (most recent call last):  File "/tmp/runscript.py", line 112, in <module>    download_and_install(args.extra_py_files)  File "/tmp/runscript.py", line 62, in download_and_install    subprocess.check_call([sys.executable, "-m", "pip", "install", "--target={}".format(install_path), local_file_path])  File "/usr/local/lib/python3.6/subprocess.py", line 311, in check_call    raise CalledProcessError(retcode, cmd)subprocess.CalledProcessError: Command '['/usr/local/bin/python', '-m', 'pip', 'install', '--target=/glue/lib/installation', '/tmp/glue-python-libs-xzfdvgzd/pyarrow-0.16.0-cp36-cp36m-manylinux2014_x86_64.whl']' returned non-zero exit status 1.so, this time, numpy is recognized during the installation of pyarrow but, as far I understand, althoughsix is installed correctly, for some reason pyarrow can't find it during the installation and indeed it tries to download from the Internet (it gets stuck a few minutes during that operation).Can anybody help me? Thanks!FollowComment"

Answer: "0It seems that you enabled Glue connection to your DBs inside your VPC in your python shell job, and there is not internet connectivity. That caused connection timeout to pypi.org.If you can have internet connectivity from your python shell job, it will work.Add NAT Gateway to your public subnet so that you can access to internet from your private subnetAdd internet gatewayRemove Glue connection if you do not need access to your DBsSee details here: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-internet-connectivity/?nc1=h_lsIf you do not want to have internet connectivity, plz update this thread.Edited by: NoritakaS-AWS on Mar 30, 2020 1:30 AMCommentShareAWS-User-6283168answered 3 years ago"


Question: quicksight is failing to add a timestream data source

"i have a quicksight account with multiple timestream data sources.when adding a new one, it fails with a strange errorstarted doing this a few days ago.the quicksight permissions are allowed to hit timestream, and i cant think of a permissions change or quicksight account change that has been implemented in our account.FollowComment"


Question: Checking AMI ID for Datasync VM

"Hello everyone,I want to launch an Ec2 instance as a Datasync agent with the relevant AMI ID. However, when I enter the command "aws ssm get-parameter --name /aws/service/datasync/ami --region ap-south-1" to check the AMI details, I am getting the error "An error occurred (ParameterNotFound) when calling the GetParameter operation".Should I be creating a parameter in Session Manager for this? I do not the AMI ID for entering in the 'Value" field under "Parameter Store".I have even checked with the command, " aws ec2 describe-images --owners amazon --filters "Name=name,Values=amzn-ami-hvm-????.??.?.-x86_64-gp2" --query 'Images[].[CreationDate,ImageId]' --output table --region ap-south-1". However, I cannot identify which is the AMI ID for using Datasync VM on EC2How to identify which AMI to use for an EC2 instance that acts as Datasync Agent?FollowComment"

Answer: "1Accepted AnswerAre you able to check that you don't have some sort of SCP that prevents you working in the ap-south-1 region, or with SSM in general?  I've just tried the command you used, and received the following:prompt: ~ % aws ssm get-parameter --name /aws/service/datasync/ami --region ap-south-1{    "Parameter": {        "Name": "/aws/service/datasync/ami",        "Type": "String",        "Value": "ami-0570b524b979c5403",        "Version": 61,        "LastModifiedDate": "2023-05-04T14:35:06.205000+01:00",        "ARN": "arn:aws:ssm:ap-south-1::parameter/aws/service/datasync/ami",        "DataType": "text"    }}CommentShareEXPERTmhjworkanswered 14 days agoAjay 13 days agoThanks for the reply. I tried with multiple terminal emulators & finally was able to execute the command with Mobaxterm. I was able to fetch the AMI details.Share"


Question: Utilizing values returned from SSM Document in a Parent/Child Document

"I have a SSM Automation document which as one of its steps, calls another automation document which return two values.I can see the output from the call to the child document back in the parent document, but I can't seem to find a way to reference it.OutputsClientToken38014768-65e1-4a3a-821d-9xxxxxxxxxxExecutionId38014768-65e1-4a3a-821d-97acxxxxxxxxxxxOutputThis is a message to pass into the updatefinding step, SUPPRESSEDStatusSuccessIf the output was in the parent document I would have used {{ParentDocumentStepName.outputvalue}}, but when I try that as {{ParentDocStepWhichCallsSubDocument.outputvalue}} it doesnt seem to resolve.    Does anyone have any suggestions for things to try?Here is my parent document:description: |  ### Document Name - TestParent  ## What does this document do?  This is the parent for a test of Parent to child testing  ## Input Parameters  None  ## Output Parameters  NoneschemaVersion: '0.3'assumeRole: ''mainSteps:  - name: Remediation    action: 'aws:executeAutomation'    isEnd: false    inputs:      DocumentName: TestChild      RuntimeParameters:        AutomationAssumeRole: 'arn:{{global:AWS_PARTITION}}:iam::{{global:ACCOUNT_ID}}:role/SO0111-ConfigureS3ServerAccessLogging'    outputs:      - Name: remediationOutputMessage        Selector: $.Payload.RemediationResultStatus        Type: String      - Name: remediationOutputStatus        Selector: $.Payload.RemediationResultMessage        Type: String  - name: UpdateFinding    action: 'aws:executeScript'    inputs:      Runtime: python3.8      Handler: script_handler      Script: |-        def script_handler(events, context):          print(events)          return {'message': 'Hello'}      InputPayload:        message: '{{Remediation.remediationOutputMessage}}'    description: Update finding    isEnd: trueAnd here is my Child Document:description: |  ### Document Name - TestChild  ## What does this document do?  returns a json object fixed for testing  ## Input Parameters  * AutomationAssumeRole: (Required) The ARN of the role that allows Automation to perform the actions on your behalf.  ## Output Parameters  * Remediation Result Status  * Remediation Result StatusschemaVersion: '0.3'assumeRole: '{{ AutomationAssumeRole }}'outputs:  - RemediateTargetBucket.RemediationResultStatus  - RemediateTargetBucket.RemediationResultMessageparameters:  AutomationAssumeRole:    type: String    description: (Required) The ARN of the role that allows Automation to perform the actions on your behalf.    allowedPattern: '^arn:(aws[a-zA-Z-]*)?:iam::\d{12}:role/[\w+=,.@-]+'mainSteps:  - name: RemediateTargetBucket    action: 'aws:executeScript'    description: |      Returns a fixed json object      ```      {            'message': 'This is a message to pass into the updatefinding step',            'resourceBucketName': 'bucket1',            'LoggingBucketName': 'bucket2',            'status': 'SUPPRESSED'      }      ```    timeoutSeconds: 60    isCritical: true    isEnd: true    inputs:      Runtime: python3.8      Handler: lambda_handler      Script: |        import json        def lambda_handler(event, context):          return {              'message': 'This is a message to pass into the updatefinding step',              'resourceBucketName': 'bucket1',              'LoggingBucketName': 'bucket2',              'status': 'SUPPRESSED'          }    outputs:      - Name: RemediationResultMessage        Selector: $.Payload.message        Type: String      - Name: RemediationResultStatus        Selector: $.Payload.status        Type: StringFollowComment"

Answer: "0In the Remediation step in the Parent document, the output from the child document is returned as a StringList and not JSON. So these lines in the parent document won't work    outputs:      - Name: remediationOutputMessage        Selector: $.Payload.RemediationResultStatus        Type: String      - Name: remediationOutputStatus        Selector: $.Payload.RemediationResultMessage        Type: StringThats why  {{Remediation.remediationOutputMessage}} doesn't resolve to anything. To reference output from Remediation step, you can do it by using the following format: Secondary_Automation_Step_Name.Output . In your case it is  {{ Remediation.Output }}. This would resolve to ['This is a message to pass into the updatefinding step', 'SUPPRESSED'] . Then you can parse it in script_handler in the UpdateFinding step.Please refer to aws:executeAutomation and aws:executeScript public AWS documents to learn more about what outputs they return.CommentShareAWS-User-7337182answered 10 months agometageek 8 months agowhat if the next step you need the output in isn't a script you can use to parse 'Output'? how can you reference individual bits? or more directly, how to return individually referenceable data from a script?Share"


Question: AWS Free Tier section in Billing Dashboard is empty.

"Was trying to access the Free Tier usage page like always to track my usage, but now it just shows: Summary: (0) and no listed services.Note: I have been using my account for more than two months or so and opened this page before.I cleared cookies and cache but no luck. Tried a different browser and icognito as well.FollowComment"

Answer: "0Accepted AnswerThe billing console takes 24 - 48 hours to get populated. This issue can either be due to the delay in update of the Billing console or there are no resources being used at the moment.Can you please check the bills section and see if that has been populated with the entries of the active service? If yes, what are the active services?CommentShareSUPPORT ENGINEERHarshavardhan_Ganswered 2 months agoAhmedSabry74 2 months agoOk. So it's solved! The free tier section was empty since the bill was being issued. I may have not been clear in my question. I did use multiple resources and the bills section was indeed populated with entries. However, it seems that the free tier section is emptied when the bill is being issued. It is now back to normal with the usage metrics available.Share0Hi. What do you want to see on this page?CommentSharemyronix88answered 2 months agoAhmedSabry74 2 months agoBasically it listed the services eligible for free tier and the used amount. So S3 requests, EC2 hours, EBS volume, etc. Each column had the current usage and the forecasted usage and so on.A similar post is can be seen here: https://repost.aws/questions/QUvxGgWl6XT9Gj-tjwtwHd2w/aws-free-tier-servicesHowever, their case is that they have not used any services, whereas I definitely did.Share"


Question: Cross-account monitoring using CDK

How to set up cross-account monitoring in Cloudwatch using AWS CDK? From Cloudformation documentation on OAM it feels like we need only two resources: a Sink in a monitoring account and Links in sharing accounts. It feels that required IAM policies are created as part of OAM::Sink. But when it fails with  "Invalid request provided: AWS::Oam::Sink". What could be missing?FollowComment

Answer: 0Try the following link:https://repost.aws/questions/QUmLk1Q-VrSTW6ok3Scj8o6A/enabling-cross-account-functionality-in-cloudwatch-without-aws-consoleCommentSharevtjeananswered 8 days ago


Question: Snapstart enabled lambda getting error "Runtime restore hook execution timed out" even though we aren't using afterRestore()

"Occasionally, we are seeing the following calling a snapstart enabled lambda: Runtime restore hook execution timed out after 2 seconds (Service: Lambda, Status Code: 408, Request ID: 18a9e2cc-18b1-4197-968b-6ab1fa738ca6)From what I see in the docs,  there is a 2 second timeout for restore hooks ("Restore hooks (afterRestore()) time out after 2 seconds"). However, afterRestore() does not exist in our code. Is there some other restore hook time perhaps in our code that might be causing this even though we don't use afterRestore()?Also, note that when this happens, there are no lambda cloudwatch log entries with that message in them. I see the from the result of the caller (in this case, a step function)I do see several high restore duration values during the timeframe where the error happened (that I can't explain), but those cases succeeded:FollowComment"

Answer: "0Hello,I understand that you are using SnapStart enabled Lambda function, where you are seeing following error intermittently:Runtime restore hook execution timed out after 2 seconds (Service: Lambda, Status Code: 408Please check to confirm whether you have implemented runtime hook, in your application. If yes, then the issue could be that the interface method afterRestore() times out."Resource – An interface with two methods, beforeCheckpoint() and afterRestore(). Use these methods to implement the code that you want to run before a snapshot and after a restore."Also, when SnapStart is activated, your initialization code can run for up to 15 minutes. Checkpoint hooks beforeCheckpoint()) count towards the 15 minutes. Restore hooks (afterRestore()) time out after 2 seconds.If this does not address your issue, we require details that are non-public information for further troubleshooting. Please open a support case, with AWS using this link, and make sure to include details on Lambda function ARN, Request IDs and Timestamp.CommentShareSUPPORT ENGINEERIsha_Kanswered 5 months agorePost-User-9707494 5 months agoThanks for the follow-up.Please check to confirm whether you have implemented runtime hook, in your application.We for sure didn't have afterRestore() in our code. That would have required the crac library dependency which we don't have included in our jar.At this point, we have opted not to use SnapStart for the time being.Share0hello, the 2 second timeout limit applies to loading the runtime (JVM) and the afterRestore() hooks. Please find the updated documentation here. Can you please let us know if there's a support ticket submitted that we can investigate to understand why your restore is timing out?CommentShareTarunanswered 5 months agorePost-User-8579281 4 months agoI have encountered this too today.  Is there a CTI I can submit a ticket too?Share0Can you please let us know if there's a support ticket submitted that we can investigate to understand why your restore is timing out?We have not created a ticket since our team decided not to spend more time on SnapStart for now.Note that the only thing I can think of that might be relevant about the errored invocation was that there were about 500 concurrent invocations of the same lambda at the time of the error. We were not using afterRestore() for this lambda.CommentSharerePost-User-9707494answered 5 months ago"


Question: Kendra Indexing not completing

"I am trying to index a 60kb .txt file into Kendra, from an S3 bucket.I have previously done with several PDFs and it works fine and completes fast. However when I use this txt file it just staying indexing and never completes. Can't seem to find anyone with the same problemFollowComment"

Answer: "0Hi - Have referred to some troubleshooting steps here https://docs.aws.amazon.com/kendra/latest/dg/troubleshooting-data-sources.html and https://docs.aws.amazon.com/kendra/latest/dg/cloudwatch-logs.htmlCommentShareEXPERTAWS-User-Nitinanswered 2 months ago0Hi, Kendra oncall checking in -With limited context we couldn't determine what is happening.In case the issue is still there, please open a ticket with AWS Support and provide necessary information in the ticket, e.g. account id, data source id, index id, etc so that we can carry out investigation.Thanks!CommentShareAWS-User-4373434answered 2 months ago"


Question: Publish to IoT Endpoint of other Account - IoTData SDK NodeJS Lambda

"Hello,I have two Accounts running with IoT-Endpoints enabled. My devices connect to the IoT Endpoint on Account A. In Account A I also have a Lambda function running, that is receiving the messages through an IoT Rule. The Lambda determines, if the message has to be forwarded to Account B or not. Since I have other services depending on IoT messages in Account B as well, I just want to republish the MQTT message to the IoT-Endpoint of Account B.Lambda is configured with NodeJS 12.x.Let's leave the IAM stuff aside. I have some roles/policies set up for that already, but I do not even get that far to test them.I use the following snippet in Lambda of Account A to send the message to the IoT-Endpoint of Account B.  let iotData = new AWS.IotData({    endpoint: '<endpointOfAccountB>-ats.iot.eu-west-1.amazonaws.com'  });    let topic_params = {    topic: "my/topic/on/other/account",    payload: JSON.stringify(payload),    qos: 1  };   iotData.publish(topic_params).promise();It seems like the endpoint attribute is just ignored, because the message gets published on Account A instead. I also tried without -ats (result of CLI: aws iot describe-endpoint ):<endpointOfAccountB>.iot.eu-west-1.amazonaws.com -> same resultWhen I print iotDev.endpoint the correct endpoint is configured.Is there a way to publish an MQTT message from Account A to Account B with the IoTData sdk?Am I missing something?Feel free to ask for more details if necessary.Best Regards,JulianFollowComment"

Answer: "1Accepted AnswerEncountered this same problem today as well. What I did to over come this was assume a Role in Account B, set the credentials in the AWS.config.credentials with the temp creds, then create the IotData object with the IoT endpoint before you publish the message.   let credentials = await STS.assumeRole({      RoleArn: 'arn:aws:iam::123456789:role/iotRole',      RoleSessionName: 'testRoleSessionName'    }).promise();   const remoteCredentials = new AWS.Credentials(      credentials.Credentials.AccessKeyId,       credentials.Credentials.SecretAccessKey,       credentials.Credentials.SessionToken);      const iotData = new AWS.IotData({      endpoint: 'a3m99gntexample-ats.iot.us-east-1.amazonaws.com', // IoTEndpoint of Account B      credentials: remoteCredentials    });    const data = await iotData.publish({      topic: `topicfilter/data/clientIdHere`,      payload: JSON.stringify({event: 'whatever'}),      qos: 1    }).promise();Be sure to give the lambda's execution role in Account A the permission to STS:AssumeRole and setup the "iotRole" in Account B to trust Account A.Edited by: jofamaws on May 5, 2020 12:39 PMCommentSharejofamawsanswered 3 years ago0Thank you very much!Worked as described.CommentSharejulianDevanswered 3 years ago"


Question: What are the recommended data integration tools for NetSuite ERP?

"A customer is interested in doing analytics using the data stored in multiple platforms like NetSuite ERP and Magenta (RDS MariaDB db backend) in AWS. They are looking to integrate the data (about 8 millions of rows but not sure of the data size) to Redshift and/or S3 so they can get started on using analytics services in AWS.[Question]Are they any recommended data integration tools for NetSuite ERP?  They have used Celigo in the past but they said they don't recommend the tool for anybody. I have heard about Matillion, Dell Boomi, or other solutions using AWS Glue but I would like to know if I there is any specific tools we usually recommend to the customer. If you can share pros/cons of each of those tools, that will be very helpful as well.I appreciate your insights!FollowComment"

Answer: "0Accepted AnswerDell Boomi (https://boomi.com/)ProsConsidered by many to be one of the most robust and complete solutionsBoomi provides ample documentation, training, and support; allowing users to work through tough problemsBoomi delivers top-notch security, allowing you to rest assured that your information is protected and proactively guarded against new threatsUser-friendly drag-and-drop interface for new usersConsSome technical skills required – analysts can build and troubleshoot but must have some training firstCost can be prohibitive – Reviewers rated Boomi in the 96th percentile when it comes to costsDevelopment is all graphic based. This can be a hang up to people with development knowledgeA lack of communityDebugging is not as easy as other platformsJitterbit (https://www.jitterbit.com/)ProsExcellent Customer ServiceMost value of any IPaaS (Jitterbit is priced at 36th percentile in the IPaaS market)Intuitive for developers to quickly and easily pick upSimple enough for non-tech analysts to learn with some trainingFlexible – allowing developers to add custom logicPerfect for SalesForce/NetSuite integrationsConsDocumentation and training materials can be improvedNot as easy to create logic in Jitterbit as a full ETL tool such as InformixVersion issues can occur whenCommentShareAWS-User-2512070answered 3 years ago"


Question: Using an Encoder Appliance with Kinesis Video Streams

A customer wishes to use an encoder appliance with Kinesis Video Streams.It appears to support RTSP and therefore should work (https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/system-requirements.html).Is there anything else  we should be looking for?Thanks.FollowComment

Answer: "0Accepted AnswerRTSP is supported by the Video Producer SDK, not the Kinesis Video Streams API. This means that, while the appliance (or any appliance/camera that produces an RTSP output) can work with the SDK, there needs to be something running an application that uses the Producer SDK to convert the RTSP stream into the format for the KVS streams. The SDK could run locally to the appliance (either on another machine, or perhaps some appliances may allow you to run your own software on them) or could be on AWS EC2/Fargate/etc.CommentShareEXPERTLeeAtk@AWSanswered 3 years ago"


Question: Best Practice to use Security group + NACL

"Team,I have a customer who has reached a limit in NACL (20 in + 20 out), customer can ask AWS support to increase the limit, but that will also have inverse impact on performance. Customer will have many other application coming in and will need more NACL + SG in place. Do we have any best practice to implement SG + NACL or any existing implementation in other customer places which can be referenced?FollowComment"

Answer: 0Accepted AnswerThis article here explains a workaround this limithttps://www.algosec.com/blog/combining-security-groups-nacls-work-around-aws-capacity-limitations/CommentShareMina Gobrialanswered 3 years ago


Question: Realtime Gamelift Script Server Questions

"For a gamelift realtime script, how do I set remote breakpoints for debugging the script?How do I develop on a local instance for a gamelift realtime script? (Not a custom gameserver build, a realtime script)I need to find a better workflow for debugging. Currently I have to upload a script to debug but I run into limitations with that.FollowComment"

Answer: "0Accepted AnswerA bit late, but the attached may help. monitor.txt|attachment (2.8 KB)Basically it "tails" all the logs (there are lots, especially if your app keeps crashing) so you get the log output in real time.Instructions (setup):Rename file  as ".js" (I had to put as .txt to upload here)Put into the server app path so it gets uploaded to the "etag" directory one each deploy.Add  https://www.npmjs.com/package/tail into package.jsonInstructions (to run):SSH in to the instance to monitor.You need to run as root (sudo).cd to any "etag" (in /local/game - can be any of the etags, does not need to be the "latest" if you are doing multiple deploys)Run: /local/NodeJS/bin/node ./monitor.jsNotes:Currently monitors last 10 files; each "server" (i.e. how many times your run your .js as set in console/CFN) creates a log file, so if you have more than 5 servers (on the single instance) then you might want to increase this. Of course there is performance hit, but for debugging you should be fine. [Monitor twice the files so you get the crash logs of the old ones)Keep your etags clean with ls -td /local/game/etag-* | tail -n +3 | head -n -1 | sudo xargs rm -rf --Keep your logs clean with cd /local/game/logs/ ls -t | tail -n +20 | sudo xargs rm -rf --CommentSharerePost-User-7028274answered 2 years ago0Right now I believe there is no method to locally run the script. Having written a few realtime scripts I share your pain on this.I'll reach out to the GameLift service team as things may have changed since I worked with Realtime scripts.For remote debugging, you can open any port on the fleet but that may not be enough for what is required as you can't launch the script with -inspect AFAIK.CommentSharerePost-User-5332620answered 2 years ago0Thanks for letting me know your thoughts. This is definitely a major pain point of mine right now. The problems I keep running into with realtime script debugging:-Not verbose enough logs and no control over that(i.e. -inspect, etc.)-I have to spend time finding the correct log by ssh if downloading it directly is not possible for some reason through the AWS console-I have to spend time uploading, which I've made a script to help automate but still takes time to runSo basically the feedback loop is very long if I want to test and verify simple things. I end up debugging blind in some situations and it becomes a huge time sink.You have any ideas/thoughts on how to locate the right log faster for situations where downloading the log via AWS console is not possible @REDACTEDUSERCommentSharerePost-User-3973093answered 2 years ago0You can remote into the instance and tail the logs live on the box. Thats the faster path to debugging that I know of.For a windows fleet theres good information here: https://forums.awsgametech.com/t/windows-remote-access-wont-connect-to-gamelift-fleet-******If you need help for Linux fleets, let me know.CommentSharerePost-User-5332620answered 2 years ago0[quote="Robbie, post:5, topic:9955"]y monitors last 10 files; each “server” (i.e. how many times your run your .js as set in console/CFN) creates a log file, so if you have more than 5 servers (on the single instance) then you might want to increase this. Of course there is performance hit, but for debugging you should be fine. [Monitor twice the files so y[/quote]@REDACTEDUSERCommentSharerePost-User-3973093answered 2 years ago0I was on vacation last week, and restrained myself from trying your script. So I finally tried it today, and wow. This is exactly what I needed. Thank you. This will help me out so much. Can't thank you enough @REDACTEDUSERCommentSharerePost-User-3973093answered 2 years ago0Thanks for the feedback.CommentSharerePost-User-7028274answered 2 years ago"


Question: AWS API Gateway Integration Response - calculate hmac hash

"I am using webhook endpoint to push messages to SQS servicepipeline looks:gateway -> integration request -> SQS -> integration response everything works fine but now third party integration requires time-to-time validation request, and i need to return calculated hmac sha256 hash  in responseNot sure if response template support all utils, but I am trying next Integration response template:#set($token = $context.responseOverride.header.RequestBody)#if(!$token || $token == '')    {"status": "ok"}#else    #set($secretKey = "my-secret-key")    #set($hmac = $util.cryptoHmac("HmacSHA256", "$token", $secretKey))    {        "token": "$message",        "hmac": "$util.base64Encode($hmac)"    }#endbut looks like $util.cryptoHmac("HmacSHA256", "$token", $secretKey) not working, method returns nullmaybe somebody could help me to resolve this caseFollowComment"

Answer: "0Hi,The Amazon API Gateway $util variable just supports the following functions:escapeJavaScriptparseJsonurlEncodeurlDecodebase64Encodebase64DecodeWhen a non-existent function is referenced, no error is shown in the logs and the request continues as normal.CommentShareMikel Del Tioanswered a month ago"


Question: "WordPress Filesystem permissions fail to be writable, even changed wp-content folder to 755 or 777"

"Hi guys,I am facing this problem for days. I build website based on Wordpress, by using EC2 - Ubuntu - Apache2.I reserched many motheds of changing filesystem permissions:I used SFTP to change "wp-content" permissions to 755 / 777. But I could not still install or upload any files. And, I also used SSH to change permissions as well by comman chmod.And, I could not install plugins for troubleshooting for the same reason.Could you guys help me for that? Much appriciated!CheersShiyuFollowComment"

Answer: "0Are all directory files under "wp-content" set to 755?CommentShareEXPERTRiku_Kobayashianswered a month agoShiyu a month agoHi Riku, thanks so much at first.I just set "wp-content" this whole folder to 755. All files inside, I didn't do anything for that.Did you mean, I should also set all of them individually to 755?CheersShiyuShareRiku_Kobayashi EXPERTa month agoIf you change the permissions on the "wp-content" folder, you can still create files.However, individual files should not be able to be deleted or edited without editing the permissions on the individual files.ShareShiyu a month agoThanks so much. While, the problem I am facing is that I could not create any files or folders via WordPress dashboard when I wanted to downlaod any theme or upload img to there. Even my "wp-content" is 755 for now.Share0Is SELinux enabled (what is the output of sestatus) ?CommentShareRWCanswered a month ago"


Question: Oracle materialized view replication to postgres using DMS CDC

I am migrating data from Oracle materialized view to PostgreSQL using DMS CDC. Initial load completed successfully.  I do not see the changes are replicating. Is any one has performed this type of migration? If Yes please share the details/document.FollowComment

Answer: "1Dear Customer - Thanks for reaching out to us via AWS re:Post.To begin with, I would like to inform you that AWS DMS supports only the migration (fullLoad) of materialized views to the target, the materialized views are migrated and created as "base tables" in the DMS target instance.However, if you like to replicate the REFRESH of materialized views on source to target then it causes issues during CDC, as DMS currently does not support the on-going replication of materialized views.As a way forward, you can use the base tables of the materialized views for on-going replication of changes to the target Oracle instance. Then if you need to use the materialized views on the Oracle target, you can recreate them using the migrated base tables.Also, kindly note that AWS DMS doesn't support the ROWID data type or materialized views based on a ROWID column.[+] https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.Oracle.html#CHAP_Source.Oracle.LimitationsI hope that I was able to address your concernsCommentShareEXPERTNIRUPAM_danswered 10 months ago0instead of migrating materialized view from oracle to postgres target I would suggest create dms task only for underlying tables.on target postgresql you can create materialized view so that it would have required data coming from underlying tables to populate.https://www.postgresql.org/docs/current/rules-materializedviews.htmlIf you migrate using DMS it will convert materialized view to table in postgresql and also it wont support migrating changes for this view.CommentShareAWS-User-8174525-subhashanswered 10 months ago"


Question: "On a windows server ec2 instance launched from an ami, steamvr runs into critical error when started after autologon."

"When I launch a new instance from an AMI (this AMI opens steamVR after logon), steamVR runs into an error. From what I have been reading it is because when an instance is launched based on an AMI, the EBS volume attached to the ec2 instance needs to get all the data from the snapshot that the AMI is based off of. i/o operations are slow for the first read and therefore when SteamVR is launched on login, it runs into a critical error. more details are here:https://forums.developer.nvidia.com/t/failed-watchdog-timeout-in-thread-server-main-in-cloudxrremotehmd-after-10-440015-seconds-aborting/180742/10In this post, the final reply is the following:"We did figure out a workaround last week. It turns out this issue is related specifically to AWS machines with EBS. When you start an EBS-backed machine in AWS, the EBS volume needs to be hydrated from the snapshot that it is based on. The snapshot data is backed by S3, and therefore is very slow for the first read of data from the volume. We are now using a little PowerShell script to basically cat {files} > /dev/null for all the files in the CloudXR and SteamVR directories before we start SteamVR. This hydrates those files into the volume so that they are fast, and we haven’t had issues crashing since then. More information on this is here: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ebs-initialize.html#ebs-initialize-windows. Hope this helps."How do I initialize the ebs volume for only the files in the steamvr and cloudxr directories? If I did use fio/dd to initialize the entire volume (200gb), how long would that take?Any help would be greatly appreciated!FollowComment"


Question: Error P52 - Audio Driver Signature

"I installed NICE DCV Server on a Windows 2019 Standard Server (on a Vmware VM) and i get a Error52 for the audio drivers. In the device manager i can see this error but reinstall the drivers does not help. Even rebooting did not help ;)I can disable the security feature during the boot but it is not persistant. After a reboot, the error occurs again. Any ideas?FollowComment"

Answer: "0Solution was easy. As default, Vmware installes VMs with UEFI boot mode. I needet to reinstall the VM with old BIOS boot. With that trick, it works.CommentSharepatrickkoehleranswered 2 years ago"


Question: IfElse Calculated Field not Working

"I am having difficulty with a QuickSight calculated field and am wondering if anyone can help me.  This is the simple field I am trying to create:ifelse({Measure}>0,{Measure},"NA")The error messaging is unhelpful and just says "The calculated field expression ifelse({Measure}>0,{Measure},"NA") is incorrect. Correct the syntax and choose Create again."The only thing I can think of is perhaps the ifelse() function doesn't allow you to return a string, but I did not think that was the case per the docs.Can anyone help me understand why this calculated field isn't working?  Thanks!FollowComment"

Answer: "0The Field you are trying to create is meant to be a numeric field but in the else branch you use a string.To make your calculated field work , you need either to set a numeric value in the else or cast the measure to a string.ifelse({Forecasted Monthly Revenue}>0,toString({Forecasted Monthly Revenue}),"NA")But I do not really think you want that.Can you try to explain what you would like to achieve?How would you show the field in a visual?are you not interested in aggregating the value by dimensions?Hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year agoThe-Cardless-Moose a year agoThe measure I am trying to create is an estimate for projecting business performance for a future time period.  Occasionally the estimate will be 0 or yield a div/0 error and in that case, I was hoping to simply have the KPI visual show "NA".Upon reading the docs more closely, I see that the then-expression and else-expression must have the same data type...but still I was hoping for some way to handle this situation where I show "NA" if the estimate is <0Share"


Question: "BEST_FIT_PROGRESSIVE works weird, maxiumum vcpus = 4, gave me 96"

"BEST_FIT_PROGRESSIVE works weird, maxiumum vcpus = 4, gave me 96.Essentially asked for for 4cpus, m5.xlarge, gave me m5.xlarge24.The auto scaling group tried to spin up 4 instances for 1 job, assuming the other 3 instances were also m5.xlarge24sFollowComment"

Answer: "0Can you be a little more detailed about what happened here?One thing with the new allocation strategies: ASG for these strategies is attempting to spin up capacity in terms of vCPUs, not instances. So if you're looking at the "desired" field, that number is a total vCPU, not a desired instance count. This will be made more explicit in later updates.CommentShareAWS-User-3176245answered 4 years ago0I made a new compute environment with best_fit_progressive strategy with maximum vCPUs set to 4.When i submit a job to that compute environment, it ignored the maximum vCPUs number and gave me an instance with 96 vCPUs. I have since deleted that compute environment, and made a new one with allocation_strategy set to best_fit and it honoured the the maximum vCPUs setting. It also tried to spin up 4 separate instances for one job, I had different jobs on different queues connected to different compute environments, i'm assuming the scheduler picked up jobs for that queue it wasnt supposed to.Edited by: looloo on Nov 4, 2019 11:21 PMCommentShareloolooanswered 4 years ago0from the docs: With both BEST_FIT_PROGRESSIVE and SPOT_CAPACITY_OPTIMIZED strategies, AWS Batch may need to go above maxvCpus to meet your capacity requirements. In this event, AWS Batch will never go above maxvCpus by more than a single instance.In this case, i would take out the largest vCPU instance from your allowed instance parametersCommentShareAWS-User-3176245answered 4 years ago"


Question: Which AWS Account or Organization Unit should be Account Management delegated admin

"Hello.I would like to ask for best practise regarding Account management delegated admin (Account that will be able to create AWS account and move the in different OU's instead of main AWS account). Which account or account in which organization unit should be this delegated admin?I was not able to find this information in the Enabling a delegated admin account for AWS Account Management documentation.Nor in the Best Practices for Organizational Units with AWS Organizations or Dedicated accounts structure.I have found, that SSO delegated administrator should be the security account here. But that is different use case.Thank you for your help,TomasFollowCommentNataliya_G EXPERTa year agoThis announcement you mentioned is only relevant for AWS SSO service (that SSO management can be delegated to another account in the Org, and it doesn't have to be existing Management Payer account anymore, as it used to be in the past).Share"

Answer: "1Only the management account has access to create AWS accounts in the AWS organization, invite other existing accounts to the AWS organization, remove accounts from the AWS organization and move accounts to different OUs. Hence, this role could not be delegated to another member account. Hence, you should follow the security best practices for your Org Management account. Please refer here for more details.Please refer here for the list of services that supports delegated admin.Thank youCommentShareSUPPORT ENGINEERAWS-User-4405679answered a year ago"


Question: Target groups: unavailable instance did not switch to unhealthy

"We had an instance that despite being unreachable did not switch from healthy to unhealthy.In the instance there is a tomcat and nginx web application as a reverse proxy.In the tomcat and nginx logs we did not find any calls from the healthcheck service during the down period,but calls resumed smoothly as soon as the instance resumed working smoothlyWould anyone be able to explain why the instance has not become unhealthy?FollowComment"

Answer: "0Hi Andrea,I understand that you would like to know why the instance became unresponsive without it switching to an unhealthy status.Please correct me if I misunderstood.It could be a Load Balancer health check fetch issue, Please note that longer intervals may mean that the Load Balancer will take longer to fetch health checks. Issues can occur and resolve in between, before the next health check and target still be showing as healthy. I would recommend that you check your configurations to understand your issue.For further assistance on the issue please consider contact AWS customer support[2].You can refer to the following document on troubleshooting issues:[1]https://aws.amazon.com/premiumsupport/knowledge-center/elb-fix-failing-health-checks-alb/[2]https://aws.amazon.com/contact-us/I hope you find this information useful.CommentShareWinnieanswered a year ago"


Question: OTA update for raspberry pi4

"I am working on raspberrypi4 and Greengrass V2 does not support greengrass-cli (aws -cli) file for the 32-bit processor, so I can not download files for version 2. can anyone suggest what should I do about it? Should I switch on another service or anything else?Thank you in advanceFollowComment"

Answer: "0Hey @nik,I believe you are talking about the aws-cli and not about the greengrass cli those are 2 separate things. The aws-cli v1 is not supported on 32-bit processors but the v2 is. I suspect you are trying to install v1 instead of v2. See https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.htmlCommentShareochoanelanswered 3 months ago"


Question: Created_tmp_files value always showing huge- MySQL RDS performance issue

"Dear All,I have been seeing below values for MySQL RDS instance of type ( db.r5.8xlarge - Managed MySQL RDS version 8.0.23), and sometime applicaton also reporting slow performance. Would liek to know what params I have to look into to find out real bottleneck wtih DB.8.0.23Created_tmp_disk_tables0Created_tmp_files4390282772 <=== Is this value really matter of concern?Created_tmp_tables15Best regards,RaviFollowComment"

Answer: "0HiI was researching this online and I found this blog post might be related to your case: https://forums.percona.com/t/created-tmp-files-what-is-the-cause/1231Looks like the increase in the Created_tmp_files resides in the memory and could be caused due to unindexed group by/order by.From MySQL DOC: https://dev.mysql.com/doc/refman/5.7/en/server-status-variables.html#statvar_Created_tmp_filesCreated_tmp_files: How many temporary files mysqld has created.Most likely related to some queries. Might need your DBAs to take a deeper look.--> Regarding to the performance, general troubleshooting need to make sure:Instance having enough resources (CPU, Memory, Throughput, these can be reviewed in CloudWatch, Performance Insight)If certain query having performance issue, then need to investigate the query plan, and tune the query.If you suspect something from AWS end causing the performance issue, you may open a support case with us for us to look into storage and host.CommentShareSUPPORT ENGINEERKevin_Zanswered a year ago"


Question: Instance failing to terminate

"Hi,As of 14:21 (UTC+1) on 25th Oct 2021, we attempted to terminate the below instance and it got stuck in the 'Shutting-down' state.Instance: i-08eec48d3ebae9b73Region: eu-west-1Can we please get it terminated.Cheers,EdFollowComment"

Answer: "0It took some time, but the instance appears to be terminated now.CommentShareedfatsomaanswered 2 years ago0It took some time, but the instance appears to be terminated now.CommentShareedfatsomaanswered 2 years ago"


Question: How to build saas product for blockchain based use case

"If my design involves solution for users that includes payment gateway, user register/login, blockchain wallet,FollowCommentiwasa EXPERT10 months agoHi, Your question is too big, so narrowing it down to what you want to know more specifically will make it easier to get an answer.Share"


Question: Cert stuck "pending validation" in eu-central-1 but works in other regions

"I have a certificate in eu-central-1 that is stuck in a "Pending validation" state. The cert is being requested via a CloudFormation stack that I successfully deployed to 2 other regions a few hours ago without problems. The Route53 zone is setup in the same account as the Certificate and the required CNAME entry has existed for at least 6 months and was already successfully used earlier today in the 2 other regions. The dig command run locally and from various servers in different regions also shows the correct CNAME entry.I canceled my CloudFormation stack deployment (which deleted the Certificate) and attempted to re-deploy it, but the new Certificate is still stuck in "Pending validation".Usually, the certificates validate almost instantly. The documentation says that after clicking the "Create record in Route 53" button it can take "up to 30 minutes" for validation to complete. Right now, it has been 90 minutes since I tried redeploying my stack.Is there currently a problem with AWS Certificate Manager validation in eu-central-1? I don't see anything on the AWS Service Health Dashboard.FollowComment"

Answer: "0This is still broken. The CloudFormation stack deployment eventually timed out and deleted everything. I am re-running the deployment but the certificate is still stuck in a "pending validation" state in eu-central-1.I just created the exact same certificate in us-west-2 and eu-west-1 and they both validated immediately.Can anybody from AWS help?CommentShareTim-Eluvioanswered 2 years ago0Hi,This is Nigel from AWS.Could you please share your domain name so that I can take a look at my end?If not present, could you also leave a certificate in the Pending Verification state?RegardsNigelCommentShareAWS-User-2243180answered 2 years ago0Hi Nigel,The certificate was finally successfully issued. It took 4 days and ~6 CloudFormation stack deployment attempts (since they kept timing out after 12 hours). No changes were made to DNS validation entries on my side and other certificates were issued without problems in multiple regions (including eu-central-1 for other hostnames).I just tried manually creating a certificate for the same hostname one that was having issues and it worked fine. So it would seem that whatever problem eu-central-1 was having with this specific domain name has resolved itself.Thanks for responding.CommentShareTim-Eluvioanswered 2 years ago"


Question: Glacier Vault Lock and Policy Changes?

"If a customer establishes a Glacier Vault Lock policy, and then the requirements change (as an example, legal requirements for data retention periods are changed), is this a "start over" condition, or can support alter policy settings once in effect?FollowComment"

Answer: 0Accepted AnswerVault Locking is comprised of a two-step process – Initiate (InitiateVaultLock) and Complete (CompleteVaultLock).  Once a policy has been built and initiated you have 24 hours to issue an Abort (AbortVaultLock) which will delete the in-progress policy and provide the opportunity to modify the policy before locking it down.  Once modifications are made it is required to issue the Initiate command again which restarts the 24 hour window in which the policy can be aborted or completed. Once the Complete command is issued the policy for that vault becomes immutable.CommentShareAWS-User-7482477answered 8 years agoEXPERTsdtslmnreviewed 9 days ago