Question: JWT Authentication - 401 authorization error for Opensearch

"I am working on integrating an ALB (Application Load Balancer) as an ingress controller, Cognito as a user pool, and deploying OpenSearch using a Helm chart on AWS EKS (Elastic Kubernetes Service). Unfortunately, I have encountered persistent "401 Authorization" errors despite our efforts to troubleshoot and resolve the issue.To provide some context, I have followed the necessary steps to configure the integration as follows:Deployed the ALB Ingress Controller: I have successfully set up the ALB as an ingress controller to route traffic to our deployed opensearch-dashboardpod on EKS cluster.Configured Cognito User Pool: I have created a Cognito user pool to handle user authentication and authorization.Deployed OpenSearch & OpenSearch-Dashboard using Helm Chart: I used the appropriate Helm chart to deploy OpenSearch and Opensearch-Dashboard on our EKS cluster. During the deployment process, I ensured that the required key has been added to the Helm chart values.yamlconfiguration file.Despite completing these steps, I am consistently receiving a "401 Authorization" error when attempting to access OpenSearch endpoints. I have been unable to identify the root cause of the issue.FollowComment"


Question: AWS SES - VPC Endpoint - does not send emails from private subnet

"I have got the spring boot app running on ec2 instance in a private subnet where no internet connection is established. I want to send emails from this app so I decided to use VPC endpoint connected to AWS SES.Here are the inbound rules of security group of this vpc endpoint.Source column is private ip of my ec2 instanceWhen I invoke the telnet command:telnet email-smtp.eu-central-1.amazonaws.com 587I got the response: Connected to email-smtp.eu-central-1.amazonaws.com.So connection is established I guess. However, when I try to send emails from my application - the exception is thrownamazon.awssdk.core.exception.SdkClientException:  Unable to execute HTTP request: Connect to email.eu-central-1.amazonaws.com:443  [email.eu-central-1.amazonaws.com/<SOME_IP>,  email.eu-central-1.amazonaws.com/<SOME_IP>, email.eu-central-1.amazonaws.com/<SOME_IP>,  email.eu-central-1.amazonaws.com/<SOME_IP>,  email.eu-central-1.amazonaws.com/<SOME_IP>,  email.eu-central-1.amazonaws.com/<SOME_IP>] failed:  Connect timed outthe method I use to send emailsfun sendEmail() {        val url = "url"        val destination = Destination.builder().toAddresses("email@domain.pl").build()        val subject = Content.builder().data("Subject").build()        val sesBody = Body.builder().text(Content.builder().data(data(url)).build()).build()        val msg = Message.builder().subject(subject).body(sesBody).build()        sesClient.sendEmail(            SendEmailRequest.builder()                .destination(destination)                .message(msg)                .source("email2@domain.pl")                .build()        )    }and the sesClient config    @Bean    fun sesClient(): SesClient {        val basicAWSCredentials = AwsBasicCredentials.create(sesAccessKey, sesSecretKey)        val credentialsProvider = StaticCredentialsProvider.create(basicAWSCredentials)        return SesClient            .builder()            .credentialsProvider(credentialsProvider)            .region(Region.EU_CENTRAL_1)            .build()    }FollowComment"

Answer: "0Your test (using telnet) is connecting to the SMTP port on the SES mail server; but your code is trying to call the SES endpoint (which is HTTPS and uses port 443) so those are two different things. The error message you're getting is telling you that too.Also, your test is to email-smtp.eu-central-1.amazonaws.com but the code is connecting to email.eu-central-1.amazonaws.com.Check to see that your instance is able to connect to email.eu-central-1.amazonaws.com on port 443.CommentShareEXPERTBrettski-AWSanswered 3 months agorePost-User-7834180 3 months agoOk, but I have got the port 443 opened. I also tried to override the default endpoint in my java app to the email-smtp.eu-central-1.amazonaws.com, however it didn't help.Share0make sure you have allowed port 25, 465, 587 & 443 depending on what you are using to talk to SES.Also did you test the telnet from your application server?you can check below links for more details.https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-email-set-up-vpc-endpoints.htmlhttps://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-connect.htmlCommentShareSachinanswered 3 months agorePost-User-7834180 3 months agoI have the connection to email-smtp.eu-central-1.amazonaws.com however I do not have connection to email.eu-central-1.amazonaws.com on port 443 even though I opened a 443 port in my smtp endpoint. How to fix this?Share0Okay, I solved the problem. I stopped using aws ses sdk, because it tries to connect through HTTPS, while I need to connect through SMTP on 587 port. So here is my final configurationspring:  mail:    host: email-smtp.eu-central-1.amazonaws.com    username: ${AWS_SES_USERNAME}    password: ${AWS_SES_PASSWORD}    port: 587    protocol: smtp    properties:      mail.smtp.auth: true      mail.smtp.starttls.enable: true      mail.smtp.starttls.required: true      mail.smtp.ssl.trust: email-smtp.eu-central-1.amazonaws.com    test-connection: falseTo generate AWS_SES_USERNAME and AWS_SES_PASSWORD you need to sign in into aws console, go to Amazon SES -> SMTP Settings -> Create my SMTP credentialsCommentSharerePost-User-7834180answered 3 months ago"


Question: What does this mean?

"I'm getting this error when looking at the cloud watch log events during the training of an image classifier:Customer Error: The value 'crop_color_transformation' is not valid for the 'augmentation_type' hyperparameter which accepts one of the following: 'crop', 'crop_color', 'crop_color_transform' (caused by ValidationError)FollowCommentMassimilianoAWS EXPERT8 months agowhat does your training script looks like? The error points out that you are trying to do an hyperparameter optimization on an unsupported parameter.Share"

Answer: "0Hi,According to our doc, the parameter augmentation_type is categorical and only accepts the following three valuescropcrop_colorcrop_color_transformThere is no value called crop_color_transformation. Are you passing this value to augmentation_type when launching the training job ? If so, please try crop_color_transform to achieve the same.CommentShareAWS-User-5210721answered 8 months ago"


Question: Running a Blazor Server app with Amplify via Github

"I tried to get my Blazor Server app running by following this tutorial:https://aws.amazon.com/de/blogs/devops/deploy-net-blazor-webassembly-application-to-aws-amplify/However, it is for Blazor wasm and it does not seem to work for Blazor Server. I do not know why but I just get an 404 after publishing. I have also tried to use 'baseDirectory: /release' instead of 'baseDirectory: /release/wwwroot' but it did not work. Nothing useful appears on the logs, I think. It ends with:2023-05-03T15:36:23.705Z [INFO]: Similino -> /codebuild/output/src852460419/src/similino/bin/Release/net6.0/Similino.dll2023-05-03T15:36:23.864Z [INFO]: Similino -> /codebuild/output/src852460419/src/similino/release/2023-05-03T15:36:23.886Z [INFO]: # Completed phase: build2023-05-03T15:36:23.889Z [INFO]: ## Build completed successfully2023-05-03T15:36:23.889Z [INFO]: # Starting caching...2023-05-03T15:36:23.890Z [INFO]: Nothing to cache2023-05-03T15:36:23.890Z [INFO]: # Caching completed2023-05-03T15:36:23.895Z [INFO]: # No custom headers found.2023-05-03T15:36:23.910Z [WARNING]: !! No index.html detected in deploy folder: /codebuild/output/src852460419/src/similino/release2023-05-03T15:36:23.910Z [INFO]: # Starting build artifact upload process...2023-05-03T15:36:24.711Z [INFO]: # Uploading build artifact '__artifactsHash.zip'...2023-05-03T15:36:24.752Z [INFO]: # Uploading build artifact '__artifacts.zip'...2023-05-03T15:36:24.968Z [INFO]: # Build artifact upload completed2023-05-03T15:36:24.968Z [INFO]: # Starting environment caching...2023-05-03T15:36:24.968Z [INFO]: # Uploading environment cache artifact...2023-05-03T15:36:25.024Z [INFO]: # Uploaded environment cache artifact2023-05-03T15:36:25.024Z [INFO]: # Environment caching completedTerminating logging...FollowComment"


Question: TCP port unavailable on lightsail container

"Hi,I installed node-red with docker and lightsail container.In my node-red app I have a 'tcp in' process that needs to listen on port 4000 but lightsail seems to be blocking the port.I have configured the public termination port to http port 1880 and added tcp port 4000 in the install but it doesn't work.Could you help me please?FollowComment"

Answer: "0Hello,Thank you for using Amazon Lightsail Container Services.I understand that you are trying to expose TCP port 4000 of your node-red container but that port is not accessible via internet.Please note that, the public endpoint of Lightsail container service supports HTTP/HTTPS only, and it does not support TCP or UDP traffic. This means you won't be able to expose port 4000/TCP over the Internet directly.As a work-around, you may set up a proxy container that communicates to the Internet via HTTP/HTTPS and forwards requests along to the TCP container over port 4000.You may refer the following Lightsail article for more details about container public endpoints.[+] https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-container-services#container-services-endpoints-domainsIf you need any further assistance, I encourage you to open a support case, so that one of our support engineers can inspect the details of the Lightsail container, and provide further assistance.CommentShareSUPPORT ENGINEERrePost-User-5227224answered 2 months ago"


Question: EC2 VM showing 1/2 passed failed and SSH not working

"Hi,One of our EC2 is acting weird. It is showing up as running but it says 1/2 check passed and SSH is also not working. Is there any way to find out what is wrong with the instance ?ThanksTejvir SinghFollowCommentYasserAlhawary 10 months agoIt's aws checks on the host and instance so you shouldn't worry about debugging the issue.Try to spin it on another host by doing stop then start it again may solve the issue .Restart will reproduce the same issue because instance doesn't start on different host .Also if it's custom Ami make sure it had no problem like a system configurations prevent the system to boot properly.Share"

Answer: "0Hi There.  I would check the system log first and see if there is anything of interest.To get console outputOpen the Amazon EC2 console at https://console.aws.amazon.com/ec2/In the left navigation pane, choose Instances, and select the instance.Choose Actions, Monitor and troubleshoot, Get system log.Please see https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-status-check-failure/ for a list of troubleshooting stepsDetermine if the instance status check or system status check failed by viewing the instance status check metrics.If the system status check failed, then see My instance failed the system status check. How do I troubleshoot this?If the instance status check failed, then check the instance's system logs to determine the cause of the failure. Depending on the data found in the system logs, use one of the following resolutions:CommentShareEXPERTMatt-Banswered 10 months ago"


Question: How to connect the EC2

"I created instance, how to connect it by using putty?and also guide me if there is another method...FollowComment"

Answer: "0Accepted AnswerHi,For putty specifically, please see this: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/putty.htmlTo connect to Linux hosts in general: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.htmlI recommend you read through this section entirely to better understand the steps and options: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstances.htmlFor example, you can use Session Manager as an option to connect to your EC2 instance.Session Manager is a fully managed AWS Systems Manager capability that lets you manage your Amazon EC2 instances through an interactive one-click browser-based shell or through the AWS CLIHope it helps,JonCommentShareEXPERTJonathan_Danswered 2 months agoDhrupal 2 months agoIts work in window?ShareDhrupal 2 months agoany video?please..ShareJonathan_D EXPERT2 months agoYes, the instructions work on Windows. The instructions should be easy to follow but you can search for a video on Youtube as well: https://www.youtube.com/results?search_query=ec2+ssh+puttyShare"


Question: Lightsail CloudFront distribution returning an “X-Cache:Miss from CloudFront”

"Hi All, I have successfully activated lightsail cdn then attached cPanel_WHM_for_Linux-2  and IP address with CloudFront. My CloudFront CDN is working fine. When I see my website header, it is showing  “X-Cache:Miss from CloudFront”. How to rectify problem my URL is https://www.bismatrimony.com/Note: My website is not wordpress it is php based siteFollowComment"

Answer: "0Hello,If the X-Cache header is "Miss from cloudfront," then the request was retrieved from the origin and wasn't served by the cache. Review the Cache-Control header in the response. If the value for Cache-Control is "no-store," then the header is directing CloudFront to not cache the response.Check the link below which shows the exact error in the header and the solution for the same.Link- https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-x-cachemiss-error/ -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago"


Question: CloudFront for HTTP API Gateway with disabled default endpoint

"I have a CloudFront distribution with WAF to protect an HTTP API Gateway. CloudFront distribution has an Alternate domain name api.mysite.dev which we manage with CloudFlare (CNAME record points to https://{distro}.cloudfront.net). Distributions Origin is an HTTP API Gateway default endpoint. We use a build-in Auth0 authorizer on API so we cannot use a custom lambda authorizer.Now I want to higher the security and disable the default API endpoint.  I created a Custom domain name for the API with an ACM certificate in the same region and disabled the default endpoint. Instead of the default endpoint, I specified the API's custom domain name as an Origin for CloudFront distribution - (apigw.mysite.dev which is pointing to API Gateway domain named-123abc123.execute-api.{my-region}.amazonaws.com).But CloudFront responds with 404 Not Found error when calling the api.mysite.dev as if CF couldn't reach the origin custom domain name. CloudFront logs doesn't bring any valuable info.I've reviewed the documentation and followed carefully the steps in knowledge center.Can anyone provide any tips on to how to fix the issue? Can I use a HTTP API with custom domain managed externally (and ACM certificate) as a origin for CloudFront?FollowComment"


Question: File Restore failing?

"After initiating a restore on several files about a day ago in S3 Glacier Deep Archive, using 'Standard' (Typically 12 hours), and setting them as 'available' for 7 days, none of the files seem to have been restored, as I'm able to successfully re-initiate the restore. I recognize that I can always choose the option, but get an error message if it's already in progress. That's not the case this time, which indicates they were never restored in the first place.The files are large video files (around 100GB each), nested deep within parent folders.Any idea how this occurred, or what I can do to successfully restore the files?FollowComment"


Question: How can I change the clothing ?[1.12]Ask for help again

"I want to achieve dynamic replacement of clothing features, real-time replacement clothes pants hats etc..I noticed there is a component Attachment, but it does not seem to fulfill my needs. What should I do? Please help me@REDACTEDUSERFollow"

Answer: "0Accepted AnswerHey @REDACTEDUSERSharerePost-User-5738838answered 5 years ago0I am very happy to receive your reply，I am currently trying a way to attach three ActorComponents to a single empty entity，Dynamically change the resources of each ActorComponent to achieve switching costumes.However, I have not yet found a very good way to dynamically change resources, and I am not sure whether this will have the extra overhead of multiple entities.I still hope someone can help me give a better planSharerePost-User-4963807answered 5 years ago0I am very happy to receive your reply，I am currently trying a way to attach three ActorComponents to a single empty entity，Dynamically change the resources of each ActorComponent to achieve switching costumes.However, I have not yet found a very good way to dynamically change resources, and I am not sure whether this will have the extra overhead of multiple entities.I still hope someone can help me give a better plan。SharerePost-User-4963807answered 5 years ago0Thank you very much for your reply，I think I found a way to solve this problem，I want to attach some ActorComponent attachments to a main Actor.Then through the dynamic change of each ActorComponent's resources to achieve the replacement.But I haven't succeeded because I haven't found a way to dynamically change ActorComponent resources, and I'm not sure that there will be additional performance overhead. Still hope someone can help me give me a better solution。SharerePost-User-4963807answered 5 years ago0Hi @REDACTEDUSERSharerePost-User-0479726answered 5 years ago0@REDACTEDUSERSharerePost-User-4963807answered 5 years ago0Hi @REDACTEDUSERThank you for your reply，As @REDACTEDUSERAnd I would like to know when this feature will be released because I did not find detailed post-development documentation or instructions.thanks again to people who care about this issueSharerePost-User-4963807answered 5 years ago0Hi @REDACTEDUSERWe don't have a timeline for release of this feature, but we are aware of this issue, and we know that other customers would like a solution as well.SharerePost-User-0479726answered 5 years ago0Hey @REDACTEDUSERI've pinged the team to response to your notes, ASAP!SharerePost-User-5738838answered 5 years ago0Thank you for you repleySharerePost-User-4963807answered 5 years ago0Hi @REDACTEDUSERSharerePost-User-4963807answered 5 years ago0Hi Lumberyard team, any update on the status of a modular character mesh component/attachment system?SharerePost-User-2743711answered 4 years ago"


Question: Rekognition video stream - ability to check eye status

"I am trying to use this sample to recognize eye status of an operatorI managed to connect my camera as source of a kinesis video stream then send data to rekognitonI used the person recognition sample to make sure i have the right person and it works I can see the name in the json formatnow I am trying to check eye status (open or close) but command is not working - the most important part is eye status  1) what is wrong in below to just get eye status without even caring who is the person2) can I recognize the person and also see the eye status  ? (see the commented out # section for example)my code:aws rekognition create-stream-processor --input "KinesisVideoStream={Arn=$VIDEO_ARN}" --name kvs-operator-processor #--settings "FaceSearch={CollectionId=$COLLECTION_ID,FaceMatchThreshold=50.0}" --setting "--settings "{"GeneralLabels":{"LabelInclusionFilters":["person"]}}----attributes "ALL"--role-arn $ROLE_ARN --stream-processor-output "KinesisDataStream={Arn=$DATA_ARN}"FollowComment"

Answer: "0Hi Chris,You can't include attributes in this constructaws rekognition create-stream-processor --input "KinesisVideoStream={Arn=$VIDEO_ARN}" --name kvs-workshop-processor --settings "FaceSearch={CollectionId=$COLLECTION_ID,FaceMatchThreshold=50.0}" [ --attributes "ALL" ]--role-arn $ROLE_ARN --stream-processor-output "KinesisDataStream={Arn=$DATA_ARN}"I removed attribute and your construct works but wont provide eye  status - do you need to find the person in your collection first then check the eyelids ?CommentShareAndy Shahbazianswered 3 months ago"


Question: I want to send logs to CloudWatch Log in Swift.

"The IAM permissions, API AccessKey, and SecretKey are all properly set up.The result of putLogEvents is success and nextSequenceToken is also received correctly.However, when checking the console, the logs are not visible even after more than 30 minutes have passed.The following is a code example, and I would like feedback on whether there are any errors.       let credentialsProvider = AWSStaticCredentialsProvider(            accessKey: "ACCESS_KEY",            secretKey: "SECRET_KEY"        )        guard let configuration = AWSServiceConfiguration(            region: .USEast2,            credentialsProvider: credentialsProvider        ) else { return }        AWSLogs.register(with: configuration, forKey: "default")        let defaultLogs = AWSLogs(forKey: "default")        let logGroupName = "MYGROUP"        let logStreamName = "MYSTREAM"        let logger = AWSDDLog.sharedInstance        logger.logLevel = .info        let logEvent = AWSLogsInputLogEvent()        logEvent?.message = "[MYDEBUG] TestTestTestTest"        logEvent?.timestamp = NSNumber(value: Int(Date.now.timeIntervalSince1970))        let logEvents = [logEvent!]        Task {            do {                let groupRequest = AWSLogsDescribeLogGroupsRequest()                let groupResponse = try await defaultLogs.describeLogGroups(groupRequest!)                let group = groupResponse.logGroups?[1].logGroupName                print("MYDEBUG: Group \(group)")                let streamRequest = AWSLogsDescribeLogStreamsRequest()                streamRequest?.logGroupName = group                let streamResponse = try await defaultLogs.describeLogStreams(streamRequest!)                print("MYDEBUG: Stream \(streamResponse.logStreams?.first?.logStreamName)")                let putLogEventsRequest = AWSLogsPutLogEventsRequest()                putLogEventsRequest?.logGroupName = group                putLogEventsRequest?.logStreamName = streamResponse.logStreams?.first?.logStreamName                putLogEventsRequest?.logEvents = logEvents                _ = try await defaultLogs.putLogEvents(putLogEventsRequest!)            } catch {                print("[MYDEBUG] \(error)")            }        }Thank youFollowComment"

Answer: "2Accepted AnswerMaybe the regions you are checking are different?The code appears to use USEast2.CommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-7871279 a month agoRegion checked (actually AP Northeast2 in my code).It is said that the log transmission was also successful.After "putLogEvents", "nextSequenceToken" was successfully transmitted in responseSharerePost-User-7871279 a month agoIt's a self-answer.TimeStamp is invalid. It works well if you convert it to TimeStamp instead of TimeInterval.Share"


Question: Route 53  - configuring Private Zone association and  Route53 resolver to resolve private zones accross multiple accounts

"Hello,I am trying to build a simple network to interconnect three accounts DEV, PROD, and Shared. The shared account has the VPN endpoint and from there I want to connect to all other accounts. The problem is the DNS resolution of Private Zones.I have followed the manual on https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-private-associate-vpcs-different-accounts.html.1.  aws route53 create-vpc-association-authorization --hosted-zone-id  {} --vpc {} ...2. aws route53 associate-vpc-with-hosted-zone  --hosted-zone-id  {} --vpc {} ..but still, I do not see the Private Zone from other accounts in the Shared account.I can see that the association was successful only when I try to add one of the associated domain names to the shared account when I get:(ConflictingDomainExists 400: The VPC ...  in the region ...  has already been associated with the hosted zone ...  with the same domain name.) I have also tried to prepare Route53 resolver - inbound on one account and rule and outbound on the shared account, but still not able to resolve private DNS names from other accounts.  I get the response from the inbound IP addresses on the DNS records when I specifically add it into the dig command as a DNS server.  The outbound addresses on the SHARED account subnets are reachable under any TCP/UDP port.The accounts are interconnected through Transit Gateway.Could you please advise what am I doing wrong?Thank you!FollowComment"

Answer: "0Hi, you can use this CLI command to see PHZs that have been shared with a VPC in your account from another account:aws route53 list-hosted-zones-by-vpc --vpc-id vpc-xxxxxxxx --vpc-region xxxxxxWhat are you using the PHZ for?  Note that a PHZ is an override of resolution for the specified domain; it and its subdomains will be resolved as per records in the PHZ instead of via the usual DNS servers.  So an EC2 instance in your DEV VPC for example should see that domain resolved as defined in the PHZ.Resolver Endpoints are a bit different in that you're delegating a domain to be resolved somewhere rather than overriding its resolution with specific records.  The two are for different use cases; I saw you mention VPN so you might want Resolver Endpoints for hybrid DNS resolution across on-prem and AWS.If you happen to be using PHZs for sharing VPC Endpoints, this article might help - https://www.linkedin.com/pulse/how-share-interface-vpc-endpoints-across-aws-accounts-steve-kinsman/ .CommentShareEXPERTskinsmananswered a year ago"


Question: Route Http to HTTPS in Elastic Beanstalk for external DNS provider

"Hi,I'd like to use HTTPS with a subdomain to access the deployed application on Beanstalk, As an organization, we have a domain (dektech.com.au) from an external DNS provider, we simply want to use https://metadesk.dektech.com.au instead of the BeanstalkURL  **https://metadek-desk-booking-env.eba-ybmik2yt.eu-north-1.elasticbeanstalk.com/ **I've done the following steps:Create a certificate and validate the domain for both dektech.com.au and *.dektech.com.auAdd a listener (port 443 , HTTPS , attach SSL certificate )  In the Load Balancer of the Beanstalk environment.Add a process (port 443 , HTTPS, https code 200)  In the Load Balancer of the Beanstalk environment.Edit HTTP:80 listener in EC2 > Load Balancer and remove the default and set Redirect to HTTPS:443.Create a hosted zone for dektech.com.au then create a new recordRecord name:metadesk.dektech.com.au , Route traffic to: Alias to Apllication and Classic Load BalancerAfter applying all the above settings, I still can't see access my application by https://metadesk.dektech.com.auMy question:-Do I really need to use Route 53 to route the traffic to the application load balancer since the DNS provider isn't AWS?-If so, What additional configuration might be needed to enable HTTPS properly?Thanks in advance.FollowComment"

Answer: "0Hi,Do I really need to use Route 53 to route the traffic to the application load balancer since the DNS provider isn't AWS?A: No, you do not need to user Route 53, you can use your own DNS service to redirect to the right name.What additional configuration might be needed to enable HTTPS properly?A: You need to include a CNAME entry in your Authoritative DNS configuration from dektech.com.au domain pointing metadesk to metadek-desk-booking-env.eba-ybmik2yt.eu-north-1.elasticbeanstalk.com, if you use Bind it will look like this:metadesk           IN         CNAME          metadek-desk-booking-env.eba-ybmik2yt.eu-north-1.elasticbeanstalk.com.Best Regards,Ricardo MakinoCommentShareRicardo_Manswered 6 months ago"


Question: "Mutation through API fails, but works from web portal"

"Hey! I'm trying to get some help figuring out why a mutation works in the AWS AppSync web portal, but fails when I try to use the API within one of my lambda tests.Schema:type OrganizationLink @model @searchable @auth(rules: [    {allow: groups, groups: ["Admin"]},    {allow: groups, groupsField: "readGroups", queries: [get, list], mutations: null},    {allow: groups, groupsField: "writeGroups" mutations: [update, delete], queries: null}]) {    id: ID!    type: OrganizationType    school: School @connection(name: "SchoolOrganization")    district: District @connection(name: "DistrictOrganization")    organization: Organization @connection(name: "OrganizationConnection")    readGroups: [String]    writeGroups: [String]}Auto-Generated Schema from backend/.../schema.graphql:...createOrganizationLink(input: CreateOrganizationLinkInput!): OrganizationLink...onCreateOrganizationLink: OrganizationLink @aws_subscribe(mutations: ["createOrganizationLink"])...input CreateOrganizationLinkInput {  id: ID  type: OrganizationType  readGroups: [String]  writeGroups: [String]  organizationLinkSchoolId: ID  organizationLinkDistrictId: ID  organizationLinkOrganizationId: ID}Mutation:mutation createLink($organizationID: ID, $schoolID: ID){  createOrganizationLink(input:{  type: SchoolorganizationLinkOrganizationId: $organizationIDorganizationLinkSchoolId: $schoolID  })  {    id  }}API Call method:const resp = await fetch(graphqlApi, {body,credentials: 'include',headers: {accept: '*/*',authorization: AccessToken,'content-type': 'application/json',},method: 'POST',mode: 'cors',});API Request Body:{    "operationName": "createOrganizationLink",    "query": "\n\t\tmutation createLink($organizationID: ID, $schoolID: ID){\n\t\t  createOrganizationLink(input:{\n\t\t  \ttype: School\n\t\t\torganizationLinkOrganizationId: $organizationID\n\t\t\torganizationLinkSchoolId: $schoolID\n\t\t  })  {    id  }\n\t}",    "variables": {        "organizationId": "5432eca5-1018-4bf1-ba60-679557ca1e3c",        "schoolId": "ed1fbead-1906-4cc8-b5b3-64b3e9995501"    }}Response Error:url: 'https://XXXXXXXXXX.appsync-api.us-west-2.amazonaws.com/graphql',     status: 400,     statusText: 'Bad Request',errorType: 'BadRequestException',message: 'No operation matches the provided operation name createOrganizationLink.' } ] }I don't understand how the operation isn't being found, when I am using the exact same operation in the web portal. The operation to create an organization link is clearly in the schema as well. I use this same function to do other mutations prior to this one and they work flawlessly. Any hints would be greatly appreciated...please let me know if any additional information is needed.Edited by: markta on Apr 19, 2019 2:03 PMFollowComment"

Answer: "0Apparently the 'operationName' is looking for what I consider the "nickname" of a mutation, not the actual "name".mutation createAndStuff{createOrganizationLink { ... } { ... }}Operation name is looking for "createAndStuff" not "createOrganizationLink"CommentSharemarktaanswered 4 years ago"


Question: AWS ECS unable to place a task because no container instance met all of its

I'm using .NET Core WEBAPI andThe deployment couldn't finish and I can see this error in the ECS Service Events tabservice cld-dummy-test was unable to place a task because no container instance met all of its requirements. Reason: No Container Instances were found in your cluster.FollowComment

Answer: 0Accepted AnswerAWS ECS has two launch type config :FargateFargate + EC2in both cases you can not access underlying resources.so may possible cause of iusse in launch type configuration you are not able to spin up task otherwise from ecs dashboard you can choose launch type and also choose task defination.CommentShareharshmanvaranswered 4 years ago


Question: DCV client automatisms?  (Windows)

"Hello!Is it possible to implement following automatisms, which would make manual settings/entries no longer necessary:How can I set up DCV Client (e.g. via the registry) so that the client establishes a connection with a double click? So I would not need to type in the hostname manually anymore?How can I set up the DCV client (e.g. via the registry) that the client is initially connected with ...a) ...  "Best Performance" instead of "Best Quality"?b). ... the 3D mouse is directly activated under Removable Devices.That would save a lot of manual work each time you login.Thank you!FollowComment"

Answer: "1You can use a DCV connection file (https://docs.aws.amazon.com/dcv/latest/userguide/using-connection-file.html#connection-file-params) to double-click and automatically connect to the DCV server (and login in case of interest). The automatic 3D mouse re-connect has some implications so it is not yet available. Best performance should be the default for the connection.CommentShareKarstenNISPanswered 8 months agopiknockyou 8 months agoThanks for the reply.Since I've set https://docs.aws.amazon.com/dcv/latest/adminguide/enable-quic.html, the default is "Best Quality". I don't even know, if it is related to it. Anyway, can I change it somehow back to "Best responsiveness"?Share"


Question: Cross account S3 access without going over internet

We have 2 AWS accounts and we are sending huge data from primary account to secondary account (data is being transfer from EC2 to S3Bucket of secondary account) so its costing us data transfer charges at huge. We are looking for solution where we can transfer the data from primary account to secondary account without going via internet. I was thinking about VPC endpoint but we are confused if this can be worked accross AWS Account or not.FollowComment

Answer: "1Accepted AnswerAdd a resource policy to the S3 Bucket allowing access from your primary account.  Make sure the policy on your EC2 instance's IAM role allows access to this bucket.  Configure an S3 VPC Endpoint in your primary account VPC.  Then your EC2 instance will be able to access the S3 service, and your bucket, without going over the internet.CommentShareEXPERTskinsmananswered 3 months agoEXPERTTushar_Jreviewed 2 months agoAWS-User-6176623 3 months agoThanks, I would try this and confirm I'm hopping this would work 100%Share1In this case I would use a S3 Gateway Endpoint in each account. They are zero cost and ensure that S3 traffic doesn't traverse a NAT or Internet Gateway. It will allow each VPC to access buckets in other accounts as required.CommentShareEXPERTBrettski-AWSanswered 3 months ago"


Question: Canot find the data iot simulator generated.

"I am trying to show data on AWS Quicksight which iot simulator generated.But I can't find data in S3.Someone Please show me where the data is stored,and the name of the file.FollowComment"

Answer: "0Accepted AnswerHi Tom177. Are you talking about the AWS IoT Device Simulator?https://aws.amazon.com/solutions/implementations/iot-device-simulator/https://github.com/aws-solutions/iot-device-simulatorIf so, this doesn't publish IoT device data to an S3 bucket. It just publishes to IoT Core. This blog post covers some patterns of how you may then build it out for visualization: https://aws.amazon.com/blogs/iot/7-patterns-for-iot-data-ingestion-and-visualization-how-to-decide-what-works-best-for-your-use-case/Apologies if you mean something other than AWS IoT Device Simulator.CommentShareEXPERTGreg_Banswered a year agoTom177 a year agoThank you for responding so quickly. Yes,I ment AWS IoT Device Simulator.I understand that data goes to IoT Core.I Think pattern3 is what I want to do.I will try sending data to Quicksignt through IoT Core.Share"


Question: Amazon MQ RabbitMQ MQTT plugin support

"Are there any plans to support rabbitmq_mqtt plugin in the future?Currently the only "workaround" I found is to have both ActiveMQ (which contains MQTT interface) and RabbitMQ and set up a shovel which takes the messages from ActiveMQ to RabbitMQ.This solution is cumbersome, prone to errors and has a couple of limitations.FollowComment"

Answer: "0We don't have a confirmed timeline, but we are tracking interest level in this plugin. Please submit a feature request through your Account Manager or TAM.CommentShareTrevor_Danswered 7 months ago"


Question: Acceptable HLS input for MediaLive

"We are trying to use MediaLive for some streaming tasks, and it's pretty straightforward to start with using MP4 as source files to PULL from.But when starting to try with HLS Pull, it seems there is no clear guidance regarding if there is any specific rules for the HLS feed.For instanceis it ok for the .m3u8 playlist include multiple sub-playlist which include different qualities, or it has to be a single tier with .ts segments only?Can the .m3u8 be a static one (vod) or a live feed with updating/dynamic contents?I've tried a few our .m3u8 but it seems there is always some errors coming out of the pipeline alerts:like:Video Not Detected[VideoBuffer[1]] Video not detected: Check input signalAudio Not Detected[1.1] Audio not detected: Check input signalIT would be great to get some helpful guide here re using HLS Pull as the input, and I can share our testing feed via PM.FollowComment"

Answer: "0Accepted Answerfeatheast-ssAWS Elemental MediaLive does indeed support HLS Live and HLS VOD as input to an MediaLive channel.  See https://docs.aws.amazon.com/medialive/latest/ug/inputs-supported-containers.htmlIn this page notice the reference to the Buffer Segments field and the use thereof for VOD assets vs. Live HLS.By default MediaLive will use the highest bit rate rendition in the HLS Stack, but can be overridden in the Input Attachment settings, General Settings - HLS Input Settings - HLS Input - Bandwidth. MediaLive does not switch between renditions for the duration of the channel being in a running state.Additionally the audio can't be in their own renditions within the HLS stack. It must be bundled with the video.  As stated on https://docs.aws.amazon.com/medialive/latest/ug/inputs-supported-containers-and-codecs.html. "The audio and video assets must be multiplexed into a single stream. MediaLive can’t ingest audio assets that are in an audio rendition group. "Feel free to open a ticket with AWS Support and we can troubleshoot the issue for you.CommentShareAWS-User-5437070answered 3 years ago"


Question: Apple Silicon WorkDocs unsupported.

"on an m1 Macbook (Apple Silicon) upon launching a recently downloaded installed Amazon WorkDocs Drive, I'm getting an error that says: "WorkDocs Drive is not supported on Apple Silicon machines. To learn more...[...]"After accpeting the error, WorkDocs just shuts down.I'm running Ventura, but the error comes from Monterrey as well.I followed the instructions on this page that say that it IS supported:https://docs.aws.amazon.com/workdocs/latest/userguide/install-wdd-mac.htmlI downloaded the apple silicon installer here:https://amazonworkdocs.com/en/clientsAny thoughts?FollowComment"


Question: I've lost my private key. How can I connect to my Window instance?

I've lost my private key. How can I connect to my Window instance?FollowComment

Answer: "1Go to EC2 - Keypairs (Delete the key pair, which you lost)create a new key pair with the same name and download it at a safe placeFrom instance description copy Instance type, VPC ID, Subnet ID, Security groups, and IAM roleShut down your instance and create AMI from it.Launch a new instance from this AMI and select the same description you noted.Use Ec2 config or EC2 launch to reset the admin password.CommentShareHoneybwmanswered 8 months ago0Hi ThereIn addition to Honeybwm's answer, you can also use Automation, a capability of AWS Systems Manager, with the AWSSupport-ResetAccess runbook to reset the local admin password of your Windows instance.  See https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-ec2reset.htmlCommentShareEXPERTMatt-Banswered 8 months agorePost-User-1944103 6 months agoI am root admin. But I unable to find AWSSupport-ResetAccess runbook inside. Do I need to grant any further permission?Share"


Question: Unable to SSH to new instances unless its an AWS Ami

"I'm encountering a weird issue. I'm unable to ssh to any instances other than anything thats an AWS AMI, even with default security groups with TCP open on port 22, and the exact same key pairs. All instances are using free tier eligible options). I can provide instance ids if needed to look into these issues further.I created an instance with an AWS AMI (amzn2-ami-hvm-2.0.20190823.1-x86_64-gp2 (ami-0b69ea66ff7391e80)), newly created key pair (testing; testing.pem), and security group shows open TCP connections on port 22I then also created an instance with Ubuntu 18.04 AMI (ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-20191002 (ami-04b9e92b5572fa0d1)), the same key pair that was used above (testing; testing.pem), and security group shows open TCP connections on port 22.AWS AMI ssh connection output ->> ~/.ssh $ ssh -i testing.pem ec2-user@54.167.74.46Last login: Mon Oct 21 02:26:43 2019 from [redactedip]       __|  __|_  )       _|  (     /   Amazon Linux 2 AMI      ___|\___|___|https://aws.amazon.com/amazon-linux-2/15 package(s) needed for security, out of 31 availableRun "sudo yum update" to apply all updates.[ec2-user@ip-172-31-88-246 ~]$ exitlogoutConnection to 54.167.74.46 closed.->> ~/.ssh $ Ubuntu 18/04 ssh connection output ->> ~/.ssh $ ssh -i testing.pem ec2-user@184.72.150.242Connection closed by 184.72.150.242 port 22->> ~/.ssh $ Anything obvious that I'm missing?Edited by: jackbeanstalk on Oct 20, 2019 8:13 PM : Removed my ip from the login messageFollowComment"

Answer: "0Accepted AnswerOn Ubuntu images, most of the time the login user is ubuntu.. Try this and yous should be able to connect.CommentShareSirkoMannanswered 4 years ago"


Question: Greengrass log showing different log time 2 hours in front of what the system time is

"Why is my GG logs showing time difference of 2 hours than my system time. I have NTPD service setup that sets the time to local timezone, but when greengrass service starts, the greengrass.log (as well as all the other component logs) are showing 2 hours ahead.FollowComment"

Answer: "0If you're running Greengrass in a Docker container, be aware that Docker containers often default to UTC, regardless of the host system's time zone. If this is the case, you can set the timezone for your Docker container explicitly.also, some other services can use UTC by default like Sitewise, SDK + Cron jobs so please check all the relevant services related to your logging and check the default timezones.https://docs.aws.amazon.com/iot-sitewise/latest/userguide/metrics.htmlCommentShareEXPERTsedat_salmananswered 14 days agoSash 13 days agoWe are not using SiteWise, only the core IoT services and Greengrass. We are also not running GG on docker container on the device. How can I set default timezone for Greengrass, if the default timezone and the NTP sync is on the local time. (in our case, Australia/Melbourne)?I am just a little confused how a process (greengrass / nucleus) that inherits the OS' time settings, has a different time on the logs.The issue that I am facing (or at least, I think that I may be facing), is:com.aws.greengrass.deployment.exceptions.AWSIotException: Unable to get response........Caused by: javax.net.ssl.SSLException: Connection resetand it may be due to the difference in the time.ShareMichaelDombrowski-AWS EXPERT2 days agoGreengrass logs are always UTC time, this is not configurable. You can tell it is UTC because the time ends with ZShare"


Question: Cloudfront Edge functions

"I'm trying to play Instagram Video assets. The challenge is the videos are expirable. They expire every N mins.I'm brainstorming a solution where I set up my CDN (Cloudfront) which forwards the incoming requests to the original server (Instagram in this case), caches the video at CDN, and then keeps serving it without the need to request Instagram again. I don't want to download the videos and keep them in my bucket.I'd a look at CloudFront functions and was able to redirect the incoming requests to another URL, basis on some conditions. Following is the code.function handler(event) {    var request = event.request;    var headers = request.headers;        if request.uri == '/assets/1.jpg'{        var newurl = 'https://instagram.com/media/1.jpg'              var response = {            statusCode: 302,            statusDescription: 'Found',            headers:                { "location": { "value": newurl } }        }        return response;     }   return request}However, this redirects it to the newURL. What I'm looking for is not a redirect, but the followingwhen the request is made to my server CDN, ie mydomain.com/assets/1.jpg, the file 1.jpg should be served from the Instagram server, whose value is the newURL in the above code snippet. This should be done without changing my domain URL (in the address bar) to Instagram.The following requests to mydomain.com/assets/1.jpg should be directly served from the cache, and should not be routed again to Instagram.Any help in this regard is highly appreciated.FollowComment"


Question: How to delete commit from a branch

"A large file was accidently committed, and pull for this branch fails.I need to delete this commit from historyFollowComment"

Answer: "0Accepted AnswerHi,Have you tried using git rebase -i <commit-id>?Hope it helps.https://linuxhint.com/remove-commit-from-history-git/#:~:text=To%20remove%20the%20commit%20from%20history%2C%20first%2C%20open%20the%20Git,commit%20and%20save%20the%20changes.CommentShareEXPERTalatechanswered 4 months ago"


Question: Play EWT and Position in queue in Amazon Connect

"Hi,I'm looking at adding some basic IVR features that I used in our legacy contact center suchas play estimated wait time (EWT) and play position in queue.How can I do it in Amazon Connect ?Regards, JohnFollowComment"

Answer: "1Accepted AnswerAmazon Connect currently does not have built-in Position In queue and Estimated Wait Time.Position in queue (PIQ) - not possible to play this information, since API or flows do not show position in queue.Estimated Wait Time (EWT) - I use  Amazon Connect API  to get stats metric QUEUE_ANSWER_TIME  for the queue.QUEUE_ANSWER_TIME is average queue answer time, so it can be used as an indicator of how much time client usually waits for an answer, pretty close to EWT. Here is more detailed explanation:https://contactcenterdude.blogspot.com/2021/09/estimated-wait-time-in-amazon-connect.htmlI would love to see EWT and PIQ added to the standard functionality of Amazon Connect, since they are pretty common features of almost all other contact center solutions.CommentShareContact Center Dudeanswered 8 months ago0Hello,Unfortunately there is no out of the box solution for getting current position. You can implement a lambda function to store queue position. For estimated waiting time, there are a couple of example solutions. You can find one of them in link below.https://github.com/aws-samples/simple-ewt-for-aws-connectThanksCommentSharebbolekanswered 8 months ago"


Question: create role with trust permission using cdk causing issues

"I want to create a role with AmazonChimeFullAccess Permissions and allow lambda to run STS-AssumeRole.I could not able to create this role using IAM role using AWS Console but couldn't identify the way to create using CDK.  The code used for creating this role in cdk is pasted below,Permissions:AmazonChimeFullAccessTrusted entities:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": [                    "arn:aws:iam::<account-number>:role/dev-lambda"                ]            },            "Action": "sts:AssumeRole",            "Condition": {}        }    ]}cdk codeval role = Role(            stackInstance, "StsChimeChatAssumeRole",            RoleProps.builder()                .assumedBy(ServicePrincipal("sts.amazonaws.com"))                .build()        )        // Add a statement to the trust policy to allow the AWS account with ID "123456789012" to assume the role        role.addToPolicy(            PolicyStatement.Builder                .create()                .effect(Effect.ALLOW)                .principals(listOf(ArnPrincipal("arn:aws:iam::<account-number>:role/dev")))                .actions(listOf("sts:AssumeRole"))                .build()        )        role.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName("AmazonChimeFullAccess"))Error:Exception in thread "main" java.lang.RuntimeException: Error: Validation failed with the following errors:  [TemplateServiceStack/dev/TemplateServiceDevWaveLambdaStack/StsChimeChatAssumeRole/DefaultPolicy] A PolicyStatement used in an identity-based policy cannot specify any IAM principals.  [TemplateServiceStack/dev/TemplateServiceDevWaveLambdaStack/StsChimeChatAssumeRole/DefaultPolicy] A PolicyStatement used in an identity-based policy must specify at least one resource.FollowComment"

Answer: "1Accepted AnswerIn order to create a Role with the trust policy you have provided with the managed policy attached, you will need to do the following:// Create a Role that can be assumed by the Lambda's Role.val role = Role(            stackInstance, "StsChimeChatAssumeRole",            RoleProps.builder()                .assumedBy(ArnPrincipal("arn:aws:iam::<account-number>:role/dev"))                .build()        )// Add the managed policy to the Role.        role.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName("AmazonChimeFullAccess"))The addToPolicy method allows you to attach IAM policies to a Role, not trust policies.CommentShareJamesJacobanswered 4 months ago"


Question: Cross Region ActiveMQ failover setup query.

We are using AWS ActiveMQ service. We can see same region failover setup but is there a cross region failover for ActiveMQ service . If yes How to set it up?FollowComment

Answer: "0Hello,This is Tom from AWS Support.ActiveMQ supports Network of Brokers configuration which allows cross-region deployment of ActiveMQ brokers. This documentation here shows a sample graph of how network of brokers topology can be configured for ActiveMQ [1]. To enable failover, I recommend including "transportConnectors" inside XML configuration file to allow server side dynamic failover. [2]Furthermore, here is an AWS blog showing a sample/reference solution for Cross Region ActiveMQ deployment [3].I hope the above resources are helpful. Have a nice day!Links and References[1] https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/network-of-brokers.html#how-to-configure-cross-region[2] https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/network-of-brokers.html#transport-connectors[3] https://aws.amazon.com/blogs/compute/using-an-amazon-mq-network-of-broker-topologies-for-distributed-microservices/CommentShareSUPPORT ENGINEERTom_Tanswered 4 months ago"


Question: Lambda triggers for Cognito User Pools refresh token?

Do any of the Cognito User Pools Lambda triggers get fired when a refresh token is used?FollowComment

Answer: "0Accepted AnswerNo, no triggers are fired on that event. The trigger on the UserPool are the following: Pre sign-up, Pre authentication, Custom message, Post authentication, Post confirmation, Define Auth Challenge, Create Auth Challenge, Verify Auth Challenge Response, and User Migration. A  token refresh does not trigger any re-authentication, hence no triggers are fired. When the refresh token itself has expired, the user will have to re-authenticate, and the authentication related triggers will be fired.CommentShareEXPERTMassimilianoAWSanswered 5 years ago"


Question: ec2 Standard Reserved instance: Can you increase the EBS size from the original size when the instance was created?

"If I have a Standard Reserved ec2 instance and the only thing I want to do is increase the EBS SSD size to a larger size than when I created the instance, can this be done? i.e. if I increase the EBS from 160GB to a higher EBS size, or change from using gp2 to using gp3, can this be done with a Standard Reserved instance? I would not be changing the instance size or type. Or would I need to have a Convertible Reserved instance to be able to change the EBS size? Nothing else would be changing.FollowComment"

Answer: 1AFAIK modification to volume size or volume type should not be an issue. Reserved instances are only for compute power ie. instance type irrespective of volumeCommentShareSydanswered 8 months ago


Question: Lost RDS Public Access

I was normally accessing my RDS DB instance through public access until I set up RDS Proxy and I just can't access the DB externally anymore (but it still works inside the network and accessible by the lambda functions). What can I do to re-establish my external access to my instance in RDS?FollowComment

Answer: "1Accepted AnswerHello Dan-IQ,if your use case is mainly DB administration and/or access from your local machine, I'd like to recommend a much safer access option to you that doesn't expose your precious database to the public Internet:AWS Systems Manager recently added support for port forwarding to remote hosts using Session Manager.You will need AWS CLI v2 on your local machine and an EC2 instance with AWS SSM (as a "Bastion Server") for that. This could be an existing instance in case you want to avoid the extra effort. This instance will then be the man-in-the-middle that forwards the database port out of a private subnet to your local machine.You then basically connect like this from your local machine (PowerShell example):aws ssm start-session `    --target i-yourEC2instanceIdHere `    --document-name AWS-StartPortForwardingSessionToRemoteHost `    --parameters host="mydb.xxxxxxxxxxxx.eu-central-1.rds.amazonaws.com",portNumber="3306",localPortNumber="3306"... then run your preferred MySQL tool and open a connection to "localhost:3306".HTH,UweCommentShareUwe  Kanswered a year agoDan-IQ a year agoAlthough I still want to understand why I lost the external access I had, I was able to connect to the database using this solution!Thanks!ShareUwe  K a year agoThanks for the feedback, Dan-IQ, much appreciated.As for the reason of the sudden loss of external access, I can only guess. Could it be that along the way of setting up RDS Proxy, the public IP of the DB got turned off or restrictive security settings were added (e.g., by CF templates)?ShareUwe  K a year agoWith a recent update to the AWS Database Blog, the above method is described extensively. The example environment is MSSQL, but can be easily applied to other database engines (or any port forwarding after all).Share0RDS proxy isn't publicly accessible (your database may still be) so you may have to use SSH Tunneling, or if your client is from a corporate network, then Direct Connect or Site-to-Site VPN are options.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-proxy.htmlCommentShareAWS_Useranswered a year ago0The point is I don't want to connect directly to RDS Proxy. I want to directly connect to my RDS MySQL instance as I usually did before RDS Proxy be implemented.CommentShareDan-IQanswered a year ago0Hi , you can change from RDS console additional setting and click on publicly accessible , make sure in Security Group you have whitelisted your public IPCommentSharesouravanswered a year ago"


Question: Lambda Function URL Throttling

"Working on a product that relies on sending off a batch of 10-100 calls to lambda. I want these requests to be as concurrent as possible. I'm noticing that after ~5 calls I start to see throttling on the requests.. No 429s, but they progressively take longer & longer to actually hit the lambda. I have tried enabling provisioned concurrency @ 20 just to see if that changed things, but nada. Is throttling expected behavior for Function URLs? I can certainly switch to an ALB or API gateway (and will eventually anyway), but I want to ensure it's not something I'm missing around Lambda config.Image below illustrates the effect. Green bar is how long the actual handler takes to process and seems to be ~consistent across calls, and the orange bar is how long the total requests takes client side.Thanks!FollowCommentvtjean 2 months agoHow long does it take for a lambda function execution to finish?Share"

Answer: "0It is important to understand the concurrency in Lambda. Below are some of the key points:-Concurrency is the number of in-flight requests your AWS Lambda function is handling at the same time. For each concurrent request, Lambda provisions a separate instance of your execution environment.As your functions receive more requests, Lambda automatically handles scaling the number of execution environments until you reach your account's concurrency limit.By default, Lambda provides your account with a total concurrency limit of 1,000 across all functions in a region.The below link provides give a good understanding and visualizing of concurrency and also talks about a formula which can used to the concurrency:-https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.htmlCommentShareAWS-User-4371564answered 2 months agorePost-User-5941029 2 months agoUnfortunately this doesn't answer my question.My question is around throttling via request delay / queueing that seems to occur with Lambda function URLs. I've found no documentation about it.Share"


Question: Textract completion msg not published to SNS Topic using Cognito user

"I have read the instructions  https://docs.aws.amazon.com/textract/latest/dg/api-async-roles.html#api-async-roles-all-topics . My set up is somewhat different because I am using a Cognito user. To enable textract to publish msg to SNS,  I pass relevant permissions to Textract to enable it to call SNS. I am able to call StartDocumentAnalysis method and get a response. But the SNS message is never published. The weird thing is that on a few occasions I did see the several data points in CloudWatch's SNS Metric - 'NumberOfNotificationsDelivered', indicating that the messages were published. However, they are almost all gone now. What is wrong with the below?The cognito authorized user has the CognitoAuthRole role:CognitoAuthRole:Type: AWS::IAM::RoleProperties:AssumeRolePolicyDocument:Version: '2012-10-17'Statement:- Effect: AllowPrincipal:Federated: cognito-identity.amazonaws.comAction: sts:AssumeRoleWithWebIdentityCondition:StringEquals:cognito-identity.amazonaws.com:aud: !Ref CoginitoIdentityPoolForAnyValue:StringLike:cognito-identity.amazonaws.com:amr: authenticated- Effect: AllowPrincipal:Service: lambda.amazonaws.comAction: sts:AssumeRole- Effect: AllowPrincipal:Service: textract.amazonaws.comAction: sts:AssumeRoleDescription: Used by cognito authenticated usersManagedPolicyArns:- !Ref DesktopPolicy                #definition is immediately belowAnd the desktop policy is:DesktopPolicy:Type: AWS::IAM::ManagedPolicyProperties:ManagedPolicyName: DesktopBackupPolicyDocument:Version: '2012-10-17'Statement:- Effect: AllowAction:- 'iam:GetRole'- 'iam:PassRole'Resource: !GetAtt "TextractEc2Role.Arn"          #definition is below- Effect: AllowAction:- "sns:Publish"Resource:- arn:aws:sns:us-east-1:xxxxxxxxxxxx:AmazonTextractTopic- Effect: AllowAction:- "textract:GetDocumentAnalysis"- "textract:GetDocumentTextDetection"- "textract:StartDocumentAnalysis"- "textract:StartDocumentTextDetection"Resource:- "*"The role that is passed to Textract service using iam:PassRole is:TextractEc2Role:Type: AWS::IAM::RoleProperties:AssumeRolePolicyDocument:Version: '2012-10-17'Statement:- Effect: AllowPrincipal:Service: textract.amazonaws.comAction: sts:AssumeRoleManagedPolicyArns:- arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess- arn:aws:iam::aws:policy/AmazonSNSFullAccess- arn:aws:iam::aws:policy/AmazonTextractFullAccess- arn:aws:iam::aws:policy/service-role/AmazonTextractServiceRoleRoleName: TextractEc2Edited by: L Jones on Sep 1, 2020 6:40 PMEdited by: L Jones on Sep 1, 2020 6:41 PMFollowComment"

Answer: "0I found the the issue. When using the .NET API (or any other API), there is no need to specify "iam:PassRole" for the user. The API has the ability to specify both the role Textract needs to call SNS and also which topic to send completion message. See .NET solution belowNotificationChannel channel = new NotificationChannel();channel.RoleArn = MY_TEXTRACT_SNS_ROLE_ARN;channel.SNSTopicArn = MY_TEXTRACT_SNS_TOPIC_ARN;request.NotificationChannel = channel;Where MY_TEXTRACT_SNS_TOPIC_ARN is an SNS topic that must begin with 'AmazonTextract'. Ex: AmazonTextractMyTopicWhere MY_TEXTRACT_SNS_ROLE_ARN  is the ARN for:TextractSnsRole:Type: AWS::IAM::RoleProperties:AssumeRolePolicyDocument:Version: '2012-10-17'Statement:Effect: AllowPrincipal:Service: textract.amazonaws.comAction: sts:AssumeRoleManagedPolicyArns:arn:aws:iam::aws:policy/service-role/AmazonTextractServiceRoleRoleName: TextractSnsCommentShareL Jonesanswered 3 years ago"


Question: How to generate Container Image Manifest for EKS from Beanstalk Applications?

"We would like to migrate some workloads from Beanstalk to EKS. What is the best way to generate container image manifests from Beanstalk applications, is there any automation / script solultion for this?FollowComment"


Question: AWS KMS: Receiving a ThrottlingExceptions error when making requests to AWS KMS

"Hi Team,Since a couple of months, we have been facing issues with throttling on AWS KMS which directly impacts our production application too.On further investigation we have seen that cloudwatch logs are generating a large number of requests on AWS KMS (more than 50,000 requests per day). As a temporary solution we have deactivated kms encryption on cloudwatch logs related to non-prod environments. Now the current AWS KMS requests has come down to around 33000 per day.Request some guidance from your side on mitigating this issue.FollowComment"

Answer: "0Unfortunately there are cases where KMS api calls are just to frequent in production- or load-test loads. You'll hit the quota of the KMS APIs and get throttled.There are 4 ways to avoid being throttled:change the quota/limit: Some of the quota's can be increased by filing a support ticket to AWS.use data key caching: If you are in control of the use of the AWS Encryption SDK (since you log the Throttling error you might be able to use this method)use different kind of encryption at rest. (Cloudwatch supports encryption at rest by default AWS managed SSE keys are used that will not get throttled)make less log lines, a good practice is to log one json object that contains everything for one requestCommentShareJaccoPKanswered a year ago"


Question: Remove WAF WebAcl created by Firewall Manager

"I am trying to delete a AWS WAF WebAcl that was created using Firewall Manager few months ago, but someone has removed the Firewall Manager policy, probably without ticking the "delete all policy resources" checkbox, so after this the webAcl remains existing, but I can't delete it. When I try to remove the webAcl I got the following error message:Error You don't have permissions to delete the resource because it's managed by Firewall Manager.Since the firewall manager policy doesn't exist anymore, I couldn't find a way to delete the loose webacl, no matter if I try via console or CLI, I always get this error message.I did a research in AWS docs but didn't find any related topic, so I am wondering if there is a way to delete it.FollowComment"

Answer: "2Hello AWS Customer,If an account or resource goes out of scope for any reason, AWS Firewall Manager doesn't automatically remove protections or delete Firewall Manager-managed resources unless you select the Automatically remove protections from resources that leave the policy scope check box.[1]Therefore, in order to delete this WebACL from your account, it has to be done from the "Admin Account".Hope you will find this information useful.Have a good day!CommentShareSUPPORT ENGINEERJisoo_Kanswered 5 months ago0Hello Jisoo,Thanks for replying.The AWS Organization where this policy lives only contain 1 member account and I tried to delete the loose webacl using the root of the management account, but got the same error.There are anything that I'm missing?CommentShareawsbrzanswered 5 months agoAWS-User-3413787 a month agoBy root of the management account, do you mean the Management account of the AWS Organisation or the Firewall Administrator account?Share"


Question: IDT for Greengrass fails to run the sample test suite on Windows.

"IDT version: v4.7.0 with test suite GGV2Q_2.5.0 for WindowsGreengrass version: v2.9.4Currently, I am exploring AWS IoT Device Tester for AWS IoT Greengrass V2. In particular, now I'm going through a tutorial on how to Build and run the sample IDT test suite. I completed all the prerequisites from the guide but got stuck on the step Use IDT to run the sample test suite. I failed to start tests trying to run a test suite or a particular test when Windows is a host machine OS. I always get the error[ERROR] [2023-03-09 12:21:44]: Test failed to start executionId=92421d27-be6c-11ed-8909-e86a646ef7fe testCaseId=test_ping error=exec: "python3": executable file not found in %PATH%but I am sure that it is there.PS D:\Edu\aws\greengrass\devicetester_greengrass_v2_win\bin> python3 --versionPython 3.9.13What can be the reason for this error?Notes:I successfully run the AWS IoT Greengrass qualification suite when Windows is a host machine OS.I successfully run both the AWS IoT Greengrass qualification suite and sample test suite from the tutorial when Linux is a host machine OS.FollowCommentVadzim 2 months agoI guess it could be related to my Python being installed from the Microsoft store. It seems, for some reason, the IDT can't recognize the Python executable installed from the Microsoft Store, although the Path environment variable was set to its executable file.I installed another Python 3.11.2 from https://www.python.org/downloads/, set the path to its executable, and successfully launched tests.Share"


Question: Server Error 500 deploy AWS RDS

"I'm trying to deploy an AWS RDS and the error below is happening:Server Error 500 <!doctype html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="robots" content="noindex, noarchive"> <meta http-equiv="Cache-Control" content="no-cache"> <meta http-equiv="Expires" content="0"> <title>AWS: 500 Server Error</title> <style> @font-face { font-family: 'AmazonEmber'; src: url(data:application/font-woff;charset=utf-Anyone know what is wrong?ThksFollowComment"

Answer: "0Hey thereThe 500 internal server error can be caused by several things which at times might be triggered by invalid API call causing the internal server not to fulfil the API request. To troubleshoot what might have caused the error, use CloudTrail. All AWS API calls including RDS actions are logged by CloudTrail. It provides actions taken by a user, role, or an AWS service in Amazon RDS.To view CloudTrail EventsGo to the CloudTrail consoleChoose Event history in the navigation paneA list of events appears in the content pane with the latest event first. Scroll down to see more events.Click an event to see its detailsYou can refer to this document for further information on Viewing CloudTrail Eventshttps://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-console.htmlIf you can’t see much information on what might have caused the error, can provide information on how you are deploying the instance for more insights also information about the agent used for the API callI hope this helps solve your problemHave a great day!CommentShareprechanswered 2 years ago"


Question: I am getting error while exporting the ec2 image to OVA/OVF

"Error:- "An error occurred (InvalidParameter) when calling the ExportImage operation: The service role vmimport provided does not exist or does not have sufficient permissions"I am trying to export this image and use it in my Mac mini M1. And we have used ARM architecture in EC2.So we are getting these errors while exporting the AMI image using CLI.We have given the administrator permission to RELATED USER AND ROLE.We have used the A1 family process in EC2.Command we have used:- "aws ec2 export-image --image-id ami-id --disk-image-format VMDK --s3-export-location S3Bucket=my-export-bucket,S3Prefix=exports/"And we have given s3 Object Ownership = Object writer and Enable ACL to the bucketPlease help me to find the solution.Link:-https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport_image.htmlhttps://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-troubleshooting.htmlFollowComment"

Answer: "2Hello,Please check the link and make sure that the vmimport role has proper trust relationship and policiesHope this helps.CommentShareSUPPORT ENGINEERVinay_Sanswered 2 months ago1Have you created the service roles described in the following documents?https://docs.aws.amazon.com/vm-import/latest/userguide/required-permissions.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: Patch host in a sequence

"Hi all,I have 6 hosts in a patch group that I need to patch in a certain sequence, what I would like to do is, e.g. , first do instance1, then 2, then 3, then 6 then 5 then 4, is this possible and if so, how must it be configured?FollowComment"

Answer: "0Hi,Usually to patch instances in a sequence, some mechanism of orchestration is needed. A good solution within AWS Systems Manger is SSM Automation. You can create a Document of type Automation ( now referred to as a Runbook) to run the patch document (AWS-RunPatchBaseline) on each of your 6 instances one at a time in certain order.CommentShareAWS-User-7262788answered 2 years ago0Thanks, I will attempt thisCommentSharePikachuanswered 2 years ago"


Question: "Cant reach Redshift cluster from outside, or kinesis"

"(technically I really want to make kinesis talk to redshift, but I'm debugging redshift permissions via my outside IP address)I have enabled external access in the redshift configs.I'm using the redshift endpoint url, which resolves to a public IPI have added a inbound rule to the security group specified in the "Network and security settings" to allow ping.Also for port 5439But I still cant ping or connect to the JDBC port. What am I missing??FollowComment"

Answer: "0Hello,Please follow the below document link for further troubleshooting and let me know if the steps helped you.Link- https://aws.amazon.com/premiumsupport/knowledge-center/cannot-connect-redshift-cluster/CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 5 months agorePost-User-2088973 5 months agothat page seems very out of date.For the second section on private subnet, it mentions things that arent in the UI.There is no "Configuration tab".So similarly, there is no "View VPCs" to click on.Nor do I see info to tell me which is the "subnet where your cluster resides"Share0Hi.Try the following things:select your Redshift cluster and go to Actions -> Modify publicly accessible setting and select Turn on Publicly accessiblego to Properties tab2.1 in Network and security settings section you should have Publicly accessible: Enabled 2.2 find VPC security group sections and click the security group link and check the Inbound rules. You should allow all traffic to port 54392.3 if you want allow access only from your IP address, in Edit inbound rules Info select My IP in Source sectionSecurity groups Inbound rulesIn general, it should not be a problem: make sure you have a cluster publicly accessible and in security groups you allow traffic to the Redshift port.CommentShareMaxanswered 5 months ago"


Question: Controling BGP Route Propagation in Transit Gateway

"When setting up a VPN connection to Transit Gateway, is there way to control which routes are propagated across the VPN tunnel via BGP?. Currently, any new attachments to the Transit Gateway will propagate the subnets across the VPN tunnels. How can a user control which IP ranges are propagated and how can they only propagate certain custom ranges?FollowComment"

Answer: 0Accepted AnswerThe way to control route propagation over BGP for VPN is with TGW route tables. Users can create a new TGW route table just for the VPN tunnel(s) and then only propagate the routes that are needed.CommentShareAWS-James-Devineanswered 3 years ago


Question: Where to find development stage editor in API Gateway ?

As per show in image I am finding development stage editor in API Gateway >> In Stage but not get any option in Stage . check out this screenshot below :This link I am following for this process FollowComment

Answer: "0You can't modify the API itself in the stage. You need to go to Resources, make the change, and deploy to a stack.The idea is to make a change, deploy to a dev, test and then deploy the same changes to prod. If you need different implementations in different stages, you probably need to create different APIs.CommentShareEXPERTUrianswered 6 months ago"


Question: What might cause an "Access Denied" error when creating a cloudfront s3 Origin using cloudformation?

"I have a bucket in account A. This bucket is configured to block all public access, and to allow GetObject to requests from cloudfront with    "aws:ResourceOrgID" matching my orgId.In Account B (inside my organisation) I can create an OriginAccessControl, and using this and the console, i can manually add the url bucketname.s3.region.amazonaws.com as an s3 origin, and using this OriginAccessControl, I can access the files from cloudformation.(I have also verified that this is not possible form an account outside my org, I believe my bucket policy is ok)Trying to configure the exact same origin using cloudformation leads to the following error:Resource handler returned message: "Access denied for operation 'Access Denied. (Service: CloudFront, Status Code: 403, Request ID: ....I assume, that cloudformation is either trying to verify that the bucket is accessbile in the background, or is trying to change the bucket permissions.Unfortunately changing the bucket policy action to * for resources BucketName, BUcketname/* doesnt help.What could cloudformation be doing that the console doesnt which causes this failure?FollowCommentkentrad EXPERT2 months agoIn the CloudFormation template, what is the value for Distribution.Properties.DistributionConfig.Origins.DomainName?Share"

Answer: "0Accepted AnswerTurns out there was no problem at all, the issue was with my bucket name being misformed!CommentShareJamesanswered 2 months ago0Hi Gary,I promise you that the following does appear to work, but only if i add the origin through the console, not when using cloudformation. The problem is using cloudformation to do the same. Also, I cannot add the distribution ID at this point to the bucket policy as it is unknown, and this bucket is not part of this stack.    {        "Effect": "Allow",        "Principal": {            "Service": "cloudfront.amazonaws.com"        },        "Action": "s3:GetObject",        "Resource": "arn:aws:s3:::MyBucketName/*",        "Condition": {            "StringEquals": {                "aws:ResourceOrgID": "myOrgId"            }        }    },It's really stumped meCommentShareJamesanswered 2 months agoGary Mclean 2 months agoThanks for the update..Intresting as I have read it in a couple of places.. Heres one https://repost.aws/questions/QUeEr7GSgESI-rPCQ_-aGqKA/how-can-i-restrict-s-3-bucket-access-to-allow-only-vpc-flow-logs-from-within-an-organizationI am trying to find anything offical on AWS Website.If you edit your bucket policy in the GUI it reports it as a security warning.. The GUI could be out of date....I am going to test moreShareGary Mclean 2 months agoI wonder if AWS updated this based on the post was some time ago...ShareGary Mclean 2 months agoPlease see my latest answer.. TaShare0Hey James,So I stand true with my statement still. Your policy "Condition" isnt allowing allowing access from your ORG, its allowing access from CloudFront to your Bucket In your Org. The Condition ResourceOrgID is the resource being accessed not the source account/service.aws:ResourceOrgID = AWS organization ID of the resource being accessedThis means anycloud Distribution can access your bucket. PrincipalOrgID would be the condition you would need to only allow access from a Role/Account in your Org but that as I said isnt supported.The table here explains what your condition is https://aws.amazon.com/blogs/security/how-to-control-access-to-aws-resources-based-on-aws-account-ou-or-organization/Your policy is only backing up your defined resource being that the bucket is in your org which is going to be because thats the where the bucket lives. So that condition doesnt actually do anything.Anyway that wasnt the issue you had but one to review if security is a concern..We use terraform where that issue you have with cat and mouse isnt a problem..GaryCommentShareGary Mcleananswered 2 months agoJames 2 months agoHi Gary,You're absolutely right actually, thanks for taking the time to look into it!I thought I'd tested it, but I just set up a cloudfront distribution in an account outside the organisation and it worked, so all I was actually testing for was a signed request from any cloudfront as you said!To resolve this, without having to add each distributionId indiviudally to the bucket policy, I've tested the following bucket policy which does seem to work (requires the Referer header to be set as a custom header in the origin){"Effect": "Allow","Principal": {"Service": "cloudfront.amazonaws.com"},"Action": "s3:GetObject","Resource": "arn:aws:s3:::MyBucketName/*","Condition": {"StringEquals": {"aws:Referer": "someSecretString"}}},It's not absolutely essential that nobody can access the bucket directly as it's a public website, and I think that restricting it to only cloudfront distributions that "know" the secret header should be sufficent?The problem I was orignally having has disappeared (turns out the problem was me).ShareGary Mclean 2 months agoHey James,That policy i think without specifying the ARN is the best your going to get. Good idea using a referer!Unless someone knows both the bucket name and header your good to go buddy..Thanks for the update.. Its good to knowGaryShare0Hey there,You can NOT reference an ResourceOrgID on Principals originating from AWS Services. The AWS Services i.e. Cloudfront does NOT reside in your ORG.You will need to reference the CloudFront ARN of the account its setup in than the ORGCorrect your bucket policy which should fix the issue as an example. Update the Bucket name and sourceARN :-{    "Version": "2012-10-17",    "Statement": {        "Sid": "AllowCloudFrontServicePrincipalReadOnly",        "Effect": "Allow",        "Principal": {            "Service": "cloudfront.amazonaws.com"        },        "Action": "s3:GetObject",        "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",        "Condition": {            "StringEquals": {                "AWS:SourceArn": "arn:aws:cloudfront::111122223333:distribution/EDFDVBD6EXAMPLE"            }        }    }}If you are using KMS encryption you may need to also adjust your KMS policy also.If this answers your question, please accept this so it helps others and me.CommentShareGary Mcleananswered 2 months ago0I think I ran into a similar problem once and it was caused by not using the region as part of the DomainName when referencing an S3 bucket.CommentShareEXPERTkentradanswered 2 months ago"


Question: AWS Transfer Family -> LOGICAL ->  Mapping directories increase limit.

"Hi,We notice that the logical mapping directories have a limit of 50 by a user we would like to have 1500, there is an instance where we can request an increase in this limit?ThanksFollowComment"

Answer: "0Hello,I believe the limit of 50 mappings for Logical Directories is a hard limit. However, I would encourage you to raise a limit increase case via Support Center and have it directly confirmed with the Transfer team. In your request, please provide information on relevant resources such as server-id, region and the desired limit. Also, do include your use-case on why you need the limit increase and how does the current limit impact your ability to utilize the service.If you do not find the specific limit increase while raising a request, select a different limit increase and share details within Case description. Or if you have a Premium Support plan, you can create a technical case as well and provide details there.Let me know if you have questions.References:[1] https://docs.aws.amazon.com/awssupport/latest/user/create-service-quota-increase.html-- SagarCommentShareEXPERTsagarb-awsanswered a year ago"


Question: [EC2 ICE] Is c5a series more prone to capacity issues? Is there an EC2 capacity heatmap?

"Today I encountered Insufficient Capacity Error whilst launching 3x c5a.8xlarge in Sydney region (AZ apse2-az2). After some re-trying I managed to launch c5a.12xlarge in the same AZ.A month or two ago I encountered the same issue with c5a.8xlarge in Mumbai region. Managed to switch some instance to c5 (without the a).My usecase is online events. I need to spin up a number of EC2 instances on short notice. Max so far has been about 10 EC2 instances (I don't think that a big number for AWS). I am using different regions depending on location of the end user. I am now using c5a series (usually c5a.8xlarge) instead of c5 to save on cost. However if another instance series is more reliable (i.e. not getting ICE'd) I would consider changing to a different series. Is the c5a series more prone to ICE?Is there a 'capacity heatmap' available, where I can see the EC2 availability across instance series, regions, and AZs?Ideally I would have access to a 'weather forecast' where I can see the current & expected capacity forecast. In my current architecture I can make changes to instance series / AZ a few days in advance of an event, but it's stressful to make changes within the hour before my customer's event starts.FollowComment"

Answer: "1Hello,Thank you for reaching out. As you properly stated, the Insufficient Capacity errors mean that at a given moment, AWS lacks capacity for on-demand Instances in an specific Availability Zone when you tried to start or launch an Instance (1).On-Demand capacity fluctuates overtime, so waiting few minutes, changing Instance type temporary or (when launching an Instance) select a new Availability Zone where capacity is available. You can use the AWS CLI command describe-instance-type-offerings to validate the Instance types you can launch in an Availability Zone (2-3).If your operation is critical, your team may consider also take a look to On-Demand Capacity Reservations so you have specific compute capacity allocated in specifics Availability Zones. Note that there is a cost associated with the use of Capacity Reservations (4-5).Unfortunately, there is no roadmap as to how more resources are made available over time. As to which Instances are prone to be more likely to encounter this issue, it all depends on the resources available c5a.8xlarge does require 32 vCPUs. If you take that multiplied by x number of Instances, they add up for sure.I understand you were looking for a more suitable answer, in AWS our customers are our priority and we constantly keep on adding more resources to alleviate this kind of issue from happening.Have a nice day!!References(1) How do I troubleshoot InsufficientInstanceCapacity errors when starting or launching an EC2 instance?(2) describe-instance-type-offerings(3) Find an Amazon EC2 instance type - (Find an instance type using the AWS CLI(4) On-Demand Capacity Reservations(5) Capacity Reservation pricing and billing(6) On-Demand Instances - (On-Demand Instance limits)CommentShareSUPPORT ENGINEERJosueAWSanswered a year ago"


Question: Voice recognition

Can amazon transcribe save a person's voice and have it used in voice recognition when transcribing audio?FollowComment

Answer: "0Hi,Amazon Transcribe can build custom language models using recorded voice data. It can also do speaker diarization to partition different speakers. Details of its usage can refer AWS official documentHope it helps.CommentShareTina Qiananswered 3 months agorePost-User-7164916 3 months agoThanks for the answer but it doesn't help me much, I already use the "speaker diarization" functionality, and I get a transcript where each one of the speakers that appear in the audio is labeled, what I need now is to know if there is any way to instead of obtaining a label like this to identify the speaker "spk_0", if I can save the voice of that person so that the amazon transcription service recognizes it by its tone of voice and that when the transcript is generated, in Instead of having a generic label that says "spk_0", obtain a personalized label that indicates the name of the person to whom that tone of voice is associated, for example "Carlos" or "Pedro".ShareTina Qian 3 months agoThanks for your further explanation and I can have a better understanding of your question now.This is a very practical scenario which is not current supported by Amazon Transcribe alone as a single feature. But you still have several options to do.One direction is to have a two-step solution by using Amazon Transcribe as the first step. You may implement your personal voice authentication using SageMaker.Another direction is that if you are facing a cloud contact center case or with similar using situations, Amazon Connect is another SaaS solution for you to consider. Amazon Connect Voice ID uses machine learning to verify the identity of genuine customers by analyzing a caller's unique voice characteristics. For more details, you may refer its official document.Hope it helps.Share"


Question: Are objects under compliance mode with retention period deletable?

"I know all the doc says objects with compliance mode turned on DEFY deletion while it's in retention period.Is there really no way around this? For instance can AWS engineers delete them on their end or are they locked up just forever?An extreme case would be somehow the bucket's default policy is compliance mode + retention period of 100 years(maximum), is the data uploaded into this bucket permanently staying in this case?Thanks!FollowComment"

Answer: "0In compliance mode, a protected object version can't be overwritten or deleted by any user including the root user in your AWS account.In governance mode, users can't overwrite or delete an object version or alter its lock settings unless they have special permissions. If you try to delete objects protected by governance mode and have s3:BypassGovernanceRetention or s3:GetBucketObjectLockConfiguration permissions, the operation will succeed.https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-modesAWS engineers do not have access to Customer's data due to strict AWS Privacy and Security policies https://aws.amazon.com/compliance/data-privacy-faq/ and hence cannot be altered from AWS end.Once the objects are locked under compliance mode compliance mode the minimum retention period must be met before any changes are to be made.CommentShareSUPPORT ENGINEERHarsh_Panswered 4 months ago"


Question: CloudFront stuck Status InProgress

"Hi, today I changed the ssl policy for the certificate of some of my distributions (I'm using a custom certificate without dedicated IP) but the distribution status remains in Progress forever.I don't see any issue on this service. What's could be wrong?ThanksFollowComment"

Answer: "0Nevermind,after some time, finally, it got Deployed!CommentSharedrenda81answered 3 years ago"


Question: AWS EKS Managed Nodepool with custom CIDR on AWS-CNI

"Hello aws re:PostI want to run my pods (network wise) in a different subnet and for that I make use of the custom CNI config for the AWS-CNI plugin which already works like a charm.Now I want to automate the whole process.I already archived to create the CRD eniconfigs and deploy them automatically. But now I stuck at the automation of the node annotation. As I could not find any useful content while searching re:Post or the internet, I assume the solution is rather simple.I assume that the solution is somewhere here in the Launch Template, User Data or via KUBELET_EXTRA_ARGS but I'm just guessing.The QuestionHow can I provide annotations like mine (below) to the nodes on launch or after they joined the cluster automatically?kubectl annotate node ip-111-222-111-222.eu-central-1.compute.internal k8s.amazonaws.com/eniConfig=eu-central-1cFollowComment"

Answer: "0Accepted AnswerThanks for the additional context! I assume you are using different node pools for each of your "backend, frontend, etc". So in that situation you can actually use the CNI ENI_CONFIG_LABEL_DEF configuration value to specify node labels instead of annotations for the ENIConfig name. From there use can use the EKS Optimized AMI bootstrap.sh script to pass in node labels via the kubelet-extra-args option. This could be done in the launch template user data for the Managed Node Group.https://github.com/aws/amazon-vpc-cni-k8s#eni_config_label_defhttps://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html#launch-template-user-dataCommentShareRyan_Sanswered 3 months ago0When using custom networking with the Amazon VPC CNI you are able to update your aws-node DaemonSet to automatically apply the ENIConfig for an Availability Zone to any new Amazon EC2 nodes created in your cluster. This is possible when you name your ENIConfigs with the same name as your Availability Zones, which it seems like you did.The command to perform this is below...kubectl set env daemonset aws-node -n kube-system ENI_CONFIG_LABEL_DEF=topology.kubernetes.io/zoneHere is also a link to the documentation describing this. Look at step 5 under the "Configure Kubernetes resources" section.https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html#custom-networking-configure-kubernetesHope that helpsCommentShareRyan_Sanswered 3 months ago0Hey Ryan,thanks for your answer.As we use a multi-zone (Frontend,Backend,Infrastructure,Data) and availability zone architecture we have like more then three ENIConfigs, so my example wasn't that accurate.Actually we use three subnets per Zone, so we needed to find a uniq name per ENIConfig....pods-backend-eu-central-1a          6h28mpods-backend-eu-central-1b          6h28mpods-backend-eu-central-1c          6h28mpods-frontend-eu-central-1a         6h28mpods-frontend-eu-central-1b         6h28mpods-frontend-eu-central-1c         6h28mpods-infrastructure-eu-central-1a   6h28mpods-infrastructure-eu-central-1b   6h28mpods-infrastructure-eu-central-1c   6h28mFrom what I understood is a subnet always bound to exactly one availability zone, right?This means that we either have to run all pods of a zone in exactly one availability zone and subnet OR we can only have three subnets which share all pods and our zone architecture will not work.CommentSharemoep_moepanswered 3 months ago0Hey Ryan, that was the resolving fact I missed.I read in several guides and tutorials that this is only possible with annotations.Also the ENI_CONFIG_LABEL_DEF was not available until I saw that I did not use the most recent version of the VPC-CNI.CommentSharemoep_moepanswered 3 months ago"


Question: "AWS SAM, unable to dynamically change the CodeUri based on Variable"

"I have different local directories for three different environments with differnet codes. I can map all other properties dynamically except the codeUri.The current code below shows up an error "'CodeUri' requires Bucket and Key properties to be specified."  AuditEventsToDynamo:    Type: AWS::Serverless::Function    Properties:      FunctionName: !Sub 'AuditEventsToDynamo${ENV}'      CodeUri: !Sub 'AuditEventsToDynamo${ENV}/'      Handler: !Join [ "", ["AuditEventsToDynamo" ,!Ref "ENV",".lambda_handler"]]      Runtime: python3.9      Environment:        Variables:          DB_TABLE: !Ref DBTABLE      Architectures:        - arm64The code is local, if I replace the CodeUri with a literal string, it works. Is there a workaround?FollowComment"

Answer: "0What's the "literal string" you used that works, and what's the value of "ENV" when it fails?  If ENV is something like "Dev", "Prod" etc then the error makes sense - your CodeUri wouldn't have both a Bucket and Key specified.CommentShareEXPERTskinsmananswered 4 months agoJay-Serverless 4 months agoI have three local directories named as AuditEventsToDynamoProd AuditEventsToDynamoTest . If I give the path as "AuditEventsToDynamoProd", it works. I couldn't use any Intrinsic Functions to add dynamic values.Share"


Question: Question about creating a VPC using the CLI

"I was reading documentation about creating a VPC using the CLI and it made me realize that I must not understand the environment correctly. It seems to me that in order to use the CLI I first have to create an EC2 instance (which as I understand, gets created in a VPC), log into the EC2 to access the CLI, then use the CLI to create a new VPC. Is this a correct assumption? Would the new VPC be a child or sub component of the VPC that the EC2 belongs to?thanksFollowComment"

Answer: 0Accepted AnswerHello. You can install and run the AWS CLI from your own computer. The CLI does not require you to run it from the AWS network. It requires that you run the aws configure command to specify your AWS access keys.JulieCommentShareAWS-User-6695526answered 3 years ago


Question: [Video Tutorial] 2020.13 - Playing & Looping Ambient Audio

"Hey devs,Part 3/6 is up, part 4 will come next Friday.https://youtu.be/4qifdO9_JO0Title  : Loop Ambient Audio using Wwise & Audio TriggersEpisode  : 2020.13Series  : Audio & SoundVersion  : BETA 1.23.1 (uploaded on  [date=2020-05-29 timezone="America/Los_Angeles"] )Host  : @REDACTEDUSERKey Takeaways:Triggering ambient audio without Script CanvasSetting audio to loop in WwiseCatching Audio finished event in Script CanvasResources  :📗 Docs - Adding Audio & Sound EffectsAppreciate any feedback or suggestions. How are you guys using audio in your projects?Follow"

Answer: "0GREAT , Thank you Mr @REDACTEDUSERhttps://forums.awsgametech.com/t/update-starter-game-with-new-physx-system-script-canvas/8768https://forums.awsgametech.com/t/ai-bug-and-ai-crash-in-script-canvas-in-lumberyard-1-23-1-24/8635/5https://forums.awsgametech.com/t/surprise-an-envelope-full-of-terrible-bugs-in-script-canvas/7993/3https://forums.awsgametech.com/t/math-nodes-bugs-in-script-canvas-ly-1-24/8654https://forums.awsgametech.com/t/where-is-water-ripple-effect-component-in-gem-ly-1-23/8108/6PLEASE FIX IT...When we can see Lumberyard Prime (Final version not beta)??SharerePost-User-8224505answered 3 years ago0Have none of these been addressed?SharerePost-User-8914159answered 3 years ago0No one has been fixed bugs and there are a lot of bugs.SharerePost-User-8224505answered 3 years ago0I'll bump this to the dev teams again, thanks for your patience!SharerePost-User-8164888answered 3 years ago"


Question: How much time it takes to restore RDS Aurora DB from AWS Backup?

How much time it takes to restore RDS Aurora DB from AWS Backup?I know it's based on the data but is there any estimates?FollowComment

Answer: "0In general time to restore from a recovery point using AWS Backup depends on the size of the data and type of resource being restored, is it a single DB, or an entire aurora cluster, a time frame cannot be estimated, it may take 5 minutes or 1 hour.Please take a look to https://docs.aws.amazon.com/aws-backup/latest/devguide/restoring-aur.htmlAnd: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Backups.htmlCommentShareOthnajidanswered a month agoJK a month agoI agree with you, but there should be a way where I can estimate that my 500 GB database will take 5 mins or 1 hour or 1 day to plan for my DR solution.Share"