Question: Mount EFS from different VPC

"Based on recommendations from AWS I have created a VPC for each one of my customers (same region, same availability zone and same CIDRs).Within each VPC I create an EFS file systems. Everything works fine for the various EFS and I can mount them on instances launched within the same VPC.For management purposes (creating initial folders) and to transfer files I need to mount these EFSs on an instance launched from my main VPC. I tried to follow the instructions here to create a peering connection, but I am unable to do this because the two VPCs have overlapping CIDRs. Based on the same walkthrough the same prerequisite is required for the transit gateway.Is there an alternative approach? I am not a network expert so please bear with me. If I have to use different CIDRs for different VPCs, would I not run out of addresses at some points?FollowComment"

Answer: "1Accepted AnswerIf you have VPCs (or networks in general) with overlapping IP ranges my strongest recommendation in this situation is to use non-overlapping IP ranges. See this blog post for other alternatives but using different IP ranges is by far the cheapest and (despite appearances) the easiest.When you create a VPC you get to choose how large the IP range for that VPC is. The default /16 (subnet mask: 255.255.0.0) range gives you 65,000 (give or take a few) IP addresses in your VPC. You probably don't need that many. Which means by creating a VPC with a smaller IP range you can have thousands of VPCs before you run out of IP addresses.CommentShareEXPERTBrettski-AWSanswered 5 months agoEXPERTTushar_Jreviewed 5 months ago1It's possible to cope with overlapping CIDRs but it adds complexity.  By far the best approach is to avoid overlaps if it's not too late.Would you run out of addresses?  You can fit a lot of VPCs in the RFC 1918 ranges, for example in 10.0.0.0/8 you can fit 4096 /20 VPCs, and you can make VPCs as small as /28 if workable for you, with room for over a million of those.If that's not enough, EFS doesn't support IPv6 yet but when it does you could consider IPv6-only VPCs - you'll never run out of addresses for those!A workaround for comms between VPCs with overlapping CIDRs adds complexity as I said.  Basically you NAT the addresses, for example:Each VPC has a secondary address block, and these don't overlap.Secondary subnets on the server side contain an ALB front-ending the app.Secondary subnets on the client side contain NAT GWs. Note that the VPC needs an IGW as a prerequisite for NAT GW even if you're not using it for internet traffic.Attach the VPCs to TGW with static routes, no propagation, so you only have routes for the non-overlapping secondary CIDRs.CommentShareEXPERTskinsmananswered 5 months ago0To mount an Amazon Elastic File System (EFS) from a different Virtual Private Cloud (VPC), you will need to set up a VPC peering connection between the two VPCs. Once the peering connection is established, you can mount the EFS file system in the target VPC by specifying its file system ID and the DNS name of the mount target in the other VPC. You may also need to configure the security groups and network access control lists for the mount target and the instances in the target VPC to allow access to the EFS file system.CommentShareBalaanswered 5 months ago"


Question: Emails coming from verified email address going to SPAM

"I've noticed that emails coming from a verified email address (whose DNS I don't have access to) are going to SPAM. For example, I validated my personal gmail/yahoo/hotmail email addresses but sent emails are going to SPAM. Is there something I can do to prevent it? Because as you may guess I don't have access to Gmail/Yahoo/Hotmail's DNS so I cannot configure any SPF/DKIM policy.FollowComment"

Answer: "0HiYou must configure the DKIM and SPF records for the verification not only the DNS there are different isues causes the Email will come to spam email.Please remember that you need to maintain the Email reputation for the Email adress, You can use this link to configure the Email bounce SNS notificationshttps://aws.amazon.com/premiumsupport/knowledge-center/ses-bounce-notifications-sns/You can check the AWS premium support resolution Email spam here  https://aws.amazon.com/premiumsupport/knowledge-center/ses-email-flagged-as-spam/I am happy to help  you, if you still have any questionsThank youGKCommentShareGKanswered a year ago"


Question: CloudFormation - Creating a Provisioning Template - Template Body JSON contains 'Ref'

"I am attempting to use Cloud Formation to create fleet provisioning template. however the JSON used for the provisioning template uses 'Ref' as a key and is cloudformation is using this as the function 'Ref'my fleet provisioning template looks like:{  "Parameters": {    "ThingName": {      "Type": "String"    },    "ThingGroupName": {      "Type": "String"    }  },  "Resources": {    "MyThing": {      "OverrideSettings": {        "AttributePayload": "REPLACE",        "ThingGroups": "REPLACE",        "ThingTypeName": "REPLACE"      },      "Properties": {        "AttributePayload": {},        "ThingGroups": [{          "Ref": "ThingGroupName"        }],        "ThingName": {          "Ref": "ThingName"        }      },      "Type": "AWS::IoT::Thing"    },    "MyPolicy": {      "Properties": {        "PolicyName": "Prefix-FleetOperator-ProvTemp"      },      "Type": "AWS::IoT::Policy"    },    "MyCertificate": {      "Properties": {        "CertificateId": {          "Ref": "AWS::IoT::Certificate::Id"        },        "Status": "Active"      },      "Type": "AWS::IoT::Certificate"    }  }}and a snippet of my cloud formation looks like  FleetProvisioningTemplate:    Type: 'AWS::IoT::ProvisioningTemplate'    Properties:      Description: Prov Template      Enabled: true      PreProvisioningHook:        TargetArn: >-          arn:aws:lambda:      ProvisioningRoleArn: !GetAtt FleetProvisioningRole.Arn      TemplateBody:          Fn::ToJsonString:            Parameters:              ThingName:                Type: String              ThingGroupName:                Type: String            Resources:              MyThing:                OverrideSettings:                  AttributePayload: REPLACE                  ThingGroups: REPLACE                  ThingTypeName: REPLACE                Properties:                  AttributePayload: {}                  ThingGroups:                  - Ref: ThingGroupName                  ThingName:                    Ref: ThingName                Type: AWS::IoT::Thing              MyPolicy:                Properties:                  PolicyName: !Sub ${Prefix}-${FleetOperator}-IoTThingPolicy                Type: AWS::IoT::Policy              MyCertificate:                Properties:                  CertificateId:                    Ref: AWS::IoT::Certificate::Id                  Status: Active                Type: AWS::IoT::Certificate      TemplateName: !Sub ${Prefix}-${FleetOperator}-ProvTemp    Metadata:      'AWS::CloudFormation::Designer':        id: 841d6a68-6dc0-4a56-8dd8-e784ca97dc79I receive the following error when trying to create the stack:Template format error: Unresolved resource dependencies [ThingName, AWS::IoT::Certificate::Id, ThingGroupName] in the Resources block of the templateHow do I get cloud formation to pass "Ref" in the template as a string and not as a function?FollowComment"

Answer: "1Hi Phil. I think you need a literal block in the YAML, so the JSON provisioning template is taken as a string. Note the pipe character after TemplateBody: statement.      TemplateBody: |{  "Parameters": {"ThingName": {  "Type": "String"},"ThingGroupName": {  "Type": "String"}  },                  etcCommentShareEXPERTGreg_Banswered 9 months agoEXPERTChris_Greviewed 9 months agoPhil Begg 9 months agoI looked into this further and as  mentioned above you can add the literal JSON Block using the '|' pipe character.I ran into further trouble when I wanted to use variables with in the fleet provisioning template. My solution was using the Join Function like this:      TemplateBody: !Join        - ''        - - >-            {"Parameters":{"ThingName":{"Type":"String"},"ThingGroupName":{"Type":"String","Default":            "          - !Sub '${Prefix}_${FleetOperator}_Group'          - >-            "},"serialNumber".....Share"


Question: Recommendations for Amazon's API Gateway 10MB payload limit

My customer wants to migrate their APIs on Amazon API Gateway.The challenge is that they have many downstream apps that post data to their APIs and there is a concern on the API Gateway 10MB payload limit.We are looking for recommendations on how to work around the 10MB payload limit with minimal change if possible to the downstream applications.FollowComment

Answer: 1Accepted AnswerSince 10MB is a hard limit on payload size for Amazon API Gateway we would recommend to the customer to examine HTTP Posting large files to S3 Pre-signed URLs.Uploading to S3 via a Pre-signed URL can be very similar to sending a POST request to API GW.The customer can use API Gateway to return an S3 Pre-signed URL in its response and then the application can use that URL in order to upload the data to S3.https://docs.aws.amazon.com/AmazonS3/latest/dev/PresignedUrlUploadObject.htmlCommentShareOren Reuvenianswered 3 years ago


Question: Why was my request denied?

"I don't agree with SES support, because my request to leave the sandbox was denied, I answered all the questions in the case, but it did not bring any results.Reconsider your decision please. Case id: 9471389061FollowCommentCarlos111 a year agoI have same issue, already 6 days trying to fix it and find out any support from AWS!Share"

Answer: "-5Hi, You can check the reason from below link :https://repost.aws/questions/QUO1mCvTNXQFOKYOJPTsM4_w/our-request-for-production-access-is-getting-deniedCommentShareJigar Shahanswered a year agoAWS-User-2472235 a year agoThanks for the answer, there are no problems with our account, the domain belongs to us and is clean, spam check listwe constantly check it for any listings in email spamlist, also all credit information is normal and is used only for this account.  We hoped for your help, but again we are convinced of your biased and unprofessional attitude towards your users.Share"


Question: Using xray on a Golang lambda function for Cognito

"Hi there,I was reading the official documentation on https://github.com/aws/aws-xray-sdk-go but not quite sure how can I add the Cognito client that is created on my lambda function to the service map and x-ray traces.import (    "context"    cognito "github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider"   "github.com/aws/aws-xray-sdk-go/xray")func GetClient() {...cfg, errCfg := config.LoadDefaultConfig(context.TODO())client := cognito.NewFromConfig(cfg)// the next line is not valid, because the function receives a *client.Client as a parameter// and my current client si of type *cognito.Client// the error is: cannot use client (variable of type *cognitoidentityprovider.Client) as *"github.com/aws/aws-sdk-go/aws/client".Client value in argument to xray.AWSxray.AWS(client)...}I appreciate your advice.FollowComment"


Question: Internet facing NLB

Why NLB needs to be internet-facing?FollowComment

Answer: "2NLB can be internal facing too.However, there are certain instances where customers want to have internet-facing NLB, just to name a few -The application might require high throughput and ultra low latency. In that regard NLB does offer better performance in certain scenarios;Some companies and applications require end to end encryption and customer does not feel comfortable putting certificate in ALB. NLB enable end-to-end encryption without terminating TLS at the load balancer level.Customer might have applications built on a custom L4 protocol.CommentShareJason_Sanswered a year ago"


Question: cloudwatch or cloudtrail for lambda passrole attack

"We have one aws user has passrole, lambda invoke and create inline policy, we suspect this user use lambda script to passrole and attach awsadminaccess policy to his account, how can we identify this? through cloudwatch or cloudtrail? if through cloudtrail, how would we know the lamda script he invoke is malicious and how to track role change for this IAM account giving date range? thanksFollowComment"

Answer: "0For sensitive questions, I'd reach out to AWS Support for help as well.For AWS Management API calls including IAM Changes such as:AttachRolePolicyPutRolePolicy (Inline Policy on a Role) like you've seen:More information about CloudTrail Logging: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.htmlIn Cloudtrail, you can filter by dates and search by Events as well.  For checking the Lambda, you can check Invocation of the Lambda (Lambda being run as well).There are some AWS Services that offer checks like that such as AWS Config: https://docs.aws.amazon.com/config/latest/developerguide/iam-policy-no-statements-with-admin-access.html, but you may want to evaluate the cost of those services as well.For information about to do with suspected compromise, read here: https://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/.CommentSharejsoncanswered a year agoMaulik_Makadiya a year agoI have found wired thing today.   I have attached one policy in one of the user and trying to find the activity of that but not able to find it in cloudtrail. no idea why.Share0Hi, I checked the cloudtrail, I define the time range, then i search event name: attachrolepolicy.i want to further restricted by user or other criteria, how to do? it only allow me to search one criterial for example Event nameCommentShareAWS-User-7030422answered a year agoMaulik_Makadiya a year agoHi There, Great, You can enable Trail under CloudTrail and it will then push all the logs in Cloudwatch. After doing so, you will be able to run queries using Athena and you can use various "where" condition similar to SQL queries.Other quick option is, from the "Event history" grid where you are searching logs, you can directly click "Create Athena Table" and it will redirect you to that query session where you can use "Select" query to search logs.Share"


Question: QuickSight stop showing me option to save & send email report now.

"Last week when setting (sharing) QS dashboard via email report, it allowed me to send the report now. Nevertheless the option is no longer available. Any thoughts why this might be happening?FollowComment"

Answer: "1For me, when this has happened it is because I'm in an Analysis instead of a Dashboard. You can only send e-mail reports from a Dashboard.CommentShareAaron Edellanswered 10 months ago0Reports include settings for when to send them, the contents to include, and who receives the email. You can view a sample report and a list of the datasets used in the report. To set up or change the report sent from a dashboard, make sure that you're an owner or co-owner of the dashboard.If you have access to the dashboard, you can change your subscription options by opening your view of the dashboard. For more information on how this works, see Subscribing to email reports -- https://docs.aws.amazon.com/quicksight/latest/user/subscribing-to-reports.html -- [1]Scheduling options that are available for an email report include the following:Send once (Does not repeat) – Sends the report only once at the date and time that you choose.Repeat once a day – Reports daily at the same time.Repeat once a week – Reports each week on the same day at the same time.Repeat once a month – Repeats each month on the same day of the month at the same time.If you choose to repeat the report, the schedule recurs at the same time and day based on the interval that you choose. For example, suppose that you choose to send your first report August 1 at 9 AM, and you choose that the report repeat once a month. In this case, the second report is sent September 1 at 9 AM. If you choose once a week, the day of the week August 1 falls on is the day that the report repeats, at the same time the first one sends.Hope this helps. Please click accept answer if this helped you.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago"


Question: HTTPS request on Lambda very slow on first request

"Hi,I am making HTTPS POST request to an API. The first request I make will take somewhere between 30-130 seconds. The subsequent request only takes 2-300 ms. This API handles millions of requests every day, so the problem does not seem to be in the API.My simple test code: const https = require('https');const acquire = (data, options) => {  return new Promise((resolve, reject) => {    options.headers['Content-Length'] = data.length;    const req = https.request(options, (res) => {      console.log("REQ compl")      res.on('data', (data) => {        console.log(data)        resolve(data)      });    });    req.on ('error', (error) => {      console.log("error", error)    })    req.write(data);    req.end();  })}const release = (data, options) => {  return new Promise((resolve, reject) => {    options.headers['Content-Length'] = data.length;    const req = https.request(options, (res) => {      console.log("REQ compl")      res.on('data', (data) => {        console.log(data)        resolve(data)      })    });    req.on ('error', (error) => {      console.log("error", error)    })    req.write(data);    req.end();  })}const data = `<methodCall>  <methodName>acquire_token</methodName>  <params>    <param>      <value>        <string>KS034</string>      </value>    </param>    <param>      <value>        <string>password</string>      </value>    </param>    <param>      <value>        <string>secret string</string>      </value>    </param>  </params></methodCall>`const options = {  hostname: 'wired.wubook.net',  port: 443,  path: '/xrws/',  method: 'POST',  headers: {    'Content-Type': 'text/xml',    'Connection': 'keep-alive',    'Content-Length': 0  }}exports.handler = async (event) => {  let resa = 'aaa';  let resb = '';      await acquire(data, options).then(res => {    xmlrpc.CustomType.call()    res = res.toString();    console.log("acquire complete")    var start = res.indexOf("<string>");    var end = res.indexOf("</string>");    // resa = JSON.stringify(res);    resa = res.substring(start + 8, end)  });  const data1 = `<methodCall>    <methodName>release_token</methodName>    <params>      <param>        <value>          <string>${resa}</string>        </value>      </param>    </params>  </methodCall>`  await release(data1, options).then(res => {    resb = res;    console.log("release complete")  });  const response = {    statusCode: 200,    body: JSON.stringify('Hello from Lambda!' + resa + resb)  }  return response;};Is there anything that can explain this behavior? I have tried the XMLRPC client for NodeJS as well; the result is the same unfortunately.Thank you very much!Edited by: KasperS on Jan 21, 2020 11:49 AMFollowComment"

Answer: 0It was a problem with the APICommentShareKasperSanswered 2 years ago


Question: Why AWS charge me by the month when I choose annual subscription?

I subscribed to the AWS annual plan but I am getting charges every month 29 dollars.  If you subscribe annually that supposed to save you 2 monthly payments. I subscribed because I am learning and studying for SAA certification. What can I do?FollowComment

Answer: "0I subscribed to skill builder, since I already have the cloud practitioner certification (I used the free resources), but to study and prepare for SAA all the options are subscription only.Should I cancel my subscription and look in other place ?CommentSharerePost-User-0599447answered 5 months agoNataliya_G EXPERT4 months agoAh, sorry, I thought you were asking about using AWS services / launching resources / etc. From learning perspective - it's completely up to you, and depending which goals you are after. It's OK if you don't want to continue paying monthly subscription, in that case you can cancel it, and look for other courses, for example from partners, or other available resources (some might be free).Share0Can you share more info which subscription you mean? AWS services are mostly charged on-demand, you pay for what you use, and when you open new account, you have some services included in the Free Tier model where you run and test resources for free. If you start using AWS on a regular basis for example for production, there are payment models for some usage types like EC2 instances (Reserved Instances or Savings Plans) where you can make an annual commitment and save costs on your EC2 bills. And there are annual subscriptions in some cases for AWS Marketplace products (partner solutions) which I wouldn't believe you should subscibe to when you're just learning and testing...If you say you are charged $29 monthly, this sounds like a Developer support plan: https://aws.amazon.com/premiumsupport/pricing/ - if you only use AWS for learning and testing, you will most likely not need a support plan, as you will likely not need to reach out to Permium Support for any issues with your services - you can still submit support cases to Customer Service (account & billing support) for free without any paid plan. You can cancel your support plan any time from your account.CommentShareEXPERTNataliya_Ganswered 5 months ago"


Question: "EC2s Development and Production Environments, Isolation, VPN, API GW, Private and Public Endpoints with RDS and Data Sanitization"

"Hi Everyone,I have the following idea for an infrastructure architecture in AWS but I believe that I need some help with clarifying several issues which I believe, the best answers to will come from here.I am thinking about the following layout:In production:an EC2 with Apache that provides service portal for web usersan RDS for the sake of the portalanother EC2 with Apache and business-logic php application as CRMthe same RDS will be used by the CRM application as wellIn development:The same layout, with 1 EC2 for web client services, 1 EC2 for the sake of developing the CRM and an RDS for the dataI thought about using two different VPCs for the sake of this deployment.I need data replication with sanitization from the production RDS to the development RDS (thinking either by SQL procedures or other method, didn't think about that yet, but I know I need it to be like that since I have no desire to enable my developers to work with real client data).Both the production and development CRM EC2s are exposing Web APIsBoth the production and development service portals are exposing Web APIsBoth the production and development CRM and service portal are web accessibleFor the development environment I want to enable access (Web and Web APIs) only through VPN, hence, I want my developers to connect with VPN clients to the development VPC with VPN and work against both EC2s on-top of that connection. I also want them to be able to test all APIs and thinking about setting an API Gateway on that private endpoint.For the production environment, I want to enable access (Web and Web APIs) to the CRM EC2 through VPN, hence, I want my business units to connect with their VPN clients to a production VPN gateway, and work against the CRM on-top of that connection. I don't want to expose my CRM to the world.For the production environment, I want to enable everyone on the internet (actually, not everyone, I want to Geo-Block access to the service portal, hence, I do believe I need Amazon CDN services enabled for that cause) to access the service portal, still, I want to enable an API Gateway for the Web APIs that are exposed by this service portal EC2.I've been reading about Amazon API gateway (and API Gateway Cache) and it's resource policy and VPC endpoints with their own security groups and Amazon Route 53 resolver for the sake of VPN connections. I also been reading lots about Amazon virtual private gateway and a private and public endpoints, but, I still can't figure-out with element comes to play where and how the interactions should be design for those elements.I believe I also need Amazon KMS for the keys, certificates and passwords, but, I'm still trying to figure out the right approach for the above, so, I'm leaving the KMS part for the end.of course I'm thinking about security at the top of my concerns, so, I do believe all connectivity's should be harden in-between the elements, is only using ACLs is the right way to go!?I would really appreciate the helpFollowComment"

Answer: 0There's a lot of ground to cover here; but in short: You're heading in the right direction for the solution you're proposing. Given the scope of this particular question I'd strongly encourage you to reach out to your local AWS Solutions Architect to discuss this because I think an in-person (or virtual even) discussion would be an excellent use of your time as there will likely be a lot of other nuances that get dragged out of the conversation.To answer the question at the end of your post: I would be using Security Groups as much as possible and only use NACLs where necessary. Security Groups can be customised for each instance (if necessary) whereas NACLs are only applied at a subnet level. It's easy to get over-complicated with NACLs then forget that they're there - then when new things are introduced to the environment they break.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: Time Duration to Setup Server less Aurora V2 Postgre SQL database cluster

"Just trying to figure out the time duration to setup the "Time Duration to Setup Server less Aurora V2 Postgre SQL database cluster" with single DB instance in a private subnet "Default settings", single availability zone cluster, no replica to be created basic backup retention.FollowComment"

Answer: "0Hi there!From the notes, I understand you are trying to figure out the time duration to setup the “Server less Aurora V2 Postgres SQL database cluster.” Please correct me if I’m wrong.Please note that there is no ETA (estimated time) on how long the duration for the setup can take, as it can depend on multiple factors e.g. the instance class of your DB instance, and internet connectivity. In your case, since you mentioned that you creating a basic set-up with default settings, I would recommend that you test on your side to get the estimated time.For more information on Aurora Serverless V2, you can check [1].Hope you find the above information helpful.Have a great day ahead!References:[1] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v2.htmlCommentShareLettyanswered a year ago"


Question: Forecast Aurora Storage IO costs

"My customer already has a regular RDS instance and thinking about elevating to Aurora for better MAZ/RR dual purposing.I would like to use metrics from their existing RDS to forecast the aurora storage IO cost?I am thinking something like thisCloudwatchVolume Read IOPsVolume Write IOPsSum over 30 daysHowever, I am unsure if the metrics stored in cloudwatch have the right data to use as an estimate for aurora.I am concerned the statistics CW captures current IOPs @ at a point in time (not ideal for aurora), or is cloudwatch capturing the sum of IOPs between and including points in time(ideal for aurora)What’s the best approach here?FollowComment"

Answer: "0Accepted AnswerNot sure about the accuracy of the estimate you are looking, but if you're looking for a ballpark figure, this calculation I use seems to match the AWS cost calculator estimates.The most difficult part is calculating the average IOs per day, as this number fluctuates. If you can approximate that on a daily basis, then:Total monthly IO cost = ((Average Read IOPS + Average Write IOPS)*86400*30)/1000000 x {cost per million IO-month}For example: for a system that does 250 Read IOPS and 500 Write IOPS per day, at $0.20 per million IOs/month = $388.80Again, this is a ballpark figure made with those assumptions. This number would be accurate if we could sum-aggregate the number of IOs per day.CommentShareAWS-User-5294568answered 3 years ago0Here is a deep dive on the Aurora-specific reasons why there could be different numbers of I/Os in Aurora than in RDS: https://aws.amazon.com/blogs/database/planning-i-o-in-amazon-aurora/The way Aurora batches together the I/O operations could reduce the number of I/Os substantially from what you see in RDS. Certain features like Aurora PostgreSQL cluster cache management or Aurora parallel query could bump the I/O number back up somewhat. X2 instances have twice as much RAM as the comparable R instances and so can have bigger buffer caches; that can be another way to bring the I/O numbers down.CommentShareAWS-User-0081273answered 2 months ago"


Question: single AZ or multi-AZ?

what's your strategy?do you copy instance AMIs to at least one AZ other than the main AZ where the instances are running?what's the risk factor?  likelihood of aws losing an entire AZ!?thank youFollowComment

Answer: "0Hi,Your AMIs are already spread across three AZs in your region upon creation. When you select an EC2 instance, and select 'Image->Create Image' and specify the Image Name, and then click "Create Image" button. Then, that Image becomes available in the "IMAGES->AMIs". This AMI is a snapshot of your EC2 instance. (as opposed to an EBS snapshot). This AMI snapshot is stored in a "special" S3 bucket. By default S3 buckets store data across a minimum of 3 AZs in an S3 Region.Hope this helps.-randyCommentShareRandyTakeshitaanswered 4 years ago0clear feedback randy - many thanks.for a region like us-west, there are only 2 AZs, Oregon and Northern Cal.if both AZs are unresponsive then we can consider the AMIs gone. correct?would be nice if aws came up with a virtual/geoless region :)the "i don't care where it is but aws knows where to find it when i need it" region.CommentShareraffi saroyananswered 4 years ago0Actually, Oregon and Northern Cal are two separate regions.o Oregon (us-west-2) has 4 Availability Zoneso Northern Cal (us-west-1) has 2 Availability ZonesSo, yes, if the Big One on the San Andreas fault finally causes California to disappear... Your AMIs in region us-west-1 with 2 Availability Zones might disappear for good :-)If that is a major concern, it is very easy to just select the AMI image and copy it to a different Destination region for backup.-randyCommentShareRandyTakeshitaanswered 4 years ago0CommentShareraffi saroyananswered 4 years ago"


Question: CodeBuild failing with invalidParameterError on build with a valid parameter given

"I'm trying to create a lambda layer in serverless and have it deploy to AWS creating the lambda layer for use in other deployments.However I'm running into an issue where the "Lambda:PublishLayerVersion" is failing because of CompatibleArchitectures. I'm wondering if its possible that there was a mistake that I'm missing or its serverless having an issue because Action is using a lowercase 'p' for "Lambda:publishLayerVersion" when the docs here: https://docs.aws.amazon.com/lambda/latest/dg/API_PublishLayerVersion.html states it is "Lambda:PublishLayerVersion".It is also likely that the SDK error is legitimate that the param "CompatibleArchitectures" isn't supported in "us-west-1" but I have a hard time finding docs to tell me what is supported in different regions.serverless.yml Spec:provider:  name: aws  runtime: python3.8  lambdaHashingVersion: 20201221  region: us-west-1  stage: ${opt:stage, 'stage'}  deploymentBucket:    name: name.serverless.${self:provider.region}.deploys  deploymentPrefix: serverless  iamRoleStatements:     - Effect: Allow      Action:        - s3:PutObject        - s3:GetObject      Resource: "arn:aws:s3:::name.serverless.${self:provider.region}/*"    - Effect: Allow      Action:        - cloudformation:DescribeStacks      Resource: "*"    - Effect: Allow      Action:        - lambda:PublishLayerVersion      Resource: "*"layers:  aws-abstraction-services-layer:    # name: aws-abstraction-services-layer    path: aws-abstraction-layer    description: "This is the goal of uploading our abstractions to a layer to upload and use to save storage in deployment packages"    compatibleRuntimes:      - python3.8    allowedAccounts:      - '*'plugins:  - serverless-layers  - serverless-python-requirementsOutput of build log[Container] 2022/04/12 17:14:41 Running command serverless deployRunning "serverless" from node_modulesDeploying aws-services-layer to stage stage (us-west-1)[ LayersPlugin ]: => default... ○ Downloading requirements.txt from bucket...... ○ requirements.txt The specified key does not exist..... ○  Changes identified ! Re-installing...... ○ pip install -r requirements.txt -t . ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.aws-sam-cli 1.40.1 requires requests==2.25.1, but you have requests 2.27.1 which is incompatible.WARNING: Running pip as root will break packages and permissions. You should install packages reliably by using venv: https://pip.pypa.io/warnings/venvWARNING: You are using pip version 21.1.2; however, version 22.0.4 is available.You should consider upgrading via the '/root/.pyenv/versions/3.8.10/bin/python3.8 -m pip install --upgrade pip' command.Collecting requests  Downloading requests-2.27.1-py2.py3-none-any.whl (63 kB)Collecting charset-normalizer~=2.0.0  Downloading charset_normalizer-2.0.12-py3-none-any.whl (39 kB)Collecting certifi>=2017.4.17  Downloading certifi-2021.10.8-py2.py3-none-any.whl (149 kB)Collecting idna<4,>=2.5  Downloading idna-3.3-py3-none-any.whl (61 kB)Collecting urllib3<1.27,>=1.21.1  Downloading urllib3-1.26.9-py2.py3-none-any.whl (138 kB)Installing collected packages: urllib3, idna, charset-normalizer, certifi, requestsSuccessfully installed certifi-2021.10.8 charset-normalizer-2.0.12 idna-3.3 requests-2.27.1 urllib3-1.26.9... ○ Created layer package /codebuild/output/src847310000/src/.serverless/aws-services-layer-stage-python-default.zip (0.8 MB)... ○ Uploading layer package...... ○ OK...ServerlessLayers error:    Action: Lambda:publishLayerVersion    Params: {"Content":{"S3Bucket":"name.serverless.us-west-1.deploys","S3Key":"serverless/aws-services-layer/stage/layers/aws-services-layer-stage-python-default.zip"},"LayerName":"aws-services-layer-stage-python-default","Description":"created by serverless-layers plugin","CompatibleRuntimes":["python3.8"],"CompatibleArchitectures":["x86_64","arm64"]}AWS SDK error:    CompatibleArchitectures are not supported in us-west-1. Please remove the CompatibleArchitectures value from your request and try again[Container] 2022/04/12 17:14:47 Command did not exit successfully serverless deploy exit status 1[Container] 2022/04/12 17:14:47 Phase complete: BUILD State: FAILED[Container] 2022/04/12 17:14:47 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: serverless deploy. Reason: exit status 1[Container] 2022/04/12 17:14:47 Entering phase POST_BUILD[Container] 2022/04/12 17:14:47 Phase complete: POST_BUILD State: SUCCEEDED[Container] 2022/04/12 17:14:47 Phase context status code:  Message: FollowComment"

Answer: "0The failure is caused neither by AWS CodeBuild nor by serverless.This error message originates from the AWS Lambda service. For some regions, the support of arm64 architecture has not been activated yet. You can contact AWS Support for details.You can also read this blog post.You can use Lambda Functions powered by Graviton2 processor today in US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Frankfurt), Europe (Ireland), EU (London), Asia Pacific (Mumbai), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo).CommentShareDmitry Balabanovanswered a year ago"


Question: "How To delete an AWS Organisations, that did not complete phone pin verification"

"Hello, i made accidentialy an invitation to AWS Organizatons (instead of IAM Account XD)I asked the owner many time, to finish the registration, so that i could delete these wrong account. He does not finish it and i think he won't to it. The Owner of the wrong invited Organisation ist NOT Member of our Company.so: How can i remove this account from our company? The support is just telling me, i shall advise the owner of the mail adress, to complete the process. But i think, he won't do this.The invitation was accidental and I do not want to accept any costs or liability for what the owner of the email address is doing, as the invitation was not intended. Please help me to delete this organization. Without their help, the registration process will not be completed and without their help I will not be able to delete the organization.What can i do? :(FollowComment"

Answer: "0Hi - how long ago did you send this invitation?Per > the documentation, < "Each invitation must be responded to within 15 days, or it expires."If it's only been a few days, monitor the situation: if the org joins, you can delete it; if the org doesn't join, it deletes in a couple of weeks. Would ensure you haven't granted it any permissions in your security profiles, and potentially set a policy block against whatever identifier you have for them.CommentShareDan_Hanswered a year ago"


Question: IAM Identity Center Applications Metadata

"It seems there is currently no way to create applications in IAM Identity Center programmatically but is there any way that the metadata for an already created application can be fetched programmatically? I have checked the cli and neither aws sso or aws sso-admin has an option for applications, and the same goes for boto3.Is this just not possible yet?FollowCommentns-simon 2 months agoWere you able to find anything? I came here to ask the same question.We are specifically looking for a way to list the users who have been granted access to an IAM IC-enabled application so we can automate the provisioning of those users into said application. Using IAM groups isn't always an option (say if you federate with Azure AD and your E3 license precludes the provisioning of groups...bummer).Share"

Answer: "0Unfortunately not. The console is the only method I have been able to find thus far.CommentShareBobkanswered 2 months agons-simon 2 months agoFWIW, we were recently talking with AWS support and they recommended that we use Cognito instead of IAM Identity Center. It does have some benefits, such as the ability to mix/match local pool users, federated users, as well as user aliasing.If you are using Shibboleth (like us), prepare to pull you hair out...Share"


Question: Jupyter hub can't start user server due to botocore.exceptions.NoCredentialsError: Unable to locate credentials

"Hello,I am facing a very frustrating problem, Jupyter Hub is showing up the main page and after logging in with default jovyan/jupyter credentials I cannot start a notebook server.I setup an EMR cluster with Jupyter Hub, Spark, Livy, Hadoop and Tensorflow. EMR version is 6.10I update some of the packages by adding a bootstrap.sh file with the following:#!/bin/bashsudo python3 -m pip install -U setuptoolssudo python3 -m pip install -U pipsudo python3 -m pip install wheelsudo python3 -m pip install pillowsudo python3 -m pip install pandassudo python3 -m pip install pyarrowsudo python3 -m pip install boto3sudo python3 -m pip install s3fssudo python3 -m pip install fsspecthe Jupyter configuration in the application config is :[  {    "Classification": "jupyter-s3-conf",    "Properties": {      "s3.persistence.bucket": "pao-emr-bucket",      "s3.persistence.enabled": "true"    }  }]The logs i get from the Docker container running jupyter hub are :[I 2023-04-07 16:14:47.900 JupyterHub provider:574] Creating oauth client jupyterhub-user-jovyan[I 2023-04-07 16:14:47.928 JupyterHub spawner:1483] Spawning jupyterhub-singleuser --port=36543 --debug[D 2023-04-07 16:14:48.676 SingleUserNotebookApp application:190] Searching ['/home/jovyan/.jupyter', '/home/jovyan/.local/etc/jupyter', '/opt/conda/etc/jupyter', '/usr/local/etc/jupyter', '/etc/jupyter'] for config files[D 2023-04-07 16:14:48.676 SingleUserNotebookApp application:902] Looking for jupyter_config in /etc/jupyter[D 2023-04-07 16:14:48.676 SingleUserNotebookApp application:902] Looking for jupyter_config in /usr/local/etc/jupyter[D 2023-04-07 16:14:48.676 SingleUserNotebookApp application:902] Looking for jupyter_config in /opt/conda/etc/jupyter[D 2023-04-07 16:14:48.676 SingleUserNotebookApp application:902] Looking for jupyter_config in /home/jovyan/.local/etc/jupyter[D 2023-04-07 16:14:48.676 SingleUserNotebookApp application:902] Looking for jupyter_config in /home/jovyan/.jupyter[D 2023-04-07 16:14:48.677 SingleUserNotebookApp application:902] Looking for jupyter_notebook_config in /etc/jupyter[D 2023-04-07 16:14:48.798 SingleUserNotebookApp application:923] Loaded config file: /etc/jupyter/jupyter_notebook_config.py[D 2023-04-07 16:14:48.798 SingleUserNotebookApp application:902] Looking for jupyter_notebook_config in /usr/local/etc/jupyter[D 2023-04-07 16:14:48.799 SingleUserNotebookApp application:902] Looking for jupyter_notebook_config in /opt/conda/etc/jupyter[D 2023-04-07 16:14:48.799 SingleUserNotebookApp application:902] Looking for jupyter_notebook_config in /home/jovyan/.local/etc/jupyter[D 2023-04-07 16:14:48.799 SingleUserNotebookApp application:902] Looking for jupyter_notebook_config in /home/jovyan/.jupyter[D 2023-04-07 16:14:48.799 SingleUserNotebookApp notebookapp:1702] Raising open file limit: soft 1024->4096; hard 65536->65536[D 2023-04-07 16:14:48.800 SingleUserNotebookApp s3manager:107] s3manager._validate_bucket: User provided bucket: pao-emr-bucket[I 2023-04-07 16:14:48.891 JupyterHub log:189] 302 GET /hub/spawn/jovyan -> /hub/spawn-pending/jovyan (jovyan@::ffff:172.31.33.43) 1004.81ms[I 2023-04-07 16:14:48.932 JupyterHub pages:402] jovyan is pending spawn[D 2023-04-07 16:14:49.838 SingleUserNotebookApp s3_fs:247] S3FS.unprefix: self.prefix_: pao-emr-bucket/jupyter/jovyan path: ['.s3keep'][D 2023-04-07 16:14:49.838 SingleUserNotebookApp s3_fs:174] S3contents.S3FS: Making dir: `pao-emr-bucket/jupyter/jovyan/.s3keep`Traceback (most recent call last):  File "/opt/conda/bin/jupyterhub-singleuser", line 10, in <module>    sys.exit(main())  File "/opt/conda/lib/python3.9/site-packages/jupyter_core/application.py", line 277, in launch_instance    return super().launch_instance(argv=argv, **kwargs)  File "/opt/conda/lib/python3.9/site-packages/traitlets/config/application.py", line 1042, in launch_instance    app.initialize(argv)  File "/opt/conda/lib/python3.9/site-packages/jupyterhub/singleuser/mixins.py", line 852, in initialize    result = super().initialize(*args, **kwargs)  File "/opt/conda/lib/python3.9/site-packages/jupyterhub/singleuser/mixins.py", line 573, in initialize    return super().initialize(argv)  File "/opt/conda/lib/python3.9/site-packages/traitlets/config/application.py", line 113, in inner    return method(app, *args, **kwargs)  File "/opt/conda/lib/python3.9/site-packages/notebook/notebookapp.py", line 2147, in initialize    self.init_configurables()  File "/opt/conda/lib/python3.9/site-packages/notebook/notebookapp.py", line 1660, in init_configurables    self.contents_manager = self.contents_manager_class(  File "/opt/conda/lib/python3.9/site-packages/s3contents/s3manager.py", line 52, in __init__    self._fs = S3FS(  File "/opt/conda/lib/python3.9/site-packages/s3contents/s3_fs.py", line 97, in __init__    self.init()  File "/opt/conda/lib/python3.9/site-packages/s3contents/s3_fs.py", line 101, in init    self.mkdir("")  File "/opt/conda/lib/python3.9/site-packages/s3contents/s3_fs.py", line 175, in mkdir    self.fs.touch(path_)  File "/opt/conda/lib/python3.9/site-packages/s3fs/core.py", line 511, in touch    self._call_s3(self.s3.put_object, kwargs, Bucket=bucket, Key=key)  File "/opt/conda/lib/python3.9/site-packages/s3fs/core.py", line 200, in _call_s3    return method(**additional_kwargs)  File "/opt/conda/lib/python3.9/site-packages/botocore/client.py", line 386, in _api_call    return self._make_api_call(operation_name, kwargs)  File "/opt/conda/lib/python3.9/site-packages/botocore/client.py", line 691, in _make_api_call    http, parsed_response = self._make_request(  File "/opt/conda/lib/python3.9/site-packages/botocore/client.py", line 711, in _make_request    return self._endpoint.make_request(operation_model, request_dict)  File "/opt/conda/lib/python3.9/site-packages/botocore/endpoint.py", line 102, in make_request    return self._send_request(request_dict, operation_model)  File "/opt/conda/lib/python3.9/site-packages/botocore/endpoint.py", line 132, in _send_request    request = self.create_request(request_dict, operation_model)  File "/opt/conda/lib/python3.9/site-packages/botocore/endpoint.py", line 115, in create_request    self._event_emitter.emit(event_name, request=request,  File "/opt/conda/lib/python3.9/site-packages/botocore/hooks.py", line 356, in emit    return self._emitter.emit(aliased_event_name, **kwargs)  File "/opt/conda/lib/python3.9/site-packages/botocore/hooks.py", line 228, in emit    return self._emit(event_name, kwargs)  File "/opt/conda/lib/python3.9/site-packages/botocore/hooks.py", line 211, in _emit    response = handler(**kwargs)  File "/opt/conda/lib/python3.9/site-packages/botocore/signers.py", line 90, in handler    return self.sign(operation_name, request)  File "/opt/conda/lib/python3.9/site-packages/botocore/signers.py", line 162, in sign    auth.add_auth(request)  File "/opt/conda/lib/python3.9/site-packages/botocore/auth.py", line 373, in add_auth    raise NoCredentialsError()botocore.exceptions.NoCredentialsError: Unable to locate credentialsTask exception was never retrievedfuture: <Task finished name='Task-2072' coro=<BaseHandler.spawn_single_user() done, defined at /opt/conda/lib/python3.9/site-packages/jupyterhub/handlers/base.py:796> exception=HTTPError()>Traceback (most recent call last):  File "/opt/conda/lib/python3.9/site-packages/jupyterhub/handlers/base.py", line 996, in spawn_single_user    await gen.with_timeout(asyncio.exceptions.TimeoutError: TimeoutDuring handling of the above exception, another exception occurred:Traceback (most recent call last):  File "/opt/conda/lib/python3.9/site-packages/jupyterhub/handlers/base.py", line 1030, in spawn_single_user    raise web.HTTPError(tornado.web.HTTPError: HTTP 500: Internal Server Error (Spawner failed to start [status=1]. The logs for jovyan may contain details.)[W 2023-04-07 16:15:16.037 JupyterHub user:767] jovyan's server never showed up at http://127.0.0.1:36543/user/jovyan/ after 30 seconds. Giving up[E 2023-04-07 16:15:16.066 JupyterHub gen:630] Exception in Future <Task finished name='Task-2073' coro=<BaseHandler.spawn_single_user.<locals>.finish_user_spawn() done, defined at /opt/conda/lib/python3.9/site-packages/jupyterhub/handlers/base.py:900> exception=TimeoutError("Server at http://127.0.0.1:36543/user/jovyan/ didn't respond in 30 seconds")> after timeout    Traceback (most recent call last):      File "/opt/conda/lib/python3.9/site-packages/tornado/gen.py", line 625, in error_callback        future.result()      File "/opt/conda/lib/python3.9/site-packages/jupyterhub/handlers/base.py", line 907, in finish_user_spawn        await spawn_future      File "/opt/conda/lib/python3.9/site-packages/jupyterhub/user.py", line 748, in spawn        await self._wait_up(spawner)      File "/opt/conda/lib/python3.9/site-packages/jupyterhub/user.py", line 795, in _wait_up        raise e      File "/opt/conda/lib/python3.9/site-packages/jupyterhub/user.py", line 762, in _wait_up        resp = await server.wait_up(      File "/opt/conda/lib/python3.9/site-packages/jupyterhub/utils.py", line 236, in wait_for_http_server        re = await exponential_backoff(      File "/opt/conda/lib/python3.9/site-packages/jupyterhub/utils.py", line 184, in exponential_backoff        raise TimeoutError(fail_message)    TimeoutError: Server at http://127.0.0.1:36543/user/jovyan/ didn't respond in 30 seconds[I 2023-04-07 16:15:16.067 JupyterHub log:189] 200 GET /hub/api/users/jovyan/server/progress (jovyan@::ffff:172.31.33.43) 27067.75msApparently botocore.exceptions.NoCredentialsError: Unable to locate credentials is what's making the problem but I cannot get to fix it, could you please help ?Thank in advanceFollowComment"


Question: AWS NoSQL Workbench log4j

Can you point me to someone that can confirm for a customer that NoSQL Workbench is not using Log4j?FollowComment

Answer: "1Accepted AnswerNoSQL Workbench is an electron app and doesn't use Java so wouldn't be vulnerable to log4j. You can download the source code here: https://aws.amazon.com/nosql/nosql-workbench-license/source-code-notice/CommentShareChris Pollardanswered a year agoTim Seyfried a year agoIn the documentation, it says JavaScript is used.Can you clarify if it is vulnerable to the log4j issue?Documentation:https://www.electronjs.org/docs/latest/What is Electron?Electron is a framework for building desktop applications using JavaScript, HTML, and CSS. By embedding Chromium and Node.js into its binary, Electron allows you to maintain one JavaScript codebase and create cross-platform apps that work on Windows, macOS, and Linux — no native development experience required.ShareChris Pollard a year agolog4j is a vulnerability that affects a Java dependency. Javascript is different from Java and a JavaScript program cannot depend on the Java log4j library. Therefore, NoSQL Workbench is not vulnerable to the log4j issue.Share"


Question: Can I record the video of a Chime video conference?

A customer is interested in using Chime as a tool to scheduling and conducting interviews with 1500 industry contacts to build up a series of podcasts. They particularly wanted to get away from Skype and wanted to know if Chime had a the features and recording quality to support their use-case.FollowComment

Answer: "0Accepted AnswerWhile Chime does provide meeting recording capabilities, it only records the audio and screen sharing (if initiated). It does not record the user video shared during a meeting so it does not seem to be a fit for this customer’s use case.CommentSharePhil_Sanswered 4 years ago"


Question: SES Logging to CloudWatch

"I inherited an SES that was set up by someone earlier.  In the Configuration Set, there's lots of CloudWatch logs mentioned, basically one for every type of event.  The basic one is called SES_log.In Cloudwatch, there is a Log Group called SES_log, but it's empty.  I tried adding a stream named SES_log inside it to it to see if that was why nothing is showing up in the log, but that did nothing.I have been testing using the aws cli, explicitly specifying the Configration Set with the --configuration-set-name parameter, and the emails I've been sending arrive in moments, but nothing gets logged.FollowComment"

Answer: "0Aha!  I found the answer.  I also found that many other people came to the same incorrect conclusion that I had.  I was expecting something to show up in Log Groups, like an actual log of the messages.Instead, what happens is that in the Metrics section of CloudWatch there's an SES item which shows counts of the messages which have come through of each type (bounce, click, etc.).My predecessor must have created a log group called SES_log on the mistaken assumption that he needed to prime the pump, as it were.The actual solution to the problem appears to be using Firehose, I think.CommentSharewritchkraphtanswered 3 years ago"


Question: Custom Amazon SageMaker container registration and deployment tracking

My customer asks that:Container images must be registered and deployments trackedContainers must be registered within a private customer-owned registry prior to deploymentOnly registered containers are to be deployed.Part of the registration process must include verification the containers have comes from a trusted source and that they have been scanned and found to be free of malware and vulnerabilities.An inventory of all deployed containers must be maintained at all times.The inventory must include:Software installed within the containerversion of all software and patch level. Where the container has been deployed. Owner of the containerDo we do any of these? Please provide documentation on AWS/SageMaker vs custom container provider's responsibilities.FollowComment

Answer: "0Accepted AnswerAmazon Elastic Container Registry (Amazon ECR) enables customers to store images, secure their images using AWS Identity and Access Management (IAM), and scan their containers for vulnerabilities. Open Policy Agent (OPA) is an open-source project focused on codifying policy such as the approved image registries. OPA is integrated with Kubernetes via Gatekeeper, an admission controller that checks if the image is from an approved registry prior to allowing it to be deployed on the cluster. For more details see: https://aws.amazon.com/blogs/containers/designing-a-secure-container-image-registryCommentShareEXPERTMahesh_Vanswered 2 years ago"


Question: Redshift stored procs best practice for transactions locking tables and avoiding serialization isolation violations

"I am facing occasional concurrency issues resulting in Serialization isolation violations where an sproc is invoked simultaneously for different tasks where the pseudo code for sp_main looks like --BEGINLOCK process_table ; -- has an IDENTITY event_idINSERT process_table VALUES(var_work, GETDATE()) ;SELECT INTO var_eid MAX(event_id) FROM process_table ;COMMIT ;END ;IF var_work = 'do_lots' THENCALL sp_slow_proc ; -- Perform lots of slower statements that do not reference process_tableELSECALL sp_quick_proc ; -- inserts new rows to process_table using a BEGIN LOCK COMMIT END constructEND IF ;BEGINLOCK process_table ;UPDATE process_table SET ended_at = GETDATE() WHERE event_id = var_eid ;COMMIT ;END ;It seems the slow running process always the one that chokes! I'm 99% confidant this can happen even if the fast process has finished (airflow job concluded having started after the slow process was commenced).Questions are:#1. is this an expected code layout ?#2. should the LOCK move outside the BEGIN END ?#3. when is a LOCK released - on COMMIT or ???FollowComment"

Answer: "0In Redshift, explicitly locking using the lock command is acquired in "ACCESS EXCLUSIVE" mode and is released when the transaction that contains the LOCK command completes.To determine which transactions might be facing/causing serialization isolation error, you can refer system table STL_TR_CONFLICT , which has information to identify transaction conflicts that result from serializable isolation errors ->https://docs.aws.amazon.com/redshift/latest/dg/r_STL_TR_CONFLICT.htmlBased on which , you should get-> a tablename( by determining the locks using svv_transactions and the associated relation id  , which can then be used to determine table name in svv_table_info )---****-> https://docs.aws.amazon.com/redshift/latest/dg/r_SVV_TRANSACTIONS.html-> https://docs.aws.amazon.com/redshift/latest/dg/r_SVV_TABLE_INFO.html-> 2 or more transaction ids  (xids) that are involved in the conflict (stl_tr_conflict) and are forming cycles.---****Using the above you can determine the sequence of  statements executed in those by querying svl_statementtext  which led to this error-> https://docs.aws.amazon.com/redshift/latest/dg/r_SVL_STATEMENTTEXT.htmlMoreover, managing transactions inside a stored procedure is a good walk-through of how to layout your code -> https://docs.aws.amazon.com/redshift/latest/dg/stored-procedure-transaction-management.htmlCommentShareSUPPORT ENGINEERAWS-User-1485210answered a year ago"


Question: Cant Signup With Lightsail

"Newbie here was trying to sign up with the $10 plan.ErrorCreateInstances[us-east-2]Sorry, your account can not create an instance using this Lightsail plan size. Please try a smaller plan size or contact Customer Supportif you need to use a larger plan.InvalidParamsI contacted support, they did a ticket but said they have no idea when the restrictions will be adjusted.Sucks being new trying to sign up and being told all new people are instance limited. Im sure there is a reason. Im just trying to throw some cash and move my VPS. And learn some aws while im at it.Anyone have any idea how long the process takes?FollowCommentAthar Gul a year agois it solved for you? if not then how you did it?Share"

Answer: "1Those kinds of errors often clear up after a little while.If you're still seeing it, I would suggest you contact support on an account question.CommentShareDavid Ganswered a year ago"


Question: How can I create a friends list with GameLift?

"Hey,How can I implement a friends list in GameLift? I am still a beginner in GameLift. Currently I have built my own server and client on which my game is already running, but the individual clients only communicate with each other when the game session is started and only these clients can communicate with each other via the server.For a friends list, however, all players in the region must be able to communicate with each other, so that they receive invitations and more.How can I implement this?I am grateful for any help!FollowComment"

Answer: "0GameLift doesn't have a notion of client -> client communication, it 'enables' some of this by bringing a group of players to a common server and the server can then facilitate chat between the connected players.You'd probably need to look at some form of:Player/Identity management: Players are registered when then first come into your game. Tracks which client is which identity (and links identities you use to some common based identity)Presence: Tracks if players are active/online.Notification/Communicator: Allows direct client->client communication (can route messages between clients as required). Handles notifications, receipts, invites.Its a lot to build.Theres a lot of examples of pieces of this, ie Presence (https://aws.amazon.com/blogs/gametech/building-a-presence-api-using-aws-appsync-aws-lambda-amazon-elasticache-and-amazon-eventbridge/) but you really need to know your requirements and have a good design first.CommentSharerePost-User-5332620answered 2 years ago"


Question: CDK ECS cluster running EC2 instances containers cannot connect to AWS services (dynamodb)

"HiAfter creating an ECS cluster and service similar to the one described here. My "healthy" service is unable to use the boto3 client to connect to a DynamoDB table in the account. The connection times out.The experience is seems exactly like a stack overflow user's question here.I have created my own instance via the CLI and put it into the same VPC (in the same public subnets) with the ecs instance and it is able to connect to dynamo without issue.I have tried adding a vpc-endpoint for the service (despite that seeming like a pray in the wind), I have looked at the security groups at each stage and seen no issue.It is important that I do not want to use the Fargate service. What is wrong with my configuration in CDK that is causing there to be no connectivity from my service to DynamoDB?class MyConstruct(Construct):    def __init__(        self,        scope: Construct,        construct_id: str,        *,        environment: EnvController,        api_cert,        dynamo_table: aws_dynamodb.Table,        bucket: aws_s3.Bucket        ):        super().__init__(scope, construct_id)        defaultVPC = aws_ec2.Vpc.from_lookup(self, "defaultVPC", is_default=True)        # Create the application load balancer and its security group        alb = aws_elasticloadbalancingv2.ApplicationLoadBalancer(            self,            "StreamProcessingLoadBalancer",            internet_facing=True,            vpc=defaultVPC,        )        albSecurityGroup = aws_ec2.SecurityGroup(self, 'alb-sg', vpc=defaultVPC, allow_all_outbound=True)        albSecurityGroup.add_ingress_rule(aws_ec2.Peer.any_ipv4(), aws_ec2.Port.tcp(443), "Allow ingress")        alb.add_security_group(albSecurityGroup)        # Define a target group for the ecs containers        target_group = aws_elasticloadbalancingv2.ApplicationTargetGroup(            self,            "StreamALBTargetGroup",            vpc=defaultVPC,            target_type=aws_elasticloadbalancingv2.TargetType.IP,            protocol=aws_elasticloadbalancingv2.ApplicationProtocol.HTTP,            protocol_version=aws_elasticloadbalancingv2.ApplicationProtocolVersion.HTTP1,            targets=[],            port=8765        )        target_group.configure_health_check(            path="/health",            protocol=aws_elasticloadbalancingv2.Protocol.HTTP        )        # Connect the target group to the ALB        listener = alb.add_listener(            'alb-listener',            open=True,            port=443,            certificates=[api_cert]        )        listener.add_target_groups('alb-target-group', target_groups=[target_group])        # Build the ESC cluster to house the processing containers        ecsCluster = aws_ecs.Cluster(self, 'ESPCluster', cluster_name=f"{environment.stage}-ESPCluster", vpc=defaultVPC)        # Add ec2 resource to the ecs cluster        asg = aws_autoscaling.AutoScalingGroup(            self,            'ClusterASG',            vpc=defaultVPC,            instance_type=aws_ec2.InstanceType.of(aws_ec2.InstanceClass.T4G, aws_ec2.InstanceSize.MICRO),            machine_image=aws_ecs.EcsOptimizedImage.amazon_linux2(aws_ecs.AmiHardwareType.ARM),            min_capacity=1,            max_capacity=10        )        capacity_provider =aws_ecs.AsgCapacityProvider(self, 'ClusterASGProvider', auto_scaling_group=asg)        ecsCluster.add_asg_capacity_provider(capacity_provider)        # Define upload the processor code to ECR and fetch the ECR repository to reference in the task definition        image = aws_ecr_assets.DockerImageAsset(            self,            'StreamProcessingImage',            directory='.',            platform=aws_ecr_assets.Platform.LINUX_ARM64        )        repo = aws_ecr.Repository.from_repository_name(self, 'ECRRepository', '*****')        # Create the task definition for the cluster        taskRole = aws_iam.Role(            self,            'ESPTaskRole',            assumed_by=aws_iam.ServicePrincipal("ecs-tasks.amazonaws.com")        )        taskRole.add_managed_policy(aws_iam.ManagedPolicy.from_aws_managed_policy_name('AmazonDynamoDBFullAccess'))        taskRole.add_managed_policy(aws_iam.ManagedPolicy.from_aws_managed_policy_name('AmazonS3FullAccess'))        taskDefinition = aws_ecs.TaskDefinition(            self,            'ESPTaskDefinition',            compatibility=aws_ecs.Compatibility.EC2,            task_role=taskRole,            network_mode=aws_ecs.NetworkMode.AWS_VPC,            cpu="1024"        )        container = taskDefinition.add_container(            'container',            image=aws_ecs.EcrImage(repo, image.image_tag),            cpu=1024,            memory_reservation_mib=500,            logging=aws_ecs.LogDriver.aws_logs(stream_prefix=f'{environment.stage}-ESP-ecs'),            environment={                "TABLE_NAME": dynamo_table.table_name,                "S3_MEASUREMENT_ROOT_PATH": f"s3://{bucket.bucket_name}",                "AWS_DEFAULT_REGION": (environment.region or 'eu-west-1')            }        )        container.add_port_mappings(aws_ecs.PortMapping(container_port=8765))        # Setup service         serviceSG = aws_ec2.SecurityGroup(self, "ECSEC2ServiceSG", vpc=defaultVPC, allow_all_outbound=True)        serviceSG.connections.allow_from(albSecurityGroup, aws_ec2.Port.all_tcp(), "Application Load Balancer")        service = aws_ecs.Ec2Service(            self,            "Service",            cluster=ecsCluster,            desired_count=1,            task_definition=taskDefinition,            assign_public_ip=False,            security_groups=[serviceSG],            capacity_provider_strategies=[                aws_ecs.CapacityProviderStrategy(                    capacity_provider=capacity_provider.capacity_provider_name,                    weight=1                )            ]        )        service.attach_to_application_target_group(target_group)        autoscaling = service.auto_scale_task_count(            min_capacity=1,            max_capacity=10        )        autoscaling.scale_on_cpu_utilization("AutoscalingCPUService", target_utilization_percent=70)FollowCommentLeeroy Hannigan EXPERT23 days agoCan you reach the public internet from within your container?Share"

Answer: "0Hello,Please note that, whenever you create a task definition for EC2 launch type which would use “awsvpc” network mode, the tasks' ENIs aren’t given public IP address. Hence, they cannot reach DynamoDB endpoint as they cannot access public endpoints, in order to access the internet, tasks should be launched in the private subnet and subnet should have route to DynamoDB endpoint.In your case, you need to enable access to DynamoDB either via VPC endpoints or NAT gateway. Also, ensure service SecurityGroup outbound meets the criteria mentioned here[1].Fargate launch type gives an option to enable the “assignPublicIp”. Hence, the Fargate tasks which are launched within public subnets do have access to the internet. If Fargate tasks launched in private subnet, then you need to follow the above mentioned procedure.Thank you and have a nice day.[1] Gateway endpoints for Amazon DynamoDB - Considerations - https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html#gateway-endpoint-considerations-ddbCommentSharerePost-User-0538723answered 20 days ago"


Question: "Cannot mount volumes made from snapshots, get "Bad message", invalid superblock"

"My old EC2 server, that was launched in 2011, has finally died. It is unreachable and cannot be rebooted.It was running an Amazon AMI.I created a new VPC server with a new Amazon Linux2.My plan was to copy my website files from an old snapshot to the new drive on the new server.I created a volume from an old snapshot taken a few days before the server died.I can see the volume  has a filesystem.$ sudo file -s /dev/xvdf/dev/xvdf: SGI XFS filesystem data (blksz 4096, inosz 256, v2 dirs)But it fails when I try to mount it.$ sudo mkdir /olddata$ sudo mount /dev/xvdf /olddata  mount: /old_data: mount(2) system call failed: Bad message.$ sudo e2fsck -p /dev/xvdf  e2fsck: Bad magic number in super-block while trying to open /dev/xvdfI tried the same things for older snapshots a month before the server died and got the same result. I know the website was running. So the old filesystem must have been somewhat OK.I tried:$ sudo e2fsck -b 8193 /dev/xvdfNo luck. I also tried "Fast snapshot restore" so that I knew I was working with a fully restored snapshot. But it made no difference.Any suggestions for how to recover the files from the old snapshot? Or how to get the old server to launch so I can FTP the files?FollowComment"

Answer: 0I was able to get a restored volume to mount on a VPC t2.small.But I was able to launch a new m1.small instance using a saved AMI backup.I had tried to do this earlier but could not get past a broken UI asking for a VPC security zone. The instructions were nonsensical. So I reverted to the older UI and was then able to successfully launch the new instance.Now I will use scp to copy the old data from the restored AMI to my new VPC.CommentSharephil-burkanswered a year ago


Question: How to install playwright in elastic beanstalk via .ebextensions?

"I need to install Playwright in my Elastic beanstalk. So, I am using this command in .ebextensions.ebextensions/01_install_playwright.configcontainer_commands:  install_playwright:     command: "npx playwright install --with-deps chromium"But it's getting error out. Here are the logs from cfn-init.log -2022-09-29 05:16:17,188 [INFO] -----------------------Starting build-----------------------2022-09-29 05:16:17,194 [INFO] Running configSets: Infra-EmbeddedPostBuild2022-09-29 05:16:17,197 [INFO] Running configSet Infra-EmbeddedPostBuild2022-09-29 05:16:17,200 [INFO] Running config postbuild_0_test_worker2022-09-29 05:16:18,246 [ERROR] Command install_playwright (npx playwright install --with-deps chromium) failed2022-09-29 05:16:18,246 [ERROR] Error encountered during build of postbuild_0_test_worker: Command install_playwright failedTraceback (most recent call last):  File "/usr/lib/python3.7/site-packages/cfnbootstrap/construction.py", line 576, in run_config    CloudFormationCarpenter(config, self._auth_config).build(worklog)  File "/usr/lib/python3.7/site-packages/cfnbootstrap/construction.py", line 276, in build    self._config.commands)  File "/usr/lib/python3.7/site-packages/cfnbootstrap/command_tool.py", line 127, in apply    raise ToolError(u"Command %s failed" % name)cfnbootstrap.construction_errors.ToolError: Command install_playwright failed2022-09-29 05:16:18,247 [ERROR] -----------------------BUILD FAILED!------------------------2022-09-29 05:16:18,247 [ERROR] Unhandled exception during build: Command install_playwright failedTraceback (most recent call last):  File "/opt/aws/bin/cfn-init", line 176, in <module>    worklog.build(metadata, configSets)  File "/usr/lib/python3.7/site-packages/cfnbootstrap/construction.py", line 137, in build    Contractor(metadata).build(configSets, self)  File "/usr/lib/python3.7/site-packages/cfnbootstrap/construction.py", line 564, in build    self.run_config(config, worklog)  File "/usr/lib/python3.7/site-packages/cfnbootstrap/construction.py", line 576, in run_config    CloudFormationCarpenter(config, self._auth_config).build(worklog)  File "/usr/lib/python3.7/site-packages/cfnbootstrap/construction.py", line 276, in build    self._config.commands)  File "/usr/lib/python3.7/site-packages/cfnbootstrap/command_tool.py", line 127, in apply    raise ToolError(u"Command %s failed" % name)cfnbootstrap.construction_errors.ToolError: Command install_playwright failedAm I missing something or any suggestion on how to run the npx command on .ebextensions. I also posted on SO but didn't see any response.While everything is working fine on code pipeline using buildspec.yml and same commandphases:  install:    runtime-versions:      nodejs: 16        #nodejs: latest    pre_build:    commands:            - echo Installing source NPM dependencies...      - npm install      - echo Installing Chromium...      - npx playwright install --with-deps chromiumFollowComment"


Question: AWS Lambda (NET 6) & Cognito: How to use Swagger?

I am developing AWS Lambda (NET 6)=>RDS  and use Cognito as Identity provider.I do not develop a client app because it will be done later.How to use Swagger to test Lambda using authentication? i.e. to use Cognito groups etc to test restriction on methods performing via Swagger?FollowComment

Answer: "0There are several options to access your Lambda. It could be deployed with a Function URL that can be called directly, or it can be fronted with an AWS Elastic Load Balancer (Application Load Balancer) or an API Gateway. Depending on how you set up your architecture, the configuration details change.Do you mean to use Swagger UI to test your Lambda function, or to define a security scheme with Swagger (JSON/YAML)?CommentSharePontus Palmenasanswered 5 days ago0I mean to test my Lambda using Swagger. I test my Lambda in Local environment: all methods etc and do it after deploying Lambda to AWS. It works fine, But now I need to add restrictions who can call methods (RBAC). I'll use Cognito. So the question: how to test the Lambda using Swagger + Cognito authentication + authorization.Customer can test the Lambda without client app and confirm it works correctly,CommentShareOleganswered 5 days ago0Hi,Given above info, if you need authentication and authorization mechanism with Lambda, you need to include a facade in front of: Api gateway or ALB as pointed out above.In fact you cannot use lambda function urls, https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html, as they have IAM authentication only.You could look into SAM https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-api.html which supports provision of swagger in its template, which then you can test local, but you still will need that facade.Hope it clarifies ;)CommentShareEXPERTalatechanswered 5 days ago"


Question: Model deployment with internal data

"Is it possible to deploy a model to an endpoint along with a large amount of data for it to use? (~50GB), this can be though of as an internal database for my model to use.I only require such functionality temporary, since I am trying to avoid using database services (e.g DynamoDB etc) for the moment.ThanksFollowComment"

Answer: "0Your best bet is to put the data in S3 if possible.  S3 integrates directly with SageMaker so it should be seamless.CommentShareEXPERTVictor Ghadbananswered 2 months ago0Yes the data is stored in S3. Do you mean I can simply download the data from S3 bucket using boto3 (say in the function the loads the model)?CommentShareOrianswered 2 months ago0Yes.  Here is a sample snippet of codeimport boto3s3 = boto3.client('s3')s3.download_file('BUCKET_NAME', 'OBJECT_NAME', 'FILE_NAME')s3 = boto3.client('s3')with open('FILE_NAME', 'wb') as f:s3.download_fileobj('BUCKET_NAME', 'OBJECT_NAME', f)CommentShareEXPERTVictor Ghadbananswered 2 months ago"


Question: s3 parquet partitions load to redshift using COPY command

"Hello,I have folder called s3://bucket/redshift-backup-test/folder_fact_ads_spend/fact_ads_spend_test.parquet/inside this there partitions like Market=AU,Market=US,Market=SG(all data in parquet format)columns: date,market,price,quantityI am trying to load this using COPY command into my redshift database where I have same columns .But I am not able to copy the data and error is columns not matching ( file having 3 and db have 4)I have tried to remove the "Market" field from db and it worked.Now my question is how I can load "Market" field which is partition column to db also.FollowComment"

Answer: "0Hi, you can try using the FILLRECORD paramater - FORMAT PARQUET FILLRECORD; see this blog for more details - https://aws.amazon.com/blogs/big-data/part-1-introducing-new-features-for-amazon-redshift-copy/CommentShareAWS-User-6132295answered 10 months ago"


Question: dateDiff not returning hours when setting date part to 'HH'

"While trying to find the difference in hours between two timestamps, i am receiving zero's for all results.first calculation attempted & results: datediff({ride_winning_eta_submitted_time},{ride_status_to_pickup_at})|Date 1| Date 2 | time diff in hours|| Aug 21, 2022 11pm | Aug 21, 2022 12 am | 0 || Aug 21, 2022 1pm  | Aug 21, 2022 4pm  | 0 |I would expect to see the below| Aug 21, 2022 11pm | Aug 21, 2022 12 am | 1 || Aug 21, 2022 1pm  | Aug 21, 2022 4pm  | 3 |I have also tried to simply extract the hour and then subtract those values but this will not take into account multiple days between, this only works if it is all same day interactions. The last thing i tried to do that is slightly different from the above is datediff({ride_winning_eta_submitted_time},{ride_status_to_pickup_at},"HH"), then focusing on hour within the columns and this gave me the same results as above.Thanks in advance for any help here!FollowComment"

Answer: 0Accepted AnswerI ended up figuring out what the issue was. I have to very similarly named fields and selected the non timestamp one accidentally and did not realize it.CommentShareBI_Analystanswered 9 months ago


Question: Athena - Unable To Query PostgreSQL DB Data Via Athena - GENERIC_USER_ERROR

"Hi all,I have setup AWS Athena to query PostgreSQL DB data.However, I encountered GENERIC_USER_ERROR when trying to query some data, with following messages:Full Error Messages:GENERIC_USER_ERROR: Encountered an exception[com.amazonaws.SdkClientException] from your LambdaFunction[arn:aws:lambda:eu-west-1:XXXXXXXXXXXX:function:jdbc_postgres] executed in context[retrieving meta-data] with message[Unable to execute HTTP request: Connect to s3.eu-west-1.amazonaws.com:443 [s3.eu-west-1.amazonaws.com/XX.XXX.XXX.XXX, s3.eu-west-1.amazonaws.com/XX.XXX.XXX.XXX, s3.eu-west-1.amazonaws.com/XX.XXX.XXX.XXX, s3.eu-west-1.amazonaws.com/XX.XXX.XXX.XXX, s3.eu-west-1.amazonaws.com/XX.XXX.XXX.XXX, s3.eu-west-1.amazonaws.com/XX.XXX.XXX.XXX, s3.eu-west-1.amazonaws.com/XX.XXX.XXX.XXX, s3.eu-west-1.amazonaws.com/XX.XXX.XXX.XXX] failed: connect timed out]This query ran against the "XXXXX" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: a01d4534-faad-4f4c-80b6-492c44fac1c4Since it mentioned about to post this error message, hence posted this error message in AWS re:Post forum.Does anyone have any ideas on how to resolve this issue?Thanks in advance!Best Regards,Jerry ChongFollowComment"

Answer: "1Accepted AnswerProblem fixed.Root Cause: VPC have no internet connection issue, causing Lambda can't access S3.Solution: Add VPC Gateway Endpoint in Lambda associated VPC.Best Regards,Jerry ChongCommentSharerePost-User-2608598answered 6 months agoEXPERTFabrizio@AWSreviewed 5 months ago"


Question: Load certificate on ALB and EC2

"Is there any way to use the SSL 443 connection between the ALB and the backend EC2 Server at the same time, that is to say, load the ACM certificate on the ALB and EC2?FollowComment"

Answer: "1Accepted AnswerHi,It might not be possible to use ACM certificates on EC2 instances. Instead, you can use a third-party SSL certificate on your ALB and EC2 instances to enable end-to-end SSL connections. In other words, you must install a third-party certificate on the EC2 instance. Then, associate the third-party certificate with the ALB by importing it into AWS ACM.For more details, please see https://aws.amazon.com/premiumsupport/knowledge-center/acm-ssl-certificate-ec2-elb/CommentSharejcvipanswered 7 months ago1If your aim is to have end-to-end encryption on your connection then here's what you can do:Use ACM to provision publicly valid certificate for the ALBCreate self-signed certificate on the EC2 instance and use that to listen to port HTTPS 443ALB doesn't validate the targets TLS certificate, it only makes sure there is a TLS certificate if you selected the target groups protocol to be HTTPS.Here's quote from our documentation:If a target group is configured with the HTTPS protocol or uses HTTPS health checks, the TLS connections to the targets use the security settings from the ELBSecurityPolicy-2016-08 policy. The load balancer establishes TLS connections with the targets using certificates that you install on the targets. The load balancer does not validate these certificates.CommentShareEXPERTToni_Sanswered 7 months agoEXPERTTushar_Jreviewed 7 months ago0Likely this is about AWS issues ACM certificates - It is not possible to attach/load/use AWS issued ACM certificate on EC2.ACM is meant for AWS managed services such as ALB (Elastic LoadBalancing) & Cloudfront to give examples. Here is full list of supported services: https://docs.aws.amazon.com/acm/latest/userguide/acm-services.htmlCommentSharewieshkaanswered 7 months ago"


Question: AWS Textract Queries response is truncated

"Hi,I am trying to use AWS Textract with BlockType as QUERY_RESULT but the response text is truncated to max of 230-300 characters. I am getting the same result in AWS Console as well.FollowComment"

Answer: "0Hi, currently Textract Queries feature supported up to 64 words in the QUERY_RESULT element. We are actively working on the future improvement for the feature to increase this limitation as well. Thanks.CommentShareAWS-User-0574899answered 8 months ago"


Question: I am unable to create cloudfront resource on AWSi got error log message showing you must verify your account.

FollowComment

Answer: "0Hi there,I'm sorry for the trouble. To get help, please follow the instructions provided in the error message shown in the screenshot you shared:Your account must be verified before you can add new CloudFront resources. To verify your account, please contact AWS Support (https://console.aws.amazon.com/support/home#/) and include this error message.We'll be in touch to assist.- Kita B.CommentShareEXPERTAWS Support - Kitaanswered 6 months ago"


Question: Error when creating new labeling job in Ground Truth

"Hello, I'm trying to setup a simple image classification labeling job with a private workforce.When creating a new labeling job, I complete automated data setup to have the manifest created. But I get the following error when clicking 'Next'NetworkingError: Network Failure - The S3 bucket 'datalabelinginsagemakertest2' you entered in Input dataset location cannot be reached. Either the bucket does not exist, or you do not have permission to access it. If the bucket does not exist, update Input dataset location with a new S3 URI. If the bucket exists, give the IAM entity you are using to create this labeling job permission to read and write to this S3 bucket, and try your request again.I have already done the following:made sure the labeling job and the S3 bucket are in the same region (us-west-1)granted these policies to the IAM role: AmazonS3FullAccess, AmazonSageMakerFullAccess, AmazonSageMakerGroundTruthExecution, + a custom policy giving access to the specific S3 bucket -- I don't think all of these are necessary, but am trying to give all permissions I can just to try to get it to workWhat am I missing here? Is there anything else I can try?FollowCommentAlex_T EXPERTa year agoNot quite sure whether it would give the error message you're seeing, but did you make sure you set up the required CORS permissions on your bucket?ShareJasper Riane a year agoDoes your existing IAM User/Role that you are using to create the labeling job have access to the s3 bucket? Based on your comment you already have provided access to the IAM Role of the labeling job but you also need to make sure that the existing IAM User/Role you are using to create the labeling job has access as well.SharerePost-User-1096925 a year agoI'm having the same issue. I've granted full access to the IAM role with AmazonS3FullAccess, AmazonSageMakerFullAccess, AmazonSageMakerGroundTruthExecution, and added CORS permissions to the bucket, but I continue to see this permission errorShare"

Answer: 0Does your existing IAM User/Role that you are using to create the labeling job have access to the s3 bucket? Based on your comment you already have provided access to the IAM Role of the labeling job but you also need to make sure that the existing IAM User/Role you are using to create the labeling job has access as well.CommentShareJasper Rianeanswered a year ago


Question: App Runner and RDS

"Hi,It seems we can't configure for the moment an App Runner service to communicate with an RDS database. Is it a current limitation, or did I miss something?FollowComment"

Answer: "2Yes, it is not currently supported. This is one of the feature requests tracked here - https://github.com/aws/apprunner-roadmap/issues/1Please vote on the issue to get it prioritized.CommentShareamitguptaatawsanswered 2 years ago2I was able access my RDS database from AppRunner successfully.  You have to configure these 2 settings on RDS:Choose the option to make the RDS instance Publicly accessible.To the VPC Security Group associated with your RDS instance, add an inbound rule to allow public access via the Internet.  Add IP address 0.0.0.0/0 and the port number your DB listens on (i.e. 5432 for PostgreSQL).With these two options AppRunner was able to communicate with the RDS DB.  If you cannot make your DB publicly accessible then you probably cannot make this work.One AppRunner enhancement could be to potentially limit the IP address range any one application can be deployed to. I noticed with every deployment the AppRunner IP address for the application would be completely different, not even having the same couple of octets in the IP address.  This would allow users to avoid total public access with IP address 0.0.0.0/0.  We would then be able to limit the rule perhaps to a particular CIDR such as 54.246.8.0/32.I also added this line to test if my application could access the RDS DB port in a startup shell script:# Test if port 5432 is accessible via this machine.echo " Zero is success: sleep 10 | echo 0 > /dev/tcp/<rds instance id>.eu-west-1.rds.amazonaws.com/5432 && echo $? : "sleep 10 | echo 0 > /dev/tcp/<rds instance id>.eu-west-1.rds.amazonaws.com/5432 && echo $?Edited by: SamSan on Jul 25, 2021 11:05 AMCommentShareSamSananswered 2 years ago2This feature is now supported: "You can now connect you App Runner services to databases in Amazon Relational Database Service (Amazon RDS)..." https://aws.amazon.com/about-aws/whats-new/2022/02/aws-app-runner-amazon-vpc/CommentShareBenoit de Chateauvieuxanswered a year ago1voted ;)any deadline for this feature?CommentSharejcmaganswered 2 years ago"


Question: CloudWatch Logs retention setting leaves behind empty log streams

"CloudWatch Logs retention setting leaves behind empty log streams. How do I configure CloudWatch Logs to deleted Log streams that are emptied because the logs contained within were deleted due to reaching retention age.I should not have to deploy additional Lambdas, or have to use the CLI or the console to delete these empty log streams.FollowComment"

Answer: "1AWS may delete empty log streams that are over 2 months old. In the meantime, you'll have to delete the empty log streams and/or log group on your own.Here's a Lambda code to delete the empty log streams other than the ones whose naming start with "2018/10*". Do test the code and adjust to your specifications.I'd also advise to open an AWS Support Case requesting customization to delete empty log streams and voice your feedback.CommentShareEXPERTShree_Canswered 10 months agorePost-User-2767921 10 months ago"AWS may delete empty log streams that are over 2 months old." - "may" ? What are the conditions ?My log streams are form 2021."In the meantime, you'll have to delete the empty log streams and/or log group on your own." - As stated in the question, that is not what I'm looking for."Here's a Lambda code" - explicitly stated as not wanted in the question."I'd also advise to open an AWS Support Case" - Done, they replied: "This is a known limitation and is currently being tracked by the CloudWatch internal team. Please note we do have an existing feature request for this ability - I’ve added this case, and your specific use, as supporting evidence on the request."ShareShree_C EXPERT10 months agoYou'll have to just wait for the feature release if you do not want to consider the other workarounds.SharerePost-User-2767921 10 months ago"This feature request was created in middle of 2019 as per the details on the feature request."SharerePost-User-2767921 10 months agoIt's hard not to be cynical about things like this when support is all to ready to point me to implementing my own lambda based solution, meaning they are confident in the procedure that should be followed to achieve the desired outcome, but for some reason the product team can't do the same and save us all the development hassle and running expense. OR is it the running expense that AWS is keen to keep collecting?Share"


Question: How to view server logs for lightsail containers

"Hello,How can I view the server logs for my lightsail containers?I don't mean the access log I mean debug logging with Psr\Log\LoggerInterface.Thank you!FollowComment"

Answer: "4The following article may help you to access container server logshttps://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-viewing-container-service-container-logsAWS LightSail does not directly support the viewing of logs from your containers. However, you can set up logging in your application and then access those logs.One possible approach is to log your application data to stdout and stderr. Many Docker base images (including official images for languages like Node.js, Python, Ruby, etc.) are set up to log information to these output streams by default. AWS Lightsail containers will capture stdout and stderr from your container and make it available in the AWS Management Console and the Lightsail API.CommentShareEXPERTsedat_salmananswered 18 days ago"


Question: Using Iceberg tables and time travel feature in Quicksight

"I have Iceberg tables in AWS data catalog which I want to use to create dashboards in AWS QuickSight. The idea is to set a date paremter in QuickSight and then to be able to use it with Iceberg time travel feature. I.e. I'd like QuickSight to filter the data as of specific date using Iceberg capability to execute queries "as of timestamp" (e.g. select * from table FOR TIMESTAMP AS OF (timestamp '2022-12-01 22:00:00').My questions are:Does Quicksight support Iceberg tables as a data source?Is it possible to use the time travel feature of Iceberg tables in Quicksight when writing custom sql queries for the data source?Is it possible to use Quicksight parameter with Iceberg time travel?If this is possible, it would be extremely powerful combination Iceberge timetravel + Quicksight dashboards. If it is not possible what is the best alternatives, assuming that my data are in Iceberg tables.It seems that Quicksight can work with Icerberg tables as a data source, but I can't figure out if quciksight paramters somehow can be used im time travel for Iceberg tables.FollowComment"

Answer: "0Hello,I see you have the following questionsDoes Quicksight support Iceberg tables as a data source?Yes, Quicksight supports Athena as a data source.Is it possible to use the time travel feature of Iceberg tables in Quicksight when writing custom sql queries for the data source?Yes, there should be no issue specifying a time travel query to Athena from quicksight.Is it possible to use Quicksight parameter with Iceberg time travel?If I am understanding your question correctly, it is not possible to create a parameter that can dynamically alter a custom SQL query to reload data.You may use a time parameter to filter timestamps of data that has been loaded as a dataset.If it is not possible what is the best alternatives, assuming that my data are in Iceberg tables.I would ask that you open an AWS support case in the case I have misunderstood any of the above questions, but also to further discuss your use case to understand the best options you have available.Thank You.CommentShareAWS_Dylananswered 6 months ago"


Question: The request could not be satisfied error coming from cloudfront

I'm getting this error when trying to call my API hosted on API Gateway:
The request could not be satisfied.
  Generated by cloudfront (CloudFront)  Request ID: Vz-IregTgUHDPhDXhiu5b1LYit867fL4mIE9ZuOF8GoC-Ij66HGoig==  I seem to get this when calling an API from my local machine to hosted (but not local to localhost or hosted to hosted).I'm using Chalice/API Gateway Developer Portal project (https://github.com/awslabs/aws-api-gateway-developer-portal/)  I didn't set up anything in CloudFront myself and I don't see anything when I go to CloudFront in AWS console.I'm also unsure if there are any rules for invoking API Gateway APIs from other API Gateway APIs. I have 2 chalice projects that I want to keep separate but for one to be able to call the other through REST API and both run in my same AWS account. Is there any issue with doing this?FollowComment

Answer: 0I think the problem was I was mistakenly passing in some data with a GET request.CommentShareedwinevansanswered 6 years ago


Question: "OpenSearch Dashboards health status red, everything else green"

"We have an OpenSearch domain here on AWS.Sometimes Cluster status and OpenSearch Dashboards health status goes into yellow for a few minutes which is fine I guess.But yesterday OpenSearch Dashboards health status went into red and is there still. Everything else works except the dashboards, which gives error 503: {"Message":"Http request timed out connecting"}{  "cluster_name" : "779754160511:telemetry",  "status" : "green",  "timed_out" : false,  "number_of_nodes" : 2,  "number_of_data_nodes" : 2,  "discovered_master" : true,  "discovered_cluster_manager" : true,  "active_primary_shards" : 166,  "active_shards" : 332,  "relocating_shards" : 0,  "initializing_shards" : 0,  "unassigned_shards" : 0,  "delayed_unassigned_shards" : 0,  "number_of_pending_tasks" : 0,  "number_of_in_flight_fetch" : 0,  "task_max_waiting_in_queue_millis" : 0,  "active_shards_percent_as_number" : 100.0}I tried triggering blue/green deployment which didn't help.How could I solve this? Is there a way to restart the domain or debug in someway?FollowComment"

Answer: "0Hello,OpenSearch dashboard can go into red state for following reasons:Node failure caused by an issue with an Amazon Elastic Compute Cloud (Amazon EC2) instance or Amazon Elastic Block Store (Amazon EBS) volume.Insufficient memory for your nodes.Upgrading OpenSearch Service to a newer version.Incompatibility between OpenSearch Dashboards and OpenSearch Service versions.A single-node cluster is running with a heavy load and no dedicated leader nodes. The dedicated leader node could also be unreachable.Due to managed nature of service you won’t be able to perform a domain restart from your end. Please refer to below article for basic troubleshooting steps:[+] https://repost.aws/knowledge-center/opensearch-dashboards-red-statusIf you continue to experience such issues after performing basic troubleshooting, please reach out to support engineering for further assistance.CommentShareSUPPORT ENGINEERRajat_Canswered 2 months ago"


Question: Serverless Inference - Limit number of workers

"We've deployed a HuggingFace model to Sagemaker as a serverless endpoint. We set memory to be 6GB and max concurrency to be 1. With these settings, we keep getting errors when we call invoke_endpoint. Not all the time, but about 60% of the time...When we check the logs and metrics, we see that the memory has gone up to almost 100%. We also see that, since the machine has 6 CPUs, if starts 6 workers. We believe this could be the cause of the problem. How can se set the number of workers?Thanks!FollowComment"

Answer: "0From “sagemaker.pytorch.model.PyTorchModel” documentation:model_server_workers (int) – Optional. The number of worker processes used by the inference server. If None, server will use one worker per vCPU.You can see this example on how to set “MODEL_SERVER_WORKERS” environment variable to set number of workers.env={    "MODEL_SERVER_WORKERS":"2"    }local_regressor = Estimator(    image,    role,    instance_count=1,    instance_type="local")train_location = 'file://'+local_trainvalidation_location = 'file://'+local_validationlocal_regressor.fit({'train':train_location, 'validation': validation_location}, logs=True)predictor = local_regressor.deploy(1, 'local', serializer=csv_serializer, env=env)Hope it helps.CommentShareEitan Selaanswered a year agoRogerio Bromfman a year agoThanks. Adding an "answer" to provide more information below...Share0Eitan, thanks for replying.I'm not sure if this worked or not, as not the cloudwatch logs are not showing the number of workers anymore! The performance seems to be the same, however. It's failing more often than it's responding. And still reaching almost 100% memory.Instead of your code, I used the following, as I'm deploying a Hugging Face model:huggingface_model = HuggingFaceModel(    name=model_name,    model_data=os.path.join("s3://" + tar_bucket_name, tarfile_name),    env={        'HF_TASK': 'text-classification',        'MODEL_SERVER_WORKERS': '1',        'MODEL_SERVER_TIMEOUT': '300'    },    role=sagemaker.get_execution_role(),    entry_point='inference.py',    transformers_version='4.12.3',    pytorch_version='1.9.1',    py_version='py38')Two follow up questions then, if you don't mind:How can I see if the serverless function actually created only one worker per instance?Where can I find all the different environment variables accepted by SageMaker?Many thanks!RogerioCommentShareRogerio Bromfmananswered a year agoRichard a year agoHi! I created the model (using CDK) with the environment variable SAGEMAKER_MODEL_SERVER_WORKERS. Maybe that makes the difference?Share"


Question: AWS ECS - CREDENTIALS_FETCHER_HOST_DIR not found Error

"I'm currently trying to deploy a Vue App to ECS. (with EC2)However, when executing the task, it was confirmed that "Essential container in task exited" was the cause of the interruption.Additionally, it returns exit code 1 for details.To check more detailed error logs, get the running container id through the docker-ps command, and docker logs <container-id> | I checked the log by entering the command head.The error log confirmed that msg="CREDENTIALS_FETCHER_HOST_DIR not found, err: stat /var/credentials-fetcher/socket/credentials_fetcher.sock: no such file or directory" module=parse_linux.go.Can you identify the cause of the problem and how to solve it?FollowComment"