Question: S3 Interface Endpoint

"Right now there are two types of VPC Endpoint for S3, the Gateway and Interface Endpoints. Regarding the Interface endpoints, there are two kinds of endpoints, global (com.amazonaws.s3-global.accesspoint) and regional (com.amazonaws.us-east-1.s3). Here are my questions:What are the differences between the two?In what particular scenario(s) can we use those endpoints?And when accessing the S3 interface endpoints via java SDK,  there are also two kinds of endpoints, "accesspoint.vpce......vpce.amazonaws.com" and "bucket.vpce......vpce.amazonaws.com", which should I use to access a bucket and download the objects keys of that bucket?And what are the differences between the two, "accesspoint.vpce..." and "bucket.vpce...."Thanks in advance,FollowComment"

Answer: "0Accepted AnswerWhat are the differences between the two?Those two S3 interface endpoints has different purpose. Global S3 interface interface is for S3 Multi Region Access Points and the other one is for normal use cases.In what particular scenario(s) can we use those endpoints?As I said, global s3 interface is for multi region access points so if you plan to use multi region access points and you want to access the bucket privately, you should use gloabal s3 interface endpoint. If you don't have plan to use multi region access points, you don't need to use it but you can use s3 interface endpoint to access S3 bucket or single region access point privately.And when accessing the S3 interface endpoints via java SDK, there are also two kinds of endpoints,"accesspoint.vpce......vpce.amazonaws.com" and "bucket.vpce......vpce.amazonaws.com", which should I use to access a bucket and download the objects keys of that bucket?If you use multi regsion access point, you should use S3 interface endpoint starts with "access.vpce..". If not, you should use s3 interface endpoint starts with "bucket.vpce".And what are the differences between the two, "accesspoint.vpce..." and "bucket.vpce...."I explained the difference between two difference S3 interface endpoint. If there is no difference except sub domain name between two different DNS names, it should be same type of S3 interface endpoint.Please refer to below.S3 interface endpoint for Multi Region Access Points should be like ".vpce-randomvalue.accesspoint.s3-global.region-code.vpce.amazonaws.com"S3 interface endpoint for all other usecases should be like ".vpce-randomvalue.region-code.vpce.amazonaws.com"Here is some explanation about "Configuring a Multi-Region Access Point for use with AWS PrivateLink" use case.https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointsPrivateLink.htmlCommentShareEunsu_Shinanswered a year agoRodel a year agoThank you. It is clear now. Tough, I have another question.For S3 Multi Region Access Points, I need to create S3 Access point to the bucket that I want to access to, right? Without S3 access point in the bucket, I can't use the  "Global S3 interface interface", right?ShareEunsu_Shin a year agoThere are two types of S3 Access Points. If you want to have multi region access point, you must create Multi Region Access Point. In this case, you can use S3 Global interface endpoint if you want to access it privately. Without S3 Global interface endpoint, you can access multi region access point with public endpoint.If you want to use just single region access point to the bucket, you can use normal S3 Access Point. In this case, you can use S3 interface endpoint(not global one) if you want to access the AP privately.ThanksEunsuShare0Interface endpoints work the same way that all other AWS service interface endpoints work; they appear as a local IP in your VPC (probably multiple - one per AZ) and can be reached by resources in that VPC; resources in other VPCs that are peered or accessible via Transit Gateway; and by resources that are on premises connected by VPN or Direct Connect. Gateway endpoints are only accessible by resources within the VPC that they are created in (there is an edge case here - create a proxy in that VPC but even then the traffic appears to come from the proxy so it still holds).Interface endpoints have a charge associated with them; Gateway endpoints do not. In general, using Gateway endpoints is a better thing because cost but it does depend on your use case.Most endpoints can be used for pretty much any purpose you like with a couple of exceptions. Access points (for example) can be used to further restrict access to specific buckets so calls outside that scope will fail. VPC endpoints can only be used to access S3 resources in the same region as the VPC itself. Website endpoints are a little different again; and website access isn't supported via Interface endpoints.Hope this answers your questions.CommentShareEXPERTBrettski-AWSanswered a year agoRodel a year agoThank you. This answer in for the general VPC endpoints. I'm looking for particular information about the two different VPC Endpoints for S3 which was explained by Eunsu_Shin.Share0To add to the answers aboveS3 Interface Endpoint and Gateway Endpoints - when to use which typehttps://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3Examples for S3 Interface Endpoint and Gateway Endpoint for Single VPC and Multi-VPChttps://aws.amazon.com/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/CommentSharethereisnoplacelikedevnullanswered a year ago"


Question: Lambda: Import error for Numpy which is a dependency for other modules I am using (Pandas & Matplotlib).

"I created a layer for my Lambda functions so that I have all my dependencies in one place. When I run this locally, I have no issues. When I run it in Lambda, I getOriginal error was: No module named 'numpy.core._multiarray_umath'I do not use Numpy explicitly in my code, it is a dependency for Matplotlib and Pandas and thus gets installed when installing these libraries. I have tried everything I can think of with no success. I verified the versions of Python (3.9), Matplotlib (3.7.0), Pandas (1.5.3), and Numpy (1.24.2) are compatible. I have looked all over the internet and the solutions I find do not work for me. I have tried reinstalling my requirements.txt with the specific versions I use in my venv locally, I tried with no specific versions designated, I tried using the --upgrade option when installing with pip, per this similar question I tried running an ec2 instance (ubuntu) and building my layer specifically with python3.9 (the lambda runtime), and many other things.For reference, here is a link to the module that is causing the issue. Granted, it works fine when cloned off of GitHub and run locally, the issue seems to be with Lambda's set up. Also, I use the same layer for my other functions (which do not use Matplotlib or Pandas) and they run just fine.I feel like there is something about Lambda's environment I am not understanding. Any help in understanding this is greatly appreciated. I have spent 10+ hours trying to get this to work with no success.Below is the whole traceback it gives me. I checked out the link they provide and couldn't find anything useful there but maybe I am overlooking something? Hoping this is a simple fix as this is the last major thing keeping me from finishing my WebApp.`START RequestId: b675dac9-a101-4f2c-a3cf-beb4f17ff3f8 Version: $LATEST[ERROR] Runtime.ImportModuleError: Unable to import module 'results':IMPORTANT: PLEASE READ THIS FOR ADVICE ON HOW TO SOLVE THIS ISSUE!Importing the numpy C-extensions failed. This error can happen formany reasons, often due to issues with your setup or how NumPy wasinstalled.We have compiled some common reasons and troubleshooting tips at:https://numpy.org/devdocs/user/troubleshooting-importerror.htmlPlease note and check the following:* The Python version is: Python3.9 from "/var/lang/bin/python3.9"* The NumPy version is: "1.24.2"and make sure that they are the versions you expect.Please carefully study the documentation linked above for further help.Original error was: No module named 'numpy.core._multiarray_umath'Traceback (most recent call last):END RequestId: b675dac9-a101-4f2c-a3cf-beb4f17ff3f8REPORT RequestId: b675dac9-a101-4f2c-a3cf-beb4f17ff3f8Duration: 24.03 msBilled Duration: 25 msMemory Size: 128 MBMax Memory Used: 40 MBInit Duration: 126.23 ms`FollowComment"

Answer: "1Your Lambda function is using x86_64 architecture, not arm64, right?CommentShareEXPERTskinsmananswered 3 months agoryzinn18 3 months agoWow, this was the solution. Thank you for this. I can't believe I spent 10 + hours so far for a minor setting done in the first step. On the bright side, I gained some good experience with Lambda layers, EC2, and VENVs in the process. Thank you!Shareskinsman EXPERT3 months agoYou're welcome!  If you get around to it, please hit "Accept" on my answer.  Thank you.ShareMayur 2 months agoHiWhat should I do to remove this same  errorWe have compiled some common reasons and troubleshooting tips at:https://numpy.org/devdocs/user/troubleshooting-importerror.htmlPlease note and check the following:The Python version is: Python3.9 from "/var/lang/bin/python3.9"The NumPy version is: "1.24.2"Shareskinsman EXPERT2 months ago@Mayur, are you asking how this was solved?  Just to make sure that the correct processor architecture, x86_64, was used when creating the Lambda function.  Native code like numpy is architecure-specific.Share"


Question: S3 AWS Backup with a copy action

"Does AWS Backup support the copy action for s3 buckets?I've configured in AWS Backup a backup plan rule with a copy action to another region within the same account and I don't see any copy jobs for my s3 bucket. I see that a backup job ran successfully for the s3 bucket, but I don't see a copy job afterwards.Note: I backup other resources (Aurora and RDS) in the same backup plan rule and I see a copy job for each of them. So the copy action is properly configured.So, does AWS Backup support the copy action for s3 buckets, or I misconfigured something else?FollowComment"

Answer: "0It's not supported. I tried to create a copy job, but the job failed with:Copy job from us-east-1 to us-west-1 cannot be initiated for S3 resources. Feature is not supported for provided resource type.aws backup start-copy-job \ --recovery-point-arn [REDACTED] \ --source-backup-vault-name [REDACTED] \ --destination-backup-vault-arn [REDACTED] \ --iam-role-arn [REDACTED]aws backup describe-copy-job --copy-job-id [REDACTED]{    "CopyJob": {        "AccountId": "[REDACTED]",        "CopyJobId": "[REDACTED]",        "SourceBackupVaultArn": "[REDACTED]",        "SourceRecoveryPointArn": "[REDACTED]",        "DestinationBackupVaultArn": "[REDACTED]",        "ResourceArn": "[REDACTED]",        "CreationDate": "2022-03-24T15:48:03.019000-04:00",        "CompletionDate": "2022-03-24T15:49:04.108000-04:00",        "State": "FAILED",        "StatusMessage": "Copy job from us-east-1 to us-west-1 cannot be initiated for S3 resources. Feature is not supported for provided resource type.",        "IamRoleArn": "[REDACTED]",        "CreatedBy": {},        "ResourceType": "S3"    }}CommentShareAWS-User-9549763answered a year ago0Why not use cross-region-replication for S3 to do the copying?CommentShareShaharanswered a year ago"


Question: EC2 Instance Stuck in "stopping" state

"I have an instance that was unresponsive and tried to stop it. Waited about 10 minutes, then tried a force stop and it has been stuck in the "stopping" state for about an hour now.Instance ID: i-0fd6c70b8c60899dbCould you please stop it for me so I can start it back up?ThanksFollowComment"

Answer: "0Disregard, the instance has finally stopped.CommentSharevipersephanswered 4 years ago"


Question: Cloud-init failures on boot after launching an AMI

"Hello,Am having difficulty getting an AMI of a machine launched. The image is CentOS 7. This seems to point to something like a Python environment issue, but I am not quite sure. The image does contain the centos-release-scl, for the purposes of installing Python3 which only operates in a Python virtual environment. I am not sure why that would affect this as Python 2 is still installed. Below are the relevant log entries from the system log at initial boot. The machine shows 1/2 checks passed, and cannot be accessed.Thank youLine 611: \[   24.190979] cloud-init\[598]: File "/usr/lib/python2.7/site-packages/pkg_resources.py", line 378, in load_entry_point\[\[1;31mFAILED\[0m] Failed to start Initial cloud-init job (pre-networking).  Line 611: \[   24.190979] cloud-init\[598]: File "/usr/lib/python2.7/site-packages/pkg_resources.py", line 378, in load_entry_point\[\[1;31mFAILED\[0m] Failed to start Initial cloud-init job (pre-networking).  Line 650: \[\[1;31mFAILED\[0m] Failed to start LSB: Bring up/down networking.  Line 650: \[\[1;31mFAILED\[0m] Failed to start LSB: Bring up/down networking.  Line 660: \[   25.114549] cloud-init\[752]: load_entry_point('cloud-init==18.5', 'console_scripts', 'cloud-init')()\[\[1;31mFAILED\[0m] Failed to start Initial cloud-init job (metadata service crawler).  Line 660: \[   25.114549] cloud-init\[752]: load_entry_point('cloud-init==18.5', 'console_scripts', 'cloud-init')()\[\[1;31mFAILED\[0m] Failed to start Initial cloud-init job (metadata service crawler).  Line 699: \[   25.572718] cloud-init\[752]: File "/usr/lib/python2.7/site-packages/requests/exceptions.py", line 10, in <module>\[\[1;31mFAILED\[0m] Failed to start Apply the settings specified in cloud-config.  Line 699: \[   25.572718] cloud-init\[752]: File "/usr/lib/python2.7/site-packages/requests/exceptions.py", line 10, in <module>\[\[1;31mFAILED\[0m] Failed to start Apply the settings specified in cloud-config.  Line 732: \[   26.120298] cloud-init\[\[1;31mFAILED\[0m] Failed to start Execute cloud user/final scripts.\[766]: File "/usr/lib/python2.7/site-packages/cloudinit/cmd/main.py", line 26, in <module>  Line 732: \[   26.120298] cloud-init\[\[1;31mFAILED\[0m] Failed to start Execute cloud user/final scripts.\[766]: File "/usr/lib/python2.7/site-packages/cloudinit/cmd/main.py", line 26, in <module>FollowComment"

Answer: "0The problem turned out to be dependency issues within python2.7 that relate to cloud-init. Removing requests and urllib3 via pip and yum, then reinstalling via yum, and reinstalling cloud-init has resolved the issue.CommentSharecjc2875answered 3 years ago"


Question: Document that AWS backup doesn't always backup files written immediately before taking a backup

I have noticed that AWS backup for EFS is not behaving as I was expecting.  There appear to be delays occasionally on the files backed up by AWS backup.Example Scenario:Save fileA.txt to EFSTake a AWS backup immediately afterwardsRestore the backup.I find that fileA.txt doesn't exist in the restore but exists in the file system. It appears files saved immediately before taking a backup are not guaranteed to be backed up.Is this the case? If so can this be documented in the AWS docs.If not is this a bug?FollowComment

Answer: "0Amazon EFS is designed to be highly available. You can access and modify your Amazon EFS file systems while your backup is occurring in AWS Backup. However, inconsistencies, such as duplicated, skewed, or excluded data, can occur if you make modifications to your file system while the backup is occurring. These modifications include write, rename, move, or delete operations. To ensure consistent backups, we recommend that you pause applications or processes that are modifying the file system for the duration of the backup process. Or, schedule your backups to occur during periods when the file system is not being modified.https://docs.aws.amazon.com/efs/latest/ug/awsbackup.html#backup-consistencyCommentShareSSanswered 6 months ago"


Question: SSL/TLS Manual Renewal

"I recently received this email regarding manually renewing my TLS/SSL cert -AWS Certificate Manager (ACM) was unable to renew the certificate automatically using DNS validation. You must take action to ensure that the renewal can be completed before Sep 17, 2022 at 23:59:59 UTC. If the certificate is not renewed and the current certificate expires, your website or application may become unreachable.To renew this certificate, you must ensure that the proper CNAME records are present in your DNS configuration for each domain listed below. You can find the CNAME records for your domains by expanding your certificate and its domain entries in the ACM console. You can also use the DescribeCertificate command in the ACM API[1] or the describe-certificate operation in the ACM CLI[2] to find a certificate’s CNAME records. For more information, see Automatic Domain Validation Failure in the ACM troubleshooting guide[3].I have gone and verified that the CNAME records match those on my DNS config for the domain that needs to be updated. Is there any further action that needs to take place? For context: my DNS and certificate were both issued and configured through AWS.FollowComment"

Answer: "0If you have verified that the CNAME is present, check if the CNAME actually resolves / propagated as well.To check for DNS propagation you can use https://www.whatsmydns.net/To check for DNS resolution you can use command "nslookup <CNAME record>. If this works, the renewal should get through.CommentShareGGanswered 7 months ago"


Question: GPU not detected by tensorflow in SM Studio

"I'm currently using SageMaker Studio with kernel "Python 3 (TensorFlow 2.3 Python 3.7 GPU Optimized)".Tensorflow doesn't detect the GPU on both ml.g4dn.xlarge and ml.g4dn.2xlarge instances (with 1 GPU).I would appreciate any advice.import tensorflow as tftf.config.list_physical_devices('GPU'): []Edited by: haganHL on Jul 29, 2021 11:55 PMFollowComment"

Answer: "0Downgrading to the Python 3 (TensorFlow 2.1 Python 3.6 GPU Optimized) kernel allowed the GPU to be recognized. However, I had to recode my notebook to support that kernel. What a shame. What a pain.Edited by: jmlineb on Aug 18, 2021 8:00 AMCommentSharejmlinebanswered 2 years ago0I am having the very same problem with the very same kernel using the very same instance types. It worked perfectly a month ago. Attempting to downgrade my kernel to see if my notebook will still work.Edited by: jmlineb on Aug 18, 2021 7:47 AMEdited by: jmlineb on Aug 18, 2021 8:11 AMCommentSharejmlinebanswered 2 years ago0Hi, I'm having the same problem here. I can't believe that Amazon hasn't fixed this - we could really use support for GPUs on new Tensorflow versions!CommentShareTerjeKWanswered 2 years ago"


Question: FilterExpression lowercase letters?

"Hello,is there a difference between using lowercase or upercase letters for "Filterexpression"?What would be the meaning of this one?FilterExpression='#ab = :g'Am I able to look it up somewhere?Thanks in advance!EllieFollowComment"


Question: DAX Evict Query Cache

"Hi, aside from the TTL that is used to evict the query cache, is there a way to manually evict a key from the query cache? Or the evict the whole query cache instead of waiting for the TTL?Thanks!FollowComment"

Answer: "0No, I'm sorry, there is not.CommentShareAWS-User-9814670answered 4 years ago"


Question: Gaps in CloudWatch Detailed Monitoring on EC2 instance stores

"I have a customer who recently moved to using M5D instance types to make use of the on-board instance stores. With the stores, the customer saw much better performance, overall, but they began to see some throttling/performance problems at peak load.With regular (Cloudwatch) monitoring, they could see the "flat line" throttling in the DiskReadOps and DiskWriteOps over some period of time during heavy work. We discussed it, and they we ok with the throttling, so that's not the problem. The problem is when they turned on detailed monitoring (1 min. vs 5 min logging), they started to see gaps in the their graphs.How do I even begin to explain it when I don't understand why they would have those gaps?I can provide a sample graph the customer sent, if that will help.FollowComment"

Answer: "0Accepted AnswerThere could be several reasons for why a datapoint goes missing in a cloudwatch metric such as:Transient issue with your instance or the networkNature of the metric - We do not record datapoint if the metric value is 0 so there will be a gap in metric if metric value = 0backfilling of delayed metricsIf the issue is backfilling of metrics (which seems to be the case here based on the symptoms), the customer should see datapoints populate in some time. If not, they can open a case with Premium Support and CloudWatch Support Ops can take a closer look.CommentShareKaustubhanswered 5 years ago"


Question: debugging 'invalid_request' on TOKEN endpoint

"I have set up a new User Pool with an App Client:no App client secretAuth Flows Configuration ALLOW_USER_PASSWORD_AUTH and ALLOW_REFRESH_TOKEN_AUTHUnder App Integration I have:enabled Cognito User Poolprovided Callback URL(s)enabled Authorization code grantAllowed OAuth Scopes: email, openedIn my app I call the LOGIN endpoint:https://myapp.auth.ap-southeast-2.amazoncognito.com/login?client_id=${AUTH_CLIENT_ID}&state=${state}&response_type=code&redirect_uri=${AUTH_CALLBACK_URI}When I get back the code from the redirect I call the TOKEN endpoint:const config = {      headers: {          'Content-Type': 'application/x-www-form-urlencoded'      }  }  const data = {      "grant_type": "authorization_code",      "client_id": AUTH_CLIENT_ID,      "code": code,      "redirect_uri": AUTH_CALLBACK_URI  }     const response = await axios.post('https://hilltop-dev.auth.ap-southeast-2.amazoncognito.com/oauth2/token', data, config)  From the above request, I get a 400 invalid_request response with no details.There are no logs I can find for Cognito with any more details.There are no CloudTrail events with any more detailsAs far as I can tell after checking several times the request is valid.I've tried setting the same app but with a client_secret and Authorization basic base64 header, but get the same invalid_request response.What's wrong with this request? How do I debug this request without any info??FollowComment"

Answer: "0Figured out the POST body isn't JSON but a query string format:// redirect the user to this URI  function getAuthUri() {  const state = crypto.randomBytes(20).toString('hex')  const uri = `${AUTH_DOMAIN}/login?client_id=${AUTH_CLIENT_ID}&state=${state}&response_type=code&redirect_uri=${AUTH_CALLBACK_URI}`  return uri  }  // after extracting the code from the authentication redirect (to AUTH_CALLBACK_URI), use this to get the access token  async function getAccessToken(code) {  const config = {  headers: {  'Authorization': 'Basic ' _ Buffer.from(AUTH_CLIENT_ID _ ':' + AUTH_CLIENT_SECRET).toString('base64'),  'Content-Type': 'application/x-www-form-urlencoded'  }  }  const body = `grant_type=authorization_code&client_id=${AUTH_CLIENT_ID}&code=${code}&redirect_uri=${AUTH_CALLBACK_URI}`  try {  const response = await axios.post(`${AUTH_DOMAIN}/oauth2/token`, body, config)  return response.data.access_token  }  catch (err) {  console.log(err.response.data.error)  throw err  }  }  // use the access token  async function getUser(accessToken) {  const config = {  headers: {  Authorization: `Bearer ${accessToken}`  }  }  const response = await axios.get(`${AUTH_DOMAIN}/oauth2/userInfo`, config)  const user = response.data  return user  }CommentShareMonkeyBitesanswered 2 years agoirfan a month agoi have encountered same invalid_request error and applied your answer but still getting the same error.Share"


Question: Change max pod count in EKS

"Hi, everyone! Could somebody help me?I have EKS-cluster with nodes  Instance type t3.medium.Seems, it could be running 17 pods on it, but I can run only 8. And eks shows me that I've reached limit. Where I can increase maximum pod count?  "status": {    "capacity": {      .....      "cpu": "2",      ......      "memory": "3943376Ki",      "pods": "8"    },    "allocatable": {      ......      "cpu": "1930m",      ......      "memory": "3388368Ki",      "pods": "8"    },FollowComment"

Answer: "0According to [1] [2] [3] each AWS ec2 instance type has limitation for Maximum Network Interfaces and IPv4 Addresses per Interface. That defines a limit of total allocated IPs ec2 instance type has when you use AWS CNI.As per this third party article [4] I can see that it says for setting --use-max-pods false in bootstrap.sh  has occasionally caused kubernetes to assign more pods to a node than it could support.Also you can use different CNI pluggins (not AWS VPC CNI). The AWS VPC CNI is the only one that is supported to run on AWS, but you could use a different CNI [5]. To name a few of the more popular alternatives - flannel [6], cilium (which utilizes a new kernel technology called BPF and is designed to address the scaling issues with iptables) [7], calico [8] which is a networking provider and network policy engine, weave-net as suggested for ease of installation in the Medium article [9], or if you would like to run multiple CNIs to better handle your workload requirements, you could use cni-genie [10] which enables kubernetes to seamlessly connect to multiple CNI plugins based on the pod's configuration.The process for changing the CNI is not simple, and things do have the potential to go sideways if you are not careful. You will always want to be sure of your actions before you perform them in the production cluster.The reason for the limitation of the pod/node density is a fundamental limitation of kubernetes architecture and associated SIGs (Special Interest Groups) [11].Such limitations include:Sizing the node instance appropriately - make sure that nodes are not oversized. No two workloads are the same, and so maybe in you case, more smaller nodes fit better. For a portion of the total workload requirements, you could also make use of Spot instances to reduce overall cost [12]. When coupled with the kubernetes Cluster Autoscaler (to dynamically change Auto Scaling Group parameters), and the Spot Instance interrupt handler (daemonset on all nodes with the label lifecycle=EC2Spot), you can gracefully scale nodegroups which contain Spot instances with zero service interruption. As well, when determining the best instance size, you always want to be sure that nodes have adequate system reservations in addition to workload compute requirements.There is ongoing work to increase interface and IP address density/instance, and when it's ready there will be a new CNI supporting it, but the current limits are what we must live with for this implementation. I recommend you to track this github issue for the latest release [13].[1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html[2] https://github.com/aws/amazon-vpc-cni-k8s#eni-allocation[3] https://github.com/awslabs/amazon-eks-ami/blob/master/files/eni-max-pods.txt[4] https://medium.com/@swazza85/dealing-with-pod-density-limitations-on-eks-worker-nodes-137a12c8b218[5] https://kubernetes.io/docs/concepts/cluster-administration/networking[6] https://github.com/coreos/flannel#flannel[7] https://github.com/cilium/cilium[8] https://github.com/projectcalico/calico[9] https://github.com/weaveworks/weave[10] https://github.com/huawei-cloudnative/CNI-Genie[11] https://static.sched.com/hosted_files/kccna18/92/Kubernetes%20Scalability_%20A%20multi-dimensional%20analysis.pdf[12] https://aws.amazon.com/blogs/compute/run-your-kubernetes-workloads-on-amazon-ec2-spot-instances-with-amazon-eks[13] https://github.com/aws/containers-roadmap/issues/398CommentShareRam_AWSanswered 2 months agonadiia a month agoI've found the problem.I used instance type for Autoscaling Group:capacity_type = ["t3a.medium", "t3.medium", "t3.small", "t3a.small"].They have different max available IP for node. When I've separated it to 3 different Autoscalling Groups, I've gotten correct Available Podes.eks_managed_node_groups = {one = {name = "ng-8-pod"instance_types = ["t3a.small"]}two = {name = "ng-11-pod"instance_types = ["t3.small", "t2.small"]}three = {name = "ng-17-pod"instance_types = ["t3.medium", "t3a.medium", "t2.medium"]}Share"


Question: Modify Auto Scaling Health Check setting for Elastic Beanstalk Enviornment

"Hi I have been go through the documentation for update the "AWS:AutoScaling:AutoSclaingGroup" in my existing EB Environment. My current environment is setup using Docker-compose.yml file to refer to the default .env file. I decided to go with update environment setting through AWS CLI. But i keep getting the error as below.aws elasticbeanstalk update-environment --environment-name Testenv-env --template-name v1An error occurred (ConfigurationValidationException) when calling the UpdateEnvironment operation: Configuration validation exception: Invalid option specification (Namespace: 'aws:autoscaling:autoscalinggroup', OptionName: 'HealthCheckType'): Unknown configuration setting.In my v1.json file, I have the setup in below  aws:autoscaling:autoscalinggroup:    HealthCheckType: ELBThen I researched online a bit, found ppl are discussing this is no longer working, and I checked the latest API documentation, which is conflicting from the instruction in below link. Apparent "HealthCheckType" is no longer in the Support field for EB.Then I turned to another solution mentioned in below link:https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environmentconfig-autoscaling-healthchecktype.htmlIt suggested that I use the autoscaling.config in the .ebextensions folder. However I found quite not clear instruction to how to use the .ebextensions folder with my current environment setup where I use docer-compose to refer to the default .env file when deploying. Can someone help in pointing to me a clear instruction.Another thought is, since the environment already exist, if I directly go to the ASG group in my environment, and update from there, would new deployment (with upgrade version) into my EB environment override this ASG change each time I do upgrade? Or the change will be honored and kept in the ASG group as long as it was not deleted.FollowComment"

Answer: "0Beanstalk creates a number of managed resources for your environment. For a web server environment the auto scaling group attached to your environment maps to the resource AWSEBAutoScalingGroup. Refer to modifying the resources that Elastic Beanstalk creates for your environment for further info.You can modify the AWSEBAutoScalingGroup resource through use of an ebextension as you called out in the link auto Scaling health check setting.Place your configuration file in a single folder, named .ebextensions, in the root of your source bundle. Configuration files must have the .config file extension and must conform to YAML or JSON specifications.When you generate the deployment package make sure you include the .ebextensions folderCommentShareRoBanswered a year ago"


Question: Why does not update Amazon CloudFront Developer Guide (GitHub Edition)?

HTTP/3 is not appeared Supported HTTP versions .Last update of Amazon CloudFront Developer Guide (GitHub Edition) is 16th Apr. 2022.https://github.com/awsdocs/amazon-cloudfront-developer-guidePlease update Amazon CloudFront Developer Guide (GitHub Edition).FollowComment


Question: Alerts for RDS Allocated Storage above certain threshold

"We want to set up an alert for when the allocated storage on an RDS instance breaches a certain threshold due to auto-scaling. However, we cannot find a CloudWatch metric that exposes the current allocated storage. There seems to be only the metric for free storage space.Could anyone suggest another approach to achieve this?FollowCommentalatech EXPERT3 months agoWould FreeStorageSpace metric not be enough? https://aws.amazon.com/premiumsupport/knowledge-center/rds-out-of-storage/Sharechamath-vetstoria 3 months agoNot quite. We want to know when the allocated storage expands above a certain limit for cost-optimization purposes. FreeStorageSpace won't help us in this case.Share"

Answer: "1Accepted AnswerYou could trigger a Lambda from RDS DB Instance events for storage modification, then in the Lambda query the DB Instance storage size and either alert to SNS directly from there or write a custom metric value and set up an alarm.CommentShareEXPERTskinsmananswered 3 months agochamath-vetstoria 3 months agoThanks, yes we will follow this approach by triggering a Lambda function on the RDS-EVENT-0218 (autoscaling completed) event.Share"


Question: Can we have a interactive filters and filter groupings in Direct Query in Quicksight?

"I am not able to get the interactive filters and filter groupings in Direct Query in Quicksight, Whereas I am able to do the same in SPICE. Is there a way to have filter groupings in Direct Query as well>FollowComment"


Question: CORS on CloudFront

"Yesterday my app went down since I started getting "[Error] XMLHttpRequest cannot load https://d9rnb4peo8bk4.cloudfront.net due to access control checks.[Error] Failed to load resource: Preflight response is not successful" Something changed? Ny ideas how to fix it, CloudFront setup to allow CORS and was working fine. Any ideas?FollowComment"


Question: How can I capture and report the specific reason for SageMaker pipeline failures?

"I have setup event bridge rules to receive SageMaker pipeline status notifications. However, I would like to inquire about how to obtain more detailed information about pipeline failures beyond just knowing that the pipeline has failed. Is there a way to capture and report the specific reason for a pipeline failure? I am looking forward to your guidance on how to implement this.Thank you.FollowComment"

Answer: "0https://docs.aws.amazon.com/sagemaker/latest/dg/pipelines-troubleshooting.htmlPlease refer above link which summarized possible pipeline issues. Most of them will be fixed during dev time (for example, lack of permissions)For execution script logs, they will be caputured in cloudwatch.https://docs.aws.amazon.com/sagemaker/latest/dg/pipelines-studio-view-execution.htmlIf you are more interested in build your own dashboard to view execution result, consider to use boto3 api to retrieve execution result,https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sagemaker/client/describe_pipeline_execution.htmlCommentShareRachelanswered 19 days ago"


Question: AWS Lambda Sbbscription to SNS

How do i create an SNS policy that only allows only lambda subscription to the SNS topicFollowComment

Answer: 0Please review the following articlehttps://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.htmlit will show you how can you define resource based on SNSCommentShareEXPERTsdtslmnanswered a month ago


Question: AdminLinkProviderForUser and Email Verification status inconsistency.

"I'm building an application that uses cognito to manage username/password users. With an added bonus, i also allow users that have Facebook/Google accounts to log with them, provided their native account with e-mail has been created. When its not, i deny the signup. If it is, i use AdminLinkProviderForUser https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminLinkProviderForUser.html to link them up as described in the documentation.The problem is: After i link these users up, everytime the user logs in using either his Google or Facebook, his Cognito email_verified field is set to false. That locks the user out of the application until he confirms the email again, which is horrible UX. Plus the fact that he loses the ability to recover his password.I can see the Google or Facebook user that gets created and linked to the native user has it's email_verified as false using the console or listing all users using the API. I suspect the issue is this. I've tried to add the "event.response.autoVerifyEmail = true" on my pre-signup lambda, but it still remains false after correctly linking the users.I've also tried to explicit get all "External_Provider" users from my pool and change their email_verified attribute to 'true', using the AdminUpdateUserAttributes method. And despite receiving a SUCCESS on the operation, the attribute is not being updated.I've tried looking online but only found reports of this exact issue with no directives to its solution.Thanks in advance for any help regarding this issue.Edited by: fabao on Aug 26, 2021 1:29 PMFollowComment"

Answer: "0I've actually find a solution for this issue! It's tricky, but it works quite well.The main problem i was having is the fact that pre/post auth lambdas do not trigger if the user is logging in with the connected provider account. Nor does the post confirmation lambda triggers after the signUp link. On top of that, if you manually try to alter the provider's user inside cognito, you still end up with the email_verified = false.So whats the solution here?Well, it's actually two in one.1 Attribute MappingSome of the providers supported by Cognito already have an 'email verified' attribute we can directly map in the Attribute Mapping section. That is the case with Google. Simply map it to Cognito's attribute and you are done!2. PreToken triggerFor the other providers, mainly Facebook (i didnt use any provider other than Facebook and Google, but it should all work the same), that don't natively have the email verified attribute, the only way i could find to properly enforce it to be verified was through the pre-token trigger. The logic goes: once the lambda is invoked, verify if the user getting authenticated have a provider linked to it and, at the same time, have its email_verified options to false. If you meet this condition, update the user with the adminUpdateUserAttributes method before returning to Cognito. That way, it doesnt matter if any subsequent provider login flips the attribute back to false, this lambda ensures it's flipped back on.If you want a sample code for the solution, here's mine pre-token handler:const AWS = require('aws-sdk');    class PreTokenHandler {    constructor({ cognitoService }) {      this.cognitoService = cognitoService;    }      async main(event, _context, callback) {      const {        userPoolId,        userName: Username,        request: { userAttributes: { identities, email_verified } }      } = event;        const emailVerified = \['true', true].some(value => value === email_verified);        if (!identities?.length || emailVerified) return callback(null, event);        await this.cognitoService.adminUpdateUserAttributes({        UserPoolId: userPoolId,        Username,        UserAttributes: \[{ Name: 'email_verified', Value: 'true' }]      }).promise();        callback(null, event);    }  }    const cognitoService = new AWS.CognitoIdentityServiceProvider({ apiVersion: '2016-04-18' });    const handler = new PreTokenHandler({ cognitoService });    module.exports = handler.main.bind(handler);    I've added the 'true' x true check to ensure i'm safe on possibly inconsistencies on the attribute value, although it's just being extra safe and probably not necessary.Related SO answer (with proper code formatting) https://stackoverflow.com/questions/68859052/aws-cognito-email-unverified-on-main-account-after-adminlinkproviderforuser/68955881#68955881Edited by: fabao on Aug 27, 2021 8:24 AMCommentSharefabaoanswered 2 years ago"


Question: Re-invoke or re execute Step function execution with same name?

"First I callstartExecution({ name: id })Then the execution finishes, and is either in FailedState or ran to completion.If i call start with the same "name"startExecution({ name: id })The execution is not in progress, so why can't i supply new machine "input" data and have it re-execute? I can't find anything around this in the documentation. Is there a way to "restart" or "re-execute" a failed or completed execution? It also could be solved by being able to "delete" an execution.The startExecution, doesn't give me an error either "ExecutionAlreadyExists", which maybe only throws if it is in progress?Another strange thing is sometimes this works. Does the execution get "removed" automatically after a certain amount of time, or at least allows you to re-execute? Appears that magic number is 5 minutes.My use case is I am using the id of an entity in my system. So i start an execution with that id, i want it to run. If i try and execute it again, while it is in progress, i want it to fail, saying in progress, which happens now. If it is failed or finished, i want it to re-execute; kind of using it like a mutex.Edited by: Qnary LLC on May 26, 2017 4:28 PMFollowComment"

Answer: "0Step Functions does not support restart of state machines, and we do not support executions using the same name within the 90 day retention period of your execution history.For every execution, you should provide a unique "name" or use the GUID provided by the StartExecution response if you do not provide a name.If you call StartExecution for an open workflow of the same name, then Step Functions will send a 400 error only if the input JSON differs. For the same input, Step Functions will return 200 to affirm the execution is already open. It will not start a duplicate execution.Step Functions should return 400 error messages for use of duplicate names of closed executions within the 90 history retention period. We will fix this bug, and clarify in the documentation.See  http://docs.aws.amazon.com/step-functions/latest/apireference/API_StartExecution.html, which states: "name The name of the execution. This name must be unique for your AWS account and region for 90 days. For more information, see Limits Related to State Machine Executions in the AWS Step Functions Developer Guide."CommentShareAndyK-at-AWSanswered 6 years ago0I think the use case is for searching executions? it would be nice to be able to search in the UI, based on some meta data. I am also using it as a primative lock.Is there no way to remove / delete an execution?When you click Stop in the UI, then search for it, it doesn't exist. But then if you refresh the page and search again, it is in the search results. Assume that is a bug.Edited by: Qnary LLC on Oct 26, 2017 11:06 AMCommentShareQnary LLCanswered 6 years ago"


Question: How to post separate messages to Kinesis

"Hi, I'm using a Kinesis + Firehose to write the received messages to S3 with each message represented as a single file.However, I found that all messages I write to Kineses are get serialised in a single file, instead of separate files.What could be causing this behaviour?Context: I'm using .NET client to generate and write JSON messages to KinesisExample:// post JSON messages from jsonObjects arrayforeach(var jsonMessage in jsonObjects){    var postMessage = PutKinesisData(awsClient, jsonMessage);}PutRecordResponse PutKinesisData(AmazonKinesisClient client, JObject jsonObject){    var jsonString = JsonConvert.SerializeObject(jsonObject);    byte[] messageObj = Encoding.UTF8.GetBytes(jsonString);    var request = new PutRecordRequest();    request.StreamName = KINESIS_STREAM_NAME;    request.PartitionKey = PARTITION_KEY;    request.Data = new MemoryStream(messageObj);    var response = client.PutRecordAsync(request).Result;    return response;}As per documentation, the PutRecord was supposed to post single messages, but for some reason, I'm ending up with a single file in S3 that contains all my JSON messages combinedWHY IS IT THE ISSUE: as per current behaviour my array of JSON is being written to the single S3 file as {json1}{json2} which makes the JSON file incorrect, instead of separate JSON filesFollowComment"

Answer: "0When you add data to your Kinesis Data Stream every record is persisted in the stream as a single record. With PutRecord() you are effectively adding a single message to the stream.Kinesis Data Firehose is the easiest way to load streaming data into data stores. With Kinesis Data Firehose you create Delivery Streams. A Delivery Stream has a Source to read data from, and a Destination to deliver the streaming data. In your case the Kinesis Data Stream is the source, and S3 is the Destination. But it does not write the data from the Data Stream as one record per file.The frequency of data delivery to Amazon S3 is determined by the S3 buffer size and buffer interval value you configured for your Delivery Stream. Kinesis Data Firehose buffers incoming data before delivering it to Amazon S3. You can configure the values for S3 buffer size (1 MB to 128 MB) or buffer interval (60 to 900 seconds), and the condition satisfied first triggers data delivery to Amazon S3. This writes1 file to S3 with all the records in the buffer, and starts again buffering records until the condition for buffer size or buffer interval is met again.You can find more information on Kinesis Data Firehose streaming concepts and how it uses Data Sources and Data Delivery in the Kinesis Data Firehose FAQs.CommentShareSantiago_Aanswered a year agoMichael a year agook I see, it makes sense. But there seems to be a flaw in the way Kinesis Firehose buffer behaves, as it simply appends all received messages together, without any delimited, breaking their structure.for the text files it might be not a critical issue, but sending binaries would make them all invalid when saving to S3 because their integrity is lost due to combining them all togeherAny advise how to tackle such situation?Share"


Question: Elastic Beanstalk Deployments Periodically Failing | /var/app/current: directory not empty |  Amazon Linux 2/3.4.1

"When deploying on Elastic Beanstalk (Amazon Linux 2), deployment periodically fails because the /var/app/current directory isn't empty. There is little consistency in when a deployment fails or succeeds. With the exact same code base, we can have multiple successes in a row, multiple failures in a row, or any combination thereof. This issue does not seem specific to one platform either based on this old AWS Developer Forum post that experienced it on PHP, while we're experiencing it on Ruby. Here are the more detailed specifics which are a combination of comments from the now archived thread, and my updated experiences since it was archived.--Error on Platform PHP 7.4, Amazon Linux 2/3.1.52021/02/12 19:16:54.204134 Executing instruction: FlipApplication2021/02/12 19:16:55.339260 An error occurred during execution of command https://forums.aws.amazon.com/ - https://forums.aws.amazon.com/. Stop running the command. Error: remove current dir failed: unlinkat /var/app/current: directory not empty2021/02/12 19:16:55.339271 Executing cleanup logic2021/02/12 19:16:55.339344 CommandService Response: {"status":"FAILURE","api_version":"1.0","results":[{"status":"FAILURE","msg":"Engine execution has encountered an error.","returncode":1,"events":}Error on Platform Ruby 3.0, Amazon Linux 2/3.4.12022/02/01 22:36:13.837697 [ERROR] An error occurred during execution of command [app-deploy] - [flip ruby application]. Stop running the command. Error: remove current dir failed: unlinkat /var/app/current/tmp/cache/bootsnap/compile-cache-iseq/c0: directory not empty 2022/02/01 22:36:13.838041 [INFO] Executing cleanup logic2022/02/01 22:36:13.838350 [INFO] CommandService Response: {"status":"FAILURE","api_version":"1.0","results":[{"status":"FAILURE","msg":"Engine execution has encountered an error.","returncode":1,"events":[{"msg":"Instance deployment failed. For details, see 'eb-engine.log'.","timestamp":1643754973,"severity":"ERROR"}]}]}I also experienced this same issue on Platform Ruby 2.7, Amazon Linux 2/3.2.4--I am able to get around this issue by removing the ruby gem bootsnap which caches some components of the Rails app, but as this issue seems to affect other language platforms as well I can't really blame bootsnap directly, and removing it does detrimentally affect our app. I'm not sure if the PHP users also use some sort of caching process.I've also attempted changing file permissions via deployment hooks to force delete the contents of /var/app/current but the same issue still is presented.Any ideas would be very welcomed!FollowComment"

Answer: "0Hello,It might be quite challenging to analyze this issue because a support case would helpful so as to get logs and more details. However at a high level, I would say the common cause I have seen is similar to your scenario. In this case, it was discovered that a gem or script was modifying the directory.Most of the time that's the root cause, which is where a custom script assumes the directory exists or assumes it is empty and tries to alter the directory.Elastic Beanstalk (EB)  doesn't want scripts altering this directory as EB prepares everything usually into /var/app/staging and copies over into /var/app/current.It is recommended to not modify the /var/app/current so it does not interfere with how EB maintains it. If any scripts needs to write/modify files of a new application version, using something like container commands is better. Container commands are commands ran in the /var/app/staging directory before files are copied to /var/app/current.As for why it happens sometimes and not others, deployment scripts that try to modify the /var/app/current directory can behave very differently on first time deployment vs subsequent deployments to the same EC2 instance. It is much safer to manipulate files in /var/app/staging and allow EB to move the final files to /var/app/current for you.An additional helpful link is Platform hooks. Note that using different ebextension blocks (ex. container commands instead of commands) or using the newer platform hooks such as post deploy hooks will have different behavior and run in different order and you would have to experiment or consider what one best fits your needs.CommentShareUgochukwu_Ianswered a year agoMonica_Lluis SUPPORT ENGINEERa year agoThank you for the answer,Ugochukwu_I.JoeyParis,Thank you for using re:Post. Let us know if this answers your question. If this solved your issue, please remember to click on the "Accept" button to let the community know that your question is resolved. This helps everyone. Thank you in advance.Share"


Question: S3 file drop fire multiple Lambdas

"Have a customer who uses an application to drop a data file from Salesforce into an S3 bucket. Once the file is dropped, they have a Lambda that fires and does some processing.Customers question is there a way to fire multiple Lambdas from the same trigger? In this case, the creation of the file in the bucket. Doesn't look like this is supported today, any work arounds?Looked at doing this via CloudWatch but it doesn't support prefix/suffix lookup on the file.FollowComment"

Answer: "0Accepted Answerinstead of triggering a Lambda from an S3 event, you can also chose SNS as event destination. Lambda supports SNS as event source and SNS allows you to have multiple subscriptions for one topic. The new architecture would look like:S3 -> SNS -> multiple LambdasCommentShareAWS-User-3879851answered 4 years ago0Having just answered a related question posted 9 DEC 2021, I found this 3-year old answer.For those looking at this answer in 2021 and beyond, there is another good answer, too.That answer is: Try using EventBridgeThere are 10 EventBridge AWS Events for S3 including CreateObject. An EventBridge Rule can be set up to trigger multiple, separate Lambda Functions any time an object is created in S3 aka doing a file drop in S3. Each AWS Event in EventBridge has its own schema, for example: aws.s3@CreatedObject is the EventBridge schema for the AWSEvent that represents a new object being added to an S3 bucket. Using EventBridge for the Event Notifications in S3 to trigger Lambda Functions, one might find more capable solutions especially given that an EventBridge Rule can have matching patterns to filter the AWS Events giving more granular control over the post-processing of the S3 Event.TheSpunicornCommentShareTheSpunicornanswered a year ago"


Question: "AWS API Gateway: Enable caching only for one endpoint, not by the stage"

"Hello There,I am looking to enable caching at AWS Gateway for a specific endpoint/resource within the API deployment, not by the whole stage.Let's say - The API configured on the gateway has following endpointsGET /choicesGET /products/{id}GET /optionsI want to enable caching only for GET /products/{id} but not for the other two resources.One way, I understand is that, I can always enable caching at stage level, and then go and override for individual endpoints/resources not to have the caching. However, in this example, I only have three endpoints, but in my actual scenario, I have a legacy api that has more than 70 resources. So, overriding most of those not to have the caching is kind of daunting.Maybe automate using the aws api to override the caching for those resources that are not required would be an option.However, Is there a way we can enable caching only for those endpoints that we want them to use cache without enabling at stage level. I would like to have that flexibility.Appreciate any suggestions.ThanksFollowComment"

Answer: "0I am not sure if this is what your looking for or if I understand correctly.  Maybe this will help youOpen the API Gateway console and select your API.Click on the resource that contains the endpoint you want to enable caching for (in your case, this would be the resource containing the GET /products/{id} endpoint).Click on the method (GET in this case) for the endpoint.Under the Method Execution pane, expand the Caching section.Enable caching by selecting Enable API caching and configuring the Cache Settings. You can set the Cache Time-to-Live (TTL) and the Cache Data Encrypted options based on your requirements.Save the changes to the method.Now, the GET /products/{id} endpoint will use caching, while the other endpoints will not.Enabling caching at the method level will override the settings at the stage level.CommentShareSteven Bouldinanswered a month agostripat a month agoThanks for the reply. However, I do not see an option under API execution pane to configure caching for any endpoint or the resource. The option we get there is to enable caching for any query, path parameters and headers. Those configuration are only to enable caching by params. Which means if you expect GET /products/1111 to be different than GET /products/1112. Anyway, the option to enable caching is only under the stage settings and then you go to individual endpoint under the stage to override the caching option (the overriding the caching becomes available only after enabling caching at the stage level)Share"


Question: How to prepare the local dev environment for AWS nitro enclave Development

"HII'm quite new to AWS Nitro Enclave Application development and already tried out the https://github.com/aws/aws-nitro-enclaves-samples/tree/main/vsock_sample/rs in an enclave instance. I tried to set up and run it on my Ubuntu 20.04 and my MacOs, but unfortunately, I was unable to run it. I'm looking for a guide on how to set up the application locally and if there is a way to test it locally without deploying that will be super helpful. Would like to know if such a resource is available. Thanks (Im using Rust for development )FollowComment"


Question: Auto Scaling: Refresh instances without downtime

"I'm using AWS Auto scaling group with AWS ALB and the following settings:Desired capacity: 1Minimum capacity: 1Maximum capacity: 3When I now start a "Instance refresh" (with Minimum healthy percentage=100%) for the autoscaling group, the one and only healthy instance is terminated before the new refreshed instance is ready/healthy which results in downtime of my service.When I set desired capacity to "2" and start instance refresh, the service keeps available.How can I achieve that instance refresh first starts a second instance, waits until it is ready and after that terminates the previous old instance so that desired capacity can be 1?FollowComment"

Answer: "1Accepted AnswerCurrently an instance refresh will always start terminating and launching the replacement instance at the same time, causing downtime in a single instance ASG: https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-instance-refresh.html#instance-refresh-limitationsThere is an internal feature request for fully launching the new instance first before starting to terminate the old one, which I've added this post to as a +1For now you'll need to set the desired to 2 first before running the instance refresh, or if the ASG is in a single AZ you can just lower the desired back down to 1 after the new instance is done launching for a similar outcome.CommentShareShahad_Canswered 3 months ago0Hi,Basically in the case of 1 instance, we can't really use the refresh instance mechanism if we want zero downtime.What I found people doing is what Shahad suggested.I.e. : determine that you are running only 1 instance -> increase the desired capacity --> decrease it back.The problem that I'm having with this solution is the timing.In my case, It's a lambda that triggers the Instance refresh after a new AMI is available.So, in the case of 1 running instance, that lambda could indeed increase the desired capacity to 2, but does not it have to wait until that instance is fully available before it resets the desired capacity back to 1 on the ASG otherwise we are back to the dreaded down time....? I could force the lambda to wait for that time with a loop checking on the status, but that's everything but elegant not to mention the billing time that, that incurs...Any ideas? Any event we could listen for....I have read about the 'create_before_destroy' terraform solution which basically duplicate the whole ASG to ensure high availability. What do you guys think about it?CommentShareMehdianswered 3 months ago"


Question: Questions I need answered soon

"I need to know a few things so here is a few questions.1 - Is it possible to by code and without hacking the engine code to start the renderer only and add and remove things in my own display buffer?2 - Is it possible to use the GUI without directly loading a GUI? I want to create a GUI dynamically.Exacly how much control can I get from default build witout load a level, start a game play session?I guess this boils down to wanting to use all the game function libraries but not drive a game outright.Last but most important, When will there be a API documentation for this internal engine?! Block diagrams, short description even. Just something to tell me what this class does.If I think theses answers are not acceptable I am going to ditch it and use another one that does.BECAUSE!It is frustrating to have to read this code and figure out wth the programmer was trying to accomplish.Follow"

Answer: "0Accepted AnswerHi @REDACTEDUSER1 - Is it possible to by code and without hacking the engine code to start the renderer only and add and remove things in my own display buffer?Hmm, the renderer is a system that is loaded by the engine itself so you can't just load the renderer without a lot of hacking. If you mean, can I start rendering without loading a level, then yes you can. However, we don't really have any samples that do this at present and there are some systems which expect a level to be loaded to pull configuration data.2 - Is it possible to use the GUI without directly loading a GUI? I want to create a GUI dynamically.Yup! You can create elements dynamically with LyShine (dev\Code\CryEngine\LyShine and dev\Code\CryEngine\CryCommon\ILyShine.h are helpful)3. - Exactly how much control can I get from default build without load a level, start a game play session?You'll need to be more specific here. Like I mentioned here, there are systems and features that rely on there being a Level to work (Flowgraph level nodes, assets in level pak files, etc.) We are working toward making the engine less around levels and more around slices so eventually, you will be able to make your game entirely without touching levels. I haven't personally tried making a game completely with just slices and no levels yet so take this with a grain of salt.4. Last but most important, When will there be a API documentation for this internal engine?! Block diagrams, short description even. Just something to tell me what this class does.All of the core foundation classes (AzCore, AzFramework, LmbrCentral etc) that we've created should have comments in the actual headers for the classes, the CryEngine classes are more hit and miss. We're still working on a unified web interface for these (ala something like doxygen or similar interface)You can find a lot of web docs for these same core classes in our developer guide for example:http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-modules-intro.htmlhttp://docs.aws.amazon.com/lumberyard/latest/developerguide/component-entity-system-intro.htmlhttp://docs.aws.amazon.com/lumberyard/latest/developerguide/asset-pipeline-ebus.htmlSharerePost-User-5841084answered 6 years ago0Hey @REDACTEDUSERAs for the documentation, we are constantly working on creating and keeping the documentation up to date and creating new documents. As for the engine API I will see if there is any info we can share on when we will have these documents ready to share.I know it can be frustrating, especially this early on in the development of a project of this scale. Your comments and concerns of this nature help us prioritize our roadmaps, so keep them coming.SharerePost-User-8353690answered 6 years ago0Well here is the bottom line @REDACTEDUSERI see mostly I will have to write my own class for Cry3DEngine since most of it is directed at a lot of stuff being processed if it exists. Especially the terrain part.IMO it was better to leave the terrain as just another object so it can be removed if wanted but anyway at least the developers followed common rules so m_p is memory pointer IName is integer, F and m_f float and so on. I was able to decipher most of the class.it is not a problem to write the code ok. I been coding for almost 40 years. It is just a slowdown in the development cycle of the project. My base server library is complete and I want to now start a client/server testing with graphics instead of just text.I have two other engines which are not as tied to editors that WILL work but I wanted to get a high level AAA engine involved to see how well the engine responds to streams.SharerePost-User-0178152answered 6 years ago0Looking forward to that answer. Especially on ETA on that API reference document ;)SharerePost-User-4807048answered 6 years ago0I understand completely. I've asked one of our techs to give a more technical response to your questions and concerns. Just wanted to make sure you knew we didn't forget about your concerns.SharerePost-User-8353690answered 6 years ago0This is one of the BIGGEST hurdles. No engine Documentation. I honestly think I will move on to urho for this project since they have more internal comments, more documentation of the core engine and the engine render system is more open to access.Correct me if I am wrong here.Maybe I was mistaken but I was under the assumption that LY core would be more accessible without relaying on the editor but my finding are saying that to initialize the engine will start a level which has to exist or rewrite the engine itself.Not acceptable.SharerePost-User-0178152answered 6 years ago0I don't disagree. We are trying to create as much documentation as we can as fast as we can. You should see a new big batch of docs and tutorials with 1.7 or shortly after.SharerePost-User-8353690answered 6 years ago0**Thank you @REDACTEDUSERI been busy with other projects so been away form LY for awhile. I have 3 projects going at the moment and want to get these easy ones done first since they are mods for Skyrim. I plan to get back to my main project in around May time frame at which I will make final decision on which main engine I'll use.1 - Is it possible to by code and without hacking the engine code to start the renderer only and add and remove things in my own display buffer?Hmm, the renderer is a system that is loaded by the engine itself so you can't just load the renderer without a lot of hacking. If you mean, can I start rendering without loading a level, then yes you can. However, we don't really have any samples that do this at present and there are some systems which expect a level to be loaded to pull configuration data.Your answer is in question 3 and what I needed to know. Don't need samples as much a API documentation since it will tell me how.2 - Is it possible to use the GUI without directly loading a GUI? I want to create a GUI dynamically.Yup! You can create elements dynamically with LyShine (dev\Code\CryEngine\LyShine and dev\Code\CryEngine\CryCommon\ILyShine.h are helpful)THANK YOU VERY MUCH! I needed to know where to look.3. - Exactly how much control can I get from default build without load a level, start a game play session?You'll need to be more specific here. Like I mentioned here, there are systems and features that rely on there being a Level to work (Flowgraph level nodes, assets in level pak files, etc.) We are working toward making the engine less around levels and more around slices so eventually, you will be able to make your game entirely without touching levels. I haven't personally tried making a game completely with just slices and no levels yet so take this with a grain of salt.This is promising because the loading of levels needs to go and if slices work it may be best solution yet. I'll have a look at this on the weekend. I was attempting to bypass the terrain and ocean which I have my own seamless world code which is build for server side and has its own database. I like the on fly capability to add and remove objects into the render buffer (entities, static models, scripts, etc..) . Maybe allowing GEM plugin would be another possibility?4. Last but most important, When will there be a API documentation for this internal engine?! Block diagrams, short description even. Just something to tell me what this class does.All of the core foundation classes (AzCore, AzFramework, LmbrCentral etc) that we've created should have comments in the actual headers for the classes, the CryEngine classes are more hit and miss. We're still working on a unified web interface for these (ala something like doxygen or similar interface)Yes, The CRY code is not documented at all or very little information. I did read comments but again having several files open and trying to correlate exactly what is going on can be a bit frustrating. doxygen is great way to put the info out so yes. please do. I guess I could do it too but flowcharting the system is even better (like graphic diagrams)You can find a lot of web docs for these same core classes in our developer guide for example:http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-modules-intro.htmlhttp://docs.aws.amazon.com/lumberyard/latest/developerguide/component-entity-system-intro.htmlhttp://docs.aws.amazon.com/lumberyard/latest/developerguide/asset-pipeline-ebus.htmlThese must be new. I will look and thanks again for this info.EDIT:After reading the first section on AZ modules I have my answer! Thank you and this is exactly what I needed.SharerePost-User-0178152answered 6 years ago"


Question: Send efs backup to S3

"I am trying to use aws backup to backup efs. In case that the client restore a backup I need to re-send the restoration files. I tried backing up in a new efs and then send to S3 using datasync with no success because the restored efs backup have no mount targets. If I restore in the same efs, how can I access only the backup files to send to S3 and then delete them from the efs?. Is there a better way to achieve this?FollowComment"

Answer: "1Accepted AnswerKeep in mind that when restoring Amazon EFS file systems using AWS Backup, the backup files can be restored to one of two locations: either a directory in the source file system; or a new file system. If you restore to a directory in the source file system, you can leverage the existing mount targets of your source file system for AWS DataSync to access your restored files. If you restore to a new file system, you will have to create at least one mount target for the new file system in order for AWS DataSync to access the restored data.CommentShareDarryl_Oanswered a year agoAWS-User-5767038 a year agoThanks for the answer. If I choose to backup in the same EFS, how can I access the backup files?, do I need to create and EC2 to access them or can I do it directly in EFS using some API?Share0I'm not clear on your use case, but it appears you wish to send only restored EFS files to S3. You can restore individual files. See https://docs.aws.amazon.com/aws-backup/latest/devguide/restoring-efs.html, specifically "Item-level Restore."It would still require verification that the file is located on S3 of the proper version before deleting it on the local EFS file system, so I would recommend using a workflow, like AWS Step Functions to execute your process.CommentShareRodney Lesteranswered a year ago"


Question: client vpn(mac) said  "The VPN process failed to start the port is already in use by another process"

HelloI was installed client vpn on my mac and use it.But the following error is returned "The VPN process failed to start the port is already in use by another process"What's wrong with this?FollowComment

Answer: "0Another OpenVPN process may already be running on your computer.Try finding the OpenVPN process, stopping it, and then reconnecting.CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: Send-SSMCommand 'AWS-ConfigureAWSPackage' -parameters @HashTableOfPackageNameActionInstallType errors that document does not support parameters

"I am attempting to use PowerShell Tools (aws.tools) module version 4.1.42 and PowerShell core 7.2.5 to send a RunCommand to EC2 instance to install the AmazonCloudWatchAgent to an EC2 instance. The error is that 'Send-SSMCommand: document AWS-ConfigureAWSPackage does not support parameters'. It MUST support parameters or else how would the document know what package name/action/installType to install? Does this commandlet need to be updated? The document DOES accept parameters because this works in the awscli via aws ssm send-command --document-name 'AWS-ConfigureAWSPackage' --parameters '{action/packagename/installtype/etc}So the document does accept parameters or else the awscli v PowerShell Tools passes the -parameters flag differently to the AWS cli.The actual code I am running is below.  (the parameter string is stolen directly from the SSM run command UI at the bottom of the runcommand page when you select your options so you can run it via aws cli, I just stole the parameter argument)$params = '{"action":["uninstall"],"installatinType":[Uninstall and reinstall"],"version":[""],"additionalArguments":[""],"name":["AmazonCloudWatchAgent"]}' | convertfrom-json -ashashtableSend-SSMCommand -DocumentName 'AWS-ConfigureAWSPackage' -InstanceID $ID -Parameter $params -region us-west-2The error is not that the variable is improperly formed , rather that 'Send-SSMCommand: document AWS-ConfigureAWSPackage does not support parameters. ' I think it is a bug with the cmdlet?Can you try running it? I am guessing that the cmdlet needs updated and is not passsing the flags correctly to the aws api for the document., the awscli must be correctly passing them.FollowCommentDmitry Balabanov a year agoCould you please provide the exact code snippet you are using to call the commandlet? Sometimes this error message means there is just an issue with the provided parameters block itself, e.g. a typo or wrong formatting.Share"

Answer: "1wow, the problem was that the "U" in Uninstall was not capitalized. I took the string directly from the console so either it provided the lowercase or I retyped Uninstall without the capital...sorryCommentShareVersaceDribzanswered a year ago0Hello,Thank you so much for your rePost question, my name is RJ an engineer and I will be assisting with your inquiry today.From the provided snippet, it looks like the parameters for the document are being passed with PowerShell's splatting. However, the parameters parameter is expecting a datatype of <hashtable>.Original:Send-SSMCommand 'AWS-ConfigureAWSPackage' -parameters @HashTableOfPackageNameActionInstallTypeProposed:Send-SSMCommand 'AWS-ConfigureAWSPackage' -parameters $HashTableOfPackageNameActionInstallTypeReferences[Send-SSMCommand Cmdlet][ssm][ssm]:https://docs.aws.amazon.com/powershell/latest/reference/items/Send-SSMCommand.htmlCommentShareSUPPORT ENGINEERRJ-Danswered a year agoVersaceDribz a year agoRJ, thank you for the reply, I should have provided some more info, I have already cast the variable as a hashtable and am actually doing this:(the parameter string is stolen directly from the SSM run command UI at the bottom of the runcommand page when you select your options so you can run it via aws cli, I just stole the parameter argument)$params = '{"action":["uninstall"],"installatinType":[Uninstall and reinstall"],"version":[""],"additionalArguments":[""],"name":["AmazonCloudWatchAgent"]}' | convertfrom-json -ashashtableSend-SSMCommand -DocumentName 'AWS-ConfigureAWSPackage' -InstanceID $ID -Parameter $params -region us-west-2The error is not that the variable is improperly formed , rather that 'Send-SSMCommand: document AWS-ConfigureAWSPackage does not support parameters. ' I think it is a bug with the cmdlet?Can you try running it? I am guessing that the cmdlet needs updated and is not passsing the flags correctly to the aws api for the document., the awscli must be correctly passing them.Share"


Question: Reducing VPC Endpoint costs - deploying an image to Amazon ECS with CodePipeline

"I have a basic understanding of AWS architecture, however I need a way to reduce current costs. My current pipeline is as follows:Source react app code from GithubUse CodeBuild to build a docker container and push it to the ECR.Deploy the container into ECS Fargate ClusterFor security reasons, I do not want my ECS service to auto-assign a public IP. Instead I have been using VPC endpoints within the same subnets that the cluster operates in, for the following services:com.amazonaws.eu-west-2.ecr.dkr (Interface)com.amazonaws.eu-west-2.ecr.api (Interface)com.amazonaws.eu-west-2.logs (Interface)com.amazonaws.eu-west-2.secretsmanager (Interface)com.amazonaws.eu-west-2.s3 (Gateway)The downside to this is now the majority of my AWS bill is taken up by having VPC endpoints stood up. The two options I thought of are:Put a CloudFormation step in CodePipeline to stand up the VPC endpoints before ECS deployment, and delete manually after deploymentCreate a Lambda function step in CodePipeline to stand up the VPC endpoints before deployment, and another Lambda step to delete them afterwards.Are either of these "best practice" or is there another way I could automatically create/delete these endpoints when required? Any further info required let me know.FollowComment"

Answer: "1That S3 Gateway endpoint won't be costing you anything but yes the Interface endpoints will.  I'm not sure how many of each type you're deploying but you only need one of each; they can be shared to save costs as discussed here - https://www.linkedin.com/pulse/how-share-interface-vpc-endpoints-across-aws-accounts-steve-kinsman/.You mention "I do not want my ECS service to auto-assign a public IP" - fair enough but is this related to your VPC endpoints?  VPC endpoints allow your service to be deployed in an entirely private subnet without any internet connectivity (plus have some other benefits).  If you don't use VPC endpoints you'll need outbound access to get to AWS services, but you can do that via NAT and don't need a public IP address for your service.CommentShareEXPERTskinsmananswered a year ago"


Question: Patch manager doesn't work on Rocky Linux

"Hello all, I'm trying to use the patch manager to update the Rocky Linux instance, But when I go to upgrade via Patch manager I received the following error:Any idea where I'm going wrong. ThanksFollowComment"

Answer: "0The Amazon Machine Images (AMIs) for Rocky Linux that are provided by AWS do not come with AWS Systems Manager Agent (SSM Agent) preinstalled by default. Not sure if you have manually install or reinstall SSM Agent on an Rocky Linux instance.Reference : https://docs.aws.amazon.com/systems-manager/latest/userguide/agent-install-rocky.htmlCommentShareEXPERTAWS-User-Nitinanswered 7 months ago0Hello, Thanks for your reply. Yes, I installed the SSM agent manually.CommentSharericardobarbosamsanswered 7 months ago"


Question: How to to launch ECS Fargate container without public IP.

"I've an ECS Fargate container app that server the API request over the public internet.My understanding is that this API service container can be deployed on public subnet and that is configured with ALB DNS and target group.As we can see target group redirect the traffic to private IP of the ECS task, I guess we don't need public IP to enabled  when launching the task.However when I attempt this on ECS task launch getting an error "Resourceinitializationerror: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve ecr registry auth: service call has been retried 3 time(s): RequestError: send request failed caused by: Post "https://api.ecr.eu-west-2.amazonaws.com/": dial tcp 52.94.53.88:443: i/o timeout"If this is not workable and we need to enable public ip on the task launch, I'd prefer to restrict the public IP port access only to web service ALB for best security practice. Could someone suggest me the workable approach on this usecase pls? Thanks.FollowComment"

Answer: "1You should not need a public IP for Fargate (https://docs.aws.amazon.com/AmazonECS/latest/userguide/fargate-task-networking.html)The error message seems to indicate that the container could not pull from ECR. You might need to configure private endpoint for ECR.https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.htmlCommentShareRolyanswered 4 months ago1Hello,The problem you are facing is related to the outbound connectivity from your ECS tasks to the ECR Service endpoints.You can create a NAT Gateway in your public subnet, and add it to the internet route (0.0.0.0/0) in your private subnet to allow your ECS tasks to connect with ECR service during Image pull.If you do not want to use NAT Gateway, you can simply create VPC Endpoints in your VPC and associate them with your private subnets. This will allow your private subnets with connectivity to ECR endpoints through private link without having to create a IGW or NAT. Please refer this ECR VPC Endpoints for more details.Please comment if you have questions/concerns with this suggestion.Thank you!CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 4 months ago0Actually for Fargate Tasks you do not need to create the ECR VPN Endpointhttps://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.htmlThere is a default VPC Endpoint enabled.Copied and pasted portions of the textImportantAmazon ECS tasks hosted on Fargate don't require the Amazon ECS interface VPC endpoints.Amazon ECS tasks hosted on Fargate using Linux platform version 1.3.0 or earlier only require the com.amazonaws.region.ecr.dkr Amazon ECR VPC endpoint and the Amazon S3 gateway endpoint to take advantage of this feature.Amazon ECS tasks hosted on Fargate using Linux platform version 1.4.0 or later require both the com.amazonaws.region.ecr.dkr and com.amazonaws.region.ecr.api Amazon ECR VPC endpoints as well as the Amazon S3 gateway endpoint to take advantage of this feature.Amazon ECS tasks hosted on Fargate using Windows platform version 1.0.0 or later require both the com.amazonaws.region.ecr.dkr and com.amazonaws.region.ecr.api Amazon ECR VPC endpoints as well as the Amazon S3 gateway endpoint to take advantage of this feature.CommentShareRolyanswered 4 months agorePost-User-8144282 4 months agoThanks @Roly,I'm able to deploy the ECS Fargate containers on Private Subnets now.However, just wondering the point "Amazon ECS tasks hosted on Fargate don't require the Amazon ECS interface VPC endpoints." - In the absence of dkr api vpc endpoints, I get an error "Resourceinitializationerror: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve ecr registry auth"After including these VPC endpoints, container launch event is successful. Any thoughts on this pls? Thanks.ShareRoly 4 months agoSo it is working, trying to understand the question ?  For ECS Fargate, since it is serverless, we have created default VPC endpoints.  So is the answer accepted ?Share0Thanks @Roly and @Venkat,I followed the steps by referring https://aws.amazon.com/premiumsupport/knowledge-center/ecs-fargate-tasks-private-subnet/#:~:text=To%20run%20Fargate%20tasks%20in,over%20a%20private%20IP%20address.i.e. configured ECR VPN endpoints, S3 Gateway, launched the containers on private subnets. Private subnets route table has NAT Gateway and ALB on public subnet with it NAT Gateway route settings. ECS Task / Service launched successfully, can see Target group registered with task private ip. However, when using the ALB DNS url, getting an error "test-dev-public-2055608301.eu-west-2.elb.amazonaws.com took too long to respond."Any suggestions pls? Thanks.CommentSharerePost-User-8144282answered 4 months agoRoly 4 months agosee previousShare"


Question: how to choose ml.g4dn.* instances in sagemaker processing jobs

"I have to perform some data manipulation for which the sagemaker "processing job" would fit perfectly. Such jobs would benefit from GPU and thus I was looking to use instances from the ml.g4dn family for cost efficiency. Unfortunately, I cant see them available in the dropdown when creating a processing job from the aws dashboard, only when creating training jobs.I previously requested the limit increase to the aws support, and i was told it was not necessary and up to 20 instances could be run in the chosen region.Am I missing anything? do i have to enable the instance family somewhere else?thanksFollowComment"

Answer: "1Hi there, thanks for reaching out about your issue. Are you able to use the AWS CLI or SDKs to start Processing jobs with the ml.g4dn instance types? Also, could you clarify whether AWS support increased your ml.g4dn quota for both Processing and Training or not?CommentShareteebkenganswered a year agoAWS-User-9604039 a year agoi think i tried via cli before engaging with the support team, but ill try again today both with the CLI and the SDK as I'll start working on the pipelines we need. I'll let you know asapconcerning the aws support, they first told me "I can confirm you that the ml.g4dn.xlarge should be already available up to 20 concurrent instances. As soon as I receive any response from our service team, I will let you know immediately." then, the service team confirmed: "I just receive a response from our service team. They confirmed me that the ml.g4dn.xlarge instance at a current quota of 20 is available for processing jobs in the EU (Ireland) region."ShareAWS-User-9604039 a year agook, so running via cli it works, while the dropdown is still empty. I would assume that via the sdk it should work too. But I still cant see the instance type in the UI. I can workaround it for a while, but Id still have users would need it via the dashboard. Any suggestion how to move from here?ShareHrushi_G EXPERTa year agoThanks for trying out CLI, and SDK should work as well. The console issue you have surfaced here seems to me a bug. We should list all supported instance types regardless of quotas. I have raised an internal ticket to look into this issue. In the meantime, I would recommend leveraging CLI or SDK.Share"


Question: Data Transfer Out charges - Just packet payload or payload+headers?

"Inquiry from a customer: In the case where AWS VPN is used to connect to on-prem, when AWS tallies up  data transfer out, does that tally include the IPsec overhead on each packet?FollowComment"

Answer: "0Accepted AnswerYes, it includes the IPSec Overhead along with the encrypted payload.CommentShareEXPERTSteveS-AWSanswered 3 years ago"


Question: loading geospatial data into table

I'm trying to load a JSON file containing a geometry in the "EnclosedJsonInputFormat" following a pattern demonstrated in the Athena geospatial query sample. The table is created but contains no data and I'm assuming there is some sort of parsing error. Is there any way to get more information on the problem?FollowComment

Answer: "0Hi,As per the documentation, you need to store "earthquakes.csv" and "california-counties.json" inside of the folder in the S3 bucket.If you look at the sample earthquake code example, you need to mention the s3 folder path (TEXTFILE LOCATION) when you run the query.CREATE external TABLE earthquakes (  earthquake_date string,  latitude double,  longitude double,  depth double,  magnitude double,  magtype string,  mbstations string,  gap string,  distance string,  rms string,  source string,  eventid string ) ROW FORMAT DELIMITED FIELDS TERMINATED BY ',' STORED AS TEXTFILE LOCATION 's3://<your_bucket_name/csv/';You need to store the .csv file under "csv" folder inside your bucket. Likewise, you also need to store the .json file under "csv" folder inside your bucket.Make sure you set the Query result location  parameter in "Query result and encryption settings" under the settings tab in Athena Console.Once you do, then you can run the queries and you'll see all the records created in the Athena data catalog table.Note: Do not add the S3 object name at the end of the TEXTFILE LOCATION in earquake sql table query as well as LOCATION  in countries sql query.For eg.  add s3://bucketabc/csv/ instead of s3://<your_bucket_name/csv/earthquakes.csvI have done the above steps and I can see all the records in both the tables:Records in Earthquake Table: 77037Records in Countries Table: 30I hope this helps.CommentShareSwwapnilanswered a year agojcc a year agoThanks for your reply. I too can get the earthquakes example to work but I'm using my own JSON files in an S3 bucket. I'm getting them to load now (my original problem was missing a trailing slash on the s3 address) but I'm still wondering how to best debug situations where the data don't parse correctly.Share"


Question: How to handle intermittent resource creation failures?

"I have a service that is used to deploy a new EC2 instance behind an ELB. The code works fine most of the time but every once in a while I get an error "Target groups 'arn:aws:elasticloadbalancing:ca-central-arn:...' not found (Service: AmazonElasticLoadBalancing; Status Code: 400; Error Code: TargetGroupNotFound" when trying to register targets in the target group. Here is a code snippet:AmazonElasticLoadBalancing client = AmazonElasticLoadBalancingClient.builder()        ....        .build();...CreateTargetGroupRequest createTargetGroupRequest  = new CreateTargetGroupRequest();...CreateTargetGroupResult targetGroupResult = client.createTargetGroup(createTargetGroupRequest);TargetGroup targetGroup = targetGroupResult.getTargetGroups().stream().findFirst().orElse(null);assert targetGroup != null;RegisterTargetsRequest registerTargetsRequest = new RegisterTargetsRequest();registerTargetsRequest.setTargetGroupArn(targetGroup.getTargetGroupArn());...client.registerTargets(registerTargetsRequest);When I get the error and go to check the target groups in the AWS Console, I can see it is there but without any registered targets. Is this some obscure timing issue? Should I put in a delay between the target group creation and registering the targets? Would it be a good idea to try the operation again if it throws the TargetGroupNotFound exception?Thanks for any suggestions.FollowComment"

Answer: "1While I haven't seen this particular problem there is a high chance that this is a timing issue. It would be very easy to write code which creates something (target group in this case) and then tries to use that something (here, register targets with the target group) before the service control plane has had time to react.Rather than just add a delay what I would do is query the service to see if the target group has been successfully created. If it hasn't, then wait (say, for a second) and try again. You might even perform an exponential backoff in that loop and have some condition for permanent failure (just in case).There's an excellent article about this in the Amazon Builder's Library.CommentShareEXPERTBrettski-AWSanswered 4 months agokensei62 4 months agoThanks for this. I will give it a try.Share"


Question: Project Rebuild Error when Compiling The Starter Game

"Hi, I'm new to Lumberyard, I selected compile the game code in Setup Assistant and installed all required SDK's. (Also I have the Visual Studio 2019 Installed with required tools). But when I try to compile the Starter Game I get this error message in the log. I hope you can help me. ThanksBuild failedTraceback (most recent call last):  File "E:\Lumberyard\1.27.0.0\dev\Tools\build\waf-1.7.13\waflib\Task.py", line 242, in process    ret = self.run()  File "E:\Lumberyard\1.27.0.0\dev\Tools\build\waf-1.7.13\waflib\Task.py", line 86, in run    return m1(self)  File "E:\Lumberyard\1.27.0.0\dev\Tools\build\waf-1.7.13\waflib\Task.py", line 86, in run    return m1(self)  File "E:\Lumberyard\1.27.0.0\dev\Tools\build\waf-1.7.13\waflib\Task.py", line 86, in run    return m1(self)  [Previous line repeated 4 more times]  File "<string>", line 24, in f  File "E:\Lumberyard\1.27.0.0\dev\Tools\build\waf-1.7.13\lmbrwaflib\msvc_helper.py", line 257, in exec_command    return self.exec_command_msvc(*k, **kw)  File "E:\Lumberyard\1.27.0.0\dev\Tools\build\waf-1.7.13\lmbrwaflib\msvc_helper.py", line 239, in exec_command_msvc    ret = self.exec_response_command(k[0], **kw)  File "E:\Lumberyard\1.27.0.0\dev\Tools\build\waf-1.7.13\lmbrwaflib\msvcdeps.py", line 325, in exec_response_command    sys.stdout.write(os.linesep.join(out) + '\n')  File "E:\Lumberyard\1.27.0.0\dev\Tools\build\waf-1.7.13\waflib\Logs.py", line 52, in write    self.stream.write(txt)  File "E:\Lumberyard\1.27.0.0\dev\Tools\Python\3.7.5\windows\lib\encodings\cp1254.py", line 19, in encode    return codecs.charmap_encode(input,self.errors,encoding_table)[0]UnicodeEncodeError: 'charmap' codec can't encode character '\ufffd' in position 320: character maps to <undefined>Process failed with return code: 1Follow"

Answer: "0Hey there @REDACTEDUSERTo help me better understand your issue, can you answer a couple of questions about how you got here?What command did you run that led to this output?In the SetupAssistant, did you check the box for Visual Studio 2019 on the first page of options?ThanksSharerePost-User-7527243answered 2 years ago0Same situation. I've just clicked rebuild project. Over 1M lines in log file :)Generally that's how it begins:"I:\Amazon\Lumberyard\1.27.1.0\dev\lmbr_waf.bat" build_win_x64_vs2019_profile --enabled-game-projects=StarterGame -p all[WAF] Engine Root: I:\Amazon\Lumberyard\1.27.1.0\dev[WAF] Executing 'build_win_x64_vs2019_profile' in 'i:\Amazon\Lumberyard\1.27.1.0\dev\BinTemp\win_x64_vs2019_profile'...and that's how it ends:Build failedTraceback (most recent call last):File "I:\Amazon\Lumberyard\1.27.1.0\dev\Tools\build\waf-1.7.13\waflib\Task.py", line 242, in processret = self.run()File "I:\Amazon\Lumberyard\1.27.1.0\dev\Tools\build\waf-1.7.13\waflib\Task.py", line 86, in runreturn m1(self)File "I:\Amazon\Lumberyard\1.27.1.0\dev\Tools\build\waf-1.7.13\waflib\Task.py", line 86, in runreturn m1(self)File "I:\Amazon\Lumberyard\1.27.1.0\dev\Tools\build\waf-1.7.13\waflib\Task.py", line 86, in runreturn m1(self)[Previous line repeated 3 more times]File "<string>", line 24, in fFile "I:\Amazon\Lumberyard\1.27.1.0\dev\Tools\build\waf-1.7.13\lmbrwaflib\msvc_helper.py", line 257, in exec_commandreturn self.exec_command_msvc(*k, **kw)File "I:\Amazon\Lumberyard\1.27.1.0\dev\Tools\build\waf-1.7.13\lmbrwaflib\msvc_helper.py", line 239, in exec_command_msvcret = self.exec_response_command(k[0], **kw)File "I:\Amazon\Lumberyard\1.27.1.0\dev\Tools\build\waf-1.7.13\lmbrwaflib\msvcdeps.py", line 325, in exec_response_commandsys.stdout.write(os.linesep.join(out) + '\n')File "I:\Amazon\Lumberyard\1.27.1.0\dev\Tools\build\waf-1.7.13\waflib\Logs.py", line 52, in writeself.stream.write(txt)File "I:\Amazon\Lumberyard\1.27.1.0\dev\Tools\Python\3.7.10\windows\lib\encodings\cp1250.py", line 19, in encodereturn codecs.charmap_encode(input,self.errors,encoding_table)[0]UnicodeEncodeError: 'charmap' codec can't encode character '\ufffd' in position 76598: character maps to <undefined>Process failed with return code: 1SharerePost-User-8001132answered 2 years ago0Hi @REDACTEDUSERYou can add my_text_file.txt to the end of the command and it will create a text file with the full log.Thank you.SharerePost-User-8164888answered 2 years ago0Well I have a log file, but new users are not allowed to send attachments :slight_smile:Btw. it's almost 50MB file, and zip is 4MB.SharerePost-User-8001132answered 2 years ago0Got the same problem here, had Lumberyard 1.21.X installed and updated to the latest, got some administration issues - solved by executing installer as administrator (edit: uninstalled previous and fresh install). In the Project Configurator I started the WAF build for a fresh project, which then died on me after about 1~2 hours of running.Full Log (177MB) | Shortened Log (< 100KB)Note: I replaced my the name of the project with <projectName> in the log fileSharerePost-User-7703066answered 2 years ago0Any fixes after @REDACTEDUSERSharerePost-User-8120901answered 2 years ago0Read this post I've made,https://forums.awsgametech.com/t/visual-studio-2019-build-errors/10743/3?u=detronSharerePost-User-4215516answered 2 years ago0I don't think this fix is relevant for this build error.SharerePost-User-5620026answered 2 years ago0Problem seems to be fixed in Lumberyard Version 1.28.0.0SharerePost-User-7703066answered 2 years ago"


Question: Application Load Balancer not freeing up old private ip after changing subnet

"Hi, I have an ALB deployed in 2 AZs. I want retire the subnets it has been using. I successfully changed the subnets to the newer ones but it has been 6 days since the subnet update I can still see an ENI owned by this ALB running in the old subnet with the status "in use". I can not detach or delete it.I tried to remove that AZ for my ALB for several minutes and later add the AZ back with the new subnet.  However, that ENI with ip from old subnet is still there handing traffic.Also I enabled VPC Flow logs for that subnet, I can see many requests going between this specific ENI to all the target groups it has associated with, both healthcheck and normal user requests.How can i get rid of it? I have target groups associated with this ALB with attributes "stickiness" set to "ON", Is there the reason for this behavior?FollowCommentHammer 7 months agothe ENI with old ip is gone. It almost exactly 7 days from deleting the old subnet. Not sure it is because the stickiness settings or my other approaches today.Share"

Answer: "0Thanks for the detailed description.First of all, when you update the subnets, the ALB nodes (ENIs) are replaced with new nodes in new subnets. Replaced node that has been removed from service will first be removed from DNS so that new traffic will not be sent to it. Then it will enter a grace period waiting for traffic to drain, and existing requests to be completed, after which it will be shutdown. That said, if your clients continue to send requests to the replaced nodes (e.g. through a long-lived connection), the node takes longer time to be drained.Stickiness setting on the other hand is to make sure any ALB node forwards to the same target or target group, which does not contribute to the current observation.CommentShareweidianswered 7 months agoEXPERTTushar_Jreviewed 7 months ago"


Question: WEB Chat - Prevent an agent from transferring a CHAT to an unavailable agent

"HelloIn Amazon Connect, how to prevent an agent from passing a CHAT conversation to an agent who is not available (the transfer between agents is done with a Quick Connection)?Thanks for your help.FollowComment"

Answer: 0Accepted AnswerYou can use 'Check staffing' blocks in your agent transfer contact flow specified in the Quick Connect configuration to verify agent availability and build error handling into the transfer.https://docs.aws.amazon.com/connect/latest/adminguide/check-staffing.htmlCommentSharegthomasanswered a year ago


Question: AWS SDK returns different data than AWS CLI

"Hey,I'm trying to get the supported instances in an availability zone using describe-instance-type-offerings,but I'm getting different results for the SDK and the CLI.Images attached:Could you help me to understand why am I getting different results?Is there might be a bug?Thanks,OriFollowComment"

Answer: "0Hey,I didn't use pagination, that is what caused the difference.Once I add pagination the results between the SDK and the CLI were equal.Thanks!CommentShareAWS-User-6944452answered 7 months ago"


Question: Letting developer from another country access AWS

"I am in the process of developing a mobile app and have selected a developer from China to help me.  Is there any restrictions on having someone from another country access my account?  I realize I will need to create another user id and set them up with the appropriate roles to restrict what they can do but, don't want to run into any issues where Amazon thinks someone is accessing my account that is not authorizedFollowComment"

Answer: "0Accepted AnswerIt is normal for users to have accounts and access in other regions. You can consider use cases where someone in the U.S, wants to deploy and support their application in Europe. Typically, this is not something that would cause issues. You may run into issues if access from China to an AWS region is blocked by China. This is not something AWS controls, rather this is controlled by the China government. AWS does have the ability to block access from known IP ranges (deny lists) that originate from DDoS or other hacking attempts, although that is the WAF denying access to your application endpoints. Let's say your developer is attempting to load test your application, and they are originating from a denied IP range or origin--that could be blocked. I suggest setting up the login and see if the developer can successfully log in.CommentShareByron_Ganswered a year ago"


Question: AWS SDK Calls to Cognito/Cloudfront From VPC without Internet Connection

"We have a client which requires all of the resources are deployed within a VPC. If possible, service-to-service comms should not be happening via the IG/NAT gateways, but via VPC endpoints.For the majority of the system, it was fine. But then I reached Cognito and Cloudfront. In the app code, there are a couple of AWS SDK calls that interact with APIs of these services.So, naturally, since these services do not support VPC endpoints, I guess the IG/NAT gateway option is my only option here?Thank you!FollowComment"

Answer: "0Correct, Neither Cognito nor Cloudfront support VPC endpoint and Private Link, thus you have to go via Internet.AWS services that integrate with AWS PrivateLink:https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.htmlHope it clarifies.CommentShareEXPERTalatechanswered 4 months ago"