Question: aws IOT core rule with dynamodb

"Hello,I'm new to use aws iot rule action with dynamodb.What I understand is that when iot rule initiated 1000 time simultaneously, then dynamodb 1000 putitem happen in once. Is it right?If so, when I want to relieve dynamodb throughput, do I have to add kinesis or sqs in here, too? or any other way exists?FollowComment"

Answer: "0Accepted AnswerUsing Kinesis or SQS :If you want to relieve the DynamoDB throughput, you could consider using Kinesis or SQS to buffer the messages before they are written to DynamoDB. This would allow you to control the rate at which messages are written to DynamoDB, and could help prevent any throttling issues that might occur if too many PutItem operations are attempted simultaneously.Here's an example architecture that uses Kinesis to buffer IoT messages before writing them to DynamoDB:Set up an IoT rule to send messages to a Kinesis stream.Use a Kinesis Lambda trigger to read messages from the stream and write them to DynamoDB.Set up a Kinesis client to consume the messages from the stream.By using Kinesis, you can also implement additional processing on the incoming messages, such as aggregating data, filtering or transforming messages before writing them to DynamoDB.CommentSharemishdaneanswered a month ago-1No, when an IoT rule is triggered, it will send a separate PutItem request to DynamoDB for each message. So if 1000 messages are sent simultaneously, then 1000 PutItem requests will be sent to DynamoDB.To relieve DynamoDB throughput, you can consider using DynamoDB Streams and AWS Lambda. You can configure DynamoDB Streams to capture changes to the DynamoDB table, and then use AWS Lambda to process the changes and perform batch writes to DynamoDB. This can help reduce the number of write requests to DynamoDB and improve the overall throughput.Using Kinesis or SQS can also help in reducing the DynamoDB write requests, but it depends on your specific use case and requirements.CommentSharemishdaneanswered a month ago"


Question: "in what order does the traffic hit aws components  - route53, cloudfront and what are those?"

"i d like to see the chain of all aws components one can use to process incoming traffic flow. What is the order in which the components work with the traffic? For example: user-> route53->waf->cloudfront->??the ones that i know: route53, cloudfront, waf. I'd like to see the full list of all traffic-related components, before it hits  my ALB. I drawn a diagram , is this the right order of the traffic flow? this is more of a general question.FollowComment"

Answer: "0When browsing to an endpoint, the first thing that happens is that DNS is resolved. So when going to www.example.com, your computer resolves the DNS name to an IP address. The DNS resolution may not come directly from Route53, but it could come from Cloudflare's DNS server or Google's, etc.After the DNS resolution, your connection goes to CloudFront but is immediately forwarded to be evaluated in the WAF rulesets. After the traffic passes through the WAF, it evaluates various CloudFront preferences and forwards to the origin. The origin, in this case, would be an ALB.CommentShareCarlo Mencarellianswered 5 months ago0Hi ErjanSo, first things WAF with CloudFront.It is more in parallel and implemented as part of the distribution. Take a look at the following security blog on how to protect using cloudfront. How to protect dynamic web applications against ddos attacks by using amazon cloudfront and amazon route 53  It explains and shows how WAF protects CloudFront Edge and Regional components.Next lets look at how you can protect you Load BalancerFirst you can also have WAF in front of ALBs. Take a look at this blog WAF for ALB that should give more context.  This is useful to prevent DDoS or application attacks at the ALB level bypassing CloudFront.You might also want to consider NACLs and Security Groups within the VPC to control traffic to the ALB and resources.You could also implement Network Firewall, or third party firewall via a Gateway Load Balancer. for inbound protection. Take a look at this Network Blog that explains how to use if for ingress traffic.Lastly you could take a look at AWS Shield.This can add additional DDOS for the following services:Amazon CloudFront distributions.Amazon Route 53 hosted zones.AWS Global Accelerator standard accelerators.Amazon EC2 Elastic IP addresses. (Shield Advanced protects the resources that are associated with protected Elastic IP addresses such as NAT Gateway, EC2 Instance)Elastic Load Balancing (ELB) load balancers.docs.aws....ddos-overviewSo you end up with something that looks more like this:Hope this helps.CommentShareRobin Fordanswered 5 months ago"


Question: how to trigger a step function from a s3 object notification?

"Can one directly invoke a step function directly from a s3 object notification ? for example , when object is created. also, does it work similar to lambda , when hooked up to the s3 object notification. for each object created , will it start a new instance of step function or can we make it such that all of the object notification goes to the same instance of step function, and as i understand step function are state machines , so say i have two states enabled and disabled. when object is created, state machine/step function will move to enable state , and for any other s3 object created notification that comes after the first one , as the step function is already in a enabled state , it won't do anything unless it is in a disabled state. once the files are processed it will move to disabled state.FollowComment"

Answer: "3To invoke a Step Function when an object is posted to S3, you'll need to create a Lambda function that starts an execution of the state machine. Each execution will be separate and independent for each uploaded object.There isn't a concept of "enabled" and "disabled" for state machine executions - they are either running and in some state, or terminated.You can find an experimental CDK solution construct that creates an S3 bucket connected to a Step Functions state machine here.CommentShareEXPERTMichael_Fanswered a year agoclouduser a year ago@Michael_F - thanks. follow up question - if we need a lambda inbetween, it should be possible to check if state machine is already running/or in some state, right? instead of creating another instance of the state machine.  and only start/run the same instance , if it is in terminated state.ShareMichael_F EXPERTa year agoThere are a few ways to go about that. The naive way would be to probe all the running executions, but the DescribeExecution API method is eventually consistent, and that could lead to errors. Instead, I would recommend keeping a list of object processing states in DynamoDB (using the S3 object ID as the primary key).Share1There is no direct integration between S3 and StepFunctions. You can send the S3 notification to a Lambda function, as suggest by @Michael_F, or a no code solution, by sending the event to EventBridge and setting a rule with a StepFunction target.Saying that, I am not sure that StepFunctions is your right solution. It seems that you want to run some process on multiple files. If that is the case, you will not be able to "attach" into a running state machine. There may be some options using the Wait For Task Token integration pattern, but I am not sure it will solve what you are trying to do.I think it would be best if you could explain your use case better.CommentShareEXPERTUrianswered a year ago"


Question: Billing alarm problem

"Hello! How can I add a billing alarm (or check the Receive Billing Alerts box), when it doesn't allow me to edit my alert preferences?FollowComment"

Answer: "0How are you logged in - as a user with the necessary Admin permissions?CommentShareEXPERTskinsmananswered a month agodobby a month agoYes, I am logged in with root user.Share"


Question: AWS EKS Internal Network load balancer (NLB) timed out while trying to connect from underlying eks worker node

"I tried following the steps from this blog post https://www.middlewareinventory.com/blog/internal-external-load-balancer-aws-eks/#Creating_AWS_Internal_Load_Balancer_with_K8s_Service_EKS  to  setup and test my internal NLB deployed on my eks cluster and I am able to successfully test it out. The NLB service is accessible from both windows and linux machine residing in the same VPC as my eks cluster. But when I tried to curl this NLB via underlying worker node, I am getting the time out as shown below. Is this a bug or that's how NLB in EKS clusters are designed? can someone help me to improve as this is 1st time I am dealing with internal NLBcurl -v http://xxxxxxxxxxxxxxxx.elb.us-west-2.amazonaws.com/SampleWebApp*   Trying xxx.xx.xx.xx:80...* connect to xxx.xx.xx.xx port 80 failed: Connection timed out* Failed to connect to xxxxxxxxxxxxxxxx.elb.us-west-2.amazonaws.com port 80 after 130915 ms: Connection timed out* Closing connection 0curl: (28) Failed to connect to xxxxxxxxxxxxxxxx.elb.us-west-2.amazonaws.com port 80 after 130915 ms: Connection timed outFollowCommentrePost-User-8915026 10 months agoHi @Venkat,I am also experiencing the same issue. Did anybody got a resolution yet? Please share your experience.Thanks,MithunShare"

Answer: "0Hello,I believe the issue you are facing could be related to the client IP preservation setting on your Network Load Balancer.When you are trying to reach your kubernetes service from the target instance of your NLB and if the request is being routed by the NLB to the same target instance, the client IP and the destination IP are the same for that request. Therefore, the request will not go through due to the hairpinning effect. Please refer this for more info.If you disable client IP preservation, the private IP address of the NLB becomes the client IP address for all incoming traffic, and thereby remediating your issue.You can use "IP" targets instead of "instance" targets to remediate this issue. You can do this by modifying the service.beta.kubernetes.io/aws-load-balancer-type annotation in your service manifest to nlb-ip instead of nlb.However, if you want the keep using "instance" targets, you can disable client IP preservation setting by adding the below annotation to your service manifest.service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=falseI hope this helps!CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 10 months agorePost-User-7557691 10 months agothanks, @Venkat_P, let me try these approach and come back in case of issuesSharerePost-User-7557691 10 months agoHello @Venkat_P, tried applying thisservice.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=false annotation but it does not solve the problem and still getting time out while trying to curl NLB via underlying nodeSharerePost-User-7557691 10 months agoalso tried the other approach :"You can use "IP" targets instead of "instance" targets to remediate this issue. You can do this by modifying the service.beta.kubernetes.io/aws-load-balancer-type annotation in your service manifest to nlb-ip instead of nlb" but after this no EXTERNAL-IP shows as <pending> for my sample service. how to test then?ShareVenkat Penmetsa SUPPORT ENGINEER10 months agoI am sorry that it didn't work for you. Can you roll it back to 'nlb' and try to manually set the preserve_client_ip.enabled=false on the target-group attributes and see if that is resolving your problem. If that does, then we can focus on why it is not working with the annotations. Thanks!Share"


Question: RDS Aurora serverless global database with secrets manager

"Hey all,we would like to deploy a RDS Aurora serverless v2 global database.According to the following documentation there is a limitation in using secrets manager with Aurora global databases:https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html#rds-secrets-manager-limitationsIs there any best practice to save and share the DB credentials whenever secrets manager is not available?In addition to this setup we using terraform to track and store our infrastructure.Best regardsFollowComment"

Answer: "0There is no auto-rotation feature, but what about using the Systems Manager parameter store?https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.htmlCommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: After making an image and creating a bundle I get a repeated error

"There was an error creating the WorkSpace. Retry the request. If the problem persists, contact AWS support.It's Amazon Linux and the original machine boots fine, but for whatever reason, for every new user I create a new workspace, I'm stuck with a non-descript error message..How do I even begin to debug this? I tried to make a new image and bundle, move regions but it's still the same problem?Help?FollowComment"

Answer: "0Errors provisioning WorkSpaces can be caused by connectivity issues to your Directory Service.  Are you able to check your directory service logs and see if there are issues there?CommentShareRobert_Fanswered a year agoAWS-User-0911311 a year agoI am not able to see my logs it seems, nor can I share my logs as outlined here: https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_enable_log_forwarding.htmlHowever, I have setup a fresh directory service in another region and i'm also facing the same issues there.However, a normal linux image from amazon itself boots fine, so I guess that means there's something wrong with my image?Share"


Question: Feature Request: Set/View MediaPackage Tags in Console

"All the other services allow you to see the tags in the console, but MediaPackage does not (unless I am blind).FollowComment"

Answer: "0Hi there,Thanks for bringing up this topic.Tagging Mediapackage resources is available, but currently only through the API or SDK.More information about how to do this is available here: https://docs.aws.amazon.com/mediapackage/latest/ug/tagging.htmlI have also passed on your feature request.Please let us know if you have any further questions!CommentShareThijsBanswered 4 years ago0Thanks.  I have been using the API, but in order for our Ops to ensure they are correct, they have to use the CLI which is restricted to them.  For now we tell them if its right in MediaLive it's probably correct in MediaPackage.Thanks for putting in the request.CommentSharerbalhornanswered 4 years ago"


Question: Ubuntu Workspace in error state

"Workspace ws-gmty84qc2 , region eu-west-1 is in error state. Can't start nor stop it. This is a very basic custom bundle with only one package installed.Can I do something to fix it or access some logs about the "error" ?FollowComment"

Answer: "0Did you attempt a Rebuild?CommentShareEXPERTStevieStetsanswered 7 months agoICT Singapore 5 months agohi all, I have a similar problem with the new WSP version of Standard with Ubuntu 22.04 which launches and ends up in error. I have ensured we have the ports 4172 / 4195 (UDP) is open for traffic. The PCOIP version used earlier was successful. As per documentation we cannot roll back WSP to PCOIP as well and at this stage no Ubuntu workspaces are available to use.Any help is appreciatedShare0No it was a fresh build. The ubuntu workspace is not customizable like the pcoip / al2 one is.I just launched a base 2022 bundle, added 1 package ( salt ) and created an image and bundle from it.Image creation succeeds, but the new workspaces launched with this image are stuck in "error" state.Clearly they never tried, there are load of errors in cloud-init-output.log, the thing is just broken.Finally I was able to delete it, I hope it will stop the billing.CommentShareAWS-User-8898528answered 7 months ago"


Question: Sagemaker Notebook from Dev Endpoint

"When creating a sagemaker notebook associated to a development endpoint, the notebook fails to start returning an error:Failure reasonNotebook Instance Lifecycle Config 'arn:aws:sagemaker:us-east-1::notebook-instance-lifecycle-config/aws-glue-script-lcconfig' for Notebook Instance 'arn:aws:sagemaker:us-east-1::notebook-instance/aws-glue-script' took longer than 5 minutes. Please check your CloudWatch logs for more details if your Notebook Instance has Internet access.This is odd as I have been able to create a Sagemaker notebook from dev endpoint in the past. I located this post on AWS Forum, but no response:https://forums.aws.amazon.com/message.jspa?messageID=936461Any feedback is appreciated. Thank you.FollowComment"

Answer: "0Hi there,Could you please check the notebook instance's Cloudwatch logs and let us know if there are any clues as to why the lifecycle config is failing?This issue might be related to this Knowledge Center article.https://aws.amazon.com/premiumsupport/knowledge-center/glue-dev-endpoint-sagemaker-notebook/CommentShareSUPPORT ENGINEERPeter_Xanswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: GO SDK V2 - configure STS client enpoint url

"Hey,I'm having trouble with using credentials issued with assume role in region ap-southeast-3.https://aws.amazon.com/premiumsupport/knowledge-center/iam-validate-access-credentials/Following the guide, I was wondering how to configure the STS client endpoint (in Golang)?This is how I configure the clients at the moment:FollowComment"

Answer: "1Hello,You can leverage the AWS SDK for Go API Reference for STS here [1]  and there's also a Dev Guide Github which shows how to configure client endpoints [2].An example code has also been provided in reference to Dynamo DB for Customizing service client endpoints in the above Dev Guide on Github ->customResolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {    if service == dynamodb.ServiceID && region == "us-west-2" {        return aws.Endpoint{            PartitionID:   "aws",            URL:           "https://test.us-west-2.amazonaws.com",            SigningRegion: "us-west-2",        }, nil    }    // returning EndpointNotFoundError will allow the service to fallback to it's default resolution    return aws.Endpoint{}, &aws.EndpointNotFoundError{}})cfg, err := config.LoadDefaultConfig(context.TODO(), config.WithEndpointResolverWithOptions(customResolver))In the context of STS, you need to specify sts.ServiceID, and to use an sts specific URL / your own custom URL like below -func main() {    customResolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {        if service == sts.ServiceID && region == "us-east-1" {            return aws.Endpoint{                PartitionID:   "aws",                URL:           "https://sts.us-east-1.amazonaws.com",                SigningRegion: "us-east-1",            }, nil        }        return aws.Endpoint{}, &aws.EndpointNotFoundError{}    })    cfg, err := config.LoadDefaultConfig(context.Background(), config.WithRegion("us-east-1"))    if err != nil {        panic(fmt.Sprintf("Error configuring AWS: %s", err))    }    // test with an api call: //    simpleTokenService := sts.NewFromConfig(cfg)    output, err := simpleTokenService.GetCallerIdentity(context.Background(), &sts.GetCallerIdentityInput{})    if err != nil {        panic(fmt.Sprintf("Error configuring AWS: %s", err))    }    fmt.Printf("%v\n", *output.Account)}In case if you still have any questions or concerns regarding the SDK, it's usage or issues, then please feel free to reach out to our Dev team directly by pulling an issue on the Github [3] to discuss your use case.References:[1] https://docs.aws.amazon.com/sdk-for-go/api/service/sts/[2] https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/endpoints/[3] https://github.com/aws/aws-sdk-go-v2/issuesCommentShareSUPPORT ENGINEERYash_Canswered 10 months ago"


Question: Snapshot via lifecycle policy for volume to get email notification

"Please guide the steps, How Could I enable the email notification for snapshot backup in my project, through email I want to get notified that my backup of today via snapshot is done. I have made a lifecycle policy and daily my volume snapshot is done. I want to get notified of the success of the same.FollowComment"

Answer: "0EBS sends an event to EventBridge when a snapshot is created https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-cloud-watch-events.html#snapshot-eventsThis means you should be able to create an SNS topic, subscribe your email address to it, and then create an EventBridge rule whose target is your newly-created SNS topic.CommentShareRWCanswered a month agorePost-User-3118042 a month ago{"source": ["aws.ec2"],"detail-type": ["EBS Snapshot Notification"],"detail": {"event": ["createSnapshot"],"source": ["arn:aws:ec2:us-east-1:233274203099:volume/vol-07da647d1709c19b4"]}}This event bridge rule is creating issue multiple snapshot arec treating but even after target is on sns topic subscription no emails were thereShare"


Question: AWS Virtual Tape Library - Specific NICs for different traffic

"I'm running a local ESX VTL with two network interfaces. ETH0 is the general purpose server network, and has access to the internet and AWS. ETH1 is my iscsi network and does not have internet access. Is there a way to bind iscsi traffic to ETH1 only?FollowComment"

Answer: "1Hello,  I'm Mike with the Storage Gateway team.There isn't a way from the gateway to bind the iSCSI traffic to a specific NIC.  You can, however, affect the same result by simply giving your iSCSI initiator the IP address of ETH1 only.  As long as your iSCSI initiator only connects to the SGW's ETH1 address, all iSCSI traffic will be confined to that NIC.Please let me know if you have any further questions.Mike H.CommentShareMike-HAWSanswered a year ago"


Question: "Does being compliant with cis-aws-foundations-benchmark-1.2.0/CloudWatch.4 in an organisation, with an organisation cloudtrail, require a 2nd trail to be compliant?"

"In my environment I have an AWS Organisation. For that organisation I have created a CloudTrail.What I have been told is that to be compliant with the subject cis standard is to have another account level CloudTrail. The reasoning is that metric filters only exist for an organisation trail at the account they are created. Therefor to be compliant with the cis standards and for robustness I would need to create another account trail, where I would be able to create metric filters that achieve the standard.Can someone please confirm this or elaborate as to why this is incorrect?FollowComment"

Answer:
"5Yes , you are correct. You can use Security help to run checks on those mandatory guardrails and configurations in order to meet the compliance requirements.The two in particular that you are referencing are:[CloudTrail.1] CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events[CloudTrail.3] CloudTrail should be enabledYou can verify the requirements here:AWS CloudTrail controls [CloudTrail.1] CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management eventsRelated requirements: CIS AWS Foundations Benchmark v1.2.0/2.1, CIS AWS Foundations Benchmark v1.4.0/3.1, NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 AU-14(1), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8), NIST.800-53.r5 SA-8(22)Category: Identify > LoggingSeverity: HighResource type: AWS::::AccountAWS Config rule: multi-region-cloudtrail-enabledSchedule type: PeriodicParameters:readWriteType: ALL  This control checks that there is at least one multi-Region CloudTrail trail. It also checks that the ExcludeManagementEventSources parameter is empty for at least one of those trails.AWS CloudTrail records AWS API calls for your account and delivers log files to you. The recorded information includes the following information.Identity of the API callerTime of the API callSource IP address of the API callerRequest parametersResponse elements returned by the AWS serviceCloudTrail provides a history of AWS API calls for an account, including API calls made from the AWS Management Console, AWS SDKs, command line tools. The history also includes API calls from higher-level AWS services such as AWS CloudFormation.The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing. Multi-Region trails also provide the following benefits.A multi-Region trail helps to detect unexpected activity occurring in otherwise unused Regions.A multi-Region trail ensures that global service event logging is enabled for a trail by default. Global service event logging records events generated by AWS global services.For a multi-Region trail, management events for all read and write operations ensure that CloudTrail records management operations on all resources in an AWS account.By default, CloudTrail trails that are created using the AWS Management Console are multi-Region trails.NoteThis control is not supported in Middle East (UAE).RemediationTo create a new multi-Region trail in CloudTrail, see Creating a trail in the AWS CloudTrail User Guide. Use the following values:

   Field   	   Value

   Additional settings, Log file validation   	   Enabled

   Choose log events, Management events, API activity   	   Read and Write

To update an existing trail, see Updating a trail in the AWS CloudTrail User Guide. In Management events, for API activity, choose Read and Write.[CloudTrail.3] CloudTrail should be enabledRelated requirements: PCI DSS v3.2.1/10.1, PCI DSS v3.2.1/10.2.1, PCI DSS v3.2.1/10.2.2, PCI DSS v3.2.1/10.2.3, PCI DSS v3.2.1/10.2.4, PCI DSS v3.2.1/10.2.5, PCI DSS v3.2.1/10.2.6, PCI DSS v3.2.1/10.2.7, PCI DSS v3.2.1/10.3.1, PCI DSS v3.2.1/10.3.2, PCI DSS v3.2.1/10.3.3, PCI DSS v3.2.1/10.3.4, PCI DSS v3.2.1/10.3.5, PCI DSS v3.2.1/10.3.6Category: Identify > LoggingSeverity: HighResource type: AWS::::AccountAWS Config rule: cloudtrail-enabledSchedule type: PeriodicParameters: NoneThis control checks whether CloudTrail is enabled in your AWS account. The control fails if your account doesn't have at least one CloudTrail trail.However, some AWS services do not enable logging of all APIs and events. You should implement any additional audit trails other than CloudTrail and review the documentation for each service in CloudTrail Supported Services and Integrations.RemediationTo get started with CloudTrail and create a trail, see the Getting started with AWS CloudTrail tutorial in the AWS CloudTrail User Guide.CommentShareabemusaanswered a month ago1I agree with the feedback that has been provided.  Landing Zone or AWS Organization construct CloudTrail configure in the Management Account consolidated CloudTrail Management Events, Data Events, and Insights events.   The destination is the highly durable and resilient S3 bucket for the trails.   CloudTrail behaves regionally and globally in AWS Partition US-EAST-1. The best practice is to create a "trail" that applies to all Regions in the AWS partition you are working on.   And, AWS Organizations, or Landing Zone can work with CloudWatch Events to raise events when administrator-specified actions occur in an organization.  This is the default setting when you create a trail in the CloudTrail console.  CloudTrail Management events were covered.  Additionally, CloudTrail data events, or data plane operations show resource operations performed on a resource in an AWS account. These operations are often high-volume activities.  CloudTrail Insights analyzes your normal patterns of API call volume and API error rates, baseline, and generates Insights events when calls are made to volume or error rates that are outside normal patterns by API calls.There is AWS Artifact, which is a central resource for compliance-related information for Organizational Compliance.   AWS Artifact Reports can download  AWS security and compliance documents, such as AWS ISO certifications, Payment Card Industry (PCI), and System and Organization Control (SOC).  As stated complaints with cis-aws-foundations-benchmark-1.2.0 is an AWS Independent Software Vendor (ISV) partner.  AWS is a Security Benchmarks Member company that includes guidelines for secure configurations for e.g., a subset of AWS cloud services.  It also provides on-demand access to security as well as sells products on AWS Marketplace.CommentShareWyCliffeanswered a month ago"


Question: "Password verification in a CUSTOM_AUTH flow, do you need to handle SRP yourself?"

"If I want to verify a username and password, AND go through the custom auth flow, would I need to implement SRP myself? i.e. generate SRP_A and calculate PASSWORD_CLAIM_SIGNATUREIs there no way to bypass these SRP calculations / Is there no function to do these calculations for me?FollowComment"

Answer: "0Hi,It's possible to use the SRP flow if you use it before dropping into the custom challenges.  This blog shows the process specifically with Duo but you could replace the custom challenges with your own.Thanks,OwenCommentShareOwenanswered 8 months agoSimonM 8 months agoOh, I'm trying to avoid SRP. I want to validate the users password/credentials and go through the CUSTOM_AUTH flow, but I don't want to have to work out SRP_A and PASSWORD_CLAIM_SIGNATURESo far it seems like SRP_A and PASSWORD_CLAIM_SIGNATURE are unavoidable if I want to validate username and passwords with CUSTOM_AUTH flowShare"


Question: Your AWS account has exceeded 85% of the usage limit.

"I have been receiving this email, It says I have exceeded 85% of my RDS free tier limit but I don't have any RDS instance running but I do have a few EC2 instances (stopped state), I receive this email around same time every month. My free tier 12 months are going to expire. Any idea why this is happening and how do I stop it? Do I need to delete my EC2 instances and if I dont will it cost me after my 12months free tier expires?FollowComment"

Answer: "1Accepted AnswerBased on the message you are receiving, I expect you have RDS running, but are not aware of it. Perhaps it's running in a different region from the one you normally use? Your AWS Bill should indicate if you have RDS running and what region it is running in. Go to the AWS Service "Billing" and select Bills in the left menu panel. In the tab Charges by Service, you should be able to find RDS (Relational Database Service). If you expand (click on the plus) the entry, it should tell you the region that the resources are running in.If you decide to delete the RDS resources, by default RDS will attempt to make a final snapshot backup. If you do not want the backups, then you should unselect the final snapshot and also verify that any backups/snapshots of the database have been deleted.CommentShareEXPERTShlomo Dubrowinanswered a month agoSufian a month agoYou are right, there was an instance running in another region. Thanks a lot.Share"


Question: View/modify amplify CLI published apps in the AWS console?

"Hi there,I've created an app with amplify init, amplify add storage, amplify add storage, amplify add hosting, etc., using the CLI.Now I want to add a custom domain, but the app doesn't show up in the Amplify console.What's the best way forward?  Do I need to tear down the site and publish from a repo (e.g. git) via the Amplify console?  Is there a way to perform custom domain configuration via the cli?I've scoured the docs and Googled, but couldn't seem to find a good lead.Any advice would be appreciated.Thanks,KimEdited by: kimford on Jun 26, 2019 3:04 AMEdited by: kimford on Jun 26, 2019 3:04 AMEdited by: kimford on Jun 26, 2019 3:05 AMFollowComment"

Answer: "0Hi,Sorry for the confusion.Init a project with amplify CLI will not create a AWS Amplify Console. What I would recommend is that push your project to GitHub and Connect your project to AWS Amplify Console. You will be able to set custom domain in AWS Amplify console.Thanks,GaryCommentShareAWS-User-0568200answered 4 years ago0Hi Gary,Thanks for the quick reply.I'm gonna add some more info here, in case anyone come across the same issue and could use the help.In short, I backed out of the cli hosting by using "amplify remove hosting".  I then followed that up with a amplify push, which (I hope) removed all of the cloud elements.  In fact, it did not remove the s3 hosing bucket, so I removed that manually.That done, I used the AWS Amplify Console to connect a Bit Bucket repo with my app code.On the first build attempt, it failed, as it could not find the src/aws-exports.js file, which was added to the .gitignore file automatically at some point during the setup of the site.That particular file has what seems to be a lot of sensitive information, so I was hesitant to exclude it from .gitignore.Tired and bored, and knowing that my bb-repo was private, I added and committed the file and waited....  and viola!Publishing this way allowed me to add a custom domain.If anyone has a better way, le me no....CommentSharekimfordanswered 4 years ago0@kimford. You do not need to commit the exports file. This tutorial shows you how to deploy a fullstack Amplify app: https://docs.aws.amazon.com/amplify/latest/userguide/deploy-backend.htmlCommentSharenikhil1986answered 4 years ago0I have the same problem right now.I build an Angular (Ionic) app with amplify.When i first deployed the app with the amplify console everything worked fine.Then my API-Key expired after 7 days. Now, after creating a new API-Key and setting the"APIKeyExpirationEpoch" = "-1"in parameters.json my app throws an error that the API-Key could not be found.I already deleted my app from the amplify console and creating a new one like in the the link @nikhil1986 posted but still the same problem.Removing the aws-exports.js from my gitignore solves the problem. But that can't be the long term solution right?Maybe someone else already solved the problem and can help me?Thanks so muchJanCommentSharejkalthoeferanswered 4 years ago"


Question: What is on AWS Lightsail's roadmap?

"Hi there,I'm an AWS Lightsail containers user. Except for a few rough edges, I generally like working with AWS Lightsail.One thing that's unclear is what's coming to AWS Lightsail. Updates to AWS Lightsail are very rare so I'm wondering is this service stagnating or is it thriving and worth investing more time and energy?Any information about the future of this service such as what new changes might be coming is very appreciated.FollowComment"

Answer: "2Hi, Thank you for your interest in Amazon Lightsail and for using Lightsail Containers. We are actively invested in improving and building new features for Lightsail Containers (and Lightsail in general). Support for Apex domains, Health check improvements, Logging improvements are some are the recent things we released on Lightsail Containers. More features and improvements are planned for the upcoming months around interoperability with other AWS/Lightsail services, user experience etc. We would be very interested in hearing your feedback and learning the rough edges you are facing with Lightsail Containers. Thank you!CommentSharesisira_nanswered a year ago1We would be very interested in hearing your feedback and learning the rough edges you are facing with Lightsail Containers. Thank you!Thanks for taking an interest.Logging improvements are some are the recent things we releasedI must have not noticed this improvement – there is no announcement about it on the what's new page either. Nevertheless, logging is my biggest complaint with Lightsail containers at the moment. The console UI for tracking logs is simply not at the level that can be used seriously.tailing logs is missing and requires constant refreshingdate and time for log entries is in UTC time but the timeframe picker is in viewer's local timeforwarding and centralising logs for Lightsail Containers is very difficult. The only way I was able to achieve an okayish workaround is to embed Filebeat in every image in order to send logs to somewhere better suited for viewing logs – i.e logz.iohaving to include Filebeat in every image is cumbersome and unnecessarily increases the size of images. Something like Heroku's log drain or DigitalOcean's App Platform log forwarding is neededit's not possible to capture container deployment logs and forward them to something like logz.ioA container can run 10 images and it seems Lightsail does not force all 10 to be the same image. This means my container can run 1 nginx load balancer image, 5 Rails images, 1 Postgres database image and 1 Redis and 1 Meilisearch image. However to deploy a new version of my Rails app I have to deploy Postgres, Redis and Meilisearch too. Why not allow deploying them individually? At the moment if a deploy does not specify the DB, Redis and search images, Lightsail will turn off any running instances of those images. That seems odd to me.Finally, the documentation for this product is light and scarce. When I think about how Lightsail can run 10 images/services per container, it makes me wonder why the team isn't blogging about various use cases that can benefit from this and describe techniques that would help folks like me not have to invent the wheel through trial and error. This is a huge opportunity to attract devs who want to try an idea on the cheap and then transition to EC2 or ECS when they outgrow Lightsail.Anyway. It's assuring to see two responses to my original question. I look forward to your response and future announcements.CommentShareAWS-User-Armananswered a year agosisira_n a year agoThank you so much for the detailed feedback! All valid points about logging. We acknowledge the importance of log tailing and forwarding and something we are definitely looking at adding. Interesting feedback on being able to do "partial" deployments. We had briefly considered supporting such deployments earlier but it needed more investigation. I am putting it back on our list to investigate if/how we could support it.Apologies on the sparse documentation - we have planned some initiatives in the new year to improve on that. Again, thanks for all the feedback and please keep it coming!ShareAWS-User-Arman a year agoI can not wait. Thank you.Share1Hello! AWS typically announces new features to services very close to their release date or just after. It's uncommon to publish a future roadmap.If you would like to follow updates for a particular services, you can visit the AWS What's New page https://aws.amazon.com/new/ and choose "Filter by Product or Service>Compute>Amazon Lightsail".For example, less than two months ago Lightsail introduced AWS Cloudformation support https://aws.amazon.com/about-aws/whats-new/2021/10/amazon-lightsail-support-aws-cloudformation-instances-disks-databases/CommentShareSUPPORT ENGINEERFrancisco_Lanswered a year ago"


Question: CIS OS level benchmarks on New Amazon Inspector

"Our team are finding a native AWS solution to perform periodical CIS benchmark scanning on our EC2s (windows, rhel), seems like this capability only offered from AWS Inspector Classic, and is deprecating. We are referring the guide here https://aws.amazon.com/blogs/devops/deploying-cis-level-1-hardened-amis-with-amazon-ec2-image-builder/.Furthermore, the new Inspector doesn't supported benchmarks for OS either, is this feature within the roadmap? As much as possible we try to contain our solution within AWS and not resort to third party scanning tools.Would appreciate any replies. Thank youFollowComment"

Answer: "0Accepted AnswerHello,I understand that you have a requirement to perform CIS scans on EC2 resources.The new Inspector currently does not support rulesets/packages unlike Inspector Classic. The new Inspector generates a risk score for each finding by correlating common vulnerabilities and exposures (CVE) information with network reachability results, exploitability data, and social media trends[1].Now, with regards to your query, will the new Amazon Inspector offer CIS Operating System Security Configuration Benchmarks scans, the Inspector FAQ mentions the following[1]:"No. While Amazon Inspector does not currently support CIS scans, this capability will be added in the future. However, you can continue to use the CIS scan rules package offered in Amazon Inspector Classic."There is an active feature request with the Inspector service team to add support for CIS scans in the new Inspector. While I am unable to comment on when this feature may get released, I request you to keep an eye on our What's New[2] and Blog pages[3] for any new feature announcements.Until then, as mentioned above you can continue using Inspector Classic for scans using CIS package.[1] Inspector FAQ - https://aws.amazon.com/inspector/faqs/[2] AWS News Blog - https://aws.amazon.com/blogs/aws/[3] What's New with AWS - https://aws.amazon.com/new/CommentShareSUPPORT ENGINEERPratyush_Sanswered 5 months ago"


Question: Cannot view or restore backups from AWS Backup

"I had setup AWS Backup some time ago for RDS and, as far as I could tell, it was correct. I was able to restore from it in my tests (from both vaults - one for production with WORM setup, and one non-production vault for resources that are used for development). The backups were also running correctly - I would see them being made each day for the Snapshots and Continuous also looked correct.Just recently - mid last week - I have not been able to see or access backups. When I view the Backup Vaults as the root user of the account, I no longer see any backups from a certain date forward (Creation Time doesn't go past May 12th). When I look at the specific protected resources, I can see creation times sooner than that, but the backups are all prefixed with rds: rather than awsbackup:. Given that AWS Backup is managing the backups (or should be) this doesn't make sense to me.Additionally, when I actually go to attempt a restore from the console with ANY of these, I receive an error that says: "Failed to retrieve snapshot."Again, I am using this as a root user and it did work previously. Very concerned about this. I would appreciate any help or guidance.FollowComment"

Answer: 0Have you checked CloudWatch/Trail for failed backup events?  The logs may show what changed in the systems as well.AWS Backup Monitoring: https://docs.aws.amazon.com/aws-backup/latest/devguide/monitoring.htmlAmazon RDS Events: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/working-with-events.htmlCommentShareDan_Hanswered a year ago


Question: Can't create Amazon issued certificate of my BeanStalk domain

"Error message says that "Additional Verification is Required"in the error description it says to contact support if you have a support plan (which we don't), otherwise reach out on the forum which redirected me to re:Post.FollowCommentJackson a year agoHi Illya. Could you perhaps give more details about the problem you are facing. Are you creating the certificate directly using the cert manager or through some other process? Where/when does this error occur and are there any additional details.Share"

Answer: "0It sounds like you're creating a certificate in Amazon Certificate Manager (ACM).  It would be helpful to know whether the domain for your certificate is managed by Route 53 or an external service.  Either way, you need to verify that you own the domain or have admin access to it, just it is easier to do that when using Route 53.  There are a couple ways to verify the domain, creating CNAME records in your domain's DNS entry is the best in my opinion because it allows for automated cert renewal.  ACM will tell you the records you need to create, and if your domain is hosted by Route 53 it will give you an option to automatically create them.  Take a look at the following for reference: https://docs.aws.amazon.com/acm/latest/userguide/domain-ownership-validation.htmlCommentShareRob Pattonanswered a year ago"


Question: Cannot find namespace 'ZenObservable' issue with aws-appsync-subscription-link in AWS AppSync JavaScript SDK

"ISSUE WITH  aws-appsync-subscription-link package in AWS AppSync JavaScript SDK.I am using the Apollo client v3.x along with aws-appsync-auth-link and aws-appsync-subscription-link packages in an Angular v12+ project.I am trying to upgrade Apollo Client from v2.6 to v3.x. While doing so I had to upgrade aws-appsync-auth-link and aws-appsync-subscription-link packages too to their latest version. Below is my current package.json:{  "name": "test-apollo-client",  "version": "0.0.0",  "scripts": {    "ng": "ng",    "start": "ng serve",    "build": "ng build",    "test": "ng test",    "lint": "ng lint",    "e2e": "ng e2e"  },  "private": true,  "dependencies": {    "@angular/animations": "12.2.0",    "@angular/cdk": "12.2.0",    "@angular/common": "12.2.0",    "@angular/compiler": "12.2.0",    "@angular/core": "12.2.0",    "@angular/forms": "12.2.0",    "@angular/localize": "12.2.0",    "@angular/platform-browser": "12.2.0",    "@angular/platform-browser-dynamic": "12.2.0",    "@angular/router": "12.2.0",    "rxjs": "~6.6.0",    "tslib": "^2.0.0",    "zone.js": "~0.10.2",    "@apollo/client": "^3.5.10",    "aws-appsync-auth-link": "^3.0.7",    "aws-appsync-subscription-link": "^3.0.10",    "graphql": "15.6.0",    "zen-observable-ts": "^1.1.0",    "@types/zen-observable": "^0.5.3"  },  "devDependencies": {    "@angular-devkit/build-angular": "12.2.6",    "@angular/cli": "12.2.6",    "@angular/compiler-cli": "12.2.0",    "@types/jasmine": "~3.6.0",    "@types/node": "^12.11.1",    "codelyzer": "^6.0.0",    "jasmine-core": "~3.6.0",    "jasmine-spec-reporter": "~5.0.0",    "karma": "~5.1.0",    "karma-chrome-launcher": "~3.1.0",    "karma-coverage": "~2.0.3",    "karma-jasmine": "~4.0.0",    "karma-jasmine-html-reporter": "^1.5.0",    "protractor": "~7.0.0",    "ts-node": "~8.3.0",    "tslint": "~6.1.0",    "typescript": "4.2.3"  }}When trying to do ng build I am getting below errors:Error: node_modules/aws-appsync-subscription-link/lib/subscription-handshake-link.d.ts:18:71 - error TS2503: Cannot find namespace 'ZenObservable'.  18     connectNewClients(connectionInfo: MqttConnectionInfo[], observer: ZenObservable.Observer<FetchResult>, operation: Operation): Promise<any[]>;                                                                          ~~~~~~~~~~~~~Error: node_modules/aws-appsync-subscription-link/lib/subscription-handshake-link.d.ts:19:68 - error TS2503: Cannot find namespace 'ZenObservable'.  19     connectNewClient(connectionInfo: MqttConnectionInfo, observer: ZenObservable.Observer<FetchResult>, selectionNames: string[]): Promise<any>;                                                                        ~~~~~~~~~~~~~Error: node_modules/aws-appsync-subscription-link/lib/subscription-handshake-link.d.ts:20:67m - error TS2503: Cannot find namespace 'ZenObservable'. 20     subscribeToTopics<T>(client: any, topics: string[], observer: ZenObservable.Observer<T>): Promise<unknown[]>;                                                                     ~~~~~~~~~~~~~Error: node_modules/aws-appsync-subscription-link/lib/subscription-handshake-link.d.ts:21:63 - error TS2503: Cannot find namespace 'ZenObservable'.  21     subscribeToTopic<T>(client: any, topic: string, observer: ZenObservable.Observer<T>): Promise<unknown>;                                                                 ~~~~~~~~~~~~~Error: node_modules/aws-appsync-subscription-link/lib/types/index.d.ts:75:15 - error TS2503: Cannot find namespace 'ZenObservable'.75     observer: ZenObservable.SubscriptionObserver<any>;A sample Angular v12 app is created in https://github.com/wildbsiu/testing-aws-appsync-subscription-link-issue to reproduce the issue. Run ng build command to reproduce the error(s).FollowCommentDan Guisinger 9 months agoDid you find a solution for this?  I am dead in the water with AppSync because of this.I had used Angular Apollo with code generation to retrieve all my data just fine, realized I needed these providers to pull data via subscription and now I'm stuck with this same error for several days.  I went from feeling like my project was nearly complete, to now considering abandoning AppSync.Share"


Question: Cloud Quest: Identity and Access Management

"For some reason I am not allowed access to Sessions Manager during the lab. I've restarted the lab 3 times to go through, but it didn't fix the problem. Running Cloud Quest on Chrome on MacOSFollowComment"

Answer: "0Please follow the steps to troubleshoot and let us know.Check if your IAM user has the necessary permissions to use Session Manager. You can do this by going to the IAM console, selecting your user, and verifying that the necessary permissions (e.g., ssm:StartSession) are included in your user policy.Ensure that your browser is up-to-date and that you have the latest version of any necessary plugins (such as the AWS Systems Manager plugin).Try using a different browser or clearing your browser cache and cookies.CommentSharehashanswered a month ago"


Question: ECS CodeDeploy "install" step is taking a while.

ECS CodeDeploy "install" step is taking a while.  What exactly is involved in the "install" step during ECS CodeDeploy.  I'm thinking the task/container is being created.  I'm trying to figure out how to reduce the time associated with the "install" step.  Any help will be greatly appreciated.  Thank you.FollowComment

Answer: "0Hi -You are mostly correct, during the install step the application is being installed on a task set that is going to replace the old one.Specifically, during the Install lifecycle event:A replacement task set is created in your Amazon ECS service.The updated containerized application is installed into the replacement task set.The second target group is associated with the replacement task set.[1]It's unclear exactly how long the step is taking, but in general it's not a step that will be finished very quickly (like within a min) because of the heavy weight activities going on.That said, you might want to see if the size of our container images is a factor.CommentShareJason_Sanswered a year agoelbigbadmo a year agoI can probably improve the container image size.Any idea on what I can adjust for #1, #2, or #3?  Maybe adjusting the health check times on the load balancer for #3.Share"


Question: Does the AmazonS3 class from the AWS JavaSDK use the public internet to upload a file to an s3 bucket?

"I am building a spring boot application that can upload images to an s3 bucket. When its finished it will run on an EC2 instance that is in the same region as my s3 buckets.The sping boot application is using the  AWS sdk for java to connect to and upload files to s3. The s3Client class that does the uploading is instantiated in the following way:@Beanpublic AmazonS3 s3client() {    BasicAWSCredentials awsCreds = new BasicAWSCredentials(awsId, awsKey);    AmazonS3 s3Client = AmazonS3ClientBuilder.standard()            .withRegion(Regions.fromName(region))            .withCredentials(new AWSStaticCredentialsProvider(awsCreds))            .withClientConfiguration(            new ClientConfiguration()                    .withMaxConnections(MAX_CONNECTIONS)            .withMaxErrorRetry(3)            )            .build();    return s3Client;}When I upload a file from localhost it must go through the public internet. But i want the s3Client to use the internal network of the AWS region once the application is running on EC2, simply because its a lot faster.My question is: Will the s3Client do this by default or do i need to configure it to use the internal network? If so, how do i do that?ThanksFollowComment"

Answer: "0Accepted AnswerWhether AWS API calls go via public internet or not is determined by your VPC networking setup - specifically VPC Endpoints.  For the S3 service you can have either a Gateway or Interface VPC Endpoint.  Generally a Gateway one is the way to go unless you need access to the endpoint from on-prem.  So if your VPC is set up with an S3 Gateway VPC Endpoint and you have the appropriate route in your route tables, then any AWS API calls to S3 from your EC2 instance will stay on the AWS network.CommentShareEXPERTskinsmananswered a year ago"


Question: Amazon - Polly support for PHP

Hello we upgraded our php sdk and now Polly stopped working. I have searched around fourms if it supports php latest version and could not find any answer. Can you clarify if polly works with php version 8.0.17?PHP SDK 3FollowComment

Answer: 0Just following up and please refer to following link for supported versions:https://www.php.net/supported-versions.phpPlease also refer to following links related to PHP interactions:https://github.com/aws/aws-sdk-php#getting-startedhttps://github.com/aws/aws-sdk-php/blob/master/tests/Polly/PollyClientTest.phphttps://www.php.net/downloads.php#v8.2.6Please also refer that recommendations for the AWS SDK for PHP Version 3 which states the minimum supported PHP version is 5.5.0https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/getting-started_requirements.htmlCommentShareN_Agarwalanswered 9 days ago


Question: Broker host name convention

"Do the hostnames for the brokers follow any convention ?b-3.CLUSTER NAME.??????.?????.kafka.us-east-2.amazonaws.comThanks,JasonEdited by: jcoelho on May 9, 2019 2:17 PMEdited by: jcoelho on May 9, 2019 2:17 PMFollowComment"

Answer: "0The bootstrap brokers naming is an opaque string that is used internally. Similar to a unique identifier and essentially random.  ThanksCommentShareAWS-User-6643836answered 4 years ago0Followup - Can we assume that these host names will never change once the cluster is created ? The reason I ask is because we have FW rules between our Datacenter VMs and AWS. So, a hostname that changes in case of a failover, will cause issues.CommentSharejcoelhoanswered 4 years ago0Hello, in general there is no guarantee that the host names will never change. However, even if they change this will not have any impact on a running application. The way the Kafka protocol works is that, after receiving these bootstrap brokers, the clients keep track and refresh the metadata including the broker addresses for all brokers they talk to in the cluster. If brokers change their IP address, the clients will refresh that metadata with no downtime to the application.Could you work with security group rules instead of individual addresses? Thanks.CommentShareAWS-User-0635593answered 4 years ago"


Question: Route 53 TLD registration support

We'd like to consolidate all of our domain registration on AWS Route 53. Please add support for registering some of these TLDs:.store.page.menu.chat.market.one.appFollowCommentCarltonHenderson a year ago+1 We also want the .one TLD.Share

Answer: "1.dev would also be greatCommentShareJeffBaconanswered a year ago0Hello, thank you for reaching out.I understand that you are requesting support for the following TLD registrations on Route 53:.store.page.menu.chat.market.one.app.devRoute 53 Domains is currently directly accredited with .com, .net, and .org registries. All other TLDs are provided via third party registrar associates. To improve our level of service and support, we are actively working to become directly accredited with all other TLDs. In addition to improving our existing offering, we will become accredited with other registries to expand our TLD catalog. This work is currently in progress. We do not currently have dates to share for adding new TLDs.You can monitor the updates here at AWS Blogs - https://aws.amazon.com/blogs/aws/You can also take a look at the following link to see what's new on AWS - https://aws.amazon.com/new/CommentShareAustin_Lanswered 10 months ago"


Question: Can't connect to a Apache Web Server (EC2 instance) http://ec2-54-255-32-232.ap-southeast-1.compute.amazonaws.com

I installed putty and Apache Web Server on my VPC EC2 instance (AWS Linux.But I can't connect to my newly created Apache Web Server by:http://ec2-54-255-32-232.ap-southeast-1.compute.amazonaws.comMy Inbound rule:Type: SSHProtocol: TCPPort range: 22Source: Custom: 0.0.0.0/0But failed.Can you help me? Any idea?FollowCommentBrettski-AWS EXPERTa year agoI recommend that you don't put the DNS name (or IP address) of your instance on the forum. This is a public space and someone may use this information in a malicious way to attempt to compromise your instance.Share

Answer: "0HelloYou need to open port 80 HTTP so that you can access the apache page please check the security group, Here is the link helpfulCommentShareGKanswered a year agoAWS-User-7964535 a year agoThanks for your information provided. But still failed.I don't know how to handle this website issue.Share0Hi there,It turns out most browsers try to resolve using SSL when URLs are opened even if you don't have an SSL configured on your server. That's why you are getting the error. To solve this, copy the IP to the browser directly or right click on the URL and choose the 'Go to option.' This will open the link without SSL.CommentShareMaureen_Keanswered a year agoAWS-User-7964535 a year agoStill failed.Same error: This site can't be reached.Share0Thanks for your reply,.However, my AWS EC2 is a Linux server:Amazon Linux 2 AMI (HVM) - Kernel 5.10How can I run telnet? Or is there any similar Linux command?CommentShareAWS-User-7964535answered a year agoBrettski-AWS EXPERTa year agoTelnet is by far the easiest and simplest way to do this. Just install it: sudo yum install telnetShare0I have added 2 inbound rules:IPV4, SSH, TCP, Port range: 22, Source: done by running https://checkip.amazonaws.com on my Windows 10 PC.IPV4, HTTP, TCP, Port 80, Source: 0.0.0.0/0On the web server, I have already enable port 80 and port 443.Then I tested my Apache Web server by: http://ec2-99999999.xxxx.compute.amazonaws.comBut still got the error: This site can't be reached.I have no idea about this issue and don't know in what way I should handle it.Please help me, thanks a lot.CommentShareAWS-User-7964535answered a year ago0"To solve this, copy the IP to the browser directly or right click on the URL and choose the 'Go to option.' This will open the link without SSL."Still failed.Same error: This site can't be reached.CommentShareAWS-User-7964535answered a year ago0Some troubleshooting steps:On the instance, try doing telnet 127.0.0.1 80 (or 443 - up to you) and see if the session opens. That proves that the Apache server is running.For good measure, also try the same command to the local IP address of the instance: telnet 10.0.0.24 80 for example.Create another instance in the same subnet and perform that second telnet command from the other instance.If all three work then I'm not sure what the problem is because the routing and the public IP clearly work because you can SSH to the instance.However, I'm guessing that at least one of the three above will fail.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: How to automate Opensearch Dashboard Security and Alerting Tasks

"I have created the Opensearch Dashboard with Cognito Authentication and Fine Grained access control using CDK and able to login to the Dashboard and create Roles, map roles, create monitors, destinations etc in the Dashboard UI. But i would like to create these as part of the CDK stack itself using Custom Resource via Lambda but i'm not able to find opensearch dashboard client to perform this operations from Nodejs lambda. Any pointers on this would be really helpful.FollowComment"

Answer: "0Accepted AnswerThere is no Opensearch Dashboard SDK available at this time but I'm able to achieve this as part of the CDK Stack using Custom Resource Lambda, Opensearch Dashboard APIs, AWS NodeHttpClient with Sigv4.There is an open requests for adding this capability in the Javascript client though.https://github.com/opensearch-project/opensearch-js/issues/264CommentSharerePost-User-6922853answered 7 months ago"


Question: I ended my resources after Free Tier had ended

"so I got the email to remind me to end any resources still active (before Apr 30), and I saw that my bill is $0, and I actually thought that was the bill because I remember ending all resources the last time I used it.Now I saw that the bill has increased at $0.26 and I just now terminated all the resources, will the bill still increase? if not how could I stop getting billedFollowComment"

Answer: "0Accepted AnswerIt is necessary to identify which resources are incurring charges.Use the "AWS Cost Explorer" to identify which resources in which regions are incurring charges.https://docs.aws.amazon.com/ja_jp/cost-management/latest/userguide/ce-what-is.htmlAfter identification, if the resource is unnecessary, it can be deleted and no fee will be charged.CommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-8844908 a month agoWell I did go to all my regions and terminated the resources, so it's fine right? I won't be charged furthermore even if I terminated them after the free tier has ended?ShareRiku_Kobayashi EXPERTa month agoIn rare cases, EC2 or RDS snapshots may be left behind, which may incur a fee, so it is a good idea to check.Yes, you will not be charged after cancellation.Share"


Question: Amazon VPC transit gateway attachment in "Failed" status and automatic deletion

"Does an Amazon VPC transit gateway attachment in "Failed" status automatically get deleted after a short period of time? For example, a failed NAT gateway is automatically deleted after about an hour.FollowComment"

Answer: "0Accepted AnswerAn Amazon VPC transit gateway attachment in "Failed" status is marked as "deleted" and therefore, automatically removed after two hours.CommentSharejkapsanswered 3 years ago"


Question: Does SSM Patch Manager support automated snapthot creation before Patches will be installed?

We plan to use the Patch Manager in automatic way to install OS patches (SLES).Normally  before wie start to patch a system we create first a Snapshoot of the root volume and than we start patching.I can't find any Information about that in context of the SSM Patch Manager to create a snapshot of the node before patching started.FollowComment

Answer: "0Accepted AnswerHi there, Yes, it does support using AWS-PatchInstanceWithRollback runbook. Take a look at https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-patchinstancewithrollback.html for more details. you may need to open it in pdf to get the details.Please upvote the answer if this helps.Thanks,YogeshCommentShareYogeshanswered 5 months ago"


Question: Unable to purchase prepaid HITs

"Hello,I was not able to purchase prepaid HITs on the Amazon Mechanical Turk requester site today (Sept 24). Each time that I tried to make a purchase, I got the error message "There has been an error displaying your payment methods, please refresh and try again", and refreshing the page does not work either...I'm wondering whether anyone has encountered the same issue? How can I add payment to my requester account in this case?Thanks.FollowComment"

Answer: "0We're still seeing this issue now and we've filed multiple tickets. Amazon hasn't updated their status page with any issues so far (https://requester.mturk.com/status/).Edited by: TeamZebra on Sep 24, 2021 6:33 PMCommentShareTeamZebraanswered 2 years ago0And nothing until now? I still have the same issue.CommentShareBilal Ghanemanswered 7 months ago0We are also seeing this error and unable to purchase prepaid hitsCommentShareUser Researchanswered 7 months ago"


Question: Python Lambda AWS Parameters and Secrets Lambda Extension timeout randomly

"Hi, I have set up a Python 3.10 Lambda that has attached Secret Layer and NO VPC attached.The timeout time is 20 secondsThe execution normally takes 1-3secondsAll Secret Layer variables aren't set, so the defaultI have noticed that randomly (1 in ~10) the execution timeout. I have enabled the PARAMETERS_SECRETS_EXTENSION_LOG_LEVEL to DEBUG and checked in CloudWatch logs:[AWS Parameters and Secrets Lambda Extension] 2023/05/24 14:35:16 INFO ready to serve traffic[AWS Parameters and Secrets Lambda Extension] 2023/05/24 14:35:16 DEBUG Caching secret with key /secretsmanager2023-05-24T14:35:36.156Z b6b0... Task timed out after 20.05 secondsNormally after the DEBUG Caching secret with key /secretsmanager... line, the source code is executed and the function succeds.But in some cases the source code doesn't even start , so I can't write any logs inside because it doesn't get thereAny help is appreacited,FollowComment"

Answer: "0Assuming that you are using the AWS SDK, there are three reasons why retry and timeout issues occur when invoking a Lambda function with an AWS SDK:A remote API is unreachable or takes too long to respond to an API call.The API call doesn't get a response within the socket timeout.The API call doesn't get a response within the Lambda function's timeout period.For more information, please look at the following URL:https://repost.aws/knowledge-center/lambda-function-retry-timeout-sdkPlease inform me if my answer was satisfactory by accepting my response with an up-vote.CommentShareAWS-User-5160897answered 6 days agorePost-User-8144263 6 days agoI'm not using the AWS SDKI'm abstracting the call using the Lambda LayerShare"


Question: Reservations Bill Breakdown for Linked Account

I'm having a hard time figuring out if reserved instance costs appear in Cost Explorer in the account they were purchased or in the account where they were applied.For example I have an Management Account and two sub accounts B and C. If the reservations I bought in the Management Account are applied to EC2 instances in account B are they billed to the Management Account or B when I break out costs by linked accounts?Put another way. Do reserved instances get applied to the Management Account as a lump sum at the beginning of the month or are they reflected as EC2 costs (billed at a lower rate) accrued inside of the linked account? When I look at my cost explorer by linked account do I see all the costs generated in that account including the reserved instances that were consumed by the account or are reserved instances billed in the account they were purchased in?FollowComment

Answer: "1Hi there,Thank you for reaching out to us. Let me address each of your questions separately :Will reserved instance costs appear in Cost Explorer in the account they were purchased or in the account where they were applied.?The Reserved Instance costs comprises of different charge types. If your reserved instance purchase is a  'Partial Upfront' (or) a 'No Upfront' purchase - there will be a monthly recurring charge. This will get reflected in the linked account. You can see this --> If you use Group by option as 'Charge type` in your Cost Explorer service.With respect to the Billing benefit application of the reserved instance --> If there are one - to- one attribute matches with an instance ; it will get applied to the same account. Now, if your organization has RI and SP discount sharing enabled at the payer account level and your account doesn't have the same set of Instances/attributes you purchased for --> it will get applied to the same attribute usage in Linked accounts.In short - You can see the Billing benefit of the reserved instance usage by using Filter : 'Reservation applies usage' and Recurring fee using Monthly Recurring fee under section Charge type . Please ensure to use the Group by option Linked account in cost explorer.See(i). How Reserved Instances are applied(ii).  https://aws.amazon.com/premiumsupport/knowledge-center/reserved-instance-applying-why/'I have an Management Account and two sub accounts B and C. If the reservations I bought in the Management Account are applied to EC2 instances in account B are they billed to the Management Account or B when I break out costs by linked accounts?'Yes, you're right. The Billing benefit of RI's purchased in management account are being utilized by the linked accounts; if the RI and SP discount sharing in enabled on the Payer account's Billing preferences section in their billing console.The recurring charges are rolled back to payer account ; as they all are part of an organization.The Owner of the RI - any account ; shows the recurring charge.'When I look at my cost explorer by linked account do I see all the costs generated in that account including the reserved instances that were consumed by the account or are reserved instances billed in the account they were purchased in?`You see both. You just have to group it by Charge type in the cost explorer feature to understand which is the monthly recurring charge and which is the Reservation applied usage.See Filtering the data that you want to view - Filter and group optionsPlease let us know if you face any issues, We'd be glad to be of help!CommentShareNithin Chandran Ranswered a year agoNataliya_G EXPERTa year ago"If your reserved instance purchase is a 'Partial Upfront' (or) a 'No Upfront' purchase - there will be a monthly recurring charge. This will get reflected in the linked account." - I'd rephrase it: the fees will reflect on the account where the RI was purchased. Any upfront and any monthly recurring charges for RIs will always be reflected on the account that purchased the RI if you use unblended cost view (switch views in the bottom right corner of cost explorer). However, if you switch to amortized view, this is when you'll be able to see which linked accounts the discount was applied to, when grouping by linked accounts.Share1Check out the links to documentation that @Nithin Chandran R provided, as there's some useful info in regards to how RIs apply to accounts in Organization. But in short, here are quick responses to your questions specifically:I'm having a hard time figuring out if reserved instance costs appear in Cost Explorer in the account they were purchased or in the account where they were applied.The fee for the RI itself (either an upfront fee, or the recurring monthly fee, depending on the purchase option you chose) will always go to the account that purchased the RI. So, if you buy your RI on the Management Payer account - that account will receive the charges for the RI itself. If it was purchased on the linked account, that linked account will be charges for the RI (EVEN if that account is not using the discount from the RI it purchased).For example I have an Management Account and two sub accounts B and C. If the reservations I bought in the Management Account are applied to EC2 instances in account B are they billed to the Management Account or B when I break out costs by linked accounts?In Cost Explorer you have an option to view charges either as "unblended" or "amortized" (see advanced options in the bottom right corner of Cost Explorer console). In case of unblended, any fees you pay for the RIs are allocated to the accounts that actually purchased the RIs. "Unblended cost" is what appears on your monthly AWS invoice. When you look at "amortized cost" - this is where you can see the RI discount is actually applying (to which linked accounts). Essentially, on your monthly AWS invoice, you would normally see RI fees on the account that purchased the RI, and you would see $0 charges for usage on linked accounts that benefited from the RIs. But if you want to see which accounts benefited from the RIs, you can group your Cost Explorer graph by linked account, and use amortized view for checking this.Put another way. Do reserved instances get applied to the Management Account as a lump sum at the beginning of the month or are they reflected as EC2 costs (billed at a lower rate) accrued inside of the linked account? When I look at my cost explorer by linked account do I see all the costs generated in that account including the reserved instances that were consumed by the account or are reserved instances billed in the account they were purchased in?It's both :) depending on whether you look at the unblended of amortized cost. And depending which one you need. From AWS monthly invoice perspective, the RI fees are charged to the account that purchased the RI. When you look at Cost Explorer grouped by linked account, and if you use amortized cost, you will see the EFFECTIVE cost of your RI applied to the account that benefited from the discount (because on the invoice, the on-demand cost will be $0 for resources that benefited from the RI discount).CommentShareEXPERTNataliya_Ganswered a year ago"


Question: Security Hub log findings

"The CIS benchmark is flagging child accounts that are configured to forward logs to a dedicated log account within the same organization as not having logging configured properly. Would the best practice here be to suppress the log related findings on those accounts and create a custom config rule to look for accounts that do not have log forwarding configured?Second question:Is it possible to modify CIS benchmark SNS notifications to include more verbose logdata or does that require a Security hub Finding custom action event? Specifically the customer is looking for the log data that triggered the event to be in the email, rather than having to go to the security hub dashboard. Example, CIS-3.1-UnauthorizedAPICalls - can the log that triggered the threshold be included in the SNS message? I can't seem to locate in the security hub documentation if this is possible without using Cloudwatch events custom findings.FollowComment"

Answer: "0Accepted AnswerPlease see the answer to your questions below:Q1. For customers with central logging they can disable the CIS 3.x checks in all child accounts that are pushing logs to a centeral account and only have these checks in the central logging account see - https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-cis-to-disable.htmlCIS 2.1 and FSBP [Cloudtrail.1]– Checks if cloudtrail is enabled in all regions and if a multiregion cloud trail exists respectively. As best practice customers should have an org trail (which is enabled on all accounts in the organization by default). If the customer is not using an org trail i.e they have centrall logging configured which involves manually adding account to the central trail then they will need a way to audit accounts that are not forwarding to the central trail using a custom rule.Q2. For CIS 3.x this is only checking if the filters/alrams are in place. As far as I know, If the customer wants details on the activity that triggered the alarm, they will need to use CWE custom findings and transforms. I hope this helps!CommentShareAWS-User-7741164answered 3 years ago"


Question: Pinpoint - where do I see the user list?

"Where in the Pinpoint console do I go to see the list of users?I'm trying to send a test notification, and I just want to send it to all the devices, but it's asking me for an 'endpoint id' or 'device token'. I don't know where to find either of them.FollowComment"

Answer: "0Open the Amazon Pinpoint console.On the All projects page, choose the project that you want to view endpoints for.In the navigation pane, under Analytics, choose Endpoints.This page displays a list of the endpoints that are associated with your application.The Endpoint ID and Device token are associated with each endpoint. When sending a direct message, you need to specify one or more endpoint IDs.CommentShareEXPERTsdtslmnanswered 5 days ago"


Question: Amazon WorkSpaces guidelines for concurrent build for scale

When doing large deployments  (100s/1000s of WorkSpaces) you can script the build out with the createworkspace API command (https://docs.aws.amazon.com/workspaces/latest/api/API_CreateWorkspaces.html). That will perform up to 25 WorkSpace builds.How long should a customer wait before sending another API call? I've seen "3 minutes" but if anyone has more info/recommendations that'd be helpful.Would this be consistent between regions?FollowComment

Answer: "0Accepted AnswerThe customer can send the next "batch" through as quick as the API endpoints can handle the ingest, but the builds may get queued up in the back end for very large builds. PowerShell is very good at handling batching, retries, and back off for you, which may also be helpful. Each region has its own limits on max numbers of builds (both on a per account as well as a per region basis) to help prevent the total environment from being affected, which is why there is a queuing process in place.CommentShareEXPERTMatt_Janswered 3 years ago"


Question: Lightsail Plesk Stack - Port 25 block

"Recently I looked into using AWS for hosting of my personal project websites and email. I found the Lightsail Plesk hosting stack and this appeared ideal for my needs. I created a new account and then generated a Plesk instance and started to migrate a couple of my domain websites to AWS Lightsail Plesk Instance from current hosting provider Inmotion Hosting.All was looking good but then I discovered I could receive email fine but I could not send any email from the Plesk instance. I did some research and found a link and form to request unblocking of port 25 to allow this to work. I completed and submitted the form. Below are the responses (this seems to be the exact same template others have received."Hello, Thank you for submitting your request to have the email sending limit removed from your account and/or for an rDNS update. This account, or those linked to it, have been identified as having at least one of the following:A history of violations of the AWS Acceptable Use PolicyA history of being not consistently in good standing with billingNot provided a valid/clear use case to warrant sending mail from EC2 Unfortunately, we are unable to process your request at this time, please consider looking into the Simple Email Service. https://aws.amazon.com/ses/ Regards, AWS Trust & Safety"I have none of those and I replied for a further explanation and explained I was a new customer and needing to be able to send and receive email to my user mailboxes. This is the template response..."Hello, Thank you for submitting your request to have the email sending limit removed from your account and/or for an rDNS update. After a thorough review, we confirmed our original finding and cannot grant your request. Please consider looking into the Simple Email Service (SES) https://aws.amazon.com/ses/. We cannot assist you further with this issue and we may not respond to additional messages on this subject. Regards, AWS Trust & Safety "I responded to try clarify but it seems they will no longer engage and ignore my responses.I don't know what to do next as without the ability to use my mailboxes, the plesk stack is no use to me and I will reluctantly need to look for an alternate partner.Can anyone offer any help please.FollowComment"

Answer: "0Would it be possible to try again but with providing more or clearer information with regards to your use case ? This is assuming the first two reasons are not applicable for your account as you have stated.Also, have you included a rDNS setup as described here ?CommentShareAWS-SUManswered 3 months ago"


Question: Filter CloudTrail event in IAM policy

"I need to create a Org SCP to deny "s3:PutBucketPublicAccessBlock" action. What I current have:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "DenyChaningBucketPublicAccessSetting",      "Effect": "Deny",      "Action": [        "s3:PutBucketPublicAccessBlock"      ],      "Resource": [        "*"      ]    }  ]}This will prevent users from changing this setting on existing buckets. However, when creating new buckets, this policy also prevents users from applying "Block public access (bucket settings)", and the result is that bucket is created, but all block public access boxes are unchecked.Looking at CloudTrail event for this particular API PutBucketPublicAccessBlock, I can see this attribute 'requestParameters'    "requestParameters": {        "publicAccessBlock": "",        "bucketName": "testbucket",        "PublicAccessBlockConfiguration": {            "xmlns": "http://s3.amazonaws.com/doc/2006-03-01/",            "RestrictPublicBuckets": true,            "BlockPublicPolicy": true,            "BlockPublicAcls": true,            "IgnorePublicAcls": true        },        "Host": "testbucket.s3.us-east-1.amazonaws.com"    },Is it possible to add a 'Condition' key to IAM JSON to filter for above CloudTrail event data?FollowComment"

Answer: "0Hello,Currently, it is not possible to restrict bucket creation action based on "Block Public Access" settings used by the user/role while creating the S3 bucket. You can use the 'block public access' settings feature on account level via CLI/SDK or AWS management console[1]. Once this setting is enabled, all the buckets are made private including the ones that are yet to be created. However, if you do have public S3 buckets then it will alter your existing setup.There is currently a feature request that is logged to make this use case possible through conditions keys. Unfortunately, we won’t be able to provide you with an ETA on when this feature might be released as I have no visibility over that process. However, all of our new announcements and releases can be found in our What's New page [1] and our Official Blog [2].[1]What's New with AWS -https://aws.amazon.com/new/[2]AWS News Blog -https://aws.amazon.com/blogs/aws/CommentShareSUPPORT ENGINEERAWS-User-6158549answered 10 months ago"


Question: Please validate: SageMaker Endpoint URL Authentication/Authorization

Need validation:Once the SageMaker endpoint is deployed. It can be invoked with the Sagemaker Runtime API InvokeEndpoint OR it can be invoked using the endpoint URL+HTTP AZ headers (below).Successful deployment also exposes a URL (on the console) that has the format:https://runtime.sagemaker.us-east-1.amazonaws.com/endpoints/ENDPOINT-NAME/invocationsWhat is the purpose of this URL (shown on console)?In my understanding this URL Cannot be invoked w/o appropriate headers as then there will be a need to have globally unique  endpoint name!!  THAT IS  to invoke this URL it needs to have the "HTTP Authorization headers"   (refer: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html)I have a customer who is concerned that anyone can invoke the URL even from the internet. Tried to do it and received the <MissingTokenException> so I know it can't be done but just want to ensure I have the right explanation. (Test with HTTP/AZ headers pending)FollowComment

Answer: 0Accepted AnswerYour understanding is correct. From the docs:Amazon SageMaker strips all POST headers except those supported by the API. Amazon SageMaker might add additional headers. You should not rely on the behavior of headers outside those enumerated in the request syntax.Calls to InvokeEndpoint are authenticated by using AWS Signature Version 4.CommentShareAWS-User-6881815answered 3 years ago


Question: Appstream Elastic Fleet set Environment Variables in Windows

"I have an application set up as an Elastic Fleet in AppStream2. I want to set up some environment variables for that application on a per user basis, ideally associated with a user from the User Pool, and not associated with a directory account.The environment variables will contain connection string settings for a database, as well as a user id for the application.Is this possible?FollowComment"

Answer: "0Setting Windows environment variables is pretty straightforward - you can write a script that calls Windows commands to set them (SET/SETX for batch/cmd, $env or [System.Environment]::SetEnvironmentVariable for Powershell).What's a bit more complicated is getting the value to be set to that environment variable. When using the CreateStreamingURL API or SAML2.0 federation, you can use the SessionContext parameter to pass information into the streaming instance which AppStream 2.0 then sets as the AppStream_Session_Context environment variable. User Pools does not support this capability, and isn't recommended for use beyond proof of concepts - it's not meant to be an identity provider. Instead, the recommendation is to integrate your existing identity provider to eliminate the need of managing users/passwords within AppStream 2.0For all authentication modes, AppStream 2.0 also creates the fleet and instance metadata environment variables which you can use on your scripts to get information about the user and the fleet. One way to manage a per-user connection string would be to have a lookup (perhaps through a Lambda function) based the username that's streaming, and return the connection string for them, to be set as the Windows environment variable. Alternatively, if you only have a handful of users, and the information isn't sensitive (eg: no issue if other users see it), store and set the values using a session script that executes before the user session starts.Hope this helps.CommentShareEXPERTMuraliAtAWSanswered a year ago"


Question: Stuck Instance

The following instance is stuck in a stopping state. Can you please clear it?i-1a6417f1Thanks!FollowComment

Answer: 0After about an hour it was finally stopped!CommentShareMrCharlesMineranswered 2 years ago


Question: SSM Agent Latest Version Release Date

"Hi, is there a way to find out when was the SSM agent latest version was made available for update via AWS SDK?FollowComment"

Answer: "0The release notes are on GitHub: https://github.com/aws/amazon-ssm-agent/releasesCommentShareGregBanswered 3 years ago0Yes, I saw that. But I am trying to find a way to know when was the latest version released using AWS SDK for JS or through some other workaround in my code. I have a use case to periodically check whether the latest version is installed on my SSM Managed Instances and generate a notification. The issue that I am facing is that sometimes when a new version is available, SSM takes some time to install the new version and during this timespan, I get a failure notification that my Managed Instances does not have the latest version installed. So I am trying to find a way to get the timestamp for the release date and then wait for some grace period before sending a notification.CommentShareakhtaranswered 3 years ago0Unfortunately, there isn't a way today to get this information via the AWS SDK. I will pass this on to the team as something we can consider for the future.Thanks.CommentSharesatyajeet-awsanswered 3 years ago"


Question: Custom login UI using Amplify + Cognito.

We are developing a custom UI for a login form using Amplify. We were able to do it but we are not getting the configured scopes in cognito. We always receive aws.cognito.signin.user.admin even when it not even checked in the config. Same thing we get using boto3 building our our login backend service.We get the right scopes if we use the hosted UI.FollowComment

Answer: 2AFAIK Custom scopes are not supported without Hosted UI.Hope it helps.CommentSharemtindanswered 9 months agoMichael A 6 months agoThis is what I am finding.  How the heck are you supposed to use Cognito then?  How does Amazon use this?Share


Question: How to re-register a managed node in AWS Systems Manager?

"Hi. I have recently been using AWS Systems Manager (SSM) with a Greengrass core device to execute shell commands remotely from the AWS console. I was successful in executing the shell commands and proceeded with de-registering the managed node due to the fact that the SSM documentation clearly states that "You can reregister an on-premises server, edge device, or VM again at any time. Systems Manager stores the command history for a deregistered managed node for 30 days". I wanted to re-register the same managed node but am unsure how to go about doing this. I tried navigating around the SSM console and even looked in the API reference to see if there was an AWS CLI command to execute to re-register a node. I also tried redeploying the Greengrass components but all these attempts were unsuccessful. Am I missing something here? Any assistance or at least a nudge in the right direction would be greatly appreciated.FollowComment"

Answer: "0Hi,the easiest way since you have Greengrass core running on the device is to deploy the aws.greengass.SystemsManagerAgent component.Alternatively you can manually install the agent by following these instructions.Cheers,MassimilianoCommentShareEXPERTMassimilianoAWSanswered 5 months ago"


Question: What are the data transfer costs between Lambda and Fargate?

I want to make http requests from a running Lambda function to Fargate within the same region. What will the data transfer costs be?FollowComment

Answer: "1Accepted AnswerIf your services are within the same region and not traversing customers network, you will not be incurred data transfer costs. Please see this DTO blog for understanding of data transfer costs between services - https://aws.amazon.com/blogs/architecture/overview-of-data-transfer-costs-for-common-architectures/CommentShareRam_AWSanswered a year agoAWS-User-6060748 a year agoDoes it matter if Fargate and Lambda are in different availability zones?Share1i think it is 0CommentSharetaewoong kdog kimanswered a year agoAWS-User-6060748 a year agoI hope so. Let's see what someone from AWS has to say.Share"


Question: 502 ERROR || The request could not be satisfied

"Generated by cloudfront (CloudFront)Request ID: Q8ButBHQ_qu22oo0A59rNSox60_lT9e2S4dKQE_XkA8z5wWt_gcHwQ==My website is not working from over a month Please Help!!!CloudFront attempted to establish a connection with the origin, but either the attempt failed or the origin closed the connection. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.FollowComment"

Answer: "0Please check your origin (ex. S3, HTTP backend) is active. If it is active, check the configurations like memory are sufficient.CommentShareManikandananswered 9 months ago0Hi therePlease can you post more information about the setup you have? What is your origin server? How does CloudFront connect to your origin?502 errors happen for a few reasons. When there is a host header mismatch or when CloudFront is unable to establish a DNS connection to your Origin server.If you are using a custom Origin, make sure that you have the correct ports open, and that the Origin is internet accessible.Make sure your certificate is valid and that it covers your Host name and any sub-domains you might be using.CommentShareSUPPORT ENGINEERBazzieB_AWSanswered 9 months ago"


Question: Cloud9: Deploy SAM Application option missing

"Hi All,I am trying to deploy a sample lambda Application using Cloud9. I couldn't find "Deploy SAM Application" option under the lambda node in AWS explorer. Screengrab below.  Am I missing something ?Please note that this is a new free tier account and unsure if there are restrictions attachedRegards,JeganFollowComment"

Answer: "0Hey,We are replacing the Deploy SAM Application option with Sync SAM Application to speed up the deployment process of lambda functions. Under the hood Deploy SAM Application uses sam deploy and Sync SAM Application uses sam sync which achieves a similar result. The Deploy SAM Application option can still be enabled in preferences at Project Settings > AWS Toolkit > Aws > Samcli: Legacy Deploy.For the time being, we'll keep Deploy SAM Application as a default choice but Sync SAM Application will most likely be the default option going forward.Hope that helps!CommentShareSergey Kazantsevanswered 5 months ago"


Question: Removed wrong IAM roles

"I destroyed some IAM roles since they did not display a "last active" attribute.Now I cannot access my data properly.When I try to reset my auth settings, I cannot:NoSuchEntity - An error occurred while processing your request: The role with name us-east-1_g9F10WnFw_Manage-only cannot be found.I'm struggling to figure out what Roles to recreate what access to give them to access my amplify environmentNot sure if this helps but here is my aws-export.js:/* eslint-disable */// WARNING: DO NOT EDIT. This file is automatically generated by AWS Amplify. It will be overwritten.const awsmobile = {    "aws_project_region": "us-east-1",    "aws_appsync_graphqlEndpoint": "https://iai3fj7vd5hgjc22z4m7kj5tn4.appsync-api.us-east-1.amazonaws.com/graphql",    "aws_appsync_region": "us-east-1",    "aws_appsync_authenticationType": "API_KEY",    "aws_appsync_apiKey": "da2-****",    "aws_cognito_identity_pool_id": "us-east-1:0afc5fb7-9bb5-45a0-ad98-50a9a38491c0",    "aws_cognito_region": "us-east-1",    "aws_user_pools_id": "us-east-1_eW3yGAOvZ",    "aws_user_pools_web_client_id": "7al4qgvvsu8qkicdsqtl9n4stv",    "oauth": {},    "aws_cognito_username_attributes": [        "EMAIL"    ],    "aws_cognito_social_providers": [],    "aws_cognito_signup_attributes": [],    "aws_cognito_mfa_configuration": "OFF",    "aws_cognito_mfa_types": [        "SMS"    ],    "aws_cognito_password_protection_settings": {        "passwordPolicyMinLength": 8,        "passwordPolicyCharacters": [            "REQUIRES_LOWERCASE",            "REQUIRES_NUMBERS",            "REQUIRES_SYMBOLS",            "REQUIRES_UPPERCASE"        ]    },    "aws_cognito_verification_mechanisms": [        "EMAIL"    ],    "aws_user_files_s3_bucket": "gr-movement-storage-e48b8b36191308-staging",    "aws_user_files_s3_bucket_region": "us-east-1"};export default awsmobile;FollowComment"

Answer: "1If you had AWS Config enabled, you can see the permissions of the IAM role you deleted. [1][1] Restoring an accidentally deleted IAM Policy using AWS Config | DevelopersIOhttps://dev.classmethod.jp/articles/the-way-to-restore-iam-policy/CommentSharemn87answered 8 months ago"


Question: RDS EBS Volume striping

"Hi,From the doc "Depending on the amount of storage requested, Amazon RDS automatically stripes across multiple Amazon EBS volumes to enhance performance.". This statement is not precise.Related to very old thread in 2012: https://forums.aws.amazon.com/thread.jspa?messageID=315713If I create an RDS r5.4xlarge with gp2 (5,334 x 2 GB) of storage, how will the EBS be striped?Can I see the number of volumes and size RDS decides to provision with ?What is the current algorithm on how RDS decides to stripe?Thanks,RobFollowComment"

Answer: "0I don't know if AWS will respond with details, they haven't historically.You have an RDS volume that has an expected number of IOPS associated with it. For io1 that is rather explicit. For gp2 it is implied by base + burst. If you have a >1TB gp2 volume it is a straight 3 IOPS per GB. The exact topology is irrelevant as long as it can deliver the expected IOPS.While RDS had a size limit for gp2 that was less than the size limit for an EBS volume there would have been no obvious reason to stripe. With RDS now having a larger size limit (32TB vs EBS at 16TB) you would obviously have to stripe for volumes greater than 16TB. However, that introduces problems since you have to change the volume topology and rejiggering 16TB is very expensive. So at some pretty modest threshold RDS will either create a volume that is striped over multiple EBS volumes for new creates, or will do the rejiggering when you grow an existing volume that crosses the threshold. This gets you no additional performance, but does allow fast scale operations if you grow the volume beyond 16TB.I'm not comfortable revealing further details without AWS having done so. Is there a reason that making those details public would be useful?CommentShareHalTempanswered 4 years ago0The exact topology matters.Per EBS page https://aws.amazon.com/ebs/features/, max IOPS for a gp2 volume is 16,000 (achieved at 5,334 GB).Thus, if you want to provision 2 x 5,334 GB of space, the optimal to go about it is to create 2 EBS volumes and stripe it. This would net twice the IOPS of 32,000 IOPS while not striping it yields 16,000 IOPS.If I were an AWS RDS team, I would stripe it.AWS, can you respond? This is important because we want to know what we pay for.Thanks,RobEdited by: TravellingSalesPerson on Mar 25, 2019 7:24 AMCommentShareTravellingSalesPersonanswered 4 years ago0Hi, you are correct volume geometry is an important detail in terms of both throughput and IOPS capacity.RDS does not expose the volume geometry directly. However you can discover this detail through the Cloudwatch metrics. If you look in the enhanced monitoring metrics there is a "Physical Device I/O" category. From this you can select reads/s, writes/s. This will show per device metrics from which you can infer the number of volumes in your RAID0 stripe.Understand that when you change the size of the RDS database volume, RDS might change the geometry.thanks,-PhilCommentShareMODERATORphilawsanswered 4 years ago0Thanks Phil@AWS I tried your suggestion out and indeed "Enhanced monitoring" allows us to know how many disks are used.RobCommentShareTravellingSalesPersonanswered 4 years ago"


Question: linux partition on Lightsail

"timeout problem / no space left on devicehi guys, i wanted to ask how to solve a problem. On an instance with this configuration "8 GB RAM, 2 vCPU, 160 GB SSD, Plesk Hosting Stack on Ubuntu" I have Wordpress installed and I can't clean secondary partitions to avoid free space problems during updates. This problem takes the site offline. Is there any tools to check the space and clean this from temporary files or resize these partitions to avoid other problems?I await your advice and wish you a good day.regardsFabioFollowComment"

Answer: "0Hi.I understand that you are experiencing the error below: “timeout problem / no space left on device”To troubleshoot your error you need to upsize your Lightsail instance, block storage disk, or database, create a snapshot of your resource, and then create a new, larger version of that resource using the snapshot [1].Prerequisites: You'll need a snapshot of your Lightsail instance, block storage disk, or database. For more information, see the following document [2]You can also create a new block storage disk and attach it to your instance [3].You can you the following commands to check free space:df -h (With -h option, it shows the disk space in human-readable format (MB and GB)).fdisk -l (Shows disk size along with disk partitioning information (may require sudo privileges)).df -T (If you want to view the disk usage with more details like filesystem type and blocks.)Please see the following link for more information about temporary files: https://developers.redhat.com/blog/2016/09/20/managing-temporary-files-with-systemd-tmpfiles-on-rhel7References: [1] https://lightsail.aws.amazon.com/ls/docs/en_us/articles/how-to-create-larger-instance-from-snapshot-using-console[2] https://lightsail.aws.amazon.com/ls/docs/en_us/articles/create-block-storage-disk-snapshot[3] https://lightsail.aws.amazon.com/ls/docs/en_us/articles/create-and-attach-additional-block-storage-disks-linux-unix[4] https://itsfoss.com/check-free-disk-space-linux/I hope the information above is helpful. Please feel free to reach out for any concerns.CommentSharePhindianswered a year ago"