Question: AWS: How to attach a policy to an IAM user that grants him the privilege to create a verified identity and not access root identities?

"In the root account, I have a verified domain identity that I used to create an email identity for transactional emails.Now, I created a new IAM account.I would like to attach a policy to this IAM account that allows it to create a verified email identity using that verified domain identity in the root account.And he must not be able to list nor use the verified email identity in the root account.Should I use an inline policy for this (which I know should be avoided and left as a last resort) or normal permission configuration?If so how should I write or pick such a policy?EDIT 1:When I tried to create an email using the IAM account, just to see what AWS would say, this is what's written in the notification:You do not have sufficient access to perform this action.User: arn:aws:iam::122443365328:user/iam-user-name is notauthorized to perform: ses:CreateEmailIdentity on resource:arn:aws:ses:us-region:122443365328:identity/test@dmain_name.com because noidentity-based policy allows the ses:CreateEmailIdentity actionAnd when I searched for the CreateEmailIdentity in the inline policy creation dashboard, it was not found:EDIT 2:I have actually found it when I picked SES-v2 as a service:I have granted the IAM user these privileges:And in resources section:I added the ARN of the verified domain name:This is the result:But, still when I try to create an email identity using the IAM account, I still get this:You do not have sufficient access to perform this action. User:arn:aws:iam::12xxxxxx5328:user/iam-user-name is not authorized toperform: ses:CreateEmailIdentity on resource:arn:aws:ses:us-west-2:122443365328:identity/dev@domain_name.combecause no identity-based policy allows the ses:CreateEmailIdentityactionWhat I don't understand here is the meaning of not being authorized to perform ses:CreateEmailIdentity on the resource that I am trying to create which is the new email.How can I be authorized to do that on an email identity that still doesn't exist.EDIT 3:Even after created an email using the root user and granted the IAM user the privilege of sending emails using that email using this policy:[![Image 9][9]][9]{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "stmt1643366831422",      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::12xxxxxx328:user/iam-user-name"      },      "Action": [        "ses:SendEmail",        "ses:SendRawEmail",        "ses:SendTemplatedEmail",        "ses:SendBulkTemplatedEmail"      ],      "Resource": "arn:aws:ses:us-west-2:12xxxxxxxx28:identity/test2@domain_name.com",      "Condition": {}    }  ]}When I send email in the backend, this is what gets logged:🚀 ~ file: emailServices.js ~ line 297 ~ .then ~ error AccessDenied:User arn:aws:iam::12xxxxx5328:user/iam-user-name' is not authorized to perform ses:SendEmail' on resource`arn:aws:ses:us-west-2:1xxxxx28:identity/domain_name.com'Then I authorized the iam user to send email on the Domain Identity using the same policy but applied on the Domain Identity.Now, sending emails using the IAM user credentials works.The problem is that he can send emails using all verified email idenitities.But, I want him to be able to do so by only using the corresponding email identity that was created specifically for that IAM user.NOTE 1:I am aware that I should not use the root account and should instead only use IAM accounts.FollowComment"

Answer: "0Hello,From the above use case, I understand that you need an IAM policy that can verify the identity but not able to list all the identities in the account. Please let me know if I misunderstood the query.For this use case, as you specified create Identity is available in SES v2. With the following set, you can verify and create but not list the identities.["ses:SendEmail","ses:TagResource","ses:CreateEmailIdentity","ses:SendBulkEmail"]SES v2 supports authorization based on tags.Customer engagement services - https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html#engagement_svcs.So if tags are supported for the resource (meaning you can create tags) then you can use "aws:ResourceTag" condition keyas that condition key checks the tag of the resourceControlling access to AWS resources using tags - https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.htmlAWS global condition context keys - aws:ResourceTag/tag-key - >>https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetagUsing tags, you can control on the IAM side and whichever IAM creates the resource should be able to send using that IAM policy. You can give specific verified identity permissions using the following:The following policy permits a user to call the Amazon SES email-sending APIs, but only if the "From" address is marketing@example.com.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ses:SendEmail","ses:SendRawEmail"],"Resource":"*","Condition":{"StringEquals":{"ses:FromAddress":"marketing@example.com"}}}]}Reference : https://docs.aws.amazon.com/ses/latest/dg/control-user-access.htmlPlease let me know if there are any questions or concerns.CommentShareSUPPORT ENGINEERAjinkya B-AWSanswered a year ago"


Question: Lambda Alias don't use "General configuration"

"Hello,When running the general lambda functions with a query, it works fine. However, the signal gets killed when running the same query with an alias version of the lambda functions. The "General configuration" isn't used for the alias, and the default time and memory are used. Is there a way to make the alias use the "General configuration", or is there a way to allocate more memory and time for the alias?best regards,Markus EkvallFollowComment"

Answer: "0I am not sure what you mean by:running function with a querysignal gets killedgeneral configurationHowever, I will try to answer what I think you mean. An alias is just a pointer to a specific function version. Each function version has its own code and configuration. Once a version is created, it is immutable, i.e., it can't be changed. If you need different configuration for a version, make the configuration changes and then publish the new version. Then you can point the alias to the new version and the new config will be used.CommentShareEXPERTUrianswered a year ago"


Question: Basic Account: Add firewall with geoblocking and individual IP bloking

Can a firewall be added to a basic account that allows geoblocking AND individual IP blocking?The application on our basic plan places a form on our website. That form is getting fake submissions from Russia and other countries.We have GeoBlocked our website but some bad actors in other countries are submitting the form through the application hosted on AWS basic. (This is an assumption since I have blocked them by geography and individual IP a the wordpress website. They still reach the application through the blocked country and specific IP address. So I assume the bad actor is accessing our application directly on the AWS server somehow and filling out the form.)Thank you for your assistance with this.Q!FollowComment

Answer: "1Accepted AnswerHi, you should use AWS WAF for the purpose of geoblocking: https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-geo-match.htmlCommentShareDidier_AWSanswered 18 days agoEXPERTTushar_Jreviewed 5 days agorePost-User-5128693 17 days agoThank you Didier_AWS - Appreciate your quick response and the included URL's.Share"


Question: Email notification and Health alert for non-existent certificate

"I had two certificates in ACM one of which was active, with the correct CNAME values against my domain and another that I was not  using. I deleted the one I wasn't using, but I'm still receiving email alerts and an item in the Health Dashboard for this Cert. Is this expected behaviour?FollowComment"

Answer: "0Not helping with your question but I have the same issue, I am receiving emails saying "You have an SSL/TLS certificate from AWS Certificate Manager in your AWS account that expires on May 11, 2022 at 23:59:59 UTC." yet I have no certificates in certificate manager and deleted this one a while ago.CommentShareAWS-User-5166374answered a year ago"


Question: How do I resolve a DNS CNAME conflict from the AWS WordPress Plug-In tool for Cloudfront?

"Following the steps of the  AWS for Wordpress Plug-In, I created cloud front distribution with SSL certificate. However, when I go to Route 53 to add the CNAME record for the distribution, I get the following error messageBad request.(InvalidChangeBatch 400: RRSet of type CNAME with DNS name www.diversereads.org. is not permitted as it conflicts with other records with the same DNS name in zone diversereads.org.)I do not have any other CNAME records (other than the validation one), so I don't know where the conflict is arising from.I went over to the Lightsail console, created a new DNS zone, updated the name servers in Route 53, and was able to add the CNAME record in Lightsail, but my site still shows not secure.FollowComment"

Answer: "1Could you please try the following as per the documentationhttps://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.htmlAdding an alternate domain name1. Sign in to the AWS Management Console and open the CloudFront console at https://console.aws.amazon.com/cloudfront/v3/home.2. Choose the ID for the distribution that you want to update.3. On the General tab, choose Edit.4. Update the following values:Alternate Domain Names (CNAMEs)Add your alternate domain names. Separate domain names with commas, or type each domain name on a new line.[...]Route 53Create an alias resource record set. With an alias resource record set, you don’t pay for Route 53 queries. In addition, you can create an alias resource record set for the root domain name (example.com), which DNS doesn’t allow for CNAMEs. For more information, see Routing traffic to an Amazon CloudFront web distribution by using your domain name in the Amazon Route 53 Developer Guide.CommentShareSrianswered a year ago0That is exactly what I have already done. However the final step, going to Route 53 to add the CNAME record is where I have the problem. I get an error message saying "conflicts with other records with the same DNS name in zone" even though there are no other CNAME records visible in my zone.CommentShareAWS-User-9612707answered a year ago0Based on a DNS query, it looks like you already have an A record for www.diversereads.org - you'll need to remove this to be able to add a CNAME record.CommentSharePaul_Lanswered a year ago0I removed the A record and still got the same error message when attempting to add the CNAME record.CommentShareAWS-User-9612707answered a year ago"


Question: Volumes with Containers in Amazon Lightsail

"Hello,I can not see any way to use volumes with AWS Lightsail. Is this possible ?ThanksFollowComment"

Answer: "0Based on the response to this post, the answer is no.https://forums.aws.amazon.com/thread.jspa?threadID=333846&tstart=75CommentShareDavid Ganswered 2 years ago0Thank you for using Lightsail and giving us your feedback. At the moment, Lightsail container does not support disk volume. I will forward your request to our product team for consideration on our roadmap.CommentShareAWS-User-2776000answered 2 years ago"


Question: G5 Instances availability in Ohio

When are G5 instances expected to be available in Ohio (us-east-2) region?FollowComment

Answer: 0Probably by the end of may 2023 ( estimated ). you can only get recent update under what's new section in AWS website (official)https://aws.amazon.com/new/you can check the feed for Ec2 G5 instances update.CommentShareutkarsh-awsanswered 7 months agorePost-User-8584599 17 days agoStill not available....Share


Question: Analytics Dashboard using AWS with access control

"Hi,We want to publish an analytics dashboard with access controls to corporate clients. The login will be their corporate email and want to give them an ability to change their password. The dashboard will have functionality to view tabular data,  charts and also provide ability to download CSV file for the data.Today, we have a low-cost & low-code solution where we we use AWS Lambda to write data to Google Sheets and then display the sheets data using Google Data Studio (GDS). For GDS, we are able to grant access basis gmail credentials but not able to limit it to corporate emails.Was wondering if there is any AWS solution which can help with this? We don't want to setup a separate EC2 webserver for this exercise and want to use some equivalent of GDS, Tableau, BI which solves the use case.Regards,dbeingsFollowComment"

Answer: "0Hi dbeing,Amazon Quicksight is the equivalent of GDS, Tableau, Power BI. You can update the Lambda function you currently use to write the data to CSV and store it in S3. Quicksight can then direct query the data from S3 using Amazon Athena. Alternatively, you can load the data from S3 into Quicksight's in-memory engine called SPICE.Amazon Quicksight is pretty flexible in terms of licensing and the bast part is that it's serverless so you don't have to worry about managing the infrastructure or how it scales.In regards to access control, you have two options:You can create users in Quicksight using the corporate email addressesYou can use IAM users, ie create the corporate users in your AWS account and give them access to QuicksightWhat I'm thinking is that you can have a Lambda function responsible for user provisioning that will create the Quicksight (or IAM user) and grant them access only if they are a corporate user.CheersCommentShareepertsanswered 8 months agodbeing 8 months agoHi,Thanks a lot for your response. We tried exploring Quicksight but it appears its not available with AWS free tier account and does not have a pay-as-you-go pricing like other services. But we can try it again if it provides a seamless login based access to dashboards. Just few queries for our use case:Can quicksight read directly from DynamoDB? Have most of our data written in DyanmoDB and would want to consume that for dashboard?If it can pick up data from CSV or excel form S3, is there a limit to number of cells / records in the CSV / excel. Google Sheets that we are using for GDS limits it to 10 M cells which requires us to do some monitoring on periodic basis.Regards,dbeingsShare"


Question: Lamdba to pull Cloudfront from AWS Config query

"Hi,I am trying to use a lamdba to pull from multi accounts and grab CloudFront information, but the following aliases "cname" won't come backselectExpression = "select accountId,resourceId,awsRegion,arn,resourceCreationTime,configurationItemStatus,configuration.domainName,configuration.lastModifiedTime,configuration.distributionConfig.aliases.items,configuration.distributionConfig.origins.items.customOriginConfig.*,configuration.distributionConfig.origins.items.customOriginConfig.httpPort,configuration.distributionConfig.origins.items.customOriginConfig.httpsPort,configuration.distributionConfig.origins.items.customOriginConfig.originSslProtocols,configuration.distributionConfig.origins.items.domainName"    selectExpression = selectExpression + " where resourceType = 'AWS::CloudFront::Distribution' print(result['configuration']['distributionConfig']['aliases']['items']) gets an error below but get origin works fine:print(result['configuration']['distributionConfig']['origins']['items'])Any suggestions?also in their docs:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-aliases and works with CLIError:Response{  "errorMessage": "'Aliases'",  "errorType": "KeyError",  "requestId": "345fga5-a4f4-405b-8c43-319f750e6f1a",  "stackTrace": [    "  File \"/var/task/lambda_function.py\", line 62, in lambda_handler\n    print(result['configuration']['distributionConfig']['Aliases']['items'])\n"  ]}{  "aliases": {    "items": [      "www.foo.com"    ]  },  "origins": {    "items": [      {        "domainName": "awseb-e-j-AWSEBLA-1XXXXXXXXXX.us-east-2.elb.amazonaws.com",        "customOriginConfig": {          "originSslProtocols": {            "quantity": 3,            "items": [              "TLSv1.2"            ]          },          "httpPort": 80,          "httpsPort": 443        }      }    ]  }}FollowComment"

Answer: "0The error message indicates that Aliases is specified with an uppercase A but the JSON snippet has aliases which is lowercase. Could that be the issue? Your code shows aliases but the line of code printed with the error message doesn't match that.CommentShareEXPERTBrettski-AWSanswered 8 months agorePost-User-2710643 8 months agoI thought of that and tried it also and no luck.print(result['configuration']['distributionConfig']['aliases']['items'])Error:Response{"errorMessage": "'aliases'","errorType": "KeyError","requestId": "345fga5-a4f4-405b-8c43-319f750e6f1a","stackTrace": ["  File "/var/task/lambda_function.py", line 62, in lambda_handler\n    print(result['configuration']['distributionConfig']['aliases']['items'])\n"]}Share"


Question: Using CloudHSM with Authenticode cert from VPN-connected desktop not EC2?

"DigiCert is dropping support for older code signing using a local PEM file: "Starting on November 15, 2022, at 00:00 UTC, industry standards will require private keys for OV code signing certificates to be stored on hardware certified as FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent."This explains how to use CloudHSM with a Windows Server EC2 instance - https://aws.amazon.com/blogs/security/signing-executables-with-hsm-backed-certificates-using-multiple-windows-instances/But what about our developers who need to use SignTool and InstallShield for code-signing on their local desktops?  Can they connect to the CloudHSM cluster using a VPN into a VPC?  Would they use AWS KMS?  A follow up blog or any pointers would be very helpfulFollowComment"

Answer: "1Hello,I would like to mention that yes, it's possible to use a CloudHSM cluster remotely.However, there are four prerequisites that must be satisfied:Network connectivity between the client instances (in this case, the local desktops) and the CloudHSM cluster. This could be accomplished by using VPN connections, Direct Connect connections, etc.Copy of the customerCA.crt [1] certificate to the client instances.Creation of a Crypto-User for the desktop computers.Installation of the CloudHSM package. For your scenario, this could be the issue. If you are using, for example, Windows 10 or Windows 11 in the desktops, we don't have any CloudHSM package for theses operating systems. You can try to use the package for Windows Server 2016/2019. [2]Please note that for such custom solution queries, we have the dedicated AWS Solutions Architect team which addresses the architecture and design level queries. I would suggest you reaching out directly to our Sales team as they can help you to get in touch with our Solutions Architect (SA) team.You can request for a member of the sales (Business Development) team to contact you using any of the following methods:>> Via form:    http://aws.amazon.com/contact-us/aws-sales/>> Via Live Chat:   https://pages.awscloud.com/live-chat-contact-us.html>> Phone support:   +1 (833) 662-9873 - 6:30am - 4:00pm (Pacific) Monday - Friday.References:[1] https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr-create-cert[2] https://docs.aws.amazon.com/cloudhsm/latest/userguide/client-history.html#client-version-5-5-0CommentShareSUPPORT ENGINEERYash_Canswered 10 months agoDave Simmons 10 months agoThanks that's helpful.  Our existing Authenticode cert doesn't expire until summer 2023 so for now we've decided to wait for other people to have this problem and hopefully post solutions.  I expect Amazon will be getting more requests for desktop cloudHSM support as we get closer to DigiCert and others requiring HSM for their new and renewal certificates.Share"


Question: Best way to archive Msk Data to s3(MSk connect too slow)

"Hi there, I need advice on moving archive MSK topic data to an S3 bucket. I'm currently doing this with MSK connect with Confluence custom plugin running two tasks. We have ~163GB of data in MSK, and for the last 48 hours, it has only copied ~3GB; this will cost us a lot of money if we leave it like this, considering msk connect running cost and S3 PUT charges. Is there a better way to migrate the data that is cost-effective? Below is the msk Connector configuration should in case I missed out anythingconnector.class=io.confluent.connect.s3.S3SinkConnectors3.region=###flush.size=1schema.compatibility=NONEtasks.max=2topics=#####format.class=io.confluent.connect.s3.format.json.JsonFormatpartitioner.class=io.confluent.connect.storage.partitioner.DefaultPartitionervalue.converter=org.apache.kafka.connect.storage.StringConverterstorage.class=io.confluent.connect.s3.storage.S3Storages3.bucket.name=#########key.converter=org.apache.kafka.connect.storage.StringConverterThanksFollowComment"


Question: Cognito Hosted UI ignores custom color for email verification input field

"When using Cognito's Hosted UI for user sign-up, in the first screen with username, email and password the input fields use the color property from inputField-customizable as expected.Then on the second screen when the user is asked for the verification code sent to the provided email address, the input field's class is NOT inputField-customizable, and so the text's color is from the background-customizable class.In our case that color was white (the background is dark so white text worked well), but then the user couldn't see any visual feedback while typing the verification code since it's white text in a white input field. As a quick workaround we changed the text color to a shade of gray so it's visible in both contexts but that's not ideal.Any solutions for this bug? Any plans to fix this by AWS?FollowComment"


Question: AWS Lightsail Firewall

"Hello,I am using AWS Lightsail to host my website. Using Cloudflare DNS + WAF for protection.I am trying to whitelist the Cloudflare IPs on the AWS infra but after defining the ACL, the site becomes unreachable.When i remove the ACL, site is back online.I am making firewall rules for http and https.Am i missing anything?https://www.cloudflare.com/en-gb/ips/173.245.48.0/20103.21.244.0/22103.22.200.0/22103.31.4.0/22141.101.64.0/18108.162.192.0/18190.93.240.0/20188.114.96.0/20197.234.240.0/22198.41.128.0/17162.158.0.0/15104.16.0.0/13104.24.0.0/14172.64.0.0/13131.0.72.0/222400:cb00::/322606:4700::/322803:f800::/322405:b500::/322405:8100::/322a06:98c0::/292c0f:f248::/32FollowCommentyujie 6 months agoHello, where did you define the ACL, Cloudflare IPs can be allowlisted in Lightsail firewall, you can follow this doc for more details: https://aws.amazon.com/blogs/compute/enhancing-site-security-with-new-lightsail-firewall-features/Share"


Question: Failed to deploy application. Unsuccessful command execution on instance id(s)

"I have a code pipeline setup to deploy the Backend Nodejs (Express) Application. But for the last 2 to 3 days I am continuously getting errors of incorrect version etc on 2 of my backend instance. Whenever the AWS code pipeline runs on code change the code deploys to Elastic Bean Stalk Fail.Error message - Code PipelineDeployment completed, but with errors: During an aborted deployment, some instances may have deployed the new application version. To ensure all instances are running the same version, re-deploy the appropriate application version. Failed to deploy application. Unsuccessful command execution on instance id(s) 'i-096exxxxx'. Aborting the operation.Error message - Elastic Bean StalkEnvironment health has transitioned from Severe to Degraded. Command failed on all instances. Incorrect application version found on all instances. Expected version "code-pipeline-xxxx"FollowComment"


Question: How to install CloudWatch on Suse

I want to install cloudwatch on suse.Could you help me please?FollowComment

Answer: "0Accepted AnswerHelloThe install steps can be found herehttps://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/download-cloudwatch-agent-commandline.htmlCommentShareEXPERTMatt-Banswered 3 months agorePost-User-6114547 3 months agoI have downloaded the cloudwatch agent for SUSE, but when i tried to install it, the following error is shown:package amazon-cloudwatch-agent-1.247357.0b252275-1.aarch64 is intended for a different architectureShareMatt-B EXPERT3 months agoLooks like you downloaded the package for ARM achitecture.  Can you try the x86 one from https://s3.<region>.amazonaws.com/amazoncloudwatch-agent-<region>/suse/amd64/latest/amazon-cloudwatch-agent.rpmShare"


Question: Timeout after login in Private MWAA behind ALB with Custom Domain

"I'm provisioning a private MWAA and setting a public access through ALB (with ACM and custom domain ), following this documentation.Domain and certificate are working, SSO login works, but redirect after login sends browser to private URL (which causes a timeout error). The only information I can find is this one but the link to another answer is brokenI also checked the Airflow documentation. . There is a key calledwebserver.base_url but it doesn't seem to work. The URL at the login screen looks fine: https://my-custom-domain/aws_mwaa/aws-console-sso?next=https%3A%2F%2my-custom-domain%2FhomeFollowComment"

Answer: "0Could you please validate the 1) target group's (Registered Targets [1])which are attached to the ALb and also the security groups attached to the ALB ? "If this does not work, please open open a support case with AWS using the following https://console.aws.amazon.com/support/home#/case/create "?  We can debug the issue and raise a request with Service team if needed.[1] https://aws.amazon.com/blogs/aws/new-application-load-balancing-via-ip-address-to-aws-on-premises-resources/CommentShareHarsha_Tanswered a year ago"


Question: Unable to delete Glacier Bucket

"I am attempting to delete a Glacier bucket that I am no longer uploading/connecting to from the source device (Synology NAS).I undersatnd you can only delete a bucket via CLI. When entering the following command in CloudShell I am presented with the message "Unknown Options: 074597366642"aws glacier delete-vault --vault-name [vaultnamehere] --account-id [numberhere]Any help would be greatly appreciated! Thank you,GavinFollowCommentiwasa EXPERT5 months agoHi, @studioloft.Your command may be wrong.Please let me know the result of executing the command below.aws --helpaws glacier delete-vaultShare"

Answer: "0Hello,you can only delete a vault only if there are no archives in the vault as of the last inventory it computed and there have been no writes to the vault since the last inventory.Please refer to the below link to delete Archives in S3 Glacier using CLI :https://docs.aws.amazon.com/amazonglacier/latest/dev/deleting-an-archive-using-cli.htmlPost which you can delete the vault, using the below command:aws glacier delete-vault --vault-name awss3vault9011 --account-id 1234569824for more information please refer to the link below:https://docs.aws.amazon.com/amazonglacier/latest/dev/deleting-vaults-cli.htmlHope this helps.CommentShareSheelnidhianswered 5 months ago"


Question: Multi-region replication and automated routing of requests

"Context: I have an Android app that is served by a backend that is hosted in us-west-2 region. All users hit this region regardless of their location.Problem: Users in India experience slow page load times, due to network latency.Question: Is there an easy way via AWS console, to replicate my backend in a nearby region (ex: ap-south-1), and enable automated location based routing? i.e., India users would automatically be served by ap-south-1 and US users would be automatically served by us-west-2?FollowComment"


Question: Redis Security Update - elasticache-20230315-002

"Hi Team,We observe that the AWS release a security update elasticache-20230315-002 on 22th of March and AWS applied it on same day itself. Ok we consider update severity is critical but why it is get applied out of the schedule maintenance window which Sunday for us.  Also the recommended apply by date is 21st April.We also see the same behaviour in our another 2 accounts.Could you please help us here why this unusual behaviour from AWS.Service update nameCluster update statusUpdate typeApply-by dateRelease dateUpdate severityStatusCluster status modified dateelasticache-20230315-002Completesecurity-updateApril 21, 2023, 02:29:59 (UTC+05:30)March 22, 2023, 02:30:00 (UTC+05:30)CriticalAvailableMarch 22, 2023, 02:46:17 (UTC+05:30)FollowComment"


Question: [EC2] SQL Connecitvity

"Apologies, it looks as if I first posted this in a dead section of the forum, if any moderators want to delete my original post then please do so - https://forums.aws.amazon.com/thread.jspa?threadID=296401&tstart=0Hi All,We have an EC2 instance setup running our SQL DB which is currently open on port 1433 (1434-1435 also open as well)I'm looking to be able to access the instance remotely but having issues doing so, I have tried to connect to both IP address, and Computer name with and without using the port, I have the SQL Browser Service running but still no joy.. I have setup my security groups to what I think are the correct settings Link: https://puu.sh/CtXwV/1125dd7d38.pngUnable to Connect:TCP Provider: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.FollowComment"

Answer: 0Resolved..CommentShareDTSysanswered 4 years ago


Question: Server-side tracking and VAST Macro Replacement

"Does MediaTailor supports replacing standard VAST Macros in case of Server Side Tracking ?Standard VAST Macros - https://interactiveadvertisingbureau.github.io/vast/vast4macros/vast4-macros-latest.html#macro-spec-timestampIf yes, how to configure it ?If no, How to achieve MediaTailor replacing Standard VAST Macros present in Tracking URLS ?Also  [SERVERUA] macro will be usefulIAB References - https://iabtechlab.github.io/programmatic-guides/pg-video/index.htmlUse CasePlayer played 2 ad pod containing 3 adsAdvertiser wants to know, what was the position of My ad within the pod and in which Pod my ad was playedEquivalent VAST macros are -ADCOUNT - https://interactiveadvertisingbureau.github.io/vast/vast4macros/vast4-macros-latest.html#macro-spec-adcountPODSEQUENCE - https://interactiveadvertisingbureau.github.io/vast/vast4macros/vast4-macros-latest.html#macro-spec-podsequenceFollowCommentShriprasad-AWS-User-0357084 a year agoAny updates here?ShareRomanR a year agoSame question about VAST 3.0 macros - [ASSETURI], [CONTENTPLAYHEAD], [CACHEBUSTING], [ERRORCODE]. I see the trackers are being fired by MT but the macros are not replaced. Is there a way to fix this?ShareShriprasad-AWS-User-0357084 a year agoAny updates here?ShareShriprasad-AWS-User-0357084 a year agoCan someone share any information, link or tutorial if any you have?ShareShriprasad-AWS-User-0357084 a year agoAny updates here?ShareShow 3 more comments"


Question: Google as External Identity Source QnA

"I'm implementing SSO for a client who uses Google Workspace.  They are an existing AWS user with a single AWS account and 10 IAM users setup with non work email addresses.  There are other non-human, cli and service IAM users setup for various programatic and automation functionality.After applying the SSO integration with Google, please confirm.Will all existing IAM users be able to continue login?Will existing IAM key/secret combos work where automation, cli and scripts are setup?IAM User bob@yahoo.com will still be able to login to the AWS console using his previous IAM credentials?Will the root user, the user that setup SSO be locked out when SSO is enabled?Obviously I will setup provisioning in google/aws so that the business work accounts get created in AWS and workers can begin using that, but i want to clarify what happens with the existing IAM user account after i click CONFIRM on the SSO setup, as i dont want to be locked out.Thank youFollowComment"

Answer: "0Accepted AnswerIAM users will be unaffected by the changeExisting long-term credentials (like access keys and secrets) will be unaffected by the changeIAM users will be unaffected by the changeThe root user will not be locked out by setting up SSOSSO functions in parallel with all the authentication examples you have given. You would likely want to remove the IAM users eventually, and force all humans to use SSO, so that their access is managed by your identity provider. You will still need some long-term credentials for your programmatic access (and somewhat ironically, IAM users are sometimes the best way to provide that to your automated processes).CommentSharerowanuanswered 4 months agoenterx 4 months agoThanks you, that's very helpful.Share"


Question: Does AWS supports FIDO2 pin-code?

"Hello, we tried to use "yubikey 5 NFC" and "yubikey BIO" as MFA device for our users (we used WebAauth), but we are not asked to provide pin-code, as we have read in yubikey official website : WebAuthn on the service provider end , PIN prompts are a result of a WebAuthn setting known as User Verification. This setting is controlled by each service provider. . Is there possibility to "force" AWS to "ask" for pin-code?FollowComment"


Question: SES sender address blocked by Microsoft smtp server

"For a couple of weeks I have intermittently had emails bouncing from hotmail, yahoo, etc. with reports like:`An error occurred while trying to deliver the mail to the following recipients:xxxx@hotmail.co.ukReporting-MTA: dns; b232-1.smtp-out.ap-southeast-2.amazonses.comAction: failedFinal-Recipient: rfc822; xxxx@hotmail.co.ukDiagnostic-Code: smtp; 550 5.7.1 Unfortunately, messages from [69.169.232.1] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3140). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors. [DB8EUR05FT037.eop-eur05.prod.protection.outlook.com]Status: 5.7.1`As far I I can see, it is the result of Microsoft blocking one or more Amazon SES server addresses.   What is the correct way to get Amazon SES to investigate and correct this issue?FollowCommentrePost-User-5638062 a year agoI have exactly the same issue. Can someone please look at this urgently? I am sending from [13.250.211.1]Share"


Question: Custom HTML for confirmation user email

"Hi, how can I set custom HTML content for the email that Amplify Cognito send automatically to the user when i call the signUp API of the Auth module or when the user ask for forgot password?I see that there is a field in the "Password protection settings" section in the Authentication settings page of Amplify Studio console, but it's only a simple text field, I can't specified HTML.Thank you!FollowComment"

Answer: "0Hi Marco,Cognito allows creating workflow triggers for lambda functions. With these workflows, it is possible to perform customizations in SignUp messages, Forgot Password messages, among other events.For more details see the documentation: user-pool-lambda-custom-messageImplementing logic via Amplify: basic-scaffolding-for-a-custom-auth-challengeCommentShareLucas L Lopesanswered 9 days ago"


Question: AWS Glue  connect with on premise DB

"I am creating sample glue job in aws console using interactive session  to connect to on-premise oracle database but getting error. Same code when I am running from Docker is working fine.tried with two versions of URLjdbc:oracle:thin:@//hostname:1521/dbnamejdbc:oracle:thin://@hostname:1521/dbnameurl='mentioned above ' user='xxgmdmadm' password='**********' dbtable='xxgmdmadm.t10' df_monitering=spark.read.format('jdbc') .option('url',url) .option('dbtable',dbtable) .option('user',user) .option('password',password).load()I am getting below errorPy4JJavaError: An error occurred while calling o80.load. : java.sql.SQLRecoverableException: IO Error: Unknown host specified  at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:489) at oracle.jdbc.driver.PhysicalConnection.<init>(PhysicalConnection.java:553) at oracle.jdbc.driver.T4CConnection.<init>(T4CConnection.java:254) at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:32) at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:528) at org.apache.spark.sql.execution.datasources.jdbc.JdbcUtils$$anonfun$createConnectionFactory$1.apply(JdbcUtils.scala:63) at org.apache.spark.sql.execution.datasources.jdbc.JdbcUtils$$anonfun$createConnectionFactory$1.apply(JdbcUtils.scala:54) at org.apache.spark.sql.execution.datasources.jdbc.JDBCRDD$.resolveTable(JDBCRDD.scala:56) at org.apache.spark.sql.execution.datasources.jdbc.JDBCRelation$.getSchema(JDBCRelation.scala:210) at org.apache.spark.sql.execution.datasources.jdbc.JdbcRelationProvider.createRelation(JdbcRelationProvider.scala:35) at org.apache.spark.sql.execution.datasources.DataSource.resolveRelation(DataSource.scala:318) at org.apache.spark.sql.DataFrameReader.loadV1Source(DataFrameReader.scala:223) at org.apache.spark.sql.DataFrameReader.load(DataFrameReader.scala:211) at org.apache.spark.sql.DataFrameReader.load(DataFrameReader.scala:167) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at py4j.reflection.MethodInvoker.invoke(MethodInvoker.java:244) at py4j.reflection.ReflectionEngine.invoke(ReflectionEngine.java:357) at py4j.Gateway.invoke(Gateway.java:282) at py4j.commands.AbstractCommand.invokeMethod(AbstractCommand.java:132) at py4j.commands.CallCommand.execute(CallCommand.java:79) at py4j.GatewayConnection.run(GatewayConnection.java:238) at java.lang.Thread.run(Thread.java:748) Caused by: oracle.net.ns.NetException: Unknown host specified  at oracle.net.resolver.HostnameNamingAdapter.resolve(HostnameNamingAdapter.java:191) at oracle.net.resolver.NameResolver.resolveName(NameResolver.java:133) at oracle.net.resolver.AddrResolution.resolveAndExecute(AddrResolution.java:431) at oracle.net.ns.NSProtocol.establishConnection(NSProtocol.java:693) at oracle.net.ns.NSProtocol.connect(NSProtocol.java:251) at oracle.jdbc.driver.T4CConnection.connect(T4CConnection.java:1140) at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:340) ... 24 moreFollowComment"

Answer: "0Hello,Please check the troubleshooting links here. I found the error that you mentioned in the AWS Reference Links.Link- https://docs.aws.amazon.com/glue/latest/dg/glue-troubleshooting-errors.htmlYou may be trying to parametize AWS Glue jobs to apply the same transformation/logic on different datasets in Amazon S3. You want to track processed files on the locations provided. When you run the same job on the same source bucket and write to the same/different destination concurrently (concurrency >1) the job fails with this error:Solution: set concurrency to 1 or don't run the job concurrently.Currently AWS Glue bookmarks don't support concurrent job runs and commits will fail.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months agoAWS-User-6494745 10 months agoHello ,I am unable to find  anything related to connection to databaseShare"


Question: R53 is set up but site still returns DNS_PROBE_FINISHED_NXDOMAIN

"Hi all,I followed this tutorial, https://www.youtube.com/watch?v=lB4DTqMEumY, and still seeing DNS_PROBE_FINISHED_NXDOMAIN for my site.These are the steps that I follow (not necessarily in this order):Register domain at exabytes (this is done by the client, so really I don't actually have access to it)Create S3 bucket (static site is working)Create CloudFront (CF's domain name is working)Create SSL Certificate and add it to CFCreate alias A, AAAA in Route 53Create CNAME to connect with the SSL CertificateMake sure Route 53's name servers are added to exabytesI don't know how many times I've double-checked to make sure everything looks correct, but I might miss something.When checked in https://toolbox.googleapps.com/apps/dig/, the NS servers are correct on both Route 53 and exabytes. But https://dnschecker.org/ shows that the DNS is propagated yet?Can someone advise me on what to check next?My domain is https://homs.com.myFollowComment"

Answer: "0Same problem for me, NS are correct, settings are correct, NS can be found, A record is set correctly, yet I get stuck with a "DNS_PROBE_FINISHED_NXDOMAIN" error when opening the address/domain.there are now 3 posts about this issue from today, seems like AWS has some problem going there...CommentShareLiXiaoPaianswered 3 years ago0Hi,I don't know anything about the YouTube tutorial, but I did notice the following about your configuration:~ You have two hosted zones named homs.com.my, created by two different accounts.~ One hosted zone was created in December of 2018. The hosted zone ID starts with Z2DHA. The name servers for this hosted zone are the name servers that are associated with your domain registration.~ The other hosted zone was created yesterday, March 5th, 2020. The hosted zone ID starts with Z2LZM. This hosted zone is not in use--the name servers are not associated with your domain registration. This hosted zone includes the alias records that I would expect to see for a configuration that is routing traffic to CloudFront.~ The name servers in the hosted zone that you created yesterday aren't synchonized as they should be. The NS record has the name servers that are associated with your domain registration and with the other hosted zone, but Route 53 assigned a different set of four name servers to the new hosted zone. If you want to use the new hosted zone, you'll want to update the name servers in the NS record, but I don't recommend it. See below.~ The hosted zone that was created yesterday includes an alias record for which the type is CNAME and the alias target is a CloudFront distribution. When you create a Route 53 alias record that routes traffic to a CloudFront distribution, you create a record with a type of A and, optionally, a second record with a type of AAAA. Here's the documentation about the Type field for an alias record:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-values-alias.html#rrsets-values-alias-typeThe fastest way to fix this is to update the hosted zone that someone created in 2018 with the records that you created yesterday in the new hosted zone. If you update the domain registration to use the name servers for the new hosted zone, the change will take up to two days to take effect because some DNS resolvers have cached the names of your name servers.ScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0Hi Scott,Thanks for the explanation. I do have a few follow-up questions:Where do you think the Dec 2018 is hosted? It is in exabytes?According to the client, the NS in exabytes is the same as the ones in the new zone, Z2LZM. And I think this has been done way before Thursday (See the attached file). So the DNS resolvers should have been updated, right?We do have a DNS Zone in LightSail, with the same NS. Is this the 2018 one? If so, do you have any tips on how we can either:Use Apex address to map to the Cloudfront, ORPreferably, redirect the apex address to www (https://homs.com.my to https://www.homs.com.my) ?Thank youThanks againCommentShareaa-surialabsanswered 3 years ago0Hi,The hosted zone that was created in December of 2018 is another Route 53 hosted zone. Sorry, I don't understand the reference to "exabytes."The name servers in the NS record for the newer hosted zone, Z2LZM, match the name servers for the domain registration. However, those are not the name servers that Route 53 assigned to the hosted zone, so DNS resolution is mostly going to fail. If you want to use the newer hosted zone, you'll need to update the name servers in the NS record to match the name servers that Route 53 assigned to the hosted zone, and you'll need to update the domain registration to use those same name servers. This will take up to two days to take effect.If you decide to go that route, here's how you do it:Here's how to fix that:Get the name servers that Route 53 assigned to the hosted zone when you created it. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the NS record to use the four name servers that you got in step 1. See "Editing Records":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-editing.htmlUpdate the domain registration to use the four name servers that you got in step 1. See "Adding or Changing Name Servers and Glue Records for a Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlI don't know much about Lightsail, but I think their documentation explains how to use Route 53 as the DNS service for your Lightsail instance.To route internet traffic from homs.com.my to www.homs.com.my, you can create a Route 53 alias record. Create the www record first, then create the record for the zone apex. For the alias target, choose the www record.ScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0Hi Scott,There are only 2 Hosted Zones that I can see, Z2LZM... and Z0891..., and I don't see Z2DHA... which is why I'm quite confused. I think the Z2DHA... is the DNS Zone in Lightsail created by my client to host the wordpress site at that time.Anyway, I've somehow figured out how to do what I want to do using a workaround. So my next question is:If I create a new Hosted Zone in R53, then update the NS in the domain registration (which is exabytes) to match with the ones in the new zone, will my site be inaccessible for 2 days until the new DNS record is updated?ThanksCommentShareaa-surialabsanswered 3 years ago0Hi,The two Route 53 hosted zones that I'm talking about were created by two different AWS accounts. I have a Lightsail instance, and, if I recall correctly, creating that instance didn't create an additional Route 53 hosted zone in my account.If you create a new hosted zone and you update the domain registration for your domain to use the new name servers, the amount of traffic that the domain is getting determines whether the domain becomes unavailable during the process. DNS resolvers cache the names of your name servers for two days, but if no one is accessing your website, then no DNS resolvers have cached those name servers. The Route 53 Developer Guide has an overview of how DNS works, including the part about resolver caching. See "How Amazon Route 53 Routes Traffic for Your Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/welcome-dns-service.html#welcome-dns-service-how-route-53-routes-trafficThere's also detailed information about how to make Route 53 the DNS service for your domain, and changing from one Route 53 hosted zone to another is essentially the same thing. We have separate processes depending on whether your domain is currently active. For more information, see "Making Amazon Route 53 the DNS Service for an Existing Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/migrate-dns-domain-in-use.htmlScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0I should have closed this earlier, but I think I found a workaround to solve this issue. ThanksCommentShareaa-surialabsanswered 3 years ago"


Question: Aurora serverless (Postgresql) restarting several times per day

"Hi,My Aurora DB in Serverless mode and on Postgresql engine worked fine in recent months. From begin new year (last two days) DB restarting several times per day with log note "DB instance restarted". DB is not available for few minutes after restart and works fine to next restart.I also noticed that before each restart (~20s) is logged "The DB cluster has scaled from 8 capacity units to 4 capacity units, but scaling wasn't seamless for this reason: timed out finding a scaling point". Sometimes from 8 ACU to 4 ACU, sometimes from 4 ACU to 8 ACU.Anybody know what is reason for this DB behavior?FollowComment"

Answer: "0I recommend that you create a support case for this issue.CommentShareEXPERTUrianswered a year ago0When Serverless needs to scale, it looks for a  safe scaling point for 5 min, if it can not ( because of long running transactions) , then it either rolls back the scaling or if you have forced scaling enabled, it will kill current in-flight transactions and force a scaling. If it can not find a scaling point, then its quite possible that the current ACUs are unable to handle the new load and this can lead to a restart ( cpu brownout). So that could explain the restart when it goes from 4 to 8. however I see no reason for a restart during scale down. So its recommended that you should open a ticket with support.CommentShareDevinder-theDBGuyanswered a year ago"


Question: Step Function manage/trigger Fargate task container override storage size?

"Hi, We successfully trigger fargate task through step function,   Something like below:Is there anyway to define the ephemeral storage size, cpu and memory within the container override section below?Now, when we create fargate task, we set desire_count=0, min_count=0 and we have 0 instance always on (which is good, we don't want to always on instance).  But how will max_count be treated?   When we have more than max_count of concurrent step function running, will some step just hanged and waiting for the finishment of certain fargate task?  Or throwing error?Thank you , in advance."UncompressGranuleECS": {"Parameters": {"LaunchType": "FARGATE","Cluster": "${module.cluster.ecs_cluster_name}","TaskDefinition": "${local.fargateTaskARN}","NetworkConfiguration": {"AwsvpcConfiguration": {"Subnets": ${jsonencode(var.subnet_ids)},"AssignPublicIp": "DISABLED"}},"Overrides": {"ContainerOverrides": [{"Name":"dyen-cumulus-uncompress_granule-fargate",              "Command": ["java",                   "-Xms7500M",                    "-Xmx7500M",                   "-jar",                   "/home/dockeruser/build/libs/my-jarfile.jar"],              "Environment":[                  {                      "Name":"region",                    "Value":"us-west-2"                },                {                      "Name":"TASK_TOKEN",                    "Value.$":"$$.Task.Token"                },                {                      "Name":"CMA_MESSAGE",                    "Value":"myjson:[]"                }              ]            }        ]      }    },    "Type": "Task",    "HeartbeatSeconds": 1800,    "Resource": "arn:aws:states:::ecs:runTask.waitForTaskToken",    "Retry": [      {        "ErrorEquals": [          "States.ALL"        ],        "IntervalSeconds": 10,        "MaxAttempts": 0      }    ],    "Catch": [      {        "ErrorEquals": [          "States.ALL"        ],        "ResultPath": "$.exception",        "Next": "failureStep"      }    ],    "Next": "MissingStep"  },FollowComment"

Answer: "1Based on the documentation all 3 of them should be configurable in the Overrides section of the RunTask API, not in the ContainerOverrides.If you try to invoke more tasks than what is configured, you should receive an error back in StepFunctions. You should use some retry mechanism, maybe with an additional Wait state to wait for other tasks to complete.CommentShareEXPERTUrianswered a year ago0Agree with @Uri that you need to implement error handling for any throttling. Wanted to confirm you initially can have up to 1 million concurrent step executions open and you can start up to 10 fargate tasks via RunTask API concurrently (this is the call to start tasks but once running is cleared) so this is an area where backoff and retry is definitely neededCommentShareEXPERTPeter_Ganswered a year ago"


Question: SSL Certificate: Why is there an underscore _ in the CNAME record name (and value) for DNS validation?

"When issuing a new SSL certificate, using the DNS validation method, a typical CNAME record looks like this:Name: _954b47e2034eb35cb5e92af85ed074e0.sub.domain.com.Type: CNAMEValue: _333e1a50ddb2aee40a75495d4b502e43.stwyzjdjkd.acm-validations.aws.Many of our customers cannot use an underscore in the "Name" section with their DNS system. This makes the whole validation process very frustrating.We are aware that the underscore can be removed from the VALUE, but not from the NAME.Why is the underscore needed?FollowComment"


Question: Amazon MSK Authentication and Authorization

"Hello world,Let's say I have 3 sets of users consuming 2 topics and I want:User 1 to have full control to both topics;User 2 can have full control to topic 1;User 3  can subscribe to topic 2.What is the best way of implementing such?Thank youFollowComment"

Answer: "0The recommended way to achieve this is using IAM authentication. IAM controls both who can be authenticated and authorized to use Amazon MSK resources. For your use case, "kafka-cluster:" Action must be allowed on all topics (eg : arn:aws:kafka:<region>:<account>:topic/ClusterName/) in the authorization policy of User 1.Similar authorization policy can be used for User 2 and User 3 but only for one topic ( arn:aws:kafka:<region>:<account>:topic/ClusterName/<topicname>). Complete information about IAM authentication and authorization - [1] https://aws.amazon.com/blogs/big-data/securing-apache-kafka-is-easy-and-familiar-with-iam-access-control-for-amazon-msk/.One other way if using SASL/SCRAM or TLS auth is to use ACLs. By setting ACLs you can restrict who can access topics - [2] https://docs.aws.amazon.com/msk/latest/developerguide/msk-acls.htmlCommentShareSUPPORT ENGINEERHarshith_Manswered a year ago"


Question: Route53 Domain resolution problem

"We created two route53 zones recently and created corresponding NS records at provider where we bought that domains. For some reason domains are not resolving from different places. For example: from my personal laptop it started resolving only after flushing cache on https://1.1.1.1/purge-cache/ page (I’m using 1.1.1.1 as my DNS server), in our Kubernetes cluster domains are not resolving correctly event after recreating coreDNS pods, the same problem exists on few more laptops/PCs, they still resolving records from our route53 zones to IP address that are assigned to root domain.I’m supposing that some DNS authorities still caching old NS records for these zones but they were created 4 days ago, so all that records should be refreshedFollowComment"

Answer: 0What are the TTL values on the records that are being cached? Route 53 (as with most DNS resolvers) generally cache records for the time specific in the TTL and that's a difficult behaviour to get around - the usual fix being "change the TTL" but you have to wait for the original value to expire first.CommentShareEXPERTBrettski-AWSanswered 3 months agorePost-User-0226068 3 months ago300 sec for A recordsShare


Question: Cloud9 sharing issue

"Hi, the option of 'Sharing with you' on the left side bar disappeared in cloud9! how can i get access to it again?ThanksFollowComment"

Answer: 0Accepted AnswerThe new UI has this option (Shared with you) in the new menu in the middle of the page under 'Environments' headline.CommentShareRamezanswered 7 months ago0CommentShareRamezanswered 7 months ago0Was replaced with this drop down list:CommentShareElianswered 6 months ago


Question: How can CPU utilization be low but the Average Active Sessions be high?

"I was originally using a t2.micro db instance for my RDS Postgres db.The queries became very slow, and when I looked at the rds console, I saw that cpu was low, but that the Current Activity sessions bar was red.You can see in this screenshot when I looked at the perf insights, that Sessions was over the vCPU number. https://i.imgur.com/1QoVPBf.pngAnd the main issue looks like it is waiting for the CPU.So now I have increased my db instance to a t3.large, and CPU util is very low, and Current Activity sessions is below the limit. https://i.imgur.com/K7sRLAi.pngBut I don't understand why the RDS dashboard originally said the CPU util was low when it looks the issue was the CPU in the first place?FollowComment"

Answer: "0Accepted AnswerYou are using a burstable instance. In the case of a t2.micro that means you are getting a baseline performance of 10% of a vCPU. When you use less than baseline you accumulate CPU Credits. When you use more than baseline you use CPU Credits. When you exhaust your CPU Credits you are stuck at baseline performance. So what you will see is CPU Utilization of 10%, but that means you are using 100% of baseline. You could verify you are running out of CPU Credits by looking at CPUCreditBalance and CPUCreditUsage https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/MonitoringOverview.htmlFor more explanation on burstable instances see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/burstable-credits-baseline-concepts.htmlYou've addressed this in one of the two ways I'd recommend, going to a t2.small; now your baseline is 20% of a vCPU. The other way would be to use a t3.micro, which RDS supports in Unlimited Mode. Those still burst, but can accommodate much longer periods of bursting before (instead of limiting you to baseline) you are charged for the excess usage. The T3 is 30% faster than the T2, so between a faster CPU meaning you can do more without eating into your credits, the way Unlimited lets you borrow against future credits, and that if you do use up the credits you just pay more instead of being locked into the low baseline performance, the t3.micro might also solve your problem.CommentShareHalTempanswered 3 years ago"


Question: Are redshift auto materialized views schema bound?

"I can’t create a user defined materialized view with no schema binding, and since my etl process involves automatically recreating tables when the source ddl has changed, that means I can’t use user defined materialized views. How do auto materialized views that just became generally available last month get around this restriction?FollowComment"

Answer: "0In this scenario Redshift will not be able to really create auto MV's for the part where tables are being dropped and recreated. But further down the line, after ETL has completed, if you have subsequent user queries which are more or less of repeatable nature then Redshift will be able to leverage this feature and create some auto MV's that will boost user query performance.CommentShareMilindOkeanswered 9 months ago"


Question: Change of sending IP

"Hello, my account has recently been hacked. It seems that everything is fixed, however, now I am doing tests and all the emails arrive in the SPAM folder, before the hack it did not happen.When I was hacked I sent massive emails and the health of the account got much worse.They reset it, now the health is fine, but the emails go to SPAM.Is it possible to change my sending IP or fix it somehow?Thanks.FollowComment"

Answer: 0What has probably (I'm guessing) happened is that the various organizations that track spam have flagged your domain as (well....) "spammy". You'll need to get in touch with them and find out if there's a way to resolve that.If you're using a dedicated IP with SES then you can get that changed; but most customers use the shared IP pool so the source IP isn't something you can control and (in general) you'll use a different IP at different times so it's unlikely to be that.CommentShareEXPERTBrettski-AWSanswered 10 months ago


Question: Cant register lightsail instance as hybrid in Systems Manager

"After updating Ubuntu in my lightsail instance, I'm now locked out via both the console and ssh.  After some searching, it looks like a way to recover might be to create a new copy of my instance connected, as hybrid, to the AWS Systems Manager.  However, I'm not able to do that.  I'm following the instructions found here:  https://aws.amazon.com/premiumsupport/knowledge-center/add-lightsail-to-systems-manager/I've created a new Hybrid Activation.  Made a copy of both the Code and ID.  Taken a snapshot of the instance.  Created a new instance from that snapshot, adding the code snippet (correctly updated with code, ID, and region) as the launch script.But following this, launching the Fleet Manager never shows any instances.  Any ideas what I can try to see why this isn't showing up.FollowComment"

Answer: 1I finally got this to work by changing the added startup code from the bash example to the snap version.CommentShareEddieAanswered 9 months agommweb a month agoCould you explain this in more detail please? Having this issues as well.Share0Please cut us a ticket and we'll route it to the appropriate team to follow up on the issue.CommentShareAWS-User-2776000answered 9 months ago


Question: Car web interface is blank

"When I have tried to connect to the car's web interface, on a desktop, only the login page displays, but the /home page remains blank. I have tried Edge and IE on a Windows computer and Chrome on an Ubuntu computer. When I tried Edge on my Android phone, there was no problem.I had a similar problem when I tried to set up the WiFi over USB; I ended up using the *.txt file method for setting the password.Could there be some settings issue that prohibits the /home page from loading on a desktop browser, but not on a mobile?FollowComment"

Answer: "0I believe there shouldn't. Are you using any special plugins like ad blockers, Grease Monkey etc? Could it have anything to do with a self-signed certificate on the car?CommentSharetptakanswered 4 years ago0I checked that there is no ad blocker on the Ubuntu machine and my efforts to add the self-signed certificate to Chrome failed. But by installing Firefox, I was able to see the /home page.CommentShareStephen314answered 4 years ago"


Question: API gateway integration request body to accept wildcard

"We would like to apply our model validation to multiple content types in proxy integration with lambda functions. This is without specifying a mapping template.We think it is either achiveable via accepting multiple content type in the request body in "Method Request". Or by rejecting any content type that does not match the specified content types in  "Method Request".We have also tried setting the "passthrough behaviour", but as the integration is a proxy lambda integration, it does not validate the request body.FollowComment"


Question: How to scan the server files

"Hi,We have following queries. Can you please suggest on these alsoCan we use AWS Marketplace: Antivirus for Amazon S3 - PAYG with 30 DAY FREE TRIAL for oursDo we have the provision to do real time Antivirus scan using thisCan we run this on our own and do the scanDo we have the possibility schedule this to do periodical scans and get the resultsWhether this installation can be done free of costApart from this do we have any alternate scanning toolThanksFollowComment"

Answer: "0Hi,if anyone could respond at earliest, it will be help full.ThanksCommentShareAWS-User-0653960answered a year ago"


Question: Provide Autopilot own data

"Is there any way to provide your own (already labeled) data to sagemaker ground truth?My plan is to use sagemaker autopilot with my own data that I have already labeled such that the folder structure represents the labels (rekognition provides such functionality).The problem is that AutoPilot can only accept manifest files or csv,txt, ect. Well I have images with labels, so my only option is to use a manifest file. HOWEVER GroundTruth create manifest file option only accepts images from only 1 folder without any option to give it labels by default, therefore forcing me to repeat the labeling on an already labeled dataset.Any idea how to use already labeled data as input???FollowComment"

Answer: "0Hello...   How are your images labeled?  What format are the labels in?If you have multiple folders each containing images, and the folder is the label then you could create a quick python (etc) script that will create a manifest file, using the folders as labels.  You can then upload all the folders and the manifest file to S3 and your set.Groundtruth is a labeling pipeline tool.  Its designed to organize people with domain knowledge to label data.   Also its pretty pricey so you definitely don't want to use it to re-label anything thats already labeled.Hope that helps.CommentShareMikeChambersanswered 3 years ago"


Question: Step Function action GetJob (AWS Glue) does not return CodeGenConfigurationNodes despite the documentation saying it should

"According to https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-GetJob the Action GetJob (AWS Glue) should return CodeGenConfigurationNodes for a given JobName as input however it only returns the Job object.[EDIT]Now tried using the python function inside a Lambda:#!/usr/bin/python# -*- coding: utf-8 -*-import jsonimport boto3glue = boto3.client(service_name='glue', region_name='eu-west-2',              endpoint_url='https://glue.eu-west-2.amazonaws.com')                            def lambda_handler(event, context):    job_name = event.get('JobName')        job_details = glue.get_job(JobName = job_name)    return json.dumps(job_details, indent=4, sort_keys=True, default=str)Doesn't return CodeGenConfigurationNodes eithier, so it looks like it maybe a bug in the python function that the the step function is using?FollowComment"


Question: Drag and drop deployment in amplify has stopped working for me in eu-west-1

"Drag and drop deployment in amplify has stopped working for me in eu-west-1. The webpage says deployment is ok, but the website is not updated. Multiple attempts and still no updates.FollowCommentkpl976 a year agoWe ran into probably the same issue as well (see question here: https://repost.aws/questions/QUboDhRl5DSB20Qr6qmBUGXw/amplify-console-custom-domain-shows-different-content-than-default-url). Were you able to figure out what was happening? For us, it seemed like a caching issue, since the updates are reflected in the default Amplify generated URL, but not the linked custom domain. Deleting and re-adding our custom domain 'fixed it'. But of course that isn't really a solution.Share"


Question: Error when deleting a Snapshot that is in a store (Backup)

"I have a Snapshot that was generated a long time ago and at this moment it is in Expired status, when I delete this snapshot at first it shows me that it was deleted, but when I refresh the portal it shows me the same snapshot again like it didn't remove it.Ask:Do these Snapshots continue to generate cost?How can I remove them completely and not appear anymore?FollowCommentHemant Chugh a month agoMore details required on snapshot.Was it scheduled snapshot or adhoc snapshot ?What ttl is set for snapshot ?Follow best practise mentioned in below linkhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-deleting-snapshot.htmlShare"

Answer: "0Are there any errors in CloudTrail after the deletion?CommentShareEXPERTRiku_Kobayashianswered a month ago0Hi, If the snapshot was created by AWS backup it cannot be deleted from the EC2 snapshot console or by using EC2 commands, it must be removed from the AWS backup service, either console or cli.Hope this helps,DCommentSharerePost-User-5099249answered a month ago"


Question: Router instance in EC2 never receives IGMP join messages from other EC2 instances

"Within a single VPC with transit Gateway multicast I can succesfully pass multicast between instances and see IGMP joins in the TGW menus.Now I want to extend to on prem, but it seems the router instance never receives join messages from instances within the VPC.My software router in EC2 has pim neighbourship with my on prem router via GRE trunnel, but no joins from other EC2 instances.Is there a way to tell the TGW to forward igmp join messages to the software router instance?I worked around this static joins and an IGMP proxy, but it's rather kludgey.I confirmed with wireshark my EC2 instance was sending IGMPV2 join messages, and they are reflected in the TGW console, but not received at the soft. router.FollowComment"

Answer: "1Accepted AnswerVPC is an overlay network and it emulates Ethernet for you so that most regular operations work; but many things don't. For example it looks like broadcasts work (ARP, for example) but again those are emulated rather than actually happening. See this YouTube video for a lot more on how VPC works.Same goes for multicast - in this case, Transit Gateway is acting as the multicast "hub" but it only implements some of the multicast functions - and it won't send the join messages back to your router - that's why you can see them being sent; why they are received by Transit Gateway; and why you're not seeing them being received again.I'd encourage you to reach out to your local AWS Solutions Architect who can get you in touch with a networking specialist to discuss your use case.CommentShareEXPERTBrettski-AWSanswered 4 months ago"


Question: How to hide the margins/credits in the CID when creating dashboards the payer account

"Hi Team,We are creating CID's for our customers who wants to see the overall spend of their AWS accounts, since we are replicating the data from payer account which also contains our margins, how can we mask that part alone in the dashboard?Only reason why we are not giving the access the payer account is because we don't want our end customers to see our margins but if we publish the dashboard from the data in CUR from payer account, wont the customer see the margins?FollowComment"

Answer: "0Have you looked at the AWS Billing Conductor service?By default, adding accounts into a billing group will allow the Billing Conductor service to create a proforma view of the CUR for that billing group that defaults to on demand rates, but allows you to customize the rates if you choose.  The primary accounts in the billing group would also see their proforma rates in the Bills page in the console.The proforma CUR that is created for a billing group could then be used with the CID to give dashboards to the end customers. The Payer account will be able to create CURs for each billing group and then use that CUR to provide a dashboard. You can create billing groups with 1 or many accounts in it, but it does not allow you to split an account or set a billing group based on other criteria.Pricing for this service is tiered based on how many accounts are in billing groups in a month, but starts at $8.25/mo for the first 500 accounts.  It goes down after that.CommentShareLisa_Hanswered 2 months ago0Hello, In addition to AWS Billing Conductor you can directly use CID to showback. By default CID shows everything as is, but it is totally possible to modify queries, excluding Credits and Refunds or adding additional lines adding them to the default summary view.Once you achieve the view that corresponds your business needs, you can set up Row Level Security to allow access to dashboards for the end customers.CommentShareIakovanswered 2 months ago"


Question: how to cancel a reserved ec2 instance

"Hi,Does anyone know how to cancel a reserved ec2 instance? I purchased a wrong ec2 instance around 6 months ago, now it charges me every month... but I'm not using itFollowComment"

Answer: "3Reserved Instances cannot be cancelled, since it's a subscription for a period of time that will give you significant discount compared to on-demand pricing if you are running EC2 instances with attributes that match your RI.However, if you made a mistake and never utilized your RI discount, I suggest opening a billing support case from the account where RI was purchased. In your request to support specify the AWS region, RI type and RI ID. This is not guaranteed, since you cannot cancel an RI, but I suggest asking support team if they can help with the solution if this was indeed a mistake and your RI discount was never used / applied to running instance.Depending on the attributes of your RI, support team may suggest how you can modify the RI or potentially exchange it in case you have convertible RI. By modifying/converting it you could change it to match the attributes of some other running instance in a region, so that way you'd be able to continue benefiting from the discount.CommentShareEXPERTNataliya_Ganswered a year ago"


Question: How to export already created (via web console) services to CDK locally and be able to deploy/update them?

"Current situation:I have an API Gateway referencing some Lambdas, and some Lambdas querying a DynamoDB instance.All created and handled manually via the AWS web console. There's no cloudformation template.^ I want to be able to have that locally too using CDK:I want to apply some healthy developer procedures and create a CDK file system locally, for testing, manage deployment, manage versioning via github or whatever aws has to offer in that field (didn't get to that part yet).I noticed that there is 0% information on how to do that. most tutorials follow a situation where1, i am creating a cdk from scratch,2. or already have a cloudformation structure.Do i just init a cdk and name services the same as my current services to "take over them"? or will they get re-written ( = total disaster).Is there a way to export a code sample for each service i currently have and connect them with each other?I don't know where to start doing that and there is totally no information about that anywherePlease help me figure our the best proper way to do that.FollowComment"

Answer: "0The best way to go about this would be to use the AWS CDK to create a CloudFormation template that will replicate the existing resources in your AWS environment. This template can then be used to create a local version of the environment using the AWS CDK.To create the CloudFormation template, you can use the AWS CDK to generate the necessary code from your existing resources. You can do this by running the following commands in the AWS CLI:To generate the CloudFormation template for an API Gateway:aws cloudformation export-stack-template --stack-name <stack_name> --output text > <output_file_name>To generate the CloudFormation template for a Lambda Function:aws cloudformation export-stack-template --stack-name <lambda_function_name> --output text > <output_file_name>To generate the CloudFormation template for a DynamoDB instance:aws cloudformation export-stack-template --stack-name <dynamodb_table_name> --output text > <output_file_name>Once you have the CloudFormation templates for each of your resources, you can then useCommentShareDivyam Chauhananswered 4 months ago0thanks for you fast reply !sudo aws cloudformation export-stack-template --stack-name 9nc4das --output-text apigw.txt usage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]To see help text, you can run:  aws help  aws <command> help  aws <command> <subcommand> helpaws: error: argument operation: Invalid choice, valid choices are:activate-type                            | batch-describe-type-configurations      cancel-update-stack                      | continue-update-rollback                create-change-set                        | create-stack                            create-stack-instances                   | create-stack-set                        deactivate-type                          | delete-change-set                       delete-stack                             | delete-stack-instances                  delete-stack-set                         | deregister-type                         describe-account-limits                  | describe-change-set                     describe-change-set-hooks                | describe-publisher                      describe-stack-drift-detection-status    | describe-stack-events                   describe-stack-instance                  | describe-stack-resource                 describe-stack-resource-drifts           | describe-stack-resources                describe-stack-set                       | describe-stack-set-operation            describe-stacks                          | describe-type                           describe-type-registration               | detect-stack-drift                      detect-stack-resource-drift              | detect-stack-set-drift                  estimate-template-cost                   | execute-change-set                      get-stack-policy                         | get-template                            get-template-summary                     | import-stacks-to-stack-set              list-change-sets                         | list-exports                            list-imports                             | list-stack-instances                    list-stack-resources                     | list-stack-set-operation-results        list-stack-set-operations                | list-stack-sets                         list-stacks                              | list-type-registrations                 list-type-versions                       | list-types                              publish-type                             | record-handler-progress                 register-publisher                       | register-type                           rollback-stack                           | set-stack-policy                        set-type-configuration                   | set-type-default-version                signal-resource                          | stop-stack-set-operation                test-type                                | update-stack                            update-stack-instances                   | update-stack-set                        update-termination-protection            | validate-template                       package                                  | deploy                                  wait                                     | help                                    I made sure im using the last version following aws documentation: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html#getting-started-install-instructionsusre@a-len:~/myapi$ sudo aws --versionaws-cli/2.9.20 Python/3.9.11 Linux/5.15.0-58-generic exe/x86_64.ubuntu.22 prompt/offCommentSharerePost-User-666answered 4 months ago"


Question: OpenSSL  CVE-2022-3602 vulnerabilities I found in ECS containers

"Hello,After checking AWS Inspector for CVE vulnerabilities I found that they are in ECS containers of our application. How do I fix container vulnerabilities please?Thank you in advanceFollowComment"

Answer: "0Please check the OpenSSL Security Advisory post for November 2022 that we published. In here you will find links to rectify OpenSSL vulnerabilities for ECS.CommentShareMKanswered 6 months ago0The recommended fix for both CVE-2022-3602 and CVE-2022-3786 is to update OpenSSL to version 3.0.7.Depending on the Container OS that you are using, it will have different packages versions to update. For example, Ubuntu 22.04 users can upgrade the “openssl” package to version 3.0.2-0ubuntu1.7. Red Hat Enterprise Linux 9 users can upgrade the “openssl” package to version openssl-3.0.1-43.el9_0CommentShareHenrique Santanaanswered 6 months ago"


Question: How to add "timestamp" field into each data record through msk connector?

"Hello,I am using MSK Connector(S3SinkConnector) to write data into S3 from MSK cluster. Now I want to add a timestamp to mark the time of storing into s3.I found there is Kafka Connect Transformations InsertField feature (https://docs.confluent.io/platform/current/connect/transforms/insertfield.html#),But when I add the below Transformations configuration into connector properties,  the msk connector cannot be created successfully.transforms=InsertFieldtransforms.InsertField.type=org.apache.kafka.connect.transforms.InsertField$Valuetransforms.InsertField.timestamp.field=TimestampFieldIt seem msk connector cannot support transforms InsertField feature.Is there any mistake from me or is there any way to add timestamp into data record through msk connector?Below is my full connector properties:connector.class=io.confluent.connect.s3.S3SinkConnectors3.region=us-east-1partition.duration.ms=60000transforms.InsertField.timestamp.field=TimestampFieldtopics.dir=<topic dir>flush.size=9schema.compatibility=NONEtasks.max=3topics=<topic>timezone=UTCtransforms=InsertFieldrotate.interval.ms=5000locale=en-USs3.compression.type=gzipformat.class=io.confluent.connect.s3.format.json.JsonFormattransforms.InsertField.type=org.apache.kafka.connect.transforms.InsertField$Valuepartitioner.class=io.confluent.connect.storage.partitioner.TimeBasedPartitionerstorage.class=io.confluent.connect.s3.storage.S3Storages3.bucket.name=<bucket>path.format='year'=YYYY/'month'=MM/'day'=dd/'hour'=HHFollowComment"

Answer: "0I found these configurations are workable. Failed reason is the data in msk topic is json format, not Struct object. need to convert it to Struct if we use InsertField features.CommentSharemingtonganswered a month ago"


Question: ResourceNotFoundException: Requested resource not found

"I'm trying to access DB from one AWS account to another AWS account. I did a STS call and got the AccessID and Key with Session as well. I set the Credentials in DynamoDB object. When i trigger a call with scan, i'm reading an error asResourceNotFoundException: Requested resource not foundResourceNotFoundException: Requested resource not foundat Request.extractError (/app/node_modules/aws-sdk/lib/protocol/json.js:51:27)at Request.callListeners (/app/node_modules/aws-sdk/lib/sequential_executor.js:106:20)at Request.emit (/app/node_modules/aws-sdk/lib/sequential_executor.js:78:10)at Request.emit (/app/node_modules/aws-sdk/lib/request.js:688:14)at Request.transition (/app/node_modules/aws-sdk/lib/request.js:22:10)at AcceptorStateMachine.runTo (/app/node_modules/aws-sdk/lib/state_machine.js:14:12)at /app/node_modules/aws-sdk/lib/state_machine.js:26:10at Request.<anonymous> (/app/node_modules/aws-sdk/lib/request.js:38:9)at Request.<anonymous> (/app/node_modules/aws-sdk/lib/request.js:690:12)at Request.callListeners (/app/node_modules/aws-sdk/lib/sequential_executor.js:116:18)const AWS = require('aws-sdk');const roleToAssume = { RoleArn: 'arn:aws:iam::00000000000:role/XXXXXXX-role',    RoleSessionName: 'session1' };// Create the STS service objectconst sts = new AWS.STS({ apiVersion: '2011-06-15' });async function getDocumentClient() {    const data = await sts.assumeRole(roleToAssume).promise();    const options = { region: 'us-east-1',        accessKeyId: data.Credentials.AccessKeyId,        secretAccessKey: data.Credentials.SecretAccessKey,        sessionToken: data.Credentials.SessionToken };    AWS.config.update(options);    if (process.env.DYNAMO_DB_ENDPOINT) {        return new AWS.DynamoDB.DocumentClient({            endpoint: process.env.DYNAMO_DB_ENDPOINT        });    }    return new AWS.DynamoDB.DocumentClient();}And the other file calls this nodejs fileconst Joi = require('@hapi/joi');const getDocumentClient = require('../util/getDocumentClient');const verifyApiAccessPermissions = require('../authentication/verifyApiAccessPermissions');const documentClient = getDocumentClient();async function scanPrimaryTable(exclusiveStartKey) {    console.log('===> Into scanPrimaryTable <===');    // console.log(documentClient);    const result = await documentClient.scan({        TableName: process.env.PROXIES_TABLE_NAME,        Limit: process.env.PAGINATION_LIMIT,        ExclusiveStartKey: exclusiveStartKey    }).promise();    console.log('===> Into Result <===');    console.log(result);    return result;}async function getProxies(lastEvaluatedKey) {    const exclusiveStartKey = lastEvaluatedKey ? {        name: lastEvaluatedKey    } : undefined;    return scanPrimaryTable(exclusiveStartKey);}async function handler(request, h) {    const lastEvaluatedKey = request.query.lastEvaluatedKey;    const result = await getProxies(lastEvaluatedKey);    const proxies = result.Items;    const permittedResponse = await verifyApiAccessPermissions(proxies, request.auth.credentials);    if (result.LastEvaluatedKey) {        const link = `</proxies?lastEvaluatedKey=${result.LastEvaluatedKey.name}>; rel=next`;        return h.response(permittedResponse)            .code(206)            .header('Link', link);    }    return h.response(permittedResponse);}FollowCommentJaccoPK a year agoCan you share some code?ShareMLGuy a year agoYou don't call the function but access documentClient. Not clear where do you get it.Share"

Answer: "0I'm using newreturn new AWS.DynamoDB.DocumentClient();CommentSharerePost-User-4719305answered a year agorePost-User-4719305 a year agoI see that there are events trails in the destination AWS account where the DynamoDB is present. But not sure why the response is not reciprocated.Share0It sounds like a 'new' might be needed, see if this fixes it: https://github.com/aws/aws-sdk-js/issues/3144CommentShareSeanManswered a year ago"