Question: "How to fix error when uploading to S3 - "curl: (56) LibreSSL SSL_read: SSL_ERROR_SYSCALL, errno 54""

"I've got a pre-signed URL and am trying to use cURL to upload to S3curl -X PUT [PresignedUrl]' \-d '@/Volumes/[Volume]/Path/To/File.mov' \-H 'Content-Type: video/quicktime' \-H 'Content-Length: 6596082'The upload seems be working until the last few bites, when I get the error curl: (56) LibreSSL SSL_read: SSL_ERROR_SYSCALL, errno 54FollowComment"

Answer: "0Hi,The errno 54 indicates a generic network connectivity issue.The issue is most likely related to your curl/ libressl or the proxy behind your internet. Ensure a good internet connection and try to update your curl/ libressl or try to connect without using proxy.Thanks.CommentSharePavithra-AWSanswered a year agoTrln a year ago@Pavithra-AWS - thanks for the followup.I've been testing using a place of work and private residence. The private residence uses no proxy, and the connectivity is excellent (1000mbps down / 1000mbps up). The same 6mb file that fails when uploading via cURL uploads in less than 2 secs on a browser UI to the same AWS server.Any idea what else might cause that error?Share"


Question: How to find source of GetMetricData

"My Cloudwatch cost has increased and i am seeing high cost on GetMetricData API calls so trying to find if there is any way to get the source of it.Cloud trail  Event History dosen't show that.Br,AvinashFollowComment"

Answer: "1Hello Avinash,Sorry for any frustration caused. You may find this article helpful in determining your CloudWatch Usage and costs: https://aws.amazon.com/premiumsupport/knowledge-center/cloudwatch-understand-and-reduce-charges/.You can also refer to this doc for more details on cost and usage reports: https://docs.aws.amazon.com/cur/latest/userguide/how-cur-works.html.If that's not quite what you need, you can always create a case with our Billing team to look into the cause of the charges: go.aws/support-center.Best wishes,Marc O.CommentShareEXPERTAWS Support - Marcanswered 5 months ago0Thankyou Marco for your valuable inputs.CommentSharerePost-User-0720851answered 5 months ago"


Question: Running Ansible in aws lambda

"I would like to run an ansible playbook in aws lambda, I have created a custom image for this and when I was able to final trigger the function, I am getting error like[ERROR] AnsibleError: Unable to use multiprocessing, this is normally caused by lack of access to /dev/shm: [Errno 38] Function not implementedansible uses python multiprocessing for it task queue manager and it uses multiprocessing queue, which uses /dev/shm to create the shared data between processes. Is there a way I can make it available for ansible ?codeFollowComment"

Answer: 0You will not get access to /dev/shm. You only have access to /tmp unless you configure access to EFS. See https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtime-environment.html and https://docs.aws.amazon.com/lambda/latest/dg/configuration-filesystem.htmlCommentShareRodney Lesteranswered a year ago


Question: SES suppressing all addresses to a domain

"All mails sent to a domain are being bounced with:"bounceType":"Permanent","bounceSubType":"OnAccountSuppressionList".However none of the destinations are visible in account supression list.I am using this to examine list:aws sesv2 list-suppressed-destinations | grep "my-domain-name"Is there any other setting which suppresses a domain?The destination domain itself is a SES verified domain.If I disable BOUNCE reason from account suppression settings, the emails get delivered correctly.Any pointers to reolve much appericitaed.FollowComment"

Answer: "0The only other suppression list would be the global suppression list [1] although given that it succeeds when disabling your account suppression list sure seems the domain is on the account level list. Would be worth attempting to remove the destinations [2] in question from your account suppression list to see if that succeeds or fails.[1] https://docs.aws.amazon.com/ses/latest/dg/sending-email-global-suppression-list.html[2] https://docs.aws.amazon.com/ses/latest/dg/sending-email-suppression-list.html#sending-email-suppression-list-manual-deleteCommentSharelp901answered 9 months agoSirish Bajpai 9 months agoThanks for your answer. It was a rather silly issue. I did'nt realize that 'aws sesv2 list-sppressed-destinations' command does not list all the destination in a single invocation. It returns a 'NextToken' in json output, if there are more to be listed. Caller is then required to invoke command again with the token passed in --next-token arguement.  Wish there was an option though to dump the entire list in single shot, for convinience in scripts etc.Sharelp901 9 months agoAh thats fair, yh some commands will handle the pagination or are supposed to but seems like its not supported on all commandsShare"


Question: SSL_connect error to email-smtp-fips.us-east-1.amazonaws.com

"Hello,I am trying to send an e-mail with postfix by relaying over email-smtp-fips.us-east-1.amazonaws.com:25. I followed the related documents and managed to do it with a regular endpoint (email-smtp.us-east-1.amazonaws.com:25). However, when I tried to do it with the fips endpoint I got the following warning and errors (syslog):postfix/smtp: SSL_connect error to email-smtp-fips.us-east-1.amazonaws.com[IP ADDRESS REMOVED]:25: -1postfix/smtp: warning: TLS library problem: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac:../ssl/record/rec_layer_s3.c:1528:SSL alert number 20:postfix/smtp: 972631FF6D: Cannot start TLS: handshake failurepostfix/smtp: SSL_connect error to email-smtp-fips.us-east-1.amazonaws.com[IP ADDRESS REMOVED]:25: -1postfix/smtp: warning: TLS library problem: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac:../ssl/record/rec_layer_s3.c:1528:SSL alert number 20:postfix/smtp: 972631FF6D: Cannot start TLS: handshake failurepostfix/smtp: SSL_connect error to email-smtp-fips.us-east-1.amazonaws.com[IP ADDRESS REMOVED]:25: -1postfix/smtp: warning: TLS library problem: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac:../ssl/record/rec_layer_s3.c:1528:SSL alert number 20:postfix/smtp: 972631FF6D: to=<EMAIL ADDRESS REMOVED>, relay=email-smtp-fips.us-east-1.amazonaws.com[IP ADDRESS REMOVED]:25, delay=23, delays=23/0.05/0.1/0, dsn=4.7.5, status=deferred (Cannot start TLS: handshake failure)I also tried port 587 without any luck. I couldn't find what is wrong and I need help.Edited by: alperdom on Jan 8, 2021 12:01 AMFollowComment"

Answer: "0For anyone that might come across this problem, here is the solution: you should be using a postfix version that supports disabling TLSv1.3 as FIPS endpoints only accept connections with cipher TLSv1.2CommentSharealperdomanswered 2 years ago"


Question: EBS Unoptimized Product

"Hello Everyone,We have an AMI product on AWS and I have been updating the version as we make progress on our application. I have never  changed from the way I have created the AMI that I am associating with the new version of the product.Last night I tried to change the version of the AMI product and put in the new AMI and received the following error which I have never seen before and can't find any information on it on the interwebs.Ebs unoptimized product  This product does not support EBS optimized AMIs. Provide a new AMI that has EBS Optimization disable.Did I click on something by accident that would make this message appear?Any help would be greatly appreciated.Thanks!FollowComment"

Answer: "0Assuming you're referring to a published AMI product on the AWS Marketplace, I would recommend you contact via https://aws.amazon.com/marketplace/management/contact-us/. You may have made changes to the metadata used (EBS Optimized and/or PIOPS requirements).CommentShareEXPERTRaphaelanswered a year ago"


Question: [1.6 UI] [Warning] XML parser: not well-formed (invalid token) at line 1

"Hi,I observed that from time to time I get warning message as:[Warning] XML parser: not well-formed (invalid token) at line 1which is connected to ui .uicanvas files, I suppose.Can you check that ?CheersFollow"

Answer: "0Accepted AnswerHi @REDACTEDUSERThat sounds like an error that could occur if the UI system was attempting to open a file as a UI canvas but the file was not actually a saved UI canvas file. Next time you see that could you open the file in a text editor and paste the first few lines here?Also, do you get this when opening a file in the UI Editor or when loading a canvas file at run-time?Thanks,RobSharerePost-User-4854644answered 6 years ago0Hi @REDACTEDUSERThis error I get during Run-time loading via Canvas/LoadIntoEntity FN (here I load one canvas into another - 2x LoadIntoEntity).The first lines are:<ObjectStream version="1"><Class name="AZ::Entity" version="2" type="{75651658-8663-478D-9090-2432DFCAFA44}"><Class name="EntityId" field="Id" version="1" type="{6383F1D3-BB27-4E6B-A49A-6409B2059EAA}"><Class name="AZ::u64" field="id" value="16546804917438919487" type="{D6597933-47CD-4FC8-B911-63F3E2B0993A}"/></Class><Class name="AZStd::string" field="Name" value="UiCanvasEntity" type="{EF8FF807-DDEE-4EB0-B678-4CA3A2C490A4}"/><Class name="bool" field="IsDependencyReady" value="true" type="{A0CA880C-AFE4-43CB-926C-59AC48496112}"/><Class name="AZStd::vector" field="Components" type="{2BADE35A-6F1B-4698-B2BC-3373D010020C}"><Class name="UiCanvasComponent" field="element" version="1" type="{50B8CF6C-B19A-4D86-AFE9-96EFB820D422}"><Class name="AZ::Component" field="BaseClass1" type="{EDFCB2CF-F75D-43BE-B26B-F35821B29247}"><Class name="AZ::u64" field="Id" value="6261678898352291036" type="{D6597933-47CD-4FC8-B911-63F3E2B0993A}"/></Class>and:<ObjectStream version="1"><Class name="AZ::Entity" version="2" type="{75651658-8663-478D-9090-2432DFCAFA44}"><Class name="EntityId" field="Id" version="1" type="{6383F1D3-BB27-4E6B-A49A-6409B2059EAA}"><Class name="AZ::u64" field="id" value="16710028582501874453" type="{D6597933-47CD-4FC8-B911-63F3E2B0993A}"/></Class><Class name="AZStd::string" field="Name" value="UiCanvasEntity" type="{EF8FF807-DDEE-4EB0-B678-4CA3A2C490A4}"/><Class name="bool" field="IsDependencyReady" value="true" type="{A0CA880C-AFE4-43CB-926C-59AC48496112}"/><Class name="AZStd::vector" field="Components" type="{2BADE35A-6F1B-4698-B2BC-3373D010020C}"><Class name="UiCanvasComponent" field="element" version="1" type="{50B8CF6C-B19A-4D86-AFE9-96EFB820D422}"><Class name="AZ::Component" field="BaseClass1" type="{EDFCB2CF-F75D-43BE-B26B-F35821B29247}"><Class name="AZ::u64" field="Id" value="718087441548082854" type="{D6597933-47CD-4FC8-B911-63F3E2B0993A}"/></Class>Thank you for your investigation :)SharerePost-User-0352889answered 6 years ago0Hi @chase,Thank you for so clarity answer. You found a problem: I use '<' and '>' chars in my text.SharerePost-User-0352889answered 6 years ago0Hi @jasiuj - if your UI canvas is loading correctly (that is, you're not seeing any issues/bugs with it other than the XML warning), then its possible that you're seeing a bug related to our Text Styling Markup feature:http://docs.aws.amazon.com/lumberyard/latest/userguide/ui-editor-components-visual.html#ui-editor-component-text-styling-markupThe feature allows you to style text (on a text component) using a basic markup language (reminiscent of HTML). We use an XML parser to parse the string every time the string contents are loaded (or are changed), so if your canvas has a text component that contains reserved XML characters ('<', '>', '&'), and the text doesn't form a (somewhat) properly formatted XML string, the XML parser will log a warning that the string couldn't be parsed.If that's the issue, then you can happily ignore the warning. We have a bug written up to suppress those warning messages to avoid unnecessary concern.To verify if that's what is causing the issue:Check the canvas that's causing the warning to see if you have any text components that contain reserved XML characters ('<', '>', '&').Or, you can create a copy of the canvas, and remove any elements with text components on the canvas and verify whether the error still occurs.Again, if you're not noticing any problems (other than the warning itself), you can probably just ignore it and we should have the issue resolved eventually in an upcoming release.Thanks for bringing this to our attention!SharerePost-User-8946916answered 6 years ago"


Question: IAM user getting access deny error when trying to send SES emails on CLI

"I am trying to send SES emails from my CLI but keep getting denied.  The user account is part of a group with AWSSESFullAccess permissions but continues to get the following error:An error occurred (AccessDenied) when calling the SendEmail operation: User ... is not authorized to perform ses:SendEmail on resource ...There is no organization Service Control Policy denying this and the domain resource is verified, the send test email button in the console works properly.  Am I missing something?FollowComment"

Answer: 0Accepted AnswerYou may want to try the IAM Policy Simulator to see if it signals which policy is responsible for the denial. See: Testing IAM policies with the IAM policy simulator.CommentShareEXPERTkentradanswered a month agorePost-User-4008751 a month agoThanks it was mfa policyShare


Question: Error in Custom Entity Recognition (AWS Comprehend)

"Hello,I'm trying to build a  Custom Entity Recognition model, and I keep getting this error (We found an insufficient number of matches in the training document corpus for the entity Experience. A minimum of 100 matches for each provided entity are required. , exit code: 255)I tried to increase the training data, then it gives me this error (Custom entity recognition supports a maximum of 120000 samples. , exit code: 255)Can someone please suggest a solution?ThanksFollowComment"

Answer: "0Hello,It looks like that some of  your entity have less then 100 examples and when you add more examples you reached maximum supported samples limit.You should analyze your text to understand how may examples you have for each entity. Then you could reduce number of examples for entities with high number of examples and add more for those entities which have less then 100.CommentShareAleksandr_Panswered 10 months ago0Hello Mohamed,Amazon Comprehend team has updated the custom NER annotation limitation, from minimum 100 annotation per entity type to 25 annotations per entity type. Check: Amazon Comprehend announces lower annotation limits for custom entity recognition for more information.For the better accuracy, when preparing the training data, make sure you have balanced annotation numbers across entity types and followed Amazon Comprehend Guidelines.CommentShareMia Canswered 9 months ago"


Question: Receiving GetStaticIPs[us-east-2] Error from Lightsail Console

"i recibe this message in lightsail console, my service not workErrorGetinstances[us-east-2]Sorry, the server is currently overloaded and can't handle your request.Please try your request again later.UnavailableGetStaticlps[us-east-2]Internal Server ErrorAcknowledgedFollowComment"

Answer: "0Dear Customer,There is an issue going on in us-east-2 region and AWS has acknowledged this issue.->"We can confirm that some instances within a single Availability Zone (USE2-AZ1) in the US-EAST-2 Region have experienced a loss of power. The loss of power is affecting part of a single data center within the affected Availability Zone. Power has been restored to the affected facility and at this stage the majority of the affected EC2 instances have recovered. We expect to recover the vast majority of EC2 instances within the next hour. For customers that need immediate recovery, we recommend failing away from the affected Availability Zone as other Availability Zones are not affected by this issue".We really apologies for the issue. Soliciting your co-operation.You can also review the below link for latest updates as wellhttps://health.aws.amazon.com/health/statusNote-> If this response helped in your workflow please feel free to accept this answerCommentShareEXPERTNIRUPAM_danswered 10 months ago0HelloPlease check the Service Health console for the latest information as there appears to be an active issue affecting EC2 in that regionhttps://health.aws.amazon.com/health/statusOperational issue - Amazon Elastic Compute Cloud (Ohio)CommentShareEXPERTMatt-Banswered 10 months ago"


Question: Problem during update to new SSL/TLS certificates "rds-ca-2019"

"As many of us we received a notification from AWS to "Update Your Amazon RDS SSL/TLS Certificates by October 31, 2019".I did that on several of my Aurora MySQL Databases. The update works fine. The Problem is, after the update it appears a new "pending maintenance" of type "ca-certificate-rotation" with a apply date in the year 2024.If I make an "upgrade now" of the database, the "pending maintenance" gets executed and the SSL/TLS certificates are switched back to "rds-ca-2015".Is this intentional?Will this "pending maintenance" stay there until 2024 if I never do an "upgrade now"?FollowComment"

Answer: "0Accepted AnswerHi THeyer, thanks for your post. This is not intentional and has been fixed. Please let us know if you're still experiencing issues.CommentShareAWS-User-0584059answered 4 years ago0Hi AWS Team,I also have a question about  how to implement the Amazon RDS SSL/TLS Certificates updates in my Aurora database instance. In the notifications that Amazon  sent today it states the following steps in order to implement the change:Amazon Aws Instruction1.Download the new SSL/TLS certificate from Using SSL/TLS to Encrypt a Connection to a DB Instance.2.Update your database applications to use the new SSL/TLS certificate.3.Modify the DB instance to change the CA from rds-ca-2015 to rds-ca-2019.MY QUESTIONSince I am using an Amazon Aws  Aurora 5.6 database, I would like to know if in my case I have only to implement step 3. I mean in order to take effect the change I do not have to follow step 1 and step 2?Many thanks for your help.Regards,AlcidesCommentSharevpanswered 4 years ago0@Alcides:you alwyas have to follow all 3 steps. I you only do step 3 you can't connect to your database anymore with SSL, because your client has an old certificate.CommentShareTHeyeranswered 4 years ago"


Question: "CDK not letting me delete SNS Topic, trapped dependency!"

"Hi,I created an SNS Topic in Stack logging and used it in stacks prod and staging. However, now I want to get rid of this SNS topic and the associated infrastructure, but CDK is not letting me delete it. When I update the code to get rid of it and try to deploy my stacks, it kind of detects a cyclical dependency. It can't detect that I've delete the SNS topic and all dependent resources from all my stacks, it errors out when deploying logging first (because stacks staging and production depend on logging), saying that the SNS Topic is in use by staging and production.Any help is appreciated.FollowComment"

Answer: 0Accepted AnswerI fixed it by deleting the resources manually and updating cloudformation as well to delete the resources from production and staging. Now CDK is able to deploy my changes.CommentShareManavanswered a year ago


Question: "CUDOS & Cost Optimisation dashboards, Account Names display account numbers"

How to change this to be the account name? where is this even configured? I have not been able to find out where it pulls that data and why it is using the account numberi nthe Account name field. Can anyone help?FollowComment

Answer: "0It looks like the resource you are using there is outdated. Have a look here: https://wellarchitectedlabs.com/cost/200_labs/200_cloud_intelligence/cost-usage-report-dashboards/dashboards/code/0_view0/CommentShareAaron Edellanswered 6 months agorePost-User-4184707 3 months agoHi, I've tried following the document you linked, but it doesn't seem to work for me. Are there other methods to change the account names?Share0This document explains how to provision Account Names instead of Account IDs in the dashboards.[+] https://catalog.us-east-1.prod.workshops.aws/workshops/fd889151-38aa-4fe2-a29d-d5fa557197bb/en-US/workshop/add-org-dataI trust this is helpful!CommentShareSUPPORT ENGINEERAWS-User-4315904answered 9 months ago0Hi thanks for that.Do I need to follow all of those steps or have I already setup some of the steps through the previous workshop creating the cost optimisation dashboard? very hard to follow these guides. Im not sure hwat has alreayd been done and where to start fromCommentSharerePost-User-2035680answered 9 months ago0Having this same problem. Has anyone been able to implement any of the steps?CommentSharetaurusimi1answered 3 months ago"


Question: Cognito Internationalization

"It is possible to replace the texts presented on the AWS Cognito hosted UI login screen? I am involved in a project, where we need the strings in Spanish.FollowComment"

Answer: "0Hi,Thank you for your patience. This is currently not a supported feature in AWS Cognito.Currently the hosted UI can have the CSS as well as the logo customized:https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-app-ui-customization.htmlCommentShareSara_Aanswered a year agoSteef Burghouts 10 months agoThe internationalization for Cognito has been on the roadmap for 4 years now, is it still on your roadmap and when will you rollout this feature?Share"


Question: Client not receiving RTS message

"I'm having trouble with one particular piece of code that is supposed to be sending a message to a client.  Both pieces of code below are from my Realtime Server Script:function onPlayerAccepted(player) {    logger.info("..New player accepted: " + player.peerId);    const newPlayerMessage = session.newTextGameMessage(OP_CODE_PLAYER_ACCEPTED,        session.getServerId(),        JSON.stringify(galaxyAndLocalPlayerState));    session.sendReliableMessage(newPlayerMessage, player.peerId);}The above block within my realtime server script runs when a player is accepted, and the message is successfully received by the client (Unity).  On the client side, logs show that OnDataReceived() is called.RTS Logs for above call:02 Mar 2022 03:59:32,191 [INFO] (ManhuntServerScript.js) 96: ..New player accepted: 102 Mar 2022 03:59:32,191 [INFO] (index.js) 333: Received custom game message from sender: -1 with opCode: 100, targetPeerId: 1, targetGroupId: 0function onMessage(gameMessage) {      switch (gameMessage.opCode) {          case OP_CODE_TRAVEL_REQUEST:              logger.info("..Travel Request Received from Peer " + gameMessage.sender + " to PlanetId: " + gameMessage.getPayloadAsText());              const travelResponseMessage = session.newTextGameMessage(OP_CODE_TRAVEL_BEGIN,                  session.getServerId(),                  JSON.stringify(playerStates));              session.sendReliableMessage(travelResponseMessage, gameMessage.sender);              break;          default:              logger.info("..Unrecognized Op Code received: " + gameMessage.opCode);              break;      }}The above block shows the message is being sent in the server logs, but is not received by the Unity client.  I have ensured the op codes match.  On the client side, logs show that OnDataReceived() is NOT called.RTS logs for above call:02 Mar 2022 03:59:36,628 [INFO] (index.js) 333: Received custom game message from sender: 1 with opCode: 200, targetPeerId: -1, targetGroupId: 002 Mar 2022 03:59:36,628 [INFO] (ManhuntServerScript.js) 136: ..Travel Request Received from Peer 1 to PlanetId: 202 Mar 2022 03:59:36,629 [INFO] (index.js) 333: Received custom game message from sender: -1 with opCode: 102, targetPeerId: 1, targetGroupId: 0The only thing I can think of is that possibly a realtime server can't send a message within onMessage() but that seems silly to me.Thanks in advance for any insight!FollowComment"

Answer: "0Thanks for the response.  I actually just found the solution, it was a problem with my client not getting the certificate generated from the RTS.  When I set the RTS to not generate a certificate, the connection and messages work as intended.  Here are my new questions:Why is my client able to connect to my RTS (and receive an onPlayerAccepted message) without the fleet's generated cert in the first place?  This seems like a security issue to me.Is there any documentation on best practices for a client to obtain a certificate for a fleet?  I don't want clients to have to make AWS API calls using temporary credentials, which is the only way I have seen so far.  I'm guessing this will be a lambda similar to how the recommended matchmaking flow works?Thanks again!CommentSharerePost-User-1960859answered a year agorePost-User-4427887 4 months agoI have encountered this issue as well, but I need to use the secured connection (cert) for a webgl https build, have you figured out how to fix it?Share0Hi @REDACTEDUSERThis is very strange indeed :PIt's not a network/firewall issue because your client could receive some message, and from the logs, looks like your server has succeeded in sending to playerId 1 during onPlayerAccepted, but not during onMessage. (Yes, you can send messages during onMessage)I'd try a these things, and do them in both onPlayerAccepted and onMessage to compare results:Before sending the message in onMessage(), print out all connected players, i.e. session.getPlayers().forEach((player, playerId) => ...). Could it be possible that the player disconnected between the 2 sendReliableMessage calls?Try broadcasting to the group instead. session.sendReliableGroupMessage(...), see: https://docs.aws.amazon.com/gamelift/latest/developerguide/realtime-script-objects.html, trying using -1 as the group id to broadcast to ALL players(Shot in the dark) Try using UDP instead of TCP? i.e. session.sendMessage(...) (the args is identical to sendReliableMessageCommentSharerePost-User-7108006answered a year ago0Thanks for your reply!  Here is a quick update:I tried this and can confirm that playerId 1 is still connected from the following log:04 Mar 2022 00:56:47,762 [INFO] (index.js) 191: Message received from player 104 Mar 2022 00:56:47,763 [INFO] (index.js) 196: Packet (including both internal messages and custom game messages) received from player: 104 Mar 2022 00:56:47,763 [INFO] (index.js) 333: Received custom game message from sender: 1 with opCode: 200, targetPeerId: -1, targetGroupId: 004 Mar 2022 00:56:47,763 [INFO] (ManhuntServerScript.js) 137: ..Travel Request Received from Peer 1 to PlanetId: 204 Mar 2022 00:56:47,763 [INFO] (ManhuntServerScript.js) 144: Connected player: playerId: 104 Mar 2022 00:56:47,763 [INFO] (index.js) 333: Received custom game message from sender: -1 with opCode: 102, targetPeerId: 1, targetGroupId: 0I gave this a try and it did not workThis unfortunately did not seem to change anything eitherI have some more info that might help:I tried a couple things on the client side, client.Session.State says READY whenever i check.  However there is one thing that seems to be off.. after 2 minutes of connectivity the connection always closes with the following log (Unity side):[server-sent] OnErrorEvent - Sender: -2 OpCode: -101[server-sent] OnCloseEventI have not defined a -101 opcode and am not sure what -2 could mean for sender.  It always happens exactly 2 minutes after opening the connection.  Am I missing a step here?Thanks again :slight_smile:CommentSharerePost-User-1960859answered a year ago0any thoughts on this? still having this issue @REDACTEDUSERCommentSharerePost-User-1960859answered a year ago0I have sent this issue to the GameLift team to investigate, sorry for the late reply!#P61454798CommentSharerePost-User-7108006answered a year ago0Hey @REDACTEDUSERCommentSharerePost-User-7791211answered a year ago0-101 is the opCode corresponding to PLAYER_CONNECT_OP_CODE which is defined in the GameLift RTS Client SDK.In this case my suspicion is there's an issue with the Websocket Connection, which surfaces as this error. Is there anyway to identify or add additional logging on the client side which might help surface connection related issues? Once you provide the GameSessionId I can take a look at the GameLift server end of things to see if there's anything I can identify on our end.CommentSharerePost-User-7791211answered a year ago0I'll work on that client side logging.  Also, I am not seeing any reference to opCode -101 in the client SDK documentation. Am I looking in the right place?Here is a game session where this has happened:Game session: arn:******Thanks for looking into this!edit: I'm digging into wireshark and can see that one of the incoming packets from my instance's IP has the TCP "Reset" flag set. my knowledge here is limited but i figured this might help:Source Port: 1900Destination Port: 65287Flags: 0x004 (RST).... .... .1.. = Reset: Setedit 2: I changed my server loggingLevel to debug and found the following logs from this game session: arn:******19 Mar 2022 19:19:07,332 [INFO] (ManhuntServerScript.js) 170: Tick... 23 activePlayers: 119 Mar 2022 19:19:08,333 [INFO] (ManhuntServerScript.js) 170: Tick... 24 activePlayers: 119 Mar 2022 19:19:08,782 [DEBUG] (index.js) 130: Attempting to ping all (1) connected players in the server19 Mar 2022 19:19:08,782 [DEBUG] (ws.js) 211: Sent ping to player: 119 Mar 2022 19:19:09,334 [INFO] (ManhuntServerScript.js) 170: Tick... 25 activePlayers: 119 Mar 2022 19:19:10,335 [INFO] (ManhuntServerScript.js) 170: Tick... 26 activePlayers: 119 Mar 2022 19:19:11,337 [INFO] (ManhuntServerScript.js) 170: Tick... 27 activePlayers: 119 Mar 2022 19:19:12,338 [INFO] (ManhuntServerScript.js) 170: Tick... 28 activePlayers: 119 Mar 2022 19:19:13,338 [INFO] (ManhuntServerScript.js) 170: Tick... 29 activePlayers: 119 Mar 2022 19:19:14,340 [INFO] (ManhuntServerScript.js) 170: Tick... 30 activePlayers: 119 Mar 2022 19:19:15,341 [INFO] (ManhuntServerScript.js) 170: Tick... 31 activePlayers: 119 Mar 2022 19:19:16,343 [INFO] (ManhuntServerScript.js) 170: Tick... 32 activePlayers: 119 Mar 2022 19:19:17,344 [INFO] (ManhuntServerScript.js) 170: Tick... 33 activePlayers: 119 Mar 2022 19:19:18,346 [INFO] (ManhuntServerScript.js) 170: Tick... 34 activePlayers: 119 Mar 2022 19:19:19,347 [INFO] (ManhuntServerScript.js) 170: Tick... 35 activePlayers: 119 Mar 2022 19:19:20,349 [INFO] (ManhuntServerScript.js) 170: Tick... 36 activePlayers: 119 Mar 2022 19:19:21,350 [INFO] (ManhuntServerScript.js) 170: Tick... 37 activePlayers: 119 Mar 2022 19:19:22,352 [INFO] (ManhuntServerScript.js) 170: Tick... 38 activePlayers: 119 Mar 2022 19:19:23,353 [INFO] (ManhuntServerScript.js) 170: Tick... 39 activePlayers: 119 Mar 2022 19:19:24,354 [INFO] (ManhuntServerScript.js) 170: Tick... 40 activePlayers: 119 Mar 2022 19:19:25,356 [INFO] (ManhuntServerScript.js) 170: Tick... 41 activePlayers: 119 Mar 2022 19:19:26,357 [INFO] (ManhuntServerScript.js) 170: Tick... 42 activePlayers: 119 Mar 2022 19:19:27,359 [INFO] (ManhuntServerScript.js) 170: Tick... 43 activePlayers: 119 Mar 2022 19:19:28,360 [INFO] (ManhuntServerScript.js) 170: Tick... 44 activePlayers: 119 Mar 2022 19:19:29,361 [INFO] (ManhuntServerScript.js) 170: Tick... 45 activePlayers: 119 Mar 2022 19:19:30,363 [INFO] (ManhuntServerScript.js) 170: Tick... 46 activePlayers: 119 Mar 2022 19:19:31,364 [INFO] (ManhuntServerScript.js) 170: Tick... 47 activePlayers: 119 Mar 2022 19:19:32,365 [INFO] (ManhuntServerScript.js) 170: Tick... 48 activePlayers: 119 Mar 2022 19:19:33,367 [INFO] (ManhuntServerScript.js) 170: Tick... 49 activePlayers: 119 Mar 2022 19:19:34,368 [INFO] (ManhuntServerScript.js) 170: Tick... 50 activePlayers: 119 Mar 2022 19:19:35,369 [INFO] (ManhuntServerScript.js) 170: Tick... 51 activePlayers: 119 Mar 2022 19:19:36,371 [INFO] (ManhuntServerScript.js) 170: Tick... 52 activePlayers: 119 Mar 2022 19:19:37,372 [INFO] (ManhuntServerScript.js) 170: Tick... 53 activePlayers: 119 Mar 2022 19:19:38,373 [INFO] (ManhuntServerScript.js) 170: Tick... 54 activePlayers: 119 Mar 2022 19:19:38,782 [DEBUG] (index.js) 130: Attempting to ping all (1) connected players in the server19 Mar 2022 19:19:38,783 [WARN] (index.js) 133: Player 1 did not respond to the last ping. Terminating the player client.19 Mar 2022 19:19:38,783 [INFO] (ws.js) 206: TCP client connection for player: 1 is terminated by the server19 Mar 2022 19:19:38,784 [DEBUG] (ws.js) 155: Received 'close' event from websocket client: undefined, player: 1 from ::ffff:(MY-IP-ADDRESS):61386edit 3: From my server script I made the following change:const configuration = {    pingIntervalTime: 30000};toconst configuration = {};resulting in the player session moving to completed a few seconds after the connection is made.  It looks like the client could respond to the first ping but not the second. I looked at this sample project and found the same configuration constant.CommentSharerePost-User-1960859answered a year ago0Thanks for providing that information @REDACTEDUSERI've gone over logs on our end and from the Game Server's view there is nothing that stands out to me. Like you've discovered via server logging the RTS server is trying a routine ping to the client, and the client doesn't respond. As a result the server terminates the player connection. I wonder if the TCP "Reset" flag is set when the server terminates the connection (Could you check if the timestamps align?).Given that the client can initially receive a message from the server, I'm wondering if this could be something network or firewall related? A couple more things we can potentially try to narrow down the issue:Can we attempt running the client on a different network to see if the behavior is the same? This will help isolate if this is something network or client related.Have you tried running the RTS sample to see if everything works as expected? This is a tested sample, so I would expect this would help narrow down issues with the environment the client is running on.Are you running the latest version of the Client SDK?With respect to the opCode I was viewing the code from the RTS Client SDK itself.CommentSharerePost-User-7791211answered a year ago"


Question: Pinpoint Voice - Getting Call Result Information

"Hello,I trying to send out call via pinpoint, and I can send, but I can't figure out how to get info back as to the results of the call, like was it picked up, duration, was it busy, did it hit an answering machine, etc.  How can I get that in my lambda function, using the messageId from (java) PinpointSmsVoiceClient::sendVoiceMessage(SendVoiceMessageRequest voiceMessageRequest).  Is there a callback, or do I have to poll something, I'm a bit confused.try {            final String languageCode = "en-US";            final String ssmlMessage = "<speak>[our message]</speak>";            final String voiceName = "Matthew";            SSMLMessageType ssmlMessageType = SSMLMessageType.builder()                    .languageCode(languageCode)                    .text(ssmlMessage)                    .voiceId(voiceName)                    .build();            VoiceMessageContent content = VoiceMessageContent.builder()                    .ssmlMessage(ssmlMessageType)                    .build();            SendVoiceMessageRequest voiceMessageRequest = SendVoiceMessageRequest.builder()                    .destinationPhoneNumber(destinationNumber)                    .originationPhoneNumber(originationNumber)                    .content(content)                    .build();            SendVoiceMessageResponse response = client.sendVoiceMessage(voiceMessageRequest);            response.messageId();  <--- What do I do with this to get the call results?            System.out.println("The message was sent successfully.");        } catch (PinpointSmsVoiceException e) {            System.err.println(e.awsErrorDetails().errorMessage());            System.exit(1);        }FollowComment"


Question: Security Group Inbound Update Not Working

"I recently added a new IP address to my security group to allow that IP address to access a EC2 instance within the group.  After 24 hours, that new IP address is still not able to access the EC2 instance.  Any help/advice would be appreciated.FollowComment"

Answer: "0Hi there,Thank you for reaching out.I can see that you are not able to access your instance.Can you verify that the instance meets all prerequisitesThe instance must meet the following conditions:The route table that is associated with your instance’s subnet has a  default route to an Internet Gateway (0.0.0./0). The internet gateway that is associated with the route isn't deleted.The security group that is attached to the instance’s elastic network interface has rules allowing outbound internet traffic (0.0.0.0/0) for your ports and protocols.The network access control list (network ACL) that is associated with the instance's subnet has rules allowing both outbound and inbound traffic to the internet.Verify that the instance has a public IP address.Please review the provided AWS documentation[1][2] for more information.I hope the provided information helps. If it does not, please let me know if you have questions.Have a great day!References[1] https://aws.amazon.com/premiumsupport/knowledge-center/ec2-connect-internet-gateway/[2] https://aws.amazon.com/premiumsupport/knowledge-center/ec2-internet-connectivity/CommentShareNeoSeemaanswered 2 years ago0Thank you for your response.  IIUC, all of the configurations you mentioned are already correctly set up.  For some more context, I am trying to switch to a different ISP.  The IP address from my old ISP and my new ISP are both in the inbound rules of my EC2's security group.  However, I can only connect to the EC2 using the old IP address.  I wonder if there is something else that I am missing, or if I should contact my ISP.  Any additional help would be great, thanks.CommentShareyajawsanswered 2 years ago0Never mind, turns out my new ISP does not give me a static IP address.  I had to change it to the right one.  Thanks.CommentShareyajawsanswered 2 years ago"


Question: Workmail username change

"Hi,Is there a way to change a username for an already created user in Workmail?Edited by: r2software on Sep 8, 2020 11:19 AMFollowComment"

Answer: "0Hey,Currently you can not change the username of an already created user, you can disable this user and create a new one with the updated username.Thanks,Vishwajit.CommentShareAWS-User-3235085answered 3 years ago0ThanksCommentSharer2softwareanswered 3 years ago"


Question: Is there antivirus software recommended to install AWS Linux 2 system?

"I'm using the following AWS services:: AMI 2 Linux EC2, Load Balancers, SecurityHub, Guard Duty, Lambda, RDS, S3, SES, Route53, CloudWatch, CloudTrail, CloudFront, SNS, VPC, ACL, WAF, IAM.Sometimes, the packages we install and the application we set up, and their dependencies may have security and vulnerability issues. The security and vulnerability issues can either be in a file or the packages we install and can be injected through the websites. To overcome such a scenario we need it in our system.Can anyone suggest to me any antivirus software available for AWS AMI 2 Linux EC2 instance? also, is there any documentation on how to install the AV on the AWS Linux 2 Linux system?FollowComment"

Answer: "0Hello,ClamAV is a popular open source antivirus: http://www.clamav.net/It can be installed on AL2 from an EPEL repository:sudo amazon-linux-extras install epelsudo yum install clamav freshclam clamav-updateCommentShareAWS-ADolganovanswered a year ago"


Question: I broke sudo by rename libssl.so.10

"While acting as root, I renamed /usr/lib64/libssl.so.10 and that broke a lot of things including ability to ssh into system and ability to sudo.I can't revert to the old state since i can't get root access(!).I know its my fault but had no idea it would break so easily.Can you tell me hoe to revert to working state?Thanks!FollowComment"

Answer: "0Accepted AnswerStop broken instanceDetach broken instance root volumeStart new instanceAttach broken instance root volume to new instanceLogin to new instance and fix the files on the broken instance volumeStop new instanceDetach broken instance volume from new instanceAttach broken instance volume to broken instanceFixed instance!CommentShareEXPERTkentradanswered 4 months agoEXPERTBrettski-AWSreviewed 4 months agorePost-User-5765333 4 months agoThanks, looks like I click the wrong button and terminated it, ooopsie!Share"


Question: AWS Instance Scheduler schedule name unknown

"The application I look after is only used during office hours, so in order to save costs, I've tried to automate the shutdown of servers overnight using AWS Instance Scheduler. I've tagged a couple of EC2 instances and an RDS instance, setting ScheduledServices=Both. However, Instance Scheduler is only shutting down the EC2 instances, while the RDS instance continues to run. I've also tried creating a second Instance Scheduler CloudFormation stack with the same TagName and setting ScheduledServices=RDS, but this doesn't cause the EC2 instance to be shutdown either.The schedule config is this:Target all instances with following tag key: ScheduleDowntime and value: Y.Targeted instances will be started at 07:00:00 and stopped at 19:00:00 on the following days: Monday, Tuesday, Wednesday, Thursday, Friday.Schedule timezone: (GMT +00:00) Europe/LondonThe Cloudwatch logs show the following message:WARNING : Skipping instance xxxx in region eu-west-2 for account xxxxx, schedule name "Y" is unknownI've Googled this message, but it appears that others were getting a similar message only when they attempted to use a stop time that is earlier than the start time, and that is not the case for me, as can be seen in the config above.How can I resolve this issue?FollowComment"


Question: Access to Business Line View for Engagement Reporting no longer have Access

https://us-east-1.quicksight.aws.amazon.com/sn/dashboards/494b0867-1f4a-44c7-a08d-e251d610bd53/sheets/494b0867-1f4a-44c7-a08d-e251d610bd53_e516ef43-05d2-497e-b4a2-193ef271a40fI've always been able to access the Detailed View tab for internal reporting on the Engage Reporting Quick Site report until this morning.   It now has restricted access due to low level security rules.   Can I please regain access.FollowComment


Question: AWS Cloudwatch Synthetic canary test failing with:  Error: connect ETIMEDOUT

We have the same test running in multiple regions of our AWS cloudwatch but only one region(Hong Kong) is failing.The errors it is providing is as follows:[Errno 104] Connection reset by peer (basic health check )No test result returned.Connection timed out after 60000ms (basic health check )Error: read ECONNRESET Stack: Error: read ECONNRESET at TLSWrap.onStreamRead (internal/stream_base_commons.js:209:20) at TLSWrap.callbackTrampoline (internal/async_hooks.js:130:1 (Multiform request with sync & async checks )But we have made no changes or alterations to the tests so it has been tricky to pinpoint the issue.Any ideas or starting points would be very much appreciated.FollowComment


Question: Encountering "PLEG is not healthy" error on EKS nodes

"We are running EKS cluster with m5.12xlarge as worker nodes. Looking at cloudwatch logs we can see that "PLEG is not healthy: pleg was last seen active 3.xxm ago" error happens very frequentlycausing instability in our cluster. What could be the possible causes or any other underlying issue? Added details of our cluster belowEKS version: v1.21.5-eks-9017834Container Runtime: DockerDocker VersionDocker version 20.10.7, build f0df350Containerd Versioncontainer d - 1.4.6 d71fcd7d8303cbf684402823e425e9dd2e99285drunc version :1.0.0commit: 84113eef6fc27af1b01b3181f31bbaf708715301spec: 1.0.2-devgo: go1.15.14libseccomp: 2.4.1FollowComment"


Question: Aws SMS Pinpoint

"Hello,I have created the pinpoint account with below features for SMS Gateway:Registered with TRAI (India)Registered SenderIds and Templates in aws sms pinpoint (Region-Mumbai)Increased the limit from sandBox to Production.What else will be the remaining steps to complete the process of sms pinpoint. Please, guide us with the furthur steps to start sending messages to users. Do i Need to register dedicated short codeFollowComment"

Answer: "0Hi there,I understand that you would like some clarification regarding the prerequisites for sending SMS to Indian endpoints.From your correspondence, it appears that you have already completed the requirements (registering with TRAI, and requesting a Sender ID from AWS Support). With this being said, you should now be able to send SMS to Indian based phone numbers.As for the actual sending of SMS, please see the step by step instructions mentioned on step 3 of this document: https://docs.aws.amazon.com/sns/latest/dg/channels-sms-senderid-india.html#sns-send-sms-indiaI hope this helps!AhmadCommentShareAhmad Tariqanswered 3 months agoTickbig 3 months agoHello Ahmad, Firstly thanks for your response.I'm trying to integrate sms pinpoint with my web application, whenever new user signup/create account we have to verify mobile number of user with pinpoint sms OTP. Adding numbers in sns destination Number field will not work for our case. We are using javascript sdk(pinpoint) for this scenario.But the javascript sdk is not working properly. Do you have any Documents related to that?Thanks in Advance,TickbigShareAhmad Tariq 3 months agoHi again!This document includes several JS code examples to send SMS. Does this help?https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/sns-examples-sending-sms.html#sns-examples-sending-sms-scenarioThanks,AhmadShareTickbig 3 months agoNo Ahmad, not regarding SNS Notification. I required to send OTP messages & verify those OTP using pinpoint SDK. Please, guide me on this.I have attached the below Pinpoint SDK's :https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Pinpoint.html#sendOTPMessage-propertyhttps://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Pinpoint.html#verifyOTPMessage-propertyShare"


Question: My domain brk.su has been rejected in ACM when requesting a certificate

"My domain has been rejected when requesting a certificate in ACM.  The help says to raise a question here, so the question is, how do I resolve this?   I have already read the info that indicates the reason is a fraud-based issue, but this data doesn't say how to get it resolved.FollowComment"

Answer: "0Did you receive any of the errors listed in the following documents when you tried to issue the certificate?If it is out, the problem should be resolved accordingly.https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-failed.htmlCommentShareEXPERTRiku_Kobayashianswered 7 days ago0Yes, additional verification required - which without a support contract points to this forum.  Therefore I am raising this question in this forum.  With "additional verification required" and no support contract, what is the process to get this resolved?CommentSharechrismevansanswered 6 days ago"


Question: How to get a summary from a URL - AI21Labs

I have a customer request to test summarizing data from URL links and I believe AI21Labs can do that but cannot find an example with the model deployed via Jumstart. Is this possible?FollowComment

Answer: "0There is a preloaded endpoint you can deploy using the AWS Marketplace: https://aws.amazon.com/marketplace/pp/prodview-dkwy6chb63hk2.Otherwise, this link shows example to deploy on SageMaker: https://github.com/AI21Labs/SageMaker, specifically: https://github.com/AI21Labs/SageMaker/blob/main/AI21_Summarize_example_model_use.ipynb.And this blog post shows how to use AI21Labs with Jumpstart: https://aws.amazon.com/blogs/machine-learning/ai21-jurassic-1-foundation-model-is-now-available-on-amazon-sagemaker/Hope this helps,JonCommentShareEXPERTJonathan_Danswered 19 days agoLorea-AWS EXPERT19 days agoHi Jon,I have tried the repo you mentioned and the notebook for summarization. However, the API is meant to be able to take not just TEXT but also a URL and it doesn't seem to work :response = ai21.Summarize.execute(source=text,# i.e "https://en.wikipedia.org/wiki/Erwin_Schr%C3%B6dinger"sourceType="TEXT",# i.e "URL"sm_endpoint=endpoint_name)Any ideas how to make it work?ShareJonathan_D EXPERT19 days agoBased on the documentation, there seems to be a length limit to 50k characters: https://docs.ai21.com/docs/summarize-api#summarize-long-text. You may try to use their segmentation API as explained here: https://docs.ai21.com/docs/text-segmentation-api. For support related to AI21Labs API, I recommend to reach out to their support.Share0For this particular problem I recommend that you use additional strategies.1.- Place the A21 model as an inference point2.- It will be necessary to use additional libraries such as LangChain and LlamaIndex to manage the "Prompts" and feed the text. (It will be necessary use of "Embeddings")3.- Adjust the Langchain (or LlamaIndex it is the same ) call to the model established in point 1Works very wellThe model is just the first step for this particular case.CommentShareTCAPPS-MX-5555answered 5 days ago"


Question: Can't create ECS deployment group using CloudFormation (loadBalancerInfo error)

"I couldn't create ECS deployment group using CloudFormation template and got error message below.For ECS deployment group, loadBalancerInfo must not contain targetGroupInfo list (Service: AmazonCodeDeploy; Status Code: 400; Error Code: InvalidLoadBalancerInfoException; Request ID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; Proxy: null)My CFn template fragment is as follows. I commented out "TargetGroupInfoList" in response to the error message, but it didn't work. (got exactly same error message)  # CodeDeploy Deployment groups  DeploymentGroup:    Type: AWS::CodeDeploy::DeploymentGroup    Properties:       ApplicationName: !Ref DeployApplication      DeploymentStyle:        DeploymentType: BLUE_GREEN        DeploymentOption: WITH_TRAFFIC_CONTROL      BlueGreenDeploymentConfiguration:        DeploymentReadyOption:          ActionOnTimeout: CONTINUE_DEPLOYMENT        TerminateBlueInstancesOnDeploymentSuccess:          Action: TERMINATE          TerminationWaitTimeInMinutes: 5      DeploymentConfigName: CodeDeployDefault.OneAtATime      DeploymentGroupName: myapp-dg      ECSServices:        - ClusterName: !Ref ECSCluster          ServiceName: !GetAtt ECSService.Name      LoadBalancerInfo:        ElbInfoList:           - Name: !Ref ALB#        TargetGroupInfoList:#          - Name: !Ref TargetGroup01#          - Name: !Ref TargetGroup02      ServiceRoleArn: arn:aws:iam::xxxxxxxx:role/CodeDeployServiceRoleHow should I define "LoadBalancerInfo" in the template?FollowComment"

Answer: "1Accepted AnswerI think the problem is you have 2 target groups.Adding more than one target group to the array is not supported.Other issue is with BLUE_GREEN -deployment type being used with ECSAWS CloudFormation supports blue/green deployments on the AWS Lambda compute platform only.See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codedeploy-deploymentgroup-loadbalancerinfo.htmlCommentShareKalluanswered a year agoktsuda a year agoThanks. I understand that BLUE_GREEN deployment with ECS is not supported in the AWS CloudFormation at the moment.I think the error message was very confusing. Most people would think from this error message that "ECS deployment group" is supported, and something is wrong with the template. Maybe this message should be fixed for more clarification.Share0If you want to simplify this process for yourself you could use CLI tools that will take care of generating the CFN templates for your use-case. I write/maintain/use ECS Compose-X  which allows me to do everything in a docker compose syntax. You also could look at the CDK or Copilot. Note that Blue/Green on ECS is something that is fairly restrictive, you are better off (IMHO) setting up ALB / NLB to the service (with healthcheck) + healthcheck at the container level and let CFN deal with rolling back for you. We work that way all the time and this works like a charm.CommentShareJohnPrestonanswered a year ago"


Question: Route 53 Registered Domain Not Resolving

"Hello,I have searched far and wide and tried several of the proposed solutions to similar problems but I have had no luck.I have an S3 Bucket that goes through CloudFront, I have linked this via a record set to my Route 53 Domain which was registered via Route 53.If I test the record set using the test button on the AWS Console it says it is fine, however if you try and connect to the domain my browser gives DNS_PROBE_FINISHED_NXDOMAINMy base domain is swiftthistle.co.uk with tag.swiftthistle.co.uk pointing to the cloud front distribution.Any help would be great!TimEdited by: timhasler on Mar 27, 2019 6:47 AMFollowComment"

Answer: "0Accepted AnswerHi,I can't confirm that your entire configuration is correct, but I did see that the NS record in the swiftthistle.co.uk hosted zone and the domain registration are both using the wrong name servers.When you create a hosted zone, Route 53 assigns four name servers to that hosted zone. When you create another hosted zone, Route 53 assigns four different name servers to that hosted zone. Based on the current settings, I'd guess that you:~ Deleted one hosted zone~ Created another hosted zone~ Changed the NS record in the new hosted zone to use the name servers from the domain registration, which has the name servers from the old hosted zoneHere's how you fix that:Get the name servers that Route 53 assigned to the new hosted zone. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the NS record in the new hosted zone to use the name servers that you got in step 1. See "Editing Records":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-editing.htmlUpdate the domain registration to use the name servers that you got in step 1. See "Adding or Changing Name Servers and Glue Records for a Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlOn a related note, you might also want to take a peek at "Getting Started," which explains how to use Route 53, S3, and CloudFront to distribute your content:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/getting-started.htmlThere are several versions of that explanation floating around in various docs; this is my favorite. :-)ScottCommentShareEXPERTAWS-User-6179575answered 4 years ago0Hello Scott,Thank you for you excellent and speedy answer! I think I did delete and remake the hosted zone at some point when I wasn't using the domain.I'll assume this will work (Waiting on the name space change taking effect :) ) so I'll mark this as answered.p.s. I think I saw your solution posted somewhere else but the instructions weren't clear, so thank you very much for making it understandable!CommentSharetimhasleranswered 4 years ago"


Question: ALB Security Policies ELBSecurityPolicy-2015-05 and ELBSecurityPolicy-2016-08 are not identical depending on region

"This page for Application Load Balancers states that Security Policies ELBSecurityPolicy-2015-05 and ELBSecurityPolicy-2016-08 are identical.When using region us-east-1, the two policies appear to be identical.When using region us-east-2 or ca-central-1, the two policies are not identical.ELBSecurityPolicy-2015-05 has an additional cipher, DHE-RSA-AES128-SHA, that is not present in the output for aws elbv2 describe-ssl-policies ELBSecurityPolicy-2016-08.I have not checked all regions.Either the documentation or the security policies per region should be updated.FollowCommentCarlo Mencarelli 4 months agoConfirmed as well.  Very interesting. The additional policy (DHE-RSA-AES128-SHA) isn't advertised in the ELBv2 (ALB) documentation at all. It is shown on the ELB Classic security policy page for the ELBSecurityPolicy-2015-03 and ELBSecurityPolicy-2015-02 policies.Share"

Answer: 0Hello Rachel!Thank you for contacting AWS re:Post!I appreciate you for taking the time to bring this issue to our attention. I understand that the security policies claimed to be identical is not the same across all regions.Your examples of us-east-1 vs. us-east-2 helped identify this gap.I have raised this issue with the service team. I am happy to let you know that they are working on the fix.Please keep an eye out on https://aws.amazon.com/blogs/aws/ and https://aws.amazon.com/new/ for further updates on releases.CommentShareArijit_Ganswered 3 months ago


Question: CLI command 'aws iam list-mfa-devices' does not return MFA devices belonging to the account root user

"AWS CLI command aws iam list-mfa-devices does not appear to return MFA devices belonging to the account root user.aws iam list-mfa-devices --user-name rootAn error occurred (NoSuchEntity) when calling the ListMFADevices operation: The user with name root cannot be found.However, CLI command aws iam list-virtual-mfa-devices does return virtual MFA devices belonging to the account root user.Is this by design?Thanks!FollowComment"

Answer: "1Accepted AnswerYes, it is by design. Note that root is not an IAM user, which is why it cannot find the user. aws iam list-users does not list root in the results.CommentShareEXPERTbwhaleyanswered 5 months agoEXPERTkentradreviewed 5 months agoRachel 5 months agoGot it, thanks. Is there any way to see if a hardware MFA device is configured for the root account via the CLI?Sharebwhaley EXPERT5 months agoNot to the best of my knowledge, unfortunately. The root user is configured in the console.Share"


Question: How to monitor and collect GPU metrics for Windows EC2 instances using Amazon CloudWatch?

"Hi,Are there ways to collect GPU metrics for EC2 Windows instances, and send those metrics to Amazon CloudWatch for monitoring? NVIDIA GPU performance metrics from Amazon Elastic Compute Cloud (Amazon EC2) accelerated computing instances running Linux are available, but could not find clear documentation for instances running Windows.FollowComment"

Answer: "2There are a couple of ways to collect GPU metrics on Amazon EC2 Windows instances and push them to Amazon CloudWatch for monitoring: 1/.Using Amazon CloudWatch Custom Metrics, 2/. Using Telegraf as a 3rd party tool.The following sections describe how both methods can be utilized. The key difference is that with Amazon CloudWatch Custom metrics, you can monitor GPU and memory-specific metrics such as utilization. Using Telegraf can expose additional metrics such as clock memory, encoder stats, and more. Hence, determining which tool to use largely depends on the use case requirements.Method 1: Using CloudWatch Custom MetricsPre-requisites:AWS CLINvidia DriverAWS Powershell modulesIAM Role assigned to the instance that will allow CloudWatch put-metrics.The following script configures a scheduled task in Windows to run every minute, collect metrics, and push them to Amazon CloudWatch while using the EC2 instance ID as a dimension.The script can alternatively be installed once using Amazon System Manager (SSM) for further automation.#Create Scheduled Task to run every minute$taskName = 'Collect GPU Stats'$description = 'Collect GPU Stats and Pass to Cloudwatch Custom Metrics'$taskAction = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-File C:\Scripts\GPUStats.ps1'$principal = New-ScheduledTaskPrincipal -UserID "Administrator" -LogonType S4U -RunLevel Highest$taskTrigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1)$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 2)Register-ScheduledTask -TaskName $taskName -Action $taskAction -Trigger $taskTrigger -Description $description -Settings $settings -Principal $principalmkdir C:\ScriptsSet-Content -Path 'C:\Scripts\GPUStats.ps1' -Value @'#Get Stats from NVIDIA-SMI$STATS = & 'C:\Program Files\NVIDIA Corporation\NVSMI\nvidia-smi.exe' —query-gpu=temperature.gpu,memory.used,memory.free,utilization.gpu,utilization.memory —format=csv,nounits#Convert to PS Object$object = ConvertFrom-Csv -InputObject $STATS -Delimiter ','#Get EC2 Instance ID$instanceID = Get-EC2InstanceMetadata -Path '/instance-id'#Put Metrics in Cloudwatchaws cloudwatch put-metric-data —metric-name Temperature —namespace GPUStats —value $object.'temperature.gpu' —dimensions InstanceId=$instanceIDaws cloudwatch put-metric-data —metric-name MemoryUsed —namespace GPUStats —unit Megabytes —value $object.'memory.used [MiB]' —dimensions InstanceId=$instanceIDaws cloudwatch put-metric-data —metric-name MemoryFree —namespace GPUStats —unit Megabytes —value $object.'memory.free [MiB]' —dimensions InstanceId=$instanceIDaws cloudwatch put-metric-data —metric-name GPUUtilization —namespace GPUStats —unit Percent —value $object.'utilization.gpu [%]' —dimensions InstanceId=$instanceIDaws cloudwatch put-metric-data —metric-name MemoryUtilization —namespace GPUStats —unit Percent —value $object.'utilization.memory [%]'—dimensions InstanceId=$instanceIDecho $objectexit'@Method 2: Using Telegraf with CloudWatch (external answer version)The steps to install and run Telegraf are outlined below:Create an IAM User that has S3 access and cloudwatch:PutMetricData permissionDownload Nvidia Grid Drivers:$Bucket = "ec2-windows-nvidia-drivers"$KeyPrefix = "latest"$LocalPath = "$home\Desktop\NVIDIA"$Objects = Get-S3Object -BucketName $Bucket -KeyPrefix $KeyPrefix -Region us-east-1foreach ($Object in $Objects) {$LocalFileName = $Object.Keyif ($LocalFileName -ne '' -and $Object.Size -ne 0) {$LocalFilePath = Join-Path $LocalPath $LocalFileNameCopy-S3Object -BucketName $Bucket -Key $Object.Key -LocalFile $LocalFilePath -Region us-east-1}}Download Telegraf (https://portal.influxdata.com/downloads/) for Windows then install it:wget https://dl.influxdata.com/telegraf/releases/telegraf-1.21.4_windows_amd64.zip -UseBasicParsing -OutFile telegraf-1.21.4_windows_amd64.zipExpand-Archive .\telegraf-1.21.4_windows_amd64.zip -DestinationPath 'C:\Program Files\InfluxData\telegraf'C:"Program Files"\InfluxData\telegraf\telegraf-1.21.4\telegraf.exe —service install —config C:"Program Files"\InfluxData\telegraf\telegraf-1.21.4\telegraf.confUpdate Conf file - Output plugin section under cloudwatch output plugin section andFirst: The OUTPUT PLUGIN section: Make the following changes:region = "region example: us-east-1"access_key = "yourIAMroleAccessKey"secret_key = " yourIAMroleSecretKey "Update the INPUT PLUGINS section to add the following:[[inputs.nvidia_smi]]bin_path = "C:\Program Files\NVIDIA Corporation\NVSMI\nvidia-smi.exe"Comment out # [[inputs.diskio]] (it was not commented out by default for me which caused an error)Comment out #[[inputs.processes]] (it was not commented out by default for me which caused an error)Start the service by going to ‘Services’ in Windows, finding Telegraf Service, and hitting ‘start’ or ‘restart’.Open CloudWatch Console and Look for InfluxData/Telegraf inputs.CommentShareAWS-User-0753981answered a year ago"


Question: ECC keys and IoT Greengrass V2

"Are there plans to support ECC keys in IoT Greengrass  V2   -  So that security devices like the ATECC608A/B etc can be used to secure keys for Greengrass communications between devices and AWS cloud ?I believe that Greengrass V1 did support this, but support seems to have disappeared it doesn't seem to possible with the  current V2 version.Is support for these devices dropped or is there a plan or roadmap for  support ?https://devices.amazonaws.com/detail/a3G0L00000AAOCcUAP/ATECC608a-CryptoAuthentication-Secure-ElementFollowComment"

Answer: "0Accepted AnswerResolved in this ticket after ECC key support was added to GG.CommentSharemajhanswered 4 months ago0Hi. Please see here: https://docs.aws.amazon.com/greengrass/v2/developerguide/hardware-security.htmlImportantCurrently, AWS IoT Greengrass doesn't support ECC keys. For information about keys that are supported, see the documentation for your HSM.Key word is "currently".CommentShareEXPERTGreg_Banswered a year ago"


Question: Did SQL Server Integration Services support Script Taks?

"As I could see on docs "Import Column and Export Column transformations and the Script component on the Data Flow Task aren't supported.", but Script Task is a different part of SSIS packages. Did SSIS support Script Tasks?FollowComment"

Answer: "0Unfortunately, the "Script Task" is one of the Control Flow tasks that is not included on the list of supported control flow tasks on RDS SSIS currently.Please see the list of control flow tasks that are supported on RDS SSIS .https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.Options.SSIS.html#SSIS.LimitationsAs you can see in the list , the following control flow tasks only are supported in RDS SSIS and  "ScriptTask" is NOT supported currently .Analysis Services Execute DDL TaskAnalysis Services Processing TaskBulk Insert TaskCheck Database Integrity TaskData Flow TaskData Mining Query TaskData Profiling TaskExecute Package TaskExecute SQL Server Agent Job TaskExecute SQL TaskExecute T-SQL Statement TaskNotify Operator TaskRebuild Index TaskReorganize Index TaskShrink Database TaskTransfer Database TaskTransfer Jobs TaskTransfer Logins TaskTransfer SQL Server Objects TaskUpdate Statistics TaskKindly note that RDS as a Managed Service does not provide host level access (OS level access).The script task option in control flow is not supported since SSIS package containing ScriptTask for C# and VB code to be executed, it can potentially require access to the underlying OS/host , which may break RDS as a Managed Database service overall as per the existing RDS design and architecture.The restricted access and control on the underlying OS\host is the main reason as why "Script Task" is not supported in SSIS on RDS as of now .Unfortunately there are no direct solution that exists to overcome this limitation on RDS SSIS as of now.With respect to this , I would like to keep you informed that there is already a feature request existing on this requirement of supporting SSIS Script Task in Control flow in RDS SQL Server SSIS and our Internal RDS product team is aware of this.They are currently looking into the possibility to bring this feature in to RDS SQL Server SSIS in accordance to the OS level restriction.However, I will not be able to provide an ETA on when this feature will be implemented & released , since any new feature/fix requires rigorous testing and compatibility checks by the RDS engineering team before they can be deployed globally.You can keep track of new features released on the official AWS Updates sources:[1] RDS What's New - https://aws.amazon.com/new/[2] AWS Database Blog - https://aws.amazon.com/blogs/database/[3] AWS Blog - https://aws.amazon.com/blogs/aws/Once again , I sincerely apologize on AWS behalf if the current limitation of Script Task not supported on RDS SQL Server SSIS has caused any kind of inconvenience to your requirement.CommentShareSUPPORT ENGINEERSachinanswered 9 months ago"


Question: Server Side Includes (SSI - shtml)

"I regularly publish static websites, but I do use .shtml extensions instead of .html, to take advantage of the Server-side includes (SSI) capabilities.How can SSI be enabled on AWS Amplify?To add some context; pages are pure html, css, and jquery. Locally I’m using IIS with SSI feature enabled.ThanksFollowComment"


Question: "Template format error: Unrecognized resource types: [AWS::Batch::JobQueue, AWS::Batch::ComputeEnvironment, AWS::Batch::JobDefinition]"

"I'm trying to deploy an AWS Batch service with AWS Fargate, but Cloudformation is returning the following error:Template format error: Unrecognized resource types: [AWS::Batch::JobQueue, AWS::Batch::ComputeEnvironment, AWS::Batch::JobDefinition]I'm using AWS CDK package, and the "@aws-cdk/aws-batch-alpha": "^2.75.0-alpha.0" library to do so. Docker image is created successfully, but it seems like the generated Cloudformation template is not being recognized.The region I'm trying to use is eu-south-2 (Spain), which supports AWS Batch, so I'm not sure why I'm getting this error.FollowComment"

Answer: "0Have you taken a look at this re:Post article:https://repost.aws/knowledge-center/cloudformation-template-validation? Specifically, the section: "Verify the availability of your resource type" would be important.However, this typically boils down to one of these causes:your template has a typo - this could be a spacing issue in YAML, the resource type name has a typo or one of the sub-objects/properties has an issueyour are trying to access resources not in your region (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-resource-specification.html)you are using Serverless resources in your template and the Transform declaration is missingCommentShareTigerSC95answered a month agoDiego Barreiro a month agoYeah, apparently those 3 resources are available through the Console but not in CFN. I've already raised a ticket about it: https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1600. I guess now it's just a matter of waiting till they cover those resource types in the region (as it already happened with the UAE region).Share"


Question: Unable to delete VPC

"I created a VPC from the console. While deleting it I have deleted all dependencies. But I get the following error:There was an error deleting vpc-nameValidating resources to delete...Cannot read property 'length' of undefinedPlease let me know what could be the issue here.Edited by: manideepa on Apr 6, 2021 7:22 AMFollowComment"

Answer: 0I was able to delete the VPC after several hours from the console. Not sure what was the root cause.CommentSharemanideepaanswered 2 years ago


Question: Textract API restFul ? Which Parameters ?

"Is the textract service usable via Rest API?If so what are the exact parameters to provide on the REST request?And what are the exact parameters to provide in the elaboration of the canonical request.For my part I tried the following code:request_HTTP is restRequestrequest_HTTP..URL = URLEncode("https://textract.eu-west-3.amazonaws.com")request_HTTP..Method = httpPostrequest_HTTP.ContentType = "application/x-amz-json-1.1"request_HTTP.Content = {"Document":{"Bytes":"xxxxx"}}xxxx is the binary buffer of a file = Hash(NameFile.jpg)requete_HTTP..Header["authorization"] = AWS4-HMAC-SHA256 Credential=myAWSAccessKey/20220411/eu-west-3/textract/aws4_request,SignedHeaders=content-type;host;x-amz-date,Signature=55fbb067c5ea5612146f7252b341fa22473338b6703cf1ad6703cf1request_HTTP..Header["x-amz-algorithm"] = "AWS4-HMAC-SHA256"request_HTTP..Header["x-amz-credential"] =myAWSAccessKey/20220411T093952Z/eu-west-3/textract/aws4_requestrequest_HTTP..Header["x-amz-date"] = "20220411T093952Z"requete_HTTP..Header["x-amz-target"] = "Text.AnalyzeExpense"for the canonical request allowing to create the chain to be signed the following code:POST\n/\nAction=AnalyzeExpense\ncontent-Type:application/x-amz-json-1.1; charset=utf-8\nhost:textract.amazonaws.com\nx-amz-date:20220411T122110Z\ncontent-type;host;x-amz-date\nbufHash_RequestPayloador bufHash_RequestPayload=LowerCase(Hex(Hash NameFile.jpg))=14a085e370add4de92a3509c7891c27c9373b37b5ba83c3e395a8570303658c3In the end I have the answer:"__type":"InvalidSignatureException","message":"The request signature we calculated does not match the signature you providedI certainly forgot somethingin advance thank you for your helpnb: x-amzn-RequestId: 7877cc30-b196-40dd-8e3d-ba6c9dcf6200FollowComment"

Answer: "0Hi,The easiest way to consume the APIs is through the SDKs(for instance in python : https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/textract.html)But if you need to implement the REST calls on your own, you can look at the API documentation here :https://docs.aws.amazon.com/textract/latest/dg/API_Operations.htmlHere is the reference to create the Sigv4 canonical request:https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.htmlhttps://docs.aws.amazon.com/general/latest/gr/signature-version-4.htmlCommentShareJean Malhaanswered a year ago"


Question: Failure to connect to Cloud9 instance - never get past spinning icon

"I have tried several times, always accepting all default options.As per the trouble shooting page, I enabled 3rd party cookies, etc.As an AWS user for about 15 years, I have never seen such a poorly rolled out product on AWS. If there are configuration problems, some form of warning or logging would be appreciated.Edited by: Mark L. Watson on Dec 2, 2017 6:09 AMFollowComment"

Answer: "0Hey Mark,I was having the same issue (just spinning forever on "Connecting..." and managed to resolve it. My issue was that I was trying to launch the EC2 instance in a private subnet. Once I added a route to the Internet Gateway it connected within a few seconds. So I would double-check that your instance is reachable.Hope that helps!Cheers,TimoCommentShareTimoVinkanswered 6 years ago0Thanks Timo, that did it!I deleted the first VPC I created, made a new one, and everything works :-)CommentShareMark L. Watsonanswered 6 years ago0Note: This behavior also happens when the instance is out of CPU credits and still processing.How this happened to me:I created an instance and then downloaded and started building boost (c++), since it doesn't come with, like the c9.io machines do.Boost took very, VERY long to compile, but was going, but after a while the IDE stopped responding and timed out.I went to EC2 console and noticed that the machine was down to 10% cpu usage and cpu credits were over (actually, stuck at 5 credits).The next day the machine was still like this and still wouldn't connect.No matter how many times I tried to shut it down, restart, etc... once it got into this state once, something bugged up the Cloud9 environment, I guess; because I couldn't connect back to it ever again.After 3 or 4 attempts with similar end-results (I tried different config combinations, etc... including turning on T2 unlimited); although a couple of these I did manage to connect back again (t2 unlimited); but since there were boost build errors ("fatal error out of memory" or such).So in the end I created an environment using a larger EC2 type (don't remember which, exactly, but not the default free-tier 1gb type; I think it was 1 or 2 above that, with at least 2gb ram) WITH t2 unlimited. This time it ran to success... not sure if T2 unlimited would even be required in this case, since it built MUCH faster...So, anyway, to sum up:If you wanna build boost c++; do NOT use the default free-tier instance, use a higher instance with at least 2gb and turn off the cpu credit thinggy by switching to t2 unlimited.Once boost is built, you can switch back to free-tier machine, depending on your needs, of course.CommentSharelflfmanswered 5 years ago"


Question: ec2 instance unreachable after reboot

"I rebooted my ec2 instance i-0b64fcd5175de4a40 and after the reboot, http and https are unreachable. I could get into it via ssh. I have listeners on 80 and 443New-Pom # netstat -an | grep -i listentcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTENtcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTENtcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTENtcp        0      0 0.0.0.0:465             0.0.0.0:*               LISTENtcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTENtcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTENtcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTENtcp6       0      0 :::111                  :::*                    LISTENtcp6       0      0 :::22                   :::*                    LISTENMy elastic IP is 52.24.24.107 eipalloc-38bc045dI have rules (sg-8e6eefeb) which allow the following:HTTPTCP800.0.0.0/0HTTPSTCP4430.0.0.0/0I don't have a local firewall blocking 80 and 443. I can telnet to those ports on the machine.I would really appreciate some help.FollowComment"

Answer: "0I'm running AWS Linux and I had done an upgrade. The upgrade either installed or reconfigured firewalld and that was blocking HTTP and HTTPS. In my original post, I said a firewall wasn't blocking those ports. I meant iptables - I checked and it had no rules for those ports.CommentShareJoeDoganswered 2 years ago0Let the necro commence!Basically check: https://aws.amazon.com/premiumsupport/knowledge-center/connect-http-https-ec2/I had exactly same issue and it was iptables rules after major yum update. Dropped iptables config / allowed everything on the instance, worked like a charm.CommentShareik80answered 4 months ago"


Question: CodeBuild hangs at DOWNLOAD_SOURCE phase

"I have configured two build projects which are connected to Github repositories. One of these projects builds successfully with no issues. The latter however, hangs indefinitely at the DOWNLOAD_SOURCE phase (I have set the clone depth to 1 on a specific branch). Cannot really debug this, as there are no logs or anything. What else could I try?FollowComment"


Question: Starting services on port 22 / remote port forwarding through it

"I have a large machine S that lives behind NAT and can only be accessed via VPN. As a quick access hack, I want to use an EC2 t2.micro instance to serve as a port-forwarding router node so I can use that EC2 instance's public IP and a port that I specify to connect to machine S. This port-forwarding works with high ports. However, I really want to use the default port 22 since the only purpose of this EC2 instance is to forward traffic (so it is a waste to have to specify ports every time). To do this, I changed my /etc/ssh/sshd_config to run normal ssh for the ec2 instance on port 222 instead and I changed some other settings to change the following to yes: AllowTcpForwarding, AllowStreamLocalForwarding, GatewayPorts. This appears insufficient though as I get a binding error when I try to bind to 22. Higher ports (e.g. 2222) work. However, I can't start on 22. I have a TCP rule in my security group for the EC2 instance that allows outbound/inbound traffic for all ip addresses to all ports. Why am I facing this issue? Is there a neat solution. Is there a network-specific instance that better serves this usecase. For weird reasons, I might need to do this more times.FollowComment"

Answer: "0Most likely this is an operating system problem: By default (due to historical reasons in the design of Unix (yes, Unix) many years ago): Ports below 1024 can only be used by the root user. Running processes as root isn't always a good idea but you might try that; but I'm sure there are mechanisms in whichever Linux-based operating system you're using that allow you to launch the process as root; bind the port; then change the running user to a "normal" user.CommentShareEXPERTBrettski-AWSanswered 4 months ago"


Question: Can CloudFormation add existing policy to existing role?

"With a CloudFormatin template, I am wanting to add an existing managed policy to an existing iam role?I can find details onadding new or existing policy to new iam roleadding new policy to existing iam roleadding inline policy to existing iam roleBut can't find details on adding an existing managed policy to an existing iam role.Am I missing something obvious, or is this a limitation of cloudformation?FollowComment"

Answer: "0Accepted AnswerThere is no native mechanism to take existing role and existing policy and attach one to the other in CloudFormation. Since CFT is about creating resources, you need to be creating at least one of the two resources. You've probably seen this support question  that covers the supported scenarios: How can I attach an IAM managed policy to an IAM role in AWS CloudFormation?To accomplish what you want, you can create a lambda-backed custom resource passing in the ARN for the existing policy and role name with the function calling the IAM AttachRolePolicy API to do this.Here is a working example I threw together. On stack delete, it will detach the policy that was attached. On stack update, it will detach the old policy from the old role and then attach the new policy to the new role allowing you to change the existing policy, existing role or bothAWSTemplateFormatVersion: '2010-09-09'Parameters:  ExistingPolicyArn:    Type: String    Default: arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess  ExistingRoleName:    Type: String    Default: ExistingRoleResources:  IamXtachPolicyRoleLambdaRole:    Type: AWS::IAM::Role    Properties:      AssumeRolePolicyDocument:        Statement:        - Effect: Allow          Principal:            Service: lambda.amazonaws.com          Action: sts:AssumeRole          Condition: {}      Path: /      ManagedPolicyArns:        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole      Policies:        - PolicyDocument:            Statement:              - Action:                  - iam:DetachRolePolicy                  - iam:AttachRolePolicy                Effect: Allow                Resource:                  - !Sub "arn:aws:iam::${AWS::AccountId}:role/*"            Version: 2012-10-17          PolicyName: aws-app-iam-xtach-policy  IamXtachPolicyRoleLambda:    DependsOn: IamXtachPolicyRoleLambdaRole    Type: AWS::Lambda::Function    Properties:      Handler: index.lambda_handler      Timeout: 30      Role: !GetAtt IamXtachPolicyRoleLambdaRole.Arn      Runtime: python3.8      Code:        ZipFile: |          import logging          import boto3          import cfnresponse          logger = logging.getLogger()          logger.setLevel(logging.INFO)          def lambda_handler(event, context):                        def attach_policy(policyArn, roleName):              return iam.attach_role_policy(                PolicyArn=policyArn,                RoleName=roleName,              )                         def detach_policy(policyArn, roleName):              return iam.detach_role_policy(                PolicyArn=policyArn,                RoleName=roleName,              )             try:              iam = boto3.client('iam')                          existingPolicyArn = event['ResourceProperties'].get('ExistingPolicyArn')              existingRoleName = event['ResourceProperties'].get('ExistingRoleName')                          if event['RequestType'] == 'Create':                response = attach_policy(existingPolicyArn, existingRoleName)              elif event['RequestType'] == 'Delete':                response = detach_policy(existingPolicyArn, existingRoleName)              elif event['RequestType'] == 'Update':                oldExistingPolicyArn = event['OldResourceProperties'].get('ExistingPolicyArn')                oldExistingRoleName = event['OldResourceProperties'].get('ExistingRoleName')                response = detach_policy(oldExistingPolicyArn, oldExistingRoleName)                response = attach_policy(existingPolicyArn, existingRoleName)              result = cfnresponse.SUCCESS                          except Exception as error:              logger.exception(error)              response = {                'status': 500,                'error': {                  'type': type(error).__name__,                  'description': str(error),                },              }              result = cfnresponse.FAILED             finally:              cfnresponse.send(event, context, result, response, {})              return   AttachExistingPolicyToExistingRole:    DependsOn: IamXtachPolicyRoleLambda    Type: Custom::IamXtachPolicyRoleLambda    Properties:      ServiceToken: !GetAtt IamXtachPolicyRoleLambda.Arn      ExistingPolicyArn: !Ref ExistingPolicyArn      ExistingRoleName: !Ref ExistingRoleNameCommentShareScott_Kanswered 2 years ago"


Question: How to get network bandwidth used to 100% and NOT throttled by DMS

"Hi, some insights will be appreciated, pleaseBased on this DOCUMENTED   DMS restrictionhttps://repost.aws/knowledge-center/dms-high-source-latency"The network speed between the source database and the AWS DMS replication instance is slow. By design, a single AWS DMS task can't use the full network bandwidth"How do we bypass it?We would rather want to have network bandwidth used to 100% and NOT throttled by DMSi.e. in customer control and not in DMS controlIs there a hidden flag to bypass this etc.?ThanksSeanFollowComment"


Question: Is there a way to edit AWS ECR image tags or otherwise manage them?

"I want to set tags in case I use an older version of the AWS ECR image.If you push with the same tag, it becomes <untagged>.So I searched and there was a method of retagging in the docs, but it was a method of attaching multiple tags. https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-retag.htmlIs there a way to directly edit or is there another tag management method?FollowComment"

Answer: "1Accepted AnswerGenerally I would suggest you to configure your repository to be immutable to prevent image tags from being overwritten if you need to use older version of image.Immutable tags gives you a way to easily and uniquely identify an image.In your case, if your image tagged like v1.0.1, v1.0.2, v1.0.3 etc.. You can use the old version tag directly for rollback (v1.0.1). This blog by Marius discussed best practice about how we should tag the image.You can edit ECR Image tag mutability here:https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-tag-mutability.htmlCommentShareAlickanswered 5 months ago"


Question: Documentation for update Iam actions of ModifyBilling

"Hello,Aws is replacing iam actions for  "aws-portal:ModifyBilling".Can someone guide me please with documenation or new iam actions to update instead of  "aws-portal:ModifyBilling".ThanksFollowComment"

Answer: "0Thanks for your response.Much appreciated. I have gone through it. It does have some examples but not what i am looking for ModifyBilling.CommentSharerePost-User-4515363answered 2 months agoalatech EXPERT2 months agoBut under Updates to Existing Managed Policies there is an example about aws-portal:ViewBilling. Could not that be applied to the one you are looking for?Share0Hi,this link reportes several examples, references and steps on how to move from retiring permissions: https://aws.amazon.com/blogs/aws-cloud-financial-management/changes-to-aws-billing-cost-management-and-account-consoles-permissions/.Hope it helps and if does I d appreciate answer to be accepted so that community benefits for clarity, thanks ;)CommentShareEXPERTalatechanswered 2 months ago"


Question: SQSD continuously crashing and restarting on Elastic Beanstalk Worker boxes

"In my Elastic Beanstalk Worker Environment, sqsd keeps crashing and restarting. We are running a NodeJS app on "Node.js 16 running on 64bit Amazon Linux 2/5.5.3". The app has been working fine up until today. Due to an issue on one box I had to reboot it and when it came back up it just keeps restarting my app and never actually successfully starts up the worker. I found this in /var/log/messages pointing to sqsd crashing. Any ideas how I can fix this? I have tried terminating the instance but that didn't fix it. It's a t2.large so it should have enough memoryJun 23 19:12:35 ip-10-1-100-88 systemd: Stopped This is sqsd daemon.Jun 23 19:12:35 ip-10-1-100-88 systemd: Starting This is sqsd daemon...Jun 23 19:12:36 ip-10-1-100-88 sqsd: Version 2 of the Ruby SDK will enter maintenance mode as of November 20, 2020. To continue receiving service updates and new features, please upgrade to Version 3. More information can be found here: https://aws.amazon.com/blogs/developer/deprecation-schedule-for-aws-sdk-for-ruby-v2/Jun 23 19:12:38 ip-10-1-100-88 systemd: Reloading.Jun 23 19:12:41 ip-10-1-100-88 sqsd: /opt/elasticbeanstalk/lib/ruby/lib/ruby/gems/2.6.0/gems/aws-sqsd-3.0.4/bin/aws-sqsd:58:in `initialize': No such file or directory @ rb_sysopen - /var/run/aws-sqsd/default.pid (Errno::ENOENT)Jun 23 19:12:41 ip-10-1-100-88 sqsd: from /opt/elasticbeanstalk/lib/ruby/lib/ruby/gems/2.6.0/gems/aws-sqsd-3.0.4/bin/aws-sqsd:58:in `open'Jun 23 19:12:41 ip-10-1-100-88 sqsd: from /opt/elasticbeanstalk/lib/ruby/lib/ruby/gems/2.6.0/gems/aws-sqsd-3.0.4/bin/aws-sqsd:58:in `start'Jun 23 19:12:41 ip-10-1-100-88 sqsd: from /opt/elasticbeanstalk/lib/ruby/lib/ruby/gems/2.6.0/gems/aws-sqsd-3.0.4/bin/aws-sqsd:83:in `launch'Jun 23 19:12:41 ip-10-1-100-88 sqsd: from /opt/elasticbeanstalk/lib/ruby/lib/ruby/gems/2.6.0/gems/aws-sqsd-3.0.4/bin/aws-sqsd:111:in `<top (required)>'Jun 23 19:12:41 ip-10-1-100-88 sqsd: from /opt/elasticbeanstalk/lib/ruby/bin/aws-sqsd:23:in `load'Jun 23 19:12:41 ip-10-1-100-88 sqsd: from /opt/elasticbeanstalk/lib/ruby/bin/aws-sqsd:23:in `<main>'Jun 23 19:12:42 ip-10-1-100-88 systemd: sqsd.service: control process exited, code=exited status=1Jun 23 19:12:42 ip-10-1-100-88 systemd: Failed to start This is sqsd daemon.Jun 23 19:12:42 ip-10-1-100-88 systemd: Unit sqsd.service entered failed state.Jun 23 19:12:42 ip-10-1-100-88 systemd: sqsd.service failed.Jun 23 19:12:42 ip-10-1-100-88 systemd: sqsd.service holdoff time over, scheduling restart.FollowComment"


Question: How to add custom route via EC2?

"I need to route certain traffic via site-to-site VPN. This trivial thing doesn't work for me in AWS, while works fine in my test on-prem environment.For instance:I need to route traffic to 111.111.111.111/32 via 10.10.10.11I tried both adding this route to 10.10.10.10, and adding it into the VPC routing table - no results. I.e. I. don't see packets to 111.111.111.111 coming to 10.10.10.11. (I checked both using network sniffer on 10.10.10.11 and using AWS Flow logs).Any ideas?TIA,VitalyFollowComment"

Answer: "1You should do this by routing to an AWS object that has the IP...  i.e. the eni-XXXX that has the 10.10.10.11 IP assigned to it.AWS route tables need to point objects like ENIs, TGWs, PCXs and not IP addresses.CommentShareIsaac Behrensanswered a year agovitaly_il a year agoThank you - I used ENI into VPC routing table. In fact, I  found the issue - it was the default "Source/dest. check" == True in the ENI of my VPN box.Share1I  found the issue - it was the default "Source/dest. check" == True in the ENI of my VPN box.CommentSharevitaly_ilanswered a year ago"


Question: Restoring RDS Snapshot with CloudFormation

"I am trying to recreate an RDS Aurora database from a snapshot using CloudFormation and I am running into a problem. During the stack creation, I am getting this error 'Only DB Snapshot Identifiers can be used with the filter DB_SNAPSHOT_ID'Here is a snippet of my CF template:Parameters:  DBSnapshot:      Type : "String"     Default: "arn:aws:rds:us-west-2:893352710245:cluster-snapshot:snapshot"Resources:  RDSDatabase:     Type: "AWS::RDS::DBInstance"     Properties:       DBInstanceClass: 'db.t2.micro'       DBSnapshotIdentifier: !Ref DBSnapshotFollowComment"

Answer: 0Accepted AnswerThink I found the issue:  DBSnapshot:     Type : "String"     Default: "arn:aws:rds:eu-west-1:300688157164:cluster-snapshot:snapshot"Resources:  MyDB:    Type: "AWS::RDS::DBCluster"    Properties:      SnapshotIdentifier: !Ref DBSnapshot      Engine: "aurora"You are restoring a cluster so need to use AWS::RDS::DBCluster and SnapshotIdentifier and not the AWS::RDS::DBInstance.CommentShareHerbert-John Kellyanswered 6 years ago


Question: Apigateway + VTL

"hello,I have an ec2 with apache and two visible headers, above is a NLB with the target group to port 80 and then I have an apigateway configured with VPC Link pointing to the NLB.What I want is how do I configure the VTL so that when I do a GET query to the API it returns only the two headers created from the apache.FollowComment"

Answer: "0From your query, I understand that you want to access the headers returned from the backend integration (NLB having EC2 in the Target group) using a mapping template(VTL). Aditionally, the EC2 instance is having an Apache server installed on it. There are two ways to integrate the backend with API Gateway: Proxy Integration, Non-Proxy Integration.Case1 : Proxy IntegrationIf, the API Gateway (REST) is using a Proxy Integration to integrate with NLB, the headers cannot be modified using mapping templates (VTL). This is because when Proxy Integration is used, the output returned from the backend cannot be modified in the integration response (using the mapping template) and the response is returned as-is from the backend.Case2 : Non-Proxy IntegrationUsing, Non-Proxy Integration with NLB, there are two ways in which Headers can be returned from the Backend.If the headers from the backend are present in Response Headers field when the API Gateway is tested out from the console, it is not possible to access headers/query strings/status codes etc. returned from the backend in the Response Body Mapping templates using VTL, and you can only access the Response Body from the backend in the templates.The only workaround currently is to send the required headers/status codes to the response body and access it in the mapping template after that or use the header mapping section in integration response. Further, you can refer this document for using header mapping section in Integration response[1].That being said, there is an existing feature request for accessing headers/query strings/status codes present in the Response Headers field. I went ahead and added your voice to this feature request by doing a +1 on the feature request. Meanwhile, I request you to keep an eye on our What's New[2] and Blog pages[3] for any new feature announcements.References:[1] https://docs.aws.amazon.com/apigateway/latest/developerguide/request-response-data-mappings.html#mapping-response-parameters[2] https://aws.amazon.com/new/[3] https://aws.amazon.com/blogs/aws/CommentShareSameera_Kanswered 8 months ago"


Question: Permission help requested

"I am trying to lock down some buckets and running into a problem.  I don't know if at one time people changed things, but some files are coming up denied, others show fine.  Basically I want the whole bucket locked down with the exception of one file, and one IAM user that can upload, change, etc.   So here is the only policy the bucket has;{"Version": "2019-05-05","Id": "Policy1557155133616","Statement": [{"Sid": "Stmt1557154959314","Effect": "Allow","Principal": {"AWS": "arn:aws:iam::account#:user/myuser"},"Action": "s3:","Resource": "arn:aws:s3:::bucket/"},{"Sid": "Stmt1557155073989","Effect": "Allow","Principal": "*","Action": "s3:GetObject","Resource": "arn:aws:s3:::bucket/folder/file.js"}]}Now that above to me says give myuser full access, everyone else has nothing except that one file.js .   The problem is there are other files in that bucket, I can click and it shows them fine.  When I look at a file, the permissions, there is nothing explicit so I am now lost!I have transmit (running on a mac) and if I manually set none to read/write it says access denied.Basically I want to reset the permissions on ALL files to no access, just one readable.  I don't see any simple GUI way or even a CLI way to say reset all permissions on all the files to nothing, then via the bucket policy explicitly set that one file.Any help is appreciated.FollowComment"

Answer: "0Accepted AnswerHelloHow are you logged in going to S3? and how are you accessing test2 when you get access denied?if you are logged in AWS and clicking on the URL for test2 and you get an access denied it is because the file is not public. The url for test2 does not have a way to authenticate/authorize who you are, it is just a url.  If you click on the download file, it should work because it has the security token associate it with it.hope this helpsRTCommentSharerttanswered 4 years ago0HelloA few things:When you create a bucket policy, the individual files will inherit the policy.the current policy is not "explicitly denying" any access, so if people have IAM (user, group, role) permissions to access the objects in that bucket, they will get those objects.if you want to make sure that only few people can access objects in that bucket, you will have to create a policy that includes a DENY for NotPrincipal which means deny for everyone except this userhttps://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notprincipal.htmland if you want to deny access to all objects except for one, you could add also a DENY wtih a not resource which means deny for all objects except this onehttps://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notresource.htmlthese two links may come handy tooIAM policy simulator to test your policieshttps://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.htmlbecome a policy ninjahttps://www.slideshare.net/AmazonWebServices/become-an-iam-policy-ninjahope this helpsRTCommentSharerttanswered 4 years ago0Thanks, I am trying to logically go through this in my head, as if this was linux I would just say hey chmod 600 *, then allow read to that one file and be done.So logically I am trying to say;User: me (allow all)everyone else deny all except file.html which should be allowed read by world.According to the NotPrincipal with Allow it states "We strongly recommend that you do not use NotPrincipal in the same policy statement as "Effect": "Allow"."    So, what is the best method to say deny all unless it's this file AND allow all to this user (even in laymen's terms).ThanksCommentSharexlancealotxanswered 4 years ago0Here is the most basic issue that I am using to try to get that understood, I have a test bucket, 2 text files and here is what I have;{"Version": "2012-10-17","Id": "Policy1556908483700","Statement": [{"Sid": "Stmt1556908464159","Effect": "Allow","Principal": {"AWS": "arn:aws:iam::11111111111:user/lance"},"Action": "s3:GetObject","Resource": "arn:aws:s3:::zzztest/test2.txt"},{"Sid": "Stmt1556908464159","Effect": "Allow","Principal": "*","Action": "s3:GetObject","Resource": "arn:aws:s3:::zzztest/test1.txt"}]}To me the above says, the world can see test1.txt and only my user can see test2.txt.    Well I save that, and I can see 1 just fine, 2 I get an error from the public side.  But logged in, going to S3 (or the URL), I can click the bucket, I can see the 2 files, but test2 says access denied.  So, before I start getting really teCommentSharexlancealotxanswered 4 years ago"