Question: The HTTP API associated with the custom domain name cannot be invoked via fetch.

"The HTTP API associated with Lambda was successfully connected to Custom domain. So I connected to the xxx.mydomain.com/vi/direct path.It was then called normally when opened in Chrome tab.However, the error "Failed to load resource: {myApiUrl} net::ERR_NAME_NOT_RESOLVED" occurs when trying to invoke via fetch in the React project. What else do you need?const callDirectUrlAPI = async() => {    const header = new Headers();    try {        const result = await fetch("api.****.com/vi/test/direct",{            method : "GET",        })        console.log(await result.text())    } catch (error) {        console.log(error)         }}The above code is the function I used to call the API.FollowComment"

Answer: "0Maybe you need to specify https:// in front of the domain?CommentShareEXPERTUrianswered 7 months agoSangHyun 7 months agoYes, I replaced it with another letter to prevent API abuse.Share"


Question: Connect Ubuntu Lightsail instance to PPTP VPN freezes/crashes instance

"Hi all,I've got an ubuntu linux VPS through AWS that I'm trying to connect to a company's VPN via PPTP. My authentication is successful , and the admin of the VPN confirms that I am connected, however I have found the my server then keeps freezing up, and I need to force a reboot via AWS UI.Running sudo pon PPTP debug dump logfd 2 nodetach gives me the below logs... sometimes (I've added the logs as a pastebin as I couldn't figure out how to format the text with re:Post to make it legible)https://pastebin.com/u4TCgWs8Occasionally it will get that far after I try terminate the connection early, but sometimes it will just hang around after sending [IPCP ConfAck id=0x7 <addr 192.168.121.103>], and then will freeze and I need to reboot.I've seen a few resources online suggesting reducing the MTU, which I'm not sure how to set, as the command for it is apparently sudo ifconfig ppp0 mtu 1300 as an example, but when I do sudo ifconfig ppp0  I get ppp0: error fetching interface information: Device not found.Is anyone able to shed some light on this?FollowComment"

Answer: "0Hello,Thank you for using Lightsail.Check the instance burst capacity metrics on your instance management page to see if you're exceeding your allocation https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-viewing-instance-burst-capacityUpgrading your instance bundle can alleviate problems related to high CPU usage.Regards,GabrielCommentShareGabriel - AWSanswered a year agoAWS-User-5851356 a year agoHi Gabriel,Thanks for your answer, I have replicated the issue and then looked at the metrics but this is not the root cause, usage did not leave the sustainable zone.Thanks,DinoShare0Hello Dino,Thank you for reaching out to us and asking your question in Re:Post. Reading your original post, it seems that after a successful connection to a company's VPN using PPTP protocol, the Ubuntu Lightsail instances becomes unresponsive. There could be several reasons for which you are experiencing this, however the first suspicion is modification of existing kernel route tables which can make the Lightsail instance unresponsive over SSH immediately after VPN connection is successful. A snippet from the pasted logs indicate:replacing old default route to eth0 [172.26.0.1]<----truncated----->restoring old default route to eth0 [172.26.0.1]If this route is not persistent, the issue will resolve after every reboot (and there will be no VPN connection, unless reconnected manually). I will recommend to use a temporary EC2 instance for this use-case so that when the instance becomes unresponsive, you can troubleshoot using Serial Console (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-serial-console.html). Please note only certain instance types and regions support it. From the console, you can login using a local user and check if the primary route has changed.Another approach could be to check if the company's VPN setup recommends to use PPTP protocol. If yes, if there are any specific guidelines for Ubuntu.Regarding the error ppp0: error fetching interface information: Device not found.: If the ifconfig command was ran before an established VPN connection, the device ppp0 was probably not yet available.On a different note, you can add logs in Re:Post using code block to maintain the format.CommentShareSUPPORT ENGINEERAWS-User-8128162answered a year ago"


Question: Systems Manager "advanced instances" stuck in pending state

"I wanted to try out the "advanced instances" feature in Systems Manager, which is now a toggle on at the account level. That worked just fine, but there is nowhere in the console to toggle it off.https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-managedinstances-advanced.htmlI tried via clia with this command: aws ssm update-service-setting --setting-id arn:aws:ssm:us-east-2:XXXXXXXXXXX:servicesetting/ssm/managed-instance/activation-tier --setting-value standardBut, now if I get status it's stuck in a pending state for more then 24hours at this point. Here is the output. Does anyone know how to get it back to standard for the account?{"ServiceSetting": {"SettingId": "/ssm/managed-instance/activation-tier","SettingValue": "advanced","LastModifiedDate": 1552956830.414,"LastModifiedUser": "arn:aws:iam::XXXXXXXXXXX:user/redacted@email.com","ARN": "arn:aws:ssm:us-east-2:XXXXXXXXXXX:servicesetting/ssm/managed-instance/activation-tier","Status": "PendingUpdate"}}Edited by: kleinberger on Mar 19, 2019 11:56 AMFollowComment"

Answer: "0Please contact AWS Support if you want to change back to the standard-instances tier.Thank youVarshaCommentShareVarsha-AWSanswered 4 years ago0Thanks, hopefully this request doesn't require a formal support contract.Case ID 5896814371CommentSharekleinbergeranswered 4 years ago0This ended up needing support to do something on the backend to revert back to "Standard" Systems Manager for the Account. The cli input that I tried was stuck in a pending state for days until the support group made their change. They refunded the incurred charges, but hopefully this helps someone else avoid.CommentSharekleinbergeranswered 4 years ago"


Question: AWS Cloud HSM: Client SDK 5: Isn't SDK 5 supports RSA Wrap and Unwrap?

"Hello community,I am looking for Cloud HSM JCE based HSM connection. One of my requirements is to generate Plain AES key and Wrap it with RSA key. This is to implement something similar to what is called "Envelope Encryption" - https://www.google.com/search?q=envelope+encryption&rlz=1C5GCEM_enUS984US984&oq=envelope+en&aqs=chrome.2.69i57j35i39j0i512j0i20i263i512j0i512l3j69i60.21307j0j4&sourceid=chrome&ie=UTF-8.What I am founding is that RSA wrap Unwrap code samples presents in SDK 3 code - https://github.com/aws-samples/aws-cloudhsm-jce-examples/blob/master/src/main/java/com/amazonaws/cloudhsm/examples/RSAWrappingRunner.java. HOWEVER THIS IS NOT PRESENT IN SDK 5 code.Does that mean SDK 5 does not support AES RSA WRAP UNWRAP. I have tried running this with SDK 5 and getting "UNSUPPORTED OPERATION EXCEPTION" which strengthen my doubt. PLEASE CONFIRM.If this is true, then when it be supported? I want to use latest SDK provided that it can have more fixes on top of what SDK 3 already has.FollowComment"


Question: AWS Workspaces access Log

"I want to know the last instance usage time of the aws workspace user as a whole.Please let me know if there is a way to check.FollowCommentStevieStets EXPERT23 days agoYes, check the CloudWatch Metric for UserConnected - https://docs.aws.amazon.com/workspaces/latest/adminguide/cloudwatch-metrics.htmlShare"

Answer: "0Is there any way to check on aws cloudwatch?I wonder how I can do it for free rather than using a separate service.CommentSharerePost-User-4950841answered 24 days ago0There are a few ways to do this. The most detailed way is with cloudwatch metrics (https://docs.aws.amazon.com/workspaces/latest/adminguide/cloudwatch-metrics.html). The UserConnected metric will show you exactly when the workspace is in use so long as the user is connecting using the workspaces client. Alternatively, if you just need to perform a quick spot check, you can go to the workspaces console and look at "User Last Active" for the specific workspace. It provides less detail and, in my experience, is slightly less reliable. Still it gets the job done. Finally, if this is something you'll do regularly, you can deploy the Workspaces cost optimizer (https://aws.amazon.com/solutions/implementations/cost-optimizer-for-amazon-workspaces/). it can generate daily usage reports for every workspace across all of your accounts/regions and dump them into S3 for you.CommentShareihaznonaymeanswered 23 days ago-3You can use the Amazon WorkSpaces Application Manager (WAM) usage reports to see the last time that a user launched an application from their WorkSpace. These reports provide information on application usage, including the number of times an application was launched and the last launch time for each user. Here is a link to AWS official documentation -> https://docs.aws.amazon.com/wam/latest/adminguide/what_is.htmlCommentShareStefanoBanswered 24 days agoihaznonayme 23 days agoThis is a terrible answer. WAM has been deprecated and adds cost and complexity that are not necessary to get this information.Share-3You can use Amazon CloudWatch to track the last time that a user accessed their Amazon WorkSpaces. However, please note that this will require you to enable logging for WorkSpaces. Once logging has started, you can view the logs in the CloudWatch console. You can use CloudWatch Logs Insights to query the logs and find the last user access time.CommentShareStefanoBanswered 24 days agoihaznonayme 23 days agoThis is incorrect. Cloudwatch metrics are captured for all workspaces at all times. There is no need for logs.Share"


Question: "ENI Trunking, IPv6 and TCP"

"I would like to report an issue with IPv6 connectivity in ECS containers running in awsvpc mode. After enabling IPv6 for our VPC and deploying IPv6 networking for our ECS workloads, we noticed that IPv6 downloads from the internet were extremely slow, with speeds less than 20 KB/s.We conducted several tests and made the following observations:Confirmed that all containers/instances had all traffic outbound rule to ::/0. There's no network ACLs.Latency and packet loss were normal, ruling out routing or MTU issues.We could reproduce the issue on different container images and different AMIs.I was able to achieve normal IPv6 TCP performance on an EC2 instance running the same AL2023 AMI, so the issue is isolated to containers running in awsvpc mode (there's no IPv6 support for bridge mode anyway).I tested iperf3 in UDP with a target bandwidth of 10 Gbps, the actual received throughput can reach >2 Gbps. This indicates that the issue is specific to TCP.Testing with different TCP congestion algorithms did not yield any significant difference in performance.Finally, we added an inbound rule for TCP 32768-65535, which immediately restored IPv6 performance to expected levels.Based on our observations, we suspect that the issue may be related to the EC2 security groups behaving as a “stateless firewall” rather than stateful for IPv6 TCP connections in containers with branch ENIs. This may indicate an issue with the connection tracking.Any tips on the above will be helpful. Thank you.Attached three iperf3 logs with identical configuration, except the first one is TCP without any inbound rules, second one is with the IPv6 TCP 32768-65535 inbound rule (which should not be needed for a stateful firewall) and the third one is in UDP mode without any inbound rules.Iperf3 log without inbound rule.# iperf3 -c 2001:df0:xxxx:xxxx:a5c2:75ae:7cee:bde8Connecting to host 2001:df0:xxxx:xxxx:a5c2:75ae:7cee:bde8, port 5201[  5] local 2001:df0:xxxx:xxxx:5112:37d6:1129:2639 port 45036 connected to 2001:df0:xxxx:xxxx:a5c2:75ae:7cee:bde8 port 5201[ ID] Interval           Transfer     Bitrate         Retr  Cwnd[  5]   0.00-1.00   sec   323 KBytes  2.64 Mbits/sec    2   8.72 KBytes[  5]   1.00-2.00   sec  0.00 Bytes  0.00 bits/sec    1   8.72 KBytes[  5]   2.00-3.00   sec  0.00 Bytes  0.00 bits/sec    0   8.72 KBytes[  5]   3.00-4.00   sec  0.00 Bytes  0.00 bits/sec    1   8.72 KBytes[  5]   4.00-5.00   sec  0.00 Bytes  0.00 bits/sec    0   8.72 KBytes[  5]   5.00-6.00   sec  0.00 Bytes  0.00 bits/sec    0   8.72 KBytes[  5]   6.00-7.00   sec  0.00 Bytes  0.00 bits/sec    1   8.72 KBytes[  5]   7.00-8.00   sec  0.00 Bytes  0.00 bits/sec    0   8.72 KBytes[  5]   8.00-9.00   sec  0.00 Bytes  0.00 bits/sec    0   8.72 KBytes[  5]   9.00-10.00  sec  0.00 Bytes  0.00 bits/sec    0   8.72 KBytes- - - - - - - - - - - - - - - - - - - - - - - - -[ ID] Interval           Transfer     Bitrate         Retr[  5]   0.00-10.00  sec   323 KBytes   265 Kbits/sec    5             sender[  5]   0.00-10.04  sec  71.7 KBytes  58.5 Kbits/sec                  receiveriperf Done.Iperf3 log with IPv6 TCP 32768-65535 inbound rule.# iperf3 -c 2001:df0:xxxx:xxxx:a5c2:75ae:7cee:bde8Connecting to host 2001:df0:xxxx:xxxx:a5c2:75ae:7cee:bde8, port 5201[  5] local 2001:df0:xxxx:xxxx:5112:37d6:1129:2639 port 40924 connected to 2001:df0:xxxx:xxxx:a5c2:75ae:7cee:bde8 port 5201[ ID] Interval           Transfer     Bitrate         Retr  Cwnd[  5]   0.00-1.00   sec   454 MBytes  3.81 Gbits/sec  233    968 KBytes[  5]   1.00-2.00   sec   456 MBytes  3.83 Gbits/sec  224   1003 KBytes[  5]   2.00-3.00   sec   471 MBytes  3.95 Gbits/sec  241    916 KBytes[  5]   3.00-4.00   sec   452 MBytes  3.80 Gbits/sec  221    846 KBytes[  5]   4.00-5.00   sec   452 MBytes  3.80 Gbits/sec  214    881 KBytes[  5]   5.00-6.00   sec   450 MBytes  3.77 Gbits/sec  229   1.04 MBytes[  5]   6.00-7.00   sec   456 MBytes  3.83 Gbits/sec  214   1.06 MBytes[  5]   7.00-8.00   sec   471 MBytes  3.95 Gbits/sec  262    907 KBytes[  5]   8.00-9.00   sec   458 MBytes  3.84 Gbits/sec  243    907 KBytes[  5]   9.00-10.00  sec   460 MBytes  3.86 Gbits/sec  248    767 KBytes- - - - - - - - - - - - - - - - - - - - - - - - -[ ID] Interval           Transfer     Bitrate         Retr[  5]   0.00-10.00  sec  4.47 GBytes  3.84 Gbits/sec  2329             sender[  5]   0.00-10.05  sec  4.47 GBytes  3.82 Gbits/sec                  receiveriperf Done.Iperf3 log in UDP mode without inbound rules.# iperf3 -c  2001:df0:xxxx:xxxx:a5c2:75ae:7cee:bde8 -u -b 10GConnecting to host 2001:df0:xxxx:xxxx:a5c2:75ae:7cee:bde8, port 5201[  5] local 2001:df0:xxxx:xxxx:4a8b:445:8410:65ae port 52683 connected to 2001:df0:xxxx:xxxx:a5c2:75ae:7cee:bde8 port 5201[ ID] Interval           Transfer     Bitrate         Total Datagrams[  5]   0.00-1.00   sec   592 MBytes  4.97 Gbits/sec  69541[  5]   1.00-2.00   sec   592 MBytes  4.96 Gbits/sec  69498[  5]   2.00-3.00   sec   592 MBytes  4.96 Gbits/sec  69499[  5]   3.00-4.00   sec   591 MBytes  4.96 Gbits/sec  69436[  5]   4.00-5.00   sec   592 MBytes  4.96 Gbits/sec  69499[  5]   5.00-6.00   sec   592 MBytes  4.96 Gbits/sec  69499[  5]   6.00-7.00   sec   592 MBytes  4.96 Gbits/sec  69498[  5]   7.00-8.00   sec   586 MBytes  4.92 Gbits/sec  68844[  5]   8.00-9.00   sec   591 MBytes  4.96 Gbits/sec  69373[  5]   9.00-10.00  sec   592 MBytes  4.96 Gbits/sec  69499- - - - - - - - - - - - - - - - - - - - - - - - -[ ID] Interval           Transfer     Bitrate         Jitter    Lost/Total Datagrams[  5]   0.00-10.00  sec  5.77 GBytes  4.96 Gbits/sec  0.000 ms  0/694186 (0%)  sender[  5]   0.00-10.04  sec  2.46 GBytes  2.11 Gbits/sec  0.019 ms  397982/694027 (57%)  receiveriperf Done.FollowComment"


Question: external platforms

"Is there a third party assistant in Amazon that works in raising the evaluation of products for merchants, if it is true, how can this be trusted?FollowComment"

Answer: "1Accepted AnswerFeedback Express: This service helps Amazon sellers manage their feedback, reviews, and ratings. It provides automated emails to buyers asking them to leave reviews and ratings, but always in a compliant manner.FeedbackWhiz: This platform offers similar features to Feedback Express, but also includes order management, product review tracking, and analytics.Helium 10: This is a comprehensive suite of tools for Amazon sellers that includes review management, keyword research, listing optimization, and more.Jungle Scout: Another full-featured platform for Amazon sellers that includes a product review request system, among other features.CommentShareEXPERTsedat_salmananswered 14 days agoHamoda 14 days agoHow can I know how true this platform is, whether it is legal or not, I don't want to be cheatedShare"


Question: When will we have PR preview feature for aws code commit ?

We are using code commit for our webapp development. When will we have PR preview feature for code commit ?We are using code commit for our webapp development. When will we have PR preview feature for code commit ?FollowComment


Question: Mobile Number Porting for Amazon Connect

"Hi,We have a customer query from Australia. Below are the points which we need to clear:Customer has 50 Australian mobile numbers they want to port those numbers to Amazon Connect.Can we use the same numbers for voice and SMS?Regards,IbrahimFollowComment"

Answer: "0Hello Ibrahim,Yes, all the 50 numbers can be ported to any Amazon Connect instances in ap-southeast-1, ap-southeast-2, ap-northeast-1 and ap-northeast-2. You will need to produce the following documents over a support case to proceed with this request:Last invoiceLetter of Authorization (LOA)Documents required for the Type of Number, as listed in the previous table for ordering phone numbersYou can read more about it here.No, we do not have the provision to use the same number for both voice (on Connect) and SMS.CommentShareSUPPORT ENGINEERRajil_Panswered 7 months agoEXPERTAWS-samfredreviewed 2 months ago"


Question: s3 lifecycle transition costs

"A customer is planning a large archive from Standard to Glacier and wants to use a lifecycle policy to complete that.Example: If I have 1,000,000 files in an s3 bucket with standard storage, and apply a lifecycle rule on the bucket so that all of the files transition to S3 Glacier storage...Do I get charged a one-time "Lifecycle transitions cost" based on 1,000,000 requests (since there are 1,000,000 objects)?And if so, based on the cost of $0.00005 per glacier lifecycle transition request ($0.05 per 1,000) we would have a one-time charge of ($0.00005 * 1,000,000) $50.00 ?FollowComment"

Answer: "0Accepted AnswerYes. Your calculations are correct. The requests are counted on per object basis. However, do not forget to consider the overhead.https://docs.aws.amazon.com/AmazonS3/latest/dev/lifecycle-transition-general-considerations.htmlS3 Glacier and S3 Glacier Deep Archive transition request charges— Each object that you transition to the S3 Glacier or S3 Glacier Deep Archive storage class constitutes one transition request. There is a cost for each such request. If you plan to transition a large number of objects, consider the request costs. If you are archiving small objects, consider aggregating many small objects into a smaller number of large objects to reduce transition request costs.Storage overhead charges – When you transition objects to the S3 Glacier or S3 Glacier Deep Archive storage class, a fixed amount of storage is added to each object to accommodate metadata for managing the object.For each object archived to S3 Glacier or S3 Glacier Deep Archive, Amazon S3 uses 8 KB of storage for the name of the object and other metadata. Amazon S3 stores this metadata so that you can get a real-time list of your archived objects by using the Amazon S3 API. For more information, see Get Bucket (List Objects). You are charged Amazon S3 Standard rates for this additional storage.For each object that is archived to S3 Glacier or S3 Glacier Deep Archive, Amazon S3 adds 32 KB of storage for index and related metadata. This extra data is necessary to identify and restore your object. You are charged S3 Glacier or S3 Glacier Deep Archive rates for this additional storage.CommentShareSunil_Yanswered 3 years ago"


Question: ACM certificate DNS validation - guidance

"HelloI have created a certificate for a domain registered under GoDaddy.comThrough https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html I am following process.To verify that I own the domain, I need to update DNS records in GoDaddy.com?Or is it "CNAME record" field for DNS ZonePlease clarifyFollowComment"

Answer: "0Accepted AnswerHello Harsha,Yes! we need to add the CNAME DNS record which is populated post creating the ACM certificate. Once this CNAME is added at the domain Hosted Zone, ACM will validate the same.ex.,Domain Name Record Name                                                                     Record Type         Record Valueexample.com _a79865eb4cd1a6ab990a45779b4e0b96.example.com. CNAME      _424c7224e9b0146f9a8808af955727d0.acm-validations.aws.Considering the above example, you need to add the record as below (Note to remove the tail domain name while adding, else it will add as double)_a79865eb4cd1a6ab990a45779b4e0b96.example.comand in the value_424c7224e9b0146f9a8808af955727d0.acm-validations.aws.Regards,CKCommentShareChethan SEanswered 10 months agoHarshaVardhanaR 10 months agoThanks ChethanI have noted the detailsThat means these values need to be populated in GoDaddy.com not on DNS Zone on Lightsail.also in certificate I have created 2 entries. abc.com and www.abc.comSo on GoDaddy , both entries need tp be populatedShare"


Question: ECS VS EC2 which is better for hosting static website.

"Hello guys,need to know which service is better for hosting a static website, an ECS (fargate), or EC2 Reserved Instances.Thanks.FollowComment"

Answer: "2Static websites do not require server-side processing.And S3 static website hosting is a mean that can achieve the objective without building a server, which seems appropriate.Hosting a static website using Amazon S3 - Amazon Simple Storage ServiceIs there any reason why you should use ECS or EC2? It will be easier to get an appropriate answer if you share it.As for the comparison between ECS (Fargate) and EC2 Reserved Instances, EC2 has a simple configuration, but on the other hand, it requires server operations. In contrast, ECS has the opposite: the complexity of the configuration is a disadvantage, but you can expect a reduction in server operation toil due to the containers. However, there are many other factors to consider, and which one you should adopt depends on your requirements.CommentSharejhashimotoanswered 5 months agodigpal parmar 5 months agoThanks for answering.I have stated ECS and EC2 because of the adequate use of read-write from the database and for scalability in futureSharejhashimoto 5 months agoDo you plan to use databases? Static sites cannot access databases because they cannot process on the server side. If you need databases, you must configure it as a dynamic site, so S3 static website hosting cannot realize the purpose, so forget my suggestion.Share1Accepted AnswerYou can use these both options if you plan to use database, etc. The main difference between the two services are:ECS stands for Elastic Container Service, which means you need to use a container to deliver your site. This means create a Dockerfile and everything that comes away. With Fargate, is a "serverless" way to run ECS since you just adjust how much capacity you want. Use for less admin overhead, containers.EC2 stands for Elastic Cloud Computing, so basically you are 'serverfull''. You will have to admin everything. Patch the OS, and decide if you want or not use use containers and if so, install the software etc. The option of RI (Reserved Instance) is good for when you have a steady and very predictable resource usage, since you can reserver the instance(s) up to 3 years with a discount. Use for full server admin and very predictable usage in the long-term.Since this post also has the serverless tag, you can use Amplify Hosting if your site is using a framework supported, comes with server side rendering, access to API, databases, etc,CommentShareIbrahim Cesaranswered 5 months agodigpal parmar 5 months agoThanks for your answer. It helpsShare1I share my case.I used ECS as the frontend and backend servers were divided.After that, it was more convenient to manage with Docker rather than access and use EC2.Because it uses Docker, it was easy to used on localhost and the stage and develop servers.And it was better to do deployment and rollback while using code deploy.CommentShareSeobsanswered 5 months agodigpal parmar 5 months agoThanks for your answer. I will apply the same.Share"


Question: Ping not working between two Elastic IP addresses.

"Hi Team,I have created two Elastic IPs one for Zabbix Server and another one for Zabbix Agent, I have attached both for EC2 instanses, however when I ping from server IP to Agent IP, I am unable to ping, I am not sure anything needs to be configure between these two IPs..? Please let me know if you find right solution for that.Server EIP = 15.206.21.176Agent EIP = 43.205.188.248FollowComment"

Answer: "0Couple of initial checks --> Security Group and NACLs (if both instances are in different subnets). Refer this - https://aws.amazon.com/premiumsupport/knowledge-center/vpc-fix-connection-with-elastic-ip/CommentShareRajesh Sanswered 10 months ago0Make sure that the security group of your instance allows ICMP protocol for the EIP address. For some OS, including Windows, ping requests are blocked. If you are using Windows, you can try to follow this: https://activedirectorypro.com/allow-ping-windows-firewall/CommentSharejoahnaanswered 10 months ago"


Question: Task to task communication with ECS

"I have a task definition which spins up 2 webservers with stateful (sticky) websockets. In front of it a load balancer is present. How would I communicate from 1 webserver to another (task-to-task communication)?I read about Service Connect/Discovery. AFAIK this is for Service-to-service communication. Currently I am reading out the private IPv4 address and communicate over that IP address, that works. Does that IP address change in a running task?FollowComment"

Answer: "0Service Discovery is the correct route, it will allow you to manage the DNS and namespaces for your ECS Tasks. IP to IP will become a problem to keep track of as these will change if a Task, which can be done through application by querying for task's ip but that add more lift to application side.Note: Service discovery supports the A and SRV DNS record types. DNS records are automatically added or removed as tasks start or stop in the Amazon ECS service. Tasks or applications that need to connect to your Amazon ECS service can locate an existing task from the DNS record.https://aws.amazon.com/blogs/aws/amazon-ecs-service-discovery/CommentShareAWS-Aaron-Sanswered 6 months agorePost-User-3357015 6 months agoThanks for your answer. I have one more question from your answer. When will an IP address change of a task?ShareAWS-Aaron-S 5 months agoIP will change when tasks goes through lifecycle[1], this could be do to a voluntary change or involuntary change. Voluntary being change to task definition to deploy new version of task so tasks will be drained and re-deployed or stop/start of a standalone task, or involuntary a task become unhealthy and needs to be rescheduled. As well this may not be as obvious if you aren't using awsvpc networking mode, cause with bridge or host it will be using the worker node (container instance) IP. [2][1]https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-lifecycle.html[2]https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.htmlShare"


Question: GWLB Routing in Security Appliances

"What configuration are needed on the security appliance(lets say using Palo Alto) while using GWLB(Gateway Load Balancer)? Obviously we will configure zone, policy associated with zone. What about routing? Will the appliance pass the traffic to GWLB --> GWLBe without any routing entries on the security appliance("Palo Alto") (or) any any routing entries required. If routing entries requires, which IP should be the next hop ip on the security appliance?FollowComment"

Answer: "0Hello,Routing depends on which Architecture pattern you choose because there are significant differences depending on your use-case.Recommend going through this blog that explains all the Supported architecture patterns for TGW + GWLB + FWs and also the routing and flow of the traffic.https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-gateway-load-balancer-supported-architecture-patterns/Also PaloAlto has detail documentation around the implementation as well.As for the below question:Will the appliance pass the traffic to GWLB --> GWLBe without any routing entries on the security appliance("Palo Alto") (or) any any routing entries required. If routing entries requires, which IP should be the next hop IP on the security appliance?In general, the appliances will simply route to the Data subnet's 1st IP (You may have Data and Mgmt separate subnets) As such, the Firewall fleet of appliances will have no awareness of the GWLB and TGW, they will simply route to the  default gateway, it is the Appliance/GWLB subnet route table that will have specific routing entries, for example:Local route for inter-VPC traffic0.0.0.0/0 towards NAT-Gateway which will subsequently connect to the internet via IGW (if you also have internet egress from the same Inspection VPC)Specific routes pointing back to TGWIts difficult to advice without knowing your specific use-case but I hope this helps.CommentShareEXPERTTushar_Janswered a year ago"


Question: STS temporary credentials: "Access Key Id you provided does not exist"

"Hello everyone,I'm running ECS Fargate tasks and they need to PUT files to an S3 bucket.I decided to use STS temporary credentials instead of just hardcoding long-lasting credentials in the docker image.So, I start by requesting this url in bash.json=$(curl "http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI")It works, it returns this json output:{ "RoleArn":"The correct ARN of the Task Role. This role has the s3:PutObject permission.", "AccessKeyId":"ASIA4H7NO7.....", "SecretAccessKey":"Some string", "Token":"Some long string"}Now I use the AccessKeyId and SecretAccessKey I got to perform a  V4 signature so I can PUT the file to S3.https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.htmlI get this response, do you have any idea why?<?xml version="1.0" encoding="UTF-8"?><Error>InvalidAccessKeyId<Message>The AWS Access Key Id you provided does not exist in our records.</Message><AWSAccessKeyId>ASIA4H7NO7...</AWSAccessKeyId><RequestId>AE2074679...</RequestId><HostId>Some long string</HostId></Error>How come it says it does not exist? It's the Access key AWS gave me.I'm not using SDKs, just scripting some bash which is indeed working fine when I use long-lasting credentials (e.g the AKIA access key).On a side note... what's with the magic IP 169.254.170.2? Can't I use some host name?Thanks in advance.FollowComment"

Answer: 0I realized I should add and sign the x-amz-security-token header as well.https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#UsingTemporarySecurityCredentialsProblem solved!CommentShareBrightSoulanswered 4 years ago


Question: AWS S3 bucket is being accessed from any region even though it is created in us-west-2

"I am using Java SDK for aws to create S3 client to access s3 bucket connection status. Now, the current bucket which I am accessing is originally in region us-west-2. But during creating an s3 client(to access the bucket programatically) if I pass any other region other then us-west-2 also, the client is being created and I am getting the connection status as true. I am confused, shouldn't it return as failed if I am passing some other region than the region it is currently located in?FollowComment"

Answer: "1Accepted AnswerBuckets are global so you don't actually need to specify a region in your requests.  Still, it's a good idea to provide the right region as it avoids a request going to us-east-1 to find out where your bucket is.  Not only it is more efficient but it removes an unnecessary dependency on S3 in us-east-1 so one less thing to go wrong and cause an outage.  I haven't tried passing a "wrong" region as you describe but given that specifying region is optional it makes sense to me that AWS would honour the request anyway rather than getting picky.  Probably it just means you've added yet more overhead - the request goes to the wrong region, then us-east-1, then the right region.CommentShareEXPERTskinsmananswered a year ago"


Question: Fractional scaling with NICE DCV and XFCE

"Does NICE DCV support fractional scaling for Linux Desktop environments?Does NICE DCV support fractional scaling for Console and Virtual desktops, or only one of those?How would dcvserver and XFCE be configured together to provide factional scaling when connected to Microsoft Windows 11 NICE DCV clients?FollowComment"

Answer: "0Hello,Greetings for the day !what DCV currently does is to set the server resolution to the one requested by the client, it does not interact with the scaling factor of the server, if needed, the customer can change the scaling from the display settings menu of the desktop environment.Fractional scaling support depends on the Desktop Environment the customer is currently using, so depending on your Desktop Environment, it could or not be available.If you want more detail about the solution related to your environment. Please open a support case with AWS using the following link:[+] https://console.aws.amazon.com/support/home#/case/createHave a good day.CommentShareShrikant_Danswered 19 days ago"


Question: Failed connect two tasks in ECS Fargate

"context:I have 2 microservices service A and service Bservice A is a general nestjs microservice while service B is using nestjs + gRPCservice A calls service B APIlocal test:local: service A and B are brought up using separate docker-compose.yml and I set them explicitly to use the same network. Everything works as expected.PROBLEM: I deployed both services to AWS ECS Fargate. Each of them has an individual task definition. I setup service discovery for service B (A type) and the Service discovery endpoint is serviceb.local. Currently connection between service A and service B are not working. I keep receiving ERROR 14 connection not established error.QUESTION: How do i make containers in two different tasks talk to one another.Code:register Service B's client in Service A@Global()@Module({  imports: [    ClientsModule.register([      {        name: SERVICE_B_NAME,        transport: Transport.GRPC,        options: {          url: 'serviceb.local',          package: SERVICE_B_PACKAGE_NAME,          protoPath: 'node_modules/services-proto/proto/serviceb.proto',        },      },    ]),  ],bootstrap Service B  const app: INestMicroservice = await NestFactory.createMicroservice(AppModule, {    transport: Transport.GRPC,    options: {      url: '0.0.0.0:50051',      package: protobufPackage,      protoPath: join('node_modules/services-proto/proto/serviceb.proto'),    },  });What I have tries:I called service B's public IP from local postman and everything works;I used Cloud9 IDE and verified that Service discovery endpoint serviceb.local is successfully resolved to the public IP;Locally testing in docker works as expected;FollowComment"

Answer: "0Hello,I understand that you are facing issue with connectivity between 2 ECS Services.To test connectivity between 2 services, you can consider to perform the following:-> Exec into the container of Task running in Service A and try reaching out to another service. Also try vice versa and if the connectivity is fine then that means both the services can reach each other and communicate as well.-> Also you can test the connectivity for the service discovery endpoint of service B from service A-> We can make use of dig or curl commands to <Service discovery endpoint> to check endpoint connectivityThis would help us to isolate the issue from networking side and further narrow down whether the issue is at application level or not. Also if our Tasks are healthy and we are using gRPC to connect 2 services, then it is also possible that error is coming from application container. However as mentioned above, the connectivity testing will help us to identify the cause of issue.References:https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.htmlhttps://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-discovery.htmlCommentSharesanjusanswered 7 months ago"


Question: Error in lexClient->StartConversationAsync

"I am currently trying to establish a stream connection between my AWSClient and a Lex Bot. I am getting the following error:aws-sdk-cpp/aws-cpp-sdk-core/source/auth/signer-provider/DefaultAuthSignerProvider.cpp:48: virtual std::shared_ptr<Aws::Client::AWSAuthSigner> Aws::Auth::DefaultAuthSignerProvider::GetSigner(const String&) const: Assertion `false' failed.Aborted (core dumped)when the code run through the following line:lexClient->StartConversationAsync(LexRequest, OnStreamReady, OnResponseCallback, nullptr);    starting.WaitOne();the entire .cpp follows:#include <aws/core/Aws.h>#include <aws/core/client/AsyncCallerContext.h>#include <aws/core/utils/Outcome.h>#include <aws/core/auth/AWSCredentialsProvider.h>#include <aws/lexv2-runtime/LexRuntimeV2Client.h>#include <aws/lexv2-runtime/model/AudioInputEvent.h>#include <aws/lexv2-runtime/model/RecognizeUtteranceRequest.h>#include <aws/lexv2-runtime/model/RecognizeUtteranceResult.h>#include <aws/lexv2-runtime/model/StartConversationHandler.h>#include <aws/lexv2-runtime/model/StartConversationRequest.h>#include <aws/lexv2-runtime/model/StartConversationRequestEventStream.h>#include <aws/lex/LexRuntimeServiceClient.h>#include <aws/lex/LexRuntimeServiceRequest.h>#include <aws/lex/model/PostContentRequest.h>#include <aws/lex/model/PostContentResult.h>#include <iterator>#include <fstream>#include <chrono>#include <unistd.h>using namespace Aws::LexRuntimeV2;int SessionCount = 0;int main(int argc, char* argv[]){    std::string lexKey, lexSecret;    std::string botId, botAliasId, localeId, sessionId, regionId;    // bot credentials    botId = "_";    botAliasId = "_";    lexKey = "_";    lexSecret = "_";    localeId = "en_US";    // starting api    Aws::SDKOptions options;    options.loggingOptions.logLevel = Aws::Utils::Logging::LogLevel::Info;    Aws::InitAPI(options);    Aws::Client::ClientConfiguration config;    config.region = "us-east-1";    // creating a lex client    auto lexClient = Aws::MakeUnique<LexRuntimeV2Client>("MyClient", Aws::Auth::AWSCredentials(lexKey.c_str(), lexSecret.c_str()), config);    Model::StartConversationRequest LexRequest;    Model::StartConversationHandler requestHandler;    requestHandler.SetTranscriptEventCallback([](const Model::TranscriptEvent& ev)    {        std::cout << ev.GetTranscript() << std::endl;    });    requestHandler.SetOnErrorCallback([](const Aws::Client::AWSError<LexRuntimeV2Errors>& error)    {        std::cout << "Request handler: " << error.GetMessage() << std::endl;    });    LexRequest.WithLocaleId(localeId).WithBotId(botId.c_str()).WithBotAliasId(botAliasId.c_str()).WithSessionId("Blah")        .WithConversationMode(Model::ConversationMode::AUDIO).WithEventStreamHandler(requestHandler);    Aws::Utils::Threading::Semaphore signaling(0 /*initialCount*/, 1 /*maxCount*/);    auto OnResponseCallback = [&signaling](const LexRuntimeV2Client*,const Model::StartConversationRequest&,        const Model::StartConversationOutcome& outcome, const std::shared_ptr<const Aws::Client::AsyncCallerContext>&)     {         std::cout << "Response handler: " << outcome.GetError().GetMessage();        signaling.Release();     };    Model::StartConversationRequestEventStream* pStream = nullptr;    Aws::Utils::Threading::Semaphore starting(0 /*initialCount*/, 1 /*maxCount*/);    auto OnStreamReady = [&starting,&pStream](Model::StartConversationRequestEventStream& stream)    {        pStream = &stream;        pStream->SetSignatureSeed("blah");        starting.Release();    };    lexClient->StartConversationAsync(LexRequest, OnStreamReady, OnResponseCallback, nullptr);    starting.WaitOne();    std::ifstream audioFile(argv[1], std::ios_base::binary);    if (!audioFile)    {        std::cout << "Cannot open audio file " << argv[2] << std::endl;        return 0;    }    if (audioFile) {        std:: cout << "Audio file is open: "<< std::endl;    }    while (!audioFile.eof())    {        unsigned char buf[320 + 1];        audioFile.read((char*)buf, 320);        Aws::Utils::ByteBuffer bytes(buf, audioFile.gcount());        Model::AudioInputEvent input;        auto millisec_since_epoch = std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::system_clock().now().time_since_epoch()).count();        input.SetClientTimestampMillis(millisec_since_epoch);        input.SetAudioChunk(bytes);        input.SetContentType("audio/lpcm; sample-rate=8000; sample-size-bits=16; channel-count=1; is-big-endian=false");        pStream->WriteAudioInputEvent(input); // o erro está aqui (quando comento o StartConversation)        sleep(20);    }    signaling.WaitOne(); // prevent the application from exiting until we're done        Aws::ShutdownAPI(options);}//g++ -o main main.cpp -laws-cpp-sdk-s3 -laws-cpp-sdk-core -laws-cpp-sdk-lex -laws-cpp-sdk-lex-models -laws-cpp-sdk-lexv2-models -laws-cpp-sdk-lexv2-runtimeI have no idea why this is happening, and without this command i obviously can't publish events to lex, since the connection does not have startedFollowComment"


Question: Best method to send guardduty logs to opensearch

What is the best method to send guardduty logs to opensearch service. ? Cloud watch or through S3+lambda? Which is more efficient and cost effective? ThanksFollowComment

Answer: "1AWS has an opensource solution that helps you set up OpenSearch: https://github.com/aws-samples/siem-on-amazon-opensearch-service. After the initial set up of opensearch, you will then follow these steps to configure GuardDuty findings to be sent to the opensearch instance: https://github.com/aws-samples/siem-on-amazon-opensearch-service/blob/main/docs/configure_aws_service.md#Amazon-GuardDutyCommentShareAWS-User-9401600answered 3 months ago0Stepping back a bit, what are you trying to do with this data? Are you trying to setup alerts? A dashboard of some kind? Or integrate with a 3rd party SIEM solution? In order to try to minimize back and forth, I will provide a solution to several of these use-cases, please let me know if any of these hit the mark.Alerts: You can create a CloudWatch event from Guard Duty findings and create an alert for them as documented here.Dashboard: Amazon Guard Duty integrates with AWS Security Hub, which provides you with a comprehensive view of your security state in AWS. Findings from Guard Duty flow over to Security Hub, which provides you with a simple workflow management interface for all findings across all services. More info here. However, strictly speaking Security Hub is not a SIEM, which leads to...3rd party integration: Most 3rd party SIEM solutions integrate with Security Hub, so any and all findings from Security Hub, including those from Guard Duty, can flow over to your SIEM of choice.Do any of these address your particular use case?CommentShareMichael_Banswered a year ago"


Question: LoRaWAN FUOTA - Defining multicast group stuck in "Package attempting"

"Hi,I'm using STM32WL55 Nucleo with MW_RADIO_VERSION: V1.2.0.I'm trying to follow the instruction in the YouTube "Get started with AWS IoT Core for LoRaWAN FUOTA"I can see my device and my GW registered up-to-date on the AWS Core IOT consoleAfter adding my device to a multicast group I don't see that the device is getting any data even though it is transmitting once every 30sec.The console show under the device status in the multicast section that the device is "Package attempting"Any idea what I'm doing wrong?ThanksEyalFollowComment"

Answer: "0Hi Eyal. Please check the Basics Station logs and see if a dnmsg is sent by AWS IoT Core for LoRaWAN when you create the multicast group. And that it's sent in response to the uplink (not before).If I were to hazard a guess, maybe you enabled Class C in the device profile? And hence the dnmsg might be getting sent right away instead of in the RX slots after the uplink. This is the device profile I used in the video (with the same version of ST Nucleo firmware except I added some additional logging so I could see the LoRaWAN MAC commands):aws iotwireless get-device-profile --id 33f77a0b-d83c-43ac-9983-22e0526deed7{    "Arn": "arn:aws:iotwireless:us-east-1:012345678901:DeviceProfile/33f77a0b-d83c-43ac-9983-22e0526deed7",    "Name": "ST Nucleo-WL55JC1",    "Id": "33f77a0b-d83c-43ac-9983-22e0526deed7",    "LoRaWAN": {        "SupportsClassB": false,        "SupportsClassC": false,        "MacVersion": "1.0.3",        "RegParamsRevision": "RP002-1.0.1",        "RxDelay1": 1,        "RxDrOffset1": 0,        "RxDataRate2": 8,        "RxFreq2": 9233000,        "FactoryPresetFreqsList": [            null        ],        "MaxEirp": 13,        "MaxDutyCycle": 0,        "RfRegion": "AU915",        "SupportsJoin": true,        "Supports32BitFCnt": true    }}Forgetting about FUOTA for a moment, you could also check whether any downlink messages work for you. Even just a regular unicast downlink.If my guess is wrong, please make use of Network Analyzer and IoT Wireless logging in CloudWatch to get greater visibility into the issue.CommentShareEXPERTGreg_Banswered a year agoAWS-User-EG a year agoHello GregSorry for my basic questions but I have some misunderstanding regarding your reply.When you say "Basics Station logs" you mean the logs from my GW? Or some logs that I can see on the console?I'm able to see the logs on the GW, and when the unit is starting to work there are some two way messages so I assume I'm able toget downlink messages. I can see incoming messages when the device start but I did not see dnmsg.I'm able also to see logs on the network analyzer, but again, did not see dnmsgAlso, when I try to see the device profile in the CLI I get this error:AWSCLIV2>aws iotwireless get-device-profile --id "661ee449-96b6-4e9e-9e74-515fa3bf359f"An error occurred (ResourceNotFoundException) when calling the GetDeviceProfile operation: Cannot complete the step because resource is not found, with resource type DeviceProfile, resource Id 661ee449-96b6-4e9e-9e74-515fa3bf359fMy default class is A:#define LORAWAN_DEFAULT_CLASS                       CLASS_AShareGreg_B EXPERTa year agoHi Eyal. Yes Basics Station is the GW software. A dnmsg is a Basics Station station downlink message. You will see them in the Basics Station log if your logging level is XDEBUG.ShareGreg_B EXPERTa year agoA dnmsg in the logs looks like this:2022-05-29 23:55:20.648 [AIO:XDEB] [4|WS] < {"msgtype":"dnmsg","DevEui":"00-00-00-00-00-00-00-00","regionid":4,"dnmode":"updn","dC":0,"diid":8693,"pdu":"601cb733019503001100000000c8afc671d222","priority":1,"RxDelay":1,"RX1DR":13,"RX1Freq":926300000,"xtime":16044073883980668,"rctx":0}You don't need this to solve the problem. It's just that the Basics Station logs can be helpful.ShareGreg_B EXPERTa year agoThe McGroupSetupReq message is sent on FPort 200. So in Network Analyzer you should be seeing downlink messages on FPort 200 (and perhaps also clock synchronization messages on FPort 202). This will not appear until you create the multicast group. Otherwise you will mainly see FPort 2 (the FPort used by the Nucleo data uplinks).ShareGreg_B EXPERTa year agoFor the error on get-device-profile I think you are using the wrong ID. Please use aws iotwireless list-device-profiles to see your device profile IDs.ShareShow 5 more comments0Hello,Was there ever a resolution to this? I'm experiencing the same problem with US915 and v1.2.0. I see multiple port 200 DL/UL events occur on the device log but the multicast session never starts. The only changes I've made to the stack are enabling US915 (vs default of EU868) and increasing the log information reported. GW is the Minihub Pro for AWS.Thank you,TimCommentShareTSloperanswered 7 months ago"


Question: Why does NAT GW get two IP address EIP and Private IP Address

"HiI need some help in understanding the use case of Elastic IP Address and Private IP Address that gets assigned to the NAT GW.1- When a NAT GW is launched, it gets two IPs Elastic IP Address and Private IP Address. What IP does it use as the SRC IP when it forwards the traffic to the Internet Gateway. From Documentation "The NAT gateway sends the traffic to the internet gateway, using its Elastic IP address as the source IP address."2- What IP [EIP or Private IP] does the Internet Gateway use for translation? From Documentation: "For communication using IPv4, the internet gateway also performs network address translation (NAT)"If I try to combine above points then does Internet Gateway translate the EIP of the NAT GW to a publicly routable address as the src before sending it out on the internet?FollowComment"

Answer: "0I suggest to check this blog, it explains the packet flow and how the Source IP gets changed at each hop. See the below statement and the diagram along with the table showing packet flow.AWS NAT Gateways performs Port Address Translation. AWS NAT Gateways performs source-NAT, and translates the IP address of the source with its private IP address. Then, the Internet Gateway (IGW) translates the private IP address of the NAT Gateway to the Elastic IP address associated with the NAT GatewayCommentShareEXPERTTushar_Janswered 9 days ago0To add some explanation to the above blog, when the packet reaches NAT-GW, The NAT-GW translates the source IP address to its private IP address then it forwards the packet to IGW. When the packet reaches the IGW, it performs another source IP translation where it uses the EIP, that's associated with the NAT-GW, as the packet source IP.CommentShareAWS-Networkeranswered 7 days ago"


Question: AWS IotTwinMaker service endpoint not working (Server not found)

Hi it seems like AWS IoTTwinMaker service endpoints are not up and running (https://iottwinmaker.us-east-1.amazonaws.com/). Can someone help and share the working endpoints? thanksFollowComment

Answer: "1Accepted AnswerHi,This is the correct us-east-1 endpoint for AWS IoT Twinmaker. We can see the URL's here in our IoT TwinMaker endpoint and quotas Documentation.In order to test the endpoint, I used the AWS CLI to call the GetWorkspace API on us-east-1 and I can confirm that the request is being made to this endpoint api.iottwinmaker.us-east-1.amazonaws.comHere is my aws cli request:aws iottwinmaker get-workspace --workspace-id Test --region us-east-1 --debugIf we check the debug prints we can confirm the URL where the request is being sentGET/workspaces/Testhost:api.iottwinmaker.us-east-1.amazonaws.comx-amz-date:20220106T041937ZI do not see any reported issues with this URL. That said, can you please let me know how you are currently checking this URL and where you are seeing "Server not found"? We are looking forward to your reply.CommentShareSUPPORT ENGINEERRyan_Aanswered a year agoRaMa a year agoThis is the endpoint url "api.iottwinmaker.us-east-1.amazonaws.com" I was looking for. The doc did not mention the api subdomain. Thanks Ryan!Share"


Question: SSM AWS-RunPatchBaseline Script Failure `missing 1 required positional argument`

"I have started seeing failures on Scanning for patching using patch manager on amazon linux 2022 and 2023. I'm seeing it on both x86 and arm deployments of AL2022/2023./usr/bin/python3/usr/bin/yum/usr/bin/dnfUsing python binary: 'python3'Using Python Version: Python 3.9.1604/13/2023 20:04:57 root [INFO]: Downloading payload from https://s3.dualstack.us-west-2.amazonaws.com/aws-ssm-us-west-2/patchbaselineoperations/crossaccount/payloads/patch-baseline-operations-cross-account-63.0.tar.gz04/13/2023 20:04:58 root [INFO]: Attempting to import entrance file os_selector_cross_account04/13/2023 20:04:58 root [INFO]: Running with snapshot id =  and operation = Scan04/13/2023 20:04:59 root [INFO]: Instance Id: i-0b************04/13/2023 20:04:59 root [INFO]: Region: us-west-204/13/2023 20:04:59 root [INFO]: Product: AmazonLinux202304/13/2023 20:04:59 root [INFO]: Patch Group: 04/13/2023 20:04:59 root [INFO]: Operation type: Scan04/13/2023 20:04:59 root [INFO]: Snapshot Id: 72267b53-9594-4369-8507-e89e45e479b104/13/2023 20:04:59 root [INFO]: Patch Baseline: {'accountId': '***********', 'baselineId': 'pb-0a624803d647da0ab', 'name': 'AWS-AmazonLinux2023DefaultPatchBaseline', 'globalFilters': {'filters': [{'key': 'PRODUCT', 'values': ['*']}]}, 'approvalRules': {'rules': [{'filterGroup': {'filters': [{'key': 'CLASSIFICATION', 'values': ['Security']}, {'key': 'SEVERITY', 'values': ['Critical', 'Important']}]}, 'complianceLevel': 'UNSPECIFIED', 'enableNonSecurity': False, 'approveAfterDays': 7, 'approveUntilDate': None}, {'filterGroup': {'filters': [{'key': 'CLASSIFICATION', 'values': ['Bugfix']}]}, 'complianceLevel': 'UNSPECIFIED', 'enableNonSecurity': False, 'approveAfterDays': 7, 'approveUntilDate': None}]}, 'approvedPatches': [], 'approvedPatchesComplianceLevel': 'UNSPECIFIED', 'approvedPatchesEnableNonSecurity': False, 'rejectedPatches': [], 'rejectedPatchesAction': 'ALLOW_AS_DEPENDENCY', 'createdTime': 1678728950.037, 'modifiedTime': 1678728950.037, 'description': 'Default Patch Baseline for Amazon Linux 2023 Provided by AWS.', 'operatingSystem': 'AMAZON_LINUX_2023', 'sources': []}04/13/2023 20:04:59 root [INFO]: Reboot Option: RebootIfNeeded04/13/2023 20:04:59 root [INFO]: Unable to initialize exit code reporting: No metrics ID from server04/13/2023 20:04:59 root [INFO]: Loading patch snapshot from snapshot.json04/13/2023 20:04:59 root [INFO]: {'patchBaseline': {'accountId': '*********', 'baselineId': 'pb-0a624803d647da0ab', 'name': 'AWS-AmazonLinux2023DefaultPatchBaseline', 'globalFilters': {'filters': [{'key': 'PRODUCT', 'values': ['*']}]}, 'approvalRules': {'rules': [{'filterGroup': {'filters': [{'key': 'CLASSIFICATION', 'values': ['Security']}, {'key': 'SEVERITY', 'values': ['Critical', 'Important']}]}, 'complianceLevel': 'UNSPECIFIED', 'enableNonSecurity': False, 'approveAfterDays': 7, 'approveUntilDate': None}, {'filterGroup': {'filters': [{'key': 'CLASSIFICATION', 'values': ['Bugfix']}]}, 'complianceLevel': 'UNSPECIFIED', 'enableNonSecurity': False, 'approveAfterDays': 7, 'approveUntilDate': None}]}, 'approvedPatches': [], 'approvedPatchesComplianceLevel': 'UNSPECIFIED', 'approvedPatchesEnableNonSecurity': False, 'rejectedPatches': [], 'rejectedPatchesAction': 'ALLOW_AS_DEPENDENCY', 'createdTime': 1678728950.037, 'modifiedTime': 1678728950.037, 'description': 'Default Patch Baseline for Amazon Linux 2023 Provided by AWS.', 'operatingSystem': 'AMAZON_LINUX_2023', 'sources': []}, 'product': 'AmazonLinux2023', 'patchGroup': '', 'instanceId': 'i-0b100e2ffed916511', 'region': 'us-west-2', 'operation': 'Scan', 'snapshotId': '72267b53-9594-4369-8507-e89e45e479b1', 'installOverrideList': '', 'rebootOption': 'RebootIfNeeded', 'associationId': '43b0b8d6-3828-4900-b0bb-4622ecf5b260', 'associationSeverity': 'UNSPECIFIED'}04/13/2023 20:04:59 root [ERROR]: __init__() missing 1 required positional argument: 'error_code'Traceback (most recent call last):  File "/var/log/amazon/ssm/patch-baseline-operations/./main_entrance_cross_account.py", line 117, in <module>    (patching_exit_code, inventory) = (get_execution_module(oper_sys, snapshot_object.product)).execute(snapshot_object, override_list)  File "/var/log/amazon/ssm/patch-baseline-operations/common_main_entrance_methods.py", line 91, in get_execution_module    raise PatchManagerError("Could not find module %s for %s" % (module_name, operating_system))TypeError: __init__() missing 1 required positional argument: 'error_code'I've removed account and instance ids from the error message.FollowComment"


Question: Damage detection on mobile

"Hi,I am new to ML/AI, Can someone help me create model for detection damage on mobile i.e. screen damage, back panel damaged etc, How sagemaker can helpFollowComment"

Answer: 0Hope this helps to get started on - https://awslabs.github.io/sagemaker-defect-detection/CommentShareEXPERTHrushi_Ganswered 7 months ago


Question: Notification when ANY status check fails

"I've seen articles about getting a notification for the StatusCheckFailed metric, but when creating an alarm it appears I HAVE TO specify an instance ID.  But we are creating and destroying instances automatically and I want a notification when ANY status check fails.  Is there a way to set that up?FollowComment"

Answer: "1Accepted AnswerYou've not stated how you are creating these instances but if it's with auto scaling the health check will automatically terminate them and launch a new one.Alternatively:There may be an Event Bridge rule you can create to pick this up and have an action off the back of it.You could have an alarm created at instance launch and delete on terminate.Write a Lambda to run on a scheduled event to check status.CommentShareSiTheAWSGuyanswered 7 months ago1Hi - Not very sure on the use case but if you use auto scaling then one of the check is status checks. Amazon EC2 Auto Scaling uses the results of the Amazon EC2 instance status checks and system status checks to determine the health status of an instance. If the instance is in any Amazon EC2 state other than running, or if its status for the status checks becomes impaired, Amazon EC2 Auto Scaling considers the instance to be unhealthy and replaces it.Reference : https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-health-checks.htmlFor other use cases, you can create alarms at instance launch and delete on terminate as needed.CommentShareEXPERTAWS-User-Nitinanswered 7 months ago"


Question: waf didn't block requests if block condition matched for first time

"Using locust , I made WAF test on my application. I made a rate limit based rule to block IP if requests exceed 100 in a default 5 minute window.  When I tested with concurrency 400 with spawn rate 40, then WAF doesnot block after total requests exceeds 100. But when I stop the test and make a new test in locust and then only WAF blocks that IP for 5 min .I tested many times and found when I make a first locust test , WAF is not working even if condition meets. But it works if I stop that test and make a new test. My purpose of blocking through WAF seems not feasible since attacker can make attack with huge requests and that won't be blocked.I have enabled WAF on API gateway.FollowComment"

Answer: "0How long are you waiting before stopping the first test? While the rate is expressed per 5 minute period, you don't have to wait that long before WAF will start blocking requests. A source IP that has exceeded the configured rate is typically blocked within 30 to 60 seconds - so it's not immediate. The rate limit is also per source IP address, so you would need to make sure that all your requests originated from the same IP.Checking the Cloudwatch metrics may help you here.CommentSharePaul_Lanswered a year agoTechxonia a year agoI tested it again with number of users (peak conccurency) 400 and spawn rate(users started/second) 5. After a one minute there are 2383 requests total and 965 requests were allowed and 1418 requests were forbidden. I have set rate limit 100 requests for 5 min in WAF and all source IP address is same. It needs to block all users requests after 100 requests. I couldn't figure what is the issue.Share"


Question: VPC peering with a VPC from a different AWS Organization - cost implications

"Background:Customer's Fargate tasks in VPC 1 accessed MongoDB clusters on EC2 in VPC 2. Customer migrated their MongoDB clusters on EC2 to MongoDB Atlas (marketplace SaaS offering) in Atlas' VPC. Customer VPC is peered with the external Mongo/Atlas VPC.Post this migration, customer data transfer cost decreased. (As I understand, customer is no longer responsible VPCPeering-in cost)Customer question:"Does traffic over a vpc peering connection shows up in cost explorer as api operation = vpc-peering even if one of the vpc’s involved is in another company’s organization/account."Ask:Q1)  Does VPCPeering-in and VPCPeering-out show in customer account even when customer's VPC is peered with the VPC of an external organization?FollowComment"

Answer: "0Accepted AnswerQ1: Yes, this will be shown in the customers account for the customer's part of the cost. SaaS provider will also see their own part of the cost. Both parties will have some IN and OUT traffic.If the VPCs in the VPC peering connection are within the same region, the charges for transferring data within the VPC peering connection are the same as the charges for transferring data across Availability Zones. If the VPCs are in different AWS Regions, inter-region data transfer costs apply.Data transferred "in" to and "out" from Amazon EC2, Amazon RDS, Amazon Redshift , Amazon DynamoDB Accelerator (DAX), and Amazon ElastiCache instances or Elastic Network Interfaces across Availability Zones or VPC Peering connections in the same AWS Region is charged at $0.01/GB in each direction.https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.htmlCommentSharembeanswered 3 years ago"


Question: Greengrass autoprovision with temp credentials is broken?

"I've been trying to autoprovision greengrass devices using temporary credentials. It always fails at the same spot. I've tried on different types of devices.Attaching TES role policy to IoT thing...Exiting due to unexpected error while looking up managed policy - The security token included in the request is invalid (Service: Iam, Status Code: 403, Request ID: 18d4f9c5-3f9a-49dc-YYYY-XXXXXXXXXXXXX, Extended Request ID: null)Error while trying to setup Greengrass Nucleussoftware.amazon.awssdk.services.iam.model.IamException: The security token included in the request is invalid (Service: Iam, Status Code: 403, Request ID: 18d4f9c5-3f9a-49dc-YYYY-XXXXXXXXXXX, Extended Request ID: null)The creds are exported as environmental vars correctly.** I confirm the temp credentials work on the devices using other AWS CLI commands. I also confirm its calling the original users permissions with : aws sts get-caller-identity**If I use the original users access key and secret, the device will autoprovision correctly. But never with temp credentials.  Nucleus version is 2.8.1Temp creds WILL WORK if you don't have '--provision true' set.I don't believe any special permissions are ever needed for TES. So I think there may be some endpoint issue in the Nucleus code. Someone please prove me wrong, its driving me crazy.FollowCommentJoeAtAWS 7 months agoHey AWS-Frenzy - to help us try to reproduce your issue, can you provide some the exact steps you're following, as well as the provisioning command you're using? ThanksShareAWS-Frenzy 7 months agoFor JoeAtAWS:I am using the standard command that creating a new Greengrass device creates:sudo -E java -Droot="/greengrass/v2" -Dlog.store=FILE -jar ./GreengrassInstaller/lib/Greengrass.jar --aws-region us-east-1 --thing-name Thing1 --thing-group-name Goup1 --component-default-user ggc_user:ggc_group --provision true --setup-system-service true --deploy-dev-tools trueShareAWS-Frenzy 7 months agoSorry Joe, you asked for exact steps. I'll list them out.In console, I create a new GG device. This gives 2 commands to be run on the device. I pause here, and don't run those commands yet.As a user with full admin privileges I create temp creds:aws sts get-session-token --region us-east-1I then export those temp creds to environmental variables on the device:export AWS_ACCESS_KEY_ID=XXXexport AWS_SECRET_ACCESS_KEY=YYYexport AWS_SESSION_TOKEN=AQoDYXdzEJr...<remainder of session token>I confirm the device can use those temp creds:aws s3 ls andaws sts get-caller-identityI run the first command on the device to get the software needed:curl -s https://d2s8p88vqu9w66.cloudfront.net/releases/greengrass-nucleus-latest.zip > greengrass-nucleus-latest.zip && unzip greengrass-nucleus-latest.zip -d GreengrassInstallerI run the second command to install the software and autoprovision the devicesudo -E java -Droot="/greengrass/v2" -Dlog.store=FILE -jar ./GreengrassInstaller/lib/Greengrass.jar --aws-region us-east-1 --thing-name Thing1 --thing-group-name Goup1 --component-default-user ggc_user:ggc_group --provision true --setup-system-service true --deploy-dev-tools trueThat is when I get the:Attaching TES role policy to IoT thing... Exiting due to unexpected error while looking up managed policy - The security token included in the request is invalid (Service: Iam, Status Code: 403ShareMichaelDombrowski-AWS EXPERT7 months agoDo you have credentials on the device in some other way in addition to the environment variables? For example, a profile file in ~/.aws/credentials, EC2 instance credentials, or SSM credentials?ShareAWS-Frenzy 7 months agoNegative. There are no other credentials on these devices other then what we added to the exported vars.I ask this kindly to anyone at AWS, can you simply try to provision your own device using temp credentials and see if it works with the current Nucleus code?ShareShow 5 more comments"

Answer: "3Accepted AnswerHi,The problem is that get-session-token does not allow any calls to IAM unless MFA authentication information is provided as part of the request as described in the documentation here: https://docs.aws.amazon.com/cli/latest/reference/sts/get-session-token.html.You can use long lived credentials, pass MFA authentication to STS, or use one of the other supported provisioning methods such as fleet provisioning https://docs.aws.amazon.com/greengrass/v2/developerguide/fleet-provisioning.html or JITP https://docs.aws.amazon.com/iot/latest/developerguide/jit-provisioning.htmlYou can also create and later deactivate long term credentials as another possibility.CommentShareEXPERTMichaelDombrowski-AWSanswered 7 months agoAWS-Frenzy 7 months agoConfirmed solution. When using the MFA token in getting temp creds, I am able to provision. (I think GG docs should be updated to say this is required.) I did however have to pass the creds using the system properties method. Environmental vars still didn't work. I can live with that.ShareAWS-Frenzy 7 months agoI wanted to add a Thank you Michael for working through this with me. I really appreciate it.ShareMichaelDombrowski-AWS EXPERT7 months agoYou're very welcome, sorry it took so long to get to the bottom of it, but I'm glad that we found a solution for you (MFA).I'll also check with our docs team about adding this information.Share0Few pointes for you to consider:1/ I am assuming you are following the guidelines as in this documentation, but re-checking.https://docs.aws.amazon.com/greengrass/v2/developerguide/quick-installation.html#provide-installer-aws-credentials2/ Can you try provisioning with an IAM user's set of credentials temporarily with the AdministratorAccess IAM policy (you can remove after Greengrass has successfully provisioned).3/ Follow the Troubleshooting AWS IoT Greengrass guide. It has specific section for the temporary credentials failhttps://docs.aws.amazon.com/greengrass/v2/developerguide/troubleshooting.htmlCommentShareSanjay Aggarwalanswered 7 months agoAWS-Frenzy 7 months agoYes on all 3.On #2, see my comment that I confirm the devices are provisioning when using the long term creds of the user. But not when using temporary.On #3, see my comment that the temp credentials are in fact being applied correctly. The devices can use those temp credentials to do other things, like list S3 buckets, etc. They just can't autoprovision.Share"


Question: Domain Verification in the wrong region

Hi !I just signing up for Amazon AWS and SES.I followed all the instructions for verified my domain name.And... success ?Almost.I juste received a mail saying this :Domain Verification SUCCESS for XXXX.com in region US East (Ohio)The probleme is I live in France...Why my domain is locating in Ohio ?The Ip Location in my Whois is FranceAnyone can help me to understand this problem and how to solve it ?Thanks !FollowComment

Answer: "0In upper right corner of console webpage, just select the region you want to work in.See image: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTyW2BSf-QsVfooFJkv9AcKaDrwhiGQd3q9ig&usqp=CAUEdited by: mdibella on Nov 30, 2021 10:38 AMCommentSharemdibellaanswered 2 years ago0Thank youuuuuu ! I didn't see it at all.CommentSharemarouanswered 2 years ago"


Question: How to relate an AWS Invoice with the charge in my bank.

"Currently, I am paying my AWS invoices by direct debits in my bank account.I would like to know how I can relate an invoice with the charge in my bank account.For instance, my bank shows the following concept for the AWS charge: 80000088242964 AWS EMEA 54BYT1ECY1QDGKKK, but this concept does not appear anywhere in AWS invoice.ThanksFollowComment"

Answer: 0You should open up an Account and billing support case with AWS Support. This is available to all customers.CommentShareEXPERTkentradanswered 3 months ago


Question: First time migration on Amazon WorkMail

"Hello,I just have my domain with email service integrated. Should I move only 2 emails from this service to Amazon Workmail?Thank youFollowComment"

Answer: "0Hello,Thank you for reaching out.Depending on the use case you can register your email domain with WorkMail easily and update the DNS. If the domain is registered with WorkMail hence, go ahead to migrate emails to WorkMail.You can migrate to Amazon WorkMail from Microsoft Exchange, Microsoft Office 365, G Suite Basic (formerly Google Apps for Work), and other platforms by working with one of our partners. For more information about our partners, see Amazon WorkMail Features.Additional information on Migrating to Amazon WorkMailShould you need further clarification and assistance on the use case, feel free to reach out to AWS Premium Support and Contact UsCommentShareChibuike_Aanswered a year ago"


Question: Does VPC need to be updated if client is changing VPN settings?

"Currently, a Lambda function uses a VPC to connect to client's server and fetch data. The client will be updating their VPN, and thus, do the VPC settings need to be updated as well? For example, the client is changing the encryption scheme, but I don't see anything related to encryption in VPC?FollowComment"

Answer: "0You might want to go to VPC console, under VIRTUAL PRIVATE NETWORK (VPN) check customer gateway and site-to-site VPN connection settings.CommentShareJason_Sanswered a year agoNS_gtechinst a year agoHi Jason, there are no VPN gateways or site-to-site VPN connection settings under VPC console. The client does not use AWS, they just made an exception in their firewall for the addresses that are available in the VPC--I have to use a login and password to fetch the data.ShareJason_S a year agoIn that case just wondering how the communication happens from the VPC to the on-prem? are the communication happens through NAT GW / public internet? If so, as the traffic is not encrypted through VPN, VPN related changes have no impact on the AWS side.Share"


Question: Mac EC2 instance stuck in "shutting-down" state

I can't release dedicated host as EC2 instance stuck in "shutting down" state upon Terminate action.Instance ID: i-08a1217064ac68d2dFollowComment

Answer: "0Hi,As per AWS documentation:You are not billed for any instance usage while an instance is not in the running state. In other words, when you terminate an instance, you stop incurring charges for that instance as soon as its state changes to shutting-down.Delayed instance terminationIf your instance remains in the shutting-down state longer than a few minutes, it might be delayed due to shutdown scripts being run by the instance.Another possible cause is a problem with the underlying host computer. If your instance remains in the shutting-down state for several hours, Amazon EC2 treats it as a stuck instance and forcibly terminates it.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesShuttingDown.htmlCommentShareSrianswered a year ago0Just got an email saying:EC2 has detected degradation of the underlying hardware of your Amazon EC2 Dedicated Host...So instance is terminated and host is released. Thanks!CommentSharedyakhnovanswered a year ago"


Question: S3 bucket per tenant approach. Can I assign different IAM roles for diefferent users in the amplify project?

"Please let me know if this a valid approach or I am missing something fundamental..Requirement:I need to be able to restrict each tenant users from accessing each other s3 filesand be able to measure each tenant space usage in the s3.Solution I think to implement:Upon user signup, we check if this is a sign up by invitation to already existing tenant space or a new registrationif it's a new tenant than we register him in a custom dynamodb table and create an s3 bucket for himif it's a new user in existing tenant we we only adding him to the IAM Role that can access the tenant s3 bucketDetails:I currently am using cognito custom attribute to save tenant ID (it's configured to not be changeable by the user itself) and struggle to figure out how I can affect the role mapping in the cognito Identity pool to implement the above logic.Please give me directions to dig further or advises on the overall approach in general.Some of the ideas are taken from this article https://medium.com/@dantasfiles/multi-tenant-aws-amplify-method-2-cognito-groups-38b40ace2e9e and it also suggests to use cognito dynamic groups to differ tenants and it seems to resolve the s3 issue as well, but with dynamic groups sync events won't work, right?Known limitation: Real-time subscriptions are not supported for dynamic group authorization.https://docs.amplify.aws/cli/graphql/authorization-rules/#user-group-based-data-accessThere is also this question https://repost.aws/questions/QUW1WibDWjQd2rOll4mDiPMA which suggest to use a lymbda and presigned s3 urls to regulate the access to s3 files based on the tenant logicFollowCommentArsen 7 months agorelated questions:https://repost.aws/questions/QUyyXhK2KrT7SKAcoG9IHuUQ/user-pools-and-access-tokenshttps://stackoverflow.com/questions/54438950/can-i-use-the-cognito-user-pool-group-in-s3-bucket-policieshttps://stackoverflow.com/questions/67713772/give-read-write-access-to-an-s3-bucket-to-a-specific-cognito-user-groupShare"

Answer: "0One of the possible approaches seem to be using the Cognito identity provider attribute mapping to principal tags in combination with s3 bucket policies.{    "Version": "2012-10-17",    "Id": "Policy1667740367430",    "Statement": [        {            "Effect": "Allow",            "Principal": "*",            "Action": "s3:GetObject",            "Resource": "arn:aws:s3:::BUCKET_NAME/*",            "Condition": {                "StringEquals": {                    "s3:ExistingObjectTag/tenant": "${aws:PrincipalTag/tenant}"                }            }        }    ]}CommentShareArsenanswered 7 months agoArsen 7 months agoalthough it doesn't seem to be possible to set the PrincipalTag <-> attribute mapping through cloud formationhttps://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/779Share"


Question: What value do I insert inside the body of my API request according to this API Specification?

"I'm trying to make a data request call from a data exchange API based on the data provider's API specification.My app is built using the Node.JS and NPM.I'm subscribed to use the API and I've verified that all my identity credentials, policies and IAM keys that give me permission to access the API.However when I test the request call in AWS CLI, I get the message '404: Asset not found'.What could be the problem with my API request call?Thanks!My current request code looks like below:aws dataexchange send-api-asset \  --data-set-id xe4xxxxxxxxxx72b7edxxxx6 \  --revision-id xx54cxxxxxxxx9d05d81xxxxxxxx \  --asset-id xxxxxxbde1fa3d5xxxxe2bb5xx \  --method POST \  --path "/psdm/graphql/" \  --query-string-parameters 'param1=value1,param2=value2' \  --request-headers '{"Content-Type": "application/json"}' \  --body '{"content": {            "application/graphql": {              "schema": {                "$ref": "#/components/schemas/CatalogSearchRequest"              },              "value": "{ursa_udp_availablemetadatarecord(limit: 10 content: {catalogProperties: { vendor: { eq: \"ICEYE\" } } } ) { assignedId }}"            }          },          "required": true        }'The Actual API Specification:{  "openapi": "3.0.1",  "info": {    "title": "image-services",    "description": "API Gateway for integration of Platform Services into AWS Data Exchange",    "version": "2022-03-03T20:04:18Z"  },  "servers": [    {      "url": ""    }  ],  "paths": {    "/psdm/graphql": {      "post": {        "requestBody": {          "description": "GraphQL query for the Catalog in the form of:\n\n  `{\n    availablemetadatarecord(\n      QUERYPARAMS\n    ) { \n      FIELDLIST\n    } \n  }`\n",          "content": {            "application/graphql": {              "schema": {                "$ref": "#/components/schemas/CatalogSearchRequest"              },              "examples": {                "Limit returned data": {                  "description": "Limit the number of records in a response.\n\nIn your query, simply specify `limit: <int>` \n",                  "value": "{\n  availablemetadatarecord(\n    limit: 10\n    content: { catalogProperties: { vendor: { eq: \"EYE\" } } }\n  ) {\n    assignedId\n  }\n}\n"                }              }            }          },          "required": true        },        "responses": {          "200": {            "description": "200 response",            "content": {              "application/json": {                "schema": {                  "$ref": "#/components/schemas/CatalogSearchResponse"                }              }            }          }        },        "security": [          {            "sigv4": []          }        ]      }    }  },  "components": {    "schemas": {      "CatalogSearchRequest": {        "title": "CatalogSearchRequest",        "type": "object"      },      "CatalogSearchResponse": {        "title": "Catalog Search Response",        "required": [          "data",          "paginationInfo"        ],        "type": "object",        "properties": {          "paginationInfo": {            "type": "object",            "properties": {              "recordsInPage": {                "type": "integer"              },              "nextOffset": {                "type": "integer"              }            }          },          "data": {            "type": "object",            "properties": {              "availablemetadatarecord": {                "type": "array",                "description": "Records returned by query",                "items": {                  "type": "object"                }              }            }          }        }      }    },    "securitySchemes": {      "sigv4": {        "type": "apiKey",        "name": "Authorization",        "in": "header",        "x-amazon-apigateway-authtype": "awsSigv4"      }    }  }}FollowComment"

Answer: "1Hello,It looks like your request body includes extra information from the OpenAPI spec that doesn't belong in the request body itself. Additionally, the content type should be application/graphql, there should be no query parameters, and I believe the path forward-slashes need to be escaped if you are running this through a CLI. Could you try:aws dataexchange send-api-asset \  --data-set-id xe4xxxxxxxxxx72b7edxxxx6 \  --revision-id xx54cxxxxxxxx9d05d81xxxxxxxx \  --asset-id xxxxxxbde1fa3d5xxxxe2bb5xx \  --method POST \  --path "\/psdm\/graphql\/" \  --request-headers '{"Content-Type": "application/graphql"}' \  --body "{ursa_udp_availablemetadatarecord(limit: 10 content: {catalogProperties: { vendor: { eq: \"ICEYE\" } } } ) { assignedId }}"CommentShareDanielMalmer_UrsaSpaceanswered 7 months agorePost-User-3943333 7 months agoThe API specification looks like above (I've updated the question). I'm having trouble understanding what values I should insert into the 'body' parameter.SharerePost-User-3943333 7 months agoIssue persists. However a command like 'aws dataexchange getDataSet(params)' works. So I really do not know what the issue is with 'send-api-asset'. Tried to find demos online for this particular API but couldn't.Share"


Question: What timestamp is being used by Amazon Connect for recordings filename? Initiation timestamp OR Disconnect timestamp?

"As we know amazon connect record the calls and store the recordings on S3 bucket, i am looking for what timestamp i can use to make the filename by myself in my code!There are two timestamps e.g. Initiation timestamp & Disconnect timestamp are being used while creating filenames with contactId_timestamp_UTC e.g. 7bb75057-76ae-4e7e-a140-44a50cc5954b_20220418T06:44_UTC.wav.I have used the callStartTime to create these filenames and then get the files from S3 using SignedURL but in few cases there is a difference of 1 sec as file stored with incremental of one sec on S3 and i couldn't get the file form S3.For example i the filename is been created by my application is: 7bb75057-76ae-4e7e-a140-44a50cc5954b_20220418T06:44_UTC.wav. but the recording stored on S3 has filename as: 7bb75057-76ae-4e7e-a140-44a50cc5954b_20220418T06:45_UTC.wav.The last thing can this data (timestamp) is available in contact object? so i can use it.FollowComment"

Answer: "0The contact trace record contains details about the S3 location of the recording - see https://docs.aws.amazon.com/connect/latest/adminguide/ctr-data-model.html#ctr-ContactTraceRecord.You can access these via Kinesis Stream or Kinesis Firehose - for setup instructions see https://docs.aws.amazon.com/connect/latest/adminguide/data-streaming.htmlCommentSharelukwarneanswered a year agoAbdul Qayyum a year agoI don't want to use Kinesis but GetObject API to get the object from S3.Sharelukwarne a year agoUse Kinesis to get the S3 location when the CTR is emitted. Then you can use that in the GetObject API.Share0Instead of finding the filename from CTR, you can try to trigger off the S3 Put Object, with this, you get the filename.  And the filename of the object has the Contact ID which you can get the rest of the info using Describe Contact API (not all the info from CTR).However, it is highly recommend that you store CTR through Kinesis to somewhere as CTR is the only source to have the full meta data of a Contact (including S3 location of the call recording)CommentShareClarenceChoianswered 6 months ago"


Question: [GO SDK V2] NAT gateway - get availability zone

"Hello,I'm trying to determine the availability zone of a NAT gateway in an account, not just for one, but for a list of NAT gateways one after another.As far as I understand, when calling ec2Client.DescribeNatGateways() the NAT's availability zone is not provided.In order to get the AZ, I'm doing another API call to ec2Client.DescribeSubnets with the NAT's subnet ID,Only then the AZ is in the output.As I'm making a multiple API calls, this could be time-consuming.I was wondering what is the most efficient way to determine the NAT's AZ?Thank you,Ori AdlerFollowComment"

Answer: "1Accepted AnswerYou can pull the list of AZs from the ENIs. Here is the CLI:aws ec2 describe-network-interfaces --filters Name=interface-type,Values=nat_gateway --query NetworkInterfaces[*].AvailabilityZoneCommentShareEXPERTkentradanswered a year ago0The response to DescribeNatGateways does include the subnet id which can be used with DescribeSubnets to determine the availability zone.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: Custom specification RDP

I want to create custom specification rdp.. i want 2 vcpu and 8 gb ram and Tesla t4 for gaming cloud server.. can anyone help me to guide how to create it..Yours trulyHassanFollowComment


Question: Greengrass IPC using c

"Hello,We have a Lambda executable developed using [1] as mentioned here - [2].This is working completely fine with Greengrass Version 1 (GGv1)We are currently exploring the Greengrass Version 2 (GGv2).Since Lambda executable is not supported in GGv2 . We followed a client device pattern as mentioned here - [3]The only time you would use the client device pattern is if your components are written in a programming language where an AWS IoT device SDK exists. In that case you can have a component act as a client device, but you will have to manage the creation of a thing and certificate in AWS IoT Core.This is working well but we came across an issue recently.The custom component developed using client device pattern fails to connect with the Greengrass core when Greengrass core is not connected to internet.The same issue does not occur when component is developed to perform IPC using AWS IoT Greengrass Core IPC libraries [4].We wanted the custom component we developed using client device pattern to work in consistent like other components developed using AWS IoT Greengrass Core IPC libraries [4] .Question 1 - Is it the correct approach to use client device pattern ?We also thought about few alternative approaches as below -As mentioned here [7] , we can use [6] . But this wont seem to be feasible to convert complete application already written in C to C++It seems it is possible to perform IPC by writing custom code [5]Question 2 - if it is the better approach to write custom code to perform IPC. How feasible is this approach, I mean is it possible to do the same. Could some one provide some steps or guidelines or links to do the same?Could some one help with the above queries?Thank you.References -[1] - https://github.com/aws/aws-greengrass-core-sdk-c[2] - https://docs.aws.amazon.com/greengrass/v1/developerguide/lambda-functions.html[3] - https://aws.amazon.com/blogs/iot/implementing-local-client-devices-with-aws-iot-greengrass/[4] - https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-service-connect[5] - https://forums.aws.amazon.com/thread.jspa?messageID=973781&#973781[6] - https://github.com/aws/aws-iot-device-sdk-cpp-v2[7] - https://forums.aws.amazon.com/message.jspa?messageID=994773#994773FollowComment"

Answer: "0Accepted AnswerHi,So from what I understand, you want to develop a component which can run your executable and talk to Greengrass core.I think the best path forward is to use the C++ IPC SDK as you pointed out [6]. It should be pretty straightforward to write a layer over the C++ SDK to expose the functionality you need (Make sure the symbols are not mangled - example method https://isocpp.org/wiki/faq/mixing-c-and-cpp#call-cpp). You won't need to rewrite your existing C application.I want to hear what are the challenges you think you will face with the approach. ThanksPS. I have used this approach to use C++ SDK from C code but don't have the code handy ATM.CommentSharesushantAtAWSanswered 2 years ago0Hi sushantAtAws,Thank you for the response.It seems it could be possible as suggested by you to write a layer over the C++ SDK to expose the functionality and looks the better approach.I am able to run the mixed C and  C++ code.Thank you so much again.CommentShareedgegoldberganswered 2 years ago"


Question: Publish emails with attachments having size greater than 256kb

We have .net 6 application from where we are publishing email/text notification using masstransit and subscribing in another application from same solution. Publishing email with attachment is working fine if file size is less than 256kb though it's failing to publish email if attachment size exceeds 256kb size limit. The question here is how can i publish such emails with attachments exactly?Please find the exception i am getting while publishing email with big size attachement*Amazon.SimpleNotificationService.Model.InvalidParameterException: Invalid parameter: Message too long ---> Amazon.Runtime.Internal.HttpErrorResponseException: Exception of type 'Amazon.Runtime.Internal.HttpErrorResponseException' was thrown. at Amazon.Runtime.HttpWebRequestMessage.GetResponseAsync(CancellationToken cancellationToken) *FollowComment

Answer: "0Hi, there are specific libraries to have attachments up to 2 GB: can you use 1 of those languages for those big messages?See https://docs.aws.amazon.com/sns/latest/dg/large-message-payloads.htmlSee also "Message publishing and batching" in https://aws.amazon.com/sns/features/CommentShareDidier_AWSanswered 12 days ago0Thank you for the quick response though unfortunately we do not use java or python.CommentShareShripad Godseanswered 12 days ago"


Question: Do public static IPs on VGW (two tunnels) remain the same for life of VGW?

A customer need to use static public IPs of VGW in VPN connection for routing purposes. Can we guarantee that VGW IPs will stay the same?FollowComment

Answer: "0Accepted AnswerVGW IP's should stay the same throughout the life of the VPN connection. As long as they have the particular VGW attached, they will have the same IP's  When they download the config, we generate these IP for them and the connection is established to these IP's form the Customer gateway IP and we will never change these.CommentShareAarthi_Ranswered 7 years ago"


Question: Route53 DS record has wrong keytag

"I have example.com registered with AWS.For top level zone, added a KSK key and activated DNSSEC to use that key.Went to registered domains console, selected example.com, "Manage keys" and added the content of the "Public key" from the previous step (content of "Establish a chain of trust" -> "Route 53 registrar").dig example.com @8.8.8.8 DS;; ANSWER SECTION:example.com.21600INDS**2___7** 13 2 E4B...44 42...48example.com.21600INDS**1___7** 13 2 18A...C8 BB...86=> returns the proper record, except the Key Tag which is one less (-1) compared to the value inside the Key details page.I tried this a second time, adding a second key, and I get the exact same result.For the child zones / subdomains, I added myself the DS record, and it works correctly.When testing the top domain here: https://dnssec-analyzer.verisignlabs.com/example.com all is good except 2 errors:None of the 3 DNSKEY records could be validated by any of the 2 DS records - I need to mention here that I do have 3 keys right now -> one I added by mistake and deleted it, but is not yet propagated (for the next 2 days most likely)The DNSKEY RRset was not signed by any trusted keysI don't know the details of DNSSEC internals, but having a different value for the KeyTag in the DS record might cause the issue as it will generate a different SHA. As the DS record for top level is not added manualy, but by adding the pub key and derived from there, could this be an issue with Route53 / AWS related?delv @8.8.8.8 example.com;; broken trust chain resolving 'example.com/A/IN': 8.8.8.8#53;; resolution failed: broken trust chaindig example.com @8.8.8.8 DNSKEY...;; ANSWER SECTION:example.com.3600INDNSKEY256 3 13 wyTR...Fxu+ /+R+Zr...Q== **-> wrong deleted key**example.com.3600INDNSKEY257 3 13 3wV0...OxK qKFjjm...A== **-> first key**example.com.3600INDNSKEY257 3 13 6NVX...Io0 J11HP...Q== -> **second key**These keys in the response are split between 55 and 33 characters, but they contains proper value when the two parts are concatenated. Not sure if this is how is formatted by dig, or this is normal as the key contains sha/salt or if this is OK as is.Thank you in advanced for any support!FollowComment"

Answer: "0Accepted AnswerFor anybody else having this issue: the key type had to be KSK and not ZSK. I assume the 1 unit difference between the actual key tag in the pub key and the value returned by dig - that is the DS record, should of tell me the problem, but for that I most likely needed to know very in depth the way DNSSEC derives the KeyTag, and all the components actually from the PUBKEY.Thank you all people that tried to look into this and good luck!CommentShareTonianswered 2 months ago"


Question: When can I cancel an ec2 export?

"I tried to cancel while exporting ec2, but the following error occurred.An error occurred (IncorrectState) when calling the CancelExportTask operation: Task can not be cancelled at this stage:It is said that it cannot be canceled at this stage, but when can it be canceled?FollowComment"

Answer: "0Hello,There are two reasons why the error occurred:The export task is completedIt is in the process of transferring the final disk imageMore information can be found here:https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelExportTask.htmlHope it helps!CommentSharepehjxanswered 3 months ago"


Question: Unable to Relaunch Elasticsearch Connector for AWS Glue from Marketplace

"Prior, I was able to Subscribe to Relaunch Elasticsearch Connector.Upon subscribing and following the instructions on that page, I ended at "Configure this software" in the Elasticsearch Connector Marketplace subscription.Upon choosing "Glue version 3.0" and selecting software version "7.13.4-2", initially, I was met with a box labeled "Usage instructions", which I was able to follow, get SecretsManager set up successfully.Initially, I was met with a generated link below "Usage instructions" reading "Deployment template: Activate connector in AWS Glue".  Upon clicking this convenient link, I was taken to "AWS Glue Studio > Connectors" page in my account, with a generated MARKETPLACE type connector.Through trial and error in getting the connector set up, I had along the lines deleted this MARKETPLACE connector, with seemingly no obvious way to restore or retrieve it.After googling around, I was unable to find any similar issues as this, so I attempted to unsubscribe and re-subscribe to the Marketplace connector.Upon doing so, and reaching "Usage instructions" (on Relaunch Elasticsearch Connector), the option "Deployment template: Activate connector in AWS Glue" had disappeared with no apparent way to re-create this MARKETPLACE connector in glue.Is this expected behavior for Marketplace custom glue connectors, and, if so, are there any steps to properly recreate a MARKETPLACE custom connector within my account?FollowComment"

Answer: 0If you have deleted the connector and wanted to relaunch another connector you can navigate to Marketplace subscriptions page  and click on "Launch more software" which would redirect you to the page where you can choose the fulfillment option and "configure to launch" like you did the first time.I was able to delete the connector and create a new one from my subscription with exact same instructions as initial launch. Try once again to see if you are able to replicate and report back.CommentShareSoumyaanswered 7 months ago


Question: Why does AWS DynamoDB separate RCU and WCU

"Why does AWS DynamoDB separate RCU and WCU? Azure CosmoDB uses a single RU model. A unit write is considered 2 RU while a unit read is 1 RU. Why doesn't Dynamo use this simpler model? Also if I need lots of RCU and very little WCU, can I convert some of my WCU into RCU in reservation?FollowComment"

Answer: "1DynamoDB uses separate models as both are different in terms of cost and it also allows customers to ensure the have enough capacity for their application needs.1 WCU = 1 write of item size 1kb1 RCU = 1 (strong) read of item size 4kbYou also have Transactions pricing and eventually consistent readsOf course DynamoDB could have had a single unit of measurement, but this was restrictive as customers want to ensure they have the correct throughput for their needs. For example, imagine your application is read heavy, and the application consumes 10,000 RCU, and you also have daily jobs which load data into the table, which consumes WCU, the write traffic will have zero impact on your customer traffic. In a shared model, there is a chance that your daily load could over consume and cause your application to throttle.Also if I need lots of RCU and very little WCU, can I convert some of my WCU into RCU in reservation?No, but if you need lots of RCU and little WCU, then you just provision your table to suit your needs. You can also let DynamoDB handle your capacity needs by using On-Demand mode which will handle of all your scaling needs instantly.CommentShareEXPERTLeeroy Hannigananswered a year ago0DyanmoDB is a distributed System. Write Operations are more complex than read operations.You can increase your WCU and RCO as often as you want and decrease up to 27 times a day for more details follow this link https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Limits.html#default-limits-throughput-capacity-modes.You can also use Autoscaling for these values. https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/AutoScaling.htmlCommentShareMarcoanswered a year ago"