Question: Root cause for AWS EC2 disconnection.

"Hi,One of our production EC2 instances (Ubuntu 18.04 OS) became unreachable and we were unable to connect it via SSH. We rebooted the instance and then we were able to connect after that. Can someone point me to where should we check for the root cause for this problem? I could not find any useful info from the Instance's system logs as well.FollowComment"

Answer: "0Actually, it was almost at 0% utilization.This is the first time we faced this issue. Instance type is c5.2xlarge. We have also checked the disk usage. It was at 55%.Is there a possibility of some internal OS error on Ubuntu, that might have crashed it and made it unreachable? If yes, where could I find the logs?CommentShareAWS-User-4594572answered 9 months agoSyd 9 months agoServer logs are saved in /var/log directory. You might want to check kern.log or syslog to rule out OS crash.Share0You should have a look at the Metrics for the instance. Especially the CPU Utilization, Status check failed metrics. See if there was high CPU utilization around the time you had to reboot instance. Depending on the instance type also look for CPU credit usage and balance.Is it a recurring issue or one-off incident? What is the instance type?CommentShareSydanswered 9 months ago"


Question: Aws scheduler doesn't seem working

"Hi,I'm following this guide to add schedule to start and stop my ec2 instanceshttps://docs.aws.amazon.com/solutions/latest/instance-scheduler-on-aws/solution-overview.htmlI tried the default tag running and stopped who worksBut when i use my tag "company-office-hours" it don't work{  "type": {    "S": "schedule"  },  "name": {    "S": "company-office-hours"  },  "description": {    "S": ""  },  "periods": {    "SS": [      "office-hours",      "office-hours-lunch"    ]  },  "timezone": {    "S": "Europe/Paris"  }}{  "type": {    "S": "period"  },  "name": {    "S": "office-hours"  },  "begintime": {    "S": "08:00"  },  "description": {    "S": "Office hours"  },  "endtime": {    "S": "20:00"  },  "weekdays": {    "SS": [      "mon-fri"    ]  }}{  "type": {    "S": "period"  },  "name": {    "S": "office-hours-lunch"  },  "begintime": {    "S": "14:00"  },  "description": {    "S": "Office hours"  },  "endtime": {    "S": "12:00"  },  "weekdays": {    "SS": [      "mon-fri"    ]  }}ThanksFollowComment"

Answer: "0Verify that the schedule is set up correctly: Make sure that the schedule you set up, "company-office-hours", is configured correctly. Double-check that the periods and timezone are set up correctly. Also, verify that the periods "office-hours" and "office-hours-lunch" are set up correctly, and that the days of the week and times match what you expect.Check the CloudWatch events: Make sure that the CloudWatch events are set up correctly and that they're triggering the correct Lambda function. You can check this by going to the CloudWatch console, selecting "Events" from the left-hand menu, and verifying that the events are present.Check the Lambda function: Make sure that the Lambda function is working correctly. You can check this by going to the Lambda console, selecting the function, and looking at the CloudWatch logs for any errors.Check the IAM role: Make sure that the IAM role associated with the Lambda function has the correct permissions to start and stop the instances. You can check this by going to the IAM console, selecting "Roles" from the left-hand menu, and verifying that the role has the correct permissions.CommentShareTasadduq Burneyanswered 4 months ago"


Question: Terraform for delegated admin IAM Access Analyzer

"Hi,Do we have terraform code/support for delegating admin for IAM Access Analyzer. I can see terraform resource blocks for delegated admins of securityhub or guard duty but not for IAM Access Analayzer.If it is not available can anyone suggest me any other ways to achieve using terraform.FollowComment"

Answer: 0You can add a delegated admin for IAM Access Analyzer using the following code:resource "aws_organizations_delegated_administrator" "iam_access_analyzer" {  account_id        = "1234567890" # DELEGATED ADMIN ACCOUNT ID  service_principal = "access-analyzer.amazonaws.com"}Terraform resource documentation: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_delegated_administratorCommentShareSean Nixonanswered 12 days ago


Question: Large amount of time spent in "com.amazonaws.services.glue.DynamicFrame.recomputeSchema" in Spark/AWS Glue

"Dear GlueCommunity,I'm using PySpark with AWS Glue for a large ETL job. Most of my source data sit in an AWS RDS Postgres instance. I read all my tables directly with create_data_frame.from_catalog because the logic is quite complex and implemented in pure PySpark, I don't use Dynamic Frames at all except when writing the final data back to S3.The first thing that puzzled me in the AWS Glue documentation was this part :https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-pyspark-extensions-glue-context.html#aws-glue-api-crawler-pyspark-extensions-glue-context-create-dataframe-from-catalogcreate_data_frame_from_catalogcreate_data_frame_from_catalog(database, table_name, transformation_ctx = "", additional_options = {})Returns a DataFrame that is created using information from a Data Catalog table. Use this function only with AWS Glue streaming sources.Can someone explain to me why we are not supposed to use create_data_frame_from_catalog with non streaming-sources ? In my case none of my sources are streamed, so would it change anything to do instead  create_dynamic_frame_from_catalog().toDF() ?However, my main problem is that one of my source data sits in S3 and is quite large (for my standards, 1To as gzip CSV). I configured the crawler and added the table into my glue database, the schema consists of only 3 columns. Everything seems in order for this table in my glue database.However, when I try & create a Data Frame for this table with create_data_frame.from_catalog, I get an additional Spark Stage which mostly consists of :fromRDD at DynamicFrame.scala:320org.apache.spark.sql.glue.util.SchemaUtils$.fromRDD(SchemaUtils.scala:74)com.amazonaws.services.glue.DynamicFrame.recomputeSchema(DynamicFrame.scala:320)com.amazonaws.services.glue.DynamicFrame.schema(DynamicFrame.scala:296)com.amazonaws.services.glue.DynamicFrame.toDF(DynamicFrame.scala:385)sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)java.lang.reflect.Method.invoke(Method.java:498)py4j.reflection.MethodInvoker.invoke(MethodInvoker.java:244)py4j.reflection.ReflectionEngine.invoke(ReflectionEngine.java:357)py4j.Gateway.invoke(Gateway.java:282)py4j.commands.AbstractCommand.invokeMethod(AbstractCommand.java:132)py4j.commands.CallCommand.execute(CallCommand.java:79)py4j.GatewayConnection.run(GatewayConnection.java:238)java.lang.Thread.run(Thread.java:748)It's unclear to my why Recomputing the Schema would be necessary as the table with the schema is already incorported into my glue database and there is no reason to assume it has changed. At the moment with 5 G2.X workers, this step takes around 12 hours.After reading about the AWS Glue streaming sources and create_data_frame.from_catalog, I tried loading the dataframe with create_dynamic_frame_from_catalog().toDF() but this step of schema recomputing occured nevertheless.Does someone have any idea why recomputing the schema is necessary at that step? Could I force non recomputation in some way or another?A more general question would be, is there any other way to have this To of data accessed more efficiently than in S3 ? I don't want to put that in an AWS RDS instance because these data would be very infrequently accessed, should I be looking at something else, DynamoDB, etc ?Thanks a lot for your help,FollowComment"


Question: Request new tag for AWS@dotnet

"It would be beneficial for the aws, partner and customer dotnet development community to be able to use re:Post to have questions and answers related to dotnet @ AWS.  This would help foster collaboration, communication, promotion and problem solving for dotnet developers using AWS tools and services.The tag would be **AWS dotnet **.The nature of the tag would be for all developers to post all dotnet related questions when working together with AWS tools and servicesFollowComment"

Answer: "1Accepted AnswerAWS-User-1215880,Thank you for your suggestion. We will contact you offline to learn more about this.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: RDS-Database Masteruser-notifications

"Hi , i want to get an SNS notification when any RDS Database master user created or any changes on database  master user. How to configure.Not for RDS events.FollowComment"

Answer: "0One way to go about it would be to use Audit logs and create a metric filter. Use it to create a event rule, configure your notification for it.I haven't tried it but you can test thisCommentSharerePost-Azamanswered 7 months ago0What dbms is on your RDS server, btw?CommentSharekeklineanswered 7 months ago"


Question: aws support case unassigned for over 24 hours

"hello we have a support case that remained unassigned for 24 hours now, how can we escalate ?FollowComment"

Answer: "1Hello,The case SLA is dependent upon the Plan and the Case Severity. You mentioned the case is open since 24 hours. Which is your plan ? Developer, Business or Enterprise and also the Severity that was opened ?Check out the Case Severity section in the link mentioned below where everything is explained. with all the details.Link: https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year ago"


Question: Can I create attachments to more than one subnet in a sing AZ?

"I know that is sufficient to have only one to be able to reach all the VPC, BUT in my scenario I would like to have a different default route rule on each of the attached subnets to be able to scale in-line NAT instances.Is it possible ? Is 5 attachments per VPC a soft limit ? Anybody knows what is the maximum ?ThanksFollowComment"

Answer: "0After insisting in the searches, I think I found the answer to my own question: No. According to https://www.aviatrix.com/answers/does-aws-transit-gateway-allow-only-a-single-subnet-to-be-connected/ AWS explicitly states "you can only select one subnet per Availability Zone"..Sad.. Seems to make it difficult to have a transit VPC with scalable inline appliances...CommentShareRicardo Pereiraanswered 4 years ago0Not clear on what it is, exactly, that you are trying to do.  Are you trying to route all your outbound traffic from multiple VPCs through single VPC?  If not, please provide some more detail about the problem you are trying to solve.CommentSharecloudbuttonanswered 4 years ago0Yes. Implement a transit VPC for a large company that requires 3rd party inline appliances for egress (instead of "the open" NAT Gateway). As per proposal of https://aws.amazon.com/answers/networking/controlling-vpc-egress-traffic/ the solution to scale is having multiple subnets so that default route can point to multiple appliances.So far my conclusions is that with Transit Gateway one has to scale attachments to multiple "transit vpcs"...CommentShareRicardo Pereiraanswered 4 years ago0For reference found a better solution on NET402 re:invent session. Deploy the inline appliances on separate VPC, but connect those VPCs to TGW with IPSec attachments, so that with ECMP the different "default routes" of each are aggregated and fault tolerant... Not simple, not cheap, but does the job I guess.CommentShareRicardo Pereiraanswered 4 years ago"


Question: AWS CloudWatch Insights Console increased latency

"In the last week or so the cloudwatch console started taking a ridiculous amount of time to load.  I recall it taking 3-4 seconds but now it is taking 10+.  To repro, just try and hit this url if you are logged into the console:https://us-west-2.console.aws.amazon.com/cloudwatch/home?region=us-west-2#logsV2:logs-insightsWas there some change that caused this additional latency? I'm seeing the same results on two different internet connections.FollowComment"

Answer: "0Accepted AnswerToday, 5/30 the latency returned to normal in us-west-2.  Leaving open in case AWS wants to acknowledge they pushed a fix. Otherwise I'll mark this as accepted in a few days.Edit 6/2 Marking as accepted.CommentShareperpilanswered 5 days ago"


Question: Student use for Free account

"I have this account for a class that ends this semester, but I may need to use it again in the following year. I just got an email stating that my account has exceeded 85% of the usage limit for AWS free tier level. I have not gotten into this server for over a month. what do I need to do to turn it off until I need to use it again for a different class?FollowComment"

Answer: "0Hi @AggieIT24.Unfortunately, there is no way to pause the 12-month Free-Tier account. You can keep using your current account and limit yourself to the "Always Free" offerings (limited compared to the 12-month free). However, if the "always free" offerings doesn't cover your use case, you can also signup for the Free-tier account using a different email.For more info please check out this link.CommentSharedunix-awsanswered 6 months agoAggieIT24 6 months agoI just want to make sure that I do not get charged for this in the future. If I need it again, it will not be until February of next year. I have not been on the server for at least 6 weeks, not sure what use it is getting at this point.Share"


Question: API Gateway custom domain with base path missing from request

"I have created a custom domain in API Gateway and assigned it to a lambda proxy with a base path so that the root URI looks like "https://myapp.mycompany.com/mybasepath/". However, when inspecting the request object inside the lambda, I can't find any clue of "mybasepath" (Host is "myapp.mycompany.com" and path is "/"). How can I find out the original URI the API was called with?FollowComment"

Answer: "0According to the documentation the domain name and path should be part of the requestContext object.{  "resource": "/my/path",  "path": "/my/path",  "httpMethod": "GET",  "headers": {    "header1": "value1",  },  ...  },  "requestContext": {    "accountId": "123456789012",    "domainName": "id.execute-api.us-east-1.amazonaws.com",    "path": "/my/path",    ...  },   ...}Could you post the complete event object that gets passed to your Lambda function?CommentShareben-from-awsanswered 2 years agoEXPERTHernitoreviewed 2 years ago0The root of the API definition for a deployed stage will be /. If you want to define paths within your API definition you will need to create new resources for each path, then add your methods under each.So a new resource "Foo" will have a defintion for methods POST. Then the API URI would be "https://myapp.mycompany.com/mybasepath/Foo" which when you look in the Lambda function will show "path: 'Foo'"CommentSharepete-from-AWSanswered 2 years ago0Regarding to the host you should look at the Origin or Referer headers. Regarding to the the path resource you can look at the resourcePath attribute inside RequestContext object.This is an example of RequestContext from one of our lambdas:[accountId=0000000000, additionalProperties={}, apiId=s4f16syio4, httpMethod=POST, identity=Identity [accountId=null, additionalProperties={}, apiKey=null, caller=null, cognitoAuthenticationProvider=null, cognitoAuthenticationType=null, cognitoIdentityId=null, cognitoIdentityPoolId=null, sourceIp=X..X.X.X, user=null, userAgent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36, userArn=null], requestId=52d92640-9966-4671-a19d-20f018551d65, resourceId=6t3yjm, resourcePath=/graphql, stage=beta, path=/profile/graphql, authorizer=Authorizer{claims={sub=0d2c9c55-1602-4a46-81a6-ea32398bfcb8, email_verified=true, iss=https://cognito-idp.us-east-1.amazonaws.com/us-east-HHHHHHHH, cognito:username=email@host.com, origin_jti=6c269796-0004-4079-b41b-015f78eaafad, aud=3p0v8km6ogo63s59q8gnv5iaet, event_id=61fc1dbf-d02d-4fb6-b062-3795dd832f78, token_use=id, auth_time=1638208343, exp=Mon Nov 29 18:52:23 UTC 2021, iat=Mon Nov 29 17:52:23 UTC 2021, jti=32205f39-91d6-44c4-8e60-87507a7eba01, email=email@host.com}}]The attribute path is providing the base path plus the resource path.Hope this may help.CommentSharejgganswered 2 years ago0Thank you all for your help. First, I forgot to mention that my Lambda is based on .net Core 3.1. But even after deeper digging for the context data I could not find any clue of the base path. Only after switching from HTTP-API back to REST-API, PathBase finally shows '/mybasepath'.CommentShareAWS-User-2258024answered a year ago0I too having same issue and wondering if anyone has found a way to include the base path into the request coming to "lambda custom authorizer" ?  I see the person asked question moved to REST API to solve this problem but in my case i would like to stick to HTTP APICommentSharerePost-User-0722094answered 7 months ago"


Question: How can I define a table width in QuickSight?

"I have added a table into my QuickSight analysis that contains on each rows textual feedback on our service. The problem that I am facing is that some of the textual feedbacks are really long making the table width huge, as it tries to keep the texts in a single line. QuickSight handles viewing the whole line by adding a horizontal scroll bar to the table.For my usage this is nevertheless suboptimal, as I would like to create a pdf-report out of my analysis and the pdf creation tool will cut the texts on the pdf page width and leave textual content out of the table.What I would like the system to do is that if the text in an individual cell is really long, that it would increase the cell height and present the text in multiple lines.I have tried to do this by increasing shell height from Format visual > Cells > Row Height and checking the Wrap text checkbox from Format visual > Cells > Wrap text. Nevertheless, this only makes the cell height larger and does not limit the table width, so the texts stay in one line and does not wrap it.FollowComment"

Answer: "1Accepted AnswerHi -You are on the right track. You just need to do one more step.Increase Cell Row HeightMake sure "Wrap text" is checked**Hover over your column header divider and resize the column width. ** This will be dragging to left, smaller, and smaller until it's the size you want.The Cell Row Height will apply to all rows but you'll have wrapped text.CommentShareRobanswered a year agoAWS-User-2984292 a year agoThis was the correct answer to my question, even though it was not the outcome that I was seeking for... Having fixed cell height for the table makes the table pretty ugly as some of the cells have only little text and some have a lotShare"


Question: AWS SES Bulk Emails through Java

How to send email to bulk/multi-recepients using java AWS SES smtp. Is there any way to fetch email from csv or any file and send through java AWS SESFollowComment


Question: how to use custom_attribute in sagemaker api?

"based on documentation provided here -> https://docs.aws.amazon.com/cli/latest/reference/sagemaker-runtime/invoke-endpoint-async.htmlI am passing  a custom attributes parameter when calling the invoke-endpoint-async function.  invoke-endpoint-async--endpoint-name <value>[--custom-attributes <value>][--inference-id <value>]--input-location <value>are there any sample/example on how can i read this in my code before/after invoking my model for inference.I am creating a preprocessing file and have input_fn and predict_fn function, can value passed in custom_attributes during api call be read or written to the response here? also, if it can be written to the response like documentation says, where can i see it . as the async endpoint only gives the output location when invoked and later process the request, i don't see the response, i just see the dumped out file in the specified output location. how can i see the full response?sagemaker_model = TensorFlowModel(model_data = 'model_data_path',role = execution_role,framework_version = '1.12',source_dir ='src',entry_point = 'preprocessing.py', ...)file: preprocessing.pydef input_fn(request_body, content_type):    //read the custom attribute here FollowComment"

Answer: "0Additionally to AWS CLI, you can pass CustomAttributes parameter during invocation of endpoint with boto3-client or SM SDK:In case of boto3: runtime_client.invoke_endpoint(CustomAttributes=json.dumps({key1:val1, key2:val2, ...}))In case of SM SDK: predictor.predict(payload, initial_args={'CustomAttributes': json.dumps({key1:val1, key2:val2, ...})})And then you could parse the context-arg in the input-handlers of preprocessing.py, as for example:def handler(data, context):    processed_input = _process_input(data, context)    custom_attrs = json.loads(context.custom_attributes)    # logic to parse / enact custom attrs ...    response = requests.post(context.rest_uri, data=processed_input)    return _process_output(response, context)See also this post: https://aws.amazon.com/blogs/machine-learning/amazon-sagemaker-runtime-now-supports-the-customattribute-header/CommentSharealar0330answered a year ago"


Question: GreenGrass V2 with ECC Keys in a Secure Element

"How close is AWS in supporting pkcs11 ECC Keys in GreenGrass ?We are using ATECC608B's from microchip with AWS-IoT and that is already supported if we use our own mosquitto broker on the device, But for GreenGrass V2 this won't work currently.I see some pull requests for pkcs11 keys (and an announcement here)  and some for ECC so I assume it is on the Roadmap ? Is this a correct assumption ?  And if so, is there a timeline that we can get ?FollowComment"

Answer: "2Accepted AnswerWait no longer! ECC support is available in Nucleus 2.5.6 (https://github.com/aws-greengrass/aws-greengrass-nucleus/releases/tag/v2.5.6)CommentShareEXPERTMichaelDombrowski-AWSanswered a year agoclogwog a year agowhoa !!! and pkcs11 support is there as well ?ShareRob a year agoclogwog, PKCS#11 support has been present since Nucleus 2.5.3 (see docs). The latest release (2.5.6) pulled in an update to the AWS IoT Device SDK which added the support for ECC.Shareclogwog a year ago@Rob thank you !! this is very very good news for us !Share"


Question: AWS event Bridge

"Hi,Just want to check that by default in event bridge events are Processed in FIFO order. Can you please guide me how to change the priority/order of the event?RegardsJOFollowComment"

Answer: "0Accepted AnswerAmazon EventBridge does not guarantee the order of the events. It also does not support priorities. There are other native services that do support order, such as SQS FIFO queues or Kinesis Data Streams. None of them support priorities.CommentShareEXPERTUrianswered a year ago0It appears you are applying concepts from a message queue system to Event Bridge. You can think of each event as a unique thing, that will follow the rules and be sent to the targets you wish. If this doesn't work for your use case, you can consider Amazon Simple Queue Service or Amazon MQ.CommentShareRodney Lesteranswered a year ago"


Question: Connect remote sites using VPN to access on-prem via existing Direct Connect?

"Hello, we currently have a Direct Connect Link with a private VIF connecting a few VPCs to our on-prem environment, and it is terminated at a Direct Connect Gateway. We are planning to build some VPN tunnels to connect a few remote sites to one "hub" VPC, so would it be possible for the remote sites to route traffic back to on-prem via the "hub" VPC? Thanks!FollowComment"

Answer: "1Accepted AnswerThis is not supported.https://docs.aws.amazon.com/directconnect/latest/UserGuide/virtualgateways.htmlThe following traffic flows are not supported:...Direct communication between the virtual interfaces that are attached to a single Direct Connect gateway and a VPN connection on a virtual private gateway that's associated with the same Direct Connect gateway.For this type of communications, the recommended model is to use Transit Gateway (requires a Transit VIF) to route traffic between on-prem and remote VPN sites.https://aws.amazon.com/blogs/aws/new-use-an-aws-transit-gateway-to-simplify-your-network-architecture/CommentShareEXPERTSheng Chenanswered a year ago"


Question: Use AWS Toolkit in VSC with role switching

"I have to switch roles and for the cli I use aws-vault which works perfectly. In Visual Studio Code I would like to use the AWS Toolkit but it does not allow me to switch roles, it only provides using different accounts. Is there a way to switch roles so I can use AWS Toolkit? Thanks!FollowComment"

Answer: "1Yes, this works perfectly. The AWS Toolkit sees the profiles in my credentials file and not in my config file. Now, following the instructions in the StackOverflow post, I've added a profile in my credentials file and now I can switch role. Awesome! Thanks!CommentSharepeterlanswered 9 months ago0Accepted AnswerHello.The following Stack Overflow response may be helpful, and we would appreciate it if you could check if we can fulfill your request here. [1][1] amazon web services - How to switch or assume role from Visual Studio to access AWS resource - Stack Overflowhttps://stackoverflow.com/questions/65517748/how-to-switch-or-assume-role-from-visual-studio-to-access-aws-resourceI have actually been able to switch roles to another account in Visual Studio Code.CommentSharemn87answered 9 months ago"


Question: default event bus vs custom event bus

When to use default event bus and when to create our own custom event bus ?FollowComment

Answer: "1Accepted AnswerYou use the Default event bus for schedule based rules (although now I recommend using the new EventBridge Scheduler, which does not use any bus) or for events generated by AWS services.If you create your own application that generates events, I recommend to use a Custom event bus.CommentShareEXPERTUrianswered 4 months ago1Just in case If you need to have a queue to connect things I would suggest to create one pipe and distinguish destinations by preprocessing using filters, with no additional cost, pay only for events after filtering:  The new feature: EventBridge Pipes https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-event-filtering.htmlCommentSharealianinhoanswered 4 months ago1When you need to have different permissions on the bus. Generally, a good idea to have a separate bus https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-bus-perms.htmlCommentShareEvananswered 4 months ago"


Question: API Gateway unable to stream back generated PDF due to encoding type

"I have posted updates below as I have gone through troubleshooting and bug fixing in regards to this problem.I have a simple application that I have built that runs perfectly locally. A React front-end that takes some text inputs, and an Express backend that generates a PDF with the information, and streams back a PDF that is generated. The whole application works fine, as does testing a locally running as well as specifically hitting the endpoints using Insomnia running locally.The front-end is currently deployed in an S3 bucket being served through Cloudfront and is working fine. If I point an API request with Insomnia at my deployed API, the GET requests works fine, returning exactly what is expected, displaying the generated PDF in the content window.However when I make my POST request, I get some mixed messages. If I hit the POST in Insomnia I get back a 200, but the PDF that is returns is blank even though I verified that it did receive the POST body.If I use the deployed UI or my local UI pointing at the deployed API, I get a combination of errors.Access to fetch at 'API ENDPOINT URL' from origin 'MY UI ORIGIN' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.POST 'API ENDPOINT URL' net::ERR_FAILEDUncaught (in promise) TypeError: Failed to fetchThe second errors feel like false flags caused by possibly the first error. However I have CORS Enabled in my API Gateway and currently am allowing wildcarded access. And the GET request works fine. I also have enabled 'application/json' and 'application/pdf' in the Binary Media Types in the Gateway settings.I saw some posts from a few years ago indicating that API Gateway doesn't support streaming back a file but I am unsure if that is correct. If so, that means I need to come up with a different solution for serving up generated files to end users. Or if that has been changed, there is another error in my AWS implementation.UPDATE: I made some progress. For testing, I actually removed the OPTIONS method from my API Gateway. That actually removed the CORS errors, which was unexpected. The GET request stills functions as it did before and all responses come back as 200. However the PDF is malformed or corrupted. It still works locally, but the PDF coming back from the deployed API does not. I also get the same result from the Test function within API Gateway but can confirm it still works running locally.UPDATED PROGRESS:  After removing the rest of what appeared to be false flag errors, it has come down to API Gateway having challenges with encoding type. After making sure to have binary types being set within the API Gateway, within my code base, and having Accept headers set on the client, the returned document still appears to be encoded improperly. That is where this question is at now, as I continue to work on it.FollowComment"

Answer: "1First step would be to make sure it is not a CORS issue. Please take a look at this document from AWS Premium Support on how to debug CORS issues - https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cors-errors/Also please take a look at the instructions on this document to ensure you are following all the steps involved in handling binary data correctly in your API Gateway assuming you are using REST APIs - https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-payload-encodings-configure-with-control-service-api.htmlIf you are using HTTP APIs instead of REST APIs in AWS API Gateway, please follow the instructions here - https://aws.amazon.com/blogs/compute/handling-binary-data-using-amazon-api-gateway-http-apis/This article is also helpful - https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-binary-data-lambda/CommentShareEXPERTIndranil Banerjee AWSanswered 8 months agobehemothdan 8 months agoI appreciate your response. I updated the status of my question. So I removed the OPTIONS method from my API Gateway which surprisingly all three of my listed errors, however it still returns what appears to be a blank or corrupted PDF. Though this functionality works fine locally and through a testing suite. I have application/pdf set as an a binary type in the API Gateway settings, and testing it through Insomnia, I set an Accept header with / for testing purposes. Unfortunately, the PDF still returns blank. I get the same result when I use the Test function within API Gateway but can confirm the PDFs generate properly locally. I have read over those articles and it looks like I have tried a lot of what they are suggesting.Share0Accepted AnswerI feel like I should come back and answer this question in case someone in the future (probably even me) comes across it. The underlying issue was problems with the encoding type that was being returned by the API Gateway. All the errors I listed were side errors having to do with OPTIONS requests that weren't needed but were automatically created when I set up CORS (my API and UI are on different subdomains, which I know if I had set it up on the first one, it would have never needed CORS to being with).Within my API Gateway Settings, I did set Binary Media Types to include application/pdf and I did add headers to my initial API request from the UI with 'Content-Type': 'application/json', 'Accept': 'application/pdf'. The final issue had to do with how I was setting up the serverless deploy. My API was exporting module.exports.handler = serverless(app) but needed an additional configuration options that ended up looking like this:module.exports.handler = serverless(app, {binary: ['application/pdf', 'application/json']});After deploying that to my Lambda being served by API Gateway, this ended up resolving the issue and I was able to stream a generated PDF to the end-user.CommentSharebehemothdananswered 8 months ago"


Question: Least-privilege Cloudwatch Logs policy for API Gateway

"Hey!I'm trying to set up a new API Gateway through Terraform, and I'm having some trouble setting up the IAM policy for the cloudwatch logs role. I've created the log group, and set retention to 1 day, but I'm unable to create a policy that'll be accepted by the AWS console.My current (anonymised) effort looks like this:{    "Statement": [        {            "Action": "logs:DescribeLogGroups",            "Effect": "Allow",            "Resource": "*",            "Sid": "LogGroups"        },        {            "Action": [                "logs:PutLogEvents",                "logs:GetLogEvents",                "logs:DescribeLogStreams",                "logs:CreateLogStream"            ],            "Effect": "Allow",            "Resource": "arn:aws:logs:eu-west-1:123456789:log-group:API-Gateway-Execution-Logs_alphanum/stage:log-stream:*",            "Sid": "LogStreams"        }    ],    "Version": "2012-10-17"}When I try to set the cloudwatch log arn in the console, I get an error The role ARN does not have required permissions configured. Please grant trust permission for API Gateway and add the required role policy.. If I try to edit the policy in the visual editor, it doesn't seem to like the format of the resources, but I've checked those repeatedly against the docs.The trust relationship is straightfoward{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "",            "Effect": "Allow",            "Principal": {                "Service": "apigateway.amazonaws.com"            },            "Action": "sts:AssumeRole"        }    ]}Any ideas?FollowComment"

Answer: "2Accepted AnswerI think it's looking for all the permissions required based on AWS managed policy AmazonAPIGatewayPushToCloudWatchLogs as listed in this documentation: https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html#set-up-access-logging-permissions. Then, I don't think you can specify the log group, since API Gateway uses the same CloudWatch logs IAM role across the region (e.g other REST APIs in the region will use the same IAM role).The following sample should work:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "CloudWatchAccess1",            "Effect": "Allow",            "Action": [                "logs:GetLogEvents",                "logs:PutLogEvents"            ],            "Resource": "arn:aws:logs:<<aws_region>>:<<aws_account>>:log-group:*:log-stream:*"        },        {            "Sid": "CloudWatchAccess2",            "Effect": "Allow",            "Action": [                "logs:CreateLogStream",                "logs:DescribeLogGroups",                "logs:DescribeLogStreams",                "logs:FilterLogEvents",                "logs:CreateLogGroup"            ],            "Resource": "arn:aws:logs:<<aws_region>>:<<aws_account>>:log-group:*"        }    ]}CommentSharejoahnaanswered a year agoBobTheMighty a year agoAPI Gateway uses the same CloudWatch logs IAM role across the regionThis is the first time I've consciously seen this information written down. That's super-helpful, thanks. I'll revert to using the managed policy and just ensure I've created my log-group before provisioning the APIG.Share"


Question: Outgoing mail from ec2

"Hello everyoneI have a problem, mail server that I installed on ec2 cannot send email using the SMTP port, 465,587can anyone helpFollowComment"

Answer: "0Accepted AnswerDo you get any errors when you try to send an email?If you see an error, please share the message.Are the required ports and IP addresses allowed in security groups and network ACLs?CommentShareEXPERTRiku_Kobayashianswered a month agoAhmadge a month agomy message error "delayed, Status: 4.4.1 Cannot connect to remote host", i try to telnet port 465 or 587 from my windows on ec2, not connectingShareAhmadge a month agoAre the required ports and IP addresses allowed in security groups and network ACLs?Port 465,587 already allow in scurity group & network ACLsShareRiku_Kobayashi EXPERTa month agoThank you for sharing your message.We want to make sure that we can communicate with the mail server, so try running the telnet command with the global IP address of the EC2 instead of the domain.If you are able to communicate with the EC2 IP address, it is possible that the DNS settings are incorrect, so check that the MX record is registered correctly by using "nslookup" or similar.Check that EC2 is listening on port 465.If your EC2 is Linux, you can check the port number with the following command.lsof -i -PShare0CommentShareAhmadgeanswered a month agoRiku_Kobayashi EXPERTa month agoThank you for sharing your message.We want to make sure that we can communicate with the mail server, so try running the telnet command with the global IP address of the EC2 instead of the domain.If you are able to communicate with the EC2 IP address, it is possible that the DNS settings are incorrect, so check that the MX record is registered correctly by using "nslookup" or similar.Check that EC2 is listening on port 465.If your EC2 is Linux, you can check the port number with the following command.lsof -i -PShare0For others who are reading along, there is an article about this: https://repost.aws/knowledge-center/ec2-windows-email-server-issuesCommentShareEXPERTBrettski-AWSanswered a month ago"


Question: Request for addition of TLD ".bayern" to Route 53

"Hi Route 53 team,I own a domain with the TLD '.bayern' and would like to transfer it to Route 53. As the TLD is not available for registration/transfer at the moment I request to add the TLD '.bayern' to Route 53.Thanks in advance.FollowComment"

Answer: "0Hello, thank you for reaching out.I understand that you are requesting to allow .bayern TLD Transfer to Route 53Registering .bayern TLD within Route 53 is on the roadmap with no public ETAs.Having said that, you can create a Hosted Zone for .bayern domain in Route53 to use it as your DNS service provider. This means you can point your name servers at your current registrar to Route 53 to manage your DNS.Additionally, Route 53 Domains is currently directly accredited with .com, .net, and .org registries. All other TLDs are provided via third party registrar associates. To improve our level of service and support, we are actively working to become directly accredited with all other TLDs. In addition to improving our existing offering, we will become accredited with other registries to expand our TLD catalog. This work is currently in progress. We do not currently have dates to share for adding new TLDs.I recommend subscribing to https://aws.amazon.com/about-aws/whats-new/2022/ and filtering for "Networking & Content Delivery > Amazon Route 53" for updates specific to Route 53.Thanks!CommentShareSUPPORT ENGINEERshreyasAWSanswered a year ago"


Question: Error encountered while try to get user data - java.lang.NullPointerExcepti

"I created a Glue job, and was trying to read a single parquet file (5.2GB) into AWS Glue's dynamic dataframe,datasource0 = glueContext.create_dynamic_frame.from_options(      connection_type="s3",      connection_options={"paths": \\["s3://my-bucket-name/path"\]},      format="parquet"  )    then do something around datasource0  Job info:Spark2.4, Python3, Glue 2.0Worker type G.2x - 8 vCPU, 32G MemoryErrors from CloudWatch:[1] NullPointerException2020-11-13 00:27:56,873 ERROR \[readingParquetFooters-ForkJoinPool-1-worker-13] util.UserData (UserData.java:getUserData(70)): Error encountered while try to get user data  java.lang.NullPointerException  at com.amazon.ws.emr.hadoop.fs.shaded.com.fasterxml.jackson.core.JsonFactory.createParser(JsonFactory.java:871)  at com.amazon.ws.emr.hadoop.fs.shaded.com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2726)  at com.amazon.ws.emr.hadoop.fs.util.UserData.getUserData(UserData.java:66)  at com.amazon.ws.emr.hadoop.fs.util.UserData.<init>(UserData.java:39)  at com.amazon.ws.emr.hadoop.fs.util.UserData.ofDefaultResourceLocations(UserData.java:52)  at com.amazon.ws.emr.hadoop.fs.util.AWSSessionCredentialsProviderFactory.buildSTSClient(AWSSessionCredentialsProviderFactory.java:52)  at com.amazon.ws.emr.hadoop.fs.util.AWSSessionCredentialsProviderFactory.<clinit>(AWSSessionCredentialsProviderFactory.java:17)  at com.amazon.ws.emr.hadoop.fs.rolemapping.DefaultS3CredentialsResolver.resolve(DefaultS3CredentialsResolver.java:22)  at com.amazon.ws.emr.hadoop.fs.guice.CredentialsProviderOverrider.override(CredentialsProviderOverrider.java:25)  at com.amazon.ws.emr.hadoop.fs.s3.lite.executor.GlobalS3Executor.executeOverriders(GlobalS3Executor.java:171)  at com.amazon.ws.emr.hadoop.fs.s3.lite.executor.GlobalS3Executor.execute(GlobalS3Executor.java:103)  at com.amazon.ws.emr.hadoop.fs.s3.lite.AmazonS3LiteClient.invoke(AmazonS3LiteClient.java:189)  at com.amazon.ws.emr.hadoop.fs.s3.lite.AmazonS3LiteClient.invoke(AmazonS3LiteClient.java:184)  at com.amazon.ws.emr.hadoop.fs.s3.lite.AmazonS3LiteClient.getObjectMetadata(AmazonS3LiteClient.java:96)  at com.amazon.ws.emr.hadoop.fs.s3.lite.AbstractAmazonS3Lite.getObjectMetadata(AbstractAmazonS3Lite.java:43)  at com.amazon.ws.emr.hadoop.fs.s3n.Jets3tNativeFileSystemStore.retrieveMetadata(Jets3tNativeFileSystemStore.java:220)  at com.amazon.ws.emr.hadoop.fs.s3n.S3NativeFileSystem.getFileStatus(S3NativeFileSystem.java:860)  at com.amazon.ws.emr.hadoop.fs.s3n.S3NativeFileSystem.open(S3NativeFileSystem.java:1319)  at org.apache.hadoop.fs.FileSystem.open(FileSystem.java:790)  at com.amazon.ws.emr.hadoop.fs.EmrFileSystem.open(EmrFileSystem.java:207)  at org.apache.parquet.hadoop.util.HadoopInputFile.newStream(HadoopInputFile.java:65)  at org.apache.parquet.hadoop.ParquetFileReader.readFooter(ParquetFileReader.java:498)  at org.apache.parquet.hadoop.ParquetFileReader.readFooter(ParquetFileReader.java:476)  at org.apache.spark.sql.execution.datasources.parquet.ParquetFileFormat$$anonfun$readParquetFootersInParallel$1.apply(ParquetFileFormat.scala:544)  at org.apache.spark.sql.execution.datasources.parquet.ParquetFileFormat$$anonfun$readParquetFootersInParallel$1.apply(ParquetFileFormat.scala:538)  at org.apache.spark.util.ThreadUtils$$anonfun$3$$anonfun$apply$1.apply(ThreadUtils.scala:287)  at scala.concurrent.impl.Future$PromiseCompletingRunnable.liftedTree1$1(Future.scala:24)  at scala.concurrent.impl.Future$PromiseCompletingRunnable.run(Future.scala:24)  at scala.concurrent.impl.ExecutionContextImpl$AdaptedForkJoinTask.exec(ExecutionContextImpl.scala:121)  at scala.concurrent.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260)  at scala.concurrent.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339)  at scala.concurrent.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979)  at scala.concurrent.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)  [2] IllegalArgumentException2020-11-13 00:28:07,339 ERROR \[Executor task launch worker for task 21] executor.Executor (Logging.scala:logError(91)): Exception in task 20.0 in stage 1.0 (TID 21)  java.lang.IllegalArgumentException: Illegal Capacity: -168  at java.util.ArrayList.<init>(ArrayList.java:157)  at org.apache.parquet.hadoop.ParquetFileReader$ConsecutiveChunkList.readAll(ParquetFileReader.java:1163)  at org.apache.parquet.hadoop.ParquetFileReader.readNextRowGroup(ParquetFileReader.java:805)  at org.apache.spark.sql.execution.datasources.parquet.VectorizedParquetRecordReader.checkEndOfRowGroup(VectorizedParquetRecordReader.java:301)  at org.apache.spark.sql.execution.datasources.parquet.VectorizedParquetRecordReader.nextBatch(VectorizedParquetRecordReader.java:256)  at org.apache.spark.sql.execution.datasources.parquet.VectorizedParquetRecordReader.nextKeyValue(VectorizedParquetRecordReader.java:159)  at org.apache.spark.sql.execution.datasources.RecordReaderIterator.hasNext(RecordReaderIterator.scala:39)  at org.apache.spark.sql.execution.datasources.FileScanRDD$$anon$1.hasNext(FileScanRDD.scala:101)  at org.apache.spark.sql.execution.datasources.FileScanRDD$$anon$1.nextIterator(FileScanRDD.scala:181)  at org.apache.spark.sql.execution.datasources.FileScanRDD$$anon$1.hasNext(FileScanRDD.scala:101)  at org.apache.spark.sql.catalyst.expressions.GeneratedClass$GeneratedIteratorForCodegenStage1.scan_nextBatch_0$(Unknown Source)  at org.apache.spark.sql.catalyst.expressions.GeneratedClass$GeneratedIteratorForCodegenStage1.processNext(Unknown Source)  at org.apache.spark.sql.execution.BufferedRowIterator.hasNext(BufferedRowIterator.java:43)  at org.apache.spark.sql.execution.WholeStageCodegenExec$$anonfun$13$$anon$1.hasNext(WholeStageCodegenExec.scala:636)  at scala.collection.Iterator$$anon$11.hasNext(Iterator.scala:409)  at scala.collection.Iterator$$anon$11.hasNext(Iterator.scala:409)  at scala.collection.Iterator$$anon$11.hasNext(Iterator.scala:409)  at scala.collection.Iterator$$anon$11.hasNext(Iterator.scala:409)  at scala.collection.Iterator$$anon$13.hasNext(Iterator.scala:462)  at org.apache.spark.util.Utils$.getIteratorSize(Utils.scala:1817)  at org.apache.spark.rdd.RDD$$anonfun$count$1.apply(RDD.scala:1168)  at org.apache.spark.rdd.RDD$$anonfun$count$1.apply(RDD.scala:1168)  at org.apache.spark.SparkContext$$anonfun$runJob$5.apply(SparkContext.scala:2101)  at org.apache.spark.SparkContext$$anonfun$runJob$5.apply(SparkContext.scala:2101)  at org.apache.spark.scheduler.ResultTask.runTask(ResultTask.scala:90)  at org.apache.spark.scheduler.Task.run(Task.scala:121)  at org.apache.spark.executor.Executor$TaskRunner$$anonfun$10.apply(Executor.scala:408)  at org.apache.spark.util.Utils$.tryWithSafeFinally(Utils.scala:1360)  at org.apache.spark.executor.Executor$TaskRunner.run(Executor.scala:414)  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)  at java.lang.Thread.run(Thread.java:748)  Any insights? Thanks in advance!Edited by: jugu on Nov 12, 2020 8:41 PMEdited by: jugu on Nov 12, 2020 8:43 PMFollowComment"

Answer: "0Hi, is there any update of this issue?CommentSharenirodgalanswered 2 years ago"


Question: Glue ErrorCode 400 InvalidInputException Task allocated capacity exceeded limit message

"I'm trying to do a very basic transformation of a CSV in S3 to a parquet file using Glue. Whenever I set the job to run, it fails almost immediately with the error in the title. I have increased the max dpus from 0 to the default 1,000 (not sure why it started at 0), but am still getting this error when I try to run jobs. What's the fix here? The IAM role I am using to do this job has full AdministratorAccess.FollowComment"


Question: Lambda (private subnet) <- ingress request< - gateway

"Hi,I am baffled by a use case that I am not able to make sense of. Will appreciate some guidance. Here is the scenario.VPC:Created through Control Tower - Landing zone - Account creation.VPC has 1 public subnet and 3 private subnets.Public Subnet:I have Public Subnet accessible from IG per the route table configurations.Resources in a public subnet are mapped with SecurityGroups which allow internet access.Private Subnet:Each private subnet is mapped in a different route table which does not have a mapping to IG.There is no NAT Gateway in this scenario.Therefore, no ingress or egress requests outside of VPC.I do have VPC Endpoints for S3, Dynamodb, and KMS.NACL:Allows all inbound and outbound traffic from all sources. Just to keep this simple.Lambda:Lambda is created using advanced configuration and is configured to run in a private subnet inside the VPC.Lambda has a simple job of accessing KMS endpoint and listing all KMS-CMKS(s).Gateway:Created a public API with /GET Resource mapped to lambda. Straight forward stuff.Per my understanding, VPC only has one ingress point IG, not bringing peering or transit gateway or private links into the mix.Based on the above subnet design and routes, resources in the private subnet should not be accessible to requests coming from outside of VPC.  Right?However, when I issue the GET request to the API, API Gateway is able to invoke the lambda and able to get the results.I am really confused. Any help will be appreciated.Meanwhile, I will dig through the documentation.Regards,SandeepFollowComment"

Answer: "0Accepted AnswerAPI Gateway doesn't invoke the Lambda function using "the network" as you have defined it (VPC in this case).When you create an integration between API Gateway and a Lambda function you authorise API Gateway to invoke the function; and you provide permissions in Lambda for API Gateway to invoke it (it's a two-way operation)."Traffic" (in this case, the request from APi Gateway to Lambda and the response from Lambda to API Gateway) is carried across the AWS services control plane so you don't need to provide a network path for that to happen.Any network traffic generated by the Lambda function (for example, accessing a database or calling another AWS service) will (in your case) will originate from the network interface Lambda has on your private subnet.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: Amazon IVS Latency 15 seconds on iOS web?

"The expected IVS latency on https://ivs.rocks/ is ultra-low (2-5seconds), but according to https://docs.aws.amazon.com/ivs/latest/userguide/streaming-config.html, "If IDR/Keyframe is 2 seconds, stream-start latency will be approximately 9-12 seconds. ", How can we reach to ultra-low 2-5 seconds by using IVS? or I may misunderstand latency measurement.FollowComment"

Answer: "0There are 2 different latency parameters that may be causing confusion; stream-start latency and viewing latency.If the encoding source to IVS is using a IDR/KeyFrame of 2 secs, the channel stream-start latency will be in the 9-12sec range. This means live streaming and capturing the stream will take that long to become active.Once the IVS channel starts, if they player has incorporated the IVS Player SDK, then viewing latency (source-to-playing device) can achieve the 2-5s value. If the IVS Player SDK is not used, generic players will experience a longer viewing latency.Also, there is an IVS Mobile SDK for incorporation into mobile streaming apps that deliver to IVS. There are both IOS and Android Mobile SDK components.CommentShareMike-MEanswered 9 months ago"


Question: Migration from RDS x86 to RDS Graviton?

A customer is asking what is the potential complexity of migration of databases (MySQL and PotsgreSQL) between RDS x86 to RDS Graviton. He raised endianness as one of the reasons such migration may be complex and time consuming. Do we have examples of customers who did the migration and/or procedures that partners can follow to perform such migrations / estimate related effort?FollowComment

Answer: 0Accepted AnswerThe migration is actually extremely simple. You can just change the instance type to an m6g or r6g to leverage it. You can also setup a replica from the old primary across to a new Graviton instance. The endianness is the same across the chips so there is no complexity there.CommentShareAWS-User-3171097answered 3 years ago


Question: AWS SES takes too long to send emails (10-20 minutes)

AWS SES takes too long to send emails (10-20 minutes)I am using AWS SDK to send email with GOLANG.Emails to some users are taking too long to send. (10-20 minutes)The average number of emails sent to users per day is less than 20.I would be grateful if you can tell me how to speed up the email sending.FollowComment

Answer: 0Is communication to the SES taking a long time?Check the application log as it may be waiting to authenticate to the SMTP server.CommentShareEXPERTRiku_Kobayashianswered 2 months agoryan123 2 months agoI checked the application server logs and found nothing.Request to send email to AWS SES and subsequent behavior takes too long...I can't figure out the cause.Share


Question: Concurrent build limit exceeded without having an active code build

"Hello,Initially, our code build was stuck in the queue for more than 30 minutes. We changed the limit of concurrent builds to 1 in the hope that we would solve our stuck in queue problem, but now we can't even get the build to start. There is currently no other active build, but AWS tells us we can't have more than one active build. Any tipps?Error calling startBuild: Concurrent build limit exceeded. This build project has a limit of 1 concurrent build(s). Start the build again after other builds are complete, or edit project configurationFollowComment"

Answer: "0There are various account level quotas that AWS sets for new and existing accounts. Some of the quotas protect you from unpredicted cost skyrocketing when you just start the cloud journey, the other ones might be applied if AWS detects something unusual in your accounts (e.g. an open vulnerability, an expired credit card, ...)The best way to resolve this issue is contacting AWS Support and requesting the quota increase for the number of concurrent builds in AWS CodeBuild. If there are some things that need to be fixed in your account first, you will be informed about that. Otherwise, the quota will be increased, so you can run more than one build in parallel.It is also worthwhile to see if there is any codebuild project running as part of codepipeline as that might be adding up to the account level quota.CommentSharemehtanidanswered 4 months ago"


Question: Launch ec2 intances with CloudWatch alarms

"Hello, my goal is to launch ec2 instances from Python code. For now I’m launching them by using launch templates. I need to create an alarm for each instance but I don’t know how to assign alarm to launch template(if it is possible).Maybe there is a different approach for that?The main idea behind alarms is that they will stop instance if it is inactive.FollowCommentVaibhav J 2 months agoAre you using AWS SDK for Python?Share"

Answer: "3Accepted AnswerYou cannot directly assign a CloudWatch alarm to a launch template. However, you can create the alarm after launching the instance using the boto3 library in Python. Here's a step-by-step guide on how to launch an EC2 instance using a launch template and then create a CloudWatch alarm for each instance:First, install the boto3 library if you haven't already:pip install boto3Launch an EC2 instance using a launch template:import boto3ec2 = boto3.client('ec2')response = ec2.run_instances(    LaunchTemplate={        'LaunchTemplateName': 'your-launch-template-name',        'Version': 'your-launch-template-version'    },    MinCount=1,    MaxCount=1)instance_id = response['Instances'][0]['InstanceId']print(f'Launched instance with ID: {instance_id}')Create a CloudWatch alarm for the launched instance:import boto3cloudwatch = boto3.client('cloudwatch')# Replace 'your-instance-idle-metric' with the appropriate metric# and 'your-comparison-operator' with the desired operator# (e.g., 'LessThanOrEqualToThreshold')response = cloudwatch.put_metric_alarm(    AlarmName=f'IdleAlarm-{instance_id}',    ComparisonOperator='your-comparison-operator',    EvaluationPeriods=1,    MetricName='your-instance-idle-metric',    Namespace='AWS/EC2',    Period=300,    Statistic='SampleCount',    Threshold=1.0,    ActionsEnabled=True,    AlarmActions=[        'arn:aws:automate:your-region:ec2:stop'  # Replace 'your-region' with the appropriate AWS region    ],    AlarmDescription=f'Alarm for stopping idle instance {instance_id}',    Dimensions=[        {            'Name': 'InstanceId',            'Value': instance_id        },    ],    Unit='Seconds',    TreatMissingData='breaching')print(f'Created alarm for instance {instance_id}')The code above launches an EC2 instance using a launch template and then creates a CloudWatch alarm for the launched instance. The alarm will stop the instance when it's inactive, based on the specified metric, comparison operator, and threshold.CommentShareEXPERTsedat_salmananswered 2 months agorePost-User-7361479 2 months agoThank you! That's exactly what I needed.Share"


Question: Send MQTT Messages at specific time

"Hello,I have a smart home system with a smartphone app and actors that communicates via MQTT. I want to be able to set in the app that an actor turns on for a certain time. For example, I want to be able to set the actor to turn on for the next 10 minutes, but also to turn on every day at 10 o'clock for 5 minutes.My first idea was to use lambda functions, which then send the switch-off command after a delay. But this did not work.How can I implement something like this with AWS?FollowComment"

Answer: "1One option might be to use EventBridge scheduler to create different schedules. On each schedule you will send the appropriate message using a Lambda function or calling the IoT SDK directly from the scheduler.CommentShareEXPERTUrianswered 4 months agoTimon 4 months agoHi,thanks for youre answer. But how can I set the EventBridge from a lambda function? At the moment, I only see that I can create a static schedule that will fire my lambda function. But I want the App User to define its own schedule.ShareUri EXPERT4 months agoJust use the EventBridge SDK from within the Lambda function. Depending on your language, we have different SDKs. For example, if you use Python, you need to use boto3, and specifically, the create_schedule API call.Share1Hi @Timon,This is an interesting design challenge.  There are probably multiple ways to use AWS services in combination to meet this need.  I will share some thoughts in case they are helpful.First, you could implement the scheduling on the device or in the cloud:If on the device, it would work even when the device does not have a network connection.  Also, the timing could probably be more precise (for example, if you need < 1 second precision).  And if you have very large scale and devices that all act at the same time you may avoid some scalability challenges (ex: 5M devices all doing something at exactly the same time).  You could implement this such that the app and cloud manage the device's activity schedule, but the net result is always synchronized to the device, where the device uses the equivalent of a local cron to take actions at specific times.  Upon network re-connect, the device should always request its latest scheduled activity list from the cloud.  The feasibility of this depends on your device hardware and software - even highly embedded systems have timers but if you're working with an 8-bit microcontroller unit then perhaps it is not feasible.  The app/cloud would just manage the device schedule similar to any stored device settings, perhaps in Amazon DynamoDB, and probably use the device's shadow to store the net activity schedule and sync it to the device.If in the cloud, then as @Uri suggests Amazon EventBridge seems attractive.  The net effect of the app/cloud managing the device's activity schedule would be input to the EventBridge Scheduler.  An EventBridge scheduled task could trigger a Lambda, which then posts a message to an appropriate MQTT topic for the device.  Anytime a device activity schedule is changed, the net effect needs to be updated in the EventBridge Scheduler using the EventBridge API.  The act of updating the EventBridge Scheduler could be implemented in Lambdas resulting from device activity schedule changes, and a different Lambda would react to the EventBridge task to propagate the event to an MQTT topic.An alternative cloud implementation may use a software package (perhaps similar to cron) to trigger the events as scheduled.  But then you get into running containers or EC2 instances, auto-scaling them, patching them, etc.  This is why I think a use of Amazon EventBridge is attractive to pursue.I will also note that if you have so many device events that they are triggering very frequently (ex: every second, every few seconds, or at least many times per minute) you may find a polling design is a better fit.  In its simplest form, run a Lambda every X seconds (depending on the precision required, such as every 5 seconds) and have it query for the events that are 'due'.  In its simplest form, query a database like Amazon DynamoDB or an RDS.  Choose event storage and indexing to optimize for this frequent activity.  The triggered Lambda runs all the events 'due' within its frequency.  Since it only needs the nearest-term events, it would not have to query the entire database of scheduled activities if the act of editing the device schedules always updated the next events somewhere easy to find (a smaller dedicated table, or similar).Lastly, a combination of the above is possible.  Instead of polling, you do use an event scheduling service such as Amazon EventBridge.  However, you do not necessarily have to configure all future events into EventBridge - technically you only need the one next event time configured.  When the Lambda triggers, it takes the necessary action(s) for the 'due' event(s) (i.e., propagates them to the necessary device MQTT topics).  But then before exiting, it queries for the next soonest event (or set of events that are scheduled at exactly the same time) and sets the next EventBridge scheduled event for that time.  Then when the Lambda subsequently triggers, it repeats the exercise.  You do also need to update the one "next Lambda trigger" event in EventBridge if any device schedule changes such that the soonest event time changes.  This option might be attractive if the frequency of events is common/continuous but not enough to justify polling overhead.Hopefully some of this information helps you design your product's user-scheduled-device-activities feature.  I think you will find some combination of Amazon EventBridge, AWS Lambda, and glue services (ex: Amazon SNS, Amazon SQS) to fit your needs.Regards,RyanCommentShareRyan_Manswered 4 months ago"


Question: EMR notebooks: Display / visualise data

"We use managed EMR notebooks for analysis of data stored on S3 using Spark. However whenever we render any HTML data e.g. KeplerGL / JSON display etc, it renders the IPython object reference instead of the actual html content. This prevents us from visualising data easily using EMR notebooks. There are a lot of documented examples for matlabplotlib but we couldn't find anything for JSON / HTML / KeplerGL / Other geo visualisation libraries.Example:from IPython.display import JSONJSON({    'string': 'string',    'array': [1, 2, 3],    'bool': True,    'object': {        'foo': 'bar'    }})Output:<IPython.core.display.JSON object>Similar question from Stackoverflow: https://stackoverflow.com/questions/66524337/produce-html-output-from-aws-emr-jupyter-notebookEnv details:Jupyterlab: Version 3.1.4EMR release label: emr-5.34.0 (also reproducible on emr-5.33.1)FollowComment"

Answer:
"0Did you try importing HTML? Your example only imports JSON.from IPython.core.display import HTMLThen you can try:display(HTML('
Hello, world!
'))CommentSharecisdevryanswered 19 days ago"


Question: How to check smdistributed-modelparallel version?

"According to the doc ( https://sagemaker.readthedocs.io/en/stable/api/training/smd_model_parallel_general.html ), there are different parameters depending on the version of smdistributed-modelparallel module / package. However, I am unable to find a way to check the version (e.g. via sagemaker python SDK) or just from the training container documentation (e.g. https://github.com/aws/deep-learning-containers/blob/master/available_images.md#huggingface-training-containers ).Any idea?Thanks!FollowComment"

Answer: "0Accepted AnswerHave not yet found a programmatic way to check the version.However, for each DLC (Deep Learning Container) available athttps://github.com/aws/deep-learning-containers/blob/master/available_images.md , we can look at the corresponding docker build files.E.g. for PyTorch 1.10.2 with HuggingFace transformers DLC, the corresponding dockerfile is here: https://github.com/aws/deep-learning-containers/blob/master/huggingface/pytorch/training/docker/1.10/py3/cu113/Dockerfile.gpuAnd we can see that the version: smdistributed_modelparallel-1.8.1-cp38-cp38-linux_x86_64.whl.CommentShareshern-tscanswered 10 months ago"


Question: AppSync Realtime Message Delivery Guarantee

"Hi,We're leveraging Appsync's real-time subscription/mutation capabilities in our app. Just wanted to check and confirm if there's any message delivery guarantee built-in in Appsync? What if the message is sent via WebSocket but not received by a web client (due to the nature of TCP)?is there some kind of Ack/retry mechanism?couldn't find much info related to message delivery guarantee (real-time WebSockets) in the Appsync docsFollowComment"

Answer: "0Hello!Maybe this sequence diagram can help you understand AppSync's GraphQL subscriptions mechanism.AppSync does not provide an ACK / Retry mechanism in case the client does not receive the event.However, I think it would have a considerable effort to manage any retry or guarantee mechanisms for each client.However you could do this test:Register a client to a subscriptionDisconnect client connection (simulating network failure)Invoke a mutationSee what happen client sideReconnect the network to the clientSee what happen client side.(I would expect that you will not receive the mutation event)I also recommend that you use the AWS suggested clients:https://docs.aws.amazon.com/en_en/appsync/latest/devguide/building-a-client-app.htmlCommentShareNoneNoneanswered a year ago0There are two main modes of "mobile notifications", one is based on store-and-forward messages such as Apple Push Notification Service (APNS) or Google's, and the second is based on push/subscriptions such as AWS Simple Notification Service (SNS).Most use cases of GraphQL and implementations are similar to the latter use case, which means that if the endpoint is not available the notification is dropped. These use cases are designed on the time-sensitivity of the notification and creating a long queue of all the notifications that you missed is usually less relevant. The assumption in these use cases is that if a mobile device is not connected to the network, the mobile application will pull the latest status of the data upon reconnection.CommentShareMLGuyanswered a year ago"


Question: Authentication providers with SFDC

"Hello there,Can someone please help me to share the steps/understanding to get the SAML authentication in place from SFDC side before accessing the AWS S3 bucket files.I can see there is setting where amazon cognito supports for the "Authentication Providers" and then "SAML" tab where "provider" and "arn" is the attributes.Also , please do let me know if this requires any help from any other team ? TIAThanks.FollowCommentChris_G EXPERTa year agoHave you tried using OpenID Connect (OIDC) instead of SAML or is there a specific use case for using SAML?ShareAWS-User-0219409 a year agoThere is ask for Ping based authentication. Thanks @Chris_G.Share"


Question: Set MaxConcurrentRuns and MaxRetries in Jupyter Notebook Job

"We have a Jupyter Notebook Glue Job and We're calling start_job_run from a Lambda with Python with boto3, we would like to change the default MaxConcurrentRuns (1) and MaxRetries (3) of the Job, as a Notebook we need to use magics, we already tried with magics and also we tried using Arguments in the Lambda that runs the Job, nothing seems to work, how should we set those settings to guarantee the Jupyter Notebook never will retry and will have a concurrency of 5, for example, we would like to have max 5 Jobs running at the same time.FollowComment"

Answer: 0You need to change the concurrency/retries on the job that you are triggering configuration (on the console or using boto3).That job is independent from your notebook session configuration.CommentShareGonzalo Herrerosanswered 3 months ago


Question: Rhytmic Noise Blasts on audio track when converting from ProRes HQ

"Hi there,I am building a converting service around MediaConvert using boto3 and it mostly runs as expected, returning informative error messages in cases it doesn't. So, firstly - thanks to the AWS engineering team for this piece of solid work, great job! :)The problem I face has to do with converting a set of ProRes 422 HQ files coming from the outside. No matter how I fiddle with the console settings, and I have been doing it for two days straight, the output's audio track always contains sharp waves of massive noise, hitting in even, ~1sec intervals. No converting errors occurred otherwise.What I tried:converting files from other sources into ProRes 422 Proxy (my desired format) -> no problem;converting the said, outside ProresHQ files into other formats, like .mp4,  with different video & audio codecs, settings. etc. -> the problem remains.Natural assumption would be that the input files are just broken -- but they're not, as the originals have a regular, audible audio track upon playing.Check it out:Input, OutputMy Example Settings JSONAs an AWS newbie I would really appreciate any hints towards possible source of the problem and  provide further info if necessary.ThanksFollowComment"

Answer: "0@JStrebeyko, do you have other sources in the same format that you can test with. There may be something wrong with the audio in the source you provided. Unclear what that may be.MediaConvert can work with ProResHQ sources with PCM S24 BE audio (the formats of your source). Running tests on the source you provided creates the same noise burst audio you detail, no matter what the audio output, even WAV files (that don' encode audio).Please submit an AWS Support ticket, specifically for MediaConvert and include the source file you have here. The MediaConvert team will be able to determine what may be the issue with the source audio, or if MediaConvert is having difficulty with ingesting it.Thanks. MikeCommentShareMike-MEanswered a year agoJStrebeyko a year agoHi there, thanks for the reply!Here are some more samples: https://app.renderro.com/shared-link/ZvCGaT7tJaThe captured video / audio are all outputs of the mainstream RED Komodo camera. Please note - the files themselves have a clear, audible audio track.The issue described above can be circumvented, if the file first gets muxed clean, like ffmpeg -i input.mov -c copy remuxed_input.mov. Unfortunately, the method does to scale well for our needs, the root cause is still sought.The ticket has been passed to the team. Will keep you updated.Share"


Question: Getting error "DataFormatConversion.SchemaValidationTimeout"

"I have a Kinesis stream which feeds into a Firehouse stream which outputs ORC to S3.All this has been working fine for about 2 years until about 2 days ago, when a new Athena table appeared named"format_conversion_failed (Partitioned)"And my primary Athena table that I use for my production data STOPPED being populated!In the "format_conversion_failed (Partitioned)" table I see a bunch of rows with all the same messages:DataFormatConversion.SchemaValidationTimeoutTimed out while retrieving table from Glue. If you have a large number of Glue table versions, please add 'glue:GetTableVersion' permission (recommended) or delete unused table versions. If you do not have a large number of tables in Glue, please contact AWS Support.I do not have a large number of Glue Tables (14). (2 are newly created by this error problem).Can somebody point me to how I can resolve this problem?FollowComment"

Answer: "0I was able to identify the problem. Leaving it here in case others hit this same error message. It had to do with us running a Glue crawler. This Glue crawler creates a new "version" of the table, even if nothing changed. Eventually you can build up SO many versions (we had 21k) that the Firehouse times out trying to get the schema for that table (apparently the large number of versions causes a problem there). Additionally, there is NO way to check how many versions you have in the AWS Console UI. The only way to see your count is if you "compare" versions, in the "compare" page it will show your version "id" which is just an incrementing integer, so this "id" would indicate your number of versions (assuming you dont delete them, which you can't do either through the UI).Our fix was to delete them manually, one-by-one, through the AWS CLI (assuming version "id" as an integer between 1 ... 21k (in our case)).So, lastly, as a warning to others. Don't use the GLUE crawler in an automated way (via scheduling) unless you intend to manually delete old versions. The crawler will not do that for you.Edited by: Jason Malcolm on Oct 22, 2020 1:41 PMEdited by: Jason Malcolm on Oct 22, 2020 1:41 PMCommentShareJason Malcolmanswered 3 years ago"


Question: Why am I not receiving "Out of the office" notifications?

"I use SES to send emails via Mautic to a variety of recipients. This also works without any problems. The bounce management also works.My problem is that I don't get any out of office notifications. When I try it with the test address ooto@simulator.amazonses.com it works. I get the out of office note delivered to the sender address.But when I test it with other email addresses that have an out of office notification set up, I don't get the out of office notification. But why?Does anyone have any idea what this could be?FollowComment"

Answer: "0It's possible that the email addresses you are testing with have their out of office notifications set to only send to specific email addresses or domains. Additionally, some email servers may not send out of office notifications to addresses that it considers to be automated messages, such as those sent by Mautic. It's also possible that the out of office notifications are being filtered to a spam or junk folder.You can try reaching out to the email addresses you are testing with to confirm their out of office settings, or contact the administrator of the email server to ensure that your messages are not being blocked or marked as spam.CommentShareDivyam Chauhananswered 4 months ago0I tried it myself with several email addresses from different providers. With none of them I get an out of office notification when I send via SES.However, all emails are delivered without any problems.Yesterday I sent a mailing to about 1600 contacts and did not receive a single out of office notice.For test purposes I let SNS send me notifications via email. When I send to ooto@simulator.amazonses.com, I get two notifications: One notification with the type delivery and one with the type bounce. If I send to another email address with an out of office note, I only get one notification with the type delivery:{   "notificationType":"Delivery",   "mail":{      "timestamp":"2023-01-24T12:14:33.924Z",       "source":"lorem@example.de",      "sourceArn":"arn:aws:ses:eu-central-1:166357261950:identity/xxx@xxxxxx.de",      "sourceIp":"94.134.xxx.xxx",      "callerIdentity":"root",      "sendingAccountId":"166357xxxxxx",      "messageId":"01070185e3b38fc4-8598e404-a827-4e99-xxxxxxxxxxxxxxxxxxxxx",      "destination":[         "ooto@simulator.amazonses.com"      ]   },   "delivery":{      "timestamp":"2023-01-24T12:14:34.636Z",      "processingTimeMillis":712,      "recipients":[         "ooto@simulator.amazonses.com"      ],      "smtpResponse":"250 2.6.0 Message received",      "remoteMtaIp":"63.32.xxxx.xxx",      "reportingMTA":"xxxxxxx.smtp-out.eu-central-1.amazonses.com"   }}{   "notificationType":"Bounce",   "bounce":{      "feedbackId":"01070185e3b39393-1160e5e3-633e-4c6e-9b09-xxxxxxxxxxxxxxxxxxxx",      "bounceType":"Transient",      "bounceSubType":"General",      "bouncedRecipients":[         {            "emailAddress":"ooto@simulator.amazonses.com"         }      ],      "timestamp":"2023-01-24T12:14:34.000Z"   },   "mail":{      "timestamp":"2023-01-24T12:14:33.924Z",       "source":"lorem@example.de",      "sourceArn":"arn:aws:ses:eu-central-1:166xxxxxxx50:identity/xxxx@xxxx-xxxxx.de",      "sourceIp":"94.134.128.230",      "callerIdentity":"root",      "sendingAccountId":"166357261950",      "messageId":"01070185e3b38fc4-8598e404-a827-4e99-xxxxxxxxxxxxxx",      "destination":[         "ooto@simulator.amazonses.com"      ]   }}Example of the other adress:{   "notificationType":"Delivery",   "mail":{      "timestamp":"2023-01-24T12:10:01.825Z",      "source":"lorem@example.de",      "sourceArn":"arn:aws:ses:eu-central-1:xxxxxxxxxxxxxxxxxx",      "sourceIp":"78.47.xxx.xxx",      "callerIdentity":"mautic-ses-smtp-user.20201218-xxxxxxx",      "sendingAccountId":"166357xxxxxxxxxx",      "messageId":"01070185e3af68e1-412b30b7-xxxxxxxxxxxxxxxxxx",      "destination":[         "oofo@example.de"      ]   },   "delivery":{      "timestamp":"2023-01-24T12:10:03.247Z",      "processingTimeMillis":1422,      "recipients":[         "oofo@example.de"      ],      "smtpResponse":"250 2.0.0 Ok: queued as E4911B320535",      "remoteMtaIp":"85.13.xxx.xxx",      "reportingMTA":"xxxxx-13.smtp-out.eu-central-1.amazonses.com"   }}CommentSharerePost-User-0018117answered 4 months ago"


Question: SSM Automation - Download file from S3 - Assume Role

"I am trying to figure out how to download file(s) from S3, using an SSM Automation document.  Note, this is not a "Command" document type, as I need to use Assume Role.  The instances themselves shouldn't have access to the bucket by default, which is why I need the Assume Role bit.  DownloadContent with a "Command" document type requires the instance to have the IAM policies/roles attached that can read the bucket.Is there a way to do this without having the iam policy on each instance being modified/have access to the bucket?FollowComment"

Answer: "0With the information provided the easiest way I would find to do this is to first create a role with a policy that allows access to the bucket, then assign the role through the sts:AssumeRole action on the instance profile.This should allow the instance to assume the role and have access to the bucket both manually and/or automating through SSM.CommentSharenissyangelanswered a year agoraithedavion a year agoYa, trying to do this without putting permissions on an instance I don't want them to normally have.  Really prefer to do this just through SSM's assume role.Share"


Question: RPO for Multiple-AZ RDS

"According to AWS FAQ, RPO for recovery with an RDS Single-AZ instance failure is typically 5 minutes. However, I do not find any document about RPO for multiple-AZ RDS(Mysql, Amazon Aurora,PostgreSQL). Any comments? If I need RPO is 1 minute, how to archive it?FollowComment"

Answer: "0Somewhat this depends on your definition of RPO. Under most definitions of RPO it is the interval between backups and is measured in hours. It only applies to situations in which your live data is completely lost and you need to recover using a copy not maintained in real-time. Because the database also backs up the log file, RPO can be brought down to minutes (vs other kinds of data volumes). But the preferred mechanism is to use multiple synchronously maintained copies so that your RPO under all but the most extreme circumstances is 0.If an RDS database instance's volumes were to be lost (logical or physical corruption), requiring recreating it from backup, then the RPO for Single-AZ, Multi-AZ, and even Aurora is typically around 5 minutes. That is the target interval for RDS to perform log backups to S3, so on a database volume loss you could have 5 minutes of log data that is also lost. There is no way to change the log backup interval, though that might be an interesting feature to add (hint: they would almost certainly have to charge for this as it would take a significant increase in resources behind the scenes to accomplish this at scale).With Single-AZ the only live copy of your data is the EBS volume that holds the data for the instance. While EBS uses mirroring of data under the covers to provide durability and availability, there are several scenarios where you would have no choice other than to recover from backups. In this case you might want to apply the 5 minute log backup interval as your RPO.With Multi-AZ the odds of data loss go way down because you have a separate synchronous copy of the volume being maintained in a separate data center (AZ). If your primary instance fails, you failover to the secondary instance with no data loss. There are far fewer scenarios where recreating the database from backup would be required, but there are still a few. Since volume-level replication is used, a corruption on the primary's volume may be replicated to the secondary's volume. And as rare as this scenario is, it would necessitate recovery from backups. I believe most customers think of Multi-AZ as having an RTO of 1-2 minutes and an RPO of 0, since they lose no data on any common failure. Again putting this into more traditional terms, even if a natural disaster were to destroy the data center housing the primary, the secondary would take over with no data loss. So assuming an RPO of 0 makes sense.With Aurora the odds of data loss take another significant drop as it maintains 6 copies spread over 3 AZs, and it does that at a granularity of 10GB. So if something does become corrupt then it is a 10GB chunk of which there are 5 other copies plus backup information on S3, making it easy to transparently recover that one copy of the 10GB segment.  There are almost no scenarios in which you would need to recreate the entire instance from backup. So truly an RPO of 0.Bottom line is that I think for availability purposes RDS offers an RPO of 0 minutes. The next step would be to decide if you have a separate RPO for disaster recovery purposes, and what your disaster recovery plan looks like. Maybe it is just backups, or cross-region snapshot copies, or cross-region read replicas. None of these can achieve an RPO of 1 minute BTW, but DR strategies rarely require that.CommentShareHalTempanswered 4 years ago0Thank you a lot, great answer with detailsCommentSharechenxganswered 4 years ago"


Question: questions on migrating DNS to route 53

"we have multiple sites we are migrating to route 53 this week.first question - we have set the TTL on the DNS provider we are moving FROM to a low number.  is the next step adding the amazon DNS servers to the list of Nameserves on the site that manages our domains (name.com), or do we wait for the TTL to replicate down, and then remove the old and add amazon?any issues with having both, since they are pointing to the same IP addresses (IPs not changing)secondly, when we had assistance setting up our domains on route 53, it looks like each domain has different DNS servers, is that normal?  our current provider only had 4, so I guess amazon has so many you can spread them out?FollowComment"

Answer: "0Accepted AnswerIn theory if everything is the same in both DNS providers, there shouldn't be an issue with the registar pointing to both sets of Name Servers; but I'm not sure there is a benefit that I can think of offhand. But there's no reason why it shouldn't work.For Route 53, in my experieince they always create 4 unique ( or at least seemingly unique ) Name Servers for a given zone record. So that is normal as far as my experience goes:;QUESTIONsubarusentinel.com. IN NS;ANSWERsubarusentinel.com. 21600 IN NS ns-1298.awsdns-34.org.subarusentinel.com. 21600 IN NS ns-154.awsdns-19.com.subarusentinel.com. 21600 IN NS ns-1786.awsdns-31.co.uk.subarusentinel.com. 21600 IN NS ns-889.awsdns-47.net.CommentSharelarryjklanswered 12 days agoEXPERTalatechreviewed 12 days ago"


Question: ssm patch manager to patch servers from other cloud vendors

How can i use ssm patch manager to patch servers from other cloud vendors?FollowComment

Answer: "0Accepted AnswerFrom an AWS perspective, servers hosted in other cloud vendors are external and are therefore exactly like on-premises servers.The instructions for using SSM for on-premises servers are here: https://docs.aws.amazon.com/prescriptive-guidance/latest/patch-management-hybrid-cloud/design-on-premises.html - they apply equally to servers in other cloud environments.You might also find IAM Roles Anywhere useful.CommentShareEXPERTBrettski-AWSanswered 7 months agoEXPERTTushar_Jreviewed 7 months ago0Dispatch manager have an agent? Often the AWS services allow you to download an agent of a service provided by AWS.CommentShareRolando Fenderanswered 7 months ago"


Question: Policy based VPN in AWS

A customer wants to establish policy based VPN connectivity from AWS to their data center.  I  looked at various documentation and still cannot determine whether we can support this or not.  Here are the links I’ve reviewed so far:http://www.mycodingpains.com/establish-policy-based-vpn-connection-aws-hardware-vpn/https://docs.aws.amazon.com/AmazonVPC/latest/NetworkAdminGuide/GenericConfigNoBGP.html#DetailedViewCustomerGateway6questions are:Can we do this with AWSWhat configuration setting makes the VPN setup policy based?  Route based?Thank youFollowComment

Answer: "0Accepted AnswerAWS Supports both Route based and Policy Based VPN (IPSec).If a customer wants to create Policy Based - that's perfectly fine, but there are some limitations.We support 1 Security Association, customer needs to initiate the traffic (we are responder only),only one tunnel will be UP in Policy-Based.Here you can find all the requirement:https://docs.aws.amazon.com/AmazonVPC/latest/NetworkAdminGuide/Introduction.html#CGRequirementsyou are limited to 1 unique Security Association (SA) pair per tunnel (1 inbound and 1 outbound), and therefore 2 unique SA pairs in total for 2 tunnels (4 SAs). Some devices use policy-based VPN and will create as many SAs as ACL entries. Therefore, you may need to consolidate your rules and then filter so you don't permit unwanted traffic.What is the device that customer is using on a customer site?Here is sample config for Policy-based VPN for Cisco ASA:https://docs.aws.amazon.com/AmazonVPC/latest/NetworkAdminGuide/Cisco_ASA.htmlCommentShareMichal Banswered 5 years ago"


Question: Adding policy to STS.assumeRole() angular / javascript

"I have a user role set up with the following permission:{            "Effect": "Allow",            "Action": ["s3:GetObject", "s3:ListBucket"],            "Resource": [                "*"            ]        }Using assumeRole() with this works as expected, however I am trying to programatically restrict access to sub folders so during the assmueRole call I add:{            Version: "2012-10-17",            Statement: [                {                    Effect: "Allow",                    Action: ["s3:GetObject", "s3:ListBucket"],                    Resource: ["arn:aws:s3:::BUCKET/SUBFOLDER/*"],                },            ],        }as the policy parameter (after JSON encoding it) but I then get 403 access denied when trying to access any of the folders root or otherwise.Setting the above as a policy in it's own right works fine too so the policy seems to be formatted correctlyHas anyone had this before or do am I doing something obviously wrong?FollowComment"

Answer: "0The resource for a ListBucket is a bucket and the resource for a GetObject is an object. Try splitting the actions out in to their own statements. With the ListBucket you can use a 's3:prefix' condition to restrict it. See: Actions, resources, and condition keys for Amazon S3.CommentShareEXPERTkentradanswered 4 months ago"


Question: Client.InstanceInitiatedShutdown: Instance initiated shutdown

My instance i-0e5918a1d7c652409 was shut down immediately after starting.The state reason: Client.InstanceInitiatedShutdown: Instance initiated shutdownDo you have any idea about this issue?FollowComment

Answer: 0I solved the problemCommentShareCuongDauanswered 3 years ago


Question: Can I Create API Gateway V2 in AWS Console?

"Can't I create an API gateway v2 from the AWS API Gateway console? REST API is used and set to region.However, the following error occurred when I tried to map API using a custom domain.API Gateway V1 doesn't support the slash character (/) in base path mappings. To create a multi-level base path mapping, use API Gateway V2.So I tried to find if I could specify V2 in the console, but I couldn't find it.Is there a solution?FollowComment"

Answer: "0Please refer to this blog - https://aws.amazon.com/blogs/compute/announcing-http-apis-for-amazon-api-gateway/API Gateway V1 had only REST APIs. API Gateway V2 added HTTP APIs and Websockets APIs.In your case, you can use HTTP APIs.Before you go too far down the path of adopting HTTP APIs, it would help to take a look at this document - https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-vs-rest.htmlIt will be good to base your decision on the features you need and whether those features are present in HTTP APIs or not.CommentShareEXPERTIndranil Banerjee AWSanswered 7 months ago"