Question: What is the cheapest way in AWS to return an HTTP 200 to a client?

I was having a discussion with some fellow developers today and this came up.  Sometimes before retiring an api you may need to return an HTTP 2xx to a client to avoid errors for a short period of time.I was thinking possibly an HTTP Lambda might be the cheapest but I'd love some feedback.FollowComment

Answer: "2If you're using API Gateway then you can create a mock endpoint that returns 200 without executing anything else. You only pay for the requests that you make and you may be eligible for the free tier: https://aws.amazon.com/api-gateway/pricing/CommentShareEXPERTBrettski-AWSanswered 4 months ago0It depends. If the APIs has crazy throughput Lambda may not be cheap after all. If access is infrequent then yes.Another idea could be to use S3, where you would host a dummy HTML page that would return 200. Depending if it has a Cloudfront distribution in front of, it may be a hack but definitely cheap too.CommentShareEXPERTalatechanswered 4 months ago"


Question: Using DMS to replicate single-tenant to multi-tenant DB structure.

"We have a PostgreSQL DB with single-tenant structure that include around 15k schemas. The data size is around 3 TB.We want to replicate the data of those schemas into one big MySQL multi-tenant DB.Note: all schemas have the same tables' structure, and the same for the target DB.Can DMS help us achieving that?FollowComment"

Answer: 0The Schema Conversion Tool is where you should start. There are options to use Glue to perform ETL as well. This may be your solution.CommentShareRodney Lesteranswered a year ago


Question: Set aurora_replica_read_consistency in DB cluster parameters

I'm trying to set the a default value for the parameter aurora_replica_read_consistency as in the docs https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-write-forwarding.html#aurora-global-database-write-forwarding-paramsThe parameter is missing from DB cluster parameters or DB parameters and it seems cannot be added manually. Is there a way to set a default value?Please note that setting this parameter for every session is not an option.FollowComment

Answer: "1Hi, thank you for asking your question.aurora_replica_read_consistency is session level parameter, so you cannot set this parameter via parameter group directly. However, please use init_connect to set this parameter instead. This parameter can be used for a string to be executed by the server for each client that connects. https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_init_connectPlease note:For users that have the SUPER privilege, the content of init_connect is not executed.Always set the aurora_replica_read_consistency parameter for any session for which you want to forward writes.If you set aurora_replica_read_consistency parameter by using init_connect, all connections will be enabled aurora_replica_read_consistency parameter. It means, every query will be forwarded to primary cluster. To avoid this per session, you need to set aurora_replica_read_consistency as blank using SET SESSION query.I hope this might help.CommentShareYUTAKA_Hanswered 5 months agogiupas 5 months agoThanks for the reply, the init_connect will do the trick.Anyway, the fact that is a session parameter is not incompatible to assigning a default value. It has already a default value chosen by AWS (the empty value) that affects the way the server works in a global scenario.Share"


Question: Unexposed functions in exposed Ebus?

"In UiTextBus.h there is a function SetSelectionRange(), but if I try to call UiTextBus.Event.SetSelectionRange(args) , I get "attempt to call field 'SetSelectionRange' (a nil value)".Is this particular function somehow not exposed to Lua? If so, what is causing that and how can I expose it?Follow"

Answer: "0Accepted AnswerHi @REDACTEDUSERYou are correct. That function is not exposed via the behavior context so it is not accessible from Lua.To see how functions from the bus are exposed to Lua take a look at UiTextComponent::ReflectThe section starting with:behaviorContext->EBus<UiTextBus>("UiTextBus")is the section that exposes methods from that bus.We probably did not expose that particular method because it seemed more of an internal method that the UiTextInputComponent uses rather than something that would be useful from Lua. I'm curious what your use case is.RobSharerePost-User-4854644answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-8353690answered 6 years ago0Thanks for the answer, that's very clear.I'm particularly interested in the zero length selection range to set a cursor between two characters on a screen with text. We are implementing a text input and display scheme that has functionality that is significantly different from a standard UI text input. I can't use the input component itself. Maybe this could be done by modifying an existing component, but I have no c++ experience.I'm also interested in highlighting a portion of the text, which is not supported in the text styling markup currently, but could be accomplished using this function.SharerePost-User-6682533answered 6 years ago0Thanks for the info @REDACTEDUSERWe have scheduled a task to expose this method to Lua. In the meantime you can add a line in the C++ reflect function to expose it if it is blocking you.SharerePost-User-4854644answered 6 years ago0Wow, thanks so much! I've moved the implementation of those features a little further down the line so it might be possible to put it off until you expose it. If not I know where to look in the c++. Thanks again!SharerePost-User-6682533answered 6 years ago"


Question: AWS Equivalent - Azure PlayFab

Does AWS have any equivalent product to Azures PlayFab?FollowComment

Answer: "0GameSparks is in preview and will be providing some similar services to PlayFab. So far there's some DynamoDB integration, messaging, notifications, local player data store and they recently added leaderboards.CommentShareKirkulesanswered a year ago"


Question: Object Metadata In S3 Inventory Report

How do I add object metadata (such as Content-Type or x-amz-meta-whatever) to the output of an Amazon S3 Inventory report?FollowComment


Question: High load on Linux server

"We have a CentOS Linux server in AWS that runs monitoring software. This server has run exceptionally well for a few years until a few weeks ago where it started experiencing high loads even when sitting idle. The previous time this occurred, we troubleshot it, upgraded the software and the OS, and felt like it was potentially fixed. With a high load yet low CPU, low memory, and zero swap used, the assumption was maybe some disk I/O issue in the server farm that resolved itself. The problem resurfaced late yesterday and after digging more this evening, we noticed the CPU steal time ('st' in the top command) is absurdly high; CPU steal time is where the hypervisor or other servers in the shared virtual environment are causing this system to wait on CPU time. If the system is simply rebooted, the problem remains. The only way we have resolved it both times is if the instance is stopped, we wait a few mins, and then start it again. Is it possible the instance is switched to a different server farm without a resource hog when we perform the extended shutdown? Does this mean AWS has over-allocated resources? Are there any other ways to prevent this from happening again beyond paying for a dedicated server? Any help would be appreciated!top - 21:47:37 up 10 days,  1:30,  2 users,  load average: 18.77, 11.27, 11.48Tasks: 155 total,   5 running, 150 sleeping,   0 stopped,   0 zombie%Cpu(s): 18.3 us,  4.1 sy,  0.0 ni,  0.0 id,  0.0 wa,  0.0 hi,  0.0 si, 77.6 stKiB Mem :  3878444 total,  1144048 free,   910772 used,  1823624 buff/cacheKiB Swap:        0 total,        0 free,        0 used.  2483948 avail Memtop - 21:47:46 up 10 days,  1:30,  2 users,  load average: 17.20, 11.18, 11.45Tasks: 157 total,   9 running, 148 sleeping,   0 stopped,   0 zombie%Cpu(s): 19.0 us,  4.2 sy,  0.0 ni,  0.0 id,  0.0 wa,  0.0 hi,  0.0 si, 76.7 stKiB Mem :  3878444 total,  1120580 free,   934224 used,  1823640 buff/cacheKiB Swap:        0 total,        0 free,        0 used.  2460496 avail MemFollowComment"


Question: API Gateway Rest Endpoint "MalformedQueryString" (worked prior for 1 month)

"Hi,I have had an API gateway running as a webhook receiver -> SQS for a little over a month with no issues. As of 9/26, I started receiving an error on all requests on my only endpoint for this API two days ago.{    "Error": {        "Code": "MalformedQueryString",        "Message": "Keys may not contain  ",        "Type": "Sender"    },    "RequestId": "XXXXX"}This is the end points def in template.    responses:      default:        statusCode: "200"    requestParameters:      integration.request.header.Content-Type: "'application/x-www-form-urlencoded'"    requestTemplates:      application/json: "Action=SendMessage&MessageBody=$input.body"    passthroughBehavior: "never"    type: "aws"Issue I am having is that the message body to the API is always truncated, with no discernable difference in the first 1024kb of the data with historical vs new messages that are failing. I can only assume after the first 1024kb of data, there must be a difference in the message being received? How do I troubleshoot this further?FollowComment"

Answer: "0I was able to isolate the issue. A field contained an ampersand "&" in the message being put into body. changing ampersands to "and" in the DB and that did the trick...not sure why this was an issue, or if this was ultimately the final cause (it could be the 3rd parties webhook that sends the initial message doesn't handle the ampersand well). That would be my first guess but I do not have the time to dig any further or point test SQS to find out!CommentSharedshelt22answered 8 months ago"


Question: AWS LB - How does being a regional service work?

"I've read that AWS Elastic LB is a regional scoped service which means it's highly available by default. My question is how (regarding the details)? If I use an LB on a region, does Amazon internally set up instances for the LB in different AZs?FollowComment"

Answer: "2Accepted AnswerSee below from the ELB documentation which explains how when you enable multiple AZs for your ALB AWS will create nodes in each of those AZs. Often in diagrams for simplicity only one ELB is shown but in reality every AZ that you enable has the ELB node in it which makes it highly available.Availability Zones and load balancer nodesWhen you enable an Availability Zone for your load balancer, Elastic Load Balancing creates a load balancer node in the Availability Zone. If you register targets in an Availability Zone but do not enable the Availability Zone, these registered targets do not receive traffic. Your load balancer is most effective when you ensure that each enabled Availability Zone has at least one registered target.We recommend enabling multiple Availability Zones for all load balancers. With an Application Load Balancer however, it is a requirement that you enable at least two or more Availability Zones. This configuration helps ensure that the load balancer can continue to route traffic. If one Availability Zone becomes unavailable or has no healthy targets, the load balancer can route traffic to the healthy targets in another Availability Zone.After you disable an Availability Zone, the targets in that Availability Zone remain registered with the load balancer. However, even though they remain registered, the load balancer does not route traffic to them.CommentShareEXPERTTushar_Janswered 3 months ago"


Question: Logging into Chime

I can no longer log into Chime on my desktop but am logged in on my phone app. It appears to be trying to create a new log in but I already have a log in. I tried calling Amazon.com support and they tried to send me to AWS support but they were not in. How do I resolve this?FollowComment


Question: Sending Route 53 DNS query alarm to Telegram or Slack

"Hi guys,I have a requirement that I need the CloudWatch Alarm to send notification to my Telegram or Slack if the Route 53 DNS query is larger than 1 million query per day.In detail, I would like to be notified via Telegram or Slack if the number of DNS queries in my Route 53 Public Hosted Zone is larger than 1 million queries. After a day, the query metric will be reset to 0 and CloudWatch will keep on tracking this metric condition and send alarm. I think the architecture is Cloudwatch —> SNS —> Lambda —> Slack/Telegram. However, I don't know how to configure step by step and how to code the Lambda function.If you know the solution, please don't hesitate to share with me.ThanksFollowComment"

Answer: "0If you only want to use Slack, you can use AWS Chatbot to send notifications without Lambda.https://aws.amazon.com/jp/chatbot/However, Telegram is not supported, so notifications here must be sent via Lambda.CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: Is there a "rest api gw usage plans" equivalent solution for http api gw?

"Hi, after reading the following articles,https://aws.amazon.com/blogs/architecture/throttling-a-tiered-multi-tenant-rest-api-at-scale-using-api-gateway-part-1/https://aws.amazon.com/blogs/architecture/throttling-a-tiered-multi-tenant-rest-api-at-scale-using-api-gateway-part-2/Is was wondering what should we do if we want to apply the same solution on http api gw, which doesn't provides the usage plans feature.As mentioned inside the article:" We limit the scope of our discussion to REST APIs because other protocols that API Gateway supports — WebSocket APIs and HTTP APIs — have different throttling mechanisms that do not employ Usage Plans or API Keys."Few comments for focusing the question:Our main goal is to achieve an api rate limiting per customer for our http api gw.I'm looking for a solution that doesn't include migrating to rest api gw (if I will migrate, I will just go with the solution from the attached article).If it helps somehow for coming up with a good solution, our http api gw is wrapped with a cloudfront distribution (we did it in the past in order to apply WAF on this api, which doesn't supports WAF out of the box).Thanks,YedidyaFollowComment"

Answer: "1Accepted AnswerHi,You are right, http api does not have usage plans out of box, while as rest api type does instead.You would need a handle it yourself. I would take inspiration from the built-in usage model and build it for your api. You could store the limits for your customers in a database(dynamo).Then each time an api is called, you would check whether the rate limit is passed for a customer, if so the api would throw a 4xx error.If limit is still below threshold, increment the limit counter.You could implement those check in different flavors such as Lambda@edge, or api gateway backed by a step function with lambda steps performing the check and counter increments.Hope this ideas can inspire youCommentShareEXPERTalatechanswered 4 months ago"


Question: "EC2 is running, but no connection."

"Hello, I have deployed my service built with django to ec2 and am using it. On the console, the instance is running. However, the Instance status checks fails, and the ssh connection is not possible. Even if I try to use the connection service within aws, I can't connect with the error "There was a problem connecting to your instance". Network access, security groups are still in use, so I don't think there was a problem here. What can i do now?I've tried everything like rebooting, shutting down, and restarting a little later!FollowComment"

Answer: "0Hello,Thank you for your question, I understand that you currently unable to connect to your instance as it is failing status checks.Please confirm whether it is failing:Instance level checks = 1/2 this means that the issue is with OS level operations (AWS has no visibility)System level checks = 2/2 this generally means that there is an issue with the underlying host hence (stop/start will be required)To check why the instance is failing status checks you can use the console logs/instance screenshots, you can reference this link [1] for further troubleshooting:To get console output1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/2. In the left navigation pane, choose Instances, and select the instance.3. Choose Actions, Monitor and troubleshoot, Get console logs.To get screenshot1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/2. In the left navigation pane, choose Instances, and select the instance.3. Choose Actions, Monitor and troubleshoot, Get instance screenshot.Once you have determined the cause for status check failure, you can reference this link [2] for common troubleshooting methods for 1/2 status checks.Feel free to share console log and/or screenshot should you require further assistance with troubleshooting[1] Troubleshoot an unreachable instance - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-console.html[2] Troubleshoot instances with failed status checks - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.htmlCommentShareSUPPORT ENGINEERLundianswered a year ago"


Question: EC2 instance metadat credentials initial delay

"We make use of EC2 instance profiles to grant iam rights to our instances. This works fine. However when we use the cli or powershell within the instance the first call to an AWS service has a long delay, frequently around 30 seconds. Subsequent calls to other APIs are almost instant.Does anyone else see a delay on initial credentials retrieval? If not, what kind of response do you get for the first call?The delay is not specific to any AWS API. It could be practically any AWS cli command.Any ideas on how I could reduce this delay or how I could troubleshoot further to find the specific call?Many thanksFollowComment"

Answer: "0There are a couple of things I would check:Make sure you're using the latest version of the AWS CLIVerify this only happens with calls out to the AWS API and not any other network calls (i.e. via curl)Monitor your CloudTrail for the target account for failed login attempts. It could be that the CLI is trying to authenticate with a stale set of credentials stored in the credentials file or an environment variable, and falling back to the IAM profile role.Monitor your VPC Flow Logs to see exactly where/when the slow-down is occurring.Ensure proper configuration and routing to your NAT gateways and/or transit networksCommentShareMichael_Banswered 8 months ago"


Question: AWS SES Keep Email or Sent Mail Data ?

"Hi,I couldn't find this answer anywhere in SES FAQ or anywhere in the net but have 2 questions :Does SES keep a copy of my sent recipient's email addresses ?Does SES keep a copy of the sent mail in the server ?I assume SES is just a passthru service and does not keep any information in its server right?ThanksFollowComment"

Answer: "0Hi skc242,You can configure SES so that all sorts of data about your emails is captured and saved to a location you specify. Our documentation has a section called "Monitoring Using Amazon SES Event Publishing," which documents the process of setting up, managing, and retrieving SES event data. See http://docs.aws.amazon.com/ses/latest/DeveloperGuide/monitor-using-event-publishing.html for a tutorial.I set up my SES instance to send all SES event data via Firehose to an S3 bucket. The resulting data contains the sender and recipient addresses, the subject, the timestamps for both sending and delivery, the SMTP response for delivered emails, and much more.I hope that helps!Thanks,BrentCommentShareAWS-User-4207280answered 6 years ago0skc242 wrote:Hi,I couldn't find this answer anywhere in SES FAQ or anywhere in the net but have 2 questions :Does SES keep a copy of my sent recipient's email addresses ?Does SES keep a copy of the sent mail in the server ?I assume SES is just a passthru service and does not keep any information in its server right?ThanksThis is addressed in our FAQ: https://aws.amazon.com/ses/faqs/Quoting the relevant Q/A here for convenience:Q: Who, if anyone, has access to my email content?We take our privacy and data protection responsibilities very seriously. Amazon SES uses in-house anti-spam/anti-virus technologies to filter email messages containing poor-quality content and prevent them from being sent. We will only access email content under very limited circumstances, such as system troubleshooting, or investigating fraudulent or abusive activity. Furthermore, other Amazon SES customers do not have access to your email content.CommentShareAWS-User-6969427answered 6 years ago"


Question: Clarification regarding user interrupts (irq_req)

"Hi,the Shell specification says:This interface uses single clock pulses for the req/ack. The CL asserts (active high) cl_sh_apppf_irq_req[x] for a single clock to assert the interrupt request to the SH. The SH will respond with a single clock pulse on sh_cl_apppf_irq_ack[x] to acknowledge the interrupt.As I understand it, the Shell uses the Xilinx PCIe DMA core (XDMA) for DMA and user interrupts. Xilinx PG195 says about the user interrupts:After a usr_irq_req bit is asserted, it must remain asserted until the corresponding usr_irq_ack bit is asserted. The usr_irq_ack bit assertion indicates the requested interrupt has been sent on PCIe. For MSI-X, once this ack has been observed, the usr_irq_req bit can be deasserted.Does the shell have additional logic to handle this requirement? I.e. does my CL need to send a single clock pulse as stated in the shell specification or must the CL assert the request line until it got ack'ed?FollowComment"

Answer: "0Hello Miob,Thank you for the query. I would suggest you to follow the SH/CL spec. So please send a pulse instead of a level based trigger.RegardsBalaCommentShareawsbalasramanswered 4 years ago"


Question: How to use regex in ECS task definition JSON?

"I'm trying to add awslogs-multiline-pattern to my ECS task definition. For matching timestamp, I'd like to use  "awslogs-multiline-pattern": "^\[([0-9]{2}:[0-9]{2}:[0-9]{2} [A-Z]{3})\]"but getting " Unexpected token [ in JSON ..." error during deploy.I couldn't find a direction for a fix/workaround.TIA, VitalyFollowComment"

Answer: "1Possibly it's treating the escape as a String escape rather than a regex escape?  Perhaps try:"^\\[([0-9]{2}:[0-9]{2}:[0-9]{2} [A-Z]{3})\\]"I'm not using this anywhere currently, and I didn't construct a test, so this guess might not pay off, but seems worth a shot.CommentShareGeoffrey Wisemananswered a year ago"


Question: Set up the pg gem - postgresql in development

"I'm using Cloud9 on AWS in development and EB for deployment.Found a lot of old stuff, but having problem to install pg gem.started with codestar, using ruby on rails appfor now with elastic beanstalkusing IDE Cloud9added RDS Postgresql for the EBinstalled all gems needed, except the pg gempostgresql set in database config for dev and productionpostgresql93-devel added in the packages.conftried to add libpq-dev - NOT WORKING (?)sudo yum install libpq-devthis worked (not sure if this is correct)sudo yum install postgresql-libsStill error when installing the gem:Building native extensions.  This could take a while...ERROR:  Error installing pg:ERROR: Failed to build gem native extension._current directory: /usr/local/rvm/rubies/ruby-2.4.1/lib/ruby/gems/2.4.0/gems/pg-0.21.0/ext_  /usr/local/rvm/rubies/ruby-2.4.1/bin/ruby -r ./siteconf20171207-7455-1v09v4h.rb extconf.rbchecking for pg_config... noNo pg_config... trying anyway. If building fails, please try again with--with-pg-config=/path/to/pg_configchecking for libpq-fe.h... noCan't find the 'libpq-fe.h header*** extconf.rb failed ***Could not create Makefile due to some reason, probably lack of necessarylibraries and/or headers.  Check the mkmf.log file for more details.  You mayneed configuration options.Any new ideas how to setup Postgresql with Cloud9 on AWS?Edited by: mikesk on Dec 7, 2017 2:50 AMFollowComment"

Answer: "0I just ran into this myself, it turns out the package you need is called postgresql-devel on RHEL systems. Try:sudo yum install postgresql-develI agree this should work out of the box. Until we are actually able to set our own base images, or AWS fixes this, though, that should suffice.CommentShareckeeleanswered 5 years ago0As of February 27, 2018, the above solution is not working on Amazon Linux Cloud9. Not sure whether Amazon updated its AMI so that it no longer functions or what.The pg_config file in /usr/bin references postgresql-9.6, but all of the components necessary to compile the pg gem for pg-9.6 are not installed when booting up the AMI for the first time. What got it working for me was the following:sudo yum install postgresql96 postgresql96-server postgresql96-libs postgresql96-contrib postgresql96-develCommentSharestnagyanswered 5 years ago0Thanks very much for posting the instructions. I'd like to ask if anyone knows how to start the postgresql service after installing postgresql on AWS Cloud 9.I have tried to runsudo service postgresql startwithout much success.Similarly, I've also tried to run the following without much successsystemctl enable postgresql-9.6.servicesystemctl start postgresql-9.6.serviceAny assistance would be much appreciated!CommentSharemikeqzanswered 5 years ago0You can follow the instructions on this article: https://medium.com/@floodfx/setting-up-postgres-on-cloud9-ide-720e5b879154sudo yum install postgresql postgresql-server postgresql-devel postgresql-contrib postgresql-docssudo service postgresql initdbCommentShareflushanswered 4 years ago"


Question: EC2 site down after php update.

"I updated my EC2 server to the newest version of php from Elastic Beanstalk. The site is now giving the error: 503 Service Temporarily Unavailable. I redeployed my site as well after the php update, still no joy.FollowComment"

Answer: "0I found the problem. Apparently the Target in the load balancer was removed with the php update, I assume with the server restart.CommentSharemibikanswered 3 years ago"


Question: Rabbitmq Support in Shared VPC

"Hi,We have a strict restriction to use only shared vpc subnets to create resources and AWS RabbitMQ doesn't support shared vpc as of now.What is the possible solution ? just wanted to understand as why rabbitmq doesn't support shared vpc as other statefull databases support it.Is there any roadmap to enable it in future.FollowComment"


Question: Application Load Balancer not registering ECS Fargate tasks automatically

"Hi,we are developing a Dockerized web application and deploying to an ECS Fargate cluster. Here's what we have until now:An ECS Fargate service that is deployed on a public (for now) subnet.A target group using protocol HTTP on port 8080.An Application Load Balancer with the target group above as a listener also deployed on a public subnet.The security groups of the Load Balancer and ECS allowing everything (again, for now).When ECS starts a task, I can get its private IP address and manually register to the target group and it works perfectly fine including the health checks and everything. My requests to the load balancer from my local machine are forwarded to the ECS tasks successfully, and I receive the expected responses.The problem is the automatic registry of the ECS tasks within the target group. If I understand correctly, the target group should discover and register new tasks on the service automatically. Unfortunately it doesn't, I have to do that manually.Why isn't it being added automatically? What am I missing here? Can you give me a hint on where to start diagnosing that?Thank you for your time.Edit: The problem was that the load balancer wasn't added to the ECS service itself. Once added, everything worked as expected.FollowComment"

Answer: "0Accepted AnswerThe problem was that the load balancer wasn't added to the ECS service itself. Once added, everything worked as expected.CommentSharerePost-User-2379483answered 2 days agoGary Mclean 2 days agoJust as I said. Define the load balancer when setting up the ecs service.Share0Please ensure you create an Target Group of Instance type.When you register your ECS service in the ECS console, you define the load balancer and target group to useWhen your ECS Servive starts, it registers its self in the target groupSounds like your using a IP type target group?CommentShareGary Mcleananswered 2 days agorePost-User-2379483 2 days agoHi, thanks and yes, we're using IP type.We use Fargate with awsvpc mode and this guide here instructs to use IP type: https://repost.aws/knowledge-center/create-alb-auto-register.I'll try using the instance type anyway.Edit: This also didn't work. Problem was something else. Thanks anyway.Share"


Question: RDS r6g: no instances of the requested class available

"Hello,I have been waiting to finish a migration from one Aurora MySQL Cluster from r5 to the new r6g but so far only one of the nodes did the change the other one receives the following error:We're sorry, your request to modify DB instance ---------- has failed.Cannot modify the instance class because there are no instances of the requested class available in the current instance's availability zone.Please try your request again at a later time.Does anyone know how much longer I should have to wait before there is capacity? I have been trying for weeks.Region: us-east-2 (Ohio)AZ: us-east-2aAZ ID: use2-az1Thanks.FollowComment"

Answer: "0Accepted AnswerHi,Sorry about the delay getting back to you. This was indeed a misconfiguration in that region that we were working on getting fixed. It should now be possible to create in/scale in to use2-az1 when using the default VPC tenancy. We're still working on enabling dedicated tenancy capacity for r6g.Let us know if you continue to see this issue. We'll also be working on better automation/monitoring to avoid these kind of problems in the future.CommentShareJordananswered 2 years ago0Hello,Yes, thank you! I have been able to change the RDS instance type to the new r6g without problems.Thanks again.CommentShareigarciaGTanswered 2 years ago"


Question: Request a new rePost tag for SageMaker Data Wrangler?

"I'm a member of SageMaker Data Wrangler team and proposing adding a new tag for our product:Tag Name – Amazon SageMaker Data WranglerTag Definition – Questions on Amazon SageMaker Data WranglerTag Information – Questions / features wanted for SageMaker Data Wrangler, include but not limited to  Data Import, transformation, analyze, model training and MLOps using SageMaker Data WranglerFollowComment"

Answer: "0Accepted AnswerThank you for your suggestion. We'll look into this. There is an internal process for AWS employees to suggest new tags. I'll contact you offline.Kind Regards,MonicaCommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: AWS Batch spinning up ec2 spot instances but not running tasks on them (and tasks remain in runnable state)

"Hello,We are seeing jobs remaining stuck in RUNNABLE state in AWS Batch for several days. On checking the AWS console here are the observations:Compute environment is in INVALID state with reason: "CLIENT_ERROR - The instance IDs 'i-019be140af144fccf, i-01bd39c87ac0f87b7, i-034e8d61e0b7d5419, i-0ac46775085e4f9c4, i-0e129e96b5112c045' do not exist". Of these 5 instanceIDs I can see that 2 actually DO exist in the ec2 console while other 3 do not (perhaps they got reclaimed as this is a SPOT managed environment?)In the ECS cluster page I can see that the running EC2 spot instances are registered and visible under "Container Instances" and there are no alerts related to Agent version, etc (Agent version is 1.65.0)In the EC2 console I can see that several spot instances have been created and many of them have been running for 3+ days now.My Queries:Can you please help me understand why this has happened? We have made ZERO changes to the compute environment and it was working correctly till Feb 1st.What can be done to fix this?Will I be charged for these instances that have been created by batch and have been sitting IDLE for over 3 days? A total of 16 instances had been created by the batch compute environment. I can share the instance ids if needed.FollowComment"


Question: Domain joined failed

"I have created an appstream instance which is working fine without the domain joined operation.error: DOMAIN_JOIN_INTERNAL_SERVICE_ERRORBut while i am trying to domain join the appstream instance, i am facing issues.Please help me in resolving the issue.FollowComment"

Answer: "0I assume you have gone through the steps listed in https://docs.aws.amazon.com/appstream2/latest/developerguide/troubleshooting-notification-codes.html for DOMAIN_JOIN_INTERNAL_SERVICE_ERRORIf not for the usual suspects as documented previously, this is likely due a Microsoft Security update.Please follow the guidance in the link here https://support.microsoft.com/en-gb/topic/kb5020276-netjoin-domain-join-hardening-changes-2b65a0f3-1f4c-42ef-ac0f-1caaf421baf8If you are using Managed AD and cannot implement the suggestions in the link, i would suggest the following:Power down the fleetDelete all the Computer Objects in the AppStream OU.Power On the fleet and let the configured AppStram Service Account create objects. What this does is to satisfy the condition in the article "The user attempting the operation is the creator of the existing account" which will help mitigate this issue.Dont change the Service Account.If the above doesnt work, please contact AWS SupportCommentShareArun_PCanswered 8 days ago"


Question: Trigger cloudwatch event from lambda

"How to trigger cloudwatch event from lambda upon creation of a record in database.My use case is I want to run a cloudwatch event that is scheduled for 5 mins for one time. As soon as a record is created in DynamoDB by Lambda, this cronjob should be triggered by same lambda and which will invoke target function after 5 mins as scheduled in cronjob.FollowCommentTasio EXPERTa year agoCan you kindly describe your use case in more detail?Share"

Answer: "3Accepted AnswerAnother approach that you can use, as this seems to be some type of workflow, is to have a Step Functions state machine that writes on the DynamoDB table, then waits for 5 minutes, and finally executes the Lambda function.CommentShareEXPERTTasioanswered a year agoShaista a year agoI opted this approach because somewhere in our workflow I might need more then 5 mins delay say 30 mins. so state machines are best choice here. SQS max limit is 15 mins. so accept this answer. thanksShare2If I understand correctly, you would like to trigger an operation that will happen 5 minutes after you make a change to a DynamoDB table.I would recommend against the pattern you suggested using CloudWatch events (EventBridge) cron jobs as they are meant for ongoing tasks, not a one time task. Even if you specify a cron job that will only fire once, the rule will remain. You will need to later delete the Rule, otherwise you will get to the max number of rules very quickly.I recommend that when you make the change to the table you will send a message to an SQS delay queue. You will also have a Lambda function triggering from that queue.If I misunderstood your use case, please update the post.CommentShareEXPERTUrianswered a year agoShaista a year agoHey, can you pls share a tutorial for this. I am unable to perform this byhttps://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/sqs-examples-send-receive-messages.htmlShareUri EXPERTa year agoThis tutorial demonstrates how to create a Lambda function that consumes messages from SQS. You will also need to send the message to SQS. You can configure the queue itself to be a delayed queue by specifying "Delivery delay" when you create or update the queue, or you can add the delay on every message you send to the queue by specifying the DelaySeconds parameter.Share0This is a perfect use case for Serverless Application Model (SAM), which is way to build serverless applications using Infrastructure as Code (IaC), using CloudFormation.Once you've installed the SAM CLI, use the sample templates to build a Hello World SAM app.Put your lambda code into the app folder, in app.py.Then, replaced the template.yaml file with the below. Modify the cron entry to the schedule you want. Modify the DyanmoDB schema to match yours.AWSTemplateFormatVersion: '2010-09-09'Transform: AWS::Serverless-2016-10-31Description: >  SAM: trigger Lambda from DDB insertGlobals:  Function:    Timeout: 40    MemorySize: 1024    Runtime: python3.9    Architectures:        - x86_64    ReservedConcurrentExecutions: 1Resources:  LambdaFunction:    Type: AWS::Serverless::Function     Properties:      CodeUri: app/      Handler: app.lambda_handler      Policies:        - DynamoDBCrudPolicy:            TableName: !Ref DDBTable       Events:        MyEvent:          Type: Schedule          Properties:            Schedule: cron(*/5 * * * ? *)  DDBTable:    Type: AWS::DynamoDB::Table    Properties:       AttributeDefinitions:         - AttributeName: area          AttributeType: S      KeySchema:         - AttributeName: area          KeyType: HASH      BillingMode: PAY_PER_REQUEST      StreamSpecification:        StreamViewType: NEW_AND_OLD_IMAGESthen run:sam build && sam deploy                                                                                CommentShareYusuf Mayetanswered a year agoTasio EXPERTa year agoIf I understand the question correctly, the requirement is to trigger a Lambda function once five minutes after an item has been put in the DynamoDB table.Share"


Question: Feature Request: Transcribe - Support for Romanian language

"This is a critical business requirement for us and the only language, for now, that is causing us the issues and forcing us to look for alternatives. It would be great if Transcribe can support this language.FollowComment"

Answer: "2Thanks for your interest in Amazon Transcribe. We already received the same request from several customers and we are working on this enhancement. However, we do not have a date yet for this release. Please keep an eye on the public announcements. Here are the latest related blog posts.CommentShareIoananswered 5 months agoosama 5 months agoThank you for update. Eagerly waiting.Share"


Question: How to reduce launch time for SageMaker Notebooks?

"I am using SageMaker Notebooks and have added a lifecycle configuration to shut it down after inactivity. However, after a period of inactivity, it takes a long time (20 minutes) to boot back up. What can I do to reduce the launch time?I have considered creating a custom container image with pre-installed packages and dependencies but I am not sure if this would help. I also wonder if using a larger instance size would reduce launch time.What are the strategies and best practices to reduce launch time for SageMaker Notebooks?FollowCommentvdanylo 4 months agoCan you tell whether it's taking 20 mins to start an instance or to run your lifecycle configuration?ShareAWS-User-0741373 4 months agoPlease check Jupyter notebook logs in cloudwatch at the duration of booting of your notebook instance. It will give the right indicators, what's happening and cause of delay. https://docs.aws.amazon.com/sagemaker/latest/dg/jupyter-logs.htmlCheck out Lifecycle configuration best practices => https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-lifecycle-config-install.htmlShare"

Answer: 0Typically lifecycle configuration scripts will timeout > 5 minutes. So if you're not seeing this timeout it could be something else that is causing the notebook to take 20 minutes to start. Check out the logs to see if you can pinpoint the issue as mentioned by another user: https://docs.aws.amazon.com/sagemaker/latest/dg/jupyter-logs.htmlInstead of building a custom container image this is our published best practice to improve lifecycle configuration script time: https://aws.amazon.com/premiumsupport/knowledge-center/sagemaker-lifecycle-script-timeout/CommentSharearnasinhanswered 4 months ago


Question: Stack stuck deleting...

This stack has been deleting for a while. It normally only takes a few minutes? Can I get someone to help?arn:aws:cloudformation:us-east-1:777477331649:stack/imcc/3794f940-8a32-11eb-9dd2-0e879b0972adThanks!FollowComment

Answer: 0It finally cleaned itself up...I think! Thanks if you helped!CommentShareimccanswered 2 years ago


Question: How to add python libraries to lambda using the CDK?

"I want to use a library in my lambda function that was created by the CDK.I did the following, without success:add the library to my requirements.txt filePillowimport the library in my lambda functionfrom PIL import Imageinstall it and deploysource .env/bin/activatepip install -r requirements.txtcdk deploy`Many thanks for any hints!FollowComment"

Answer: "0Accepted AnswerYou should have a look at the aws-lambda-python module: https://docs.aws.amazon.com/cdk/api/latest/docs/aws-lambda-python-readme.htmlIt's still experimental and needs docker, but it will take care of your requirements.txt.The same exists for nodejs just in case (https://docs.aws.amazon.com/cdk/api/latest/docs/aws-lambda-nodejs-readme.html).CommentShareJerome VDLanswered 3 years ago"


Question: The instance has not stopped after force to stop by action menu.

"I've received the message "This instance is scheduled for retirement after September 21, 2020", then I tried to connect the instance but it's not responseding. I try to restart it.The instance has not stopped after I force instance to stop by using the stop action menu for 10 minutes.Could you help me to solve it ?Instance ID: i-8217be4fFollowComment"

Answer: 0Instance was stoped.CommentShareTee4Cuteanswered 3 years ago


Question: enable Amazon EventBridge for s3 bucket via CDK

"Hi team,I create a bucket with CDK and set the property eventBridgeEnabled to trueconst bucket = new Bucket(      this,      "myBucket",      {        versioned: false,        publicReadAccess: false,        blockPublicAccess: BlockPublicAccess.BLOCK_ALL,     **eventBridgeEnabled: true**,      }    );but when I go to the** s3 console** and check the properties tab/ EventBridge it's still showing "off" instead of "on"is there anything missing?Thank you.FollowCommentMichael_K a year agoI just created a cdk project using 2.21.1 and it worked. Send notifications to Amazon EventBridge for all events in this bucketOnWhat version are you using?ShareJess a year agoI'm using version 1.153.1Share"

Answer: "0Accepted AnswerNeed to post answer to get the code formatting.Even with v1.153.1npx cdk@1.153.1 init app --lanaguage typescriptnpm install @aws-cdk/aws-s3npm install @aws-cdk/aws-s3-deploymentCreate a file to uploadmkdir web-distecho "Hello World" > ./web-dist/index.htmlGo to ./lib/<name of the cdk project>.tsimport * as cdk from '@aws-cdk/core';// import * as sqs from '@aws-cdk/aws-sqs';import { Bucket, BlockPublicAccess } from '@aws-cdk/aws-s3';import { BucketDeployment, Source } from '@aws-cdk/aws-s3-deployment';export class RepostTemp2Stack extends cdk.Stack {  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {    super(scope, id, props);    const bucket = new Bucket(      this,      "myBucket",      {        versioned: false,        publicReadAccess: false,        blockPublicAccess: BlockPublicAccess.BLOCK_ALL,        eventBridgeEnabled: true,      }    );    new BucketDeployment(this, 'DeployIndex', {      destinationBucket: bucket,      sources: [Source.asset('./web-dist')],    });  }}Now you can deploy the cdk project.npx cdk deployGoing to the deployed bucket and checking the properties shows:Send notifications to Amazon EventBridge for all events in this bucketOnMaybe you have something else that is undoing the setting? Would need to see more of the app to understand what is going on.CommentShareMichael_Kanswered a year agoJess a year agoI'm using this package with my code : @aws-cdk/aws-s3-deploymentShareMichael_K a year agoUpdated to include s3-deployment. Did my answer solve your problem or are you still having trouble?Share"


Question: Aurora MYSQL Max_Connections Number

"Hello everyone,I'm facing a little issue with my Aurora MYSQL database, I keep changing the max connections number to avoid 1040 error in my custom parameter group as showed in documentation, but after they say It was changed in RDS events It keeps returning to default value (180 for 2 instances in my case), I wonder if someone faced the same issue and how to fix that, thank you.FollowComment"

Answer: "0Accepted AnswerHi there!From the notes, I understand that you managed to create a custom parameter group for your DB cluster and changed the max connection value but the value is not reflecting/changing. Please correct me if my understanding is wrong.Please note that when changing the parameter value of your custom parameter group, you will need to associate the custom parameter group with the DB cluster. Check document in link [1] to confirm the steps to associate a DB cluster parameter group with a DB cluster. Change the check box under “Scheduling and Modifications” from apply during the next maintenance window to apply changes immediately.Please note that after you change the DB cluster parameter group associated with a DB cluster, a reboot will be required on the primary DB instance in the cluster to apply the changes to all of the DB instances in the cluster.I hope the above information is helpful.References:[1] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_WorkingWithDBClusterParamGroups.html#USER_WorkingWithParamGroups.AssociatingClusterCommentShareLettyanswered a year ago"


Question: Can't start server: listen tcp: address 80: missing port in address

"Using ECR I created an ECS task and I created an IMGPROXY server and I bind to port 80. In security, I allowed all traffic anywhere for inbound and outbound. But when i am deploying the task it's showing this error that port is missing but i already opened all ports.FollowCommentcogito-ergo-sum a year agoCan you show your Task definition and Dockerfile?Share"

Answer: 0Insufficient information to help. :)CommentShareEXPERTposquit0answered a year ago


Question: Code commit + Code pipeline and AppConfig as deployment

"Hi,We want to using code pipelines. The source of data is codecommit and we want to deploy via APPConfig. While creating pipeline, we need to enter Input artifact configuration path. I am not getting what to be entered as input artificats stage. My code commit repository only contains .json files which directly needs to be deployed. Build stage is not required at all. I even created sample .zip file and uploaded on S3 and entered path of that. Still failed.FollowComment"

Answer: "0The artifact name will be config.json in CodeCommit.For example, if you have config.json in the config directory in CodeCommit, you need to specify "config/config.json".https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-AppConfig.htmlThe file path of the configuration data within the input artifact to deploy.If this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-7852843 a month agoThanks. This works. If i want to have multiple files in config folder and also multiple directories, how to add artifact file so that it picks up the changes.Also lets say i have two files in code commit under config directory. ConfigA.json, ConfigB.json and i only change configb.json, so would the app config pick only one change or it would pick the complete repository.ShareRiku_Kobayashi EXPERTa month agoI'll have to try it out, but I think I can only specify one config.json, so it will only pick up one change.SharerePost-User-7852843 a month agoApart from this. Can you also check if I need to bundle this entire with code build so that that can encapsulate this as single artifact file and code deploy can pick that.ShareRiku_Kobayashi EXPERTa month agoOnly one config.json could be set.I could be doing it wrong and you should try it too.Share"


Question: How do I connect mongodb on my Build objectURL

The only way I can connect is when I have to start my Server folder from my local computerFollowComment

Answer: "0Can you clarify the question? it's a bit vague in the current form. Object URL could refer to S3 or others, where is MongoDB running?CommentShareEXPERTRaphaelanswered a year ago"


Question: How does sagemaker creates a model?

"I am creating sagemaker resources such as model, endpoint configuration and real time endpoint via cloudformation ( sample below) . in the template below, we provide the s3 bucket URI for the model artifact in the ModelDataUrl argument. if we update the model artifact , or delete a older version and upload a new model.tar file in the same bucket. will that work, instead of creating a new model resource everytime there is a new version of model.tar file ? when making a inference, I understand , sagemaker downloads the model.tar file in the container specified , unpack the model.tar file and call the binary file for inference ,so it doesn't matter if we update the model.tar file , right? sagemaker will simply download whatever tar file is present in the s3 URI and works with that.SageMakerModel:    Type: AWS::SageMaker::Model    Properties:       Containers:         -          Image: !Ref ImageURI          ModelDataUrl: 's3://some-bucket/model.tar'          Mode: SingleModel      ExecutionRoleArn: !Ref RoleArnFollowComment"

Answer: "1If you trained your model in SageMaker, the model artifacts are saved as a single compressed tar file in Amazon S3. If you trained your model outside SageMaker, you need to create this single compressed tar file and save it in a S3 location. SageMaker decompresses this tar file into /opt/ml/model directory before your container starts.Reference : https://docs.aws.amazon.com/sagemaker/latest/dg/your-algorithms-inference-code.htmlCommentShareEXPERTAWS-User-Nitinanswered 7 months ago1Just to add a bit more detail to Nitin's answer since you raised a couple of interesting secondary questions:First, to be picky, your artifact does need to be a compressed .tar.gz file as mentioned here. Plain .tar files (which you mentioned a couple of times) likely won't have this compression and won't work. From my recent tests the filename extension itself in S3 doesn't matter though - so if your object is in the correct format but just happens to be called .tar, this should be fine.Second, yes today you can simply update the saved model artifact in S3 and continue referencing the same SageMaker model - but when can you do it and should you?One important caveat to bear in mind is that if you're deploying your models to online inference endpoints, there's no API available to force running instances to re-fetch an updated model tarball. If you update your artifact while an endpoint is live (especially if auto-scaling is enabled or some endpoint update is in progress) you could end up with endpoint instances running a mixture of old vs new model.The second is that, even if you only run defined batch jobs and can guarantee the timing of artifact updates won't overlap with job start-up, keeping track of your model versions is a pretty important best practice to help keep your operations in order.So even though it's possible to just update the artifact in S3, I'd usually suggest users track their historical models: For example by treating the S3 prefix as immutable, re-creating Models for new artifact versions, and using SageMaker Model Registry to track the history of versions. It's worth mentioning that storing your history of versions ("ModelPackages") in Model Registry doesn't necessarily have to balloon the number of "Models" in SageMaker: As discussed here, a ModelPackage isn't necessarily tied to a Model, and you need to create a Model from it to be able to use in deployment/inference.CommentShareEXPERTAlex_Tanswered 7 months ago"


Question: Route53 - Manual Update of IP address for A record of EBS Environment

"Hi,I have a hosted zone testabc.com in Route53. Under this hosted zone, I have two records.testabc.com    A      1.1.1.1www.testabc.com   CNAME   testabc-env.elasticbeanstalk.comFor the above 2 records.Record 1:1.1.1.1 is just an example, we have to update this IP address very regularly, as we are using the IP address of the EBS environmentRecord 2:We link the EBS environment URL directly to itMy question is, because the IP address of the EBS environment changes regularly on AWS side, we have to manually update the the value for the A record shown above. Is there a recommended way to do that, so that we can access the website via both testabc.com and www.testabc.com ?<Edited on 15 June>Just wondering, would it be possible for AWS to assign an elastic IP to the EBS environment, so that we don't need to update the IP value for the A record every now and then?Thank you.FollowComment"

Answer: "0Hi,I understand you want to access your website from both testabc.com and www.testabc.com. The issue you facing CX is due to CNAME limitation, where CNAME cannot co-exist with another record.To solve this, when DNS is Hosted in R53, we normally advised CX to use A (alias) in root/parent domain. Below will be the necessary steps needed to take when creating an alias[1]:Sign in to the AWS Management Console and open the Route 53 consoleIn the navigation pane, choose Hosted zonesChoose the name of the hosted zone that you want to use to route traffic to your Elastic Beanstalk environmentChoose Create recordSpecify the following valuesChoose Create records[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-beanstalk-environment.html#routing-to-beanstalk-environment-get-domain-nameCommentShareLwazianswered a year agorePost-User-2606776 a year agoHi Lwazi,Thank you for your reply.Currently, my CNAME record is working fine. However for my A record value, we have to keep checking up the IP address of the EBS environment, and updating it accordingly.Also, based on the link that you provided, for EBS environment URL that does not include the region, we can only use CNAME to route the traffic via the subdomain, which we have already done so (refer. Record 1). In that case, how should we go about if we want to route traffic to the root domain testabc.com as well.Thank you.Share"


Question: Amazon Personalize Data Requirements

"A customer is looking to make video recommendations using a small data set of just 150 videos including metadata on each video. They currently do not have any data on user interaction with the videos at this point as they haven’t released them yet to their customers.Are they still able to utilize Personalize to begin making initial recommendations or do they need this interaction data (1,000 interactions/25 customers/2 interaction entries)?For example - if a user finishes watching a video, could they recommend the next video based on similar genres/meta data of the videos themselves? And then of course integrate the user interaction data that they generate over time to make stronger recommendations.Ultimately, I'm wondering if this lack of user interaction data is a blocker to utilizing Personalize or if it simply will result in weaker recommendations. If it's a blocker to Personalize, is there a better solution for basic recommendations for a team without any ML experience?FollowComment"

Answer: "0Accepted AnswerI recently helped a customer in a very similar situation. They had a small set of interactions, but not nearly enough for Personalize. When using Personalize, it was clear that Personalize resorted to its Popularity Count model (which happens when the other recipes can't provide good recommendations).The customer did have metadata available, which wasn't great quality, but at least provided a bigger dataset than the interactions. I built a prototype with their small interaction dataset and their larger metadata dataset using the LightFM package, which is a variation of factorization machines. The results were promising, despite the bad data quality.In the case of this customer, their business model meant they would never be able to gather enough interaction data for Personalize, so they are exploring the option of expanding upon the prototype I built. However, if your customer would be able to gather sufficient interaction data over time, then it is likely that Personalize would eventually provide better results. It could be worthwhile implementing an interim solution which places more emphasis on metadata, while gathering data to eventually move to Personalize.CommentShareS_Mooseanswered 3 years ago"


Question: how to put variable into a string as a prefix of function in Graphql?

"As title, we have a graphql file in amplify, and we have a need to put a variable at the start of lambda function name.e.g.type Query {grantDeviceToken(macs: [String!]!): GrantTokenResponse @function(name: "${site}-appsyncGrantDeviceToken-${env}")}As this example, is it possible to make ${site} as a variable and how do I setup the variable value?thankshow to put variable into a string as a prefix of function in Graphql?As title, we have a graphql file in amplify, and we have a need to put a variable at the start of lambda function name.e.g.type Query {grantDeviceToken(macs: [String!]!): GrantTokenResponse @function(name: "{site}-appsyncGrantDeviceToken-${env}")}As this example, is it possible to make ${site} as a variable and how do I setup the variable value?thanksFollowComment"

Answer: "1Hello, I understand that you would like to set lambda resolver name dynamically using a variable(“site”). Please note that according to the documentation the @function directive allows you to use ${env} to reference the current Amplify CLI environment.However, I could not see any resources/documentation discussing an out of box approach to create variables which could be accessed in the GraphQL schema as mentioned by you.Having said that, please feel free to raise a feature request with the Amplify service team via the GitHub.In case I misunderstood the query, please feel free to reach out to us via creating a support case from the support centre dashboard and elaborate your usecase in detail.CommentShareSUPPORT ENGINEERNiharika_Banswered 9 months ago"


Question: S3 Presigned Get Object Request with encryption

"Is it possible to generate a presigned URL to get an encrypted ( with customer provided key ) object in an S3 bucket ? If it were possible, would this this URL be usable in a browser ?FollowComment"

Answer: "0Simple answer, yes and no.S3 pre-signed URL is just an S3 URL on behalf of the signing entity.So if the signing entity has permission to read the encrypted S3 object, anyone with that pre-signed URL will have the same permission over that object within the valid time period.However, because SSE-C requires specific HTTP headers, it may not be usable in a browser (https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html#ssec-and-presignedurl)CommentShareRichardFananswered a year ago0Hello, so your mean we must use something like axios to send request URL to s3 with specific HTTP headers right? But if use aws-sdk package do we need add headers too?CommentSharerePost-User-8207723answered 9 months ago"


Question: Unable to select region when in billing.

I wanted to see my billing info . But when I logged in to my root account to see the billing I could not get any info . I saw then the region was set to global and assumed I had to change to my region north but all the options for regions were unclickable and gray and dont highlight when I hover over them. and the url is https://us-east-1.console.aws.amazon.com/billing/home?region=eu-north-1#/ even though it stands global.FollowCommentGovind Kumar a month agoAre you managing you AWS Account using AWS Control Tower?Share

Answer: "0There are several answers and comments already that are hinting to a few things I think we should clarify. The Billing "Service" which includes Billing, Cost Explorer, and Budgets are not regional services, but considered global. Therefore, when in those parts of the user interface, you cannot select a region. This should not impact your permissions to see or not see billing data.If your account is part of an AWS Organization, then your account (even root) may not have permission via IAM, SCP (Security Control Policy) or Control Tower to view billing data. These permissions would need to be requested and allowed from the AWS Organization Admin. If your account is not part of an AWS Organization and is therefore stand-alone, then the root user should be able to see billing data and permissions can also be granted to other IAM/SSO users or Groups to view billing data. [1]Since we are talking about billing permissions, it should also be noted that the billing permissions will be changing in July 2023 for accounts created before March 2023. Accounts created after March 2023 will already have the new permissions enabled. [2][1] https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/control-access-billing.html[2] https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/migrate-granularaccess-whatis.htmlCommentShareEXPERTShlomo Dubrowinanswered a month agoThis is my name a month agoOk . But I had no problems viewing it yesterday . Why did it suddenly stop? It does not say that I am able to see all the content in tthe billing page  I can see for example Current month's total forecast. But for example when I look at the free tier "There is no Free Tier services data available" is shownShareShlomo Dubrowin EXPERTa month agoThis is probably due to the change in months. Unfortunately, it is a known symptom of the AWS bills being run that some of the costing data is delayed for the first few days of the month. I would expect you to have the view back by Friday or Saturday. If the data does not come back, I suggest opening a billing support case. To open a case, in the AWS Console, click on the ? with a circle around it and select support center. All support levels are able to open a case for Account&Billing.Share-1If you are unable to view your billing information after logging into your root account and changing the region to your desired region, it's possible that you may not have the necessary permissions to access the billing information.To check your permissions, you can navigate to the IAM (Identity and Access Management) console and verify that your account has the necessary permissions to view billing information. You can also check if there are any billing-related policies attached to your account or IAM user that might be preventing you from accessing the information.CommentShareWilklinsanswered a month agoThis is my name a month agoThe problem is that I am unable to change the region once I am in the billing page . I am automatically set to global and all the other regions turn gray. I am logged in to my root account so permissions should not be an problem because I have not changed the permissions recently.Share"


Question: Get the status of queue messages in greengrass v2

Is there a way to know when the queue messages in greengrass v2 is full?FollowComment

Answer: "1Accepted AnswerIf you try to publish a message using publish_message_to_iot_core then it will return an error if the queue is full. This is the only way to know the status of the outbound MQTT queue, which is what I'm assuming you're asking about.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 8 months agoaws-user-4321 8 months agoThanks! and this error where appears? in the log of the component that sends the message?Share"


Question: YAML_FILE_ERROR Message: Unknown runtime version named '12' of nodejs

"I have an Angular 8 / node express (node 10) application. I have updated it locally to Angular 10 / node 12. When I push it and it tries to deploy I get the following error:[Container] 2020/08/31 13:46:21 Waiting for agent ping[Container] 2020/08/31 13:46:23 Waiting for DOWNLOAD_SOURCE[Container] 2020/08/31 13:46:24 Phase is DOWNLOAD_SOURCE[Container] 2020/08/31 13:46:24 CODEBUILD_SRC_DIR=/codebuild/output/src553343447/src[Container] 2020/08/31 13:46:24 YAML location is /codebuild/output/src553343447/src/buildspec.prod.yml[Container] 2020/08/31 13:46:24 Processing environment variables[Container] 2020/08/31 13:46:24 Selecting 'nodejs' runtime version '12' based on manual selections...[Container] 2020/08/31 13:46:24 Phase complete: DOWNLOAD_SOURCE State: FAILED[Container] 2020/08/31 13:46:24 Phase context status code: YAML_FILE_ERROR Message: Unknown runtime version named '12' of nodejs. This build image has the following versions: 10, 8My .yml file had 10 which I changed to 12:version: 0.2phases:install:runtime-versions:nodejs: 12commands:- npm i npm@latest- npm install- npm install -g @angular/cliwhere do you configure what node versions the build image supports - "This build image has the following versions: 10, 8"?FollowComment"

Answer: "0You can go through https://github.com/aws/aws-codebuild-docker-images/issues/361 this I am able to solve this using the given approach.CommentShareVatsalanswered 2 years ago0I came across the same issue in my CodeBuild pipeline and I can explain the frustration in finding the answer that worked for me.According to this link (https://docs.aws.amazon.com/codebuild/latest/userguide/runtime-versions.html) it says that that Amazon Linux 2 should support NodeJs 12. But it does not give no distinction between the different version of Amazon Linux 2 images that exist.This link (https://docs.aws.amazon.com/codebuild/latest/userguide/available-runtimes.html) cleared it up for me. I was using Amazon Linux 2 x86_84 standard:1.0, this only supports up to NodeJs 10.The fix: Update your image to one of the following:Amazon Linux 2 x86_64 standard:2.0Amazon Linux 2 x86_64 standard:3.0Amazon Linux 2 AArch64 standard:1.0Amazon Linux 2 AArch64 standard:2.0Ubuntu standard:3.0Ubuntu standard:4.0Ubuntu standard:5.0Paying attention to the Linux type when switching. In my case (I was using CDK) updating the build image from codebuild.LinuxBuildImage.AMAZON_LINUX_2 to codebuild.LinuxBuildImage.AMAZON_LINUX_2_2 made the difference. I don't know what that looks like in a .yml file but I am certain there is some syntax that will enable the build image to be changed to one of the above images. Good luck and I hope this post helps anyone else struggling with this.CommentSharetraysonanswered 2 years ago"


Question: inferentia neuron core usage is only 1 when 4 cores are available

"Im using the following code to load a neuron compiled model for inference. However on my inf1.2xlarge instance, neuron-top shows for cores (NC0 to NC3). Only NC0 gets used in inference. How do I increase throughput by using all cores???from transformers import BertTokenizer, BertModelimport torchimport torch_neuronimport os.pathimport osos.environ['NEURON_RT_NUM_CORES']=str(4)fname = 'modelneuron.pt'tokenizer = BertTokenizer.from_pretrained('bert-base-uncased')inputs = tokenizer("Hello, my dog is cute and big", return_tensors="pt")if not os.path.isfile(fname):    model = BertModel.from_pretrained('bert-base-uncased', return_dict=False)    neuron_model = torch_neuron.trace(model,                                    example_inputs = (inputs['input_ids'],inputs['attention_mask']))    neuron_model.save("modelneuron.pt")    print('saved neuron model')else:    neuron_model = torch.jit.load('modelneuron.pt')    print('loaded neuron model')for i in range(10000):    outputs = neuron_model(*(inputs['input_ids'],inputs['attention_mask']))print(outputs)FollowComment"

Answer: "1Hi,For running inference in parallel using Neuron on a inf1 instance to utilize all available NeuronCores we can use torch.neuron.DataParallel.torch.neuron.DataParallel implements data parallelism at the module level by duplicating the Neuron model on all available NeuronCores and distributing data across the different cores for parallelized inference.You can read more about running Inference using torch.neuron.DataParallel here:https://awsdocs-neuron.readthedocs-hosted.com/en/latest/frameworks/torch/torch-neuron/api-torch-neuron-dataparallel-api.html#torch-neuron-dataparallel-apiIn addition, here is an example of using DataParallelhttps://awsdocs-neuron.readthedocs-hosted.com/en/latest/src/examples/pytorch/resnet50.html#Run-Inference-using-torch.neuron.DataParallelCommentShareChris_Tanswered 6 months ago"


Question: Terraform for Glue DataBrew

"Hi,I don't see Glue DataBrew in Terraform's AWS provider.I do see that it's supported in CloudFormation (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-databrew-job.html).Can anyone help me locate it please?FollowComment"

Answer: "0Accepted AnswerThere are two AWS providers in Terraform:aws - the original provider & is popularawscc - these are auto generated AWS Control API.The terraform provider awscc would help you with implementing Glue Databrew - https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/databrew_datasetThese are the available resources:Dataset - https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/databrew_datasetProject - https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/databrew_projectJob - https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/databrew_jobRuleset - https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/databrew_rulesetSchedule - https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/databrew_scheduleIf this helps, please accept answer or upvote.CommentShareAnanth Tirumanuranswered 3 months ago"


Question: Any special configs for pinned lambda components required?

"We face a strange situation with our two pinned lambda based component running in GGv2.These two components are similar to each other. They both are connected to local MQTT broker from one side and to IoT Core via IPC from another side.One of the components forwards messages from local MQTT broker to IoT topic. It is subscribed to one local topic and publishes messages to one IoT core topic.The second component does the same but it uses a different local topic and shadow topics in IoT Core. Plus it forwards messages in the opposite direction as well - from IoT shadow topics to local MQTT topic.So there is no intersection in topics, components use different scopes of topics on both sides. The only common point are local MQTT broker and IPC. We use the same local mosquitto broker but create two different clients using paho-mqtt python created independently in components. We use aws-iot-device-sdk-python-v2 package to work with IPC and IoT Core from Greengrass.When we deploy any single component to our device it works fine without any problems. But being deployed together, one of them fails after a while:2021-03-10T18:17:36.688Z [WARN] (pool-1-thread-3) com.aws.greengrass.lambdamanager.Lambda: The lambda has not reported status within the specified timeout PT1M and will be restarted immediately.. {componentName=CustomComponent}2021-03-10T18:17:36.688Z [ERROR] (pool-1-thread-3) com.aws.greengrass.lambdamanager.UserLambdaService: service-errored. {serviceInstance=0, serviceName=CustomComponent, currentState=RUNNING}com.aws.greengrass.lambdamanager.StatusTimeoutException: Lambda status not received within timeoutat com.aws.greengrass.lambdamanager.Lambda.lambda$createInstanceKeepAliveTask$5(Lambda.java:261)at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)at java.lang.Thread.run(Thread.java:748)2021-03-10T18:17:36.688Z [INFO] (pool-1-thread-3) com.aws.greengrass.lambdamanager.UserLambdaService: service-report-state. {serviceInstance=0, serviceName=CustomComponent, currentState=RUNNING, newState=ERRORED} 2021-03-10T18:17:36.688Z [INFO] (CustomComponent-lifecycle) com.aws.greengrass.lambdamanager.UserLambdaService: service-set-state. {serviceInstance=0, serviceName=AWSCM-46.DoorLocker, currentState=RUNNING, newState=BROKEN} 2021-03-10T18:17:36.689Z [INFO] (CustomComponent-lifecycle) com.aws.greengrass.status.FleetStatusService: fss-status-update-published. Status update published to FSS. {serviceName=FleetStatusService, currentState=RUNNING} 2021-03-10T18:17:36.693Z [INFO] (pool-2-thread-73) com.aws.greengrass.lambdamanager.UserLambdaService: Shutdown initiated. {serviceInstance=0, serviceName=CustomComponent, currentState=BROKEN} 2021-03-10T18:17:37.060Z [INFO] (pool-2-thread-73) com.aws.greengrass.lambdamanager.UserLambdaService: generic-service-shutdown. {serviceInstance=0, serviceName=CustomComponent, currentState=BROKEN}What is more interesting that the component which placed first in deployment.json file used in deployment always fails. We can change the order of components but the first component always fails. It seems as if once the second component is deployed it is somehow affects the first one.Are there any additional settings required to allow two components to work with IPC at the same time? How to debug this issue in general? It's not clear why a component doesn't report its status.FollowComment"

Answer: "0I've tested it with the most simplified configuration. It seems that it is not related to MQTT, brokers, topics or IPC at all.I created two simplest python lambdas with code:print("Body")def lambda_handler(event, context):passThen I created two greengrass components (pinned and with GreengrassContainer mode) with all default params.Both components were deployed successfully, they printed 'Body' into their logs. But after a while one component failed with the same errors as in my initial post. Actually according to logs one component was restarted two times and another was restarted three times. After the third restart the component was marked as BROKEN. The first component contined to run without any further restarts and errors. After each restart both components printed 'Body' into their logs so every time they started normally.It seems as if two components interfere each other and maybe compete to some resources. Really weird behavior. Don't know how to dedug it further.CommentSharelacteolusanswered 2 years ago0The two pinned lambda which you deployed, are they based on the same lambda? In the effectiveConfig.yml file, do your two components have the same lambda arn value in the configuration?You are running both in container mode, what is the memory limit set to? By default it is 16MB which is quite small for Python. Your lambdas may run out of memory and the OS is killing them. Please also try to increase the memory limit if you just used the default value.Thanks,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hi MichaelDombrowski-AWS,Thanks a lot. These two components are based on two different lambdas and ARNs for them are different in effectiveConfig.yml.But is seems that memory settings have effect. With 128 MB per container two components have been running for 30 minutes without issues.I thought that 16 MB was quite enough for lambda which only prints a single word. And there were no any hints about lack of memory in logs. Plus the components are independent and it was weird that one of them failed but another one didn't. So it all was confusing.Nevertheless it raises some additional questions. How this container memory config is tied to Nucleus memory settings? Are these megabytes or part of them consumed from the memory provided for Greengrass core or not? Should I change configurationUpdate for Nucleus deployment accordingly?E.g. "merge": "{"jvmOptions":"-Xmx2G"}"BRCommentSharelacteolusanswered 2 years ago0The lambda memory is not in any way related to the Nucleus JVM memory settings. Greengrass core will not be using any of those 16MB. There will be some amount of memory being used by the Greengrass Python Lambda runtime support library, but that's relatively small.CommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago"


Question: "Sending UDP traffic to EC2 host from ECS instance, security group issue on EC2 host"

"I'm wanting to send UDP traffic to an EC2 host in the same VPC as an ECS instance and I can only get it to work by testing with allowing all source IPs in the security group for the EC2 instance. With RDS it's always worked fine to use the RDS instance's security group ID as source in the ECS container's security group, but that isn't working here, where I'd use the ECS container's SG as source for the UDP port in the EC2 instance's SG. I tried using something like 172.30.0.0/16 to allow all VPC traffic, but that doesn't work either. Are ECS instances in my VPC? Thanks for any help.FollowCommentMarc Schuricht a year agoI'm assuming you are using ECS on EC2, not Fargate...can you confirm? If so, what Task networking mode are you using? (AWSVPC, BRIDGE, or HOST)?Sharechintanp 9 months ago@AWS-User-5227227 Were you able to resolve this issue? I have the same issue, where I am trying to connect to a DB on EC2 from ECS - without success.Share"


Question: What cipher mode is used for Elasticache encryption at rest?

"I am currently working through some due diligence for use of Elasticache for Redis. I need to understand the encryption standard used and cypher mode.The following AWS whitepaper references Elasticache uses AES-512 standard for encryption at restThis page highlights it now meets AES256 standards.I am not a cryptography expert but as I understand it, the biggest block size for AES is 256.Ignoring the AES standard. I am more interested in the cypher mode at this stage.Does anyone know cypher mode is used? is it XTS?FollowComment"

Answer: "0Accepted AnswerSee this whitepaper on encryption in AWS: AWS KMS Cryptographic Details"Each volume is encrypted using AES-256-XTS. This requires two 256-bit volume keys, which you can think of as one 512-bit volume key. "CommentShareEXPERTkentradanswered a year ago"


Question: Step-by-Step Guide in setting up omnichannel contact center

"Is there any step-by-step guide to setting up a remote Amazon Connect contact center? If so, can someone send me the link or can Amazon Support help with the setup? Thank youFollowComment"

Answer: 0These 3 tutorials introduces basic capability:https://docs.aws.amazon.com/connect/latest/adminguide/tutorials.htmlThis is a self learn workshop:https://catalog.us-east-1.prod.workshops.aws/workshops/b06b53f6-3b36-4e1a-a208-ddbeb25405c6/en-USLost of good ideas here:https://aws.amazon.com/blogs/machine-learning/category/contact-center/amazon-connect/And finally the resource center:https://aws.amazon.com/connect/resources/CommentShareKishananswered a year ago0This is also very usefull :https://github.com/amazon-connectThis one contains a lot of good stuff: https://github.com/amazon-connect/amazon-connect-snippetsCommentShareLuc Paquetanswered a year ago


Question: LightSail - Black screen with cursor

"Hi,I just started a new instance using a snapshot.Few minutes  later i tried the browser-based SSH client.I just get a black screen and the cursor in the top left.Using Putty i get the same result.I retried 1 hour later but no luck.Reboot no changeShutdown then Start no changeUpdate 1 : The browser-based SSH client  ends up giving me the  UPSTREAM_NOT_FOUND [519]So i tried to add a Launch Scriptsudo ufw disablesudo iptables -Fsudo mv /etc/hosts.deny /etc/hosts.deny_backupsudo touch /etc/hosts.denysudo systemctl enable sshdsudo systemctl restart sshdStill not workingUpdate 2 : Find  some Instance status check failuresCheck the troubleshooting sectionit s not a disk usage issue , i m only using 39%burstable zone :  i m not higher than 12 %What can I do ?Any magic scripts ?ThanksFollowComment"

Answer: "0What are the specs for your instance? Do you encounter the same issue when you create a new instance from scratch instead of creating from a snapshot?If you continue to have issues feel free to submit a ticket through the "Questions? Comments?" link in Lightsail's footer area so we can investigate further.Thanks for using LightsailCommentShareAWS-User-7183595answered a year ago0Additionally, ensure that your instance has opened the default SSH port 22https://lightsail.aws.amazon.com/ls/docs/en_us/articles/understanding-firewall-and-port-mappings-in-amazon-lightsailCommentShareAWS-User-7183595answered a year ago0Thanks for the ideaSSH port is openedIf I create a brand new instance from scratch it works  ...So it means that all the daily snapshots i have are corrupted ... no wayCommentShareAWS-User-5639703answered a year ago"


Question: Cloudfront 502 when using an ALB as custom origin via Lambda@Edge

"Hi there,I filter requests to have crawlers and bots consuming a dedicated origin.This origin is an express webserver using puppeteer on ECS, behind an ALB.Calling directly the ALB using public DNS name works  - the required content is served as expected.I use two Lambda@Edge functions to filter the incoming requests:first one at viewer request to "tag" the request by adding a header,second one at origin request to change the origin of the request, from S3 to custom origin (the ALB).Everything works fine, the lambda are triggered, but the result is a 502 from cloudfront:
502 ERROR

The request could not be satisfied.

CloudFront wasn't able to connect to the origin.We can't connect to the server for this app or website at this time. There might be too much traffic or aconfiguration error. Try again later, or contact the app or website owner.The origin is changed as in the examples:   request.origin = {    custom: {     domainName: 'XXX.eu-west-3.elb.amazonaws.com',     port: 3000,     protocol: 'https',     path: '',     // querystring: request.querystring,     sslProtocols: ["TLSv1", "TLSv1.1", "TLSv1.2"],     readTimeout: 5,     keepaliveTimeout: 5,     customHeaders: {}    }   };   request.headers['host'] = [{ key: 'host', value: 'XXX.eu-west-3.elb.amazonaws.com' }];As said previously, calling XXX.eu-west-3.elb.amazonaws.com:3000 directly using Postman works perfectly fine.Am I missing something ?!Thanks for the help,EDIT: I checked the protocol, added the custom origin in the "Origins" of Cloudfront without change of the resultFollowComment"

Answer: "0You can  check why the 502 is the failing which should be one of the following  conditions:SSL/TLS negotiation failure between CloudFront and a custom origin serverOrigin is not responding with supported ciphers/protocolsSSL/TLS certificate on the origin is expired, invalid, self-signed, or the certificate chain is in the wrong order:Origin is not responding on specified ports in origin settingsReference : https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/http-502-bad-gateway.htmlI would first configure the ELB as Origin in the Cloudfront and route the request to see everything is working and then emulate the Origin request using lambda using the below Event structure for Origin request :https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-event-structure.html#example-origin-requestCommentShareAWS-User-6083366answered a month ago"


Question: Adding Domain Name to CloudFront Distribution

"Good afternoon.I created a S3 static website (public settings enabled) reachable by the Object URL.   I then created a CloudFront distribution with the S3 bucket as the origin domain and an Amazon issued SSL certificate. No issues as I am able to reach the distribution through the distribution domain name.   Next, I want to add a domain (Amazon is the CA and I have a hosted zone) to the distribution, but this is not working.I added a alternate domain name in the distribution with the website domain name and created an alias in Route 53 pointing the record name to the distribution domain name.    What I am missing?My Route 53 hosted zone has NS, SOA, A (alias) and CNAME (for ACM certificate).Thank you in advance and have a blessed holiday season.FollowCommentflyingpan1996 a year agoIs this the Resume challenge? Are you able to load your site without "www" ?Share"

Answer: "0Accepted AnswerOk, for the 50th time, I deleted the alias and created it again.   This time it worked.Last night, AWS was having us-east-1 issues.   Maybe DNS was also affected.   I will close the question.CommentSharesharpedgewvanswered a year ago"


Question: Fetching the Time of the User Status

"I am new to Amazon Connect and I want to fetch the total time for which the user was in a particular state.Eg:1 - After logging in, for how many time the user was in "Available" state?2 - After logging in, for how many time the user was in "Offline" state?Are there any API Calls to fetch these times?Please help.FollowComment"

Answer: "0You can get that data from the native historical reporting.There you can run an Agent report and add the metrics required, e.g. Agent idle time, Non-Productive Time, Online time or time spend in any of the custom Status you may have defined.  You can find more information about the historical metrics reports in the Administrator Guide.Currently you cannot get the data directly via an API as the Agent channel is available in the GetMetricData API.If you require an programmatic way to access that data, you could leverage agent event streams to store and later on calculate changes to your agents states.CommentSharefaddianswered a year agoEXPERTAWS-samfredreviewed 2 months ago"


Question: Firewall Appliance in front of API Gateway

"Hi Guru's, I have an organisation which desires that traffic is private and runs through a traditional security perimeter which includes an AWS Firewall!  Some consumers are external and call the API Gateway from the internet using a RESTful call.  The intention is that the API Gateway uses a private endpoint inside a DMZ VPC behind a WAF and Firewall, but is presented externally (Potentially using the AWS Firewall to achieve this which routes the traffic to the private API Gateway).  The organisation would like the DMZ API Gateway to call another Service API Gateway which then calls the APIs in the same VPC via their private endpoint.  The initial call to the DMZ API Gateway uses OpenID Connect for authentication.  The internal API's call each other using Mutual TLS Auth.  I have provided a basic diagram of the desired setup but based on my research I am not sure this is feasible.  Can anyone provide information as to whether this is possible, and suggest a configuration that could be used?  We are happy to use other devices such as NLB etc to achieve this objective.Many thanks in advance.FollowComment"

Answer: "1First, this architecture won't work because you can't present a Network Firewall endpoint publicly. You must have something that has an Elastic IP attached to it (so in this case, probably Application Load Balancer) and then direct the traffic to Network Firewall.Second, I wouldn't recommend this architecture. Given the features available in APi Gateway (in terms of pulling inbound requests apart; checking them for validity; and acting as an ingress point for all requests) and that you can attach WAF to API Gateway I would question the value of adding a firewall to the mix. In short, I think there are better ways of doing this although I totally understand that customers are often comfortable with the approach of "but this is the way we've always done it".If it were me, I'd use API Gateway and (maybe) WAF to go with it - because it provides a high level of security for a low  level of complexity.Given the complexity of this design and the customer requirements I'd strongly recommend that you get in touch with your local AWS Solutions Architect to discuss the best way forward. Not trying to avoid a conversation here - more that this is something much easier accomplished interactively rather than in this particular format.CommentShareEXPERTBrettski-AWSanswered 10 months agoChris 10 months agoThanks very much for your response.  Appreciate your comments that this may not be the best architecture, but it may be the only architecture I can get through a traditional security team.  The Organisation also has a hard requirement for IPS, which may involve using a 3rd party IPS device i.e. a Firewall with IPS as the front door and removing the AWS Firewall from the architecture.  With this in mind, if I place a 3rd party Firewall/IPS device inline, remove the AWS Firewall, would the architecture be viable?  I will also use the company channels to initiate a conversation with an AWS architect interactively.ShareBrettski-AWS EXPERT10 months agoYes, you can place a third-party IPS/Firewall device as the primary, Internet-facing device - but then that leads to scaling issues; single point of failure problems. You could put a load balancer (again: ALB) in front of the IPS/Firewall appliance and while that is better it's still not a great solution. There are other ways to do this but (as you've pointed out) they are difficult to propose to customers who are still thinking traditionally.Share"


Question: How long does it take for DNS records to update via Lightsail?

"Does anyone know how long it takes to update DNS records via the Lightsail console? I'm manually renewing SSL certs which requires adding TXT records to the DNS (https://aws.amazon.com/premiumsupport/knowledge-center/lightsail-bitnami-renew-ssl-certificate/). I've added the new TXT record via the Lightsail console, but querying the records (via https://mxtoolbox.com/SuperTool.aspx) still shows the old files. It's been over an hour at this point so I'm not sure if that's normal or not.FollowCommentJohn Vold a year agoIn case anyone sees this after the fact...I ended up redoing it and it completed in about 10 minutes, so unfortunately I don't know what the issue was.Share"

Answer: "1Hello! As stated in our documentation https://aws.amazon.com/getting-started/hands-on/map-your-domain-at-route53-to-lightsail/6/ DNS record updates can take up to 72 hours.Sometimes I have used this third party website https://www.whatsmydns.net/ to check the status of the propagation around different DNS servers around the world.CommentShareSUPPORT ENGINEERFrancisco_Lanswered a year agoJohn Vold a year agoI understand they say it can take up to 72 hours, but in reality does it take that long? It's now been almost 24 and it's still not resolving.ShareFrancisco_L SUPPORT ENGINEERa year agoI have seen records take nearly 72 hours, but usually takes less. Have you checked the status of the propagation of the records? Have you used tools like nslookup to query the nameservers of your domain, to see if the records are there? For example:nslookupset type=NS<domain.com>take a look at the nameserver records reported.exitnslookup - <name server record>set type=TXT<record name>If you still have issues, consider raising a new support case so an engineer can assist you further.Share0You can use Amazon Inspector to conduct scans on your instances. See: https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.htmlCommentShareRodney Lesteranswered a year ago"


Question: QLDB finance/acconting books/materials/courses

"Hello,Currently, I'm trying to build the finance/trading system based on QLDB.I want to go deeper into this topic.May I ask you if you have some AWS books/guides/courses/best practices (if I can take/pay) for building a trading ledger (or related topic)?I would appreciate it if you have any.Cheers,SvitlanaFollowComment"

Answer: "0Accepted AnswerHi Svitlana,Thanks for your question! Here are some resources that should help you to get started:An overview of Amazon QLDB and its origins in this 1 hour YouTube video: https://www.youtube.com/watch?v=ZfYDl4kaVCoA 1.5 hours YouTube video that will walk you through an example of building a ledger-based system with Java driver for Amazon QLDB: https://www.youtube.com/watch?v=-5LqDjzAyZUAmazon QLDB Immersion Day Workshop - a set of labs that you can follow to try different aspects of using QLDB: https://qldb-immersionday.workshop.aws/An example of double-entry bookkeeping application with Java and Amazon QLDB: https://github.com/aws-samples/amazon-qldb-double-entry-sample-javaThere is also a great sample application that goes deeper into using the driver in different languages with many examples: https://docs.aws.amazon.com/qldb/latest/developerguide/getting-started-sample-app.htmlA great catalogue of other resources related to Amazon QLDB: https://github.com/mlewis7127/awesome-qldbWhen it comes to the trading ledger, from the architectural stand point, Amazon QLDB can play a role of settlement ledger, like in the  double-entry bookkeeping example above. At the same time, when it comes to order matching, the queries might become complicated and your solution might require to use another database in conjunction with QLDB, that will facilitate those queries more efficiently (see Lab4 as an example of using Amazon Aurora together with QLDB). Here are some details about optimizing query performance that also touches on the limitations to be aware of: https://docs.aws.amazon.com/qldb/latest/developerguide/working.optimize.htmlCommentShareNikolay Vlasovanswered 2 months agorePost-User-2019375 a month agoThanks a lot!Share"


Question: EFS mount point vs access point

"Hi There,Can someone help me understand what is the fundamental difference between an Access Point and a Mount Point in EFS. I have read the aws docs but I am still so confused!!Or maybe point me to a simple documentation..Thanks in advance :)Kind Regards,DhairyaFollowComment"

Answer: "1HelloWhen you create a EFS file system, it's mounted on a client through a mount target [mount target provides an IP address for an NFSv4 endpoint at which you can mount an Amazon EFS file system].  During mount operation, you specify a mount point [this is the local directory on the client where the EFS file system is mounted & accessible on the client]. Essentially you are presenting the top level/root of the filesystem to the client and all the data underneath. You must have proper privileges to perform these operations and you can use IAM to implement security controls. Following link provides good explanation of this along with some diagrams.https://docs.aws.amazon.com/efs/latest/ug/how-it-works.htmlAfter creating a file system, by default only the root user (UID 0) has read, write, and execute permissions. For other users to modify the file system, the root user must explicitly grant them access. You can use access points to automate the creation of directories that a nonroot user can write from. For more information, see Working with Amazon EFS access points.https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.htmlhttps://docs.aws.amazon.com/efs/latest/ug/accessing-fs-nfs-permissions.htmlAmazon EFS access points are application-specific entry points into an EFS file system that make it easier to manage application access to shared datasets. Access points can enforce a user identity, including the user's POSIX groups, for all file system requests that are made through the access point. Access points can also enforce a different root directory for the file system so that clients can only access data in the specified directory or its subdirectories.You can use AWS Identity and Access Management (IAM) policies to enforce that specific applications use a specific access point. By combining IAM policies with access points, you can easily provide secure access to specific datasets for your applications.https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.htmlEssentially this comes down to the security permissions and how EFS is being used. Possible scenarios can be implementing use of EFS for a single application/user/dataset or multiple application/users/dataset. Hope this helps.CommentSharerePostfanclubanswered a year agoEXPERTRob_Hreviewed a year ago"


Question: Benefits of using Amazon CloudFront together with HTTP Amazon API Gateway

This question is related to https://repost.aws/questions/QUGMi_eNmkTB-nVwLdze9eKA/what-are-the-benefits-of-using-amazon-cloud-front-together-with-amazon-api-gateway where REST API Gateway performance benefits were discussed when using along with CloudFront.What about CloudFront distribution in front of HTTP API Gateway. Does it provide the same benefits in terms of performance? As far as I'm concerned this type of API Gateway uses Regional API endpoints. I wonder if I would benefit from a CloudFront distribution pointing to a HTTP API Gateway in a single region?FollowComment

Answer: "0Hi,Apart from providing same benefits for performance, it is also a way to enable WAF on http api via CloudFront, given that you cannot directly attach a WAF to an http api gateway type.Hope it helpsCommentShareEXPERTalatechanswered 3 months agorePost-6493930 3 months agoHi @alatech , thanks for posting. The WAF indeed is an additional benefit in this case. However, I still have some doubts about the performance. In particular I wonder how the traffic between CF and HTTP API Gateway flow? Does it leverage on the AWS backbone or public internet? Since HTTP API Gateway endpoint is PUBLIC I expect that the traffic goes via the Internet.Share"