Question: Greengrass V2 Pub/Sub Hello World

"I am doing the "com.example.HelloWorld" tutorial on Python Greengrass V2. I added the tutorial stuff and am using ipc_client.new_publish_to_iot_core() to push a message to the core (per all the online example code) - and added the permissions stuff for it in my deployment. I am doing LOCAL development of this function - using greengrass-cli to create and restart it - and looking at the logs (and timestamps) to confirm it's running.It APPEARS to be working in that it is nothing is throwing errors - and the prints I have before and after the publish all are coming out.But my question is - I thought if I went to the "test->MQTT Test client" in the IoT GUI, and subscribed to the "#" topic - I should be able to see my messages get published - but I am not. I saw another demo online in which this is exactly what they did.So - is this the correct way to see if stuff is getting published? Or is there somethiing else. And if so - and idea why this wouldn't be working??FollowComment"

Answer: "0Accepted AnswerI can see that you are using the ipc_client.new_publish_to_topic() method. This is used for local pub/sub as shown here https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-publish-subscribe.html#ipc-operation-publishtotopic. Instead you should be using ipc_client.new_publish_to_iot_core() as shown in the publish to IoT core tutorial (and also add relevant permissions) as shown here https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-iot-core-mqtt.html#ipc-operation-publishtoiotcoreCommentShareAWS-User-1579492answered 2 years ago0Hi Bradley,Can you check the IAM Role (associated to the IoT Role alias) for the GG Core to make sure it has permissions to publish to the IoT Core? Can you share the policy document?To debug further, it will be helpful to get the debug logs for both the component and greengrass.log. Have you taken a look at the greengrass.log file for any clues?ThanksCommentSharesushantAtAWSanswered 2 years ago0Thanks for the help! I assume from your response I SHOULD be seeing the published message in the console??My log output is:2021-11-14T01:20:32.376Z [INFO] (pool-2-thread-36) com.example.HelloWorld: shell-runner-start. {scriptName=services.com.example.HelloWorld.lifecycle.Run, serviceName=com.example.HelloWorld, currentState=STARTING, command=["python3 -u /greengrass/v2/packages/artifacts/com.example.HelloWorld/1.0.0/hell..."]}2021-11-14T01:20:32.716Z [INFO] (Copier) com.example.HelloWorld: stdout. BKG2 Hello, world! Current time: 2021-11-14 01:20:32.715702.. {scriptName=services.com.example.HelloWorld.lifecycle.Run, serviceName=com.example.HelloWorld, currentState=RUNNING}2021-11-14T01:20:32.727Z [INFO] (Copier) com.example.HelloWorld: stdout. SCRIPT DONE. {scriptName=services.com.example.HelloWorld.lifecycle.Run, serviceName=com.example.HelloWorld, currentState=RUNNING}2021-11-14T01:20:32.773Z [INFO] (Copier) com.example.HelloWorld: Run script exited. {exitCode=0, serviceName=com.example.HelloWorld, currentState=RUNNING}i.e. There is NOT reference to the publish failing.MQTT Test Client is showing a few events like:$aws/events/subscriptions...and$aws/events/presence/...for my GG node if I restart the Nucleus - so something is connecting. But nothing for the topic I am publishing to or anything else on the "#" topic.The script (I removed a little to make it shorter):message = "BKG2 Hello, %s! Current time: %s." % (sys.argv[1], datetime.datetime.now())print(message)ipc_client = awsiot.greengrasscoreipc.connect()topic = "my/topic"message = "Hello, World!"request = PublishToTopicRequest()request.topic = topicpublish_message = PublishMessage()publish_message.binary_message = BinaryMessage()publish_message.binary_message.message = bytes(message, "utf-8")request.publish_message = publish_messageoperation = ipc_client.new_publish_to_topic()operation.activate(request)future = operation.get_response()future.result(10)print ("SCRIPT DONE")IAM access advisor says that any IoT accesses were "Not accessed in the tracking period"The IAM policy for this thing is as follows:{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": ["logs:ListTagsLogGroup","iot:ListProvisioningTemplateVersions","logs:DeleteSubscriptionFilter","logs:DescribeLogStreams","iot:ListJobExecutionsForJob","logs:DescribeSubscriptionFilters","logs:StartQuery","logs:DescribeMetricFilters","iot:ListThingsInThingGroup","iot:ListTargetsForSecurityProfile","logs:DeleteLogStream","iot:ListJobExecutionsForThing","iot:ListSecurityProfilesForTarget","logs:CreateExportTask","logs:CreateLogStream","logs:DeleteMetricFilter","iot:Subscribe","iot:GetBehaviorModelTrainingSummaries","iot:ListDetectMitigationActionsExecutions","logs:DeleteRetentionPolicy","logs:GetLogEvents","iot:ListPolicyVersions","iot:GetThingShadow","logs:AssociateKmsKey","logs:FilterLogEvents","iot:Publish","iot:ListViolationEvents","logs:DisassociateKmsKey","iot:ListNamedShadowsForThing","logs:DescribeLogGroups","logs:DeleteLogGroup","iot:ListSecurityProfiles","logs:CreateLogGroup","logs:PutLogEvents","iot:UpdateThingShadow","logs:PutMetricFilter","iot:Receive","iot:ListActiveViolations","iot:ListTargetsForPolicy","iot:ListThingsInBillingGroup","iot:ListThingGroupsForThing","logs:PutSubscriptionFilter","logs:PutRetentionPolicy","logs:GetLogGroupFields"],"Resource": ["arn:aws:logs:us-east-1:583841319539:log-group:greengrasstest:log-stream:","arn:aws:logs:us-east-1:583841319539:log-group:greengrasstest","arn:aws:iot::583841319539:thinggroup/"]},{"Sid": "VisualEditor1","Effect": "Allow","Action": ["logs:ListTagsLogGroup","iot:ListProvisioningTemplateVersions","logs:DeleteSubscriptionFilter","logs:DescribeLogStreams","iot:ListJobExecutionsForJob","logs:DescribeSubscriptionFilters","logs:StartQuery","logs:DescribeMetricFilters","iot:ListTargetsForSecurityProfile","logs:DeleteLogStream","iot:ListJobExecutionsForThing","logs:CreateExportTask","logs:CreateLogStream","logs:DeleteMetricFilter","iot:Subscribe","iot:GetBehaviorModelTrainingSummaries","iot:ListDetectMitigationActionsExecutions","logs:DeleteRetentionPolicy","logs:GetLogEvents","iot:ListPolicyVersions","iot:GetThingShadow","logs:AssociateKmsKey","logs:FilterLogEvents","iot:Publish","iot:ListViolationEvents","logs:DisassociateKmsKey","iot:ListNamedShadowsForThing","logs:DescribeLogGroups","logs:DeleteLogGroup","iot:ListSecurityProfiles","logs:CreateLogGroup","logs:PutLogEvents","iot:UpdateThingShadow","logs:PutMetricFilter","iot:Receive","iot:ListActiveViolations","iot:ListTargetsForPolicy","iot:ListThingsInBillingGroup","iot:ListThingGroupsForThing","logs:PutSubscriptionFilter","logs:PutRetentionPolicy","logs:GetLogGroupFields"],"Resource": ["arn:aws:logs:us-east-1:583841319539:log-group:greegrasstest:log-stream:","arn:aws:logs:us-east-1:583841319539:log-group:greengrasstest","arn:aws:iot::583841319539:custommetric/","arn:aws:iot::583841319539:dimension/","arn:aws:iot::583841319539:topic/","arn:aws:iot::583841319539:thing/","arn:aws:iot::583841319539:securityprofile/","arn:aws:iot::583841319539:topicfilter/","arn:aws:iot::583841319539:job/","arn:aws:iot::583841319539:provisioningtemplate/","arn:aws:iot::583841319539:billinggroup/","arn:aws:iot::583841319539:policy/"]},{"Sid": "VisualEditor2","Effect": "Allow","Action": ["logs:ListTagsLogGroup","logs:DisassociateKmsKey","logs:DeleteSubscriptionFilter","logs:DescribeLogGroups","logs:DeleteLogGroup","logs:DescribeLogStreams","logs:DescribeSubscriptionFilters","logs:StartQuery","logs:DescribeMetricFilters","logs:CreateLogGroup","logs:DeleteLogStream","logs:PutLogEvents","logs:CreateExportTask","logs:PutMetricFilter","logs:CreateLogStream","logs:DeleteMetricFilter","logs:DeleteRetentionPolicy","logs:GetLogEvents","logs:AssociateKmsKey","logs:FilterLogEvents","logs:PutSubscriptionFilter","logs:PutRetentionPolicy","logs:GetLogGroupFields"],"Resource": "arn:aws:logs:us-east-1:583841319539:log-group:greegrasstest"},{"Sid": "VisualEditor3","Effect": "Allow","Action": ["iot:ListOTAUpdates","logs:GetLogRecord","iot:ListAuditSuppressions","iot:ListTunnels","iot:ListV2LoggingLevels","iot:ListAuditMitigationActionsExecutions","iot:ListBillingGroups","logs:ListLogDeliveries","iot:ListJobTemplates","iot:Subscribe","iot:ListScheduledAudits","logs:CancelExportTask","iot:ListDomainConfigurations","iot:ListThingRegistrationTasks","iot:ListMitigationActions","iot:ListDetectMitigationActionsTasks","logs:DescribeDestinations","iot:ListCertificatesByCA","iot:ListAuditFindings","logs:StopQuery","logs:DeleteQueryDefinition","iot:ListCustomMetrics","iot:Receive","logs:CreateLogDelivery","logs:DescribeExportTasks","iot:ListAuditMitigationActionsTasks","iot:ListPrincipalThings","logs:GetQueryResults","logs:UpdateLogDelivery","iot:ListPolicies","iot:ListFleetMetrics","iot:ListRoleAliases","iot:ListIndices","iot:ListThings","iot:ListTopicRuleDestinations","iot:ListDimensions","iot:ListOutgoingCertificates","iot:ListCACertificates","logs:GetLogDelivery","iot:ListThingGroups","iot:ListPrincipalPolicies","logs:DeleteLogDelivery","iot:ListProvisioningTemplates","logs:DescribeQueryDefinitions","logs:PutDestination","logs:DescribeResourcePolicies","iot:Publish","iot:ListThingRegistrationTaskReports","logs:DescribeQueries","iot:ListAuditTasks","iot:ListTopicRules","logs:PutDestinationPolicy","iot:ListPolicyPrincipals","logs:TestMetricFilter","logs:DeleteDestination","logs:PutQueryDefinition","iot:ListAttachedPolicies","iot:ListThingTypes","iot:ListRetainedMessages","iot:ListStreams","iot:ListThingPrincipals","iot:ListAuthorizers","iot:ListJobs","iot:UpdateThing","iot:ListCertificates"],"Resource": "*"}]}CommentShareBradley Goodmananswered 2 years ago"


Question: cannot to clone codecommit with username in git url

"I have one repo in CodeCommit, and I created one IAM account in IAM, for example my name is user01I can use command, git clone https://my-repo-url.git to clone my repo, it is success.but when i use clone https://user01@my-repo-url.git, i get 403.I need to attach username to url, because i use third party service, it attach the username to git urlFollowComment"

Answer: "0In my environment, I was able to clone the following.If you do it with a username followed by a password, there should be no problem.git clone https://username:password@my-repo-url.gitCommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-4753344 2 months agoYes I test it , your command "git clone https://username:password@my-repo-url.git" works.Does  "git clone https://username@my-repo-url.git" works in your env?ShareRiku_Kobayashi EXPERT2 months agoNo, if you do not include the password, it will fail with a 403 error.Share0Please put your settings in the following file.".git/config"Please change the URL as follows.[remote "origin"]url = https://username:password@my-repo-url.gitCommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-4753344 2 months agoHi, this is my command output, the git command should have not access .git/configroot@vultr:~# git clone https://git-xxx.us-east-1.amazonaws.com/v1/repos/xxx_app.gitCloning into 'xxx_app'...Username for 'https://git-xxx.us-east-1.amazonaws.com': ^Cthis command show username prompt for input success.root@vultr:~# git clone https://xxx_git-at-1211112121@git-xxx.us-east-1.amazonaws.com/v1/repos/xxx_app.gitCloning into 'xxx_app'...fatal: unable to access 'https://git-xxx.us-east-1.amazonaws.com/v1/repos/aufwallet_app.git/': The requested URL returned error: 403this command reject my request.Share0Is there any chance to see this working when specifying the username only? I need it to mirror an external repository to CodeCommit, and the interface (of the external repo) does not permit to specify the URL in the user:pwd form.CommentSharerePost-User-5618207answered 2 months agorePost-User-5618207 a month agoThis is needed to address push repository mirroring like this: https://docs.gitlab.com/ee/user/project/repository/mirror/push.html#set-up-a-push-mirror-from-gitlab-to-aws-codecommitOther Git management tools work fine with the https://username@url form.Is there any chance to let this work?Share"


Question: Correct workflow for IAM password expiry email notifications

"Hello all!Is there currently a supported way of providing users with password expiry notifications via email? I've started putting something together using Lambda and the IAM credentials report, but that seems like a feature that might already exist - what would be the correct way to implement this?FollowComment"

Answer: "0Hello danielpodwysocki,You seem to be on the right track with putting something together using Lambda and IAM credentials report, although IAM Management console does include a 15 day warning for password expiration on IAM user accounts[1], I think this is not sufficient for what you are trying to accomplish. This is a third party link that will provide some more detail on creating a script that would allow for you to utilize Lambda to create an email notification workflow[2].Let me know if you have any other questions.References:[1]https://aws.amazon.com/blogs/security/new-iam-features-enhanced-password-management-and-credential-reports/#:~:text=Users%20are%20notified%20starting%2015,access%20the%20AWS%20Management%20Console.[2]https://stackoverflow.com/questions/58082159/how-to-notify-iam-users-when-password-access-keys-expireCommentShareMichael_Oanswered 10 months ago"


Question: Setting up an S3 notification for a read operation

"I am trying to get a notification each time an S3 object is opened (read), and wondering if this is possible using S3 notifications. We are using a barcode scanner to open pdfs stored as S3 objects.I found a tutorial somewhere on how to do this:"For the "Events" section, select the "All object read operations" or choose "Specific object read operations" and check "GetObject". This will trigger the event when an object is opened (read)."Here's where I'm looking for notifications:S3 bucket > Create event notification > ("Specific object read operations") - cannot find this trigger.So, is there a way to send a notification or trigger a Lambda function when an object is opened?FollowComment"

Answer: 1Take a look at this: Introducing Amazon S3 Object Lambda – Use Your Code to Process Data as It Is Being Retrieved from S3.CommentShareEXPERTkentradanswered 2 months agoEXPERTBrettski-AWSreviewed 2 months ago


Question: PennyLane Lightning-GPU simulator

"I ran the single instance training job using the PennyLane Lightning-GPU simulator on a ml.p3.16xlarge instanceas shown at the following URL using Amazon Braket SDK from my local machine command line:https://github.com/aws/amazon-braket-examples/blob/main/examples/hybrid_jobs/5_Parallelize_training_for_QML/Parallelize_training_for_QML.ipynbI get the following output:Traceback (most recent call last):File "/media/user1/QML/amazon-braket-examples/examples/hybrid_jobs/5_Parallelize_training_for_QML/parallelize_training.py", line 27, in <module>job = AwsQuantumJob.create(File "/home/user1/.conda/envs/braket/lib/python3.10/site-packages/braket/aws/aws_quantum_job.py", line 198, in createjob_arn = aws_session.create_job(**create_job_kwargs)File "/home/user1/.conda/envs/braket/lib/python3.10/site-packages/braket/aws/aws_session.py", line 211, in create_jobresponse = self.braket_client.create_job(**boto3_kwargs)File "/home/user1/.conda/envs/braket/lib/python3.10/site-packages/botocore/client.py", line 508, in _api_callreturn self._make_api_call(operation_name, kwargs)File "/home/user1/.conda/envs/braket/lib/python3.10/site-packages/botocore/client.py", line 915, in _make_api_callraise error_class(parsed_response, operation_name)botocore.errorfactory.AccessDeniedException: An error occurred (AccessDeniedException) when calling the CreateJob operation: This account is not authorized to use this resource. In order to access additional resources, please contact customer supportI am told by AWS support that my approved service quota is:Service:SageMaker Notebook InstancesRegion: US East (Northern Virginia)Resource Type: Training Job InstancesLimit name: ml.p3.16xlargeNew limit value: 2What could be the issue here regarding the AwsQuantumJob.create error? The same training job ran on a ml.m5.2xlarge instance with the lightning.qubit simulator. Just the ml.p3.16xlarge instance with the lightning.gpu simulator does not work.FollowComment"

Answer: 0Accepted AnswerHi there- Braket Hybrid Jobs is a separate product and does not relate to your SageMaker limits. Support would need to help you get unblocked for Hybrid Jobs specifically to get access to the desired resource. If you have an open support case feel free to use this statement as a follow-up in that case.CommentShareChristian_Manswered 10 months ago


Question: Best way to find AWS server with lowest hop count between servers

I need to find an AWS server that has the lowest hop count to an IP address outside the AWS network. Tips?FollowComment

Answer: "0Hi,The best tool for the job is traceroute. Have you used it before?[ec2-user@ip-172-31-11-211 ~]$ traceroute 8.8.8.8traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets1  216.182.226.220 (216.182.226.220)  190.865 ms 216.182.237.227 (216.182.237.227)  99.642 ms  99.630 ms2  100.66.12.160 (100.66.12.160)  13.744 ms 100.65.65.144 (100.65.65.144)  6.517 ms 100.66.8.64 (100.66.8.64)  66.327 ms3  100.66.10.120 (100.66.10.120)  6.488 ms 100.66.14.98 (100.66.14.98)  12.536 ms 100.66.48.32 (100.66.48.32)  6.490 ms4  100.66.50.182 (100.66.50.182)  6.453 ms 100.66.34.142 (100.66.34.142)  13.740 ms 241.0.11.195 (241.0.11.195)  6.431 ms5  241.0.11.215 (241.0.11.215)  6.420 ms 241.0.11.207 (241.0.11.207)  6.409 ms 241.0.11.223 (241.0.11.223)  6.397 ms6  242.2.10.169 (242.2.10.169)  6.410 ms 240.0.160.24 (240.0.160.24)  0.376 ms 240.0.160.18 (240.0.160.18)  0.353 ms7  52.93.29.43 (52.93.29.43)  0.933 ms 52.93.29.63 (52.93.29.63)  0.803 ms 52.93.29.53 (52.93.29.53)  0.792 ms8  52.93.29.45 (52.93.29.45)  0.777 ms 100.100.4.12 (100.100.4.12)  1.185 ms 52.93.29.43 (52.93.29.43)  0.887 ms9  100.100.4.2 (100.100.4.2)  0.844 ms 100.100.2.38 (100.100.2.38)  1.572 ms 99.83.68.209 (99.83.68.209)  1.667 ms10  * * 99.83.65.3 (99.83.65.3)  0.913 ms11  dns.google (8.8.8.8)  1.089 ms  1.143 ms  0.989 ms[ec2-user@ip-172-31-11-211 ~]$Best,DiegoCommentShareEXPERTDiego Soaresanswered a year ago"


Question: Cloud Quest Architect Role permission denied

"Hello! I'm currently on a Container Services step in the Architect Role of a cloud quest. I followed instructions carefully but have an issue with installing docker during the lab part. I got an error./install_scripts/install_docker.sh Permission deniedI tried with different browsers and sessions, but got the same message. Could you help me with this pleaseAnnaFollowComment"

Answer: "0Hello Anna,We could not reproduce the issue. Can you please retest?Docker is installed by default in the Cloud9 instance. You can potentially skip the step to install docker.Regards,Ashok.CommentSharerePost-User-1604498answered 6 months ago"


Question: When can we expect an upgrade to Amazon image "aws/codebuild/amazonlinux2-x86_64-standard:2.0" with nodejs runtime version 14?

"As per a communication received from AWS, we need to update our application from CDK v1 to v2. Since the minimum requirement to do this update is we need node js version>=14 which is currently v12 for Amazon image "aws/codebuild/amazonlinux2-x86_64-standard:2.0". Hence we cannot upgrade the CDK version to v2 until there is an upgarde available . We would want to know when can we expect upgrade to the mentioned image for runtime nodejs version 14.FollowComment"

Answer: "0Hi,As you know that Nodesj v12 is the latest for Amazon Linux 2 x86_64 standard:2.0 and v14 being latest version on nodejs.To view the latest versions you can consult the attached document[1].Regrettably, node js version>=14 is currently not made available for Amazon Linux 2 x86_64 standard:2.0, I am certain that the internal team is constantly working towards releasing the nodes v14 for the above mentioned Image. I would also advised you to keep an eye on what’s new for future releases: https://aws.amazon.com/new/I hope this helps.Resources:[1] https://docs.aws.amazon.com/codebuild/latest/userguide/available-runtimes.htmlCommentShareAsisiphoanswered a year agorePost-User-5508308 a year agoHello, Thanks for the update. Also is there any workaround which can be implemented until then, so that we can still upgrade to CDK v2.Share0Hi there,Upon doing further testing and replication on my side, I was able to install nodejs.x86_64  version 14.19.3-1 successfully by using repo https://rpm.nodesource.com/setup_14.x and then installed aws-cdk@2.28.1 as can be seen below:sudo su -amazon-linux-extras install epel -yyum install curl -ycurl -sL https://rpm.nodesource.com/setup_14.x | sudo bash -yum install nodejs -ynpm install -g aws-cdkConfirmed that nodejs is installed:[root@ip-172-31-54-73 ~]# yum list installed nodejsLoaded plugins: extras_suggestions, langpacks, priorities, update-motd208 packages excluded due to repository priority protectionsInstalled Packagesnodejs.x86_64                                                           2:14.19.3-1nodesource                                                           @nodesource[root@ip-172-31-54-73 ~]#Confirmed that cdk is installed:[root@ip-172-31-54-73 ~]# cdk --version2.28.1 (build d035432)[root@ip-172-31-54-73 ~]#I hope this helps, have a pleasant day!CommentShareAsisiphoanswered a year ago"


Question: App Runner service creation failed

"Unable to create app runner service, here is the App Runner service ARN - arn:aws:apprunner:eu-west-1:770785616967:service/website-app-deploy-test-envs/9b8c8ad1fa4a419f9960bac46f58b75a. Creating this onbehalf of the customer for github issue - https://github.com/aws/apprunner-roadmap/issues/110#issuecomment-1331809397FollowComment"

Answer: "0Hi @simon,We can definitely help in increasing the timeout, will let you know once the timeout is increased across all regions so you can retry this service again. ThanksCommentShareHarianswered 6 months agosimon 6 months agoLooking foward to it already :) thanksShareHari 6 months agoHi @simon,We have increased the timeout and the change is promoted across all regions, can you please give it a try and let us knowShare0Hi Hari,yeah it can take quite a while, depends on the machine it's running on. For comparison, on github actions:Run test pipeline / build core packages (pull_request) Successful in 5mRun test pipeline / Build website-app and run tests (pull_request) Successful in 10mthere it takes 15 minutes in total (with a cache though).Is there any possibility to modify the timeout?CommentSharesimonanswered 6 months agoHari 6 months agoHi @simon,We have increased the timeout and the change is promoted across all regions, can you please give it a try and let us knowShare0In this case, the build stage took more than 19 mins to complete which has caused the service creation to fail, possibly because the build is executing some custom script or running unit tests which is taking much longer to complete.Question to @simllll [customer] - When you tested this locally how long did it to take to complete the execution of the build command? I am assuming we are using this command?npm install && npm run buildCommentShareHarianswered 6 months ago"


Question: How can I delete a "hidden" SQS

"I've edited a SQS with a incorrect policy (deny) and then I can't find the SQS in the SQS list console.Therefore, I can't delete it.Is there a way to delete the SQS or edit the SQS policy ?FollowComment"

Answer: 3You will most likely need to login to the account as the root user to delete the queue.CommentShareEXPERTkentradanswered a year ago


Question: S3 presigned URLs not working with Safari 15/iOS 15

"We are migrating a project to PHP SDK V3 from V2. During the testing, we found the images using presigned URLs generated by PHP SDK V3 cannot successfully work with Safari 15/iOS 15. It is easy to test this problem by constructing a simple html file like this:<img src="presigned S3 URL">Then open the html file in Safari, the image will not be successfully downloaded (403 error)  unless you turn off the "Hide IP address" option in Safari 15's preference settings. In Safari 15/iOS 15, the "Hide IP address" is turned on by default, so it's not an option to ask end-users to turn it off.Nevertheless, if you generate the presigned S3 URL by PHP SDK v2, the presigned URLs will work well in Safari 15. We think the V4 signature algorithm used in PHP SDK v3 includes more header checking which failed in Safari 15.Please help us to solve this problem. Thanks a lot.FollowComment"

Answer: 0Accepted AnswerWe found the problem. It is due to that Safari will use apple's machine to download the image file when the "Hide IP address" option is turned on. That machine's IP address is not in the allowed range of the IAM group user which generate the presigned url. Although we are still not sure why v2 signature used by PHP SDK v2 is OK on this situation.CommentSharerePost-User-9868393answered 9 months ago


Question: Project Configurator Advanced Settings and Lyzard.exe Crash

"Ever since 1.21.2 I cannot access Advanced Settings for any project. And when I try to run "Lyzard.exe" it just crashes.When I switch on a gem, save, and switch it off, and save in order to update the ordering of gems and dependencies this doesn't help at all.Follow"

Answer: "0Hi I have this problem too for Lumberyard 1.22 can I check does the Advance setting work for Starter game when you switch it? On discord group they say its a reflection issue for the component.SharerePost-User-9691099answered 3 years ago0Saying it's a reflection issue doesn't help me at all.No, advanced settings doesn't work with Starter Game either. Advanced Settings doesn't show up for a clean project.SharerePost-User-9359627answered 3 years ago0Hi Sorry about the reflection part I think its relates to this part of the docs here: https://docs.aws.amazon.com/lumberyard/latest/userguide/component-entity-system-reflect-component.htmlBut I am not sure how to edit or fix the components.Anyways I managed to get one of my old projects advance settings back by doing a rebuild of it using Lmbr_waf I did it by disabling and re-enabling one of the gems in the project configurator then did a rebuild using lmbr_waf. I also made sure my Visual Studio had all the correct components installed, you may need to uninstall and reinstall.https://docs.aws.amazon.com/lumberyard/latest/userguide/building-your-lumberyard-game-project.htmlSharerePost-User-9691099answered 3 years ago0I did what you said and it didn't work. It also took forever.SharerePost-User-9359627answered 3 years ago0This remains an issue.SharerePost-User-9359627answered 3 years ago0Unhandled exception at 0x00000000642B3310 (qt5core.dll) in Lyzard.exe: 0xC0000005: Access violation reading location 0x0000000000000008. occurredSharerePost-User-9359627answered 3 years ago0Hi,I think I am facing the same issue.The advanced settings trries to, but don't show of anymore.I've rebuilded disabling my gems, did a full reinstallation of lumberyard platform, but without success.Will investigate to get more info ...SharerePost-User-5053647answered 3 years ago0I think it's a bug in 1.22SharerePost-User-9359627answered 3 years ago0HiI don't know if it is related to the issue, but I have installed Perforce, to get rid of some warnings.Now the Advanced settings are showing.BrSharerePost-User-5053647answered 3 years ago0@REDACTEDUSERSharerePost-User-8164888answered 3 years ago0I'm experiencing this same issue in 1.23SharerePost-User-0499262answered 3 years ago0Yup. Still a problem. And the problem is not good. The Advanced Settings GUI are important for setting properties for system components. The XML for which the advanced settings GUI is a front end is what modified but there's no documentation for that XML structure so there's no way to modify it via XML unless this problem becomes fixed or the XML structure is documented.SharerePost-User-9359627answered 3 years ago0Gotcha, I've contacted the team working on that feature to see if there's an update.SharerePost-User-8164888answered 3 years ago0I've notice Lyzard.exe crashes after trying to connect to Perforce. I wonder if anyone else with this problem can install Perforce to see if that solves the issue. I could try but I have no need for Perforce and I don't wish to install it.SharerePost-User-9359627answered 3 years ago0So no update then????SharerePost-User-9359627answered 3 years ago0@REDACTEDUSERSharerePost-User-7328120answered 3 years ago0Hi  Julian,For me installing Perforce solved the issue, but indeed I tried many things that did not worked before, may be one of them succeeded.I remember I've installed two componenet from Perforce web site : a client and the server.Sorry this doesb't help muchGood luck ..SharerePost-User-5053647answered 3 years ago0Thanks Yan for support!SharerePost-User-7328120answered 3 years ago0@REDACTEDUSERSharerePost-User-7158712answered 3 years ago0I really appreciate you taking the time to investigate this issue. Truly thank you.SharerePost-User-9359627answered 3 years ago0This bug has been fixed in 1.25 ... HOWEVER, there's a new bug. I can't modify the "lyshine" system component for "CursorImagePath." It won't allow me to edit it. The whole point of me wanting to use this settings editor was to be able to change that. So now I have to wait on a fix for this NEW bug to be able to use it.SharerePost-User-9359627answered 3 years ago0Update!  The issue has been found and is actively being worked on.The crash seems tied to a problem with error/warning handling. People will typically see that crash when not having Perforce set up, not because of any Perforce issue, but rather the messaging system itself leads to the crash. In the meantime, if you're using the Advanced Settings to edit the System Entity properties a workaround might be to edit the desired values via C++ directly.Otherwise, if you'd like to edit the Memory Settings, you can do so by hand editing dev<your_project>\Config\Game.xml.Sorry for the inconvenience, the team is now actively working on a fix.  Stay tuned!SharerePost-User-7158712answered 3 years ago0https://thumbs.gfycat.com/EthicalRepulsiveAlaskajingle-mobile.mp4SharerePost-User-9359627answered 3 years ago0Hi @REDACTEDUSERArgh I'm sorry to hear about this :(I'll get in touch with the LY-Shine team to see why it's not working and if there's a quick fix.Thanks for your patience, will let you know what I find out 👍TomSharerePost-User-0765265answered 3 years ago0Sorry I never updated this but I do think this did get investigated and resolved, I'm not 100% sure which release it will be in but I'll try and find out tomorrow 👍SharerePost-User-0765265answered 3 years ago0So this is now being officially tracked but unfortunately hasn't been worked on yet, it's on the backlog though! Sorry not to have more infoSharerePost-User-0765265answered 3 years ago0Hey I'm just happy it's on the log. Thanks.SharerePost-User-9359627answered 3 years ago0Just a reminder this wasn't fixed in the latest beta rollout. The button does not work.SharerePost-User-9359627answered 3 years ago0Hey @REDACTEDUSERThanks for the reminder!I actually decided to look at this today (thinking it would be simple... unfortunately it was anything but 😂)I'll follow up with an epic debugging story soon. I think people might find it interesting :slight_smile:Stay tuned...TomSharerePost-User-0765265answered 3 years ago0TLDR: It's still not fixed I'm afraid, but I've got a lot closer... read-on for the sordid details...Okay where to begin...First of all I'd totally forgotten how to even launch and debug the Lyzard.exe app 🙈 To do this you need to generate the lmbr_setup_tools solution file with lmbr_waf msvs -p lmbr_setup_tools.Once I got that working I then tried launching ProjectConfigurator (making it the start-up project) but it spawns a new process when you open the project settings. You need to set some special command line args from Visual Studio to launch Lyzard.exe standalone (-ade-project SamplesProject -ade-config Editor) and make it the start-up project.After going through all this I discovered the button callback is actually firing (I eventually found where this is - PropertyAssetCtrl::PopupAssetPicker()) , but it turns out the call to AssetBrowserComponentRequests::PickAssets was not being handled! We send the request, and there's no friendly listener waiting to give us a response. 😦The reason for this is the Component responsible for implementing this bus is not instantiated in the Lyzard application. The Component in question is AssetBrowserComponent which was not registered in GetRequiredSystemComponents in LyzardGUIApplication.I added this in to the list of Components but then started getting a crash in Qt! 😩 It was complaining that I was trying to create a QWidget before the QApplication had been instantiated (a big no no unfortunately...).This seemed a bit weird to me and after some more head scratching I remembered the next thing to always check is the Output window...Trace::Error d:\dev-london-desktop\dev\Code\Framework\AzCore\AzCore\Component\Entity.cpp(218): 'void __cdecl AZ::Entity::Activate(void)'Entity 'SystemEntity' [0] cannot be activated. Component 'AssetBrowserComponent' is missing another required component.Success! We got a separate error that tried to then report itself using Qt, but at this stage Qt hasn't been created yet, so we get a crash 🙈So next it's off to check GetRequiredServices on AssetBrowserComponent which helpfully tells us that ThumbnailerService is required... While I was at it I checked ThumbnailerComponent and it fortunately has no other required services so we should be good.Still not out of the woods yet... I try launching Lyzard.exe again, but now another crash! 😩 We're trying to create a QPixmap before a QGuiApplication has been created in Thumbnail - no dice 🙁After more digging I realised that QtAppSystemComponent needs to be activated before ThumbnailerComponent, as that creates the QApplication.  To ensure QtAppSystemComponent is activated before ThumbnailerComponent, we need to make ThumbnailerComponent depend on QtAppSystemComponent (using GetDependentServices/GetProvidedServices). I made a new service called QtAppService and hit run one last time...BAMREMOVEDUPLOADAt this point I'm now slowly losing the will to live... (remember this is all to get one button working again...).After some digging it looks like the most likely candidate is that we're missing a call toAzFramework::SimpleAssetReference<TextureAsset>::Register(*serializeContext);in Lyzard.exe... the problem is TextureAsset is actually defined in LmbrCentral, and we don't want to depend on that in Lyzard.exe... So we basically need to refactor TextureAsset to live in a more sensible place than LmbrCentral...I'm afraid at this point I ran out of time... :(I will keep looking into this on Monday, but I hope this gives some indication of the difficulty of fixing seemingly trivial bugs...Watch this space!UPDATE: After all that (going down the rabbit hole and back up again...) there might be a much easier way to simply use am AZStd::string instead of a AzFramework::SimpleAssetReference<LmbrCentral::TextureAsset>... This will avoid pretty much all these problems. It's just a shame this would never have worked in the first place :( I'll take a quick look on Monday and see if there's a nice, quick fix 👍SharerePost-User-0765265answered 3 years ago0Wow. Haha. Well, I just edited the XML anyway so I don't really need button now but that's pretty crazy that one little bug can take you on an odyssey like that. I really appreciate your time though.SharerePost-User-9359627answered 3 years ago0Lol no worries 😛Classic Friday 😂SharerePost-User-0765265answered 3 years ago"


Question: "AWS EC2 Linux 2 MATE -- GUI Issue  --  "cannot open display,various error numbers 3389, 3470""

"First-off, I am accessing VM from Android.Free Tier AWS EC2 Linux 2 with MATE desktop pre-installed, starts/boots in CLI !?Connection through SSH Client from Android has been established smoothly & works fine.The root passed has been set up too.The systemctl has been set to default on boot to desktop.sudo systemctl set-default graphical.targetDespite all that the reboot defaults in cli, how do manage to initialize MATE desktop?FollowComment"


Question: defining the name of task definition json to run ecs task in github actions

"I haven't been able to define task definition file in GitHub actions to run the task of deploying a container with image stored in my repo in ECR. The error I get is:Error: Task definition file does not exist: ecs-task-definition.json  So, I believe this happened because of incorrect path mapping or directories. So, what is the right way to specify the name of task json files?Here's how I have done it:    - name: Fill in the new image ID in the Amazon ECS task definition        id: task-def        uses: aws-actions/amazon-ecs-render-task-definition@v1        with:          task-definition: ecs-task-definition.json          container-name: adp-ecs-container          image: ${{ steps.build-image.outputs.image }}  for more information and all the relevant screenshots:https://stackoverflow.com/questions/64538337/github-actions-error-task-definition-file-does-not-exist-when-pushing-andFollowComment"

Answer: "0I hadn't included the task-definition file in my github repo, which github actions searched when defining task definition.CommentShareNaveen Reddy Marthalaanswered 3 years ago0I faced the same issue, then I figured out that I need to download the task definition first then update it with the new container image.that solved the issue and I was able to deploy to ECS.- name: Download task definition   run: |          aws ecs describe-task-definition --task-definition ${{ secrets.ECS_TASK_DEFINITION }} \          --query taskDefinition > task-definition.json      - name: Fill in the new image ID in the Amazon ECS task definition   id: task-def   uses: aws-actions/amazon-ecs-render-task-definition@v1   with:          task-definition: task-definition.json          container-name: ${{ secrets.ECS_CONTAINER_NAME }}          image: ${{ steps.build-image.outputs.image }}CommentShareSalahianoanswered a year ago"


Question: AWS S3: Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced setting)

"Yesterday, out of the blue when users upload images on my site an error is thrown:##### RightAws::S3Interface returned an error: 400 Bad Request<?xml version="1.0" encoding="UTF-8"?><Error>InvalidBucketAclWithObjectOwnership<Message>Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced setting</Message><RequestId>REQUEST</RequestId><HostId>ID$##### RightAws::S3Interface request: https://bucket.s3.amazonaws.com:443/ ####RightAws::AwsError (InvalidBucketAclWithObjectOwnership: Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced setting):This had never happened before, but earlier I had received an email from AWS:Hello,We are reaching out to inform you that starting in April 2023 Amazon S3 will change the default security configuration for all new S3 buckets. For new buckets created after this date, S3 Block Public Access will be enabled, and S3 access control lists (ACLs) will be disabled.The majority of S3 use cases do not need public access or ACLs. For most customers, no action is required. If you have use cases for public bucket access or the use of ACLs, you can disable Block Public Access or enable ACLs after you create an S3 bucket. In these cases, you may need to update automation scripts, CloudFormation templates, or other infrastructure configuration tools to configure these settings. To learn more, read the AWS News blog [1] and What's New announcement [2] on this change or visit our user guide for S3 Block Public Access [3] and S3 Object Ownership to disable ACLs [4]. Also, see our user guide for AWS CloudFormation on these settings [5][6].This seems related, although it is only supposed to apply to new buckets.  However, using guides I found related to this I changed the settings on my bucket by adding a bucket policy:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "Stmt1380877761162",            "Effect": "Allow",            "Principal": {                "AWS": "*"            },            "Action": "s3:GetObject",            "Resource": "arn:aws:s3:::bucketname/*"        }    ]}And changing the Object OwnershipDespite these changes I am getting the same error.  What would be causing this?FollowComment"

Answer: "0Have you reviewed what ACLs you have on your bucket. You may have a ACL for public access which now needs moving to the policy. You’ll need a put object also on the bucket policy?You can’t have an ACL and bucket owner enforced.CommentShareGary Mcleananswered a month agorePost-User-4356071 a month agoI currently have ACLs disabled.  I thought I was only able to do that if there are no ACLs on the bucket?  At Amazon S3 > Buckets > bucketname > Permissions > Access control list (ACL), I cannot edit and have the message "This bucket has the bucket owner enforced setting applied for Object Ownership When bucket owner enforced is applied, use bucket policies to control access."  Is there another way an ACL can be on it?  And do you have an example of the put for the bucket policy?Share0Hi.  I am sorry you're having this trouble.  You are correct, the behavior just changed.  This error:InvalidBucketAclWithObjectOwnershipis usually only seen when you attempt to create a new S3 bucket that has ACLs but you have bucket ownership enforced.  Since that's not what you're doing, we need to figure out whats actually happening when your website tries to commit the image.  It is possible that error is coming from RightAWS::S3Interface doing some kind of explicit object-level ACL operation when it does the PUT.What kind of website is it that the users are uploading images through?  Rails maybe?Whatever it is, what kind of authentication is it doing for the PUT operation?  How is it being granted access?I'm guessing you want the bucket public for GETs, is that correct?If you enable enable S3 Server Access Logging, we should be able to see specifically what calls are being made by RightAWS:S3InterfaceSide note: even though bucket policies are recommended now, there's nothing wrong with ACLs per se.  They should have continued to work if nothing changed.  I'm a bit puzzled why anything broke at all.  Hopefully the answer will emerge once we see the details of the S3 API calls.CommentShareseahowanswered a month agorePost-User-4356071 a month agoYes, this is a Rails 2.3.2 app.  On the model we have:has_attached_file :image, :storage => :s3,:s3_credentials => "#{RAILS_ROOT}/config/s3.yml",:path => "images/:attachment/:id/:style.:extension",:bucket => 'bucketname',:styles => {:thumb => {:geometry => "160x160>", :processors => [:cropper]} ...   }The Gem Paperclip is used to manage the uploads. Let me know if there's anything specific I should add related to that.Previously it was public for read and writes.Share0Unfortunately, Paperclip expects to use ACLs.  I can see it explicitly trying to interact with them in the gem source.  It has also been deprecated for a few years, so an update to make it work with bucket policies is unlikely.  To get this application working in the short term, you will need to switch your configuration back to having ACLs enabled and Object Ownership not enforced, and troubleshoot why it stopped working in the first place.S3 Server Access Logging will be helpful in that process: https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.htmlGiven the circumstances, I would also recommend opening a case with AWS Support: https://aws.amazon.com/premiumsupport/CommentShareseahowanswered a month ago"


Question: How to assign a lambda function alias to LexV2

"LexV2 allows you to assign a lambda for validation and fulfillment of intents. When selecting the lambda, the console says you can also select a "Lambda function version or alias". In the drop down, I am only able to see lambda versions, but not my lambda function alias. How can I assign a lambda alias to a LexV2 bot?FollowComment"

Answer: "1Hey,We've identified the issue and are working on a fix. We will post an update to this thread once the fix is rolled out. Thanks for bringing this to our attention.Update (02/23) - We have deployed the fix, please let us know if it still doesn't work.CommentShareABHISHEKanswered a year agoCarson-NurtureBoss a year agoAwesome, thank you!Share0Hi,You can publish an alias through aws console as well.Go to your lambda function.You will find an alias header. ( Search for keyword alias ). click on the header.You will find a button Create alias. Click on it.Provide name, description and version number to which you are assigning an alias.Alias will be created successfully.Then in the dropdown, it will show you the the lambda , alias.To know more on lambda alias, refer LINKThank you.CommentShareUchiha_Madaraanswered a year agoCarson-NurtureBoss a year agoI already have a lambda alias, but only the lambda versions are showing in the dropdown. I literally cannot select the alias.Share0To use a lambda alias with my bot alias locale I needed to use the aws cdk with the aws lexv2-models update-bot-alias command. I was able to update theen_US local like so:  "botAliasLocaleSettings": {      "en_US": {          "enabled": true,          "codeHookSpecification": {              "lambdaCodeHook": {                  "lambdaARN": "arn:aws:lambda:<region>:<accountId>:function:<functionName>:<aliasName>",                  "codeHookInterfaceVersion": "1.0"              }          }      }  },Note, from the console the "Lambda function version or alias" section is blank but calling describe-bot-alias shows the proper configuration. This appears to be a console bug.API DocsCLI DocsCommentShareCarson-NurtureBossanswered a year ago"


Question: Amazon SES Custom MAIL FROM Domain Setup jumping between DISABLED / ENABLED

"Since I have enabled a custom mail from domain I keep getting notifications that the domain setup has been disabled – and a couple hours later enabled again. This happens almost once every day. Note that I am not changing any DNS setting in between. The domain is not hosted with AWS, but the DNS records are properly set.Any idea what might go wrong?Subjects of the email notifications:Amazon SES Custom MAIL FROM Domain Setup DISABLED in AWS Region Europe (Frankfurt)Amazon SES Custom MAIL FROM Domain Setup ENABLED in AWS Region Europe (Frankfurt)FollowCommentShane A Farrar a year agoWhen you say that the DNS records are properly set, does that include verifying that the NS record is set properly where the domain was bought, and a name server url hasn’t been mistakenly truncated. Additionally, there are no conflicts with records on that end? For instance, there isn’t an A record for my.example.com and an NS record for my.example.com where the domain is currently administered from, which might be resolving strangely?ShareJohannes a year agoHi Shane, thanks for the reply. Yes, everything you mentioned is set properly and double checked. The error mail specifies that the problem lies at the MX records. However, the MX record is properly set to "feedback-smtp.eu-central-1.amazonses.com" with priority 10. I also periodically verify using mxtoolbox.com.ShareSteve de Niese a year agoI'm experiencing this exact same issue - any update on solving this one?ShareJohannes a year agoUnfortunately not. I continue to receive the mails every few days and click them away...ShareGlen a year agoAlso having this problem, DNS at Cloudflare.  I get Enabled and Disabled pretty much daily now.Share"

Answer: "0There are a couple of things required to set up a custom MAIL FROM domain in SES.  This section of AWS SES documentation details the requirements - https://docs.aws.amazon.com/ses/latest/dg/mail-from.html#mail-from-set.Of particular note are the DNS records that must be present to be successful.NameTypeValuesubdomain.domain.comMX10 feedback-smtp.region.amazonses.comsubdomain.domain.comTXT"v=spf1 include:amazonses.com ~all"---** Important **To successfully set up a custom MAIL FROM domain with Amazon SES, you must publish exactly one MX record to the DNS server of your MAIL FROM domain. If the MAIL FROM domain has multiple MX records, the custom MAIL FROM setup with Amazon SES will fail.The link has details how to add DNS records to popular DNS providers (Item #6).  I recommend checking DNS MX record values when you get enabled/disabled, corresponding to Verified/Failed in the Classic SES console and Successful/Failed in the new SES console.CommentShareSUPPORT ENGINEERRon_Hanswered a year agoJohannes a year agoHi Ron, thanks for your reply. The DNS records are set as specified. There is only one MX record set for the subdomain. The domain in question is mail.literaturkreis.online if you want to verify.ShareRon_H SUPPORT ENGINEERa year agoHello, Johannes.  Thanks for sending, I see that is listing amazonses as required.  To confirm, that's when the status of MAIL FROM is good?  I'd be interested in seeing the value when showing failed (disabled).ShareJohannes a year agoHi Ron, sorry for the late reply. The problem had stopped for a while. Unfortunately, it has been back for two days and the status changes to DISABLED about once a day and then to ENABLED a few hours later. To answer your question: Nothing was changed in the DNS configuration in the meantime. That's the strange thing.ShareGlen a year agoI don't think this issue is being fully understood.  If the correct settings were not in place, the MAIL FROM would NOT BE ENABLE to begin with EVER!!  The problem that we are experiencing  is that everything is set up correctly (the proof is that AWS ENABLES the MAIL FROM domain), yet, AWS still DISABLES and ENABLES the MAIL FROM on a daily basis.You can see my inbox here: https://ibb.co/zrZWxrdShare0Experiencing the same issue with custom MAIL FROM domain setup jumping between enabled and disabled. Spent some time investigating today.Like Johannes, my MX and TXT records are set up correctly.I noticed the name servers of both my domain and Johannes' domain sometimes return the TLD part in upper case. Not entirely sure, but this is either the result of message compression or a security measure (see this post on serverfault.com for more details).Could this be the problem? It shouldn't be, because DNS is case insensitive.One of my other domains, with Route 53 NS works fine. The MX record for that domain is always returned in the same format (lower case).Hope someone can confirm that this is indeed the cause.Here are the dig queries to verify:dig +noall +answer literaturkreis.online NSliteraturkreis.online.  0       IN      NS      ns.inwx.de.literaturkreis.online.  0       IN      NS      ns2.inwx.de.literaturkreis.online.  0       IN      NS      ns3.inwx.eu.dig +noall +answer @ns.inwx.de mail.literaturkreis.online MXmail.literaturkreis.online. 3600 IN     MX      10 feedback-smtp.eu-central-1.amazonses.COM.dig +noall +answer @ns3.inwx.eu mail.literaturkreis.online MXmail.literaturkreis.online. 3600 IN     MX      10 feedback-smtp.eu-central-1.amazonses.com.CommentSharemartiananswered 9 months ago"


Question: Multiple CNAME records not resolving

"After adding a new CNAME record, the record will not resolveThe new record:Record name: outreachRecord type: CNAMEValue: proxy-ssl.webflow.comI also noticed some other records that are set do not resolve. For example, links: links.charliehealth.com.Meanwhile, www does resolve.Is there some kind of cacheing/flushing I can do? Or A possible misconfiguration?Here is a link to a screenshot of all the records in the hosted zoneNOTE: I am only concerned with the CNAME record for outreach. I have been trying to get this subdomain to work for weeks now. The way I have added the record is exactly what webflow support has directed me to do.FollowComment"

Answer: "0Your screenshot is not the zone that is serving charliehealth.com !!!$ dig NS charliehealth.com...;; ANSWER SECTION:charliehealth.com.172800INNSns-1043.awsdns-02.org.charliehealth.com.172800INNSns-1935.awsdns-49.co.uk.charliehealth.com.172800INNSns-420.awsdns-52.com.charliehealth.com.172800INNSns-517.awsdns-00.net.But you have different name servers in your screenshot. So those are not the records you are looking for ;-)CommentShareKalluanswered 2 months agowebdev-ch 2 months agoHello, could you explain this a little more? My screenshot is the only zone that I have and it is for charliehealth.com. What records should I be looking for?ShareKallu 2 months agoIf you look at the NS records (nameservers) returned for "dig NS charliehealth.com" above and compare those to your screenshot those are not the same. This is something that was setup when you (or someone) did register charliehealth to .com -domain at GoDaddy (that seems to be registrar for the domain charliehealth.com). Would that help in finding the root cause?Share0Dear user,DNS can always be tricky, but I might need some more information about your environment.But first I need to check one thing:I cannot find a CNAME entry for links.charliehealth.com but multiple A entries which resolve fine: https://www.whatsmydns.net/#A/links.charliehealth.comYou write that you want to configure a subdomain but mention a CNAME record. Did you specify the CNAME record in the zone charliehealth.com ?Some customer run split-DNS configurations. Can you check if the hosted zone where your created the outreach CNAME record is a public hosted zone and it is reaching the right AWS account, e.g. by comparing the NS entries?CommentShareEXPERTAndreas Seemuelleranswered 2 months agowebdev-ch 2 months agoThank you!Here are screenshot of the dns records: https://ibb.co/YDhr3hCInteresting, not sure why that would be.YesIt is a public hosted zone. The rest of the setup is and has been working properly as far as I can tell. Which entires should I be comparing?Share0Chaining CNAME in general isn't considered as "best-practice" but it does work like your example of www.charliehealth.com proves.;; ANSWER SECTION:www.charliehealth.com.2791INCNAMEproxy-ssl.webflow.com.proxy-ssl.webflow.com.60INCNAMEproxy-ssl-geo.webflow.com.proxy-ssl-geo.webflow.com. 60INA34.251.201.224proxy-ssl-geo.webflow.com. 60INA34.253.101.190proxy-ssl-geo.webflow.com. 60INA54.194.170.100Without being able to see how your Route53 records are, the only guess I could come up with was thishttps://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html#CNAMEFormatif you create a CNAME record for a subdomain, you cannot create any other records for that subdomain. For example, if you create a CNAME for www.example.com, you cannot create any other records for which the value of the Name field is www.example.com.CommentShareKalluanswered 2 months agowebdev-ch 2 months agoHello and thanks!I updated my question with a link to a screenshot of the records.In the docs you link above it also states:"You cannot create a CNAME record for example.com, but you can create CNAME records for www.example.com, newproduct.example.com, and so on."I think it's saying I cannot create www.outreach.charliehealth.com--unless I am misunderstandingShare"


Question: Error importing signed Private CA cert from external root

"I set up a private subordinate CA, configured for an external root. I set up a basic CA structure using LibreSSL 2.8.3 (macOS 10.15.4) for the external CA with a self-signed root cert. When I exported a CSR from the AWS private CA, the Subject DN has its fields in a very unusual order:C=US, O=Foobar, OU=AWS Subordinate CA, ST=New Dakota, CN=My AWS Subordinate CA, L=SometownWhen I use the openssl ca command to sign the CSR, the resulting certificate has the subject DN fields in the more usual order:C=US, ST=New Dakota, L=Sometown, O=Foobar, OU=AWS Subordinate CA, CN=My AWS Subordinate CAWhen I try to import the signed certificate I get an error:CertificateMismatchExceptionThe certificate subject contains a different subject than the CA certificate signing request.Why does the Private CA generate the DN fields in that unusual order? And is there a way to fix this, either from the AWS side or the external CA side?Edited by: PaulSuh on Apr 27, 2020 6:12 PMFollowComment"

Answer: "0To answer my own question:Yes, there is a flag on the openssl ca command that will preserve the order of fields in the subject DN:-preserveDNNormally the DN order of a certificate is the same as the order of the fields in the relevant policy section. When this option is set the order is the same as the request. This is largely for compatibility with the older IE enrollment control which would only accept certificates if their DNs match the order of the request. This is not needed for Xenroll.So, this solves the immediate problem.However, in the long run it would be better if the AWS Private CA put the subject DN fields in the more usual order of C=,ST=,O=,OU=,CN= This is supposed to represent a descent into an X.500 directory tree, and the order of C=,O=,OU=,ST=,CN=,L= is just bizarre.Also note that the openssl ca man page specifically indicates that this option was created for a really old IE quirk, and is no longer needed. The OpenSSL/LibreSSL devs may remove this option and then we'd be stuck again. We could re-order the fields in the openssl.conf file, but this seems to be overkill for a single oddball case.CommentShareplsuhanswered 3 years ago"


Question: Multi-pool CognitoAuthorizer only accepting id token from first-listed pool

"I have a RestApi declared with Cloudformation using AWS::Serverless::Api and created a default cognito authorizer there and declaring a UserPoolArn pointing to my UserPool1's.Then, I created a custom resource, with RestApiId and a UserPool2ARN properties, so it could find (the APIG's authorizers) and add the second pool into the CognitoAuthorizer.It seems to work, AWS Console API Gateway Authorizers page shows the CognitoAuthorizer with TWO different pools.But the problem is when I "initiateAuth" different users from each pool to get an "idtoken", only the idtoken from the first-listed pool is going through. The idtoken from the other pool gets an unauthorized.FollowComment"

Answer: "0First, you should not use the ID Token to consume an API but the Access Token.Second, as you use the Identity Token authentication method, you must has configured the Token validation field in the Cognito authorizer which should match the aud claim of the identity token [client id value] issued by the first user pool. As Client id value as unique per user pool, the identity token issued by the second user pool will never have this aud claim set to the right value and therefore will always fail the check.CommentShareJeff Lombardo-AWSanswered 4 months ago"


Question: Filter on Thing Group from AWS IoT Rule

Is it possible to select only messages in a certain thing group from an IoT Rule SQL query?For Example: SELECT * FROM '$aws/events/presence/disconnected/#' WHERE clientId.thinggroup = "dev"FollowComment

Answer: "2Accepted AnswerApproach 1: build a lambda function which extracts a group name from the device and use:SELECT * FROM '$aws/events/presence/disconnected/#' WHERE aws_lambda("MyLambdaToExtractGroup",{"clientid":clientId}).groupname= "dev"When using this approach, please consider the quotas for ListThingGroupsForThing API you will find in https://docs.aws.amazon.com/general/latest/gr/iot_device_management.html (50 or 10 TPS depending on region, adjustable). If you face some limits here, the approach 2 provides an almost limitless scalability.Approach 2:Alternative approach would be to save a group name for each of clientId in DynamoDB, and then use:SELECT * FROM '$aws/events/presence/disconnected/#' WHERE  get_dynamodb("ClientIdToGroupMapping", "clientId", clientId, "arn:aws:iam::12345678910:role/getdynamo").groupname = "dev"To store Group name for each client id, you could use https://docs.aws.amazon.com/iot/latest/developerguide/registry-events.html in another IoT Rule.However, there may be more cost efficient options available depending on how you want to process the payload of IoT Rule. Can you tell more about it? (i.e. which Actions do you intend to use)CommentShareAndrei Sanswered a year agoValyantLuke a year agoBasically I am trying to implement the recommended delayed SQS queue for handling lifecycle events. I would like to put the message on the queue and after a delay, trigger a lambda to make sure the device is still offline before updating any connect status info. The issue is that we currently don't take advantage of using multiple accounts for dev test and prod. It's just one account with tagged resources. This becomes an issue when using the rules as they are triggered regardless of what Thing Group the device is in (e.g. dev or prod). In the long run I think the best solution would be to move to a multi account setup so Dev Things are not triggering the same resources as Prod Things, but for now it sounds like the lambda you suggested may be the only option for how our infrastructure is currently set up.ShareAndrei S a year agoSplitting dev and prod into different accounts is certainly most cost-efficient and sustainable solution here.If you use SQS queue for handling lifecycle events and need to build Lambda for that anyway, you could also implement the filtering logic in that Lambda. The cost calc needs to be done as always, but I could imagine that it would not result in significantly higher costs then using the Lambda approach I proposed.ShareValyantLuke a year agoFor sure. This is more of a temporary solution until we can get our environments split up. So until then I am going to go with your first suggestion of writing a quick lambda to extract the group name. Thanks for the help.ShareAndrei S a year agoYou are very welcome!Share"


Question: How to get a file from CodeCommit using JS AWS-SDK

"Hello,is there a way to read a file from a specific branch in a CodeCommit repository using the aws-sdk for js/node?I need to do this from a lambda function.I saw there's a getFile method but the docs lacks of examples. What I've done so far:const client = new AWS.CodeCommit({ region: "us-east-1" });    const file = await client.getFile({        filePath: "myFile.txt",        repositoryName: "myRepo",        commitSpecifier: "myBranch"    });the documentation says that getFile Returns the base-64 encoded contents of a specified file and its metadata. But is also says the return type is a AWS.Request object, so I can I read it?thanksMFollowComment"

Answer: "2After strugling half a day I found a solution I'd like to share:function uint8arrayToStringMethod(myUint8Arr) {    return String.fromCharCode.apply(null, myUint8Arr);}const client = new AWS.CodeCommit({ region: "us-east-1" });const config = {        filePath: "myFile.txt",        repositoryName: "myRepo",        commitSpecifier: "myBranch"};const file = await client.getFile(config);const u8str = uint8arrayToStringMethod(file.fileContent);I am using aws-sdk V3thanks everyone for your help.MCommentSharerePost-User-3116220answered 4 months ago0Hi there,Using the github search feature I was able to find an example on how the read the file contents:Example use of getFileexport async function getRawFile(  fileName: string,  repoName?: string,  branchOrTag?: string): Promise<string | null> {  const fileRes = await client.getFile(    repoName ?? config.repository,    fileName,    branchOrTag  );  if (!fileRes?.fileContent) {    return null;  }  const buf = Buffer.from(fileRes.fileContent);  return buf.toString();}The commitSpecifier seems to have to be a commitId in stead of a branchName though.Regards, JaccoCommentShareJaccoPKanswered 4 months ago"


Question: Amazon Connect - Flow for Voicemail

"Hi Community,I am trying to implement a common scenario in Amazon connect where if a customer is waiting in the queue for an agent to answer for more than 15 minutes, they should be given the option to leave a voicemail. The problem is once my flow is in the 'Basic Customer queue' flow (contact flow = customer queue type), I cannot add a 'Transfer to Flow' block and transfer it to my custom voicemail flow. Is there any other way to achieve this?FollowComment"

Answer: "0You don't have to transfer the call out, leave it in that flow and just do you VM logic in there. Be aware that if the agent becomes available they will be pulled out of that logic and sent to an agent.CommentSharedmaciasanswered 7 months agoEXPERTAWS-samfredreviewed 2 months ago0I would instead offer them a callback...Voicemails tend to be mostly... "Heres my phone number, please call me back".Then you need to allocate an agent to be unavailable on phones, and off listening to recorded messages...Transferring to a callback instead means the call gets offered to an agent as it reaches the front of the queue, and the customer will receive a call, and you don't have to allocate anyone to the task of listening to recorded messages.CommentShareVitoanswered 11 days ago"


Question: I can't create Lambda Function

"I tried to create Lambda Function such as this picture.If I clicked [Create Button] , AWS stopped processing after loading for about 10 seconds.I clicked [Create Button] again, AWS stuck on loading screen.As another problem, the function list screen shows a blank error display and an unnatural update date and time.Thank you for resolving this problemFollowComment"

Answer: "0Is the time/date on your computer/laptop correct? Having the time slightly out of sync (i.e. in the future or in the past) can cause odd errors like this.CommentShareEXPERTBrettski-AWSanswered 5 months agomontaro 5 months agoI checked the time, but there was no deviation.Also, I checked on a total of 3 PCs, but the same problem was confirmed.ShareBrettski-AWS EXPERT5 months agoNext thing is to check the developer console in your browser and see what errors are being thrown then troubleshoot from there. You might also raise a case with our support team to help troubleshoot.Share"


Question: Why is the S3 api changing my bucket policy?

"Yesterday we wanted to store my network load balancer access logs in a S3 bucket so by following the docs  we copied and edited the policy and when we pasted it and saved it, the NLB didn't have permission to use the bucket.We noticed that the "aws:SourceAccount": ["0123456789"] kept getting saved as "aws:SourceAccount": "0123456789" even when we updated the policy using the AWS CLI (e.g. aws s3api put-bucket-policy --bucket my-bucket --policy file://policy.json)Is this a bug in the API that is preventing me to use this as we want?Any help would be greatly appreciated.FollowComment"

Answer: "0Accepted AnswerHi to anyone facing a similar issue :)Even though the bucket policy kept changing when I saved it in the bucket using the console, as I've stated above, that actually wasn't the problem. The documentation example policy I copied end edited has an error, particularly in the following line:"Action": "s3:PutObject",            "Resource": "arn:aws:s3:::my-bucket/AWSLogs/account-ID/*",Remove the AWSLogs part and everything will work. Please make the docs clearer.CommentShareRockyanswered 3 months ago0The issue you are experiencing is likely due to the formatting of the policy file. The AWS policy language requires that some fields be formatted as a JSON array (e.g. "aws:SourceAccount": ["0123456789"]) instead of a string (e.g. "aws:SourceAccount": "0123456789").To ensure that the policy is formatted correctly, you can use a JSON linter or validator to check the syntax of the policy file before saving it. Additionally, you can try using the AWS Management Console to edit the bucket policy, as it may automatically format the policy correctly.It's unlikely that this is a bug in the AWS API, as the behavior you're describing is consistent with the policy language requirements.CommentShareKanavpreet Singhanswered 3 months agoRocky 3 months agoHi,thank you for the quick response. As I've said above I've used the AWS Management Console to edit the bucket policy and even though I correctly input a JSON array for the aforementioned field, when I click "Save" it appears as a string. I've used a validator before it and everything checks out.Now usually things in AWS work well but sometimes they don't. It's rare but it happens, so that's why I'm asking this.Share"


Question: How to upgrade php version on lightsail instance

Wordpress made recommended to use php 7.4...I've been trying to upgrade my version.I've been searching on bitnami and forums but still not sure what to dowhen I type "sudo apt install php7.4" I get a :E: Unable to locate package by glog 'php7.4'E: Couldn't find any package by glob 'php7.4'E: Couldn't find any package by regex 'php7.4'How can I install php 7.4 and activated to use so when I type php -v it will output php 7.4 ?FollowComment

Answer: 0I have the same problem :(CommentShareEladioanswered 5 months ago


Question: Traffic between AWS serverless services - Does it always stay within the AWS network?

"I guess that in most cases traffic between AWS serverless services stays within the AWS network.But I wonder whether it's always true. Including the following example cases, is it true that traffic(API call) between AWS serverless services never leaves the AWS network?An Amazon Event Bridge rule triggers a Lambda function(cross account access) A CloudWatch alarm in account X publishes a message to a SNS topic in account Y(Using AWS SDK) A Lambda function calls KMS decrypt API using AWS SDKFollowComment"

Answer: "3Accepted AnswerTraffic never leaves the AWS network, but will traverse the internet portion of the AWS network as opposed to the internal portions of the AWS network.If you run a lambda function within a VPC, and provision VPC Endpoints for all of the services that your function uses then traffic will not leave your VPC via the NAT gateway and stay entirely within the 'internal' side of AWS.It is possible to block any internet access, if all the AWS APIs that your functions call have VPC Endpoints (or you're calling 3rd-party APIs using AWS PrivateLink).For this example, both SNS and KMS have VPC Endpoints.To actively block internet traffic, you can do this in multiple ways:Security groups let you add all your endpoints into a security group, and allow your function to only communicate with that security group and not the default 0.0.0.0/0Configure AWS Network Firewall on the VPC to manage egress traffic.Modify the route table for the subnets the functions are configured to use, and remove the default route from that subnet entirelyHow far you go down this path will depend on your attitude to risk and regulatory requirements, and the cost/granularity tradeoff - the managed firewall option is more flexible, but costs more compared to using endpoints.CommentSharecloudandmediaanswered a year ago1Yes. All traffic between AWS services stays within the AWS network. You can find more information in the VPC FAQ.CommentShareEXPERTUrianswered a year ago"


Question: Successfully Connected PuTTy to Instance but... got Stuck

"I wish I had Tech agent that could help me navigate this tough terrain.So I'm working on deploying my first Deep Learning Model, I feel late.I was able to successfully connect to my instance load numby, I've got python downloaded and when I attempted to load TensorFlow onto my instance I got a not enough space error.It looks to only need about 528MB of space, I have more than enough space and tried on my other computer with more than enough space and still got the same error.Is this because I use a free version of AWS?This can be very confusing for someone who's never done this but deep down I feel like this could be accomplished in a fair to moderate amount of time with the right effort. I was told to focus on python, use spyder, but mind you ChatGPT is my only real help. Help?I've gone the puTTy route and I hope I can deploy today.FollowComment"


Question: DynamoDB PartiQL Unsupported clause: LIMIT in console

"Hi there, according to the documentation  LIMIT is an optional parameter for DynamoDB PartiQL .  However when I attempt to use it in the console by entering a statement like select * from "USER" limit 1 I receive an error "ValidationException: Unsupported clause: LIMIT "Would be good if the console supported this since the API doesFollowComment"

Answer: "3Hi,This is expected behaviour as the Limit parameter does not belong to the Statement but rather the request body:{   "ConsistentRead": boolean,   "Limit": number,   "NextToken": "string",   "Parameters": [      ...   ],   "ReturnConsumedCapacity": "string",   "Statement": "string"}  client.executeStatement({    Statement: statement,     Limit: 1  })For that reason, Limit is not currently available for the Web Console.CommentShareEXPERTLeeroy Hannigananswered a year agokiwichris a year agoIt makes sense in a way, although someone with a SQL background may find this counter-intuitive.  For example ORDER BY is part of the statement for example and from a SQL point of view LIMIT and ORDER BY are both equally part of a "regular" SQL statementShare"


Question: in AWS API Gateway how can I pass data from Integration Request to Integration Response when I'm using mock integration

Hello. I don't want to use Lambda function. I want to directly pass data from Integration Request to Integration Response. my Integration Request's mapping template looks like this :{  "statusCode": 200}I want to extract statusCode from this and use it in Integration Response. I'm trying it in following way :{"provided_statusCode": "$input.path('$.statusCode')"}I also tried input.json('$.statusCode') but it doesn't work. can anyone help?I got response :{  "provided_statusCode": ""}FollowComment

Answer: "1Accepted AnswerIn API Gateway you have to create Integration Response and Method Response for each status code (200, 302, 400, 500) you want to present.You can get all data from Integration Request into Integration Response except Status Code since API Gatewway manages it for you.Here's an example of getting the body from Integration Request into Integration Response when using Mock:Integration Request#set($context.requestOverride.path.body = $input.body){  "statusCode": 200,}Integration Response#set($body = $context.requestOverride.path.body){  "statusCode": 200,  "body": $body,}CommentSharevtjeananswered 2 months agorePost-User-8269649 2 months agoYes, Thanks for help. Also I found this documentation helpful : https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-mapping-template-reference.htmlThere are ways to get different parameters directly in Integration responseShare"


Question: Some emails are delayed

"We have been using AWS SES for at least  7 years and lately there is some strange delay on emails which makes it unusable. We use it for emailing stuff from our application. The application is used by about 30 customers, and each customer uses a different identity (email-from-address).At first I thought it had to do with a certain identity, since only one customer complained. And some quick tests suggested that this was the case, but now that I've scratched my head for about 24 hours I did some further testing on other customers and saw that they also seems to have issues. Only that they haven't reported anything yet.We are using SES through the API, and on our side we use Perl. But that should not be an issue since we get the confirmation string/GUID from the API, which we also logs.What I've noticed while testingSent 10 emails within about 10 minutes.Firstly they did not come in order.Some emails was delivered almost instant.Most of the emails were delivered within 10 minutes.The last email came 6.5 hours after sending it.Any ideas?Best Regards,JoakimFollowComment"

Answer: "0SES is a relay agent which takes the email from your API then filter it as per standards and accept it if all good. Then it setup connection with recipient MTA and handover the email to recipient MTA. Once SES got SMTP 250 OK from recipient MTA we donot have any visibility how recipient MTA process the email.There could be below mentioned possible reason behind delay:If recipient MTA is not able to accept new connections then SES will keep retrying. If you want notification for each retry then you can configure the same by referringhttps://aws.amazon.com/about-aws/whats-new/2020/06/amazon-ses-can-now-send-notifications-when-the-delivery-of-an-email-is-delayed/Recipient MTA accepts the email and then keeps that in buffer before landing it in recipients inbox.Recipient MTA facing some throttling hence not processing the emails at given time.Rare but possible if recipient MTA has SES IP addresses in filtering hence you may facing throttle issues.In order to resolve this please open support case with AWS and share below mentioned:From email address, To email address, Time stamp and Message ID from logs if possible.By having this information SES team will analyze the internal logs in order to find root cause and that's how they will help you to resolve this issue.CommentShareSumit Bhardwajanswered a year agoJoakimL a year agoHiI've chosen not sign up for support, since in my experience I only get links to be able to read and find out the answer myself. (Which I kind of understand, but I can find this information myself, so no need to pay for it.)So I can't open a support case. =(Since yesterday I've enabled SES in another region and from the initial tests it seems to work better than eu-west-1.Also, I have tried emailing different recipients and the issue is the same. So my guess is that it's not due to recipient MTA.Share"


Question: Attach a Persistent Volume Without knowing fileType and partition number in EKS

I have a EBS volume and EKS cluster. I want to attach the volume to a cluster's node programatically but I don't have information on disk's fsType and partition number. Is there any way to fetch the info or any plugin I can use which can mount all the partitions in the volume.Here is the storage class and persistent Volume with aws csi driver. I have to know the fsType and partition number to mount correctly.kind: PersistentVolumemetadata:  name: name-pvspec:  storageClassName: "gp2"  accessModes:  - ReadWriteOnce  capacity:    storage: "100Gi"  volumeMode: Filesystem  csi:    driver: ebs.csi.aws.com    fsType: <NotKnown>    volumeHandle: "vol-XXXX"    volumeAttributes:      partition: "<NotKnown>"---apiVersion: storage.k8s.io/v1kind: StorageClassmetadata:  annotations:    name: gp2  parameters:    fsType: <NotKnown>    type: gp2provisioner: kubernetes.io/aws-ebsreclaimPolicy: DeletevolumeBindingMode: WaitForFirstConsumerFollowComment

Answer: "1Accepted AnswerYou can use the blockVolume feature of the AWS EBS CSI driver to attach the volume without knowing the file system type and partition number. This feature allows the EBS volume to be attached to the node as a block device without being formatted or mounted. You can then use tools such as lsblk or blkid to inspect the device and determine the file system type and partition number.Here's an example of how to create a PersistentVolume and attach an EBS volume using the blockVolume feature:apiVersion: v1kind: PersistentVolumemetadata:  name: my-pvspec:  capacity:    storage: 10Gi  volumeMode: Block  accessModes:    - ReadWriteOnce  persistentVolumeReclaimPolicy: Retain  csi:    driver: ebs.csi.aws.com    volumeHandle: vol-xxxxxx    volumeAttributes:      blockVolume: "true"Once the volume is attached to the node, you can use the following commands to inspect the device and determine the file system type and partition number:# List all available block deviceslsblk# Determine the file system typefile -s /dev/xvdf# Determine the partition tablefdisk -l /dev/xvdfNote that the device name may vary depending on your setup, so adjust the commands accordingly. Once you have determined the file system type and partition number, you can update the PersistentVolume definition to include the correct values for fsType and partition.Here are some useful links that provide more information about the AWS EBS CSI driver and attaching EBS volumes in Kubernetes:AWS EBS CSI driver documentation: https://docs.aws.amazon.com/eks/latest/userguide/ebs-csi.htmlKubernetes documentation on using block volumes: https://kubernetes.io/docs/concepts/storage/volumes/#block-based-volumesAWS documentation on attaching an EBS volume to a Linux instance: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-attaching-volume.htmlCommentShareMina Gobrialanswered 3 months ago"


Question: Amazon Keyspaces retry policy for NoHostAvailableException

"The Cassandra java driver will attempt to retry idempotent request transparently to the application. If you are seeing NoHostAvailableException when using Amazon Keyspaces, replacing the default retry policy with the ones provided in this repository will be beneficial.The Amazon Keyspaces Retry Policy is an alternative to the DefaultRetryPolicy for the Cassandra Driver. The main difference from the DefaultRetryPolicy, is the AmazonKeyspacesRetryPolicy will retry request a configurable number of times. By default, we take a conservative approach of 3 retry attempts. This driver retry policy will not throw a NoHostAvailableException. Instead, this retry policy will pass back the original exception sent back from the service.The following code shows how to include the AmazonKeyspacesRetryPolicy to existing configurationadvanced.retry-policy {     class = com.aws.ssa.keyspaces.retry.AmazonKeyspacesRetryPolicy     max-attempts = 3 }https://github.com/aws-samples/amazon-keyspaces-java-driver-helpers/blob/main/src/main/java/com/aws/ssa/keyspaces/retry/AmazonKeyspacesRetryPolicy.javaFollowComment"


Question: How to have client applications start/stop EC2 instances

"I am working on a project which uses VR for architectural visualization, and we are wanting to use AWS EC2 instances with CloudXR to run applications for clients, however, these would need to be remotely started and stopped when the clients are using or not their app. It would be ok to have 1 client per EC2 instance, as each app would be unique, so a manual process of creating and setting up an EC2 instance per client is how I see it working for now, but it couldn't stay running, as they will only be using the app perhaps a few hours a week.I am not sure how to go about this, and I haven't been able to find what I'm looking for so far, so any pointers would be greatly appreciated.CheersFollowComment"

Answer: "1There are a lot of ways to do what you're asking; the short version is: Use the EC2 API to start/stop the instances that you need on a schedule that is required by your clients. But that opens a can of worms in terms of what the schedule is; what the client needs are; and so on.Something that might help. Many moons ago I wrote a blog post which allowed end-users (after authenticating with Active Directory) to control their Workspaces instances without having to log into the AWS console.It's not exactly the use case you're looking for but it can be customised: You don't have to use AD; you could just use Cognito to authenticate clients. You can change the Workspaces APIs for EC2 APIs. And so on.CommentShareEXPERTBrettski-AWSanswered 10 months agoAedan 10 months agoThanks for your reply. Your blog seems like it will be very helpful. If I am able to get it set up that could definitely work, at least as a solution for now.Share"


Question: AWS Certificate Manager - Additional Verification Required

Hello!I'm trying to set up a custom Cloudflare domain name for AWS Cloudfront. I tried to create a public certificate using AWS Certificate Manager and got a Failed error. CNAME name and value become invisible.FollowComment

Answer: "0Hello,The error prompt you mentioned is in the link below,ACM requires additional information to process this certificate request. This happens as a fraud-protection measure if you use email verification and your domain ranks within the Alexa top 1000 websites.To provide the required information, use the Support Center to contact AWS Support. If you don't have a support plan, post a new thread in the ACM Discussion Forum.Link-https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-failed.html#failed-additional-verification-requiredCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year agoAWS-User-6620793 a year agoHey!I know why this error occurs. My support plan is Basic and I can't contact the Support Center. That's why I wrote here. The old AWS forum redirects here to AWS re:Post.Can you help with domain name verification?Sharekasumiru 6 months agoI have similar problem. Your domain is not .ru by any chance? my question: https://repost.aws/questions/QUCyT2_x6QTVeF7bAv-MS-lQ/aws-certificate-manager-always-return-status-failed-for-verification-domainShare"


Question: Questions regarding Route 53

Can I purchase .de Domains for testing purpose in AWS Route 53 ?Kindly Help !FollowComment

Answer: "3Yes, If you:go to Route 53 in the AWS ConsoleGo to Registered domainsKlick Register domainyou can buy a .de domain for $9Hope this helps!//CarlCommentShareCarl Ostrandanswered 10 months agoEXPERTChris_Greviewed 10 months agoMonica_Lluis SUPPORT ENGINEER10 months ago@carl, thank you for the prompt response. We appreciate your help.@Akshay, if Carl's answer helped you, please ensure to mark it as accepted to thank Carl and help the community members find validated answers.Thank you!ShareAkshay 9 months agoThanks for the help @carlShareMonica_Lluis SUPPORT ENGINEER9 months ago@akshay, thank you for your comment to Carl. If you can  please click on the "Accept" button on Carl's answer, this will let community know that the answer provided was the solution you were looking for.Kind Regards,Share"


Question: Stateful applications across more than one Availability Zone?

"https://docs.aws.amazon.com/eks/latest/userguide/autoscaling.htmlIn the AWS EKS documentation on autoscaling (see above), there is a section titled "Use EBS volumes as persistent storage" which discusses building stateful applications in Kuberenetes. Specifically, there is the following statement: "For a better solution, consider building stateful applications that are sharded across more than one Availability Zone using a separate Amazon EBS volume for each Availability Zone."How do I do this - create a separate EBS volume for each availability zone?FollowComment"

Answer: 0From the Management consoleNavigate to EC2Then Navigate to EBSClick create and one of the options is Availability Zone.the below image illustrates the aboveAfter that you can use Kubernetes Taints and Tolerations to ensure that your pods are scheduled on the appropriate nodes.https://docs.aws.amazon.com/eks/latest/userguide/node-taints-managed-node-groups.htmlCommentSharetedtrentanswered 6 months ago


Question: WORM backups for RDS?

"Is it possible to make automatic WORM backups of my RDS instance?I mean I could always take a sql dump and store it in a WORM S3 bucket, but then I lose all the really nice point in time recovery options of the automatic RDS backups. It would be great if there was a way to protect those from a hacker who gained access to my AWS account being able to just clicking delete on everything.Edited by: Mohamed Hafez on May 2, 2020 6:45 AMFollowComment"

Answer: "0I don't believe that a WORMable backup (which doesn't exist) would solve the problem you are worried about. WORM is great for making sure that objects aren't changed, but it typically does not prevent them from being deleted.  And if it could, how would you ever delete them when no longer needed?The generally recommended way to address the scenario you bring up is with the cross-account snapshot copy feature. What you do is set up a separate account for compromise protection and schedule periodic copies of important snapshots from your main account to the compromise protection account. Access to the  credentials for the compromise protection account are than severely restricted, to reduce the chance of a disgruntled employee having access. Yes, disgruntled employees have done exactly what you fear.  So require two employees be involved to access the credentials for the compromise protection account.You should also be protecting both your main account and your compromise protection account with Multi-Factor Authentication.CommentShareHalTempanswered 3 years ago0Thanks for the tip, that does sound like a good workaround!Regarding the WORM backups, maybe I'm getting the terminology wrong, but in S3 you can make a bucket with a policy that anything you write to it can't be deleted or altered for X number of days, and then you can make an automatic lifecycle policy to delete it after that. That'd be more convenient since it would only need one account, and wouldn't need to set up the automatic daily transfer to the other account, and probably most importantly you would retain the ability to do point in time restores, instead of only being able to restore to your last daily backup.Edited by: Mohamed Hafez on May 6, 2020 9:21 AMCommentShareMohamed Hafezanswered 3 years ago0I don't believe RDS supports that S3 capability. It is likely not practical to implement for automated backups, but could be implemented for manual snapshots. I don't know where that sits as a priority for the RDS team or even if it is on the backlog. What the RDS team did implement is the ability to export a snapshot's data to S3 (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ExportSnapshot.html), which you could then apply the WORM capabilities against. That would satisfy the kind of legal requirements that WORM is generally intended for, but is not ideal for your scenario.Any way you slice it though you don't get point-in-time recovery. That applies to an instance, not to a snapshot. RDS does PITR by taking the last automated snapshot and applying the log backups to it. But a snapshot alone, particularly a manual snapshot, would not have the log information available to it.One other point, if your root account is compromised it can be deleted. If the account is deleted I don't know what happens to those S3 WORM buckets. The separate account model protects against a far larger set of compromise scenarios than a snapshot delete. For example you could put the second account in a separate region. That means it provides both account compromise protection and disaster recovery capabilities.Edited by: HalTemp on May 6, 2020 9:48 PMCommentShareHalTempanswered 3 years ago0I belive what you are looking for is Vault Lock in AWS Backups. When active, backups can't be deleted by anyone prior to the retention period ending and you can store continous backups allowing for point-in-time recovery of up to 35 days.CommentShareFydon_answered a year ago"


Question: Unable to configure Application Load Balancer using Cognito client App which has no secret

"Hello,I try to setup environment in which Cognito user pool Application is linked to the Application Load Balancer Listener. When I try to use App client created with no secret I get an error "The user pool client must have a client secret" .  Client App has been created with no secret in order to use TOTP.My question is whether there is a limitation to use App client without secret linked to the ALB ?brJackoFollowComment"

Answer: "2Accepted AnswerHello there,Per the documentation  , when configuring Application Load Balancer with Cognito user pool and app client , you need to generate the client secret as it is a required attribute for actions attribute while creating the ALB ruleCommentShareSiva_Ranswered 9 months agoEXPERTToni_Sreviewed 9 months ago"


Question: Is the sessionId in PutEvent related to the session in the HRNN model?

Is the sessionId field in PutEvent related to the session in the Session-based HRNN model?Is it used only for associating events with a user before they log in?FollowComment

Answer: "0Hey hdseo,The sessionID is a required field associated with a user's session, it is not related to the session of the HRNN model. Yes, it is used to view a users behavior if they are not logged in and is a better identifier than one that is only visible when a user is logged in.The userID, for example, is not a required Field, but can be used for the identifier of the user in this current session (if they are logged in).That's the way I understand it.Hope that helps.CommentSharelaw-dwganswered 2 years ago"


Question: Lambda logging to CloudWatch seems to be broken?

"For some reason, one of my Lambda's logs are no longer appearing on CloudWatch. I see output from a Test run in the Lambda's screen but the CloudWatch list of logs is persistently empty.After some flailing around, I decided to try creating a new Lambda with the same code and configuration. Test ran. But when I hit "Click here to view the corresponding CloudWatch log group.", It opened CloudWatch looking at the expected log group name -- with a big red warning that this group did not exist. Clicking "(Logs)" at the top of the test output gave the same behavior. This is surprising; I thought I remembered that creating a Lambda created its log groups automagically...?I tried creating the group manually, but now I'm back where I was -- the lambda runs, I get local log output, but the CloudWatch Log Group for my lambda still shows no Log Streams. I checked the CloudWatch configuration, and it does list both the old and new Lambda's ARNs as being allowed to create and write to log streams...My oldest lambda (the one my Alexa skill uses directly) is still apparently writing to CloudWatch successfully.I am very confused. I'm a relatively new user, and I'm willing to believe this is user error -- but I have no idea what that error might be. Any advice folks can offer on fixing this would be tremendously appreciated, especially since my Skill just went live and the failing lambda is the one that is triggered by an EventBridge cron job to update the database in the background. It does seem to be running OK for now -- but I need logs if I'm ever going to have to debug it again, and I need to understand why a new copy of that Lambda is having the same problem.Programmer's mantra: "If it was easy, they wouldn't need us..."FollowComment"

Answer: "1Accepted AnswerLooks like this was indeed self-inflicted. When I went to the IAM role, I discovered that logging was authorized only for a specific ARN. Checking the "authorize for all in this group" button resulted in my starting to get logs again.I don't remember when I would have changed that, but.... Whew.CommentShareKubyc Solutionsanswered a year ago0Please check if your Lambda function's execution Role has permissions to write logs to CloudWatch. You can use the AWS managed policy AWSLambdaBasicExecutionRole or if you are creating the IAM role/policy manually (and follow least privilege), refer to this document: https://docs.aws.amazon.com/lambda/latest/operatorguide/access-logs.htmlCommentSharejoahnaanswered a year ago"


Question: Deploy web app to aws greengrass Iot

"I am going to deploy a image classification react web app to aws Iot greengrass. I would like to perform a two step operation using different version of mobilenet. The first operation, which is already in the web app,  will be placed on edge and the second operation, which receives result from the web app then further operate and return the final result to the web app, will be place on the cloud. Here is the questions.How to achieve this design?Should I place the greengrass Iot core to the server where my web app located?Do I need to use device SDK on the cloud or on edge?To connect to the cloud, should I place the second step to the s3 bucket in order to configure it as a greengrass component?How to connect the web app to greengrass?How do I perform the communication between the two operation? Should I use MQTT?What is the difference between aws greengrass core device on the left and aws Iot core on the right?Thank you for taking the time to read this.FollowComment"

Answer: 1Assuming that the app in the greengrass will be developed using a custom component [1]. You have two ways to handle your scenarioPublish/subscribe local messages [2]Publish/subscribe AWS IoT Core MQTT messages [3]The AWS IoT Core MQTT messaging IPC service lets you send and receive MQTT messages to and from AWS IoT Core. Components can publish messages to AWS IoT Core and subscribe to topics to act on MQTT messages from other sources.Referenceshttps://docs.aws.amazon.com/greengrass/v2/developerguide/develop-greengrass-components.htmlhttps://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-publish-subscribe.htmlhttps://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-iot-core-mqtt.htmlCommentShareEXPERTAWS-User-Nitinanswered 6 months ago


Question: CDK v1 detected by AWS. "Action required" email notice

"I received an email to inform me to update some CDK stacks to version 2 or all of my stacks firstly created with CDK 1 were migrated on v2 from January 2022.Despite several searches via the console or using awscdk-v1-stack-finder No stacks were found.CDK v1 entered on end-of-support period on June 1, 2023. So I would like to make sure that I don't have andy stacks or nested stacks in CDK v1.Do you have any idea how to do this ?FollowComment"

Answer: "0Since you migrate all in January 2022, maybe is a false positive. Maybe they gathered the data from all accounts before you complete your migration.Since is a tool from CDK Labs, is safe to assume their findings are compliant. Mu mindset is that is better to have a false positive like this than not have awareness at all. So, I think you can assume you are covered.Did the email you receive is from the same email in the account  you had run the checks? (I know is a very basic question, but just double checking in case you have more than one account).CommentShareIbrahim Cesaranswered 3 months ago0That's what I think too. I received an email by account and by region.It is reassuring that this could be a false positive however, doubt will still remain about a potential residual.Thanks for the answer.CommentShareAinaanswered 3 months ago"


Question: WAF for lightsail

How to enable WAF rule for an website hosted in LightSail ?FollowComment

Answer: "0In Amazon Lightsail, AWS WAF requires you to use an Application Load BalancerAWS WAF is tightly integrated with Amazon CloudFront and the Application Load Balancer (ALB), services that AWS customers commonly use to deliver content for their websites and applications.If you're not using one of these technologies AWS WAF will not work for you.Please refer toLightsail with other AWS ServicesAWS WAF FAQCommentSharesimonanswered 3 months ago"