Question: How to Access Administration Account On Workspace to Admin Simple AD.

"I want to admin a Simple AD for Workspace (windows). However I can't seem to find the answer I'm looking for. Has anyone got any personal experience with this? I've had lots of people say that I just need to be logged in with the correct credentials. I have the correct credentials, what I lack is the ability to access Workspaces with those credentials.I just want global admin access to the AD in order to manage all the users. My notes of what I have tried below1stly, I'm logged in as the main admin for AWS. I have access to everything.When you create a Workspace, you can add a single user to a workspace and they act as a Local Admin. They can not administer the AD. The options are greyed out.When you set up Simple AD, you create a admin password. However, there is no way of accessing Workspace with the Administrator and password. When you try to create a Workspace with the Administrator profile,  i get an error saying you can do that on a service account.The user guides say that you need to connect an EC2 instance to the domain, But When I do that, I am unable to see the domain in AD tools, despite being part of the domain. I've added all the correct Features (AD DS and AD LDS Tools & DNS Server Tools) but the domain does not show up and there is no way of accessing the domain via this route. The error you get is "To Manage User, Groups and computer in a domain, log on a as a user with domain administrator rights".Can someone please let me know how to administrate Simple AD? I've spent all week researching and experimenting and I'm completely stumped.ThanksFollowComment"

Answer: "1Accepted AnswerFinally Figured it out. You'll need to run up an EC2 instance in windows, connected to your domain/Directory Name and admin . Now when you run your instance, click other user and enter your credential as if your were logging into an domain account.  domainname\Administrator and then use your Directory Password. This now logs you in with the correct credentials.CommentShareLallenanswered 7 months ago"


Question: AWS macie reveal samples

"Macie provides detailed positions of sensitive data in output file. But, I want to extract that data using positions from output file. Also, macie reveal only 10 samples.Is there any way to get more than 10 samples in aws macie "reveal samples"? If don't, is there any other solution(like sql query or something) to extract the complete data from sensitive files?FollowComment"

Answer: "1I would suggest to refer to the following AWS code sample posted on the following link (gitHub resource):https://github.com/aws-samples/data-classification-pipeline .This solution uses the Macie Findings instead the Macie Job Results because the documentation shows that is best practice [https://docs.aws.amazon.com/macie/latest/user/findings.html] , since the Job Results has to be immutable, using KMS encryption. When the Findings are delivered to a S3 bucket (from a Firehose Data Stream), a Lambda function starts a Glue Workflow that runs ETL Jobs and Crawlers to transfor Json into Parquet.CommentShareSreenathanswered 2 months ago"


Question: Amazon SES: Custom 'Mail From' Domain still 'Pending'

"Dear Forum Members,We would like to set up our own domain as the custom 'Mail From' domain within Amazon SES for several regions, i.e. London, Ireland, ...We use Cloudflare as the DNS for our domain and added the following records to Cloudflare:MX  wwweedback-smtp.eu-west-2.amazonses.com    10TXT  www"v=spf1 include:amazonses.com ~all"Initially, our domain was 'verified' for custom domain sending for the Ireland region and then we received an error message from AWS. For London it continues to show pending.We would very much welcome your feedback and advice.Many thanks for your help.Pairfum LondonFollowComment"

Answer: "0Hello,In order to verify custom Mail from, we need to confirm the following records:subdomain.domain.com. MX10 feedback-smtp.region.amazonses.comsubdomain.domain.comTXT"v=spf1 include:amazonses.com ~all"Please confirm the domain name and we can dig for the above records to confirm.https://docs.aws.amazon.com/ses/latest/dg/mail-from.htmlLooking forward for your response.CommentShareSUPPORT ENGINEERAjinkya B-AWSanswered a year ago0Dear Ajinkya,Many thanks for your reply.We have since discovered that in order for the custom domain 'mail from' to work with Cloudflare DNS, that we configure the DNS records in the following way:Type   Name                        Content                                                        PriorityMX      www.domain.com. feedback-smtp.region.amazonses.com   10TXT     www.domain.com  v=spf1 include:amazonses.com ~allWe found the following:subdomain must be wwwthe content must not be within speech marks.we can only do this for one region. As soon as we start adding more Amazon SES regions, the existing ones are failing.We find it quite surprising that it is not possible to configure multiple regions to have a 'mail from' domain.Best regards,Pairfum Londonhttps://www.pairfum.comCommentSharePairfum-Londonanswered a year ago"


Question: SNS Phone carrier has blocked this message

"We are having issues sending messages for one time passwords from a toll free number already registered and configured for transactional messages, in past days it was working fine, but since yesterday we are getting this error log for all messages: {        "Timestamp": "2022-11-28 19:53:04.136",        "Status": "FAILURE",        "Message ID": "ba38a5b9-abb8-50b4-97aa-fe46b875a656",        "Destination phone number": "+1******",        "Provider response": "Phone carrier has blocked this message",        "Message type": "Transactional"    },    {        "Timestamp": "2022-11-28 19:49:10.814",        "Status": "FAILURE",        "Message ID": "400cbe0f-1e8c-5d15-a24d-e5f00c6fe40c",        "Destination phone number": "+1******",        "Provider response": "Phone carrier has blocked this message",        "Message type": "Transactional"    },    {        "Timestamp": "2022-11-28 19:49:04.603",        "Status": "FAILURE",        "Message ID": "3f471359-3ce4-5bf8-b974-48a62e072b29",        "Destination phone number": "+1******",        "Provider response": "Phone carrier has blocked this message",        "Message type": "Transactional"    }FollowComment"

Answer: "0Hello Juan Castaneda,When an SMS message is published to AWS SNS, the message is forwarded to downstream Providers. The downstream Providers, in turn, forward the message to mobile phone carriers.That is, the flow for SMS messages is as follows:Amazon SNS -> downstream Providers -> Mobile Phone carriers -> Mobile EndpointMobile carrier is responsible for getting the message to the endpoint.Issues in downstream Providers and carriers can sometimes be the reason for the failures in SMS notifications. As the complete architecture is not under AWS control, you need to let AWS know about issues so AWS can escalate it with the downstream carriers and work with them till the issue is fixed. You can submit you case here.With that said, there are also a couple of other reason why SMS delivery can fail, few of them are:Blocked as spam by phone carrierDestination is excludedInvalid phone numberMessage body is invalidPhone carrier has blocked this messagePhone carrier is currently unreachable/unavailablePhone has blocked SMSPhone is blocked listedPhone is currently unreachable/unavailablePhone number is opted outThis delivery would exceed max priceUnknown error attempting to reach phoneFor more information please read this blog post.Also please check out the SMS best practices.CommentSharedunix-awsanswered 6 months agomiguelconde91 6 months agoI have a similar issue and is curious, you have to pay to AWS for a technical support plan to report an issue in the infrastructure, a wrong behavior that is not a bad implementation of the user, is a service that start to work in an unexpected way.Share0US mobile carriers have recently changed their regulations and require all toll-free numbers (TFNs) to complete a registration process with a regulatory body. Several other countries have followed suit. As a part of that registration, you specify the content your messages will contain to the carrier along with the use-case. It's possible your messages no longer match what was submitted, or your number was reported as spam.To view the status of your toll-free number, access the Pinpoint console and view Phone Numbers under the SMS and Voice section. It will display the status of that toll-free number.For more information on how to comply with carrier restrictions of toll-free numbers, see AWS' documentation.CommentShareAWS-User-0364917answered 6 months agomiguelconde91 6 months agoI have my toll-free number registered in Pinpoint in Production mode and I have a similar issue, a month ago I tested send SMS with 2FA codes to Costa Rica and works fine, this week we are not receiving the SMS.Share"


Question: Site-to-site VPN hardware recommendation

"I need to set up a site-to-site VPN. Bandwidth requirement is low as the traffic traversing the VPN is just some management traffic - a bit of SSH and some RDP/VNC.I use a Cisco 5506-X for another of these but they are no longer available, and the successor - the Firepower 1010 - seems to be out of stock everywhere.Can anyone recommend something cheap and cheerful, and very easy to set up (I have no appetite for learning another vendor's peculiar CLI or impenetrable idiosyncrasies!). I just want something that fits in a 1U slot or on a shelf, that I can set up super easily, and that I can then forget about (bar the odd security patch)...FollowComment"

Answer: 0I use DrayTek [https://www.draytek.com/products/vigor2927] myself and very happy with it. Few people have also mentioned Ubiquity edge routers to me https://store.ui.com/collections/operator-edgemax-routers . i have tried the UISP EdgeRouter X but not happy wit the performace.CommentSharebodepanswered 2 months ago


Question: Route 53 A record with Load Balancer DNS not propagating

"I´ve configured a Load Balancer but when adding A record on Hosted Zone, the DNS is not propagating. Let me explain my current configuration (Let´s say the domain is 'something.com' and security groups are allowing traffic, also rules on LightSail):LightSail instance and VPC peered (AWS default VPC and LightSail VPC are in the same avaliability zones and currently peered). From now, this will be 'previous VPC' on followint points.A target group pointing to private IP addres of LightSail instance (Type: IP Addresses,  Network 'Other private IP address', previous VPC, HTTPS protocol and Healty state).Load Balancer with certificate imported, Internet-Facing, IPv4, previous VPC, 2 subnets selected (including the one where the Light Sail instance belongs to).Hosted Zone for 'something.com' with a DNS A record  for 'dummy.something.com' record pointing to Load Balancer DNS. With Alias that redirect traffic to 'Classic Load Balancer and applications', same region and previously created Load Balancer.I´ve done this before to protect an OWASP JuiceShop and it worked perfectly. The difference with the current one are:DNS zone on LightSail with A record for 'dummy.something.com' pointing to the instance public IP (I´m deleting that record when creating the one Route 53, the one on previous point 4), between others records type for 'something.com' (for example A record apidummy.something.com)The hosted zone is NOT 'created by Route53 Registar'.After all of this and after create the DNS A record of point 4, the DNS does not propagate and application hosted on 'dummy.something.com' is not accessible (DNS error returned).What I´m doing wrong or missing? should I create a CNAME record on LightSail for 'dummy.something.com' resolving to Load Balancer DNS? should I register 'dummy.something.com' with  route53? other completely different thing? Any help would be really appreciated.FollowComment"

Answer: "2Accepted AnswerHi ThereIs something.com domain name registered with Route53 or another provider?  If its with another provider, make sure to update the NS records to point to the Route53 Hosted Zone.Verify which NS records the domain name is using.  You can use a WHOIS website like https://lookup.icann.org/en/lookupWhen you input the domain name, look at the Nameservers section and verify it matches the Nameservers from your Route53 Hosted Zone.Refer to Step 7 in the documentation here:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/migrate-dns-domain-in-use.html#migrate-dns-change-name-servers-with-providerCommentShareEXPERTMatt-Banswered 8 months agoPepelu 8 months agoHello Matt,Thanks for your answer, it actually works. I´ve modified the nameservers and I get it to work. Now I have I doubt regarding DNS records. Kindly let me explain.The application is using for authentication another app that is behind, let´s say, 'apidummy.something.com', but the A record for 'apidummy.something.com' is still on LightSail name servers, together with a bunch of others A records and some TXT records.I guess that next step is to move all the records to Route 53, right?  could it broke anything? apart from the downtime due to the time that would take the new name servers and the DNSs to fully propagate, once propagated, it should be working as usual, right? on the other hand, will the WAF works if instead of move the records to Route53, I create an A record for 'dummy.something.com' pointing to the DNS of the Load Balancer? documentation only talk about Route 53, so I´m not sure if WAF will work if it DNS is resolved by LightSail name servers.Excuse me, probably a dumb question, but I have no much experience with DNS changes, but I´m worried about what could happen, specially for webmail A records.BR.Share"


Question: Amazon Linux 2 Kernel 5.10

Is there a minimal version AMI being planned for ALI-2 Kernel 5.10 similar to 4.14?FollowComment

Answer: "0Hello! I just clicked "Launch an instance" on the EC2 Management console and the first AMI that is listed is this one (on us-east-1):Amazon Linux 2 AMI (HVM) - Kernel 5.10, SSD Volume Type - ami-0ed9277fb7eb570c9 (64-bit x86) / ami-0a1eddae0b7f0a79f (64-bit Arm)Hopefully that helps. In addition, AWS just announced Amazon Linux 2022 which is based on Fedora and as such it will appeal to users that want the latest versions of the Kernel and packages https://aws.amazon.com/about-aws/whats-new/2021/11/preview-amazon-linux-2022/CommentShareSUPPORT ENGINEERFrancisco_Lanswered a year ago"


Question: How can I implement exponential backoff and retries in KDA(running Flink 1.13)

"I saw that in Flink 1.15, this was added(https://nightlies.apache.org/flink/flink-docs-release-1.15/docs/ops/state/task_failure_recovery/) but I need to handle the scenario of my source and sink(which are Kinesis Data Streams) going away(and returning a UnknownHostException).  I know it's not a thing that will happen very often with KDS but we happened to run into this one time.  Our Flink App is written in Java.  I see several config constants but was thinking about making this exception recoverable and using this consumer config(SHARD_GETRECORDS_RETRIES).  I'm not sure on the producer side(not sure if the KPL will do the retry for me).FollowComment"


Question: Loading data from RDS postgres database to S3 bucket but getting Unable to execute HTTP  request error.

"Hi all. I created a Glue job that extracts data from RDS postgresql database and load to S3 bucket. i used crawler to create schema of RDS postgresql source database. But when i run the job it keeps running almost one hour and after got failed with the following error. I have created role that give AWSGluerole acces to it which i am using for running the glue job. I have given permissions to lake formation and also added inline policy to access to s3 bucket. Any solution  will be highly appreciated.22/10/31 13:55:48 ERROR GlueExceptionAnalysisListener: [Glue Exception Analysis] {"Event": "GlueExceptionAnalysisTaskFailed","Timestamp": 1667224548950,"Failure Reason": "Unable to execute HTTP request: Connect to my-first-bucket-0.s3.ap-northeast-1.amazonaws.com:443 [my-first-bucket-0.s3.ap-northeast-1.amazonaws.com/52.219.196.98, my-first-bucket-0.s3.ap-northeast-1.amazonaws.com/52.219.8.63, my-first-bucket-0.s3.ap-northeast-1.amazonaws.com/52.219.4.75, my-first-bucket-0.s3.ap-northeast-1.amazonaws.com/52.219.16.187, my-first-bucket-0.s3.ap-northeast-1.amazonaws.com/52.219.1.27, my-first-bucket-0.s3.ap-northeast-1.amazonaws.com/52.219.152.58] failed: connect timed out","Stack Trace": [{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient$RequestExecutor","Method Name": "handleRetryableException","File Name": "AmazonHttpClient.java","Line Number": 1207},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient$RequestExecutor","Method Name": "executeHelper","File Name": "AmazonHttpClient.java","Line Number": 1153},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient$RequestExecutor","Method Name": "doExecute","File Name": "AmazonHttpClient.java","Line Number": 802},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient$RequestExecutor","Method Name": "executeWithTimer","File Name": "AmazonHttpClient.java","Line Number": 770},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient$RequestExecutor","Method Name": "execute","File Name": "AmazonHttpClient.java","Line Number": 744},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient$RequestExecutor","Method Name": "access$500","File Name": "AmazonHttpClient.java","Line Number": 704},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl","Method Name": "execute","File Name": "AmazonHttpClient.java","Line Number": 686},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient","Method Name": "execute","File Name": "AmazonHttpClient.java","Line Number": 550},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient","Method Name": "execute","File Name": "AmazonHttpClient.java","Line Number": 530},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.AmazonS3Client","Method Name": "invoke","File Name": "AmazonS3Client.java","Line Number": 5140},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.AmazonS3Client","Method Name": "invoke","File Name": "AmazonS3Client.java","Line Number": 5086},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.AmazonS3Client","Method Name": "access$300","File Name": "AmazonS3Client.java","Line Number": 394},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.AmazonS3Client$PutObjectStrategy","Method Name": "invokeServiceCall","File Name": "AmazonS3Client.java","Line Number": 6032},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.AmazonS3Client","Method Name": "uploadObject","File Name": "AmazonS3Client.java","Line Number": 1812},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.AmazonS3Client","Method Name": "putObject","File Name": "AmazonS3Client.java","Line Number": 1772},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.s3.lite.call.PutObjectCall","Method Name": "performCall","File Name": "PutObjectCall.java","Line Number": 35},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.s3.lite.call.PutObjectCall","Method Name": "performCall","File Name": "PutObjectCall.java","Line Number": 10},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.s3.lite.call.AbstractUploadingS3Call","Method Name": "perform","File Name": "AbstractUploadingS3Call.java","Line Number": 87},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.s3.lite.executor.GlobalS3Executor","Method Name": "execute","File Name": "GlobalS3Executor.java","Line Number": 114},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.s3.lite.AmazonS3LiteClient","Method Name": "invoke","File Name": "AmazonS3LiteClient.java","Line Number": 191},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.s3.lite.AmazonS3LiteClient","Method Name": "invoke","File Name": "AmazonS3LiteClient.java","Line Number": 186},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.s3.lite.AmazonS3LiteClient","Method Name": "putObject","File Name": "AmazonS3LiteClient.java","Line Number": 107},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.s3n.Jets3tNativeFileSystemStore","Method Name": "storeFile","File Name": "Jets3tNativeFileSystemStore.java","Line Number": 152},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.s3n.MultipartUploadOutputStream","Method Name": "uploadSinglePart","File Name": "MultipartUploadOutputStream.java","Line Number": 198},{"Declaring Class": "com.amazon.ws.emr.hadoop.fs.s3n.MultipartUploadOutputStream","Method Name": "close","File Name": "MultipartUploadOutputStream.java","Line Number": 427},{"Declaring Class": "org.apache.hadoop.fs.FSDataOutputStream$PositionCache","Method Name": "close","File Name": "FSDataOutputStream.java","Line Number": 73},{"Declaring Class": "org.apache.hadoop.fs.FSDataOutputStream","Method Name": "close","File Name": "FSDataOutputStream.java","Line Number": 102},{"Declaring Class": "com.fasterxml.jackson.dataformat.csv.impl.UTF8Writer","Method Name": "close","File Name": "UTF8Writer.java","Line Number": 74},{"Declaring Class": "com.fasterxml.jackson.dataformat.csv.impl.CsvEncoder","Method Name": "close","File Name": "CsvEncoder.java","Line Number": 989},{"Declaring Class": "com.fasterxml.jackson.dataformat.csv.CsvGenerator","Method Name": "close","File Name": "CsvGenerator.java","Line Number": 479},{"Declaring Class": "com.amazonaws.services.glue.writers.JacksonWriter","Method Name": "done","File Name": "JacksonWriter.scala","Line Number": 73},{"Declaring Class": "com.amazonaws.services.glue.hadoop.TapeOutputFormat$$anon$1","Method Name": "close","File Name": "TapeOutputFormat.scala","Line Number": 217},{"Declaring Class": "com.amazonaws.services.glue.sinks.HadoopWriters$","Method Name": "$anonfun$writeNotPartitioned$3","File Name": "HadoopWriters.scala","Line Number": 125},{"Declaring Class": "org.apache.spark.util.Utils$","Method Name": "tryWithSafeFinallyAndFailureCallbacks","File Name": "Utils.scala","Line Number": 1495},{"Declaring Class": "org.apache.spark.sql.glue.SparkUtility$","Method Name": "tryWithSafeFinallyAndFailureCallbacks","File Name": "SparkUtility.scala","Line Number": 39},{"Declaring Class": "com.amazonaws.services.glue.sinks.HadoopWriters$","Method Name": "writeNotPartitioned","File Name": "HadoopWriters.scala","Line Number": 125},{"Declaring Class": "com.amazonaws.services.glue.sinks.HadoopWriters$","Method Name": "$anonfun$doStreamWrite$1","File Name": "HadoopWriters.scala","Line Number": 138},{"Declaring Class": "com.amazonaws.services.glue.sinks.HadoopWriters$","Method Name": "$anonfun$doStreamWrite$1$adapted","File Name": "HadoopWriters.scala","Line Number": 129},{"Declaring Class": "org.apache.spark.scheduler.ResultTask","Method Name": "runTask","File Name": "ResultTask.scala","Line Number": 90},{"Declaring Class": "org.apache.spark.scheduler.Task","Method Name": "run","File Name": "Task.scala","Line Number": 131},{"Declaring Class": "org.apache.spark.executor.Executor$TaskRunner","Method Name": "$anonfun$run$3","File Name": "Executor.scala","Line Number": 497},{"Declaring Class": "org.apache.spark.util.Utils$","Method Name": "tryWithSafeFinally","File Name": "Utils.scala","Line Number": 1439},{"Declaring Class": "org.apache.spark.executor.Executor$TaskRunner","Method Name": "run","File Name": "Executor.scala","Line Number": 500},{"Declaring Class": "java.util.concurrent.ThreadPoolExecutor","Method Name": "runWorker","File Name": "ThreadPoolExecutor.java","Line Number": 1149},{"Declaring Class": "java.util.concurrent.ThreadPoolExecutor$Worker","Method Name": "run","File Name": "ThreadPoolExecutor.java","Line Number": 624},{"Declaring Class": "java.lang.Thread","Method Name": "run","File Name": "Thread.java","Line Number": 750}],"Task Launch Time": 1667223676080,"Stage ID": 1,"Stage Attempt ID": 0,"Task Type": "ResultTask","Executor ID": "9","Task ID": 11}FollowComment"

Answer: 0Please take a look at this troubleshooting guide - https://aws.amazon.com/premiumsupport/knowledge-center/glue-s3-endpoint-validation-failed/CommentShareEXPERTIndranil Banerjee AWSanswered 7 months ago


Question: SES sent email lands in spam after activating Custom MAIL FROM domain and WorkMail

"Hey guys, I'm using SES to send emails programmatically since weeks and everything was fine.Now I followed a recommendation from the AWS console to activate "Custom MAIL FROM domain". Meanwhile I was activating Amazon WorkMail as well to activate a new email for sending and receiving emails.I'm using this plugin to send emails programmatically:https://www.npmjs.com/package/@strapi/provider-email-amazon-sesThis tool is asking for these credentials:providerOptions: {key: env("AWS_ACCESS_KEY_ID"),secret: env("AWS_ACCESS_SECRET"),amazon: "https://email.eu-central-1.amazonaws.com",},settings: {defaultFrom: "no-reply@....com",defaultReplyTo: "info@....com",},Neither no-reply@, nor info@ are setup yet in WorkMail as it wasn't needed before I suppose it's not needed.Do I have to wait until the changes of "Custom MAIL FROM domain" are verified by the receiving email providers or why does the programmatically sent emails land in spam now?The newly setup email address in WorkMail works fine. Those emails sent through the WorkMail Web Client works fine. E-Mail does not land in spam.Any ideas how to solve the Spam issue?Thank you in advance.FollowComment"

Answer: "0Yes, unfortunately I was using SES in eu-central-1 and had to activate WorkMail in eu-west-1.WorkMail worked find but then I experienced the above issue.So I thought I simply delete SES in eu-central-1 and recreate it in eu-west-1.Now my newly created SES in eu-west-1 is in sandbox mode and I'm still waiting for the activation of the production mode.Due to that whole misunderstanding, I cannot send any emails in production right now for my product.Maybe you can speed up things: Case ID 9843889541CommentShareAWS-User-7444961answered a year agosld a year agoHi -- I see that case has been taken care of. Hopefully you're back in action now, but feel free to ping if you run across any further bumps. Have a great weekend!Share0Hi there -- thank you for your interest in WorkMail and SES!I noticed that in the credential options you quoted above, you're citing the SES endpoint for eu-central-1. That is a region that WorkMail is not available in, so your WorkMail organization must be elsewhere. If you have used the same custom MAIL FROM subdomain (e.g., mail.yourdomain.com) for both SES and WorkMail, you may have accidentally invalidated your domain's Custom MAIL FROM MX record for your application running in eu-central-1, because it is region-specific.If this is the case, you can easily correct it just by giving your WorkMail organization's custom MAIL FROM a new, unique subdomain name, and then changing that original MX record back.Just head back to the Domains page in the WorkMail console and follow the link in the Custom MAIL FROM section, which will take you to the right page in the SES console. In the Custom MAIL FROM section, click the Edit button, give it a new name, save it, and then publish the new DNS records. For example, if you were using mail.yourdomain.com and want to keep that one for your SES activity, you could use workmail.yourdomain.com for WorkMail instead. After your WorkMail records are published, just change the MX record for your SES Custom MAIL FROM domain to point back at eu-central-1 instead of the WorkMail region it is now. At that point you should have SES verified identities for the same domain name in each of two regions, one for each of your messaging use cases, and each with its own valid and unique custom MAIL FROM.I hope that helps!Kind regards,SabrinaCommentSharesldanswered a year ago"


Question: AWS Terraform based Webserver Connection Getting refused

"HI,Anyone faced this problem while learning AWS Terraform ?I am following the Book to practice the Terraform I am getting below error.url: (7) Failed to connect to <<<removed Public IP Address of EC2 >> port 8080 after 49 ms: Couldn't connect to serverPlease advise if there is any recent upgrade ?My Code is belowprovider "aws" {region="us-east-2"}resource "aws_security_group" "instance" {name="terraform-example-instance"ingress {from_port=8080to_port=8080protocol="tcp"cidr_blocks=["0.0.0.0/0"]}}resource "aws_instance" "example" {ami="ami-0a695f0d95cefc163"instance_type="t2.micro"vpc_security_group_ids=[aws_security_group.instance.id]user_data=<<-EOF#!/bin/bashecho "Hello, World" > index.htmlnohup busybox httpd -f -p 8080 &EOFtags={"Name" = "terraform-example"}}FollowComment"

Answer: "0To reach out an instance from the internet, your ec2 needs to:have a public ip addressbe deployed on a public subnet (with the routing pointing to an internet gateway)You said that you are trying to connect to the public ip, so i assume that you have already done the point 1, otherwise add associate_public_ip_address to the aws_instance resource.To accomplish the point 2, first create the internet gateway:resource "aws_internet_gateway" "gw" {  vpc_id = aws_vpc.your_vpc_resource_name.id  tags = {    Name = "main"  }}then create a routing table that point to it:resource "aws_route_table" "main" {  vpc_id = aws_vpc.your_vpc_resource_name.id  route {    cidr_block = "0.0.0.0/0"    gateway_id = aws_internet_gateway.gw.id  }  tags = {    Name = "main"  }}then associate it to the subnet where the EC2 has been deployed:resource "aws_route_table_association" "main" {  subnet_id      = aws_subnet.your_vpc_subnet_name.id  route_table_id = aws_route_table.main.id}After that, your connection should works.CommentShareDavideGanswered 2 months agorePost-User-5918101 2 months agoThanks for your advise, Do I need to declare aws_vpc and aws_subnet resource also ?│   on main.tf line 6, in resource "aws_internet_gateway" "gw":│    6:   vpc_id = aws_vpc.your_vpc_resource_name.id││ A managed resource "aws_vpc" "your_vpc_resource_name" has not been declared in the root module.Share0Sure, you need even a vpc and a subnet, here it's a full example:resource "aws_vpc" "main" {  cidr_block       = "10.0.0.0/16"  tags = {    Name = "main"  }}resource "aws_subnet" "a" {  vpc_id     = aws_vpc.main.id  cidr_block = "10.0.1.0/24"  availability_zone = "us-east-2a"  tags = {    Name = "Main"  }}resource "aws_internet_gateway" "gw" {  vpc_id = aws_vpc.main.id  tags = {    Name = "main"  }}resource "aws_route_table" "main" {  vpc_id = aws_vpc.main.id  route {    cidr_block = "0.0.0.0/0"    gateway_id = aws_internet_gateway.gw.id  }  tags = {    Name = "main"  }}resource "aws_route_table_association" "main" {  subnet_id      = aws_subnet.a.id  route_table_id = aws_route_table.main.id}Then you need to create a security group and the EC2 with the code that you have already written.regardsCommentShareDavideGanswered 2 months ago"


Question: Performance Insights option missing

"We have a MySQL RDS instance (t2.micro), and when attempting to modify the instance, the option to enable/disable Performance insights is not present among the options. At the top of the section "Additional configuration" it says "Performance Insights enabled", but the option is not there. Also, it is possible to select Performance Insights in the Monitoring section of the instance, but the carts are empty in the Performance Insights view. Any suggestions of how to solve this?Best regardsMaxFollowCommentAWS-User-0508046 a year agoI have the same problem, I want to upgrade my engine motor (t3.medium, with performance insight enable) from 9.02 to 9.10, It says that I cant because performance insight is enable. They tell me that I need to disable performance insight first, but I cant because the option doesn't appear in the user interface. What is the process that I should follow to upgrade to 9.10 and keeping my t3 instance (even if it mean that I will loose performance insight). I will upgrade my instance from t3 later on, now I just want to upgrade the engineShare"

Answer: "0Accepted AnswerHi,For MySQL RDS, performance insights aren't available on the small and micro instance sizes. There are also engine requirements. Found here: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.Overview.Engines.html"8.0.17 and higher 8.0 versions, version 5.7.22 and higher 5.7 versions, and version 5.6.41 and higher 5.6 versions.Not supported on the following DB instance classes: db.t2.micro, db.t2.small, db.t3.micro, and db.t3.small."CarloCommentShareCarlo-Manswered 2 years agoAWS-User-0508046 a year agoI have the same problem, I want to upgrade my engine motor (t3.medium, with performance insight enable) from 9.02 to 9.10, It says that I cant because performance insight is enable. They tell me that I need to disable performance insight first, but I cant because the option doesn't appear in the user interface. What is the process that I should follow to upgrade to 9.10 and keeping my t3 instance (even if it mean that I will loose performance insight). I will upgrade my instance from t3 later on, now I just want to upgrade the engineShare"


Question: Preserve aws deployment state in a file and then use to redeploy.

"How can we achieve following? Is there a command/cli for doing this:Preserve aws deployment state in a file and then use to redeploy. Use this file to deploy and clean and then redploy to bring in same running instances and services. Can we use Sam or another command to save the state in a yaml or a similar file?command save-state <aws-state.yaml>command clean-existing-state //wipes and cleans off aws deployed state, can probably turn off or even removecommand restore-state <aws-state.yaml>vim aws-state.yaml //manually make certain changescommand clean-existing-statecommand restore-state <aws-state.yaml> //redploy updated stateThanksFollowComment"

Answer: "0If you want to define a repeatable deployment that you can use to manage your infrastructure, you've just defined cloudformationWhile there are some attempts to turn existing infrastructure into CloudFormation, such as Cloudformer - it's quite difficult to do this reliably.You can use Drift Detection to show where your infrastructure has changedCommentSharecloudandmediaanswered a year ago"


Question: docker container in EC2  cannot connect to elasticCache

"EC2 can connect to elasticache,but docker container in EC2 cannot connect to elasticache unless i set the network_mode=host.But i want to use docker swarm to deploy the services,so i shouldn't set the network_mode=host,how can i do itFollowComment"

Answer: "0Hello hy_galen,When you use network_mode=host, your containers will use the underlying host's network namespace. Therefore, it is equivalent to running your application on an EC2 instance wrt networking.If you do not specify the above parameter, your containers running in the swarm cluster will be connected to the underlying host's docker_gwbridge network by default. I believe the issue could be related to the docker network setup in your swarm cluster.Docker modifies the iptables on your nodes to provide network isolation. If you have configured docker daemon settings in /etc/docker/daemon.json, make sure you have not set iptables=false as this will break your container networking. For more info, refer this doc.I found a stackoverflow issue that is similar to yours. Try to follow the steps provided and see if it helps in finding the root cause.CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 9 months ago"


Question: Mount EFS in Workspaces Stuck in Read-Only

"Greetings. I am administering an AWS EFS and a handful of Amazon Linux 2 workspaces. I can mount the EFS in the workspace using its IP address, but it only mounts in read-only mode. I made an Ubuntu EC2 instance and mounted the EFS there (as the root Ubuntu user), and I have both read and write access.Why can't I mount my EFS to my WorkSpace in read/write mode? And why can I only mount it by IP and not with Amazon's EFS helper?FollowComment"

Answer: "0Hi phriskiiiI understand that you were having trouble mounting your efs in read/write mode and would also like to why you cannot mount using the efs helper.Mounting EFS in read/write mode:The following are two common issues that prevent you from writing to your file system:* The mount option in the /etc/fstab file is set to read-only access. * The associated AWS Identity and Access Management (IAM) policy indicates read-only access, or root access disabled.Resolution:{color:#f00}Note:{color} This resolution uses the Amazon EFS mount helper [1]. The Amazon EFS mount helper is preinstalled on Amazon Linux.- Verify that mount options are correct in the /etc/fstab file.- Verify that permissions are set correctly.- For a more detailed walkthrough please check [2]Mounting EFS using the EFS helper:- To use the EFS helper you must:    - ensure that you can use the efs mount helper, you must make sure to add the security group of the EFS to the security group of the Workspace[3]    - The EFS should be configured on the same VPC on which the WorkSpaces are being provisioned or VPC peering should be enabled when EFS and WorkSpaces are in different VPCs. Please refer the documentation on mounting EFS File Systems from Another account or VPC here [4].    - Also take note that - DNS resolution for file system DNS names requires that the Amazon EFS file system has a mount target in the same Availability Zone as the client instance.I hope this information helpsReferences:[1] Amazon EFS mount helper:https://docs.aws.amazon.com/efs/latest/ug/using-amazon-efs-utils.html[2] Enable read-write-access on EFS:https://aws.amazon.com/premiumsupport/knowledge-center/efs-enable-read-write-access/[3] Add EFS security group to workspace Security group:https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-security-groups.html#security_group_existing_workspace[4] Mounting EFS File Systems from Another Account or VPC:https://docs.aws.amazon.com/efs/latest/ug/manage-fs-access-vpc-peering.htmlCommentShareMabandlaanswered 2 years ago0Run the following commands on the efs directory after mounting.•sudo chmod 777 efs•sudo chmod -R 666 efs/*CommentSharephriskiiianswered 2 years ago"


Question: key error lambda function dynamodb

"Hi,I am getting the following error when testing a lambda function which exports fields from a dynamodb if they are populated :"errorMessage": "'Win'","errorType": "KeyError",The lambda function is:import boto3def lambda_handler(event, context):# Connect to DynamoDBdynamodb = boto3.resource('dynamodb')table = dynamodb.Table('ticketing')# Get all items from the tableitems = table.scan()['Items']# Create a list to hold the filtered itemsfiltered_items = []# Iterate through the items and check if the fields are not emptyfor item in items:    if item['username'] and item['Win'] and item['Lose'] and item['Score']:        filtered_items.append({'username': item['username'], 'Win': item['Win'], 'Lose': item['Lose'], 'Score': item['Score']})        # Return the filtered itemsreturn filtered_itemsCan anyone shed some light on this please?Thank you :-)FollowComment"

Answer: "2You should first check the items have those keys before using them:for item in items:    if all(key in item for key in ("username", "Win", "Lose", "Score")):       if item['username'] and item['Win'] and item['Lose'] and item['Score']:CommentShareEXPERTLeeroy Hannigananswered 4 months agoND Bhav 4 months agoThank you for replying :-)Ended up doing it another way:import boto3dynamodb = boto3.resource('dynamodb')table = dynamodb.Table('INSERT DATABASE NAME HERE')def lambda_handler(event, context):users = table.scan()['Items']filtered_users = []for user in users:if user.get('Win') or user.get('Lose') or user.get('Score'):filtered_users.append({'username': user.get('username'),'Win': user.get('Win'),'Lose': user.get('Lose'),'Score': user.get('Score')})return filtered_usersShare"


Question: EKS GUI create node pool all the time failed after 30 min

I try to create Kubernetes cluster and all the time it failed with errorFollowComment

Answer: "0Hello,Thanks for your query. I understand that there are two statements, one is you are not able to create the node group and second being, you are not able to create the kubernetes cluster and you are getting some error. Please let me know if my understanding is not apt.If possible, could you please share the error which you are getting and to answer your question, we might require details that are non-public information. I would suggest you to open a support case with AWS using the following link [1].Have a great day ahead.Reference Link:[1]. https://console.aws.amazon.com/support/home#/case/createCommentShareSUPPORT ENGINEERrePost-User-0191609answered 8 months ago0Hi this is the error:"Unhealthy nodes in the kubernetes cluster"CommentSharerePost-User-9833995answered 8 months ago"


Question: How to edit wp-config and I upload an error theme?

"Hi everyoneIntroduce me TaufiqI want to ask? I have a problem when my website theme is an error, I already have a web server I want to move to Amazon, how to migrate to WordPress Lightsail.May I ask you more professional opinions for WordPress settings.Thank youFollowComment"

Answer: "0Accepted AnswerHi, if you're considering migrate your Wordpress web server to Lightsail, you can follow this guide: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/migrate-your-wordpress-blog-to-amazon-lightsailCommentSharerePost-User-6151282answered 5 months ago0I have successfully imported my articles and pictures.But at the time of importing my theme.There has been a critical error on your websiteThank youCommentShareTaufiqanswered 5 months ago"


Question: Lightsail Burst Capacity Goes Unused When Needed

"Our cPanel running wordpress constantly hits the burstable zone and going down when trying to edit a page/post. When this happens, I am not seeing any change in our Burst capacity—which is at 100%.Why isn't our instance using its burst capacity?Example: Today we hit 25.52%. Our sustainable zone is 20%. When we hit that 25.52% the site when down. At the same time, our Burst Capacity was at 100%.cPanel_WHM_for_Linux4 GB RAM, 2 vCPUs, 80 GB SSDFollowComment"

Answer: "0I have read through that documentation already–it does not answer the question. When our CPU utilization goes into the burst zone,  why are't we utilizing any of our burst capacity? The documentation seems to suggest we should see burst capacity usage, but we are not, and the site goes down.CommentSharerePost-User-3295309answered a year ago-1Thanks for using Lightsail! Here is the Doc related to detailed explanation of Lightsail instance burst capacity. Hopefully this will answer your question.CommentShareYiran-AT-AWSanswered a year ago"


Question: Why is transferring domain between accounts "unavailable at this time"?

"Attempting to transfer a domain between two accounts (as root user) as per the instructions detailed here:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-transfer-between-aws-accounts.htmlWhen enter destination account id and click transfer it fails with the message "The domain is not transferable at this time". Same error for another couple of domains. All were registered with Route53 in the first place and have been owned for some time so there should not be anything that has not yet propogated.Help and suggestions welcome, thanks.FollowComment"

Answer: "0Hello Sean,If you haven't already, I'd recommend reviewing How do I troubleshoot domain transfer failures in Route 53?.Additionally, ensure you've turned off the transfer lock for the domains you want to transfer. For more information, visit Locking a domain to prevent unauthorized transfer to another registrar.-BriCommentShareBriNasAWSanswered 24 days ago"


Question: PSI Terminated My Exam For Apparent Rule Violation Which Never Occurred

"Supposed to have AWS Certified Security - Specialty at 12:00 PM with PSI. Try launching the exam for more than 2 hours. Exam terminated for apparent rule violation. TV was Off, table cleared, phone not in the near, alone in the room, not taking to anybody/ghost, I only move my head closer to my laptop to read or move my mouth to read only to myself not loud.I felt powerless, frustrated and cheated upon. I had about 10 questions left to complete the exam with about 40 minute to go.This was my third exam with PSI and the experiences were horrible but I was ready to go through it again but not the exam been terminated for fake reason. The support had been friendly but what do you do when they disappear and you alone with your problem.This is my very first time of writing on a forum. Hope you get the point.FollowComment"

Answer: "0terriblefrustrated,I have responded to your initial post at https://forums.aws.amazon.com/thread.jspa?threadID=346632.KimAWS CertificationCommentShareKimWD-AWSanswered 2 years ago0I used PearsonVUE and had a similar experience but only received a warning. They did a thorough check of the room (via webcam) and made sure that nobody could see through the window behind me. Halfway through my test a message popped up saying that I was murmuring / reading aloud and if I continued the exam would be cancelled. In fact I was reading some of the questions quietly, not even realizing it. In any case, the warning was enough, I clamped shut and finished the exam.My guess is they are worried we are recording our words, collecting questions. Having a warning gave me a fair chance. Realistically though I worried during the whole test that someone would inadvertently come into the room. My test was not very expensive and the testing center was quite far. Also, there was a problem connecting through my laptop built-in camera. I had an external USB camera and was able to use that. Not sure what would have happened if that had fallen off the table since I was supposed to be in view at all times.In retrospect, if it was an expensive test, not sure it would be worth the risks of doing it from home.CommentShareshawngieseanswered 2 years ago0Resolved. But never again an exam from homeCommentShareterriblefrustratedanswered 2 years ago"


Question: Can't connect to an RDS Instance from Lambda (different account tough)

"Hello,I am trying to connect to an RDS Instance for developpement purpose from a Lambda function used as an Authorizer. But it seems to timeout each time.I have another database which works fineSome detailed informations :About the RDS instance Network Configuration :RDS Instance is wide open. I can connect from my computer with Pgadmin.Inbound rules of the group security attached to the RDS are correct :*PGS TCP 5432 - 0.0.0.0/0*PGS TCP 5432 - ::/0DNS are OKUsing default aws VPC.About the lambda function :There is already a database settings configured in the code and it works fine.Outbound rules of the scurity group attached to the lambda are OKALL 0.0.0.0/0, ::/0Public accessibility : YesCode is OK since i can connect to an another database in my accountOne difference tough : the rds instance i am trying to connect is not on the same aws account that i am using but in the same region (west3c). I don't think this is a problem.I am out of idea.Edited by: MrJibus on Apr 10, 2020 7:06 AMFollowComment"

Answer: 0Oh yeah ... my vpc doesn't access to the internet ...Removing the vpc from the lambda resolves the issue.CommentShareMrJibusanswered 3 years ago


Question: Not able to set the Lambda Provisioning causing error "unreserved account concurrency is 10"

"We are facing the lambda cold start issues. We used java and kotlin to build our backend applications following the serverless and micro service approach to deploy the data services inside lambda and api composition for front end apps in another lambda. The front end request goes to API GW and then to API Composition Lambda and goes to other Data Lambdas.In order to reduce the cold start, we are trying to use provisioned concurrency on our lambda. But When I tried to change the config for provisioned concurrency, I got the below error“The maximum allowed provisioned concurrency is 0, based on the unreserved concurrency available (10) minus the minimum unreserved account concurrency (10).“Pasted the screenshot for reference.Then I checked the configuration, it says the number of unreserved account concurrency is 10. Pasted the screenshot below for reference.Now I am stuck with not able to increase the unreserved account concurrency and not able to provision the lambda.I didn't understand what is going wrong. Can some expert here explain, what I am missing here and help understand fix the issue ?FollowComment"

Answer: "2Hi,Not a direct answer to above, but have you tried to use Snapstart instead? Could be an easier win than provisioned concurrency for cold start: https://docs.aws.amazon.com/lambda/latest/dg/snapstart.htmlCommentShareEXPERTalatechanswered 3 months agoG V Navin 3 months agoThe snapstart is not available in ap-south-1Sharealatech EXPERT3 months agoInteresting. So when looking at this page: https://aws.amazon.com/premiumsupport/knowledge-center/lambda-concurrency-limit-increase/#:~:text=Important%3A%20If%20you're%20using,invocations%20at%20any%20given%20time, it says: "The default concurrency limit per AWS Region is 1,000 invocations at any given time. However, note that new AWS accounts have reduced concurrency and memory quotas." Is your account a new one?ShareG V Navin 3 months agoWe created this account 4 months ago. Not sure how much recency qualifies for the "new"  account in this case. I also asked for quota rise support.Sharealatech EXPERT3 months agoIt will depend on usage. If account was created 4 months ago and then barely used, the limitations may still apply. Let me know if issue goes away by raising limitsShareG V Navin 3 months agoAfter we raised the quota increase, the number is increased, after that we are able to set the provisioned concurrency values.Share0Accepted AnswerIt looks like our account is created 4 months ago. Seems new account will have low values for the quota.After we raised the quota increase request from AWS console, the allocated number is increased. After the increase we are able to set the provisioned concurrency values.CommentShareG V Navinanswered 3 months ago"


Question: Lightsail DNS not working.

"Hi, My site kitchenathoskins.com was up and running for more than a year with out any problem in light sail. Last two days it was down because of DNS failure. Yesterday I was able to bring it back up by creating a new static ip address. But it was slow. So I deleted the DNS zone and static ip and created a new. Its been hard down ever since. I updated the name servers in my Route 53 as well. But nothing seems to be working. pl. help.FollowComment"

Answer: 0Accepted AnswerSeems to be working fine here...CommentShareRobMManswered 4 years ago0yes. thanks. Maybe just DNS propagation delay.CommentSharekitchenathoskinsanswered 4 years ago


Question: Unauthenticated AppSync Resolvers

"I am using AppSync as my API for my application. I would like a few basic features to be available to users who haven't signed in yet.I'm aware that it is possible to use IAM authentication and to create a temporary AssumeRole call to an unprivileged role and use that with IAM authorization, but I'd really much prefer to be able to designate certain resolvers are not requiring any authentication.Is this possible? I don't want to have part of my app be a GraphQL API for authenticated users and part of it be a REST API for unauthenticated users.FollowComment"


Question: Create multipart using S3 API

"I have been trying to create a multipart upload using S3 API but I got stuck with signature verification. I am not sure if I am doing it in the right way but anyone who can give me a suggestion on it would be appreciated. Following is my code snippet. please have a look into it.reference (https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateMultipartUpload.html)import datetimeimport hashlibimport hmacimport osimport sysimport requestsmethod = 'POST'service = 's3'host = 's3_bucket_host'region = 'aws_region'endpoint = 'https://s3.us-east-1.amazonaws.com/'request_parameters = 'uploads='def sign(key, msg):    return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).digest()def getSignatureKey(key, dateStamp, regionName, serviceName):    kDate = sign(('AWS4' + key).encode('utf-8'), dateStamp)    kRegion = sign(kDate, regionName)    kService = sign(kRegion, serviceName)    kSigning = sign(kService, 'aws4_request')    return kSigningaccess_key = os.environ.get('AWS_ACCESS_KEY_ID')secret_key = os.environ.get('AWS_SECRET_ACCESS_KEY')t = datetime.datetime.utcnow()amzdate = t.strftime('%Y%m%dT%H%M%SZ')print(amzdate)datestamp = t.strftime('%Y%m%d')  # Date w/o time, used in credential scopecanonical_uri = 'xyz/xyz'canonical_querystring = request_parameterscanonical_headers = 'host:' + host + '\n' + 'x-amz-date:' + amzdate + '\n' + 'x-amz-content-sha256:abcdefghijklmnopqrstuvwxyz'signed_headers = 'host;x-amz-content-sha256;x-amz-date'payload_hash = hashlib.sha256(('').encode('utf-8')).hexdigest()canonical_request = method + '\n' + canonical_uri + '\n' + canonical_querystring + '\n' + canonical_headers + '\n' + signed_headers + '\n' + payload_hashalgorithm = 'AWS4-HMAC-SHA256'credential_scope = datestamp + '/' + region + '/' + service + '/' + 'aws4_request'string_to_sign = algorithm + '\n' + amzdate + '\n' + credential_scope + '\n' + hashlib.sha256(    canonical_request.encode('utf-8')).hexdigest()signing_key = getSignatureKey(secret_key, datestamp, region, service)signature = hmac.new(signing_key, string_to_sign.encode('utf-8'), hashlib.sha256).hexdigest()authorization_header = algorithm + ' ' + 'Credential=' + access_key + '/' + credential_scope + ', ' + 'SignedHeaders=' + signed_headers + ', ' + 'Signature=' + signatureprint(authorization_header)headers = {'x-amz-date': amzdate,           'Authorization': authorization_header,           'host': host,           'x-amz-content-sha256': 'abcdefghijklmnopqrstuvwxyz'}request_url = endpoint + canonical_uri + '?' + canonical_querystring#print('\nBEGIN REQUEST++++++++++++++++++++++++++++++++++++')print('Request URL = ' + request_url)r = requests.post(request_url, headers=headers)print('\nRESPONSE++++++++++++++++++++++++++++++++++++')print('Response code: %d\n' % r.status_code)# from awsxmltojson import convert_xml_to_dictprint(r.text)## response from API<Error>SignatureDoesNotMatch<Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Error>FollowComment"


Question: Elasticache Redis 6 multi-threading enabled?

"My organization is using the Redis Cluster implementation of ElastiCache 5.0.6. Redis 6 boasts multi-threading which can improve performance , but it is disabled by default.If we upgrade to ElastiCache with Redis 6.x, will it have multi-thread enabled? How many threads? Is there a way to configure multi-threading capabilities at time of migration?FollowComment"

Answer: "0ElastiCache Redis 5.0.3 and higher for newer generations with 4 or more vCPUs, we do dynamic network processing to enhance I/O handling and it utilizes extra CPU core. This greatly improve the throughput/latency and work best for applications that require a larger number of concurrent connections. And it is worth mentioning that no client side changes are needed to get these benefits. More details can be found on this blog[1]. Also, ElastiCache for Redis 6.2 has done performance improvement for TLS-enabled clusters to offload encryption and connection handling outside the main Redis thread and some explanations are provided on this page[2]. Redis is still a single threaded by design, but these enhancement we have made improve performance.[1]https://aws.amazon.com/blogs/database/boosting-application-performance-and-reducing-costs-with-amazon-elasticache-for-redis/[2]https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/supported-engine-versions.html#redis-version-6.2CommentShareRajananswered a year ago"


Question: SES Suppression List - Report Button Greyed Out

How can I export my suppression list as there doesn't seem to be a way to search for emails that are in the suppression list.  Very hard to troubleshoot why someone isn't getting emails.  The report button is greyed out.  Why and is there a way to make that work.  ThanksFollowComment

Answer: "0The AWS CLI can be used to obtain a list of email addresses on the suppression list.https://docs.aws.amazon.com/ses/latest/dg/sending-email-suppression-list.html#sending-email-suppression-list-view-entriesaws sesv2 list-suppressed-destinationsAlso, what is the situation with the report button being grayed out?I can't see it on my screen so it would be helpful if you could show it to me in an image.CommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: Getting unhealthy service error

"Dear,I am trying to create my demo ECS service on Farget with public docker image. I tried multiple time but always getting instance unhealthy.Could you please help me to know where I am doing wrong.Test data are as follows:cluster name: nginx-demo-cltask defination: nginxdemos-helloservice: nginxdemos-hello-SVCLoadBalancer: NginxALBTarget Group: nginx-tgSecurity Group: nginxdemos-sg and nginxdemos-alb-sgdocker image: nginxdemos/nginx-helloFollowComment"

Answer: "0Hi,According to the error message, it seems that you are having problems with the health check. Have you read the following Knowledge Center article about How to troubleshoot health check failures for Amazon ECS tasks on Fargate? Your specific error is described and they recommend checking the security group inbound configuration,  ping port value or health check grace period, among other steps.CommentShareMikel Del Tioanswered a month ago"


Question: Pipeline to deploy a Python Lambda using serverless

Is there a step by step tutorial on how to deploy a Python Lambda via serverless using a Pipeline (or CodeBuild only for that matter) somewhere ?I've gone through someones tutorial here: https://www.youtube.com/watch?v=aGI4Wlm5c9Ubut always seem to get stuck at the multiple IAM policies involved..Just wondering if AWS has a step by step that i can follow.FollowComment

Answer: 0Accepted AnswerYou can try this workshop - https://cicd.serverlessworkshops.io/It has both Node.js and Python versions.CommentShareEXPERTIndranil Banerjee AWSanswered a year agoclogwog a year agothat looks good. i'll go through it. thank you !Share


Question: Redshift-Serverless - Create Endpoint Access in a different AWS Account

"Redshift allows you to deploy Redshift-managed VPC endpoints in a different AWS account than the one where the cluster resides as described here. However, there appears to be no option to accomplish this for Redshift-serverless instances.The document here explains how to do this for another VPC in the same account, but no options seem to exist to do it cross-account. Even over aws-cli, while you can specify --resource-owner when using aws redshift create-endpoint-access, but no such options exist for aws redshift-serverless.Any hints around how to do this for serverless are much appreciated!!FollowComment"

Answer: 3Accepted AnswerAWS Redshift Serverless does not provide a built-in way to create VPC endpoint access for a Redshift Serverless cluster in a different AWS account.If you want you can do it manuallyCreate a VPC peering connection between the VPC in the account where the Redshift Serverless cluster resides and the VPC in the other account where you want to access the Redshift Serverless cluster.Update the route tables in both VPCs to include routes for the CIDR blocks of the peered VPCsModify Security groupsCommentShareEXPERTsedat_salmananswered a month ago


Question: Can I import an RDS uncrypted mysql snapshot to an RDS encrypted mysql?

"I have an uncrypted rds mysql, inside there are several databases so I can't afford a stop of all my applications.I have thought to create a snapshot of my actual rds mysql, create a new encrypted mysql db and then import this snapshot into new rds instance.If this isn't possible maybe can I use DMS to sync my actual uncrypted db with the new one encrypted ?FollowComment"

Answer: 1Accepted Answerconversion of unencrypted rds mysql from snapshot to encrypted one is possible.for minimum down time please refer to https://aws.amazon.com/premiumsupport/knowledge-center/rds-encrypt-instance-mysql-mariadb/CommentShareAWS-User-8174525-subhashanswered a year ago


Question: Site-to-Site VPN Convergence

"Hello,We currently use a redundant site-to-site VPN with BGP between between AWS and our on-prem site. Each site-to-site VPN from AWS side connects to a single WAN endpoint on our side. We have configured BGP with LP and MED to make sure the flow is symmetric with the preference as shown in the image below. BGP is configured with a keep-alive of 3 and hold-down timer of 9 seconds while DPD is configured with 10 seconds interval and retry count of 3.While doing failover testing I observed that whenever WAN1 goes down, it takes approximately 20-35 seconds for the AWS side to converge. I can see our side firewall using the new tunnel and BGP route as soon as 10 seconds.  Further decreasing the BGP timers and the IPSEC DPD timers don't bring much change to this time. I have a trace/mtr running from inside the VPC and I can see that AWS side keeps using primary tunnel even when the tunnel is down on AWS side. The TGW route-table does update prompty with the new tunnel attachment but the traceroute keeps using the old down tunnel. I have tried MTR with different options like TCP/ICMP/UDP to make sure it's not some weird ICMP hashing issue.FollowComment"

Answer: "0Check if you have configured Bidirectional Forwarding Detection (BFD). BFD is a simple hello mechanism that detects failures in a network.CommentShareSachinanswered 3 months ago0BFD is not configured between the peers and I am not sure its even supported on the AWS side while configuring over IPSEC.Regardless we don't seem to converge within 10seconds so i doubt BFD configuration if possible would make any difference.CommentSharerePost-User-9145521answered 3 months ago0BFD needs to configure on Direct connect. you need to check with your vendor.check below link for example.https://aws.amazon.com/premiumsupport/knowledge-center/enable-bfd-direct-connect/CommentShareSachinanswered 3 months ago0As I have mentioned in my question, we are using the IPSEC tunnels and not direct connect so not sure how I can use BFD in my scenario. I know BFD is supported on direct connect but the problem is related to IPSEC tunnel convergence.CommentSharerePost-User-9145521answered 3 months ago"


Question: Cloud9 installation fails

"I have a Lightsail instance that I created with Node pre-installed. I would like to get Cloud9 installed because my end goal is to be able to work on a MERN stack and see the changes over a domain name immediately.Creating a base React app and a base server was not a problem. But the next step is to get Cloud9 and it is not going well.I am following these instructions: https://docs.aws.amazon.com/cloud9/latest/user-guide/lightsail-instances.html#lightsail-instances-setupStep 2.8 links to this page to use the Cloud9 installer https://docs.aws.amazon.com/cloud9/latest/user-guide/installer.html#installer-download-runThis in turn says to use one of these 2 commands to pull it down and install.curl -L https://d3kgj69l4ph6w4.cloudfront.net/static/c9-install-2.0.0.sh | bashwget -O - https://d3kgj69l4ph6w4.cloudfront.net/static/c9-install-2.0.0.sh | bashIt appears the getting the file is not a problem but wither I use curl or wget I get the same error:Collecting codeintel==0.9.3  Using cached CodeIntel-0.9.3.tar.gz (11.9 MB)  Preparing metadata (setup.py) ... error  ERROR: Command errored out with exit status 1:   command: /opt/bitnami/python/bin/python -c 'import io, os, sys, setuptools, tokenize; sys.argv[0] = '"'"'/home/bitnami/.c9/tmp/pip-download-ujactnl_/codeintel_6b166ed96c3c4abea8b3820caf7af722/setup.py'"'"'; __file__='"'"'/home/bitnami/.c9/tmp/pip-download-ujactnl_/codeintel_6b166ed96c3c4abea8b3820caf7af722/setup.py'"'"';f = getattr(tokenize, '"'"'open'"'"', open)(__file__) if os.path.exists(__file__) else io.StringIO('"'"'from setuptools import setup; setup()'"'"');code = f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' egg_info --egg-base /home/bitnami/.c9/tmp/pip-pip-egg-info-h_eacai8       cwd: /home/bitnami/.c9/tmp/pip-download-ujactnl_/codeintel_6b166ed96c3c4abea8b3820caf7af722/  Complete output (8 lines):  Traceback (most recent call last):    File "<string>", line 1, in <module>    File "/home/bitnami/.c9/tmp/pip-download-ujactnl_/codeintel_6b166ed96c3c4abea8b3820caf7af722/setup.py", line 7, in <module>      import codeintel    File "/home/bitnami/.c9/tmp/pip-download-ujactnl_/codeintel_6b166ed96c3c4abea8b3820caf7af722/codeintel/__init__.py", line 204      resource.setrlimit(resource.RLIMIT_AS, (2 * GB, -1L))                                                        ^  SyntaxError: invalid syntax  ----------------------------------------WARNING: Discarding https://files.pythonhosted.org/packages/17/24/fdbdb494142f28d524ed81edacf5630fe97aa209b3252ae01260af0e1ad6/CodeIntel-0.9.3.tar.gz#sha256=258d25f7376c6564f7c58d98273734b9b56e40e53ff82aacbfa5f8c8835c8419 (from https://pypi.org/simple/codeintel/). Command errored out with exit status 1: python setup.py egg_info Check the logs for full command output.ERROR: Could not find a version that satisfies the requirement codeintel==0.9.3 (from versions: 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1, 0.9.3, 2.0.0b10, 2.0.0b11, 2.0.0b12, 2.0.0b13, 2.0.0b14, 2.0.0b15, 2.0.0b16, 2.0.0b19, 2.0.0b20, 2.0.0b21, 2.0.0b22, 2.0.0b23, 2.0.0b24, 2.0.0b25, 2.0.0b26, 2.0.0b27, 2.0.0b28, 2.0.0b29, 2.0.0b30, 2.0.0b31, 2.0.0b32, 2.0.0b33, 2.0.0b34, 2.0.0b35, 2.0.0b36, 2.0.0rc1, 2.0.0rc2, 2.0.0)ERROR: No matching distribution found for codeintel==0.9.3real0m2.764suser0m2.358ssys0m0.286sThe instance came with python 3.8.16 pre-installed, and the first page of instructions instructed to install python 2.7 using sudo apt install -y python-minimal -- which failed, so I installed python 2.7 using sudo apt install -y python2 -- which produced no errors. I added alias python='/usr/bin/python2.7' to ~/.bashrc and done source ~/.bashrc and tried the same commands, with the same error as a result.If it's relevant, NodeJS is v16.18.1So, why is the Cloud9 installer getting hung up on codeintel here?Note: I've visited https://pypi.org/project/CodeIntel/0.9.3/#files and codeintel does have a version 0.9.3, so the line saying "could not vind a version that satisfies" doesn't make any sense to me. I even checked the download link and the sha256 hash matches what was output there. I do not know why the listed versions in the installer's output doesn't display it. To me, that leaves the first part of the error as culprit, but I have very little familiarity with Python so I'm not sure how to parse that command. /opt/bitnami/python/bin/ is the location where all the python3 files are stored, but I guess that python is still 2.7, bc python version still returns 2.7.18 and which python is /opt/bitnami/python/bin/python so....FollowComment"

Answer: "1Accepted AnswerSo I finally worked this out. I realized the key was this:ERROR: Could not find a version that satisfies the requirement codeintel==0.9.3 (from versions: 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1, 0.9.3, 2.0.0b10, 2.0.0b11, 2.0.0bfor some reason I couldn't find 0.9.3 in there on previous checks.Since it couldn't find a version that it lists (still WTF about that) I decided to try codeintel 2, since that's stable and much newer. I also ran this with Python 3.8.16 -- so basically ignoring the insistence AWS has that you use 2.7, a version that was sunset almost 3 years ago.So here's the steps I took.instead ofcurl -L https://d3kgj69l4ph6w4.cloudfront.net/static/c9-install-2.0.0.sh | bashwget -O - https://d3kgj69l4ph6w4.cloudfront.net/static/c9-install-2.0.0.sh | bashdo curl -L https://d3kgj69l4ph6w4.cloudfront.net/static/c9-install-2.0.0.sh --output ~/c9-install-2.0.0.sh to save the file.edit the file vim ~/c9-install-2.0.0.shNear the end of the file there's these commands: $PIP download -d /tmp/codeintel codeintel==0.9.3 inflector==2.0.12  tar xf CodeIntel-0.9.3.tar.gz  mv CodeIntel-0.9.3/SilverCity CodeIntel-0.9.3/silvercity  tar czf CodeIntel-0.9.3.tar.gz CodeIntel-0.9.3replace with $PIP download -d /tmp/codeintel codeintel==2.0.0 inflector==2.0.12  tar xf CodeIntel-2.0.0.tar.gz  mv CodeIntel-2.0.0/SilverCity CodeIntel-2.0.0/silvercity  tar czf CodeIntel-2.0.0.tar.gz CodeIntel-2.0.0exit and saverun bash ~/c9-install-2.0.0.shproceed with Step 3 on the "Amazon Lightsail instances in the AWS Cloud9 IDE"CommentSharethelemuranswered 5 months ago"


Question: "Access AWS Workmail via REST API to send, forward and receive emails."

"From a custom iOS app, I want to access AWS Workmail via REST API to send, forward and receive emails. Is such an API available ? If so, please point me to the relevant docs and sample code. If not, what are my other choices ?FollowComment"

Answer: "0Accepted AnswerHi,WorkMail offers access to the mailbox via EWS which allows you to access the mailbox and send email.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 5 months ago"


Question: How to sent emails to unverified address

"HiI can't sent emails to unverified addresses.I ran many tests and sent to emails with verified address in SES Home > Emails Addresses, these emails are coming without problem.But, when senting email to unverified address, emails that is NOT in  SES Home > Emails Addresses, these emails NOT are coming to my customer.Can anyone help with this?FollowComment"

Answer: "0Hi indhio,In order to send email to unverified email addresses, you have to have your account removed from the Amazon SES sandbox. Please see the following page for more information: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/request-production-access.htmlI hope this information is helpful. Let me know if you have any additional questions.Thank you for using Amazon SES!Brent @ AWSCommentShareAWS-User-4207280answered 5 years agorePost-User-4700675 4 days agoHi. What I can do of I am already out of the sandbox (production mode), but still able to send e-mails only to verified entities (e-mail addresses), but not to unverified ones? I have already made sure that the SES client uses the same region. Yet, sending to unverified is NOK, but to verified OK.Share"


Question: I have problem with EC2

Can you help me?FollowComment

Answer: 0There can be several reason for this. Was it working before and it stopped working? Did you make any change?Please follow the links below to get suggestions on what to look at:https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-status-check-failure/https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/ec2-windows-instance-status-check-fail/CommentShareEXPERTJonathan_Danswered 4 months ago


Question: Local DynamoDB Batch Write Causes Excess SELECT Statements

"Hello, I have a dynamodb local instance running on my Windows 11 system and have been testing the batch write feature of DynamoDB. I'm using ASP.NET Core and am using the high-level DynamoDBContext class to perform the writes. The writes are working and that's not an issue. What I'm curious about is what the SQLLite logs are showing. The server states this:INFO  com.amazonaws.services.dynamodbv2.local.server.LocalDynamoDBServerHandler - target: BatchWriteItemAnd then dozens, if not hundreds of these lines show up immediately after:[SQLiteQueue[shared-local-instance.db]] DEBUG com.amazonaws.services.dynamodbv2.local.shared.access.sqlite.SQLiteDBAccessJob - SELECT StreamID FROM sm WHERE TableName = ? AND (DeletionDateTime IS NULL OR DeletionDateTime > ?) ORDER BY CreationDateTime DESC LIMIT 1;And then, finally, I see the batch write HTTP request show up. Is this something I should be concerned about? Is this specific to the local dynamoDB implementation? I don't have any sort of code logic that's sending reads in parallel with the batch writes in this situation. Any insight on what these logs mean would be awesome.UPDATE 7/21/2022:A user asked for the code snippet and dynamodb local version. I'm using version 1.18.0 and this is the downloaded version, not Docker.Code snippet where the task is fired off in parallel. This is awaited later on in the method. Only 25 items are batched at once:BatchWrite<DynamoBGCLog> batchWriter = this.dynamo.CreateBatchWrite<DynamoBGCLog>();batchWriter.AddPutItems(logsToWrite);logsToWrite.Clear(); // empty out the bagwriteTasks.Add(    Task.Run(            () => BGCUtilities.BackoffAsync(                    () => batchWriter.ExecuteAsync(abortToken),                            maxRetries: 30,                            maxRetryTimeMS: 5000,                            abortToken: token),                        token));Thanks!FollowCommentLeeroy Hannigan EXPERT10 months agoCan you share the code snippet used for BatchWrite and also the version of DynamoDB Local which you are using and on which platform (docker or direct download).Shareucrbgc 10 months agoI updated the original post with these details. Dmitry Balabanov provided an answer that seems to answer my question. But sharing this info seems helpful anyways. Thanks!Share"

Answer: "0Accepted AnswerThis is an implementation detail of the DynamoDBLocal package. It only applies to the local version of DynamoDB.With this SELECT statement, the implementation queries the metadata looking for open table streams. If there is an open stream for the target table, the written items will be put into the stream as well.CommentShareDmitry Balabanovanswered 10 months agoucrbgc 10 months agoThanks for the info. It was my assumption it was something specific to the local version. Good to know that I'm not doing something wrong in the code though. Appreciate it!Share"


Question: two aws lightsail instances with same domain

"can there be 2 aws lightsail instances with same domain , if yes, which instance website will be seen upon clicking the domain url in a google search bar.FollowCommentAWS-Leslie 4 months agoHi,Thank you for using Lightsail. I am not sure what your intended result needs to be. If you are using 2 instances for the same thing, then you can put them behind a load balancer and set up your DNS records to route to your load balancer, effectively allowing traffic going to your domain to go to either of those instances. If the instances are entirely separate, then you can create 2 DNS records to route to each specifically through unique subdomains. Here are some docs to guide you:https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-create-dns-entry#lightail-add-records-to-the-dns-zonehttps://lightsail.aws.amazon.com/ls/docs/en_us/articles/add-alias-record-for-lightsail-load-balancerShare"

Answer: "0Hi.Lightsail instances do not have domains.The domain URL entered in Google Search Bar is resolved by querying DNS. (e.g. Lightsail DNS)In the end, the IP address will point to your Lightsail instance, but that depends on how your DNS server is configured with which instance and what rules.In short, you configure which instance your domain is bound to in your DNS server.CommentShareEXPERTiwasaanswered 5 months ago"


Question: HTTPS suddenly stopped working (have tried everything!)

"Hi,I have a Python project deployed using Elastic Beanstalk. Today my site was running fine and was working over HTTPS. It stopped working completely for HTTPS when I tried disabling the listener for port 80 (HTTP). I re-enabled the listening port and rebuilt my environment. Still the site does not work for HTTPS. I have my security groups set up and Classic Load Balance set up to listen to inbound HTTPS traffic on port 443 and route to HTTP port 80. My SSL certicate is also fine. When I 'eb ssh' to the server and run 'sudo netstat -nlp | grep 443' nothing shows up, however it shows up for port 80. Can someone at AWS please help me? My instance id is i-0381e2fb8f8176f21 . Thanks.Edited by: AlviKabir on May 3, 2020 7:11 PMEdited by: AlviKabir on May 3, 2020 7:15 PMFollowComment"

Answer: "0Hello,Beanstalk support 2 types of HTTPS configuration:SSL offloading at LoadBalancer:https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-elb.htmlSSL termination at instance (end-to-end encryption):https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-endtoend.htmlPlease ensure that you have set up the configuration as mentioned above.CommentShareKaushikM-AWSanswered 3 years ago"


Question: Access to KMS is not allowed when User Permission changes

"Hi,I created a new encryption key and gave user access to aws-elasticbeanstalk-ec2-role. Then, I created a Secret Manager and set the new encryption key as the one for the secret. Then I deployed the example code to elastic beanstalk and test it and all worked just fine.Then I removed IAMFullAccess permission for my user and test it again but I got the following error message:"An error occurred (AccessDeniedException) when calling the GetSecretValue operation: Access to KMS is not allowed "Then a added the IAMFullAccess permission and it worked again. It is important to say that other users have PowerUserAccess and IAMFullAccess so they can see everything.Please tell me why is this happening and what can I do to use secret without having IAMFullAccess permission in my user.FollowComment"

Answer: "0HIYou create your inline policy according to your need for the user or role and attach it if the required access is not present in the default aws roles / policies.CommentShareMuthukumarSivaanswered 5 years ago0Hi,Thank you for your answer.It is important to notice that the error message: "An error occurred (AccessDeniedException) when calling the GetSecretValue operation: Access to KMS is not allowed" appears when trying to access to the secret from elastic beanstalk machine.I gave aws-elasticbeanstalk-ec2-role IAMFullAccess permission and removed it from my user permissions and the same error appears.What I want to achieve is the secret to be accessible from an elastic beanstalk machine but not from my user in the aws console.any ideas?CommentSharebochagaviaanswered 5 years ago0An error occurred (AccessDeniedException) when calling the GetSecretValue operation: Access to KMS is not allowedThe same error i'm getting when calling secretsmanager form python sdk, while in CLI working fine.CommentShareMilanTyagianswered 4 years ago0Hello,It appears that you have chosen to encrypt secrets with a AWS KMS customer master key (CMK). In such scenarios, you must provide permissions to decrypt using the CMK. This is in addition to the Secrets Manager permissions required to retrieve the secret. See KMS documentation on authorizing use of CMK with Secrets Manager for details: https://docs.aws.amazon.com/kms/latest/developerguide/services-secrets-manager.html--ApurvCommentShareAWS-User-7689511answered 4 years ago"


Question: Does the succesful sent request graph in the SES dashboard show the amount of emails that were delivered successfully?

The description of the Sends chart is The count of successful send requests.. What is the definition of a successful send request? Does a succesful send request mean that an email was successfully sent and delivered or only that the sent action itself was succesful?FollowComment

Answer: "0Accepted AnswerThe documentation here says that even global suppression is counted, so I think it only means that the send action itself was successful.https://docs.aws.amazon.com/ses/latest/dg/monitor-sending-activity.htmlSend – The send request was successful and Amazon SES will attempt to deliver the message to the recipient’s mail server. (If account-level or global suppression is being used, SES will still count it as a send, but delivery is suppressed.)If this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: Multiple chat widgets using out-of-the-box client?

"Hello,Is it possible to create multiple, different chat widgets using the out-of-the-box client?  (ie, the chat widget you can customize at xxx.my.connect.aws/customize-chat-widget).  We'd like to have different chat widgets for different domains connecting to different pools of agents on different schedules.Or do you have to create and host your own client in that case?Thanks.FollowComment"

Answer: "1Accepted AnswerGuide: https://docs.aws.amazon.com/connect/latest/adminguide/add-chat-to-website.html#confirm-and-copy-chat-widget-scriptYou can add up to 5 URLs for different domains that you'd like to host the chat widget on.Then using the chat widget script you canChange some of the look and feelAdd attributesThis is at a per chat script instance-level on your website(s).Therefore, you send all chats to the one contact flow but then check the contact attributes and filter to other contact flows as needed, resulting in different experiences per deployed script.CommentShareDanBloyanswered a year agoEXPERTAWS-samfredreviewed 2 months agorePost-User-6040968 a year agoThanks, this is helpful and looks like it works for our needs currently.  Is the 5 URL limit a hard limit?  If we need to support more domains then we have to start hosting our own client?  Thanks again.Share"


Question: Error updating account spend limit using the Amazon SNS console

"After AWS raised our quota limit for Sending Text Messages, we received email with instructions "Before you can send messages, you must update your account spend limit using the Amazon SNS console or API using the following instructions. (http://docs.aws.amazon.com/sns/latest/dg/sms_preferences.html)After following the steps, entering the spend limit and clicking on save changes, we are getting this error: Couldn't set text messaging attributes.Error code: AuthorizationError - Error message: You are not authorized to perform actions for the provided bucket policy Allows"Action":   "s3:PutObject", "s3:*"FollowComment"

Answer: "1Accepted AnswerReview your S3 bucket policy and check if it allows Amazon SNS (Principal service: sns.amazonaws.com) access for S3 actions s3:PutObject, s3:GetBucketLocation and s3:ListBucket.Here's a sample bucket policy:https://docs.aws.amazon.com/sns/latest/dg/sms_stats_usage.html#example_bucket_policyAfter adding the required bucket policy, continue configuring your SMS messaging preferences.CommentSharejoahnaanswered a year agoAWS-User-7737745 a year agoIt worked... Thank You!Share"


Question: Transitioning from EFS-to-EFS backup solution to AWS Backup service

"Hello,We have been using the EFS-to-EFS backup solution for about a year now and it seemed to work great.We recently saw the AWS Backup solution and would like to transition to it since it's much simpler to manage and allows for us to use the infrequent access storage class to save some money.Is there any guide on this transition or do I just delete the cloudformation stack? Just don't want to somehow lose customer data and wanted confirmation my current EFS instances wouldn't be affected by the deletion.My plan is to leave the backup EFS instance until the new backup service has worked fine for a few weeks. Afterwards, I would delete it and then add a lifecycle policy to my main instance. Anything else I need to do?FollowComment"

Answer: "0adg-keith,Thanks for the feedback - we're glad that you find EFS IA and AWS Backup to offer a simpler user experience!With respect to the EFS-to-EFS backup solution: the CloudFormation template typically creates your backup file system as part of deploying the stack.  With CloudFormation's default behavior, if you delete the stack, it will delete any resources created by the stack, including your backup file system.  You can follow the instructions in this guide to change the CloudFormation behavior and retain any resources created when you tear down your stack: https://aws.amazon.com/premiumsupport/knowledge-center/delete-cf-stack-retain-resources/.  We recommend first testing these steps using a different CloudFormation stack than the one that you're using to back up your file systems.You can apply a lifecycle management policy to your file systems at any time, and any files that are eligible given the policy you choose (for example, files that haven't been accessed for 14 days) will immediately begin to move to EFS IA.Let us know if you have any other questions.--JoeAmazon EFS teamCommentShareAWS-User-2481325answered 4 years ago0Thanks for the reply.Any issue with just disabling the cloudwatch rule which triggers the backup until I have more time to handle the removal of the stack? Wasn't sure if there was a better way to just turn it off.I didn't want to turn on the lifecycle policy until the efs-to-efs setup was disabled since I figured it would potentially hit the IA files and cause additional costs. Just a guess on my part though and could be wrong about that.CommentShareadg-kkeithanswered 4 years ago0Yes, disabling the CloudWatch rule is a good way to cancel the scheduled backups inside the backup solution.For AWS Backup, you are not charged for data access to files in EFS IA that are performed as part of the activity of backing up your file system.Let us know if we can help with any other questions.CommentShareAWS-User-2481325answered 4 years ago0Figured I would follow up with my findings to help anyone who comes across this in the future with a similar question.Make sure you remove the EFS-to-EFS backup security group from your source file system before removing the CloudFormation stack otherwise it will fail to delete. Seems obvious now, but since I didn't set that up I didn't even think about it.The backup file system is set to be retained during deletion in the CloudFormation template by default so I didn't have to worry about that getting removed.CommentShareadg-kkeithanswered 4 years ago"


Question: Does IAM Federation with Google Workspace support user groups?

"Multiple blogs and documents suggested that a Google workspace user can be assumed to an IAM role.However, is it possible to map a Google workspace user group with one or multiple IAM roles? If I understand correctly, IAM federation with Azure AD DC supports idp user group to iam role mapping. But not sure if the support is one-to-one or many-to-many type.Thanks!FollowComment"

Answer: "0I don't think this is possible with G Suite, but haven't tried it myself.The update to this blog about using G Suite as an external IdP says:May 4, 2021: AWS Single Sign-On (SSO) currently does not support G Suite as an identity provider for automatic provisioning of users and groups, or the open source ssosync project, available on Github.CommentSharerowanuanswered a year ago"