Question: Device farm: How to add NodeJS cucumber-html reports to  customer artifact ?

"Hi, I'm able to run cucumber specs (NodeJS & appium) successfully in aws device farm and framework reports generate in host machine file path: /private/tmp/scratchcd0WWN.scratch/test-packageXL7CdE/reports/html/index.html, how can I copy reports from this path location to customer artifact folder. I have included -$DEVICEFARM_LOG_DIR and $WORKING_DIRECTORY in .yml file. please help.!FollowComment"

Answer: "0Hello,Thank you for reaching out to aws Re:Post team. I understand that you are able to successfully run test specs in aws device farm, which generates report in host machine file path.In order to copy generated report, from host machine file path into customer artifact folder, we need to include the copy commands in the Test Spec file. For example, we can make a directory, say “TestReports" and include the below commands in the "post_test" section of Test Spec YML file to copy the file to desired location.After our test run finishes, we can successfully collect the test reports file for our tests in the "customer artifacts" section of test reports on "DEVICEFARM_LOG_DIR/TestReports/<files>" path :Example Command :post_test:    commands:    - mkdir TestReports    - cp -r $DEVICEFARM_TEST_PACKAGE_PATH $DEVICEFARM_LOG_DIR/TestReportsI hope this is helpful. If you experience any issue, please let us know.CommentShareSUPPORT ENGINEERIsha_Kanswered a year ago"


Question: How to keep track of artifacts in via sagemaker experiments ?

"based on the docs here , https://sagemaker.readthedocs.io/en/stable/experiments/sagemaker.experiments.html. I can use the sagemaker api or experiments package to start a trial/experiment and record it's  run , also I can choose what all i want to track - parameters , metrics ... of each run. I assume here, there are lot of different type of things we are track , such as artifacts, metrics , logs, scripts .... , and this can be all viewed in/within sagemaker. artifacts lives in some s3 bucket , i guess, but when it comes to the scripts that we use for training, evaluations  or even preprocessing , how does it keep track of these. i assume the default is simply that there is some s3 location that saves all of the artifacts related to each run. can the scripts live in code repository, aws code commit and we can link the all the scripts associated with a run to a link in code commit? or can other git repositories , github or gitlab linked in such way?FollowComment"


Question: Pass CommitId of a CodeCommit tag to CodeBuild project

"My requirement is to build a CodeCommit repository when a tag is pushed to origin.I was able to do this using a CloudWatch event which triggers a Lambda function. Following is the resulting event,{"version": "0","id": "5cf07036-282a-a925-8007-4422b1377dbb","detail-type": "CodeCommit Repository State Change","source": "aws.codecommit","account": "369837395262","time": "2019-05-13T23:44:14Z","region": "ap-southeast-2","resources": ["arn:aws:codecommit:ap-southeast-2:XXX"],"detail": {"callerUserArn": "arn:aws:iam::XXX","commitId": "3ea7c9822fc80813aeac50e46ab439f4bb26468d","event": "referenceCreated","referenceFullName": "refs/tags/temp-tag-1","referenceName": "temp-tag-1","referenceType": "tag","repositoryId": "XXX","repositoryName": "xxx"}}The "temp-tag-1" is created using "git tag temp-tag-1 -m  6a2359d64291a6490412a46de8d6566602e8f736" command. (This is not the latest commit id)Is there a way to pass the commit id 6a2359d64291a6490412a46de8d6566602e8f736 rather than 3ea7c9822fc80813aeac50e46ab439f4bb26468d to the lambda function?If possible I can pass that commit id as the "sourceVersion" to the code build project using lambda function (boto3).Edited by: mumbo on May 13, 2019 11:19 PMFollowComment"

Answer: "1Hi mumbo,Glad you could find a solution for your issue. Right now CodeCommit does not emit events for tag creation, so as you have already figured out, the right way to get what you want, given you know the tag name, is to just call CodeCommit to get the commit id using that tag reference.CommentSharerobison-awsanswered 4 years ago0I think I found a way to do it.Instead of trying to get the correct id from the CloudWatch event, I've used boto3 codecommit client in my Lambda function.  botoCodeCommitClient = boto3.client('codecommit')  botoCodeCommitClient.get_commit(repositoryName=repository, commitId=tagCommitId)The result contains the correct commit id.  "commit": {"commitId": "6a2359d64291a6490412a46de8d6566602e8f736","treeId": "72e8659841587e1afa59a775bafe9d6a5c8a8f5d","parents": ["8ccc13c43416850ac16105e789fc8db5911db11e"],"message": "xxx","author": {"name": "xxx","email": "xxx,"date": "1557711827 +0000"}Edited by: mumbo on May 14, 2019 1:10 AMCommentSharemumboanswered 4 years ago0Hi robison,I am planning to add the branch name to the artifact path on S3. Eg. /tags/<branchname>/<tagname>Is there a way in boto3 to get the branch name of a given commit id?ThanksCommentSharemumboanswered 4 years ago"


Question: AWS s3 sync Fails with Extant File (debug log is attached)

"I’m attempting to use the CLI to backup a file on a Windows 10 PC to an s3 bucket. The command (in a command file) has worked for a few days but today it failed, saying the file doesn’t exist. This problem recurred after a reboot and after upgrade to the latest version of the CLI.I’ve attached the debug log which is preceded by a chkdsk and followed by a confirmation that the file exists. Any comments would be much appreciated.Thank you,Don MacnaughtonFollowComment"

Answer: "0For anyone else who has this problem, I see that the s3 sync command only syncs directories, not files. I was trying to sync a file. I suspect that my original version worked properly because I was using cp and not sync. I suspect that I changed cp to sync and then forgot that I had done that.Don MacnaughtonEdited by: DonMac1503 on Apr 4, 2020 3:56 PMCommentShareDonMac1503answered 3 years ago"


Question: AWS ElastiCache Limits and general questions

"Hi AWS,What if each key value pair is storing 100mb of data?How much maximum key value pair is allowed and any restriction?Does it use memory for cache from application server or from the cache server?Also can you please share the architecture diagram?FollowComment"

Answer: "0ElastiCache is a managed in-memory data store service that supports two engines: Redis and Memcached.https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.htmlhttps://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/WhatIs.htmlconcepts are very similar but if we talk about redisnot have a strict limit on the size of a key-value pair, it's generally recommended to keep them smaller for better performance but if you need to store 100MB no problem you can storeRedis does not have a strict limit on the number of key-value pairs. The actual limit depends on the memory available in your cache node or clusterElastiCache uses memory from the cache server, not from the application server. Your application server connects to the ElastiCache cluster to store and retrieve data, but the actual data resides in the memory of the cache server.there is no specific architecture for elasticache it depends on you app architectureCommentShareEXPERTsdtslmnanswered 2 months ago"


Question: New Ubuntu Instance failing with 1/2 checks passed: instance status check failed

"We have created a spot instance (Spot2) from a snapshot image of a current spot EC2 instance (Spot1) to upgrade the system, but it is failing with 1/2 checks passed.Type: r5n.xlargeOS: Ubuntu 18.0.4The system logs does not indicate any error or failure point. We created the new instance with the specifications of the current system and launched it in the same VPC/subnet and with same security group.The only thing we observed is that the hostname of Spot2 is not changed but remains set to the Spot1 (by the system logs), and we tried to change this with user-data but it seems this also was not applied.For about 2 months now we could not resolve this issue but we need to upgrade to ubuntu 22.0.4 as soon as possible.Please can you help us resolve this issue?FollowComment"

Answer: "0Hi there,In most cases, 1/2 status check means there's either a boot issue, or a networking issue. In both cases, having a look at the system logs [1] and instance screenshot [2], is the best way to find the potential culprit. I see you've stated there's no particular information in the system logs, so the screenshot will be your next best bet.Should the screenshot show the login prompt, this would confirm that there's no boot issue, however, there is a network issue. Reason being it can only get to the login prompt if boot is successful. Further, not being able to connect to the instance when the login prompt is there, confirms network issues.The opposite is also true, if there's no login prompt on the screenshot, then it's most likely a boot/OS issue.You can use this information to further troubleshoot with the help of the following document:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.htmlReferences:[1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-console.html#instance-console-console-output[2] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-console.html#instance-console-screenshotCommentSharerePost-User-3330605answered 10 hours ago"


Question: [ Lumberyard [1.11.0.0] EMotion FX ] Reverse joints on import FBX

"Hi, i try EMotion FX, and found some thing. When i import *.fbx Maya to EMotion FX all bones orientation reversed on Y and Z axis.REMOVEDUPLOADAnd i feeling this problem in (Root motion exploding on blending the reverse of the animation with event sync.) and in this (Blend shapes broken in EMotion? Using FBX from Maya).p.s.For more detail, read all Castor answers below too.Follow"

Answer: "0Accepted Answerright click on the FBX file in asset browser and edit import settings ... there is a flip 180 degree or do nothing... based on your DCC you may want to choose one of them.SharerePost-User-7621041answered 6 years ago0Hi @REDACTEDUSERSharerePost-User-0479726answered 6 years ago0But, how i can setup character if i create Y+ its front and Z+ it's up (In CryLegasyAnimation) all looking like i create, but in EMotion FX no, the character stand reversed, back side looking to front.p.s.in Maya setup all precisely like in Lumberyard orientationp.s.2Or this docs (Rigging Characters) not actual ?SharerePost-User-0150549answered 6 years ago0SUPER !!! You right Gamely. All looking good. :) Thank you Gamely and Castor for help me find answer !!!SharerePost-User-0150549answered 6 years ago0Some additional thing to keep in mind is to also use the same setting for your motions. Otherwise the motion data coordinate system doesn't match the actor's coordinate system.The reason why on default there is a rotate 180 degrees is to make the entity's forward vector point into the direction the character is looking towards with its eyes. This assumes you model your character in such a way that you see the face of the character in front view of your DCC tool (Max or Maya for example).If you set it to "Do Nothing" the forward direction of your entity will point behind in the opposite (so behind) direction of the character.SharerePost-User-8134033answered 6 years ago0"The reason why on default there is a rotate 180 degrees is to make the entity's forward vector point into the direction the character is looking towards with its eyes. This assumes you model your character in such a way that you see the face of the character in front view of your DCC tool (Max or Maya for example)."Now i understand why default "rotate 180 degrees". But for me it's very strange, i every time trying create all like needed. If front +y, it mean +y and no more convertation. Only for good looking in DCC viewport change orientation bones and geometry hmm. This only my looking on this and i am not professional in game development. In any case thank you John for understand why "rotate 180 degrees" is default set :)SharerePost-User-0150549answered 6 years ago0Hi @REDACTEDUSERREMOVEDUPLOADSo you want to orient the root joint of your character to match the orientation of the "Lumberyard default" axis. To do this, you need Joint Orient values on your root joint - values of 90.0 / 0.0 / 180.0 in the x/y/z fields will rotate that joint accordingly. Make sure that the rotation values are in the Joint Orient fields, and NOT in the rotation fields - you must all rotations zeroed out on the root joint to export your character. Obviously, you will have to unparent the root joint to do this, as well as reset your bind pose, but if you start with a root joint at this orientation, and then leave other joints in your skeleton at any orientation you like, your character should end up facing the same direction. Hope this helps!REMOVEDUPLOADREMOVEDUPLOADSharerePost-User-0479726answered 6 years ago0Hi @REDACTEDUSERREMOVEDUPLOADREMOVEDUPLOADSo "forward +Y" in Lumberyard is "negative -Y" in Maya default Z-up. Hope that helps clarify.SharerePost-User-0479726answered 6 years ago0Hi Castor. Sorry for so many questions. "If i work in Maya and Z-Up axis".I have problem with viewport example "Front View"REMOVEDUPLOADTo fix that i change Front View camera orientation on z axis on 180REMOVEDUPLOADThen working with my model like in Lumberyard orient system. And my root joint will have zero on orientation and rotation.REMOVEDUPLOADWhen i export to Lumberyard, i set "FBX Export->Axis Conversion->Up Axis" to Z.REMOVEDUPLOADAfter load my fbx to Lumberyard Editor i set "FBX Settings->Coordinate System change" to "Do nothing" for Actor and Motion.REMOVEDUPLOADAnd all looking like i create in Maya.Is that correct way, working with Maya Z-up axis ?And some about coordinate system.REMOVEDUPLOADI think that is a equal coordinate systems. Just observer have different position. To check that we can set some point (0.5f, 1.0f, 0.5f) and then set camera observer to some position like (2.0f, 2.0f, 2.0f) in each variants we will see equal world. Or no?Thank you Castor for help.p.s.Sorry for my persistence, i work with my game, alone. And for me very important deeply understand all.SharerePost-User-0150549answered 6 years ago0Wow, Castor, you excellent helped me understand all !!! :)REMOVEDUPLOADSharerePost-User-0150549answered 6 years ago"


Question: S3 calls costing for HBASE on EMR

"Hi Team,We are planning to use S3 as storage for HBase in EMR cluster.Our usage is as belowApprox 15M record insert/Read per day in HBase in batch mode.Approx 5M put/get request per day real time in HBase.Can anyone guide how it will cost to us?FollowCommentFabrizio@AWS EXPERTa year agodo you have the split between put and get? (write and read)Share"

Answer: 0Hello!You can utilize the Cost Explorer to forecast these costs: https://docs.aws.amazon.com/cost-management/latest/userguide/ce-forecast.html.Here is an article that provides additional information as well: https://aws.amazon.com/blogs/machine-learning/forecasting-aws-spend-using-the-aws-cost-and-usage-reports-aws-glue-databrew-and-amazon-forecast/.-- Leo W.CommentShareMODERATORAWS Support - Leoanswered a year ago


Question: Use of exisitng gpg key in AWS Secret Manager

"Hello, I have an existing gpg key exported to public and private keys. The public key is shared with many customers and is in use on on-prem servers. I want to store these keys in AWS Secret Manager to be used by AWS Transfer Family. Please assist with how to store/receive keys.Thanks,FollowComment"

Answer: "1https://docs.aws.amazon.com/transfer/latest/userguide/key-management.html#pgp-key-managementCommentShareKevinanswered 3 months ago0Recently, we added a detailed walkthrough of how to use PGP keys in a Transfer Family workflow decrypt step. This is documented here: https://docs.aws.amazon.com/transfer/latest/userguide/workflow-decrypt-tutorial.htmlCommentShareAWS-User-8721706answered 2 months agoEXPERTalatechreviewed 2 months ago"


Question: Best practice to synchronize CDK scripts with actual resources

"After creating resources with CDK scripts, sometimes created resources should be modified directly or should be newly created accidentally.In this case, I must repair the CDK scripts to create the right resources. Drift detection is a powerful tool, but can't detect newly created resources. What do you think about the best practice to do it?FollowComment"


Question: Private DNS precedence?

"Tried looking but couldn't find any document that would list precedence of private DNS entries in AWS. Is there any information available?For example, let's say I have API Gateway VPC endpoint in VPC that has Private DNS enabled, thus pointing execute-api host names to internal IP addresses. If I then add Private hosted zone with an alias pointing to API gateway (that resolves to AWS public IPs), it seems that the private hosted zone has higher priority than VPC endpoint private DNS?But is this documented feature that can be trusted or was it just by luck? This would be really useful as we could then access public API Gateways from VPC even when Private DNS in VPCE is enabled.FollowComment"

Answer: "0Thanks for the detailed description.This document https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-private-considerations.html#hosted-zone-private-considerations-private-overlapping describes the precedence when pubic/private or private/private hosted zones have overlapping namespaces.As a side note, the "Connect to public APIs with private DNS enabled" section in https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-vpc-connections/ also looks relevant to your question.Hope it helps.CommentShareweidianswered 8 months ago"


Question: AWS: createUserPool: How to set up SmsConfiguration (ExternalId and SnsCallerArn)?

"I want to create a userPool for every enterprise within a multi-tenant web solution. Here's what I have:const AWS = require('aws-sdk');const uuid = require('uuid');const cognitoIdentityServiceProvider = new AWS.CognitoIdentityServiceProvider();params: {   PoolName: uuid.v4();   ...   SmsConfiguration:  {      ExternalId: 'some Id',      SnsCallerArn: 'some arn:aws:iam'   }   ...My attempts to apply what I think is the correct policy to an existing role attached to my lambda causes the iam:PassRole exception to occur. How then and where am I supposed to create the proper ExternalId and SnsCallerArn? Thanks.FollowComment"


Question: Getting test results for each test

"Hi,I am using Appium _ TestNG _ java to run my tests. After running my test suite of 2 tests, the AWS test report for my test suite shows only one pass or one fail even though i had 2 tests executed. Also the two tests are in one video. How can I get results broken down for each individual test?Thanks,JonathanFollowComment"

Answer: "0Hello,This is the behavior we use for our custom environment runs (runs that specify a test_spec). The only way to separate them is by reverting to our standard mode runs, but it is recommended to use our custom mode environment whenever possible.https://docs.aws.amazon.com/devicefarm/latest/developerguide/how-to-create-test-run.htmlCommentShareTobe-AWSanswered 4 years ago0Thanks for the reply!I actually ran into another problem today and hope you can answer it in this same post thread as it's completely blocking my automation. It seems the firebase remote config calls from my app are failing when running tests on aws device farm. It seems to be an authentication or forbidden connection issue I never got this issue when testing locally. Is this AWS not allowing calls to Firebase? or maybe the other way around? Is this an issue that anybody else has encountered and what was the solution?Thanks,JonathanCommentSharejonaHaranswered 4 years ago"


Question: Lightsail Database is stuck in the modifying state for 10 months

"Last April, I tried to restore a Lightsail Database. The new database came up but never moved out of the modifying state. I worked with billing support, but the guides they gave me didn't help. I've tried to stop and delete the database using the CLI, but it doesn't work. There are no options to do so from the console. I'm certain I need an AWS tech to intervene. I guess my question is, can I get help with that through this forum, or do I need to pay for support?FollowCommentChris_W a year agoDo the Lightsail Database logs show anything of interest? https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-viewing-database-logs-and-historyShare"

Answer: "0Hello @chrismcgahan,Thanks for using Lightsail.Please reach out to customer support and ask them to pass your case to the Lightsail team, we'll help you unblock the database.RegardsCommentShareYiran-AT-AWSanswered a year ago"


Question: Some Samsung devices have enabled animations

"Dear Amazon Team,Can you please disable animations on "Samsung Galaxy S4(Unlocked)" and "Samsung Galaxy S6 (Verizon)"? Our tests are failing significantly on these 2. Is there a reason why these devices have turned on animations since we would expect they are by default disabled on all devices already? Other devices in our device pool have animations disabled as expected.Samsung Galaxy S4(Unlocked): https://us-west-2.console.aws.amazon.com/devicefarm/home?#/projects/dc2068f7-4b09-417c-9909-b77f559c9641/runs/e048c9af-f684-4c84-a19e-08988a3b34c7/jobs/00005/suites/00002/tests/00017Samsung Galaxy S6 (Verizon): https://us-west-2.console.aws.amazon.com/devicefarm/home?#/projects/dc2068f7-4b09-417c-9909-b77f559c9641/runs/e048c9af-f684-4c84-a19e-08988a3b34c7/jobs/00001/suites/00004/tests/00001Thank you.Regards,DraganFollowComment"

Answer: "0Can you please specify which animations are you referring to?Thanks,ShreyansEdited by: Shreyans on Oct 9, 2019 12:52 PMEdited by: Shreyans on Oct 9, 2019 12:55 PMCommentSharesktdfanswered 4 years ago0Hi Shreyans,Thank you for the message. I am referring to "System Animations" documented in https://docs.aws.amazon.com/devicefarm/latest/developerguide/test-types-android-instrumentation.html#test-types-android-instrumentation-settings that should be disabled by default for quite some time now on all devices. I am not sure if the official documentation on that link is outdated (it's about android.support.test.runner.AndroidJUnitRunner) or using latest and recommended AndroidX version JUnitRunner androidx.test.runner.AndroidJUnitRunner is causing this problem but I can clearly see in videos in my tests on some Samsung devices that progress indicator is spinning meaning these system animations are enabled. Please note that on majority of all devices this round progress indicator is static image as expected (meaning system animations are turned off) and it's broken only on some Samsung devices.Thank you.Regards,DraganEdited by: marjanovic on Oct 10, 2019 4:32 AMEdited by: marjanovic on Oct 10, 2019 4:33 AMEdited by: marjanovic on Oct 10, 2019 4:34 AMCommentSharemarjanovicanswered 4 years ago0Hi,We have turned off animations for these Samsung devices for now. Please verify at your end, if it solves your issue.Thanks,ShreyansCommentSharesktdfanswered 4 years ago"


Question: question on aws cost analyzing through athena

"why this query  is not executing ?SELECTDATE_FORMAT((line_item_usage_start_date),'%Y-%m-%d') AS month_line_item_usage_start_date,SUM(CASEWHEN (line_item_line_item_type = 'SavingsPlanNegation') THEN 0ELSE line_item_unblended_costEND) AS sum_line_item_unblended_cost,SUM(CASEWHEN (line_item_line_item_type = 'SavingsPlanCoveredUsage') THEN savings_plan_savings_plan_effective_costWHEN (line_item_line_item_type = 'SavingsPlanRecurringFee') THEN (savings_plan_total_commitment_to_date - savings_plan_used_commitment)WHEN (line_item_line_item_type = 'SavingsPlanNegation') THEN 0WHEN (line_item_line_item_type = 'SavingsPlanUpfrontFee') THEN 0WHEN (line_item_line_item_type = 'DiscountedUsage') THEN reservation_effective_costWHEN (line_item_line_item_type = 'RIFee') THEN (reservation_unused_amortized_upfront_fee_for_billing_period + reservation_unused_recurring_fee)WHEN ((line_item_line_item_type = 'Fee') AND (reservation_reservation_a_r_n <> '')) THEN 0ELSE line_item_unblended_costEND) AS amortized_cost,SUM(CASEWHEN (line_item_line_item_type = 'SavingsPlanRecurringFee') THEN (-savings_plan_amortized_upfront_commitment_for_billing_period)WHEN (line_item_line_item_type = 'RIFee') THEN (-reservation_amortized_upfront_fee_for_billing_period)WHEN (line_item_line_item_type = 'SavingsPlanNegation') THEN (-line_item_unblended_cost)ELSE 0END) AS ri_sp_trueup,SUM(CASEWHEN (line_item_line_item_type = 'SavingsPlanUpfrontFee') THEN line_item_unblended_costWHEN ((line_item_line_item_type = 'Fee') AND (reservation_reservation_a_r_n <> '')) THEN line_item_unblended_costELSE 0END) AS ri_sp_upfront_feesFROM"cudos_aggregated_cur_db"."cudos"GROUP BY'month_line_item_usage_start_date'limit 10getting error asSYNTAX_ERROR: line 2:4: '"date_format"(line_item_usage_start_date, '%Y-%m-%d')' must be an aggregate expression or appear in GROUP BY clauseThis query ran against the "cudos_aggregated_cur_db" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: cfe03f00-4992-4d04-b1fc-689bb432e420FollowComment"

Answer: "0The error message is indicating that the DATE_FORMAT function is being used on the "line_item_usage_start_date" column, but it is not being included in the GROUP BY clause. The DATE_FORMAT function is used to format the date to a specific format, but it must be included in the GROUP BY clause along with the other columns that are being selected in the query.In the GROUP BY clause, you need to include the month_line_item_usage_start_date which is the DATE_FORMAT function applied on line_item_usage_start_date.SELECT DATE_FORMAT((line_item_usage_start_date),'%Y-%m-%d') AS month_line_item_usage_start_date,SUM(CASE WHEN (line_item_line_item_type = 'SavingsPlanNegation') THEN 0 ELSE line_item_unblended_cost END) AS sum_line_item_unblended_cost,SUM(CASE WHEN (line_item_line_item_type = 'SavingsPlanCoveredUsage') THEN savings_plan_savings_plan_effective_costWHEN (line_item_line_item_type = 'SavingsPlanRecurringFee') THEN (savings_plan_total_commitment_to_date - savings_plan_used_commitment)WHEN (line_item_line_item_type = 'SavingsPlanNegation') THEN 0WHEN (line_item_line_item_type = 'SavingsPlanUpfrontFee') THEN 0WHEN (line_item_line_item_type = 'DiscountedUsage') THEN reservation_effective_costWHEN (line_item_line_item_type = 'RIFee') THEN (reservation_unused_amortized_upfront_fee_for_billing_period + reservation_unused_recurring_fee)WHEN ((line_item_line_item_type = 'Fee') AND (reservation_reservation_a_r_n <> '')) THEN 0 ELSE line_item_unblended_cost END) AS amortized_cost,SUM(CASE WHEN (line_item_line_item_type = 'SavingsPlanRecurringFee') THEN (-savings_plan_amortized_upfront_commitment_for_billing_period)WHEN (line_item_line_item_type = 'RIFee') THEN (-reservation_amortized_upfront_fee_for_billing_period)WHEN (line_item_line_item_type = 'SavingsPlanNegation') THEN (-line_item_unblended_cost) ELSE 0 END) AS ri_sp_trueup,SUM(CASE WHEN (line_item_line_item_type = 'SavingsPlanUpfrontFee') THEN line_item_unblended_costWHEN ((line_item_line_item_type = 'Fee') AND (reservation_reservation_a_r_n <> '')) THEN line_item_unblended_cost ELSE 0 END) AS ri_sp_upfront_feesFROM "cudos_aggregated_cur_db"CommentSharejayamaheizenberganswered 4 months ago"


Question: Getting write:errno=104 when i was trying to connect from vmware vcenter vm

"Hi,We have enabled kafka cluster for public access. we are getting below error when we are trying to connect from virtual machines.SSL_connect:SSLv3/TLS write client helloread from 0x55e272aa0740 [0x55e272ab5f33] (5 bytes => -1 (0xFFFFFFFFFFFFFFFF))SSL_connect:error in SSLv3/TLS write client hellowrite:errno=104no peer certificate availableNo client certificate CA names sentSSL handshake has read 0 bytes and written 359 bytesVerification: OKNew, (NONE), Cipher is (NONE)Secure Renegotiation IS NOT supportedCompression: NONEExpansion: NONENo ALPN negotiatedEarly data was not sentVerify return code: 0 (ok)FollowComment"

Answer: "0Hi,Please note that errno 104 is ECONNRESET for "Connection reset by peer". This means that either the server closed the connection maybe due to problems with the setup or that the server was not even started or that there is some firewall between client and server blocking access. So could you please check if there is firewall between the VM and the cluster?If that is not the case, I would suggest raising a support ticket so we could check from the MSK cluster side.CommentShareSUPPORT ENGINEERJiahenganswered a year ago"


Question: Location header lost from Python response

"I'm returning a "Location" header from my POST handler. Here is how the response is setup:body = { 'data': 1 } # Dummy for this example  location = 'https://my.web.site/url' # dummy value for this example  headers = { 'location': location }  result = { 'statusCode': 200, 'body': json.dumps(body),  'headers'=headers}  This works when I use the lambda locally (sam local start-api), but when I deploy on AWS Lambda and invoke the functions through its HTTPS URL, the response does not contain the Location header.(Also, I now fail to find the docs on the Python lambda handler return value dictionary. I don't remember where I found the statusCode, body and headers docs)FollowComment"

Answer: "0Assuming you're using a lambda proxy integration from api gateway, the output dict documentation is here: https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-lambda-proxy-integrations.html#api-gateway-simple-proxy-for-lambda-output-formatYou have an = in you result dict, which should be a syntax error.As an aside, the location header usually isn't much use with a 2xx response. Usually needs a 3xx.CommentShareEllisonanswered 3 years ago0The = in the dict is a red herring caused by careless simplification of the code for illustration.201 CREATED response usually contain a location header. (See for example: https://restfulapi.net/http-status-201-created/)Again, the fact the a given HTTP code usually has a location header or not is mostly irrelevant. The problem is that the code works with lambda run locally but not on AWS.CommentSharePierre-Banswered 3 years ago0Well, at this point I'd say there's no easy answer. There could be some difference in how sam is set up as opposed to api gateway and lambda. There could be some other problem. If you can, please post the (suitably redacted) lambda and the api gateway config?CommentShareEllisonanswered 3 years ago0I created a simplified version and I found the problem:When run locally, the header is Location (Uppercase L)When run when deployed, the header is location (lowercase L)The API gateway changes the headers case. The test I ran was too strict and expected the case not to change.CommentSharePierre-Banswered 3 years ago"


Question: Amazon SES - email receiving missing

"All of my services (lambda, ec2, rds, etc.) are in us-east-2 (Ohio). Today, I created a SES Identity but accidentally created it in us-east-1 (Virginia). Since I need SES to call a lambda in 2, I deleted it and recreated it in 2. I noticed that "Email Receiving" is a link when I go into us-east-1 but it is not there when I am in 2. Why would it be missing?FollowComment"

Answer: "2Email receiving in Amazon SES is currently only available in the us-east-1, us-west-2, and eu-west-1 regions. For more information about Amazon SES service endpoint, see the AWS General Reference (scroll down to the Email Receiving Endpoints section).CommentShareEXPERTBrentAtAWSanswered 4 months ago"


Question: Turn on TTL functionality on existing DynamoDB table

"Hi, I have a couple of questions about turning on TTL on a table that has already several GB's of data (we already have a field with proper format to use as TTL):Will the TTL config apply to old information or just to new added rows?If answer to first question is yes: Can this "massive" deletion affect performance or It will just run in background, following the regular behavior?Thanks.FollowComment"

Answer: "2Accepted AnswerWill the TTL config apply to old information or just to new added rows?YesIf answer to first question is yes: Can this "massive" deletion affect performance or It will just run in background, following the regular behavior?It will just run in the background, there will never be performance degradation caused by TTL.CommentShareEXPERTLeeroy Hannigananswered 4 months ago0The TTL config will apply to both old and new information in the table.The deletion of data due to TTL will run in the background and should not affect performance too much as it's an asynchronous process. However, the exact impact on performance depends on the size of the table and the rate at which the data is being deleted.CommentShareGabriel Olaleyeanswered 4 months agoLeeroy Hannigan EXPERT4 months agoHowever, the exact impact on performance depends on the size of the table and the rate at which the data is being deleted.Can you point me to the documentation for this please?Share"


Question: Disable EC2 Classic from my account and move to VPC

"Hi there,My account was created over 9 years ago so it still has access to EC2 Classic. I have no resources or instances running.I would like to move completely to VPC and disable EC2 Classic on my account. Is there a way to do this?Currently when I run:aws ec2 create-default-vpcI get the error:An error occurred (OperationNotPermitted) when calling the CreateDefaultVpc operation: Accounts on the EC2-Classic platform cannot create a default VPC.I have read documentation on how to migrate EC2 Classic instances to VPC but that's not what I'm looking for (I have no EC2 Classic instances). I just want my account to work as if I had created it after VPC was introduced on AWS.This thread mentions a similar issue: https://forums.aws.amazon.com/thread.jspa?threadID=274112However it looks like an Amazon employee had to manually change this person's account? I've reached out to support but they don't seem to know what to do. Is it possible to migrate my account off EC2 Classic and only use VPC?Edited by: josh_v on Jun 10, 2020 12:22 PMFollowComment"

Answer: "0Hello,Hope you are doing good! You can find the process to remove EC2-Classic from your account here: https://aws.amazon.com/vpc/faqs/#Default_VPCs.Quoting the question and the solution from the link above:Q. I really want a default VPC for my existing EC2 account. Is that possible?Yes, however, we can only enable an existing account for a default VPC if you have no EC2-Classic resources for that account in that region. Additionally, you must terminate all non-VPC provisioned Elastic Load Balancers, Amazon RDS, Amazon ElastiCache, and Amazon Redshift resources in that region. After your account has been configured for a default VPC, all future resource launches, including instances launched via Auto Scaling, will be placed in your default VPC. To request your existing account be setup with a default VPC, please go to Account and Billing -> Service: Account -> Category: Convert EC2 Classic to VPC and raise a request. We will review your request, your existing AWS services and EC2-Classic presence and guide you through the next steps.Have a good rest of the day!Best,AkshayCommentShareAWS-User-7762444answered 3 years ago"


Question: AppMesh mTLS - Unable to verify SSL encryption is established using SPIRE

"I'm in the process of setting up a prototype mesh with mTLS. I've gotten to the point where I have my services coupled with envoy sidecars and the sidecars are receiving certificates from SPIRE. I've been following along with this article  and am now running into an issue.In their steps, they perform a curl command from a container outside of the mesh and get some TLS negotiation messages. When I try to do the same thing, I get the following:bash-4.2# curl -v -k https://grpc-client-service.grpc.svc.cluster.local:80/*   Trying 10.100.152.100:80...* Connected to grpc-client-service.grpc.svc.cluster.local (10.100.152.100) port 80 (#0)* ALPN, offering h2* ALPN, offering http/1.1* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH* successfully set certificate verify locations:*  CAfile: /etc/pki/tls/certs/ca-bundle.crt*  CApath: none* TLSv1.2 (OUT), TLS header, Certificate Status (22):* TLSv1.2 (OUT), TLS handshake, Client hello (1):* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol* Closing connection 0curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocolAny advice on where I should start to troubleshoot this issue?Here's a rough overview of my setup:There are two pods that represent a client and a server service. The client has a web interface that allows the user to input text. The client takes the input text and submits that to the server service. The server service responds with an echo message that has some extra formatting so you know it came from the server.I've got both pods wrapped in virtual services that connect directly to virtual nodes. I was able to successfully test this with a basic mesh setup prior to adding the SPIRE workload parameters to the services. Within the envoy sidecars, I can see that the SPIRE server is indeed issuing certificates.FollowComment"

Answer: "0If your client applications are also trying to negotiate TLS in addition to the proxy, this issue might occur.TLS in App Mesh currently supports the proxies negotiating TLS between themselves, while the applications speak plain-text to the proxies.There is a roadmap item for allowing the downstream (client) applications to negotiate TLS instead of the proxy. Please refer this github comment for more info.Having said that, this implementation with AppMesh and SPIFFE/SPIRE involves multiple components. Therefore, I advise you to reach out to the AWS Premium Support for troubleshooting the issue using this link.CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered a year ago"


Question: AWS Developer Associate Material

"I'm an Azure Development Support Engineer.New to AWS Cloud (Self-learning)Not Sure Can ask this question here or not & with which tags.Apologies for any wrong tags or any mistakes in my questioning.To learn for Azure Certifications, Microsoft has some official documentation for each certification such as https://learn.microsoft.com/en-us/certifications/azure-developer/Similarly, do we have any official Learning Documentation for AWS Cloud Practitioner, and Developer Associate?In my efforts - I have found the official docs/information for specific topics but not like the sequential topics in certification perspective.FollowComment"

Answer: "2Accepted AnswerHi Hari, no apology needed ;)A similar learning path is available for those two certifications.For instance the AWS Cloud practitioner has this page. https://aws.amazon.com/certification/certified-cloud-practitioner/. On its bottom, there are references for exam guides, training and sample exams. Same for developer associate: https://aws.amazon.com/certification/certified-developer-associate/.Moreover, I have written a guide with resources that helped me achieve those certifications, here is a link: https://alatech.medium.com/aws-certifications-part-ii-my-6-exams-journey-tips-4f62991f30e.Hope it helps and if it does I’d appreciate the answer to be accepted so that community can benefit for clarity when searching in repost for similar enquires. Thanks and good luck!CommentShareEXPERTalatechanswered 3 months agoR Hari Krishna 3 months agoThank you for clear guidance @alatechShare1In addition to the above, check out these:Ramp Up GuidesSkill BuilderAWS Training Partner (ATP) CoursesAWS Twitch ChannelCommentShareEXPERTkentradanswered 3 months ago"


Question: Can we use AWS SDK ECS client API in production environment

We are creating the ECS cluster through cloud-formation in production. we want to increase the Minimum and desired count for the ECS service through AWS SDK ECS client api calls.I want to confirm is there any issue or security concerns to increase the task count through AWS SDK ECS client API instead of Cloud-formation deployment?FollowComment

Answer: "1Yes, you can, but it is NOT recommended. If you do, MAKE SURE that you update the CloudFormation Stack shortly after with the correct config to put your environment back in sync.I would recommend you do it using CloudFormation. Take a ChangeSet and ensure the service is not being recreated (your change should not cause this, but if you already have a drift, it might happen). If the Sevice is replaced, you can expect a 2-7 min hiccup so maybe do it off hours.Hope it helps!CommentShareCarl Ostrandanswered 7 months ago1Making modifications outside of Cloudformation (or any IaC) will result in drift. If you don't make the same modification in your CF yaml file, the next time you run your CFT, it will reset the parameters. In many organizations, no changes are allowed without using IaC. That is a good practice as allowing direct modifications in production is a recipe for disaster and can cause differences in the environments between production and lower environments. You will never know what you tested in the lower environments will work in production.CommentShareEXPERTIndranil Banerjee AWSanswered 7 months agoEXPERTTushar_Jreviewed 7 months ago"


Question: Is possible to set up the BGP pass on a S2S VPN connection

"Hi all,I want to set up a S2S VPN connection using dynamic routing between on-prem and AWS environment. But on-prem engineers are telling me to set up a  BGP password on this VPN in AWS side. Is possible to set up a BGP password in AWS side? As I didn't found anything about BGP password on S2S VPN documentation and in console as well, didn't found the field for BGP password. I know that on a Direct Connect is possible to set up a BGP password. I'm only asking is for a S2S VPN is possible as well? Thank you, Valentin.FollowComment"

Answer: "2Accepted AnswerNo, that's not possible today. Please get in touch with your local AWS account team so that we can add this as a feature request.Also: What's the requirement for having a password on the BGP session? The BGP session can only be established within the VPN tunnel which is already authenticated and encrypted so adding a password for BGP doesn't increase the level of security.CommentShareEXPERTBrettski-AWSanswered a year agoValentin a year agoThank you Brettski for the fast reply on my question. That was my assumption as well, it's great to have a confirmation :). In my opinion the  requirement is purely due to following some guidelines too strictly. Most of them applied on on-prem configuration. Have a great day! ValentinShare"


Question: Root Account Hacked and Email Changed

"Hello,I created my AWS account for a personal school project. However, it has now been hacked and the email has been changed. So I cannot access it anymore. I am afraid of what the hacker may do and the billing it may charge me. I don't know how long I have to wait, but it has been hours since I have been waiting in support chat. Can I get help as soon as possible?Thank you.FollowCommentrePost-User-9822842 6 months agoIt is important to use the two factor authentication.   It is a level of annoyance to have to enter the MFA but the increase in security is worth the effortShare"

Answer: "1Hello AWS Customer,I think it's important that you report suspected abuse to get this out of the way as soon as possible.[1]And also, you can send reports of abuse of other Amazon Web Services to abuse@amazonaws.com, making sure to include as much identifying information as possible. Please kindly note that Amazon Web Services will not open any attachments.Please let me know if you have any further questions or concerns. I will be more than glad to assist you.Best regards,Jisoo K.CommentShareSUPPORT ENGINEERJisoo_Kanswered 6 months ago0This happened to my Business account. I had to create a new personal account and start a contact us chat. I provided them the account number for the hacked account and informed them that I did not authorize a root email change. I provided them with the previous email and the email it was changed to that was provided by the change notice email received. They submitted to the security team and within an hour the email was changed back. Ensure to activate MFA after this to prevent future attacks.CommentShareLiberty Brandsanswered 4 months agoLiberty Brands 4 months agoJust a heads up! AWS support is awful. I recommend seeking out services elsewhere.Share"


Question: AWS Glue writing to S3 but not creating table

"Hey! I have a setup currently with a crawler that connects to a PostgreSQL database with JDBC, this works and the crawler generates around 20 tables for this database.I now want to create an ETL job that extracts the data from one table to a S3 bucket, and make S3 data queryable in Athena. I now have a ETL Glue flow that looks like this:This seems to work except no Table is being created in the database. The S3 target location contains the parquet files and the job succeeds. But no table.The auto generated spark code looks like this:S3bucket_node3 = glueContext.getSink(    path="s3://data-lake",    connection_type="s3",    updateBehavior="UPDATE_IN_DATABASE",    partitionKeys=[],    enableUpdateCatalog=True,    transformation_ctx="S3bucket_node3",)S3bucket_node3.setCatalogInfo(    catalogDatabase="postgres_glue_database", catalogTableName="tableName")S3bucket_node3.setFormat("glueparquet")S3bucket_node3.writeFrame(ApplyMapping_node2)job.commit()Does anybody have any idea on where to look? There seems to be nothing wrong with the connection/crawler/bucket permissions. Its just not creating a table for the data its written to the bucket.I tried:recreating the bucket / rolesgiving the table other namesadding and removing additional Input argumentsThanks in advance!FollowComment"

Answer: "0So I managed to find the solution:AWS Glue provides you with multiple log streams and apparently I missed one, there I found this:com.amazonaws.services.glue.model.AccessDeniedException: Insufficient Lake Formation permission(s)So I added AWSLakeFormationDataAdmin to the role and for now it seems to continueCommentShareD Joeanswered a month ago"


Question: Is it possible to rate limit AWS Rekognition?

"I am slightly worried that it can accidentally do way more requests than expected. At some point I had 2k requests in a few minutes, and I don't understand where they came from (maybe tests).Anyways, is it possible to have rate limit on those to prevent accidents?FollowComment"

Answer: "0Hi User,You may put an API Gateway in front of your rekognition endpoint to throttle requests and put in place a rate limit. Please refer to this guide on how to make the configuration on API Gateway: GuideHope this helps!CommentSharejunkaianswered 3 months agorePost-User-2708083 3 months agoThanks!Getting UnknownOperationException when using API Gateway with Rekognition...Sharejunkai 3 months agoAre you able to provide more details on your setup?Share"


Question: AFI load error with -F flag?

"Hi, I have one AFI created OK and I can check out it status as below--it is not public.            "State": {                "Code": "available"            },            "Tags": [],            "Public": falseNow when I try to load it I got below error report:~/aws-fpga$ sudo fpga-load-local-image -S 0 -H -I -F agfi-XXXXXXXXXError: (5) invalid-afi-idThe agfi id passed is invalid or you do not have permission to load the AFI.However, if not using -F flag, I can load it correctly:~/aws-fpga$ sudo fpga-load-local-image -S 0 -H -I agfi-XXXXXXXXXType  FpgaImageSlot  FpgaImageId             StatusName    StatusCode   ErrorName    ErrorCode   ShVersionAFI          0       agfi-XXXXXXXXX            loaded            0        ok               0       0x04261818Type  FpgaImageSlot  VendorId    DeviceId    DBDFAFIDEVICE    0       0x1d0f      0xf000      0000:00:1d.0why does that happen?  I checked the fpga-load-local-image -F means-F, --force-shell-reload          Reload the FPGA shell on AFI load, even if the next AFI          doesn't require it.Will that "-F" flag really matter?If not using -F flag, shell (which by my understanding is PCIE driver, interface stuff) shall always in FPGA? this should be fineFollowComment"

Answer: "0Just find if I put -F to end of the command there is no issue, so this is a false alarm.CommentSharemacleonshanswered 4 years ago0Thanks!  Looks like you figured it out.-I, --fpga-image-id","          The ID of the FPGA image. agfi-<number>",Which is why the command you had with "-I -F agfi-XXXXXXXXX" does not work.CommentShareAWS-kristopkanswered 4 years ago"


Question: EC2 Docker Site Issue

"Hi,We are trying to launch an application with EC2 which deals with video rendering.I launched an instance using GPU inference as our project requires GPU help.I am using a combination of Flask - Docker - Nginx for the web app.Following is the Dockerfile:The Docker container has been up since saturday.I am trying to access the app through the public dns providedBut I'm not able to access it.Please let us understand what is lacking here. Is it a configuration issue? Or I need to deploy the app anywhere else in order to run it?Regards,NovneetFollowComment"

Answer: "0You've probably not configured the Security Group correctly to allow external connections. If you want to access the instance via HTTP + HTTPS, you'll have to add inbound rules for TCP port 80 and 443 for example. How to update the Security Group is described here in detail:https://aws.amazon.com/premiumsupport/knowledge-center/connect-http-https-ec2/https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/working-with-security-groups.html#updating-security-group-rulesYou may want to check as well if there's any Network Access Control List rule assigned to the instance subnet that is blocking traffic. Information on NACL usage can be found here:https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.htmCommentShareDanielanswered 10 months ago"


Question: ElasticSearch service stuck on "being deleted"

"Hi, I tried to delete one of my ElasticSearch services 2 days ago and it has been stuck at 0% on "being deleted" since then. None of the options on the console seem to be enabled since it is "being deleted" and the instance always returns a 502 when I try to anything via the API.FollowComment"

Answer: "0This seems a case in which AWS Support should be able to help you.Your best next steps would be to open a Support case, in case you have not yet a Support subscription, consider to upgrade to Developer Support or Business support depending on the urgency of your case.Without looking at the internal logs or having more detailed information on the situation it is not possible to provide guidance, sorry.CommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: "From looks like: From temptable, table2 without a join, can someone explain how this works?"

"Hi all,I've found an old query which I'm trying to understand. I've a question about the FROM part. I understand that the temporary table is a key-valuepair. But I don't understand what happens in the from part. Because it returns the dutch names of the week (created in the key-valuepair), but why? The query looks like this:WITHdays AS (SELECT "map"(ARRAY['Sunday','Monday','Tuesday','Wednesday','Thursday','Friday','Saturday'],ARRAY['Zondag','Maandag','Dinsdag','Woensdag','Donderdag','Vrijdag','Zaterdag']) "dagen")SELECT, "date"("tabel1"."datumtijd") "date", "dagen"["date_format"("date"("tabel1"), '%W')] "days"FROMdays, "tabel1"LEFT JOIN "tabel2 "ON (....FollowComment"

Answer: 0Accepted AnswerThe FROM part specifies the tables being joined. Run an EXPLAIN and you should get more information about the query execution.CommentShareMilindOkeanswered 3 months ago


Question: Redshift error: authentication method 13 not supported appears when trying to authenticate using libpq with a user with sha256 hashed password

"I have successfully created a user in Redshift with sha256 hashed password. When trying to authenticate through my app which is using libpq's PQconnectdb to make a new connection to Redshift I experience "authentication method 13 not supported". The same code/workflow works fine when using a user with md5.Also, I have verified that the problem is not related to the user or Redshift configuration by establishing DB connection through ODBC and JDBC drivers (that support sha256) with the same user. Libpq(s) that I used for testing(s) are from PostgreSQL 14 and 15.Can you please tell me if I am doing something wrong or confirm that libpq does not support Redshift sha256 hashed passwords?FollowComment"

Answer: "1I created a user with sha256:create user admin1 password 'sha256|Mypassword1';I tried with psql version 9.2.24 to connect as admin1 and it failed with:psql: authentication method 13 not supported9.2.24 is older and before sha-256 was added. I believe sha-256 was added in version 11.https://www.postgresql.org/docs/current/auth-password.htmlI then tried with psql version 14.1 and got the same error message:failed: authentication method 13 not supportedI then tried rsql which uses ODBC instead of libpq and it connects just fine.Password for user admin1: DSN-less ConnectedDBMS Name: Amazon RedshiftDriver Name: Amazon Redshift ODBC DriverDriver Version: 1.4.52.1000Rsql Version: 1.0.f3e0dc68Redshift Version: 1.0.44903Type "help" for help.This must mean the implementation of sha-256 in Redshift is different from PostgreSQL. Redshift is a fork of PostgreSQL 8.0 and I don't know if we have done any updates to libpq. I also believe the guidance is to use ODBC or JDBC to connect.This was asked before too:https://www.repost.aws/questions/QUGYGra6yiQrOxXat9-tLcsg/redshift-error-authentication-method-13-not-supported-when-creating-a-user-with-sha-256-hashed-passwordCommentShareEXPERTjgrcloudanswered 5 months ago0Hi,The two methods that are supported by the Libpq library are md5 and scram-sha256. You can find more details on the following links:https://www.postgresql.org/docs/current/libpq-misc.htmlhttps://www.postgresql.org/docs/current/auth-password.htmlThanks,CommentShareZiadanswered 6 months agojgrcloud EXPERT5 months agosha-256 doesn't appear to be supported in Redshift when connecting with libpq.Share"


Question: AppStream 2.0 or Workspaces for CAD applications

"A customer is interested by our VDI solutions to offer CAD applications to their end users but I have some questions where I do not have answers (yet):Q1: As Amazon AppStream 2.0 is providing a managed NICE DCV server, do the customer is able to use the NICE DCV client from his/her laptop in addition to the web browser (to get a better user experience) or the web browser is well-managing it? If it is, do we have benchmark on it?Q2: By using Amazon Workspaces thanks to Graphics and GraphicsPro bundles available, do the customer has to install a NICE DCV server on each workspace to get benefits from NICE DCV protocol or our own Workspace client application is well-handling it (thanks to the PCoIP protocol)? If it is, do we have benchmark or relevant customer story on it?Q3: If Amazon AppStream 2.0 solution is the selected by the customer (thanks to the wide range of GPU at the customer disposal), what about cost? Indeed, CAD applications will incur a lot of data egress charges while data egress costs in Amazon Workspaces (for pixel streaming) are included in the bundles charges.Thank you very much for your useful inputs!Warm regards,FollowComment"

Answer: "0Accepted AnswerQ1: As Amazon AppStream 2.0 is providing a managed NICE DCV server, do the customer is able to use the NICE DCV client from his/her laptop in addition to the web browser (to get a better user experience) or the web browser is well-managing it? If it is, do we have benchmark on it?AppStream 2.0 has its own Windows native client. AppStream 2.0 does not support other OSes at this time, and the NICE DCV client will not work with AppStream 2.0. That said, in general, the web client provides a great experience. The AppStream 2.0 native clients are provided due to limitations from the browser, which are mainly: 1/ keyboard shortcuts (keys like alt get captured by the browser), 2/ device limitations (can't do USB redirection or printer redirection through a browser), and 3/ experience - our latest native client has 'native app mode' where the application looks native to the underlying OS which isn't possible through the browser.Q2: By using Amazon Workspaces thanks to Graphics and GraphicsPro bundles available, do the customer has to install a NICE DCV server on each workspace to get benefits from NICE DCV protocol or our own Workspace client application is well-handling it (thanks to the PCoIP protocol)? If it is, do we have benchmark or relevant customer story on it?Amazon WorkSpaces has its own client which provides richness and is fully managed. What's the benefit of installing yet another protocol on top of it, and having to manage it? WorkSpaces provides a connection broker, which DCV does not - the customer would have to manage IPs, or build their own connection broker, to protect the connections from the internet.Q3: If Amazon AppStream 2.0 solution is the selected by the customer (thanks to the wide range of GPU at the customer disposal), what about cost? Indeed, CAD applications will incur a lot of data egress charges while data egress costs in Amazon Workspaces (for pixel streaming) are included in the bundles charges.AppStream 2.0 pixel streaming charges are included in the price. Are you seeing something that says to the alternative?That said, you really need to validate with the customer what is the experience that's wanted. WorkSpaces provides the user a fully persistent experience - every time they log in, it's the exact same instance, in the state they last left it - think of it as an engineering workstation replacement. AppStream 2.0 on the other hand is fully non-persistent - meaning, the user is basically getting a brand new engineering workstation every time they log in.There's also management differences - WorkSpaces requires all the tools necessary to manage a laptop/desktop, while AppStream 2.0 is purely managed through the image.CommentShareEXPERTMuraliAtAWSanswered 3 years ago"


Question: Lua or C++? When to use which language?

"Hi so I am new to Lumberyard but not to game development, I have been using Unity for the past year which only lets you program in C#. I was wondering if you could help me decide whether I should be using Lua or C++, I am on a 7 person team for a semester long school project.I understand that Lua doesn't require the engine to be recompiled and thus is faster to develop for, but C++ is much more performant and also used more in the actual game industry. Using both seems like too much time to keep switching. Does anyone have any recommendations/suggestions, and reasoning would be great!Follow"

Answer: "0Accepted AnswerHi jacwilso. I think this question is individual for project and team. I haven't team and i am using only C++, no Lua. it's not about performance or some language better, just for me it more convenient and easy.p.s.Read here too: When to use FG/Lua/C++SharerePost-User-0150549answered 5 years ago0i use both but there is a reason why there is lua built into the engine & it is for rapid development & i think reading & writing code is better than trying to fit, arrange, connect & figure out all them little boxes in the script canvas. Lua is a very fast language it was chosen by the devs at crytek for that reason & to speed up the development of their games, it can be hot loaded & the results can be seen almost instantly. i use C++ only if lua is to slow for what i want the engine to do for my game.SharerePost-User-6748027answered 4 years ago0Hi @REDACTEDUSERIusing of Script Canvas Amazon Lumberyard 1.18 , this language is powerful & fast , I publishing new video tutorials for Script Canvasnodes , also Emotion Fx graphs , I invite you to my channel in youtube :-)https://www.youtube.com/channel/UCN9MWr1LFeR7i5AdkyxVMbg/videosCheersAhmad Karamia computer teacher / a solo developer/ a gameplay programmer / a debuggerSharerePost-User-8224505answered 4 years ago"


Question: Systems Manager Fleet manager Remote Desktop from CLI or boto3

"I have a windows instance (i-1234567890) running, ssm-agent and everything installed, it is running in a public network.When I open console and I go to: AWS Systems Manager, Node Management, Fleet ManagerI select my windows instance (i-1234567890)From the menu node actions I select Connect, Connect with remote desktopIn the Fleet Manager – Remote Desktop window:I select Keypair, I browse from my key pair fileClick connect, and the i have the remote desktop...Can I do this from the cli or boto3?Actually the nicest solution is to load the key-pair-file content from AWS Secrets Manager.FollowComment"

Answer: "0I think "Fleet manager Remote Desktop" is only available from the management console.It is possible to do port forwarding with SSM Session Manager and RDP from a local computer without setting the EC2 security group.https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ssm/start-session.htmlaws ssm start-session --target <ssm-managed-instance-id> --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters '{"portNumber":["3389"],"localPortNumber":["3389"],"host":["EC2 IP"]}'CommentShareEXPERTRiku_Kobayashianswered 19 days ago"


Question: CLI get-usage-forecast filtering expression

"Hi, i'm having a problem on finding the correct way of passing the parameter values to the following filtering expression for the get-usage-forecast. Can anyone help me with knowing how to writing the values for this expression?aws ce get-usage-forecast --time-period Start=2022-10-07,End=2023-01-07 --granularity MONTHLY --metric USAGE_QUANTITY --filter {"Dimensions": {"Key":"USAGE_TYPE_GROUP, "Values": ["EC2: ELB - Running Hours", "EC2: Running Hours", "RDS: Running Hours"]}}FollowComment"

Answer: "0Accepted AnswerYour filter has two issues.The Key value "USAGE_TYPE_GROUP is missing a double-quote at the end.Since you need to pass the filter as a single value as a JSON, you want to enclose the filter JSON within a single quotes ('').The working command looks like the following:aws ce get-usage-forecast --time-period Start=2022-10-22,End=2023-01-07 --granularity MONTHLY --metric USAGE_QUANTITY --filter '{"Dimensions": {"Key":"USAGE_TYPE_GROUP", "Values": ["EC2: ELB - Running Hours", "EC2: Running Hours", "RDS: Running Hours"]}}'CommentShareTaka_Manswered 7 months agoSympleUser 7 months agoThanks a lot for your help, that worked perfectly. I didn't know about enclosing the JSON within single quotes...Share"


Question: Work Mail API to fetch inbox

We working on the integration of WorkMail with IOS Mobile App. We needed to show all user's mail in the App. Before Workmail we were using Google WorkSpace.There we used gmail.users.messages.list to get all mails from the inbox for a user.Is there any API or SDK functions available in AWS WorkMail?Any option without EWS?FollowComment

Answer: "0Hi,Thank you for your interest in WorkMail. For programmatic Mailbox access WorkMail you can use its EWS end-point to access mailboxes. Here are some examples in python or java. WorkMail recently also release Impersonation allowing for mailbox access via access roles.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 5 months ago"


Question: How can I resolve AWS::S3::Errors:: Access Denied?

"Hi I've followed the link below to configure paperclip with AWS S3 but I keep getting a "AWS::S3::ERRORS::AccessDenied (Access Denied):" from the heroku logs. If I remove my block public access settings, I am able to upload an image to my S3 folder without fail.May I know if there's anything I should configure to make this work properly? My ENV files are 100% correct as they were able to connect when I removed block all public access..I currently have a bucket policy like that and no CORS configuration{"Version": "2012-11-17","Id": "Policy1231xxx1231xx","Statement": [{"Sid": "Stmt1123123123","Effect": "Allow","Principal": {"AWS": "arn:aws:iam::2123123123:user/someuser"},"Action": "s3:*","Resource": "arn:aws:s3:::somename"}]}FollowComment"

Answer: "2Accepted AnswerHi andy,From your description the S3 policy seems fine. Just to be sure, I would test the policy with the user you are trying to use. Just go to IAM -> (in the main Dashboard) Right side of the screen click in Policy Simulator -> Select the user you are trying to use -> Select the S3 bucket action you are tying to perform with that user.About the paperclip configuration ( the one from the config folder like /config/environments/production.rb ), can you confirm you are using the following structure:config.paperclip_defaults = {    storage: :s3,    s3_credentials => {        bucket: ENV.fetch('S3_BUCKET_NAME'),        access_key_id: ENV.fetch('AWS_ACCESS_KEY_ID'),        secret_access_key:  ENV.fetch('AWS_SECRET_ACCESS_KEY'),        s3_region: ENV.fetch('AWS_REGION')    }}?CommentShareGabriel Bartholomeuanswered 10 months agoandy spcl 10 months agoMinor issue in the config, works now. thanks!Share"


Question: Overview of active topics in IoT Core

"I'm trying to find a list of active topics in our account.  During testing it's very difficult to understand what devices are publishing to which topics and how often.Worse, a device could be publishing to a random topic and could be billing for messages we can't find.It's a feature we've used heavily in other MQTT brokers like EMQX & HiveMQ.I think it would be a very useful feature to have a topic overview where all topics recently used in the broker are listed along with their volume of use.This would be especially useful for debugging topics when trying to define an application-wide topic schema.Perhaps there is a way to do this already?FollowComment"

Answer: "1Accepted AnswerHi. One way is to enable AWS ioT Logging. Then use CloudWatch Logs Insights to query the AWSioTLogsV2 log group with a query like this (over whatever timeframe you want to check):fields @timestamp, @message| filter eventType = 'Publish-In'| stats count(*) by topicNameThis will give you a list of every topic during that timeframe and the number of messages published to each topic.CommentShareEXPERTGreg_Banswered a year agoAWS-User-9404308 a year agoThat did exactly what I needed, thank you!Share"


Question: Reporting Amazon CloudFront traffic by hostname in one distribution

Customer is using one Amazon CloudFront Distribution to deliver multiple hostname (CNAME).A challenge is  - it became legacy and person in charge doesn't know whether some of CNAMEs are still used or not.Is there visibility on traffic (bytes / requests) on host name (host header value)?FollowComment

Answer: "0Accepted AnswerYou can enable CloudFront Access Logs and analyse them (x-host-header), they can quickly do this with Athena. You can also have an idea by checking the Top Referers in CloudFront console, logs remain the most precise.Sample request with AthenaSELECT hostheader as CNAME, count(hostheader) as NbRequests from nameoftable_cflogs WHERE (date BETWEEN date '2020-05-01' AND date '2020-06-14') GROUP BY hostheaderCommentShareJibril-AWSanswered 3 years ago"


Question: How to trigger lambda function when image is pushed to ECR?

"I am trying to invoke a lambda function as soon as a new image is pushed to ECR. For this, I have created a lambda function and successfully tested its attached code snippet.As a trigger, I am using an EventBridge rule with the event pattern:{  "source": ["aws.ecr"],  "detail-type": ["ECR Image Action"],  "detail": {    "action-type": ["PUSH"],    "result": ["SUCCESS"],    "repository-name": ["myrepo1", "myrepo2"],    "image-tag": ["latest"]  }}I can see the cross reference of the rule to the lambda and vice versa. But when a new image is pushed to ECR, the rule is not triggered. According to this post this should be enough, as ECR events should be published automatically.Best regards,SebastianFollowComment"

Answer: "0Hi there,It sounds like you have correctly set up the EventBridge rule and Lambda function to trigger when a new image is pushed to your Amazon Elastic Container Registry (ECR) repositories. However, it appears that the rule is not being triggered when a new image is pushed to ECR.One possible reason for this is that the event pattern in your EventBridge rule may not be correctly configured to match the specific events that are generated by ECR when a new image is pushed. The event pattern in your rule specifies that the source of the event must be "aws.ecr", the detail type must be "ECR Image Action", and the action type and result must be "PUSH" and "SUCCESS", respectively. However, you may need to specify the registry and repository where the image was pushed to the event pattern in order for the rule to match the events that are generated by ECR when a new image is pushed.Another possible reason is that the ECR repository where the image is pushed may not be configured to publish events to EventBridge. By default, ECR repositories do not publish events to EventBridge, so you will need to enable this feature in the repository settings in order for the events to be sent to EventBridge and trigger your rule.I would recommend checking the event pattern in your EventBridge rule and ensuring that it is properly configured to match the events that are generated by ECR when a new image is pushed. You should also check the settings for the ECR repository and ensure that the repository is configured to publish events to EventBridge. If these are not the issue, you may need to check for other potential causes or contact Amazon customer support for assistance.CommentShareajmarcinanswered 6 months agoSebastian 6 months agoThanks for the lightning-fast reply. Upon investigation of my ECR repo, I was unable to find the option to enable event creation. I have directed this at my admin for further investigation. Regarding the second suggestion, could you point me to an example where the registry is specified? I created this rule in the browser GUI, so I am completely oblivious what to edit.ShareSebastian 6 months ago@ajmarcin I have tried out your suggestions, e.g. I added the total repository path including the registry to the rule like so: "repository-name":["<userID>.dkr.ecr.eu-central-1.amazonaws.com/myrepo1"] , but that didn't do the trick, unfortunately. And neither my admin nor myself were able to find the configuration option of the repository where the event publishing is managed. Editing the repositry only provides me with options regarding visibility, image scanning, and encryption. Could you provide further information, please?Share0You need to filter this event    "eventSource": "ecr.amazonaws.com",    "eventName": "PutImage",CommentShareCarlos Garcesanswered 6 months agoSebastian 6 months agoCould you elaborate on where to put this snippet? I tried adding it under "detail", but without success. Also, isn't this quite redundant with the existing fields?Share"


Question: I am trying to connect to my ec2 instance but instead its loading endlessly

FollowComment

Answer: "0PLs, check the security group attached with the instance. check if port 22 (SSH) is allowed from anywhere IP(0.0.0.0/0). For more check the attached SS. for more: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html. As I checked your website working on the given public  IP address means instance internet is working..CommentShareVISIanswered 10 months ago"


Question: Slow lambda responses when bigger load

"Hi,Currently, I'm doing load testing using Gatling and I have one issue with my lambdas. I have two lambdas one is written in Java 8 and one is written in Python. I'm using Gatling for my load testing and I have a test where I'm doing one request with 120 concurrent users then I'm ramping them from 120 to 400 users in 1 minute, and then Gatling is doing requests with 400 constants users per second for 2 minutes.There is a weird behavior in these lambdas because the responses are very high. In the lambdas there is no logic, they are just returning a String.Here are some screenshots of Gatling reports:Java ReportPython ReportI can add that I did some tests when Lambda is warm-up and there is the same behaviour as well.I'm using API Gateway to run my lambdas.Do you have any idea why there is such a big response time? Sometimes I'm receiving an HTTP error that says: i.n.h.s.SslHandshakeTimeoutException: handshake timed out after 10000ms Here is also my Gatling simulation code:public class OneEndpointSimulation extends Simulation {HttpProtocolBuilder httpProtocol = http        .baseUrl("url") // Here is the root for all relative URLs        .acceptHeader("text/html,application/xhtml+xml,application/json,application/xml;q=0.9,*/*;q=0.8") // Here are the common headers        .acceptEncodingHeader("gzip, deflate")        .acceptLanguageHeader("en-US,en;q=0.5")        .userAgentHeader("Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:16.0) Gecko/20100101 Firefox/16.0");ScenarioBuilder scn = scenario("Scenario 1 Workload 2")        .exec(http("Get all activities")                .get("/dev")).pause(1);{    setUp(scn.injectOpen(                    atOnceUsers(120),                    rampUsersPerSec(120).to(400).during(60),                    constantUsersPerSec(400).during(Duration.ofMinutes(1))            ).protocols(httpProtocol)    );}}I also checked logs and turned on the X-ray for API Gateway but there was nothing there. The average latency for these services was 14ms.What can be the reason for that slow Lambda responses?FollowComment"

Answer: "0Hi,Without your lambda code or lambda logs is hard to say.Are you sure your lambda is taking that long to respond?You can check the duration using cloudWatch.Try going to cloudWatch > log Insights and runnig this agains your lambda after running your load test.filter @type = "REPORT"| stats avg(@duration), max(@duration), min(@duration) by bin(30m)CommentShareFazelanswered a month ago"


Question: Can AWS DocumentDB log slow aggregate queries containing a $lookup stage?

"I have the profiler enabled on DocumentDB and it is happily logging slow queries (both simple queries and aggregate pipelines). However whenever I execute an aggregate query containing a $lookup stage, it never appears in the slow query logs (despite it definitely being slow).Can anyone shed any light on why this may be happening?FollowComment"


Question: Get Parameter from POST request multipart/form-data on Local wokrs

"Hello!Basically I have a .jsp let's call card.jsp so there is a form where the user can upload text and pdf, image, audio, so I wrap all those info, in a form created by a aux.js and send it to the same card.jsp using POST method and enctype = 'multipart/form-data'So when I try to get the params in order to send the request to a controller, all the params are nullOn local machines this is fine and its working, when the .war is uploaded to Elastic Beanstalk and all the forms with multipart/form-data are not working well (no error logs exist and no errors on console, simply just refresh the site)this is the piece of code .jspif( request.getParameter("sendRequest") != null && Boolean.parseBoolean(request.getParameter("sendRequest")) ){List<Part> archivos = new ArrayList<Part>();for( Part part : request.getParts() ){if( part.getSubmittedFileName() != null && part.getSubmittedFileName() != "" ){archivos.add( part );}}sendRequest = requestController.crearRequest(request.getParameter("requestType"),request.getParameter("description"),Integer.parseInt(request.getParameter("idTaskCard")),archivos);}The .jsconst urlParams = new URLSearchParams(window.location.search);const formularioAEnviar = document.createElement('form');formularioAEnviar.action = 'job_card.jsp?idTaskCard=' + urlParams.get('idTaskCard');formularioAEnviar.method = 'POST';formularioAEnviar.style = 'display: none';formularioAEnviar.enctype = 'multipart/form-data';const requestType = document.createElement('input');requestType.type = 'text';requestType.value = typeRequest.value;requestType.name = 'requestType';const text = document.createElement('input');text.type = 'text';text.value = description.value;text.name = 'description';const action = document.createElement('input');action.type = 'checkbox';action.checked = true;action.value = true;action.name = 'sendRequest';formularioAEnviar.appendChild(requestType);formularioAEnviar.appendChild(text);formularioAEnviar.appendChild(action);const inputs = document.querySelectorAll('input[type="file"].d-none');inputs.forEach( input => {formularioAEnviar.appendChild(input);} );document.body.appendChild(formularioAEnviar);formularioAEnviar.submit();as extra data: I have cnofigured the https for my domain, and from that URL my request are madeFollowComment"


Question: "Amazon connect Contact Flow back up, restore and promote to different environments"

"We have a couple of contact flows created in our amazon connect instance. We built our contact flows and were trying to take back up of the flows and we are receiving an error as "The number of blocks or resources in the flow exceeds the maximum allowed, or the file exceeds 1MB.". I understand that this is a limitation with in amazon connect.We wanted to set up dev and UAT enviornment for same contact flows in a different instance of Amazon Connect account. Can you please advise how the call flows can be exported when the "The number of blocks or resources in the flow exceeds or the file exceeds 1MB"Also, what are the possibilities for implementing a CI/CD pipe line for our future developments. We are expecting the initial work to be done in the Dev enviornment and later promote to QA, UAT and after the testing phase promote to the Production instance. All environments are in different aws accounts or at least a couple of themAWS account #1 - Dev and QAAWS account #2 - UATAWS account #3 - ProductionIs there a cloud formation templates or stacks can be useD?FollowComment"

Answer: "0You could try using the DescribeContactFlow API, but honestly, if your contact flows are that big you probably need to look at refactoring them, maybe splitting out some of the logic into modules?For the deployment pipeline, you have a couple of options, either deploying programatically via the API see here:  https://docs.aws.amazon.com/connect/latest/adminguide/migrate-contact-flows.htmlOr you can using Cloud Formation scripts see here: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Connect.htmlCommentShareledgeanswered a year ago"


Question: pack code build fail

"Hi team,i'm trying to create AWS code build using this example :https://aws.amazon.com/blogs/containers/creating-container-images-with-cloud-native-buildpacks-using-aws-codebuild-and-aws-codepipeline/it finish always with error on this command at the end of the buildspec file:./pack build --no-color --builder $builder \      --tag $IMAGE_TAG $ECR_REPOSITORY:latest \      --cache-image $ECR_REPOSITORY:cache \      --publishI have this error :ERROR: failed to : ensure registry read access to 111111111.dkr.ecr.region.amazonaws.com/myrepo:latestERROR: failed to build: executing lifecycle: failed with status code: 1not sure what I did wrong? I tried to follow the blog's buildspec as isI already added the required ECR permissions to the code build service roleupdate:I added the adminAccess to the code build service role to see if it's a permissions issuenow I have this error :===> ANALYZINGRestoring data for SBOM from previous image===> DETECTINGERROR: No buildpack groups passed detection.ERROR: Please check that you are running against the correct path.ERROR: failed to detect: no buildpacks participatingERROR: failed to build: executing lifecycle: failed with status code: 20[Container]  Command did not exit successfully ./pack build --no-color --builder $builder \--tag $IMAGE_TAG $REPOSITORY_URI:latest \--cache-image $REPOSITORY_URI:cache \--publish exit status 1basically I just want to generate the docker image of my spring boot appli in buildspec.yml without using a docker file,if there is any other method then using packbuikders?I appreciate your help on thisCheers,FollowComment"

Answer: 0It seems you are having the issue with ECR login.Please double-check that you are logging in correctly. Check your buildspec# Log in to ECR    - ECR_DOMAIN="$AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com"    - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $ECR_DOMAINRef: https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.htmlCommentShareawsfanboyanswered 4 months ago


Question: Locate the json file which contains changes that we made on a newly created rekognition dataset

"When dataset is created and shown in the rekognition interface. We opt to make few changes to the labels height and width. Now, before we start to train it. We need to download the manifest/json file which will have the changes that we made on the interface. The issue is that we cannot locate where the manifest file is on s3 where these changes get saved.The initial manifest used to generate the dataset while creating the project does not contain any updates to the records. (on which we made changes)FollowComment"

Answer: "0Hello,Thanks for reaching out.For datasets, we do not save updated manifest files in customer bucket. Instead we provide APIs to interact with manifest files related to your datasets.For your use case, we recommend using list-dataset-entries API and paginate to see updated entries in your dataset. Here is the API guide for your reference.Alternatively, on Rekognition Custom Labels console, you can visit Datasets page under your project to visualize your updates.Hope this helps.CommentShareAWS-Pavananswered a year agoNomanM a year agoThanks AWS-Pavan,I tried the “list-dataset-entries“ through AWS CLI, but it’s not a known argument in aws, even I also used the python code, however, it’s giving same issue.I am getting "aws: error: argument operation: Invalid choice" on cli command.Actually, I want to extract or get the bounding box width, height and x, y positions that are saved in the updated manifest file.Share"


Question: IAM user access to manage API

"I have been battling this for a while. The user must be able to view, edit and create API's.I have tried using the AWS Policy Generator to create the following: {  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Stmtxxxxxxxxxxx",      "Action": "apigateway:*",      "Effect": "Allow",      "Resource": "arn:aws:apigateway:us-east/*"    }  ]}Then when testing the policy, I get that my username does not have apigateway: GET rights. What gives?FollowComment"

Answer: "1Accepted AnswerIt looks like your resource is not formatted properly -- for instance you don't have a valid region specified in your policy document.  us-east is not a valid region.  It's also unclear what resource you are trying to declare.  To see what the resource specification format should be check out Actions, resources, and condition keys for Amazon API Gateway Management -- particularly the section on the resource specification for RestApis.It looks like you might need something like this:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "ApiCreateAndEditAccess",      "Effect": "Allow",      "Action": [        "apigateway:*"      ],      "Resource": [        "arn:aws:apigateway:us-east-2::/restapis",        "arn:aws:apigateway:us-east-2::/restapis/*"      ],    }  ]}CommentShareMiguelUTanswered 8 months agorePost-User-5483003 8 months agoThanks for the reply,I have tried that also before:{"Version": "2012-10-17","Statement": [{"Sid": "Stmtxxxxxxxxxxxx","Action": "apigateway:*","Effect": "Allow","Resource": "arn:aws:apigateway:us-east-2::/**************"}]}I still get the same errorsnot authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-2::/account because no identity-based policy allows the apigateway:GET actionnot authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-2::/restapis because no identity-based policy allows the apigateway:GET actionnot authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-2::/apisI have tried lots of different resource combinations but to no availShareMiguelUT 8 months agoThere are some example policies here: https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies.  I'm not sure if that's an exact copy-paste there but you should never need to use more than one wildcard in a row.Share0Please take a look at this document https://docs.aws.amazon.com/apigateway/latest/developerguide/permissions.htmlThe section "API Gateway permissions model for creating and managing an API" talks about IAM permissions required to create and manage APIsCommentShareEXPERTIndranil Banerjee AWSanswered 8 months agorePost-User-5483003 8 months agoThe problem is how I represent the resource. If I use"*" as the resource, then it works.Share"


Question: What is the Differences between SageMaker pytorch SDK and tensorflow SDK?

"Dear SageMaker makers,Hi, I'm reading the docs about sagemaker pytorch, tensorflow SDK.But I can't get how each framework sdks are optimized for that framework.Literally, What makes using pytorch sdk more beneficial to train and deploy pytorch model than using just sagemaker sdk(sagemaker.pytorch.estimator.PyTorch vs. sagemaker.estimator.Estimator)thank you!FollowComment"

Answer: "0Hello,Sagemaker has two types of APIs the Low-level API (i.e. AWS SDK for Python (Boto 3)) [1] and the High-level API (i.e. Amazon SageMaker Python SDK) [2].The low-level API provides APIs for creating and managing SageMaker resources.The High-level API is an open source library for training and deploying machine learning models on Amazon SageMaker.The high-level API aka Amazon SageMaker Python SDK supports managed training and inferencing for a variety of machine learning frameworks which includes PyTorch, Tensorflow, etc. So what you are referring to as SageMaker Pytorch SDK and Sagemaker Tensorflow SDK are not SDK but the popular ML frameworks included in the SageMaker Python SDK.SageMaker uses 2 types of estimators:The generic estimator (sagemaker.estimator.Estimator) andthe framework estimator (sagemaker.[framework].estimator.[Framework] eg. sagemaker.pytorch.estimator.PyTorch)The generic estimator allows you to extend one of the pre-built containers or build a custom container to create your own ML environment with SageMaker. You use the generic Estimator class to specify the image URI of the custom Docker container hosted in your Amazon Elastic Container Registry (Amazon ECR) [3].When using the framework estimator you do not explicitly provide a Docker image as a default image but have the flexibility to set-up a customised image. It can be beneficial in the sense that the framework estimator class picks up your training script and automatically matches the right image URI of the pre-built image, given the value specified to the framework_version parameter. In terms of optimisation, the framework estimator supports a quick adoption of distributed training job [4].In a nutshell, you use the generic estimator if you want to extend a pre-built container or built a custom container and use the framework estimator for customised models built using framework specific script.You can find more information about the framework estimator in the documentation [5] and the generic estimator here [6].Let me know if this answers your question.References:[1] https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sagemaker.html?icmpid=docs_sagemaker_lp[2] https://sagemaker.readthedocs.io/en/stable/index.html[3] https://docs.amazonaws.cn/en_us/sagemaker/latest/dg/data-parallel-use-api.html#data-parallel-use-python-skd-api[4] https://docs.amazonaws.cn/en_us/sagemaker/latest/dg/data-parallel-use-api.html#data-parallel-framework-estimator[5] https://docs.amazonaws.cn/en_us/sagemaker/latest/dg/prebuilt-containers-extend.html[6] https://docs.amazonaws.cn/en_us/sagemaker/latest/dg/distributed-training-notebook-examples.htmlCommentShareSUPPORT ENGINEERjude-awsanswered 6 months ago"


Question: EC2 Instance HTTP ports blocked on AWS side

"Hi there,I had HTTP ports blocked for one of my instances due to malware on one of hosted websites.Such website is disabled now and I wish to get my other websites accessible again.Could someone help me to get HTTP ports unblocked??Thanks in advance.Regards,FelipeFollowComment"

Answer: "0Hi Felipe,I have sent you a message regarding this.CommentShareAWS-User-8424448answered 3 years ago0Ports were unblocked. Thanks!CommentShareFelipeBarrosoanswered 3 years ago"


Question: Link RoboMaker ROS nodes with EKS

"I'm developing a simulated multi robot fleet management algorithm. The robots are simulated via different RoboMaker instances, while the multi robot management algorithm is deployed into a K8s pod in EKS.Is there a service available to link the ROS nodes in RoboMaker to a cluster's pod in EKS?FollowCommentMassimilianoAWS EXPERT9 months agoCiao Matteo, which protocol is the robot management system using to communicate with the robots?Share"


Question: GetObjectRequest - Access Denied for Virtual Hosted-Style Request

"Hello,I am working in unity and using the latest unity sdk. A couple of days ago i created s3 buckets in EU region while having a few buckets with AP region.The app worked fine with the AP region bucket and always receives "access denied" error when access objects from EU bucket. Do note that this is not a permissions issue for the buckets.When looking at the GET request I noticed that the SDK internally generates a path-style request for AP region bucket and hosted-style request. That is the only difference and it is something done by the SDK. I did read that path-style requests will be deprecated by Sept 30 2020. Is this what is affecting my application?Here are the Get requests"properties":{"AsyncCall":"True","CanonicalRequest":"GET\n/bucketname/user/profile/userProfile.xml\n\nhost:s3.ap-southeast-2.amazonaws.com{"AsyncCall":"True","CanonicalRequest":"GET\n/user/profile/userProfile.xml\n\nhost:bucketname.s3.eu-west-2.amazonaws.comPlease advise how to get the GET/PUT requests to work for EU buckets.RegardsFollowComment"

Answer: "0I mananged to fix the issue by assigning permissions to the cognito identity pool that was accessing the EU S3 bucket.To do thisLogin to your AWS consoleGo To IAMOn left tab, click 'Roles'Now click on the Role that is related to the cognito identity poolEdit the Json policy.Basically your identity pool which is assigned to your cognito user pool should have access to S3.Following assigns access to all but you may want to restrict the access and theeg. policy json:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["s3:","other stuff:"],"Resource": ["*"]}]}CommentShareexsurgoAnkitanswered 3 years ago"


Question: Greengrass Core V2 - Restart component on config change

"Hi,After making a change to a component's config and then deploying this via GG V2 deployment, how can I trigger the component to restart automatically so it picks up the new configuration?Many thanks in advanceFollowComment"

Answer: "1Any configuration which is interpolated into the "lifecycle" section of the recipe will cause the component to reinstall. You can achieve this by interpolating the configuration into environment variables using "setEnv" key for example. If you're using IPC to read the configuration, then ideally you would subscribe to configuration changes and reconfigure without needing to restart. https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-component-configuration.html#ipc-operation-subscribetoconfigurationupdateCommentShareEXPERTMichaelDombrowski-AWSanswered a year ago"


Question: Why TCP connections drops in Frankfurt eu-central-1 even though same connections work without a problem in Stockholm (eu-north-1)

"Steps to reproduce:Create EC2 instance in eu-central-1 region with following configuration - t3.small, ami-042172eb88687b43e (Windows Server 2016 Base), Public IP, igw to handle traffic.Login to the instance through RDP. Install telnet (it can be done  through PowerShell with following command Install-WindowsFeature -name Telnet-Client). Open command line and try use telnet to connect 10-20 times to remote host with following command telnet 212.90.186.150 80. At least one attempt will fail with error "Connection failed".Repeat all steps above in eu-north-1 region and will see 0 errors.Is there a problem with routing in eu-central-1 region?You can also trace (tracert 212.90.186.150) to find out through which IPs/Networks the connection goes. From the 212.90.186.150 country (Ukraine) side the route is the same for both regions but when you trace from eu-central-1 it also goes through few internal IPs: 100.95.20.135, 100.100.22.2, 100.95.21.129, 100.100.4.58 and one "Frankfurt IPv4 Peering LAN". It could be a problem with this route. Could you help to solve the issue?FollowComment"


Question: "An error occurred (InvalidRequestException) when calling the CreateProvisioningTemplate operation: Access denied during validating provisioning hook, Hook: arn:aws:lambda:ap-southeast-2::f"

"I am trying to create a provisioning template with a hook lambda for greengras v2. and it show this errorhere is the command i used:aws iot create-provisioning-template \  --template-name GreengrassFleetProvisioningTemplate \  --description "A provisioning template for Greengrass core devices." \  --provisioning-role-arn "arn:aws:iam:::role/GreengrassFleetProvisioningRole" \  --template-body file://greengrass-fleet-provisioning-template.json \  --pre-provisioning-hook targetArn=arn:aws:lambda:::function:preprovisioning \  --enabledand here is the error:An error occurred (InvalidRequestException) when calling the CreateProvisioningTemplate operation: Access denied during validating provisioning hook, Hook: arn:aws:lambda:ap-southeast-2::function:preprovisioningi tried to add "lambda:*" to GreengrassFleetProvisioningRole, and i am sure my aws account has all permissions required to do this.Where should i look into to fix this errorThanks for your time.FollowComment"

Answer: 1Accepted AnswerI think the IAM role of your pre-provisioning hook Lambda may be missing a permission. IoT needs permission to invoke the function.Some good information here in this workshop: https://iot-device-management.workshop.aws/en/provisioning-options/fleet-provisioning.html#optional-pre-provisioning-hookAt this step:aws lambda add-permission --statement-id $(date '+%Y%m%d%H%M%S') \--principal iot.amazonaws.com \--action lambda:InvokeFunction \--function-name [YOUR_LAMBDA_FUNCTION_NAME]CommentShareEXPERTGreg_Banswered a year agoAWS-User-6797102 a year agoI added that permission in the lambda execution role insteadShare0this is for serverlessfunctions:  preprovisioning:    name: preprovisioning    handler: functions/preprovisioning.lambda_handler    timeout: 100resources:  Resources:    PermissionToCallHookLambda:      Type: "AWS::Lambda::Permission"      Properties:         Action: lambda:InvokeFunction        FunctionName: preprovisioning        Principal: "iot.amazonaws.com"CommentShareAWS-User-6797102answered a year ago


Question: How to move Opencart from a Hosting Company to AWS?

"Hi, I am currently using OC3.0.3.1 and would like to move everything from HostPapa to AWS. Is that a wise decision and what is the best simple way of doing it?I currently setup a root and AIM account.I would appreciate if you can explain it step by step if you know it.ThanksFollowComment"


Question: Security group doesn't exist but I know it exists

"I created a CFN stack for Kubernetes cluster and then deleted it and noticed that the VPC and ENI were left undeleted so wanted to remove the ENI but couldn't because a security group is attached to it. Tried to remove the SG and assign a default VPS SG but it says I don't have permissions to do that. I tried looking up the SG using aws cli but it says that the SG doesn't exist. I can see it right now in my console so why does it say it doesn't exist? I'm stuck. Please help me. How do I remove the ENI, VPC and the SG. Thank you in advance.FollowCommentRoB a year agoSearch for the ENI to get the subnet and security group(s) it uses with the below command. Ensure you replace <ENI> and <REGION> placeholders with respective values. The output of the below command will be json which you can parse with something like jq. This should align with what you see in the consoleaws ec2 describe-network-interfaces --network-interface-ids <ENI> --filters Name=network-interface-id,Values=ENI --region <REGION> --output json --query 'NetworkInterfaces[0].{Subnet:SubnetId,SecurityGroups:Groups[*].GroupId}')Share"

Answer: "2Are you in the same region using CLI?CommentShareMGanswered a year agoAWS-User-6689421 a year agoAWS CLI does not have the option to specify the regionaws ec2 describe-security-groups --filters Name=vpc-id,Values=... --group-ids ...An error occurred (InvalidGroup.NotFound) when calling the DescribeSecurityGroups operation: The security group '...' does not existBut I am on the security group page in the console now as we speak so it does exist.Share2Try adding in --region at the end of your CLI command to whatever region you see the Security Group in.For example:aws ec2 describe-security-groups ... --group-ids --region us-east-1You can also run an aws configure get region to get the region of what region your CLI is setup for.That would be my first look - ensure where you are looking in console matches the region in your CLI.CommentSharejsoncanswered a year agoAWS-User-6689421 a year agoYou are a genius! Bullseye! That solved my problem. Thank you very much!Share"


Question: new user here - looking for help to starting and download first platform on aws

just signed up and dowloadedthe vpn . this is where i am and cant figure out how to download my first platform(tradestation) to awsFollowComment