Question: Multiple AWS Account setup

I have a personal AWS account and manage multiple AWS accounts for my company. AWS does not allow the same phone number across multiple accounts. What are the best practices for this scenario? And should we use a personal phone number for company owned AWS accounts?FollowComment

Answer: "3A best practice is to use AWS Organizations to manage multiple accounts. You can easily add accounts tied to your organization with just an email address.https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_create.htmlCommentSharehayao-kanswered a year ago3As hayao-k has already pointed out, AWS Organisations is the best way to manage multiple accounts for the same company.However, I would strongly advise against using any of your personal accounts/numbers when managing AWS accounts for a company.  Things can get very nasty/legal if you part ways on bad terms, especially if everything is still tied to you personally.  You'd be better off creating a new (free) "Root" account for the company and then adding existing accounts to it.Are you referring to not being able to use the same phone number for SMS based MFA across multiple accounts? If so, I would point you to some news that broke a few years ago when NIST changed their policy to advise against using SMS for MFA.Password managers like 1Password have special Teams accounts that not only store account credentials but also provide virtual MFA devices to be used instead of SMS.  Credentials can be securely shared amongst specific company staff that require root logins for AWS accounts.When organising multiple accounts under AWS Organisations I would also advice the use of a hardware MFA token for the main company "root" account.CommentShareDaniel Craigieanswered a year ago2Accepted AnswerIt sounds like you are the administrator for multiple AWS Accounts for your company.AWS recommends for professional AWS Accounts, to use company contact info such as a company phone number and email address rather than individual contact info.  If the root user is configured with personal contact information (email, phone number), this becomes difficult to recover if the individual leaves the company.  More information here: https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.htmlTo that end, you can set alternate contacts for the AWS Account as some others have mentioned for Billing, Operations, and Security.  https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html#manage-acct-update-contact-alternate.While you could use Organizations, which is great for multi-account management, it could be a lot for a handful of accounts.  When using Organizations, keep in mind the following info will be copied to new accounts (Account Name, Phone Number, Company Name, Company Contact Email, etc).  For pre-existing accounts, you could move those accounts into an Organization via an invite as well.  The company contact email could be a distribution list or a company-managed group email as well.There's a lot to consider here with managing multiple accounts!  As others have said, best practice is to keep your personal accounts completely separate from your company's AWS Accounts.CommentSharejsoncanswered a year ago2When setting up multiple accounts you can also define alternate contact types specific to Billing, Operations, and Security. Alternate contacts allows AWS to contact another person about issues with your account, even if you're unavailable. The alternate contact doesn't have to be a specific person. You could instead add an email distribution list if you have a team that is responsible for managing billing, operations and security related issues.This way when alternate contacts are configured you have the relevant info from below sent to the right people across all accounts.Billing - When your monthly invoice is available, or your payment method needs to be updated. If your Receive PDF Invoice By Email is turned on in your Billing preferences, your alternate billing contact will receive the PDF invoices as well. Notifications can be from AWS Support, or other AWS service teams.Operations - When your service is, or will be, temporarily unavailable in one of more Regions. Any notification related to operations. Notifications can be from AWS Support, or other AWS service teams.Security - When you have notifications from the AWS Security, AWS Trust and Safety, or AWS service teams. These notifications might include security issues or potential abusive or fraudulent activities on your AWS account. Notifications can be from AWS Support, or other AWS service teams concerning security related topics associated with your AWS account usage. Do not include sensitive information in the subject line or full name fields since this might be used in email communications to you.CommentShareRoBanswered a year ago"


Question: Error: TargetGroup cannot be associated with more than one load balancer

"When a TargetGroup, LoadBalancer, and Listener are setup, if an update triggers a replace of the LoadBalancer the stack can't be updated. Below is an example stack. After creating it the first time, update it and change the ELBScheme parameter. Doing this results in the error:Target group 'arn:aws:elasticloadbalancing:...' cannot be associated with more than one load balancerMy understanding of the problem is that when the load balancer gets replaced, this causes the Listener to also be replaced. But when the listener is replaced, it now tries to connect to the existing TargetGroup. And this causes the problem.If the TargetGroup cannot be associated with more than one load balancer, then the TargetGroup should have an explicit reference to the load balancer in CloudFormation, and then the TargetGroup can be replaced when the load balancer is replaced. Or perhaps I'm missing something here.I'm going to experiment with some hacky solutions around this and will report back.AWSTemplateFormatVersion: '2010-09-09'Description: Test of an issue with CloudFormation TargetGroupsParameters:  ELBScheme:    Type: String    Default: internet-facing    AllowedValues: [ 'internet-facing', 'internal']  Subnet1:    Type: AWS::EC2::Subnet::Id  Subnet2:    Type: AWS::EC2::Subnet::Id  VPC:    Type: AWS::EC2::VPC::IdResources:  ELBv2:    Type: AWS::ElasticLoadBalancingV2::LoadBalancer    Properties:      Subnets:      - !Ref Subnet1      - !Ref Subnet2      Scheme: !Ref ELBScheme  ELBTargetGroup:    Type: AWS::ElasticLoadBalancingV2::TargetGroup    Properties:      Port: '80'      Protocol: HTTP      VpcId: !Ref VPC  ELBListener80:    Type: AWS::ElasticLoadBalancingV2::Listener    Properties:      DefaultActions:      - TargetGroupArn: !Ref 'ELBTargetGroup'        Type: forward      LoadBalancerArn: !Ref 'ELBv2'      Port: '80'      Protocol: HTTPFollowComment"

Answer: "1The following template fixes this issue. It uses the Name property of the TargetGroup resource. Whenever the Name property changes the TargetGroup needs to be recreated. So this template uses the unique identifier part of the load balancer name and adds a prefix to it.  The TG1 prefix is there incase you have multiple target groups connected to this same load balancer. Each of these groups should use a different prefix so the Names don't conflict.AWSTemplateFormatVersion: '2010-09-09'Description: Test of an issue with CloudFormation TargetGroupsParameters:  ELBScheme:    Type: String    Default: internet-facing    AllowedValues: [ 'internet-facing', 'internal']  Subnet1:    Type: AWS::EC2::Subnet::Id  Subnet2:    Type: AWS::EC2::Subnet::Id  VPC:    Type: AWS::EC2::VPC::IdResources:  ELBv2:    Type: AWS::ElasticLoadBalancingV2::LoadBalancer    Properties:      Subnets:      - !Ref Subnet1      - !Ref Subnet2      Scheme: !Ref ELBScheme  ELBTargetGroup:    Type: AWS::ElasticLoadBalancingV2::TargetGroup    Properties:      Name: !Join      - '-'      - - 'TG1'        - !Select [ 2, !Split [ '-', !GetAtt ELBv2.LoadBalancerName]]      Port: '80'      Protocol: HTTP      VpcId: !Ref VPC  ELBListener80:    Type: AWS::ElasticLoadBalancingV2::Listener    Properties:      DefaultActions:      - TargetGroupArn: !Ref 'ELBTargetGroup'        Type: forward      LoadBalancerArn: !Ref 'ELBv2'      Port: '80'      Protocol: HTTPCommentSharescytacki-ccanswered 6 years ago0Thanks!  This helped immensely.  In the end I just named my target group the same as my loadbalancer and that was enough to draw a dependency between em.CommentSharesnarkyFishanswered 6 years ago"


Question: Annotating PDF files - SagerMakerExecutionRole can not assume role for sagemaker.amazonaws.com

"I follow this tutorial :https://docs.aws.amazon.com/comprehend/latest/dg/cer-annotation-pdf.html#cer-annotation-pdf-set-upAt the step "Creating an annotation job", I get this error :botocore.exceptions.ClientError: An error occurred (ValidationException) when calling the CreateLabelingJob operation: The role ARN arn:aws:iam::xxxxxxxxxxxx:role/xxxxxxxx-SageMakerExecutionRole-xxxxxxxxxxxxxx isn't valid. Make sure the role exists and that its trust relationship policy allows the action "sts:AssumeRole" for the service principal "sagemaker.amazonaws.com"So, I went to IAM and check the trust relationships :        {            "Effect": "Allow",            "Principal": {                "Service": "sagemaker.amazonaws.com"            },            "Action": "sts:AssumeRole"        }Is that enough ?I'm using the Ubuntu app under Windows 10.I checked the version of boto3 :# pip show boto3Name: boto3Version: 1.26.52...What can I do more ?Thank you in advance !FollowComment"

Answer: 1One of the first steps in this tutorial consists in setting up your AWS credentials. Calling aws configure by default points you to the AWS account the currently authenticated IAM user is part of along with a default region. Are you running the annotation job creation script from within the same account as where the stack was created?We'd need more information to make sure but it seems to a plausible cause.CommentShareNZanswered 2 months ago


Question: RDS stuck on security group modification

Hi everyone.I get a problem with RDS postgresql. It stucks on Security Group (screenshot). Now I cannot change Security Group. May I get help?FollowComment


Question: need help completely terminating and canceling all AWS services... cancel all please

We are still getting billed for a few services that I thought we canceled months ago...FollowComment

Answer: 0Hi - You can follow this AWS link to achieve your requirement.https://repost.aws/knowledge-center/terminate-resources-account-closureCommentSharePraveen Muppalaanswered 2 months ago


Question: How to activate Workdocs

I have done some searching and I believe the reason my Workdocs is not syncing is that it is inactive. See belowStatus messageActiveWorkDocsDisabledHow do I activate my WorkDocs again?FollowComment

Answer: "0You can activate WorkDocs from the WorkDocs Console by selecting Get Started , select your directory and click Enable directoryCommentShareRobert_Fanswered 7 months agorePost-User-7951030 7 months agoHI RobertI already have a directory and it was working until last week. What I need to know is how to activate Workdocs again as it has been disabled.Share"


Question: KMS key policy to allow access to the key only to the role used to create the key

"Looking for a KMS key policy that satisfies the following requirement.  The role that a user/program assumes to create a KMS key is specified in the key's policy as the only role/user which being assumed may access the key in the future.If such policy is possible, then what it is? If not, then which specific feature of KMS doesn't allow it?The approach described below has been unsuccessful.Through the AWS console in account 444444444444, I can create a KMS key with a policy (see below).KMSCreateCustomerKeyRole in account 444444444444 is a cross-account role for account 3333333333333. In the latter there is encryption_key_manager user in a user group that can assume KMSCreateCustomerKeyRole.Logging into AWS console as a encryption_key_manager user and assuming KMSCreateCustomerKeyRole, a key with the same policy also gets created successfully.{"Version": "2012-10-17","Id": "key-default-1","Statement": [    {        "Sid": "Enable IAM User Permissions",        "Effect": "Allow",        "Principal": {            "AWS": "arn:aws:iam::444444444444:root"        },        "Action": "kms: *",        "Resource": "*"    },    {        "Sid": "Deny for everyone except the specified role and user",        "Effect": "Deny",        "NotPrincipal": {            "AWS": [                "arn:aws:iam::444444444444:root",                "arn:aws:sts::444444444444:assumed-role/KMSCreateCustomerKeyRole/ encryption_key_manager",                "arn:aws:iam::444444444444:role/KMSCreateCustomerKeyRole"            ]        },        "Action": "kms: *",        "Resource": "*"    }]}So far, it works in the sense that other users/role can't access the key through the console.However, key creation should be done programmatically, so to test this policy I try to create a key via cli. CLI uses the KMSCreateCustomerKeyRole profile, which points to the default encryption_key_manager profile with aws credentials file as[default] role_arn = arn:aws:iam::444444444444:role/KMSCreateCustomerKeyRole source_profile = encryption_key_manager[encryption_key_manager]  aws_access_key_id = .....get-caller-identity returns{"UserId": "AAAAAAAAAAAAAAA:botocore-session-1640070193","Account": "444444444444","Arn": "arn:aws:sts::444444444444: assumed-role/KMSCreateCustomerKeyRole/botocore-session-1640070193"}Key generation request aws kms create-key --description another_key --policy file: //policy.json --region us-east-2results in an error occurred (MalformedPolicyDocumentException) when calling the CreateKey operation: The new key policy will not allow you to update the key policy in the future.Same error is produced for encryption_key_manager profile aws kms create-key --description another_key --policy file: //policy.json --profile encryption_key_manager --region us-east-2I thought that this may happen because while using command line we pass to AMS KMS an ARN with session-id, and KMS can't match this ARN to any of ARN in the array for NotPrincipal in Deny part of the policy. I have added the ARN with session id     (arn:aws:sts::444444444444: assumed-role/ KMSCreateCustomerKeyRole/botocore-session-1640070193) to the ARN's array, but the error stays the same.FollowComment"

Answer: "1{  "Version": "2012-10-17",  "Id": "key-consolepolicy-2",  "Statement": [    {      "Sid": "Allow use of the key",      "Effect": "Allow",      "Principal": {"AWS": [        "arn:aws:iam::111122223333:role/KeyCreatorRole"      ]},      "Action": [        "kms:Encrypt",        "kms:Decrypt",        "kms:ReEncrypt*",        "kms:GenerateDataKey*",        "kms:DescribeKey"      ],      "Resource": "*"    }  ]}This is taken from the examples found here: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.htmlCommentShareEXPERTkentradanswered a year ago"


Question: GreenGrass is not authorized to assume the Service Role

"Hello,I am trying to follow the official Greengrass setup guide on Raspberry Pi.Everything seems to have installed fine so far. I used a permanent user id and access key to run the gg-device-setup-latest.sh script, and then set up a systemd script that runs the core daemon on start.I have opened up the TCP ports 8883, 8443 and 443 on the Pi, just in case, as well as a port to SSH into it.I am able to use the AWS CLI on another machine to run aws greengrass get-service-role-for-account, to verify that the Greengrass role is activated on the account. I manually attached it to the created Greengrass group on the AWS web console, and it has the AWSGreengrassResourceAccessRolePolicy policy in it.But.. every time I have attempted to click deploy in the web console, I see this printed: "GreenGrass is not authorized to assume the Service Role associated with this account". I tried rebooting the Pi, but that did not help. Made sure the Greengrass group is in us-east-1, which is where the CLI told me the service role was associated.No idea how to get past this.Thank you.FollowComment"

Answer: "0Accepted AnswerHi @meoporter,There are 2 concepts here:Greengrass Service RoleThis is the role you grant AWS Greengrass to assume to access resources in your AWS account. It allows Greengrass group deployments to succeed. Service role association is done at the account level per region.Greengrass Group RoleThis is the role you associate for each of your Greengrass group. It is used and assumed by lambdas within that group to access other AWS services. This association is done at the group level.The error "Greengrass is not authorized to assume the service role" indicates that your Greengrass Service Role might not be correctly configured. Can you try and confirm the following?With AWS CLI, run the following:aws greengrass get-service-role-for-account --region <YOUR_REGION>Check if you have associated a service role for your account in that region. If yes, you should be able to see something like "arn:aws:iam::<ACCOUNT_ID>:role/service-role/<ROLE_NAME>". Note down the role arn/name.2. With AWS CLI, run the following:aws iam get-role --role-name <ROLE_NAME> --region <YOUR_REGION>You should be able to see an output similar to the following:{    "Role": {        "Path": "/",        "RoleName": "ROLE_NAME",        "RoleId": "ROLE_ID",        "Arn": "arn:aws:iam::<ACCOUNT>:role/<ROLE_NAME>",        "CreateDate": "2019-12-27T18:38:54Z",        "AssumeRolePolicyDocument": {            "Version": "2012-10-17",            "Statement": [                {                    "Effect": "Allow",                    "Principal": {                        "Service": "greengrass.amazonaws.com"  <--- Check here                    },                    "Action": "sts:AssumeRole"                }            ]        },        "MaxSessionDuration": 3600    }}Verify if the statement allows Greengrass service principal to assume role.Thanks,LiusuCommentShareAWS-User-0557233answered 3 years agoEyithings a year agoHi.In my case, I pass both steps you recommended above, yet unable to progress and still have:com.aws.greengrass.tes.CredentialRequestHandler: Error in retrieving AwsCredentials from TES. {iotCredentialsPath=/role-aliases/GreengrassV2TokenExchangeRoleAlias/credentials, credentialData=TES responded with status code: 400. Caching response. {"message":"Unable to assume the role, or the role to assume does not exist"}}The role as well as the alias exists in role-aliase of IoT Core menu, as well as role in IAM menu.Share0Hello,As an update, I had previously been trying with or without having a Role attached to the Greengrass group in us-east-1.. could not get past this error.Then, I switched to us-west-2, and downloaded new certs and a new config.json to the Pi. And WITHOUT having a Role attached, and it DID successfully deploy in the web console!Neither of these behaviors is making much sense to me. I do not understand why us-east-1 was having issues with the Role, or why us-west-2 could deploy without a Role.Thank you.CommentSharemeoporteranswered 3 years ago0Hi meoporter,The service role is region specific. The console tries to be helpful and create it for you if it doesn't exist.See: https://docs.aws.amazon.com/greengrass/latest/developerguide/service-role.html#manage-service-role-consoleYou can also see the error in the Troubleshooting guide.https://docs.aws.amazon.com/greengrass/latest/developerguide/gg-troubleshooting.htmlIf you have any questions or if the problem persists, please let us know.Thanks,KR-AWSCommentShareKR-AWSanswered 3 years ago0Hi KR-AWS,Yes the attachment of the role appears to be region specific. The roles themselves appear under global IAM console.However, in us-east-1, for the Greengrass group I created, with or without a role attached, the deployment fails.In us-west-2, setting up a Greengrass group without any role attached, I was able to get this Greengrass group to deploy.This does not make any sense.Thank youCommentSharemeoporteranswered 3 years ago0Hi LiusuZ,I had thought Greengrass Group Role controlled the Deploy functionality. Thank you for clarifying that it is independent.I must have had an old or non-existent role associated with my account in the us-east-1 region. Once I started over, creating the role, and then associated it with the region again, overwriting the earlier association.. Deploy worked.Thank you for your detailed reply.CommentSharemeoporteranswered 3 years ago"


Question: I cant login Lightsail Plesk account

"Hi there,I have Password also cant loginFollowComment"

Answer: "0Greetings from Lightsail!If you haven't done so yet, could you please follow the steps in the following doc: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/set-up-and-configure-plesk-stack-on-lightsailWe'd appreciate if you'd update this thread with your new findings, and hopefully with the resolution.Regards,guvenAWSCommentShareguvenAWSanswered 7 months ago"


Question: Publish/Subscribe to IoT device messages via Java SDK?

"I'm using the aws Java SDK to build a Java server application that works with IOT services.My server application is designed to be a supervisor that can communicate with all of the IOT devices in my network.So far I've been able to instantiate an instance of IotClient using an AWS access key/secret key pair. I can call functions like listThings() or describeEndpoint() which return valid results.I'm confused as to how to proceed from here. I need a simple way to publish and subscribe to messages, but there doesn't seem to be any such functionality available in the IotClient class.I found some documentation pointing me to an "AWS Iot Device Service" SDK, but I don't think this is what I want; I think it's probably intended for devices.What's the simplest way for my Java server application to publish and subscribe to messages?Thanks,FrankFollowCommentFrank a year agoSo far I've been able to retrieve and update shadows using IotDataPlaneClient, and I can also publish messages. What I'm struggling with is that although I can publish, I can't subscribe. It's essential that I be able to subscribe. How is this accomplished?Share"

Answer: "0The Java SDK doesn't support subscribing. The Java SDK is a relatively thin wrapper around the AWS services API (HTTPS). There is no API for subscribing: https://docs.aws.amazon.com/iot/latest/apireference/API_Operations_AWS_IoT_Data_Plane.htmlTo subscribe, you would need to connect to the AWS IoT Core MQTT broker.  As Ryan_B has indicated elsewhere, one solution is to use the device SDK: https://github.com/aws/aws-iot-device-sdk-java-v2/tree/main/samples#basicpubsubHowever, do you have need of receiving messages in real-time? It's not so common for web applications to connect directly to IoT Core. Solutions are often architected such that incoming device messages would typically flow through IoT Core to Rules Engine and then to another AWS service. Perhaps Kinesis, SQS or a storage service. Decoupling the application from the flow of incoming messages. The application would then retrieve the data from these other services, often through API gateway. Something like this: https://docs.aws.amazon.com/solutions/latest/smart-product-solution/architecture.html .Amplify is also a popular choice: https://docs.amplify.aws/lib/pubsub/getting-started/q/platform/js/CommentShareEXPERTGreg_Banswered a year agoFrank a year agoThanks for the response. I have installed the package you suggested, and gotten the publish and subscribe functions to work.My use case is fairly simple and most of the messages will be flowing from my application to the devices. I plan to use the device "shadows" for this communication. As an FYI, my application is not a web application, rather, it is a mobile application with a server that is hosted on EC2 (and it is the EC2 instance that connects to IoT core on behalf of the app user, not the app itself).I do have one infrequent use case where a device needs to signal back an alarm condition, which needs to be acted on quickly. My thinking is that I'll have all of the devices send that alarm to a common message queue, which I will monitor on my server. Does this sound feasible? I haven't tried it yet, but I don't think there's anything that would prevent me from having all of my devices publish messages to some standard queue such as "alarm".As far as the other Amazon services you mention, I haven't looked at them yet but I'm not sure I'll really need them given the simplicity of what I'm doing. I'll certainly keep them in mind if more complex interactions are needed later.Share"


Question: AWS IoT broker how to register a client certificate 1024 bits key length?

"Hi,We are trying to register a self signed X.509 for client authentication to aws iot core (aws iot register-certificate) but we get the error "The key in the certificate is not valid".The problem seems related to the length of the key, it's 1024 bits, we have no problems register a certificate with 2048 bits key. Signing algorithm is "SHA-256 with RSA".Here there is a note about the key length of the CSR request, no mention about the key length of a self-signed certificate:https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.htmlHow can register a self signed certificate with 1024 bits key length?Thanks in advance for supportReason for this question:We have an old device with few calculation resources, connection to the broker using a 2048 bits key length client certificate takes 10 secs, using a client certificate with 1024 bits key takes 4 seconds, we measured using another broker not aws iot.  We know 1024 bits key is not the best key but 10 seconds to connect is two much.FollowComment"

Answer: "2Accepted AnswerHi,the document you are referring to mentions: The certificate signing request (CSR) must include a public key that is either an RSA key with a length of at least 2048 bits...". So you cannot use a key with a smaller length than 2048 bits.But you could try to use custom authentication with AWS IoT Core to achieve your goal.Cheers,PhilippCommentSharePhilipp Sanswered 7 months agoEXPERTGreg_Breviewed 7 months agoSam B 7 months agoHi Philipp,The note also refers to the CreateCertificateFromCsr API and this confuses me, we are creating self-signed certificates instead. So this rule also applies to self-signed certificates?Thank you for the custom authentication suggestion, we are considering this.Best Regards,SamShareGreg_B EXPERT7 months agoHi Sam. You will find confirmation here: https://docs.aws.amazon.com/iot/latest/developerguide/audit-chk-device-cert-key-quality.htmlAWS IoT performs basic sanity checks on these certificates when they are registered. These checks include: Their cryptographic key sizes must meet a minimum required size (for RSA keys, they must be 2048 bits or larger).I agree that perhaps the basic requirements set out there could also be listed on the link you gave. Please consider to use the Feedback button on that page.ShareSam B 7 months agoHi Greg,Thank you for the confirmation, feedback sent.We explored other ways and connection with a ECC key from NIST P-256 (curve secp256r1) takes 5 secs, it's more secure than RSA 1024 and good enough for our requirements.We can share this link, we found it very usefull for optimization parameters:https://csrc.nist.gov/csrc/media/events/lightweight-cryptography-workshop-2015/documents/presentations/session7-vincent.pdfThanks again,Best Regards,SamShareGreg_B EXPERT7 months agoThanks for the link Sam. Interesting document.Share"


Question: How to avoid: "Request throttled because message visibility configuration was updated too recently."

"I am getting the following error when calling ChangeMessageVisibility:Request throttled because message visibility configuration was updated too recently.I can't find anything on google or on here as to how to fix this. I've tried waiting up to 43 seconds after creating the queue to see if calls to ChangeMessageVisibility have to occur after the (30 second) VisibilityTimeout setting itself, but no dice. The FIFO in question is created in an automated (pytest) fixture and all of the other ways we use that fixture work great. It's just this call to ChangeMessageVisibility.How can I fix this? Thanks!FollowComment"

Answer: "0Silly question: Are you definitely calling the ChangeMessageVisibility API for a message or trying to change the default VisibilityTimeout by calling SetQueueAttributes? Because the error message implies that that it is the queue configuration that is being changed, not the message visibility.That said: Information that is missing that would be handy: What's the default message visibility timeout for the queue? What are you setting the message visibility to? How often are you doing that?I ask because: If you have delays in your processing that are happening frequently, maybe it's a sign to change the default message visibility in the queue or to set the individual message visibility a lot higher rather than trying to set it a lot of times.CommentShareEXPERTBrettski-AWSanswered a year agopatrickstinsonak a year agoThanks for your reply. I am getting the error when calling queue.change_message_visibility_batch(). The queue object is created like this:    incoming = client.create_queue(        QueueName="TEST-INCOMING.fifo",        Attributes={"FifoQueue": "true", "ContentBasedDeduplication": "false", "VisibilityTimeout": "30"},    )Putting back messages is a slight but important edge case for us when a customer is tearing down their account while an SQS consumer is also processing messages for that account.Does that answer your questions?Share"


Question: How can I use API to get the tel number of customers from AWS Connect

"Hello, I would like to know how I can get the tel number of customers calling on AWS Connect from API. I look through the API methods and cannot find one to get it.FollowComment"

Answer: "0Accepted AnswerYou can select a block setContactAttribute, where you do the following:Use AttributesSelect type as SystemSelect value as CustomerNumberName itthis will be accessible inside contact attributes.CommentSharefaizanshahanswered 3 years ago"


Question: RDS MySQL upgrade takes forever due to 0% repeatly snapshot creation

"I am upgrading RDS MySQL from 5.7.34 to 5.7.37 but it takes forever. The log says:February 28, 2022, 8:34:21 AM UTC - Backing up DB instanceFebruary 28, 2022, 8:31:06 AM UTC - Backing up DB instanceFebruary 28, 2022, 8:27:45 AM UTC - Backing up DB instanceFebruary 28, 2022, 8:24:16 AM UTC - Backing up DB instanceFebruary 28, 2022, 8:20:49 AM UTC - Backing up DB instanceIt tried to create the new snapshot every 3-4 minutes before upgrading but every snapshot stuck at "Creating" "0%".Unfortunately, the DB cannot be deleted due to enabled delete protection. Therefore, it run upgrading forever :(Please advice.ThanksAccount ID: 358204806461FollowComment"

Answer: "0It looks like the workflow got stuck at the pre-upgrade backup it was taking. And if you still see those messages, I would reach out to the Support.I hope, the backup and upgrade got completed by now.CommentShareD-Raoanswered a year agoD-Rao a year agoI hope the issue is resolved by now.Share"


Question: Mount FSx in EC2 of different aws account

Is it possible to mount FSx of account A in EC2 of account B? If yes then How can it be done?FollowComment

Answer: "0There are a couple approaches that come to minf. If the subnet(s) (Windows and NetApp OnTap can be multi-AZ, while Lustre and ZFS are currently single AZ) of the FSx deployment are peered with the second account, or, if you share the subnets, you should be able to access the filesystem. You'll want to ensure you meet your security requirements between the accounts by having Security Group, Network ACLs, IAM Roles, Active Directory Authentication, etc. to ensure you don't leave vulnerabilities for access to things you don't wish to expose.CommentShareRodney Lesteranswered 7 months agorePost-User-6290701 7 months agoSo, I wanted to use Lustre from Account A and mount it in EC2 of Account B. After sharing the subnets, it will be possible.Share"


Question: HTTPS/TLS + static S3 websites

A customer is currently hosting a static website on S3 and want to enable HTTPS/TLS connections. Currently the domain resides outside AWS and the customer has created a certificate that they want to use. I was reading through documentation and it says the only way to achieve this is by redirecting to Cloudfront.Any thoughts on this? What is the simplest way to achieve this ? Can this be achieved without using Cloudfront? Will the customer need to import their certificate to ACM?ThanksFollowComment

Answer: "0Accepted AnswerCloudFront would be the best option, since as well as providing the requirement (HTTPS on custom domain name) it will also provide added benefits of lower latency and lower costs (assuming that the clients for the website are outside the AWS region that the bucket it located).This is a common usecase for CloudFront. CloudFront supports custom CNAMEs and certificates (either through ACM or third-party provided certificates) and using S3 as an origin - either via its website endpoint or directly using the S3 API endpoint.CommentShareEXPERTLeeAtk@AWSanswered 2 years ago"


Question: Lex Automated Designer - Internal Error

"I am attempting to create a bot using transcripts (automated chatbot designer). The transcripts are stored in an S3 bucket and are appropriately formatted in json. Using a smaller subset of this data, I was able to create a bot without errors. However, no intents were detected with the smaller set. I then switched to the full dataset, which contains around 38,575 individual messages and around 19,000 conversations. When creating the bot with this full dataset, I received the following error: There was an internal error while processing bot recommendation request.FollowComment"

Answer: "0Hi,While, we don't have enough information to pinpoint your failure, we were able to find a bot recommendation that failed, containing around 38,575 individual messages and around 19,000 conversations. We have already root caused the issue and fix was deployed. Can you please retry the run?CommentShareABHISHEKanswered a year ago"


Question: Time required for DNS server update to propagate?

"Hi,We recently change our Name server to Amazon Route 53 (over 4 days ago) and some people are still not able to see our domain.In a previous post it mentioned that "DNS resolvers typically cache the names of name servers for two days".How long does it take for DNS servers to be visible to everyone?ThanksFollowComment"

Answer: "0Accepted AnswerHello,Please refer to the below article for troubleshooting the same. Also, if still unaccessible, perform the below steps and also reach out to AWS Premium Support for detailed analysis.Link- https://aws.amazon.com/premiumsupport/knowledge-center/route-53-propagate-dns-changes/CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year ago"


Question: Inbound TCP traffic to AppStream deployed App?

"I have a successfully deployed a 3D scientific visualization app using AppStream 2.0 that now needs to get a TCP data stream from the client. How does one set up the AppStream VPC/Fleet/Image/... to enable and route an external TCP socket connection from the client back to the AppStream app at a specified port/range of ports?Thanks in advance for any help or ideas!Regards,MarkFollowComment"

Answer: "0AppStream 2.0 is not meant to be used that way. You should consume the TCP data stream from within the streaming session.Why does it have to be outside the session? You could consider deploying the 3d scientific visualization app on EC2, and accessing the TCP data stream from AppStream 2.0.CommentShareJeremy_Sanswered 7 months agorePost-User-3137730 7 months agoThanks for your response!I might be misunderstanding your response, or I might not have posed the question quite right.  The application as it runs on a user's desktop relies upon another small program running on the user's desktop that opens a TCP socket to the application, processes various inputs and forwards data to the application. So to port this to AppStream 2.0, I need to find a way to for that application on the user's desktop to open a socket connection to the AppStream 2.0 app instance running in the cloud. I presume that between gateways, NATs, port forwarding, etc there might be a way to get that connection to work.Are you suggesting an EC2 intermediary at a known endpoint accessible by both the user's machine and the AppStream app running in the VPC subnet? Or can it be handled with AppStream and its deployment framework?Thanks for any clarification!MarkShareJeremy_S 7 months agoTo port to AppStream 2.0, you should put both programs in the same AppStream 2.0 image.Your fleets should be deployed in a private subnet with a NAT GW, which means they won't have inbound ports open. The instances are non persistent, so if they were in a public subnet that does allow that, the addresses would change every session.I was suggesting EC2 for the server / client model, but it may not be applicable with your app.I think the easiest way to port to AppStream 2.0 is to install everything the user needs on the same image.SharerePost-User-3137730 7 months agoJeremy - thanks for your continued follow-up. Unfortunately I can't put everything in the AppStream image - that ancillary program accesses multiple hardware and client-side data on the client's machine that can't live in the cloud (this is medical visualization/analysis so some esoteric hardware and sensitive data).  Hence local processing is necessary with a push to the visualization app in the cloud... The different address for each run of the app is okay, as I can forward that information to the client/user via the appstream-deployed app at least via an information dialog that displays the current internet ip address and port.Given the above, what do you recommend? The linux image is already configured to allow the inbound ports, andit sounds like a security group with a small # of ports enabled via an inbound traffic rule on the vpc is part of the solution, but other plumbing is needed too.  What would the minimal set of other infrastructure be?Thanks again for your help and any ideas!Regards,MarkSharerePost-User-3137730 7 months agoSuccess!  This was easier than I expected: for now I have put the app in a public subnet (I can work on deploying to a private subnet and expose some public ports later if necessary), add the necessary Security Group and rules, forward the public ip address and port via the client to the user who then starts up the client-side data-push program with the relevant settings, and voila.Thanks Jeremy for the dialog that allowed me to get to this point.MarkShareJeremy_S 7 months agoThanks for posting your solution. Glad it is working for youShare"


Question: S3 Bucket cannot be reached in GroundTruth Labeling

"I am currently using GroundTruth Labeling, and have created a manifest file successfully. Right now, I am encountering the error "NetworkingError: Network Failure - The S3 bucket  you entered in Input dataset location cannot be reached. Either the bucket does not exist, or you do not have permission to access it. If the bucket does not exist, update Input dataset location with a new S3 URI. If the bucket exists, give the IAM entity you are using to create this labeling job permission to read and write to this S3 bucket, and try your request again."I have made the contents of the S3 bucket and the bucket itself public to everybody, so I was wondering why this error occurs.FollowComment"

Answer: "0First of all, please do not make your S3 bucket public. Doing this way, anybody in the world can access your bucket. Please remove public access immediately from your S3 bucket.Now coming to the actual problem, while you create the groundtruth labeling job, you need to provide an execution role. That execution role must have access to s3 bucket where you are storing the unlabeled data. If you want to simplify things, you can add a policy to the execution role, which provides access to any s3 bucket in your account. While this will solve it temporarily, as a best practice, please always use only least required permissions in your role policies. Hope this helps.CommentShareVikesh_Panswered a year agoAWS-User-4011551 a year agoI have already created the execution role as shown in 4:02 in the tutorial link: https://www.youtube.com/watch?v=_FPI6KjDlCI&t=217sSomehow it does not work for my case.Another strange thing is that at 3:25 in the video, I was able to see my bucket, but I could not see the contents of my bucket. I was still able to successfully create a manifest file however.Share0I think Diffgram is a better option!CommentShareAWS-User-2043476answered a year ago"


Question: Alarm for resource created without tag

"I need a cloudwatch alarm, to warn if any resource was created without TAG. I couldn't find any service that would make this work or any guidance. Has anyone done this here?FollowComment"

Answer: "1Hi.I understand that you want to detect untagged resources.In your scenario, it's better to use AWS Config instead of CloudWatch alarms.AWS Config can check the customized compliance status of resources and notify administrators.In particular, the required-tag managed rules provided by AWS will be useful to you. It is also possible to expand the range of support for various resources by creating your own custom rules.https://docs.aws.amazon.com/config/latest/developerguide/required-tags.htmlEither way, AWS Config is for you.CommentShareEXPERTiwasaanswered a year agoAndre a year agoThank you for your help!But do you have any solutions or documentation on how this can be done via CloudWatch? To receive email alerts as soon as resources without TAG are created. Psi I didn't find anything like it.Thank you again.Shareiwasa EXPERTa year agoCloudWatch conditions monitor metrics and logs, but not tags.I don't think there is any documentation, but why do you want to use CloudWatch? You should use Config in your use case.You should send email alerts from Config using SNS.Share"


Question: set customer phone number as outbound caller id in aws connect

i don't want to show my aws connect phone number to external number instead i want to show customer numberFollowComment

Answer: 0You can set the outbound number dynamically in a contact flow.It depends on the Region and Country you're dialling to what options are available to you for masking outbound numbers and if Custom Caller ID's are supported. Those require a Support Ticket to get the Caller ID allowlisted. Please see the Coverage Guide for more information.CommentSharefaddianswered 7 months ago


Question: How get the bot designed using Amazon Lex V2 to recognize Intents without sample utterances when its input contexts are active

I have designed a QnA bot that has some intents without sample user utterances. Since in QnA bot the questions the users can ask cannot be predetermined. I however have a clear set of input contexts set for these intents.I want to know how to ensure that such an intent gets triggered when all the input contexts are active and fallback intent doesn't get triggered.On a side note is there a way to disable fallback intent on Lex V2?FollowComment

Answer: "1To ensure that an intent without sample utterances gets triggered when all input contexts are active, you can use slot filling. When a user asks a question that triggers an intent with active input contexts but without sample utterances, the bot can prompt the user to provide more information through slot filling. The bot can ask questions to get more information and determine the appropriate response.Here is an example:Let's say you have an intent called "FindRestaurant" with active input contexts "City" and "Cuisine." The user asks, "What are some good restaurants in Boston?" The bot recognizes that the input contexts "City" and "Cuisine" are active and prompts the user to provide more information using slot filling. The bot can ask, "What type of cuisine are you interested in?" The user can respond with "Italian," and the bot can then provide a list of Italian restaurants in Boston.Regarding your second question, there is no way to disable the fallback intent in Amazon Lex V2. The fallback intent is automatically triggered when the bot cannot match the user's input to any of the other intents. However, you can customize the fallback intent to provide a more meaningful response to the user.CommentShareAWS_Guyanswered 3 months ago"


Question: DMA questions

"I’m working on optimizing my project, which uses DMA, and have a few questions about best practices on the software side of things as I’m more of an RTL person.My design is a search engine that compares data provided to the FPGA from the computer against a reference library stored in the DDR. I load GBs of data to the DDR in a single dump on startup but then need to make ~100 4kB writes per second to keep the library updated. The data in each update is written to consecutive DDR addresses but the updates are scattered throughout the DDR address space. My drivers use fpga_dma.h.Questions:Is it better practice to open a DMA queue a single time and store the descriptor in my driver library, which would potentially leave the queue open for days, or should I open and close the DMA queue every time I do a write?I’d like to have the XDMA driver load automatically when the F1 instance is powered up but it’s not doing that after I follow the instructions in the link below. Is it supposed to be persistent? I’m using the FPGA Dev AMI v1.9.1 but am having to follow the full instructions each time so DMA works, maybe because of the XOCL driver conflict as it seems to be coming back each reboot. Very possible I've screwed up something as my unix skills are google/cut/paste.https://github.com/aws/aws-fpga/blob/master/sdk/linux_kernel_drivers/xdma/xdma_install.md#xdmainstallfailFollowComment"

Answer: "0Hello,While we work on getting you answers for your first question, I can answer your second question about removing XOCL.Calling rmmod removes it from the kernel but since the module still exists in the /lib/module directories, it will be reloaded on boot.To remove XOCL completely, you have to remove new XRT version, you need to call the following commands: sudo systemctl stop mpd sudo yum remove -y xrt xrt-awsAfter this, you can install XDMA and XRT/XOCL drivers shouldn't be reloaded on boot.Thank you for this question. I will also update these instructions in the XDMA install readme.Please let me know if you need more help on this topic and I'll be happy to help.-DeepEdited by: awsdeep on Mar 12, 2021 9:18 AMCommentShareDeep_Panswered 2 years ago0Super helpful Deep. It would have taken me forever to figure this out on my own!CommentShareljp0101answered 2 years ago"


Question: A cancelled spot request has not been disappeared for a long time

"Hi,I have a cancelled spot request that has not been deleted for 2 months.The state is displayed as cancelled and all instances were terminated, why is the request remained on the Spot Requests list?Any help would be appreciated.Thanks!FollowComment"


Question: can I use Bref php serverless to install sendy?

if I follow the tutorial it it possible to make Sendy server-less with Bref?Or is it a waste of time?FollowComment

Answer: "0I would recommend reaching out to Sendy and Bref to see if it's possible to make it work. However, looking at the getting started guide for Sendy (step 3), it notes that /uploads folder permission should be set as 777. However, on Lambda, the only writable directory is /tmp unless you use EFS to mount a directory. If the uploads directory path or any other directory path to write files can be modified, it may be possible (from Lambda perspective).CommentShareTaka_Manswered 7 months agoLoot 7 months agoI cant use s3?Share"


Question: Mail configuration

"While updating MX records why is AWS taking the domain name?I have mail purchased from Godaddy and updating MX records in AWS... But in the record name, GoDaddy has provided only @, and in AWS it is updating @ with the domain name.Godaddy customer says we are not receiving the mails because of thisFollowComment"


Question: ESP8266 keeps disconnecting with AWS IOT - Getting CLIENT_ERROR

"Hi,My ESP8266 keeps disconnecting from AWS IOT.  It connects fine but it immediately disconnects. I have added Arduino code and logs as below.  My board publishes Temperature and Humidity values to AWS IOT.My Payload is not that big, i tried sending hello world but still it gives me CLIENT_ERROR in disconnect reason.Also i am sending connection request only once.Below is the subscription data i receive in AWS Console for IOTLogs from Serial port - ArduinoArduino Code:#include <ESP8266WiFi.h>#include <WiFiClientSecure.h>#include <PubSubClient.h>#include <ArduinoJson.h>#include <time.h>#include "security.h"float h=12 ;float t=22;unsigned long lastMillis = 0;unsigned long previousMillis = 0;const long interval = 5000;#define AWS_IOT_PUBLISH_TOPIC "esp8266/pub"#define AWS_IOT_SUBSCRIBE_TOPIC "esp8266/sub"WiFiClientSecure net;BearSSL::X509List cert(cacert);BearSSL::X509List client_crt(client_cert);BearSSL::PrivateKey key(privkey);PubSubClient client(net);time_t now;time_t nowish = 1510592825;void NTPConnect(void){Serial.print("Setting time using SNTP");configTime(TIME_ZONE * 3600, 0 * 3600, "pool.ntp.org", "time.nist.gov");now = time(nullptr);while (now < nowish){delay(500);Serial.print(".");now = time(nullptr);}Serial.println("done!");struct tm timeinfo;gmtime_r(&now, &timeinfo);Serial.print("Current time: ");Serial.print(asctime(&timeinfo));}void messageReceived(char *topic, byte *payload, unsigned int length){Serial.print("Received [");Serial.print(topic);Serial.print("]: ");for (int i = 0; i < length; i++){Serial.print((char)payload[i]);}Serial.println();}void connectAWS(){delay(3000);WiFi.mode(WIFI_STA);WiFi.begin(WIFI_SSID, WIFI_PASSWORD);Serial.println(String("Attempting to connect to SSID: ") + String(WIFI_SSID));while (WiFi.status() != WL_CONNECTED){Serial.print(".");delay(1000);}NTPConnect();net.setTrustAnchors(&cert);net.setClientRSACert(&client_crt, &key);client.setServer(MQTT_HOST, 8883);client.setCallback(messageReceived);Serial.println("Connecting to AWS IOT using thing name ");Serial.println(THINGNAME);while (!client.connect(THINGNAME)){Serial.print(".");delay(1000);}if (!client.connected()) {Serial.println("AWS IoT Timeout!");return;}// Subscribe to a topicclient.subscribe(AWS_IOT_SUBSCRIBE_TOPIC);Serial.println("AWS IoT Connected!");}void publishMessage(){StaticJsonDocument<200> doc;doc["time"] = millis();doc["humidity"] = h;doc["temperature"] = t;char jsonBuffer[512];serializeJson(doc, jsonBuffer); // print to clientclient.publish(AWS_IOT_PUBLISH_TOPIC, jsonBuffer);}void setup(){Serial.begin(115200);connectAWS();}void loop(){Serial.print(F("Humidity: "));Serial.print(h);Serial.print(F("% Temperature: "));Serial.print(t);Serial.println(F("°C "));delay(2000);now = time(nullptr);if (!client.connected()){connectAWS();}else{Serial.print("in else loop");client.loop();Serial.print("after client loop");if (millis() - lastMillis > 5000){Serial.print("in if loop");lastMillis = millis();publishMessage();}}}FollowComment"

Answer: "0Hi. I think you may have a problem with your IoT policy. Please review it. Please post it here if you're unsure.https://docs.aws.amazon.com/iot/latest/developerguide/connect-and-pub.htmlCommentShareEXPERTGreg_Banswered 10 months ago0Thanks a lot. After having a closer look at my Policy, i figured out that the topic name in policy was incorrect. After correcting it is working fine.For reference below is the Policy{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "iot:Connect",      "Resource": "arn:aws:iot:ap-south-1:1234567890:client/${iot:Connection.Thing.ThingName}"    },    {      "Effect": "Allow",      "Action": "iot:Subscribe",      "Resource": "arn:aws:iot:ap-south-1:1234567890:topicfilter/esp8266/sub"    },    {      "Effect": "Allow",      "Action": "iot:Receive",      "Resource": "arn:aws:iot:ap-south-1:1234567890:topic/esp8266/sub"    },    {      "Effect": "Allow",      "Action": "iot:Publish",      "Resource": "arn:aws:iot:ap-south-1:1234567890:topic/esp8266/pub"    }  ]}CommentShareUjjwalkumar Sonianswered 10 months ago0I am using the same code but cannot get any readings.See my console Please help me.CommentShareSiddanswered 9 months ago"


Question: Make S3 static website accessible to Cloudfront Only Permissions

"I'm hosting a static website in an S3 bucket. I am attempting to limit access permissions to cloudfront only. My current configuration:{"Version": "2008-10-17","Id": "PolicyForCloudFrontPrivateContent","Statement": [{"Sid": "AllowCloudFrontServicePrincipal","Effect": "Allow","Principal": {"Service": "cloudfront.amazonaws.com"},"Action": "s3:GetObject","Resource": "arn:aws:s3:::MYBUCKET/*","Condition": {"StringEquals": {"AWS:SourceArn": "DISTRIBUTION_ARN/"}}}]}But this does not allow cloudfront access and returns a 403 Forbidden error. How can I fix this?FollowComment"

Answer: "0Accepted AnswerYou haven't mentioned whether you're trying to use Origin Access Control (OAC), or Origin Access Identity (OAI - legacy).However, the policy that you've provided looks almost correct for OAC, except for the Condition key which should look like this (no trailing slash):AWS:SourceArn": "arn:aws:cloudfront::<AWS account ID>:distribution/<CloudFront distribution ID>"Please take a look at the documentation for more information, particularly the section on SSE-KMS, if you're using that on your bucketNote also that in the Cloudfront Origin settings, there's an option to copy a pre-populated policy statement that you can insert into your S3 bucket policy.CommentSharePaul_Lanswered 23 days agoEXPERTalatechreviewed 23 days ago"


Question: "how do i tag api operations like CreateDBInstance:0014, CREATE_CERTIFICATE_AUTHORITY or CreateCacheCluster:0002?"

I'd like to assign cost allocation tags to certain api operations that appear as untagged when i look at them in cost explorer? I think some of these are related to upfront charges for reserved instances. I can't seem to find a way to assign tags to these in the AWS docs. How do I do it?FollowComment

Answer: "0Hello,I understand that you would like to know how to tag API Operations like CreateDBInstance:0014, CREATE_CERTIFICATE_AUTHORITY or CreateCacheCluster:0002.To achieve that :You can activate the CreateDBInstance tag in the Billing and Cost Management console.Sign in to the AWS Management Console and open the AWS Billing console at https://console.aws.amazon.com/billing/ .Under cost management (Cost explorer)Navigate to the right (Report parameters)“Group by”, on dimensions filter for API OperationsYou can download the Cost and usage breakdown as CSV.[+] https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/activate-built-in-tags.htmlI hope this helpsResource :-[1] https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/aws-tags.htmlCommentShareAsisiphoanswered 5 months agorePost-User-5254816 5 months agoUnfortunately, your steps do not answer the question asked. Your steps explain how to  group or filter by API operations. But I'm not seeking to group or filter by the API operations, I'm looking to apply a cost allocation tag to the API operations. To explain in other words, these API operations show up under the "No tag key:" filter and that's what I want to fix. I want to apply my cost allocation tag key to these API operations.Share"


Question: Custom domain names with the CDK

"When using the CDK to create a few services (cloudfront and cognition) I run into a circular problem: I can't create the custom domain in the service until the CNAME record exists, but the CNAME record can't exist yet because I haven't created the service.Example:    const domainNames=["my.something.com"];    const certificate = Certificate.fromCertificateArn(stack, "some-id", "arn:aws:acn:us-east-1:........");    const cfconfig = new CloudFrontWebDistribution(stack,        "xxx-cloudfront-static",        {           /* more stuff */           viewerCertificate: ViewerCertificate.fromAcmCertificate(certificate, { aliases: domainNames })        }    );This attempt just gets you this:One or more aliases specified for the distribution includes an incorrectly configured DNS record that points to another CloudFront distribution. You must update the DNS record to correct the problem. For more information, see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-restrictionsThis happens with Cognito as well.  To get around this, I have to omit the custom domain, then give the ops team manual instructions toDeploy the stackGo into the console and get the real cloudfront and cognito distribution hostnamesModify the CNAME records in their DNS (not route 53)Go back into the console and manually set up the custom domains for cloudfront and cognitoIs this just the way it is or am I missing something?It is possible this is just a matter of patience.  I destroyed my stack and created it again, but I had old  CNAME records now pointing to the new place.  I deleted them, but maybe I need to wait longer for them to time out.  I had created all the old records with 15 minute TTLs but maybe somebody along the way is not honoring those TTLs.FollowComment"

Answer: "0Accepted AnswerNobody answered but that's ok - it's pretty clear that you can have non CNAME pointer or a correct CNAME pointer, but cloudformation will fail if there is an existing CNAME record pointing to the wrong place.CommentSharewz2banswered 7 months ago"


Question: "mp4 from Galaxy S21 works, but S23 mp4 does not"

Hi.  I am using my lightsail site to post a few short videos for my iPhone friends and family since Android to iPhone doesn't transmit good files unless they use Signal like I do.  I have a few mp4 videos from my Galaxy S21 on the site and they play correctly.  I recently upgraded to Galaxy S23 and the video I uploaded says the codec is not supported.   What can I do?FollowComment

Answer: "0Ok thanks.   What's actually happening is that the lightsail server I have can't play it.  It plays audio, but no video.  So I'm thinking that Windows Media Player on that server isn't able to figure it out.  I tried running an update on that, but still no luck.  The Galaxy S21 videos were fineCommentShareTodd in socalanswered a month agoBrettski-AWS EXPERT25 days agoNormally I'd install VLC because it has lots of codecs and plays pretty much everything.Share0Given that the video is downloading correctly to your new device (because it is trying to play it) the error message is telling you that it doesn't know how to play the video.I'd suggest searching for how to add additional video codecs to your Samsung device. You might be able to determine the codec required by downloading it to desktop computer (Mac or Windows) and looking at the file properties.CommentShareEXPERTBrettski-AWSanswered a month ago0I'll look into it.  Side note:  The exact same video from my phone plays correctly on my laptop using Windows Media Player.Also, I installed VLC on the remote machine and it didn't play on that either.  And windows explorer shows a preview image of the Galaxy S21 video, but does not show one for the S23 video.So I'll have to see if I can make a change on the phone itselfCommentShareTodd in socalanswered 24 days ago"


Question: Does S3 charge for delete marker objects with a Null ID?

"This scenario came up while working with the customer:Customer had previously enabled versioning on their S3 bucketCustomer suspended versioning on their S3 bucketCustomer uploaded a file ("hello.txt") to their S3 bucketCustomer still sees the "Show"/"Hide" version toggle on their S3 consoleCustomer deletes the "hello.txt" objectCustomer toggles versioning to "Show"S3 console shows "hello.txt" with a "Delete marker" and with a Version ID of "null"When Versioning is enabled, "Delete markers accrue a nominal charge for storage in Amazon S3"[1].However, my question is whether there is any charge for the Delete marker objects when versioning is suspended with a Version ID of null?And a related question is whether there is any way to revert S3 back to its original state without versioning ever being enabled such that the Delete marker objects with a Version ID of null are created and viewable by the customer?[1] https://docs.aws.amazon.com/AmazonS3/latest/dev/DeleteMarker.htmlFollowComment"

Answer: "0Accepted AnswerDelete markers are an object and charged like any other object regardless of the bucket status(as mentioned in the documentation, size of a delete marker is euqal to its key name).Your explained scenario is possible only if customer have already uploaded a "hello.txt" object before versioning suspension. Once versioning is suspended, all subsequent DELETE operations will produce a delete marker but the original object is really deleted(Customer should have seen only a Delete Marker and not the original object after deletion[Step 7]).As per the documentation, once versioning is enabled and then suspended, bucket behavior can never be reverted to 'disabled versioning' state.CommentShareAWS BKSanswered 4 years ago"


Question: Changed ECDSA host key even when I didn't manually change it? Database connection error

"Hi, when I started and stopped my lightsail instance (linux), it says "Error establishing a database connection."Upon further investigation, I saw:[pem file]: Please contact your system administrator.Add correct host key in /Users/sid/.ssh/known_hosts to get rid of this message.Offending ECDSA key in /Users/sid/.ssh/known_hosts:3ECDSA host key for braindocacademy.com.au has changed and you have requested strict checking.Host key verification failed.I don't understand what's going on, and what steps I should take. I didn't manually change any keys whatsoever.If you could assist me with this, it would be greatly appreciated.Cheers,CarlFollowCommentdonleyataws 7 months agoCan you verify that the hostname you are using is resolving to the IP address of your instance? Host key changes can indiciate an MITM attack, so please be cautious.Share"


Question: Is Textract aware of document language and character set used within the language?

"I've run into problems when trying to get texts from PDF which is in Czech language - some characters especially carons are badly recognized and/or not even returned. If Textract is aware about the source language or region then he should also know character set used within the language (source texts inside the PDF are utf-8 strings, but the national characters which are really used are usually limited to CE subset - such subset is specified in older iso-8859-2 or Latin-2/cp1250 char tables).The PDF documents have been uploaded into CE region bucket (eu-central-1) and processed in batch by client::StartDocumentTextDetection(options) (the client's region set to eu-central-1 too).Is there an option to specify source document language or preferred character set or how to enhance the detection results ?FollowComment"

Answer: "0Hi, as noted here in the developer guide, Czech is not in the list of language currently officially supported by the service for text extraction. Also as of now, there's no option in the APIs (for example StartDocumentTextDetection or StartDocumentAnalysis) to explicitly specify which language(s) your content is in.In my experience, Amazon Textract can still work well for other latin-character languages outside the list (for example Indonesian / Malay), but other locales with almost-but-not-quite supported character sets (such as Vietnamese) can be a challenge.One option you could explore for some locales is to run an (e.g. open-source) spell-checker on the output to try and reconstruct the missing characters / accents? The semantic importance of the unsupported characters will drive how successful this approach can be: If it's usually pretty clear substitution, then great, but if not then a simple dictionary- and rule-based spell-checker may not be sufficient. Apologies I don't have experience with Czech in particular.If post-processing Amazon Tesseract isn't viable in your particular case, you could perhaps explore:Other 3rd-party OCR offerings available on the AWS MarketplaceOpen-source tools with existing AWS deployment patterns. For example:This document processing pipeline sample for layout-aware entity recognition can tackle some advanced structure extraction use cases similar to Textract and Comprehend, and uses Textract for OCR by default - but has integration options for multi-lingual models and open-source Tesseract OCRA range of 3rd-party authors have released samples and blogs about deploying Tesseract OCR serverlessly on AWS LambdaCommentShareEXPERTAlex_Tanswered 6 months ago"


Question: How to use AWS text extract UI to upload a sample document for testing

"Hi,I would like to upload a document through the text extract UI for testing and evaluation.Documentation shows that there should be an "upload document" button, but i can only see" reset demo" button.Not sure if this a bug or not.FollowComment"

Answer: "0If you scroll down the page, you can find an option to upload document right below the paystub section. Again, it's listed on the lower left side of the page.CommentShareTaka_Manswered 5 months ago"


Question: Importing a VHDX as an image get stucked updating at 27%

"Nice to meet you.I saw a similar question, but I will ask again because the OS of the virtual machine is different.https://repost.aws/questions/QUPOVpB758S5q_mFw_Ow6Q1g/aws-ec-2-import-image-get-stucked-updating-at-27I wanted to migrate a virtual machine created with Hyper-V to AWS,I ran the following command in the AWS CLI.aws ec2 import-image --disk-containers "file://bar-locar.json"At first it works fine.However, after a while, if you type the following command,The progress rate remains at 27% and it will not progress. aws ec2 describe-import-image-tasks --import-task-ids import-ami-XXXXXXXIMPORTIMAGETASKS        import-ami-XXXXXXX    27      active  updatingSNAPSHOTDETAILS foo       /dev/sde        43490738176.0   VHDX    completed       s3://myS3bucket/VM.vhdxUSERBUCKET      mys3bucket      Quick.vhdxI think the requirements are met, but could you please tell me the solution?Using VM informationEdition:Windows 10 EnterpriseVersion:21H1OS build:19043.1165Experience:Windows Feature Experience Pack 120.2212.3530.0Locale:en-USFilesystem:NTFSPartition Style:GPTFollowComment"

Answer: 1I don't think you are doing anything incorrect if the migration has progressed as much as you have described. You will need to open a support ticket to look into this or reach out to your AWS account representatives.CommentShareAWS-VGanswered a year ago


Question: DynamoDB ProjectionExpression exclude attribute (all fields except one)

"I have a requirement where my dynamodb table has many attributes, and i need all of them in the projection expression except one or two columns which i dont need in response. (I am scanning the table).Is there a way how can i define this in ProjectionExpression (all except this one column).I have seen examples where ProjectionExpression only takes what all "is required" and not the other way.FollowComment"

Answer: "0There is not an "all but X attributes" type of filter or syntax for projections, you have to list out all the attributes you want to project if you only want a subset.CommentShareAWS-User-6425534answered 4 years ago"


Question: Where are my bounce notifications?

Just starting to use SES. I'm seeing in Sending Statistics that there have been a bunch of bounces.My domain & sender are both configured to receive bounce notifications by email.Yet I'm not receiving any bounce notifications.Does it take time to receive them or something? It's been nearly an hour.Thanks!FollowComment

Answer: 0Solved. Gmail was sending them to Spam.CommentShared0ganswered 3 years ago


Question: Cannot enable MFA for account

I have tried Authy - both on my phone and the desktop app - and I have also tried Microsoft Authenticator. Each time I scan the QR code and provide the 6 digit code I receive "Invalid MFA Code"FollowComment

Answer: "0HelloPlease look at the information from the link to enable the MFA on the devices https://aws.amazon.com/iam/features/mfa/?audit=2019q1You can Enable MFA for the IAM user and ROOT account, You can find the information to enable MFA for the IAM User and Root account, If you are enabling the root account MFA you need to enter two values in order to enable MFA. if you have this problem then you just need to delete the app and reinstall it again.I am using desktop app in named  [https://apps.apple.com/in/app/authenticator-app/id1538761576] Authenticator in Mac OS and Google authenticator those works pretty good, If you have still troubles you just need to reset app and re install again.Thank YouGKCommentShareGKanswered a year ago"


Question: How do deactivate my AWS services when I have a member account listed in the organization?

"How do I deactivate my AWS services, especially when I have a member account still active. The member account in the organization is no longer in our business and she does not know her username and password to re-enter into the account. Please advise me on what we can do.FollowComment"

Answer: 0Organization cannot be deactivated when there is an active member account in the organization. The options are to open support case to regain root access and close the account. You can also attempt to close the account from the organization console if All-features are enabled.https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_close.htmlCommentShareFrank_Ranswered 24 days ago


Question: AWS Client VPN timeout

A customer is looking for a solution to manage the idle session timeouts with AWS Client VPN.  Any pointers will be highly appreciated.ThanksFollowComment

Answer: "0Accepted AnswerThe maximum timeout on CVPN is 24 hours. The CVPN connections will reset after this period. Customers should not use Client VPN service for long lived tunnels. ClientVPN does not support long-lived VPN tunnels. They should design/tune the application to detect timeouts faster and periodically re-establish the connections every 2 or 3 hours.If they have a requirement to use long lived sessions, they should opt for site-to-site VPN connection. If they would like to tune existing CVPN setting they can add the following in their .ovpn client config filereneg-sec 0keepalive 1 120CommentSharejkapsanswered 3 years ago"


Question: Does anyone else have trouble downloading the RDS CA Bundle file from S3 on a CodeBuild job?

"We have a CodeBuild jobs that connect to our RDS databases using TLS.  For that we need to grab the AWS RDS CA Bundle file, which we download using curl.curl https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem --create-dirs -o $MYSQL_SSLCAEverything works fine most of the time, but every once in a while we get a SSL_ERROR_ZERO_RETURN error after it tried to download the file for 60 seconds.  If we rerun the job everything works fine.                                 Dload  Upload   Total   Spent    Left  Speed  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0  0     0    0     0    0     0      0      0 --:--:--  0:00:02 --:--:--     0....  0     0    0     0    0     0      0      0 --:--:--  0:00:52 --:--:--     0  0     0    0     0    0     0      0      0 --:--:--  0:00:53 --:--:--     0  0     0    0     0    0     0      0      0 --:--:--  0:00:53 --:--:--     0curl: (35) OpenSSL SSL_connect: SSL_ERROR_ZERO_RETURN in connection to s3.amazonaws.com:443 My question is, why is this happening?  I was under the impression that S3 was more robust than this.  Is there some problem with this request?  Is anyone else seeing this problem?  We're not even running that many CodeBuild jobs. maybe 100 / week, and I've seen this problem enough to recognize it.FollowComment"


Question: V spare center on ec2

Can we install v spare center  in ec2 instanceFollowComment

Answer: "0I assume you mean vSphere. Short answer is yes but given the amount of work involved, why not consider VMware Cloud on AWS which is already built for you.CommentShareEXPERTBrettski-AWSanswered 10 months ago"


Question: SAML "Failed to determine the state of the SSO redirect"

I have a Grafana account configured that was previously working fine. When I attempted to login recently I am receive a "Failed to determine the state of the SSO redirect" message. Any ideas on what is causing the error and unsuccessful attempts to log into Grafana?FollowComment

Answer: "0Hello,Failed to determine the state of the SSO redirect error usually occurs while signing into Amazon Managed Grafana workspace using a SAML IdP. Kindly note, when a user try to login and the authentication is successful at SAML IdP side, the SAML IdP will send a SAML Assertion file to AMG, and AMG will parse the incoming SAML assertion from SAML IdP to use the attributes within the "AttributeStatement" tags for identifying the user access level.Thus, the above error usually occurs due to :-Single sign on URL in your IdP is not setup correctly i.e. ACS / Redirect URL is not correct.SAML Assertion Response received from IdP do not contain the required attributesSAML Assertion Response not following UTF-8SAML IdP's certificate expiredAs you already mentioned that the setup was working fine previously but started throwing the errors recently. It could be possible due to SAML IdP's certificate expired. However, it is also possible that the SAML IdP application might have been modified.Thus, please verify your SAML IdP setup according to SAML Setup documentation, and also ensure the certificate is not expired.If the suggestions above do not help resolve the issue, we might need to troubleshoot based on your configurations. Could you please create a support case, so we may discuss details on your resource configurations?Please do not post any sensitive information over re:Post since this is a public platform.As always, feel free to reach back with any further questions or concerns in the meantime!CommentShareSUPPORT ENGINEERMounika_Kanswered 8 months ago"


Question: Migrate Specific records from RDS to S3

"Hi,I have a use case where have to periodically check and archive some years old data from RDS to S3. Also hard delete from RDS later. Can i leverage DMS here as i need to query data by timestamp after an interval or will need to write a custom lambda ?FollowComment"

Answer: "0Hi, DMS will allow you to export to S3 data that is updated by your application at the moment of this update.It seems that your use case is different.Our ETL service Glut seems more appropriate to what you want to do: check it out at https://aws.amazon.com/glue/CommentShareDidier_AWSanswered a month ago0i think your scenario fits as per the aws blog https://aws.amazon.com/blogs/database/archiving-data-from-relational-databases-to-amazon-glacier-via-aws-dms/CommentShareAWS-User-8174525-subhashanswered a month ago"


Question: AWS DMS validation fails if multi-column primary key contains boolean column

"I am trying to migrate data from an on prem SQL Server DB to Postgres Aurora using AWS DMS. The data migrates just fine, but for tables that have a boolean column in the primary key, during validation it fails with the following error:[Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Statement(s) could not be prepared.Upon checking the logs on the Postgres side, I find this:ERROR: invalid input syntax for type boolean: "" at character <number>STATEMENT: SELECT cast ("pcode" as varchar(6)) , "other_columns" , "boolean_column" FROM "db"."table" WHERE ((("boolean_column" = ' ' AND "pcode" > 'L7L3V9') AND ("boolean_column" = ' ' AND "pcode" <= 'L8L4E8'))) ORDER BY "boolean_column" ASC , "pcode" ASC During validation, it's fetching the records from the postgres in batches, and for each batch it uses the wrong value for the "bolean_column" (comparing to '' - blank string). I am not sure why it's doing this, or how to influence this behaviour so that the validations will be performed successfully.The boolean column is a:bit field on the SQL Server sideon postgres side, have tried converting to (both with same validation error as above):numeric with precision 1booleanFollowCommentJitender 4 months agoCould you pls. confirm if both column  ( i am assuming table composite primary key not unique key with two column in them) not NOT NULL. You said primary key just wanted to be double sure. If one of the column is null able, validation would not be possible, it is not supported. MSSQL - BIT to Boolean seems right conversion.Share"


Question: Price items for VPC peering inter-region

What data transfer items should I consider to estimate the cost of a inter-region VPC peering? Only Data Transfer OUT From Amazon EC2 To Another AWS Region?FollowComment

Answer: "0Accepted AnswerYes - the customers will be charged only for data transfer out. From in the docs: "Data transferred across Inter-Region VPC Peering connections is charged at the standard inter-region data transfer rates." [https://aws.amazon.com/about-aws/whats-new/2017/11/announcing-support-for-inter-region-vpc-peering/]Also, Inter-region VPC peering is now available globally: https://aws.amazon.com/about-aws/whats-new/2018/02/inter-region-vpc-peering-is-now-available-in-nine-additional-aws-regions/CommentShareAWS-User-2843108answered 5 years ago"


Question: Using CodeArtifact with AWS Greengrass

"We have a few AWS Greengrass components written in Python. These are currently being installed using the Install lifecycle in the component recipe. The components have a few external dependecies that are being installed using pip. Originally these dependencies were installed directly from pypi.org but we have moved these to be hosted in CodeArtifact instead (where we also have a few internal Python packages that we use). Since CodeArtifact requires an authorization token when configuring pip, we wrote a small Python script which obtains the token using the boto3 API which is then used to configure pip according to these instructions: https://docs.aws.amazon.com/codeartifact/latest/ug/python-configure-pip.html. The IoT policy used by the Greengrass device has the necessary privileges to download packages from CodeArtifact.This seemed to work fine, but know we have discovered that sometimes (during e.g. a reboot of the Greengrass serviec), the token cannot be obtained in time for the installation lifecycle. The reason seems to be that the aws.greengrass.TokenExchangeService has not yet launched - we have specified this component as a dependency, but the dependencies appear to be only for the Run part of the lifecycle, not the Install phase. The only workaround we have found so far is to move the package installation commands to the Run lifecycle instead - then the aws.greengrass.TokenExchangeService is up and running. But this doesn't seem to be the "correct" way.Is there another recommended way to use CodeArtifact with Greengrass to make this work in a better way? Or is it possible to specify the aws.greengrass.TokenExchangeService as an installation dependency somehow?FollowComment"

Answer: "0Accepted AnswerTES is not available during install phase. You should install simply run the installation steps during run. If the dependencies are already installed then it won't take any time.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 3 days agoerikf 2 days agoOk, then it was like we suspected - thanks for the input.Share"


Question: How to point a new instance with a domain?

"how can i point a new instance with a domain which is already exist with another ip address in hosting zone? Is that even possible?FollowCommentGK a year agoHello your question is not clear for me, Can you please explain in detail ?ShareAWS-User-9592127 a year agoBy mistake i had lauch an instance in different region and for that i have been charged $8.40, i have stoped that instance and i also lauch a new instance in local region as per free tier user terms. So my question is shall i need to connect the new instance status with the domain (ip address) if yes than i can i do that?Share"

Answer: "0Helloas far as I understand that you are trying to access the Ec2 instance with an IP address or Domain with the existing Ec2 instance or IP, Please look into the following information in detail.When you create an EC2 instance in Public Subnet AWS will automatically create a PUBLIC IP address or PUBLIC DNS for the Ec2 instance, so in any case, if you stop and start the machine your public Ip will be LOST, in order to have the static IP Adress, you can use ELASTIC IP address and associate this address to the Ec2 instance. In any case, instance have some problem you can easily disassociate and re-associate with another instance very quicklySo AWS Ec2 instance public IP or public DNS cannot be static it is dynamic **it is not possible to associate with another ec2 instance **https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.htmlI hope i answered your questions. Thank YouCommentShareGKanswered a year ago"


Question: How to create parent policy that limits permissions of child policies it creates

"The context: I am Account A. In my master/parent policy that I am given, I will be able to create, update, and delete policies/roles AND other infrastructure resources in Account B.The goal: I want to craft this master policy to be able to manage ONLY the resources I have created.NOT the problem: trust relationships, external ids, confused deputy, getting access to Account B etcIS the problem: I don't know of a way to enforce that all child policies that I create must also have all of the conditions that the parent policy has. Therefore, a child policy could be created which much greater permissions than the parent policy, defeating the purpose of limiting access to only the resources I have created.CLARIFYING SCENARIO: I could, in the master/parent policy giving access to Account A, provide the condition that all resources, child policies, child roles, etc in Account B MUST be created with tags and MUST have the tags to be updated or deleted. HOWEVER, while I can create policies that say, have that tag, I do not know of any way to enforce that THOSE child policies must ALSO include the EXACT SAME condition that they too can ONLY create/update/delete tagged resources.How might parent policy conditions be enforced in all child policies such that nothing created could have greater permissions than the creator? If this doesn't exist, it seems like a massive oversight in permissions management in AWS.FollowCommentpranjali 8 months agoYou can may be attach an SCP at the org level that explicitly prohibits actions that you don't want users and roles in certain accounts to perform.Share"

Answer: 0Accepted AnswerI would recommend using IAM Permissions boundaries.  They are an extra set of permissions that can be applied that can set max permissions for an IAM entity.See https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.htmlCommentSharerePost-User-8954329answered 8 months ago0You can may be attach an SCP at the org level that explicitly prohibits actions that you don't want users and roles in certain accounts to perform.CommentSharepranjalianswered 8 months ago


Question: Model for Amazon Comprehend sentiment analysis

Is it known to the public what type of model Amazon Comprehend uses for text classification? Either in the case of the built-in model or when training a custom model?Thanks?FollowComment

Answer: "1Accepted AnswerNo, this is not information that is shared publicly. For what it's worth, this information is not even shared internally outside the Comprehend team ;)Cheers, HeikoCommentShareHeikoanswered 7 months ago"


Question: A few questions regarding AWSEC2-CloneInstanceAndUpgradeWindows

"Hello,I'm nervously about to upgrade my Ec2 server from 2012R2 to 2019 via the AWSEC2-CloneInstanceAndUpgradeWindows "Simple Execution" functionality and have a couple of questions that weren't clear to me from the documentation I could find.First, I'm running SQL Server Express locally on my Ec2 instance.  I assume I need to stop any sites using it while the upgrade is going on so that there's no data loss due to the upgrade?  Is there any best practices to follow for this particular situation?I assume the new instance will retain the same IP address just like before?Will the newly upgraded instance start on its own automatically?  Basically is there any additional steps I need to perform after the upgrade has finished?FollowComment"

Answer: "0So my main question on this is what exactly happens after the upgrade.  Is the original VM just automatically replaced or do I need to manually point my public IP to the converted instance?  The documentation isn't clear on this.Edited by: motohead400 on Jul 19, 2021 6:14 AMCommentSharemotohead400answered 2 years ago0Hi there, hope you are doing well!I see that you would like to understand how the document ‘AWSEC2-CloneInstanceAndUpgradeWindows’ operates. Please find your queries addressed below.The document ‘AWSEC2-CloneInstanceAndUpgradeWindows’ basically creates an Image (AMI) of your instance -> launches a temporary instance with it -> performs upgrade on the temporary instance -> Creates an image from the temporary instance after upgrade for you to use [1]. Now to answer your queries,“First, I'm running SQL Server Express locally on my Ec2 instance. I assume I need to stop any sites using it while the upgrade is going on so that there's no data loss due to the upgrade?”While running the document, you may choose the NoReboot option. This will tell the document execution not to reboot the instance during the first image creation process.However, when you get the final upgraded image. You will need to launch a new instance with that image, which will serve as a replacement to the original instance. For this, you will need to switch the application to the new instance which will cause some downtime. Thus, I would recommend that you schedule the switching over to the new instance accordingly.“I assume the new instance will retain the same IP address just like before?”The document will generate an image (with upgraded OS) as the output. You will need to create the new instance manually using the image.If you want the new instance to have the same private IP as the existing one, you will need to first terminate the original instance so that you can use its private IP on the new instance.If your existing instance has an Elastic IP attached, you can detach the Elastic IP and attach to the new instance.“Will the newly upgraded instance start on its own automatically? Basically is there any additional steps I need to perform after the upgrade has finished?”No. The upgraded instance will need to be launched automatically using the AMI generated by the document.“Is the original VM just automatically replaced or do I need to manually point my public IP to the converted instance?”The original instance remains untouched and you will manually need to create the upgraded instance from the image.You will also need to detach the public Elastic IP from the existing/original instance and associate it with the new instance.I hope I was able to address your queries to the fullest.Have a great day!Reference:[1] https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-awsec2-CloneInstanceAndUpgradeWindows.htmlCommentSharenarendraAWSanswered 2 years ago0Thank you that's exactly what I needed to know.CommentSharemotohead400answered 2 years ago"


Question: AWS Error while assigning Roles

I am wondering about the significance of roles while creating any service into AWS IoT.It always asks to create roles. I appreciate if you give some solution upon what is roles and when to create and assign while using AWS IOT Service?FollowComment

Answer: "0Hi hIOTron,Apologies for the late reply -Roles are necessary so that AWS IoT can access required resources on your behalf. For example, with an appropriate role, AWS IoT Rules Engine can send data to an S3 bucket in your account.This link: https://docs.aws.amazon.com/iot/latest/developerguide/iot-create-role.html gives you a great overview of how to create a role that AWS IoT can you use to access your resources.See also - https://docs.aws.amazon.com/iot/latest/developerguide/pass-role.html - Access to "Pass" your role to another IoT service (e.g Rules Engine)Hope this helps!RyanCommentShareAWS-User-5135715answered 4 years ago0Thanks a lot, it was really helpful.CommentSharehIOTronanswered 3 years ago"


Question: Error establishing SSH connection to your instance.

I can't connect to my EC2 instance after attaching a new volume (from a snapshot).  Please advise.  Thank you.FollowComment

Answer: "0Hi, @OnFleek.You should refer to the following article to get the detailed error message and troubleshoot.https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-ssh-troubleshooting/?nc1=h_lsOnce you know the cause, use the serial console or EC2 Rescue to solve the problem.CommentShareEXPERTiwasaanswered 8 months agoOnFleek 8 months agoLinux instance.  I am following these instructions and everything is looking fine.  The original problem accessing my site happened when I attached a new volume to it.  It was during that troubleshooting that I discovered that I could no longer connect to my instance.  Could they be related?Shareiwasa EXPERT8 months ago@OnFleek.Yes, I think they are related.Please share the error when connecting.Share0"Error establishing a database connection" when trying to access site."Failed to connect to your instance. Error establishing SSH connection to your instance. Please wait and try again later." when trying to connect to my instance.CommentShareOnFleekanswered 8 months ago"


Question: How to upload large Excel file into Quicksight?

Customer is ingesting excel files into Quicksight.  According to Creating DataSet from Excel the max file size is 1GB and there are limits on number of columns and column size.I'm looking for a strategy to handle large files.  take for example a 10GB excel file.Break into smaller files and upload each file independently into QuicksightUpload smaller files into S3 and then into QuicksightUpload large file into RDS and then into Quicksightother option?FollowComment

Answer: "1Accepted AnswerHere is a great blog post around ingesting excel data into QuickSight. It most aligns with your 2nd option. Put excel file into S3, convert file type, map the file to a Glue Table, then use Athena to bring the data into QuickSight.https://aws.amazon.com/blogs/big-data/ingest-excel-data-automatically-into-amazon-quicksight/CommentShareAWS-User-2013569answered 2 years ago"


Question: How to combine CFT resource lists for the SecurityGroupIds property of EC2::Instance?

"We're creating several instances via CloudFormation that will each have multiple security groups attached:  one SG that's created in the same CFT stack along with its instance (so that each instance has its own unique SG), and then two or three more pre-existing SGs entered as parameters during stack creation.The instance-specific SG gets created but nothing else done to it during stack deployment; it gets programmatically accessed later, we're just putting in place for now:Resources: UniqueAndSpecificSecurityGroup:  Type: AWS::EC2::SecurityGroup  Properties:    VpcId: !Ref TheVPCWhereIt'sGoing    GroupDescription:  something meaningful and profound here    Tags:    ....That part works fine.Getting the list of existing SGs is straightforward, as we haveParameters:  ExistingSGList:    Description:  again, our descriptions are pure poetry    Type: List<AWS::EC2::SecurityGroup::Id>    # can't do Default entries unless the type is a CommaDelimitedListThis gives a dropdown list showing all the SGs in the account.  (Sadly, there's no way to programmatically restrict the list to only the SGs that actually exist in the same VPC where the instance is being created.  Life is hard.)  The architect deploying the stack can select the combination of security groups they want for this group of instances.  That part also works fine.The trouble comes when we try to apply both the single created SG, and an arbitrary list (only a few total, obviously, since the limit of #SGs that can be attached is small, but the combinations of available SGs is considerable) when creating the actual instance:Resources:  InstanceBeingCreated:    Type: AWS::EC2::Instance    Properties:      SecurityGroupIds:        - !Ref ExistingSGList        - !Ref UniqueAndSpecificSecurityGroupThat fails, because CFN hates the list-of-lists.  YAML doesn't seem to have a standard way of "flattening" the list, or adding another entry to it; if it does I would love to learn the syntax.I also tried repeating the properties, in the hope that they would accumulate:      SecurityGroupIds:        - !Ref ExistingSGList      SecurityGroupIds:        - !Ref UniqueAndSpecificSecurityGroupCFN was fine with that, but silently replaced the first property with the second; the instance gets deployed with only the last one.  Okay, not surprising.Is there some kind of !Join invocation that will let me expand the arbitrary list, add the other unique SG, and then glom them back together into one list that I can give to SecurityGroupIds?  I'm familiar with the Join function, but have very little experience trying to manipulate YAML arrays.FollowComment"


Question: RDS cluster snapshot copy events

"With the regular DB snapshots there are copy events being fired, why are those not firing for cluster DB snapshots being copied?https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.Messages.html#RDS-EVENT-0059FollowComment"


Question: Is deployment mandatory for Grreengrass V2 to work on GGC device?

"Hello,I am interested in understanding if GGC device once provisioned in field with Greengrass V2 can be updated/deployed offline withouth really needing to connect to AWS Greengrass Service in cloud.Background:Greengrass V2 has only Nucleus component to be mandatory, which can be installed manually.And Greengrass V2 provides a local deployment way for all other components deployment.Reference:  https://docs.aws.amazon.com/greengrass/v2/developerguide/test-components.htmlIn addition and as a difference to Greengrass V1, all configurations, subscription settings in V2 are part of the component deployment itself in form of receipes,So, is Greengrass Deployment from AWS Greengrass cloud service mandatory in Greengrass V2?Thanks,AkhileshFollowComment"

Answer: "0Hello Akhilesh,Thank you for trying out Greengrass V2. It is entirely possibly to use Greengrass V2 without ever connecting to the Greengrass cloud service by just using the local Greengrass V2 CLI. The easiest way is to install the CLI by using a cloud deployment, however it is feasible to add it without that, just not as easily.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hi Michael,Thanks for your reply, it helps.CommentShareAkhileshanswered 2 years ago"


Question: Moving resources between AWS accounts

"We have a number of EC2 Linux instances running in a legacy AWS Account in a different OU.  Our plan is to create a Linux AMI, and move those to a new OU/AWS Account.  VPCs, and Security Groups have been replicated to the new AWS Account.(1) What's the recommended method to move these instances?  (2) Some of them have elastic IPs; can they be retained?FollowComment"

Answer: 0Your method of moving the instances is correct - you create a snapshot of the existing instance; convert it to an AMI; share it with the new account.Elastic IP addresses can be moved between accounts. You will need to create a support ticket in both accounts for the request.CommentShareEXPERTBrettski-AWSanswered 10 months agoEXPERTChris_Greviewed 10 months ago


Question: RDS Backup & Restore SP Failing with Error - Provided Token Is Expired

"We had scheduled, daily auto back-up of our SqlServer Db on RDS, to S3 bucket for at least last 6 years. It was working fine since then. Suddenly it stopped working, which means we don't see any Backup in our S3 bucket since 24th March. Up on diagnosing the problem, we realized that it is failing since then and the error isSTEP1exec msdb.dbo.rds_restore_database@restore_db_name='RestoreDbFromS3',@s3_arn_to_restore_from='arn:aws:s3:::awsbucketName/SqlServerDb.bak';STEP 2exec msdb.dbo.rds_task_status @task_id=7;Response indicates Error with following Task Description[2022-05-28 12:51:22.030] Task execution has started.[2022-05-28 12:51:22.237] Aborted the task because of a task failure or an overlap with your preferred backup window for RDS automated backup.[2022-05-28 12:51:22.240] Task has been aborted[2022-05-28 12:51:22.240] The provided token has expired.We studied a lot to identify the root cause and solution but could not find anything accurately relevant.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.html#SQLServer.Procedural.Importing.Native.Troubleshootingabove link shows troubleshooting options as per the error responses, but this does not include the error response that we are getting.Note: between 25th & 26th March, our aws instance was suspended for couple of hours due to delayed payment of monthly invoice. we restored the same quickly. Everything on the same aws account is working fine since then, but we just found out that db backup service has impacted as we see the last successful backup available in S3 bucket is of dated 24th March.We suspect that some token has expired up on account suspension, but are unable to identify which one and how to restore the same back to normal.Help, Assistance and Guidance would be much appreciated.FollowComment"

Answer: "0HiI understand that your automated back-ups on RDS to S3 bucket stopped backing up your data after the 24th of March as your account was suspended for a few hours.It could be that when your account was suspended, your resources were also stopped and as a result, your IAM role might be still holding on to the cached credentials before the account suspension. You may refresh the IAM credentials[1] to release the cached credentials and see if that would solve the issue at hand. Please also see this documentation [2] on troubleshooting sql server backup issues. You may also consider reaching out to AWS Premium Support to have them look into your issue.Reference:[1] https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html[2] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.htmlI hope this information would be helpful to you.CommentShareWinnieanswered a year ago"