Question: how to auto deploy an updated greengrass component

"Hello,I have a greengrass deployment for just a few of my dev machines.The deployment has a few greengrass components in it:  say A, B and CWhen i build a new greengrass component for B for example, I auto bump the version and publish it to greengrass usingaws greengrassv2 create-component-version --inline-recipe fileb://${PROJ_ROOT_DIR}/receipes/receipe.jsonwhich works well, but i would like to automate the auto deployment of the existing deployment with the latest version of the component as well.Is this possible ? and if so , how?I found https://docs.aws.amazon.com/cli/latest/reference/greengrass/create-deployment.htmlbut it doesn't talk about how to update the deployment to the latest version of BFollowCommentJoeAtAWS 9 months agoFYI you've referenced our Greengrass V1 create deployment API, which doesn't have the concept of a component. For V2, we have a similar API.https://docs.aws.amazon.com/greengrass/v2/developerguide/create-deployments.htmlShareGreg_B EXPERT9 months agoNice catch Joe. I'd upvote your comment if I could.Share"

Answer: "1Accepted AnswerHi clogwog. You can achieve it by making a call to get_deployment, modifying the result with the new component version, and then calling create_deployment.An example, using boto3, here: https://github.com/awslabs/aws-greengrass-labs-component-for-home-assistant/blob/main/deploy_component_version.pyIn that example, the component has dependencies on the Secret manager component and the Docker application manager component, which is why they're mentioned in the code.CommentShareEXPERTGreg_Banswered 9 months agoclogwog 9 months agoThanks Greg !looks like we will switch to python for this bit.Cheers,TomShareclogwog 9 months agoI notice that the search starts by searches for the latest deployment of a particular device.response = greengrassv2_client.list_deployments(            targetArn=thing_arn,            historyFilter='LATEST_ONLY',            maxResults=1        )We have devices with multiple deployments, so i can't assume that the latest deployment is the correct one to update.The list-deployments aws cli (https://docs.aws.amazon.com/cli/latest/reference/greengrass/list-deployments.html) seems to take a group-id not a Target-Arn of a thing ?--group-id (string) The ID of the Greengrass group.or is this a different list-deployments call ?or is that a greengrass v1 group ?Shareclogwog 9 months agoah... https://docs.aws.amazon.com/cli/latest/reference/greengrassv2/list-deployments.htmli seeShareGreg_B EXPERT9 months agoHi Tom. Yes, depending on your deployments, you will need some different logic on the listing to find the right one to get and modify.Share"


Question: How to point my namecheap domain to my EC2 intance

"So far I found my way to Route 53 and it is probably what I need to use. So I found my way to a page called hosted zones and created a new Hosting zone, it asked for a domain name and i used the domain name I bought from Namecheap let us call it example.com. Continuing from there I saw that some record sets were already created one with the type "NS" and another with the type "SOA" I thought that the four NS values I got might be the ones I needed to connect to my Custom Namecheap DNS. I did so and waited a day and now and still nothing has happened. I have a feeling I am doing something wrong, which is why I ask for help now.FollowComment"

Answer: "0Accepted AnswerHi,I just realized that you didn't mention creating any records of your own in your Route 53 hosted zone. That's how you specify that you want to route internet traffic for your domain (for example, artonn.com) to your resources. For information about creating records, see "Working with Records":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/rrsets-working-with.htmlIf you're using an Amazon EC2 instance, see "Routing Traffic to an Amazon EC2 Instance":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-ec2-instance.htmlScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0Hi,Based on your description, you've taken the correct steps to make Route 53 the DNS service for the domain that you registered with Namecheap. It can take a couple of days for a change of DNS service to take effect because DNS resolvers typically cache your name servers for two days. For an explanation of how this works, see "How Amazon Route 53 Routes Traffic for Your Domain" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/welcome-dns-service.html#welcome-dns-service-how-route-53-routes-trafficScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0Hi Scott.What makes me a bit confused is, how does the route 53 hosted record that I made know to point the domain to my E3 Instance? I am running a web server on it.CommentShareArtonnanswered 3 years ago0Thank you very much for the links Scott, I will check them out.I have hear people talk about elastic ip, is that something i need to do as well?ArtonnCommentShareArtonnanswered 3 years ago0Hi,Yes, you'll want an Elastic IP address. That prevents the IP address of your EC2 instance from changing when you restart it. That's mentioned in "Routing Traffic to an Amazon EC2 Instance":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-ec2-instance.htmlScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0Perfect thank you, Scott.I have created an A record, that contains my elastic IP associated with the EC2 instance in the value. I have used the NS values for my NameCheap DNS custom record.Am I all set up now, and it is only about time before my domain name points to my server?EDIT:I just checked my url today, and I am simply getting an "Cannot connect to this website" browser error.CommentShareArtonnanswered 3 years ago0Hi,If you post your domain name, I'll take a look at your DNS configuration.ScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0Today my domain finally connected to the elastic IP. I can now access my website with the url, without problem. Thank you very much for your help, greatly appreciated.CommentShareArtonnanswered 3 years ago"


Question: Slidedeck of "Navigate data protection in the EU with AWS"

"Where can I find the slidedeck of a video of WPS203 "Navigate data protection in the EU with AWS" which was given on Friday, December 2?FollowComment"

Answer: "1Hello AWS Customer,Here's the video you want.https://www.youtube.com/watch?v=hG9k9wQbXyMI haven't been able to find it on AWS Events Content yet, but expect it to be uploaded soon.Hope you will find this information useful. Please let me know if you have any further questions or concerns. We will be more than glad to assist you.I hope you are always healthy and have a nice day.CommentShareSUPPORT ENGINEERJisoo_Kanswered 6 months ago"


Question: Consulting help to manually implement Amplify iOS client w/ CDK deployed AppSync API.  No CLI or CodeGen.

Attempting to manually implement amplify iOS client w/ CDK deployed AppSync API.  No CLI or CodeGen.Looking to hire a consultant to help with implementation guidance.Any hourly rate is fine.Please reach out to dave@mystride.com if interested.FollowComment

Answer: "0Hello,If you would like to discuss more about the implementation which would be the best fit for your environment/use case, I would suggest reaching out to an AWS Solutions Architect, as queries of this nature can be better handled by them, who can be reached via our Sales team here: https://aws.amazon.com/contact-us/aws-sales/CheersCommentShareNishant_Banswered 10 months ago"


Question: Website getting timed out error and very slow

"My wordpress website hosted in lightsail, but website very frequently website getting timed out error and its also very slow after some time getting back.FollowComment"

Answer: "0Hi,Most probably your issue is related to how much resources your VM has.It's recommended to run WordPress to have, at least:1vCPU512MB of RAMBut the catch is that this is only for WordPress, so you will need to add the MySQL requirements so I wouldn't deploy WordPress in less than 1GB of RAM if I'm managing all components.CommentSharemarianordanswered a year ago"


Question: Need on call technical help in hosting a Cisco remote VPN on AWS

"Need on call technical help in hosting a VPN on AWS. Preferably looking to host Cisco remote vpn on an instance. Please help. If a trial of 30 days or few days is provided, it would help to understand the speed/bandwidth and decide if it is suitable for our need.FollowComment"

Answer: 0This lab provides some guidance on doing what you are asking - https://catalog.workshops.aws/networking/en-US/beginner/lab2.The lab uses an EC2 instance running Cisco software to simulate 'on-prem'.  You just need to flip it and treat the office network as AWS network.CommentShareChristian Lorisanswered a month ago


Question: Can we/How to provide an array as contextual metadata on GetRecommendation?

"This is a follow up question after this Question.I am storing contextual metadata on interaction whose value is an array so it is stored as | separated string. The data stores the users licenses at the time of interaction. User may bought new licenses any time.Say, The definition of the Contextual Metadata on interaction is,{          "name": "LICENSES",          "type": "string",          "categorical": true }And the data can be "L1",  "L1|L3",, or "L1|L2|L3" etc. Where L1, L2, L3 are different licenses. Users may have any combination of them.Now I want to get  Recommendations using GetRecommendation based on that context data.  I would like to pass the current licenses user have on the Context. Can I pass the | separated string and get the desired result?For example an user has license L1 and L2,context = {      'LICENSES': 'L1|L2'    }Now my question is, can we pass context like this? And will it work? I want to show items based on the license users have.On the documentation, it never explicitly says that we can provide such categorical data in context. All the examples use a single string, not a | separated array of strings.So I am wondering if I can pass such | separated array of string on context which would work.One might suggest filtering the Items based on license. But we want to show items without filtering in our case.FollowComment"

Answer: "0Hello,Thank you for using Personalize Service.Looking at the questions you have asked along with the follow up question, I believe deeper exploration needs to be done on your use case along. To get better assistance, I'd recommend you to open a case with Premium Support Personalize team so that we can discuss more on the use case along with the implementation required for your use caseOpen a support case with AWS using the link:https://console.aws.amazon.com/support/home?#/case/createCommentShareSUPPORT ENGINEERKartik_Ranswered a year ago"


Question: [Announcement] AWS GameKit for Unreal Game Engine is now Generally Available

"Today we are releasing AWS GameKit, a new solution that allows game developers to deploy and customize game backend features directly from Unreal Engine. AWS GameKit comes with AWS CloudFormation templates for each feature that follows AWS Solution Architect designs. AWS GameKit also comes with an integration code between the game backend features and Unreal Engine. AWS GameKit is for game developers looking to build AWS-powered game features directly from Unreal Engine with just a few clicks.With this release, developers have access to four game backend features: Identity and Authentication, Achievements, Game State Cloud Saving, and User Gameplay Data. AWS GameKit uses AWS CloudFormation templates to provision and connect all the necessary AWS resources together into a cohesive solution to power these features. Each feature follows the AWS well-architected framework to provide a secure, high-performing, resilient, and efficient infrastructure deployment that is fully customizable and runs in the developer's own AWS account.AWS GameKit also provides Unreal Engine Blueprints, C++ code, libraries, documentation, and sample UIs for each of the four game features. The provided AWS CloudFormation templates automatically configure cloud resources that allows game developers to programmatically apply AWS best practices with common abstractions. This leads to the rapid creation of cloud-connected game features without being an AWS expert.AWS GameKit can be used to deploy cloud-connected game backend features in 17 AWS Regions where applicable, dependent on feature requirement of available AWS primitives: US East (Ohio, N. Virginia), US West (Oregon, N. California), Canada (Central), South America (Sao Paulo), EU (Ireland, London, Paris, Frankfurt), Europe (Stockholm), Asia Pacific (Tokyo, Seoul, Mumbai, Singapore, Sydney), Middle East (Bahrain).Learn more and download AWS GameKit from the AWS GameKit website or our GitHub Repository.FollowComment"


Question: Will I lose my static ip on restarting lightsail ubuntu instance

There is conflicting information: some docs say your static ip will only be "saved" if you started the instance on EC2 to begin with.some say you will retain the static ip on lightsail even if you reboot it.will static ip for lightsail -ubuntu be saved for reboot ?will static ip for lightsail -ubuntu be saved for start and stop ?how can i reserve the allocated ip through both 1 and 2 above?TIAFollowComment

Answer: "0Hello,Thank you for your questions,Applies to Lightsail:We can answer 1 and 2 by quoting the official Lightsail documentation, "The default dynamic public IP address attached to your Amazon Lightsail instance changes every time you stop and restart the instance. Create a static IP address and attach it to your instance to keep the public IP address from changing"You can follow steps in docs [1] to create a static IP that does not change.Applies to EC2:For EC2 the default public IP will change on stop/start but retained during reboots, to preserve the IP during stop/starts you can attached an Elastic IP to the instance [2]Hope this helps, let me know if there is anything further.[1] https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-create-static-ip[2] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.htmlCommentShareSUPPORT ENGINEERLundianswered a year ago"


Question: Invoice cancellation due to service activation by mistake

"Good morning!We're investigating what happened, but for some reason a database service was activated in our AWS account, but it was not used and this generated a charge. We recently received an Invoice and we need help negotiating its cancellation. How shall we proceed?FollowComment"

Answer: "0In this case, you will need to submit a support case for the Billing service to discuss options.CommentShareAWS-User-1005068answered 3 months ago"


Question: Reserved CIDR range in a Subnet

"Customer wants to reserve a CIDR range from the CIDR of a subnet. They want to keep the CIDR for private use, and the IPs in the CIDR can't be auto assigned when running instances with auto assigned private IPs.An example, there is a subnet with CIDR 10.85.0.0/18, the customer wants keep 10.85.1.0/24 for other use, that means when running run-instances in this subnet, the EC2 instances shouldn't auto get a private IP from the reserved CIDR 10.85.1.0/24.Do we have this feature or workaround for this requirement?FollowComment"

Answer: "0Accepted AnswerAlthough it's a little ugly, one option would be to create ENIs with specific IP addresses that should be in their reserved range. They can automate this using the "create-network-interface" EC2 API so it wouldn't be difficult. They should tag the ENIs that are "holding" IP addresses so that it is obvious what they are doing.CommentShareEXPERTBrettski-AWSanswered 3 years ago"


Question: AWS Rekognition timeout error happening randomly

"I have an application in Electron that does facial recognition of people to then decide whether or not they can enter the place and for that I'm using Amazon Rekognition.Everything was working fine (for a few months) until, two days ago, a customer reported to me that the app was behaving strangely, like it wasn't responding to requests for facial recognition.After several tests, I discovered that what is happening with it is a timeout error, which occurs in all API calls, whether they are looking for faces (SearchFacesByImage) or registering new faces (IndexFaces).The error says:{    "message": "connect ETIMEDOUT 3.226.60.54:443",    "errno": -4039,    "code": "TimeoutError",    "syscall": "connect",    "address": "3.226.60.54",    "port": 443,    "time": "2022-12-14T13:50:10.909Z",    "region": "us-east-1",    "hostname": "rekognition.us-east-1.amazonaws.com",    "retryable": true}What intrigued me was the fact that everything was working fine, until this behavior just started happening (and I didn't make any code changes/updates to the app running on my client's computer).And what makes me even more intrigued is that this behavior occurs completely randomly and only on the machine of that client in question. Sometimes the API calls work correctly (returning whether the person was recognized or not), but most of the time, the calls take about 90 seconds to return the timeout error. When executing the same code on my machine (same methods and same CollectionId) everything runs normally and there was no timeout error at any time - while at the exact same moment on my client's machine the behavior continues.I was using aws-sdk and then switched to @aws-sdk/client-rekognition (thinking that could solve the problem) but the code only worked on a few of the first calls to the API and a few minutes later it got the timeout errors again.The code I'm using to configure and make calls to Rekognition is basically this:const { RekognitionClient, IndexFacesCommand, SearchFacesByImageCommand } = require('@aws-sdk/client-rekognition')const rekognitionClient = new RekognitionClient({    credentials: {        accessKeyId: 'accessKeyId',        secretAccessKey: 'secretAccessKey'    },    region: 'us-east-1'})const registerFaceOnRekognition = async (bytes, userId) => {    const params = {        CollectionId: 'collectionId',        Image: { Bytes: bytes },        ExternalImageId: userId,        MaxFaces: 1,        QualityFilter: 'HIGH'    }    const command = new IndexFacesCommand(params)    try {        const { FaceRecords } = await rekognitionClient.send(command)        if (!FaceRecords.length) {            console.log('No faces detected.')            return        }        console.log('Face created:')        console.log(FaceRecords[0].Face.FaceId)    } catch (error) {        console.error(error) // timeout error    }}const searchFaceByImageOnRekognition = async (bytes) => {    const params = {        CollectionId: 'collectionId',        Image: { Bytes: bytes },        MaxFaces: 1,        FaceMatchThreshold: 99,        QualityFilter: 'HIGH'    }    const command = new SearchFacesByImageCommand(params)    try {        const { FaceMatches } = await rekognitionClient.send(command)        if (!FaceMatches.length) {            console.log('This face has not been registered yet')            return        }        console.log('Face found:')        console.log(FaceMatches[0].Face.ExternalImageId)    } catch (error) {        console.error(error) // timeout error    }}// Method called through the renderer process that has a canvas where the webcam view is reproducedconst onTakePicture = (event, data) => {    const bytes = Buffer.from(data.dataURL.replace('data:image/jpeg;base64,', ''), 'base64')    // If there is a userId, register the face in the image    if (data.userId) {        registerFaceOnRekognition(bytes, data.userId)        return    }    // Else, search for the face in the image    searchFaceByImageOnRekognition(bytes)}Just remembering that: during all tests on my client's computer the internet connection was stable and working properly.What is the best way to investigate and resolve this issue?FollowComment"

Answer: "0Hi Igor Remas,Sharing more information would help us to look further into your issue. Can you open Support case and provide account id, region, collection and time when you experienced timeouts?https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlCommentShareAWS-Artemanswered 5 months agoIgor Remas 5 months agoRight! I will open a support case. Anyway, I enabled debug logs and they can be found at:  https://gist.github.com/IgorSamer/4e58e09f3fa615401f85ca325b794245In it, the first three requests (2022-12-16T13:48:45.932Z, 2022-12-16T13:53:20.325Z and 2022-12-16T14:19:12.479Z) occur normally. However, all other consecutive requests start to give the timeout error, where, in fact, no data is returned after the [DEBUG] App: endpoints Resolved endpoint: step.From yesterday until now, my dashboard has already received this timeout error 58 times and as previously mentioned the internet connection was working fine. I could managing to reproduce the error via remote access too, that is, the machine was the internet okay.Share"


Question: Upgrade AWS Aurora Cluster MySQL from 5.7 to 8.0

"Hi, I have to upgrade Aurora Cluster MySQL from 5.7 to 8.0, with DMS I can't migrate JSON fields from some table. I try to config external replication, but, after take snapshot and restored to version 8 cluster, when i try to call mysql.rds_set_external_master i get error "Failed purging old relay logs: Failed furing log reset" and start replication doesn't work.Edit: When one of the AWS command (like mysql.rds_set_external_source) fails or has some problems, all of the similar functions fail with the error above. I solved the situation with rebooting the replica instance.FollowComment"


Question: Attempting to programmatically replace file results in "No response body" (C++)

"In my C++ project using the S3 API, I have a function that boils down to something like this:void replaceFile(const std::string &key, const std::string &filePathToUpload, std::function<void (const Aws::S3::Model::PutObjectOutcome &)> successCallback, std::function<void (const Aws::S3::Model::PutObjectOutcome &)> failureCallback){Aws::S3::S3Client client;Aws::S3::Model::PutObjectRequest req;req.SetBucket("name of my bucket");req.SetBody(std::make_shared<std::fstream>(filePathToUpload));req.SetACL(Aws::S3::Model::ObjectCannedACL::public_read);req.SetKey(key);if (auto outcome = client.PutObject(req); outcome.IsSuccess())successCallback(outcome);elsefailureCallback(outcome);}Basically, I want to replace files that I have already uploaded. (I suppose I could really just re-upload the file; I hadn't thought about that till now. However, the upload function has the same problem.) Unfortunately, this function won't work. It sends data to AWS but ends up with an error "No response body." This error is HTTP 400 and has the internal error code 100 for Aws::S3::S3Errors::UNKNOWN. I checked the SDK issue list for issues involving this error message and found a few that looked similar, but they all involved HEAD, not PUT. Is the SDK doing a HEAD request behind my back? Am I missing something? What is wrong?I'm running this on openSUSE Tumbleweed with SDK version 1.9.180 (OK, OK, I'm using master main, but that's the same thing).Thanks in advance.FollowComment"

Answer: "0Accepted AnswerI solved my own problem: the file path I sent to std::fstream was null, so AWS wasn't receiving any data.CommentShareLorenDBanswered a year ago"


Question: Can we send email notifications from SNS using our own domain?

"Can someone please confirm if it's possible to send email notifications from SNS using our own domain (instead of sns.amazonaws.com) if we have the MAIL FROM validated in SES?I don't see that working so I'm not sure if there is still something wrong in my setup, or it's just that SNS always use aws domain no matter what its in SES configured... In SES, I have everything working and I'm able to send emails using my own domain, but SNS is still using aws domain when sending notifications.ThanksFollowComment"

Answer: "0Accepted AnswerNot directly. You can write a Lambda function to be a subscriber to the topic, and it can use SES to send from your verified domain. You would have to build your own opt-in/opt-out process, as well.CommentShareJesse_Tanswered a year ago"


Question: Sagemaker Studio -Land cover segmentation - unable to upload geojson

"I went to geojson.io and selected a rectangle over a random area on the map. I then downloaded the geojson and uploaded it to Sagemaker's Studio's spatial - Land cover segmentation portal. I then received the following error:"Invalid GeoJson formatUploaded file cannot be a Feature or Feature Collection GeoJson. Please upload a GeoJson with a 'type' of 'Polygon'"How else can I pick a piece of land from anywhere on the globe and feed it to sagemaker studio, if not with geojson.io? thanksFollowComment"


Question: PCIe device passthrough on bare-metal EC2 instances

HiI am trying to run some experiments which require passing one or more of the local NVMe SSDs on a bare-metal EC2 instance into a VM. I am running Linux as the host OS and would normally leverage kvm and vfio-pci to get this done. On my EC2 instance however I see no IOMMU groups or vfio kernel module. I have heard that PCIe passthrough is possible on EC2 bare-metal. Can I get some details on how to do that? I would prefer to use Ubuntu 22.04 as my bare-metal OS but if I need to use something else Linux based I can.ThanksStephenFollowComment

Answer: 0As an update I have tried adding intel_iommu=on to my GRUB and rebooting. That causes my instance to hang! So I suspect some very nasty interaction between the AWS Nitro system and the Intel IOMMU is occuring?CommentSharesbates-nvmeanswered 9 months ago


Question: Access denied when trying to GET objects uploaded to s3 bucket via aws sdk using cloudfront

"Using client-s3 sdk signed URLs, i was able to PUT and DELETE objects in my s3 bucket. But when trying to access those same objects using a GET request via cloudfront, s3 denies me access (Access Denied) to the objects. On the permissions section of the bucket, i set the bucket policy to allow GET requests from my cloudfront distribution. I know it works because when i upload objects via the s3 console, i can use cloudfront signed URLs to GET the objects from s3, that works. But once i programmatically use the client-s3 to upload the object, i am unable to GET it using my cloudfront distributionFollowComment"

Answer: "1If I understand correctly, from the same bucket and using the same cloudfront distribution, you were able to get objects you uploaded in console, but not the objects you PUT through pre-signed URLs generated using SDK?  If that's the case, you may want to check 1.  Is the client generating the URLs under the same account as the bucket owner  2.   You are not specifying KMS encryption in generating the URL  3.  Are you setting any ACLs using header or querystring in PUT request?    You can verify by checking the SSE and Permission (Owner/ACL) of the objects you got Access Denied.CommentShareBo_Ganswered a year agoInfinityString a year ago@Bo_G Yes, I am pretty new to aws. But from what i understand, the client is generating the URL under the same account as the bucket owner, if it wasn't i wouldn't be able to access the objects uploaded via the s3 console from the client. Since it works for that case, i dont think thats the issue.I don't know anything about KMS encryptions, but according to the documentation i used, all i needed was a key pair id for a RSA public key i provided to aws and the RSA private key. Those were supplied to generate the URLI am not setting any ACLs on my PUT request, ACLs are disabled on my bucket. I went ahead to check the permissions of the object i got denied from, and only the object owner has read/write priviledges.ShareBo_G a year agoIf you compare the objects that you got access denied with the objects you uploaded from console and were able to get through Cloudfront, check the Properties -> Server-Side Encryption Settings, then compare the Permission / ACL / Object Owner canonical ID, are they all the same?Share0Accepted AnswerApparently, the issue was from how i was naming the object in the bucket. I added a timestamp in ISO8601 format to each objects' name when creating the s3 presignedUrl for the PUT request. So when cloudfront tries to access it, it changes the some of those weird characters in the date string, and as a result, s3 denies access. Because the object cloudfront is trying to access doesn't exist. Thanks for the helpCommentShareInfinityStringanswered a year ago0Assuming that your use-case is to securely fetch the S3 objects.  You first need to get the pre-signed URL and then use that pre-signed URL to fetch the S3 object.  One common way is to use an API endpoint (backed by a lambda function) that returns the pre-signed URL generated for the S3 object you want to read.  Then you'd use that pre-signed URL in your client to actually fetch the S3 object.  Hope I answered your question.CommentShareVenkat_Gomathamanswered a year agoInfinityString a year ago@Venkat_Gomatham I don't have issues generating and fetching s3 objects using the s3 pre-signed URLs. The issue i have is fetching the object using cloudfronts signed URL. The flow is, I get a pre-signed URL using the s3 sdk, i use that URL to PUT an object into s3 (that works fine). But when i want to GET that object back, i don't want to use s3 pre-signed URLs anymore for that, i want to GET the object back using cloudfront, to be more precise, cloudfront signed URLsShare"


Question: AWS MediaConvert - Job for multiple audio-only stream

"Hey there,doesn't matter which settings I try, I just can't get it work. I have several MP3 audio selectors for input and trying to get them into one HLS output group as 1:1 outputs (audio-only). What I want is an audio-only stream where I can switch between the tracks/languages. I already made this running with video but it's not working if I use the same settings and just delete the "video" parts of the job. So what I'm doing wrong?FollowComment"

Answer: "0Hi,For HLS audio-only outputs the codecs supported are AAC or Dolby Digital (AC3) : https://docs.aws.amazon.com/mediaconvert/latest/ug/supported-codecs-containers-audio-only.html.You will need to select "Container for audio-only output" in the Audio section of the Output Settings for the HLS output group : https://docs.aws.amazon.com/mediaconvert/latest/ug/setting-up-audio-only.html.Depending on the scenario you can also select "audio only variant stream" in the Audio Track Type on the same section.ThanksCommentSharePedro_Fanswered a year agoHarmonikaPuls a year agoThanks for your reply, but sadly I already tried these options but it didn't work. Selecting "audio only variant stream" depends on which scenario? Sorry for asking but there are so many options I still don't know good enough about... Is there something in the input settings I did wrong? I have my audio selectors, do I have to select any selector type (PID,Track,Language code or HLS rendition group)?Share"


Question: Device MetaData in AWS IOT core

"Can we store Device/Thing MetaData in AWS IOT core ?We have iot things that we provision using fleet provisioning. These devices have metadata associated with it and other characteristics example battery health data which can change. What is a good practice to maintain this data ?Should we use device shadows to maintain the battery health etc ? This data only flows from the device to aws and not vice versa , is the device shadow still a good place to hold the information ?How do we store the metadata associated with a thing ? We will need to retrieve this data using api's when needed.FollowComment"

Answer: "1Hi, to store data related to the device that changes over time you can use Thing Shadows. To report state you  will publish your data on $aws/thing/<thing_name>/shadow/update in the following format{  "state": {      "reported": {           "battery": 0.40      }   }}To read the data you can either use the Thing Shadow REST API GetThingShadow [1] or subscribe to $aws/thing/<thing_name>/shadow/get/+ and publish a message on $aws/thing/<thing_name>/shadow/get. [2][1] https://docs.aws.amazon.com/iot/latest/apireference/API_iotdata_GetThingShadow.html[2] https://docs.aws.amazon.com/iot/latest/developerguide/device-shadow-mqtt.htmlCommentShareEXPERTMassimilianoAWSanswered a year agoSmr a year agoThank you . And can you help me with what is a good practice to store the metadata ?Share"


Question: How to install Phyton package in Jupyter Notebook instance in SageMaker?

"Hi,I want to use awswrangler package in my Jupyter Notebook instance of SageMaker.I understand that we have to use Lifecycle configuration. I tried to do it using the following script:#!/bin/bashpip install awswrangler==0.2.2But when I import that package into my Notebook:import boto3                                      # For executing native S3 APIsimport pandas as pd                               # For munging tabulara dataimport numpy as np                                # For doing some calculationimport awswrangler as wrimport iofrom io import StringIOI still get the following error:---------------------------------------------------------------------------ModuleNotFoundError                       Traceback (most recent call last)<ipython-input-1-f3d85c7dd0f6> in <module>()      2 import pandas as pd                               # For munging tabulara data      3 import numpy as np                                # For doing some calculation----> 4 import awswrangler as wr      5 import io      6 from io import StringIOModuleNotFoundError: No module named 'awswrangler'Any documentation or reference on how to install certain package for Jupyter Notebook in SageMaker?FollowComment"

Answer: "0Accepted AnswerHi,example how to use lifecycle config to install python package in one environment : https://github.com/aws-samples/amazon-sagemaker-notebook-instance-lifecycle-config-samples/blob/master/scripts/install-pip-package-single-environment/on-start.shand to all conda env - https://github.com/aws-samples/amazon-sagemaker-notebook-instance-lifecycle-config-samples/blob/master/scripts/install-pip-package-all-environments/on-start.shCommentShareAWS-User-3214020answered 3 years ago"


Question: Lenses.io source connector plugin in MSK connect not flushing S3 files to Kafka topic

"I am using AWS MSK connect to send files from S3 bucket to Kafka topic. For this, I am using lenses.io source connector plugin: https://docs.lenses.io/5.0/integrations/connectors/stream-reactor/sources/s3sourceconnector/The connector is streaming the existing files in S3 to Kafka right after the creation. However, when more files are added in S3, the source connector is not streaming those files to Kafka topic any longer.Can someone help if I am missing anything critical on the configuration side? I can't find any documentation for S3 source connector in AWS MSK documentation. I could just get the documentation for S3 sink connector: https://docs.aws.amazon.com/msk/latest/developerguide/mkc-create-connector.html. Wondering if source connector can be used for production or not?Below is the configuration for the connectorSource connector configuration:connector.class=io.lenses.streamreactor.connect.aws.s3.source.S3SourceConnectorconnect.s3.kcql=insert into test_topic select * from test_bucket:tutorial STOREAS jsontasks.max=1topics=test_topicvalue.converter=org.apache.kafka.connect.storage.StringConvertererrors.log.enable=truekey.converter=org.apache.kafka.connect.storage.StringConverterFollowComment"


Question: AWS instance end Credentials

"Good afternoon.I want to apologize for the possibly wrong question.I am not a native English speaker and my question may be misunderstood. But I will try to ask my question as correctly as possible in order to find a way to solve it.There is a client-server application.The client has an instance.The server is in the Enclaves.In order for the client to connect to the server, the client must send a request to Credenshales.On the client, the script creates a file that temporarily creates credentials for such a connection.These credentials are copied from the server's memory and copied into this file. (temporarily)This file is then deleted.I would like to somehow protect myself and somehow encrypt this file or find an alternative SAFE solution how to bypass this process and use other tools that Amazon AWS has.Is it possible to somehow automate this process and make the transfer of credentials that the client takes from the server and inserts into its application. Because the credentials are temporarily stored unencrypted, I think this is a serious vulnerability for my application.It is enough for me to give an idea to solve my problem. Then I'll try to figure it out myself.AWS contains a fairly large amount of materials and it is very difficult to find the right topic. I am sure that in his tools he will be able to offer a solution to my problem.Thanks.FollowComment"

Answer: "1I'm not sure there is a good answer to your question (but I hope that someone else has something better than what I'm offering).It's not clear what risk you're trying to protect against other than not storing the credentials in clear text.One possible risk is that someone might be able to copy the disk image that the instance is running and extract the previously written file from that image. You can protect against some of that risk by encrypting the volume. However, an attacker with a level of permission to use the AWS console (or APIs) to make a copy of the disk will probably also have access to the encryption key as well.Another risk is that there is a malicious process on your instance that can scan the disk to look for unencrypted credentials. Or might be able to read the file while it exists. Here, disk encryption is not going to protect the data because the disk encryption is transparent to the instance so all processes can read and write files according to their permissions in the instance.Similarly, a process with high enough permissions will be able to read the credentials from the memory of another process so even not writing the credentials to disk may not protect you.In short: If there is a malicious actor (person or process) with enough credentials within your environment the protections that you can use are very minimal.You might consider writing the file to disk already encrypted; but that assumes that you have a secure method of sharing the encryption key between the process that is writing the file and the process that is reading it. Again, a malicious process on the instance will be able to read the encryption key and therefore gain access to the credentials.I would strongly recommend that you enable encryption of the disk; it's a good security measure and costs nothing to do. Otherwise, without knowing the attacks that you're trying to protect against it's difficult to provide more advice - and even the advice above isn't terribly useful.CommentShareEXPERTBrettski-AWSanswered a year ago0Thank you very much for such a detailed answer.Based on the information received, I have already built a certain sequence of my further actions.Tell me please.I am interested in such a question - is there a way to encrypt processes in RAM on AWS using some tools.Offers AWS some built-in tools or solutions from its partners.And I have long been interested in the answer to this question - are all processes running in RAM on AWS virtual machines encrypted or are they not encrypted at all.If there is a link to the technical documentation on this topic, I will be very grateful for the help.ThanksCommentSharerePost-User-8411867answered a year agoBrettski-AWS EXPERTa year agoAs you mentioned in the original question, Nitro Enclaves might be the way to solve that because it allows you to create an isolated execution environment within your instance. I say might because your application may have to pass data into the Enclave or extract data from it so you need to consider how you will do that securely. Because this is a complex topic I'd encourage reaching out to your local AWS Solutions Architect for an in-depth conversation.Share"


Question: Athena - GENERIC_INTERNAL_ERROR: No value present

"I created a table with partition projectionThis is the setup:PARTITIONED BY (   `userid` string,   `taskid` string,   `accountid` string,   `month` int,   `year` int)ROW FORMAT SERDE   'org.apache.hadoop.hive.ql.io.orc.OrcSerde' STORED AS INPUTFORMAT   'org.apache.hadoop.mapred.TextInputFormat' OUTPUTFORMAT   'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'LOCATION  's3://bucketName/'TBLPROPERTIES (  'has_encrypted_data'='false',   'projection.accountid.type'='inject',   'projection.enabled'='true',   'projection.month.digits'='2',   'projection.month.range'='1,12',   'projection.month.type'='integer',   'projection.taskid.type'='inject',   'projection.userid.type'='inject',   'projection.year.range'='2018,2051',   'projection.year.type'='integer',   'storage.location.template'='s3://bucketName/userid=${userid}/taskid=${taskid}/accountid=${accountid}/month=${month}-${year}/',activae querywhere userid='626b4b4e-9518-46cd-a7af-0ebda24425bd' and taskid='6d45c163-d5f5-4a44-9aa5-f80e8f8152e4' and accountid = 'blabla-blabla@abc.com'  and "month" = 12 and "year" = 2020gotGENERIC_INTERNAL_ERROR: No value presentquery id - Query Id: de3b869c-6d1a-4b10-989f-be79356569a1Any idea why?ThanksFollowComment"


Question: Unable to copy elasticache for redis backup to S3 bucket in the same region

"Hi, I need to export a backup of Elasticache for redis to a S3 bucket which has the bucket policy according to the document at https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups-exporting.html. And my IAM has full access to the S3 resources.When I use CLI command 'aws elasticache copy-snapshot --source-snapshot-name <source snapshot name> --target-snapshot-name <target snapshot name> --target-bucket <S3 bucket name>, I got some normal output data without error message. However, I don't see any files in the S3 bucket I created earlier. The same issue when I used the Elasticache console to copy the backup to the S3 bucket.Here're some properties of the redis cluster:Node type: cache.t2.microEngine version: 5.0.6Cluster mode: offBucket policy:{"Version": "2012-10-17","Statement": [{"Sid": "ElastiCacheRedisBackupAccess","Effect": "Allow","Principal": {"Service": "ap-southeast-1.elasticache-snapshot.amazonaws.com"},"Action": ["s3:PutObject","s3:GetObject","s3:ListBucket","s3:GetBucketAcl","s3:ListMultipartUploadParts","s3:ListBucketMultipartUploads"],"Resource": ["arn:aws:s3:::<S3 bucket name>","arn:aws:s3:::<S3 bucket name>/*"]}]}Any idea why I don't see the files in the S3 bucket? Thanks!FollowComment"

Answer: "0Accepted AnswerFinally, after trying different configurations, it's working now. The trick is that you have to enable the ACL and add the grantee according to the 'Amazon ElastiCache for Redis user guide'. I thought AWS was trying to deprecate this method. Anyway, case closed.CommentShareblacktulip11answered 9 months ago"


Question: how to allocate elastic IP address to auto scaling group?

"I have allocated an elastic IP address to the auto-scaling group. after traffic increases, it creates another instance with a new IP address. the newly generated IP address is not assigned automatically to the elastic IP address.FollowComment"

Answer: "1You could use a Proxy or NAT-Gateway in front of the EC2 fleet that way regardless of the ASG activity externally NAT-Gateway EIP will be seen as the source IP.CommentShareEXPERTTushar_Janswered 9 months agoArshad 9 months agoThank you for responding,Could you please share any reference links where I can get help from it?ShareTushar_J EXPERT9 months agoIf you're using private subnets, you can allow the Auto Scaling instances to access the internet by using a public NAT gateway.https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.htmlShare0An EIP (or any public IP) can only be assigned to a single instance/ENI, you can't assign it to multiple instances as you scale.  AutoScaling only supports a static EIP when the group has a max of 1 instance (in which case that EIP/ENI can be reused on replacement instance, but the group can't scale above 1 instance).  What is your goal here?A static inbound IP?Use a Network Load Balancer (NLB) and attach its target group to the ASG.  NLB IPs are static and never change with 1 EIP per AZStatic outbound IP?Use a NAT GatewayBoth?You'll need to create a pool of unused EIPs, and then create a userdata script in the Launch Template for your AutoScaling Group.  The script will need to search for available EIPs and attach one to the instanceNote that all 3 of the above options have varying levels of cost associated with them.CommentShareShahad_Canswered 9 months ago"


Question: How stop "Elastic IP address not attached to a running instance per hour (prorated)"?

"Hi. I deleted all Elastic IP address, but every day I get new a bill charging for Elastic Compute Cloud in line "Elastic IP address not attached to a running instance per hour (prorated)".How ca I stop charging the amount for resources that I do not use?FollowComment"

Answer: "1I am assuming that where you have mentioned delete Elastic IP is release Elastic IP. If not follow these steps.To release an Elastic IP addressOpen the Amazon EC2 console at https://console.aws.amazon.com/ec2/.In the navigation pane, choose Elastic IPs.Select the Elastic IP address to release and choose Actions, Release Elastic IP addresses.Choose Release.Now coming to your cost, these are might be the reasons from my experienceEC2 instance which is in stopped state has an EBS attached to it will incur chargesOther data analytics services that was provisioned but not deleted will also incur chargesYou need to check in the cost explorer about the exact resource which is incurring charges.Choose "cost explorer" from the navigation menu.From Report parameters which is the right side, select "Usage Type" in Group By. You will see all the resources that are being charged including EC2-Others.CommentShareBiswaanswered 6 months agovitaliy 6 months agoThanks. Sure, you right. Now it have stopped. But what interesting, after I had deleted Elastic IP,  cost was increasing for two daysShare0Maybe good point will delete account AWSCommentSharevitaliyanswered 6 months ago0Are you sure you don't have Elastic IPs in a different region to what you expect?  If you go into Cost Explorer you can for example group by Region and see which region the costs are coming from.CommentShareEXPERTskinsmananswered 6 months ago0You can go to your cost explorer and select The EC2-Other category under service and group by Usage type  tracking costs associated with elastic IP addresses. It will provide which region if any.CommentShareEXPERTAWS-User-Nitinanswered 6 months ago"


Question: "Stack stuck in update, cant canel"

The following stack is stuck updating and I cant cancel it.  Can someone at AWS take a look?arn:aws:cloudformation:ap-southeast-2:925270365688:stack/barxui-prod-api/b398c6f0-1fb0-11e9-b3bd-02181cf5d610ThanksFollowComment

Answer: 0Never mind.  Sending this message was enough to fix it :/CommentSharepetergjonesanswered 4 years ago


Question: Athena Table timestamp column with null values

"I have some data in a csv in s3 in the format:idconfirmed_atcancelled_atsuspended_ata16784147162691678414716269b1678316522493c167823191578716782318982201678231915787I've defined my table with the structurecolumn namedata typeidstringconfirmed_attimestampcancelled_attimestampsuspended_attimestampbut when I am using Athena to query my data, it fails on rows where cancelled_at or suspended_at are blank with the errorError parsing field value '' for field 1: For input string: ""i am using OpenCsvSerde but have tried LazySimpleSerDe with 'serialization.null.format'='' but get the same erroris it possible to have athena support having a timestamp column that could be null / blank?FollowComment"

Answer:
"1Hello,Please note that errors that specify a null or empty input string ("For input string: "") happen when both of the following are true:You're using Athena with OpenCSVSerDe, which means that your source data uses double quotes (") as the default quote character.The source data contains null values ("") or empty cells.You can refer the same in the below document:

https://aws.amazon.com/premiumsupport/knowledge-center/athena-hive-bad-data-error-csv/It seems that this error is occurring because there are empty cells for some of columnsAs mentioned in the above document in order to mitigate the issue “Define each column as STRING. The parser in Athena parses the values from STRING into actual types based on what it finds. This prevents Athena from throwing an error when it finds null values (empty strings with double quotes and no spaces) or empty cells (no values or double quotes).”CommentSharerePost-User-9367235answered 3 months ago"


Question: EC2 instance with v6 address not responding to the internet

I have an EC2 instance properly setup with v4 addressing and an EIP and that works just fine. I can SSH to thge instance from the internet b ut the v6 IP allocated to the instance doesn't seem to work. I have checked the Security Groups and SSH is allowed for ::0 but I cannot get to my instance via v6. Is there anything else besides Security Gruops I need to check to ensure I have end-to-end v6 connectivity?FollowComment

Answer: "0Do you use custom or default VPC? IT may be that your VPC is not set to support IP6Please check this link about how to set the ip6 for the VPChttps://docs.aws.amazon.com/vpc/latest/userguide/get-started-ipv6.htmlCommentShareAWSome Useranswered a year ago0I manually created my VPC and associated the IGW and Subnets with the route tables so everything works as far as v4 is concerned. But for some reason v6 just does not work. I have ensured my Security Groups work fine but v6 simply doesn't work and a traceroute seems to suggest the traffic is being held up somewhere inside of the AWS network ....nomaxpi@Ns-MacBook-Pro keys % traceroute6 2600:1f18:424f:f000:f85:e9e5:c51:846traceroute6 to 2600:1f18:424f:f000:f85:e9e5:c51:846 (2600:1f18:424f:f000:f85:e9e5:c51:846) from 2600:6c63:653f:3e00:b052:5831:de73:acf6, 64 hops max, 12 byte packets1 - 2600:6c63:653f:3e00::1  1.938 ms  2.236 ms  2.015 ms2  * * *3  lag-61.dtr02hmndla.netops.charter.com  14.024 ms  9.293 ms  9.390 ms4  lag-210.crr01slidla.netops.charter.com  11.106 ms  11.349 ms  11.100 ms5  lag-110.crr02slidla.netops.charter.com  11.375 ms  10.687 ms  11.359 ms6  lag-704.bbr02slidla.netops.charter.com  11.601 ms  12.036 ms  11.362 ms7  lag-808.bbr01atlnga.netops.charter.com  35.680 ms  36.184 ms  40.631 ms8  * * *9 - 2620:107:4008:7cf::1  37.475 ms  34.868 ms  35.805 ms10  * * *11 - 2620:107:4000:ff::b  64.542 ms2620:107:4000:ff::b4  35.006 ms2620:107:4000:ff::b  34.870 ms12 - 2620:107:4000:8002::80  47.869 ms2620:107:4000:8002::86  60.043 ms2620:107:4000:8002::65  55.814 ms13  * * *14  * * *15  * * *16 - 2620:107:4000:4011:8000:0:6441:db0  51.521 ms2620:107:4000:4011:8000:0:6441:ea0  65.124 ms2620:107:4000:4011:8000:0:6441:f00  67.710 ms17 - 2620:107:4000:4011:8000:0:6442:504  55.613 ms2620:107:4000:4011:8000:0:6442:59a  54.958 ms2620:107:4000:4011:8000:0:6442:52e  49.618 ms18 - 2620:107:4000:4011:8000:0:6442:69c  49.531 ms2620:107:4000:4011:8000:0:6442:6bc  49.558 ms2620:107:4000:4011:8000:0:6442:608  54.132 ms19 - 2620:107:4000:4011:8000:0:6442:17fb  49.248 ms2620:107:4000:4011:8000:0:6442:17cb  49.473 ms2620:107:4000:4011:8000:0:6441:e40  561.805 ms20 - 2620:107:4000:4011:8000:0:6442:15bd  50.092 ms2620:107:4000:4011:8000:0:6442:871  49.581 ms2620:107:4000:4011:8000:0:6442:9a5  67.662 ms21  * * *22  * * *23  * * *24  * * *25  * * *26  * * *27  * * *28  * * *29  * * *30  * * *CommentSharenomaxpianswered a year ago0Hello there,There are a couple of factors to check here. Security Groups, NACL & VPC settings. Also there needs to be a route and reverse route for the traffic to enter the AWS Network.I strongly advise to reach out to the Premium support if you have a support plan since they will have the visibility needed to check the exact EC2 machine that you are trying to reach.If not, It would be also good to check the VPC flow logs on the Eni/VPC level to confirm on the EC2 whether the traffic is being reached to the right EC2 or not. This will confirm if the traffic is reaching the VPC and is being dropped due to wrong NACL/SG setting.Link- https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.htmlCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year ago"


Question: Can you set a Cognito Identity Pool to include all users/EC2s of the acct?

"I followed a tutorial for how to create a QnA bot that used a CloudFormation stack.That stack created an identity pool. Using either my own secretAccessKey/accessKeyId, or an EC2 server's creds works for signing into the service. When I look at the identity pool, I see that the authenticated identities look like regions followed by "_" and then some letters and numbers. Are these identities references to account-wide VPC values or something? I don't understand how you can make an identity that includes all users/servers of the AWS account. Googling doesn't help me understand what's going on here.FollowComment"

Answer: "0Ok, so I figured out a more accurate way to look at this.I shouldn't be using identity pools at all.I can specify a certain AWS service's (EC2 or Lambda, etc) role as having access to any other service.I can restrict access to an IP address range.I can specify a particular AWS User's account.I can specify a group of AWS user accounts in a Cognito User Group.I can specify a Cognito User Group or other IDP provider, or an unauthenticated user in a Congito Identity Pool.Edited by: ShaneS on Sep 28, 2020 7:52 AMCommentShareShaneSanswered 3 years ago"


Question: Deploy already exists in stack error from cdk deployment

The question has been resolved.FollowComment

Answer: "0Hello,From the query description, I understand that your query has been resolved. However, if you have any continuing concerns for the same issue, please feel free to reach back.Thank you!CommentShareSUPPORT ENGINEERRashi_Janswered 2 months ago"


Question: Launch test instance for MGN conversion fails with "Conversion failed"

"Hello, I'm using MGN to migrate a Windows 2016 64 bit with 2 disks (each ~232 GB). The migration dashboard shows that the initial replication finished and that it's "ready for testing." However, when I try to launch a test instance, the conversion starts, but fails a few minutes later. The job log (under Launch history > Job:mgnjob...) doesn't provide a lot of context, the only feedback is "Conversion failed". I've tried launching test instances multiple times, all with the same result. In an attempt to get a little bit more data as to what's going on, I can view the system log for the converter instance as the conversion is progressing. I've included relevant snippets of the system log below. I'd appreciate any recommendations anyone can offer in terms of next steps for troubleshooting why the conversion is failing.Included below are some snippets of the system log.Start of the log:2022/06/21 17:17:34Z: Windows sysprep configuration complete.2022/06/21 17:17:36Z: Message: Waiting for meta-data accessibility...2022/06/21 17:17:36Z: Message: Meta-data is now available.2022/06/21 17:17:38Z: AMI Origin Version: 2022.06.152022/06/21 17:17:38Z: AMI Origin Name: Windows_Server-2016-English-Full-Base2022/06/21 17:17:38Z: OS: Microsoft Windows NT 10.02022/06/21 17:17:38Z: OsProductName: Windows Server 2016 Datacenter2022/06/21 17:17:38Z: OsInstallOption: Full2022/06/21 17:17:38Z: OsVersion: 10.02022/06/21 17:17:38Z: OsBuildLabEx: 14393.5192.amd64fre.rs1_release.220610-16222022/06/21 17:17:38Z: OsCurrentBuild: 143932022/06/21 17:17:38Z: OsReleaseId: 16072022/06/21 17:17:38Z: Language: en-US2022/06/21 17:17:38Z: TimeZone: Coordinated Universal Time2022/06/21 17:17:38Z: Offset: UTC 00:00:002022/06/21 17:17:38Z: AMI-ID:2022/06/21 17:17:38Z: Instance-ID:2022/06/21 17:17:38Z: Instance Type: m4.large2022/06/21 17:17:56Z: Driver: AWS PV Driver Package v8.4.22022/06/21 17:17:56Z: Driver: Intel(R) 82599 Virtual Function v2.1.186.02022/06/21 17:17:57Z: Launch: EC2 Launch v1.3.20036392022/06/21 17:17:57Z: SSM: Amazon SSM Agent v3.1.1188.02022/06/21 17:17:57Z: RDPCERTIFICATE-SUBJECTNAME:2022/06/21 17:17:57Z: RDPCERTIFICATE-THUMBPRINT:2022/06/21 17:18:10Z: HibernationEnabled: false2022/06/21 17:18:14Z: Message: Windows is Ready to use2022/06/21 17:18:15Z: EC2LaunchTelemetry: IsTelemetryEnabled=true2022/06/21 17:18:15Z: EC2LaunchTelemetry: IsAgentScheduledPerBoot=false2022/06/21 17:18:15Z: EC2LaunchTelemetry: IsUserDataScheduledPerBoot=true2022/06/21 17:18:15Z: EC2LaunchTelemetry: AgentCommandErrorCode=12022/06/21 17:18:56Z: MGN script started2022/06/21 17:19:26Z: 2022/06/21 17:18:55Z: ACPI SPCR table not found. Bailing Out2022/06/21 17:19:26Z: 2022/06/21 17:18:55Z: Opening port (COM1) handle to write to the console2022/06/21 17:19:26Z: 2022/06/21 17:18:56Z: MGN script started2022/06/21 17:19:26Z:     Directory: C:\2022/06/21 17:19:26Z: Mode                LastWriteTime         Length Name2022/06/21 17:19:26Z: ----                -------------         ------ ----2022/06/21 17:19:26Z: d-----        6/21/2022   5:18 PM                CloudEndureFollowing that are some HTTP get requests that I will exclude since I believe the query parameters may include some sensitive information.Next a series of "getting next command with token" in the log:Starting running http commands.run_commands startedclient_config threads have spawnedgetting next command with token 3a44cf0cb475650494ed7aa694017179command receivedgetting next command with token 142f6916cb537e313e48eb1c9c6e92f7command receivedThe last part of the log before the conversion fails is interesting. It references two services: UmRdpService and TermService. These are the Windows services for "Remote Desktop Service" and "Remote Desktop Services UserMode Port Redirector." So it appears that the conversion process has some issues with these two services, but that's as much as I've been able to glean.Failed running all commands : None2022/06/21 17:22:03Z: http_commands_client.exe returned:SERVICE_NAME: UmRdpService    TYPE               : 20  WIN32_SHARE_PROCESS      STATE              : 3  STOP_PENDING                             (NOT_STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)    WIN32_EXIT_CODE    : 0  (0x0)    SERVICE_EXIT_CODE  : 0  (0x0)    CHECKPOINT         : 0x116    WAIT_HINT          : 0x0SERVICE_NAME: TermService    TYPE               : 20  WIN32_SHARE_PROCESS      STATE              : 3  STOP_PENDING                             (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)    WIN32_EXIT_CODE    : 0  (0x0)    SERVICE_EXIT_CODE  : 0  (0x0)    CHECKPOINT         : 0x1        WAIT_HINT          : 0xea602022/06/21 17:22:03Z: MGN script finishedFollowComment"


Question: Re-host migration of RHEL server to AWS

We have a requirement to migrate (Re-Host) RHEL 6 server which has MAC based licenses to AWS. Wanted to check how can we leverage existing on-prem Licenses in AWS which is MAC bases ? Does it require to deactivate license from on-prem and then activate it again in AWS ?Please suggest.FollowComment


Question: AWS control tower notification forwarder and python 3.6 EOL

We are using AWS tower landing zone and have got a notice that the aws-controltower-NotificationForwarder is running python 3.6 and is nearing EOL.This lamda function is provided by the AWS tower landing zone for the accounts and can't be updated manually.Will this be fixed in an upcoming patch for the landing zone?FollowComment

Answer: "0Accepted AnswerUpdate to AWS Control Tower is coming soon. Here is the official communication :"You are receiving this communication because the AWS Control Tower service contains a notification Lambda Function using Python version 3.6 which is planned for deprecation in July 2022. A new version of the Control Tower notification Lambda will be updated prior to deprecation in July. We will provide periodic updates in the Control Tower management console regarding the updates and any actions we may need you to take.We are aware that some Control Tower customers have received a number of emails regarding the Python 3.6 deprecation for Lambda functions, and we apologize for any confusion that these messages may have caused. We are working with the Lambda team to limit any future notifications."CommentShareAWS-CIA-Robert-Canswered a year ago"


Question: SES Reconnect Not Working

Our SES service was working perfectly with Sendy mailing until an incident recently where the service was suspended because of bounced emails.  We made corrections within our process and AWS reinstated our account.  However now nothing is sending out of Sendy.  Is there something needs to be reset at AWS SES?FollowComment


Question: Can matchmaking event notifications of type PotentialMatchCreated and AcceptMatchCompleted be sent after those of type MatchmakingSucceeded?

"A while ago, I made a Lambda function that subscribed to a SNS topic for GameLift event notifications. The lambda function would store relevant information into DynamoDb. There was one incident where an event of type MatchmakingSucceeded came before an event of type PotentialMatchCreated. There was no player acceptance in this case, so I assumed that perhaps because the the actual match was made so quickly that the events came out of order? This is pretty rare as I have again only experienced this once, and since then, I have ignored storing information about events of type PotentialMatchCreated into DynamoDb. I am not 100% sure if I should ignore PotentialMatchCreated events so definitely let me know if I shouldn't or if these events can contain important information that I am not seeing.So this got me thinking, in cases where there is player acceptance, could events of type AcceptMatchCompleted be sent to the SNS topic after events of type MatchmakingSucceeded for the same match/ticket? Is the order of GameLift events being sent to SNS always guaranteed?Right now when I make the clients poll DynamoDb for the latest status of their matchmaking tickets, I usually grab the latest entry in the table with the corresponding ticket id. However, now I'm wondering if I should account for this very rare case of events coming out of order and start having the clients check for each state of the matchmaking process one at a time. Hope this question made sense, thanks in advance!FollowComment"

Answer: "0Accepted AnswerHave attached this to your other Matchmaking Event issue with GameLift teamIts worth noting that SNS does not guarantee event ordering.Q: Will messages be delivered to me in the exact order they were published?The Amazon SNS service will attempt to deliver messages from the publisher in the order they were published into the topic. However, network issues could potentially result in out-of-order messages at the subscriber end.https://aws.amazon.com/sns/faqs/CommentSharerePost-User-5332620answered 3 years ago"


Question: Textract all image data in one file

"Hello everyone. After using bulk file upload, is there a way to make a bulk download of the results? Having to open several zip files takes too much time.Thanks in advance.FollowComment"

Answer: "3Accepted AnswerThere is no easy method for this method but there is workaroundyou can store all output to S3https://aws.amazon.com/blogs/machine-learning/store-output-in-custom-amazon-s3-bucket-and-encrypt-using-aws-kms-for-multi-page-document-processing-with-amazon-textract/thenUse AWS Lambda or similar service to combine all the result files into one file. (for example)import boto3s3 = boto3.resource('s3')bucket = s3.Bucket('your_bucket_name')combined_contents = ""for obj in bucket.objects.all():    body = obj.get()['Body'].read()    combined_contents += body.decode('utf-8') + "\n"  # Assumes text files. You'll need to adjust for other formats.bucket.put_object(Key='combined_results.txt', Body=combined_contents)Download the combined fileCommentShareEXPERTsdtslmnanswered 14 days agoLionelGarcia 13 days agoWill try, thanks!Share2To open several zip files you can use command line toolsWindows:@echo offfor /R "C:\path\to\your\zips" %%I in (*.zip) do (    "C:\Program Files\7-Zip\7z.exe" x -o"C:\path\to\extract\to" "%%~fI")pauseLinux:find /path/to/your/zips -name '*.zip' -exec unzip {} -d /path/to/extract/to \;If you're processing documents in bulk using Amazon Textract and want to store the results for later use, you would typically set up an Amazon S3 bucket to store the documents and the results. When you call Textract to process a document, you can specify the bucket where the document is located, and then store the returned data in another object in the bucket.To download the results in bulk, you could then download the objects from your S3 bucket. The AWS CLI includes a sync command that can be used to download all objects in a bucket:aws s3 sync s3://mybucket .CommentShareEXPERTsdtslmnanswered 15 days ago0Thanks for your answer, but is there a way to get all the results in one file/zip? Having 7-8 differents file takes too much time to process.CommentShareLionelGarciaanswered 14 days ago"


Question: Problem with "lame delegation" in my DNS records

"So I have a Route 53 domain, and I'm creating A records but they aren't working. The browser says that the "server's IP could not be found". I went to Google Public DNS and it says this:{"Status": 2,"TC": false,"RD": true,"RA": true,"AD": false,"CD": false,"Question": [{"name": "DOMAIN.","type": 1}],"Comment": "Name servers refused query (lame delegation?) [205.251.199.212, 205.251.194.252, 2600:9000:5307:d400::1, 2600:9000:5302:fc00::1, 2600:9000:5304:1800::1, 205.251.196.24, 205.251.193.49, 2600:9000:5301:3100::1]."}How can I fix this?FollowComment"

Answer: "0Hi,If you post your domain name, I'll take a look at your configuration.ScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0Hey, thanks! justinchristopherday.comCommentSharethemaskedavengeranswered 3 years ago0Hi,Name servers appear in three places, and they typically all match:~ The name servers in the NS record in your hosted zone.~ The name servers that Route 53 assigned to the hosted zone when you created it (or when we created it for you, when you registered a domain). These values can't be changed.~ The name servers that are associated with your domain registration.For justinchristopherday.com, the name servers match for the two locations in the hosted zone, but the name servers for the domain are different. I'd guess that you deleted your hosted zone and then recreated it at some point. When you create a new hosted zone, Route 53 assigns four new name servers. You then need to update the domain registration to use these name servers. Here's how to fix it:Get the name servers that Route 53 assigned to the hosted zone. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the domain registration with the name servers that you got in step 1. See "Adding or Changing Name Servers and Glue Records for a Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0That did it! Just so you know, I didn't delete a hosted zone, but I migrated this domain from another registrar, so maybe that's it. Thanks for your help :)CommentSharethemaskedavengeranswered 3 years ago"


Question: Federated Identity authenticated role - custom claims?

"Hello,I am using a pre-token generation trigger to add some custom claims into a user's JWT token. One of the custom claims I am adding is "business_id" which maps a user as belonging to a particular business in my multi-tenant SaaS app.NOTE: this is not an editable cognito user pool custom attribute. This JWT claim is added programmatically as described above using a pre-token generation trigger.In the Authenticated role I can restrict access to an S3 path based on each user's unique ID (Cognito sub) using this variable in my IAM policy:${cognito-identity.amazonaws.com:sub}Like so:{  "Effect": "Allow",  "Action": [    "s3:GetObject",    "s3:HeadObject",    "s3:PutObject"  ],  "Resource": [    {      "Fn::Join": [        "",        [          "arn:aws:s3:::",          { "Ref": "S3Bucket" },          "/user/${cognito-identity.amazonaws.com:sub}/*"        ]      ]    }  ]}Is there a way to do something similar with a custom claim? Like my example of having a "business_id" custom claim? I need all my users that belong to the same business (id) to have access to the same S3 path.I tried replacing the IAM template variable using 'sub' with 'business_id' but it did not work, I still get access denied.${cognito-identity.amazonaws.com:business_id}I know there is a way to map an IAM role to a authenticated user, but this approach would mean I could end up needing 100s or 1000s of IAM roles whose only difference would be the "business_id" value being hardcoded into the S3 path to allow access for.Again, business_id is not an editable Cognito user pool custom attribute. So, I shouldn't need to worry about a user's business_id changing and giving them access to resources that they should not have access to.All help and ideas are very appreciated!Thanks!ErikEdited by: paulsson-cs on Feb 27, 2020 12:35 PMFollowComment"

Answer: "1Ok, I found a good working solution. IAM and Cognito still does not allow you to use custom JWT claims in IAM permissions. This only works for a small subset of claims that Cognito sets by default like the Cognito user sub:${cognito-identity.amazonaws.com:sub}The approach I took was to use S3 pre-signed URLs after verifying that the calling user is allowed access to the file in S3.Basically, I was able to add a AppSync GraphQL query to my existing GraphQL API in my Amplify stack. This new GraphQL query is backed by a lambda function which verifies that the calling user belongs to the same business as the file being requested before generating and returning the S3 pre-signed URL.Hope this can help someone else out. I think this would be a very common use-case in multi-tenant apps.CommentSharepaulsson-csanswered 3 years ago"


Question: How to Autoscale (add a node) Memcached cluster?

"Hi,I am using Memcached cluster with one node. I did setup an alarms which will kickoff either 50% CPU or  50% Memory. Can I add a node when alarm gets triggered using auto scaling?fyi: I'm using Terraform to build my AWS infrastructure.Thanks in advance.FollowComment"

Answer: "0Accepted AnswerYou can not directly scale your memcached cluster from CloudWatch. If it would be Redis, then application auto scaling would be the easy solution. Fortunately there is no problem that can not be solved with bit of custom code and Lambda function. On high-level it would go like this; CloudWatch alarm gets triggered -> CloudWatch Events rule matches the alarm -> Lambda function is triggered to add a node to the cluster.  Similar case is described in below blog post.https://aws.amazon.com/blogs/mt/customize-amazon-cloudwatch-alarm-notifications-to-your-local-time-zone-part-1/https://docs.aws.amazon.com/autoscaling/application/userguide/what-is-application-auto-scaling.htmlPs. Adding nodes to a Memcached cluster increases the number of your cluster's partitions. When you change the number of partitions in a cluster some of your key spaces need to be remapped so that they are mapped to the right node. Remapping key spaces temporarily increases the number of cache misses on the cluster.CommentShareKalluanswered 4 months ago"


Question: Target group - Health checks failed with these codes: [500]

"Hello,I would appreciate it if you could help me please.I have issues with Registered targets Health status is unhealthy  and Health Status Details has Health checks failed with these codes: [500]Our infrastructure is using AWS ECS container instances.I tried to search everywhere for a solution but no joyMany thanks in advanceDelFollowComment"

Answer: "0There isn't enough information in your question to provide detailed answers. If you see HTTP 500 errors for the health checks, your instances return that response. I suggest looking at your instances' logs to determine the cause of the HTTP 500 response. Additionally, you could try running your container locally and making a request to the same path as the health check and see if the service behaves the same, returning an HTTP 500 response, or different.CommentShareJason Butzanswered 3 months agoAbdel 3 months agoHi JasonThanks for the suggestion. What other info would you like me to provide you with?Share"


Question: Update queries are returning Consistency level errors

"In eu-north-1 (Stockholm) MCSUPDATE tbl SET field='ABC' WHERE other_field='DEF';InvalidRequest: Error from server: code=2200 [Invalid query] message="Consistency level ONE is not supported for this operation. Supported consistency levels are: LOCAL_QUORUM"This was not the issue last week. Now Update is not working on existing tables.The SELECT operations seems to be working fine.According to Apache the default level is ONE. Same with Cassandra drivers, without config they defaults to ONE. Why now it is changed to LOCAL_QUORUM?FollowComment"

Answer: "0All writes in Amazon MCS are stored durably and replicated three times across multiple AWS Availability Zones using LOCAL_QUORUM consistency. To help customers optimize performance and consistency, reads can be executed using either ONE, LOCAL_ONE or LOCAL_QUORUM consistency. Early in the preview, MCS would map unsupported consistency levels to supported levels to help customers migrate workloads without minimal changes to their source code. In this case, ONE was mapped to LOCAL_QUORUM. However, based on customer feedback, we have adjusted MCS to explicitly reject unsupported consistency levels to ensure there is no confusion about the consistency level being used.CommentShareAlmero-AWSanswered 3 years ago0You mentioned "can be executed using either ONE, LOCAL_ONE or LOCAL_QUORUM consistency". In that case why level ONE is not applicable for UPDATE command?@cqlsh> CONSISTENCY;Current consistency level is ONE.@cqlsh> UPDATE ... SET ... WHERE ...;InvalidRequest: Error from server: code=2200 [Invalid query] message="Consistency level ONE is not supported for this operation. Supported consistency levels are: LOCAL_QUORUM"CommentShareDmitrijsanswered 3 years ago0Is there a way to configure created keyspace/tables to default to level ONE? Update and Insert commands in provisioning scripts are failing because of default level.CommentShareDmitrijsanswered 3 years ago0Hey Dmitrijs - ONE is only supported for reads, not writes. Can you update your application to use LOCAL_QUORUM just for writes? Are you using ONE for performance? MCS will still offer single-digit write performance, even using LOCAL_QUORUM.CommentShareAWS-User-6425534answered 3 years ago0I've updated scripts and connector to use configurable consistency level. Thank you for answer!CommentShareDmitrijsanswered 3 years ago"


Question: Scaling websocket notifications

"I'm building an e-commerce app and each and every day, we have a special offer at noon. Every customer is notified at noon and connects to the website where they are added to a queue. They open a websocket between the browser and the backend (API Gateway) and at some point they want to send a notification to all users through the websocket (via a lambda looping over all connectionId), which takes too long (around 50k users).I had a look at different solutions (MQTT over websocket with AWS IOT, Appsync), but both need Cognito, and I already have another authentication mechanism (in-house).I saw it is also possible to use signature v4 for MQTT over websocket, we could have an endpoint to get this temporary signature but I'm not sure that's a really good practice.I also thought about spreading (fan out) the sending of notifications.Am I missing a better alternative?FollowComment"

Answer: 0Accepted AnswerBroadcasting over WebSockets is built into AppSync. Some articles on the subject:https://aws.amazon.com/blogs/mobile/aws-appsync-real-time-reference-architecture/https://aws.amazon.com/blogs/mobile/appsync-realtime/https://aws.amazon.com/blogs/mobile/appsync-websockets-python/There's no looping over a list of connections. It's true brodcasting.CommentShareawsedanswered 3 years ago


Question: "Incremental archive from DynamoDB, Glue Bookmarking?"

My customer is currently archiving DynamoDB data to their data lake with a Glue job and the DynamoDB connector. They've asked if instead of a full load each day they can do an incremental.I see Glue supports bookmarking which looks like what I need but it only supports S3 (and some JDBC) sources for this.Is there a way to achieve this?FollowComment

Answer: "0Accepted AnswerHi,Have they considered using DynamoDB Streams + Lambda + Kinesis Data Firehose to continuously feed the data lake in S3?This blog post describes something similar for expired items with a TTL.CommentShareEXPERTTasioanswered 4 years ago"


Question: certificate pinning

can i search my aws environment to see if certificate pinning was configured by a previous admin?FollowComment

Answer: "0Hi.Certificate pinning is configured on the application side, so I think it is difficult to check it by searching the AWS environment.CommentShareEXPERTiwasaanswered 8 months ago"


Question: Can I use Debian os as my EB custom image?

I need to use Debian/Ubuntu as my beanstalk ami. How can I do it? what is pre-requesit?FollowComment

Answer: 0The only option I see would be to use a debian based docker container. See https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/create_deploy_docker.htmlCommentShareRodney Lesteranswered 8 months ago


Question: How to access commitid during CodeDeploy stage of a CodePipeline execution?

"I have a CodePipeline with a Source (CodeCommit), Build (CodeBuild) and Deploy (CodeDeploy) stage. This is for a Node.js application deploying to an AutoScaling group (Blue/Green). My CodeBuild stage runs a few Gulp scripts to minify CSS and JS files, append the commitid to the filename and then copies them to S3. I can pass the commitid during CodeBuild stage using #{SourceVariables.CommitId}. However, I cannot do the same during my CodeDeploy stage. I need the commitid during the deploy stage so that I can write it to a .env file within the Node.js application route directory. My application uses string interpolation to append ${process.env.COMMIT_ID} to the CSS and JS filenames within the HTML.FollowComment"


Question: Sync Issues due to patch management using AWS Systems Manager

"While we patch the EC2 instances through patch manager; in case of deployments managed by a pipeline on these instances, won't the System Manger workflow cause the version set to be out of sync (which is getting the updates during live from merge too) ?
How do we manage the update versions since the instances are getting updates from 2 sources (Patch Manager as well as pipeline deployment) ?FollowComment"


Question: Video delivery speed in AWS S3 storage

"Hi, we have session recording software. We are looking for the following things: 1. Our session recording videos of all customers, as and when generated, should automatically get uploaded to AWS S3 from our VPS server. Is such an arrangement possible? 2. Currently, our session recording videos buffer for 10 seconds before starting to play. If we deliver this video through AWS S3, can buffering be reduced to 2 seconds?Basically, we want to deliver session recording videos to all our customers at the best video speed. How can I achieve this and by using which Amazon service?FollowComment"

Answer: "3Hi,For number 1, take a look at Kinesis Video Streams. This service was purpose built specifically to delivery streaming video to S3. https://aws.amazon.com/kinesis/video-streams/features/?nc=sn&loc=2For 2, there are several things you can try. First, you want to match you media with the consumer. For example, you don't necessarily want  to deliver 4K video over a 3G comms link. So with both HLS and Dash you can provide adaptive bitrate streaming so that you can match the delivery network with the delivery format. Elemental MediaPackage does this for you and you can configure how Media Package works. https://aws.amazon.com/mediapackage/CommentShareMarc Schurichtanswered 7 months ago0Hello,What kind of format are you storing the video file in on S3? If it's one giant MP4 or MOV or similar file, you might want to pull the file through MediaConvert and output to S3 in either HLS or DASH format with a short segment length (Like 2 or 4 seconds), this would greatly reduce the time the player would need to buffer the content, as it's only downloading a few segments at a time while playing back the content. Rather than having to download the entire file to the player.-DirkCommentShareDirkjan_Banswered 7 months ago"


Question: EventBridge API Destination Connection AWS Secretes Manager Pricing

"When an event is sent to an API Destination, does the connection associated with the API Destination do 1 read from AWS Secrets Manager. So if 10000 events are sent to an API destination, would that cost $0.05 + $0.40c for AWS Secrets Manager per month?ThanksFollowCommentblahblahblah2 a year agoThat's a good question.As per AWS Blogpost:The service manages the secret in AWS Secrets Manager and the cost of storing the secret is included in the pricing for API destinations.However, this does not mention the reads and whether they're extra paid or not. I believe I've seen an information that EventBridge heavily caches these secrets, but I would love to get a straight answer from AWS.Share"

Answer: "0Secrets created by EventBridge Connection resources that are used with API Destinations are free when called by EventBridge to authorize requests to the API!CommentShareNikPinski-AWSEventBridgeanswered a year ago-1To get a good estimate for using AWS Secrets Manager, use the AWS Pricing Calculator: https://calculator.aws/#/createCalculator/SecretsManager you can configure your number of Secrets, duration and number of API calls.When I configured it for US-East with 1 Secret for 30 days and 10,000 API events, it returned a monthly price of $0.45 USD.CommentShareLisa_Hanswered a year ago"


Question: Please support domain registration for .bh domains

Please support domain registration for .bh TLD domainsFollowComment

Answer: "0Hello, thank you for reaching out.I understand that you are requesting to support ".bh" TLD registration on Route 53.Route 53 Domains is currently directly accredited with .com, .net, and .org registries. All other TLDs are provided via third party registrar associates. To improve our level of service and support, we are actively working to become directly accredited with all other TLDs. In addition to improving our existing offering, we will become accredited with other registries to expand our TLD catalog. This work is currently in progress. We do not currently have dates to share for adding new TLDs.You can monitor the updates here at AWS Blogs - https://aws.amazon.com/blogs/aws/ and what's new on AWS - https://aws.amazon.com/new/CommentShareSUPPORT ENGINEERChetan_Panswered a year ago"


Question: Data traffic price

"I am interesting what is a price for data transfer from/to Lambda@Edge?For example I have a bucket with an images in Frankfurt region and use Lambda@Edge for resize. As I understood we run Lambda@Edge in a nearest region cache edge. If a user from UK will open my website, we will run Lambda@Edge in London and there will be a cross region traffic (Lambda London <-> S3 Frankfurt). The question what is a price for this traffic? Will it be billed like CF traffic (0$) or cross region (0,02$) or internet (0,09$)?FollowComment"

Answer: "0Accepted AnswerData transferred “in” to and “out” of your AWS Lambda functions from outside the region the function executed in will be charged at the EC2 data transfer rates as listed in the following doc under “Data transfer”.https://aws.amazon.com/ec2/pricing/on-demand/Apart from the above data transfer, you will be charged for the s3 read/writes.Reference: https://aws.amazon.com/lambda/pricing/CommentSharetirthatawsanswered 3 years ago"


Question: Chat Bot slots and Lamba

"I have created the slots values and the lambda function and this appears on the test:Invalid Lambda Response: Received invalid response from Lambda: Cannot construct instance of IntentResponse, problem: The validated object is null at [Source: (String)"{"statusCode":200,"body":""Hello from Lambda!""}"; line: 1, column: 50]FollowComment"

Answer: "2Hi,It looks like your Lambda function is returning a generic response.  Lex is expecting a specific format after running the function:https://docs.aws.amazon.com/lexv2/latest/dg/lambda.html#lambda-response-formatYou need to modify your Lambda function to return the specific response format.See also:https://repost.aws/questions/QUxVxtLzR1Rp6bLUnk6_MYyw/having-issue-while-sending-lambda-response-to-lex-v-2-error-invalid-lambda-response-can-not-construct-instance-of-intent-responseCommentShareAWS-TimGanswered 7 months agoEXPERTIndranil Banerjee AWSreviewed 7 months ago"


Question: AWS Inspector Suppression Rules

"Requirement: To Suppress all Inspector findings without the image tag equal to 'latest'Configuration: Suppression rules filter: Image tag NOT_EQUALS latestBehaviour: Inspector DOES supresses all findings without the image tag equal to 'latest', however it DOES NOT suppress <untagged> images. Is there a filter I can use to suppress untagged images?FollowComment"

Answer: "0This is currently not possible, but there is a feature request created for the same. Please work with your AWS stakeholders to add support for this feature request.CommentShareAarthi Kannananswered 4 months ago"


Question: Can I use SES and WorkMail on the same domain?

"I'd like to receive e-mails on my domain in two ways:firstname@example.com : a classic mailbox with WorkMailcontact@example.com : a custom ticket system using SES to receive emailsUsually, one cannot run two different email services on the same domain, for obvious reasons, as MX resolves to a single set of servers.However, WorkMail and SES both being part of AWS, are they based on the same infrastructure / email servers, and as such can they cohabit on the same domain?Thanks in advance for your reply(ies).FollowComment"

Answer: "0Accepted AnswerHi,Thank you for your interest in WorkMail and yes you can combine this with SES. You can set-up WorkMail and use that without any worry of SES. For your custom ticket system you can add a rule in the SES inbound rules section. This for the ticketing system email address to be a different action than WorkMail.For more information on the SES inbound rules: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/receiving-email-receipt-rules.htmlKind regards,RobinCommentShareMODERATORrobinkawsanswered 2 years ago0Thank you, Robin.After some testing I can confirm that I can use both services on the same domain at the same time!CommentShareBMRKanswered 2 years ago"


Question: Email validation in ACM still pending after 12 hours!

"Hi, I'm having some issues with email validation on ACM. I registered a domain on Route 53 and then tried to attach a certificate. I went through the process and choose email validation. I use Gmail and have yet to receive an email to validate, I have checked spam, promotions etc. Is there a reason why I haven't received an email with this? I double checked on Route 53 to ensure the correct email address was used, all okay at that end. Any help on this issue would be great!FollowComment"

Answer: 0Please try the following AWS official documentation and other troubleshooting tips. [1] [2] [3] [4][1] Troubleshoot email validation For ACM certificateshttps://aws.amazon.com/premiumsupport/knowledge-center/acm-email-validation-custom/?nc1=h_ls[2] Troubleshoot email validation problems - AWS Certificate Managerhttps://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-email-validation.html#troubleshooting-no-mail[3] Email validation - AWS Certificate Managerhttps://docs.aws.amazon.com/acm/latest/userguide/email-validation.html[4] Troubleshoot ACM certificate requestshttps://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-fail/?nc1=h_lsCommentSharemn87answered 8 months ago


Question: create-auto-scaling-group with MixedInstancesPolicy

"i am following this guide https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-purchase-options.htmlto create auto-scale group with different type of ec2 types , (fleet) but getting error in return.is this not active yet in region=eu-west-1 ?even using there example return same error:/usr/local/aws/bin/aws autoscaling create-auto-scaling-group --auto-scaling-group-name tmp-eli --cli-input-json '{"AutoScalingGroupName":"tmp-eli","MixedInstancesPolicy":{"LaunchTemplate":{"LaunchTemplateSpecification":{"LaunchTemplateName":"lt-10349","Version":"v1"},"Overrides":[{"InstanceType":"c4.2xlarge"},{"InstanceType":"c5.2xlarge"},{"InstanceType":"c5d.2xlarge"}]},"InstancesDistribution":{"OnDemandBaseCapacity":0,"OnDemandPercentageAboveBaseCapacity":50,"SpotInstancePools":2}},"MinSize":2,"MaxSize":100,"DesiredCapacity":4,"VPCZoneIdentifier":"subnet-ae6a6ed8,subnet-aa2c6ef2,subnet-07c8ce63","Tags":[]}' --output jsonParameter validation failed:Unknown parameter in input: "MixedInstancesPolicy", must be one of: AutoScalingGroupName, LaunchConfigurationName, LaunchTemplate, InstanceId, MinSize, MaxSize, DesiredCapacity, DefaultCooldown, AvailabilityZones, LoadBalancerNames, TargetGroupARNs, HealthCheckType, HealthCheckGracePeriod, PlacementGroup, VPCZoneIdentifier, TerminationPolicies, NewInstancesProtectedFromScaleIn, LifecycleHookSpecificationList, Tagsany idea?eliFollowComment"

Answer: "0it's turned out the version of the awscli should be newer , 1.16 at leastCommentShareelismadar0071answered 4 years ago"


Question: "Obtain client IP address through a network load balancer (TCP socket server, Python)"

"Hi All,I run a couple of TCP socket server on EC2, behind a network load balancer (NLB).even I've set the target_group to preserve client IP address.  I am not able to obtain the actual client IP address in my Python TCP socket server. All I am getting seems to be a few fixed IP address, likely belong to the load balancer or some edge computing node ?when I bypass the load balancer, my server app is able to obtain the proper client IP address.any idea, what I am missing here ?FollowComment"

Answer: "3More info on this topic:For Network Load Balancers, register your targets by instance ID to capture client IP addresses without additional web server configuration. For instructions, see Target group attributes instead of the following resolutions (refer the link)For Network Load Balancers when you can register only IP addresses as targets, enable proxy protocol version 2 on the load balancer. For instructions, see Enable proxy protocol instead of the following resolutions.Reference: https://aws.amazon.com/premiumsupport/knowledge-center/elb-capture-client-ip-addresses/CommentShareEXPERTTushar_Janswered a year agosourav a year agoYes,I've tested, it's working in my setupSharerePost-User-7359932 a year agothanks, but this is not relevant to me , I am using Network LoadbalancerShareTushar_J EXPERTa year agoThanks for the clarification, I modified the answer, the link I provided has information for NLB as well.SharerePost-User-7359932 a year agothank you.Share0Behaviour depends on the type of ELB - NLB preserves Source IP (except for IP Address targets), whereas servers behind CLB & ALB see load balancer IPs as Source IPs in client requests and rely on x-forwarded-for header to indicate true source.CommentShareEXPERTskinsmananswered a year agorePost-User-7359932 a year agothis is where the confusing part is:I am using NLB, and I am seeing a few IP addresses (all my client connection seems all come from these few IP address based on the TCP server log). but reality is I have thousands of client accessing, and they are definitely not from these few IP addresses.when I by pass the NLB, I see the correct IP address for the ClientShare"


Question: Vulnerabilities at url administration portal aws

"Hello everyone, I have a question about vulnerabilities in the administration portal of aws,  we made a vulnerability scan in the url of the portal adminsitration like this https://x-xxxxxxxx.awsapps.com/start  and we found many vulnerabilities with high level  the most of them are problems with the tls protocol  if exist any chance to make a remedation in this kind of url I research a little and found that this url  belongs to aws workspaces,FollowComment"

Answer: 0You can report security vulnerabilities to our security team as per the instructions here: https://aws.amazon.com/security/vulnerability-reporting/CommentShareEXPERTBrettski-AWSanswered 3 months ago


Question: Move Lightsail instace to another account

HelloCould I move a lightsail instance to  another account insaide my organization? Maybe creating a ticket? We would like to separate cost using differents account.FollowComment

Answer: "2No, you can't move lightsail instances to another account directly.Apparently you can move EC2 instances between accounts ... so, in theory, you could export your lightsail instance to EC2 and move that ... but then your instance would be in EC2 and not lightsail.CommentShareDavid Ganswered a year ago0Good question.  Typically, moving resources between accounts is tricky as accounts are used as a boundary between resources.I would suggest trying to use tagging.  Tagging is a good way of aggregating spend by tags - you could tag some resources with one project and the other resources with another project tag such as the key value pair of "project": "Project Alpha"Lightsail supports tagging as well:https://aws.amazon.com/about-aws/whats-new/2018/11/amazon-lightsail-now-supports-resource-tagging/https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.htmlCommentSharejsoncanswered a year ago"


Question: Help me change the instance type from m5d.xlarge to m5a.2xlarge

At the moment I can't change the instance type even when the instance is stopped. Can you enable this option?Thank you in advance.FollowComment

Answer: "0Hi, since you already stopped the instance, the other option is that hibernation mode is enabled.To view if an instance is enabled for hibernationOpen the Amazon EC2 console at https://console.aws.amazon.com/ec2/.In the navigation pane, choose Instances.Select the instance and, on the Details tab, in the Instance details section, inspect Stop-hibernate behavior. Enabled indicates that the instance is enabled for hibernation.You cannot disable it, so you ll need to launch a new instance from an image.Hope it helps ;)CommentShareEXPERTalatechanswered 2 months ago"


Question: Can an AFI support on the fly partial reconfiguration through providing AWS multiple DCPs or a partially reconfigurable DCP?

The goal is to have an FPGA in an F1 instance that can be partially reconfigured on the fly to support a variety of use cases. Could this be done through providing AWS a DCP that in itself partially reconfigurable so that the AFI produced can be partially reconfigured on the fly? Or perhaps could the developer provide multiple DCPs that could be loaded compiled onto the AFI and be loaded on the fly?FollowComment

Answer: "0Hello,Thank you for posting your query. I understand that you would like to know if it is possible to have a DCP that is reconfigurable, which in turn would allow the AFI to be reconfigurable.AWS Support has limited expertise on this subject and typically provide support on existing customer resources. With that said, the Github project is the best place to contact the service team directly, with regards to FPGA and AFI's[1]:https://github.com/aws/aws-fpga/issuesFurthermore, I have found that your user created a similar query on re:Post, where some guidance on this topic has been provided:https://repost.aws/questions/QUIjNk4calSDm_aa0gsX3KPA/can-we-live-switch-multiple-dcps-in-a-single-afiIf the information on that re:Post query does not completely answer your query, then I would suggest posting the query directly to the service team on the Github project.Reference:[1] https://github.com/aws/aws-fpga#developer-supportCommentShareSUPPORT ENGINEERFrancois_Banswered 6 days ago"


Question: Boto3 giving empty responses for 'Hourly' Cost Explorer queries

"Hi,I'm trying to use the recently added Hourly billing queries but I can't get it to work with boto3. I have had success using the very latest awscli (1.16.292), but version 1.10.28 of boto3 at least does not appear to work for me.The query I'm using:import boto3from datetime import datetime, timedeltaCURRENT_HOUR = datetime.today().replace(minute=0,second=0,microsecond=0)PREVIOUS_HOUR = CURRENT_HOUR - timedelta(hours=1)aws_client = boto3.client(    'ce',    aws_access_key_id=AWS_ACCESS_KEY_ID,    aws_secret_access_key=AWS_SECRET_ACCESS_KEY,)response = aws_client.get_cost_and_usage(        TimePeriod={            'Start': PREVIOUS_HOUR.isoformat() + 'Z',            'End': CURRENT_HOUR.isoformat() + 'Z',        },        Granularity='HOURLY',        Metrics=['UNBLENDED_COST'],        GroupBy=[            {                'Type': 'DIMENSION',                'Key': 'SERVICE'            },            {                'Type': 'DIMENSION',                'Key': 'LINKED_ACCOUNT'            }        ]    )Can anyone replicate this?Edited by: ElliottIwoca on Nov 29, 2019 3:44 AMEdited by: ElliottIwoca on Nov 29, 2019 3:48 AMEdited by: ElliottIwoca on Nov 29, 2019 3:48 AMFollowComment"

Answer: "0OK, I worked out that the "HOURLY" responses will respond empty if they are too recent. The most recent response I got was around 31 hours ago, so I will query 2 days in the past to make sure I get a valid response.CommentShareElliottIwocaanswered 3 years ago"