Question: Aurora Postgres upgrade from 11.13 to 12.8 failing - I assume due to PostGis

"Trying to upgrade our Aurora Clusters finally. Got them recently updated to 11.13, but every attempt I make to upgrade to 12.8 fails with"Database cluster is in a state that cannot be upgraded: Postgres cluster is in a state where pg_upgrade can not be completed successfully."Here are the logs which I think point to the culprit:2022-02-11 22:37:53.514 GMT [5276] ERROR: could not access file "$libdir/postgis-2.4": No such file or directory2022-02-11 22:37:53.514 GMT [5276] STATEMENT: LOAD '$libdir/postgis-2.4'2022-02-11 22:37:53.515 GMT [5276] ERROR: could not access file "$libdir/rtpostgis-2.4": No such file or directory2022-02-11 22:37:53.515 GMT [5276] STATEMENT: LOAD '$libdir/rtpostgis-2.4'command: "/rdsdbbin/aurora-12.8.12.8.0.5790.0/bin/pg_ctl" -w -D "/rdsdbdata/db" -o "--config_file=/rdsdbdata/config_new/postgresql.conf --survivable_cache_mode=off" -m fast stop >> "pg_upgrade_server.log" 2>&1waiting for server to shut down....2022-02-11 22:37:53.541 GMT [5185] LOG: received fast shutdown request2022-02-11 22:37:53.541 GMT [5185] LOG: aborting any active transactions2022-02-11 22:37:53.542 GMT [5237] LOG: shutting down................sh: /rdsdbbin/aurora-12.8.12.8.0.5790.0/bin/curl: /apollo/sbin/envroot: bad interpreter: No such file or directory2022-02-11 22:38:10.305 GMT [5185] FATAL: Can't handle storage runtime process crash2022-02-11 22:38:10.305 GMT [5185] LOG: database system is shut downI found several other articles that point to issues with Postgis, so I followed what they suggest, but no luck. First our cluster is running Postgis 2.4.4. So I went ahead and updated this to 3.1.4, tried the approach to restart the instance and validate its really using Postgis 3 and that all looks fine. Nothing helps though.If anyone has suggestions, I am happy to try.ThanksThomasFollowComment"

Answer: "0We are seeing the same error trying to upgrade to PG 12.The issue is that even after completely removing postgis from a PG 10 Aurora cluster (where postgis 3.1.7 is the available version) we have 98 rows in pg_proc for functions with $libdir/rtpostgis-2.4 in the probin column. So when we try to upgrade we get a similar message as the op2023-04-05 18:14:41.359 GMT [31870] ERROR: could not access file "$libdir/rtpostgis-2.4": No such file or directory2023-04-05 18:14:41.359 GMT [31870] STATEMENT: LOAD '$libdir/rtpostgis-2.4'I assume that at some point in the past postgis 2.4 was installed, but it's not there any more and we just need to have those references to it in pg_proc cleaned out but of course as it is a system table we can't do that so how do we proceed with the upgrade?CommentSharerePost-User-5910926answered 2 months agorePost-User-5910926 2 months agoI solved this by dropping the old functions with probin = '$libdir/rtpostgis-2.4'I used this query to get the list of functions (it generates the DROP FUNCTION statements as well as ALTER FUNCTION statements that change the owner of the function to my user):select 'ALTER FUNCTION ' || proname || '(' || oidvectortypes(proargtypes)::varchar || ') OWNER TO admin_user;', 'DROP FUNCTION IF EXISTS ' || proname || '(' || oidvectortypes(proargtypes)::varchar || ') CASCADE;' from pg_proc where probin = '$libdir/rtpostgis-2.4' order by proname, oidvectortypes(proargtypes)::varchar;SharerePost-User-5910926 2 months agoOne more thing, there was also an old view left over from the previous postgis installation - there was a postgis view named raster_overviews that caused the upgrade to fail - if you have removed postgis the raster_overviews view should no longer exist, if it does you may need to drop it manually like I did.Share0Thank you very much for your response. I would like to try to get this resolved without involving AWS support as it will be tedious with all the environments that have to go through this, potentially multiple times. Here is the output to the queries you gave me, sorry about the bad formatting, I hope its readable.SELECT SUBSTR(version(),1,18),postgis_full_version();| PostgreSQL 11.13 o |POSTGIS=3.1.4 ded6c34 [EXTENSION] PGSQL=110 GEOS=3.7.3-CAPI-1.11.3 b50468f PROJ=6.2.1 LIBXML=2.9.9 LIBJSON=0.12.99 LIBPROTOBUF=1.3.0 WAGYU=0.5.0 (Internal)SELECT extname,extversion,extnamespace::regnamespace,extowner::regrole FROM pg_catalog.pg_extension WHERE extname LIKE 'postgis%';| postgis | 3.1.4 | public | rdsadminSELECT probin,count(*) FROM pg_catalog.pg_proc WHERE probin LIKE '%postgis%' GROUP BY 1 ORDER BY 1;| $libdir/postgis-3 | 515SELECT name,version,installed FROM pg_catalog.pg_available_extension_versions WHERE name LIKE 'postgis%' order by 2,1;| postgis, 3.1.4, true | postgis_raster, 3.1.4, false | postgis_tiger_geocoder3.1.4, false | postgis_topology, 3.1.4, false | postgis, 3.1.4next, false | postgis_raster, 3.1.4next, false | postgis_tiger_geocoder, 3.1.4next, false | postgis_topology, 3.1.4next, false | postgis, unpackaged, false | postgis_raster, unpackaged, false | postgis_topology, unpackaged, falseSELECT count(typname) AS "number of installed raster types in pg_type" FROM pg_type WHERE typname IN ('raster', 'rastbandarg', 'geomval', 'addbandarg', 'summarystats', 'agg_count', 'reclassarg', 'agg_samealignment', 'unionarg');| 0CommentShareThomasanswered a year agoSeanatAWS a year agoLooking at the output of these queries is it possible that you have one or more other databases where postgis is installed on this RDS DB instance?I believe this is the case as you can see in the upgrade error you reported references to "$libdir/postgis-2.4" but in the query results for the database you ran we can only see "$libdir/postgis-3" and the other results show postgis 3.1.4 is installed correctly in that database at least.It's fairly common to miss another database which might not be the "main" database but still exists on the RDS instance with postgis installed but not in a clean state, sometimes I need to check many databases to pinpoint which one is causing the trouble.Share0Hi Thomas,Depending on the current installed state of postgis you may require assistance from AWS Support, however the following meta-data for the database which is triggering this error. You may need to check this data on multiple databases, the following SQL will pull data related to the postgis state which may help provide the next steps to resolve this issue.Can you share the information from the SQL below? If you open a support case this information will help the AWS Support team also.SELECT SUBSTR(version(),1,18),postgis_full_version();SELECT extname,extversion,extnamespace::regnamespace,extowner::regrole FROM pg_catalog.pg_extension WHERE extname LIKE 'postgis%';SELECT probin,count(*) FROM pg_catalog.pg_proc WHERE probin LIKE '%postgis%' GROUP BY 1 ORDER BY 1;SELECT name,version,installed FROM pg_catalog.pg_available_extension_versions WHERE name LIKE 'postgis%' order by 2,1;SELECT count(typname) AS "number of installed raster types in pg_type" FROM pg_type WHERE typname IN ('raster', 'rastbandarg', 'geomval', 'addbandarg', 'summarystats', 'agg_count', 'reclassarg', 'agg_samealignment', 'unionarg');CommentShareSeanatAWSanswered a year ago0If your problem is the same as mine, then its all about by default "hidden objects/databases". I use pgadmin and there is a setting to "Show System Objects". turn this on and you will be surprised how many more databases are there. For me postgis was installed in some system database too, so before I could upgrade the cluster I either had to remove postgis from the system databases or update postgis (the same way like you did in your database).CommentSharerePost-User-6516049answered 2 months ago"


Question: InvalidDefinition error when creating a step-functions state machine with a "Map" state in the docker image amazon/aws-stepfunctions-local for local testing

"Hi everyone,I am running the amazon/aws-stepfunctions-local docker image locally and creating a state-machine which contains a Map state. But the creation fails with the following error message:An error occurred (InvalidDefinition) when calling the CreateStateMachine operation: Invalid State Machine Definition: ''SCHEMA_VALIDATION_FAILED: These fields are required: [Iterator] at /States/MapState', 'SCHEMA_VALIDATION_FAILED: Field 'ItemProcessor' is not supported at /States/MapState''Is it possible to create a state-machine with a Map state in the docker-image amazon/aws-stepfunctions-local for local testing?More dailed description below:I am doing the following:docker run -d --name workflow_test -p 8083:8083 \--mount type=bind,readonly,source="$PWD/src/test/WorkflowTest_Mock.json",destination=/home/StepFunctionsLocal/MockConfigFile.json \-e SFN_MOCK_CONFIG="/home/StepFunctionsLocal/MockConfigFile.json" amazon/aws-stepfunctions-local # In another terminalaws stepfunctions create-state-machine \    --endpoint http://localhost:8083 \    --definition "$(cat src/test/test.json)" \    --name "LambdaSQSIntegration" --role-arn "arn:aws:iam::123456789012:role/service-role/LambdaSQSIntegration"where src/test/test.json contains the following:{  "Comment":"Test",  "StartAt":"MapState",  "States":{  "MapState": {"Type": "Map","ItemProcessor": {  "ProcessorConfig": {"Mode": "INLINE"  },  "StartAt": "MyTask",  "States": {"MyTask": {  "Type": "Task",  "Resource": "<my-arn>", # substituted  "End": true}  }},"End": true  }  }}FollowComment"

Answer: "2Accepted AnswerHello,We can definitely create a state-machine with Map state in the docker-image amazon/aws-stepfunctions-local. However, upon testing it with the latest Version: 1.12.0 [1], I could confirm that Step Function Local is not yet moved to new schema and therefore, "ItemProcessor" is currently not supported.Alternately, you may use "Iterator" in the state machine definition as follows :{  "Comment":"Test",  "StartAt":"MapState",  "States":{  "MapState": {"Type": "Map",                "Iterator": {  "StartAt": "MyTask",  "States": {"MyTask": {  "Type": "Task",  "Resource": "<my-arn>", # substituted  "End": true  }     }  },"End": true    }     }}I have created a feature request to the service team. While I am unable to comment on if/when this feature may get released, I request you to keep an eye on our What's New[2] and Blog[3] pages for any new feature announcements.[1] https://hub.docker.com/r/amazon/aws-stepfunctions-local/tags[2] https://aws.amazon.com/new/[3] https://aws.amazon.com/blogs/aws/CommentShareAkanksha_Tanswered 5 months agojim-salyer-efleets 5 months agoIs there a direct link to the feature request that we can follow? Our team is also experiencing this issue.Sharetoasty-postie 5 days agoAs above, we're experiencing the same issue, tested with the latest  amazon/aws-stepfunctions-local, 1.12.2. The fields were deprecated in Dec 2022 so it would be great to use the current language. Beyond name changes (Iterator to ItemProcessor and Parameters to ItemSelector), this issue means that it isn't possible to use Distributed Maps. Any current config needs to be backported to remove invalid fields (e.g. ProcessorConfig doesn't exist under Iterator) & as docs have been removed for Iterator/Parameters, you have to hunt for old docs or guess (!) the syntax based on old & current examples.Sharetoasty-postie 5 days agoIs it possible to get an update as to where this is at and a link to the feature request as @jim-salyer-efleets mentioned above?  A changelog/release notes for https://hub.docker.com/r/amazon/aws-stepfunctions-local would be really helpful - otherwise we as users are flying blind as to what's changed and when. I appreciate the links you mentioned @Akanksha_T but there's no mention of aws-stepfunctions-local in any past news article or blog post, which makes it seem unlikely there will be any time soon.Share"


Question: "In a EC2 host, where are the files of the website ?"

"Hello,My client has a website hosted with EC2 , I have been in the terminal (Cloudshell) and looked for a folder like /var/www , but I could not find anything related to his website.I also did not find a trace of a webserver (apache, nginx), so now I am wondering if I am even looking in the right place.So, how can I be sure that the Cloudshell I am looking into corresponds to the website of my client ? (about his website, I only have his URL)More generally, where are the files of his website ? :)Thanks a lotFollowCommentChamal 7 months agoAre you sure the website is hosted on this EC2 instance and not elsewhere, like S3? And do you not have access to at least the codebase of the website?The locations usually depend on the tech stack and configurations rather than EC2. I'd start looking in the home directory for ec2-user if there are any clues. Also check /var/log/cloud-init.log and /var/log/cloud-init-output.log to see if any user data script has been run to install or set up anything.SharerePost-User-4183691 7 months agoThanks, no I don't have access to the codebase of the site, I am looking for it :) (and I don't have a copy either to help me searching for it). I am sure it's a EC2 instance, I have checked with this https://hostingchecker.com/ and it returns : AWS EC2 (eu-west-3) (you can check as well, the website is https://api.savemypaquet.com).I have checked /var/log and the files you are mentioning are not there.ThanksShare"

Answer: "0Hi,Have you checked if there is a docker service running a container hosting a web service?CommentSharejcvipanswered 7 months agorePost-User-4183691 7 months agoHello, no I haven't checked, on the left panel in console.aws.amazon.com/ec2 where should I go ? there is thie "Image" section but I don't see anything thereSharerePost-User-4183691 7 months agoI am just wondering something very simple: how to find a trace of the URL's website in this EC2 dashboard ?Share"


Question: How to find a domain owner

"How do I find the owner of a certain domain?And when found, how do I find the contact details for the owner?FollowComment"

Answer: "0Adding to Azeem's answer, since the registrars (the companies that registers the domain names) are not required to provide the real name of the domain owners, you will find difficult to reach out to the person that owns the domain name. Normally you'll find just a generic e-mail like the one you see in Azeem's example above, hostmaster@amazon.com.CommentShareAndre_Manswered 5 months agoIsa 5 months agoHi Mello, thanks! Is there a way to find out the name/contact details of the domain owner?ShareAndre_M 5 months agoI found some tips on how to find out the domain owner at this URL --> https://www.shopify.com/blog/how-to-find-out-who-owns-a-domainI hope it helps.Share0Could you elaborate your question.In my understanding from your question you have a domain name eg: "example.com" and you want to find out who owns it and what are the contact details. If yes, there are few ways to do it.You can use whois cli from your windows/mac/linux terminal. It will show up the details.If you would like to use GUI approach you can use websites like https://who.is/% whois amazon.com % IANA WHOIS server% for more information on IANA, visit http://www.iana.org% This query returned 1 objectrefer:        whois.verisign-grs.comdomain:       COMorganisation: VeriSign Global Registry Servicesaddress:      12061 Bluemont Wayaddress:      Reston VA 20190address:      United States of America (the)contact:      administrativename:         Registry Customer Serviceorganisation: VeriSign Global Registry Servicesaddress:      12061 Bluemont Wayaddress:      Reston VA 20190address:      United States of America (the)phone:        +1 703 925-6999fax-no:       +1 703 948 3978e-mail:       info@verisign-grs.comcontact:      technicalname:         Registry Customer Serviceorganisation: VeriSign Global Registry Servicesaddress:      12061 Bluemont Wayaddress:      Reston VA 20190address:      United States of America (the)phone:        +1 703 925-6999fax-no:       +1 703 948 3978e-mail:       info@verisign-grs.comnserver:      A.GTLD-SERVERS.NET 192.5.6.30 2001:503:a83e:0:0:0:2:30nserver:      B.GTLD-SERVERS.NET 192.33.14.30 2001:503:231d:0:0:0:2:30nserver:      C.GTLD-SERVERS.NET 192.26.92.30 2001:503:83eb:0:0:0:0:30nserver:      D.GTLD-SERVERS.NET 192.31.80.30 2001:500:856e:0:0:0:0:30nserver:      E.GTLD-SERVERS.NET 192.12.94.30 2001:502:1ca1:0:0:0:0:30nserver:      F.GTLD-SERVERS.NET 192.35.51.30 2001:503:d414:0:0:0:0:30nserver:      G.GTLD-SERVERS.NET 192.42.93.30 2001:503:eea3:0:0:0:0:30nserver:      H.GTLD-SERVERS.NET 192.54.112.30 2001:502:8cc:0:0:0:0:30nserver:      I.GTLD-SERVERS.NET 192.43.172.30 2001:503:39c1:0:0:0:0:30nserver:      J.GTLD-SERVERS.NET 192.48.79.30 2001:502:7094:0:0:0:0:30nserver:      K.GTLD-SERVERS.NET 192.52.178.30 2001:503:d2d:0:0:0:0:30nserver:      L.GTLD-SERVERS.NET 192.41.162.30 2001:500:d937:0:0:0:0:30nserver:      M.GTLD-SERVERS.NET 192.55.83.30 2001:501:b1f9:0:0:0:0:30ds-rdata:     30909 8 2 e2d3c916f6deeac73294e8268fb5885044a833fc5459588f4a9184cfc41a5766whois:        whois.verisign-grs.comstatus:       ACTIVEremarks:      Registration information: http://www.verisigninc.comcreated:      1985-01-01changed:      2019-08-14source:       IANA# whois.verisign-grs.com   Domain Name: AMAZON.COM   Registry Domain ID: 281209_DOMAIN_COM-VRSN   Registrar WHOIS Server: whois.markmonitor.com   Registrar URL: http://www.markmonitor.com   Updated Date: 2019-05-07T20:09:37Z   Creation Date: 1994-11-01T05:00:00Z   Registry Expiry Date: 2024-10-31T04:00:00Z   Registrar: MarkMonitor Inc.   Registrar IANA ID: 292   Registrar Abuse Contact Email: abusecomplaints@markmonitor.com   Registrar Abuse Contact Phone: +1.2086851750   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited   Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited   Domain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited   Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited   Domain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited   Name Server: NS1.P31.DYNECT.NET   Name Server: NS2.P31.DYNECT.NET   Name Server: NS3.P31.DYNECT.NET   Name Server: NS4.P31.DYNECT.NET   Name Server: PDNS1.ULTRADNS.NET   Name Server: PDNS6.ULTRADNS.CO.UK   DNSSEC: unsigned   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/>>> Last update of whois database: 2022-12-20T12:54:04Z <<<# whois.markmonitor.comDomain Name: amazon.comRegistry Domain ID: 281209_DOMAIN_COM-VRSNRegistrar WHOIS Server: whois.markmonitor.comRegistrar URL: http://www.markmonitor.comUpdated Date: 2019-08-26T19:19:56+0000Creation Date: 1994-11-01T05:00:00+0000Registrar Registration Expiration Date: 2024-10-30T07:00:00+0000Registrar: MarkMonitor, Inc.Registrar IANA ID: 292Registrar Abuse Contact Email: abusecomplaints@markmonitor.comRegistrar Abuse Contact Phone: +1.2083895770Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)Domain Status: serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)Domain Status: serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)Domain Status: serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)Registry Registrant ID: Registrant Name: Hostmaster, Amazon Legal Dept.Registrant Organization: Amazon Technologies, Inc.Registrant Street: P.O. Box 8102Registrant City: RenoRegistrant State/Province: NVRegistrant Postal Code: 89507Registrant Country: USRegistrant Phone: +1.2062664064Registrant Phone Ext: Registrant Fax: +1.2062667010Registrant Fax Ext: Registrant Email: hostmaster@amazon.comRegistry Admin ID: Admin Name: Hostmaster, Amazon Legal Dept.Admin Organization: Amazon Technologies, Inc.Admin Street: P.O. Box 8102Admin City: RenoAdmin State/Province: NVAdmin Postal Code: 89507Admin Country: USAdmin Phone: +1.2062664064Admin Phone Ext: Admin Fax: +1.2062667010Admin Fax Ext: Admin Email: hostmaster@amazon.comRegistry Tech ID: Tech Name: Hostmaster, Amazon Legal Dept.Tech Organization: Amazon Technologies, Inc.Tech Street: P.O. Box 8102Tech City: RenoTech State/Province: NVTech Postal Code: 89507Tech Country: USTech Phone: +1.2062664064Tech Phone Ext: Tech Fax: +1.2062667010Tech Fax Ext: Tech Email: hostmaster@amazon.comName Server: ns3.p31.dynect.netName Server: ns4.p31.dynect.netName Server: pdns6.ultradns.co.ukName Server: ns1.p31.dynect.netName Server: ns2.p31.dynect.netName Server: pdns1.ultradns.netDNSSEC: unsignedURL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/>>> Last update of WHOIS database: 2022-12-20T12:54:02+0000 <<<CommentShareAzeem Ayazanswered 5 months ago0Thank you!What if it looks like this, how can I get in contact with the domain owner? (already tried to contact AWS but no answer since a week)Registrar InfoName: Amazon Registrar, Inc.Whois Server: whois.registrar.amazon.comReferral URL: https://registrar.amazon.comCommentShareIsaanswered 5 months ago"


Question: Issue sending email updates to encrypted SNS topic

"I have an SES configuration set that is sending updates to an SNS topic.I would like to encrypt that topic but I somehow need to give permission to SES to access the KMS key.I don't think I can attach a policy to the SES service directly and I can't edit the policy on the default KMS key.Does anyone know how to achieve this setup?Thanks,ArthurFollowComment"

Answer: "0Apparently this isn't possible, you need to create a customer KMS key and attach a policy approving the SES configuration set.CommentSharearthur-guyanswered 3 years ago"


Question: MTurk: editing batch after publishing

"If I go to the "Manage" section of MTurk and look at my published batch, it says "Note: If you have edited the Project after publishing this Batch, you will see the latest version."If I made any changes to my project, such as updating the keywords or changing requirements, do I have to cancel the currently published batch and then republish or can I just leave the published batch as it is?FollowComment"


Question: AWS VPC End Point

"Will there be any cost incurred if I use this EP within my application code?https://secretsmanager.<region>.amazonaws.comIf I create a VPC interface endpoint using the above default endpoint, will it cost?FollowComment"

Answer: "3Accepted AnswerHi,I think it will incur a cost until you delete it.Pricing per VPC endpoint per AZ ($/hour) (us-east-1) - $0.01From https://aws.amazon.com/privatelink/pricing/You can create AWS PrivateLink endpoints to enable private connectivity to a service that is either owned by AWS or owned by an AWS customer or partner. You will be billed for each hour that your VPC endpoint remains provisioned in each Availability Zone, irrespective of the state of its association with the service (learn more). Such hourly billing for your VPC endpoint will stop when you delete it. Hourly billing will also stop if the endpoint service owner rejects your VPC endpoint’s attachment to their service, and that service is subsequently deleted. Such VPC endpoints cannot be reused and you should delete them.From https://aws.amazon.com/blogs/architecture/reduce-cost-and-increase-security-with-amazon-vpc-endpoints/Interface endpoints allow you to connect to services powered by AWS PrivateLink. This includes a large number of AWS services. It also can include services hosted by other AWS customers, and AWS Partner Network (APN) partners in their own VPCs, By using AWS partner services through AWS PrivateLink, you no longer have to rely on access to the public internet. Data transfer charges for traffic from Amazon EC2 to the internet vary based on volume. After the first 1 GB / month ($0.00 per GB), transfers are charged at a rate of $ 0.09/GB (for AWS US-East 1 Virginia). Like gateway endpoints, interface endpoints can be secured using resource policies on the endpoint itself and the resource that the endpoint provides access to. Interface endpoints allow the use of security groups to restrict access to the endpoint.SriCommentShareSrianswered a year ago1If you create VPC Interface endpoint manually and if your application access the interface endpoint within VPC, it will cost.Please refer to link below.https://aws.amazon.com/privatelink/pricing/?nc1=h_lsThanksCommentShareEunsu_Shinanswered a year ago1Hello AWS-User-4124479, let us know if any of the answers provides solves your question. If so, please remember to click on the "Accept" button to let the community know that your question is resolved. This helps everyone. Thank you in advance.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago0The following blog post has relevant reference architectures and DT costs -- https://aws.amazon.com/blogs/architecture/overview-of-data-transfer-costs-for-common-architectures/CommentShareAWS-User-9819141answered a year ago"


Question: Registering a S3 repository to opensearch domain

"I am trying to register a repository to take a manual backup in opensearch. Right now I am achieving this trough python script. To avoid using script, I am trying to send a api PUT request through postman but getting a error telling anonymous user not authorized to pass role. If I pass a IAM user credentials in postman as aws signature, I am getting  "The request signature we calculated does not match the signature you provided".FollowComment"

Answer: 0Accepted AnswerYou most probably need to sign your requests with SignV4. See here for more infoCommentShareRoianswered 7 months ago


Question: State of Script Canvas as of 2019 (vs Lua)

"Hi guys, newcomer to Lumberyard here.I was trying to figure out if there is something that you could achieve with Lua that you could not achieve with Script Canvas (so that I don't need to learn yet-another programming language) and I got to this kind-of-old post (https://forums.awsgametech.com/t/lua-and-canvas-what-is-the-difference/4551/1) stating that Script Canvas was missing certain features such as debugging and feature nodes. So I wanted to know if those missing functionalities have been covered as of today and Script Canvas can do everything that Lua can in terms of Lumberyard.Thank you in advanceRegardsFollow"

Answer: "0Accepted AnswerHi @REDACTEDUSERScript Canvas is designed to use the exact same script bindings as Lua, this means that the same Lumberyard scripting features exposed to Lua are available for use in Script Canvas.It is also designed to allow you to extend it. You can write you own custom nodes in C++, enabling you to construct your own game's scripting building blocks.Most of the features in the post you mentioned are already available in Lumberyard 1.17, as of today there isn't much that you can do in Lua that you can't do in Script Canvas, and we're working on closing that gap.With GDC just around the corner I invite you to follow @AmazonGameTech on twitter, there's sure to be some interesting news.Luis SempéSr. Software Engineer | Scripting Team Lead | LumberyardSharerePost-User-2322203answered 4 years ago0That was quick! And right what I wanted to know :). Gracias Luis. I sure was already following @REDACTEDUSEROh! and thank you guys for your youtube series, they are beyond useful!RegardsSharerePost-User-6799335answered 4 years ago0Hi @REDACTEDUSERYes! We're still working on buttoning it up for release, but container support in Script Canvas will be available.Luis SempéSr. Software Engineer | Scripting Team Lead | LumberyardSharerePost-User-2322203answered 4 years ago0Has there been any support added to Script Canvas for some kind of array, list, or iterator functionality? That's one feature that I've found sorely missing from Script Canvas prompting me to not consider it over Lua. Array type Script Canvas variables would go far in closing the gap between what's possible in each.SharerePost-User-1217528answered 4 years ago0EDIT: nevermind I found it, I had to go into SC settings and enable preview to show all nodes.@REDACTEDUSERWhat happened to 'input handler',,trying to make script canvas for better player movement etc but I can't find input handler that was there in 1.17 release.Was it removed in favor of ?tySharerePost-User-2755327answered 4 years ago0Glad you found it! Sorry for the late response I'm currently at GDC and wasn't near my computer. Cheers!SharerePost-User-2322203answered 4 years ago0I never even thought about GDC so busy with so much to learn given I"m a single dev, and I hope its going well and LY getting notice ;)SharerePost-User-2755327answered 4 years ago"


Question: AWS Macie not identifying PII data properly (Names and SSNs)

"So I have started using the Macie service to do some data classification for a project I am building. I originally tried it with some JSON data that was put into a text file that contained US SSN numbers. I ran the Macie service to have it try and find this data and the scan did not return any findings.Next I figured that I would try the Macie scan on a an excel file with three columns. The first column had 5 first names, the second column had 5 last names, and the third column had 5 SSN numbers. Nothing else was in the excel file. I ran the Macie scan again and it still failed to find any sensitive data. I tried using the all managed identifiers scan and just the individual SSN scan and neither of them returned any findings.Does anyone know what I might be doing wrong and why Macie cant find simple SSN numbers? I am happy to provide more context as well as share the files if it will be helpful (all the SSNs are fake numbers for testing).FollowComment"

Answer: "0Hi - I used a simple .xlsx file with some fake first/last name and fake ssn. Created a job and it was able to identify as belowThe object contains personal information such as first or last names, addresses, or identification numbers.Also review some of the requirements mentioned here https://docs.aws.amazon.com/macie/latest/user/data-classification.htmlYou can also you can monitor and analyze specific events that occur as a job progresses https://docs.aws.amazon.com/macie/latest/user/discovery-jobs-monitor-cw-logs.htmlCommentShareEXPERTAWS-User-Nitinanswered 7 months agorePost-User-1738718 7 months agoHi Nitin thanks for your response. Could you share with me the excel doc you used and what the data looked like? Thank you for those links I have seen those as I have been investigating this problem. The cloudwatch logs just say that the scan was running and was completed but does not give me any insight into why Macie cant pick up on these sensitive data types.Share0Could you provide the sample file in the form of comma separated values in a comment?It's worth noting that Macie does have some validation built in to filter out fake numbers. For example, if you entered 123-45-6789 or 000-00-0000 as the SSN, it wouldn't trigger.CommentShareChris Simmonsanswered 7 months ago"


Question: AWS Quicksight Access - via Amazon Active Directory AND IAM Roles

"We are looking to expand services via AWS Quicksight, our use case would include Amazon subsidiary users who can be both in Amazon network and not. My question is it possible to setup new AWS accounts to allow BOTH Active Directory (for in network users) and unique IAM roles (for subsidiary/off-network users)?  If not what are the options to allow this type of access using SSO where possible.FollowComment"

Answer: "0Hello, Thank you for your question. Yes it is possible to set both active directory and IAM roles within an AWS account.You can assign Active directory users and groups to IAM roles and grant permissions to these roles. You can also use Quicksight with IAM.Here are the links with more information about Active directory:https://aws.amazon.com/blogs/security/introducing-aws-directory-service-for-microsoft-active-directory-standard-edition/https://docs.aws.amazon.com/quicksight/latest/user/external-identity-providers.htmlHere's the link if you need further assistance using Quicksight with IAM policies and roles:https://docs.aws.amazon.com/quicksight/latest/user/security_iam_service-with-iam.htmlCommentShareJosie_Kanswered 10 months ago0Hello, I have the same concern, only what would happen if I have my quicksight configured by SSO and I want to enter the mobile application with IAM users or the quicksight console by IAM users without being redirected to SSO?CommentSharehcantosanswered 6 months ago0No you cannot configure a single QuickSight account to use both AD and IAM users.  If you use AD it is all or nothing. If you use IAM you can federate users from multiple Identity Providers though (some internal some external for instance).CommentShareJesse-AWSanswered 2 months ago"


Question: ELB logging/monitoring best practices

My customer is implementing logging/monitoring around ELB Access and asking if AWS has any best practices to share. Specifically they want to know best practices around external ELB vs internal ELBs. Do we have any documents to share?FollowComment

Answer: 0Accepted AnswerFor logging/monitoring customers could make use of the metrics available through CloudWatch. There is also a re:Invent video that dives deep into ELB and its best practices.CommentShareEXPERTPrabhakar_Canswered 3 years ago


Question: Function of AWS IoT Greengrass

"As I am a starter, I would like to ask what is the basic functions of AWS IoT Greengrass.Now, I just only understand it can build, deploy and manage software. Thank you!FollowComment"

Answer: "0Hi,you can find more information about AWS IoT Greengrass in the developer guide. It also includes some tutorials to get started.Cheers,PhilippCommentSharePhilipp Sanswered 6 months ago"


Question: recover my account

"Hello,Please help me to recover my lost account. I have an EC2 machine associated with my email bjonoska@gmail.com, and cannot login to my console manager. So I opened this new account from a new email only to contact Customer Support.Thanks so much.Best,BIljanaFollowComment"

Answer: 0Please submit this form https://support.aws.amazon.com/#/contacts/aws-account-support/CommentShareEXPERTAWS-User-Nitinanswered 2 months agoEXPERTalatechreviewed 2 months ago


Question: AWS trusted entity with multiple principal types and condition

"have a Terraform code that generates a trusted entity like this that is attached to a role for cross-account access:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::444555666:root",                "Service": "backup.amazonaws.com"            },            "Action": "sts:AssumeRole",            "Condition": {                "StringEquals": {                    "sts:ExternalId": "444-555-666-777-888"                }            }        }    ]}If I intend to allow the AWS account with an externalId to assume the role and I also want the AWS backup service to adopt the role, is the generated resource policy correct? I don't know if the policies engine will pick the condition and try to apply it to the account and also to the service, which is not desired.Anybody knows if this is correct? are these kind of more complex rules documented by AWS?, I only have found info about simpler rulesI guess a way to ensure the correctness would be to separate both needs into different statements, but this is what the Terraform generates out of the provided HCL.thanksFollowComment"

Answer: "0I believe that the trust policy that you want is{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::444555666777:root",                "Service": "backup.amazonaws.com"            },            "Action": "sts:AssumeRole",            "Condition": {                "StringEquals": {                    "aws:PrincipalAccount": [                         "111222333444",                         "444555666777"                     ]                }            }        }    ]}where "111222333444" is the account hosting the role, assuming that you want AWS Backup to run in the same account as the role. If not, reduce the list to the single remote account, "444555666777", in the aws:PrincipalAccount condition statement. See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalaccount for more information about aws:PrincipalAccount .CommentShareAWS-Everettanswered 10 months ago0Hi, thanks for the answerindeed the vendor of the solution proposes the following policy to enable the backups:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "",            "Effect": "Allow",            "Principal": {                "Service": "backup.amazonaws.com"            },            "Action": "sts:AssumeRole",        }    ]}so this should work without specifying the same account IDthen, formerly I already had the following policy working:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::444555666:root",            },            "Action": "sts:AssumeRole",            "Condition": {                "StringEquals": {                    "sts:ExternalId": "444-555-666-777-888"                }            }        }    ]}the policy of the first post is the combination of the two policies that Terraform generates. However, I'm not sure if Terraform should have separated both policies into two statements or if it's correct. Notice that in your proposal and what I have written (Terraform) the policies engine has to figure out that the "Service": "backup.amazonaws.com" line only applies to the own account and not the external account ( "AWS": "arn:aws:iam::444555666:root",). The documentation of AWS doesn't specify if there's an array matching one to one, if there's an OR condition, etc. to determine what happens in this situation, so I'm wondering if someone knows about if the split in different statements is needed and how the statement is read by the IAM in case everything is put together into one statement.CommentSharejohn_awsanswered 10 months ago0If I understand you correctly this time, then yes, you can have a statement list. Also, use the aws:SourceAccount condition to restrict AWS backup to your local account.{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "AllowAWSBackupFromLocalAccount",            "Effect": "Allow",            "Principal": {                "Service": "backup.amazonaws.com"            },            "Action": "sts:AssumeRole",            "Condition": {                "StringEquals": {                    "aws:SourceAccount": [                         "111222333444"                    ]                }            }        },        {            "Sid": "AllowPrincipalsFromRemoteAccount",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::444555666777:root"            },            "Action": "sts:AssumeRole",            "Condition": {}        }    ]}CommentShareAWS-Everettanswered 10 months ago0Hi, I'd need to include the    "sts:ExternalId": "444-555-666-777-888" for the cross-account. However, the key point for me is if I can combine both statements into one as Terraform is generating. I don't know if then the condition applies to both principals or if the engine of aws iam is smart enough to detect the (   "sts:ExternalId": "444-555-666-777-888") as a condition only applies to the cross-account principal (and not to the service principal)CommentSharejohn_awsanswered 10 months ago"


Question: Environment variables not found in Spark env with EMR 6.x

"Hi,We are currently using EMR 5.x with Spark 2.4.x.We are running pyspark jobs and it's working fine.I tried multiple times to start using EMR 6.x and the spark jobs are always failing to read environment variables that are set during cluster creation.Inside the run job flow configurations, we have something like:{"Classification": "hadoop-env","Configurations": [{"Classification": "export", "Properties": {"someKey": "someValue"}}],}I've tried with "Classification": "spark-env" as well but it still does not work.The pyspark job always returns a KeyError that we don't have in EMR 5.x.I tried already back in spring 2020, but I write now as we would like to be able to use Spark 3.x from now on.I hope someone can help us.Best regards,ClaudeEdited by: claude8 on Oct 9, 2020 4:06 AMEdited by: claude8 on Oct 11, 2020 10:26 PMFollowComment"

Answer: "2I found how to fix this issue.I had to use the "spark-defaults" classifications and in the properties have something like {"spark.yarn.appMasterEnv.YOUR_ENV_VARIABLE": "the value"}.This is explained in the Spark documentation (https://spark.apache.org/docs/latest/configuration.html#environment-variables), however I don't understand why it was working differently in EMR 5.xCommentShareclaude8answered 3 years agoranald 7 months agoRan into an issue with EMR 6.60 where the encoding of Jupyter Spark was for some reason in ASCII instead of UTF8 like in Zeppelin and others. The problem only existed in Jupyter for whatever reason. The settings I used for EMR 5.x for the same issue stopped working, using your suggest of spark-defaults fixed the issue. Thanks!Share"


Question: "[Solved] Material Editor (Filter), not working?"

I trying change filter of texture and any time no changes :( Need see original image with pixels without adding filters and anti-aliasing.REMOVEDUPLOADp.s. Lumberyard 1.23.0.0Follow

Answer: "0Accepted AnswerYou can change the cvar r_TexMinAnisotropy to 0.The current value for this cvar is set to 16 in \dev\Engine\Config\CVarGroups\sys_spec_Texture.cfg file with highest setting.Any none-zero values will force the material textures samplers to use Anisotropic filter instead of filter you selected in material editor.By setting it to 0 will let the material using whatever filters specified in material editor.SharerePost-User-3971700answered 3 years ago0You'll want to right click the texture in the asset browser and click "Edit Texture Settings..." and then disable mipmaps and filtering there to get a cleaner pixelated image if that's what you want.SharerePost-User-9359627answered 3 years ago0No ChangesREMOVEDUPLOADSharerePost-User-0150549answered 3 years ago0Did you disable the filtering? Maybe try changing the filtering and leaving mip maps on.SharerePost-User-9359627answered 3 years ago0How disable the filtering ?SharerePost-User-0150549answered 3 years ago0How i understand filtering apply only wen texture rendering, and this setting sets in Material Editor (Shader).SharerePost-User-0150549answered 3 years ago0REMOVEDUPLOADSharerePost-User-9359627answered 3 years ago0Nothing, problem not in import settings. Problem In render. Texture rendering in scene, shader apply filter and not looks in shader settings, and you can't switch that filter :(.REMOVEDUPLOADSharerePost-User-0150549answered 3 years ago0Found this, and nothing. Date - Nov. 2017https://forums.awsgametech.com/t/texture-filtering/4326SharerePost-User-0150549answered 3 years ago0I don't know. I hope the lumberyard team takes note of this bug.SharerePost-User-9359627answered 3 years ago0Hi there!  Thank you for the feedback.  We're looking into the issue and will get back asap!SharerePost-User-4350143answered 3 years ago0SUPER !!! All Worked. Thank you all for answer and yours time :)REMOVEDUPLOADSharerePost-User-0150549answered 3 years ago"


Question: AWS IVS Player and JWPlayer

"I integrated the jwplayer with my the IVS player and everything works fine. I push to prod, all good. I can make changes and still good.I don't touch the project for a couple of days, no code changes at all, neither local nor prod player will play the test IVS test video, I get a 404 from live-video.net that the playlist can't be found. Yet it's the AWS IVS test video they run to test against. No changes have been made at all to the code.This has happened a couple of times now. I'm able to remove the jwplayer integration and it works again. But I'd like to use the jwplayer.Anyone else experience this? This is getting frustrating. Thanks.FollowComment"

Answer: "0Hi Andrew,The error code you have received is indeed due to the playback URL being incorrect per (https://aws.github.io/amazon-ivs-player-docs/1.12.0/web/interfaces/playererror.html). If the behaviour still persists,could you kindly cross-check there isn't any typo or spacing at the start/end of the URL,or check the behaviour is reproducible using https://debug.ivsdemos.com/or if you're comfortable to share the code snippet of the player, to reproduce from my side.CommentShareAWS-Sathia-Saithanyaanswered 9 months ago0Thank you for the reply, but the solution is embarrassingly simple: check to see if that stream is even available. The test stream was down for at least a day and a half, I finally tried to get it on other code samples and same issue on those. I just assumed it was the integration :facepalm. The stream is back now.*I am the original poster, not sure why I have different accounts.CommentSharerePost-User-7987631answered 9 months ago"


Question: [Lightsail] mysql-server crippled on Ubuntu 20.04 image?

"Hi all,I did a fresh installation today, just spinned a new instance on lightsail with Ubuntu 20.04 image and noticed that doing:sudo apt install mysql-serverBasically not only does it fails but it cripples the server completely hogging the CPU because the mysqld fails to start but somehow ends in the weirdest loop ever.All I know is that I can't set up the server and I haven't had a problem using another service.. I don't know if it's a mirror thing. It's been a weird turn of events.FollowComment"

Answer: "0davidg50,Thanks for using Lightsail. I am sorry to hear that you are having trouble with this setup. With problems like these the first thing I do is see if I can't easily reproduce the issue by trying what you did. I started up a Nano sized instance running Ubuntu 20.04 LTS and then issued the same command you mention below once it had come up.On the Nano instance my installation also failed and I experienced some CPU throttling as well. /var/log/syslog had this to say:Sep 28 23:49:48 ip-172-26-10-28 kernel: [ 1677.033109] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/mysql.service,task=mysqld,pid=5995,uid=113Sep 28 23:49:48 ip-172-26-10-28 kernel: [ 1677.033132] Out of memory: Killed process 5995 (mysqld) total-vm:731884kB, anon-rss:270104kB, file-rss:2012kB, shmem-rss:0kB, UID:113 pgtables:772kB oom_score_adj:0Sep 28 23:49:48 ip-172-26-10-28 kernel: [ 1677.064135] oom_reaper: reaped process 5995 (mysqld), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kBSo it seems the server daemon ran out of memory during startup.I tried this on the next size up (Micro) and it worked without problems.If you are using our smallest size instance to do this, you may consider bumping that up to the Micro size. If you are not using the Nano, please provide any snippets from your syslog or mysql error.log files to help diagnose the issue.I hope this helps!DonleyCommentSharedonleyatawsanswered 3 years ago0Hello,It seems mysql-server uses so much memory these days but yea that fixed my issue. I selected the 1GB ram lightsail instance and it went away.CommentSharedavidg50answered 3 years ago"


Question: AWS Marketplace SaaS Product Integration Testing - Registration edge cases

"I am an engineer designing a product integration with AWS Marketplace as a seller.  I'm finding some of the documentation around what would pass testing in order for the product to be published a bit vague.  It seems testing can take a while, so I'd like to minimize the back and forth during that phase by getting clarity now."Tested that you can accept incomplete registrations and multiple registration attempts."quoted from https://docs.aws.amazon.com/marketplace/latest/userguide/aws-marketplace-integration-checklist.htmlWhat does accept incomplete registrations mean?  I could see this being fulfilled by the product not falling over. I could see creating a temporary account that later the user can finish registering with the same details. How is this tested and what outcomes are going to be checked?What does multiple registration attempts mean?  Does this mean re-registering after the first attempt was completely successful?  Does this mean attempting to register multiple accounts with the same token? How is this tested and what outcomes are going to be checked?Thanks in advance.FollowComment"

Answer: "0"Tested that you can accept incomplete registrations and multiple registration attempts" is to make sure that the seller provides a buyer experience (similar to any product signup/sign-in experience) so that a proper message is displayed while buying a SaaS product on the AWS Marketplace. So, seller should display a error message for incomplete registrations and multiple registration attempts.CommentShareJCanswered 2 months agoJT 2 months agoThank you for your response. This doesn't help me with most of my questions, however. I've also tried reaching out to the Marketplace team for clarification.ShareJC 2 months agoMaybe this helps a bit more: Multiple registration attempts means that the customer can keep coming back through the redirect process outlined above multiple times, for the same MP purchase. This needs to be handled gracefully. Either ISVs can detect that the MP customer identifier has already been associated with a SaaS account on their side, or they can support associating multiple SaaS accounts with a single MP customer identifier.Share"


Question: S3 bucket PDF files can't be accessed using virtual hosting style links

"Hi there, I have a static website being hosted in an S3 bucket with Route 53 handling redirects to our short URL and everything is working well (I'm able to use relative paths in the HTML for pages, images, CSS etc.) except for with PDF files.  For some reason, the PDF files can't be accessed using virtual hosting style links (such as http://www.townepoint.org.s3-website-us-west-2.amazonaws.com/images/newsign3.JPG) and only path style links (such as http://s3.us-west-2.amazonaws.com/www.townepoint.org/TPOA+Commons.pdf) work.  This is breaking the ability to reference the files relatively like all of the other files on the site.Using the examples above, http://www.townepoint.org/TPOA+Commons.pdf is not a working URL when http://www.townepoint.org/images/newsign3.JPG does work.FollowComment"

Answer: 0Sure looks like something tricky going on there.  I noticed that this works:aws s3 cp s3://www.townepoint.org/images/newsign3.JPG foowhereas this gets "fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden":aws s3 cp s3://www.townepoint.org/TPOA+Commons.pdf fooSo as a first step I'd suggest reviewing bucket permissions and making sure that both the above work OK for other users.CommentShareEXPERTskinsmananswered a year ago


Question: No Wordpress option for Windows

"Complete noob here so sorry for the basic question: I was looking to deploy a simple WordPress website on AWS, I just need a website where I can upload my own HMTM/JavaScript. In my research on AWS I came across LightSail as a solution, read the documentation and watched the videos that looked super easy. But when I went to do it myself and choose the Windows instance, there is no option to install WordPress as shown in the videos. I do see this option under Linux but I know nothing at all about Linux.  I've searched the forums extensively and online but I cannot find a simple solution for using WordPress on a Windows instance. I did see in one forum response that MySQL is needed for WordPress, does than mean WordPress itself is only available for Linux?Thank you very much for any direction you can point me inFollowComment"

Answer: "0Hello,Thank you for your interest in Lightsail.WordPress is designed to work on Linux. It's fairly common for people to develop their WordPress content or code on Windows and then upload it to a Linux server. You can upload your files from a Windows PC to Linux using SFTP https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-connecting-to-linux-unix-instance-using-sftpRegards,GabrielCommentShareGabriel - AWSanswered 3 years ago0Perfect!Thank you GabrielCommentSharecutTheBlueWireanswered 3 years ago0gabrielataws wrote:WordPress is designed to work on Linux. It's fairly common for people to develop their WordPress content or code on Windows and then upload it to a Linux server.Strictly speaking, Wordpress is designed to run on PHP ... the OS isn't a major factor.I know of sites running Wordpress on Windows without a problem.  I'm also aware of sites running wordpress on IBM i (formerly iSeries, System i, & AS/400).That said, the most common OS that wordpress is run on is indeed Linux.davidCommentShareDavid Ganswered 3 years ago"


Question: Filter metrics inside dashboard

"Is there any way to filter our metrics inside a dashboard.I have a single dashboard containing metrics of two different accounts (dev and qa). Is there any way to add a filter like dev and qa inside that dashboard , so that if dev is clicked , dev metrics to be shown and vice versa. Everything to be done only inside that single dashboardThank you in advanceFollowComment"


Question: Cannot load Wordpress Multisite after setting primary domain

"Hi everyone.I have a domain registered through route 53 and the DNS zones and wordpress multisite set up through Lightsail.Everything was working until I went to change the primary domain, here https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-define-the-primary-domain-for-your-wordpress-multisiteAfter that, navigating to the domain leads to a server not found page. I also can no longer load anything from the static IP address. Trying to navigate to the static IP address redirects to http://[domain].com/wp-signup.php?new=[static ip].nip.io which also does not load. If I try to use the Bitnami command to change the primary domain back to the static ip or [static ip].nip.io I get a "too many redirects" error.I've double and triple checked and I'm almost positive I followed all the steps correctly. Has anyone else had this issue and know how to fix it?Thank you!FollowComment"

Answer: "0It simply started working on its own; I suspect the problem was that I wasn't patient enough. Sorry for wasting your time!CommentSharedragonmorgananswered 2 years ago0started working on its own, I suspect I wasn't patient enough, nothing to see here :)CommentSharedragonmorgananswered 2 years ago0How long did you wait? I waited for 4 hours, but still nothing shows up.CommentSharerandom-repostanswered 2 months ago"


Question: CodeDeploy sometimes fail with autoscaling

"I have an autoscaling with a run configuration using a windows image.I also have an application with an execution group and pipeline configured to deploy this autoscaling. Only deploy copying a .zip file from S3 to windows.It happens that sometimes the implantation works and other times it doesn't, what could cause this? When it fails, the deployment is pending for about an hour and then an UnkownError is generated in the ApplicationStop event.I don't understand why sometimes it works and sometimes it doesn't.FollowComment"

Answer: "2It might be because of the Healthcheck you have configured at the Loadbalancer level.CommentShareGovind Kumaranswered a month agoDeveloperG a month agoIt was actually something else. I was using an image on EC2 created for the A1 subnet (for example). In the autoscaling had configured to create the EC2 in any subnet, it happens that when he created for others than the A1 the error occurred. It was just configuring EC2 to always create in the same subnet as the image and it worked.I would have liked to have created the image without setting the default subnet so that it would use them randomly. When I use the standard AWS VPC it even works, but with my private one I couldn't do thatShare"


Question: Security Updates for PHP on Elastic Beanstalk

"HelloFollowing up on my post on the archived forums, we still have outdated PHP versions on Elastic Beanstalk: https://forums.aws.amazon.com/thread.jspa?threadID=347958&tstart=0Currently we're sitting at version 7.4.21 while version 7.4.27 is the newest as of this post. Of these 6 updates (which date back to July 1 2021; more than 6 months!), 4 of them are security related according to the php.net release log.I cannot comprehend how it can take you guys so long to get these versions updated. With the resources you presumably have at your disposal, it makes no sense to be so far behind on updates for a platform you support.Please take a look at this. Every security problem that's publicly documented and patched, but not applied to production instances, serves as an attack vector that can be utilized by anyone.Note that the outdated version issue also applies to PHP 8, we just happen to use 7.4.If you don't plan on improving this, at least explain why.FollowComment"

Answer: "0Nobody cares about this? Come on, guys.CommentSharenickdnkanswered a year ago"


Question: Push a container to Lightsail with AssumeRole and MFA

"We are using roles as best practices to access our various environments. I have set up my ~/.aws/config with the role:[profile dev]source_profile=defaultrole_arn=arn:aws:iam::987654321:role/MyRolemfa_serial = arn:aws:iam::123456789:mfa/MyUserThis works fine and I am prompted for my MFA code when running cli commands as expected and all is ok.However, when I run aws lightsail push-container-image with the Lightsail Control (lightsailctl) plugin I get an error:AssumeRoleTokenProviderNotSetError: assume role with MFA enabled, but AssumeRoleTokenProvider session option not set.Command '['lightsailctl', '--plugin', '--input-stdin']' returned non-zero exit status 1.I tried the other method of calling aws lightsail register-container-image. This requires the --digest flag, so I built and pushed my image to our GitLab image registry:docker build -t registry.gitlab.com/myorg/myimage:latest .docker push registry.gitlab.com/myorg/myimage:latestI then get the digest using docker images --digests. But when I run aws lightsail register-container-image I getAn error occurred (NotFoundException) when calling the RegisterContainerImage operation: Image with digest "sha256:7494ec375bd1948670750289069cfbb0caa7c08eaae821674ee5a54b0ee422d5" not found.I get the same NotFoundException if I push to AWS ECR.If I try to push to the Lightsail ECR reference after login I cannot connect and the layers are stuck retrying...PS > cat pwd.txt | docker login 585224773020.dkr.ecr.ap-southeast-2.amazonaws.com -u AWS --password-stdinLogin SucceededPS > docker build -t 585224773020.dkr.ecr.ap-southeast-2.amazonaws.com/myorg/myimage:latest .[+] Building 3.3s (17/17) FINISHEDPS > docker push 585224773020.dkr.ecr.ap-southeast-2.amazonaws.com/myorg/myimage:latest      The push refers to repository [585224773020.dkr.ecr.ap-southeast-2.amazonaws.com/myorg/myimage]a7cb1ff97502: Retrying in 10 seconds762b147902c0: Retrying in 10 seconds235e04e3592a: Retrying in 10 seconds6173b6fa63db: Retrying in 10 seconds9a94c4a55fe4: Retrying in 10 seconds9a3a6af98e18: Waiting7d0ebbe3f5d2: WaitingEOFFollowComment"

Answer: "1I think you'll need to authenticate with MFA before running the "push" command. These instructions might be helpful: https://aws.amazon.com/premiumsupport/knowledge-center/authenticate-mfa-cli/CommentShareAlexanswered a year ago0Accepted AnswerThanks, yes it appears mfa_serial is not useful in this scenario.Here are the steps I took to push an image:Set up your default profile in ~/.aws/credentials so you can call get-session-token:[default]aws_access_key_id=example-access-Key-for-an-IAM-useraws_secret_access_key=example-secret-access-key-for-IAM-userSet up a profile in ~/.aws/credentials to use with Lightsail:[mfa]aws_access_key_id=<not available yet>aws_secret_access_key=<not available yet>aws_session_token=<not available yet>Create an entry in ~/.aws/config for your role that will use the [mfa] profile:[profile mfa-dev]source_profile=mfarole_arn=arn:aws:iam::<account_id>:role/<role>Call get-session-token, passing in the token code from your MFA device:$ aws --profile default sts get-session-token --serial-number arn:aws:iam::<account_id>:mfa/<user>  --token-code xxxxxxThis will return credentials in JSON format. Copy the JSON values into your [mfa] profile in**~/.aws/credentials** :[mfa]aws_access_key_id=<value from JSON>aws_secret_access_key=<value from JSON>aws_session_token=<value from JSON>Set your environment to use the [mfa-dev] profile (this is in Powershell): $env:AWS_PROFILE = "mfa-dev"Push the image$ aws lightsail push-container-image --service-name <service> --label <label> --image <image>CommentShareMonkeyBitesanswered a year ago"


Question: PostContent ResponseCard Support

"According to  https://docs.aws.amazon.com/lex/latest/dg/howitworks-manage-prompts.html#msg-prompts-resp-card I cannot receive ResponseCards while using PostContent. I realize when people are using speech to interact with a bot, ResponseCards might not be useful, however for those who would like to display a response card, or even use the data in response cards to enhance their app there exists no way to use the nice Lex PostContent interface. Instead we would need to implement the speech recognition and synthesis ourselves and this feels like a waste when Lex has access already.This is a question/feature requestQuestion: Are there any ways to work around PostContent, other than reimplementing the speech features provided by Lex?Feature Request: Add an option to enable ResponseCards for the PostContent Api.FollowComment"

Answer: "0I got it working by using sessionAttributes.For those who are having my same problemThis only works if you can control the sessionAttributes (using a lambda)Simply encode the responseCard data and store it as a key/value pair in sessionAttributes (You can only store a string/string pair inside of the attributes, so encoding it as a JSON string works). You will need to decode this on the client side and then display it yourself.Note: If you want the responseCard buttons to work and reply with audioOutput you need to use postContent() with the contentType set to "text/plain; charset=utf-8"https://docs.aws.amazon.com/lex/latest/dg/API_runtime_PostContent.html#API_runtime_PostContent_RequestSyntaxhttps://docs.aws.amazon.com/lex/latest/dg/context-mgmt.html#context-mgmt-session-attribsCommentShareAskingQuestionsanswered 4 years ago"


Question: add an attachment along with templated email

"I need to attach a pdf to the templated email , how can i do that ?FollowComment"

Answer: "0Hello,To attach a PDF file to an Amazon SES templated email, you'll need to use the SendTemplatedEmail action along with a MIME message to include the PDF attachment. F.ex:import base64import boto3from email.mime.multipart import MIMEMultipartfrom email.mime.text import MIMETextfrom email.mime.application import MIMEApplication# Set your AWS region, sender email, recipient email, template name, and PDF file pathREGION = 'us-west-2'SENDER = 'sender@example.com'RECIPIENT = 'recipient@example.com'TEMPLATE_NAME = 'YourTemplateName'PDF_FILE = 'path/to/yourfile.pdf'# Initialize the SES clientses_client = boto3.client('ses', region_name=REGION)# Create the MIME container for the emailmsg = MIMEMultipart()# Add the email templatemsg.attach(MIMEText(f'{{"Template": "{TEMPLATE_NAME}"}}', 'ses'))# Attach the PDF filewith open(PDF_FILE, 'rb') as f:    pdf_data = f.read()attachment = MIMEApplication(pdf_data, 'pdf')attachment.add_header('Content-Disposition', 'attachment', filename='yourfile.pdf')msg.attach(attachment)# Encode the MIME messageraw_message = base64.urlsafe_b64encode(msg.as_bytes()).decode('utf-8')# Send the emailresponse = ses_client.send_raw_email(    Source=SENDER,    Destinations=[RECIPIENT],    RawMessage={        'Data': raw_message    })print(f"Email sent! Message ID: {response['MessageId']}")Hope it helps,Regards,CommentShareJorgeanswered a month ago"


Question: How can we set s3 lifecycle rule to delete the files form S3 bucket!

"I am trying to delete files form my bucket as two .csv files will be pushed in my bucket daily and i want to delete both files after 14 or 16 hours, and next day the same activity will be repeated as 2 new files will be pushed and then deleted.i think it only delete the files which get older then 24 hours if i am not wrong!any suggestion please!!FollowComment"

Answer: 0Leverage a Lambda with scheduled Cron to run the S3 Delete API for the objects.CommentShareEXPERTRob_Hanswered a year ago


Question: Lightsail and KMS

"I created a IAM user with access to Lightsail and KMS. Is this sufficient to call KMS? Since KMS is a core service, it will be helpful if you can bring KMS like S3 within Lightsail console.FollowCommentmn87 9 months agoPlease clarify how you would like to access the KMS.Are you a developer using an IAM user who wants to access KMS?Or is it an application in Lightsail?Share"

Answer: "1Hi! Lightsail uses a service-linked role in IAM which means that it is the service itself which has access to KMS to do what is needed for operating Lightsail. You can read more about that here https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-using-service-linked-rolesHope this helps!CommentShareBent_Tanswered 8 months agomn87 8 months agoI am not the one asking the question, but I am simply curious.In the Lightsail documentation that Bent_T referred me to, it appears that  service-linked role do not have permission to access KMS.It also states that service-linked role  cannot be edited.If this is the case, is it still possible to access KMS with  service-linked role?Incidentally, one method I have found for accessing other AWS services from Lightsail is to use the credentials of an IAM user. [1][1] amazon web services - Can I access AWS Parameter store from Lightsail instance?https://stackoverflow.com/questions/71818943/can-i-access-aws-parameter-store-from-lightsail-instanceShare0Accepted AnswerThe answer of service linked role provided was not helpful. What we did was create a IAM service account, provided IAM permissions for KMS. Then used API keys to encrypt/decrypt within my application hosted in Lightsail.CommentSharerePost-User-8628382answered 8 months ago"


Question: Lightsail Load Balancer with Plesk Ubuntu Wordpress Instances

"Hi,From all the documentation I've seen, AWS suggests that Lightsail Wordpress Highly Available and Scalable sites be set up with Wordpress Bitnami Instances.Can Plesk Instances be used in this kind of setup?  Is there any documentation to help show how to integrate Plesk Ubuntu instances with a Lightsail Load Balancer? (plus the other resources...Lightsail managed/RDS database, Cloudfront, etc.)Or is it not recommended to do so?Thanks!DavidFollowComment"


Question: Deleted volume still attached to instance

"Hi,I am unable to attache a new volume xvdb to an instance because it says there is already a volume attached to it.I ran "aws ec2 describe-instances --instance-ids i-0facb573439f86e77" and effectively there is an xvdb volume attached to it, but the volume is not showing on aws console.                "BlockDeviceMappings": \[                      {                          "DeviceName": "xvdb",                          "Ebs": {                              "AttachTime": "2019-02-23T13:00:42.000Z",                              "DeleteOnTermination": false,                              "Status": "attached",                              "VolumeId": "vol-036a842b4d29cc04c"                          }                      },                      {                          "DeviceName": "/dev/sda1",                          "Ebs": {                              "AttachTime": "2019-02-24T01:02:53.000Z",                              "DeleteOnTermination": false,                              "Status": "attached",                              "VolumeId": "vol-0b6f0ea451f8be630"                          }                      }                  ],  I later run "aws ec2 detach-volume --volume-id vol-036a842b4d29cc04c --force" and I get the following error:An error occurred (InvalidVolume.NotFound) when calling the DetachVolume operation: The volume 'vol-036a842b4d29cc04c' does not exist.I have tried starting the instance but it fails to start.I there any way to get this solved without having to terminate the instance and create a new one?ThanksFollowComment"

Answer: "0Hello,Thank you for letting us know about the problem. The issue seems to be related to our underlying AWS infrastructure and so I have created an internal ticket for our service team to investigate it. I will inform you when the issue is resolved.Thank you for your patience and please accept our apologies for the inconvenience caused.Regards,awstomasCommentShareAWS-User-3892169answered 4 years ago0This issue was resolved through supportCommentSharefeancosa12answered 4 years ago"


Question: Amazon GameLift announces updated console experience

"Hello GameLift Devs,Today, the Amazon GameLift team is excited to announce the launch of the updated Amazon GameLift console experience to help you more intuitively and efficiently manage and scale your game servers. Amazon GameLift customers asked us to streamline navigation, provide more monitoring and information about their game serves and instances, and add more helpful resources without having to leave the Amazon GameLift console.With this new release, you can now more easily manage various Amazon GameLift features such as creating builds, scripts, fleets, and FlexMatch rules using the redesigned left-hand navigation. The updated console includes over 80 new info panels, new pages to view information about your game server groups and instance pricing history, a completely new sample game, and a sample FlexMatch rule set to help you better configure and deploy your Amazon GameLift resources. With the extended Amazon CloudWatch integration, you can create your own dashboards and custom views such as instance performance, utilization/capacity, and player sessions. In summary, the updated console experience gives you more visibility, flexibility, and speed when it comes to managing and scaling your game servers on Amazon GameLift.To learn more about the updated Amazon GameLift console, see the following resources:What’s new postRelease notesSachin Gupta, Amazon GameLift PMFollowComment"


Question: creating multiple instance with same with single database?

"hi, i having a wordpress website and i create multiple instance on same region on lightsail. Add a lightsail managed database and connected loadbalncerbut i couldnt able to add most plugins, when we add a plugin and it will activate successfully, but when checking on another siteit says woocommerce plugin deactivated due to an error, the plugin does not exist. I can see that both are using same database. when we edit a post and adding update, it reflect on other servers as wellany solution?FollowComment"

Answer: "0Without knowing more details about the errors and related logs, it isn't easy to diagnose this.Having worked with WordPress in the past, I expect that the database contains values specific to the WordPress instance that the add-on was installed from, which breaks when trying to reference it from other instances. I imagine not every add-on has this restriction or uses instance-specific values, so mileage may vary for sharing a single DB with multiple WordPress installs.CommentShareCarlo Mencarellianswered 4 months ago0Thanks friend, while check creating website for multiple instance reduce the site loading, thats whyany other suggestionsCommentSharerePost-User-1636532answered 4 months ago"


Question: Unable to flat nested data from DocumentDB using Athena federated query

"Currently I'm trying to perform a federated query to DocumentDB.It is  now returning information but I'm not able to flatten nested data even though I've tried the approach provided in https://docs.aws.amazon.com/athena/latest/ug/rows-and-structs.html  (btw, I'm not casting the rows since I want to perform this transformation to the entire dataset) and also in https://developer.imdb.com/documentation/bulk-data-documentation/querying-in-athena/?ref_=side_nav .Error being SYNTAX_ERROR: line 3:5: Expression XXXXX is not of type ROWCould it be an issue with table schema?Any help with this will be truly appreciated.Thanks in advanceFollowComment"

Answer: 0I would like to inform you that this type of error“SYNTAX_ERROR: line 3:5: Expression XXXXX is not of type ROW”usually occurs when the nested data are queried with “.” without using UNNEST function on the nested field of the table while performing the query. Further You can also face such error when your table name is same as any of your column name and as Athena is case insensitive so even upper and lower case difference can cause this issue. You can also use “json_extract_scalar” to flatten your data. I have added some documentation for your reference . If you still face any error please raise a case to premium support from the respective account along with following informations :-query_idsmall data set with same schema.Reference:-[1] https://topjun.medium.com/how-to-flatten-json-array-in-athena-dddd46db8240[2] https://www.sledgeworx.io/querying-complex-json-objects-in-aws-athena/CommentSharerePost-User-3337999answered 6 months ago


Question: Player Role Permissions

"Hi,Not sure if this is the right board to ask questions about default 'roles' in Lumberyard.CloudCanvas automatically defines the "Player" role but I was curious about what qualifies as "Player". For example, when creating an API with 'AbstractRole' set to 'Player', I was under the impression that only logged in player's would be able to call that API, but realized that sample levels without user login were utilizing the same set up for their API's (i.e. text-to-speech api calls).Upon further inspection in the deployment-access-template.json file, it seems that there is a reference to cognito userpool though.I guess my question is, does the 'Player' role limit access to cognito users? or does it just give any of your game "clients" access, regardless if they're registered, access to the API?Follow"

Answer: "0Accepted AnswerHi Naotoy,You are correct. The "Player" role is granted to anyone who has obtained a valid id from our Cognito User Pool. The Cognito User Pool supports anonymous authentication. When your game is built with the Cloud Gem Framework enabled the game will obtain an anonymous Cognito id on startup.To enabled an authentication flow in your game you could enable our Cloud Gem Player Account gem.http://docs.aws.amazon.com/lumberyard/latest/developerguide/cloud-canvas-cloud-gem-player-account.htmlDoes that help clear things up?Happy New Year!TonyPSharerePost-User-7717892answered 5 years ago0Yup, it does but does! Is there any predesignated role that verifies that a user is logged into a non-anonymous & verified Cognito id (i.e. "PlayerLoginRole"). Lol, maybe I'm trying to get around an API auth too much but if it's implemented, I would love to use it!edit: I also noticed my project doesn't have a deployment-access-template.json file, is this normal?SharerePost-User-5509042answered 5 years ago0Hi @REDACTEDUSERThat definitely clears things up for me with the RoleAccess! Thanks!So for the deployment-access-template.json, can we disregard the files listed under 'Administration' in the Resource Manager now as they all return blank (since no such files exist in the project folder)? Instead, do we work in the Gems\CloudGemFramework\v1\ResourceManager\resource_manager\templates if we would like to edit any Role related behavior?SharerePost-User-5509042answered 5 years ago0Hi @REDACTEDUSERA separate "AuthenticatedPlayer" access role is on our near term to do list which on our current schedule would put it in the 1.15 release.Regarding the deployment-access-template.json file that is normal - this file used to live at tools/lmbr_aws/AWSResourceManager/default-project-content and get copied into the project folder but now lives at Gems\CloudGemFramework\v1\ResourceManager\resource_manager\templates and is not copied. Did you run into some documentation describing the old system?SharerePost-User-5014759answered 5 years ago0@CC_Brian Thanks for your replies! That definitely helps clear it up enough to lead me in the direction I wantedSharerePost-User-5509042answered 5 years ago0Hi @naotoy,So you can think of the files living under CloudGemFramework as the "defaults" and then we created a series of "extension" files which can live in your GameProject\AWS\ folder that can further customize/add to/restrict your resources which will appear under the Administration tab. In general you should be able to make changes here rather than editing the defaults directly since that could make integrating new code drops a bit trickier, though that is an option if you'd like to go that route. There's some documentation at https://docs.aws.amazon.com/lumberyard/latest/developerguide/cloud-canvas-resource-definitions.html under "Template Extension Files" which describes working with these files.SharerePost-User-5014759answered 5 years ago"


Question: SQL Server License Information

"Hi,May I please know if I deploy a SQL Server Enterprise Edition on my AWS Account, how may licenses will I need?Is the number of license required same as vCPUs of the EC2 instance?For eg. If I install SQL Server on a 16 vCPU instance, then will I need 16 SQL Server licenses?I currently have Enterprise edition SQL Server with Software Assurance installed on my local machine (out side AWS). It has 10 physical cores and 20 logical cores. I'm paying for 10 core license.So does that means I can use those 10 licenses for 10 vCPUs?I have gone through multiple documentations, so please don't point to any document. Would appreciate if I can get answer in yes or now for above two questions.Please help. Thank youFollowComment"

Answer: "0This page [1] should give you the mapping between EC2 instances & the number of cores you need to licensePlease also ensure you follow the instructions here [2] for signing up/verifying license mobility, as well as the instructions for using AWS License Manager to mange your BYOL licenses [3].Microsoft is still the authoritative source on their licenses, so their terms here [4] potentially could conflict with AWS documentation - please ensure you meet these requirements as well.[1] https://aws.amazon.com/windows/resources/licensemobility/sql/[2] https://aws.amazon.com/windows/resources/licensemobility/[3] https://docs.aws.amazon.com/license-manager/latest/userguide/getting-started.html[4] https://www.microsoft.com/en-us/licensing/product-licensing/productsCommentShareGreg_Hanswered 4 months agorePost-User-4631805 4 months agoThanks. But is there no simple answer for how Microsoft licence SQL server on EC2? I would like to know if it's one licence per vCPU?Share0Thanks. But is there no simple answer for how Microsoft licence SQL server on EC2? I would like to know if it's one licence per vCPU?CommentSharerePost-User-4631805answered 4 months ago0There really are no simple answers when it comes to Microsoft software licensing anywhere.From the first link I posted:  “To license individual VMs using the Per Core model, customers must purchase a core license for each v-core (or virtual processor, virtual CPU, virtual thread) allocated to the VM, subject to a four-core license minimum per VM.”This tells you 1 core license per vCPU, with a minimum of 4 core licenses. The table on the same page is a guide to help you determine how many core licenses you would need for each instance type.Please note that SQL Server Enterprise may have some other licensing considerations, for which you will either need to contact your Microsoft licensing rep, or your AWS Account Manager: "If you run Microsoft SQL Enterprise Edition, there are additional Microsoft License Mobility SQL Enterprise Edition options available. Speak to your account manager for more details."I would strongly recommend talking to your AWS Account Manager, or your Microsoft licensing rep to ensure you are fully covered if you are not clear on the licensing requirements of your specific licensing agreement.CommentShareGreg_Hanswered 4 months ago"


Question: Deploy web app to aws Iot greengrass

"How to publish a component and for a JS web project run by npm start? I tried upload my project.zip to AWS S3 and create the component using gdk component init --template HelloWorld --language python but the deploment failed. What can be the problem? And if the deployment success,where will be the web hosted? FollowCommentJoeAtAWS 6 months agoYour GDK command is creating a Python project. Do you want that or JS?What was the deployment failure message?Share"


Question: How to know from which Pod DNS request is originated?

"I am using AWS GuardDuty and EKS. Recently I got couple of alerts from AWS GuardDuty for DefenseEvasion:EC2/UnusualDNSResolver mentioning one of the EKS nodes are connecting to 1.1.1.1. When I check the running pods in the node, I couldn't find any pods suspicious.Is there a way to identify which pod or which process is exactly making the request to public DNS server?FollowComment"

Answer: "4Because the data source of GuardDuty finding DefenseEvasion:EC2/UnusualDNSResolver is VPC flow logs[1], so you can firstly collect the VPC flow logs into S3 [2] to trace the events (which is not collected by default), the query tool for VPC flow logs could be Athena[3] (using SQL), and then figure out which and when the source IP address(s) of EC2 instance and Pod established connection to 1.1.1.1 [4].[1] https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#defenseevasion-ec2-unusualdnsresolver[2] https://docs.aws.amazon.com/vpc/latest/userguide/working-with-flow-logs.html[3] https://aws.amazon.com/blogs/networking-and-content-delivery/analyze-vpc-flow-logs-with-point-and-click-amazon-athena-integration/[4] https://aws.amazon.com/blogs/networking-and-content-delivery/using-vpc-flow-logs-to-capture-and-query-eks-network-communications/CommentShareBard Lananswered 10 days ago"


Question: Replication between RDS and on premises Oracle

"I am planning to build a standard three tier architecture web portal with an RDS backend. Some of the data needs to be sync'd back to my on-premise Oracle database.I want updates from either source (the portal or the Oracle database) to sync to the other database in near real time.I have looked at DMS, Oracle Goldengate and using a Lambda function to trigger an update.Have you got any guidance on how to approach this problem?FollowComment"

Answer: 0Accepted AnswerIf you have a GG license already then that would be the first choice. If not then DMS but DMS does not do two way replication so you will have to address handling replication in both directions.  Other native replication options may work like looking at distributed transactions in Oracle.Another option would be to code the app tier to update both databases.CommentShareEXPERTJohn_Fanswered 3 years ago


Question: Workmail email migration to Namecheap

I want to migrate emails from AWS Workmail to NameCheap Cpanel hosting. How can I do that?FollowComment

Answer: "0Hello,Thank you for reaching out.Ideally, we have a definite process to migrate to AWS WorkMail using our partners. See Migrating to Amazon WorkMail.For more information about our partners, see Amazon WorkMail Features.To know the best migration steps to NameCheap, I would recommend reaching out to NameCheap to confirm if they have supported migration platform from WorkMail.Review Audriga which is a self service migration toolShould you need further clarification and assistance, feel free reach out to AWS Premium Support and Contact UsCommentShareChibuike_Aanswered a year ago"


Question: Ubuntu Mate AMI in "Community" leads to "Marketplace" and extra charge

"If you are building an instance, and you search for an AMI with 'Ubuntu Mate', you get a collection of results that include 33 Marketplace and 1 Community.  The Community AMI seems to come from Ubuntu themselves. It has an Ubuntu logo and a Verified Provider stamp.  It is defined as:Verified providerUbuntu Desktop 22.04 LTS - GUI Mate with VNC - v0822-852675f6-b132-4b36-844e-9bd39171a762ami-0256fae9ba5c5a428When I Select it, I get taken to an error:  Instance launch failed In order to use this AWS Marketplace product you need to accept terms and subscribe. To do so please visit https://aws.amazon.com/marketplace/pp?sku=7vs4oeivly897ootc0hciswv6   Following this link, I am taken to another Ubuntu offering by Arara Solutions, which is an extra cost offering.Why are these two items being confused?  How can I install the version from Ubuntu themselves?FollowComment"

Answer: "0Hello,With the Community AMI there isn't necessarily a filtering mechanism to confirm the authenticity of the AMI and the contents of the product is kind of not guaranteed and its at the user risk to try an AMI out. Whenever you create an AMI, you can add permissions to it to make it public. In that case, it goes to "community AMIs". Therefore, all Public AMIs are listed in community AMIs list regardless of whether they need marketplace subscription or not.I hope this answers your question. Thank you!CommentSharerePost-User-4831976answered 3 months ago"


Question: How does the Route 53 Resolver share endpoints across multiple accounts and VPCs?

"I want to use Amazon Route 53 as my DNS for both AWS and on-premises (both inbound and outbound). I have multiple accounts and VPCs. Does setting up the Route 53 Resolver for my use case require creating multiple endpoints, that is 1/2 per each VPC on each account?I see the following on the Route 53 pricing page:A Route 53 resolver endpoint includes one or more IP addresses. Each IP address corresponds to one elastic network interface (ENI). A single endpoint can be shared by multiple VPCs across multiple accounts within the same region.How is a single endpoint shared across multiple accounts? Is this related to private hosted zones and VPC associations?What's the best practice that I can follow for my use case?FollowComment"

Answer: "0Accepted AnswerIn most cases, you need only a single set of outbound and inbound endpoints between multiple accounts or VPCs. You need to use RAM for the sharing process. You don't actually share the endpoints themselves, but rather the Resolver rules and the ability to use outbound endpoint to forward requests defined by those rules to on-premises.The inbound endpoint is not shared. For the inbound endpoint, you just need to make sure that the VPC that hosts the endpoint has connectivity to on-premises. If you have a private hosted zone that needs to be resolved from on-premises, you need to associate that zone with the same VPC that hosts the inbound endpoints.CommentShareEXPERTAWS-User-7100868answered 4 years ago"


Question: "Is there a list of APIs for all AWS Services, which can ideally be checked programmatically ?"

"Hi,I am searching for a (programmatically checkable) list of all API calls for AWS services.Background is the usage of allow/deny of specific services in a service control policy (SCP).For example:If I would like to allow/deny AWS WAF, I need to allow/deny the following APIs in the SCP:"waf-regional:","waf:","wafv2:*There is from my point of view no easy way to find these information in the docs (https://docs.aws.amazon.com/cli/latest/reference/waf/index.html?highlight=waf or https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html).If there is any change for WAF, for example version 3 or additional features for the WAF, I would like to check a list in a scheduled way to look for changes and then add them to the SCP.Is there a consistent and easy way to get the information I need ?Kind regards,DavidFollowComment"

Answer: "0One way to approach this is toAllow all servicesDeny services not on your allow listSo even if there is a new service introduced, say 'waf3', that service will be denied.{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "AllowsAllActions",            "Effect": "Allow",            "Action": "*",            "Resource": "*"        },        {            "Sid": "DenyNotAllowList",             "Effect": "Deny",            "NotAction": [ "dynamodb:*", "s3:*" ],            "Resource": "*"        }    ]}The array of services under NotAction are the allowed services.CommentShareEXPERTkentradanswered a year agodsa a year agoHi, thanks for the response, this is a possibility, which I already use, but my main question is not solved.I want to easliy have a list of all API calls for services  which are available, so that I can detect waf3 and add it to my allow list, because I want that all waf services are usable as they are available and do not want to wait till somebody tells me: I want to use the new waf, but can't because of the SCP.For all other services I want them not to be automatically usable, so therefore the implicit deny works, but as I stated not for my main question.Share"


Question: launch template suddenly stopped working

"Hi,I have a simple launch template that fires up an instance based on an AMI built through Image Builder, which also distributes the ami to the template as a new version. All was working fine until yesterday when a colleague tried to launch an instance and it wouldn't proceed unless I put a value in for IOPS on the gp3 root volume. This is new. Previously it just went with a default for gp3 (3000) - now it has to be specified.I checked previous known good versions of the template, and they also displayed this change in behaviour - this rules out a change on my side. I also checked cIoudtrail to see if anyone else had changed anything - they hadn't. I have got my stuff working again, by removing 'gp3' as a volume type, but this seems to be an undocumented breaking change that I only picked up due a bit of ClickOps. What gives?FollowComment"

Answer: "0Hello Jim Boy,I can understand your frustration and am glad you have found a solution that works already. After reviewing the documentation on launch templates here https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html it states that it is necessary to specify an IOPS when using a gp3. If you would like to use the default amount you have to specify so in the launch template. Thank you!CommentShareEitan_Canswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 9 months ago"


Question: OS in Batch compute environment suddenly changed?

"Hi,I have multiple AWS accounts in which I use AWS Batch to run jobs. All Batch compute environments were created with the default EC2 AMI: ECS_AL1 (Amazon Linux). Here's part of the output from aws batch describe-compute-environments for one of my accounts:        "type": "MANAGED",          "state": "ENABLED",          "status": "VALID",          "statusReason": "ComputeEnvironment Healthy",          "computeResources": {              "type": "EC2",              "minvCpus": 0,              "maxvCpus": 64,              "desiredvCpus": 0,              "instanceTypes": \[                  "c4.large",                  "c4.xlarge",                  "c4.2xlarge",                  "c4.4xlarge",                  "c4.8xlarge"              ],              "subnets": \[                  "...",                  "..."              ],              "securityGroupIds": \[                  "..."              ],              "instanceRole": "arn:aws:iam::...",              "tags": {},              "ec2Configuration": \[                  {                      "imageType": "ECS_AL1"                  }              ]  In the past I could use yum, as you do in Amazon Linux, inside Batch jobs to install dependencies for my workloads.Yesterday I noticed that yum doesn't work anymore. I also noticed that the OS in my compute environments changed! Now it's Debian. Here's the output of cat /etc/os-release which I ran inside one of my Batch jobs:PRETTY_NAME="Debian GNU/Linux 10 (buster)"NAME="Debian GNU/Linux"VERSION_ID="10"VERSION="10 (buster)"VERSION_CODENAME=busterID=debianHOME_URL="https://www.debian.org/"SUPPORT_URL="https://www.debian.org/support"BUG_REPORT_URL="https://bugs.debian.org/"Why did the OS inside my Batch jobs change and how can I make it Amazon Linux again?For more context, I don't start Batch jobs directly. Metaflow (https://metaflow.org/) in a SageMaker Notebook instance does that for me.FollowComment"

Answer: 0Turns out Metaflow was the culprit. Metaflow's config has the following key which specifies the container image: METAFLOW_BATCH_CONTAINER_IMAGE.CommentSharezedsanswered 2 years ago


Question: How to handle failed lambda functions

"Hello everybody,I have a S3 bucket with files. A lambda function is called after an upload event is coming from my s3 bucket.Within my lambda (python based) function, I upload this file to my personal server outside of aws via a rest call.Problem:My rest endpoint is not always online. (For example system restart, updated etc or any other problems)·But I don't want to loose any files. Is there a nice aws way to retry to upload infinitely?(For example every hour?)Thank you :)FollowComment"

Answer: "3You have different options. The easiest I think would be to send the S3 events to an SQS queue with a VisibilityTimeout of 1 hour and a retention of 14 days. You will trigger the function from the queue. The function will try to upload the file to the API. If it failed, it will return a value indicating that the message processing failed. That message will become visible again in an hour and will be retried. This will happen up to 14 days, the maximum retention time for the queue.If 14 days is not enough, you could also set up a DLQ with many retries. If it failed all those retries the message will be sent to the DLQ. You will then be able to re-drive them back to the original queue for another round.There are other options for instance using StepFunctions. You will invoke a new state machine for each file. The state machine will call a Lambda function to upload the file. If upload is OK, state machine ends. If not, it gets into a loop with a Wait state. It can run for up to a year.CommentShareEXPERTUrianswered a year agoEXPERTBrettski-AWSreviewed a year ago0You could do it in a two step process: use the S3 event/lambda to create a record in a database (e.g. dynamodb) and then have another lambda that checks the database for files that need to be uploaded and does the upload. You can schedule that lambda to run every hour from a cloudwatch/eventbridge event.Another thing to consider is using a deadletter queue on your current lambda and then replay the events on the deadletter queue via a scheduled lambda.CommentShareRollerblade7answered a year ago"


Question: Is there an easy way to make changes when simulation is running?

"Hi everyone,When I create a new simulation job I see my nodes are working and doing their jobs. But then I wanna change a little part of the code or add a new node. After that here the steps I watch:Close the simulation.Do the changes or add some new features on Cloud9.Build, bundle and copy your code into S3.Run a new simulation.Do I have to repeat these steps all the time when I want to change something? I am wondering that is there an easy way to do these or not?Thank you.FollowComment"

Answer: "0You can restart the simulation job, which you can also do from the CLI/terminal. To improve ergonomics, set Job FailureBehavior to continue, Job Duration to the length of the development session (so the job doesn't terminate), Edit code, build, bundle, upload to S3 replacing the existing bundle, then Restart the job.CommentShareAWS-User-5010218answered 3 years ago"


Question: Build an IOS Application Tutorial - Trigger Authentication at Run Time

"Hi, still working my way through this tutorial & have worked out that I am on the latest Xcode with IOS 15. Hence some differences. Im trying to add Signin, Signet Code in Module 3 but my build (that succeeds) doesn't have an info.plist file. Wondering where it should go know or should I just create such file?Thanks in advanceFollowComment"


Question: Returning multiple responses for a query using Textract

"I am trying to use Textract to analyze legal documents and I have an issue with the query system. There are multiple attorneys listed on each complaint and I am trying to get a list of all of them as well as all their State Bar Numbers. Unfortunately, I can only get Textract to return one per document. Is it possible to get more than one response for a query?As an example of the documents I'm working with, I am trying to extract the attorney information which is on the top left of the document at this link. As you can see, there are two attorneys, (Carney R. Shegerian, Esq. and Anthony Nguyen, Esq.) along with two State Bar numbers, (State Bar No. 150461 and State Bar No. 259154.)FollowComment"

Answer: "0Are you using the console or the SDK?CommentShareAWS-User-5526165answered a year ago-1See the following example to retrieve key value pairs from a form:https://docs.aws.amazon.com/textract/latest/dg/examples-extract-kvp.htmlCommentShareAWS-User-2184908answered a year agorePost-User-1467000 a year agoThank you for your answer, but the documents I'm analyzing aren't arranged as key-value pairs, (I wish they were though!) Here's an example of the format I'm looking to parse. I'll edit my original answer to include this.https://images.law.com/contrib/content/uploads/documents/403/10688/JOHN-DOE-v.-OGLETREE-COMPLAINT-FOR-FILING.pdfShare"


Question: AWS Backup for S3 Storage Type failed with Access Denied

I enabled AWS Backup and its successfully worked for all resource types except S3 Backup as its failed with error Access DeniedFollowComment

Answer: 0Please take a look at the "Permissions and policies for Amazon S3 backup and restore" section in this documentCommentShareEXPERTIndranil Banerjee AWSanswered 7 months agorePost-User-6251017 7 months agoMany Thanks IndranilShare