Question: "WorkDocs drive app says storage limit exceeded, but web interface works properly. User cannot upload files through Drive App and windows file explorer."

"My 2 colleagues and I have been using amazon workdocs for a few months. I am the admin. Recently one of my colleagues (PowerUser1) has started getting the message "storage limit exceeded" on her drive app, so she cannot upload files through windows file explorer. She can download files. She does not face the upload problem when using the web interface. I tried logging in using the PowerUser1 account on my windows computer and the drive app works properly. Her firewall settings appear to be the same as mine. We have tried rebooting, and reinstalling. My other colleague (PowerUser2) has no issues.We recently had another user (GuestUser1) leave the company, so I set that person as an "inactive user". I don't see why this would relate to the problem I describe above, but the timing of the GuestUser1 leaving and PowerUser1 having problems seems to match.FollowComment"

Answer: "1Hi, I can help you out here. Do you know how much disk space Poweruser 1 has on her laptop? Do you mind checking this for me? ThanksCommentSharerePost-User-w6522502answered 8 months agoDerek 8 months agoThanks for offering to help. I was away for a few days.Poweruser1 has 2 drives -- one with 123 GB free of 232 GB, and one with 798 GB free of 931 GB. Her "network locations" shows her W drive (the workdocs drive) as about half full.Share1I was away for a few days so I am just seeing your reply. There is a known limitation with WorkDocs mirroring the available space on the main harddrive. This is because WorkDocs needs an extra X amount of disk space to transfer X amount of data. This sounds like a symptom of that limitation but it may not be the case due to your description of available disk space. To verify, can you try uploading a tiny file and seeing if that works?CommentSharerePost-User-w6522502answered 7 months agoDerek 7 months agoI got her to try uploading a 1 byte text file and it worked. I then got her to test by uploading some normal files and folders, and that worked properly also. She has been using the web interface for the last few weeks, so this was the first time that she tried the file explorer interface in a while. Strange that it works now and not before. Thanks for your help, although I don't know if this is actually a "solution" or not. Unless you think uploading the 1 byte file triggered a change.Share-1Adding David to answer your question.CommentShareShrutianswered 8 months ago"


Question: How to migrate email from hostgator to aws workmail?

"I have my own domain with about 20 email mailboxes hosted on hostgator. I want to start using AWS WorkMail instead of the server provided in hostgator. I have set up WorkMail with the test domain and it's working. How do I define users on WorkMail, as xxx@mydomain? The documentation keeps referring to the active directory, but hostgator has no such thing. What happens to the existing email messages if I just change the MX/TXT/CNAME records?FollowComment"

Answer: "0Hi,Thank you for choosing WorkMail. To start using your own domain with WorkMail, you can add it in the WorkMail console and verify ownership by creating the required domain records: Documentation. I suggest to wait with updating the MX record until you have created users in WorkMail to ensure you're not missing new incoming mail. Once the domain is verified you can add users with that domain. If all users are created you can update the MX record to point to WorkMail.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 10 months agodoug9f 10 months agoRobin, you missed an important part of my question: do I define users as xxx@mydomain or xxx@friends.awsapps.com? And what about existing emails on mydomain? Do I delete all the email addresses on mydomain when I have switched over to AWS?Sharerobinkaws MODERATOR10 months agoHI,I recommend to us your own domain. You can already verify you domain in WorkMail before you switch over to WorkMail. To migrate email, it depends what services that mail server supports. If it supports the EWS protocol you can use the WorkMail migration partners to migrate your old data. Another solution is to use IMAP sync or move mails via PST's exported and imported using Windows Outlook.You do not need to delete your old email address as the MX domain record will tell where to deliver email. So you can clean up the old stack while already using WorkMail.Kind regards,RobinShare0I'm still confused. If I add email xxx@mydomain to WorkMail, where does the email data physically reside? On my domain website or Amazon's? I added a dummy email and was not prompted for storage size like I'm normally prompted for. I assume that I manually add all the existing emails to WorkMail and when I switch MX/... records from mydomain to workmail, everything will work magically. If I don't delete the emails from mydomain (using CPanel), aren't they dead and taking up space on mydomain website?CommentSharedoug9fanswered 10 months ago0Hi,If you add your domain to an email address to a user in WorkMail it will allow that user to send email with that domain and that action configures WorkMail  systems to deliver mail for that email address to this user.To actually receive email in that mailbox you need to configure the MX record for that domain to point to WorkMail. As long as that points to your old provider mail will be delivered to that mailbox.After changing the MX record to point to WorkMail, mail will be delivered to WorkMail. But old data will still reside in the old mailbox and the other provider. Depending on the services available you can move that data manually or use a migration partner.After the switch to WorkMail you users will need to re-configure their mail client to connect to WorkMail as well.As for sizes, WorkMail mailboxes have a default mailbox size of 50GB. You can reduce the size of the mailbox in the WorkMail console.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 10 months ago"


Question: Lambda executing the default syntax rather than executing my code !

"https://pasteboard.co/K1Dopbz.pngMy old functions are working fine but if I create a new function and test it, it’s not considering my code and is just showing me output of the default syntax which is present when we create a new lambda.I’ve been trying since yesterday, please let me know how should I resolve this. My code is correct as it's working on another account but execution result are incorrect there as well.I’m using boto3 script under python_3.8 inside lambda function in ap-south-1 region.Edited by: AshutoshV on May 12, 2021 7:04 PMFollowComment"

Answer: "0We need to click on Deploy first before testing our Lambda function.CommentShareAshutoshVanswered 2 years ago0Could you please double check this answer? Doesn´t that void the job of testing? Actually, the problem I am having is that no matter what the body of my function does, since I am using the Hello world template for building my Test, I always get the result of a Hello World, like Hello AWS or something like that :(Can you please clarify how to test a lambda function in AWS? What test template are you supposed to use for Lambdas?CommentShareGeeAWSanswered 2 years ago"


Question: How does one monitor whether a certain EC2 instance was not launched from a golden AMI or has deviated from a patch configuration of a golden AMI

"Customers use golden AMI's such that developers use these golden AMI's for any compute needs. From a security perspective, the golden AMI's are patched up. However how does a customer monitor for any compute instances that are not launched from a certain golden AMI Or whether an certain Ec2 instance has deviated from a patched up AMIFollowComment"

Answer: "0Accepted AnswerYour customer can use AWS Config to monitor whether or not AMIs are launched from a pre-approved list of golden AMI images: https://aws.amazon.com/blogs/devops/aws-config-checking-for-compliance-with-new-managed-rule-options/Then, your customer can use SSM State Manager to detect drift from the golden AMI: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-state.htmlAlso, they can use a more "out of the box" solution with the new Golden AMI Pipeline: https://aws.amazon.com/blogs/awsmarketplace/announcing-the-golden-ami-pipeline/CommentShareAWS-User-2684542answered 3 years ago"


Question: MSK - HELP Backup

"Hi everyone, I need to create a backup for AWS MSK, and I found this article https://aws.amazon.com/en/blogs/big-data/back-up-and-restore-kafka-topic-data - using-amazon-msk-connect/ but the problem is that we have too many topics and new topics are created every day.How do I use this MSK backup solution in disaster recovery cases?FollowComment"

Answer: "0Hello Luis,I understand that you looking for Disaster Recovery solution for your AWS MSK topics. The blog you mentioned is currently the most effective method of backing up your MSK topic data.To adjust the suggested method from the blog for a Disaster recovery solution, I recommend using MSK connect to backup data from your topics to a single S3 bucket. When it comes time to recover that data, Amazon Athena can be used to query said data to a new MSK cluster using MSK Connect.You can move the MSK connector to the new cluster after recovery.Resources:https://docs.aws.amazon.com/msk/latest/developerguide/mkc-S3sink-connector-example.htmlhttps://docs.aws.amazon.com/athena/latest/ug/what-is.htmlCommentSharePrithvidhar_Panswered 10 months ago"


Question: CentOS7 AMI does not have ec2-net-utils package to configure secondary interface

"We have a CentOS7 (CentOS Linux release 7.9.2009 (Core)) AMI from the marketplace and we see that it does not have ec2-net-utils package installed.When we attach the secondary interface, IP gets assigned at the EC2 instance level, but on the OS level no IP is assigned to eth1 interface. Also, no files (ifcfg-eth1, route-eth1, rule-eth1)are created under /etc/sysconfig/network-scripts/ directoryCould not find any documentation to install ec2-net-utils.Cloud-init is already installed with the availabe latest version of 19.4.$ rpm -q cloud-initcloud-init-19.4-7.el7.centos.5.x86_64$Regards,GauravFollowCommentGauravMittal a year agoGot the solution for this issue. Below are the steps to compile and install the net-utils in the CenOS7yum -y install git make systemd systemd-units rpm-buildgit clone --branch=1.x --single-branch --depth 1https://github.com/aws/amazon-ec2-net-utils.gitcd amazon-ec2-net-utils/curl -LO 'https://github.com/aws/amazon-ec2-net-utils/archive/1.5.tar.gz'rpmbuild --define "_sourcedir $PWD" -bb amazon-ec2-net-utils.specls ~/rpmbuild/RPMS/noarch/yum localinstall ls ~/rpmbuild/RPMS/noarch/amazon-ec2-net-utils-1.5-1.el7.noarch.rpmShare"

Answer: 0Accepted AnswerGot the solution for this issue. Below are the steps to compile and install the net-utils in the CenOS7# yum -y install git make systemd systemd-units rpm-build# git clone --branch=1.x --single-branch --depth 1 https://github.com/aws/amazon-ec2-net-utils.git# cd amazon-ec2-net-utils/# curl -LO 'https://github.com/aws/amazon-ec2-net-utils/archive/1.5.tar.gz'# rpmbuild --define "_sourcedir $PWD" -bb amazon-ec2-net-utils.spec# ls ~/rpmbuild/RPMS/noarch/# yum localinstall ls ~/rpmbuild/RPMS/noarch/amazon-ec2-net-utils-1.5-1.el7.noarch.rpmCommentShareGauravMittalanswered a year ago


Question: Redirection www to non-www in AWS Lightsail

"I have a duplicate website the www. and the nacked version. I would like to redirect all traffic to the nacked link www to non-www traffic. I have updated the .htaccess file but it doesn't work.Coding used:RewriteEngine EnabledRewriteRule ^(.*)$ http://www.example.com [NC]RewriteCond %{HTTP_HOST} ^example.com/$1 [L,R=301]It seems that changes to the .htaccess in Apache are handled differently... And the edits are not applied.Could you advise me on how to handle the www to non-www redirection?FollowCommentalatech EXPERT4 months agoAre you using Cloudfront?Share"

Answer: "0Hello,I'm sorry to hear about the redirect issues.  I believe one of the following will achieve your goal.#1 - This sample redirects TO the wwwRewriteEngine onRewriteCond %{HTTP_HOST} ^example.com [NC]RewriteRule ^(.*)$ http://www.example.com/$1 [L,R=301,NC]#2 - This alternative instead redirects away from www to the higher level domainRewriteEngine onRewriteCond %{HTTP_HOST} ^www.example.com [NC]RewriteRule ^(.*)$ http://example.com/$1 [L,R=301,NC]CommentShareAWS-Andyanswered 4 months ago0Seems the Bitnami doesn't read the .htaccess file as none of the above code worked.Also I've got an issue with the Image Headers Expire, even though is also set in the file.# BEGIN Imagify: webp file type<IfModule mod_mime.c>AddType image/webp .webp</IfModule># END Imagify: webp file type# BEGIN WP Rocket v3.12.5.2# Use UTF-8 encoding for anything served text/plain or text/htmlAddDefaultCharset UTF-8# Force UTF-8 for a number of file formats<IfModule mod_mime.c>AddCharset UTF-8 .atom .css .js .json .rss .vtt .xml</IfModule># FileETag None is not enough for every server.<IfModule mod_headers.c>Header unset ETag</IfModule># Since we’re sending far-future expires, we don’t need ETags for static content.# developer.yahoo.com/performance/rules.html#etagsFileETag None<IfModule mod_alias.c><FilesMatch "\.(html|htm|rtf|rtx|txt|xsd|xsl|xml)$"><IfModule mod_headers.c>Header set X-Powered-By "WP Rocket/3.12.5.2"Header unset PragmaHeader append Cache-Control "public"Header unset Last-Modified</IfModule></FilesMatch><FilesMatch "\.(css|htc|js|asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|eot|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|json|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|otf|odb|odc|odf|odg|odp|ods|odt|ogg|pdf|png|pot|pps|ppt|pptx|ra|ram|svg|svgz|swf|tar|tif|tiff|ttf|ttc|wav|wma|wri|xla|xls|xlsx|xlt|xlw|zip)$"><IfModule mod_headers.c>Header unset PragmaHeader append Cache-Control "public"</IfModule></FilesMatch></IfModule><IfModule mod_mime.c>AddType image/avif                                  avif    AddType image/avif-sequence                         avifs</IfModule># Expires headers (for better cache control)<IfModule mod_expires.c>ExpiresActive onExpiresDefault                              "access plus 1 month"# cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5)ExpiresByType text/cache-manifest           "access plus 0 seconds"# Your document htmlExpiresByType text/html                     "access plus 0 seconds"# DataExpiresByType text/xml                      "access plus 0 seconds"ExpiresByType application/xml               "access plus 0 seconds"ExpiresByType application/json              "access plus 0 seconds"# FeedExpiresByType application/rss+xml           "access plus 1 hour"ExpiresByType application/atom+xml          "access plus 1 hour"# Favicon (cannot be renamed)ExpiresByType image/x-icon                  "access plus 1 week"# Media: images, video, audioExpiresByType image/gif                     "access plus 4 months"ExpiresByType image/png                     "access plus 4 months"ExpiresByType image/jpeg                    "access plus 4 months"ExpiresByType image/webp                    "access plus 4 months"ExpiresByType video/ogg                     "access plus 4 months"ExpiresByType audio/ogg                     "access plus 4 months"ExpiresByType video/mp4                     "access plus 4 months"ExpiresByType video/webm                    "access plus 4 months"ExpiresByType image/avif                    "access plus 4 months"ExpiresByType image/avif-sequence           "access plus 4 months"# HTC files  (css3pie)ExpiresByType text/x-component              "access plus 1 month"# WebfontsExpiresByType font/ttf                      "access plus 4 months"ExpiresByType font/otf                      "access plus 4 months"ExpiresByType font/woff                     "access plus 4 months"ExpiresByType font/woff2                    "access plus 4 months"ExpiresByType image/svg+xml                 "access plus 4 months"ExpiresByType application/vnd.ms-fontobject "access plus 1 month"# CSS and JavaScriptExpiresByType text/css                      "access plus 1 year"ExpiresByType application/javascript        "access plus 1 year"</IfModule># Gzip compression<IfModule mod_deflate.c># Active compressionSetOutputFilter DEFLATE# Force deflate for mangled headers<IfModule mod_setenvif.c><IfModule mod_headers.c>SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-EncodingRequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding# Don’t compress images and other uncompressible contentSetEnvIfNoCase Request_URI \\.(?:gif|jpe?g|png|rar|zip|exe|flv|mov|wma|mp3|avi|swf|mp?g|mp4|webm|webp|pdf)$ no-gzip dont-vary</IfModule></IfModule># Compress all output labeled with one of the following MIME-types<IfModule mod_filter.c>AddOutputFilterByType DEFLATE application/atom+xml \                          application/javascript \                          application/json \                          application/rss+xml \                          application/vnd.ms-fontobject \                          application/x-font-ttf \                          application/xhtml+xml \                          application/xml \                          font/opentype \                          image/svg+xml \                          image/x-icon \                          text/css \                          text/html \                          text/plain \                          text/x-component \                          text/xml</IfModule><IfModule mod_headers.c>Header append Vary: Accept-Encoding</IfModule></IfModule><IfModule mod_mime.c>AddType text/html .html_gzipAddEncoding gzip .html_gzip</IfModule><IfModule mod_setenvif.c>SetEnvIfNoCase Request_URI \.html_gzip$ no-gzip</IfModule><IfModule mod_rewrite.c>RewriteEngine OnRewriteBase /RewriteCond %{HTTPS} on [OR]RewriteCond %{SERVER_PORT} ^443$ [OR]RewriteCond %{HTTP:X-Forwarded-Proto} httpsRewriteRule .* - [E=WPR_SSL:-https]RewriteCond %{HTTP:Accept-Encoding} gzipRewriteRule .* - [E=WPR_ENC:_gzip]RewriteCond %{REQUEST_METHOD} GETRewriteCond %{QUERY_STRING} =""RewriteCond %{HTTP:Cookie} !(wordpress_logged_in_.+|wp-postpass_|wptouch_switch_toggle|comment_author_|comment_author_email_) [NC]RewriteCond %{REQUEST_URI} !^(/(?:.+/)?feed(?:/(?:.+/?)?)?$|/(?:.+/)?embed/|/(index\.php/)?(.*)wp\-json(/.*|$))$ [NC]RewriteCond %{HTTP_USER_AGENT} !^(facebookexternalhit|WhatsApp).* [NC]RewriteCond "%{DOCUMENT_ROOT}/wp-content/cache/wp-rocket/%{HTTP_HOST}%{REQUEST_URI}/index%{ENV:WPR_SSL}%{ENV:WPR_WEBP}.html%{ENV:WPR_ENC}" -fRewriteRule .* "/wp-content/cache/wp-rocket/%{HTTP_HOST}%{REQUEST_URI}/index%{ENV:WPR_SSL}%{ENV:WPR_WEBP}.html%{ENV:WPR_ENC}" [L]</IfModule># END WP Rocket# Redirect www to non-wwwRewriteEngine OnRewriteCond %{HTTP_HOST} ^www.tanic.design [NC]RewriteRule ^(.*)$ https://tanic.design/$1 [L,R=301,NC]# BEGIN WordPress# The directives (lines) between "BEGIN WordPress" and "END WordPress" are# dynamically generated, and should only be modified via WordPress filters.# Any changes to the directives between these markers will be overwritten.<IfModule mod_rewrite.c>RewriteEngine OnRewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]RewriteBase /RewriteRule ^index\.php$ - [L]RewriteCond %{REQUEST_FILENAME} !-fRewriteCond %{REQUEST_FILENAME} !-dRewriteRule . /index.php [L]</IfModule># END WordPressDo you know how I can fix this? Why the .htaccess is being dismissed?CommentShareyaizamartinezanswered 4 months ago"


Question: Problem routing traffic

"Hello,I've partially followed this guidehttps://aws.amazon.com/blogs/aws/new-vpc-ingress-routing-simplifying-integration-of-third-party-appliances/which explains how to route all traffic going through an internet gateway to a device (appliance), which then forwards it to the final destination (application).However, when I try to SSH to the "application", the traffic never reaches. If, instead, I remove the routing through the intermediate device, it all works normally.I'm trying to understand what could be the cause of this.Here is the exact setup:Internet gateway route table:10.0.0.0/16local10.0.1.0/24      network_interface_applianceAppliance route table10.0.0.0/16      local0.0.0.0 /0         internet-gatewayApplication route table10.0.0.0/16      local0.0.0.0/0          network_interface_applianceThe appliance is on subnet 10.0.0.0/24 and the application on 10.0.1.0/24The appliance has the ip forwarding as expected:sudo sysctl -w net.ipv4.ip_forward=1sudo sysctl -w net.ipv6.conf.all.forwarding=1When I try to ssh, I get a connectio timeoutThank you in advance for any helpFollowComment"

Answer: 0I had forgotten to remove the destination check.This can be done either usingaws ec2 modify-instance-attribute --region $AWS_REGION \                           --no-source-dest-check        \                           --instance-id $APPLIANCE_ID  or in the console -> actions -> networking -> Change source/dest checkNote: the instance must be stopped when applying this modification.CommentShareEddyMercuryanswered 3 years ago


Question: About S3 and DMS

"Hlw ,Actually i am facing an issue, my DMS is working properly it loaded all the tables but S3 is showing some tables...i didn't get what the main issues ..Please guide me .....FollowCommentD-Rao 9 months agoCan you pls. elaborate more on the issue? What;s the exact issueShare"


Question: AWS CloudFormation deployment of AWS Network Firewall

"I am deploying a Network Firewall setup (VPC, protected subnet, NAT subnet, firewall subnet, NAT GW, Network Firewall, IGW, route tables and routes) with CloudFormation.How can I setup a needed route in the route table?The route points to Network Firewall VPC endpoint in a specific subnet and I have to setup the route usingthe CloudFormation Type: AWS::EC2::Route:IGWIngressRoute:    Type: AWS::EC2::Route    DependsOn: NetworkFirewall    Properties:      RouteTableId: !Ref IGWIngressRouteTable      DestinationCidrBlock: !Ref NATGatewaySubnetCIDR      VpcEndpointId: <<<<<< here comes a specific Network Firewall endpoint The property VpcEndpointId should be set to a specific Network Firewall endpoint for a particular subnet.The Network Firewall resource contains the EndpointIds attribute with the list of all endpoints. I can get that list with !GetAtt NetworkFirewall.EndpointIdsThe problem: how should I proceed correctly to setup the route pointing to a Network Firewall endpoint?So far I have not found any sample CloudFormation snippet doing that.I understand, that the route setup can be done via CFN custom resource or post-deployment etc. But is it doable with CloudFormation template only?FollowComment"

Answer: 2Accepted AnswerYou will have to use a Custom Resource (or possibly a Macro). Passing in the EndpointIds and either sorting them or returning a structure that can be selected from.There's an open issue on the public resource provider which is worth tracking or contributing to.CommentShareEXPERTRaphaelanswered 2 years agoEXPERTBrettski-AWSreviewed 2 years ago


Question: RDS Instance not triggering an  storage auto-scaling event.

"I have an RDS Instance running SQL Server SE 14.00.3381.3.v1 Multi-AZ. The instance has autoscaling enabled with the upper threshold set at 4500GB,I have been getting database event notifications stating the free space is less than 10% for the last two daysThe free storage capacity for DB Instance: databaseName is low at 10% of the provisioned storage [Provisioned Storage: 3848.87 GB, Free Storage: 385.30 GB]. You may want to increase the provisioned storage to address this issue.Now my question is when does the scaling event trigger? I thought this might be done during the maintenance window, but the maintenance window was today morning and the storage auto-scaling was not triggered.I did update the Autoscaling threshold today morning to 5000GB to see if this solved the issue, but no storage scaling so far.The autoscaling of storage has worked previously, so not sure why the storage is not getting scaled up this time. is there anything in the RDS logs I should look for?ThanksSanoobFollowComment"

Answer: "2Dear Customer,Thanks for reaching out to us via AWS re:Post.AWS storage auto-scaling for RDS gets triggered based off the below conditions->With storage autoscaling enabled, when Amazon RDS detects that you are running out of free database space it automatically scales up your storage. Amazon RDS starts a storage modification for an autoscaling-enabled DB instance when these factors apply:Free available space is less than 10 percent of the allocated storage.The low-storage condition lasts at least five minutes.At least six hours have passed since the last storage modification, or storage optimization has completed on the instance, whichever is longer.The additional storage is in increments of whichever of the following is greater:5 GiB10 percent of currently allocated storageStorage growth prediction for 7 hours based on the FreeStorageSpace metrics change in the past hour. For more information on metrics, see Monitoring with Amazon CloudWatch[] Working with storage for Amazon RDS DB instances - Managing capacity automatically with Amazon RDS storage autoscaling - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIOPS.StorageTypes.html#USER_PIOPS.AutoscalingAuto-scaling does not exclusively wait for the maintenance window.Hope I was able to shed some light on the matter for you - Have a great rest of the day!CommentShareEXPERTNIRUPAM_danswered a year ago"


Question: S3 website Url not working with cloudfront when Public access is disable.

"Hi,S3 has static website enabled and configured through cloud front  using OAI.When s3 is public accessible , the cloudfront url is working , once S3 Public access is disabled , even website is not being accessed by cloudfront url and getting access denied.FollowComment"

Answer: "0Hi,Make sure bucket policies are also updated as pointed out here: https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-access-to-amazon-s3/.Hope it helps and if does I would appreciate if answer can be accepted so that community can benefit for clarity when searching for similar issues, thanks ;)CommentShareEXPERTalatechanswered 2 months ago0Check the Origin Domain value under the CloudFront -> Distribution -> Origin. You probably have the URL set to the website URL instead of the bucket URL.CommentShareEXPERTkentradanswered 2 months ago"


Question: How to automate the checking of Mechanical Turk Workers responses?

"We would like to set up an automated system that uses existing training data to check whether workers have correctly understood the task we have for them (it is a data classification task that is more complicated than most). This is so that we can give more work to those workers who perform well and avoid those who perform less well, so that when we move on to new data that needs classifying, we can do so with confidence in the workers involved.Does anyone have experience of how to do this/is able to help us set this up?FollowComment"


Question: Service Quota and Spot Instances vCPUs

"Customer is running at-scale processing of large datasets with Spot Instances. They want to know their limits for vCPUs per region and per account, however this information does not appear in Service Quota. However, "All <insert-instance-type-here> Spot Instance Requests" are available, but this limit is different from the "vCPU limit".What is the correct way to understand the limit on Spot Instances that the customer can launch?FollowComment"

Answer: "0Accepted AnswerAs of October 2020, Spot Instances moved to a vCPU based service quota and not instance based. The number seen in the Service Quotas page and the EC2 Limits page addresses the number of vCPUs in their quota. For example: In the quota with the name "All Standard (A, C, D, H, I, M, R, T, Z) Spot Instance Requests" you can see that the description is "The maximum number of vCPUs for all running or requested Standard (A, C, D, H, I, M, R, T, Z) Spot Instances per Region"CommentShareMODERATORAWS-User-8435852answered 3 years ago"


Question: I cannot use current_date + interval in Athena boto3 query in Lambda

"I am attempting to use Lambda to run an Athena query in order to schedule it to run weekly for a report.  When i run the query  directly in Athena, I get results.  When i run it as a python boto3 query, it does not work if I attempt to use 'current_date + intervalWorking in Athena Query Editor:SELECT * FROM "datebasename"."table" where date < current_date + interval '1' day);**Error when ran from Lambda **Syntax error in module 'lambda_function': invalid syntax (lambda_function.py, line 6)"stackTrace": [    "  File \"/var/task/lambda_function.py\" Line 6\n    query ='SELECT * FROM \""datebasename"\".\"table\" where date < (current_date + interval '1' day))'\n"  ]If I remove the '+ interval '1' day'  from the lambda athena query , it works.  I have tried with parenthesis, as well as tried using date_add, with similar results when i use an interval.Is there something I need to change to allow interval to work in boto3 athena query?FollowComment"

Answer: "1Accepted AnswerIt looks like a syntax error.  You have the query wrapped in single quotes in your python code and also have the '1' wrapped in single quotes.  You will need to either escape the single quotes on the '1' or remove the single quotes.CommentShareEXPERTChris_Ganswered a year agoEXPERTFabrizio@AWSreviewed a year ago0That was it! I think the output was a little misleading, but you were right.  I had to escape the single quotes of the '1' in the boto3 athena query, which was not necessary in athena query editor.FYI, removing the quotes did work, and resulted in another syntax error.Thanks you!CommentSharemkwtxanswered a year ago"


Question: AWS F1 Instance-- CL_SDE example: trying to use DPDK Pkt gen

"So I am using the AWS F1 instance with a modified CL_SDE example from the GIT repo.  We modified the HDL in the example to allow us to invert the loopbacked data through a control register, stop the internal loopback, see the last packet in/out on the control registers, and to see the packet counters....Something super simple but exercises a lot of our libraries...We run the testpmd tool and the packet counters we have matches the tool.  We see that the testpmd tool sends in a 64 byte packet as expected and that seems to repeat.  When I invert the data, the testpmd keeps reporting everything as loopbacking back just fine(no data integrity checking).  When I stop the traffic via my control register, traffic stops.  This all seems like the simple hardware does what I want and matches the sim we created.We are now moving over to use the DPDK pktgen tool to generate some more strenuous and controllable traffic.  I was able to get the DPDK pktgen libary to compile (I had to use the same tag for the GIT repo as the DPDK version).  It appears to have built and installed just fine.  However, it doesn't run well.  I have tried a number of things (devbind) and all sorts of things, but I keep getting a message saying "did not find any ports to use".In the Virtual ethernet example, the end to end example uses the PKTGEN tool to generate traffic and send it over an elastic network interface to another VM.  I am just trying to get PKTGEN to talk directly to the FPGA.  In the link below under end to end, I am just trying to get the PKTGEN tool to bind to the SPP directly.Has anyone been able to get the PKTGEN tool to work directly with the FPGA?https://github.com/aws/aws-fpga/blob/master/sdk/apps/virtual-ethernet/doc/Virtual_Ethernet_Application_Guide.md#HelloWorldLoopbackI have tried a number of things, but to no avail on this.Copyright (c) <2010-2020>, Intel Corporation. All rights reserved. Powered by DPDKEAL: Detected 8 lcore(s)EAL: Detected 1 NUMA nodesEAL: Auto-detected process type: PRIMARYEAL: Multi-process socket /var/run/dpdk/pg/mp_socketEAL: Selected IOVA mode 'PA'EAL: No available hugepages reported in hugepages-1048576kBEAL: Probing VFIO support...EAL: No legacy callbacks, legacy socket not created*** Copyright (c) <2010-2020>, Intel Corporation. All rights reserved.*** Pktgen  created by: Keith Wiles -- >>> Powered by DPDK <<<Port: Name         IfIndex Alias        NUMA  PCI!PANIC!: *** Did not find any ports to use ***PANIC in pktgen_config_ports():*** Did not find any ports to use ***6: [veth_app/Pktgen-DPDK/Builddir/app/pktgen() [0x404baa]]5: [/lib64/libc.so.6(__libc_start_main+0xea) [0x7ffa3d16013a]]4: [veth_app/Pktgen-DPDK/Builddir/app/pktgen() [0x4047fd]]3: [veth_app/Pktgen-DPDK/Builddir/app/pktgen() [0x42681b]]2: [/usr/local/lib64/librte_eal.so.20.0(__rte_panic+0xba) [0x7ffa3db5aeaa]]1: [/usr/local/lib64/librte_eal.so.20.0(rte_dump_stack+0x1b) [0x7ffa3db7a09b]]Aborted[ec2-user@ip-10-20-7-111 runtime]$FollowComment"


Question: Domain-join AppStream fleet profile management issue

"We are trying to deploy FSLogix profile management to a domain-joined AppStream fleet. We are also using folder redirection. Every time we try to enable profile management, I get a series of errors when the user logins in that they don't have permissions to the redirected folders of the test user. I'm using a domain user for the testing part of the sealing process, and it is applying the test user's redirected folders to any user that logs in instead of the logged in user's redirected folders. Of course the logged in user doesn't have rights to those folders and these are not the folders we need to access anyway. Anyone, know how to resolve this issue?FollowComment"

Answer: 0I believe I see the problem. It's trying to copy the contents from the test user redirected folders to the logged in user. I have disabled all home folders and application persistence settings on the stack. I don't believe it should be doing this and that is not what we want as we don't want to overwrite any files (See one example error below):CommentShareAWS-User-2639757answered 8 months ago


Question: [AWS BUG?] NLB stops working during blue/green deployment with code-deploy.

"I have a Fargate + ECS service, with an NLB with a TCP listener in 443 port and a TCP test listener in port 9443. We use NLB with TCP to do TLS termination the hosts (containers).I also have a second Target Group for blue/green deployments. All target types are setup to IPv4, and the service is working as expected outside deployments.I've run the following experiments:When I run my integration tests outside of a deployment (both listeners are pointing to the same target group) all tests pass against both listeners (443 and 9443).When I run them in the context of a deployment, in the AfterAllowTraffic hook (both listeners pointing to the replacement target group), all tests pass against both listeners (443 and 9443).When I run the tests in the context of a deployment, in the AfterAllowTestTraffic hook, after I checked that listener 443 points to the blue target group, and the listener 9443 points to the green target group with a healthy container, neither of them pass, they fail to establish connection. However, If I run the tests directly against the container instances by targeting their IP, then all tests pass.If I manually replicate the blue/green deployment setup, and point the test listener to other target group, so listener in 443 keeps pointing at a target group and then listener 9443 points to another target group, then both listeners STOP WORKING!If in the experiment #4,  I delete the listener on 9443, so there is only one listener in 443 targeting the blue target group, then it starts working again.Is this a misconfiguration on my side? It seems likely this is a problem in AWS-NLB side?FollowComment"

Answer: "0Accepted AnswerFound the issue. It was that during deployments, the client I used for Integration Tests was in us-east-1a while the service had only 1b and 1c AZs.I had to enable the cross-AZ option in the NLB and it now works.CommentSharemleonrivasanswered 6 months ago"


Question: Update Tags across entire account

"Is there a way to grant a role in AWS to be able to only update tags across the entire account? I am able to do that as a root user. But, would like a different approach.FollowComment"

Answer: "0Accepted AnswerI presume you mean being able to do add tags across ANY AWS resource on the account right? In that case, you can do that as the root user because by default it has unrestricted access to everything. In this case, for any other IAM entity, you'd have to look up the permissions for each service that pertains to tags. Such as ec2:CreateTags, iam:TagUser, iam:TagRole, rds:AddTagsToResource, etc. As you can see this will unfortunately be a cumbersome approach as the tagging APIs are not consistent across various services so sadly there isn't a quick policy you can have that will work across all services which is I believe what you're looking for. I recommend focusing on just the services your customer needs, looking up the APIs that relate to tag create, modify, delete, and non-mutable activities and create an IAM policy based off of that. If it's only for a handful of services then it shouldn't be too difficult, otherwise the task will be much more complex.Couple other useful resources you should keep in mind are checking whether the service supports ABAC and if you can use resource groups on supported services to tag multiple resources at once.CommentShareEXPERTgabawsanswered 3 years ago"


Question: How to upgrade from Ubuntu 16.04 to 18.04

"Hello all. I received an email that I need to upgrade from Ubuntu 18.04. I have just one instance (Lightsail) and it is running Ubuntu 16.04.Is there  a way that I can upgrade my 16.04 to 18.04 so that I can upgrade to the current Ubuntu version?I am, most definitely, a newbie...FollowComment"

Answer: "0Why can't you run a new 18.04 instance?CommentSharemyronix88answered 20 days agorePost-User-3217431 20 days agoIt looks as though 18.04 isn't available.SharerePost-User-3217431 20 days agoAre you suggesting that I start a new instance and move to that instance?Share0To safely upgrade from Ubuntu 16.06 to 18.04 without downtime in your application, it is better to create a new Lightsail instance with Ubuntu 18.04 and setup your application there. Once you get your application working in the new instance, you can deprecate the old instance.CommentSharerePost-User-1170069answered 20 days ago"


Question: Is it real to get UE4 Beacon port?

"Hey! My server listens on 2 ports and uses port 7777 for client connection and port 7787 for beacon connection. When starting a game session, if any of these ports are busy, IpNetDriver increments the port numbers and starts listening. This could be, for example, "7778 and 7788" or "7780 and 7791". There are no dependencies. The beacon client can only connect to the expected beacon port, but it changes every new game session. Is there a way to get the gaming session beacon port together with the server's IP and port as a search result?FollowComment"

Answer: "0The UE4 beacon is a customer specific implementation detail. Currently the 2 APIs for querying game sessions SearchGameSessions[1] and DescribeGameSessions[2] only have the capability to provide the GamePropeties/GameSessionData that were provided as part of the CreateGameSession[3] request. If the beacon port is variable and not available at the time CreateGameSession was called, there is currently no way to provide this as part of a search result.Once connected, the game client and server process communicate directly without involving the GameLift service. Would it be possible to communicate this information post initialization? If that is not possible, I would alternatively suggest coming up with a fixed convention to assign beacon ports. Here's an article[4] regarding how ports are handled when there are multiple server processes per instance (the customer can follow something on the lines of Option 2 while initializing their beacon).Refer relevant documentation:https://docs.aws.amazon.com/gamelift/latest/apireference/API_SearchGameSessions.htmlhttps://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameSessions.htmlhttps://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateGameSession.htmlhttps://forums.awsgametech.com/t/how-do-ports-get-handled-when-running-multiple-server-processes-per-instance/2287/2CommentShareSUPPORT ENGINEERNamratha_Kanswered a year ago"


Question: How to properly monitor Control Tower deployment while progress bar is frozen?

"The Control Tower progress bar has been sitting at 4% since it started 15 minutes ago:This is the fifth time I've tried to run Control Tower and it does this every time.  (It hasn't succeeded even once yet, and I have a brand new, fresh root account.)FollowComment"

Answer: "0Hi,2 possibilities:-As more resources are created at once, the "timestamp" will eventually advance,or it will fail to construct the resources.If you have already encountered the error but were monitoring it for one, I'd advise referring to this page. - https://docs.aws.amazon.com/controltower/latest/userguide/troubleshooting.htmlCommentShareAWS-CSinghanswered 4 months ago"


Question: MSK TimeBasedPartition  resulting in error

"Hi Team,I want the s3 bucket files to be prefixed with Timestamp of generation . i tried using the below tags.partitioner.class=io.confluent.connect.storage.partitioner.TimeBasedPartitionertimestamp.extractor=Wallclockorpartitioner.class=io.confluent.connect.storage.partitioner.TimeBasedPartitionertimestamp.extractor=Recordboth of the resulting in some java error.log look like:[Worker-0d72378639a66c465] org.glassfish.jersey.internal.Errors logErrorsandTask threw an uncaught and unrecoverable exception. Task is being killed and will not recover until manually restarted (org.apache.kafka.connect.runtime.WorkerTask:191)FollowComment"

Answer: "0HelloI understand that you would like to add the timestamp to the s3 objects written by the s3-sink connector.The s3 sink connector writes with the ojects to s3 with the format "<topic>+<kafkaPartition>+<startOffset>.<format>", refer [1] for the details of the format.You can modify the object name either by using lamdba function to read the messages in Kafka topics, refer[2] for further detailsKinesis firehose can also be used to write the messages in kafka topic to s3 with required format, refer[3] for further details.With regards to the error that you have mentioned, can you kindly open a case with AWS Support to investigate with Cluster, connector and IAM details.References:[1] https://docs.confluent.io/kafka-connectors/s3-sink/current/overview.html#s3-object-names/[2] https://aws.amazon.com/blogs/compute/using-amazon-msk-as-an-event-source-for-aws-lambda/[3] https://aws.amazon.com/blogs/big-data/kinesis-data-firehose-now-supports-dynamic-partitioning-to-amazon-s3/CommentSharerePost-User-4624066answered 6 months ago"


Question: instances with failed status checks

"Hello, i just receive this email from aws:EC2 has detected degradation of the underlying hardware hosting your Amazon EC2 instance (instance-ID: ******************) associated with your AWS account (AWS Account ID: *********) in the eu-west-3 region. Due to this degradation your instance could already be unreachable. We will stop your instance after 2023-05-05 14:00:00 UTC. Please take appropriate action before this time.My instance is running but with failed status checked, and im not being able to start my application on server again. Anyone can help me with that ?TksFollowComment"

Answer: "0Hi,What you can do is to stop and start the instance. Check below article:https://repost.aws/knowledge-center/ec2-linux-degraded-hardwareHope it helps ;)CommentShareEXPERTalatechanswered a month ago"


Question: Athena table for CloudWatch logs

"Hi, I have a custom cloudwatch group with the fields:  @timestamp, @ingestionTime, @logStream, @message, @log.I can't find any guide on how to create a table like this one for VPC flow logs: https://docs.aws.amazon.com/athena/latest/ug/vpc-flow-logs.htmlCan you help me with that?ThanksFollowComment"

Answer: 0This article details how to use the CloudWatch connector to query CloudWatch directly versus querying S3 for flow logs.  Let me know if this works for you!CommentShareChristian Lorisanswered a month ago


Question: AWS Glue Jobs 3.0 Unable to parse CSV file

"Hello, I am running a job to apply an ETL on a semi-colon-separated CSV on S3, however, when I read the file using the DynamicFrame feature of AWS and try to use any method like printSchema or toDF, I get the following error:py4j.protocol.Py4JJavaError: An error occurred while calling o77.schema.: org.apache.spark.SparkException: Job aborted due to stage failure: Task 0 in stage 1.0 failed 1 times, most recent failure: Lost task 0.0 in stage 1.0 (TID 1) (52bff5da55da executor driver): com.amazonaws.services.glue.util.FatalException: Unable to parse file: s3://my-bucket/my-file.csvI have already verified the codification, it is UTF-8 so there should be no problem. When I read the CSV using spark.read.csv, it works fine, and the Crawlers can also recognize the schema. The data has some special characters that shouldn't be there, and that's part of the ETL I am looking to perform. Neither using the from_catalog nor from_options function from AWS Glue works, the problem is the same whether I run the job locally on docker or Glue Studio.  My data have a folder date partition so I would prefer to avoid using directly Spark to read the data and take advantage of the Glue Data Catalog as well.Thanks in advance.FollowCommentGonzalo Herreros 3 months agoCan you share the full stacktrace, there should be a "Caused by" part giving more informationShare"

Answer: "0Accepted AnswerHello,Error "Fatal exception com.amazonaws.services.glue.readers unable to parse file *.csv" is observed when CSV is either not "UTF-8" encoded or if it has non UTF-8 encoded characters.As you have already verified that your CSV file is UTF-8 encoded and you mentioned that data has some special characters, please try running ETL job after removing these characters from file.Using a semi colon separated CSV file I have tested in my personal AWS account, I was able to run Glue ETL job successfully using the from_catalog function.Steps I followed for this test:1. Created a sample semi colon seprated CSV file.2. Created the table from this file using Glue Crawler.3. Created a Glue ETL job to read this table using from_catalog functionCommentShareSUPPORT ENGINEERShahrukh_Kanswered 3 months agoAftu 3 months agoThank you so much, when I did the conversion to CSV UTF-8 it appears the code was corrupted so the problem persisted but removing some characters before the conversion worked.Share"


Question: Seamlessly switch between CloudFront distributions using Route 53?

"My customer wants ultimately to migrate multiple CloudFront Distributions from one AWS Account to another but realize it’s not quite possible.Right now their CloudFront Distribution is configured this way:CNAME of the CloudFront Distribution is the same as a production customer-facing FQDN (e.g.: download-office.customer.com)in Route53 customer-facing FQDN is pointed to CloudFront Distribution FQDN using CNAME record (e.g.: download-office.customer.com CNAME d11ipsxxxxxxx.cloudfront.net)What they want to do is to introduce an intermediate FQDN and place it in between the customer-facing FQDN and CloudFront Distribution FQDN using Route53 Alias Records. So the configuration would look like:CNAME of the CloudFront Distribution is the same as a intermediate FQDN (e.g.: balancer-download-office.customer.com)in Route53 intermediate FQDN is pointed to CloudFront Distribution FQDN using ALIAS record (e.g.: balancer-download-office.customer.com ALIAS d11ipsxxxxxxx.cloudfront.net)in Route53 customer-facing FQDN is pointed to intermediate FQDN using ALIAS record (e.g.: download-office.customer.com ALIAS balancer-download-office.customer.com)It's working in their QA environment but they would like feedback on any issues. However, they are finding from support engineers that the only way to swap a CloudFront distribution without downtime is specifically through a support case.The question is: what is the best way for my customer to seamlessly switch between CloudFront distributions, and ultimately move to a CloudFront distribution in another account without downtime?FollowComment"

Answer: "0Accepted AnswerThe CloudFront team has the ability to migrate a CNAME between distributions without any downtime, though during the switch, some edge locations will respond with the old distribution, and some with the new one, as they receive the update. This can be done via a support ticket, if the migration is a 'one-off'.CommentShareEXPERTLeeAtk@AWSanswered 3 years ago"


Question: Give bucket policy to Bucket to be accessed by aws personalize but it not working

"{     "Version": "2012-10-17",     "Id": "PersonalizeS3BucketAccessPolicy",     "Statement": [         {             "Sid": "PersonalizeS3BucketAccessPolicy",             "Effect": "Allow",             "Principal": {                 "Service": "personalize.amazonaws.com"             },             "Action": [                 "s3:GetObject",                 "s3:ListBucket"             ],             "Resource": [                 "arn:aws:s3:::fashionrecommendationsystem",                 "arn:aws:s3:::fashionrecommendationsystem/*"             ]         }     ] } This is the bucket policy I have attached to my S3 bucket.FollowComment"

Answer: 1Accepted AnswerThere 3 (4 if u need encryption) steps in that article. Did you follow all three?1- Setting up permissions to set up permissions so Amazon Personalize2- Attach a policy to the Amazon Personalize service role3 - Attach a bucket policy to the Amazon S3 bucket - this one looks like u didCommentShareNikoanswered 2 months agoPavan Gole 2 months agoThank you for your response. The problem was as encryption was enabled by default in the S3 bucket. The objects of the buckets override that default encryption. Because of that it has given that error message.ShareNiko 2 months agoGlad you found the problem. Please remember to accept the answer if you found it helpful.Share


Question: Please help us moving out of the sandbox - redirected from support centre

"Dear Support,We're having issue with the sandbox access.To move out of sandbox, we followed the message on top of the console to Request a Sending Limit Increase, case id 5772894811.The request was approved:Thank you for submitting your request for a sending quota increase . Your new sending quota is 50,000 messages per day. Your maximum send rate is now 14  messages per second. We have also moved your account out of the Amazon SES sandbox.The quota and send rate have been increased as described, however the account is still in the sandbox as showing in AWS console, and we cannot send emails to unverified addresses (from a verified domain) neither via the api nor aws console.So we reopened the case again with screenshots and email sending error message, twice, and the last reply wasUnfortunately, I am not able to provide Amazon SES support through this channel. We encourage you to participate in the Amazon SES forum: https://forums.aws.amazon.com/forum.jspa?forumID=90 .Can anyone here help us please?ThanksFollowComment"

Answer: 0It turned out that the best way is to reopen the ticket again and again until someone can solve the issue.CommentSharejay-inlightanswered 4 years ago


Question: S3->SQS latency

"Hi,We have an S3 Event Notification configured to push to an SQS queue when a file is uploaded to a bucket. However, about an hour ago, these started coming in consistently ~20 minutes late, but only for some of our buckets.We didn't change any configs, and aren't running into any resource limitations as far as I can tell. There's nothing about this on the AWS status dashboard.Is this just something transient and we should "wait it out", or do we need to rearchitect around unreliability of S3 Event Notifications?Thanks!YakovFollowComment"

Answer: "0Yakov,Can you share with me your bucket names in a private message?--CarlCommentShareAWS-User-6108294answered 3 years ago"


Question: Error 53: The network path was not found with FSX Windows Share

"I've got several FSX shares working already and I'm just looking to add another one and for some reason, no matter what I get the error "Error 53: The network path was not found" when I try to create a new share using fsmgmt.msc. If I browse to the network share from file explorer, I'm able to browse to it and as expected it shows no shares. However, when I try to create a new share and I right click on "shares" I eventually get a dialog with the above error message.The share is on a private VPC along with all the other shares but anything new I try to create, fails with the above area.FollowComment"


Question: Can I fully authenticate to AWS iOT through API Gateway HTTP using only header authentication methods?

"HII am looking to build an app using FlutterFlow to interact with AWS iOT Core. The plan is to interact through the app and register iOT devices, and create / edit rules in iOT.The issue is that FlutterWave only has simple API authentication. I.e. they only allow authorisation through headers in the HTTP request.Is there a way to use Cognito or API Gateway, with a Lambda function if needed, to authenticate such that I can do more than shown here (publish mostly):https://docs.aws.amazon.com/solutions/latest/constructs/aws-apigateway-iot.htmlOr, do I need to authenticate through Congito and IAM such that the user is authenticated fully, and can create iOT devices, edit rules etc?There is also a way to authenticate through Firebase, not sure if that can help?ThanksFollowComment"

Answer: "0You could implement custom authorizer to validate the header request before to forward the request to IoT as described in the link you posted.If you want to use the REST API (as in the link posted) you can check here for information on how to create a custom authorizer via lambda. This would allow you to get the request header and verify it before your request is forwarded to IoTIf you want to use HTTP Api gateway (but I don't think you can link directly to IoT) you can check hereCommentShareMikianswered a year agoAWS-User-6834750 a year agoThanks Miki!I have looked through the documentation further and HTTP calls are restricted in what they can do, only publish.Plus, I don't think I can provision devices through the HTTP API.Do you know if there's a way to have someone hit an HTTP API gateway, and a Lambda function then upgrades that transmission to a MQTT or MQTT over WebSockets connection?Share"


Question: Asking for a friend - Cloudformation Parameters - Default : If condition

"Hello All,I have a ci/cd with a multi account strategy and multi accounts - right now I am trying to pass parameters to a cloudformation template that will be choosing in between different parameters set depending if the branchname is test xxxx or dev xxxxPlease find sample below############ VPC used depending on the Branchname ########################  VpcA:    Type: String    Default: "vpc-redacteda"  VpcB:    Type: String    Default: "vpc-redactedb"      VPCid:    Type: String    Description: VPC Used for the cluster position    Default: !If [IsTest, !Ref VpcA, !Ref VpcB]The error being returned is that every default member must be a string - is there a way around that ? perhaps using commadelimitedlist instead of string and passing the parameter in a single line.There's no matching use case on github or other platform....Help me awesome peopleFollowComment"

Answer: "0Accepted AnswerThe right way to do that is to have VPCId being an SSM parameter : https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-parameter.htmlYou will use !GetAtt Value to obtain its value: see final section of the aboveThen you can drive its value with your !If statement to VpcA or VpcB by using the !If construct that you already have.I am using this myself quite oftenYou may even go on a simpler path if you need VPCIOd only once.  You can insert  the condition directly at the place were you need id.See https://blog.shikisoft.com/aws-cloudformation-no-value-pseudo-parameter/SampleInstance:    Type: AWS::EC2::Instance    Properties:      InstanceType: t2.micro      SubnetId: !Ref WebServerSubnet      ImageId: !Ref ImageId      SecurityGroupIds:        - !If [ EnvironmentIsProduction, !Ref SecurityGroup, !Ref 'AWS::NoValue' ]CommentShareDidier_AWSanswered 21 days ago0Unfortunately decided against using the SSM Parameters route. However I have found you can get the effect I was looking for without.So to Address that point I have added all the parameters bunch that I needed in Mappings. Those mappings can be addressed afterwards within the same cloudformation template          ExecutionRoleArn:             !If [BranchNameEqualsTest,              !FindInMap [BranchParameters, test, 'ClusterTaskRole'],               !FindInMap [BranchParameters, dev, 'ClusterTaskRole']]         CommentShareJeremy ANCELINanswered 19 days agoDidier_AWS 19 days agoHappy that you found the right solution for your use case. Thanks for having accepted my answerShare0You may be able to use the PyPlate example Macro - see https://github.com/awslabs/aws-cloudformation-templates/blob/master/aws/services/CloudFormation/MacrosExamples/PyPlate/README.md.I haven't in any way tested this code, but once you make the PyPlate macro available, you could use something roughly like:Transform: [PyPlate]Parameters:  VpcA:    Type: String    Default: "vpc-redacteda"  VpcB:    Type: String    Default: "vpc-redactedb"      VPCid:    Type: String    Description: VPC Used for the cluster position    Default: |      #!PyPlate      isTest = ... (Get this from "params" dict or a condition in the "template" dict - not clear to me where you're getting this from)      output = params[VPCid]      if not output.startswith('vpc-'):        output = params[VpcA] if isTest else params[VpcB]CommentShareEXPERTskinsmananswered 21 days ago"


Question: Please explain instance reservation recommendations

"Can someone help me to understand the instance reservation recommendations provided by the AWS Cost Management?For instance, we make use of the following EC2 instances:2x m5.large3x t2.small1x t3.mediumBut, the reservation recommendations are:Buy 2 m5.largeBuy 12 t2.nanoBuy 8 t3.nanoWhy? Why wouldn't I just buy the exact number and type of instances that we use? Where do these t2.nano (12!) and t3.nano (8) recommendations come from? Supposedly this is based on the last 30 days of our actual usage, but our usage has been exactly as above for quite a long time.We also use Lambda functions.... but I don't think reservations can cover Lambda usage, right?Similarly odd recommendations are for our RDS and OpenSearch usage -- the recommendations only partially match our actual usage.And to be clear -- our actual usage has been stable for a long time.Any ideas?FollowCommentAWS-User-1252302 5 months agoSome helpful information:https://aws.amazon.com/premiumsupport/knowledge-center/regional-flexible-ri/https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/apply_ri.htmlShare"

Answer: "1Accepted AnswerThere's another question which perhaps covers the "why" here. When using Linux instances you'll see that the pricing is linear - a 2xlarge instance is twice the price of a large instance (as an example). So what you purchase is normalised behind the scenes for EC2.You're correct - reserved Instances don't cover Lambda but you might instead consider Savings Plans where you do the same sort of things as with Reserved Instances (commit to a specific amount of usage) but instead it is spread across whatever EC2 instances you use and other services such as Lambda.For RDS and OpenSearch, Reserved Instances are the way to go - if in doubt, please contact your local AWS team and they can help.CommentShareEXPERTBrettski-AWSanswered 5 months agoAWS-User-1252302 5 months agoAh, I see! So for example, my 1x t3.medium == 8x t3.nano. I guess the 8x is suggested to provide flexibility.Is this support for equivalence new (ish)? The last time I purchased reserved instances was about 2014, and I'm pretty sure then that one has to purchase the exact same reserved instance type as was used.ShareNataliya_G EXPERT5 months agoWe've launched size-flexible RIs since then (any Linux/UNIX RI with Regional scope and Shared tenancy is size-flexbile). In this case, any RI within the family and generation can apply to a running instance of any size within the same family and generation (if other attributes also match... like OS, tenancy, region...) - and RI recommendations engine will always go with the lowest size in the family to offer this flexibility to cover a certain number of normalized units (your total RI footprint), instead of exact number of instances that you are running, thus potentially increasing coverage.Share"


Question: Glue 3.0 UI improvement suggestion in table version comparer in dark mode

I am using the tool to compare the version of a table in Glue 3.0 in dark mode and there is an obvious problem in the interface colors of the modified columns.FollowComment

Answer: "1thanks for letting us know, we will be addressing thisCommentShareghudginsanswered 23 days ago"


Question: Unable to delete a Security Group Rule

"I added an Inbound Rule to a Security Group, temporarily.  After I was done with it, I attempt to remove it.  When I try I get the following error...There was an error modifying your security group inbound rulesThe specified rule does not exist in this security group.It is still listed as a rule, but I cannot delete it.Advice? thxFollowComment"

Answer: "0Check if you have permission to delete security group rules.Try to use cli command to delete the ingress rule, such as:aws ec2 revoke-security-group-ingress --group-name mySecurityGroup--protocol tcp --port 22 --cidr 203.0.113.0/24CommentShareChunminganswered 2 months ago"


Question: How to know if a CloudTrail event is a Management Event or Data Event?

"When analyzing an CloudTrail event, how to know if it is a management event or data event?FollowComment"

Answer: "1Accepted AnswerIf you look at the json of an event, you'll see a property "managementEvent": true, if it's a management event.In CloudTrail, you can go to Trails > click on the trail > and then you'll see a section for management event and data events, and you can edit those to choose which of either to include in your trail. That way you'll see a list of all currently supported data events.For more:Details on management events.[Details on data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html).CommentShareyann_stonemananswered a year ago"


Question: AWS Config - OrganizationConformancePack fails with NoAvailableConfigurationRecorderException

We are trying to deploy Organization Conformance Packs via CloudFormation. But the deployment always fails with the below exception:NoAvailableConfigurationRecorderException in 1 account(s)AWS Config recorder ist configured in the Management Account and we have completed the Prerequisites for Organization Conformance Packs. Trusted service access for AWS Config is enabled in our Organization by creating a multi-account aggregator and adding the organization.Our Cloud Landing Zone is created using Control Tower. Also we've followed this blog post to try the same with a delegated Administrator account. Last but not least we've given the config recorder role admin access and excluded all account except the Management Account in our template. Still no luck. Anyone having an idea how to solve this issue?FollowComment

Answer: 0Accepted AnswerProblem is solved. I've found out that one legacy member account which is not enrolled in Control Tower doesn't have Config activated. I've used CLI to deploy and troubleshoot it.CommentShareJonas Koeniganswered a year ago


Question: How to create a paginated reports

How to prepare a paginated reports and how to integrate quicksight dashboard to a websiteFollowComment

Answer: "0Hi ,please refer to the following resources to learn how to create a Paginated Report in Amazon Quick Sight:Create and Share Operational Reports at Scale with Amazon QuickSight Paginated ReportsVideo: Analytics Workshop: Create, Schedule, and Share Paginated Reports with AWSas for the Embedding question please refer to the following examples, more can be found searching the AWS Blog Portal:Embed interactive dashboards in your apps and portals in minutes with Amazon QuickSight’s new 1-click embedding featureQuickSight Workshop User-based Embedding or Anonymous EmbeddingFinally you can refer to the Amazon QuickSight Community for additional resources.hope this helps.CommentShareEXPERTFabrizio@AWSanswered 20 days ago"


Question: Service stuck in "pending" on EKS with Fargate

"Hi!I created a simple cluster and a simple deployment with service (see below).eksctl create cluster --name artem-cluster --region eu-west-1 --fargate --profile mfaapiVersion: apps/v1kind: Deploymentmetadata:name: sample-appspec:replicas: 2selector:matchLabels:app: nginxtemplate:metadata:labels:app: nginxspec:containers:- name: nginximage: public.ecr.aws/nginx/nginx:1.19.6ports:- name: httpcontainerPort: 80apiVersion: v1kind: Servicemetadata:name: sample-serviceannotations:service.beta.kubernetes.io/aws-load-balancer-type: nlb-ipspec:ports:- port: 80targetPort: 80protocol: TCPtype: LoadBalancerselector:app: nginxBut service is stuck in <pending> state -sample-service   LoadBalancer   10.100.5.193   <pending>     80:31505/TCP   5h57mIn "describe" I see the only string:Type    Reason                Age   From                MessageNormal  EnsuringLoadBalancer  29m   service-controller  Ensuring load balancerBy the way, if I create service without "service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip", it created successfully, butcurl <external_ip>:80 returns empty response, so I found in docs that I should use "nlb-ip" and now stuck with it.FollowComment"

Answer: 1Accepted AnswerAh in my case I didn't read through the prereqs closely enough and hadn't set up the AWS Load Balancer Controller. This is need to create an ALB or NLB targetting IP (like in Fargates case). I followed the steps here: https://aws.amazon.com/premiumsupport/knowledge-center/eks-alb-ingress-controller-fargate/CommentShareasdfjkl123answered 2 years ago0Following thread. I've also run into the same issue.CommentShareasdfjkl123answered 2 years ago


Question: AWS Glue Python Shell upgrade

"Hello AWS team,When is AWS Glue Python Shell is planned to be updated from version 3.6 to something more fresher?ThanksVitalyFollowComment"

Answer: "0Hello,The python version upgrade for AWS Glue python shell jobs is in the pipeline. However, we do not have an exact ETA around the same. I would recommend you to stay tuned to this link  for any AWS service updates.CommentShareSUPPORT ENGINEERChiranjeevi_Nanswered a year ago0Hello,we recently added support for python 3.9 and additional libraries to simplify the work of data scientists.To learn more please refer to this blog post.CommentShareEXPERTFabrizio@AWSanswered 10 months ago"


Question: Lambda limits for concurrent executions

"Hi Guys,we are thinking about implementing Lambda for our project. However we are not sure about concurrent executions limits.According to this resource:https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-limits.htmlThere is info that there is 1,000 concurrent executions default limit.But then bellow there is another info:Invocation frequency per Region (requests per second):10 x concurrent executions limit (synchronous – all sources)10 x concurrent executions limit (asynchronous – non-AWS sources)Unlimited (asynchronous – AWS service sources)Mismatch information: 1000 vs unlimited in case of AWS service sources and 1000 vs 10 concurrent executions limit in case of non-AWS sources.Which is correct? Maybe we just misunderstood it = could anyone elaborate it more?FollowComment"

Answer: "0The invocation frequency limit is not the same thing as the concurrent execution limit. The invocation frequency limit is based on the concurrent execution limit, and they describe two different things.The concurrent execution limit is how many active lambda instances your account may have at any given time. If this limit is reached, any subsequent invocation attempts will receive throttling errors until at least one of the active lambdas instances completes.The invocation frequency limit is 10x the concurrent execution limit, so for the default concurrent execution limit of 1000, the invocation frequency limit is 10000/second. This controls how many lambda instances can be started per second. If this limit is exceeded, invocation attempts will receive throttling errors until the rate of invocations slows. Notably, this limit only applies to lambdas that have sub-second durations, as if the duration is longer, it will first run into the burst concurrency limit and receive throttling errors from that first. See https://docs.aws.amazon.com/lambda/latest/dg/invocation-scaling.html for more information on the burst limit.Also please note that of the above limits you can request limit increases for the concurrent execution limit only, which will indirectly increase the invocation frequency limit.CommentShareEllisonanswered 3 years ago0Thank you very much for clarification. It is a clear now.CommentShareJelenikanswered 3 years ago0The invocation frequency limit is 10x the concurrent execution limit, so for the default concurrent execution limit of 1000, the invocation frequency limit is 10000/secondSo the concurrent execution limit is NOT the total number of executions at a given time, but the accumulated executions inside one given second, am I right?CommentSharenewme2021answered 2 years ago0Hi,1.000 concurrent executions are applied per-region and are shared across all Lambda functions in AWS accountFor synchronous invocations, each Lambda function can serve 10x "concurrent executions" per second. Please note that the "concurrent executions" is still shared across all functions.If you have a single Lambda function with invocations duration of 100ms, then you can have up to 1 invocations per 100ms, this means that in 1 second you will have 10 x 1.000 = 10.000 invocations.Regarding the asynchronous invocations, the invocation frequency is unlimited. However, you may still experience throttles, as explained in more details here [1]. AWS Lambda will handle the failures and it will retry the invocations and you have the option to configure the retry pattern of the failed invocations.[1] Asynchronous Invocation - https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.htmlCommentShareAWS-User-9460217answered 2 years ago"


Question: SQL server instance deleted from EC2

I have installed SQL Server on EC2 instance. After a few weeks it disappeared from EC2 instance as if it was never installed. All SQL files and apps have been deleted. Anyone ran into this issue before?FollowComment

Answer: 0I would start by taking a look through your CloudTrail logs and see if anything was done to this EC2 instance.  Is it possible someone terminated and re-launched with a new AMI or restored a snapshot?CommentShareEXPERTMatt-Banswered 5 months ago


Question: Is this sufficient? - Terminating Free Tier Cloud Watch Service

"Hi, I received 'Free Tier' expires soon E-mail Alert.Under Bills section, I have 1 Active service which is CloudWatchI have deleted Alarms and Logs as mentioned in this post. I also won't be using any metrics: https://repost.aws/questions/QUrVPNcEbhTgqdx-gzN41N3Q/how-can-i-remove-free-tier-cloud-watch-serviceAlarmsLogsMetrics - Under Metrics I have some items listed, but I won't be using them or sending the data anywhereDespite doing the above, under Bills section, cloudwatch is still shown as Active. (I have verified the Region as well)**All the above steps that I have done, are they sufficient so as to not incur any charges? Has the CloudWatch service been terminated now? **Please let me know.ThanksFollowComment"

Answer: "0You should also make sure you don't anything active in other regions.According to the pricing guide you can get charged for each Metrics that you have an alarm on.This is something you can use AWS Support for, they helped me once to find a NAT I left running.    They have the ability to look and tell you if you will be good or not.CommentShareRobert Loveanswered a month ago"


Question: Cannot set reserve concurrency for a lambda function

"The Unreserved account concurrency of my account is  100I have four lambda function in eu-central-1 and I want to limit the concurrency of one of them to a very small value. Specifically, I do not want more than 3 instances of this function running concurrently. This function is not expected to receive a lot of traffic so setting its Reserve concurrency to a low value makes a lot of sense.However, when I try to do I get a rejection message as follows: The unreserved account concurrency can't go below 100. (see attached screenshot).What should I do to be able to restrict the concurrency of this function?FollowComment"

Answer: "1Lambda provisioned concurrency can be reserved up to 100 less than the number of unreserved account concurrencies. [1][1] Managing Lambda reserved concurrency - AWS Lambdahttps://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.htmlTherefore, to set the provisioned concurrency to 3, the account concurrency must be greater than 103.The concurrency limit can be requested via service quotas. [2][2] AWS service quotas - AWS General Referencehttps://docs.aws.amazon.com/general/latest/gr/aws_service_limits.htmlCommentSharemn87answered 8 months agoIndranil Banerjee AWS EXPERT8 months agoProvisioned concurrency and reserved concurrency are different things. I believe you intended to say Reserved Concurrency and not Provisioned ConcurrencyShare1You have to leave a minimum of 100 for lambda functions in an account that don't have reserved concurrency - https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html that mentions "You can reserve up to the Unreserved account concurrency value that is shown, minus 100 for functions that don't have reserved concurrency."You have to request an increase in the account concurrency to a number higher than 100, so you can set reserved concurrency for certain lambda functions in your account.CommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago"


Question: Usage of StreamingFileSink is throwing NoClassDefFoundError

"I know this could be my problem, but trying to graple it for a while. I am trying to run flink in AWS EMR cluster.My setup is: Time series event from Kinesis -> flink job -> Save it to S3    DataStream<Event> kinesis =                env.addSource(new FlinkKinesisConsumer< (this.streamName, new EventSchema(), kinesisConsumerConfig)).name("source");    final StreamingFileSink<Event> streamingFileSink =                StreamingFileSink.<Event>forRowFormat(                        new org.apache.flink.core.fs.Path("s3a://"+ this.bucketName + "/" + this.objectPrefix),                        new SimpleStringEncoder<>("UTF-8"))                        .withBucketAssignerAndPolicy(new OrgIdBucketAssigner(), DefaultRollingPolicy.create().build())                        .build();DataStream<Event> eventDataStream =  kinesis                .rebalance()                .keyBy(createKeySelectorByChoosingOrgIdFromTheEvent())                .process(new KeyedProcessFunction<String, Event, Event>() {                    @Override                    public void processElement(Event value, Context ctx, Collector<DeviceEvent> out) throws Exception {                        out.collect(value);                    }                });eventDataStream.addSink(streamingFileSink).name("streamingFileSink");From one of the sites, https://www.mail-archive.com/user@flink.apache.org/msg25039.htmlI came to know that in order to make StreamingFileSink work, one has to drop a jar flink-s3-fs-hadoop-1.7.1.jar to /usr/lib/flink/lib folder. My /usr/lib/flink/lib folder in EMR master node looks as below-rw-r--r-- 1 root root     9924 Mar 20 01:06 slf4j-log4j12-1.7.15.jar-rw-r--r-- 1 root root 42655628 Mar 20 01:06 flink-shaded-hadoop2-uber-1.7.1.jar-rw-r--r-- 1 root root   483665 Mar 20 01:06 log4j-1.2.17.jar-rw-r--r-- 1 root root   140172 Mar 20 01:06 flink-python_2.11-1.7.1.jar-rw-r--r-- 1 root root 92070994 Mar 20 01:08 flink-dist_2.11-1.7.1.jar-rw-r--r-- 1 root root 23451686 May  5 23:04 flink-s3-fs-hadoop-1.7.1.jarWhen I try to run the flink job, it throws the below exception in EMR slaves.2019-05-06 01:43:49,589 INFO  org.apache.flink.runtime.taskmanager.Task                     - KeyedProcess -> Sink: streamingFileSink (3/4) (31000a186f6ab11f0066556116c669ba) switched from RUNNING to FAILED.java.lang.NoClassDefFoundError: Could not initialize class org.apache.flink.fs.s3base.shaded.com.amazonaws.services.s3.internal.S3ErrorResponseHandler    at org.apache.flink.fs.s3base.shaded.com.amazonaws.services.s3.AmazonS3Client.<init>(AmazonS3Client.java:374)    at org.apache.flink.fs.s3base.shaded.com.amazonaws.services.s3.AmazonS3Client.<init>(AmazonS3Client.java:553)    at org.apache.flink.fs.s3base.shaded.com.amazonaws.services.s3.AmazonS3Client.<init>(AmazonS3Client.java:531)    at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.fs.s3a.DefaultS3ClientFactory.newAmazonS3Client(DefaultS3ClientFactory.java:80)    at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.fs.s3a.DefaultS3ClientFactory.createS3Client(DefaultS3ClientFactory.java:54)    at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.fs.s3a.S3AFileSystem.initialize(S3AFileSystem.java:256)    at org.apache.flink.fs.s3.common.AbstractS3FileSystemFactory.create(AbstractS3FileSystemFactory.java:125)    at org.apache.flink.core.fs.FileSystem.getUnguardedFileSystem(FileSystem.java:395)    at org.apache.flink.core.fs.FileSystem.get(FileSystem.java:318)    at org.apache.flink.streaming.api.functions.sink.filesystem.Buckets.<init>(Buckets.java:112)    at org.apache.flink.streaming.api.functions.sink.filesystem.StreamingFileSink$RowFormatBuilder.createBuckets(StreamingFileSink.java:242)    at org.apache.flink.streaming.api.functions.sink.filesystem.StreamingFileSink.initializeState(StreamingFileSink.java:327)    at org.apache.flink.streaming.util.functions.StreamingFunctionUtils.tryRestoreFunction(StreamingFunctionUtils.java:178)    at org.apache.flink.streaming.util.functions.StreamingFunctionUtils.restoreFunctionState(StreamingFunctionUtils.java:160)    at org.apache.flink.streaming.api.operators.AbstractUdfStreamOperator.initializeState(AbstractUdfStreamOperator.java:96)    at org.apache.flink.streaming.api.operators.AbstractStreamOperator.initializeState(AbstractStreamOperator.java:278)    at org.apache.flink.streaming.runtime.tasks.StreamTask.initializeState(StreamTask.java:738)    at org.apache.flink.streaming.runtime.tasks.StreamTask.invoke(StreamTask.java:289)    at org.apache.flink.runtime.taskmanager.Task.run(Task.java:704)    at java.lang.Thread.run(Thread.java:748)Can you pls let me know what is the basic thing I am missing?Edited by: nischit on May 6, 2019 7:09 AMFollowComment"

Answer: "0Finally I found the cause. Although its very very deceptive.Flink internally uses AWS SDK version 1.11.271.The class S3ErrorResponseHandler which is causing NoClassDefFoundError...has the following static variables.public class S3ErrorResponseHandler implements        HttpResponseHandler<AmazonServiceException> {    /** Shared logger for profiling information */    private static final Log log = LogFactory            .getLog(S3ErrorResponseHandler.class);    /** Shared factory for creating XML event readers */    private static final XMLInputFactory xmlInputFactory = XMLInputFactory            .newInstance();    private static enum S3ErrorTags {        Error, Message, Code, RequestId, HostId    };   ....   ...In AWS SDK 1.11.272, the initialization of XMLInputFactory has been removed.That gave me a clue.I rebuilt flink library 1.7.1 by switching to 1.11.272. Voila it started working.This still posed me few unanswered questions.I did thorough debugging within Flink JVM running in EMR.The classpath clearly has flink-s3-fs-hadoop-1.7.1.jar. I wrote a code to read that jar and print all its entries and I did see S3ErrorResponseHandler.In my flink operator, I could initialize as below -XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance()The classloader clearly had reference to jre libs.Yet, flink was unable to initialize this specific class. I wonder why!! Is it because of how Flink deals with operators!!!Flink underneath serializes the operators and transmits to slave nodes. In slave nodes, the operators are deserialized, initialized and run as a task.Between those vaarious phases, the Flink classloader somehow didnt have access to default implementation of XMLInputFactory from JRE. Thats very wierd!!! Also I wish JRE is more specific about which static variable it could not initialize when loading the class.Should I call this as a bug in Flink?No one has reported this error in AWS EMR when using Flink?Also noted that flink release 1.7.1 has a bug with StreamingFlileSink. If your EMR cluster has 2 mounts, it tries do a read/write operation on both causing it to fail.It was resolved in 1.8.0 and above. However AWS EMR still uses 1.7.1 release by default. So pls ensure you put 1.8.0 libraries under /usr/lib/flink/libCommentSharenischitanswered 4 years ago"


Question: OpenSearch: Intermittent mapper_parsing_exception

"Hey there,I have recently set up an OpenSearch cluster to store vector data for KNN searching. For the most part everything is working fine, however every 9-10 days the cluster enters a state where I receive a mapper_parsing_exception that the cluster cannot parse the vector that is being inserted (the vectors being inserted are always the same dimension). This has happened once when the cluster was briefly in a yellow state, but most recently happened in a green state. I did some checks on disc space and that whenever I see the error pop up but everything seems fine there and once I make any change to the cluster configuration (e.g. change the instance type and change it back again) the issue resolves itself.Just wondering if anyone has encountered this issue before and how have they gotten around it if so.Thanks in advance!Cluster information:Instance type: m6g.xlarge.searchNumber of nodes: 10Version: OpenSearch 2.3FollowComment"


Question: X-Ray Filtering and Grouping

"Hello Team,I have couple of questions w.r.t X-Ray filtering and Grouping.Q1 : How do we forward the Traces to a predefined Trace Group ?Description : I would like to know how do we group the Traces from a Kubernetes cluster. We are using Otel Collector to forward the Traces from Cluster to Cloud X-Ray.We can define a group in case of fluentbit and forward the logs to specific group on a cloud watch. Do we have anything like this.Q2: How do we filter on the Metadata of a Trace ?We have Cluster specific information in our metadata and trying to filter on the the same. This data is getting displayed in Segement Tab -> Metadata.Sample:{"default": {   "otel.resource.k8s.pod.uid": "82784adc-4f59-411e-9a7e-ee8f070752d8",    "otel.resource.service.version": "v1",    "otel.resource.k8s.deployment.name": "ihe-forwarder",    "otel.resource.k8s.pod.start_time": "2023-01-09 19:16:11 +0000 UTC",    "otel.resource.ClusterId": "",    "otel.resource.service.instance.id": "95fb977c-7ded-40be-8da3-983b052db1ef",    "otel.resource.k8s.pod.ip": "10.42.0.90",    "otel.resource.k8s.node.name": "ingbtcpic6vl355",    "otel.resource.k8s.pod.name": "ihe-forwarder-7f6b98b99b-nthw7",    "otel.resource.service.name": "ix-ihe-forwarder",    "db.statement_type": "Text",    "otel.resource.k8s.namespace.name": "ix"}}Overall, my requirement is to get the Total number of Trace metric from a given Kubernetes Cluster. I am capturing these metrics to have the Cost Analysis done for our Application.Thanks,FollowComment"

Answer: 0Answer Q2:indexed_attributes in OTel collector xray exporterWhat is X-Ray annotationCommentSharerePost-User-5399159answered 5 months ago


Question: when will the notification of RDS db-instance create subscription be generated?

"Subscribed to RDS db-instance "create" event.Expects to receive notification AFTER the db instance was created; i.e. in Available state.However, I experienced cases that the end-point of db instance was unavailable when notification was received.FollowComment"

Answer: "0Dear AWS CustomerFrom the notes, I understand that, you have subscribed to RDS db-instance "create" event.According to the subscription, it is expected that you shall be receiving a notification soon after the db instance was created; i.e. it comes into an Available state. However, you  experienced a case wherein the end-point of db instance was unavailable when notification was received.In an ideal condition, the event RDS-event-0005 will be triggered soon after the RDS instance is created and comes to an Available state.Please allow me to share that, sometimes the event notifications might take up to five minutes to be delivered as documented in the below AWS article [+] :[+] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.overview.html#USER_Events.overview.resourcesIn some cases, it may happen that although an event is triggered as the RDS gets created and comes into Available state, there may be a scenario when the RDS goes to unavailable/offline/rebooted during that period until the message arrives. In such cases, you may find the instance to be unavailable due to delayed delivery of message.Furthermore, in case you encounter any such event, please reach out to us via a support case so that we can check your AWS resources and thoroughly investigate the root cause.CommentShareSUPPORT ENGINEERrePost-User-3261332answered 19 days ago0AWS RDS events are intended to provide a notification when the state of your DB instance changes. However, these events might not necessarily guarantee that the DB instance is fully operational and available for connections at the exact moment the event is sent.The "create" event in RDS is triggered when the DB instance enters the "creating" state. This does not necessarily mean that the DB instance is fully operational. It just signifies that the creation process has begun.After the DB instance is created, it transitions to the "backing-up" state while the initial backup is taken. Only after this backup completes does the DB instance transition to the "available" state and is ready to accept connections.While the "create" event should be a good indicator that the process has begun, it's not a guarantee that the DB instance is ready. If you need to perform actions that require the DB instance to be available (like connecting to the database), you should wait for the "Available" state. You might want to set up a process that periodically checks the status of the DB instance until it becomes available.CommentShareEXPERTsedat_salmananswered 19 days ago"


Question: Redshift ML SageMaker Domain

Which Sagemaker Domain is used when using Redshift ML CREATE MODELFollowComment

Answer: "1Accepted AnswerHi @jkrice, Redshift ML does not use SageMaker Studio (domains). When you run a CREATE MODEL statement, it calls SageMaker to create an Autopilot job (https://aws.amazon.com/sagemaker/autopilot/) to train a model. Autopilot usually does preprocessing, and trains on a variety of suitable models for your use case and finally returns the best model, that's then deployed for inference in Redshift. You can see more information here - https://docs.aws.amazon.com/redshift/latest/dg/machine_learning.htmlCommentShareDurga_Sanswered a month ago"


Question: first call to cognito method is slow

"Hi,the first call to the two methods below is very slow and after the same calls become fast. do you know why ?Method 1:var user = new CognitoUser(...)AuthFlowResponse resp = await user.StartWithCustomAuthAsync(new InitiateCustomAuthRequest()....)Method 2:RespondToAuthChalengeResponse verresponse = await provider.ResponseToAuthChallengeAsync(new RespondToAuthChalenge(){...})thank you in advancebest regardsFollowComment"


Question: Aurora Serverless v2 without VPC

"Hello,I'm trying to set-up a new Aurora Serverless v2 database. The documentation here mentions that VPC is not mandatory for V2 when comparing v1 vs. v2 features. However, I can't find any example and options to create an Aurora Serverless v2 database without a VPC.Can Anyone point me in the right direction?ThanksFollowCommentSri_K a year agoWhat type of db engine are you using to setup Aurora Serverless v2 database?Share"

Answer: "0Hi there,from the case notes I understand you want to launch an Aurora serverless v2 without deploying it in a VPC.I launched an Aurora serverless v2 from my side  and it is not possible to launch it without a VPC.Please note,Aurora Serverless resides in the private subnet of a VPC and it is based on Aurora infrastructure and it relies on a VPC being there.I will lodge a documentation review of where it means that Aurora Serverless v2 can be created without a VPC.I have provided you with additional documentation under the reference section.If you have any further questions , feel free to reply back.Reference[1]https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/CHAP_SettingUp_Aurora.html#CHAP_SettingUp_Aurora.Requirements[2]https://aws.amazon.com/blogs/database/best-practices-for-working-with-amazon-aurora-serverless/[3]https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v2.create-cluster.htmlCommentShareKaraboanswered a year ago0The doc page linked from the question says "Yes" to VPC being required for both Serverless v1 and v2. All Aurora clusters use a VPC. What's different for Serverless v2 is that you can make the instances publicly accessible and so connect to them from outside the VPC.CommentShareAWS-User-0081273answered 2 months ago"


Question: "AWS CLI: "Missing the following required SSO configuration values: sso_start_url, sso_region." when Using ASSUMED ROLE."

"I am trying to use SSO on Windows and I am following the configuration instructions, as provided by AWS.I successfully completed the aws configure sso step, input all of the required information like start URL, region, etc. The browser opens and authentication completes.I execute the aws s3 ls --profile <profile-name> command and it lists all the buckets I can access.When I execute aws sso login --profile <assumed-role>, I get the message "Missing the following required SSO configuration values: sso_start_url, sso_region."The message at step 3 is asking me to complete what I did in step 1, even though everything appears to have worked properly.  I've deleted the AWS config file, removed and reinstalled AWSCLIv2, but no joy.Note: The Assumed Role has been added to the config file, and the setting validated by a co-worker.Any ideas?  TIA.FollowComment"

Answer: "0Hello,Your expectations are correct: once you configure AWS CLI v2 for Single Sign On (SSO), you should only need to run 'aws sso login'. That's because the previous step, 'aws configure sso', should've persisted the SSO configuration on user's ~/.aws/config by defining profile-specific sso_* parameters [1].After you get authenticated on CLI, you are prompted to select the Account and also the Role (Permission Sets) you want to assume in the selected account. Once these selections are done, you will be prompted to create a profile with those details which are similar to the one below and then choose a name for the profile or select the default one.[profile My-Acct-1]sso_start_url = https://ALIAS.awsapps.com/start/#/sso_region = us-east-1sso_account_id = 555555555555sso_role_name = AWSPowerUserAccessregion = us-east-1output = jsonPlease ensure that the value for "sso_account_id" under the profile in the AWS config file is correctly populated.To understand whats going on, we require details that are non-public information. Please open a support case with AWS using the following link: https://console.aws.amazon.com/support/home#/case/createReferences[1] https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.htmlCommentShareSUPPORT ENGINEERAWS-User-6158549answered 6 months ago"


Question: How can files in an S3 bucket be tracked?

"How can files in an S3 bucket be tracked?   A customer is looking for a way to track who accesses, deletes, edits, or writes files into S3 buckets.  Is there a way to obtain this information?  Thanks!FollowComment"

Answer: "0Accepted AnswerAll of these actions mentioned in the description can be logged using CloudTrailS3 objects can't be edited or modified but they can be overwritten. You can make a GET request on the object, make changes and then write it back with a PUT request into the bucket.CommentShareEXPERTLeeAtk@AWSanswered 3 years ago"


Question: AWS Glue API get-partitions can't seem to cope with the partition column name "key" in the `expression` filter

"I created a AWS Glue table with the following columns:key : string (partition column)x : intThe following command works as expected:aws glue get-partitions --database-name glue --table-name repro100 --region us-east-2On the other hand, the command:aws glue get-partitions --database-name glue --table-name repro100 --region us-east-2  --expression="key=part1"returns the following exception message:An error occurred (InvalidInputException) when calling the GetPartitions operation:Doing the same call via Java AWS API I could retrieve the following error code:HIVE_METASTORE_ERROR  code 16777216When using a different partition column name (e.g. : foobar ) the expression filter can be handled successfully.I assume that the problem is linked to the usage of the column name key in the expression filter.Any hints on how to escape the column name in the filter ?Out of curiosity, what exactly means HIVE_METASTORE_ERROR  code 16777216 ?FollowComment"

Answer: "0Hello,By using "key" as one of the column names in AWS Glue table, get-partitions API call returns error as statedAn error occurred (InvalidInputException) when calling the GetPartitions operation:I would recommend you to please change the column "key" name as "key1" or any other name in Glue data catalog which is not in the reserved words as a workaround.Regarding the Hive error code 16777216, it usually happens when the Hive metastore does not return any data for a partition. Here in your case since "key" is not being recognized as a partition, the above error code is returned.CommentShareSUPPORT ENGINEERVishali_Nanswered a year ago"


Question: VMware Cloud on AWS : Extending Networking to other accounts

"Can we extend the VMware Cloud on AWS Networking to another VPC in a separate AWS account.  I.e. can a VM in VMware Cloud on AWS, access an EC2 instance in another AWS account, which was not integrated to VMware Cloud on AWS during the setup phase.FollowComment"

Answer: 2Accepted AnswerYou'll need to VPN from the NSX Tier 0 router in VMware Cloud on AWS to the transit gateway in that other account. You can also VPN into a VGW of another VPC if a transit gateway is not being utilized.CommentShareAWS-User-3868621answered 3 years ago


Question: "SES  emails blocked / bounced by all Microsoft (hotmail, Live, MSN, etc)"

"I've been using SES for a while, email list about 6,000. Longstanding (years...all proper subscribers). Recently, I see everything going to Microsoft properties is bouncing, all of them have the same feedback for the bounce:Bounced Reason: smtp; 550 5.7.1 Unfortunately, messages from [23.251.242.9] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors. [SN1NAM02FT0055.eop-nam02.prod.protection.outlook.com] @ 2022-07-14 22:48:37I have no idea what to do. Any guidance?FollowComment"

Answer: "1It may be best to open a support case (from the AWS console) so the AWS support team can help look at the logs to further assist.I've seen this due to the fact that, by default, SES messages are sent from a shared pool of IP addresses, meaning you and other customers may be originating from the same AWS-owned IP block.From the error you posted, it sound like that a set of IPs you've been using have been added to a third-party blocklist. The AWS SES team works to keep AWS IPs from being blocked, but it does occasionally happen. A support case can help highlight this to get resolution.Alternatively, you can chose to use a dedicated pool of IP addresses, potentially avoiding being blocked due to others' activities.CommentShareAaron Doddanswered a year agorePost-User-0428278 a year agoI'm a small-time user. Longstanding email list for years of legit subscribers. The first thing I did was put in a ticket to AWS. Totally blew me off and referred me here. And you make a good point. I do not have dedicated IP, so this may have nothing to do with me.Zero stars for AWS support.Share"


Question: SQL Server RDS migration to EC2 SQL Server

"Hi, Has anybody ever done a migration of SQL Server from RDS to on-prem or EC2 SQL? I'm struggling to find a way to migrate the databases across. Any pointers would be much appreciated.FollowComment"

Answer: "0Accepted AnswerWhat exact issues are you running into? Easiest way would be to perform a native backup on to s3 and then download the backup to your ec2 or on-prem machine and restore it. Please take a a look at this blog on how to configure native backup.https://aws.amazon.com/premiumsupport/knowledge-center/native-backup-rds-sql-server/CommentShareDevinder-theDBGuyanswered a year agorePost-User-2959740 a year agoAh apologies, the existing backup that I tried to use was corrupt, I took a fresh backup and it has worked perfectly. Many Thanks!Share"