Question: Security concerns with Unreal Engine AWS Plugins

"So a number of plugins have been published on the Unreal Engine Marketplace promising to make integration with AWS GameLift, Cognito, and Lambda, easy and just through blueprints (no c++).My team would like to use such plugins especially related to AWS Cognito.However, looking through their tutorials it seems like some of the practices they are using are not secure.Specifically, in this part of the Aws Cognito tutorial it shows to put in your Aws Access ID and AWS Secret Key to create a Cognito Idp object on the game client. This seems to just be a blueprint wrapper over the CognitoIdentityProviderClient constructor in CognitoIdentityProviderClient.h of the aws-cpp-sdk.I was under the impression that you could not trust the game client with anything in terms of keys or credentials, never mind an AWS Secret Key. Similar credentials are used in the GameLift plugin when creating game sessions from the client (again not a good practice?).I would love to get some of the AWS staff's take on this. Am I incorrect about this security practice? Is it fine in production as long as the credentials you are adding to the client is one of an IAM user that has limited permissions just for these few functions?Along the same lines but maybe less of an issue: it shows to implement the signup and authentication again on the client. Wouldn't it be a better practice to put the proposed username and password in an HTTPS request to an API Gateway that then runs this Cognito function on say a Lambda that then communicated the result to the game server that then communicates back to the game client?I assume its ok to put the Aws Cognito app client id on the game client?Any input on this would be appreciated. Cheers!FollowComment"

Answer: "0I will give my opinions formed from the research I have done, but I am definitely also interested in what an AWS Staff member has to say about this topic. Let me first provide this picture from the documentation.REMOVEDUPLOADAccording to the docs, it is recommended to call GameLift, Cognito, and other AWS services through a client service. It seems from a lot of the forum posts that a popular option is to call Lambda APIs via http requests. From what I believe, the reason for this is because it can be dangerous to leak secret keys to the client. If you call specific AWS services directly from the client, you need credentials to call those specific AWS services. If someone has these credentials, then there is no limiting of how often they can call those AWS services unless those credentials are manually revoked. On the other hand, if you handle everything through authorized Lambda functions, you have more control over how the AWS service is being used. For example, if the function is authorized via a token, you can limit how many times a specific user identified by a token can call this AWS service in a certain amount of time. It is not the best example but it just shows that you can surround additional logic around an AWS SDK function call to help further make the architecture secure.My only concern with even temporary AWS credentials is that at this moment, they can't be invalidated. Temporary AWS tokens will last their full lifespan of an hour no matter what. However, refresh tokens can be invalidated at any time so keep this in mind. For more information about best practices regarding AWS credentials, check out this link: https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.htmlAs for your last question about the Cognito client id, I believe that this is safe to expose. Here's a stackoverflow answer that talks about it, https://stackoverflow.com/questions/39649899/is-it-safe-to-expose-the-aws-cognito-ids, but there are a lot of forum posts that talk about this topic.CommentSharerePost-User-5100160answered 3 years ago0@REDACTEDUSERCommentSharerePost-User-4435701answered 3 years ago0@REDACTEDUSERNow, a lot of software developers think about just development (ie how do I get this working, rather than what should I do in production) or make assumptions that you have already gotten credentials from somewhere as everyone does it differently. So you may see patterns like those of the UE4 plugin developers.The recommendation is that you always fetch and use your credentials (which are short lived session based) in memory like Cognito etc.Chris already posted a good link, where if you replace the word 'mobile' with 'games', you can see what you should do:https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.htmlBasically, clients should never be trusted to be the source of truth, all their input should be sanitized/checked and any credentials/permissions they have should be easy to revoke/remove.Obviously you may have some specific use cases where you may not a strong identity to tie credentials too such as launch/pre-login metrics. But even those should be designed with abuse in mind and with extremely limited permissions/functionality with throttles and best-case delivery.As to the video, Client side authentication is cheaper (fewer lambda calls etc), faster and easier for most folks to build and in the mobile space where its easy to push updates, it can work. Server side will be more secure but, requires just that a server, which can quickly require more expense/development time/outlay then people have. In both cases I believe you can use lambda triggers to further secure your flows. There are probably some great best practice documents on client side auth (will try and dig some up).Is it "ok to put the [Aws Cognito app client] id on the game client? "From the docs they state "It is your responsibility to secure any app client IDs or secrets so that only authorized client apps can call these unauthenticated APIs". However, if you are doing client side auth then you probably need these client side and you probably aren't using a secret in this case.Oh and you can also use Cognito Authorizers directly with APIGateway: https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html which gives you some different controls to handle auth wrt to serverless style 'game services'CommentSharerePost-User-5332620answered 3 years ago0Just want to add that you can avoid putting the Cognito app client id on your game client by authenticating your user through a Lambda function and then of course have your client call that function. This is still client-side authentication and currently the approach I am using to avoid putting any Cognito user pool information on the client directly.CommentSharerePost-User-5100160answered 3 years ago0Thanks, @REDACTEDUSERAlso thanks @REDACTEDUSERAfter doing some reading I'm still a bit unclear about how the implementation of the initial unauthorized functions (a.k.a. signup, login, & forgot password) could be called securely.The lambda triggers that Pip alluded to seem to be additional checks and experience improvements that are triggered at specific intervals on the Cognito calls. For example, the pre sign-up lambda trigger could be used for additional validation checks. However, from the examples I have seen it would seem that we would still have to call CognitoIdentityProviderClient::SignUp(const SignUpRequest& request) from our game client to have the lambda trigger fire. We would still need the aws credentials in the client to create the CognitoIdentityProviderClient object to call it, which is exactly what we wanted to avoid.The other way I can see around this is just to have the game client send an HTTPS request, say for a signup, with the proposed username and password. That hits the api gateway that hits a lambda function that then (if we're using python) calls the signup method on cognito-idp in boto3. The Client Id, Secret hash, etc would then just be on the lambda and never exposed to the game client. One could then do a similar dance from the game client to a different lambda to confirm_sign_up . Easy enough to do the same thing for login and forget password.The second method seems more secure and straight forward, but (at least from my research) it does not seem to be common which makes me hesitant as I may have overlooked something.Maybe its too easy for an attacker to flood the api gateway with requests to login, requiring us to ro throttle it and hence not allowing legitimate users through?After authentication, it seems straight forward enough to use Cognito Authorizers directly with APIGateway (as Pip pointed out) to make sure that the HTTPS requests to the matckmaker are done securly. Its just how to get users authenticated in the first place that I am unclear on.CommentSharerePost-User-4435701answered 3 years ago0If you're going for client-side authentication, which seems to be a popular option due to the allure of serverless, you can use the auto-generated UI from Cognito user pools for the functions that you mentioned. For example, signup, login, and forget password are all taken care of by that UI.  For more information on that, you can follow the steps outlined here:https://docs.aws.amazon.com/cognito/latest/developerguide/getting-started-with-cognito-user-pools.htmlYou can of course later on make your own UI to better customize it. Here is a good article on how to do that, https://medium.com/@gmonne/custom-authentication-using-aws-cognito-e0b489badc3fYou can also do this in Unreal Engine as well, I just could not find any good examples. The quickest solution is to use the auto-generated UI in the web browser widget in Unreal Engine. Of course, you can also make a program separate from Unreal Engine for logging in, signing up, etc. If you choose to do something like that or making your own UI, then that medium article I linked above would be good for recognizing the patterns you would need to follow. Just a note that in the medium article, the user makes the cognito user pool and client id public. However, I will then point out that the auto-generated UI link has the client-id in it. At the end of the day, in my opinion, this is better than sending username and password data to a API through an http request. Even if encrypted, you don't want to risk those man-in-the-middle attacks regardless. It is better to do everything strictly through Cognito when it comes to login, signup, forget password, etc., because it is more secure. I am not sure exactly how Cognito is more secure because that is outside of my direct knowledge scope.The point of this is that, assuming you are using the authorization code grant flow for client-side authentication, after successful authentication, you will now have a code. This code can be used to retrieve a temporary access token as well as ID and refresh tokens. For more information about the token endpoint, check out this link, https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.htmlAnother good read on AWS credentials and Cognito in general: https://theiconic.tech/authentication-an-in-depth-look-at-aws-cognito-658336515169CommentSharerePost-User-5100160answered 3 years ago0Hmmm yeah I have setup the auto-generated UI for a test. Thanks for the insight and the helpful links. Gmonne's article was especially helpful.  I did notice that he specifies "To keep this information ["User Pool" id & client id] private I created a  config.js  file that saves this information on two global variables."I'll try doing something close to gmonne's article but would like to build the UI in ue4 so will also try to investigate other methods to do that (likely with the aws-sdk-cpp).CommentSharerePost-User-4435701answered 3 years ago0why not use SRP directly in unreal? this cognito plugin support SRP. https://youtu.be/xU8l-00dzo0 and tracking the device https://youtu.be/NxDYmpMAKXc and with MFA https://youtu.be/oMgCztrRV8kand login with SRP is what the cognito UI did in js.CommentSharerePost-User-8825394answered 2 years ago0Will,Were you able to get the aws-sdk-cpp into your project?  I'm trying to do the same as you, but am having trouble getting the sdk into my visual studio functionality.  Can't get things linked.CommentSharerePost-User-5424407answered 2 years ago"


Question: ORA-12637 Packet receive failed

I have created a new RDS oracle 19c instance but I am unable to connect it via SQL client. It throws an error of "ORA-12637 Packet receive failed".I didn't face this issue with RDS oracle 12.I tried to resolve it but that didn't help.Can somebody help me to overcome this issue?FollowComment

Answer: "0Hi,I understand that you have created a new RDS oracle 19c instance but you are unable to connect to it via SQL client getting error “ORA-12637 Packet receive failed”. Please correct me if I misunderstood.You can start by checking the state of your Amazon RDS for Oracle DB instance.If the instance is in any state other than available, storage optimization, or backing-up, then you can't connect to the instance[1]. Secondly verify that you can connect to the database instance over the database port[2] by default oracle uses port 1521.For further assistance you can contact AWS Customer Support to review/validate or to get your instance available.You can refer to the following documents on troubleshooting issuesReference links:[1]https://aws.amazon.com/premiumsupport/knowledge-center/rds-cannot-connect/[2]https://aws.amazon.com/premiumsupport/knowledge-center/rds-oracle-connection-errors/I hope you find this information useful.CommentShareWinnieanswered a year ago"


Question: Confusing UI on RDS Proxy Target Group

"On RDS Proxy target group config there are two options Session pinning filters and Initialization query - optional which can be used to filter out conditions that cause connection pinning.The problem is that none of this options work when using PostgreSQL engine. We came to know this from this link, also confirmed by AWS support.Both these options should be removed from the UI to avoid confusion for users which may think that they actually work.FollowComment"

Answer: "0Hello,I understand the below options are not supported for PostgreSQL when selected as an engine via RDS Proxy. The request is to remove these options from the UI Console.Session pinning filtersInitialization query - optionalWe are actively working on improving the console using your feedback as it is important to us. Therefore, I have created an internal request on your behalf requesting for these above options to be removed from the UI console when PostgreSQL is selected as an engine via RDS Proxy window.Thank you.CommentShareSUPPORT ENGINEERSomto_Manswered a year ago"


Question: Lambda Alias in Role Policy

"Is there a way to design a Lambda execution role policy to restrict access by using Lambda alias name. For example, I want to have an alias "Prod" and only executions of function with that alias would have permissions to write to a particular bucket. I tried using the new lambda:SourceFunctionArn condition, but it does not seem to include the alias, or I am not using it correctly. In the example below I am trying to achieve ability of all variants of my function to write into my-bucket-test, but only Prod alias to be able to write to my-bucket-data. Is there a way to achieve this?{"Version": "2012-10-17","Statement": [{"Sid": "Logging","Effect": "Allow","Action": ["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/MyLambda_*"},{"Sid": "S3","Effect": "Allow","Action": "s3:PutObject","Resource": ["arn:aws:s3:::my-bucket-test/*"]},{"Sid": "S3Prod","Effect": "Allow","Action": "s3:PutObject","Resource": "arn:aws:s3:::my-bucket-data/*","Condition": {"StringLike": {"lambda:SourceFunctionArn": "*Prod"}}}]}Thanks,AlexFollowComment"

Answer: "0I don't think that condition is available in that context.As an alternative, could you tag (environment=prod) the role that is assigned the the Lambda functions with Prod alias. Then use the "aws:PrincipalTag" to control access to the operation/object     "Sid": "S3Prod",     "Effect": "Allow",     "Action": "s3:PutObject",     "Resource": "arn:aws:s3:::my-bucket-data/*",     "Condition": {          "StringEquals": { "aws:PrincipalTag/environment": "prod"   }      }CommentShareEXPERTkentradanswered 4 months agomadman6886 4 months agoI think the condition is available because access is granted if I do something like"StringLike": {"lambda:SourceFunctionArn": "*MyLambda*"}it does match, but it seems to me that lambda:SourceFunctionArn is literally the function arn without any version/alias suffixed to it...I was looking at the tags as well, but the tags are only applied at the un-aliased function, and there doesn't seem to be a way to add a tag to a function alias - at least I don't see it in the console.Sharekentrad EXPERT4 months agoYes, and aliases/version don't have their own role, sorry. Have you tried this: "lambda:SourceFunctionArn": ":Prod"? Or "lambda:SourceFunctionArn": ":<function-name>:Prod"?Share"


Question: How to connect properly AWS IoT Core to DocumentDB

"Hi, I would like to connect my documentDB to an AWS IoT Core properly (do something similar to IoT Core -> Dynamo Db with a rule).I need it to be highly scalable to handle millions of devices. Has someone done that before? What are the best practices?Thanks in advance !FollowComment"

Answer: "1Accepted AnswerHi. In general, if AWS IoT Rules Engine doesn't have an action to route data to a particular service, Lambda would be a way to achieve it.AWS IoT Core -> Rule -> Lambda -> DocumentDBIf you had a high rate of messages coming through, you could consider to insert something like SQS or KDS between the Rule and the Lambda, so the Lambda does batch processing of messages. This would help lower costs.These would be amongst the simplest patterns to achieve what you want.CommentShareEXPERTGreg_Banswered a year ago0Hi thereFrom the note, I understand you want to connect my documentDB to an AWS IoT Core properly and you need it to be highly scalable to handle millions of devices. Please correct me if my understand is wrong.Please note you would have to configure the IoT devices with a MongoDB client and use the SDK to insert data to DocumentDB but this is an out of scope solution for Support and would require your developers to build it.I hope the above information is helpful.References:1.https://docs.aws.amazon.com/documentdb/latest/developerguide/documentdb-development.html2.https://docs.aws.amazon.com/iot/latest/developerguide/iot-ddb-rule.htmlCommentShareNonkululekoanswered a year agorePost-User-7070899 a year agoThanks for your response, you have fully understood my question.Share"


Question: S3 Bucket List reveals top-level object names

"The SituationCustomer is building a bucket that ingests data from outside multiple customers. If we call it "ingest-bucket" their intent is to use a folder structure with one folder per customer. The intended structure is something like this:ingest-bucket/customer1/data1.logingest-bucket/customer1/data2.logingest-bucket/customer2/data1.logingest-bucket/customer2/data2.logingest-bucket/customer3/data1.logingest-bucket/customer3/data2.log...and so on...The TaskThey have tried to give a third party access to just the ingest folder that corresponds to them. Imagine this is an engineer from customer2. It appears that they need to grant S3:ListBucket in order to allow them to read and download the files.The ProblemThe problem is that when customer2 does a ListBucket command, they can see the existence of the customer1 and customer3 folders. They don't have access to any objects inside those folders, but they can see the existence of the folder itself. This is a problem because Siemens doesn't want customer2 to see the folder named "customer1". It tells customer2 that customer1 is a Siemens customer and that's undesirable.Possible SolutionIs there a solution to this? We decided to potentially use random names for this first-level folder, which anonymises the folder names. That's not great, but it's acceptable. Is there something I'm missing, though?They've created an S3 bucket policy something like this:{    "Id": "bucket123456",    "Statement": [{        "Sid": "1",        "Action": [   "s3:ListBucket" ],        "Effect": "Allow",        "Resource": "arn:aws:s3:::ingest-bucket",        "Principal": {  "AWS": "arn:aws:iam::XXXXXXXXXXXX:user/src–iam-user"   }    }, {        "Sid": "2",        "Action": ["s3:GetObject"],        "Effect": "Allow",        "Resource": "arn:aws:s3::: ingest-bucket/customer2/*",        "Principal": {  "AWS": "arn:aws:iam::XXXXXXXXXXXX:user/src–iam-user"  }    }]}FollowComment"

Answer: "0Accepted AnswerAlthough you can't limit what is returned in the bucket listing, you can make a condition that the caller specifies a key prefix in the list call which limits the results to just their 'folder'http://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#condition-key-bucket-ops-2Example policy with condition that requires them to provide a key prefix when listing:{    "Id": "bucket123456",    "Statement": [{        "Sid": "1",        "Action": [   "s3:ListBucket" ],        "Effect": "Allow",        "Resource": "arn:aws:s3:::ingest-bucket",        "Principal": {  "AWS": "arn:aws:iam::XXXXXXXXXXXX:user/src–iam-user"   },       "Condition" : { "StringEquals" : { "s3:prefix": "customer2"  } }     }, {        "Sid": "2",        "Action": ["s3:GetObject"],        "Effect": "Allow",        "Resource": "arn:aws:s3::: ingest-bucket/customer2/*",        "Principal": {  "AWS": "arn:aws:iam::XXXXXXXXXXXX:user/src–iam-user"  }    }]}CommentShareEXPERTLeeAtk@AWSanswered 6 years ago"


Question: Converting NAT gateway to NAT instance to save cost

"I'm using this cloudformation template as part of a deployment of an amazon neptune db. However the NAT gateways that it creates are quite expensive. One suggestion that seems appealing is to use NAT instances instead of NAT gateways. My understanding so far is that the NAT gateways allow my db and its associated resources to make outbound network requests while remaining unavailable from the public internet. I would like to preserve that functionality while switching to NAT instances, but I'm not sure how to go about modifying the template to achieve that. Can someone please offer direction on how I can do this?FollowComment"

Answer: "1Accepted AnswerMy advice is have NAT gateway(s) as it is managed service (vs EC2 instance you would be responsible of both capacity and keeping it up-to-date with patching etc). If the cost is the factor, you could consider using just a single NAT gateway instead one per AZ as it is now in the template. In theory this would lower the fault tolerance a bit, but would also cut your costs to 1/2 or (1/3 in case of 3 AZ deployment). To do this, remove NATGW2, NATGW3, ElasticIP2 and ElasticIP3, and then in AZ2 and AZ3 private route tables just point the default route to NATGW1.CommentShareKalluanswered a year agoKallu a year agoThere are also some rather strange tagging build into template. E.g. assigning StackId=${AWS::StackId} to many resources, but no all of them. Cloudformation assigns following tags by default to all resources;aws:cloudformation:logical-idaws:cloudformation:stack-idaws:cloudformation:stack-nameSo unless you must have "StackId" as key, this information is already available without explicitly stating it in templete. There are also some explicit dependencies that are not needed. E.g. when there is a routetable created it is assigned to VPC but there is also stated dependency to VPC. Cloudformation can figure out dependencies make you make references without explicitely stating them out. I thin these make the template look more complex than it needs to be.ShareAWS-User-8778696 a year agoThanks for this! I've disabled one of the nat gateways and elastic IPs so I can still have 2 for some fault tolerance like you mentioned. I'll watch over the coming days to see how it affects the price. Thanks again!Share"


Question: Need help to import multiple certificates to ACM

I search for the solution of importing multiple certificates to ACM via cli.Any one could advised?FollowComment

Answer: "0As per best of my understanding certificates must be imported one at a time with cli.aws documentation syntax:-aws acm import-certificate --certificate fileb://Certificate.pem --certificate-chain fileb://CertificateChain.pem --private-key fileb://PrivateKey.pem --region us-east-2 --profile defaultAlso pointer to note Multiple certificates with the same domain name can be imported, but they must be imported one at a time.If my answer is satisfactory, kindly mark the Question is Answered to help others in this forum.CommentShareShashank Abhishekanswered 5 months ago0You can use the AWS Command Line Interface (AWS CLI) to import multiple certificates into AWS Certificate Manager (ACM) using the import-certificate command.Here's an example of how to import multiple certificates from a directory called certs:for file in certs/*.pem; do  aws acm import-certificate --certificate file://$file --private-key file://$file.key --certificate-chain file://$file.chaindoneThis will loop through all of the .pem files in the certs directory, import each certificate using the import-certificate command and specifying the path to the certificate, private key, and chain files using the file:// prefix.Also, you will need to make sure that you have the correct permissions to import certificate into ACM.CommentShareEXPERTcloudgeek7answered 5 months ago"


Question: New requester here. I'm getting the "You have exceeded your monthly credit limit" error.  Is there any way for a new requester to pre-pay for HITs?

"Here's the step-by-step description of my problem.I created a new MTurk requester account, and it seemed to force me into linking that account to AWS billing (instead of pre-paying for HITs as was done in the past). I mean, I looked carefully, and the only way they offered to do the billing was through AWS.So, I linked my Mturk requester account to AWS. And I added a valid credit card to AWS. On AWS Console, under Service Quotas >> AWS Services >> Mechanical Turk, it says the Monthly Usage quota's "Applied quota value" is 1,500. Which, I assume, is US dollars. That's far more than I need to spend on MTurk, so it looks like my monthly credit limit is plenty high.Back on MTurk, at requester.mturk.com/account, the top of the page says, "Your account is configured to pay for HITs using AWS Billing. You are not permitted to purchase Prepaid HITs at this time." So, it looks like I'm ready to start paying for HITs to be done.As a first test, I tried to publish a tiny HIT, with a total cost of 54 cents. I've been using MTurk for years as a requester at another organization, so I'm certain I created the HIT correctly.MTurk will not publish that tiny HIT. The error: "You have exceeded your monthly credit limit."   As I described above, the monthly usage quota is $1,500, so that doesn't appear to be the reason I can't run a $1 HIT.I would be entirely willing to pre-pay for HITs. I've got a valid credit card in my hand, and I want to use it. But pre-paying doesn't seem to be an option anymore for new requesters. Is that right? Just no way at all anymore?What's the solution/workaround for this "You have exceeded your monthly credit limit"? How is a new requester supposed to pay for HITs?FollowCommentrePost-User-3430926 6 months agoHi, I too getting this issue. Have you resolved the problem？Sharecustomer 6 months agoIs this issue resolved? Can you please tell me what steps did you follow to resolve this?SharerePost-User-2902730 6 months agoIs this issue resolved? Can you please tell me what steps you followed to resolve this?SharerePost-User-9687991 4 months agoSame. I'm new and my limit says it's 2,500 already yet I couldn't publish something for 1,008. I dropped it to 2 and that exceeded the limit too. So I'm pretty sure when you're new the limit is 0. We are forced into AWS billing and can't use pre-paid HITS or pay upfront in any way and then they don't give you a workable account. I've been waiting for 5 days and this is after being told 3 times my case is being expedited.Share"


Question: API Gateway: Difference between "Maximum integration timeout" and "TimeoutInMillis"

Can someone help me understand the difference between API Gateway's TimeoutInMillis and the quotaMaximum integration timeout described in the Amazon API Gateway quotas and important notesThe first has a maximum of 29 seconds whilst the other has a maximum of 30 seconds. It doesn't seem to make sense to have the API Gateway timeout after 29 seconds but allow for a greater timeout for integration points.Also where on the AWS console can I find the current value for those two settings? I found an old post saying it was on the "Integration Request" but there is no such setting.FollowComment

Answer: "0Accepted AnswerREST vs. HTTP APIs. REST has a maximum of 29 while HTTP has a maximum of 30.For REST, it is listed in the Integration, select the METHOD (GET for example), then on the bottom, there is "Use Default Timeout". Unselect it and you should be able to change the custom timeout between 50ms to 29s.For HTTP, it is under Integration Details, Advanced Settings.REST is also known as v1, and HTTP is known as V2. API Gateway HTTP APIs is not at parity with REST, but has better latency, cheaper, and will be the future. More parity features will be forthcoming.CommentSharesang_kanswered 2 years ago"


Question: Access declined

"Hi, I have created an AWS account using salesforce org (Voice with Amazon Connect), after login to the AWS as a root user I can not perform any task, it gives the error You Need Permissions, Access denied (User: arn:aws:iam:::root is not authorized to perform: connect:ListInstances on resource: arn:aws:connect:us-east-1::/instance with an explicit deny). How to fix it.FollowComment"

Answer: 1Someone in your organization has blocked the root user in your account from making any changes to this particular resource. This is a wise decision as the root can be destructive in nature if used improperly. I suggest using a different IAM user or have the organization create one with appropriate permissions for you.Please review this documentation on root user best practices: https://docs.aws.amazon.com/accounts/latest/reference/best-practices-root-user.htmlCommentShareDavidanswered 12 days ago


Question: AWS Glue Studio source: S3 -> target: Redshift job wants to select GDC not Redshift table in target

"Greetings,I have a really simple ETL that should take a csv from s3 and insert it into Redshift. However, I can't configure Redshift as a target because for some reason in the target properties the dropdown only shows Glue Data Catalog databases and not Redshift ones. I have tried different browsers thinking it was a caching issue, but am now convinced it's an AWS error.FollowComment"

Answer: 0It is possible to create GDC database and table mapped to Redshift native table using Crawler with JDBC connection.CommentShareDavidanswered 5 months ago


Question: How does OpenSearch Serverless support 1TiB of index data?

"The opensearch serverless capacity limits states:Each OCU includes enough hot ephemeral storage for 120 GiB of index data. OpenSearch Serverless supports up to 1 TiB of index data per collection.If one collection (full-text search) has 960 GiB of index data, how many OCUs are needed? 16 OCUs (8 for index and 8 for search)? How will index data be cached among OCUs? For example, OpenSearch Serverless creates 8 shards for the collection, and each OCU serves one shard? Or simply 1 shard?When the collection is not accessed, serverless will scale down to the minimal 4 OCUs (2 for index and 2 for search). When the queries come, serverless will scale up to 16 OCUs? The queries will have to wait till all 16 OCUs are ready, e.g. 840 (960-120) GiB of index data are downloaded?FollowComment"

Answer: "3Please find below in-line the response:Each OCU includes enough hot ephemeral storage for 120 GiB of index data[1]. Using this, you will need approx. 8 OCUs to support a full-text search workload for a 960GB collection.The index data is cached across all the OCUs in a collection. Each OCU contains a portion of the index data, and the data is replicated across the OCUs for redundancy. This ensures that the data is readily available for processing and querying.When queries are submitted, the OpenSearch serverless will automatically scale up and down based on the current workload. The queries will not have to wait for all the OCUs to be ready. The scaling is in response to query demand, so additional OCUs will be added dynamically and will become available for processing queries as soon as they are ready. This ensures that query performance is maintained as the query volume changes over time.References:[1] https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-scaling.htmlCommentShareGovind Kumaranswered a month agorePost-User-1543166 a month agoThanks Govind for the answer! Could you explain why 960GB only requires 8 OCUs? Don't we need the standby OCUs for search? Also how about the OCUs for data ingestion?The index data is cached across all the OCUs in a collection. Each OCU contains a portion of the index data, and the data is replicated across the OCUs for redundancy. This ensures that the data is readily available for processing and querying.If the 960GB data is replicated across the 8 OCUs for redundancy, do you mean one OCU will have much more than 120GB data? This sounds conflict with the 120GB limit.The queries will not have to wait for all the OCUs to be ready. The scaling is in response to query demand, so additional OCUs will be added dynamically and will become available for processing queries as soon as they are ready. This ensures that query performance is maintained as the query volume changes over time.Still not sure how this works. I understand that OCUs could scale as the query volume changes over time. But one query should be served from all 960GB data, right? Do you mean OpenSearch Serverless could serve the query without all 960GB data be downloaded to the local disk? If so, the query may not be accurate?Share3Kindly find the answers to your queries below:Could you explain why 960GB only requires 8 OCUs? Don’t we need the standby OCUs for search? Also how about the OCUs for data ingestion?Firstly, I would like to mention that Opensearch serverless has Indexing and Search OCUs. When you create your first collection, OpenSearch Serverless instantiates a total of four OCUs (two for indexing and two for search). These OCUs always exist, even when there's no indexing or search activity [1].Further, the number of OCUs required for an OpenSearch Serverless cluster depends on the specific use case and workload. There is no fixed or standard number of OCUs that can be defined for all use cases. The number of OCUs required for a cluster depends on factors such as the size of the data set, the frequency of data updates, the number of concurrent search queries, the complexity of the search queries, Storage retained in Amazon S3 [2].Thus, as an approximate if you are using Search collection then, 960GB of data can take 8 OCUs for Indexing which is ( 960 GB of data / 120 GB of data per OCU ) and 8OCU for search as well. However, this can increase/decrease according to your usage as mentioned in [2]. If you have high search request then the capacity can scale up to accommodate data, it can’t currently scale up search replicas. OpenSearch Serverless functions with two search replicas running in active-active mode.Kindly note, the formula ( 960 GB of data / 120 GB of data per OCU ) is just a generic formula to calculate the approximate number of OCUs required but it may vary according to the usecase as stated above.Thus, to check how many OCUs are required AWS recommend users to create a test collection and do a small testing with the workload that you think that may come. However, if there is high or low workload the OCUs will increase or decrease accordingly.If the 960GB data is replicated across the 8 OCUs for redundancy, do you mean one OCU will have much more than 120GB data? This sounds conflict with the 120GB limit.As mentioned above, the number of OCUs required for an OpenSearch Serverless cluster may vary depending on the workload, and it is difficult to provide an exact number. If the workload includes a high volume of search requests, the capacity can scale up to handle the data [2]. The data can be replicated in search OCUs ephemeral storage.Further more, the requirement of OCU also depends upon if you are using Search collection or time series collection.I understand that you would like to get cost estimation and a good idea how OCUs work so that you can test how many OCUs will be required for different collection. Thus, here you can manage capacity for your collections and to control costs, you can specify the overall maximum indexing and search capacity for the current account and Region, and OpenSearch Serverless scales out your collection resources automatically based on these specifications [1].Maximum indexing capacity – OpenSearch Serverless can increase indexing capacity up to this number of OCUs.Maximum search capacity – OpenSearch Serverless can increase search capacity up to this number of OCUs.References[1] Managing capacity limits for Amazon OpenSearch Serverless - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-scaling.html[2] https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-scaling.htmlCommentShareGovind Kumaranswered a month ago"


Question: ReSchedule AWS EXAM

"Hi Team,I scheduled AWS Associate Exam on 26Th DEC but due to Name Mismatch Online Proctor asked to reschedule the Exam after COrrect Name is updated. Now i updated the Correct Name. now how can i reschedule the Exam again. please help. Also Proctor given Case Number also. please find below.Case Number - 08980479Candidate:Dinesh  Babu PrabakaranCandidate ID:AWS03287353Registration ID:438167940FollowComment"

Answer: "0Please submit a ticket to the AWS Training & Certification customer support team, and they will provide assistance. If you already submitted a case, please allow at least 48 hrs to get a response.CommentShareNelliT-AWSanswered 2 months ago"


Question: passing parameters in step functions

"Hello,Within step function, I want to pass parameters received from input to a Glue:ListCrawler state to run related crawlers inside a Glue and after running all crawlers, I also need to pass the input parameters to a choice step to run glue jobs. Because the output of Glue:ListCrawler is the CrawlerName, I can not use OutputPath to include input parameters. Can anyone help me how to receive input parameters within choice state, in this regard?step function run with this Json format:{"Comment": "Run Glue workflow","tags": {"client": "test","environment": "qa"},"glue":{"client": "test","environment": "qa","partitionDate" : "2023-03-2"}}Step function definition:{"Comment": "A utility state machine to run all Glue Crawlers that match tags","StartAt": "Pass","States": {"Pass": {"Type": "Pass","Next": "Get Glue Crawler List based on Client, Environment"},"Get Glue Crawler List based on Client, Environment": {"Next": "Run Glue Crawlers for all LOB","OutputPath": "$.CrawlerNames","Parameters": {"Tags.$": "$.tags"},"Resource": "arn:aws:states:::aws-sdk:glue:listCrawlers","Retry": [{"BackoffRate": 5,"ErrorEquals": ["States.ALL"],"IntervalSeconds": 2,"MaxAttempts": 3}],"Type": "Task"},"Run Glue Crawlers for all LOB": {"Iterator": {"StartAt": "Run Glue Crawler for each LOB","States": {"Run Glue Crawler for each LOB": {"Catch": [{"ErrorEquals": ["States.ALL"],"Next": "Crawler Success"}],"Next": "Crawler Success","Parameters": {"Input": {"crawler_name.$": "$"},"StateMachineArn": "arn:aws:states:ca-central-1:467688788830:stateMachine:run_each_crawler"},"Resource": "arn:aws:states:::states:startExecution.sync:2","Retry": [{"BackoffRate": 5,"ErrorEquals": ["States.ALL"],"IntervalSeconds": 2,"MaxAttempts": 1}],"Type": "Task"},"Crawler Success": {"Type": "Succeed"}}},"ResultPath": null,"Type": "Map","Next": "Choice","MaxConcurrency": 4},"Choice": {"Type": "Choice","Choices": [{"Variable": "$.environment","StringEquals": "qa","Next": "start glue-qa-dh"},{"Variable": "$.environment","StringEquals": "uat","Next": "start glue-uat-dh"},FollowComment"

Answer: "3In order to pass the input parameters to the choice step, you can use a "Pass" state between "Run Glue Crawlers for all LOB" and "Choice" states. This "Pass" state will help you to merge the output of "Run Glue Crawlers for all LOB" and the original input parameters. Update your Step Function definition as follows:{  "Comment": "A utility state machine to run all Glue Crawlers that match tags",  "StartAt": "Pass",  "States": {    "Pass": {      "Type": "Pass",      "Next": "Get Glue Crawler List based on Client, Environment"    },    "Get Glue Crawler List based on Client, Environment": {      "Next": "Run Glue Crawlers for all LOB",      "OutputPath": "$.CrawlerNames",      "Parameters": {        "Tags.$": "$.tags"      },      "Resource": "arn:aws:states:::aws-sdk:glue:listCrawlers",      "Retry": [        {          "BackoffRate": 5,          "ErrorEquals": [            "States.ALL"          ],          "IntervalSeconds": 2,          "MaxAttempts": 3        }      ],      "Type": "Task"    },    "Run Glue Crawlers for all LOB": {      "Iterator": {        "StartAt": "Run Glue Crawler for each LOB",        "States": {          "Run Glue Crawler for each LOB": {            "Catch": [              {                "ErrorEquals": [                  "States.ALL"                ],                "Next": "Crawler Success"              }            ],            "Next": "Crawler Success",            "Parameters": {              "Input": {                "crawler_name.$": "$"              },              "StateMachineArn": "arn:aws:states:ca-central-1:467688788830:stateMachine:run_each_crawler"            },            "Resource": "arn:aws:states:::states:startExecution.sync:2",            "Retry": [              {                "BackoffRate": 5,                "ErrorEquals": [                  "States.ALL"                ],                "IntervalSeconds": 2,                "MaxAttempts": 1              }            ],            "Type": "Task"          },          "Crawler Success": {            "Type": "Succeed"          }        }      },      "ResultPath": null,      "Type": "Map",      "Next": "MergeResults",      "MaxConcurrency": 4    },    "MergeResults": {      "Type": "Pass",      "ResultPath": "$.CrawlerResults",      "Next": "Choice"    },    "Choice": {      "Type": "Choice",      "Choices": [        {          "Variable": "$.glue.environment",          "StringEquals": "qa",          "Next": "start glue-qa-dh"        },        {          "Variable": "$.glue.environment",          "StringEquals": "uat",          "Next": "start glue-uat-dh"        }      ]    },    "start glue-qa-dh": {      ...    },    "start glue-uat-dh": {      ...    }  }}This updated definition adds a "MergeResults" Pass state that is used to store the output of the "Run Glue Crawlers for all LOB" state in a new field named "CrawlerResults". Since the "ResultPath" is set to "$.CrawlerResultsCommentShareEXPERTsdtslmnanswered 2 months ago"


Question: Public IP been changed after I reboot my EC2

"Hi there,I got a problem,that my public IP changed after I reboot my EC2 while I did nothing to network interface.I got everything configured before this.Now,I have to do everything again.Plz help me.Thanks.Edited by: bigusual on Sep 5, 2017 11:57 AMFollowComment"

Answer: "0Surely this is the default behaviour of EC2 unless you allocate (and pay for) a fixed public IP address, isn't it? There is lots of documentation around on how to use a DDNS service to overcome this. As I understand it, each running EC2 instance gets a public IP address allocated when it is booted up and this remains allocated until the instance is shut down at which point it may get harvested. If you intend to keep the instance running 24/7, you can get a public IP address permanently allocated to it, but you will pay a small standing charge for that address if the instance that it is allocated to is not running.CommentShareMabyanswered 6 years ago0Maby is correct.  Amazon allocates a public IP address until the instances has been shut down and brought back up.You can look into getting an Elastic IP and associating it with whatever instance you'd like if maintaining the IP address is an issue.  Either that or keeping the machine on.One thing to note: Elastic IP's are free under the trial as long as the machine is on.CommentShareThomasVuanswered 6 years ago0Depending on your application, DDNS may be an acceptable solution. I'm running an EC2 instance intermittently during development and testing and didn't want to have to reconfigure each client everytime I start the VM - I registered with one of the free DDNS services and configured the VM to refresh the records each time it start - apart from a lag of a few seconds on each reboot, it works well.Given that this must be a fairly common requirement, I'm surprised that Amazon have not included DDNS functionality in Route53...Edited by: Maby on Sep 11, 2017 11:07 PMCommentShareMabyanswered 6 years ago0Thanks for kindly help.CommentSharebigusualanswered 4 years ago"


Question: EKS: "There are no available nodes for LoadBalancer"

"Hi there, I am trying to deploy EKS managed by ArgoCD and deployed with Pulumi. The setup is as follows:#pulumi_IaC/__main__.py...argo = k8s.helm.v3.Release(    "argocd",    args=k8s.helm.v3.ReleaseArgs(        chart="argo-cd",        namespace=ns.metadata.name,        repository_opts=k8s.helm.v3.RepositoryOptsArgs(            repo="https://argoproj.github.io/argo-helm"        ),        values={            "server": {                "service": {                    "type": "LoadBalancer",                }            }        },    ),    opts=pulumi.ResourceOptions(provider=provider, parent=ns),)app_ns = k8s.core.v1.Namespace(    "sock-shop",    metadata={        "name": "sock-shop",    },    opts=pulumi.ResourceOptions(provider=provider, parent=cluster),)argo_app = app.argoproj.v1alpha1.Application(    "sock-shop",    metadata=k8s.meta.v1.ObjectMetaArgs(name="sock-shop", namespace=ns.metadata.name),    spec=app.argoproj.v1alpha1.ApplicationSpecArgs(        destination=app.argoproj.v1alpha1.ApplicationSpecDestinationArgs(            namespace=app_ns.metadata.name,            server="https://kubernetes.default.svc"        ),        project="default",        source=app.argoproj.v1alpha1.ApplicationSpecSourceArgs(            path="sock-shop",            repo_url="https://github.com/argoproj/argocd-example-apps",            target_revision="HEAD",        ),        sync_policy=app.argoproj.v1alpha1.ApplicationSpecSyncPolicyArgs(            automated={}        )    ),    opts=pulumi.ResourceOptions(provider=provider, depends_on=[argo, app_ns]),)Viewing the cluster through Kube Lens showes the following message: "There are no available nodes for LoadBalancer" | argocd-7483fb39-server.I am not sure if this or something else is the reason I can't access the application from my machine... How can I access the sock-shop frontend?FollowComment"

Answer: 1Accepted AnswerI found the ip for the lb using: kubectl get services -n sock-shop | grep LoadBalancerCommentShareElonanswered 10 months ago


Question: CloudFormation Nonsense: Seven (7) SNS Subscriptions created for SQS Queues by a Template

"Greetings!,I have a nonsense CloudFormation behaviour, the problem is in the section where i create an SNS Topic and two SQS Queues in a typical Fan-out pattern:Resources:  ForwardMessageQueue:    Type: AWS::SQS::Queue    Properties:      QueueName: !Sub 'ForwardMessageQueue${EnvironmentPrm}'      Tags:        - Key: 'Environment'          Value: !Ref EnvironmentPrm  AuditMessageQueue:    Type: AWS::SQS::Queue    Properties:      QueueName: !Sub 'AuditMessageQueue${EnvironmentPrm}'      Tags:        - Key: 'Environment'          Value: !Ref EnvironmentPrm  CallbackNotificationTopic:    Type: AWS::SNS::Topic    Properties:      TopicName: !Sub 'CallbackNotificationTopic${EnvironmentPrm}'      Subscription:        - Endpoint: !GetAtt ForwardMessageQueue.Arn          Protocol: "sqs"        - Endpoint: !GetAtt AuditMessageQueue.Arn          Protocol: "sqs"      Tags:        - Key: 'Environment'          Value: !Ref EnvironmentPrmThe template executes successfully and the solution once deployed, does what it has todo.The problem is when I checkout the configuration of the Queues through the AWS Web Console, I find seven SNS Subscriptions like:Subscription ARNTopic ARNarn:aws:sns:us-east-1:012345678901:CallbackNotificationTopicDev:cef23e99-12c6-4120-9219-bb4b7ac05ef4arn:aws:sns:us-east-1:012345678901:CallbackNotificationTopicDevarn:aws:sns:us-east-1:012345678901:CallbackNotificationTopicDev:afdfc906-5b0d-41f0-9185-572b51fecaf5arn:aws:sns:us-east-1:012345678901:CallbackNotificationTopicDevarn:aws:sns:us-east-1:012345678901:CallbackNotificationTopicDev:ab1ebde3-91b9-4567-a2b4-9613afefbbd7arn:aws:sns:us-east-1:012345678901:CallbackNotificationTopicDevarn:aws:sns:us-east-1:012345678901:CallbackNotificationTopicDev:930edf3c-ccb4-4184-b263-32ee64136387arn:aws:sns:us-east-1:012345678901:CallbackNotificationTopicDev... and other 3 rows more, seven rows in total.Any idea of the cause of this misbehavior?Thanks in advanced!.FollowCommenteduardo_j_yanez_p a year agoToday I created a very simple CloudFormation template just for the fan-out pattern (identical to the previous one, I just changed the logical names of the SNS Topic and SQS Queues), the result was as expected: one SNS subscription for every Queue.Exactly the same code in the real solution's template create seven SNS Topic subscriptions per SQS Queue, weird...Share"

Answer: 0I launched your template (copied from your post) and couldn't reproduce the issue I'm afraid. If you are on an AWS support plan (i.e. Developer or higher) I'd suggest opening a support ticket as the support team can then investigate internally to see what the services are doing.CommentShareEXPERTJames_Sanswered a year ago


Question: How do I clear Device Shadow 'desired' state from device

"We are using AWS IoT "Device Shadow" service to sync settings between cloud back-end services and our embedded device.The device publishes its "reported" state to $aws/things/xxx/shadow/update:{ "state": { "reported" : ... } } And when the back-end wants to change something, it publishes a "desired" state:{ "state": { "desired" : ... } } This generates a delta message on $aws/things/xxx/shadow/delta, which we subscribe to on the device. This all works well.However, sometimes the device needs to reject a change (typically because the device was offline and so the change is too old and not reliable data). In this case, we don't want to keep getting "delta" messages for this change we want to reject.According to this post, we can set the "desired" state to null to clear it:[https://repost.aws/questions/QUx_YtxvdmTFODhuuNd4D_Yw/how-to-deal-with-shadow-updates-initated-by-device-not-and-server]As per the example, I have tried sending this from our device to $aws/things/xxx/shadow/update:{"state" : {"desired" : null } }However, this is rejected by the server and causes a message on $aws/things/xxx/shadow/update/rejected:{  "code": 400,  "message": "Payload contains invalid json"}The JSON looks valid. Also, this DOES work if I post it to $aws/things/xxx/shadow/update from the online MQTT client in the AWS console (i.e. it is accepted, and has the desired effect - the desired section of the device shadow is deleted).Why do I get this error when the message is sent from the device? How do I clear / reject a "desired" change?FollowCommentPhilipp S 5 months agoHow do you try to update the shadow? Could you provide a code snippet?ShareMassimilianoAWS EXPERT5 months agoI would suggest to check that the JSON data is serialized correctly. You can also subscribe to $aws/things/+/shadow/update in the AWS console to see what message is effectively being sent.Sharekbrandsen 5 months agoIf the update works sending it via the AWS MQTT client but does not on your device it points to there most likely being a JSON formatting/Parsing error on the device. Can you please attach as snippet of the publish code so that I may have a look.ShareGalgAgDevTeamMember 5 months agoDeeper investigation showed that the outgoing message buffer was being overwritten by the next message - AFTER I logged it to check the content but BEFORE the message had been fully sent - due to a threading "misunderstanding". Thanks @MassimilianoAWS for suggesting that I check the "$aws/things/xxx/shadow/update" topic in the AWS console - this made the corrupt content obvious. What can I say, it was a Friday...Share"

Answer: "0Deeper investigation showed that the outgoing message buffer was being overwritten by the next message before it was fully sent, due to a misunderstanding of how the threading worked in the client library.Using {"state" : {"desired" : null } } does successfully clear the device shadow "desired" section.CommentShareGalgAgDevTeamMemberanswered 5 months ago"


Question: In QuickSight how can I make a table exactly the same width as a pdf report?

"I have a table in my QuickSight analysis. The table contains one column and multiple rows with textual data. I have set the table header width to match the analysis editor width, which unfortunately is dependent on the screen width. Now I want like to make a pdf-report out of my analysis.The problem is that currently the table in the pdf-report is only 2/3 of the pdf width. I would like that the table width would match exactly the pdf width. Is there any easy way on how I can get the table width to match the pdf width? E.g. is there a way to define the graph heights and widths with a pixel value?FollowComment"

Answer: "0Hi,to define a pixel perfect report or visual, please, review the free form feautre as in dept describe in the blog post "Create stunning, pixel perfect dashboards with the new free-form layout mode in Amazon QuickSight".Also, for QuickSight related questions we have launched a fully dedicated community; in case you want to check there to see if there are further answer to your questions.hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Suggestion on storing public certificates in AWS

"Hi, I have a case where I would like to store third-parties certificates in our AWS account. We MUST NOT have access to their private, only public keys.What would you recommend to store public keys certificate, which belong to external clients, in AWS?FollowComment"

Answer: "1Accepted AnswerIt is kind of shared responsibility model issue and you may be familiar on it. AWS provides security of the cloud, and customer needs to ensure security in the cloud (e.g. how you configure security policy to ensure data is securely stored). For security of the cloud, AWS provides with Secret Manager to store the sensitive data like, API key, certificate etc. Undoubtedly, you can also store public key on Secret Manager.  Ensure you have properly configure security of the Secret Manager and the size of secret is limited to 64KB. (https://docs.aws.amazon.com/secretsmanager/latest/userguide/security.html).CommentShareSamuelanswered 4 months ago0AWS Certificate Manager (ACM) can help the customer handling third-parties certificates, AWS public CA or private CA. To import a self–signed SSL/TLS certificate into ACM, you must provide both the certificate and its private key. To import a certificate signed by a non-AWS certificate authority (CA), you must also include the private and public keys of certificate.Refer URL:https://docs.aws.amazon.com/acm/latest/userguide/import-certificate.htmlCommentSharerePost-User-0782469answered 4 months agoalatech EXPERT4 months agoPrivate key cannot be shared so above doesn’t flyShare"


Question: AWS IoT Greengrass (V2) Core Device - Management

"Hello,I have a couple of questions related to selecting the right tool for the job.There are three different technologies, which apparently all of them can handle device management:AWS Systems Manager Agent component - the standard edition is limited to 1,000 devices (per account and per region). My understanding is that it would allow me to use the regular system manager capabilities, e.g., patching, automation, session manager (remote shell access), etc.AWS IoT Device Management - there are some unique capabilities but similar to AWS Systems Manager it enables Device Jobs (that can be used to support software updates), Secure Tunneling (remote access), etc.AWS Greengrass V2 Deployments (Create deployments) - appear to allow updating Greengrass software via jobs.I prefer to use just the tools I really need. Can you please advise what is the different between the three approach specifically for managing (patch/updates) Greengrass (V2) Core devices? is the 3rd option (AWS Greengrass V2 Deployments) sufficient for patch/updates in this particular use case?Thank youFollowComment"

Answer: "1Accepted AnswerHi yossico. Greengrass V2 deployments are purpose built for managing and updating your Greengrass v2 components, including the Nucleus itself. This is the best way to manage your components.However, Greengrass deployments don't natively support updating or managing the underlying OS of your core device. This is where the Systems Manager Agent can be a powerful addition, allowing you to orchestrate OS patch management across your fleet. In particular the Node Management features such as Patch Manager, Run Command, Session Manager and Fleet Manager. This video may be of interest: https://www.youtube.com/watch?v=CqzSBkp5Vi0Deployments do indeed use AWS IoT Jobs, but deployments are a specialized kind of job. You can build a component that uses AWS IoT Jobs for other purposes. However, Greengrass V2 does not have any generalized support for jobs out of the box.Secure Tunneling is a great tool for remote access, but what it gives you is quite similar to Systems Manager Session Manager, so you may not need or want both. You are only charged when you open a tunnel however, so you can install the Secure tunneling component and only use it if/when you need it.CommentShareEXPERTGreg_Banswered a year ago"


Question: Unable to upscale resolution when using Newest Nvidia GRID/vGPU Drivers (511.65)

"Hello,We seem to have an issue with Nice DCV where we cannot upscale the resolution past 1440x990 when using to connect to an AWS instance with newest GRID/vGPU drivers 511.65.In the past we have always used a specific version of vGPU/Grid driver 443.05 which works and allows the upscale to 1920x1080. We tested updating the GPU drivers but this blocks us from upscaling past 1440x990. If you were to RDP to the instance, this works and allows the upscale resolution. This only effects us when trying to use the Nice DCV web access.We have also tried different versions of Nice DCV with different newest vGPU drivers but we still get the same issue.Has anyone else come across this issue?ThanksRobFollowComment"

Answer: "2Hello Rob, thank you for posting.There does appear to be a known issue regarding GRID drivers and limited display resolution. During my review of the issue I found that this is often related to licensing. When downloading the GRID driver directly from the AWS S3 bucket, it includes automatic issuing of a GRID license when installed, whereas if the driver is downloaded directly from Nvidia this automatic licensing does not occur. Please refer to "Option 3" in the documentation page referenced below[1] for instructions on obtaining the GRID driver from the S3 bucket.If you continue to experience difficulty after downloading the driver from the S3 bucket, I encourage you to open a support case so that our team of Support Engineers can investigate the specifics of the issue.References:[1] https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/install-nvidia-driver.html#nvidia-installation-optionsCommentShareSUPPORT ENGINEERAWS_SamManswered a year ago1Hello! If you have found an issue between NICE DCV and a specific NVIDIA driver version, we will probably need to escalate this to the Service Team to perform an investigation. I would suggest opening a case with AWS Premium Support. In this case, please provide the instance ID as well as the NICE DCV server logs and the specific NICE DCV version you are using. If you can only reproduce via the web browser and not the Windows NICE DCV client, you can also provide HAR logs https://aws.amazon.com/premiumsupport/knowledge-center/support-case-browser-har-file/CommentShareSUPPORT ENGINEERFrancisco_Lanswered a year ago"


Question: AWS Grafana Bad Gateway error to AWS Opensearch

"Hi,We have AWS Grafana set up in our Organization root account with access to AWS Opensearch services.I have created a new aws opensearch in a different accountI have added it as a data source to aws grafana (shows up in adding new data sources)But when i go to save and test in the data source details it shows as Opensearch error: Bad GatewayI have tried adding a index name to the opensearch details of grafana , using basic auth, but always get the same error.any ideas how to resolve?FollowComment"

Answer: "0The error reported indicates that Amazon Managed Grafana couldn't reach the OpenSearch domain.I would like to mention that in order for AMG workspaces to access datasources in a VPC:> The datasource must be publicly accessible via the internet.> AMG IP addresses must be allow-listed for inbound traffic into their VPC.However, a feature request is currently open to provide access to private sources in AMG, since product road maps are not shared with Premium Support, I will not be able to confirm if/when this new feature will be available.Nevertheless, to keep abreast of all the latest developments in AMG, you can follow https://github.com/aws/amazon-managed-grafana-roadmapAs a workaround, you can configure a proxy with a publicly accessible endpoint for your OpenSearch domain, and connect to it from AMG. To do so, you can follow the steps below:Amazon OpenSearch Service / Nginx configuration [1]1. Launch an EC2 instance in the public subnet of the same VPC as your remote OS domain.2. Register a DNS name with the public IP address of the EC2 instance as an "A Record".3. Install and configure your NGNIX proxy server. a. If you launched an Amazon Linux AMI:$ sudo yum install nginxb. For instances launched with an Amazon Linux 2 AMI:$ sudo amazon-linux-extras install nginx1c. Configure Nginx:Note: The following example is meant to be used as a starting point, and adjustments might be necessary to reflect your use case and requirements.Under the http section in the file /etc/nginx/nginx.conf, add the following:resolver 10.0.0.2 ipv6=off;This parameter represents your VPC DNS resolver and might change according to your VPC settings.Create a configuration file (for example, /etc/nginx/conf.d/os-proxy.conf) with the following content:server {    listen 443 ssl;    server_name <AmazonOS_External_DNS>;# Replace by the DNS name created on step 2.    rewrite ^/$ https://$server_name/_plugin/dashboards redirect;    ssl_certificate /etc/nginx/cert.crt;# Replace by your certificate    ssl_certificate_key /etc/nginx/cert.key;# Replace by your certificate private key    ssl_session_cache builtin:1000 shared:SSL:10m;    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;    ssl_prefer_server_ciphers on;    set $os_endpoint <AmazonOpenSearchService_Endpoint>;    set $cognito_endpoint <Cognito_Host>;    location /_plugin/dashboards {        # Forward requests to OpenSearch Dashboards        proxy_pass https://$os_endpoint;        # Handle redirects to Amazon Cognito - comment/remove if you are not using Cognito authentication        proxy_redirect https://$cognito_endpoint https://$server_name;        # Update cookie domain and path        proxy_cookie_domain $os_endpoint $server_name;        # Response buffer settings        proxy_buffer_size 128k;        proxy_buffers 4 256k;        proxy_busy_buffers_size 256k;    }    # In the case you are not using Cognito authentication, comment/remove the following section    location ~ \/(log|sign|error|fav|forgot|change|confirm) {        # Forward requests to Cognito        proxy_pass https://$cognito_endpoint;        # Handle redirects to OpenSearch Dashboards        proxy_redirect https://$os_endpoint https://$server_name;        # Handle redirects to Amazon Cognito        proxy_redirect https://$cognito_endpoint https://$server_name;        # Update cookie domain        proxy_cookie_domain $cognito_endpoint $server_name;    }}d. Enable and start Nginx service:$ sudo systemctl enable --now nginx4. After starting the NGINX service, your domain can be accessed via OpenSearch Dashboards through https://<AmazonOS_External_DNS>.Amazon Managed Grafana configuration [2]1. Login to your Amazon Managed Grafana workspace and, in the left navigation bar, select the AWS icon.2. In the 'AWS services' tab, select 'Amazon OpenSearch Service'.3. Under 'Regions', select the corresponding region and choose the AOS domain you want to add as a data source. Click on 'Add data source'.4. Under 'Provisioned data sources', click on 'Go to settings'.5. Update the datasource with the following information:* HTTP:- For 'URL', add the public DNS name created before, in the format https://<AmazonOS_External_DNS>.- For 'Access', select 'Server (default)'.* Auth:- Select 'Basic auth', and 'Skip TLS verify'.- Unselect 'SigV4 auth'.* Basic Auth Details:- Add the credentials for an OpenSearch user.* OpenSearch details:- Add the index name on 'Index name', and its corresponding 'Time field name'.Click on 'Save & test'.References:[1] How do I use an NGINX proxy to access OpenSearch Dashboards from outside a VPC that's using Amazon Cognito authentication?https://aws.amazon.com/premiumsupport/knowledge-center/opensearch-outside-vpc-nginx/[2] Use AWS data source configuration to add Amazon OpenSearch Service as a data sourcehttps://docs.aws.amazon.com/grafana/latest/userguide/ES-adding-AWS-config.htmlCommentShareAWS-Aaftab_Aanswered 8 months ago"


Question: How can I confirm if GuardDuty logs are consolidated in one account?

"I have a task where I'm required to make sure all my GuardDuty logs from multiple accounts are logged to one account using a centralized logging solution.At the moment, I'm trying to find a way either via console or cli, or both to confirm if my guardduty logs are centralized in the account I am in.Is there an easy way to confirm this?FollowComment"

Answer: "0Having a central GuardDuty (delegated administrator) is the best practice in a multi-account environment. Member accounts join the central GuardDuty and consolidate all findings there. Central GuardDuty can store logs/finding in an S3 bucket.Another option is to have independent GuardDuty service in every AWS account and you can make them send logs to the same S3 buket in different folders (prefixes), but this is not so convenient.CommentShareOleksii Bebychanswered 4 months agorePost-User-0476594 4 months agoI'm asking how do I verify this. I'm not asking what's the best option to use for GuradDuty. Though this is helpful information it wasn't m question.My question is how do I confirm through the console or even an CLI that my accounts have a Delegated Administrator or if it's sending logs to a bucket?ShareOleksii Bebych 4 months agoAWS Organization's Management account:GuardDuty - Settings - Delegated Administrator - Account IDGuardDuty Delegated Administrator account:GuardDuty - Settings - Findings export options - S3 bucketYou can select an S3 bucket in the same account or in another account + KMS key for logs encryptionShare01/ Navigate to GuardDuty in the main account (payer) in your organization. Choose settings, and you will see which account is the Delegated Administrator.2/ Login to that account and go to the GuardDuty console.3/ Choose settings, Accounts. You will see a list of every account in the organization, and if GuardDuty is enabled.4/ You will have to repeat this for each Region you want GuardDuty enabled in.You can enable Export findings from the GuardDuty administrator account. It will include the findings from all associated member accounts that are generated in that Region. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html?icmpid=docs_gd_help_panelCommentShareJeremy_Sanswered 4 months ago0Amazon GuardDuty supports the consolidation of these findings to one AWS account to support centralized log management. You must choose a one of AWS accounts to be the central log account for GuardDuty.There are two ways to associate accountsBy sending an invitation through GuardDuty. Additional for multiple accounts, you can add child accounts by using the “Upload List (.csv)”.Throughout an AWS Organization that all accounts are members of.Once child accounts has accepted the invitation, all the findings log in the secondary account will now be sent to the central log  account.After that, look back in GuardDuty central log account, the status of invited account will now be “Enable”All GuardDuty logs will be stored in central log account which is in an S3 bucket of central log  account.For more detail, please visit https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.html .CommentShareKajonsakanswered 3 months ago"


Question: Mcu compatible to Fleetwise

"I need to know witch MCU could be compatible with Fleetwise, Can i use another NXP MCU like the S32K or something like that in the same family of S32 or i can use another family of NXP ?FollowComment"

Answer: "0https://aws.amazon.com/iot-fleetwise/faqs/Q: What are the hardware requirements for AWS IoT FleetWise Edge?AWS IoT FleetWise Edge Agent currently supports the NXP S32G vehicle network processors and will continue to add support for additional popular automotive hardware. The same AWS IoT FleetWise Edge Agent can also run on Amazon Elastic Compute Cloud (Amazon EC2) Graviton instances with previously collected vehicle data. For more details, see the “Edge” guide available within the console.CommentShareEXPERTGreg_Banswered a year ago0Note that the agent itself is a Linux application, and therefore it can run on any device that supports Linux. For porting information see documentation here: https://github.com/aws/aws-iot-fleetwise-edge/blob/main/README.md. Other OS support is being developed.CommentShareAWS-User-0515442answered 9 months ago"


Question: How do I fix the error "DataStore - User is unauthorized"

"React application when attempting to use any Datastore functions returns this warning in the console.DataStore - subscriptionError Connection failed: com.amazonaws.deepdish.graphql.auth#UnauthorizedExceptionDataStore - User is unauthorized to query syncFriendships with auth mode API_KEY. No data could be returned.What is causing this error, how do I fix it, and get my app to where I can read and write data to the database? Note this backend works on a react native application. I have ran amplify pull and have all the changes locally. I am on day 7 of trying to fix this.FollowCommentrePost-User-1643959 a year agoI have the same issue:My Expo project was working fine.After I installed TopTabNavigation my project got messed up. I started having issues with conflicting versions  of dependencies specially for react-native-tab-view which I fixed with expo doctor --fix-dependencies, but then I got this error that I have not found in any forum yet:DataStore - User is unauthorized to query syncUsers with auth mode API_KEY. No data could be returnedCan you help me? ThanksShare"


Question: Installing Athena ODBC Driver on Mac OS

"Hi,I downloaded Athena ODBC Driver on Mac OS through the linkI found that it requires additional configuration to use this driver on Mac os.In order to do that, I need to copy the license file to /Library/simba/athenaodbc path but I can't find this file and didn't receive it through email as well.Please advise how I can finish the configuration to use the driver.FollowComment"

Answer: "3Download OSX Driver from the linkhttps://docs.aws.amazon.com/athena/latest/ug/connect-with-odbc.htmlAnd Follow the configuration guide for MAC OSX from the documenthttps://s3.amazonaws.com/athena-downloads/drivers/ODBC/SimbaAthenaODBC_1.1.19.1002/docs/Simba+Amazon+Athena+ODBC+Connector+Install+and+Configuration+Guide.pdfAnd Configure the Driver as in the document sectionConfiguring the ODBC Driver Manager on Non-Windows MachinesCommentShareEXPERTsdtslmnanswered a month agoSojeong 24 days agoHi,Thanks for your comment yet I still couldn't handle the issue.I modified both odbc.ini and odbcinst.ini files as below based on the docs but I still cannot load the driver with an error message: 'specified driver could not be loaded'./Library/simba/athenaodbc/Setup/odbc.ini[Simba Athena]Driver=/Library/simba/athenaodbc/lib/libathenaodbc_sbu.dylibAuthenticationType=IAM CredentialsUID=${Access key}PWD=${Secret key}AwsRegion=us-east-2S3OutputLocation=s3://test//Library/simba/athenaodbc/Setup/odbcinst.ini[ODBC Drivers]Simba Athena ODBC Driver=Installed[Simba Athena ODBC Driver]Description=Simba Athena ODBC DriverDriver=/Library/simba/athenaodbc/lib/libathenaodbc_sbu.dylibShare"


Question: Does AWS Roles Anywhere support keys in an enclave?

"AWS Roles anywhere as recently released https://aws.amazon.com/blogs/security/extend-aws-iam-roles-to-workloads-outside-of-aws-with-iam-roles-anywhere/  appears to use a client tool aws_sigining_helper that takes a parameter of the private key.   Is this code open source? can it be? (I didn't see it on github) because I would like a feature that would enable the key being in an enclave (like with a Mac, or using a Yubikey)This feature would help in cases where the key material should not leave the device.  (almost all cases IMO)FollowComment"

Answer: "0Hello,Greetings from AWS !The authentication sign process is explained here [1]. You can implement your own code following the process explained in this document [1] to call the CreateSession API of Roles Anywhere. Though there is no sample code from AWS side, I would like to share this third-party document [2] which contains sample code in Python making request to CreateSession API following the signing process explained in [1].Note: AWS would not be able to vouch for the integrity of the content being provided in third-party links. Kindly ensure to implement in your test environment first and then to use in your production environment.That said, there is an existing feature request on making the code open source. While I am unable to comment on if/when this feature may get released, I request you to keep an eye on our What's New and Blog pages for any new feature announcements.I believe the information is helpful to you. In case you have any further queries/concerns then please let us know. We will be more than happy to assist you further.Wish you an AWeSome day ahead and stay safe ! 🙂--References--[1] https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-sign-process.html[2] https://nerdydrunk.info/aws:roles_anywhereCommentShareSUPPORT ENGINEERTarit_Ganswered 9 months ago"


Question: Glue Jobs on Large Data files

"Hi Team,I have a requirement to create ETL to transform data from 100's of data files (each has unique schema) into a common format CSV file.  Source files  are in S3 bucket folders. (each folder is unique dataset). Sometimes the requirement is to join multiple files in a folder and also write business logic in transformation. These files have millions of records.I have tried Glue Cralwer and Glue jobs to create target files using limited data.  My question is, How Glue will perform on millions of records and will it be cost effective? Can you please share information on this one?And also, I'm planning to orchetsrate each Glue crawler and Glue job from Step Functions. Is this correct approach?  Thank you.FollowComment"

Answer: "0Accepted AnswerAWS Glue main focus is the kind of use case you describe and much larger datasets.Obviously, depending on the complexity of your joins and transformation logic, you can run into challenges if you don't have previous experience using Apache Spark (which Glue ETL is based on).  It's probably worth investing some time understanding how it works and how to monitor it.The cost effectiveness depends on how efficient is your logic is and how you tune your configuration. Glue 4.0 provides a number of improvements and optimizations out of the box, that should really help you with that.Crawlers are an optional convenience, you could read the csv files directly if you only need to read them once (if is not a table you to use for other purposes).Step Functions require a bit learning but  allow building advanced workflows, for simple workflows Glue provides triggers and visual workflows inside Glue.CommentShareGonzalo Herrerosanswered a month ago"


Question: AWS SQS Logging Message Consumption

According to the referenced article the SQS supports the following logging actions (https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-logging-using-cloudtrail.html):AddPermissionCreateQueueDeleteQueuePurgeQueueRemovePermissionSetQueueAttributesTagQueueUntagQueueI have a requirement to log SQS API requests for the consumption of SQS queue messages?  Is there a solution for this?FollowComment

Answer: "0Accepted AnswerNo. SQS logs to CloudTrail the control plane APIs (as listed in your question). Consuming messages from a queue is a Data plane API, and only a few services (S3, DynamoDB and Lambda) support logging those messages to CloudTrail. SQS is not one of them.If you need to log all those messages, do it in your application. Another option, that is relevant depending for the reason for the logging requirement, is to send the events to EventBridge and create a Rule with two targets. The first is the SQS queue. The second target is CloudWatch logs. This way all the messages will get to the application as well as to CWL.CommentShareEXPERTUrianswered 10 months ago"


Question: Visualizing amplify graphql definition

Is there any way I can easily visualise the amplify graphql structure in the form of a graph. Any service or tool will work. Being interactive will be a bonus. I have seen general graphql visualisers. But what I  am looking for is something which takes care of the amplify directives as well.FollowComment

Answer: "0Hi,Thanks for your patience as we worked with the Amplify team regarding your query.The Amplify team informs us that they aren't aware of any third-party tool that can visualize the model schema with respect to Amplify specifically. The Amplify GraphQL transformer will convert the model schemas into a full GraphQL schema for use with AppSync, which a data visualizer like GraphQL Voyager or others listed in that article can be used on that, but nothing specifically for before the data is transformed.CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago"


Question: Configure Linode MX Records for SES Mail From

"Hi All,I have successfully setup DKIM. I am working now on Mail From. I am using Linode. SES is saying the MX record is wrong. At Linode I have set the "subdomain" field to "mail" and the "Mail Server" field to "feedback-smtp.us-east-1.amazonses.com" wither Preference set to 10 and TTL set to Default. Still, SES is saying "To complete configuration of your custom MAIL FROM domain, you must update the domain's DNS settings using the MX record provided."Anyone else have issues setting up Mail From with Linode? Their MX field names don't match the ones on SES, but Linode support tells me this is correct.Thanks,DavidFollowComment"

Answer: 0Incase anyone else has this issue. It turns out what I had to to resolve SES not seeing the MX record was just turn "Custom MAIL FROM" off and on. Silly... but yeah it didn't automatically detect the fixed MX record on its own over several days.CommentShareDavid Kopecanswered 2 years ago


Question: Is Elastic Beanstalk affected by ec2 Autoscaling Launch Configurations deprecation?

I received information that Amazon EC2 Launch Configurations will Deprecate support for new Instances (https://aws.amazon.com/blogs/compute/amazon-ec2-auto-scaling-will-no-longer-add-support-for-new-ec2-features-to-launch-configurations/). When running inventory check I see that all Elastic Beanstalk clusters are using deprecated functionality but there is no migration path in documentation. How does the change impacts Elastic beanstalk users?FollowComment

Answer: "1As announced in EC2's Blog Post in 2021 1 and more recently through an email campaign, after Dec 31st 2022 AWS will not be adding support for newly released instance types to EC2 Auto Scaling groups that use launch configurations. As a customer of Elastic Beanstalk, your Environments that are configured to use launch configurations will continue to be supported past this date, but no newly released instance types will be available for use in those environments. Environments configured to use launch configurations will function as expected and attempts to Update with a new (unsupported) instance type will fail. If you are interested in configuring your Environment to use launch templates, you may migrate your Environment to an AL2 platform 2 and set IMDSDisableV1 to true 3. For more information on the IAM policies required to use launch templates, see our developer guide 4.CommentShareShahad_Canswered 6 months agoduckworth 6 months agoHi @Shahad_C ,We have already done all of those:1 - Our Environment is on an AL2 platform2 - IMDSDisableV1 is set to true3 - We are using the AWS managed IAM policies that have the correct permissions for LaunchTemplatesYet our environment still uses launch configurations and there is nothing documented on how to migrate an existing environments to use LaunchTemplates. Nothing seems exposed on Elastic Beanstalk to make this possible. Even cloning the environment keeps the launch configuration. Only brand new Applications seem to use LaunchTemplates.Please advise.ShareShahad_C 5 months agoHi @duckworth - Are there EBExtensions which might be forcing the environment to use a launch configuration?  I'm not able to see your account information here, do you have a support plan where you can open a support case to have someone look into your specific settings?Share"


Question: Permission denied on S3 when using Athena on AWS console

"I am logged into AWS console as administrator and trying to use Athena to read files on s3 that I don't allow public access to, but it doesn't work. budget policy is as follows, work group is The budget policy is as follows and the work group is the primary Athena SQL one. databaseI have confirmed that the database is using the one generated by default and that the Data lake permissions also give All permissions to the IAM user used to log in to the console and I can open and download s3 budget file.The DDL query for the create table including the s3 LOCATION succeeds, but when I try to hit the select statement"Permission denied on s3 path: (s3 url)This query ran against the "default" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 444f5547-4c37-4e05-a4a7-d1cd67cb865d"I think this is probably because the IAM role used in the Athena query that I type in AWS console is different from the IAM user used for login, but I don't know where to refer to the Athena IAM User. (The work group in spark has IAM, but the primary in Athena SQL didn't have IAM.){"Version": "2012-10-17","Statement": [{"Sid": "sample","Effect": "Allow","Principal": {"AWS": ["IAM user login to console"]},"Action": "s3:*","Resource": ["s3 arn",                                "s3 arn/*"]}]}about answer1.About Output folder, budget policy has already been set.2.And Glue Data Catalog Policy is configured as this.{  "Version" : "2012-10-17",  "Statement" : [ {    "Effect" : "Allow",    "Principal" : {      "AWS" : [ "my Iam user arn" ]    },    "Action" : "glue:*",    "Resource" : "arn:aws:glue:ap-northeast-1:my id number:*"  } ]}3.I confirmed s3 is encrypted by Amazon S3 managed keys (SSE-S3).I mistaked encrypted by my KSM key. but user and administrater key policy is attach to my iam accountbut same error happened on AWS management console Athenaerror messages s3 url is one I wanted to read from s3. not output folderPermission denied on s3 path: (s3 url)FollowComment"

Answer: "0Hi there,There are few things you have to check according to https://aws.amazon.com/premiumsupport/knowledge-center/access-denied-athena/IAM permission on S3 including the athena output folder in your workspace [seems that you have already done]IAM permission on Glue Data Catalog policy [missing?]IAM permission on KMS and KMS key user permission if the s3 bucket is encrypted by customer-managed key.Hope this help.CommentSharehspoonanswered 3 months agorePost-User-2086621 3 months agoThank you for answering question but, I cannot solve this as I commented belowShare"


Question: DMS CDC to Redshift during cluster resize

"A customer has a 28-node dc2.large RS cluster and a CDC DMS process continuously replicating data from an on-prem database. They plan to migrate the RS cluster to a 3-node ra3.4xlarge cluster and are worried about any possible failure on the CDC process during the migration.The process they will follow is:Elastic resize the cluster from 28 dc2.large nodes to 7 ra3.4xlarge nodes.Classic resize the cluster from 7 ra3.4xlarge nodes to 3 ra3.4xlarge nodes.This way they will keep the same cluster endpoint, so theoretically nothing should change regarding DMS configuration. Do you see any potential risk for the replication process during the migration?Thank you in advance!FollowComment"

Answer: "0Accepted AnswerIs there a reason you aren't using Elastic re-size for both operations? Our docs say you can use Elastic re-size to change node types if the new/old node types are supported so it would be worth double checking that.Whilst CDC will work after you've done the migration as you aren't changing DB configuration, during the re-size you won't be able to update the DB on the Redshift cluster, as per our docs "During the resize operation, the cluster is read-only"For elastic re-size, this would be 10-15 minutes, but for classic resize this could be 2 hours - 2 days and it's something you'd want to prepare your customer for.CommentShareEXPERTAndrew_Ranswered 3 years ago"


Question: Error importing AWS::ApiGateway::UsagePlanKey

"Hi,I've been trying to import an AWS::ApiGateway::UsagePlanKey resource in to an existing stack and wasn't sure of the correct format of the id. I've now discovered that the correct format is "usagePlanId:apiKeyId" and the process is working, but the error message I received up until this point was very unhelpful:I'm guessing the value is split on the : character and therefore if your input doesn't have one it comes up with the error Index: 1, Size: 1. Can I suggest that you capture this error and make it more user friendly? In the interim hopefully others might find this post to help them with the above issue.ThanksMarkFollowComment"

Answer: "0I tested the above using similar scenario on my end and replicated the same error. Your investigation is correct that when we pass an incorrect identifier (without the : ) for the resource AWS::ApiGateway::UsagePlanKey while importing it, we are getting the below error which is not very clear.There was an error creating this changesetIndex: 1, Size: 1Using a correct identifier (for eg - 123a4bcde5:a1bfcd) resolved the issue and the resource can be imported successfully.I would like to take advantage of this to thank you for bringing it to our notice. As we strive to improve our products, your feedback is greatly appreciated. I also understand that this might have caused inconvenience to your work-flow, and sincerely extend my apology for the sameHowever, I would like to add that I have passed on this feedback to the internal CFN team so that they can check if the error messaging can be improved here and add it to their roadmap.CommentShareSiddhant_Manswered a month ago"


Question: Server time out

"I am trying to run a "dotnet build" from within my t2.micro server,It just hangs and never executes.What could be the issue?I have added volume to the instance, but no improvementFollowCommentDmitry Balabanov a year agoWe would need some more information to help. Which AMI do you use? What is your EC2 instance configuration (instance store or EBS, volume size, networking, ...) Which .NET SDK do you use? What kind of project do you build? Does it require NuGet packages? Have you tried to check with top how much CPU and memory the .NET SDK uses? In general, it should work. For troubleshooting your issue you'd have to identify what is causing the freeze (network, storage, CPU, ...)Share"

Answer: "0Hi, @Chisco-IrisI tried to build with EC2 instance size set to t2.micro, but it didn't hang.[root@ip-10-0-20-225 hoge]# dotnet build --diagnosticsMicrosoft (R) Build Engine version 17.1.1+a02f73656 for .NETCopyright (C) Microsoft Corporation. All rights reserved.  Determining projects to restore...  All projects are up-to-date for restore.  hoge -> /usr/bin/hoge/bin/Debug/net6.0/hoge.dllBuild succeeded.    0 Warning(s)    0 Error(s)Time Elapsed 00:00:01.53Does it work properly if I change the instance size?Get additional information by adding some options during dotnet build.Does it work for dotnet restore?CommentShareEXPERTiwasaanswered a year ago"


Question: SSL connection error: error:14082174:SSL routines:ssl3_check_cert_and_algorithm:dh key too small

"We tried to create Source Endpoint in AWS DMS but we got this error message when testing the connection:Test Endpoint failed: Application-Status: 1020912, Application-Message: Cannot connect to ODBC provider ODBC general error., Application-Detailed-Message: RetCode: SQL_ERROR SqlState: HY000 NativeError: 2026 Message: [unixODBC][MySQL][ODBC 8.0(w) Driver]SSL connection error: error:14082174:SSL routines:ssl3_check_cert_and_algorithm:dh key too smallDo you have any idea about this issue?FollowComment"


Question: Can I register an IDP with multiple certificates on AWS IAM

"What I have is:An OpenId Complaint service (Rest) that provides tokensThis service has multiple certificates (keyPairs) for signing tokens depending on some factors when requesting a tokenThe service is implementing the 2 OpenId Endpoints (well known and certs)What I did:I registered the service as an IDP on AWS IAM service successfully (hence my two OpenId Endpoints are working other wise AWS wont accept the IDP)I created roles on IAM that are to be assumed using the IDP service tokensI got two tokens from the IDP service to be used for assuming role (each signed with different key)Problem:AssumeRole is failing and I'm getting invalid token exception for both tokens.I tried to set the "kid" claim in the tokens each with the corresponding kid of the certificate and it didn't work :(.Note:I'm assuming role using Java AWS APIWhen I remove one of the certificates (from the below sample response) the remaining certificate works fine. So the problem is with having 2 certs, but I need to have two certificates and AWS should have a way of working with such case I just don't know how.Sample of how my certs endpoint looks like:{"keys": [{"kid": "kid","kty": "kty","use": "use","alg": "alg","n": "nValue","e": "eValue","x5c": ["cert1"],"x5t": "x5t=","x5t#S256": "x5t#S256"},{"kid": "kid1","kty": "kty","use": "use","alg": "alg","n": "nValue","e": "eValue","x5c": ["cert2"],"x5t": "x5t=","x5t#S256": "x5t#S256"}]}Edited by: hfakih on Feb 10, 2020 6:49 AMFollowComment"

Answer: "0So the problem was that I tried to set the kid in the "claims" of the JWT.However it turned out that ,in order for AWS to distinguish that this JWT was signed with this key (from the jwks response), it checks in the headers of the JWT. If a kid is found in the header then it looks in the jwk response for the certificate with the corresponding kid.So to solve the issue I just had to set the kid of in the "headers" of the JWT.So if you are in java :public String buildToken(Key key) {Map<String, Object> claims = new HashMap();Map<String, Object> headers = new HashMap();claims.put(claimName, someClaim);  ...  headers.put(KID, KID_OF_THIS_TOKENS_CERTIFICATE);  ...  return Jwts.builder().setClaims(claims).setHeader(headers).signWith(SignatureAlgorithm.RS256, key).compact();  }CommentSharehfakihanswered 3 years ago"


Question: Which Amazon SageMaker algorithms can only use GPU for training?

"I read somewhere that some Amazon SageMaker's built-in algorithms can only be trained using GPU, whereas some can use either GPU or CPU, and some can only be used on CPU.Is there any official documentation explicitly stating which algorithms can only use GPU or both?FollowComment"

Answer: "0Accepted AnswerDocumentation for Amazon SageMaker built-in algorithms  provides recommendations around choice of Amazon EC2 instances and whether given algorithm supports GPU or CPU devices.Let's take Image Classification as an example. Here is a excerpt from online documentation:For image classification, we support the following GPU instances fortraining: ml.p2.xlarge, ml.p2.8xlarge, ml.p2.16xlarge, ml.p3.2xlarge,ml.p3.8xlargeand ml.p3.16xlarge. We recommend using GPU instances withmore memory for training with large batch sizes. However, both CPU(such as C4) and GPU (such as P2 and P3) instances can be used for theinference. You can also run the algorithm on multi-GPU andmulti-machine settings for distributed training.For more complex scenarios, such as Script or BYO Container modes, customers have flexibility to choose which device (GPU or CPU) to utilize for which operation. This is configured as part of their training scripts.CommentShareAWS-User-2431717answered 3 years ago"


Question: CoreDNS with ETCD backend on EKS

"CoreDNS has a ETCD plugin https://coredns.io/plugins/etcd/, which essentially allows for dynamic DNS by reading the values from ETCD.Since EKS is managed, it means we can't access the etcd instance on master node, that's fine as I can create my own etcd cluster (and I did). Below is my coredns deploymentapiVersion: v1data:  Corefile: |    .:53 {        errors        health        log        kubernetes cluster.local in-addr.arpa ip6.arpa {          pods insecure          fallthrough in-addr.arpa ip6.arpa        }        etcd {            path /skydns            endpoint http://etcd-cluster-ip.default.svc.cluster.local:2379            fallthrough        }        prometheus :9153        forward . /etc/resolv.conf        cache 30        loop        reload        loadbalance    }kind: ConfigMapmetadata:  annotations: {}  labels:    eks.amazonaws.com/component: coredns    k8s-app: kube-dns  name: coredns  namespace: kube-systemThe issue I face now is that the master node is not able to resolve the ClusterIP DNS etcd-cluster-ip.default.svc.cluster.local, which is the ClusterIP of my etcd cluster. If I change that DNS with the actual ClusterIP, name resolution works as expected and CoreDNS is able to access ETCDHow can the master node resolve the DNS of my cluster ? I see below line in coredns logs{"level":"warn","ts":"2022-03-16T20:44:42.352Z","caller":"clientv3/retry_interceptor.go:61","msg":"retrying of unary invoker failed","target":"endpoint://client-fd406ba0-cc21-4132-bfef-ca14e3fd4eb3/etcd-cluster-ip.default.svc.cluster.local:2379","attempt":0,"error":"rpc error: code = DeadlineExceeded desc = latest balancer error: all SubConns are in TransientFailure, latest connection error: connection error: desc = \"transport: Error while dialing dial tcp: lookup etcd-cluster-ip.default.svc.cluster.local on 10.0.0.2:53: no such host\""}FollowComment"

Answer: "0I believe you are encountering the same issue as described in this CoreDNS issue - https://github.com/coredns/coredns/issues/2159As per this comment, your desired setup will work only if the FQDN of the ETCD server can be resolved outside the cluster.The work-around is to directly specify the ClusterIP of your ETCD service in the Corefile endpoint configuration, and I see that you are already using this approach.The bottom line is that your CoreDNS pod cannot use itself to perform DNS resolution.I hope this helps!CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered a year ago"


Question: My Lightsail instance site shows someone else's content

"As mentioned, I applied for a free SSL certificate on my example, and after a while, the site content became someone else's site content, with only the header footer and home page unchangedFollowComment"