Question: How to add own third party libirary to Gems

"I'm using Lumberyard 1.11.1.0 and trying to create Gems with own library.I found shortcuts of 3rd party paths here. dev\Code\SDKsI added own libraries in 3rdParty. But "lmbr_waf.bat configure" doesn't create shortcut of it. Do I need to create it?Is it right to add this line in wscript of Gems?win_uselib = ['library name'],Follow"

Answer: "0Accepted Answer3rd party libs for gems are a bit tricky.For me, i did a two fold of using a json in the Gems/<gem>/3rdParty and modifying the wscript.You can check it out with my libsndfile gem for my alt. audio system: https://github.com/alatnet/Lumberyard-Alternative-Audio-Libsndfile-GemSharerePost-User-8564951answered 6 years ago0In essence the 3rd party json is like this:  {"name": "Libsndfile","source": "@GEM@/3rdParty","description": "Libsndfile libraries","includes": ["libsndfile/include"],"lib_required": "True","platform": {"win_x64_vs2013": {"libpath": ["libsndfile/lib"],"sharedlibpath": ["libsndfile/bin"],"lib": ["libsndfile-1.lib"],"shared": ["libsndfile-1.dll"]},"win_x64_vs2015": "@win_x64_vs2013"}}Here's the breakdown:name - can be anything you want it to be.source - important, shows where to look for 3rd party libraries, best to keep it as i have in the example above.description - can be anything you want it to be.includes - refers to include files (you can also include source files into this), do note that the path is prepended with the source entry.lib_required - used to tell whether or not it has a library to link. i dont know exactly...platform - VERY important, this is a list of what platforms are used to define how to link or copy libraries. Entries are: win_x64_vs2013, win_x64_vs2015, linux_x64, android_arm7_gcc, android_arm7_clang (i think), darwin_x64, and ios. Though there may be more.-For each entry, there's defines on how to link or find libraries:-- libpath - library path-- sharedlibpath - shared library path-- lib - library to use (lib, a, so)-- shared - dynamic libraries to use (dll, dynlib, so)Note, that the paths are also prepended with the source entry.Also note, with the example above, you can copy an entry just by appending @REDACTEDUSERNote, you can also separate which build to use by adding "_<build>" to each of the entries, for example: libpath_debug. There are 4 build types: debug, profile, performance, release.SharerePost-User-8564951answered 6 years ago0The wscript method is a bit more... fidlier...from waflib.TaskGen import feature@REDACTEDUSERdef feature_copy_libsndfile(self):platform = self.bld.env['PLATFORM']configuration = self.bld.env['CONFIGURATION']#for the windows platformif platform == 'win_x64' or platform == 'win_x64_vs2015' or platform == 'win_x64_vs2013':output_folder = self.bld.get_output_folders(platform, configuration)[0]#copy libsndfilesnd_source_file = self.bld.CreateRootRelativePath('Gems/' + self.name + '/3rdParty/libsndfile/bin/libsndfile-1.dll')self.create_task('copy_outputs', self.bld.root.make_node(snd_source_file), output_folder.make_node('libsndfile-1.dll'))def build(bld):bld.DefineGem(# Add custom build options herefeatures = [ 'copy_libsndfile' ],includes = [bld.Path('Code/CryEngine/CryAction'),bld.path.abspath() + '/../3rdParty/libsndfile/include'],lib = ['libsndfile-1'],libpath = [bld.path.abspath() + '/../3rdParty/libsndfile/lib'],win_features = ['crcfix'])The wscript method is different as it uses the waf system to essentially copy libraries (dll, so, dynlib) to the build directory where the launcher is (or where you want it to be, it's flexible).The way this is done is using the feature system that is with the waf system. That's the top of the part before the def build(bld) section.Be sure to have each feature definition unique as there will be problems with coping libraries.The feature in the example above should be self explanatory but the breakdown is as followed:platform - this variable holds what platform we are building to, same platforms as described in the json explanation, i believe.configuration - holds which configuration we are building to, debug, profile, performance, release.output_folder - holds the path to where to copy files to.Now, to copy files, you first create a root relative path to where the file you want to copy is. The example above is the snd_source_file variable. I use self.name as a way to, hopefully, make sure that where the file is located is relative to the root of the gem's folder (i.e. if the gem folder name changes, so does self.name, havent tested this and is where the unique feature name comes into play...). So with that, you can change the "/libsndfile/bin/libsndfile-1.dll" section to where you have the library at. Next is to actually copy the file itself. That's where the self.create_task comes into play. Be sure to adapt it to your code and to change the "libsndfile-1.dll" in the output_folder.make_node to the library you are using.To enable the usage, be sure to add in "features = [ '<feature name>' ]" in your bld.DefineGem section.The rest is standard wscript with the aside that i have linked any 3rd party includes and libraries using bld.path.abspath() to allow for gem folder name changes.Both methods should work for using 3rd party libraries but i would implement both because it's been hit and miss with the json version.SharerePost-User-8564951answered 6 years ago0@REDACTEDUSERSharerePost-User-6684262answered 6 years ago0I found a much better way with the wscript method.This is something that i found within another gem that copied dll files but it makes it so much easier to copy dynamic libraries.This is from my portaudio gem but i had modified it with the new method:    def build(bld):bld.DefineGem(# Add custom build options hereincludes = [bld.Path('Code/CryEngine/CryAction'),bld.path.abspath() + '/../3rdParty/portaudio/include',bld.path.abspath() + '/../3rdParty/libsamplerate/include'],lib = ['portaudio_x64','libsamplerate-0'],libpath = [bld.path.abspath() + '/../3rdParty/libsamplerate/lib'],debug_libpath = [bld.path.abspath() + '/../3rdParty/portaudio/lib/Debug'],profile_libpath = [bld.path.abspath() + '/../3rdParty/portaudio/lib/Debug'],performance_libpath = [bld.path.abspath() + '/../3rdParty/portaudio/lib/Release'],release_libpath = [bld.path.abspath() + '/../3rdParty/portaudio/lib/Release'],win_features = ['crcfix'],win_debug_copy_dependent_files = [ bld.path.abspath() + '/../3rdParty/portaudio/bin/Debug/portaudio_x64.dll' ],win_profile_copy_dependent_files = [ bld.path.abspath() + '/../3rdParty/portaudio/bin/Debug/portaudio_x64.dll' ],win_performance_copy_dependent_files = [ bld.path.abspath() + '/../3rdParty/portaudio/bin/Release/portaudio_x64.dll' ],win_release_copy_dependent_files = [ bld.path.abspath() + '/../3rdParty/portaudio/bin/Release/portaudio_x64.dll' ],win_copy_dependent_files = [ bld.path.abspath() + '/../3rdParty/portaudio/bin/Debug/libsamplerate-0.dll' ])take a look at the last 5 lines.copy_dependent_files is what the method is. What it does is copies what file you want to the bin folder of your build, Bin64vc140 for visual studio 2015 profile build for example.The prefixes in front of them determine which build the copy_depended_files executes.Note! Order of the prefixes matter! It's platform then configuration then function. This is also reflected with the libpath above the copy_depended_files.Another note about the prefixes is that it can be applied to all entries. You can also mix and match entries and prefixes to customize your build.While copy_dependent_files isnt as flexible as the feature method, it does make it a lot easier to deal with dynamic library copying.SharerePost-User-8564951answered 6 years ago0I ordered a leap motion controller last week your timing is impeccable. Thank you for your help it works great. Setting up the waf files is simple and humbling at the same time.SharerePost-User-4778853answered 6 years ago"


Question: Scan to SMB Folder on FSX for Windows File Server

"We are currently facing an issue with setting up scan-to-folder functionality on AWS FSx for Windows File Server.When attempting to use the scan-to-folder feature on our Sharp copier, we receive the following error message: "Account name or authentication password is invalid. Consult your network administrator." To troubleshoot this, we ran a packet capture and found that the error received is "Tree Connect Response, Error: Status_Access_Denied."Steps we have tried so far:Verified that the account being used for authentication has full access permissions to the designated folder on the FSx file server share.Tried using the IP address of the server instead of the DNS nameUsed domain admin credentials and still received an authentication errorIt's worth noting that this was working perfectly fine on our on-premises server before migrating to FSx.Has anyone encountered a similar issue or can offer any suggestions on what might be causing this problem?FollowComment"

Answer: "0Accepted AnswerThis could be due to SMB encryption enabled on FSx if the scanner does not support SMB encryption. You can try and disable encryption of data on the FSx with the below command using the CLI for remote management on PowerShell:PS>Set-FSxSmbServerConfiguration -EncryptData $Falsehttps://docs.aws.amazon.com/fsx/latest/WindowsGuide/manage-encrypt-in-transit.htmlCommentSharebodepanswered 7 days agogsloan 6 days agoThank you so much! As soon as I ran that script, everything worked!Share"


Question: S3 file path description

"Hi AllI'm trying to follow this tutorial: https://medium.com/swlh/upload-binary-files-to-s3-using-aws-api-gateway-with-aws-lambda-2b4ba8c70b8eI'm not clear about the code line:  file_path = 'YOUR_FILE_PATH_HERE'Is this the path to the S3 folder?If so, how do I find this, or what is it's format?code example:import jsonimport base64import boto3BUCKET_NAME = 'YOUR_S3_BUCKET_NAME_HERE'def lambda_handler(event, context):file_content = base64.b64decode(event['content'])file_path = 'YOUR_FILE_PATH_HERE's3 = boto3.client('s3')try:s3_response = s3.put_object(Bucket=BUCKET_NAME, Key=file_path, Body=file_content)except Exception as e:raise IOError(e)return {'statusCode': 200,'body': {'file_path': file_path}}Edited by: cloudstartuptech on Oct 6, 2019 3:02 PMFollowComment"

Answer: "0Accepted AnswerHi,the value you specify here is the "object name" (i.e. Key) in the S3 bucket.  The "object name" can include "folders" as part of the "key".For example, if you have a bucket called "example-bucket", and you specifiedfile_path='myDog.jpg' s3.put_object(Bucket=BUCKET_NAME, Key=file_path, Body=file_content)If you viewed your bucket in the AWS S3 console, you would see 'myDog.jpg' as a top level object.You could also include "folders". For example:file_path='pets/mydog.jpg's3.put_object(Bucket=BUCKET_NAME, Key=file_path, Body=file_content)Now, if you want to your AWS S3 console, and opened your bucket, you would see a "folder" called pets. If you clicked on the "pets folder", you would then see myDog.jpg.Hope this helps,-randyCommentShareRandyTakeshitaanswered 4 years ago"


Question: Back up Amazon WorkMail

"How do I back up and save all my emails (inbox, sent, deleted, etc) in Amazon WorkMail?FollowComment"

Answer: "1Hi,You can export your mailbox to s3 bucket. I've used aws cli for that , please follow the documenthttps://docs.aws.amazon.com/workmail/latest/adminguide/mail-export.htmlCommentSharesouravanswered a year agoPzSniper 10 months agoOK but...after the backups has been done..in the future how can you restore the emails in workmail account?Share"


Question: Session Manager to connect ec2 instance cannot be enabled

"I met a weird problem, I use a same AMI to launch a ec2 linux instance.If I launch the instance from aws console, and use the default vpc and subnet. this instance can be access through "Session Manager Connect". The Session Manager "Connect" button is enabled.If I launch a instance through a cloudformation, and the instance is in a created vpc and subnet. This instance's role already have AmazonSSMManagedInstanceCore policy.  But this instance cannot be accessed through "Session Manager Connect". The Session Manager "Connect" button is disabled.The security group is as below:I ssh to above two instances, check the ssm-agent status.Both instances ssm-agent status isActive: active (running) since xxxxxxxxxxxxI don't know what's the reason?Could you help me? What should I check or configure?FollowComment"

Answer: "0I suspect that the new instance is being launched in a private subnet and therefore the SSM agent on the instance can not reach the SSM service endpoint.  You can solve this by using a VPC Endpoint. See: Creating VPC endpoints for Systems Manager.If the instance is being deployed into a public subnet (the route table attached to the subnet has a route to an internet gateway), check that the instance has a public IP address. Also, if you are using NACLs, make sure the inbound/outbound rules allow this traffic.CommentShareEXPERTkentradanswered a year ago0Got the reason, I set the PermissionsBoundary which did not contain ssmmessages and ec2messages permission. This make session manager not working.Add following:          - Effect: Allow            Action:              - 'ssm:*'            Resource: '*'          - Effect: Allow            Action:              - 'ssmmessages:*'            Resource: '*'          - Effect: Allow            Action:              - 'ec2messages:*'            Resource: '*'CommentSharemingtonganswered a year ago"


Question: "CodeBuild Bug? AWS CLI broken on AL2/aarch64 env, error "pyenv: version `3.9.7' is not installed""

"Summary:On CodeBuild projects running on AL2/aarch64, running the aws CLI command (any command works, I use --version as a sanity check) yields the following error:[Container] 2022/09/10 02:39:37 Running command aws --versionpyenv: version `3.9.7' is not installed (set by /codebuild/output/src576940877/src/.python-version)The process exits with status code 1 and the build terminates. I can reproduce the error exactly on my M1 MBP running locally, following the instructions for local agent usage here.Steps to ReproduceCreate minimal buildspec.yml:version: 0.2phases:  build:    commands:      - aws --versionLaunch on CodeBuild project set to AL2/aarch64, on SMALL size build.Expected behaviorBuild should pass. Output of command should be:[Container] 2022/09/10 03:00:41 Running command /usr/local/bin/aws --versionaws-cli/2.7.31 Python/3.9.11 Linux/5.10.104-linuxkit exe/aarch64.amzn.2 prompt/offActual behaviorOutput is actually:[Container] 2022/09/10 02:39:37 Running command aws --versionpyenv: version `3.9.7' is not installed (set by /codebuild/output/src576940877/src/.python-version)WorkaroundThe AWS CLI can be installed manually and run via direct path:version: 0.2phases:  install:    runtime-versions:      python: 3.9    commands:      - curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o "awscliv2.zip"      - unzip awscliv2.zip      - ./aws/install  build:    commands:      - /usr/local/bin/aws --versionThis produces the expected output and the build succeeds.FollowComment"


Question: Python Lambda SES Timeout

"My SES account is out of sandbox. I am trying to send emails with SES using a Python lambda that is in a VPC. I know that the lambda being in a VPC is why I am having a task timeout when trying to run any boto3 SES SDK code.  Note:  I intend for this lambda to be invoked only through the Lambda console, not through API Gateway or another resource.I have followed the steps in this article:  https://docs.aws.amazon.com/ses/latest/dg/send-email-set-up-vpc-endpoints.htmlI assigned subnets to a VPC interface endpoint for the email.smtp service.  For the VPC itself, one of the subnets is in an AZ not supported by SES, but I did not assign that subnet to the interface endpoint--I only assigned the other 3 subnets which are supported by SES. The EC2 instance I created was private (only having a private IPv4 address).  I included a CIDR of the IPv4 address as the source for the endpoint's security group.  With the restricted traffic for port 25, I am using port 587 in the security group's inbound rule.  I have not included anything in terms of NAT gateway, Direct Connect, or other resources/services.  I am still seeing a task timeout with my boto3 lambda for using SES.I am not finding any specific guidance on how the route table should be configured for SES.  The route table for the VPC has no explicit subnet associations.  The subnets without explicit association are all four subnets for the VPC (including the one in an AZ not supported by SES)--I do not know if that matters based on what I shared in the first paragraph.Is there something additional I need to cover?Do I need to use special SMTP credentials when integrating with SES this way?Are there any specific configurations needed in the route table to tie the VPC to SES?Is there only one EC2 instance needed?FollowComment"

Answer: 0I assume this is related to your other question.When creating Interface Endpoints for services such as SES you don't need to modify the route table. When you create the endpoint you nominate the subnets where you want the endpoint to be created. Because the endpoints use a local IP address there is no need to change the route table.When you call the SES service the credentials used will be that of the Lambda function or EC2 instance - you can assign a role to each of those with the appropriate permissions. That's assuming you are calling the SES API using boto3.If you are using port 25/587 then you will need NAT Gateway to reach the SES endpoint. Definitely easier to use the endpoint and boto3 in my opinion.CommentShareEXPERTBrettski-AWSanswered 8 months ago


Question: "DynamoDB Data Mapper, SDK v3"

"Does anybody know if AWS Labs Datamapper works with @aws-sdk/client-dynamodb?  When I try, for example, to do a mapper.scan() I get:"errorMessage": "this.client.scan(...).promise is not a function",like it's looking for a .promise() method, when client.scan() already returns a promise.  The calling point causing this is ScanPaginator.ts#L27this.client = new DynamoDB({});this.mapper = new DataMapper({    client: this.client})I think the reason for this mayhem is that dynamodb-data-mapper was designed for aws-sdk 2.7 and never updated for v3.  I found some really old documentation that sort of explains what's going on:By default, the AWS SDK for JavaScript will check for a globally defined Promise function. If found, it adds the promise() method on AWS.Request objects.so I think the gist of all this is that it's trying to make scan() async even though in v3 it already is.  Since this is typescript can anybody think of a workaround?  Perhaps extend the v3 DynamoDB client to add a .promise() method that does nothing?FollowComment"

Answer: 1Accepted AnswerThe dynamodb-data-mapper-js package has not been updated for a number of years and I would strongly advise against taking a dependency on it if you intend to use JS V3.CommentShareEXPERTLeeroy Hannigananswered 7 months agowz2b 7 months agoOK thanks.  I thin this TypeORM alternative looks pretty good!Share


Question: Gamelift SDK 5.0.0 InitSDK for ON_DEMAND instances

"Hello,I have upgraded our game server to the latest sdk version (5.0.0). The new InitSDK takes a Aws::GameLift::Server::Model::ServerParameters parameter.For our deployed build I provide the struct with its default values, as in the documentation here: https://docs.aws.amazon.com/gamelift/latest/developerguide/integration-server-sdk5-cpp-actions.html#integration-server-sdk5-cpp-initsdk it tell to ignore this parameter for GameLift managed EC2 instances. But the game server on the gamelift fleet failed the init of the sdk and the sdk returned this error: "Connection Failed / Connection to the GameLift Service WebSocket has failed".It is working perfectly with the old SDK version.I suspect it's an issue with the ServerParameter struct, but so far I didn't find anything.Any help about how to do the proper init with the sdk 5.0.0 would be greatly appreciated :)Thanks,VictorFollowComment"

Answer: "0Hello,I am using the c++ sdk and not the c# one, and after digging further, it uses the environment variables before the server parameters, so it should work if the env variables are set.So I have run a micro game server that just dump the environment variables, and the env variables bellow do not exist for the game server process spawned on a gamelift managed fleet, so I suppose this is where is the issue.I suppose the older versions of the SDK didn't uses them as game server built with the sdk 06_03_2021 still works, and I didn't found references to those variables in the sdk 06_03_2021 code.Is there something additional to do on the fleet configuration, so gamelift add those environment variables when launching the game server executable?The missing environment variables:GAMELIFT_SDK_WEBSOCKET_URLGAMELIFT_SDK_AUTH_TOKENGAMELIFT_SDK_PROCESS_IDGAMELIFT_SDK_HOST_IDGAMELIFT_SDK_FLEET_IDHave a nice day,VictorCommentSharevictoranswered 4 months agoJamesM_AWS 4 months agoHi Victor, when creating your Build, did you by any chance set your build's ServerSdkVersion? Those environment variables would not be set unless the ServerSdkVersion is 5.0.0 or above. Sorry if the doc is unclear, I can relay this to the doc team to see if improvements can be made.CreateBuild Doc: https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateBuild.html#gamelift-CreateBuild-request-ServerSdkVersionSharevictor 4 months agoHi James, it was totally that, we missed this argument in our automated build deployment system, so it was defaulting to 4.0.2. It is working now.Thanks a lot for the help!Share0Hi,The ServerParameters argument is not required in the managed EC2 fleets, but there is currently no way to pass in a null ServerParameters due to how to SDK is implemented -- e.g. in C#, ServerParameters is implemented as a struct and therefore is not nullable.GameLift has plans to implement a parameterless initSDK() method, in the mean time, you can work around this by constructing ServerParameters with null values, e.g.ServerParameters serverParameters = new ServerParameters(null, null, null, null, null);if (InitSdk(serverParameters)) {  ...}A slightly more robust way to implement this is by passing in ServerParameters values using CLI to the server process executable, for example:public static void Main(string[] args){  Options options = new Options();  if (CommandLine.Parser.Default.ParseArguments(args, options))  {    ServerParameters serverParameters = new ServerParameters(option.WebSocketUrl, option.ProcessId, option.ComputeId, option.FleetId, option.AuthToken);    if (InitSdk(serverParameters))     {      ...    }  }}public class Options{  [Option('w', "websocketUrl", DefaultValue = null, HelpText = "WebSocket URL from RegisterCompute for communicating with GameLift.")]  public string WebSocketUrl { get; set; }  [Option('x', "processId", DefaultValue = null, HelpText = "Host process ID for this host process.")]  public string ProcessId { get; set; }  [Option('i', "computeId", DefaultValue = null, HelpText = "Compute ID from RegisterCompute associated with this host process.")]  public string ComputeId { get; set; }  [Option('f', "fleetId", DefaultValue = null, HelpText = "Fleet from CreateFleet associated with this compute.")]  public string FleetId { get; set; }  [Option('n', "authToken", DefaultValue = null, HelpText = "Authentication token from GetComputeAuthToken for this process.")]  public string AuthToken { get; set; }}Then, when testing your server process locally with GameLift anywhere (see doc), you may execute your server process as such: ./MyServer --websocketUrl <results from RegisterCompute> --processId my-process-id-123 --computeId <input to RegisterCompute> --fleetId <results from CreateFleet> --authToken <results from GetComputeAuthToken>When running the same executable in the managed EC2 instance, you can set the RuntimeConfiguration as /local/game/MyServer without any parameters, as they will default to null.CommentShareJamesM_AWSanswered 4 months ago"


Question: Can't associate elastic ip to network interface of public subnet

"Logged in as root user.EC2 > Network Interfaces > Associate Elastic IP addressI select the elastic IPv4 (3.x.x.x) that is not yet in use (just allocated) and a private IPv4 (10.x.x.x) from a public subnet of a VPC created by the VPC Wizard, I even allow reassociation, but I get the error "You do not have permission to access the specified resource.".FollowCommentJeremy BOUCHET 8 months agoHello,I encounter the same behavior.I explain my context :I deployed an sFTP instance (AWS Transfer Family) and I configured this one to use the VPC integration (endpoint) to allow to have a private ip address.Through my private network I connect well to the private ip of the sFTP server.Now I need to allow to connect to this sFTP server through a public access.So I created an elastic ip and I want to associate this one to the network interface (attached to the VPC endpoint) of the sFTP server.But the association not work, I encounter the error "An error occurred (AuthFailure) when calling the AssociateAddress operation: You do not have permission to access the specified resource".I tried with the aws cli command and through the AWS console and I have the same error / behaviour.If anyone has encountered the same thing and fixed this one, I would be really interested !ShareJeremy BOUCHET 8 months agoMy problem came from the configuration of my sFTP Transfer Family instance, I encountered this error because the association between my elastic ip and the network interface must be do at the moment when we change on the sFTP server (AWS Transfer Family) the access from "Internal" to "Internet Facing".At this time you can link the elastic ip to the subnet id.Share"

Answer: "0That sounds like an IAM permission error: You don't have the appropriate permissions to do that - check what permissions have been assigned to you via roles, groups or directly to you as a user.CommentShareEXPERTBrettski-AWSanswered a year agowp a year agoI'm logged in as root user.ShareBrettski-AWS EXPERTa year agoIf you're operating in a complex environment where the VPC is shared with you (or you're sharing it with another account) and the EC2 instances isn't in the same account then that's something you might trip across. If you're in a "simple" environment then this is a good time to create a support case as they can look at the resources for you and determine why the association is failing.Share"


Question: S3 restore from Glacier Deep Storage seems hung.

"I have approx 100k files that I initiated a restore from Glacier Deep. The files now show both "This object is stored in the Glacier Deep Archive storage class In order to access it you must first restore it." AND "Restoration statusCompleted Restoration expiry date April 22, 2023, 20:00:00 (UTC-04:00)". I cannot copy the files to another S3 bucket as I get "warning: Skipping file s3://FILE_NAME. Object is of storage class GLACIER. Unable to perform copy operations on GLACIER objects. You must restore the object to be able to perform the operation." It has been over 24 hours since the restoration began.FollowComment"

Answer: "0Hi,If you are restoring with GLACIER bulk retrieval.. it takes around 48 hrs to retrieve all the files completely. You can probably check with headObject api call on respective object to know about the object restoration status.If the object restoration is in progress, the header returns the value ongoing-request="true". Else it will be "false".You can copy the "false" value objects to another bucket.https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3/client/head_object.htmlCommentShareAritro Senanswered 2 months ago"


Question: Binary uploads to API Gateway Proxy with Lambda Integration

"It doesn't look like there's a way to upload binaries with an API Gateway Proxy/Lambda integration. Am I correct? If so, is there a clean workaround? Unfortunately, uploading to S3 and triggering a Lambda event isn't an option due to security constraints.FollowComment"

Answer: "0Accepted AnswerDoes this blog post help at all?In this post, I show how you can use the new binary support in API Gateway to turn this Lambda function into a public API, which you can use to include a binary image file in a POST request and get a thumbnail version of that same image. I also show how you can now use API Gateway and Lambda to create a thumbnail service, which you can use to include a binary image file in a POST request and get a thumbnail version of the same image.https://aws.amazon.com/blogs/compute/binary-support-for-api-integrations-with-amazon-api-gateway/CommentShareSteveanswered 6 years ago"


Question: Direct connect "ConnectionState" metric unit issue

"For AWS Direct Connect, We have an issue with "ConnectionState" metric unit. We are trying to collect metric data for "ConnectionState" through rest API (getMetricData) for our customers. In AWS doc, unit for this metric is "Boolean", but that is not valid.  For few accounts we are getting metric data with unit as "None" and for few  with unit as "Count". Why it is different for different accounts. We need a generic one. Can someone  please help us with this.https://docs.aws.amazon.com/directconnect/latest/UserGuide/monitoring-cloudwatch.htmlFollowComment"


Question: Restore Virtual Machine Failure Vmware

Hello GuysI'm having a problem restoring a Virtual Mahine in the On-premises Vmware environment.Backup is listening correctly. AWS BACKUP is running backup jobs. But to restore i'm having trouble.I followed the document: https://docs.aws.amazon.com/aws-backup/latest/devguide/restoring-vm.htmlBut it is giving this error: Invalid folder detected during virtual machine creation. Aborted restore jobMaybe the Path is wrong?thanks.FollowComment

Answer: "1This error usually occurs when a customer is not using the correct fields such as a host and the path in the restore.  There is really no "best answer" on the AWS side for these fields as it really depends on the organization's virtual machine best practices.You can find the path and host details in the console by navigating as below.AWS backup console --> Select Hypervisors --> Choose the correct Hypervisor --> under "Connected virtual machines" section --> you should see 'Host' and 'Path' which are supposed to be used.General resource:https://aws.amazon.com/blogs/storage/backup-and-restore-on-premises-vmware-virtual-machines-using-aws-backup/CommentShareGanesh_Canswered 7 months ago0Hello GaneshI have a question about the PATH, what is the correct path i have to add?CommentSharechmoreiraanswered 7 months ago0PATH will depend on your organization’s virtual machine best practices. The path can be seen from the details page of the original VM that you are trying to restore. You should use the same path.CommentShareGanesh_Canswered 7 months ago"


Question: ELASTIC COMPUTE CLOUD

How To Update Ami Tools At Boot Time ?FollowComment

Answer: "1Accepted AnswerWe recommend that your AMIs download and upgrade the Amazon EC2 AMI creation tools during startup. This ensures that new AMIs based on your shared AMIs will have the latest AMI tools. https://documentation.help/ec2-dg-2009-04-04/building-shared-amis.html#public-amis-update-ami-toolsFor Fedora Add the following to rc.local:Update the Amazon EC2 AMI creation toolsecho " + Updating ec2-ami-tools"wget http://s3.amazonaws.com/ec2-downloads/ec2-ami-tools.noarch.rpm && rpm -Uvh ec2-ami-tools.noarch.rpm && echo " + Updated ec2-ami-tools"For other distributions: For other distributions:On most Red Hat systems, add these steps to your /etc/rc.d/rc.local script.On Gentoo systems, add them to /etc/conf.d/local.local.On Ubuntu systems, add them to /etc/rc.local.On Debian, you might need to create a start up script in /etc/init.d and use update-rc.d <scriptname> defaults 99 (where <scriptname> is the name of the script you created) and add the steps to this script.CommentShareAWS-User-2213811answered 2 years agoEXPERTJohn_Freviewed a year ago"


Question: How to delete files transferred successfully by Datasync?

"We want to transfer files from our data center to S3 using Datasync. Based on the documentation, apparently, datasync does not delete the file at the source after the data transfer is successful. What is the common practice followed to delete the files locally after they are successfully transferred?FollowComment"

Answer: "0DataSync does not provide an option to delete files from the source location. An option could be to configure the tasks log level to Log all transferred objects, files, and folders. CloudWatch would then contain a list of transferred and verified files that can be used to delete files on the source.Here is a link to a blog that also discusses using CloudWatch logs to perform post-process activities on transferred files.https://aws.amazon.com/blogs/storage/post-process-your-transferred-data-with-file-level-logging-in-aws-datasync/CommentShareDarryl_Dioanswered 6 months ago"


Question: Use UDP via PrivateLink

"PrivateLink partially works with Network Load Balancers - allowing listeners to be TCP, but not UDP.Is there a defined technical reason for this - as opposed to "doesn't do that".Might it?FollowComment"

Answer: "0The only answer you can get is. It may or may not be a feature in future.NLB also only had TCP in 2017 and then got UDP Support in 2019Similarly, if enough number of customers demand for UDP Support on Private link. Then who knows one day this support might be available or similar product.For now , unfortunately not supported.If you have Ent Support. Then I would suggest to submit a feature request through support.CommentShareMuhammadanswered 4 months ago"


Question: Cause and Solution for com.amazonaws.services.gluejobexecutor.model.InvalidInputException: Entity size has exceeded the maximum allowed size

"We have a glue job using workload partitioning by bounded execution. In a recent run the job failed during the Job.commit call.Based on the message I assume that the bookmark was too large to save.How would this occur?What options are available to prevent this from happening?How would we recover from this if this occurred in a production environment?The error stack trace provides:2022-10-20 17:05:44,413 ERROR [main] glue.ProcessLauncher (Logging.scala:logError(91)): Exception in User Class com.amazonaws.services.gluejobexecutor.model.InvalidInputException: Entity size has exceeded the maximum allowed size. (Service: AWSGlueJobExecutor; Status Code: 400; Error Code: InvalidInputException; Request ID: xxx; Proxy: null) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1819) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleServiceErrorResponse(AmazonHttpClient.java:1403) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1372) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1145) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:802) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:770) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:744) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:704) at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:686) at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:550) at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:530) at com.amazonaws.services.gluejobexecutor.AWSGlueJobExecutorClient.doInvoke(AWSGlueJobExecutorClient.java:6964) at com.amazonaws.services.gluejobexecutor.AWSGlueJobExecutorClient.invoke(AWSGlueJobExecutorClient.java:6931) at com.amazonaws.services.gluejobexecutor.AWSGlueJobExecutorClient.invoke(AWSGlueJobExecutorClient.java:6920) at com.amazonaws.services.gluejobexecutor.AWSGlueJobExecutorClient.executeUpdateJobBookmark(AWSGlueJobExecutorClient.java:6610) at com.amazonaws.services.gluejobexecutor.AWSGlueJobExecutorClient.updateJobBookmark(AWSGlueJobExecutorClient.java:6580) at com.amazonaws.services.glue.util.AWSGlueJobBookmarkService$$anonfun$commit$1.apply(AWSGlueJobBookmarkService.scala:184) at com.amazonaws.services.glue.util.AWSGlueJobBookmarkService$$anonfun$commit$1.apply(AWSGlueJobBookmarkService.scala:183) at scala.Option.foreach(Option.scala:257) at com.amazonaws.services.glue.util.AWSGlueJobBookmarkService.commit(AWSGlueJobBookmarkService.scala:183) at com.amazonaws.services.glue.util.JobBookmark$.commit(JobBookmarkUtils.scala:88) at com.amazonaws.services.glue.util.Job$.commit(Job.scala:121) at ...FollowComment"

Answer: "01)How this occurs:-->A bookmark enabled Glue job to tracks the processed data in a state. By design, there is a hard limit of 400 KB on the size of this state and if your bookmark state exceeds this value, the below error will be thrown.More about bookmarks: https://docs.aws.amazon.com/glue/latest/dg/monitor-continuations.html2)There are many options available to overcome the problem:Resetting the bookmark,Splitting the job into different jobs to process different datasources,Using bounded execution for S3 datasources to reduce the number of files to be processed,If there are many transformation_ctx parameters in your job, you can reduce the number of transformation_ctx parameters by only using the transformation_ctx parameter on your read operations/data source,If bookmark support is needed for all of the datasources, can you split up the job to have fewer data sources in per job?3)Regarding the query "How would we recover from this if this occurred in a production environment?"-->“MAX_FILES_IN_BAND” to reduce the number of bookmark states. This option specifies the maximum number of files to save from the last maxBand seconds. If this number is exceeded, extra files are skipped and only processed in the next job run .It defaults to 1000. So with the default setting, there can be as many as 1000 s3 prefixes stored in the bookmark state ,it can be set to 0 for mitigating the issue. More about connection types and options:https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-connect.htmlCommentShareSahil_Sanswered 7 months ago"


Question: What are the AWS::EC2::AvailabilityZone::Name Values?

"I am trying to deploy a vendor (Cisco) appliance using the vendor-supplied CF template via Terraform.The CF template has a parameter "pAvailabilityZone" that uses AWS::EC2::AvailabilityZone::Name to present an AZ dropdown.In my terraform plan I am supplying that parameter the value "us-west-1a"The stack is for sure in the right region, I can see the stack start to get created in US West 1 (N. California), but it bombs out and says ""Parameter validation failed: parameter value us-west-1a for parameter name pAvailabilityZone does not exist. Rollback requested by user."I've tried a few variations of the az like "us-west-1-a" but I get the same error. Any ideas?Thanks!FollowComment"

Answer: "0Not sure if this is what you are referring to but are there any other parameters in the CloudFormation template?  That one looks like it asks for aws_region as a parameter.What about your Terraform provider setup?  Are you specifying the region there?# Configure the AWS Providerprovider "aws" {  region = "us-west-1"}CommentShareEXPERTMatt-Banswered 10 months ago0Ugh, I coulda swore the US West 1 Region AZ options were 1a & 1c, but I noticed in the CF dropdown the only options are 1b & 1c.Problem fixed using "us-west-1b" instead of 1a ><CommentShareAJCruzanswered 10 months ago"


Question: F1 xilinx device name

"Hi,My design verilog is created from hls, which later will be manually integrated with the F1 shell.To create my verilog, the hls requires the exact Xilinx target device used in F1.The full name is needed, including speed grade, etc (xcvu9p...).Is this info available?ThanksFollowComment"

Answer: "0Hi,Please use target device as xcvu9p-flgb2104-2-i-ThanksCommentShareawsSiddharthanswered 4 years ago0Great, thanksCommentSharegabimaanswered 4 years ago"


Question: aws-sdk services timing out in lambda nodejs

"I am currently working on a lambda function in which I have to send a message to an SQS queue. The Lambda function sits inside of a VPC to allow connection with a peered network that the Function makes requests to.Whenever I try to send the message to SQS however code execution seems to timeout consistently. I had the same issue when I was trying to send commands to DynamoDB.import { SQSClient, SendMessageCommand } from "@aws-sdk/client-sqs";const sqsClient = new SQSClient({region: 'us-east-1'});export const handler = async (event, context, callback) => {  const response = await sqsClient.send(new SendMessageCommand(messageParams));  console.log(response); // <----- Doesn't reach here  return callback(null, 'OK'); };IAM Permissions are all correct and the Security Group allows all traffic (When set to a VPC)So far, to specifically target the timeout problem, I've tried putting the function in a private subnet, public subnet, placing it in no VPC, replacing SDK v3 with aws-sdk v2 via a layer. None of these seem to have any impact on the issue.I haven't used VPC endpoints yet but I guess that shouldn't be necessary when the function is not connected to a VPC or in a public subnet?FollowComment"

Answer: "0Consistent timeouts when trying to call a public API are usually caused by network misconfiguration which prevents the function from being able to reach the internet. In the case of Lambda functions in a VPC, in order to reach the internet they must be configured in a private subnet with a route through a NAT Gateway.  See this article for more info on how this should be configured. Alternatively you can add the appropriate VPC endpoints to allow you function to be able to connect with the required APIs privately.CommentShareKevin_Canswered 2 months ago"


Question: CloudFront for naked domain name WordPress problem

"I have created a WordPress website (mywebsite.com) and wanted to use CloudFront. In the wizard, it asked me to add the below CNAME record in my DNS records.Name               Type     Valuemywebsite.com      CNAME    xxx123.cloudfront.netBut when I tried to enter that in my DNS records I got an error that it is not allowed. What is your solution for this?Note: I even tested this with Route 53 and got a similar error:(InvalidChangeBatch 400: RRSet of type CNAME with DNS name mywebsite.com. is not permitted at apex in zone mywebsite.com.)FollowComment"

Answer: "2Accepted AnswerUse an alias in Route 53 for the apex. See: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.htmlCommentShareEXPERTkentradanswered a year agoEXPERTBrettski-AWSreviewed a year agoAWS-User-1399589 a year agoYou mean I have to create A records to IP4 and IP6? Does this defeat the purpose of having dynamic IP addresses to the various regions?SharePaul_L a year agoAlias records are route53-specific extensions to DNS functionality. They are not the same as A records. You can find more information here: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.htmlYou cannot use a CNAME for the zone apex. Alias records provide you similar functionality to CNAME records when used with CloudFront distributions, plus they can be used for the zone apex.  If you create any alternate domain names though, eg. www.example.com, you should use a CNAME record.Share"


Question: Error connecting to a Windows Server with Putty

"Hi all.I just started fumbling with a virtual server, today.I setup a Windows one and I can connect to it with RDP with no problems. Though, when I try connectin with putty as SSH, I get the "Network error: connection timed out".I already tried the recommended workarounds (SSH on port 22 enabled on security policies and so on...) but I had no luck.I'm connecting from home (Windows 10 Pro) and my ISP doesn't provide a public IP. But I set up all IP's allowed on incoming traffic.Is there a way to solve?Thank youPS: I added a rule to the local firewall to allow outgoing traffic on port 22 tooEdited by: Rogas on Jun 4, 2021 9:40 AMFollowComment"

Answer: 0I was able to do that. I didn't check and the OpenSSH Server was not installed on the serverCommentShareRogasanswered 2 years ago


Question: How do I integrate API Gateway (Web Socket) with ALB?

Hello!All my application components are placed behind ALB for OIDC integration. I've created API Gateway Web Socket service and want to place it behind the ALB. Is it possible?FollowComment

Answer: "0API Gateway can be placed behind an ALB only for private end points. WebSockets do not support private end points so you can't really do it.Why do you need to do it? Do you want to do the auth in the ALB? API Gateway can do it as well, either using a Cognito authorizer or using a Lambda authorizer.CommentShareEXPERTUrianswered a month agorePost-User-9844082 a month agoI use multiple ECS services behind ALB. I just needed to add web socket endpoint to themShareUri EXPERTa month agoYou can add ECS as backend for WebSockets managed by API Gateway. For every request that API gateway receives on one of the connections, it will forward it to the ECS backend, via the ALB, as an HTTP request. Not using a WebSocket, i.e., Client creates a WS to API gateway. Client sends messages on such socket. API Gateway sends the message in an HTTP request to the backend.Share0Hi,to try to be consistent with your design you could look into this. https://repost.aws/questions/QUV9Q0bXHHRTe3JYnfVPxx3g/is-there-a-way-to-implement-web-sockets-on-aw-ss-elb-elastic-load-balancerhttps://aws.amazon.com/blogs/compute/using-websockets-and-load-balancers-part-two/Also consider looking at https://workshop.serverlesscoffee.com/0-introduction/1-overview.html where IOTCore can be a simpler approach to build websocket compared to API Gateway, as it the later involves many manual setup with Lambda and storage layer to store sessions.Hope it helps ;)CommentShareEXPERTalatechanswered a month ago0Follow these stepsCreate an HTTP API Gateway with WebSocket support:You can create an HTTP API Gateway with WebSocket support using the AWS Management Console or the AWS CLI. After creating the API Gateway, you need to create a route that handles WebSocket traffic.Create a target group:Create a target group for the WebSocket traffic and register the instances or services that handle the WebSocket traffic.Create a listener rule:Create a listener rule for the target group to forward traffic from the API Gateway to the registered instances or services. For example, you could create a listener rule that forwards traffic from the API Gateway to the target group based on the path of the WebSocket connection.Configure the API Gateway:Configure the API Gateway to use the ALB as a target for WebSocket traffic. You can do this by specifying the target group you created in step 2 as the target for WebSocket traffic.Deploy your WebSocket API:Deploy your WebSocket API and test it by connecting to the WebSocket endpoint.CommentSharehashanswered a month ago"


Question: Error 500 in Account Settings section

"Hi,I have error 500 when I try to Edit Account Settings section. There is some additional info from browser console log:GET https://signin.aws.amazon.com/updateaccount?redirect_uri=https%3A%2F%2Fconsole.aws.amazon.com%2Fbilling%2Fhome%23%2Faccount 500/updateaccount?redirect_uri=https%3A%2F%2Fconsole.aws.amazon.com%2Fbilling%2Fhome%23%2Faccount:1 The Content-Security-Policy directive 'default-src' contains the keyword 'none' alongside with other source expressions. The keyword 'none' must be the only source expression in the directive value, otherwise it is ignored.updateaccount:5 The Content-Security-Policy directive name 'Content-Security-Policy:' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.style.css:1 GET https://signin.aws.amazon.com/static/images/logos/aws_smile-header-desktop-en-white_59x35.png 404FollowComment"

Answer: "0Hi ,Are you using AWS SSO and Firefox ?Would you mind trying with another browser ?Thank youCommentShareNabilanswered a year agoAWS-User-8909534 a year agoI've tried Chrome, Firefox, Safari and Brave browser. It still doesn't work.Share"


Question: Installing Agent on Elasticbean Stalk on creation of new application

"Hi,I would like to install the SSM Agent on my ec2 server when I create a new elastic beanstalk environment, I've researched and saw that you need to create an .ebextension and config file.What commands I should have in the config file specifically for SSM Agent? I have found for the ec2 instance ( https://docs.aws.amazon.com/systems-manager/latest/userguide/agent-install-al2.html )  however it seems that EBS needs to be configured after the application is created and not before creation.Any help?FollowComment"

Answer: "0Accepted AnswerHey,The SSM agent comes installed on all Amazon Linux 2 AMI's now so it should be on Beanstalk AMI's as they are based on normal AL2 AMI's.By default, SSM Agent is installed on Amazon Linux Base Amazon Machine Images (AMIs) dated 2017.09 and later.  [1]You can connect to your instance via SSH and confirm its running, checkout these commands. [2]If you are modifying the agent / EC2 Instance in anyway it should be done via ebextensions only and not on the instance via SSH. [3][1] https://aws.amazon.com/premiumsupport/knowledge-center/install-ssm-agent-ec2-linux/[2] https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent-status-and-restart.html[3] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/platforms-linux-extend.htmlCommentShareCormacanswered a year agoAWS-User-6424256 a year agoHello Cormac,Thanks so much for your reply! I have a question with regards to using the .ebextensions to modify the agent, I'm not sure what exactly i need to write on the conf files to edit or modify the SSM agent, do you have a snippet or example you could show me ?ShareCormac a year ago@AWS-User-6424256 - this depends on what you want to configure, you will need to provide more info on your use case. Are you using the agent so you can access the instance via Session Manager? If so then all you should need to do is add permissions to the default Beanstalk instance profile "aws-elasticbeanstalk-ec2-role" https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-add-permissions-to-existing-profile.htmlShare"


Question: How to bypass time zone redirection policy to local station?

How to bypass time zone redirection policy to local station?FollowComment

Answer: 0Answered here.CommentShareMayank_Janswered a year ago


Question: CloudFormation template publishing without creating and publish an AMI

"Hello!Is it possible to publish in AWS Marketplace my CloudFormation template without creating and publish an AMI, and specify in this template ubuntu 18.04 id (which I choose when launching an instance)?For example like this:"EC2Instance": {"Type": "AWS::EC2::Instance","Properties": {"ImageId" : "ami-0f65671a86f061fcd",     #ubuntu 18.04 id or region mapping value with ubuntu 18.04 id in selected region.....#installing software and preparing instance in UserData sectionThank you!FollowComment"

Answer: "0It is not possible to publish a CloudFormation template without an underlying AMI asset coming from you. AWS Marketplace's publishing process would need the AMI to be built as per the best practices outlined in https://docs.aws.amazon.com/marketplace/latest/userguide/best-practices-for-building-your-amis.html.CommentShareAWS-User-5890248answered 4 years ago0Hi! Have the same case here.Well... Can't we use AMI from Amazon Marketplace, or use smth like Amazon Linux, which is definitely built according all your standards? It would be a great overkill if we will have to maintain our own copy of Amazon Linux which is exactly the same.CommentShareArseniiPetrovichanswered 4 years ago0You can definitely use an Amazon Linux AMI as your base AMI and build your product on top of it. However, we do need an AMI with your product binaries baked in due to how we assign product code.  From https://docs.aws.amazon.com/marketplace/latest/userguide/ami-products.htmlEach product in AWS Marketplace is assigned a unique product ID. This ID is used to track and identify the product in our catalog and is included in seller reports. A unique product code is assigned to all AMIs submitted to AWS Marketplace. The unique product ID is used to distinguish your product in AWS Marketplace and provide access to users who purchase your product as well as for the customer billing process.CommentShareAWS-User-5890248answered 4 years ago0Thanks for the answer!I can create and test a template with AMI from the store (like default ubuntu 18.04 image) but this template will not be valid for publication on the marketplace. It seems a bit strange to me.CommentShareantozhanswered 4 years ago"


Question: Amazon Transcribe with multiple channels

I have a need to use Amazon Transcribe with files that contain multiple channels. But if the file contains more than two channels I get back an error message that says "You are using too many channels". Is 2 really the limit or is there some way to get it to recognize more channels? We don't care if we have to pay for each channel but we'd really prefer not to have to submit multiple jobs and merge the outputs ourselves.FollowComment

Answer: "0Currently Transcribe supports 1 or 2 channel audios, which can be processed together or separately. Please see these link.https://docs.aws.amazon.com/transcribe/latest/dg/how-input.html#how-input-channelshttps://docs.aws.amazon.com/transcribe/latest/dg/channel-id.htmlIf you need to process more than 2 audio channel, there may be ways to create multiple Transcribe instances to handle that.Are you able to detail your application, source formats and current workflow?Phone call related workflow? Recorded audio file? Video+audio processing?audio files only? audio channels from a video?CommentShareMike-MEanswered a month ago0Thanks for the response. Our application is involved with court reporting. We capture audio files from several different microphones during a session, and upload them for transcription later. So there's no video or real-time processing.We discussed solving the problem with multiple Transcribe jobs. It will require a lot of work on our end since we already have a system built for 1 or 2-channel processing, but if that's the best way to do it we'll proceed. I wanted to check first to see if there was some easier way. I'd hate to do 100 hours of work if Amazon is planning to increase this limit soon.FrankCommentShareFrankanswered a month ago"


Question: "How to delete Pipeline, Trial and Experiment in Sagemaker"

"I already deleted Domain, Users, Models, Endpoints, Endpoint configurations, Notebook instances, S3 Bucket instance and log groups but left with Pipeline, Trial and Experiment. Can anyone please help me with steps to followed to delete Pipeline, Trial and Experiment.FollowComment"

Answer: "0Delete Pipeline (https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sagemaker.html#SageMaker.Client.delete_pipeline):client = boto3.client('sagemaker')response = client.delete_pipeline(    PipelineName='string',    ClientRequestToken='string')Delete Trial (https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sagemaker.html#SageMaker.Client.delete_trial_component):response = client.delete_trial_component(    TrialComponentName='string')CommentShareEitan Selaanswered 7 months agorePost-User-3457871 7 months agoCould you please provide any details related to where do I need to run these scripts?Share"


Question: Can you use session manager to send a single command and return the output?

"When using SSH, you can connect to an instance, run a command and disconnect with one command. Such asssh user@host.com 'ls -l'Is this possible with Session Manager? And furthermore, can it be done against a Windows target?FollowComment"

Answer: "0Thanks for reaching out! Yes, Session Manager can be used to run a single interactive command against Windows targets. You can either use Session Manager public document "AWS-StartInteractiveCommand" or create a custom document to run restricted commands. Please refer to the example provided in below documentation and let us know in case of further queries.https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-restrict-command-access.htmlCommentSharenitikaawsanswered 3 years ago0Thanks, I didn't know that. But I was actually talking about being able to issue a single command that connects to the remote instance and then executes given command on the instance then disconnects. As opposed to issuing the command to start the session and then issuing the given command after being connected.I was not referring to restricting the user to a single command.CommentSharekidbraxanswered 3 years ago0Thanks for sharing more details! Interactive Command scenario of Session Manager can be used to run a single or a set of predefined commands and it works by establishing a connection which is disconnected once commands are executed.Below is a sample StartSession request that would execute the command "echo HelloWorld", display the output and disconnect. Here the command to be executed is passed along with the StartSession request.aws ssm start-session --target <TARGET_ID> --document-name AWS-StartInteractiveCommand --parameters command="echo HelloWorld"Another alternative would be to create a custom InteractiveCommands type session document with pre defined commands within the document. Below documentation can be referred for the sample custom document scenario:https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-restrict-command-access.htmlPlease let us know in case of further queries.CommentSharenitikaawsanswered 3 years ago0That's exactly what I needed. Thank you.CommentSharekidbraxanswered 3 years ago"


Question: How to use the payload's timestamp?

"We receive JSON-encoded data like{"data":\[{"n":1234,"s":"abcd","t":1630543365507,"x":0.5678}],"type":"sample"}where "t" is the (UNIX epoch milliseconds) time at which this sample was collected.How can we use that as the Timestream timestamp?Timestream's Product FAQ (https://aws.amazon.com/timestream/faq/?loc=5#Data_ingestion) says it "uses the timestamp of the time series event being written into the database."The Developer Guide (https://docs.aws.amazon.com/timestream/latest/developerguide/concepts.html) says "Timestamp - Indicates when a measure was collected for a given record."The Developer Guide (https://docs.aws.amazon.com/timestream/latest/developerguide/data-ingest.html) says "Data ordered by timestamps has better write performance"What do the ingested data's timestamps matter, if Timestream will apply timestamps corresponding to the time they're written into the database?A Timestream developer forum thread (https://forums.aws.amazon.com/thread.jspa?threadID=329388) refers to an IoT developer forum thread (https://forums.aws.amazon.com/thread.jspa?messageID=959502) in which the IoT feature Timestream Rule Action (https://docs.aws.amazon.com/iot/latest/developerguide/timestream-rule-action.html) was implemented (according to @manbeenaws) to specify an arbitrary value (i.e. a timestamp specified in the MQTT payload) as the Timestream timestamp.Is there a way to use a payload value as the Timestream timestamp, if the data don't arrive via IoT?Edited by: bobsut on Sep 1, 2021 11:44 AMEdited by: bobsut on Sep 1, 2021 12:35 PMFollowComment"

Answer: "0You can use the timestamp from your data sample when using the WriteRecords API to write data to Timestream. For each record in your WriteRecords request, you set the "Time" parameter as the timestamp for the event (in your case, to the value of "t"). Timestream uses this value as the timestamp for the event.More information on the WriteRecords API: https://docs.aws.amazon.com/timestream/latest/developerguide/API_WriteRecords.htmland on the Record type: https://docs.aws.amazon.com/timestream/latest/developerguide/API_Record.htmlI hope this helps with your use case. Thanks for your interest in Amazon Timestream!AudreyCommentShareAudrey Lanswered 2 years ago"


Question: RTO of Availability Zone Failure

"If the Availability Zone has been wiped off the map and is never coming back, any guaranteed RTO for all services?FollowComment"

Answer: "1This question requires more details and discussions but I can try to give some guidance here.You typically define the RTO for a workload and set an objective agreed with the business owners to recover in X minutes/hours. If the 10000 instances you are referring to are part of the same workload and all of these instances are required for your workload/business to function, then the RTO may be the same for all. In this case, you can deploy these instances across Multiple AZs and have a way to isolate traffic to the impaired AZ. Static stability is an important concept here as well: if you need 10000 instances for your application/workload to operate and if an AZ is impaired, then you should still have a total of 10000 instances in the remaining AZs. You should avoid provisioning new capacity in a new AZ to recover.Here is a nice read on this: https://docs.aws.amazon.com/whitepapers/latest/advanced-multi-az-resilience-patterns/multi-az-recovery-patterns.htmlHope it helps,JonCommentShareEXPERTJonathan_Danswered 25 days ago0If an entire Availability Zone is completely wiped out and is not recoverable, the Recovery Time Objective (RTO) for services running in that zone will depend on various factors such as the complexity of the system, level of redundancy and the recovery plan in place. It's important to have a disaster recovery plan that includes multi-region architectures to reduce the impact of such events. In summary, the RTO for such events varies and having a well-documented disaster recovery plan in place can help ensure a fast and effective response.CommentShareTasadduq Burneyanswered 25 days agoKit Lau 25 days agoIf we created 10000 EC2 (with tier 0 recovery plan) in that failed AZ, is the same RTO applied to that 10000 EC2?ShareRodney Lester 25 days agoHe's asking about a single AZ being permanently lost. You don't need multiple regions to recover from an AZ destruction.Share"


Question: SES Domain Identity Verification

"Hello, I've been trying to verify an SES identity for more than a week and everytime I get Failed.I've purchuased a domain in route 53. I have a hosted zone with the same name, a public one. I haven't modified the hosted zone.In the SES service I've created a new Identity. I chose Domain and entered, ex: mydomain.comThen I choose "Easy DKIM", "RSA_2048_BIT", enabled "Publish DNS records to Route53", enabled "DKIM signatures" and finally "Create Identity".After that I went to my domain hosted zone and noticed 3 CNAME records were added.The problem is that for 3 days I get the verification is still pending and then I get failed. I've tried this 3 times for 9 days. I'm really not sure what I'm doing wrong.Acording to the documentation I'm doing everything i need when I create an Identity. Is there a role I need to associate? Do I need to change any setting in route 53?Both record names and values match in the identity and in the hosted zone.Thank youFollowCommentSylvain_BRUAS_TeamWork 2 months agoHello,Can you please share your public domain name to allow us to see the CNAME and maybe find the root cause ?SharerePost-User-8411711 2 months ago@Sylvain_BRUAS_TeamWork, I updated the postShare"

Answer: "1Accepted AnswerThanks for the screenshots.I can find your domain with WHOIS tools.But when I try to get public information on your domain, I had errors.I think the problem is coming form the NS field in your R53 hosted zone. I think it's not redirected to R53 name servers. I can be the root cause of your troubleMaybe this part of the documentation can help you :https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/troubleshooting-domain-unavailable.html#troubleshooting-domain-unavailable-transferred-domain-wrong-name-serversCommentShareSylvain_BRUAS_TeamWorkanswered 2 months agoEXPERTalatechreviewed 2 months agorePost-User-8411711 2 months agoSylvain, thank you. The name servers from the hosted zone did not match the ones in my domain. Basic error, I updated them. Thanks for your help. My identity just verified itself =)Share"


Question: Instance reachability check failed

My instance which was working for several years is unable to load today and says "Instance reachability check failed Check failure at 2022/10/10 18:45 GMT+5 (19 minutes)".It is c6i.2xlarge type of instance running Windows.I tried to reboot instance several times and stpped and started it but that did not solve the issue. I checked the logs but those are completely empty.I have also open a ticket 10972555931Please help!FollowComment

Answer: "0Could you please follow the steps outlined under https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/screenshot-service.htmlYou could try the EC2 rescue https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/Windows-Server-EC2Rescue.htmlfurther referencehttps://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/screenshot-service.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/ec2-windows-instance-status-check-fail/CommentShareEXPERTAbhishek Sonianswered 8 months agoMFJ 8 months agoScreenshot simply shows some issues with network, see this: https://ibb.co/mh4djBdTried EC2 rescue and it did not detect anything serious on volume as seen here: https://ibb.co/dtsmk4gI grabbed logs through EC2 rescue but that did not show anything serious either.After completing all steps of EC2 rescue, I attached volume back to original machine, but it still says the same " Instance reachability check failed, Check failure at 2022/10/10 21:19 GMT+5 (22 minutes)"Share"


Question: kube-proxy failing after update to 1.16+

"Hi all,I've recently updated one of our clusters from version 1.15 to 1.16 and then to 1.17. Before this one I updated 8 other clusters with no issues whatsoever. However, for some reason, when I update kube-proxy to bring it in line with the new Kubernetes version the pods fail. The logs are empty and the reason why the pods are terminated is "Error", which isn't informative at all.In short:Server Version: v1.17.17-eks-087e67Nodes version: v1.17.17-eks-ac51f2Working kube-proxy version: v1.15.11-eksbuild.1kube-proxy versions that cause the problem: 1.16.13-eksbuild.1, v1.17.9-eksbuild.1At first I thought it could just be that particular version of kube-proxy so I decided to keep updating. Now I assume it's something else.Running kubectl logs -f podName doesn't help. It doesn't return anything.State:          Waiting    Reason:       CrashLoopBackOff  Last State:     Terminated    Reason:       Error    Exit Code:    1    Started:      Mon, 18 Oct 2021 12:32:56 +0200    Finished:     Mon, 18 Oct 2021 12:32:56 +0200  Events:Type     Reason     Age                From                                                    MessageNormal   Scheduled  66s                default-scheduler                                       Successfully assigned kube-system/kube-proxy-bh7r4 to  ip-xxxxxx.eu-west-1.compute.internalNormal   Pulling    65s                kubelet, ip-xxxxxx.eu-west-1.compute.internal  Pulling image "602401143452.dkr.ecr.eu-west-1.amazonaws.com/eks/kube-proxy:v1.17.9-eksbuild.1"Normal   Pulled     63s                kubelet,  ip-xxxxxx.eu-west-1.compute.internal  Successfully pulled image "602401143452.dkr.ecr.eu-west-1.amazonaws.com/eks/kube-proxy:v1.17.9-eksbuild.1"Normal   Created    23s (x4 over 62s)  kubelet,  ip-xxxxxx.eu-west-1.compute.internal  Created container kube-proxyNormal   Started    23s (x4 over 62s)  kubelet,  ip-xxxxxx.eu-west-1.compute.internal  Started container kube-proxyNormal   Pulled     23s (x3 over 62s)  kubelet,  ip-xxxxxx.eu-west-1.compute.internal  Container image "602401143452.dkr.ecr.eu-west-1.amazonaws.com/eks/kube-proxy:v1.17.9-eksbuild.1" already present on machineWarning  BackOff    8s (x6 over 61s)   kubelet,  ip-xxxxxx.eu-west-1.compute.internal  Back-off restarting failed containerCan you please advise? I'm quite confused here. I'm comparing what I did with our other clusters and I took the exact same steps. Not sure why this is not working.Thanks a lot!Edited by: twgdavef on Oct 18, 2021 4:24 AMFollowComment"

Answer: 0Upgrading to version 1.18 and using the add-ons solved the issue.CommentSharetwgdavefanswered 2 years ago


Question: AWS glue python shell script unable to connect to oraclDB

"Hello All,I am trying to create small python shell script to connect to oracle DBIn code I have mentionedimport oracledbSince this module is not available. I ran pip install  oracledb on my local system and folder got generated in C:\Dev\Python3.11\Lib\site-packages as oracledb.Then copied that folder to s3 bucket and passed the path of s3 bucket s3://XXXXXXXX/oracledb/ like this .Now when i am running it I am getting below error CommandFailedException: Library file doesn't exist: /tmp/glue-python-libs-jmz3/FollowComment"

Answer: "1Hello,I understand you wish to use python-oracledb in you Glue PySpark ETL job. It can be done by either of the following approaches:If your Glue job runs in a VPC subnet with public Internet access (a NAT gateway is required since Glue workers don't have public Ip address [1]). You can specify the job parameter like this:Key:  --additional-python-modulesValue:  oracledbIf your Glue job runs in a VPC without internet access, you must create a Python repository on Amazon S3 by following this documentation [2] and include oracledb in your "modules_to_install.txt" file. Then, you should be able to install the package from your own Python repository on S3 by using following parameters. (make sure replace the MY-BUCKET with the real bucket name according to your use case)"--additional-python-modules" : "oracledb","--python-modules-installer-option" : "--no-index --find-links=http://MY-BUCKET.s3-website-us-east-1.amazonaws.com/wheelhouse --trusted-host MY-BUCKET.s3-website-us-east-1.amazonaws.com"As you are facing "CommandFailedException: Library file doesn't exist:" error, please consider looking at the IAM permission for Glue and the S3 object as well.Unless a library is contained in a single .py file, it should be packaged in a .zip archive. [3] Please try creating zip files and use Python 3.9.For using extra python files you can use it in the job parameters as follows:key: --extra-py-files value: s3://<bucket_name>/etl_jobs/my_etl_job.zipFor Glue Python Shell jobs , you can add python libraries (not spark) and the method to do so is found here: https://docs.aws.amazon.com/glue/latest/dg/add-job-python.html#create-python-extra-libraryFor Glue ETL jobs (PySpark) you can find the info on how to add additional libraries here: https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-python-libraries.htmlPlease refer to the below [4] [5] [6] articles for more elaborate explanation on the above.References:https://aws.amazon.com/premiumsupport/knowledge-center/nat-gateway-vpc-private-subnet/https://aws.amazon.com/blogs/big-data/building-python-modules-from-a-wheel-for-spark-etl-workloads-using-aws-glue-2-0/https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-python-libraries.html#aws-glue-programming-python-libraries-zippinghttps://aws.amazon.com/premiumsupport/knowledge-center/glue-version2-external-python-libraries/https://stackoverflow.com/questions/61217834/how-to-use-extra-files-for-aws-glue-jobhttps://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-python-libraries.htmlIn order for me to troubleshoot further, by taking a look at the logs in the backend, please feel free to open a support case with AWS using the following link with the sanitized script, the job run, any additional dependency that you are trying to import and we would be happy to help.CommentShareSUPPORT ENGINEERAnushka_Sanswered 4 months ago0For example 1 ) I am not finding --additional-python-modules key in AWS console. Does its name got changed ?key: --extra-py-filesvalue: s3://<bucket_name>/etl_jobs/my_etl_job.zipI also tried adding Zip file in S3 bucket for oracleDB . but it is giving ModuleNotFoundError: No module named 'oracledb'. After adding this file do I need to change something my script so that it reads from this  file ?When adding wheel file then getting error :ImportError: cannot import name 'base_impl' from partially initialized module 'oracledb' (most likely due to a circular import) (/glue/lib/installation/oracledb/init.py)CommentShareAWS-User-6494745answered 4 months agoGonzalo Herreros 4 months agoYou can use --additional-python-modules even if it's not offered in the this. The reason you get that import 'base_impl' is because it cannot find the native .so file, it needs to be precompiled that's why it's better just to install from pipShare"


Question: [FAILED] Failed to start Initial cloud-init job (pre-networking)

"Hi!I have an issue with a migrate instance from Azure to AWS.I do install the Kernel version for AWS in the instance (Ubuntu 18.04) and enabled the ENA support for that.But when the Instance is starting the status check show an status 1/2.In the registry of system in the console I can see the next error and logging into the instance via the EC2 Serial Console and run the next command the error displayed is:Command: systemctl status cloud-init-local.serviceError displayed:● cloud-init-local.service - Initial cloud-init job (pre-networking)Loaded: loaded (/lib/systemd/system/cloud-init-local.service; enabled; vendorDrop-In: /lib/systemd/system/cloud-init-local.service.d└─50-azure-clear-persistent-obj-pkl.confActive: failed (Result: exit-code) since Fri 2022-02-25 01:28:39 UTC; 10min aProcess: 875 ExecStart=/usr/bin/cloud-init init --local (code=exited, status=1Process: 852 ExecStartPre=/bin/sh -xc if [ -e /var/lib/cloud/instance/obj.pklMain PID: 875 (code=exited, status=1/FAILURE)Feb 25 01:28:41 UHP-ECOMM-US-DB2 cloud-init[875]: Command: ['netplan', 'generateFeb 25 01:28:41 UHP-ECOMM-US-DB2 cloud-init[875]: Exit code: 1Feb 25 01:28:41 UHP-ECOMM-US-DB2 cloud-init[875]: Reason: -Feb 25 01:28:41 UHP-ECOMM-US-DB2 cloud-init[875]: Stdout:Feb 25 01:28:41 UHP-ECOMM-US-DB2 cloud-init[875]: Stderr: /etc/netplan/51-netcfgFeb 25 01:28:41 UHP-ECOMM-US-DB2 cloud-init[875]:           ethernets:Feb 25 01:28:41 UHP-ECOMM-US-DB2 cloud-init[875]:                     ^Feb 25 01:28:41 UHP-ECOMM-US-DB2 cloud-init[875]: ------------------------------Feb 25 01:28:39 UHP-ECOMM-US-DB2 systemd[1]: cloud-init-local.service: Failed wiFeb 25 01:28:39 UHP-ECOMM-US-DB2 systemd[1]: Failed to start Initial cloud-initCan you help me?FollowComment"


Question: Website has been hacked notification on google searches

Our website hosted on AWS when searched by Google indicates a "This site has been hacked" message. I have tried to add a DNS text entry and install an HTML provided by Google but neither appear to be resolving the issue. Anyone throw any light on this?FollowComment

Answer: 0have you tried out this articlehttps://support.google.com/websearch/answer/190597?hl=en#zippy=%2Cwhat-to-do-when-you-see-this-message%2Cremove-this-message-from-your-siteCommentShareAWS-User-8552542answered a year ago


Question: DMS charges for target S3 Bucket PUTs

"Customer would like to use S3 as a target for DMS to pull data from a on-premises MySQL database.  The AWS DMS pricing page says that any data transferred into DMS is free.  Does that mean the data transferred from the DMS to S3 (since it's the target ) is also free, so no charges are levied for the PUTs to S3? Or how it is calculated?FollowComment"

Answer: "0Accepted AnswerAs per pricing docs "All data transfer into AWS Database Migration Service is free, and data transferred between AWS Database Migration Service and databases in Amazon RDS and Amazon EC2 Instances in the same Availability Zone also is free."This implies that standard S3 charges will be applicable when S3 bucket is the target of DMS.CommentShareEXPERTBehramanswered 3 years ago"


Question: aws-iot-device-sdk-embedded-C v4_beta on ESP32

"Hello, I've ported the v4_beta as an ESP-IDF (master) component and I'm having some issues with the MQTT socket disconnecting on read.  Wireless works fine, because I'm setting the time using SNTP before the demo code runs.  I'm using mbedtls that is included with ESP-IDF with one change, I had to implement mbedtls_net_poll.  The shadow demo code I'm using is not modified from the SDK demo.  I don't know where to begin to debug this problem.Here is a log from the library:  https://pastebin.com/5jJj5SgNHere is my fork/branch of ESP-IDF:  https://github.com/jkent/esp-idf/tree/gtechHere is my demo project: https://github.com/jkent/gtech-iot-demoAny pointers would be greatly appreciated.Edited by: jkentfromgithub on Sep 4, 2020 3:16 PMFollowComment"

Answer: 1Turns out I didn't have a policy attached to my certificate.  Problem resolved!CommentSharejkentfromgithubanswered 3 years ago


Question: Securing Cross-Account Access for CodePipeline

"I'm using CodePipeline to deploy code from my development account to my application account using cross-account deployment techniques describe on the following page:https://aws.amazon.com/premiumsupport/knowledge-center/codepipeline-deploy-cloudformation/I have a cross-account role that is deployed in the deployment target accounts via a CloudFormation as follows:  CrossAccountDeploymentRole:    Type: 'AWS::IAM::Role'    Properties:      AssumeRolePolicyDocument:        Version: '2012-10-17'        Statement:          - Effect: 'Allow'            Principal:              Service:                - 'cloudformation.amazonaws.com'            Action:              - 'sts:AssumeRole'      ManagedPolicyArns:        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess'      RoleName: 'CrossAccountDeploymentRole'It seems to me that this grant is overpermissive and would allow someone who knew the account number and role name to assume this role via a cross-account CloudFormation stack deployment from their own account.  Essentially, there's nothing here that says "only let CloudFormation assume this role if the request is from account number 123456789012".How can I limit this role such that CloudFormation is only allowed to assume this role if it is being called from a specific AWS account?FollowComment"

Answer: "1The configuration you describe provides the service role that CloudFormation uses to execute the change set or deploy the stack. You still have to have permissions to pass the role to CloudFormation (iam:PassRole) on a per stack basis and create the stack itself. See here. You can only pass the role from an IAM role in the same account. So, if I'm trying to create a stack and specify a role in a different account, the stack creation will fail because I can't pass that role to CFN. If you look at the instructions here and here, you'll see that the cross account access relies on a role in Account A where the pipeline lives assuming a role in Account B. Then it uses the role in Account B to create the stack and to pass a third role to CFN, also in Account B. This prevents any type of cross account access with the role that trusts the CloudFormation service principal (cloudformation.amazonaws.com).CommentSharemikeanswered a year agoTimGustafson a year agoThe role I described is deployed in account B.  Account A assumes this role during a CodePipeline deployment via a CloudFormation deployment.  The pipeline does have the ability to sts:AssumeRole the role in account B.  This already works, and is not my question.  My question is that the role in Account B does not know anything about account A.  How do I tell account B to only allow the role to be assumed by CloudFormation when it's called from a CodePipeine executing in account A?ShareAlex_P a year agoPer @mike's description, you will have 2 roles in Account B - 1/ cross-account role that CodePipeline will assume 2/ service role that will be passed to CloudFormation and deploy the resources. Cross-account role is the one that has permissions to pass the service role to CloudFormation for Account B. This is also the only role that can trigger the deployment in Account B. In order to prevent from another account to use the cross-account role, you can specify Account A as the only approved principal in role's trust policy.ShareTimGustafson a year agoYou said "you can specify Account A as the only approved principal in role's trust policy", which is exactly what I'm trying to do.  What's the magic incantation to make that happen?Share1Hi!  Good question.  I'm reviewing the 2 answers above, and don't think they solve what you're trying to do.In this case, you would want to limit access via the role you have in Account B - and to do so, you would have to do so on the IAM Role's trust relationship to scope that down so AWS is not using CloudFormation as a confused deputy.Check out the IAM Condition Key aws:SourceAccount: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceaccount.  I'm not sure if this works with CodePipeline, but that condition would do what you are looking to do:"This key is included in the request context only if accessing a resource triggers an AWS service to call another service on behalf of the resource owner. The calling service must pass the resource account ID of the source to the called service. This account ID includes the source account ID."aws:PrincipalOrgID would not be applicable to the trust policy you have posted above, since the trusted principal is the AWS Service, cloudformation.amazonaws.com.CommentSharejsoncanswered a year agoTimGustafson a year agoYes, I think aws:SourceAccount is what I'm looking for.  Where can I find whether or not CodePipeline and/or CloudFormation include this in the cross-account request?Share0If you're using AWS Organizations you can use IAM Condition Keys, such as aws:PrincipalOrgID, to help craft a more specific scoped policy on who (or what) can assume a role.  In the case of wanting to ensure only principals from within your organization are able to assume a role.  You can also build the IAM role/policy with a condition (or specific ARN depending on how prescriptive you want to be) which only allows assuming a role from a single known account or even a single role in a single account.CommentShareAllison_Panswered a year ago"


Question: "[Nevermind, My question was answered]"

Nothing to see here!!!!!!!!!!!!!!!!!!!!!!FollowComment

Answer: "0Please don't do that to the posts, as they appear unanswered to the community.Instead, answer your question with the actual resolution, in order to help anyone who could have had the same problem and could be looking for the answer.CommentShareIvan Rodriguesanswered a month ago"


Question: Creating a new Lightsail Instance from Snapshot - ERROR

"I am trying to create a new (larger) instance from a snapshot.  When I go through the steps I receive the following error message:ErrorCreateInstancesFromSnapshot[us-east-1]Sorry, you've reached your maximum limit of Lightsail Instances: 2. If you're new to Lightsail, please try again later. If the issue persists, please contact Customer Support.ResourceLimitExceededI thought we could have up to 20 instances.  How can I fix this issue, or am I limited to 2 instances?FollowComment"

Answer: "1This can sometimes happen, especially with new accounts. In the error message it should be giving you a link to contact Customer Support. If you follow that process, you can ask them to raise the limit on your account so you can create more Lightsail instances.CommentSharerianbkanswered 8 months ago"


Question: AWS Lambda + beautifulSoup python painfully slow

"I'm working on web scraping project with Lambda and beautifulsoup,requests libs.Unfortunately the code is extremely slow. locally the code run 20 seconds, on Lambda its 172 seconds.I can't work and develop my project like that.Please suggest me some solutionsFollowComment"

Answer: "1Accepted AnswerHow about increasing the Lambda specs to match the specs of the local development environment?The default setting is 128 MB.As per the following documentation, Lambda can be configured with up to 10 GB of memory.https://docs.aws.amazon.com/lambda/latest/dg/configuration-function-common.html#configuration-memory-consoleWe recommend that you read the following best practices document once.https://docs.aws.amazon.com/lambda/latest/dg/best-practices.htmlCommentShareEXPERTRiku_Kobayashianswered 7 days agoEXPERTAWS-User-Nitinreviewed 7 days agoDanielTheProgrammer 7 days agoThank you so much for the suggestion!What is the maximum Lambda specs that I can use in the free tier?DanielShareRiku_Kobayashi EXPERT6 days agoThe maximum amount of memory that can be set is 10,240 MB.If you need more memory than this, you will need to use ECS or AWS Batch.https://docs.aws.amazon.com/batch/latest/userguide/what-is-batch.htmlhttps://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.htmlShare1Hi,Apart increasing memory on lambda, which is something without limitations under free tier as well, you can consider creating the function as a container: https://docs.aws.amazon.com/lambda/latest/dg/images-create.html,as increases portability, supports larger package size (mostly for python numpy and similar libraries).CommentShareEXPERTalatechanswered 6 days agoDanielTheProgrammer 3 days agoCan I do proxy rotation with container?Share"


Question: AWS savings plan and reserve instance

so my question is that if we purchased Reserve instance on 1 instanceand we applied 1 of saving plan (from our compute or ec2 saving plan) on the same instance so it'll WORK OR NOT?FollowComment

Answer: "2In short: The Reserved Instance (RI) takes priority over the Savings Plan. Since the RI would cover the whole of your 1 instance (I assume it meets the criteria of the instance you mentioned), the Savings Plan would not apply in this case.In detail:If you do happen to have both RIs and Savings Plans in your AWS Account, the application logic is as follows:Zonal RI apply to the account that owns it; if there are RI hours left – it applies to the rest of Organization if you are part of oneNext, the non size-flexible Regional RIs (i.e. those for Windows) apply to matching usage on the account that owns it; if anything left is – rolls out to the rest of OrganizationThen, size-flexible Regional RI applies to the account that owns it (smallest instance within the family first and going up to larger instances), then to the rest of Organization.EC2 instance SP apply within the account that purchased it (starting from the usage that will result in highest discount and rolling down to usage with least discount) then to the OrganizationCompute SP apply within the account that purchased it (starting from the usage that will result in highest discount and rolling down to usage with least discount) then to the OrganizationLastly, you would use On-Demand instances to cover the restEssentially, most restrictive takes priority and moves on to the more flexible options. You can read more examples here in our documentation: https://docs.aws.amazon.com/savingsplans/latest/userguide/sp-applying.html (Scenario 4 will be of interest to you).CommentShareKarl_Canswered 5 months agorePost-User-8174665 5 months agoThank you, appreciate your time to answer the question.ShareKarl_C 5 months agoMy pleasure! If you are able to officially accept the answer, that would be much appreciatedShare"


Question: Enabling AWS Configuration on Control Tower Main Account

Control Tower has been enabled and has a number of accounts setup under it.These accounts have all got AWS Config setup logging their changes to the Log Archive account central control tower bucket.The Control Tower Main account however does not have AWS Config setup. Is there a way it can be setup to allow it to log to the control tower main buckets in the log archive account?FollowComment

Answer: "1The Control Tower management account (along with the other shared accounts) are not intended to have custom changes deployed to them (1). The permissions and guardrails should generally prevent such changes, and working around these limitations to make changes may lead to issues with Landing Zone updates or account registration.That said, API activity from the management account should be available in CloudTrail (2) for auditing purposes.(1) https://docs.aws.amazon.com/controltower/latest/userguide/best-practices.html#getting-started-guidance : Best practices for AWS Control Tower administrators  - Guidance for Creating and Modifying AWS Control Tower Resources(2) https://docs.aws.amazon.com/controltower/latest/userguide/cloudtrail.html : Monitoring Events with CloudTrailCommentShareSUPPORT ENGINEERWayne_Ganswered a year agoAlex a year agoIf im activating SecHub in the ControlTower Organization it send this as Finding. So what is the recommendation?Share0I agree. The reality is, with AWS Organizations and service interrogations along with AWS SSO you end up using the management account quite a lot, so feel it should be covered - especially to get a "whole platform" security posture.There is some sample code for the Security Reference Architecture that helps fill this gap:https://github.com/aws-samples/aws-security-reference-architecture-examples/tree/main/aws_sra_examples/solutions/config/config_management_accountHTHCommentSharedjbrightmananswered a year ago"


Question: Website is down due to AWS Data Transfer reach 100 %

"Hi , We deployed our Laravel application on aws using Laravel Forge.in my "Free tier tab" under Billing dashboard, it shows that "AWS Data Transfer" reach to 100 %. We are using ec2 in free tier. We have enough amount in credits as well provided by aws when we signed up here.now the issue is my site is down from couple of days due to this issue. It should charge automatically from my credits I think  , but Its not charging as well. And I don't know how i can fix this issue as I can't see any issued invoice there as well. Please let me know how we can fix this issue now.According to my understandings , the way how AWS free tier and credits works is : it issued invoice at the end of every month and it automatically charge using that credits. Today as its 21 may so it will issue the invoice at 31 May and then will charge automatically from the credits at that time. and then with new month it will again restart the cycle with all the things AWS provides in their service LIKE 'AWS Data Transfer' it provides 100 GB per month, so I can imagine from 31May site will work normally as all things will work from scratch. But we have two issues here.how I can wait till 31 May, our users having a lot of issues at the momentIf Data Transfer reach 100 % this month then it can reach next month as well.NOW i need to confirm how I can charge to AWS using my credits for extra DATA Transfer its using right now so my site works normally, OR  we have to move to paid plan rather than Free tier ?This is our website link you can also check if neededhttps://indymandi.com/Yesterday I restarted my server and site worked again, but within 24 hours it stops again, I again restarted my server so maybe site works when you check. But obviously the issue will come again as its not resolved yet on AWS side.Second questions : As i already mentions I have like 1100 $ in my credits , and 350 $ specially for my AWS Developer support. But I am not able to use this credit for developer support . How I can talk to developer support if i need to by using my credits?ThanksFollowComment"

Answer: "0Hi,You  may want to check this link --> https://repost.aws/knowledge-center/aws-promotional-creditHope this will answer your query.Regards,Prince AroraCommentSharePrince Aroraanswered 15 days agorePost-User-1411094 14 days agoHi prince Arora. Thanks for sharing this link, I check it but no luck, I compared all points with my credits status. I am been using Credits from 1st day and its been 4 months we deployed site on AWS. My credit have expiry till 2024. I am not using any organization as well its standalone account.  this AWS Data Transfer service also exists under "Applied Products" table for my credit as well. So all points seems perfectly fulfilled. Anything else if you can share that can help.ThanksShare"


Question: SMB File Gateway Joined to Domain - Permissions

"I've just joined our File Gateway to domain. The idea is to have some folders inside a Bucket and assign each one permissions to certain users, but I think it's not possible.The allow/deny access to file shares, only works at root level? There's not granular permissions? If a users acess a file share, will he have full control on every folder this bucket has?If I want to have several folders (for example, to separate departments of a company), must I create one Bucket for each department and get one file share to each Bucket? It's the only way I think is possible to have separated folders, each one with different access permissions.Thanks in advance.Edited by: melanina896 on May 9, 2019 6:17 PMFollowComment"

Answer: "0Accepted AnswerBefore we launched this feature, the permissions you could assign to individual files and folders in your file share were very limited. You could've changed say the user who own's the file to get read-only or read-write permissions. And now from what you're describing you can assign permissions to different users and groups on those files and folders in your file share.To enable this feature I suggest using the UpdatedSMBFileShare API, pass your file share ARN and SMBACLEnabled: Truehttps://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateSMBFileShare.html{"FileShareArn": "arn:aws:storagegateway:us-east-2:111122223333:share/share-YYYYYYY","SMBACLEnabled": "true",}In general to run APIs, you will need to get credentials. Details can be found here: https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.htmlCommentShareAWS-User-9826533answered 4 years ago0Hi, You'll be pleased to know that we just launched support for ACLs on the file gateway. So now you can have different folders in your bucket (marketing, common, finance, etc)  and use the exported SMB file share after enabling ACLs to set Windows ownership and permissions for individual users and groups (up to 10) on those folders.Please refer to the announcement for more details and it also points you to the link in our user guide with instructions to enable ACLs: https://forums.aws.amazon.com/ann.jspa?annID=6801CommentShareAWS-User-9826533answered 4 years ago0Hi! Thanks @smithaAWS, it's great to know that.Just for being sure, I want to ask:a. Without this feature, is it impossible to grant permissions to individual folders on a Bucket using SMB File Gateway joined to domain? I mean, until today it was impossible?b. Is there any detailed guide for using this feature? I don't know how to access the UpdateSMBFileShare APi.Thanks so much.CommentSharemelanina896answered 4 years ago0Just applied update-smb-file-share and it's working great.Now I can assign permissions to my domain users from folder's properties.I have only one question:Which is the best way to prevent users (with access to file share) to add permissions for another users? Any user that has access to the file share can modify permissions, even his own permissions.Thanks you so much.CommentSharemelanina896answered 4 years ago"