Question: AWS Budget action for Lambda function

"Hello folks,Hope you are well and safe and also hope that this questions don't gonna be an already asked question.I'm here to ask you a brief explanation on how can I stop calling Lambda function when a budget alert (both Actual then Forecasted) is over passed?I'll try to explain better my self: I want to avoid situation where, for an error in Development env, the system call many times a Lambda function.I've setup 3 alert, but I want to add action that made inactive/no-responsive the calling to Lambda function.Is there a way to achieve this behaviour?Best regards.FollowComment"

Answer: "0Hello, AWS Budget Actions are what you are looking for. So on top of a notification you can allow Budget Actions to apply an IAM policy in your account to block something from running. i.e. remove permission from Lambda usage via an SCP being added to your accounts: https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-controls.html#budgets-action-roleYou can apply it to the Lambda itself too if you script it, this could be used to apply an IAM policy to your Lambda that denies the invoke permissions. Here's some info on Lambda policies.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.LambdaCreatePolicy.htmlCommentShareEXPERTRob_Hanswered a year ago0Good question.This could be done via Budget Actions.Rob_H has some good recommendations.  Keep in mind:SCPs (Service Control Policies) would require usage of AWS Organizations and familiarity with how SCPs work/get applied to accounts.  That would also require access to your company's Organizations and SCP Management (which could be complex).You could apply an IAM Policy which would not require AWS Organizations, but this would need to be applied wherever the Lambda is being invoked from.  For this, you could simply apply an extra deny policy to your developer users(s) and/or role(s) - but keep in mind that you don't want the developers to be able to detach/re,ove the policy.Another IAM Policy could be to apply a broad Deny to the Lambda Execution Role (this works best if the Lambda is within a VPC), and would fail to spin up from lack of networking permissions (https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html).  This would not be ideal as the lambda would kick off and immediately fail.CommentSharejsoncanswered a year ago"


Question: Quicksight - Total line in Table to show Sum of Max values from each row

"Hi All,I have a data set in which I have to use the "max" function in displaying a particular measure (i.e. not sum) but I need the Total line to show the sum of the max values coming from each row.In Excel, a pivot table can do that, i.e. a measure in max function in the table can still be summed in the total line.In Quicksight, Total line gives me the max of all the max values it finds in the tableIs this possible in Quicksight? i.e. controlling what the Total line should show for a measure?FollowComment"

Answer: "0Accepted AnswerYou could create a calculated field and use the sumOver function .the measure would be the aggregated value you are looking for (max in your case), partition by the dimension in the pivot and you can leave blank the third parameter (the default is POST_AGG_FILTER that is what you are looking for).Using QuickSight samples Sales Pipeline analysis the calculated field (max_revenue) would be:sumOver(max({Weighted Revenue}),[Region])the result would look like the pivot table on the right in this screenshot.CommentShareEXPERTFabrizio@AWSanswered a year ago0Thank you very much for this. This was exactly what I neededCommentShareBurakTansuganswered a year ago"


Question: Gave a user full access to SQS but it can still access absolutely no data

"I created a new user and assigned it the following policy:{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": ["sqs:DeleteMessage","sqs:GetQueueUrl","sqs:ListQueues","sqs:ChangeMessageVisibility","sqs:SendMessageBatch","sqs:UntagQueue","sqs:ReceiveMessage","sqs:SendMessage","sqs:GetQueueAttributes","sqs:ListQueueTags","sqs:","sqs:TagQueue","sqs:ListDeadLetterSourceQueues","sqs:DeleteMessageBatch","sqs:PurgeQueue","sqs:DeleteQueue","sqs:CreateQueue","sqs:ChangeMessageVisibilityBatch","sqs:SetQueueAttributes"],"Resource": ""}]}I also gave it access to 'all resources' instead of a specific ARNHowever, if I try to get the list of queues, I see one which I don't recognize, and if I try to directly view one of my SQS queues by getting its attributes, it tells me I don't have access to it.Any ideas what I did wrong..? May be because of that one unknown queue, its pulling from somewhere else instead of my account's queues?FollowComment"

Answer: 0Turns out the default credentials were not being read from the environment variables as the documentation promised. Providing them specifically using the static credentials provider fixed this issue.CommentShareali_akhtaranswered 4 years ago


Question: AWS RDS proxy connection close

"I have a question about how the rds proxy works. If I close the connection to the proxy endpoint from the application (lambda function), does it also close the underlying database connection (proxy to rds) ? Or it just closes the application to proxy connection and return the database connection back to the pool? If the latter is true, can I safely close the connection from the application when the work is done and request it again when necessary?FollowComment"

Answer: "1Accepted AnswerRDS Proxy is a managed connection pool for RDS. As such, it creates a pool of connections to the database. The clients create the connections to the proxy. There is not a 1-1 relation between client connections and database connections. Whenever a request is received from the client, the proxy will take a connection from the pool, perform the request and return the connection to the pool.Given the above, your application can create and destroy connections and will have little effect on the database connections. Saying that, it is recommended that you will maintain the connection between your Lambda function and the proxy to reduce execution time.You can find more information about connections settings hereCommentShareEXPERTUrianswered a year agoEXPERTParnabreviewed a year agoAWS-User-4609384 a year agoThanks for the clarification. The only reason I wanted to close the application connection was to prevent database connection closed error after long period of inactivity. Now that rds proxy re-uses the db connection during the application idle period, I don’t think there would be any database connection closed errors (need to make sure there is no connection pinning to allow db connection re-use)Share"


Question: Volume can't be detached

"My account was being on hold and after I get access to account I can't start my instance.When I click storage tab in my EC2, the error "Failed to describe volume vol-000321e527462ca02The volume 'vol-000321e527462ca02' does not exist." appears.Also no matching volumes found by id in ElasticBlockStore.Volumes.How can I detach this volume?FollowComment"

Answer: "0I would check your Personal Health Dashboard and see if there is info about your instance being degraded.  Probably a good idea to open a ticket with support to have AWS check the instance.  I have seen similar situation with detaching ENI and attaching to replacement instance in the past when there was an issue with the physical host that the instance was running on.  This usually resolved itself after some time (about an hour) but AWS was able to force the instance to stop and allow the detachment via support ticket.CommentShareIsaac Behrensanswered a year agoAWS-User-5854074 a year agoThanks for your reply, but I can't open a support ticket on the free plan.One solution I see is to create another EC2 instance and attach my EBS (from snapsot) to this instanceShare"


Question: AWS CloudFront WAF ACL

"I am trying to set a WAF ACL on top of my CloudFront distribution.Initial idea behind the implementation is the idea of having a Video On Demand streaming. So basically I do have a web application, which is hosted on my HTTP web server. The web application wants to access a specific video resources, stored in my previously configured S3 bucket. There is an AOI created on top of it, so my CloudFront distribution shares the files stored in a previously mentioned S3 bucket.I do want to prevent access to the files that can be accessed through a CloudFront distribution URL, and limit the access so only my web server which hosts my web application, can read those files. All other potential attackers and users who does not access files via my web application, should be rejected.I already created a AWS WAF ACL with the allow action access policy on my set of IPs (within set of IPs there is only my web server IP which hosts my web application listed) and associate it within a rule as well as associate my WAF ACL with a previously mentioned CloudFront distribution.I am looking for a way to enable video download through CloudFront distribution only via my web application. I've looked in a signed URLs implementation, but I do have a problem because i need to specify my video URL link into my web application through a simple web form on course level, which does not enable me some sort of dynamically set a signed URL once I could generate it.FollowComment"

Answer: "0I think from your description that you are asking for CORS support to restrict loading of the video only from your web pages. See: CORS headers.CommentShareEXPERTkentradanswered 3 months agoromerogt 3 months agoAgree with kentrad that CORS is suggested approach but might not be enough to restrict access to authorized users.  Just to point out, for Cloudfront to deliver your content to your users you can not use a WAF rules restricting access only to your webservers, your app will only deliver a cloudfront URL.If you need to limit access for a video for a period of time or only to your-app authorized users you would need Cloudfront signed URL or signed cookies.Share"


Question: IVS player quality of streaming 1080 is poor

"streaming with amazon-ivs-broadcast-ios-sample and using  "amazon-ivs-react-native-player": "^1.0.0"streaming qualityAVC profileMainAVC level4.2Resolution1080 x 1920Target bitrate8,500 kbpsTarget framerate60Video codecavc1.4D002AAudio codecmp4a.40.2Target audio bitrate160 kbpsAudio sample rate48 kHzNumber of audio channels 2Output in player is not more than 2500KBPSso there is no use to use such a high qualityeven though I have good internet connection 71.2 Mbps download 27.5 MBps uploadi got in ivs playeronVideoStatistics={(qvd) => {        if (qvd?.duration) {          // console.log(`onVideoStatistics ${JSON.stringify(qvd?.bitrate)}`)          props.onSetBit(`${parseInt(parseInt(qvd?.bitrate) / 1000)} kbps`)          // console.log(qvd)        }      }}Please let me know is there a way to improve qualitytried with these option also but nothing worked     // autoMaxQuality={{      //   bitrate: 8500000,      //   codecs: 'avc1.4D002A,mp4a.40.2',      //   framerate: 60,      //   height: 1920,      //   name: '1920p60',      //   width: 1080,      // }}      // autoQualityMode={false}      // quality={{      //   bitrate: 8500000,      //   codecs: 'avc1.4D002A,mp4a.40.2',      //   framerate: 60,      //   height: 1920,      //   name: '1920p60',      //   width: 1080,      // }}FollowComment"

Answer: "0Accepted AnswerHello,I want to check with the IVS team here at AWS, but wanted to confirm a few details, first.  You are using this samplefrom the AWS GitHub https://github.com/aws-samples/amazon-ivs-broadcast-ios-sample with https://github.com/aws/amazon-ivs-react-native-player from AWS GitHub?Including a link for the AWS documentation for IVS (guidance section for configuration settings) https://docs.aws.amazon.com/ivs/latest/userguide/streaming-config.html while I query my colleagues on your behalf.Thanks for confirmations.CommentShareSUPPORT ENGINEERRon_Hanswered a year agoRon_H SUPPORT ENGINEERa year agoDoes the quality remain at 2500 or does it adjust at all as it plays?Share0You may want to reduce the source video bitrate to about 8Mbps, instead of 8.5Mbps. The max input for IVS is currently 8.5Mbps. There may be a variation on the video bitrate and create >8.5Mbps. This may cause some IVS pipeline issues. If you are only getting 2.5Mbps from the player, please check what the top level manifest is listing for bitrates of all the renditions. The top rendition should be close to your source video bitrate. If the top rendition is 2.5Mbps, there may be issues with the source input, as indicted above. After reducing your source video bitrate, recheck the top manifest.CommentShareMike-MEanswered a year ago"


Question: Embed comprehend medical visualizer UI into browser-based (React) app

"Hello,The browser-based Comprehend Medical visualizer is very well done. High praise to the team!Of course we want to use it in our own app! Please consider this for a future release.Thank you,TerrisEdited by: terris on Jan 4, 2019 11:56 AMFollowComment"

Answer: 0Moved. Please delete.CommentShareterrisanswered 4 years ago


Question: Restricting access to EC2 instances using IAM Policy

"Hi all,I'm trying to restrict access to EC2 instances (especially describe-instances) to a IAM User with a IAM Policy (using Tags) as described in the following post:https://aws.amazon.com/premiumsupport/knowledge-center/iam-ec2-resource-tags/I added the following tag "Environment/Labs" to few EC2 instances.I then created the following IAM Policy that I attached to a IAM user.{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": "ec2:*",            "Resource": "*",            "Condition": {                "StringEquals": {                    "ec2:ResourceTag/Environment": "Labs"                }            }        },        {            "Effect": "Allow",            "Action": "ec2:Describe*",            "Resource": "*"        },        {            "Effect": "Deny",            "Action": [                "ec2:DeleteTags",                "ec2:CreateTags"            ],            "Resource": "*"        }    ]}Unfortunately, this is not working and I'm able to list all the instances. ;(Any hint on what I'm missing here?Note: I tried to attach the condition to the Describe*/DescribeInstances action and this was blocking any access to EC2 instances.Many thanks in advance for the help,Best regards,FredFollowComment"

Answer: "1Accepted AnswerHi Fred,The ability to run the DescribeInstances API is required to gain visibility to these resources.  You need this visibility to know what instances are there.  The first part of your policy will allow additional commands on those resources matching the condition, in your case preventing changes to any instances not tagged with "Environment = Labs".  You cannot prevent seeing the names of all resources but you can prevent actions on resources not matching the condition.CommentShareBert_Zanswered a year ago1According to the latest IAM Policy Reference for EC2, there are no resources or conditions that can be applied to the DescribeInstances action that can be used to restrict the scope of what can be described. So it is all-or-nothing: if you allow DescribeInstances to any principal, all instances can be described.CommentShareEXPERTMichael_Fanswered a year ago1Describe instance can not be restricted using condition but Depending on your business requirement if it is must to avoid the user from seeing all instances you can consider moving to multi-account setup.Or you can completely disable the describe instance permission for the user and provide the list of instance IDs by other means, e.g lambda + s3. But it depends on your use-case and problem you are trying to solve.CommentSharehameedullahanswered a year ago0Thanks to all of you @Bert_Z @Michael_F and @hameedullah.That was my understanding that the describe_instances can not be restricted, but I have to admit I was a bit confused with the blog post and that's why I tried it.I have to admit that it would be a great feature to be able to limit visibility using IAM policy instead of applying some filter later on when the full list is retrieved.CommentShareFredericDanswered a year ago"


Question: Configuration and cost management for iam user

"Is it possible to manage the fleet, stack, and user pool configurations and divide the costs by Iam user even if these are under the same root user?Any advice or suggestion is appreciated. thanks in advance.FollowComment"

Answer: "0Accepted AnswerYes, via tagging the fleet and stacks properly. You could only allow the IAM User the ability to create fleets and stacks where the tags match what you have set for the user. Then designate these tag(s) as cost allocation tags.See:Controlling access to AWS resources using tagsIAM tutorial: Define permissions to access AWS resources based on tagsApplying Attribute Based Access Control in AWS - WorkshopTagging Your Amazon AppStream 2.0 ResourcesCommentShareEXPERTkentradanswered 2 months agoEXPERTalatechreviewed 2 months ago0Thank you for the suggestion, I try and then if I need back to you with questions.CommentShareAWS-User-6631477answered a month ago"


Question: disable read permission on certain folders on s3

"I have a bucket with 2 folders inside, I want my IAM user to be able to access just one of them, I tried using group policy, but the actions s3:ListAllMyBuckets and s3:ListBucket (which is mandatory for listing objects) grants access to all objects in the bucket, denying the action s3:GetObject in the bucket policy doesn't help too. I'd like to create an exception for certain folders, is it possible?FollowComment"

Answer: 0perhaps creating a bucket policy can help.https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/CommentShareUser-HNanswered 8 months ago


Question: Enable/Disable Pinpoint Analytics on AWS SDK for IOS

"A mobile developers team is leveraging on aws-sdk-ios to integrate Pinpoint into a mobile app.They are following the documentation, initializing the client inside their AppDelegates' application:didFinishLaunchingWithOptions: method.They initialize the client with the analytics disabled, because at the very first launch of the app, the user needs to give consent to be tracked. If the user accepts the analytics tracking, then the app needs to enable pinpoint analytics. Ideally, developers would like to update the config of the client, but they could not find any way to do it, since the client config is read-only. So they tried to instantiate a new client, but if a client already exists, that one is returned with its configuration (so analytics disabled). So at this moment, they are not able to enable Pinpoint analytics within the first session of app usage.This is the method they are using:/** Creates an `AWSPinpoint` instance with the specified `configuration` if the instance does not already exists for the configurations' `appId`. If an instance exists for the given `appId`, returns the existing instance. `configuration` are ignored if an instance exists for the given `appId`. The strong reference to the instance is maintained by `AWSPinpoint`, and the developer does not need to retain it manually.  This initializer should be called inside your AppDelegates' application:didFinishLaunchingWithOptions: method.  @param configuration A configuration object. By default, it uses [AWSServiceManager defaultServiceManager].defaultServiceConfiguration to access the service.  @returns The AWSPinpoint instance with the specified appId or nil if serviceConfiguration is invalid or appId is empty. */+ (nonnull instancetype)pinpointWithConfiguration:(AWSPinpointConfiguration *)configuration;How can developers update the configuration of AWSPinpoint instance, after it's been instantiated?Thanks!FollowComment"


Question: EBS Snapshot Question

"We have some EBS snapshots that were unencrypted that came up on a finding. I made a copy of the EBS snapshots and encrypted them. I notice previous unencrypted EBS snapshots were associated with AMIs before deleting them to resolve the finding. I am worried if I complete these actions in the url below it will mess up the AMIs. Please advise the best way to do this without messing anything up or if that is not possible? Thanks in advancehttps://aws.amazon.com/premiumsupport/knowledge-center/snapshot-in-use-error/#:~:text=If%20you%20no%20longer%20need,the%20navigation%20pane%2C%20choose%20AMIs.FollowCommentgokul_G 3 months agoHello, Hope the below answer helps and if does, please accept the answer so that community benefits for clarity, thanks!Share"

Answer: "0Hello Bryan,EBS snapshots associated with the AMIs are tightly coupled. From your question, I assume that you have manually copied the unencrypted EBS snapshots and created encrypted copies but they would have not associated back with the AMI. If you follow the url that you mentioned and deregister the AMI in order to delete the old unencrypted snapshots , then the AMI will be lost and you cannot use it  again.The best way to do this is make copy of your AMI itself. During the ami copy , you will get option to enable the encryption so the new snapshots that gets created will be encrypted and associated with the new AMI (copy of old). Then you can follow the url that you have mentioned to deregister the old ami and delete the old unencrypted snapshots.Follow the steps in this page https://docs.amazonaws.cn/en_us/AWSEC2/latest/UserGuide/CopyingAMIs.html#ami-copy-steps , Refer to section "Copy an AMI" and you can make copy of your existing AMI along with enabling encryption.By this way, you will have your new AMI with encrypted snapshots. and delete the old AMI & its associated unencrypted snapshots.CommentSharegokul_Ganswered 3 months ago"


Question: VirtualBox localhost "Login incorrect"

"I am new to virtual machines, Linux and amazon so please bare with me. I have installed the virtual machine according to amazon's instructions listed here.I am able to boot in VirtualBox, but I am stuck on a sign in page that asks for:localhost login:rather than:amazon login:as I've seen others report.Now I have not made changes to the *meta-data *file in the ISO image, so all it says is:local-hostname: amazonwith some additional commented lines regarding 'network-interfaces' that I am unfamiliar with.The server goes to "localhost" as a direct result of this, I guess? but I do not know the login for localhost and the users and passwords set in the user-data file do not work. If someone could point me in the right direction to set the proper network configuration or help with the  credentials that would be greatly appreciated.FollowComment"


Question: I need to attach IAM role to my EC2 instance.

"PentestEnvironment-Deployment-Role/octopus is not authorized to perform: iam:PassRole on resource. I have CF template which create Ec2 and Iam role for my env and all this env I create from not-root account.Iam Role for this account it's only main part:{"Sid": "IAM1","Effect": "Allow","Action": ["iam:PassRole"],"Resource": ["arn:aws:iam:::role/Pentest-EC2-Role"],"Condition": {"StringEquals": {"iam:PassedToService": "ec2.amazonaws.com"},"StringLike": {"iam:AssociatedResourceARN": ["arn:aws:ec2:us-west-2::instance/"]}}},{"Sid": "IAM2","Effect": "Allow","Action": ["iam:GetRole","iam:CreateRole","iam:DeleteRole","iam:DetachRolePolicy","iam:AttachRolePolicy","iam:PutRolePolicy","iam:GetRolePolicy"],"Resource": ["arn:aws:iam:::role/Pentest-EC2-Role"]},{"Sid": "IAM3","Effect": "Allow","Action": ["iam:ListRoles"],"Resource": [""]},{"Sid": "IAM4","Effect": "Allow","Action": ["iam:GetPolicy","iam:CreatePolicy","iam:ListPolicyVersions","iam:CreatePolicyVersion","iam:DeletePolicy","iam:DeletePolicyVersion"],"Resource": ["arn:aws:iam:::policy/Pentest-AWS-resources-Access"]},{"Sid": "IAM5","Effect": "Allow","Action": ["iam:CreateInstanceProfile","iam:DeleteInstanceProfile","iam:RemoveRoleFromInstanceProfile","iam:AddRoleToInstanceProfile"],"Resource": "arn:aws:iam:::instance-profile/Pentest-Instance-Profile"},{"Sid": "EC2InstanceProfile","Effect": "Allow","Action": ["ec2:DisassociateIamInstanceProfile","ec2:AssociateIamInstanceProfile","ec2:ReplaceIamInstanceProfileAssociation"],"Resource": "arn:aws:ec2:::instance/"}]}Why do I have this error?FollowComment"

Answer: "1HiI think you can add another permission on the policy to recheck if the issue persists again.{     "Sid": "IAM1",     "Effect": "Allow",     "Action": [ "iam:PassRole","iam:GetRole" ],     "Resource": [ "arn:aws:iam:::role/Pentest-EC2-Role" ],     "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" },     "StringLike": { "iam:AssociatedResourceARN": [ "arn:aws:ec2:us-west-2::instance/" ] } } }Check the EC2 trusted policy is there and its correct.Test the Policies: You can use AWS IAM simulator to check if the policy permissions are okay https://policysim.aws.amazon.com/home/index.jsp?#CommentShareGKanswered a year agoYurii a year agoThanks you! I need to take away the condition from policy! And works)Share"


Question: Using subdomain with Lightsail Containers

"I have an existing domain e.g., example.com for a different purpose outside AWS and I want to use a subdomain and connect it to a Lightsail container e.g., mycontainer.example.comIs it possible? I can only see an option for using a root/apex domain.FollowComment"

Answer: "0Hello,I believe you can accomplish this by creating a CNAME record in your example.com domain that maps "mycontainer.example.com" to your container service's public domain. It would look something like:mycontainer CNAME foo.guid.region.cs.amazonlightsail.com(where "foo.guid.region.cs.amazonlightsail.com" is replaced by your container service's public domain URL).I hope this helps. Thank you for using Amazon Lightsail!Best,MaxCommentShareMaxwellanswered 2 years ago0@MaxwellAtAWSThanks that is right however there's one more thing to do that wasn't clear in the UI. I eventually found out that you first need to add TLS certificates for your root domain before the option to add subdomains will come up. So this means that even if you're not going to use your root domain, a TLS certificate must still be created for it, before you can add subdomains.CommentSharecrsdevanswered 2 years ago"


Question: "VPC elastic ip address has been reached, request more elastic ip"

"we are move EC2-Classic to EC2-VPC (US-East) and move classic elastic ip to VPC. The max no. address has been reached. Would you help to add more elastic ip (+30) . current our running 43 instance.Regards,ChrisFollowComment"

Answer: "1re:Post is not the right place to ask for this. Instead, open the Quota Support Console and request the limit to be raised.Also, you might consider changing your design so that you don't require so many public IP addresses. I don't know how you would go about that (not enough information here) but it might make your environment easier to manage and secure by reducing your exposure to the Internet.CommentShareEXPERTBrettski-AWSanswered 10 months ago0Hello,You can use Service Quotas from within your AWS account console to request a quota increase to EC2-VPC Elastic IPs.Bellow references to AWS documentation to help you in this process:Elastic IP address limitRequesting a quota increaseBest regardsCommentShareYounes Benhoumichanswered 10 months ago"


Question: AWS CDK - AWS EMR (creating task instances)

"Hello,I was trying to create emr cluster using aws_cdk.aws_emr module, but I could not figure out a way to add task instances. It is possible using aws_cdk.aws_stepfunctions_tasks, but then it does not have manged_scaling_policy as available in aws_cdk.aws_emr .If anyone here could point me towards a way to achieve it, I would really appreciate it.Thank you,ManjilFollowComment"

Answer: "0Hello,You can use aws_cdk.aws_emr property "JobFlowInstancesConfigProperty" for instantiating task instances. Please see below example and hope this helps.``eg:emr_clst = CfnCluster(self,"my_emr_cluster",            name="my-test-cluster",            applications=[CfnCluster.ApplicationProperty(name="Hive")],            log_uri=f"s3://mybucket/emr/",            release_label=<<emr_version>>,            visible_to_all_users=True,            service_role=<<service_role>>            job_flow_role=<<job_flow_role>>,            instances=CfnCluster.JobFlowInstancesConfigProperty(                termination_protected=False,                master_instance_group=CfnCluster.InstanceGroupConfigProperty(                    instance_count=1,                     instance_type="c5.9xlarge"                ),                core_instance_group=CfnCluster.InstanceGroupConfigProperty(                    instance_count=5,                     instance_type="c5.9xlarge"                ),                ec2_subnet_id=<<subnet_id>>            ),            configurations=[                CfnCluster.ConfigurationProperty(                    ...                    ...                    ...                )            ]        )``Please replace the items in << >> with the respecting values and refer the documentation for more details- https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-emr.CfnCluster.JobFlowInstancesConfigProperty.html.CommentShareAWS-User-6896183answered a year agoManjil a year agoThank you for your answer. I also reached to this point, but I am not really sure on what goes inside CfnCluster.ConfigurationProperty?Share0These are the configuration properties that you want to add it to the EMR cluster. A configuration consists of a classification, properties, and optional nested configurations. A classification refers to an application-specific configuration file. Properties are the settings you want to change in that file.Please refer the link for more details on ConfigurationProperty - https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-emr.CfnCluster.ConfigurationProperty.htmlCommentShareAWS-User-6896183answered a year agoManjil a year agoThank you for pointing it out, but could you please provide with a short example on what the classification would be, what to put in the properties? Because, I did not find it in the document. May be you could point me towards it too.Share"


Question: Connect Lambda function within VPC to Sagemaker Serverless Inference Endpoint

"Hello!I have a Lambda function which needs to connect to a MySQL RDS instance which is within a private VPC. The Lambda function also needs to connect to a Sagemaker Serverless Inference Endpoint, taking data from the RDS instance and passing it to a Sagemaker model for inference.I have tested a vanilla Lambda function from outside of the private VPC to connect to the Sagemaker Endpoint which was successful. However, in order for Lambda to access data from the RDS database, I have associated the Lambda function with the same private VPC and subnets as the RDS instance. As a result, the Lambda function can no longer access the Sagemaker Endpoint as it now lies within the private VPC.I need advice on how to create a VPC Interface Endpoint to enable the Lambda function to access the Sagemaker Endpoint, and on** how to build the associated security groups** to enable the network access. I am unsure of how to implement the VPC Interface Endpoint or how to implement the correct security groups, so I would appreciate advice on the implementation.As an alternative architecture, I could create two lambda functions: one which is associated with the private VPC and connects to the RDS instance then stores the required data in an S3 bucket; and another lambda function which is not within the VPC which pulls the data from the S3 bucket and serves it to the Sagemaker Endpoint. **Would this be a better option? **FollowComment"

Answer: 0It looks like AWS PrivateLink (VPC Endpoints) supports Sagemaker. You should be able to follow the steps on the Access an AWS service using an interface VPC endpoint documentation page to create the interface you need.CommentShareJason Butzanswered a month ago


Question: Cross account multi region patch management

"Greetings, everyone. To summarize, I am seeking to implement a centrally managed patching solution for EC2 instances across multiple regions and accounts within my organization's environment. It is important to note that our infrastructure is entirely cloud-based, without any on-premises components. As someone who is relatively new to this area, I have made various attempts, but I have encountered difficulty in achieving a comprehensive, unified view of multiple accounts through a single interface. Any assistance provided would be greatly appreciated.FollowComment"

Answer: "0The following documents may be useful for cross-account Systems Manager patching.Briefly, EventBridge and Lambda are created in the management account to automate the periodic patching of EC2, etc. for each AWS account with Systems Manager Automation.https://aws.amazon.com/jp/blogs/mt/scheduling-centralized-multi-account-multi-region-patching-aws-systems-manager-automation/CommentShareEXPERTRiku_Kobayashianswered 18 days ago"


Question: s3-dist-cp changes compression of already compressed input files

"Hi,I am trying to copy a large number of .gz files between two S3 buckets using s3-dist-cp command, submitted as a step in an EMR cluster. While the copy is successful, I noticed a size discrepancy at the destination; the copied files are a little smaller in size.I downloaded a small sample to my laptop to compare with the source. When uncompressed, the files are identical. gzip -l reports a compression ratio of 65.8% for the source file and 66.2% for the destination file. So it seems that s3-dist-cp modifies the compression.Is it possible to just copy the files as-is?  In this article it is mentioned that --outputCodec=keep is supposed to do just that, but in the docs there is no keep option for the --outputCodec argument. Instead, it is mentioned thatIf you do not specify a value for ‑‑outputCodec, the files are copied over with no change in their compression. This does not appear to be true. I tried all the below invocations, none achieved the desired result of copying files as-is:s3-dist-cp --src=s3a://source-bucket/ --dest=s3a://dest-bucket/ --copyFromManifest --previousManifest=s3://dest-bucket/manifest.gzs3-dist-cp --src=s3a://source-bucket/ --dest=s3a://dest-bucket/ --copyFromManifest --previousManifest=s3://dest-bucket/manifest.gz --outputCodec=keeps3-dist-cp --src=s3a://source-bucket/ --dest=s3a://dest-bucket/ --copyFromManifest --previousManifest=s3://dest-bucket/manifest.gz --outputCodec=none  (this actually uncompressed the files at the destination)In contrast, when copying .gz.parquet files there is no size discrepancy. So, how can I achieve the same result for .gz files?FollowComment"


Question: Athena : serDe should not be accessed from a null StorageFormat

"I'm stroing cloudtrail logs into the S3 and through glue crwaler trying to crawl the S3(cloudtrail logs) and creating a glue table. While I'm running query against that table in Athena , getting below errorHIVE_UNKNOWN_ERROR: serDe should not be accessed from a null StorageFormatCan someone please help in fixing the issue or tell the workaround. I'm creating all the resources through terraform.FollowComment"

Answer: "0Check the table parameters for the SerdeInfo of the StorageDescriptor.  The crawlers don't always detect and configure the InputFormat, OutputFormat and SerializationLibrary parameters, so they can be NULL.  Ex:$ aws glue get-table --region <region> --profile <profile> --database-name <db name> --name <table name> --query '*[].StorageDescriptor.[InputFormat,OutputFormat,SerdeInfo.[SerializationLibrary]]'[[null,null,[null]]]If you manually edit the table (and recreate any partitions), then you'll be cleared to query.  Ex: (for a .csv file)[["org.apache.hadoop.mapred.TextInputFormat","org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat",["org.apache.hadoop.hive.serde2.OpenCSVSerde"]]]CommentSharesdsqldbeanswered a year ago"


Question: "Can we managed AWS Inspector suppression rules as code ? (terraform, api calls?)"

"Hello everyone !I've been researching the AWS DOC, the Terraform doc, tried Googling it, I can't find a way to manage the AWS Inspector suppression rules from elsewhere than the UI.  I'm kinda surprised. Maybe it has a different name ?When you have multiple environments, and different owner of different products, managing it from the UI makes no sense.Any hints ?Thanks !FollowComment"

Answer: "0Accepted AnswerIn API/CLI, Suppression Rules are called Filters. You can list, create, update and delete suppression rules.CommentShareBenoit de Chateauvieuxanswered a month agoJM a month agoOh I see @benoit, in the create-filters, there is indeed the --action SUPPRESS!Okay interesting. It's not implemented yet in the Terraform Provider, but maybe I can work around this.Thanks for the reply !Share-1https://docs.aws.amazon.com/inspector/latest/user/findings-managing-supression-rules.html Correct this is troubling @JM. If you are an enterprise customer I HIGHLY suggest you submit a PFR to get this ball rolling. I checked to see if there was a means to do this via CLI and alas there wasn't. While this isn't an "Answer" I think you have validated your concern. Your feedback means a lot to us to help drive the service to be better for you. If this was acceptable as an answer please don't fret from marking it such. I know I will make this known to the service team internally.CommentShareD Ganswered a month agoJM a month agoAlright well thanks for confirming my suspicion ! Sad to hear cause this makes AWS Inspector hard to use for container findings. Happy to hear that my question might trigger some initiatives on your end though.Good evening !ShareBenoit de Chateauvieux a month agoSuppression Rules can be created via CLI: https://docs.aws.amazon.com/cli/latest/reference/inspector2/create-filter.htmlShareD G a month agoVery valid point @Benoit de Chateauvieux I was checking inspector1 not 2. To the OP I believe these comments provide you next steps to move forward.Share"


Question: Cloudformation conditions yaml

"I have to create an auto scaling group in two regions and the only difference between the two are the subnets. us-east-1 has 1 subnet whereas us-east-2 has two. How can I use the condition to call the subnet value from region map. Here's my broken code. Any help is appreciated.Mappings:  RegionMap:    us-east-1:      AMI: "ami-066f487d3b6819b0d"      Subnet1: "subnet-0e6f12f64042ea5b1"    us-east-2:      AMI: "ami-0aef5e0adcbc7cc0f"      Subnet1: "subnet-0e6f12f64042ea5b1"      Subnet2: "subnet-0bc661bb8d98f3f03"Conditions:  region: !Equals [!Ref us-east-2, Subnet2]  autoscaling:    Type: AWS::AutoScaling::AutoScalingGroup    Properties:      AutoScalingGroupName: asg1      VPCZoneIdentifier:         - !FindInMap [RegionMap, !Ref "AWS::Region", Subnet1]        - If regions = us-east-2 then !FindInMap [RegionMap, !Ref "AWS::Region", Subnet2] # This is what I need to figure outI couldn't find any examples of this. Has anyone used a region map and used conditionals with it?FollowComment"

Answer: "0How about this? I have not tested the template.Mappings:  RegionMap:    us-east-1:      AMI: "ami-066f487d3b6819b0d"      Subnets: ["subnet-0e6f12f64042ea5b1"]    us-east-2:      AMI: "ami-0aef5e0adcbc7cc0f"      Subnets: ["subnet-0e6f12f64042ea5b1", "subnet-0bc661bb8d98f3f03"]Resources:  autoscaling:    Type: AWS::AutoScaling::AutoScalingGroup    Properties:      AutoScalingGroupName: asg1      VPCZoneIdentifier: !FindInMap [RegionMap, !Ref "AWS::Region", Subnets]I added the following on 2022-12-10.I verified that the stack creation completes successfully using the following template. I confirmed with us-east-1 and us-east-2.Note: I changed the AMI IDs and Subnet IDs to the values of my AWS account.AWSTemplateFormatVersion: "2010-09-09"Mappings:  RegionMap:    us-east-1:      AMI: "ami-0b0dcb5067f052a63"      Subnets: ["subnet-xxxxx28b"]  # mask    us-east-2:      AMI: "ami-0beaa649c482330f7"      Subnets: ["subnet-xxxxxb61", "subnet-xxxxx9e5"]  # maskResources:  autoscaling:    Type: AWS::AutoScaling::AutoScalingGroup    Properties:      LaunchTemplate:        LaunchTemplateId: !Ref myLaunchTemplate        Version: !GetAtt myLaunchTemplate.LatestVersionNumber      MaxSize: "1"      MinSize: "0"      DesiredCapacity: "1"      VPCZoneIdentifier: !FindInMap [RegionMap, !Ref "AWS::Region", Subnets]  myLaunchTemplate:    Type: AWS::EC2::LaunchTemplate    Properties:      LaunchTemplateName: launch-template-test      LaunchTemplateData:        ImageId: !FindInMap [RegionMap, !Ref "AWS::Region", AMI]        InstanceType: t2.microCommentSharejhashimotoanswered 6 months agolearner00 6 months agoThank you for your response. I had initially tried it but ran it a problem while creating it with the following error."Value of property VPCZoneIdentifier must be of type List of String"Sharejhashimoto 6 months ago@learner00I added the template I verified to my answer. The template worked as expected. If you could share the entire template with us, it might help us figure out the cause of your error.Share0Hello, for error "Value of property VPCZoneIdentifier must be of type List of String", consider removing [ ] enclosing the subnets in the Mappings section. Also, the following template can be used in both us-east-1 and us-east-2 regions that you can consider testing:Note: Displayed limited resource properties for simplicity. Make sure to add the required properties and replace your subnets IDs and AMI IDs.Mappings:  RegionMap:    us-east-1:      AMI: ami-xxxx      Subnets: "subnet-xxxx"    us-east-2:      AMI: ami-xxxx      Subnets: "subnet-xxxx, subnet-xxxxx"Parameters:  region:    Type: String    AllowedValues:      - us-east-1      - us-east-2Conditions:  UE1: !Equals     - !Ref region    - us-east-1Resources:  autoscaling:    Type: 'AWS::AutoScaling::AutoScalingGroup'    Properties:      AutoScalingGroupName: name-of-asg      VPCZoneIdentifier:        - !If           - UE1          - !FindInMap             - RegionMap            - !Ref region            - Subnets          - !FindInMap             - RegionMap            - !Ref region            - Subnets #with other required properties in this resource typeCommentShareSUPPORT ENGINEERSreshtha_Kanswered 6 months ago"


Question: IVS support for audio rendition groups

"Hello,Can IVS support audio rendition group? meaning can I stream to users single video with 2 audios? like one audio is "music" and the other is "commentary" and let the users choose (if I understood correctly this is audio rendition group).Thx.FollowComment"

Answer: "1Accepted AnswerAt the moment, IVS only support 2 audio channels (either stereo or mono). For more details refer the link below.https://docs.aws.amazon.com/ivs/latest/userguide/streaming-config.htmlYou may explore AWS Elemental Media Live for such use-cases.CommentShareSubin_Hanswered a year ago"


Question: SM Elastic Inference Accelerators are not available during inference

"Hi Team,Greetings!!We are able to deploy on real-time endpoint with elastic inference accelerators. But SM Elastic Inference Accelerators are not available during inference, could you please have a look?Note:We are bringing our own trained model using Pytorch = 1.10.2 on SM.We don't find any errors in cloud watch logs.Converted our trained model to TorchScript and able to load that model as well during inference.Tried both Torchscript's trace and script modes but no luck.Codefrom sagemaker.pytorch import PyTorchModelfrom sagemaker import get_execution_roleendpoint_name = 'ner-bert'pytorch = PyTorchModel(entry_point='deploy_ei.py',source_dir='code',model_data=model_data,role=get_execution_role(),framework_version='1.3.1',py_version='py3',sagemaker_session=sagemaker_session)predictor = pytorch.deploy(initial_instance_count=1,instance_type='ml.m5.large',accelerator_type='ml.eia2.xlarge',endpoint_name=endpoint_name)Thanks,VinayakFollowComment"


Question: the use of kendra in aws lex

"As is commonly understood, AWS Lex is responsible for handling responses through utterances and slots, while AWS Kendra is used for searching. I am curious about the connection between these two services and the reasons for using AWS Kendra with AWS Lex.FollowComment"

Answer: 0Accepted AnswerCheck thishttps://aws.amazon.com/blogs/machine-learning/integrate-amazon-kendra-and-amazon-lex-using-a-search-intent/CommentShareAWS-User-3429271answered 18 days ago


Question: Personalize Recommendations for Anonymous Users using SessionId

"For the User-Personalization recipe:According to this documentation: https://docs.aws.amazon.com/personalize/latest/dg/recording-events.html#recording-anonymous-user-events:~:text=You%20can%20record%20events%20for%20users%20before%20they%20create%20an%20account.%20This%20allows%20you%20to%20get%20recommendations%20for%20anonymous%20users.%20You%20can%20provide%20the%20sessionId%20as%20the%20userID%20in%20your%20GetRecommendations%20request.It seems like we should be able to query the Personalize engine for a session_id if it has interactions and does not have a user_id. However, when trying this and querying with a session_id, it still returns the high popularity items instead of relevant item recommendations.Is this incorrect, or will it only return relevant items after the user creates an account (e.g. has a user_id in the Users dataset)?Thanks in advanceFollowComment"

Answer: "0If you call the PutEvents API without a userId to send in new interactions for an anonymous user, you can call the GetRecommendations API after 1-2 seconds with the sessionId as the userId to retrieve recommendations that are personalized to the session. Of course, the sessionId from the PutEvents call needs to be the same value in the GetRecommendations API call.If your PutEvents call(s) have a sessionId and userId specified, you must use the userId as the userId in the GetRecommendations call.CommentShareJames_Janswered 8 months agorePost-User-5347235 8 months agoWhen we do a bulk upload from a csv (dataset import job), with interactions having session_ids but no user_ids, is it supposed to be the same way? Or is this functionality dependent upon using the PutEvents functionality? Thanks for your quick responseShareJames_J 8 months agoReal-time recommendations (i.e., where recommendations change in (near) real-time based on new interactions) requires that a campaign (or recommender) be used and new interactions are streamed in via the PutEvents API. This also only applies to specific recipes. Check the docs for details. https://docs.aws.amazon.com/personalize/latest/dg/recording-events.htmlNew interactions uploaded via import jobs (bulk or incremental imports), will only impact recommendations for known users after the model is fully retrained.Share"


Question: Athena SemanticException Partition - Non-Partition Columns

"I am trying to use an Athena table for Config data that is supposed to be partitioned.  The partition is not getting created because of 'non-partition columns'.ALTER TABLE aws_config_configuration_snapshot ADD PARTITION (accountid='444453583253', dt='latest', region='us-east-1')location 's3://config-bucket-444453583253-us-east-1/AWSLogs/444453583253/Config/us-east-1/2023/1/24/ConfigSnapshot/'The error shown in Athena is:[ErrorCategory:USER_ERROR, ErrorCode:SYNTAX_ERROR], Detail:FAILED: SemanticException Partition spec {accountid=444453583253, dt=latest, region=us-east-1} contains non-partition columnsThis query ran against the "cost" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: a9974a89-2ae7-4416-97de-02a6ee5ee5f2The external table syntax is as follows:CREATE EXTERNAL TABLE aws_config_configuration_snapshot (fileversion STRING,configsnapshotid STRING,configurationitems ARRAY < STRUCT < configurationItemVersion: STRING,configurationItemCaptureTime: STRING,configurationStateId: BIGINT,awsAccountId: STRING,configurationItemStatus: STRING,resourceType: STRING,resourceId: STRING,resourceName: STRING,ARN: STRING,awsRegion: STRING,availabilityZone: STRING,configurationStateMd5Hash: STRING,configuration: STRING,supplementaryConfiguration: MAP < STRING,STRING >,tags: MAP < STRING,STRING >,resourceCreationTime: STRING > >)PARTITIONED BY (dt STRING, region STRING)ROW FORMAT SERDE 'org.openx.data.jsonserde.JsonSerDe'WITH SERDEPROPERTIES ('case.insensitive' = 'false','mapping.fileversion' = 'fileVersion','mapping.configsnapshotid' = 'configSnapshotId','mapping.configurationitems' = 'configurationItems','mapping.configurationitemversion' = 'configurationItemVersion','mapping.configurationitemcapturetime' = 'configurationItemCaptureTime','mapping.configurationstateid' = 'configurationStateId','mapping.awsaccountid' = 'awsAccountId','mapping.configurationitemstatus' = 'configurationItemStatus','mapping.resourcetype' = 'resourceType','mapping.resourceid' = 'resourceId','mapping.resourcename' = 'resourceName','mapping.arn' = 'ARN','mapping.awsregion' = 'awsRegion','mapping.availabilityzone' = 'availabilityZone','mapping.configurationstatemd5hash' = 'configurationStateMd5Hash','mapping.supplementaryconfiguration' = 'supplementaryConfiguration','mapping.configurationstateid' = 'configurationStateId')LOCATION 's3://config-bucket-444453583253-us-east-1/AWSLogs/';A similar problem is noted here:  https://repost.aws/questions/QU43lhf9JOSv6Ew6QT5y4fZg/not-able-to-get-the-data-in-query-result-in-the-athena-for-the-aws-config-from-s-3-bucketFollowComment"

Answer: "0Accepted AnswerYour table definition says "PARTITIONED BY (dt STRING, region STRING)"; it's not partitioned by accountid so you can't add a partition containing that column.CommentShareEXPERTskinsmananswered 4 months ago"


Question: How to manipulate SendMessageRequest to add MessageAttribute via Reflection when using SDK 2?

"With Java SDK 1 when sending a message to AWS, we could add a custom MessageAttributeValue after the SendMessageRequest object has been made by calling the addMessageAttributeEntry(String Key, MessageAttributeValue attribute) on the SendMessageRequest object. This could have been done via Reflection.But with Java SDK 2, the implementation of SendMessageRequest has changed and we cannot add a message attribute after the SendMessageRequest object has already been created. We have to create a new SendMessageRequest object, which we cannot. Because we are manipulating the object via Reflection. Also we cannot 'put' a new Entry into sendMessageRequest.messageAttributes() map because it's of type Unmodifiable.FollowComment"


Question: Video Segment analysis and SQS status update

"I am running rekognition video-segment-detection in a notebook using the guideline from https://docs.aws.amazon.com/rekognition/latest/dg/video-analyzing-with-sqs.html. However, the SQS never receives a Jobstatus update. So my task run forever. I used AWS CLI to confirm that the video analysis has succeeded long ago.AmazonS3FullAccess,AmazonRekognitionFullAccess,AmazonSNSFullAccess and AmazonSQSFullAccess have all been granted to the IAM user used to run this script.What could be the reason why the the SNS topic did not update SQS queue when the rekognition segment analysis completed?FollowComment"

Answer: "1Hello PeterCrayonite,I understand that you are using the example code in [1] in a notebook to run a video-segment-detection in Amazon Rekognition. You mentioned that you have granted the IAM user all permissions as stated in step one of Configuring Amazon Rekognition Video [2] and you have used the CLI to confirm that the video analysis was completed successfully. However, the Jobstatus update never gets sent to the SQS queue.You can get the completion status message by subscribing to the topic with an Amazon SQS queue [3] which is supposed to be done for you within the code example [1]. In addition to that you have to create an IAM service role to grant Amazon Rekognition Video access to your Amazon SNS topics, see step 7 in doc [2].Please note, to get the completion status from the Amazon SQS queue, the example [1] tracks the job identifier (JobId) that is returned in StartLabelDetection, and only gets the results for matching job identifiers that are read from the completion status. For simplicity, the example deletes jobs that don't match. Consider adding them to an Amazon SQS dead-letter queue for further investigation [1]. To help your investigation, subscribe to the Amazon SNS topic by email so you can receive the messages that are sent to your Amazon SNS topic in your email inbox [4][5] if you have not done so.I recommend that you open a Support case with AWS Technical Support [6] if this issue persist. The Technical Support team will be able to help you with further troubleshooting of this issue.References:https://docs.aws.amazon.com/rekognition/latest/dg/video-analyzing-with-sqs.htmlhttps://docs.aws.amazon.com/rekognition/latest/dg/api-video-roles.htmlhttps://docs.aws.amazon.com/sns/latest/dg/subscribe-sqs-queue-to-sns-topic.htmlhttps://docs.aws.amazon.com/sns/latest/dg/sns-create-subscribe-endpoint-to-topic.htmlhttps://docs.aws.amazon.com/rekognition/latest/dg/video-troubleshooting.htmlhttps://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlCommentShareAWS-Cebzanswered 6 months ago0Hi PeterCrayonite,Can you please double check whether you are subscribing to the correct topic, etc.? There are also some more details on role setup in https://docs.aws.amazon.com/rekognition/latest/dg/api-video-roles.html. Please check if something is still missing.My guess is still something missing in the setup.Thanks.CommentShareAWS-Ragibanswered 6 months ago"


Question: d3.micro Postgres RDS resetting instance every day

"I have recently created a d3.micro Postgres RDS instance. In the instance I created new database and few tables with data.Problem:Every day, Instance is resetting / deleting the database and all uploaded data.PointersNo details of deletion in logsNo user has manually deleted the newly created database and its dataFollowComment"

Answer: "0Dear Customer,I thank you for reaching out to us via AWS re:Post.I think, to deep dive on the instance issues a support case to the Premium Support Team would help as they can critically analyze the issue and provide you the result.[] Monitoring Amazon RDS API calls in AWS CloudTrail - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/logging-using-cloudtrail.htmlApart from that, I would suggest, checking CloudTrail for any app/unwanted-user triggering the restarts(or maybe some automation) - I sincerely hope I was able to shed some light on the matter for you.CommentShareEXPERTNIRUPAM_danswered 10 months ago"


Question: Regarding the quick sight

Amazon QuickSight supports a variety of data sources that we can use to provide data for analyses.Is there any documentation which tells which data source should be best according to our use case?FollowComment

Answer: "0Hello,You can see the list of supported sources on this documentation page. As for applied best practices and examples of many different use cases, try taking a look at some of the content on the AWS Big Data Blog (with QuickSight tag) hereLet me know if you have any other questionsLoc, Data Architect, AWS ProServeCommentShareLocanswered 2 months ago"


Question: Not able to download the PDF report for my application whose backend is hosted on AWS EC2 Linux Instance.

"Hi AWS,I am working on a fullstack application, where the frontend of the application is written in ReactJS and the backend is in NodeJS. The static files are stored in S3 and is hosted through CloudFront.When I am trying to download the file which is in the PDF format I am able to download it successfully when testing it locally whereas the same is failing when hosted on AWS EC2 Instance.Is there anything which I need to change in terms of EC2 settings for making it work. The issue is similar to this one: https://stackoverflow.com/questions/68507437/downloading-a-pdf-file-in-reactjs-works-locally-but-doesnt-work-on-amazon-ampliPlease help.FollowCommentiwasa EXPERT9 months agoHi, @Arjun Goel.Is the error happening on the frontend or the backend? Can you share the error log etc.?Please share an overview of your PDF report generation code if it's happening in the backend.I think it's either a security issue or a problem with the PDF generation process in the backend.Share"


Question: "Spot fleet specifies that the interrupting behavior is stopped and does not persist, but still loses data"

"We followed the AWS documentation at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/interruption-behavior.htm and https://docs.aws.amazon.com/AWSEC2/latest /UserGuide/stop-spot-instances.html and set the terminate behavior of Spot in the template of Spot fleet to stop. According to the explanation of AWS documentation, it should keep the data persistence and private IP of the root directory unchanged.However, in the model replacement that happened on 2023.1.15, we found that not only has the previous data not persisted, but the private IP has also changed. Please help us to find out the reason.Our Spot-Fleet request id ：sfr-b3e1521c-786e-4372-a15a-e06445a93ceeFollowComment"


Question: AWS API Gateway private integration with mutual TLS

"Is mutual TLS supported with private resource integration in HTTP API gateway?I created HTTP integration that routes traffic into private ALB's HTTP listener. After that I implemented mutual TLS by using this quide:https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/While testing certificate authentication I created second set of certificates and used second set's client key and pem to authenticate successfully against first sets keystore. This is behavior should not be possible. With this configuration api gateway demands, that clients sends certificate and key, but never verifies them against specified truststore. Tested this setup by switching private integration to lambda integration and TLS operated like it should, by verifying the certificate against truststore.How to reproduce:-create HTTP API gateway API with lambda integration (used ANY /)-create custom domain for the API, with mutual TLS enabled and default endpoint disabled-create 2 set of certificates and client keys-TLS should check the validity of the client certificate and prevent mixing certificates between sets-switch lambda integration to private alb integration with HTTP listener-test TLS again by mixing certificates-API gateway accepts mixed certificates-As an side effect in this configuration gateway ignores the default endpoint disable setting and enables bypassing the TLS completely.FollowComment"

Answer: "1As per the doc (https://docs.aws.amazon.com/apigateway/latest/developerguide/rest-api-mutual-tls.html), private APIs don't support mutual TLS.In order to do that, you would need something like: Client -> NLB -> Proxy (to handle mTLS) -> interface VPC endpoint for API Gateway -> private APIYou can have a look at this blog post: https://aws.amazon.com/pt/blogs/aws-brasil/suportando-mutual-tls-mtls-utilizando-certificados-do-icp-brasil-para-o-open-banking-no-brasil-utilizando-o-amazon-api-gateway/, it's in Portuguese but you will see the architecture, and can probably translate.CommentShareJerome VDLanswered a year agoEXPERTPankaj_Areviewed a year agoAWS-User-5658400 a year agoI'm aware that mutual TLS for private API gateways are not supported, but in my case I'm using public API gateway with VPC link. Shouldn't this configuration be supported, as only difference between functional and nonfunctional configurations is to swap lambda integration with VPC link integration?Share"


Question: Amazon POlly - Track must be 44.1 kHz

Amazon PollyWe need the generated audios to be at 44.1 kHz. Can Amazon Polly be configured?FollowComment

Answer: "0You can configure the sample rate, but the supported values depend on the format. Unfortunately none of the formats go as high as 44.1 kHz. From the API documentation:The audio frequency specified in Hz.The valid values for mp3 and ogg_vorbis are "8000", "16000", "22050", and "24000". The default value for standard voices is "22050". The default value for neural voices is "24000".Valid values for pcm are "8000" and "16000" The default value is "16000".CommentShareS_Mooseanswered 2 months ago"


Question: Cloudwatch alarm taking a lot of time with missing data

"We are currently using cloudwatch alarms(PutMedia.Success metric) to give us a notification whenever there is no frame in Kinesis Video Stream.But the state change(from 'ok' to 'alarm') takes around 6 mins. Upon further investigation, we came across a discussion thread where it has mentioned that this is the expected behaviour of cloudwatch alarms in  case of missing data points. Is there any way can we bring the time taken for state change to under a minute? It would be really helpful if you could help us with this. I will attach the discussion thread and screenshot of our cloudwatch configuration with this question. Eagerly waiting for a reply/https://forums.aws.amazon.com/thread.jspa?threadID=284182FollowComment"

Answer: "2Hi there,I am understanding your question as to when the PutMedia.Success metric from (1) has a missing datapoint you would like to trigger the Alarm in a timely manner, please correct me if I'm wrong.General background on CloudWatch Alarm evaluation (2), whenever an Alarm tries to evaluate it retrieves more periods of data actually configured as per datapoints to Alarm + Period configured on the Alarm. For example, if you have configured Period=1min(60s), and Datapoints to Alarm of '1 out of 1' on a Standard metric Alarm - then practically last 1 minute of datapoint is required/used for the Alarm evaluation which is called Evaluation Period. However, from CloudWatch service there is an extension to this function which it retrieves more periods of datapoints required/configured for the Alarm and that is called 'Evaluation Range' which typically the number of period for the Range depends on the type of metric and period it is configured.As explained on (2), with the implementation of Evaluation Range each evaluation has more datapoints required and when the latest datapoints are missing it may or may not be used in the evaluation based on the configuration. Most importantly, CW tends to use Missing Datapoints as less as possible, so when there is enough datapoints required to evaluate the state from Evaluation range then no missing datapoints will be used so in this case Treat Missing Data attributes do not come into the picture if there are enough number of Datapoints to evaluate the state within Evaluation range. When there is not enough datapoints within Evaluation Range, then the Missing Datapoints and TreatMissingData attributes come into the picture. This can be understood effectively from the link (2).So back to your initial question, if the PutMedia.Success do not publish datapoint(missing datapoint) and then you want the Alarm to trigger  - you can utilize metric math FILL() function. Fill function lets you fill the value of a datapoint when the value is missing, so let's say your metric has missing datapoint then if you use FILL(m1,FILLING_VALUE) on the Alarm where FILLING_VALUE is a value that breaches the threshold of your Alarm then this alarm should trigger if 1 out of 1 configuration is in place.I suggest testing this function on a custom metric or dev environment to fully understand how the function is working in your scenario then proceed with deploying to prod environment.Feel free to further discuss by providing alarm configuration details.ThanksCommentShareSUPPORT ENGINEERMunkhbat_Tanswered a year ago1Hey! Thanks for your help! It worked.CommentShareAWS-User-1473903answered a year ago"


Question: SQS Fifo TPS Limit and Solution

"Hi,I am building a service which need a queue for sending message from one service to another service. For this i need a FIFO queue but FIFO queue has a API call limit of 3000/sec and with batch of 10 message i can maximum get 30000 message per second. But my Application need more API Call limit as i need around 50k to 60k message per second.Is this possible by any way that i can achieve this limit with SQS FIFO.Or is there any other solution for this problem?FollowComment"

Answer: "0You can look at using Kinesis Data Streams (https://aws.amazon.com/kinesis/data-streams/) or Managed Kafka Service (https://aws.amazon.com/msk/)Kinesis maintains the ordering of messages per shard and Kafka maintains the ordering of messages per partitionCommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago0If you are using Lambda as the consumer, you can just create multiple queues, all triggering the same function. Distribute the messages between the queues based on some group ID hashing algorithm, so that all messages with the same group ID will get to the same queue.CommentShareEXPERTUrianswered 8 months ago"


Question: DNS changes not propagating

"I have registered a domain through Amazon, added the DNS A records and shoed they work using dig when I specify the name server dig @205.251.198.207 dundeeurc.org  i get an answer however when i dig the google server dig @8.8.8.8 dundeeurc.org i get none.  Suspect the records are not propagating.  I notice that the name servers in the dns config are not the same as those in the whois record.  Anyone know what might be stopping propagation?FollowComment"

Answer: "0Hi,The name servers in your domain registration should match the name servers that Route 53 assigned to your hosted zone. They don't currently match, which I think means that you deleted the hosted zone and later created another one. (Route 53 assigns four new name servers to a hosted zone whenever you create another one.)Here's how you fix that:Get the name servers for your hosted zone. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the domain registration to use the name servers that you got in step 1. See "Adding or Changing Name Servers and Glue Records for a Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlScottCommentShareEXPERTAWS-User-6179575answered 4 years ago0Thanks Scott, spot on about deleting and re-adding the hosted zone.  Just made the changes and worked, thanks so much!CommentShareAlastairBrownanswered 4 years ago"


Question: Where can found SOC 1or 2 report (Jan 1 2021 - Mar 31 2021)

"Our auditor request SOC 1or 2 report (Jan 1 2021 - Mar 31 2021), but I can't found in Artifact, is too old report so hidden  or start from 1 Apr 2021 to Current ?FollowComment"

Answer: "0contact aws support and request service limit increaseCommentShareEXPERTsdtslmnanswered 2 months ago0Hi,Contacting AWS support or your AWS Account Team to request this information would be the way to go.Hope this helps!CommentSharePablo Guzmananswered 2 months ago"


Question: SageMaker serverless inference API

"I am working on a project related to serverless inference API. Getting error while calling the CreateEndpoint API, need some reference or sample code related to serverless inference ?FollowComment"

Answer: "1Accepted AnswerI would suggest to check the AWS Sagemaker serverless inference link and the blog for an example that has flow for ML model deployment:https://docs.aws.amazon.com/sagemaker/latest/dg/serverless-endpoints.htmlhttps://aws.amazon.com/pt/blogs/machine-learning/deploying-ml-models-using-sagemaker-serverless-inference-preview/Following are 2 Github repos:https://github.com/aws/amazon-sagemaker-examples/tree/main/serverless-inferencehttps://github.com/aws/amazon-sagemaker-examples/blob/main/serverless-inference/Serverless-Inference-Walkthrough.ipynbAlso, check the API reference:https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateEndpoint.htmlI hope this provides the reference that you are looking for.CommentShareN_Agarwalanswered 13 days agoEXPERTsdtslmnreviewed 6 days ago"


Question: AMI creation stuck at pending status

"Hello,I'm trying to create an AMI from an EC2 instance, but the creation is stuck at pending status. Could you please help? Thanks much!!ami id: ami-0fd830b5bf57a56ccinstance id: i-0b9423d4375153329FollowComment"

Answer: "0All the sudden, it's OK now, it should take a long time. Sorry about this.CommentShareWei11132020answered 3 years ago0Hello thereThanks for reaching out to forum support.Please note that there is no SLA when it comes to AMI creation. AMI creation involves creating snapshots and snapshot creation time depends on various factors likeIf its first snapshot, it would definitely take longer time.If there are too many changes done at the volume side.Im glad that issue is fixed. Let me know if you have additional queries :)CommentShareAWS-User-7041766answered 2 years ago"


Question: AWS Client vpn connected but cannot access internet

"I have been able to create aws client vpn endpoint also i am able to access servers inside vpc but looks like i am not able to access internet.DNS resolution doesn't work when connected to vpn.one thing is tested is before enabling vpn i copied the IP of lets say amazon.com and when i turned vpn on tried to ping that ip and that was working. so most likely its problem with DNS but don't know to fix it.Here are the screenshotsI get in tunnelblickcode2023-01-04 03:29:44.819311 VERIFY KU OK2023-01-04 03:29:44.819382 Validating certificate extended key usage2023-01-04 03:29:44.819400 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication2023-01-04 03:29:44.819414 VERIFY EKU OK2023-01-04 03:29:44.819427 VERIFY OK: depth=0, CN=server.zenskar.com2023-01-04 03:29:45.616001 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA2562023-01-04 03:29:45.616136 [server..com] Peer Connection Initiated with [AF_INET]34.192.121.223:4432023-01-04 03:29:46.930345 MANAGEMENT: >STATE:1672783186,GET_CONFIG,,,,,,2023-01-04 03:29:46.943423 SENT CONTROL [server..com]: 'PUSH_REQUEST' (status=1)2023-01-04 03:29:47.622919 PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 0.0.0.0,route 10.0.0.0 255.255.0.0,route-gateway 11.0.0.161,topology subnet,ping 1,ping-restart 20,ifconfig 11.0.0.162 255.255.255.224,peer-id 0,cipher AES-256-GCM'Without VPN TableInternet:Destination        Gateway            Flags           Netif Expiredefault            192.168.29.1       UGScg             en0127                127.0.0.1          UCS               lo0127.0.0.1          127.0.0.1          UH                lo0169.254            link#15            UCS               en0      !192.168.29         link#15            UCS               en0      !192.168.29.1/32    link#15            UCS               en0      !192.168.29.1       8c:a3:99:43:d4:c6  UHLWIir           en0   1189192.168.29.3       62:86:e7:b7:95:3   UHLWIi            en0     46192.168.29.41      d6:e3:d9:51:75:9f  UHLWI             en0    325192.168.29.50/32   link#15            UCS               en0      !192.168.29.53      16:c2:44:9f:bd:5c  UHLWI             en0     82192.168.29.130     9e:df:ca:48:30:f1  UHLWI             en0     84192.168.29.223     d6:78:7e:8a:b1:1   UHLWI             en0    934192.168.29.255     ff:ff:ff:ff:ff:ff  UHLWbI            en0      !224.0.0/4          link#15            UmCS              en0      !224.0.0.251        1:0:5e:0:0:fb      UHmLWI            en0239.255.255.250    1:0:5e:7f:ff:fa    UHmLWI            en0255.255.255.255/32 link#15            UCS               en0      !With VPN TableInternet:Destination        Gateway            Flags           Netif Expiredefault            192.168.29.1       UGScg             en010/16              11.0.0.129         UGSc            utun711.0.0.128/27      11.0.0.130         UGSc            utun711.0.0.130         11.0.0.130         UH              utun7127                127.0.0.1          UCS               lo0127.0.0.1          127.0.0.1          UH                lo0169.254            link#15            UCS               en0      !192.168.29         link#15            UCS               en0      !192.168.29.1/32    link#15            UCS               en0      !192.168.29.1       8c:a3:99:43:d4:c6  UHLWIir           en0   1200192.168.29.3       62:86:e7:b7:95:3   UHLWIi            en0   1168192.168.29.41      d6:e3:d9:51:75:9f  UHLWI             en0    247192.168.29.50/32   link#15            UCS               en0      !192.168.29.53      16:c2:44:9f:bd:5c  UHLWI             en0      4192.168.29.130     9e:df:ca:48:30:f1  UHLWI             en0      6192.168.29.223     d6:78:7e:8a:b1:1   UHLWI             en0    856192.168.29.255     ff:ff:ff:ff:ff:ff  UHLWbI            en0      !224.0.0/4          link#15            UmCS              en0      !224.0.0.251        1:0:5e:0:0:fb      UHmLWI            en0239.255.255.250    1:0:5e:7f:ff:fa    UHmLWI            en0255.255.255.255/32 link#15            UCS               en0      !```FollowComment"

Answer: "1See this documentation; specifically this section:  Scenario #2: Split-tunnel with the "DNS Server IP address" parameter enabledhttps://aws.amazon.com/premiumsupport/knowledge-center/client-vpn-how-dns-works-with-endpoint/Also, please note below from the documentation:Routing considerationsWhen you enable split-tunnel mode, all the routes in the Client VPN endpoint's route table are added to the client's route table when the VPN connection is established. This operation is different from the default behavior, which overwrites the client's route table with the entry 0.0.0.0/0 to route all traffic over the VPN.It is not recommended to add a 0.0.0.0/0 route to the Client VPN endpoint's route table when using split-tunnel mode.From your screenshots I see that you have Split tunnel enabled as well as 0.0.0.0/0 route added which is not recommended.Lastly, you seem to have setup DNS server as 10.0.0.2 which looks correct (VPC CIDR +2); when you are connected to the ClientVPN is the client machine able to ping the DNS server?CommentShareEXPERTTushar_Janswered 5 months agorePost-User-4511260 5 months agoHi Tushar, thanks for the help. even when i disable split tunnel the case is same and it doesn't connect to internet. I will check if i am able to ping 10.0.0.2 as dns serverSharerePost-User-4511260 5 months agoI just tested i am not able to ping the dns server 10.0.0.2 though i am able to ping 8.8.8.8. so something is wrong with my dns server in vpc?Share1Once connected to VPN, can you ping / telnet/ ssh any machine in your VPC ? IF yes, that means connectivity over tunnel is working fine.Start with troubleshooting with these commands.dig www.google.comnslookup www.google.comit will confirm if DNS is reachable or not.Some time problem is where system OS prefer locally network interface configured DNS server instead VPN pushed DNS server, but since traffic is going to tunnel, it cant reach local DNS server which will be 192.168.x.x in your case and fails.its been discussed herehttps://docs.aws.amazon.com/vpn/latest/clientvpn-user/linux-troubleshooting.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/client-vpn-fix-dns-query-forwarding/CommentShareMuhammadanswered 5 months ago"


Question: Full Screen on Single Monitor Only (Dual Monitor Setup)

"I did a search on the forums and on Google, but did not find an answer. But I have a question from my users for which I cannot find a way to achieve.On a Windows 10 PC, with multiple monitors attached, there is an option in the Workspaces client application to "Enter full screen on all displays", but not for a single display. I have users that would like their workspace to be full screen on only one of their two displays. Is this possible via a config file or anything, since it's not an option via the menus or application settings?Thanks.FollowCommentFrank Dux 7 months agoI still having the same problem, does anyone from AWS knows how to fix this frustrating thing !Share"

Answer: "0Hello,I have a laptop with 2 monitors so 3 monitors overall. When I hit CTRL _ ALT _ ENTER, the Workspace goes to the 2 external monitors instead of just 1. Is there a way to just have the Workspace on 1 of the 2 external monitors?Thank you,CommentShareRRPVTSanswered 2 years ago0As work around you can hide the task bar in the second display, is less annoying 😉CommentShareFrank Duxanswered 7 months ago-1Press CTRL_ALT_ENTERCommentSharezblazeranswered 2 years ago"


Question: How to connect AWS RDS by using AWS Gamelift?

I try to do real-time game by AWS Gamelift. I don't know how to connect to AWS RDS with lambda when the game initialize to get the data of AWS RDS and save the client's data when one player  sends data to other players.FollowComment

Answer: "0To read data from RDS from Lambda, you could use AWS provided libraries and methods. For instance if you are using Python boto3 would be the library that you could use. Here is some reference instructions and code that would help you read from RDS using a Lambda - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Connecting.Python.htmlCommentShareAnanth Tirumanuranswered 8 months ago"


Question: "Copy from multiply files, DIST KEY matters?"

"I ve read that when copying from s3 multiply files using single COPY command Reshift takes advantage of processing data in parallel and sending data to different slices. But if my table has DIST KEY set up, does it matter if files themself are splitted by DIST KEY value? or it will not affect the performance and data can be mixed in the files?FollowComment"

Answer: "0Accepted AnswerToebs2 is correct in that you can't control with file with a single DISTKEY value in it will be processed by which slice because Redshift doesn't expose it's hashing algorithm and mapping algorithm that maps a some function of the hash value (probably some form of a MOD() function) onto which slice in the ring of slices.Other analytic column-stores like Vertica expose this information and therefore support data loading optimization with a direct node (or slice) assignment of files to COPY commands.However, pre-splitting the files to load will have an impact on performance.  I just can't say whether it is a positive or negative impact or if the impact varies due to other factors.  There are a lot of variables that influence whether benefit is positive or negative for any given workload.Consider a general case where there is one input file to the COPY command containing a large set of DISTKEY values that will distribute rows to all slices.  That file gets assigned to one slice to process.  That slice, let's call it the "initiator slice", must perform the following steps by itself:Perform all the file reading of the input.Parse all the input from the input format, probably something like delimited text lines, into records and validated field data types using the information in the COPY command.Compute the DISTKEY of each record, a hash in this case.Compute the mapping of the DISTKEY hash onto the slice ring to determine which slice will store that row.Buffer that record for the target slice.Send buffer(s) of records to the slice over the cluster interconnect network to all other slices.All slices must perform the following steps independently, including the "initiator slice" that does all the above work (hopefully the "initiator slice" takes a memory mapped network buffer short cut to mitigate some of the cost of asymmetric workload it's performing for the COPY command):Receive buffers of records to store locally.Convert that data to Redshift columnar blocks.Write columnar blocks for all records it receives.The above shows how the workload for one file with a large set of DISTKEY values in a COPY command results in an asymmetric workload where the "initiator slice" does the lion's share of the work compared to the target slices.Now it should be rather obvious that work pattern for a COPY command that only processes a file containing only one DISTKEY value degenerates into the "initiator slice" only needing to send network buffers to one target slice.  Overall, this will reduce the workload on the "initiator slice" but increase the workload on the single target slice.  So, this may likely have an reduction in throughput WRT to this one file to process because only one network path is exercised and only one slice is doing all the block formatting and writing.However, there are other cluster wide considerations.  The ultimate general case cap on a many file COPY command where every slice gets one or more files to process and is every slice processing an input file and sending record buffers to every slice (the hard work) PLUS every slice receiving record buffers from every other slice.  In effect, a full mess cluster communications task which has the tendency to put a high load if not saturate the cluster interconnect network.Now, if we pre-split all the input data down to one DISTKEY value per file it's easy to see while the load on the "initiator slices" is reduced because it only has to communicate with one target slice and the load on each target slice is increased, the overall load on the cluster interconnect network has gone down.  Maybe this brings that cluster interconnect load down below the saturation point, and if not saturated frees capacity on the cluster interconnect network to process inter-slice communication from other concurrent statements, even other concurrent COPY commands.  Also the reduced "initiator slice" workload also frees up node local resources, like CPU, memory, and cluster interconnect network bandwidth for the slice to process work from other concurrent statements too.  So, maybe the overall cluster throughput can increase.Only a real world benchmark with real data and a real SQL workload will tell the story as to whether pre-splitting input files for COPY command(s) will have a statement level or overall cluster throughput level improvement or degradation in performance.As always "your mileage may vary".  ;-)I hope this helps to break down and explain where the work of the COPY command is distributed across the cluster and how it impacts the cluster and slice level resources.Regards,-KurtCommentShareklarsonanswered 4 years ago0It could matter, but you have no control over it, so it doesn't help you.So, imagine you have ten slices and your distkey column has 10 values.  Let's also imagine one distkey value goes to one slice.So if we have a single file with all data, that's loaded by a single slice, which then distributes the rows.Now imagine we have ten files, each with only one distkey value.This would be great if you could ensure the correct file was loaded by the correct slice.However, you can't.  You don't know which slice will get which distkey value, and you don't know which slice which load which file.So each slice will load a file, and there's a 1 in 10 chance a slice will load its own file, and so the other 9 slices will redistribute their rows to the other slices.CommentShareToebs2answered 4 years ago"


Question: "S3 cp with transfer acceleration error:  Host override cannot be combined with Dualstack, FIPS, or S3 Accelerate"

"I setup AWS S3 acceleration in one of my buckets, mybioinformaticsm and use S3 acceleration to upload a big file from local to S3, as in a following command;aws s3 cp /Volumes/Documents/R/BM/bm.int s3://myawsbioinfo/bm.int  --region us-east-2 --endpoint-url https://myawsbioinfo.s3-accelerate.amazonaws.comIt used to work until recently. When I use this command, it failed with a following error message;Host override cannot be combined with Dualstack, FIPS, or S3 AccelerateI have not set up Dualstak and am not sure about FIPS. At this point, I would really appreciate any input on this.FollowComment"


Question: Chime Restricting Users remove restrictions

"Hello AWS,I have an PBX and I want to resisted a toll free Phone number with Chime. When I go to Phone number management in AWS Chime and than I go to the Orders tab and I click on the button called 'Provision phone numbers' I than chose 'Voice Connector' and In type I chose toll free and I press the search bar I get an error message that is writing : «Your service has been restricted. If you feel like you have received this message in error, please submit a support request in the upper right with the category “Voice Calling”.».I understand I use the free tier plan and I still plan to use it and I am very careful with AWS fees and pricing. I am also very familiar with Azure and Azure doesn't resisted anything.I was wondering how can I remove the restriction of my account?Thanks for helping me.FollowComment"

Answer: "0I'm sorry this impacted you. This generally happens on accounts with limited billing history (new accounts). Submitting the support request from the console is the way to have the restriction removed.This limitation is just a part of the fraud protection on PSTN calling. (It protects both you and AWS.) After you submit the request, unless there are other concerns with your account, it may take about 3 business days to complete.CommentShareDougLanswered a year agoAWS-User-3620630 a year agoThanks but, how can I Submitting the support request from the console? ThanksShare"


Question: Possible/Worth-it merging different AWS accounts into one AWS Organisation

"Current situation: We have multiple AWS accounts, one per customer to make use of the free tier.Question: Would it be possible in the future to merge these different AWS accounts into one AWS Organisation? being each AWS account an Organizational Unit.The main reason to keep them separate at the beginning would be to make use of different free tiers.Reasons to put them later together into one AWS Organisation are Consolidated Billing (once the resources in each account are bigger) and easier management.Also interested in hearing reasons to put them (or not) all in one accountFollowComment"

Answer: "1Accepted AnswerHi ThereYes you can take advantage of AWS Organizations and consolidated billing by creating a new organization and inviting the accounts as members.  You can create OU's to apply similar Controls and Policies to groups of accounts.I would suggest getting started by creating a new account that will be used as your new Management account, and deploy Control Tower..  You can then invite each account to the Organization and enroll into Control Tower.Please check out the Multi Account Strategy Whitepaper for benefits of using Organizations and multiple accounts.√ If my answer addressed your question adequately, please consider clicking the ACCEPT button.  It helps the community find answers to similar questions more quicklyCommentShareEXPERTMatt-Banswered 8 months agojrv_usc 8 months agoThanks Matt-B for the fast reply! 2 follow-up questions:when I "invite the accounts as members" will they keep all their cloud services (EC2s, ...)?when they are part of the organisation will they lose their independent free-tier? and all the accounts in the Organisation will have one shared free-tier right?Btw Control Tower looks very interesting.ShareMatt-B EXPERT8 months agoWhen you invite an account to an organization, Organizations will create a service linked role in the account and all charges instantly become the responsibility of the Management account.  All of your EC2 instances, S3 buckets, etc are not disturbed.  See https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_invites.htmlFrom https://aws.amazon.com/free/free-tier-faqs/  If you are linked to an Organization (under AWS Organizations), only one account within the organization can benefit from the Free Tier offers. To calculate the Organization’s use of AWS Services under any Offers, we will aggregate the usage across all accounts in the Organization.Share"


Question: How to make proxy for http long polling requests using AWS Gateway API and HTTP_PROXY?

I am using an external api in which the client side fetches data from backend using HTTP long polling. For this is there special way of setting up the gateway? Currently I tried making a endpoint which matches my backend API using HTTP proxy integration.FollowComment


Question: /api/auth/login Lambda@Edge failing with "secret" is required on AWS Amplify

"I am deploying next.js application with auth0 authentication onto AWS Amplify. This is working on localhost as expected.I created "Environment variables" with AUTH0_SECRET and others in the amplify App Settings, and I am able to authenticate and it is working fine. Suddenly after one of the deployment, I keep getting this error. I redeployed older version, error did not disappear.I believe it is not the app issue, it is something to do with Amplify settings as previous deployment also stopped working.Browser Error503 ERRORThe request could not be satisfied.The Lambda function associated with the CloudFront distribution is invalid or doesn't have the required permissions. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.Logs:ERRORInvoke Error {    "errorType": "TypeError",    "errorMessage": "\"secret\" is required",    "stack": [        "TypeError: \"secret\" is required",        "    at Object.get (/var/task/node_modules/@auth0/nextjs-auth0/dist/auth0-session/get-config.js:147:15)",        "    at Object.getConfig (/var/task/node_modules/@auth0/nextjs-auth0/dist/config.js:66:38)",        "    at Object.initAuth0 (/var/task/node_modules/@auth0/nextjs-auth0/dist/index.js:22:23)",        "    at getInstance (/var/task/node_modules/@auth0/nextjs-auth0/dist/index.js:18:24)",        "    at handleAuth (/var/task/node_modules/@auth0/nextjs-auth0/dist/index.js:124:18)",        "    at Object.5862 (/var/task/pages/api/auth/[...auth0].js:214:129)",        "    at __webpack_require__ (/var/task/webpack-api-runtime.js:25:42)",        "    at Object.7416 (/var/task/pages/api/auth/[...auth0].js:189:23)",        "    at __webpack_require__ (/var/task/webpack-api-runtime.js:25:42)",        "    at __webpack_exec__ (/var/task/pages/api/auth/[...auth0].js:325:39)"    ]}for debugging, I printed the secret using console.log and I am able to see it.Reproductionmy [...auth0].jsimport { handleAuth } from '@auth0/nextjs-auth0';console.log('the AUTH0_SECRET env var is set: ', !!process.env.AUTH0_SECRET);export default handleAuth();EnvironmentPlease provide the following:Version of this library used:"@auth0/auth0-react": "^1.9.0","@auth0/nextjs-auth0": "^1.7.0","axios": "^0.26.1","jsonwebtoken": "^8.5.1","next": "latest","react": "17.0.2","react-dom": "17.0.2","react-is": "^18.0.0","swr": "^1.3.0",FollowCommentaxelmukwena 6 months agoDid you ever find a workaround?Share"


Question: "Trigger lambda only on S3 object create, but not to trigger on override"

"We had a use case to trigger the AWS Lambda from S3 for the objects which are created for the first time. We don't want the lambda to be triggered for the object overrides.  I checked the documentation for S3 POST and PUT, both looks similar.FollowComment"

Answer: "1Accepted AnswerThere's no particularly easy way to do what you want to do here. PUT/POST events both send out events for object creation even when they are replacing existing objects.You could enable versioning on the bucket and detect (by looking at the object metadata) whether there is a new version that has just been uploaded. But it would mean that you'd have extra copies of objects in the buckets. Those could be deleted using lifecycle rules but it's extra work to do.Even more work would be to maintain a database which holds a list of existing objects; the Lambda function would check to see if this is a replace operation rather than a "proper" creation and stop running as appropriate.That said, if you already have a database (or list or something) which you're trying not to populate with additional data when the objects are replaced then maybe you could query that? If the object doesn't exist in that store then it is new; otherwise it is a replacement.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: Does Amplify outbound bandwidth fall under the new 1TB/month Free Tier Data Transfer Expansion announced for CloudFront?

"Last month, AWS announced an expansion of the data transfer free tier for CloudFront to 1TB/month and removed the restriction to the free tier being in the first 12 months after signup.  Will the pricing for AWS Amplify change to account for this difference?  AWS Amplify users are now at quite a pricing disadvantage as compared to using the unbundled versions of the underlying AWS services.FollowComment"

Answer: "0No, 1TB/month Data Transfer Free Tier only applies to CloudFront service and any traffic leaving CloudFront. AWS Amplify has different pricing, different billing dimensions, and it has its own Free Tier limits: https://aws.amazon.com/amplify/pricing/ (check pricing examples at the bottom of the page)Amplify doesn't have the same data transfer usage and charges like EC2 or CloudFront. There is "traffic served per month" pricing dimension instead, which has its own Free Tier limits.I hope this helps.CommentShareEXPERTNataliya_Ganswered a year ago"


Question: Please add TLD .game to Route 53

"Hello,We are a gaming company and would greatly appreciate if you added the top-level domain .game to Route 53.Thanks in advance,LeoFollowComment"

Answer: "0Hello, thank you for reaching out.I understand that you are requesting for addition of ".game" to TLD list.Route 53 Domains is currently directly accredited with .com, .net, and .org registries. All other TLDs are provided via third party registrar associates. To improve our level of service and support, we are actively working to become directly accredited with all other TLDs.In addition to improving our existing offering, we will become accredited with other registries to expand our TLD catalog. This work is currently in progress, and rest assured I have added your TLD request in there as well. Please note that we do not currently have dates to share for adding new TLDs.I recommend subscribing to https://aws.amazon.com/about-aws/whats-new/2022/ and filtering for "Networking & Content Delivery > Amazon Route 53" for updates specific to Route 53.Additionally, please feel free to reach out to your account management team or technical account manager who can also help create a feature request on your behalf.CommentShareSUPPORT ENGINEERYash_Canswered 8 months ago"


Question: How to find list of static IPs that are not connected with any instance yet added

I had few Lightsail instances connected with static IPs. I deleted those instances without deleting static IPs. I understand static IPs that are not connected to instances will incur cost. So I need to ensure that static IPs are deleted.FollowComment

Answer: "0You can find them in the VPC console, under "Elastic IPs".  Look for ones that aren't Associated with any resource.CommentShareEXPERTskinsmananswered 4 months ago0Static IPs can be viewed in the Networking tab. Static IPs not attached to an instance will display a warning that they are not currently in use.You can learn more about static IPs in Lightsail here.CommentSharejsctaanswered 4 months ago"


Question: 30 day limit - Delete an Organization with Many Accounts

"Hello,We are trying to close an Organization account. It has about 15 sub accounts. We are not allowed to delete the Organization until all the accounts have been delete, but we are only allowed to delete 2 accounts every 30 days. That will take half a year to remove these accounts.How can we remove the closing account limit?FollowComment"

Answer: "0Hi ,AWS have a closing account quota of 10% of your total running accounts per 30 days. As a default, you were only able to close 2 accounts from your existing 15 .To resolve this , you could raise an exception request via the AWS support in the console to close the additional accounts beyond the limit that you have.Steps: Console->AWS Support->Create Case->Account & Billing Support-> Type:Acccount -> Category: Close/Cancel My AccountHope this helps, cheers.CommentShareAWS-Vincentanswered a year ago0This was the answer from support"★ Unfortunately, this limit for percentage of active member accounts in an organization that can be closed within a 30 day period, is a default limit and cannot be increased further on request.https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_limits.htmlI apologize for the inconvenience this has caused you. I appreciate your understanding on this issue.Due to AWS security policies, we will not be able to perform any account specific tasks on your behalf. "Not working so make up your mind, or remove this stupid and useless ruleCommentSharerePost-User-8837823answered 5 months ago"


Question: Cognito preferred_username and access tokens

"I've got a Cognito User Pool set up that has the preferred_username set up to work correctly as an alias for username. This means that I can have users - local and federated - able to change their "preferred_username" value and it all works correctly, including ensuring that the values are always unique. It also means that I can use admin-get-user by username and it matches across both fields, and all is good. So far - fantastic.However, it seems that when I have a user authenticate, neither the Access Token nor the ID Token contains the "preferred_username" field. They do contain the "username" but this is the original one and not the new value if it's been changed.My desire is to have an API home document that, if the API call is authenticated, contains a link to the Users resource for the user. And ideally that link would be by preferred_username if set - the same way that admin-get-user works.Am I right that the only way to do this is to get the "username" from the access token, and then make a subsequent API call to get the user details in order to determine the "preferred_username" value? Or is there some way to have the Access Token or ID Token contain the "preferred_username" value?CheersFollowComment"

Answer: "0Hey,Not sure what language or setup you are using here but can you check to see if the claims returned in the authenticated user has the info you need?ThanksCommentShareGrayNiallanswered 5 months agograhamcox82 5 months agoHi there,I've already checked and they don't. They have the username field, but if there is a preferred_username set then this isn't present.What I'm not sure about is if there's some way to configure things so that it is present, or if it's just not an option.CheersShare"