Question: How to add tag for My Terrain in LY 1.24?

"How to add tag component for My Terrain in LY 1.24.0? 😕I want detect my terrain by Raycast Script Canvas but I can not add tag to terrain, I searched a lot 🧐  but It is not possible for add my tag to terrain 😳 🏴Is there a way to tell me? If it is not possible , IT IS BIG PROBLEM FOR MY 3D VISUALIZATION PROJECT 😭Follow"

Answer: "0Accepted AnswerHi AhmadKarami,Got some feedback from the dev team, see below.on StarterGame using TerrainDataRequesttake a look at Gems\StarterGame\Characters\Assets\ScriptCanvas\CharacterAudio.scriptcanvasin particular GetMaxSurfaceWeight, from which he can Extract Properties and get the Surface Typeneeds to configure the terrain surface types in libs\MaterialEffects\surfacetypes.xmlLet us know if this works!SharerePost-User-8164888answered 3 years ago0---Update 01---I did raycast on terrain without tag , result is null 😕 💔for entities had collider, result is name entities ✅SharerePost-User-8224505answered 3 years ago0[quote="lmbr_Saulty, post:3, topic:9116"]Let us know if this works![/quote]Thank you 🙏 🙂  sure , I download Lumberyard 1.25.0 Tomorrow and I test soon... ✅SharerePost-User-8224505answered 3 years ago0I could be misleading here because I am not a dev, but there should only ever be one level terrain component in your hit result if terrain is hit. If all you want to know is if terrain was hit you should be able to get it by type in the result. Tags are useful when you are trying to find components/entities in a list of same components/entities.Lmbr_Saulty's answer is the next step and will get you surface information for the properties of the terrain layers, if that is what you want.SharerePost-User-6034607answered 3 years ago0@REDACTEDUSER1- Terrain Object The ground on which the player can walk/run(That can NOT be destroyed)2- Terrain entities like grass, trees , etc (That can be destroyed)This feature is an introduction to a script canvas open world game with destructibility 😉SharerePost-User-8224505answered 3 years ago0I understand. However, there is an important distinction. Although you may have entities that you logically refer to as terrain entities, the word terrain has a specific meaning in the context of Lumberyard. If refers to a type of level component, and there should only ever be one in the level.You can test for the Legacy Terrain level component any number of ways in your RayCastHit result. A simple fast way is in the Script Canvas mentioned above, keep the terrain EntityID as a variable in the script and test for equality. You could also use the EntityID in the hit result to try to determine the type if you prefer to make the script canvas a bit more hands off.EDIT: Maybe I didn't understand. I see you wrote "Objects on the ground that can NOT be destroyed". These are entities you call terrain objects because they sit on the ground (terrain component) and can be traversed, correct? You can differentiate these objects by giving a unique tag for objects or a property that defines whether they are destructible, and calling their destruction function when they are hit by a ray.  Or you could try doing something clever with the EBus, where you send out a destruction event, but I'm not sure how performant this scenario might be if you have a lot of destructible entities.SharerePost-User-6034607answered 3 years ago0[quote="microAMZN, post:7, topic:9116"]EDIT: Maybe I didn’t understand[/quote]@REDACTEDUSERin unity , when you want delete/destruct trees on the terrain , It is interesting to know that terrain are also destroyed along with trees 😉 Then the player is not the ground on which to walk or run 🙂 I mean, the terrain should not be destroyed, I hope my explanation was sufficient and useful.SharerePost-User-8224505answered 3 years ago0[quote="microAMZN, post:7, topic:9116"]. I see you wrote “Objects on the ground that can NOT be destroyed”.[/quote]Yes, of course , also you can not destroy road or river on the terrain 🙂 Unless changeable C++/Lua/Script Canvas API voxels are destroyed during the game(Edit terrain in run time game), such as a diversion of the river in a major world war, or roads being bombed in the game.SharerePost-User-8224505answered 3 years ago"


Question: Connect on-premises app to RabbitMQ

I'm building two RabbitMQ clusters in two AZ in the same VPC. I need to have an application running on AWS to connect to RabbitMQ. How can i integrate them? I don't want to have the traffic going through public internet.FollowComment

Answer: "0Access to the RabbitMQ cluster from EC2 for applications in the VPC does not go out to the public Internet.AWS service-to-service communication does not access the public Internet as described in the following document.Q. Does traffic go over the internet when two instances communicate using public IP addresses, or when instances communicate with a public AWS service endpoint?No. When using public IP addresses, all communication between instances and services hosted in AWS use AWS's private network. Packets that originate from the AWS network with a destination on the AWS network stay on the AWS global network, except traffic to or from AWS China Regions.In addition, all data flowing across the AWS global network that interconnects our data centers and Regions is automatically encrypted at the physical layer before it leaves our secured facilities. Additional encryption layers exist as well; for example, all VPC cross-region peering traffic, and customer or service-to-service Transport Layer Security (TLS) connections.https://aws.amazon.com/vpc/faqs/?nc1=h_lsCommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: AWS VPN Client - iOS authentication options

"Hi all,We are migrating from legacy remote access solution to AWS VPN Client solution, and we have come across some architectural challenges.I was wondering if someone maybe came across challenges or knows what direction I should look.At the moment we are using OpenVPN as our remote access solution to access resources in AWS accounts. We have an OpenVPN server hosted in private subnet that end users can access using OpenVPN clients on  MacOS, Windows and iOS devices.To improve our security, we made a decision to migrate our remote access solution to AWS VPN Client.  This will allow us to use our existing Azure Active Directory as authentication and authorization backend by using AzureAD as SAML Identity Provider for AWS VPN Client.Users will be able to install AWS VPN Client on their devices, login to AWS VPN Client endpoint and then login using Azure AD including MFA.This has been working smoothly for both MacOS and Windows devices. However we also have several developers that work on creating mobile applications and they have a requirement to use iOS device to connect via VPN.Unfortunately, AWS VPN Client is not available for iOS devices. It is possible to use OpenVPN Client on iOS to login to AWS VPN Client endpoint, however SAML Authentication is not supported for this scenario. We have already enquired about this issue with AWS Support and we had a confirmation that SAML federation is not supported when using iOS.This means we can’t use SAML and we are left with two other options for authentication for this scenario :Mutual authentication with certificates.  This solution assumes distribution of certificates to the clients. While this may work, this is suboptimal for us as this assumes that joiners and leavers procedures will need to be duplicated as separate set of credentials would be used.AWS Managed AD or AD Connector. If we can  synchronize subset of  AWS Managed AD from the our current Azure AD , that would suit us perfect as this would mean we still have one identity store.The questions I have is related to the second solution, i.e using AWS Managed AD.Is it possible to have identities sync between Azure AD Managed AD and Azure AD? I could not find any guides or examples  for this scenarios. Most examples are describing on prem or EC2 based AD sync using AD Connect or Azure Passthrough authentication, none of these apply to our case.If this is not possible, what are the possible ways to solve our problem to ensure we don’t have a separate identity store like I described for the case with mutual authentication?FollowComment"

Answer: "0Hello Team,From your query I understand you wish to know if there's a way to use Azure AD users and groups with your AWS MAD under a single identity.You can create a 'Trust' from your Azure AD with your AWS managed AD. You just need to ensure that connectivity in the backend is in place.AWS Managed Microsoft AD supports all three trust relationship directions: Incoming, Outgoing and Two-way (Bi-directional). You can choose them as per your use case.However the trust relationship between Azure AD and AWS managed AD needs to be checked after initiating a trust relationship from Azure AD side only as trust relationship always initiated from on-premise side and get completed on AWS side. I did not find any such use case in our repository and also I can't test this setup on my end due to limitation on setting up Azure AD environments like yours.The following are the prerequisites to setup the domain trust between AWS Managed AD and Ms Azure :Azure Active Directory Domain Services (Azure AD DS) , using self-managed AD DS domain which support AD domain / forest trusts [1]VPN connectivity between AWS VPC and Azure [2]Inbound and outbound rules in security groups allowing traffic between the two networksI would also like to clarify that Azure AD lies out of scope of AWS Support and I'm providing these details on best effort basis only. For the links which are not provided from AWS are considered third party information only.Hope you understand. We highly value your cooperation and support with us.Thanks again for reaching out to us! Looking forward to hearing from you.Have an AWSome day ahead!References :[1] https://docs.microsoft.com/en-us/azure/active-directory-domain-services/compare-identity-solutions[2] https://blogs.technet.microsoft.com/canitpro/2016/01/11/step-by-step-connect-your-aws-and-azure-environments-with-a-vpn-tunnel/[3] Creating a trust relationship : https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_setup_trust.html[4] Tutorial: Create a trust relationship between your AWS Managed Microsoft AD and your self-managed Active Directory domain : https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_setup_trust.html{+} https://aws.amazon.com/blogs/database/integrate-amazon-rds-for-sql-server-db-instances-with-an-existing-active-directory-domain/{+} Video Tutorial : https://www.youtube.com/watch?v=SIBCi76wspQ&ab_channel=AmazonWebServicesCommentSharerePost-User-4749360answered 2 months ago"


Question: Device Farm: Run stuck on a pending/stopping device forever

"I started two runs on the Google Pixel 6 Pro (Unlocked) device and I had to stop them, I mean, I clicked on the "Stop run" button in the AWS Device Farm console.To my surprise, after many minutes without changing the status, both runs are still "Stopping".One of these devices finished the tests correctly but was unable to Tear Down and finish, so I had to hit "Stop Job" but even so, it is still "Pending".Can anyone help me?What is the implication of this platform failure on my minutes billing?FollowComment"

Answer: "0Thank you for reaching out us regarding the above query. I would like to share that, in order to answer your question, we require details that are non-public information such as Device specifications and corresponding logs further, we would need to check the configurations using our internal tools. Hence, I would request you to kindly open a support case with AWS using the following link.Also, as a gentle reminder, kindly refrain from sharing account information, device ARN and account ID on public forums to protect the privacy and security concerns of your account.  Please feel free to get back to us via a support case and we would be delighted to assist you further.Stay safe and have a great weekend ahead!!CommentShareSUPPORT ENGINEERSubhayu_Manswered 7 months ago"


Question: Request to allow .re TLD Transfer to Route 53

"Hi there,I'd like the ability to transfer domain to Route 53 with TLD as ".re".FollowComment"

Answer: "1Hello, thank you for reaching out.I understand that you are requesting to allow .re TLD Transfer to Route 53Route 53 Domains is currently directly accredited with .com, .net, and .org registries. All other TLDs are provided via third party registrar associates. To improve our level of service and support, we are actively working to become directly accredited with all other TLDs. In addition to improving our existing offering, we will become accredited with other registries to expand our TLD catalog. This work is currently in progress. We do not currently have dates to share for adding new TLDs.You can monitor the updates here at AWS Blogs - https://aws.amazon.com/blogs/aws/ and what's new on AWS - https://aws.amazon.com/new/CommentShareSUPPORT ENGINEERAnsh_C answered a year ago"


Question: Using Amazon SES for phishing simulation campaign

"Hello,For my work, I need to simulate phishing attacks with my clients. This is an activity that I am contractually authorized to do. I have several questions regarding the use of Amazon SES and its services:Is such activity allowed by Amazon SES (knowing that the account will never be used to send spam to anyone other than those designated by the client company)?Is it possible to have a dedicated IP address even for a low volume of email (it is necessary to have a fixed dedicated IP so that customers can whitelist this IP in their corporate email anti-spam system)?Won't sending few e-mails be a problem for the delivery of the messages (it doesn't matter if the message takes a few minutes to arrive, as long as it arrives)?Amazon blocks SMTP port 25 on EC2 instances by default.If it is not possible to use the SES service, is my activity allowed and legal to allow the unblocking of SMTP port 25 on my EC2 instance that will be responsible for sending the phishing campaign simulations to my customers?Thank you !FollowComment"

Answer: "0Hello! As stated on the AWS Penetration Testing page [1], "Customers seeking to perform Simulated Phishing campaigns must submit a Simulated Events form for review. "Here is a link to this Simulated Events form [2]For the whole workload as you mentioned, does you customer know the account ID(s)? If so, you can add this to the form and this should allow your customer to continue to run the phishing simulations.Links: [1] - https://aws.amazon.com/security/penetration-testing/ [2] - https://console.aws.amazon.com/support/contacts#/simulated-eventsCommentSharerePost-User-2054795answered 3 months ago0It is not possible to simulate phishing using SESInternet service providers don't distinguish complaints for simulated phishing from real phishing, which means that simulated phishing by one customer negatively affects the deliverability for all SES customers.Please review: https://docs.aws.amazon.com/ses/latest/dg/faqs-enforcement.html#e-faq-miTypical problems include, but aren't limited to, the following:Your sending violates the AWS Acceptable Use Policy (AUP).Your emails appear to be unsolicited.Your content is phishing related (this includes simulated phishing).Your content is otherwise associated with a use case that Amazon SES doesn't support.CommentShareJesse_Tanswered 3 months ago"


Question: RDS certificate bundle is no longer trusted by MacOS Catalina

"So we're trying to SSH tunnel into a DocumentDB instance, which enforces using the new CA bundle and TLS (And we'd always want to use TLS). The problem we have is the new certs were made after June 2019, which means they're subject to the new cert validity rules (if the cert isn't in MacOS's trust store). This is a maximum validity of 825 days, the RDS certs are 5 years which is over this. https://support.apple.com/en-gb/HT210176 So anytime we try to connect from our laptops, it ends up failing with this error from the mongo-shell.2020-03-19T15:38:20.802+0100 E  NETWORK  [js] SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_CERT_SUSPENDED; connection rejected2020-03-19T15:38:20.803+0100 E  QUERY    [js] Error: couldn't connect to server 127.0.0.1:27017, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_CERT_SUSPENDED; connection rejected :connect@src/mongo/shell/mongo.js:341:17@(connect):2:62020-03-19T15:38:20.806+0100 F  -        [main] exception: connect failed2020-03-19T15:38:20.806+0100 E  -        [main] exiting with code 1If other OS's like Linux start enforcing this it could potentially break a lot of things? Is it possible to get a shorter lived certificate for this bundle? or cross sign it with the Amazon Root CA's?FollowComment"

Answer: "0Please see: "What if I’m having issues connecting directly to my Amazon DocumentDB cluster from Mac OS X Catalina?" here: https://docs.aws.amazon.com/documentdb/latest/developerguide/ca_cert_rotation-temp.htmlCommentShareAWS-User-2073714answered 3 years ago0Same problem here on macos :2020-03-20T12:52:16.461+0100 E  NETWORK  [js] SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_CERT_SUSPENDED; connection rejected2020-03-20T12:52:16.461+0100 E  QUERY    [js] Error: couldn't connect to server xxx.eu-west-1.docdb.amazonaws.com:27017, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_CERT_SUSPENDED; connection rejected :connect@src/mongo/shell/mongo.js:341:17My documentdb instance uses 2019 certificate and I tried with rds-ca-2019-eu-west-1.pem, rds-ca-2019-root.pem and rds-combined-ca-bundle.pem.CommentSharejblancheanswered 3 years ago0Mac OS X Catalina has updated the requirements for trusted certificates. Trusted certificates must now be valid for 825 days or fewer (see https://support.apple.com/en-us/HT210176). Amazon DocumentDB instance certificates are valid for over four years, longer than the Mac OS X maximum. In order to connect directly to an Amazon DocumentDB cluster from a computer running Mac OS X Catalina, you must allow invalid certificates when creating the TLS connection. In this case, invalid certificates mean that the validity period is longer than 825 days. You should understand the risks before allowing invalid certificates when connecting to your Amazon DocumentDB cluster.To connect to an Amazon DocumentDB cluster from OS X Catalina using the AWS CLI, use the tlsAllowInvalidCertificates parameter.mongo --tls --host <hostname> --username <username> --password <password> --port 27017 --tlsAllowInvalidCertificatesCommentShareAWS-User-2073714answered 3 years ago"


Question: LightSail LAMP PhP with Postgresql database suddenly extremely slow

"Hello, as of today we are experiencing extreme delays between our Php website in a LAMP instance and our LightSail managed PostgreSQL database. It is working for some pages with small queries, very slowly, but not for pages requiring more data. I have rebooted the LAMP instance and the database. The metrics available for the database are quite limited and I can't find any inkling of what is going on. When I try to connect to the database with pgAdmin I get a timeout error. Scrolling through the log available within LightSail is impossible as it starts at the top and requires the press of a button to get more lines, and I can't find a way to download it, or a way to turn on slow query logging. I'm not sure if something may have changed within Bitnami but this is a very important database for us. I'm not sure what else to try besides migrating it to RDS.FollowCommentrePost-User-5372742 9 months agoI have an update - creating a new Lightsail database from a snapshot of the problem database, and pointing my website to that, worked and now the site is blazingly fast. But there is still no inkling what might be wrong with the original database unless the issue is with the Amazon hardware itself.Share"

Answer: 0Just like to say I have exactly this problem. Around 12 August connections to lightsail instance started taking ~60 seconds to complete.No load on DB server (~10%).No changes to configuration or quantity of data.Database completely unusable.Postgresql.log file unusable (too slow to page through)Connections timeout from lambda triggers and from using psql on the command line.CommentShareAWS-User-1216181answered 9 months ago


Question: EC2 Instance Status Check fails when created by CloudFormation template

"I have created a CloudFormation Stack using the below template in the us-east-1 and ap-south-1 regionAWSTemplateFormatVersion: "2010-09-09"Description: Template for node-aws-ec2-github-actions tutorialResources:  InstanceSecurityGroup:    Type: AWS::EC2::SecurityGroup    Properties:      GroupDescription: Sample Security Group      SecurityGroupIngress:      - IpProtocol: tcp        FromPort: 80        ToPort: 80        CidrIp: 0.0.0.0/0      - IpProtocol: tcp        FromPort: 443        ToPort: 443        CidrIp: 0.0.0.0/0      - IpProtocol: tcp        FromPort: 22        ToPort: 22        CidrIp: 0.0.0.0/0  EC2Instance:     Type: "AWS::EC2::Instance"    Properties:       ImageId: "ami-0d2986f2e8c0f7d01" #Another comment -- This is a Linux AMI      InstanceType: t2.micro      KeyName: node-ec2-github-actions-key      SecurityGroups:      - Ref: InstanceSecurityGroup      BlockDeviceMappings:      - DeviceName: /dev/sda1        Ebs:          VolumeSize: 8          DeleteOnTermination: true      Tags:        - Key: Name          Value: Node-Ec2-Github-Actions  EIP:      Type: AWS::EC2::EIP      Properties:        InstanceId: !Ref EC2InstanceOutputs:  InstanceId:    Description: InstanceId of the newly created EC2 instance    Value:      Ref: EC2Instance  PublicIP:    Description: Elastic IP     Value:      Ref: EIPThe Stack is executed successfully and all the resources are created. But unfortunately, once the EC2 status checks are initialized the Instance status check fails and I am not able to reach the instance using SSH.I have tried creating an Instance manually by the same IAM user, and that works perfectly.These are the Policies I have attached to the IAM user.Managed PoliciesAmazonEC2FullAccessAWSCloudFormationFullAccessInLine Policy{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "iam:CreateInstanceProfile",                "iam:DeleteInstanceProfile",                "iam:GetRole",                "iam:GetInstanceProfile",                "iam:DeleteRolePolicy",                "iam:RemoveRoleFromInstanceProfile",                "iam:CreateRole",                "iam:DeleteRole",                "iam:UpdateRole",                "iam:PutRolePolicy",                "iam:AddRoleToInstanceProfile"            ],            "Resource": "*"        },        {            "Sid": "VisualEditor1",            "Effect": "Allow",            "Action": [                "s3:PutObject",                "s3:GetObject",                "s3:ListAllMyBuckets",                "s3:CreateBucket",                "s3:DeleteObject",                "s3:DeleteBucket"            ],            "Resource": "*"        }    ]}Thanks in advance for helping out. Have a good dayFollowComment"

Answer: "0Accepted AnswerHi.AMI: ami-0d2986f2e8c0f7d01 is an Amazon Linux 2 (HVM) virtual machine for ap-south-1.For HVM virtual machines, specify xvda as the root device.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/device_naming.html#available-ec2-device-namesYou should change BlockDeviceMappings.DeviceName to:       BlockDeviceMappings:       - DeviceName: /dev/xvda         Ebs:           VolumeSize: 8           DeleteOnTermination: trueCommentShareEXPERTiwasaanswered a year agoCode Panthers a year agoThanks mate. This solved the issue. Happy coding.Share"


Question: Where are e-mail notifications configured for AWS Certificate Manager expirations?

"We have recently received an e-mail notification for the upcoming renewal of some certificates, and are looking into changing the e-mail address configured to receive such notifications. I've tried to find where the e-mail recipient is configured in ACM and SNS, but doesn't seem to be there.Does anyone know where is e-mail configured to receive these messages?FollowComment"

Answer: "0Hi Tedi,I understand you want to change your email where you receive your certificate notifications. You can subscribe an email address to an Amazon SNS topic to receive notifications, guided steps are provided in the documentation [1].Use your registrar's website to associate your contact addresses with your domain name. You can configure your email address for ACM with the provided documentation [1]. In addition I provided an email validation document with all details on when notifications are sent out prior to certificate expiring [2].[1] https://docs.aws.amazon.com/sns/latest/dg/sns-email-notifications.html[2] https://docs.amazonaws.cn/en_us/acm/latest/userguide/setup-email.html[3] https://docs.amazonaws.cn/en_us/acm/latest/userguide/email-validation.htmlCommentShareLwazianswered a year agotedi a year agoThanks for your answer @Lwazi.The problem is that we are currently receiving certificate renewal notices into an e-mail address, and we want to change these to be sent to a different e-mail.The certificate was created in ACS using DNS validation (not e-mail validation), and the whois information have different e-mail details for all contacts, and not the address where the notifications are being received.SharerePost-User-8413122 a year agoAm also looking the solution for the same issue but we are using email validation and want to see which emails are configured in WHOIS. Our certificate is already expires so please any anyone reply ASAPShare"


Question: New to Greengrass and have a few general queries related to it.

"Have faced the following 3 issues in the past few weeks-->> My colleague stated that his deployment fails with error stating “Group definition is not valid”? I couldn't find anything in the GG troubleshooting document about the error.-->> I updated my group definition and added Lambdas to it but I don’t see that reflected on the device. Do the changes take place upon rebooting device ?  is the deployment failed ? or the change made on cloud but never made to the device.-->> In the beginning I couldn't find error logs in my Green grass local machine, neither CloudWatchThanks Community, looking forward to exploring GG.Joan.FollowCommentvidishataws a year agoHi Joan,It looks like you are using Greengrass v1. Greengrass v1 is in maintenance mode. We highly recommend using greengrass v2Thanks,VidishShareAWS-User-8637566 a year agoHello @Vidishataws  yes we are on track to upgrade to V2 but can you please let us know the cause of the following issues mentioned above ?Sharevidishataws a year agoHi Joan,Can you share the following details:Greengrass versionSteps your colleague followed to get "Group definition is not valid".Did you make a deployment with the lambdas?You should be able to find logs in the <greengrass-root>/var/log directory. If you wish to upload logs to cloudwatch, you will have to configure the logger as shown hereShare"


Question: Why is patch manager ignoring OS scope when scanning/patching instances?

"My goal is to scan/path instances in a patch group and only impact instances that match the specified operating system in my patch policy definition. SSM Patch manager ignores the rules in the patch baseline and impacts all instances in the group. What am I missing here?DetailsI spun up two ubuntu instances with versions 18.04 and 16.04 and created a patch group that included these two instances. Next, I created a custom patch policy and set the OS to Ubuntu and the product name to Ubuntu 18.04 and set the other entries to all.I used the run command document "AWS-RunPatchBaseline"  in scan mode to scan the above mentioned patch group.I can see in the output both the instances were scanned even though only Ubuntu 18.04 was mentioned in the patch baseline. How do i ensure that only the particular OS version is scanned or patched in case there are two instances with same Operating System but have different versions..?Payload section of my runcommand output indicates the document seems to not factor in the OS version:Patch Baseline: {'accountId': '*', 'baselineId': 'pb-061ce09db20eee31e', 'name': 'pp_ubuntu_18', 'globalFilters': {'filters': []}, 'approvalRules': {'rules': [{'approveAfterDays': 0, 'filterGroup': {'filters': [{'key': 'PRODUCT', 'values': ['Ubuntu18.04']}, {'key': 'SECTION', 'values': ['']}, {'key': 'PRIORITY', 'values': ['']}]}, 'complianceLevel': 'UNSPECIFIED', 'enableNonSecurity': False}]}, 'approvedPatches': [], 'approvedPatchesComplianceLevel': 'UNSPECIFIED', 'approvedPatchesEnableNonSecurity': False, 'rejectedPatches': [], 'rejectedPatchesAction': 'ALLOW_AS_DEPENDENCY', 'createdTime': 1562154060.257, 'modifiedTime': 1562154060.257, 'description': 'pp_ubuntu_18', 'operatingSystem': 'UBUNTU', 'sources': []}Full output:/usr/bin/python3/usr/bin/apt-getReading package lists...Building dependency tree...Reading state information...python3-apt is already the newest version (1.1.0~beta1ubuntu0.16.04.5).0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.Using python binary: 'python3'07/03/2019 14:32:59 root [INFO]: Downloading payload from https://s3.dualstack.us-east-1.amazonaws.com/aws-ssm-us-east-1/patchbaselineoperations/linux/payloads/patch-baseline-operations-1.21.tar.gz07/03/2019 14:33:00 root [INFO]: Running with snapshot id = and operation = Scan07/03/2019 14:33:00 root [INFO]: Instance Id: i-********07/03/2019 14:33:00 root [INFO]: Region: us-east-107/03/2019 14:33:00 root [INFO]: Product: Ubuntu16.0407/03/2019 14:33:00 root [INFO]: Patch Group: ubuntu_servers07/03/2019 14:33:00 root [INFO]: Operation type: Scan07/03/2019 14:33:00 root [INFO]: Snapshot Id: 8e6377dd-6a5b-459e-b1ff-a1944588dd7a07/03/2019 14:33:00 root [INFO]: Patch Baseline: {'rejectedPatchesAction': 'ALLOW_AS_DEPENDENCY', 'modifiedTime': 1562154060.257, 'approvalRules': {'rules': [{'filterGroup': {'filters': [{'key': 'PRODUCT', 'values': ['Ubuntu18.04']}, {'key': 'SECTION', 'values': ['']}, {'key': 'PRIORITY', 'values': ['']}]}, 'approveAfterDays': 0, 'complianceLevel': 'UNSPECIFIED', 'enableNonSecurity': False}]}, 'description': 'pp_ubuntu_18', 'sources': [], 'createdTime': 1562154060.257, 'operatingSystem': 'UBUNTU', 'accountId': '**********', 'name': 'pp_ubuntu_18', 'approvedPatchesEnableNonSecurity': False, 'approvedPatches': [], 'approvedPatchesComplianceLevel': 'UNSPECIFIED', 'rejectedPatches': [], 'globalFilters': {'filters': []}, 'baselineId': 'pb-061ce09db20eee31e'}2019-07-03 14:33:00,859 root [INFO]: Starting APT patching operation.2019-07-03 14:33:00,859 root [INFO]: Loading patch snapshot from snapshot.json2019-07-03 14:33:00,918 root [INFO]: Searching for sources for product: Ubuntu16.042019-07-03 14:33:01,109 root [INFO]: Re-synchronizing the package index files from their sources.Hit http://us-east-1.ec2.archive.ubuntu.com/ubuntu xenial InReleaseHit http://us-east-1.ec2.archive.ubuntu.com/ubuntu xenial-updates InReleaseHit http://us-east-1.ec2.archive.ubuntu.com/ubuntu xenial-backports InReleaseGet:1 http://security.ubuntu.com/ubuntu xenial-security InRelease [109 kB]Fetched 109 kB in 0s (0 B/s)2019-07-03 14:33:16,165 root [INFO]:FollowComment"

Answer: "0Hello,Thank you for using Patch Manager. The ApprovalRules and GlobalFilters (https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreatePatchBaseline.htmlhttps://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html) define which patches should be included in a patch baseline NOT which Operating System (OS) to be targeted. For targeting OS, there is just UBUNTU not individual versions like Ubuntu18.04, Ubunutu16.04 (https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreatePatchBaseline.html#systemsmanager-CreatePatchBaseline-request-OperatingSystem).So, in your case "two ubuntu instances with versions 18.04 and 16.04", with only one patch group "ubuntu_servers". Both the instances with tag - Patch Group : ubuntu_servers and having OS - "Ubuntu" will be targeted (https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-patch-patchgroups.html). So you would need to create a separate patch baseline for ubuntu 16.04 and link a new patch group (attached to the ubuntu 16.04 instances) to that baseline.Please reach out if there are any doubts.KalhanEdited by: Kalhan-AWS on Jul 5, 2019 3:35 PMCommentShareAWS-User-6343427answered 4 years ago"


Question: Is it possible to do RDMA using libibverbs and EFA?

"A customer is evaluating AWS for migrating an on-prem workload that, at the moment, consists of 10 bare metal servers communicating over Infiniband and RDMA using libibverbs.I am considering C5n/R5n/P3dn instances and EFA as an alternative, but I am still at a loss whether the customer will be able to do RDMA later as desired.Is it possible to do RDMA using libibverbs and EFA? If so, is there any documentation that I can share with the customer?FollowComment"

Answer: "0Accepted AnswerEFA adapters are exposed through libfabrics (https://github.com/aws/libfabric) which offers a comparable interface in terms of functionality (slightly higher level actually). So an application written for libverbs won't work on EFA/libfabric without a significant rewrite.It does not offer RDMA capabilities yet, but this is usually an implementation detail. What the customer usually cares about is the low-latency / high-throughput and not the fact that the messages are actually transmitted using RDMA.CommentShareEXPERTArthur Petitpierreanswered 3 years ago"


Question: About automatic backfill

"Hello,I am trying to implement automatic backfill mechanism for my game and i have some issues with this. After i search on the forum, i get quite confused as well. So my setup is like that: i have a game session with a max of 4 players. I use flexmatch to place players to game sessions. When the player connects to the server and then disconnects from it, i can see player session status as completed. However, i cannot use this slot anymore, meaning that if 4 players get connected and then disconnected from the game session, for 5th player, gamelift opens a new game session. My initial assumption is automatic backfill handle these completed or terminated player sessions and place new players to these slots. My question is, is automatic backfill do that or i get it wrong? If automatic backfill does not cover this, how can i reuse these slots in a game session?FollowComment"

Answer: 0https://docs.aws.amazon.com/gamelift/latest/flexmatchguide/match-backfill.htmlAutobackfill only backfills incompletely filled game sessions. For the use case where players drop out of a game session check the 2nd recommendation in the linked documentation. (Check "Send backfill requests (from a game server)" section)CommentSharerePost-User-8861461answered 2 years ago


Question: PATO--Government Authorization for IL4/IL5 PDF

Where can I find the PATO that DOD has provided for the AWS Services?FollowComment

Answer: 0This CAC-enabled DISA link has PATO docs for IL4 to IL6:https://disa.deps.mil/org/RMED/cas/SitePages/CSOCatlog.aspxCommentShareRajarshi_Danswered a month agorePost-User-8684968 a month agoWhere is the nonCAC access?ShareRajarshi_D a month agoI believe your Agency contact has access to those. Not sure if nonCAC access is allowed. Please reach out to your AWS account team for assistance here.Share


Question: Started detaching volume by mistake - how to cancel

"Hi,I started detaching an EBS volume by mistake (I chose the wrong volume).Since the volume was still mounted it has not detached and is now stuck in a "busy" state.It still works fine but if the instance is rebooted at any time then I'm worried it will detach and this might happen when I am not around to sort it out.Is there any way to cancel the detach instruction and get the volume back in a normal "attached" state?Thanks and regardsFollowComment"

Answer: "0How about setting it to automatically mount after reboot?The following document describes how to set it up.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-using-volumes.html#ebs-mount-after-rebootWith this setup, if you accidentally detach it, it will be restored after attaching and rebooting.CommentShareEXPERTRiku_Kobayashianswered 22 days agorePost-User-8611036 21 days agoThanks. That article contained some great info I was not aware with, such as mounting devices using their UUID. I do already have an fstab file to mount the volume on reboot, was hoping though I could "cancel" the detach instruction so that I don't have a service interruption while I unmount and mount again (or reboot and mount again). Was also hoping the detach instruction would time out since the volume is still mounted but seems there is no timeout and the "busy" state persists forever until an unmount or reboot happens.Share"


Question: How to resolve amazon-linux-extras in AL2023?

"Hello,I'm working on a project where we use amazon-linux-extras, but after updating to AL2023 we are getting an error that it can't be found. I've seen in some forums that it has been discontinued, could you inform me if there is any substitute for this package? or any other solution so I can dowload amazon-linux-extras?FollowComment"

Answer: "1Accepted AnswerHello,As per FAQ of Al2023Q: Does AL2023 have Amazon-Linux-Extras like AL2?A: No, AL2023 does not have extras. For higher-level software packages like language runtimes, we will use the quarterly release where we will add major/minor updates to packages as separate namespaced packages in addition to the default package provided in the repository. For example, default Python version in Amazon Linux 2023 may be 3.8, but we will add Python 3.9 (python39) as a separate namespaced package whenever it is made available. These additional packages will closely follow their upstream release cadence and support model and their support policies can be accessed by the package manager for compliance and security use cases. Default packages will continue to be supported throughout the life of AL2023.Details of all package available in release of Al2023 can be found hereIf the package you need is not there in the default repo, then you can request it through this github linkI hope this helps.CommentShareSUPPORT ENGINEERVinay_Sanswered 25 days ago"


Question: AWS Certificate Manager: Additional Verification Required

"The page https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-failed.html#failed-additional-verification-required recommends:ACM requires additional information to process this certificate request. This happens as a fraud-protection measure if your domain ranks within the Alexa top 1000 websites. To provide the required information, use the Support Center to contact AWS Support. If you don't have a support plan, post a new thread in the ACM Discussion Forum.Doing so. ("post a new thread in the ACM Discussion Forum")Which required information should I provide and where? The message doesn't provide details.The certificates:arn:aws:acm:us-east-1:140092269777:certificate/5aff7884-1a02-41cb-a313-681e691e5a07 for mustread.ruarn:aws:acm:us-east-1:140092269777:certificate/b75372d1-726c-413c-9908-9d8b6e892b32 for xmlhack.ruFollowComment"

Answer: 0Seems it's because they are .ru domains.CommentShareolpaanswered 12 hours ago


Question: Problem Sagemaker and Spark

"Hi there,I followed this tutorial to set up Sagemaker Notebook with Spark (EMR): https://aws.amazon.com/blogs/machine-learning/build-amazon-sagemaker-notebooks-backed-by-spark-in-amazon-emr/I launched a notebook with sparkmagic (pyspark3) and tried to call the Spark context but got the following error:"""The code failed because of a fatal error:Invalid status code '400' from http://xxx.xx.xx.xx:8998/sessions with error payload: "Invalid kind: pyspark3 (through reference chain: org.apache.livy.server.interactive.CreateInteractiveRequest["kind"])".Some things to try:a) Make sure Spark has enough available resources for Jupyter to create a Spark context.b) Contact your Jupyter administrator to make sure the Spark magics library is configured correctly.c) Restart the kernel."""Anyone encountered the same issue?FollowComment"

Answer: "0Hey,Thanks for using SageMaker! This is an issue in pyspark3 with latest Livy. Starting with version 0.5.0-incubating, session kind “pyspark3” is removed, instead users require to set PYSPARK_PYTHON to python3 executable[1].So there're two options:You can switch to use pyspark kernel instead of pyspark3.You can set PYSPARK_PYTHON variable in EMR's config file for spark: spark-env.sh[{"Classification": "spark-env","Configurations": [{"Classification": "export","Configurations": [],"Properties": {"PYSPARK_PYTHON": "/usr/bin/python3"}}],"Properties": {}}]Let us know if you have any other question.Thanks,Han[1]https://livy.incubator.apache.org/docs/latest/rest-api.html#pyspark[2]https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-spark-configure.htmlCommentShareAWS-User-2543952answered 5 years ago0Submitting these EMR configuration options at the time of cluster creation worked for me:[{"Classification": "spark-env","Configurations": [{"Classification": "export","Properties": {"PYSPARK_PYTHON": "/usr/bin/python3"}}]},{"Classification": "yarn-env","Properties": {},"Configurations": [{"Classification": "export","Properties": {"PYSPARK_PYTHON": "/usr/bin/python3",}}]}]CommentSharevzawsanswered 4 years ago"


Question: How to get ARN for Lake Formation Table?

"I'm trying to use table ARN in aws lakeformation describe-resource .However, when building ARN like recommendedtable_arn = f"arn:aws:lakeformation:{region}:{account_id}:table/{database_name}/{table_name}"I'm, getting the following error:An error occurred (InvalidInputException) when calling the DescribeResource operation: Un-supported resource arn formatWhat is wrong with ARN formatting I'm using?FollowComment"

Answer: "0To get the ARN (Amazon Resource Name) for a Lake Formation table in AWS, you can follow these steps:Open the AWS Management Console and navigate to the Lake Formation service.In the Lake Formation console, select "Tables" from the left-hand menu.Locate the table for which you want to retrieve the ARN and click on its name.On the table details page, you should find the ARN listed under the "Details" section or a similar heading.Alternatively, you can use the AWS Command Line Interface (CLI) to retrieve the ARN. Open a terminal or command prompt and run the following command, replacing "table-name" with the name of your Lake Formation table:aws lakeformation describe-table --database-name your-database-name --table-name table-nameLook for the "TableArn" attribute in the command output to find the ARN of the specified table.The ARN will be in the following format: arn:aws:lakformation:<region>:<account-id>:table/<database-name>/<table-name>. It uniquely identifies the Lake Formation table within your AWS account and can be used for various purposes, such as granting permissions, referencing the table in other AWS services, or integrating with third-party tools.Let me know if this helps.CommentSharehimanshustallongmailcomanswered 14 days agoStas Khirman 13 days agoHi, thank you for a prompt answer, but unfortunately neither of solution works :1.) There is no ARN in "Detail" section.2.) There is no describe-table operation : aws lakeformation describe-table returns :aws lakeformation describe-table --database-name test_lakeformation --table-name test_tableusage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]To see help text, you can run:  aws help  aws <command> help  aws <command> <subcommand> helpaws: error: argument operation: Invalid choice, valid choices are:add-lf-tags-to-resource                  | assume-decorated-role-with-saml         batch-grant-permissions                  | batch-revoke-permissions  Sharehimanshustallongmailcom 13 days agoCould you please post the below query answer?aws lakeformation describe-tableaws lakeformationaws lakeformation describe-table --database-name test_lakeformationShareStas Khirman 13 days agoaws lakeformation describe-tableusage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]To see help text, you can run:  aws help  aws <command> help  aws <command> <subcommand> helpaws: error: argument operation: Invalid choice, valid choices are:add-lf-tags-to-resource                  | assume-decorated-role-with-saml         batch-grant-permissions                  | batch-revoke-permissions                cancel-transaction                       | commit-transaction                      create-data-cells-filter                 | create-lf-tag                           delete-data-cells-filter                 | delete-lf-tag                           delete-objects-on-cancel                 | deregister-resource                     describe-resource                        | describe-transaction                    extend-transaction                       | get-data-lake-settings                  get-effective-permissions-for-path       | get-lf-tag                              get-query-state                          | get-query-statistics                    get-resource-lf-tags                     | get-table-objects                       get-temporary-glue-partition-credentials | get-temporary-glue-table-credentials    get-work-unit-results                    | get-work-units                          grant-permissions                        | list-data-cells-filter                  list-lf-tags                             |ShareStas Khirman 13 days agoaws lakeformationusage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]To see help text, you can run:  aws help  aws <command> help  aws <command> <subcommand> helpaws: error: the following arguments are required: operationShare"


Question: Using S3 bucket as source for table in Athena

"When creating a table in Athena I browse to my S3 bucket, but it's greyed out and I can't select it as a source. I have granted myself Athena read/write and made my bucket public. What am I missing?FollowCommentapradana 9 months agoHave you tried granting access to your S3 bucket?Share"


Question: Quicksight dataset SPICE refresh not loading data

"Dataset is not loading data on schedule /manual refresh . Rows Ingested 0 , rows dropped 0. but query returns data in database.No error message in quicksightFollowComment"

Answer: "0What is the source of your dataset? If it is Athena, check the table in Athena and see if there is any data. You can do this by clicking on the three dots next to the table name and click preview table.CommentShareAaron Edellanswered a year ago"


Question: lambda - redshift - status = Query does not exist

"The same code works in one account but not another account.In a step function, lambda calls a redshift query, returns, next step calls get status.The lambda returns but the status call errors with msg "Query does not exist".The query in the previous step has successfully run and a statement id returned.Its only the step with status call that fails.Other lambdas in the same step function using the same pattern work correctly.These other steps use the same get status lambda as the steps that fail.The common item is the call to the redshift query in the previous step.When ever that is used the status call fails.However:The query executes correctly and the same lambda works in the same step function in another account.Other points:The redshift clusters were built with a cloud formation template and should be identical.The entire step function (unchanged other than account number change) works correctly in another account.The lambdas have been manually copied and pasted from the account that works to ensure they are identical.Does any one have any suggestions, as all obvious checks have been done.For completeness the code for the redshift query call is below, however as stated above this works in another account.import jsonimport boto3import base64import urllib.parseimport botocore.session as bcfrom botocore.exceptions import ClientErrorssm_client = boto3.client('ssm')def lambda_handler(event, context):    environment             = event['environment']    source_bucket           = event['source_bucket']    processed_bucket        = event['processed_bucket']    role                    = event['role']    region                  = event['region']    database_name           = event['database_name']    secret_name             = event['secret_name']    secret_arn              = event['secret_arn']    cluster_id              = event['cluster_id']    proc_name               = event['proc_name']        ssm_redshift_proc_name  = ssm_client.get_parameter(Name=proc_name, WithDecryption=True)    redshift_proc_name      = ssm_redshift_proc_name['Parameter']['Value']    query_str               = "call "+redshift_proc_name+"();"    bc_session = bc.get_session()    session = boto3.Session(            botocore_session    = bc_session,            region_name         = region,        )            client_redshift = session.client("redshift-data")    res = client_redshift.execute_statement(            Database            = database_name,SecretArn           = secret_arn,Sql                 = query_str,ClusterIdentifier   = cluster_id)    return {'environment': environment,'source_bucket': source_bucket,'processed_bucket': processed_bucket,'role': role,'region': region,'database_name': database_name,'secret_name': secret_name,'secret_arn': secret_arn,'cluster_id': cluster_id,        'statementid': res['Id']    }FollowComment"

Answer: "0Accepted AnswerHi,Have you checked the IAM roles used? Are they identical in both accounts?Are the DescribeStatement and ExecuteStatement permissions attached to the used IAM Role?Thanks,CommentShareZiadanswered 6 months agorePost-User-9963180 6 months agoHi ZiadThanks for your response. Both state machines are executing with a role that has identical polices and trust relationships, including RedshiftDataApiFullaccess and LambdaFullAccess.However, I have just checked the individual lambda's. There are 36 lambda's and 35 had the correct role!Thank you very much. I had checked the permissions before but missed this (the two role names are very similar). Thank you for prompting me to check again.ShareZiad 6 months agoThank you for the update. Good news.Share"


Question: Regarding GridMate and MultiplayerEvents

"How does one use GridMate_GridMember.GetPlayerId?How do you connect to the MultiplayerEvents, is it like the other buses?Any documentation on these topics? Can't seem to find any documentation.Regards QviddFollow"

Answer: "0Accepted AnswerHey @Qvidd,Here's our networking doc as it stands in case you've missed it: http://docs.aws.amazon.com/lumberyard/latest/developerguide/network-intro.htmlSpecifically for your questions:What are you trying to use GetPlayerId for? That information fetch is generally populated by the service implementing it (if at all) and then used by said service. GameLiftClientService being an example of that.If you're looking at MultiplayerEventsComponents, those functions are intended to be used through LUA. Unfortunately there's not yet doc on its usage but I can try to answer specific questions on usage you might have. You can call the functions being exposed to LUA in that class normally. They're not presently bound to a bus. Some of the GridMate Tests have examples of this.SharerePost-User-6135477answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-5738838answered 6 years ago0I was trying to make a game manager that would get the ID of every player that joined, so that I could assign players to their entity.But I found another way via the example provided in the C++ sectionQviddSharerePost-User-2043254answered 6 years ago"


Question: Pinpoint APNS Channel in Cloudformation


Question: AWS Step Functions - Invalid JSON Path

"I am getting the following error when attempting to use the following JSON Path in my ResultsSelector $.Clusters[:].ClusterIdentifier.What is curious to me is that in the Step Function Data Flow simulator, the results work as expected when testing the path selection, so I am at a loss as to how to proceed.In the end, I want to use Describe Clusters to get the data on what is running and inspect the created array to determine if my cluster of interest is running.FollowComment"

Answer: "0Accepted AnswerHi,AWS Step Functions uses Amazon States Language to describe state machines declaratively, and the "@", ",", ":", and "?" operators are not supported, since all reference Paths MUST be unambiguous references to a single value, array, or object (subtree).Thus, the wildcard symbol could be employed to select all elements of an object or array.Step Function definition{  "Comment": "A description of my state machine",  "StartAt": "Pass",  "States": {    "Pass": {      "Type": "Pass",      "End": true,      "Parameters": {        "clusterids.$": "$.Clusters[*].ClusterIdentifier"      }    }  }}Input{  "Clusters": [    {      "ClusterIdentifier": 1    },    {      "ClusterIdentifier": 2    }  ]}Output{  "clusterids": [    1,    2  ]}I hope this helps you.CommentShareMikel Del Tioanswered a month agoEXPERTalatechreviewed a month agobtibertPQ a month agoAhh, I even scanned the spec and totally didn't pick up on that, especially since data were returned in the data flow simulator.  Regardless, thank you for the note!Share"


Question: Glue job does not sort data without "Automatically scale the number of workers" check

"I have created an ETL job executing processes below using AWS Glue Studio.Reading a data source from a Oracle database table through a table of Glue Data Catalog.Executing the SQL statement "select * from tableA order by col1".Repartitioning the DynamicFrame to 1 output.Writing the DynamicFrame to a csv file.With this job, if I set "Automatically scale the number of workers" checked, the output data is sorted.But I set the option unchecked, the output data is NOT sorted ("order by" clause doesn't work).What is the cause of this phenomenon?Thank you.FollowComment"

Answer: "0Accepted AnswerHi ,Small disclaimer: I do not have tested it, so my theory is not proven.My understanding is that you are repartitioning the data to 1 partition (to have 1 file) using the repartition or coalesce command.Now you have to consider that Spark run in a distributed cluster and each partition is managed by a different executor so in a normal execution when you are reading the data from Oracle even if it is sorted during the ingestion it may be split and re-merged after without conserving the sorting order.This is why without Autoscaling checked the data is not sorted.Now , when Autoscaling is enabled you are telling Glue to start only the number of executors are actually needed. This combined with Spark Lazy evaluation   and your repartition(1) could bring glue to start only one executor and thus read and write the data in your sorted order.To validate it you could look at the Spark UI for the 2 jobs and see how many executor are running at anytime during the Job.hope this helps,CommentShareEXPERTFabrizio@AWSanswered 7 months agorePost-User-2300507 7 months agoThank you for your reply. Your explanation was a great help.Share"


Question: What operating system can I use to run SAP on Oracle database on AWS ?*

What operating system can I use to run SAP on Oracle database on AWS ?“NOTE: This is a common question asked by AWS customers. The AWS team is posting it to provide an answer that can benefit everyone.”FollowComment

Answer: 1Accepted AnswerOracle requires that the Amazon Machine Image (AMI) used for supported cloud instances should be based on Oracle Linux (OEL) for both the Oracle Database Server and SAP NetWeaver Application Servers with Oracle Instant Client installed.You may refer to SAP note 2358420 - Oracle Database Support for Amazon Web Services EC2 and blog https://blogs.sap.com/2021/02/08/key-topics-for-running-sap-oracle-on-aws/ for latest information.Oracle Linux AMIs for AWS can be found under community AMIs in EC2 from the user ID 131827586825.NOTE: This answer is provided by the SAP on AWS speciality team and is accurate at the time of publish. Please check comments as the answer may have changed/services evolved.CommentShareDeep_Kanswered a year ago0Oracle LinuxCommentSharesinuhesanswered a year ago


Question: CDK AwsCustomResource: Howto know when there are no more ResponseFields?

"What I'm trying to accomplish:I want to call the SES verifyDomainDkim API method via AwsCustomResource. From the documentation I know that it returns a response as follows:{    DkimTokens: [       "EXAMPLEq76owjnks3lnluwg65scbemvw",        "EXAMPLEi3dnsj67hstzaj673klariwx2",        "EXAMPLEwfbtcukvimehexktmdtaz6naj"    ]}Now I want to use those DkimTokens to create the required CNAME records in Route53. How do I know how many entries the DkimTokensarray has? I currently have hardcoded looping over 3 records like the following:const verifyDomainDkim = new AwsCustomResource(...);for (let i = 0; i < 3; i++) {      new route53.CnameRecord(this, `ses-dkim-${i}`, {        zone: props.hostedZone,        recordName: `${Token.asString(verifyDomainDkim.getResponseFieldReference(`DkimTokens.${i}`))}._domainkey.${domain}`,        domainName: `${Token.asString(verifyDomainDkim.getResponseFieldReference(`DkimTokens.${i}`))}.dkim.amazonses.com`,      }).node.addDependency(verifyDomainDkim);    }However what if at some point there are more than three DKIM tokens? Can I somehow make this dynamic?FollowComment"

Answer: "0Accepted AnswerYou'll need to think about this slightly differently, as your CDK code is only executing BEFORE CloudFormation creates the stack. Your references to the response values from your custom resource will be rendered into some combination of GetAtt and Select intrinsic functions in the template which is output, and so you're back to your already-identified problem of knowing how many results there will be.I think the way to handle this may well be another custom resource (or maybe the same one, if you want) which takes the DkimTokens list and can execute the logic to create the Route 53 records as required. So you won't have AWS::Route53::RecordSets in your stack, you'll have a Custom::CreateRecords (or whatever) which "owns" all the records, but those records are opaque to CloudFormation.CommentShareEXPERTJames_Sanswered 2 years ago"


Question: Route53 Cloudwatch Logs Dashboard

How can I view view Route 53 DNS Query logs in a dashboard in an easier way rather than say pushing them into Elasticsearch?FollowComment

Answer: "0Accepted AnswerOnce the Route 53 query logs are enabled, they can be viewed in CloudWatch console, and there is a dashboards menu that can be used to create simple dashboards, Beyond that with other options, such as Exporting Log Data to Amazon S3,just note that log data can take up to 12 hours to become available for export, you can do cron jobs for a scheduled export as well. One the data is in S3, it can visualized by using QuickSight, with the use of Glue and Athena for some data transformation if required, here is a sample. Alternatively, Using AWS CloudWatch in Grafana ,can also be looked at.CommentShareMODERATORAWS-User-8412605answered 5 years ago"


Question: UnprocessableEntityException: outputGroups[0].outputGroupSettings.streamName additional property "streamName" exists in object when not allowed; outputGroups[0].outputGroupSettings Object does not mat

"I am trying to create an rtmp push input and create a channel with this input only to livestream using aws elemental medialive apis.I am facing this error, while creating the channel through createChannel API, while i was able to make the input with createInput API.Error: UnprocessableEntityException: outputGroups[0].outputGroupSettings.streamName additional property "streamName" exists in object when not allowed; outputGroups[0].outputGroupSettings Object does not match "hlsGroup"This is my channel config:const channelConfig = {        Name: "test-channel",        ChannelClass: "SINGLE_PIPELINE",         InputAttachments: [          {            InputId: data.Input.Id,            InputSettings: {              AudioSelectors: [                {                  Name: "Audio Selector 1",                },              ],              VideoSelector: {                ColorSpace: "FOLLOW",                ColorSpaceUsage: "FORCE",              },            },          },        ],        Destinations: [          {            Id: "destination1",            Settings: [              {                StreamName: "test-stream",                Url: "rtmp://a.rtmp.youtube.com/live2/h0g0-j7sx-g6ap-ztz0-3xcj",              },            ],          },        ],        EncoderSettings: {          AudioDescriptions: [            {              AudioSelectorName: "Audio Selector 1",              CodecSettings: {                AacSettings: {                  Bitrate: 96000,                  InputType: "NORMAL",                  Profile: "LC",                  RateControlMode: "CBR",                  SampleRate: 48000,                },              },              LanguageCodeControl: "FOLLOW_INPUT",              Name: "Audio Description 1",              AudioTypeControl: "FOLLOW_INPUT",            },          ],          OutputGroups: [            {              Name: "File Group",              Outputs: [                {                  OutputSettings: {                    HlsOutputSettings: {                        NameModifier: "hls",                        HlsSettings: {                            StandardHlsSettings: {                                AudioRenditionSets: "program_audio",                                M3u8Settings: {                                    AudioFramesPerPes: 4,                                    AudioPids: "492-498",                                    EcmPid: "8182",                                    PatInterval: 0,                                    PcrControl: "PCR_EVERY_PES_PACKET",                                    PcrPeriod: 400,                                    PcrPid: "8181",                                },                            },                        },                    },                  },                  VideoDescriptionName: "Video Description",                },              ],                OutputGroupSettings: {                    HlsGroupSettings: {                        Destination:{                            DestinationRefId: "destination1"                        }                    }                                    }            },          ],          TimecodeConfig: {            Source: "EMBEDDED",          },          VideoDescriptions: [            {              CodecSettings: {                H264Settings: {                  AdaptiveQuantization: "HIGH",                  AfdSignaling: "NONE",                  Bitrate: 500000,                  ColorMetadata: "INSERT",                  EntropyEncoding: "CABAC",                  FlickerAq: "ENABLED",                  FramerateControl: "SPECIFIED",                  FramerateDenominator: 1,                  FramerateNumerator: 60,                  GopBReference: "ENABLED",                  GopClosedCadence: 1,                  GopNumBFrames: 3,                  GopSize: 60,                  GopSizeUnits: "FRAMES",                  Level: "H264_LEVEL_3",                  LookAheadRateControl: "HIGH",                  MaxBitrate: 500000,                  MinIInterval: 0,                  NumRefFrames: 3,                  ParControl: "INITIALIZE_FROM_SOURCE",                  Profile: "MAIN",                  RateControlMode: "CBR",                  ScanType: "PROGRESSIVE",                  SceneChangeDetect: "ENABLED",                  Slices: 1,                  SpatialAq: "ENABLED",                  Syntax: "DEFAULT",                  TemporalAq: "ENABLED",                  TimecodeInsertion: "DISABLED",                },              },              Height: 720,              Name: "Video Description",              RespondToAfd: "NONE",              ScalingBehavior: "DEFAULT",              Sharpness: 50,              Width: 1280,            },          ],        },      }Please help regarding the error.FollowCommentSteve_W 3 months agoPlease redact your stream destination from this post.Share"

Answer: "0Hi,Your immediate issue is you are using an HLS output group type to send to an RTMP destination. You need to create an RTMP output group instead. Please see https://docs.aws.amazon.com/medialive/latest/ug/rtmp-create-procedure.htmlRegards,SteveCommentShareSteve_Wanswered 3 months agorePost-User-7859701 3 months agoHey, thanks for the reply. But can you give me a suggestion about the config, as i need to create the channel using the api.Share0Hi, See https://docs.aws.amazon.com/medialive/latest/apireference/channels.htmlYou can only select one "outputGroupSettings" option per output group, the one you want is:"rtmpGroupSettings": {            "authenticationScheme": enum,            "cacheLength": integer,            "restartDelay": integer,            "cacheFullBehavior": enum,            "captionData": enum,            "inputLossAction": enum,            "adMarkers": [              enum            ]          },Regards,SteveCommentShareSteve_Wanswered 3 months ago"


Question: build project environment image override

"As we got an email that aws/codebuild/standard:4.0 is going to be suspended soon and we need to update this , so if we will update this there are services running on y machine so my question is. are those services or my machine will be affected by this change?FollowComment"

Answer: "0One easy way of testing this is to open your CodeBuild project and to perform a build with overrides (see "Start build with overrides" button). Here, select "Advanced build overrides" to gain access to the option to modify the environment image. Select "Override image" and chose the new image that you want to test your build with, for example "aws/codebuild/standard:6.0" if you want to update from Ubuntu 18.04 (standard 4:0) to Ubuntu 22.04, which is the latest Ubuntu image provided by CodeBuild as of this date. Confirm the selection with "Start build" and verify via the build status and logs.If everything went fine, you can safely update the build project permanently with the successfully tested image. Depending on whether you're using an "Infrastructure as Code" approach such as CloudFormation, CDK or Terraform, you'll either have to update the image within the corresponding code, or you apply the changes via the AWS Console ("Edit" > "Environment" > "Override image").Hope this helps!CommentShareDanielanswered 2 months ago"


Question: Mapping OPC-UA Variable to Asset Property unclear

"Dear Community and Support,I am trying to map a Variable (Double) from an OPC-UA Server to an asset property of type measurement.According to the swCollector.log my gateway on a Raspberry PI successfully connects to the server and traversed the nodeset. But somehow it does not write any values to the stream. Probably because I assigned the wrong "data stream path" to my property-alias.To give an example:The publicly available OPC-UA Server at opc.tcp://milo.digitalpetri.com:62541/milo has the following structure:Root|--- Objects|---  ..|---  Dynamic|---  ..|---  RandomDoubleI am trying to map the Random Double with the OPC-UA NodeID "ns=2;s=Dynamic/RandomDouble" to a measurement property in my asset.However, I don't understand, what is meant by the "OPC-UA data streams", which I am supposed to map to my property-alias.Having "/Objects/Dynamic/" as my Base-Node for the gateway, I tried the aliases "/Objects/Dynamic/RandomDouble", "RandomDouble" and the Node-ID "ns=2;s=Dynamic/RandomDouble". All without success.Please provide clarification on how to extract the OPC-UA data stream path from a server in general and specify the correct path for my example case.Cheers,WillyFollowComment"

Answer: "0Hi Willy,We had a chance to play around with the OPC-UA server you linked. I think there are two things that are going on:The server has a “Turtle” node structure that is a recursive structure which will lead the gateway to keep browsing the folder in a loop. This seems to be specific to this OPC-UA server.The combination of data stream prefix, Node ID and property alias seem to not match.Here are a couple combinations that worked for us:With Prefix:Data stream prefix: digitalpetriAlias: digitalpetri/Dynamic/RandomDoubleNode Filter Rules: /Dynamic/*W/o Prefix:Data stream prefix: <blank>Alias: /Dynamic/RandomDoubleNode Filter Rules: /Dynamic/*You can also specify the actual browse path component of the NodeId with the forward slash prepended, instead of using a wild card. In this case it would be "/Dynamic/RandomDouble"."Please provide clarification on how to extract the OPC-UA data stream path from a server in general and specify the correct path for my example case."The best way to extract the path from the server is by looking at the node Id. In your case, s=Dynamic/RandomDouble tells you the path.Please note that:We recommend having prefixes, in case you may have multiple OPC-UA servers with similar browse paths."Objects" as seen in the browse tree is not part of the browse path.We prepend the data prefix, if one is defined, and the forward slash to the browse path of the NodeId.Hope that helps,SantoshEdited by: Santosh@AWS on May 14, 2020 12:57 PMCommentShareAWS-User-4947585answered 3 years ago0Hi Santosh,thank you for your thorough and helpful reply.I successfully connected to the server with your given property-aliases/browse-paths and was able to replicate the method for a different, locally hosted OPC-UA server.Especially the hint that "Objects" is not part of the browse-path was valuable. As it seems this is always the case. I would therefore recommend including this information in the docs.The notion that "Objects" can / has to be omitted in the browse path implies that the querying of the server is limited to Nodes in the "root/Objects" Folder. Imho this is a reasonable restriction, as the other two OPC-UA default folders under root ("root/Types" and "root/Views") are probably of little use for many IIoT applications in the cloud.I have not checked if this restriction applies (='root/types' and 'root/Views' not accessible from AWS), but if this is indeed an assumption/ a restriction than this should also be included in the docs, if not already done so.Thanks again and Regards,WillyCommentShareopcwillanswered 3 years ago0Hi Willy,Thank you for the feedback. I'm glad you were able to get it working.I successfully connected to the server with your given property-aliases/browse-paths and was able to replicate the method for a different, locally hosted OPC-UA server.SK: Yes, agreed, we will add this to the docs.The notion that "Objects" can / has to be omitted in the browse path implies that the querying of the server is limited to Nodes in the "root/Objects" Folder. Imho this is a reasonable restriction, as the other two OPC-UA default folders under root ("root/Types" and "root/Views") are probably of little use for many IIoT applications in the cloud.I have not checked if this restriction applies (='root/types' and 'root/Views') not accessible from AWS), but if this is indeed an assumption/ a restriction than this should also be included in the docs, if not already done so.SK: We will look to adding this clarity in the docs as well. I'll need to verify, but I think we only support object paths at the moment. I understand you have a ticket open with documentation, we'll use that to enhance the docs on this topic.As a side note, many thanks for the feedback on our docs. We love this as it helps us ensure we are thorough and future customers have the info needed in a self service manner.Best,SantoshEdited by: Santosh@AWS on May 19, 2020 11:23 AMCommentShareAWS-User-4947585answered 3 years ago"


Question: Does CloudFront fully supports HTTP/3?

"I used a website to run a test for my HTTP/3-enabled website, but the website says:Is this normal, or else?FollowComment"

Answer: "0CloudFront supports HTTP/3.However, the viewer must support TLSv1.3 and Server Name Indication (SNI). [1][1] Values that you specify when you create or update a distribution - Amazon CloudFronthttps://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesSupportedHTTPVersionsCommentSharemn87answered 8 months agosimoncmchan 7 months agoHi, then, any tools we can check cloudfront http3 workable?I try to use:https://geekflare.com/tools/http3-testhttps://http3check.net/both says http3/QUIC not work.RegardsShare"


Question: How to mount FSX Lustre on an on-prem Linux Server

I want to mount FsX Lustre onto an on-prem RHEL Server.  I already have SSH access from the on-prem server to the AWS EC2 server.  The purpose is for the on-prem application to consume files produced by the application running on AWS.FollowComment

Answer: "0Please refer the documentshttps://docs.aws.amazon.com/fsx/latest/LustreGuide/mounting-on-premises.htmlHope this help.CommentShareSanjay Aggarwalanswered 4 months ago0Thanks.  Do we need to allow bi-directional traffic on TCP traffic on ports 988, 1018-1023 on the on-prem linux server?CommentSharerePost-User-0812598answered 4 months ago"


Question: I can't download the certificate(AWS IoT)

"when Thins > Security > Create certificateDownload does not respond, if i click.All keys belowA certificate for this thingA public keyA private keyAlso when downloading an existing key,when actions > downloadThe following message is displayed"Failed, please try again later. FrontendError"Please teach me.I'm not good at English.RyotoFollowComment"

Answer: "0Sorry for the issue. I couldn't reproduce what you mentioned. I was able to create a certificate for a thing using the steps you described. If you are able to reproduce the issue, please tell us what region, and if possible any other details such as API request, responses (by going into browser's Inspector).CommentShareAWS-User-3247576answered 3 years ago0Hi Ryoto, yesterday we identified and corrected an issue with certificate downloading from the console in the Tokyo region. Please let us know if you are still encountering the issue.RyanCommentShareRyan_Banswered 3 years ago0Thank you for your reply.Now available for download in the Tokyo region.It was helpful.RyotoCommentShareryotoanswered 3 years ago"


Question: bug: Quicksight graphs do not show all data

"Since a couple of weeks, the QuickSight graphs are not automatically showing all data in my analysis and in my dashboards:When I open the analysis or dashboard, only data till September 2022 is shown. While all data is available until December 2022.See graphs. In the title of the graphs, you can find the selected date range.When I click on drill-up and then on drill-down, all data become visible. See the graph below.FollowCommentiwasa EXPERT6 months agoHi.Please let us know the details of your analysis setup.Do you use calculated fields and optional historical data references?ShareUser-5659647 6 months agoI used a calculated field:calculated_field1 = dateDiff({time1}, {time_2}, 'SS') / 60.0The bar chart is generated using the value: sum(calculated_field1).It does not only happen for bar charts. Also, my line chart has the same behaviour.I don't know what you mean with optional historical data references?Share"


Question: Could merge a Pull Request without getting reviewer approval

"Hello everyone!In AWS Code Catalyst, I could do merge a PR (without required approver) directly as a contributor. It means that I could a PR without required reviewer and then directly did merge that PR to main branch. It is probably unsecured process. There is not protected branch feature in source repository in Code Catalyst.How can I overcome this issue?Thank you!FollowComment"

Answer: "0Hi,According to this: https://docs.aws.amazon.com/codecatalyst/latest/userguide/pull-requests-review.html,All required reviewers must approve a pull request before it can be merged.Depending on your screen size and browser, the buttons to approve or merge a pull request might be hidden behind the Additional info information bar.So it could be that if you do not add any required approves, you can then merge the PR.You could look into adding IAM policies preventing to merge into a specific branch.CommentShareEXPERTalatechanswered 2 months ago0Hi Alatech,Thank you for your comment!In my case, I expected that merging PR should NOT be allowed if that merging skips approver. In other words, merging PR is possible only with approval.Currently, Code Catalyst is managing users based on Builder ID accounts. As per my information, there is no any relationship between IAM and Builder ID accounts.May I know any documentation for IAM policies preventing to merge into a specific branch in Code Catalyst?I highly appreciate your comment.Thank you!CommentShareAWS-User-7789572answered 2 months ago"


Question: How do I not receive "Internal Failure for IAM authorizer" error when using AWS IAM authorizer on Govcloud?

"I have an app which uses a role with this policy to invoke an API gateway:    {        "Version": "2012-10-17",        "Statement": [            {                "Effect": "Allow",                "Action": [                    "mobileanalytics:PutEvents",                    "cognito-sync:*",                    "cognito-identity:*"                ],                "Resource": [                    "*"                ]            },            {                "Effect": "Allow",                "Action": [                    "execute-api:Invoke"                ],                "Resource": [                    "arn:aws:execute-api:us-east-1:XXXXXXXXXX:aaaaaaaaaa/$default/POST/routename/${aws:PrincipalTag/username}"                ]            }        ]    }(In govcloud, us-east-1 is changed to us-gov-west-1).This works fine in commercial. However, I get 500 internal server errors on govcloud. Upon customizing and inspecting the logs, I find that it's an authorizer error with the error message "internal failure for IAM authorizer".Searching this error on google yielded 0 results... Now I'm scared.In a panic, I tried opening up all permissions more broadly    {        "Version": "2012-10-17",        "Statement": [            {                "Effect": "Allow",                "Action": [                    "mobileanalytics:PutEvents",                    "cognito-sync:*",                    "cognito-identity:*"                ],                "Resource": [                    "*"                ]            },            {                "Effect": "Allow",                "Action": [                    "execute-api:*"                ],                "Resource": [                    "*"                ]            }        ]    }But this yielded the same results.However, when I tried hitting the same endpoint using complete admin permissions, my requests went through just fine.What can I do to stop this behavior? Are IAM Authorizers even supported on govcloud? Do I need to add more permissions?FollowComment"


Question: No instance size with 8 vCPUs and 128 GiB RAM for Windows Server and SQL Server on Amazon EC2

I was looking through available instance sized for Windows Server and SQL Server on Amazon EC2and couldn't find one with 8 vCPUs and 128 GiB RAM.Why is that?FollowComment

Answer: "0You could choose an instance size that is a 128gb and change the cpu on launch to match the number of vcpu you require.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-specify-cpu-options.htmlYou can specify these CPU options during instance launch. There is no additional or reduced charge for specifying CPU options. You're charged the same as instances that are launched with default CPU options.This may not be what you’re looking for cost wise.  Have you considered RDS?CommentShareGary Mcleananswered 9 days agoYoni Sade 9 days agoRDS is much more expensive, especially when you need HA with EC2 with FCI compared to RDS Multi AZ with AG:RDS for SQL Server db.r6i.4xlarge (16 vCPU 128 GiB RAM) =$4438 x2 for Multi-AZ = 8876$ monthlyRDS for SQL Server db.z1d.3xlarge (12 vCPU 96 GiB RAM) =$3902 x2 for Multi-AZ = 7804$ monthlyEC2 r6a.4xlarge (16 vCPU 128 GiB RAM) = with Windows 1,361$ + MSSQL BYOL 674$ = 2035$ monthlyEC2 x2gd.2xlarge = (missing for Windows+MSSQL BYOL - potentially could cost 1794$ monthly)I hope the x2g/x2gd instance classes will be available for SQL Server RDS/EC2 Windows+SQL in the near future.Share0Have you considered x2iedn.xlarge ? It has the memory you are looking for.SQL Server is much more memory and IO intensive than CPU.  Check out a guide we just published https://aws.amazon.com/blogs/modernizing-with-aws/a-guide-to-optimizing-microsoft-licensing-on-aws/and look for Use the Optimize CPU feature for SQL Server workloads.CommentShareRafetanswered 8 days ago"


Question: 503 Gateway Time-out

Hi there!I'm accessing a very slow API in my express application and I'm getting 503 Gateway timeout in my preview in Cloud9...How can I increase this timeout? I need to set this to 1 or 2 minutes...Many thanks!FollowComment

Answer: 0Accepted AnswerHi lflfm3!Unfortunately it's not possible to change this timeout.CommentShareanester-awsanswered 2 years ago


Question: Guard Duty with Security Hub

trying to understand relationship between security hub and guard duty in aws organisation sub accountIf GuardDuty is enabled on organisation member account B and security hub is enabled on organisation master/delegated admin account Athan will the master account A recieve findings from account B even if we don't enable guard duty in master account?FollowComment

Answer: "1Accepted AnswerIf Security Hub and GuardDuty are enabled in the same account then Security Hub will receive the GD findings for that account and then send all findings to Security Hub in the delegated admin account for that region. Enabling GuardDuty on all accounts and in all regions is recommended best practice however - there is no cost if there are no workloads or activity in that account and if something WAS to happen then at least you would know about it. In addition it make it so much easier to manage and view all GD findings in a single account. Is there a reason for not enabling GD in your management/delegated admin account? (Note: we recommend making the delegated admin account the same for ALL security services like GD, SH, Inspector, Macie, Detective etc)CommentShareAlex_AWSanswered 10 months ago0Yes, I have tried it in my environment.You can receive findings from member account B without enabling GaurdDuty on management/delegated admin account A.CommentSharehayao-kanswered 10 months ago"


Question: Wifi monitor mode with Kali in ec2?

"When I ssh into Kali image ec2 instance from my windows 10 Lenovo Thinkpad, no wifi adapter is shown for intel dualband wireless ac 8260 which is in the motherboard, not external USB wifi adapter. I'm a beginner please help. Is it not possible to put my wifi in monitor mode using ec2 instance??FollowComment"

Answer: "0Hi AWS-User-7198048,I understand that you are attempting to enable Monitor Mode using your Kali Linux EC2 instance.When an EC2 instance is launched, the default Elastic Network Interface (ENI), or virtual network card (eth0), is created and handles all traffic sent and received from the instance. To collect data packets sent through WiFi, Kali Linux Monitor Mode requires a wireless adapter that supports it. You can attach more ENIs to your EC2 instances, but no WiFi or wireless adapters (wlan0). Most laptops, tablets, and mobile phones have built-in WiFi adapters, but making your local WiFi at home or in an office accessible to an EC2 instance is not a functionality provided by Amazon Web Services.If you would like a way to log and analyze network traffic on your instance, you can try using Amazon VPC Traffic Mirroring [1][2] and monitor traffic using CloudWatch [3]. You can also look into using other popular network analyzer tools such as tcpdump and Wireshark.References:[1] https://aws.amazon.com/blogs/networking-and-content-delivery/using-vpc-traffic-mirroring-to-monitor-and-secure-your-aws-infrastructure/[2] https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html[3] https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirror-cloudwatch.htmlCommentShareKegan_Sanswered 9 months agoSUPPORT ENGINEERAWS_SamMreviewed 9 months ago"


Question: auto determine Lambda Layer ARN

We can add AWS provided layers to lambda via console.below is the line for cloudformationLayers:        - arn:aws:lambda:us-east-2:590474943231:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4where we can directly put ARN.but how to determine automatically based on name and version? so we we can have it dynamically for different region as well.tried same to determine using terraform as well but no luck data "aws_lambda_layer_version" "existing_security_layer" {   layer_name = "AWS-Parameters-and-Secrets-Lambda-Extension"  version= 4}FollowComment

Answer: "0The ARN for a Lambda layers is constructed as follows. Using this information you can construct the right ARN to put into things like CloudFormation and CDK.arn:PARTITION:REGION:ACCOUNT:layer:LAMBDA-LAYER-NAME:VERSIONIf you're operating in the AWS commercial regions (which is everything except our China regions and GovCloud) then REGION will be "aws".REGION is the region name that the Lambda Layer is deployed in.ACCOUNT is the account number that you're operating in.LAMBDA_LAYER_NAME is the name of the layer.VERSION is the version that you want to reference.You can find more information about how ARNs are constructed here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.htmlYou can also call the Lambda service using the ListLayers API to look for the current version of the Lambda Layer.CommentShareEXPERTBrettski-AWSanswered a month agoAli a month agounfortunately, that did not work.aws provided lambda layers is different in different region and it's different from logged-in account.if we want to create a lambda and add a layer using terraform or cloudformation without knowing the layer ARN beforehand, how to do that?I can pass the lambda layer name and version.also below commands is giving an empty listaws lambda list-layers \    --compatible-runtime python3.7Output[ ]ShareBrettski-AWS EXPERT22 days agoAt this time, there isn't an API to get a list of AWS-curated Lambda Layers.Share"


Question: Is Amazon S3 endpoint accessible from multiple VPC's?

Customer has multiple VPC's and is looking to avoid creating an S3 endpoint in each VPC. Is there a way for transit gateway to allow cross VPC endpoint communication?FollowComment

Answer: 1Accepted AnswerAmazon S3 uses Gateway Endpoints for which traffic has to be originated from the VPC itself and cannot be transitive. This Gateway Endpoint limitation is documented here: https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html#vpc-endpoints-limitations.An option to overcome this limitation is to use Amazon EC2 proxy Instances. More detailed information can be found here: https://d0.awsstatic.com/aws-answers/Accessing_VPC_Endpoints_from_Remote_Networks.pdfCommentShareEXPERTShakeel_Aanswered 4 years ago


Question: Has anyone ran into this spark error -  ERROR Utils: Uncaught exception in thread

"Hey I am running into this error during a data ingest job. The job has worked in the past with main different files but this one refuses to ingest.I am curious if anyone has over come it The error seems like some sort of threading issue and cant write data.Cloudwatch logs2023-02-23 19:13:01,888 ERROR [shutdown-hook-0] util.Utils (Logging.scala:logError(94)): Uncaught exception in thread shutdown-hook-0java.lang.ExceptionInInitializerErrorat com.amazon.ws.emr.hadoop.fs.files.TemporaryDirectoriesGenerator.createAndTrack(TemporaryDirectoriesGenerator.java:125)at com.amazon.ws.emr.hadoop.fs.files.TemporaryDirectoriesGenerator.createTemporaryDirectories(TemporaryDirectoriesGenerator.java:149)at com.amazon.ws.emr.hadoop.fs.s3n.S3NativeFileSystem.create(S3NativeFileSystem.java:356)at org.apache.hadoop.fs.FileSystem.create(FileSystem.java:1125)at org.apache.hadoop.fs.FileSystem.create(FileSystem.java:1105)at org.apache.hadoop.fs.FileSystem.create(FileSystem.java:994)at org.apache.hadoop.fs.FileUtil.copy(FileUtil.java:414)at org.apache.hadoop.fs.FileUtil.copy(FileUtil.java:387)at org.apache.hadoop.fs.FileSystem.copyFromLocalFile(FileSystem.java:2424)at org.apache.hadoop.fs.FileSystem.copyFromLocalFile(FileSystem.java:2390)at org.apache.hadoop.fs.FileSystem.copyFromLocalFile(FileSystem.java:2353)at com.amazon.ws.emr.hadoop.fs.EmrFileSystem.copyFromLocalFile(EmrFileSystem.java:568)at com.amazonaws.services.glue.LogPusher.upload(LogPusher.scala:27)at org.apache.spark.util.ShutdownHookManagerWrapper$.$anonfun$addLogPusherHook$2(ShutdownHookManagerWrapper.scala:9)at org.apache.spark.util.ShutdownHookManagerWrapper$.$anonfun$addLogPusherHook$2$adapted(ShutdownHookManagerWrapper.scala:9)at scala.Option.foreach(Option.scala:257)at org.apache.spark.util.ShutdownHookManagerWrapper$.$anonfun$addLogPusherHook$1(ShutdownHookManagerWrapper.scala:9)at org.apache.spark.util.SparkShutdownHook.run(ShutdownHookManager.scala:214)at org.apache.spark.util.SparkShutdownHookManager.$anonfun$runAll$2(ShutdownHookManager.scala:188)at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)at org.apache.spark.util.Utils$.logUncaughtExceptions(Utils.scala:1996)at org.apache.spark.util.SparkShutdownHookManager.$anonfun$runAll$1(ShutdownHookManager.scala:188)at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)at scala.util.Try$.apply(Try.scala:209)at org.apache.spark.util.SparkShutdownHookManager.runAll(ShutdownHookManager.scala:188)at org.apache.spark.util.SparkShutdownHookManager$$anon$2.run(ShutdownHookManager.scala:178)at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)at java.util.concurrent.FutureTask.run(FutureTask.java:266)at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)at java.lang.Thread.run(Thread.java:750)Caused by: java.lang.IllegalStateException: Shutdown in progressat java.lang.ApplicationShutdownHooks.add(ApplicationShutdownHooks.java:66)at java.lang.Runtime.addShutdownHook(Runtime.java:203)at com.amazon.ws.emr.hadoop.fs.files.TemporaryDirectoryShutdownHook.<clinit>(TemporaryDirectoryShutdownHook.java:18)... 31 moreFollowCommentGonzalo Herreros 3 months agoThat's a misleading error. The cluster is shutting down due to an error and that thread still tries to do something and finds it closed. Please checks the logs for the actual error that caused the unexpected shutdownShare"