Question: ElasticSearch Disk Throughput Throttle

"We have been getting "Disk Throughput Throtte" notifications 4-5 times every day on our ElasticSearch production cluster running on Elasticsearch 6.8."Your domain is experiencing throttling as you have hit disk throughput limits. Please consider scaling your domain to suit your throughput needs. Please refer to the documentation for more information: https://docs.aws.amazon.com/opensearch-service/latest/developerguide/monitoring-events.html."ThroughputThrottle metric shoots to 1 several times a day, even when WriteThroughput & ReadThroughput are less than 100k bytes/sec on both nodes.ReadIOPS & WriteIOPS at those timestamps are below 1 count/second (maximum), and ReadThroughput & WriteThroughput at those timestamps are below 1 MBps (maximum).We have enterprise support with AWS and they have advised us to move from gp2 to gp3 to increase our baseline throughput, but we do not believe that is the right solution because the requests to our cluster are very low and we do not see any spike in read/write throughput on CloudWatch.We also have a dev cluster with a similar number of requests per day and a smaller instance type for data nodes (t3.medium) with gp2 32GB but that is not being throttled, so we are unable to justify gp2 as the culprit.Looking for a second opinion before we make a decision on scale-up. Thanks in advance.Production cluster config:2 Data nodes of the type - m4.large.search using gp2 EBS storage 35 GiB3 Masster nodes of the type - t3.medium.searchFollowComment"

Answer: "0Hi There,Given that ThroughputThrottle metric is spiking to 1 frequently, it does indicates that the underlying GP2 based EBS volume on individual data node is throttling. As you might already be aware at this point, a value of 1 indicates that the requests (read/write) are being throttled due to limitations of underlying EBS volumes on data nodes.As AWS Premium Support had advised you already, switching to GP3 based EBS volumes should stop this CloudWatch metric bouncing to 1 and prevent any throttling issues with the underlying EBS volume. Furthermore, with GP3 based volumes you can individually scale the parameters — IOPS and Throughput, which is not feasible with GP2 based volumes. Moreover, GP3 based EBS volumes offer better baseline performance than its GP2 counterpart, and all of this at a lower cost than GP2.The below documentations from AWS should help you in making an informed decision.[+] Monitoring OpenSearch cluster metrics with Amazon CloudWatch - Cluster metrics: https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-cloudwatchmetrics.html#managedomains-cloudwatchmetrics-cluster-metrics[+] Monitoring OpenSearch cluster metrics with Amazon CloudWatch - EBS volume metrics: https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-cloudwatchmetrics.html#managedomains-cloudwatchmetrics-master-ebs-metrics[+] General Purpose SSD volumes - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/general-purpose.html[+] Amazon OpenSearch Service Pricing: https://aws.amazon.com/opensearch-service/pricing/Hope this helps in making an informed decision!CommentSharerePost-User-3196696answered 2 months ago"


Question: How to get the enable / disable of the trigger set in lambda with boto3.

"Hi,I want someone to tell me.How to get the enable / disable of the trigger set in lambda with boto3.For example,The s3 event set for lambda has been disabled.did get_policy ().The value of "action" of the returned json was "lambda: InvokeFunction".Why not "lambda: DisableInvokeFunction"?Or isn't it "action"?Or can't get it with get_policy ()?How can I get it?FollowComment"

Answer: "0Hi ,Please refer this link :https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/lambda.htmlThe above link has the info on how to create / delete trigger set in lambda , listed out all the possible methods supported by lambda.Thanks,UchihaMadaraCommentShareMadaraanswered 3 years ago0Hi,UchihaMadara,Thank you for the information:-)I know that lambda operation by boto3 is written in that url.And I tried all getxxx and listxxx methods that seem to be related.However, no useful results have been obtained....CommentShareKAROSHI1answered 3 years ago"


Question: lambda function always timing out when connecting to AWS Elasticsearch

"I have created an elastic search domain VPC mode and put the lambda function in the same VPC and even the same subnet along with the same security group with free access in all ports.I have given all the permissions like : AWSLambdaVPCAccessExecutionRole,elasticSearchPolicyinline Policy ,CloudWatchLogsFullAccess,AWSLambdaBasicExecutionRole but my lambda function is still timing out for a single document 60 seconds timeout. Do anybody know how to correct this?Edited by: sagarRsys on Nov 26, 2019 6:27 AMFollowComment"

Answer: "0The thing was error wasn't actualy in Elasticsearch part. My s3 access code and elasticsearch access code were tied up. Initially, s3 part was running fine due to lambda having default access to internet. However when i introduced elasticsearch, i put my lambda in vpc. During this time, I forgot that s3 code lost access to s3 storage. So when i ran the code and it was timing out, I assumed it was due to Elasticsearch. After hours of digging, I realized my error. The solution was to create Vpc endpoint for s3 service in that region and put it in the route table. elasticsearch was running fine.CommentSharesagarRsysanswered 4 years ago"


Question: S3 Static Website RoutingRules when using Cloudfront and a domain name

"Hello, I'm having a problem with my S3 RoutingRules on an S3 static website.I've got an S3 bucket dev.example.com set as static website hosting. I have a Cloudfront distribution using the bucket as an origin, via the s3-website URL (not the REST URL from the dropdown selection). My domain name is registered in R53 and pointed to the CloudFront distribution URL.All of that is working very nicely.However, I've been trying to add a 301 redirect from one bucket object to another - I moved a page on my website.So I've got my S3 bucket RoutingRules as follows:<RoutingRules>  <RoutingRule>    <Condition>      <KeyPrefixEquals>old-url</KeyPrefixEquals>    </Condition>    <Redirect>      <ReplaceKeyPrefixWith>new-url</ReplaceKeyPrefixWith>      <HttpRedirectCode>301</HttpRedirectCode>    </Redirect>  </RoutingRule></RoutingRules>When I visit dev.example.com/old-url, the redirect takes place, but takes me to dev.example.com.s3-website.eu-west-2.amazonaws.com/new-url - not to my domain name.Is it possible to tell S3 to redirect to the correct domain name?I have tried adding the full URL to the new page, i.e.<ReplaceKeyPrefixWith>https://dev.example.com/new-url</ReplaceKeyPrefixWith>but this doesn't work, I just get the S3 URL with my full URL on the end!Suggestions gratefully received.FollowComment"

Answer: 0Well it seems I rubber ducked myself.Of course there's theHostNameproperty.Which works a treat.CommentSharejames912648answered 4 years ago


Question: How to calculate the number of hours covered by EC2 Instance Savings Plans

"I am using EC2 Saving Plans for 6 instances. In the bill, I see On Demand Linux Instance Hour (hrs) and usage covered by EC2 Instance Savings Plans (hrs). I wonder how I can calculate the usage covered by SP.For instance (on August):Commitment: $0.42400/hour$0.125 per On Demand Linux m4.large Instance Hour: 4,464.000 Hrs (= 6 x 24 x 31)m4.large Linux instance usage in ap-southeast-1 covered by EC2 Instance Savings Plans: 4,393.599 HrsSP rate: $0.07400On-Demand rate:  $ 0.12500FollowComment"

Answer: "1Accepted AnswerYou stated that your Commitment - $0.424/hourHence if you run your 6 servers for 24 hours per day over the course of 1 month and wish to use SP to cover all the running hours (i.e. 100% coverage)You will need to purchase $0.074 (SP Rate) X 6 = $0.444/hour as a commitment to attain 100% on the savings plan.What you see currently covered by EC2 Instance Savings Plans: 4393.599 Hrs was due to the purchased SP commitment/hour which didn't cover the entire 4,464 hours in that month hence the rest of the hours not covered by the SP (~70.4 running hours of the 6 instances) will be charged at On-Demand rate of $0.125/Hr.Hope the above helps!CommentShareRaymond Tanswered 9 months agoduyl97 8 months agoMany thanks for your answer. I'm agree that 6 instances exceeded the commitment and be charged with On-Demand rate. I'm just confused if I could calculate the number of hour covered by SP or not. That will be useful when I plan to use more instances within the family instance.ShareRaymond T 8 months agoTo understand if your current commitment/hour is able to be covered by SP or not - simply take the 2 numbers and multiply by number of hours in a month like below -( Current commitment per hour / (SP rate of Instances * quantity) ) * number of hours in the monthTaking example above( $0.424 / ($0.074 * 6) ) * 4,464 hours = ~4,262.91 hours covered by SP in that month.SP cover per hour utilizations, hence should not be calculated as a per month but rather by looking at per hour coverage if you are looking to cover 100% under Savings Plans.Shareduyl97 8 months agoThanks for your info. That makes sense to me.Share"


Question: DocumentDB Autoscaling available?

Is auto-scaling available for DocumentDB? For both storage and compute?FollowComment

Answer: "0Hi, please see this link to understand scaling options for DocumentDB: https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-manage-performance.html.CommentShareEXPERTJonathan_Danswered a month agorePost-User-0947676 a month agoThank you. I've read that page. Does it mean that auto-scaling is available for storage but not compute?ShareMihai A a month agoCorrect, at this time there is no built-in mechanism to scale the compute layer automatically. You could implement a solution based on Cloudwatch and Lambda, for example when the alarm threshold is reached, Lambda script will be triggered to add a new replica to the cluster (scale out). See https://aws.amazon.com/blogs/database/amazon-documentdb-with-mongodb-compatibility-read-autoscaling/ or https://github.com/theuves/docdb-autoscaling/tree/masterShare"


Question: SSL Certifiacte

"Earlier we have Lets Encrypt SSL.  We have purchased a new 1 year ssl for our site.Now nobody able to figure out, how to remove lets encrypt and replace with new alpha SSL.FollowComment"

Answer: "0HelloWhen you create Lets encrypt Certificate from the Web servers Ngnix/Apache it will update the configuration files for the Website you have for example **some-website.conf **file, So how to update the Certificate inside the Webserver configuration, I do not have information about the Nginx or Apache but you have the information below,Apache SSL Configuration:Copy the SSL Certificate to the server including the private keyCheck the Configuration file of your website and update the configuration as below<VirtualHost 192.168.0.1:443>    DocumentRoot /var/www/html2    ServerName www.yourdomain.com        SSLEngine on        SSLCertificateFile /path/to/your_domain_name.crt        SSLCertificateKeyFile /path/to/your_private.key        SSLCertificateChainFile /path/to/DigiCertCA.crt    </VirtualHost>Once done save the file and run a command apachectl configtest to check your configuration is correct.then restart service apache2 restartNginx SSL Configuration:`server {listen 443;ssl on;ssl_certificate /etc/ssl/ssl-bundle.crt;ssl_certificate_key /path/to/your_private.key;root /path/to/webroot;server_name your_domain.com;}access_log /var/log/nginx/nginx.vhost.access.log;error_log /var/log/nginx/nginx.vhost.error.log;location / {root /var/www/;root  /home/www/public_html/your.domain.com/public/;index index.html;}}`CommentShareGKanswered a year ago"


Question: AWS Greengrass V2 Console: Cannot create a component version

"Description:Trying, and failing, to publish a greengrass component in the ca-central-1 region.I have read and checked the steps in:https://docs.aws.amazon.com/greengrass/v2/developerguide/troubleshooting.html for the error, 'Invalid Input: Encountered following errors in Artifacts: {<s3ArtifactUri> = Specified artifact resource cannot be accessed}'Tools/Versions:aws-cli/2.10.3 Python/3.9.11 Linux/5.15.0-60-generic exe/x86_64.ubuntu.20Command:aws greengrassv2 create-component-version --inline-recipe fileb://<name>-<version-number>.yamlDebug steps taken:Both AWS S3 bucket and create-component-version invocation are in the same region (ca-central-1). Set with both --region flag in the command, and with aws configure default region. both 'ca-central-1'The S3 artifact URI is valid - i can aws s3 cp dopy it locallyi can create the component via the console, but not using aws cliAWS account has permissions (full admin permissions set, no deny policies)RESOLVED - see comment on response below re. credentialsFollowComment"

Answer: "0Hey @scriobhneoir,It is possible that there is an error on your recipe with your s3 URL. Make sure the artifact exists on that path on s3 before running that command.CommentShareochoanelanswered 3 months agoscriobhneoir 3 months agoI’m able to run AWS S3 cp , and ls, on the URI included in the error message.The exact same recipe, when copy pasted manually into the console, ( signed in as the same user ) works, and successfully creates the componentSharescriobhneoir 3 months agoThe issue was my local credentials - they had to be refreshed. Although I could S3 copy/ls with the credentials I had on my cli, they did not permit me to issue greengrass client commands, once they were refreshed I could.Share"


Question: [Bug] AVG() function does not work in Redshift materialized view

"If I create a materialized view using the AVG() function, it raises an error when I query data from that view. Meanwhile, the function works just fine on a normal view.I'm attaching below the query to replicate this bug.FollowComment"

Answer: 0If you have a support ticket with AWS please post the ticket number here and we can review this in more details.CommentShareAWS-User-4882824answered 9 months ago


Question: Site to site VPN on Lightsail

Is there any possibility to configure site to site VPN on a LightSail Linux Bundle. Setting up my development environment and trying to configure wireguard for ssh tunneling. Appreciate your help!.FollowComment

Answer: "0check below youtube link , explaining step by step to setup VPNhttps://www.youtube.com/watch?v=Ro8Y8IhtB3ECommentShareSachinanswered 3 months ago"


Question: Encryption of LightSail Instances

"I've created a Lightsail Instance.  I have not created any addition 'attached disks'.  I'm running an IP PBX application in this Lightsail instance.  This IP PBX application includes voice mail.  So voice mails are created and stored in a folder.  It works very well.My question involves encryption.The documentation does state that "attached disks" (aka Block Storage Disks) are encrypted.But, it does not indicate whether or not the storage in an 'Instance' is encrypted or not.So that is my question.  Is the data that is created and stored by my application in a Lightsail instance encrypted at rest?  Or do I need to use an additional 'attached disk' (Block Storage Disk), in which to store data that I wanted encrypted at rest?FollowComment"

Answer: "2According to the Lightsail FAQ, yes it does encrypt the data at rest and in motion.What does Lightsail manage for me?Lightsail manages a range of maintenance activities and security for your managed database and its underlying infrastructure. Lightsail automatically backs up your database and allows point in time restore from the past 7 days using the database restore tool, to help protect against data loss or component failure. Lightsail also automatically encrypts your data at rest and in motion for increased security and stores your database password for easy and secure connections to your database. On the maintenance side, Lightsail runs maintenance on your database during your set maintenance window. This maintenance include automatic upgrades to the latest minor database version and all management of the underlying infrastructure and operating system.Does Lightsail block storage offer encryption?Yes, to help keep your data secure, all Lightsail attached disks and disk snapshots are encrypted at rest by default, using keys that Lightsail manages on your behalf. Lightsail also provides encryption of data as it moves between Lightsail instances and attached disks.CommentShareEXPERTTushar_Janswered 8 months agoEXPERTChris_Greviewed 8 months agopaulio 7 months agoI do not see how this answer addresses whether or not an Instance is encrypted at rest. It definitely describes how the db and block storage are. And thank you for that!Would you have any further information on whether or not a Lightsail root instance is encrypted at rest?Share"


Question: Synthetics Canary keeps failing with 403 error

"I cannot get canary to hit api gateway endpoint. I keep getting an error below. I can hit the api using postman without authentication key so not sure why I can't do the same using synthetic canary. The API is within the same account as the canary also if this helps. Please can anyone help me with this? (Arn changed for privacy so please ignore this fact.){"message":"User: anonymous is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-east-1:********2234:54354534534/test/GET/mezzanine with an explicit deny"}The code I have for the canary is:const synthetics = require('Synthetics');const log = require('SyntheticsLogger');const syntheticsConfiguration = synthetics.getConfiguration();const apiCanaryBlueprint = async function () {syntheticsConfiguration.setConfig({    restrictedHeaders: [], // Value of these headers will be redacted from logs and reports    restrictedUrlParameters: [] // Values of these url parameters will be redacted from logs and reports});// Handle validation for positive scenarioconst validateSuccessful = async function(res) {    return new Promise((resolve, reject) => {        if (res.statusCode < 200 || res.statusCode > 299) {            throw new Error(res.statusCode + ' ' + res.statusMessage);        }        let responseBody = '';        res.on('data', (d) => {            responseBody += d;        });        res.on('end', () => {            // Add validation on 'responseBody' here if required.            resolve();        });    });};// Set request option for Verify https://453453453.execute-api.us-east-1.amazonaws.comlet requestOptionsStep1 = {    hostname: '4534535.execute-api.us-east-1.amazonaws.com',    method: 'GET',    path: '/test/mezzanine',    port: '443',    protocol: 'https:',    body: "",    headers: {"health":"true"}};requestOptionsStep1['headers']['User-Agent'] = [synthetics.getCanaryUserAgentString(), requestOptionsStep1['headers']['User-Agent']].join(' ');// Set step config option for Verify https://5345345345435.execute-api.us-east-1.amazonaws.comlet stepConfig1 = {includeRequestHeaders: true,includeResponseHeaders: true,includeRequestBody: true,includeResponseBody: true,continueOnHttpStepFailure: true};await synthetics.executeHttpStep('Verify https://45345334535.execute-api.us-east-1.amazonaws.com', requestOptionsStep1, validateSuccessful, stepConfig1);};exports.handler = async () => {return await apiCanaryBlueprint();};For the API I have no Auth on and the resource Policy is:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "","Action": "execute-api:Invoke","Resource": "arn:aws:execute-api:us-east-1:34324234234234:343243242///"},{"Effect": "Deny","Principal": "","Action": "execute-api:Invoke","Resource": "arn:aws:execute-api:us-east-1:3432434234:434324234///","Condition": {"NotIpAddress": {"aws:SourceIp": ["23.23.23.23/32","23.23.23.23/32","23.23.23.23/32"]}}}]}I have also tried leaving the resource policy blank and also with the below code but still cannot get this canary to work.{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "","Action": "execute-api:Invoke","Resource": "arn:aws:execute-api:us-east-1:4534534543:4543534543534///"}]}FollowComment"

Answer: "1Hi ThereHave you run through the troubleshooting steps here?Also is this canary running in a vpc?  if so does your VPC have internet access? See  hereThe canary being in the same account as the API Gateway doesn't matter too much, you would still need to make sure the canary has the appropriate permissions and networkingCommentShareEXPERTMatt-Banswered 4 months ago0got it working, thank you, it looks like the software guys had not got the api set up properlyCommentSharerePost-User-1495231answered 3 months agotsiu 3 months agoHi there, I'm curious what your software guys set up to get the synthetics working? I have exactly the same scenario with the exception that I verified the Synthetic call succeeds against our API GW REST API when I temporarily removed the "Deny" statement from our resource policy. Our resource policy also has a "Deny" to explicitly block all traffic coming from outside our VPN. Our Synthetic is running in the same account as our API GW, which is a regional endpoint type. I'm a little confused over how I can additionally unblock traffic from CW Synthetic in addition to keeping my existing inbound traffic limited to our VPN. I've tried use "aws.SourceVPC", but that didn't work and I think that only applies private API GW endpoints. Any suggestions on how else I might debug this? And yes, I did look through the troubleshooting doc and could not find anything which helps me. Thanks!Share0In addition, can you check to make sure the end of your IAM permissions for execute-api:Invoke Resource is /*CommentSharehungstepanswered 3 months ago"


Question: Member account access to control tower s3 log bucket

"I have a control tower setup and the s3 logging bucket is delegated to the logging archive account.  I am trying to create an SCP with Access Analyzer from a member account.   I got it to work from the main account, but get denied access to the control tower s3 log bucket from member account.How can I get the IAM access analyzer to run?And is this the best way to implement guardrails for new clients who don’t know what guardrails to start with?FollowComment"

Answer: "3Unfortunately, Control Tower prevents you from modifying the access to your S3 log bucket and granted member accounts access. There are several Guardrails Control Tower deploys upon initializing your landing zone.  Some of these are "Mandatory Guardrails" and cannot be deactivated.Mandatory controlsMandatory controls are owned by AWS Control Tower, and they apply to every OU on your landing zone. These controls are applied by default when you set up your landing zone, and they can't be deactivated. Following, you'll find a reference for each of the mandatory controls available in AWS Control Tower.* Disallow Changes to Bucket Policy for AWS Control Tower Created Amazon S3 Buckets in Log Archive{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "GRCTAUDITBUCKETPOLICYCHANGESPROHIBITED",            "Effect": "Deny",            "Action": [                "s3:PutBucketPolicy",                "s3:DeleteBucketPolicy"            ],            "Resource": ["arn:aws:s3:::aws-controltower*"],            "Condition": {                "ArnNotLike": {                    "aws:PrincipalARN":"arn:aws:iam::*:role/AWSControlTowerExecution"                }            }        }    ]}https://repost.aws/questions/QUOh2j9EkES3uqMeIVakwdNQ/grant-access-to-control-tower-created-cloudtrail-s-3-bucketAWS Control Tower Guardrail prevents updates to bucket policies, so you will need to log into the Organization Management account first, then use the Switch Role capability from the drop down menu under your login in the upper right, to assume the AWSControlTowerExecution role in the Logging account. Using that role, you will be able to update the bucket policy in the Logging account. If you prefer doing this in code, you can also accomplish this using the AssumeRole cli command.CommentShareabemusaanswered 2 months agoabemusa 2 months agohttps://repost.aws/questions/QUOh2j9EkES3uqMeIVakwdNQ/grant-access-to-control-tower-created-cloudtrail-s-3-bucketAWS Control Tower Guardrail prevents updates to bucket policies, so you will need to log into the Organization Management account first, then use the Switch Role capability from the drop down menu under your login in the upper right, to assume the AWSControlTowerExecution role in the Logging account. Using that role, you will be able to update the bucket policy in the Logging account. If you prefer doing this in code, you can also accomplish this using the AssumeRole cli command.Share"


Question: .ai TLD support in Route53

"Hello,Just posting here to request for .ai TLD support in AWS Route53 as soon as it is possible, for transfer and creation.Thanks!FollowComment"

Answer: "1Today you can create a Hosted Zone with a .ai TLD, you only cannot register or transfer the domain ownership to Amazon Route 53.    This means you can point your name servers at your current registrar to Route 53 to manage your DNS.Registering a .ai TLD within Route 53 is on the roadmap with no public ETAs.I recommend subscribing to https://aws.amazon.com/about-aws/whats-new/2022/ and filtering for "Networking & Content Delivery > Amazon Route 53" for updates specific to Route 53.CommentShareEXPERTChris_Ganswered a year agoAlon Bar-Lev a year agoJust to let you know, we also would like to manage our domain within .ai TLD in Route53Share"


Question: Cannot add environment variable through Ebextensions

"I'm using .ebextensions to create VPCEndpoints so in the Resources section I've addded the needed section for the VPCEndpoint. Then after that in the  option_settings section I'm trying to add an environment variable in my elastic beanstalk application referencing the created VPCEndpoint, but when i check the environment variables from the elastic beanstalk console the value is added as a plain text not the Ref of the VPCEndpoint(Check the screenshot)So how can i make it interpret the Ref of the endpoint ?Resources:  NewsonarVPCEndpoint:    Type: AWS::EC2::VPCEndpoint    Properties:      PrivateDnsEnabled: false      SecurityGroupIds:        - {"Fn::GetOptionSetting": {"Namespace": "aws:elasticbeanstalk:application:environment", "OptionName": "ALLOW_INBOUND_FROM_VPC_SECURITY_GROUP", "DefaultValue": "default_value"}}      ServiceName: {              "Fn::Join": [                "", [                  "com.amazonaws.vpce.",{"Fn::GetOptionSetting": {"Namespace": "aws:elasticbeanstalk:application:environment", "OptionName": "AWS_REGION", "DefaultValue": "us-east-1"}},".",{"Ref": "sonarVPCEndpointService"}]]            }      SubnetIds:        - { "Ref": "Subnet1Id" }        - { "Ref": "Subnet2Id" }        - { "Ref": "Subnet3Id" }      VpcEndpointType: Interface      VpcId: { "Ref": "VpcId" }option_settings:  aws:elasticbeanstalk:application:environment:    VPC_ENDPOINT: '`{"Ref" : "NewsonarVPCEndpoint"}`'FollowComment"

Answer: "0Hello,If you use an AWS CloudFormation function to define an environment property, the Elastic Beanstalk console displays the value of the property before the function is evaluated. You can use the get-config platform script  to confirm the values of environment properties that are available to your application. See Environment properties and other software settings.CommentShareSUPPORT ENGINEERSreshtha_Kanswered 7 months ago"


Question: file won't update

"I just updated one of my website's htm files. I uploaded this new file to my S3 folder but I'm not seeing the changes when I check my website. The file on AWS shows that the file date is new, today's date,  but the website is still showing the old page before the latest changes. What's going on?Also, I noticed at the address bar my Amazon website says "not secure", shouldn't this say "secure"? I joined AWS for reliability and security.FollowComment"

Answer: "1Hi - If you are using static website from S3, then Amazon S3 website endpoints do not support HTTPS or access points. If you want to use HTTPS, you can use Amazon CloudFront to serve a static website hosted on Amazon S3. For more information, see How do I use CloudFront to serve HTTPS requests for my Amazon S3 bucket? To use HTTPS with a custom domain, see Configuring a static website using a custom domain registered with Route 53. Further if you are using a cache in your case, then check the TTL or else invalidate the cache.Reference : https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteEndpoints.htmlCommentShareEXPERTAWS-User-Nitinanswered 2 months agoEXPERTalatechreviewed 2 months ago1Internet browsers normally include the capability of caching pages in order to make your internet browsing a quicker experience. The problem that occurs is that sometimes you visit a page where a change has occurred and it does not appear because you’re seeing the old cached version that your browser stored. This can be easily fixed by simply clearing the browser cache.Run the browser in incognito mode. When you first open an incognito window, a new temporary folder is created to hold your cache. Previously-cached browser data is not used in the incognito window. When you close the window, the temporary cache is deleted.CommentShareHemant Chughanswered 2 months ago0Thanks for the tips.I copied the link and and tried it in two other web browsers, MS Edge and Brave,  no difference. For some reason, this one htm file will just not update in the AWS S3 folder.I have this identical webpage on another webhost, Award Space, and the new htm file uploads just fine and the latest changes are there. It takes me to the correct link in my webpage when I click on the link.Any thoughts? Should I delete everything and re-upload?CommentSharerePost-User-0566376answered 2 months agoHemant Chugh 2 months agoIf file is not getting updated last option as you said delete everything and re-upload. That should refresh everything.Share"


Question: Adding UUID tag while creating certificates via ACM

"While creating a private certificate via ACM, i have added tag askey: UUIDvalue: "xxxxx"While adding a condition in IAMRolesAnywhere trust policy i added below:"Condition": {"StringEquals": {"aws:ResourceTag/UUID": "xxxxx"}}If i do that, while generating temporary credentials, i get error:2023/04/11 08:48:11 AccessDeniedException: Unable to assume role for arn:aws:iam::977695881:role/testIAMRolesAnywhere.If i remove condition, it works fine.Is there anything wrong with the condition?FollowComment"

Answer: "0That condition is testing the tags of the role, since that is the resource specified in the policy and the resource the policy is attached to.Instead of testing the tag of a certificate, test the attributes that are extracted from the cert. See: Trust policy.I would put it in the Subject Name Alternative, DirName, CommonName. But you will need to use the CLI to generate this as the console does not have this option. See: issue-certificate.CommentShareEXPERTkentradanswered 2 months agorePost-User-4222090 2 months agoOk, thanks. In certificates, subject CN is the domain name we provide while ACM creates the certificate. My use case needs to add UUID in the certificates to differentiate between 2 devices. Where should UUID be added?Share"


Question: How many Nodes/Requested does Created/Manage by 1 ELB

"I am new to ELB, Wanted to use Application load balancer. Total count of web users are near to 1k so How many ALB needed to manage these requests.How many nodes will be created by 1 ELB.How many EC2 can be configured to 1 ELB.Is it good to even go with 1 ELB to handle 4 EC2 or Go with 1 EC2 in which Apache load balancer install to handle these 4 EC2 since it is open source?FollowComment"

Answer: "1Accepted AnswerHow many ALB needed to manage these requests?I believe one ALB will work just fine. ALB will scale based on incoming traffic.How many nodes will be created by 1 ELB?At least one per availability zone. Additional nodes are added in case of scaling.How many EC2 can be configured to 1 ELB?You usually configure/create target groups in which you place targets. In your case EC2 instances.Per docs, there is a limit of 100 target groups per ALB and a limit of 1000 targets per ALB.Check this link: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-limits.htmlIs it good to even go with 1 ELB to handle 4 EC2or Go with 1 EC2 in which Apache load balancer install to handle these 4 EC2 since it is open source?If you go with EC2 and apache then you will have to manage it on your own (ensure HA, scaling, patching).ALB is the better option here.CommentShareweexanswered 7 months agorePost-User-8467960 7 months agoHow many requests 1 ALB can handle?Shareweex 7 months agoThere is no exact number or at least I could not find it in the docs.  ALB will scale up aggressively as your traffic increases. In theory, it can handle an unlimited number of requests. In some cases, ALB may return 503 errors if it is not able to scale up fast enough. This can happen if your baseline traffic is low and you have sudden request spikes. In cases like that, there is an option to pre-warm ALB.  You could hit ALB with requests in advance to force it to scale, but the best practice is to contact AWS support to do it for you. Anyway, you should test it with your expected traffic and see how it behaves for your use case.   Reference: https://aws.amazon.com/articles/best-practices-in-evaluating-elastic-load-balancing/#pre-warmingShare0In your query you have mentioned about Apache load balancer. ALB is almost similar in that functionality with 2 more benefits. 1. Managed by AWS so you don't take overhead of managing it. In Apache since you will be deploying it then it becomes your responsibility of managing. 2. Cloud Native service - That means it will fit and can be used by other AWS services. ALB is one of the ELB type. There are Network Load Balancing and Gateway Load Balancing. https://docs.aws.amazon.com/elasticloadbalancing/index.htmlNow coming to choosing the number of EC2 in your ELB(specifically ALB) can be done in the following manner.Using target groups based on the  request from client. Create listeners to check for connection requests from clients, and listener rules to route requests from clients to the targets in one or more target groups.Use auto scaling group in control the number of EC2 instances. It has min and max values. For the specific use case you have mentioned go ahead min as 1 and max as 3. To use Elastic Load Balancing with your Auto Scaling group, attach the load balancer to your Auto Scaling group.  You can see further details here.https://docs.aws.amazon.com/autoscaling/ec2/userguide/autoscaling-load-balancer.htmlCommentShareBiswaanswered 7 months ago"


Question: AWS IoT as drop-in replacement for existing MQTT server?

"AWS IoT uses MQTT, but can it also just replace an existing MQTT server for an architecture that was not set up with AWS in mind?When setting up AWS IoT, one is very much steered to creating devices and 'things' in the AWS panel. "Getting Started" (https://docs.aws.amazon.com/iot/latest/developerguide/iot-gs.html) starts with registering devices, creating a certificate for it, etc. What I can't seem to get clear, is whether one can use AWS IoT as a simple drop-in replacement for any MQTT server, to which clients simply publish and subscribe, especially when your server implements custom authentication. Basically just this part: https://docs.aws.amazon.com/iot/latest/developerguide/iot-message-broker.html but then with custom, stateful, authentication.For instance, with Mosquitto or HiveMQ (and probably others), you can simply implement a Java or C interface for 'login', 'ACL check', etc. You can write any code you want, which we did: a C++ .so file that looks at what patterns the username contains, takes different authentication routes based on that, caches the result, etc. Any device that is connected can authenticate, then simply publishes, and any client can subscribe to those publishes, provided the authorization back-end grants it, based on a user profile stored in a MySQL DB.I would like to implement this using AWS IoT if possible. Is it?FollowComment"

Answer: "0Hi Wiebe,While a straight drop-in replacement may not be achievable (devices will need some update to get credentials via custom auth, point at new endpoint, configure custom auth in back-end, etc), AWS IoT Core can be used as a managed MQTT broker without opting in to any of the higher level device and management features. You're definitely looking at some level of effort to switch, though the use case described is supported.Note there are a few differences between the broker implemented in AWS IoT Core and the official MQTT 3.1.1 spec from which it is derived. These are documented here: https://docs.aws.amazon.com/iot/latest/developerguide/mqtt.htmlIf you just want a managed MQTT broker without the bells and whistles of AWS IoT, take a look at Amazon MQ https://aws.amazon.com/amazon-mqHTH,Ryan@AWSCommentShareRyan_Banswered 4 years ago0Thanks Ryan. Unfortunately my case isn't fixed with the snap of a finger apparently, but your answer helped. I'll have a look at the plain MQ.CommentShareWiebeanswered 4 years ago"


Question: NEUTRAL SPF validation when sending from only one of my verified domains

"We have a system sending emails for lots of our clients. Eveyone of them is verified using the same process where we create a domain into AWS SES and with our clients, we create approriates DNS entries into their DNS system. (TXT record for verification, CNAMEs for DKIM signatures and MX + TXT records for MAIL FROM custom domain). After everything is verified, we activate the "send email" feature.We encountered a situation where only one of our clients is getting a NEUTRAL SPF validation. I can repro easily using the "Send Test Email" button from the AWS portal for that particular domain where all other domains (70+) always gets full validation.Can you help out finding whats wrong?The client successfully created into his DNS the appropriate MX and TXT records for the custom MAILFROM info.csportneuf.qc.ca having the TXT record value to "v=spf1 include:amazonses.com ~all". Checked with Powershell Resolve-DNSName -Name info.csportneuf.qc.ca -Type TXTAfter sending to a GMail address and looking at "Original message" or header, we can see the following:Received-SPF: neutral (google.com: 54.240.11.127 is neither permitted nor denied by best guess record for domain of 0100016b0494cee6-e942c362-c724-42c7-8db0-90db23fdb43c-000000@info.csportneuf.qc.ca) client-ip=54.240.11.127;Is that particular IP not considered as being amazonses.com?FollowComment"

Answer: "0Accepted AnswerHello,I was able to reproduce the same way you have your configuration. In order to resolve this, please correct the TXT record for the custom mail from.Currently it is =>$ dig TXT info.csportneuf.qc.ca +short""v=spf1 include:amazonses.com ~all""Please change that (in the value in your dns settings) =>"v=spf1 include:amazonses.com ~all"The TXT records for other custom mail from are set in the same manner. For example:$ dig TXT info.cqsb.qc.ca +short"v=spf1 include:amazonses.com ~all"Please wait for the change to propagate and test it. This should fix the issue.Regards,Gaurav @ AWSCommentShareAWS-User-7751712answered 4 years ago0Hi Gaurav,Thanks for your reply and sorry for replying that late but i seem to have missed the email notification when you replied. Just discovered you had answered me!According to my issue, i want to make sure i understand the right usage of the "quote" character.In the AWS console, when you generate entries for TXT domain validation, DKIM Cnames and MX records, you do not use any "quotes" characters around the value you generate except for the TXT record for the SPF entry where you actually include the "quote" into the following value=> "v=spf1 include:amazonses.com ~all"When i ask my customer to add those entries into his DNS for validation, shall i ask them to NOT include the "quotes" or should they? My probleme seems to happen when the customers includes the quotes when entering the value into his DNS. If so, why do you include the quotes only into this entry into the AWS console?CommentShareperreaultdanswered 4 years ago"


Question: Glue job error : run ID: jr_f96799827354866ac2e798fb8b40d5781284e5ed5b3a4ff

"When i try to run Glue job using python to Relationalize array and struct data...Job run ID: jr_f96799827354866ac2e798fb8b40d5781284e5ed5b3a4ff519d6bced541913bcI'm getting below errorINFO Log4j appears to be running in a Servlet environment, but there's no log4j-web module available. If you want better web container support, please add the log4j-web JAR to your web archive or server lib directory.Any one know the resolution for this issuesFollowComment"

Answer: "0This is no error. The INFO flag already tells us that this is not an error and no need to worry about.Edited by: paragshahade on Apr 29, 2021 7:02 AMEdited by: paragshahade on Apr 29, 2021 7:03 AMCommentShareparagshahadeanswered 2 years ago0Spark uses log4j for logging. To remove the INFO from the log, You can download logf4j-web-<version>.jar from apache (https://logging.apache.org/log4j/2.x/download.html) and upload the jar file to Amazon Simple Storage Service (Amazon S3), and use the jar file in the AWS Glue job.To reference the Jar file from the S3 in the glue  job, do the following:Open the AWS Glue console.In the navigation pane, choose Jobs.Select the job - Drop down Actions, and then choose Edit job.Expand the Security configuration, script libraries, and job parameters (optional) section.In the  Dependent jars path, paste the full S3 path where you stored the log4j-web jar file.CommentShareMuthuvelan_Sanswered 2 years ago"


Question: sql server restore from backup is failing

"Hi,I'm trying to restore my small (under 1GB) database:exec msdb.dbo.rds_restore_database@restore_db_name='KlionskyDB',@s3_arn_to_restore_from='arn:aws:s3:::amazon-klionsky-org-db/DB_29907_kliondb2017_backup_2021_05_24.bak'but getting the same error right away:[2021-05-25 05:34:22.140] Aborted the task because of a task failure or a concurrent RESTORE_DB request. [2021-05-25 05:34:22.400] Task has been aborted [2021-05-25 05:34:22.407] Error making request with Error Code Forbidden and Http Status Code Forbidden. No further error information was returned by the service.Please help!DanielFollowComment"

Answer: "0Accepted AnswerThank you for the response :)So, RDS needs permissions to access your S3 bucket to upload and download database backups. To provide this access to RDS, you can do one of two things. You can provide your own AWS Identity and Access Management (IAM) role—this approach comes in handy when you already have an IAM role that contains a bucket where you want RDS to place backups or retrieve backups from. Or you can let RDS set up an IAM role for you in the background by providing the necessary information.As per my previous message: "How to restore your backup:https://aws.amazon.com/blogs/database/migrating-microsoft-sql-server-enterprise-workloads-to-amazon-rds-part-1/it contains all the detailed steps"Have a look at the above link Migrating Microsoft SQL Server Enterprise Workloads to Amazon RDS.The S3 bucket does not have to be public but the IAM role that will be used by the SQLSERVER_BACKUP_RESTORE option group needs to have access to the bucket. See step 5 in the above link.I hope this helps! Feel free to reach out if you have any questions.CommentSharenaz97answered 2 years ago0Hi DanielAT2021Thank you for reaching out :)First, could you please confirm that you are not hitting one of the limitations here - Importing and exporting SQL Server databases - Limitations and recommendations: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.html#SQLServer.Procedural.Importing.Native.LimitationsTo troubleshoot the HTTP 403 Forbidden error from the Amazon S3 console, please check the following:1. Missing permissions to s3:PutObject or s3:PutObjectAcl  Verify that the AWS Identity and Access Management (IAM) user or role that you're using has permissions for the s3:PutObject action on the bucket. Without this permission, you get an HTTP 403 Forbidden error.2. Missing permissions to use an AWS Key Management Service (AWS KMS) key  If you are using AWS KMS, you must have the permissions to use the key. Please see below link to grant permission:https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying.html#key-policy-modifying-how-to3. Explicit deny statement in the bucket policy   Review the bucket policy for any statements that explicitly deny ("Effect": "Deny") permission for s3:PutObject unless certain conditions are met. Verify that your action meets the bucket policy requirements for access to the s3:PutObject action.4. Bucket access control list (ACL) doesn't allow the AWS account root user to write objects  You can check your Bucket ACLs by using the guide in the following link:https://docs.aws.amazon.com/AmazonS3/latest/userguide/managing-acls.html5. AWS Organizations service control policy doesn't allow access to Amazon S3  If you're using AWS Organizations, then check the following link on service control policies:https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html#orgs_manage_policies_scpAdditionally, I have provided more resources:For more troubleshooting options:https://aws.amazon.com/premiumsupport/knowledge-center/s3-troubleshoot-403/How to restore your backuphttps://aws.amazon.com/blogs/database/migrating-microsoft-sql-server-enterprise-workloads-to-amazon-rds-part-1/ it contains all the detailed stepsI hope this helps!CommentSharenaz97answered 2 years ago0thank you for your suggestions, naz97.I had to have to make s3 access public in order to make it work.Is that correct solution?Edited by: DanielAT2021 on May 25, 2021 8:57 AMCommentShareDanielAT2021answered 2 years ago"


Question: EC2 Linux Domain Join w/ SSM - AWS-JoinDirectoryServiceDomain - winbind vs sssd...

"Hi all, a bit of a strange one here. I've been trying to rework my environment so that we can enable seamless domain join for any and all instances created moving forward and up until now, we have been manually joining Linux EC2 instances using sssd.In following the documentation here (https://docs.aws.amazon.com/directoryservice/latest/admin-guide/seamlessly_join_linux_instance.html) I came to find that the AWS-JoinDirectoryServiceDomain SSM Document instead uses winbind, which threw things for a bit of a loop as nearly every component we configured with sssd in the past was not applicable with winbind (limiting ssh access to the instance to specific groups, realm commands were slightly different, fsx for windows mounting commands, etc).After some reading, it seems that sssd is the preferred method as it is more modern and supports greater flexibility. Is there a reason winbind is being used here? Does AWS plan on updating this document to use sssd instead? Given all of the little challenges initially faced with my first seamless domain joined machine, I'm a little wary of continuing to use this document/method of seamlessly joining machines to my domain.Thanks!FollowComment"

Answer: "2Accepted Answersssd is indeed the preferred method to add Linux instances to Active Directory, however, it has one limitation in that it does not support forest trust authentication. RedHat documentation states:SSSD only supports domains in a single AD forest. If SSSD requires access to multiple domains from multiple forests, consider using IPA with trusts (preferred) or the winbindd service instead of SSSD.See: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/integrating_rhel_systems_directly_with_windows_active_directory/connecting-rhel-systems-directly-to-ad-using-sssd_integrating-rhel-systems-directly-with-active-directory#connecting-to-multiple-domains-different-ad-forests-sssd_connecting-directly-to-adMost customers using managed AD today have a Forest trust back to there on-prem and require cross authentication over the trust, using sssd for domain join would block this cross authentication. To workaround this sssd limitation, Winbind which supports Forest trusts by default was used in seamless domain join script.I will have raise a feature request on your behalf so we could have a separate document that defaults to sssd for Active Directory domain joinCommentSharerePost-User-5406923answered 4 months agothe-aws-architech 4 months agoThanks for the detailed response and for looking into this further. The organization I'm working with started all on-cloud so there's no on-premise or legacy forest to connect back to. It would be a great alternative to either have the option to select winbind vs. sssd in the document or, if not, just to have a separate document that moves to the newer, preferred method.Share"


Question: Access to Feeds.SubmitFeed is denied

"I am trying to connect Seller Partner API from C# console , but it will gives error "Access to Feeds.SubmitFeed is denied"  for SubmitFeedRequests .Passed all required parameters i.eActionMarketplaceIdListMerchantMWSAuthTokenFeedTypeContentMD5ValueAWSAccessKeyIdTimestampVersionSignatureVersionSignatureMethodSignaturePlease suggest .FollowComment"

Answer: 0You may want to post this on the Seller Central forum here:Seller Central Marketplace Web Services (MWS) ForumCommentShareEXPERTChris_Ganswered a year ago


Question: Urgent update of First Name

"Hi,My first name in identification documents includes the middle also in a single line whereas my certification account just has the first name.I raised a few tickets in the certification account but unfortunately, it has not been actioned yet.Kindly assist in updating my first name.Candidate ID: AWS01384827Regards,FollowComment"

Answer: "0kansari1,Our Customer Support team will respond to your ticket as quickly as possible. We appreciate your patience.KimAWS CertificationCommentShareKimWD-AWSanswered 2 years ago0Thanks, Kim for your response, I have just sent you a PM, kindly check.regards,CommentSharekansari1answered 2 years ago0Thanks a lot Kim for your timely help.CommentSharekansari1answered 2 years ago"


Question: S3 Bucket simultaneously exists and doesn't exist

"Hello,I have the following list of S3 buckets, as shown by the command below:$ aws s3 ls2023-04-27 20:21:10 mys3nsbyt2023-04-27 20:21:11 mys3oestlTrying to delete these bucket I get:$ aws s3api delete-bucket --bucket mys3nsbytAn error occurred (NoSuchBucket) when calling the DeleteBucket operation: The specified bucket does not exist$ aws s3api delete-bucket --bucket mys3oestlAn error occurred (NoSuchBucket) when calling the DeleteBucket operation: The specified bucket does not existHow come that the buckets exist when listed and don't exist when trying to delete them ? And what am I supposed to do here ? For having googled for a while, I can see several times this issue to be reported, but no any pertinent solution, other than to wait 10 hours in order that it disappears by itself.Many thanks in advance,NicolasFollowComment"

Answer: "1HiGenerally, when you issue a delete API call to delete a S3 bucket, it will be sent to a bucket deletion queue and this queue will be processed and replicated across all regions.  This is a completely automated process and it is not performed immediately and can take some time to replicate across all regions.Until the bucket is removed by S3,  you may see the bucket in the response of  ListAllMyBuckets request due to S3 eventual consistency, however you cannot perform any other action on this bucket.I would suggest you to wait up to 24 hours after the bucket deletion time and then check the S3 console.CommentSharemadhuri_danswered a month agoNicolas a month agoYou seem to find that normal to wait 24 hours such that an operation to terminate. Is that supposed to be a solution ?Share0Accepted AnswerThe issue has disappeared by itself 24 hours later. That's crazy that people accept to leave with that !CommentShareNicolasanswered a month ago0I suggest trying with the switch --region and pass where the bucket exists. If you do not specify the region I believe it uses your config/env settings.See if that makes a difference.Also you could always enable debug --debugCommentShareGary Mcleananswered a month agoNicolas a month agoNo difference given that an S3 bucket is global. And yes, of course I can enable debug, but what for ? Would that change anything ? In any case, the issue has disappeared 24 hours later.Share0Check the status of the bucketaws s3api get-bucket-location --bucket mys3nsbytmaybe The bucket has been locked by another user or the bucket  is still in the processCommentShareEXPERTsedat_salmananswered a month agoNicolas a month agoIt cannot have been locked by another user given that I'm the only one. Anyway, the issue disappeared by itself 24 hours later. I hope I won't have to wait 24 hours each time I need to delete and recreate my stack !Share0This happened again: $ aws s3 ls2023-06-02 17:23:33 mys3fwflw$ aws s3 rb s3://mys3fwflw --forcefatal error: An error occurred (NoSuchBucket) when calling the ListObjectsV2 operation: The specified bucket does not existremove_bucket failed: Unable to delete all objects in the bucket, bucket will not be deleted.$ aws s3api get-bucket-location --bucket mys3fwflwAn error occurred (NoSuchBucket) when calling the GetBucketLocation operation: The specified bucket does not existAnd of course, the AWS console doesn't show any bucket. So the bucket exists when getting the list but doesn't when trying to remove it or to get its status. It exists and doesn't exist in the same time LOLCommentShareNicolasanswered 2 days ago"


Question: Incorrect NS record returned for domain after re-creating hosted zone

"I moved my domain from a different registrar to Route53 some time ago. I created a hosted zone for it and an A record. All was working fine and DNS queries were correct and successful.A few weeks ago I deleted the hosted zone and recreated it (for the same domain) via CloudFormation. The creation operation completed successfully but DNS resolution stopped working.The NS records publicly available are different from the ones displayed in the Route53 configuration.When using dnsquery.org to test the domain (NS lookup) I see this error:Step 2We've got referrals (a.gtld-servers.net., b.gtld-servers.net., c.gtld-servers.net., d.gtld-servers.net., e.gtld-servers.net., f.gtld-servers.net., g.gtld-servers.net., h.gtld-servers.net., i.gtld-servers.net., j.gtld-servers.net., k.gtld-servers.net., l.gtld-servers.net., m.gtld-servers.net.) from queries on previous step. We'll query them now, until we got an authoritative result69.95 ms d.gtld-servers.net. [192.31.80.30] (United States);;Authority[redacted_domain]. 172800 IN NS ns-1508.awsdns-60.org.[redacted_domain]. 172800 IN NS ns-1795.awsdns-32.co.uk.[redacted_domain]. 172800 IN NS ns-298.awsdns-37.com.[redacted_domain]. 172800 IN NS ns-542.awsdns-03.net.;;Additionalns-298.awsdns-37.com. 172800 IN A 205.251.193.42We got referrals from d.gtld-servers.net.Step 3We've got referrals (ns-542.awsdns-03.net., ns-298.awsdns-37.com., ns-1795.awsdns-32.co.uk., ns-1508.awsdns-60.org.) from queries on previous step. We'll query them now, until we got an authoritative result32.14 ms ns-298.awsdns-37.com. [205.251.193.42] (Seattle, United States);;Query failed: "DNS request failed: The name server refuses to perform the specified operation for policy reasons."1.39 ms ns-542.awsdns-03.net. [205.251.194.30] (Seattle, United States);;Query failed: "DNS request failed: The name server refuses to perform the specified operation for policy reasons."1.34 ms ns-1508.awsdns-60.org. [205.251.197.228] (Seattle, United States);;Query failed: "DNS request failed: The name server refuses to perform the specified operation for policy reasons."8.27 ms ns-1795.awsdns-32.co.uk. [205.251.199.3] (Seattle, United States);;Query failed: "DNS request failed: The name server refuses to perform the specified operation for policy reasons."The authoritative answer from the root servers differs from the ones currently configured for the NS record of the domain in Route53:ns-1956.awsdns-52.co.uk.ns-1471.awsdns-55.org.ns-522.awsdns-01.net.ns-8.awsdns-01.com.In fact, the Route53 tool to check the domain returns the correct entries for the NS record:DNS response code NOERRORProtocol UDPResponse returned by Route 53ns-1471.awsdns-55.org.ns-1956.awsdns-52.co.uk.ns-522.awsdns-01.net.ns-8.awsdns-01.com.To rule out a TTL issue I have tried deleting and re-creating the domain twice waiting one week in between. In both cases the NS values returned by the root servers have been the old name servers.This is the only hosted zone/domain I have in my account but is effectively unusable at the moment and re-creating the hosted zone does not seem to be helping whatsoever.I need help. What else can I do here?Thanks.Edited by: OutsideCentre on Feb 28, 2019 9:14 PMFollowComment"

Answer: "0Accepted AnswerHi,When you create a hosted zone, Route 53 assigns four unique name servers to that hosted zone. When you create another hosted zone, Route 53 assigns four unique name servers to that hosted zone. Route 53 doesn't pay any attention to the name servers that are assigned to a domain registration when you create another hosted zone.To make your domain work again, perform the following procedures:Get the name servers that are assigned to your hosted zone. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the domain registration to use the name servers that you got in step 1. See "Adding or Changing Name Servers and Glue Records for a Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlScottCommentShareEXPERTAWS-User-6179575answered 4 years ago0As simple as that... :)Thanks Scott, all working now.CommentShareUser2229answered 4 years ago"


Question: Best way to overcome HIVE_PARTITION_SCHEMA_MISMATCH error in Athena while preserving structure of structs?

"I ran the following Amazon Athena query on a table created by AWS Glue, which had crawled an Amazon S3 export of Synthea data from Amazon HealthLake:SELECT * FROM "glue01234567890_fhir_export_abcdefghijklmnopqrst";That resulted in this error:HIVE_PARTITION_SCHEMA_MISMATCH: There is a mismatch between the table and partition schemas. The types are incompatible and cannot be coerced. The column 'code' in table 'demo.glue01234567890_fhir_export_abcdefghijklmnopqrst' is declared as type 'struct<coding:array<structsystem:string,code:string,display:string>,text:string>', but partition 'partition_0=ImagingStudy' declared column 'id' as type 'string'.This query ran against the "demo" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query IdI saw one answer to go to edit the Crawler and then to output -->configuration and "Update all new and existing partitions with metadata from the table." However, that didn't resolve the error for me.When I edit the schema manually an change column 'code' from struct to string, the error goes away, and Athena brings my attention to the next mismatch:partition 'partition_0=Immunization' declared column 'patient' as type 'structreference:string'.I don't think, however, manually replacing all structs with strings will get me the results I want, because I need Glue and Athena to be aware of the fields inside the structs. What is the best approach to overcoming this error while preserving the structure of the data, in this situation where I want to make the HealthLake export queryable by Athena?I understand I'll want to add a step to the ETL in Glue to first convert to Parquet or ORC for Athena performance reasons, but right now I'm dealing with a small sample dataset and just want to focus on getting a minimum viable end-to-end flow going.FollowComment"

Answer: "0The reason for the problem is the size of the dataset which confuses the crawler to pick the "correct" column type based on too few examples.I would start with the general type of String. You can still use Athena to parse it, either directly with the dot notation (SELECT patient.reference FROM...) or using the many JSON functions. See more ways to query JSON here.CommentShareMLGuyanswered a year agoyann_stoneman a year agoThank you for the idea! To help me understand this deeper, I'm interested how you arrive at the conclusion that the size of the dataset is an issue here, and how that would make a difference to this scenario? Great point that Athena is able to parse values of type String as JSON without the need of having type struct.Share"


Question: Running a lamba event on a cron schedule to start an EC2

"Having issues making an event trigger in the lambda console.  I have it selected for Eventbrtidge (CloudWatch)|schedule expression and have added this "cron(0 3 ** ** Sun-Thu *)" to run at 03:00 UTC Sunday to Thursday, also tried variations with ? for the month, and omitting the year, all with the same response.But I get an error "Parameter ScheduleExpression is not valid. (Service: AmazonCloudWatchEvents; Status Code: 400; Error Code: ValidationException; Request ID: 300a10ad-4089-4990-91d6-553274289679; Proxy: null)"  when I try to add it.I've searched all the documentation and I've found some that says to omit the cron( ) wrapper if using the lambda console, but that fails the validation entirely, I checked the cron format and it matches all formatting I can locate.Any ideas why I'm getting the error and what to do to resolve it ?FollowComment"

Answer: "0Resolved this finally.  The secrets are there is no seconds value in the cron, you must have the cron( ) wrapper.  Day names must be all upper case, month only seems to work as ? and not **, and you must include ** for the year.  Also all times are in UTC, not local zone time.Got it working with cron(** ** 3 ? ** SUN-THU **)CommentShareThorpedoanswered 3 years ago"


Question: How to get the Salesforce Account fields using aws lambda?

"Hi, I am trying to get the Salesforce Accounts Fields from aws lambda function, it does return the Salesforce Contact Fields like Id, Name, Email and other Fields but giving me the error"errorMessage": "INVALID_FIELD: No such column 'City_CB__c' on entity 'Contact'. If you are attempting to use a custom field, be sure to append the '__c' after the custom field name. Please reference your WSDL or the describe call for the appropriate names.",  "errorType": "Exception" when tried to get the Accounts fields.I am following this documentation https://connect-blogs.s3.amazonaws.com/Amazon+Connect+Salesforce+CTI+Adapter/Amazon+Connect+CTI+Adapter+for+Salesforce+Lightning+-+Setup+and+Installation+Guide.pdf#page=68&zoom=100,121,298And my event format is:{   "Details":{      "Parameters":{          "name":"Accounts",          "sf_operation":"phoneLookup",          "sf_phone":"[PhoneNumber]",          "sf_fields":"Id, Name, Email, City_CB__c"      }   }}It returns the Contact fields but not the Account fields.FollowComment"

Answer: "0After a lot of brainstorming i got to know you just have to add account. in start of the fields to get the Account Fields.{   "Details":{      "Parameters":{          "sf_operation":"phoneLookup",          "sf_phone":"[PhoneNumber]",          "sf_fields":"account.Id, account.Name, account.Email, account.City_CB__c"      }   }}CommentShareAbdul Qayyumanswered a year agoEXPERTAWS-samfredreviewed 2 months ago"


Question: How to change allocation strategies for existing aws batch compute environments

"Hi, I would like to Change the AWS Batch's default compute environment from 'BEST_FIT' allocation strategy to 'BEST_FIT_PROGRESSIVE' for existing environments. i am not finding the options in aws console. please help!FollowComment"

Answer: "0As shown in the following document, it is not possible to change the setting if "BEST_FIT" is selected.https://docs.aws.amazon.com/batch/latest/userguide/updating-compute-environments.htmlAllocation strategy (allocationStrategy, must be either BEST_FIT_PROGRESSIVE or SPOT_CAPACITY_OPTIMIZED. If the original allocation strategy is BEST_FIT, infrastructure updates aren't supported.)CommentShareEXPERTRiku_Kobayashianswered a month ago0As per the documentation we can't change the Allocation strategy of the existing Batch Compute Environments.https://docs.aws.amazon.com/batch/latest/userguide/updating-compute-environments.htmlAllocation strategy (allocationStrategy, must be either BEST_FIT_PROGRESSIVE or SPOT_CAPACITY_OPTIMIZED. If the original allocation strategy is BEST_FIT, infrastructure updates aren't supported.)CommentShareHimanshu_Tankanswered a month ago"


Question: Cognito - CustomSMSSender InvalidCiphertextException: null on Code Decrypt (Golang)

"Hi, i followed this document to customize cognito SMS delivery flow https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-sms-sender.htmlI'm not working on a Javascript environment so wrote this Go snippet:package mainimport ("context"golog "log""os""github.com/aws/aws-lambda-go/events""github.com/aws/aws-lambda-go/lambda""github.com/aws/aws-sdk-go/aws""github.com/aws/aws-sdk-go/aws/session""github.com/aws/aws-sdk-go/service/kms")// USING THIS TYPES BECAUSE AWS-SDK-GO DOES NOT SUPPORTS THIS// CognitoEventUserPoolsCustomSmsSender is sent by AWS Cognito User Pools before each mail to send.type CognitoEventUserPoolsCustomSmsSender struct {events.CognitoEventUserPoolsHeaderRequest  CognitoEventUserPoolsCustomSmsSenderRequest  `json:"request"`}// CognitoEventUserPoolsCustomSmsSenderRequest contains the request portion of a CustomSmsSender eventtype CognitoEventUserPoolsCustomSmsSenderRequest struct {UserAttributes map[string]interface{} `json:"userAttributes"`Code           string                 `json:"code"`ClientMetadata map[string]string      `json:"clientMetadata"`Type           string                 `json:"type"`}func main() {lambda.Start(sendCustomSms)}func sendCustomSms(ctx context.Context, event *CognitoEventUserPoolsCustomSmsSender) error {golog.Printf("received event=%+v", event)golog.Printf("received ctx=%+v", ctx)config := aws.NewConfig().WithRegion(os.Getenv("AWS_REGION"))session, err := session.NewSession(config)if err != nil {return err}kmsProvider := kms.New(session)smsCode, err := kmsProvider.Decrypt(&kms.DecryptInput{KeyId: aws.String("a8a566c5-796a-4ba1-8715-c9c17c6f0cb5"),CiphertextBlob: []byte(event.Request.Code),})if err != nil {return err}golog.Printf("decrypted code %v", smsCode.Plaintext)return nil}i'm always getting InvalidCiphertextException: : InvalidCiphertextException null, can someone help?This is how lambda config looks on my user pool:"LambdaConfig": {   "CustomSMSSender": {        "LambdaVersion": "V1_0",        "LambdaArn": "arn:aws:lambda:eu-west-1:...:function:cognito-custom-auth-sms-sender-dev"    },     "KMSKeyID": "arn:aws:kms:eu-west-1:...:key/a8a566c5-796a-4ba1-8715-c9c17c6f0cb5"},FollowComment"

Answer: "0I'm facing same issue but unfortunately couldn't find any solution. There is no enough documentation as well. My assumption is something about encryptionContext. If you found the solution, please let me know.Thanks.CommentShareFatihanswered a year agoAWS-User-1153293 a year agoHi, i couldn't find a workaround for Golang. The reason is the lack of compatibility for the aws encryption sdk... It is only available for certain languages and Go is not in the list. https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/introduction.htmlThe code is encrypted throught keyring (an aws kms master key provider) which is somehow inside the aws encryption sdk encrypt/decrypt process. Writting your own sdk for Go is not an option, so i'll suggest you to use Javascript or Python instead for this scenario.What a shame aws...Edit: here's a how keyring works https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/using-keyrings.html to understand why the posted code will never work for this caseShare0Is there not a solution for this? I have the same issue.CommentSharerePost-User-8735291answered 6 months ago"


Question: EC2 instance not able to join to AWS managed MS AD domain

"I have a Windows EC2 in a subnet with no internet access, but the VPC has endpoints to all SSM related services. When I try to join the domain by associating an SSM document, it fails and the error log shows the following:2020-03-25 10:23:35,277 [1] ERROR [Framework] - Failed to create domain computer account 'TESTVM', Message=A WebException with status ConnectFailure was thrown.,ErrorCode=,ErrorType=Sender,StatusCode=0Amazon.Runtime.AmazonServiceException: A WebException with status ConnectFailure was thrown. ---> System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 52.95.35.59:443   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)   --- End of inner exception stack trace ---   at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context)   at System.Net.HttpWebRequest.GetRequestStream()   at Amazon.Runtime.Internal.HttpHandler`1.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.Unmarshaller.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.ErrorHandler.InvokeSync(IExecutionContext executionContext)   --- End of inner exception stack trace ---   at Amazon.Runtime.Internal.WebExceptionHandler.HandleException(IExecutionContext executionContext, WebException exception)   at Amazon.Runtime.Internal.ErrorHandler.ProcessException(IExecutionContext executionContext, Exception exception)   at Amazon.Runtime.Internal.ErrorHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.CallbackHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.RetryHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.CallbackHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.CallbackHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.ErrorCallbackHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.MetricsHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.RuntimePipeline.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.AmazonServiceClient.Invoke[TRequest,TResponse](TRequest request, IMarshaller`2 marshaller, ResponseUnmarshaller unmarshaller)   at Amazon.DirectoryService.AmazonDirectoryServiceClient.CreateComputer(CreateComputerRequest request)   at Amazon.EC2Services.Config.Plugins.DomainJoin.Ec2SDomainJoin.CreateComputer(DomainJoinDto domainJoinDto, String desiredComputerName, String accountCreationPassword)It seems like the error is happening because it cant reach 52.95.35.59 which is expected because it is not internet accessible. But what is this IP ? I dont think it is an amazon IP, and the location of this IP shows somewhere in China ?If the server has internet access, associating the ssm document works.Edited by: thescreenslaver on Mar 25, 2020 3:50 AMEdited by: thescreenslaver on Mar 25, 2020 3:52 AMFollowComment"

Answer: "0I figured out the problem.Writing it here for future reference. The IP it was looking for is indeed an AWS IP address. It is the endpoint IP for AWS Directory service (ds.ap-southeast-1.amazonaws.com). Since DS do not have a VPC endpoint as of now, it is not possible to join the instances without internet access to the domain automatically.CommentSharethescreenslaveranswered 3 years ago"


Question: WAF new rules warning

"Does WAF warn administrators of new rules that are added by AWS?  Is there a way to disable new rules by default, then turn new rules on if you like?FollowComment"

Answer: "2Yes, with the release of versioning for managed rule groups, you can choose a specific version of the managed rules you wish to use. Updates are released as new versions, providing you the ability to test them before enabling them in block mode. You can also receive notifications of updates to managed rules via SNS. The announcement here: https://aws.amazon.com/about-aws/whats-new/2021/08/aws-waf-offers-managed-rule-group-versioning/ has further information and links to documentation.CommentSharePaul_Lanswered a year ago0If you have another IAM User/Role who can create new rule and you want to enforce the rule after review from your side, you can guide the IAM User/Role to create new rule with count action. Count action will not allow or block HTTP request but will just count if the request match the rule. So there should be no impact on service traffic and you can change the action to allow/block if you like the rule.You can also create CloudWatch alarm if someone create new rule.Below link is for creating CloudWatch Alarm using CloudTrail. The example in this link is for changing security group but you can create CloudWatch alarm for changing WAF rule group with eventName:UpdateWebACL.https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.htmlThanksCommentShareEunsu_Shinanswered a year agoCML a year agoI am specifically asking about new rules that are added by AWS.  We think a new rule was added by AWS that prevented users from viewing a previously viewable page.  How do we disable the new rules so that we can review them before enabling themSharePaul_L a year agoYou will need to edit your managed rules and change the version from "Default" to a specific version number. Be sure to subscribe to the SNS topic so that you know when new versions are released, you can then test them before upgrading to the new version. You can also see the changelog here: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.htmlShare0Getting notified of new versions and updates to a managed rule groupCommentShareEXPERTkentradanswered a year ago"


Question: Change CodeBuild Image for AWS Lambda Applications

"I created an AWS Lambda Application using the Nodejs template.https://us-east-2.console.aws.amazon.com/lambda/home?region=us-east-2#/applicationsThis uses the following image for CodeBuild.Image: aws/lambda/nodejs:10-1.0I see this inside the serverlessrepo-APP_NAME-toolchain stack under the template tabhttps://us-east-2.console.aws.amazon.com/cloudformation/home?region=us-east-2#/stacks/templateIs there a way to change this image for the stack? I'd like to have java jdk with gradle installed in addition to nodejs. I'm am currently trying to do a workaround where I install java, gradle and set the environment variables during the install phase in the buildspec.yml, but that is a hacky workaround that will slow down the build pipeline.  Can I modify the stack image after it's been created? I only saw an option to make a new stack that is a modification of a previous stack, but the previous stack is left unchanged.Here's the buildspec.yml with the workaround. It's still failing to install java correctly so the build is failing, but I think this is the wrong approach anyway. I should be updating the build image so it's ready to go.https://github.com/bennebbenneb/sample-app/blob/master/buildspec.yml#L4FollowComment"


Question: Help setting up IAM Roles Anywhere

"Very excited to read  about new AWS Capability; namely, IAM Roles Anywhere. We have a number of on-prem servers, where we would like to copy logs to S3. Now we are using user profiles, which are obviously not the best practice!I was trying to set it up, and I got confused. The example is using AWS PCS, which is $400/month - a little steep for just trying out. So, obviously, I am trying to use free Let's Encrypt. My understanding that this is their certificate bundle.I successfully created Trust anchor (by pasting let's encrypt PEM file); I created a role, and I created a profile. I don't think I missed anything. Now, I am trying to obtain temporary security credentials, as described here../aws_signing_helper credential-process \    --certificate    --private-key    --profile-arn    --role-arn    --trust-anchor-arnprofile, role, and trust-anchor are clear. I assume certificate is the path to the file that I pasted into the trust. But what is private-key? I never saw instructions to upload any public key to AWS - so it doesn't make sense.Obviously, I am getting an error - AccessDeniedException: Untrusted certificate. Insufficient certificate. Maybe I misunderstand what needs to be pasted in trust anchor? Is there some guidance for trust from external certificate bundle?Thank you! I feel I am close...PS. I feel that it is a generic question; so broader community can benefit; and it is not urgent since we are using user credentials now - but let me know if it should be better directed to support!PPS. Please consider adding "Roles Anywhere" as a new tagFollowComment"

Answer: "2Accepted AnswerI have a fully working example in my blog, which demonstrates it with a CA you create using openssl, and a step-by-step for everything.check it out:https://medium.com/cyberark-engineering/calling-aws-services-from-your-on-premises-servers-using-iam-roles-anywhere-3e335ed648beCommentShareroybanswered 10 months agovirshu 10 months agoIt will take me awhile to read and understand :) but this is exactly what I was asking! Thank you very much. And needless to say, your point about "for testing purposes only" is very well taken! Bigger part, I didn't even understand that you need to roll out your own CA, so learning how to get one for test purposes is major benefit!Share1Ah now I understand what you mean. The answer is found here: https://aws.amazon.com/blogs/security/extend-aws-iam-roles-to-workloads-outside-of-aws-with-iam-roles-anywhere/Specifically: "Your application makes an authentication request to IAM Roles Anywhere, sending along its public key (encoded in a certificate) and a signature signed by the corresponding private key. Your application also specifies the role to assume in the request. When IAM Roles Anywhere receives the request, it first validates the signature with the public key, then it validates that the certificate was issued by a trust anchor previously configured in the account. For more details, see the signature validation documentation."Hope this helpsCommentShareZadusPlaceanswered a year agovirshu1 a year agoThank you Zadus for your enthusiasm. However, I don't think it is helpful to copy and paste the text of the blog that I linked to in the very first sentence of my original question.ShareZadusPlace a year agoI have not tried it with a PKI yet. I am planning to try the ACM Private CA first, make sure I get that working, and then move on to try with a custom PKI.Does let's encrypt provide more details?Share0One thing to add: AWS mentioned the words "CA bundle", and I believe they meant the root CA certificate + any intermediate CA certificate or certificates, all concatenated and BASE64 encoded in one file. This is mentioned here: https://docs.aws.amazon.com/acm-pca/latest/userguide/PcaImportCaCert.htmlI am not 100% sure if this was your issue, but if the trust anchor is not setup properly, obviously nothing will work. Please let me know if this actually works.If you try with a real PKI infra, I think it might be easier to setup versus Lets Encrypt, as it will have a domain configured, and all the appropriate CA chain.CommentShareZadusPlaceanswered a year agovirshu1 a year agothank you. at this time I think I have reached the limit of my knowledge. we use letsencrypt for all our certificates, so I am not sure how they are different from real PKI infrastructure. obviously, what I am pasting into trust anchor doesn't include my public key, so it is wrong. but I need help how to generate correct CA bundle.I will follow with supportShareZadusPlace a year agoThats why I want to play with the free ACM option first (and make sure I get Roles anywhere working), before I create my own PKI (which requires a domain and all). And like you said, since the feature is literally less than 2 weeks old, not many tutorials are available yet. Let me know if you do figure it out, I would be curious to know what was the issue exactly (note: am not an AWS employee).Share0I read yesterday that ACM can be tried out for 30 days for free, so that would make things easier for you to implement and try out: https://aws.amazon.com/certificate-manager/pricing/--private-key is your own private-key.pem file (it wont be sent to AWS).CommentShareZadusPlaceanswered a year agovirshu a year agoThank you @ZadusPlace. I am pretty sure I know what private key is ;) My point is that for private key to work I need to send public key to the other party - and I don't see a step to do that!I'll play with ACM (thanks for pointing out 30-day free option) - maybe it will give me a clue how to do that; or I will ask support - but I was hoping that there will be some tutorial with external CA. Obviously, it is a new service - so maybe it is still in the works!Share0Simply put, you need a certificate indicated by --certificate to present to AWS in exchange for access keys. This certificate can be the same as a certificate that you see on this page. But the owner of the certificate will have the private key key. This is the parameter --private-key that you must point to. Any certificate has a certificate chain with the root CA at the top of the chain. This chain is the certificate bundle that you need to configure when setting up the trust anchor.CommentShareViper25answered 4 months ago"


Question: how to fix an hacked account please help

"i think my account has been hacked using a phishing method, i m struggling for weeks in order to get a real call from your services in order to explain the situationA service called amazon turk mechanical has been activated in my account at the same time as a FMA code that blocked me my access to my account.i tried to fix it but amazon asked me for an affidavit, from a lawyer which i had to execute, Then i had again to fix the fees on turk 25k usd !!! i tried to inform your service that it was not due to me but you still tried to withdraw the amounts from my credit card!!i had on the phone a supposed agent from amazon to fix the problem but i assume it s a fake agent. I'd like your serviceto contact me by phone and by email bothly in order to fix that +xxxxxxxxxxxx ( it s a morrocan number )i'm rebei karimmy email account is xxxxxxx@gmail.comaccept my best regards*Personally Identifiable Information (PII) removed - Randi S.FollowComment"

Answer: "0Hi Rebei,I apologize for any continued frustration regarding this issue.While I can’t discuss account or case details here, I was able to look into your case and can see our agents have been attempting to reach out via email. To keep the line of communication open, please respond to the most recent no-reply email. Be sure to check your spam/junk folders as our responses can be filtered there.If you’d like, you can also reach out to our MTurk team using this form: http://go.aws/contact-mturk.Thank you,- Randi S.CommentShareEXPERTAWS Support - Randianswered 8 months ago"


Question: Access Docker containers in ECS Fargate?

A customer wants to use ECS fargate but at the same time also want an occasional flexibility to exec into the containers. I understand its quite opposite to what fargate is meant for. but what are the options for any configuration tracability in fargate. for application traceability we have x-ray but do we have anything for configuration and dependency settings of docker containers.FollowComment

Answer: "0Accepted AnswerIt's a interesting request where the answer is: It's possible, but why?In many cases the developer choose to build the smallest possible container where the image don't have any shell binary.For example, the developer decide to build a Go app that has all dependencies linked in the binary. He can build this image using the scratch base (https://hub.docker.com/_/scratch) this will create a docker container with just the binary inside and a pointer to execute this binary.At the same time there are other projects that use scratch to build other base images like Debian, busybox that will contain shell access and other library dependencies for execution and the container image will be bigger if compared to the previous example.So, having Ubuntu, Debian and so many container images on Docker, should we use them for workloads?If it's a production workload I would recommend to minimize the container to only the required components that will use less disk space, less bootstrap time as the container image will be smaller to download and the boot time will be faster. Not mentioning that without any shell binary or other component that you app will not use will drastically reduce the chances of remote exploits in your container app.But where do I run those linux distro images?Probably when you are developing software in your desktop or need to test some desktop app in multiple linux distro versions you can have a series of container images to run tests in all of them without the need to have VM's or physical servers with them.Is that your customer case? building desktop apps where he need to test them?Maybe even if he need to test such apps he probably can run automated scripts to execute commands and get back the results in a log.If the case is: My customer need visibility of what is happening in the App and debug in case of issues.In this case the recommended approach is to enable app logging (every language provide a logging library and if not, a simple print statement can output the log to stdout or stderr and all those outputs can be captured by Cloudwatch and streamed to Cloudwatch logs to review.If the concern is memory utilization, temporary files, etc. I would just add an ENVIRONMENT VARIABLE to set the verbosity level of the logs and include the logging statements to output such events in the log for analisys.Well, there is a lot of aproachs that your customer can adopt and avoid the use of shell in the app.CommentShareEXPERTRafael Koikeanswered 3 years ago"


Question: CodeDeploy: Script at specified location failed to close STDOUT

"I am trying to add the following script to the ApplicationStart section of my CodeDeploy appspec.yml:# collect_static_files.sh#!/bin/bash# source other files, change dir, activate python here./manage.py collectstatic --noinputWith this file added deploys fail withScript at specified location: scripts/deploy/collect_static_files.sh failed to close STDOUTThe log for the ApplicationStart event doesn't show anything other than the command output:[stderr]You are using pip version 18.1, however version 21.3.1 is available.[stderr]You should consider upgrading via the 'pip install --upgrade pip' command.Script - scripts/deploy/collect_static_files.sh[stdout][stdout]170 static files copied to '/var/www/mydir/static'.I've tried turning off and redirecting output:# ./manage.py collectstatic --noinput > /dev/null 2>&1# ./manage.py collectstatic --noinput --verbosity 0Neither of which clear the error and even if they did wouldn't really solve the problem as I would like the output added to the log.There is something similar discussed on the codedeploy agent GitHub but for backgrounded commands.Also did a search for closing STDOUT but that doesn't seem like something I should be doing manually. What am I missing?FollowComment"

Answer: 0Accepted AnswerIncreasing the timeout fixed it:  ApplicationStart:    - location: scripts/deploy/collect_static_files.sh      timeout: 60Previous values was 5. The command itself runs much quicker than that though so I'm not sure it was timing out.CommentShareJPanswered a year ago


Question: RequestParameters for Api Event in Serverless::Function in JSON - how does it work?

"I'm trying to add some query string parameters for a Lambda function, using a SAM template written in JSON.  All the examples are in YAML?  Can anyone point out where I'm going wrong.Here's the snippet of the definition:    "AreaGet": {      "Type": "AWS::Serverless::Function",      "Properties": {        "Handler": "SpeciesRecordLambda::SpeciesRecordLambda.Functions::AreaGet",        "Runtime": "dotnet6",        "CodeUri": "",        "MemorySize": 256,        "Timeout": 30,        "Role": null,        "Policies": [          "AWSLambdaBasicExecutionRole"        ],        "Events": {          "AreaGet": {            "Type": "Api",            "Properties": {              "Path": "/",              "Method": "GET",              "RequestParameters": [                "method.request.querystring.latlonl": {                  "Required": "true"                },                "method.request.querystring.latlonr": {                  "Required": "true"                }              ]            }          }        }      }    },and here's the error message I get:Failed to create CloudFormation change set: Transform AWS::Serverless-2016-10-31 failed with: Invalid Serverless Application  Specification document. Number of errors found: 1. Resource with id [AreaGet] is invalid. Event with id [AreaGet] is invalid. Invalid value for 'RequestParameters' property. Keys must be in the format 'method.request.[querystring|path|header].{value}', e.g 'method.request.header.Authorization'.Sorry I know this is a bit of a beginners question, but I'm a bit lost as to what to do, as I can't find any information about this using JSON. Maybe you can't do it using JSON?Thanks,Andy.FollowComment"

Answer: "0Accepted AnswerHi, @Andy Douglas.Does it work if you enclose the elements of the array in {} as follows?"Events": {    "AreaGet": {        "Type": "Api",        "Properties": {            "Path": "/",            "Method": "GET",            "RequestParameters": [                {                    "method.request.querystring.latlonl": {                        "Required": "true"                    }                },                {                    "method.request.querystring.latlonr": {                        "Required": "true"                    }                }            ]        }    }}CommentShareEXPERTiwasaanswered a year agoAndy Douglas a year agoAh that's it!  Thank you.  Rather annoyingly, that works!I say annoyingly, because I'm sure I tried that (?) but also because visual studio hates it - it's all in red, and vs2022 is pretty good at these things usually.  I guess the problem was me not really knowing JSON or YAML properly and how to translate between them - I thought I did, but maybe not.  Examples using JSON in the docs would be very welcome though.Thanks again - I can move forward now.Andy.Share"


Question: How does Glue divide work among workers

"I am trying to understand how Glue divides up large inputs among the worker nodes.Example:Say I have a Glue job that will need to process 1,000,000 input recordsThe job is configured to use 5 workersIs Glue going to send 200,000 records to each of the 5 workers?Is Glue going to send 'X' number of records to each worker and then send another 'X' records as the workers finish?I am not so much interested in how to configure this job.   I am most interested in how does Glue process?   I am going to use this information in the design of my project.FollowComment"

Answer: "0Glue uses Apache Spark underneath.There are many factors involved in dividing data across workers.Spark jobs are divided into stages and each stage contains multiple tasks.Each task in a stage is doing same piece of work on different chunks of data.Each worker (G.1X/G.2X) maps to a Spark Executor where these tasks are executed. Each Executor can run multiple tasks.While reading the data, factors listed below are considered to determine how the data read is parallelized.Further, intermediate stages and distribution of the data depends on the transformations in the ETL script.For more information on DAG (Directed Acyclic Graph created by spark engine based on the ETL script), stages in the DAG and tasks in each stage, enable SparkUI and launch a spark history server to understand if the configured workers are utilized optimally.https://docs.aws.amazon.com/glue/latest/dg/monitor-spark-ui-jobs.htmlhttps://docs.aws.amazon.com/glue/latest/dg/monitor-spark-ui-history.htmlIf data source is a JDBC - data is parallelized based on the parameters hashpartition and hashfield/hashexpression.https://docs.aws.amazon.com/glue/latest/dg/run-jdbc-parallel-read-job.htmlDepending on the table schema and above configuration parameters in create_dynamic_frame, data is read in parallel across multiple workers.If data source is S3 - following factors affect the read operation -File type - csv, json, parquet, ORC, AVRO, etcCompression type - If files are compressed whether the compression is splittable or nothttps://stackoverflow.com/questions/14820450/best-splittable-compression-for-hadoop-input-bz2Size of the files - Suppose file is splittable, data is read in chuncks of 128MB.Data is read across multiple workers, each task in these workers reading a chunk of data.For more information - https://spark.apache.org/docs/latest/index.htmlCommentShareSachin_Kanswered a year ago0Hello,We could see that you are look for a resource to understand how glue divides work across workers. Below document provides detailed explaining for the same.https://aws.amazon.com/blogs/big-data/best-practices-to-scale-apache-spark-jobs-and-partition-data-with-aws-glue/================ Have a nice day !!!CommentShareSUPPORT ENGINEERArunanswered a year ago"


Question: MediaLive - Start RTMP (output) push separately from channel start

"Our current understanding is that once a MediaLive channel is started, outputs begin to push immediately.E.g. one RTMP output is YouTube, and once the channel is RUNNING the stream is immediately being pushed to YouTubeIs there a workflow that allows a channel to be in a 'preview' state before pushing to the outputs?Where you can view your inputs, before pushing them.Our current workaround is to have a MediaLive 'preview' channel for checking the quality of the feed. And once ready to go live, we start a second MediaLive 'live' channel to send the output to the destinations (and subsequently shutting down the preview channel). This is OK, but obviously, there is a delay in starting up each channel, and we are looking to enable being able to go from 'preview' to 'live' in a matter of seconds vs potentially a matter of minutes.FollowComment"

Answer: "0This is more of an observation than an answer.The obvious answer is no there is no preview option. What we have noticed though is if there is no source there is no push. As an example we were tasked with a Live HLS Pull to RTMP Push. The ML instance would be started however it was not until the HLS link became active did the RTMP Push started.One would think that it would just send null packets to the RTMP Server. Not true it sent nothing until the HLS link became active.Speculation that if the RTMP Push was soured by an S3 file it would not started until the file on S3 was present.CommentShareB-Wilkinsonanswered a year ago0Hi Brodie-LIGR,While not a "preview" option, you can always use the channel schedule functionality to pause one or both pipelines' outputs. You can schedule the pause/unpause in UTC time or issue an "immediate" pause/unpause which takes effect ASAP.https://docs.aws.amazon.com/medialive/latest/ug/schedule-fields-for-pause.htmlNote that a pause affects all outputs on the pipeline.Regards,SteveCommentShareSteve_Wanswered a year ago"


Question: "This instance type does not support retrieving the latest console logs"

"Hi, I am trying to investigate what is wrong with my Linux instance.I get "This instance type does not support retrieving the latest console logs" errorI cannot find any information what instances actually supports this functionality."ec2:GetConsoleScreenshot","ec2:GetConsoleOutputpermissions have been given. GetConsoleScreenshot gives nothing either just a screen full of dashes.ThanksFollowCommentBrettski-AWS EXPERTa year agoWhat type of instance is it? What operating system is it running?Share"

Answer: "0Hi AWS-User-4707325,        Viewing the latest console output is available only with the instances built using the nitro system and is not available through the EC2 console. Here is a link that shows all instances that use the nitro system: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances                       For some more additional information check out this link:         https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-console.html#instance-console-console-outputCommentShareZion_Canswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: How does the start and stop for the same single chime session work ?

"By reading this page - https://github.com/aws-samples/amazon-chime-media-capture-pipeline-demo,I understand that we can start the media pipelines and start the concatenation to get the video.How does the start and stop, again start and stop for the same single session work ?We want to embed the video capture in our online meeting app. There is a possibility that meeting owner in that meeting might pause the video recording for some time or even stop the recording and start again.We want to capture all the recordings in one video.  How do we enable this using startMediaPipeline and startConcatenation tasks ?Some insights on this will be super helpful.FollowComment"

Answer: "1Accepted AnswerIt depends on what you want the single file to look like.If every time that you call CreateMediaCapturePipeline you specify the same S3 bucket and folder for the artifacts, then one call to CreateMediaConcatenationPipeline will cause all of the artifacts to be concatenated. This will be a continuous media file and the gaps between the captured segments will not be obvious.However, if every time that you call CreateMediaCapturePipeline you specific a different S3 bucket and folder, then you will need to call CreateMediaConcatenationPipeline one time for each capture pipeline. This will create a single file for each segment of your meeting that is captured. You could then post-process these into a single file and insert some sort of image or clip where the gaps between the segments are.Once you decide on the final output that you'd like to have, you can make one of the choices above about your capture pipeline folders.CommentShareDougLanswered 5 months ago"