Question: ManagedBlockchain Copy cert file from S3 - failing

"Hi I am following the steps to Enroll a Admin User from here https://docs.aws.amazon.com/managed-blockchain/latest/hyperledger-fabric-dev/get-started-enroll-admin.htmlThe step to copy a preconfig'd cert from a S3 location to my EC2 fails with Forbidden.I have checked my role for permissions, that is attached to the EC2. The perms look like this:{             "Sid": "AccessManagedBlockchainBucket",             "Effect": "Allow",             "Action": [                 "s3:GetObject"             ],             "Resource": "arn:aws:s3:::us-east-1.managedblockchain/*"   },I get this:[xxxx@ip-xxxxx~]$ aws s3 cp s3://us-east-1.managedblockchain/etc/managedblockchain-tls-chain.pem  /home/ec2-user/managedblockchain-tls-chain.pem fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden Any pointers on what is wrong with the s3 cp still?FollowComment"

Answer: "0This article suggests your policy may need to be adjusted.CommentShareJCanswered 6 months agoRavneet 6 months agoHmmm I will continue to troubleshoot, but I have the ListBucket action also mentioned in the policy, which is attached to the role, which is attached to the EC2 instance. The right arn on s3 is also in the policy. Maybe I need to look at my aws cli config - checked that and its referring to the right region.Share"


Question: Amazon Lex v2 Chatbot session not updating

"Hello,I am trying to make a Lex Chatbot with lambda validations in .NET, if the slot input is valid it should ask for the "slotToElitict" in "proposedNextState" by the bot itself otherwise I re-elicit the slot.My problem comes when the user input is valid, I pass a json response with no problem but when the next user input is received, all the values from the previous session are lost, so it keeps asking for the same two slots every time.I have tried storing the values from the previous slots and passing them to the json response if the input is valid but it doesn't work, I have also tried using "AmazonLexRuntimeV2Client.PutSessionAsync" to update the session but I couldn't get it to work either because session ID doesn't  exist, even though it's appearing in CloudWatch Logs.Example Conversation flow:User inputs "Hi"Bot asks for slot "firstName"User inputs his first nameLambda validates "firstName"Valid input -> bot asks for slot "surname",  otherwise -> go back to step 2User inputs his surname (but now slot "firstName" has lost its value in lambda input json)Lambda validates input for "surname"Valid input -> ask for "phoneNumber" ,  otherwise ->  re-ask step 5 (never pass this stage, input json next state proposed is to re-elicit "firstName" because it has no value)User input his phone number...Any help would be greatly appreciated, thank you very much!FollowComment"

Answer: "1Hello,When using Lamnda code hook, you are expected to have the relevant slot values set in the session state in the Lambda response (post validation). I.e.,  in step 5 of your flow, ensure value of "firstName" slot is set. Otherwise, Lex bot will assume the first name is not set (perhaps because it didn't pass business validation), and reprompt the user.ThanksCommentShareswapandeepatawsanswered a year agoaechegoyan a year agoThe issue is that I already tried to set the slot values in the Lambda response, but on the next user input, those values I already set disappear, even if Lex accepted the JSON correctly or even if the slot value was encoded.For example: in step 5, I set an encoded "firstName" value, Lambda accepts it correctly, but when step 6 is triggered, the "firstName" slot goes back to null if I check CloudWatch logs.I'm returning a JObject (Newtonsoft.JSON) that represents a JSON rather than a direct string representation of a JSON as I've seen elsewhere. could this be a problem? Apparently Lambda accepts it just fine and the JSON it produces is valid.Maybe I'm doing something wrong or just Lex doesn't store session state and I have to track and validate everything myself but that doesn't seem to be the case as I've seen Python-JavaScript examples without this problem.Share"


Question: Recover Accidentally Deleted IAM User and Its Access Keys

"Hello,Is there a way to recover the IAM user and its access keys that were accidentally deleted? Please help.Thanks & RegardsFollowComment"

Answer: "1HiUnfortunately you wont be able to recover lost access keys.  You will need to re-create the IAM user and create new access keys.See https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys_retrieve.htmlCommentShareEXPERTMatt-Banswered 10 months ago0If you have AWS Config active, you can find the configuration of the IAM User there (policies, groups, etc) to recreate it.CommentShareEXPERTkentradanswered 10 months ago0Thanks, one more question, seems quicksight data is user based, if any user creates a dashboard it wont saved in root account, if that user removed, can we recover quicksight data?quicksight authenticate with iam user to login as well, anyone please help?CommentSharerePost-User-6156594answered 10 months ago"


Question: ClientError: An error occurred (UnknownOperationException) when calling the CreateHyperParameterTuningJob operation: The requested operation is not supported in the called region.

"Hi Dears,I am building ML model using DeepAR Algorithm.I faced this error while i reached to this point :Error :ClientError: An error occurred (UnknownOperationException) when calling the CreateHyperParameterTuningJob operation: The requested operation is not supported in the called region.Code:from sagemaker.tuner import (IntegerParameter,CategoricalParameter,ContinuousParameter,HyperparameterTuner,)from sagemaker import image_uriscontainer = image_uris.retrieve(region= 'af-south-1', framework="forecasting-deepar")deepar = sagemaker.estimator.Estimator(container,role,instance_count=1,instance_type="ml.m5.2xlarge",use_spot_instances=True,  # use spot instancesmax_run=1800,  # max training time in secondsmax_wait=1800,  # seconds to wait for spot instanceoutput_path="s3://{}/{}".format(bucket, output_path),sagemaker_session=sess,)freq = "D"context_length = 300deepar.set_hyperparameters(time_freq=freq, context_length=str(context_length), prediction_length=str(prediction_length))Can you please help in solving the error?I have to do that in af-south-1 region.ThanksBasemhyperparameter_ranges = {"mini_batch_size": IntegerParameter(100, 400),"epochs": IntegerParameter(200, 400),"num_cells": IntegerParameter(30, 100),"likelihood": CategoricalParameter(["negative-binomial", "student-T"]),"learning_rate": ContinuousParameter(0.0001, 0.1),}objective_metric_name = "test:RMSE"tuner = HyperparameterTuner(deepar,objective_metric_name,hyperparameter_ranges,max_jobs=10,strategy="Bayesian",objective_type="Minimize",max_parallel_jobs=10,early_stopping_type="Auto",)s3_input_train = sagemaker.inputs.TrainingInput(s3_data="s3://{}/{}/train/".format(bucket, prefix), content_type="json")s3_input_test = sagemaker.inputs.TrainingInput(s3_data="s3://{}/{}/test/".format(bucket, prefix), content_type="json")tuner.fit({"train": s3_input_train, "test": s3_input_test}, include_cls_metadata=False)tuner.wait()FollowComment"

Answer: "0Accepted AnswerThe error message indicates that CreateHyperParameterTuningJob operation is not supported in the region you're currently using. If possible, try the notebook in a region that supports HPO jobs.CommentShareDurga_Sanswered a year ago"


Question: API Error N. Virginia ?

"I cannot access my services via Dashboard, the Ressources section on Dashboard indicates API Error.See screenshot : https://drive.google.com/file/d/1Spo99NrydNETG4unh9UI3odrFpUAIWa9/view?usp=sharingOn Health Dashboard, all services are marked functional.Anyone can help me please ?FollowComment"

Answer: "0Hello SuperBuck88 - I'm seeing similar issues on my account as well. I'd be willing to bet that there may be a temporary outage or a service event. I'd recommend opening up a customer support case (I'm doing the same).CommentShareChet_Hanswered a year ago0Just saw an update on Status Dashboard. Thanks for your reply.8:22 AM PST We are investigating increased error rates for the AWS Management Console.8:26 AM PST We are experiencing API and console issues in the US-EAST-1 Region. We have identified root cause and we are actively working towards recovery. This issue is affecting the global console landing page, which is also hosted in US-EAST-1, however customers can access console in other regions directly, by accessing https://.console.aws.amazon.com/. So, to access the US-WEST-2 console, use https://us-west-2.console.aws.amazon.com/.CommentShareSuperBuck88answered a year ago0Yes, there is an ongoing outage that will hopefully be resolved soon!!CommentShareAWS-Julieanswered a year ago0Check out AWS status page, indeed there is outage in us-east-1https://status.aws.amazon.com/CommentShareNino_Ganswered a year ago"


Question: How to specify target feature in Sagemaker XGBoost?

"I am considering migrating a data science project from Datarobot to Sagemaker. I am familiar with writing Python and have been going through one of the tutorial Jupyter notebooks to see how to explore the data and to build and deploy and estimator. But, I cannot see how to specify the target feature. I have entirely numerical data in a csv file. One of the fields in that file is the intended target for estimation, the rest are information from which the estimate is to be made.How do I specify the column that is to be estimated?The code I expect should have this is ...container = sm.image_uris.retrieve("xgboost", session.boto_region_name, "1.5-1")xgb = sm.estimator.Estimator(    container,    role,    instance_count=1,    instance_type="ml.m4.xlarge",    output_path="s3://xxxxxx001/",    sagemaker_session=session,)xgb.set_hyperparameters(    max_depth=5,    eta=0.2,    gamma=4,    min_child_weight=6,    subsample=0.8,    verbosity=0,    num_round=100,)s3_input_train = TrainingInput(    s3_data="s3://xxxxxx001/data.csv", content_type="csv")xgb.fit({"train": s3_input_train})FollowComment"

Answer: "0Accepted AnswerOn a badly formatted page on the AWS documentation, I found a statement that - the CSV file must have no headers and the target field must be the first field. So, apparently, it is not possible to specify the target. So primitive, yeah?CommentSharedatascience18answered 9 months ago"


Question: Using Lambda for data processing - Sagemaker

"I have created a docker image which has Entrypoint as processing.py. This script is taking data from /opt/ml/processing/input and after processing putting it /opt/ml/processing/output folder.For processing the data I should put the file in /opt/ml/processing/input from s3 and then pick processed file from /opt/ml/processing/output into S3.Following script in sagemaker is doing it properly:from sagemaker.processing import Processor, ProcessingInput, ProcessingOutputimport sagemakerinput_data = 's3://sagemaker-ap-south-1-057036842446/sagemaker/Data/Training/Churn_Modelling.csv'output_dir = 's3://sagemaker-ap-south-1-057036842446/sagemaker/Outputs/'image_uri = '057036842446.dkr.ecr.ap-south-1.amazonaws.com/aws-docker-repo:latest'aws_role = sagemaker.get_execution_role()processor = Processor(image_uri= image_uri,role=aws_role,instance_count=1,instance_type="ml.m5.xlarge")processor.run(inputs=[ProcessingInput(source=input_data,destination='/opt/ml/processing/input')],outputs=[ProcessingOutput(source='/opt/ml/processing/output',destination=output_dir)])Could someone please guide how this can be executed with lambda function? It is not recognizing sagemaker package, second there is a challenge in placing file before the script execution and pick processed files.I am trying codepipeline to automate this operation.FollowComment"

Answer: "1SageMaker Python SDK, as a third party Python package, is not naturally installed Lambda's default runtime. You need to install this package.You can either follow steps in https://docs.aws.amazon.com/lambda/latest/dg/python-package.html to form a zip archive or similarly install sagemaker Python SDK as a layer as in https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.htmlThis should provide a similar runtime env as you container.CommentShareAWS-User-5210721answered 6 months ago0I have build a codepipeline where after build I am executing lambda in the deploy stage.In Lamdba I am executing the docker image.To execute docker image I need to first provide it file from s3 and after script processing file generated need to move to S3.Is it actually possible in Lambda limitations?CommentShareMr Karkianswered 6 months ago"


Question: Connection closed on port 443

"I have an Ec2 server with Jenkins docker and git installed on it. The server is running behind. Load balancer with dns configured on route 53  A records as alas to the application load balancer the ALB is listener on 80 redirected to 443 map to a target group registered with my instance ID on port 8080 because Jenkins run on port 8080, when I put the URL of my A record on the browser it open up Jenkins default login page, Jenkins time out while am try to configure to build, the error message read as: connection closed on port 443. Please help am behind schedule to start building. ThanksFollowComment"

Answer: "0How long does the build take?If it is longer than the ALB timeout value, it may be disconnecting the session with the Jenkins server, so how about extending the timeout value?https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#connection-idle-timeoutCommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: Using Gamelift Realtime with webgl Unity builds

"I've got most of the process working but at the Client.connect()I come across this error in the webgl client:SocketException: SuccessSystem.Net.Sockets.Socket..ctor (System.Net.Sockets.AddressFamily addressFamily, System.Net.Sockets.SocketType socketType, System.Net.Sockets.ProtocolType protocolType) (at <00000000000000000000000000000000>:0)--- End of stack trace from previous location where exception was thrown ---this also occurs when trying to collect a local udp port (I simply set it to -1) which causes the error to occur later on at client.connect()Thank you for any help!FollowComment"

Answer: "0Hi! It is not clear to me exactly from the error you've shared what is causing this issue, however, I hope that I can nevertheless assist.You mentioned UDP in your post. Unfortunately, web browsers do not natively support communication over raw TCP sockets or UDP. They support WebRTC DataChannels for unreliable unordered messaging and WebSockets for reliable ordered messaging, but these are specific protocols running on top of TCP and UDP.  I suspect that what's happening here is that the GameLift Realtime Client SDK / Unity tries to prepare for receiving packets on TCP or UDP, but this is not supported for WebGL builds and that's why it's throwing the error. As per Unity's own documentation about networking in WebGL:Note that you can’t use .NET networking classes, because JavaScript code doesn’t have direct access to IP Sockets to implement network connectivity.My current understanding is that because of this browser limitation, WebGL builds are not supported in GameLift Realtime either. However, there is one thing you can try; you can try passing a custom ClientConfiguration to the GameLift Realtime Server Client constructor. Try changing the connectionType to something else. If you're using RT_OVER_WS_UDP_UNSECURED, try using RT_OVER_WSS_DTLS_TLS12 or RT_OVER_WEBSOCKET.CommentShareJoris_Danswered 4 months agorePost-User-4427887 4 months agoThank you for the response, I suspected this was the issue.I was already using RT_OVER_WSS_DTLS_TLS12 and had thought since it was over wss (Websocket secured) it would work but I believe it utilizes unsecured socket types before making that final secured connection which is where the problem occurs.Regarding the UDP, I simply found that as the first cause of error but set a hard value instead of searching for it (which is of course not possible in webgl) - that lead to the next cause of error which was client.connect()Let me know if there is anything else I could do, thank you very muchShare"


Question: Adding second account in aws organizations shows limit exceeded error

"Im not able to add an account in aws organizations. I only have my root account there. In service quota, it shows i can create upto 10 accounts. Kindly help.EDIT: I also added a payment preference just now (below screenshot). Also, on top of the page in blue box...do I need to be concerned about that notification about regulatory change?FollowCommentJaccoPK 4 months agoDid you set up payment method?ShareShivam 3 months agoYes, I just added one (Net Banking). I think i'll have to wait for a day again right?ShareShivam 3 months agoI am still getting the same error. also this time any new IAM user with any permission policy  is not able to access resources.Share"

Answer: "0Accepted AnswerBasically it could be:your payment method is not set up or expired or not yet validatedyou did a lot of invites before adding the second account (see quota)your primary email / organization email is not yet validatedjust wait one day :-)Here is the stackoverflow answer I got the options from:https://stackoverflow.com/questions/46835884/you-cannot-add-accounts-to-your-organization-while-it-is-initializing-try-againCommentShareJaccoPKanswered 4 months ago0The default maximum number of accounts allowed in an organization is 10 . If you need more, you can request an increase by using the Service Quotas console.For details, please refers to the documentation at: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_limits.htmlCommentShareronald_lanswered 3 months ago"


Question: Deletion of CloudFront Distribution I can't see that has a Custom Domain

"I have a cloudfront distribution that is listed in the associated resources of one of my certificates. However, this distribution does not show up in the cloudfront distribution console, nor when I try to get it's config using AWS CLI: This distribution is causing issues in that when I update my website, it redirects traffic to previous versions of the website.I'd like to have this distribution deleted, but as I can't see it in the console, nor access it via the CLI, I have no way to do this. Is there another way to delete this distribution?FollowComment"

Answer: "1Not sure if it applies here but note that when you use an API Gateway edge-optimised API it creates a CloudFront distribution managed by API GW that's in an AWS-managed account, not in your account even though it's using your ACM certificate.CLI command "aws apigateway get-domain-names" can be used to see the distribution domain names; it would be worth a look in case this is the issue.CommentShareEXPERTskinsmananswered 4 months agoQuinnyPig 4 months agoBingo. A key giveaway here is if the account ID in the "associated resource" arn happens to be 250044486744; see https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-resources/ for details.ShareVincent 4 months ago@QuinnyPigThanks for your response and suggestions.So, I had used the details in https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-resources/ for a similar problem and whilst it worked before it didn't work here. :-(I tried the deletion of the domain name by "aws apigateway delete-domain-name --domain-name 'mydomainnamehere'" as suggested in the article, but I receive the message "An error occurred (NotFoundException) when calling the DeleteDomainName operation: Invalid domain name identifier specified" I got the same result when I removed the speech marks (I just tried the steps again, just to be sure, but same result).I'm not sure why you've mentioned the account id of 250044486744. The cloud front (i.e. the associated resource) has an arn of my own account id. Interestingly enough, when I googled 'arn account id 250044486744' the first result was the knowledge centre page you suggested, but I can't find '250044486744' on that page! The next few results were links to deletion of certificate problems, with just about all coloured purple as I've visited them already. I'm going to have a look at those which I haven't yet visited just in case there's something there. Is there a particular thing about account 250044486744?ShareVincent 4 months ago@skinsmanThanks for your response.I tried out the get domain names command and didn't see the domain name that I am trying to delete - I did see two others that I am using quite happily. I also tried using the region flag of us-east-1 to check if they were hiding elsewhere, that returned zero results.However, one thing that I have done that might be causing an issue is that I created the certificate in certificate manager via cft templates as well as creating another CloudFront distribution to associate with this certificate (of course, this association doesn't work as the domain name is already associated with a CloudFront Distribution). I'm going to delete this distribution and certificate and see if that clears things up at all.UPDATE - deleted the distribution and the certificate but didn't see any change in the either the console displaying the missing distribution, nor in the CLI being able to delete the domain. I've had to recreate a distribution for my website to run...Share"


Question: Instance i-0b40cefb72ab67799 is stuck on pending start

"Hello fellow colleagues, one of our instances is unable to start since yesterday. I can stop it (with and without the --force parameter), but whenever I try to start it, it remains on "Pending". I've also tried to use a different instance type without success (although several other instances are using the very same AMI and instance type without issues).Any suggestions?Thank youFollowComment"


Question: MSK & KafkaJS - UNSUPPORTED_SASL_MECHANISM when using IAM authentication

"I am receiving the error code UNSUPPORTED_SASL_MECHANISM when attempting to connect to my MSK cluster using KafkaJS. My cluster supports IAM and SASL/SCRAM authentication as shown in the below image:Below is the code I am using to connect:import {AclOperationTypes, AclPermissionTypes, AclResourceTypes, Kafka, ResourcePatternTypes} from "kafkajs";const kafka = new Kafka({    clientId: 'test',    brokers: [        `BROKER1`,        `BROKER2`,        `BROKER3`    ],    ssl: true,    sasl: {        mechanism: 'aws',        authorizationIdentity: 'ROLE_ID',        accessKeyId: 'ACCESS_KEY',        secretAccessKey: 'SECRET_KEY',    }});(async () => {    const admin = kafka.admin()    await admin.connect();    console.log(await admin.describeAcls({        resourceType: AclResourceTypes.ANY,        resourcePatternType: ResourcePatternTypes.ANY,        operation: AclOperationTypes.ALL,        permissionType: AclPermissionTypes.ANY    }))})();Below is the KafkaJS error output:{"level":"ERROR","timestamp":"2023-03-09T14:17:16.414Z","logger":"kafkajs","message":"[Connection] Response SaslHandshake(key: 17, version: 1)","broker":"BROKER","clientId":"test","error":"The broker does not support the requested SASL mechanism","correlationId":1,"size":23}{"level":"ERROR","timestamp":"2023-03-09T14:17:16.416Z","logger":"kafkajs","message":"[BrokerPool] The broker does not support the requested SASL mechanism","retryCount":0,"retryTime":346}path\to\node_modules\kafkajs\src\protocol\error.js:581  return new KafkaJSProtocolError(errorCodes.find(e => e.code === code) || unknownErrorCode(code))         ^KafkaJSProtocolError: The broker does not support the requested SASL mechanism    at createErrorFromCode (path\to\node_modules\kafkajs\src\protocol\error.js:581:10)  retriable: false,  helpUrl: undefined,  type: 'UNSUPPORTED_SASL_MECHANISM',  code: 33}Below is the response received from the MSK cluster:{ errorCode: 33, enabledMechanisms: [ 'AWS_MSK_IAM' ] }The following line is also sent to CloudWatch Logs:[2023-03-09 15:48:54,559] INFO [SocketServer listenerType=ZK_BROKER, nodeId=1] Failed authentication with /MY_IPv4 (Unsupported SASL mechanism AWS) (org.apache.kafka.common.network.Selector)I am also unable to run the same code above but using SASL/SCRAM instead of IAM authentication - I receive error code CLUSTER_AUTHORIZATION_FAILED.The following is sent to CloudWatch Logs:[2023-03-09 15:59:31,869] INFO Retrieving credential for user: USERNAME [INTERNAL]I have also followed the steps outlined in this documentation but this has not had any effect.FollowComment"

Answer: 0Accepted AnswerIt turns out that the AWS SASL mechanism that KafkaJS provides out of the box is not the one that AWS MSK uses!I instead used this package https://github.com/jmaver-plume/kafkajs-msk-iam-authentication-mechanism to authenticate which worked immediately.CommentShareSammycorgianswered 3 months ago


Question: Does the RTMPS server stay the same for all channels on the same account and region? Is it possible to CNAME to the RTMPS server?

"It seems to me that every channel on my account within the same region has the same RTMPS server. Does this stay consistent, or is it possible that for new channels in the future something may create a new RTMPS server link?Assuming that the RTMPS does stay the same for newly created channels on the same account and region, is it possible to create a CNAME record that links to the RTMPS server? I have previously been able to use a CNAME record to link to an RTMP server, but I'm not sure how to go about this for RTMPS.FollowComment"

Answer: "0Accepted AnswerAll IVS channels within the same region (under the same account) will have the same ingest endpoint URL. For example, for account 123456789012, all channels created in us-east-1 will have the same endpoint (ex: a1b2c3d4e5f6.global-contribute.live-video.net). While all channels created in us-west-2 will have a different endpoint from us-east-1, but the channels in the us-west-2 region will have the same endpoint (ex: abcdef123456.global-contribute.live-video.net). If you need to get the ingest endpoint URL information for a channel, the GetChannel or BatchGetChannel API calls are recommended (https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetChannel.html).As for using a CNAME record or alias for the ingest endpoint URL, the IVS team recommends against putting anything (CNAME, proxy, redirection URLs) in front of the IVS provided URL. By using a CNAME or other method to "mask" the IVS ingest URL, there can be unexpected adverse effects, such as; improper routing logic, latency on starting a stream, and other unforeseen behaviors.CommentShareriley-awsanswered a year ago"


Question: Opensearch upgrade stuck

"We have a single node Opensearch 1.1 cluster. After selecting to upgrade it to 1.2 the cluster has been stuck on "Preparing to process updates".I found out that it is stuck because the default settings for .opendistro-* indices are to create 5 primaries and 1 replica shard. As our cluster only consists of a single shards those some of the .opendistro-* indices are not unallocated.I created index templates for those indices in question with 1 primary and 0 replicas and deleted some of the .opendistro indices but there are .opendistro-alerting-alerts indices which I can not delete even though I have all the permissions possible.Also followed this guide but still getting 403 https://aws.amazon.com/premiumsupport/knowledge-center/opensearch-disable-index-alerts/GET _cat/shards.opendistro-alerting-alerts                            3 r UNASSIGNED.opendistro-alerting-alerts                            1 p STARTED                   x.x.x.x 92b97e40e5fe8565ff6a7bdf023bb822.opendistro-alerting-alerts                            1 r UNASSIGNED.opendistro-alerting-alerts                            2 p STARTED                   x.x.x.x 92b97e40e5fe8565ff6a7bdf023bb822.opendistro-alerting-alerts                            2 r UNASSIGNED.opendistro-alerting-alerts                            4 p STARTED                   x.x.x.x 92b97e40e5fe8565ff6a7bdf023bb822.opendistro-alerting-alerts                            4 r UNASSIGNED.opendistro-alerting-alerts                            0 p STARTED                   x.x.x.x 92b97e40e5fe8565ff6a7bdf023bb822.opendistro-alerting-alerts                            0 r UNASSIGNED.opendistro-alerting-alert-history-2022.03.16-1        3 p STARTED                   x.x.x.x 92b97e40e5fe8565ff6a7bdf023bb822.opendistro-alerting-alert-history-2022.03.16-1        3 r UNASSIGNED.opendistro-alerting-alert-history-2022.03.16-1        1 p STARTED                   x.x.x.x 92b97e40e5fe8565ff6a7bdf023bb822.opendistro-alerting-alert-history-2022.03.16-1        1 r UNASSIGNED.opendistro-alerting-alert-history-2022.03.16-1        2 p STARTED                   x.x.x.x 92b97e40e5fe8565ff6a7bdf023bb822.opendistro-alerting-alert-history-2022.03.16-1        2 r UNASSIGNED.opendistro-alerting-alert-history-2022.03.16-1        4 p STARTED                   x.x.x.x 92b97e40e5fe8565ff6a7bdf023bb822.opendistro-alerting-alert-history-2022.03.16-1        4 r UNASSIGNED.opendistro-alerting-alert-history-2022.03.16-1        0 p STARTED                   x.x.x.x 92b97e40e5fe8565ff6a7bdf023bb822.opendistro-alerting-alert-history-2022.03.16-1        0 r UNASSIGNEDDELETE .opendistro-alerting-alert-history-2022.03.16-1DELETE .opendistro-alerting-alerts{"error" : {"root_cause" : [{"type" : "security_exception","reason" : "no permissions for [] and User [name=xxx, backend_roles=[], requestedTenant=]"}],"type" : "security_exception","reason" : "no permissions for [] and User [name=xxx, backend_roles=[], requestedTenant=]"},"status" : 403}I would gladly add some additional data nodes to the cluster in order to fix this but this also fails as the cluster is stuck on "Preparing to process updates".EDIT:I tried deleting the .opendistro indices with "m aster" user but even "m aster" user receives error 403.FollowComment"

Answer: "0If we had premium support we wouldn't be asking for help in here.I was under the impression that this is the place to come for help in case you don't have a paid support plan.Could you answer why is the "\master" user not able to delete the indices I mentioned? If we'd get those deleted then we'd probably be able to carry on with the upgrade.Also this site does not allow posting the word "\master".CommentShareAWS-User-7264420answered a year ago-1When the cluster is in processing state, the cluster will try to complete the blue/green deployment change for a limited number of times before getting stuck. Once the cluster has failed the maximum number of retries possible, the cluster will remain in processing state until intervened by AWS internal team. Please reach out to the premium support with the ARN of the cluster to get the cluster back to the active state.Other recommendation is to please follow the best practices for Amazon OpenSearch Service: https://docs.aws.amazon.com/opensearch-service/latest/developerguide/bp.htmlBlue/green deployment: https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-configuration-changes.htmlCommentShareSUPPORT ENGINEERVarun_Sanswered a year ago"


Question: Exploded costs declared as No-Resource - sometimes 10 times higher then the day before

"Hi!We use a lot of services such as EC2, Lambda, SQS, CloudWatch, CloudFront etc.Usually we spend about $60-70 per day.But on few days we reach peaks about $600-800 per day! The cost explorer declares it as "No-Resource".It seems it can be SQS, but I cannot explain.We use Laravel-Vapor for managing the lambda environment and its backend sayy samething about 6 Million queues invoked per month. Concerned to aws price list it shouldn't lead to hundreds of dollar even a few dollar.Does anybody know how I can check which service causes this extensive costs?Thank you in advance!Best,MichaelFollowComment"

Answer: "0Hi Michael,There are some costs not bound to specific resources, like certain API calls or data traffic. But with the help of Cost Explorer you should be able to narrow down the source of your spend.A very helpful function of Cost Explorer is the "Group By" function, directly above the chart. The first thing I would do is selecting "Service" as grouping option. That way you can nail it down to Lambda, SQS, CloudWatch, etc.Another thing you should do is group by Region. Check if the spend is really at the location you are looking for it.Depending on your account setup you can also try to open the invoice for this account, which also gives you a line by line explanation of the spend, grouped by service and region. You can find this option also in the Billing Dashboard.CommentShareEXPERTAndreas Seemuelleranswered a year agofrancosdad a year agoHi and thank you for your answer, but it didn't help. We got a credit budget for trying amazon services. The credit budget is melting like ice in the sun, but there are no specific information for what the credit has been used for.Only really payable services are on the bill or in the cost explorer chart. For example we generated a "Business Service Fee" about $500 for May, based on about $5000 used services. But which services exactly caused this amount isn't comprehensible.I see costs about $500-$600 for each day from 29. to 31. May. But if I group the services or charged by, I only see some dollars for EC2 etc. and $500 for Business Service fee.On the bill it isn't declared what caused the high business fee, because there are only records which has to be payed, all fees which has been offset are missed on the invoice.It is really strange and a real gamble.Share0You can also groupby ChargeType. There are some chrges such as credits, refunds, Tax etc that are not directly associated with resources.CommentShareAWS-User-9819141answered a year agofrancosdad a year agoHey, thank you for your answer. It didn't help. I commented it related to the post of Andreas_SShare0I m in a similar situation where billing is not clearly answering where did all the requests came from despite the console not showing that much activity. My questions refers to sqs. I have 14 total queues of which 7 are deadletter queues. I have been testing a recently developed app with 1 user and I am getting >1 M requests per month billing. This number does not seem plausible considering I am using at max 50 requests per day with 1 user. There are usually 10 -20 messages per day being sent around. I don't know if this is a technical issue or a billing error. The sqs is connected to a lambda and everything works but the number is ridiculous and i have not launched the app yet. I am afraid what will happen with actual users. Any guidance on where to look for answers for this. The code is pretty straightforward and follows aws recommended style.CommentSharerePost-User-6858217answered a year agofrancosdad a year agoI understand this. Concerning AWS price list 1M requests should be cost $0.40. Regarding my costs with about $3.500 per month, it must be at least 9 billion messages. That would mean 3.500 messages per second, 210.000 messages per minute.Sorry, but if I don't get managed that I have to leave AWS.Share"


Question: Can I downgrade Wowza Instance?

"Hi,I have EC2 that now running Wowza Streaming Engine (Linux PAID) then I found that I can use lower-spec EC2. I want to make sure that I can change instance type and don't have to reset setting. Will it less cost?Thank youFollowComment"

Answer: "0Accepted AnswerIf you change the type of an EC2 instance the information is not lost (except for the instance store-backed instances), so your application should be working as usual.To be sure that you can do the change follow the next steps:First, check the compatibility of your instance type with the new type that you want to have:  Compatibility for changing the instance type.Then, check the Considerations for compatible instance types list.To do the instance type change follow the next steps:Shutdown the instance (make sure the shutdown behavior is not set to terminate).Change the instance type andStart the instance again.For detailed information about changing the instance type, have a look at the Change the instance type documentation.Regarding the pricing, when you change the instance type, you'll start paying the rate of the new instance type. For the on-demand rates of all instance types, see Amazon EC2 On-Demand Pricing. So if your new instance is less expensive you will reduce your final cost.I recommend you to have a look at the Get recommendations for an instance type for having a better insight of the better instance type to use for your workload.CommentShareigsalvaranswered 16 days agoEXPERTRiku_Kobayashireviewed 16 days ago"


Question: On-demand parameterized nodejs lambda function on greengrass

"Hi Team,I would like to receive messages published on a topic from IoT cloud, in nodejs lambda function on greengrass and pass the values in that message as a parameter to nodejs lambda function methods, so that the function executes accordingly.However, I am not able to find AWS IoT APIs which subscribe to the messages published by IoT cloud.Can you please provide help on this? It will be helpful if you can provide sample nodejs lambda function code for this.Best Regards,NKVFollowComment"

Answer: "0Hi NKV,You can setup subscriptions for topics between IoT Cloud and your Lambda.https://docs.aws.amazon.com/greengrass/latest/developerguide/module3-II.htmlYou can pass values in the message. For example:def function_handler(event, context):    #Set to LEDstate    if event['LEDstate'] == "ON":        #turn LED ON       # call some function using these values.returnCommentShareKR-AWSanswered 4 years ago"


Question: Metric Filter Creation from CloudWatch Log

"HiMy CW log contains this line, and I need to filter/extract a metric06-22-2022 14:01:01::1DB::TABLE_UPDATEbatches-ZZZZ\Noodles\GhostProcessor\Batches::processBatches 0 batches successfully closed{I want to extract the number 0 after processBatches.What is a good expression to use to extract the number?I tried [date,time, msg=processBatches] which gives the entire line. anything else doesnt work.FollowComment"

Answer: "1Hello there,I understand that you would like to extract values from Log events using Metric Filter.Give your Log Event, you can try few methods.06-22-2022 14:01:01:: 1 DB::TABLE_UPDATE batches- ZZZZ\Noodles\GhostProcessor\Batches::processBatches 0 batches successfully closed {First, you can use the space-delimited log matching with [date, time, w3, w4, w5, w6, BatchProcessCount, w8] which the BatchProcessCount field will be assigned the number after ..processBatches in your log event.Second, if you don't know how many space-delimited fields are there in your Log event you can use ellipsis (...) to reference any unnamed fields and if you are only interested in that number. [..., BatchProcessCount, w8=batches, w9=successfully, w10=closed, w11]In both cases $BatchProcessCount will be extracting the number after ...processBatches in your log event.You can review the filter pattern syntax detail from 1Hope this helps,ThanksCommentShareSUPPORT ENGINEERMunkhbat_Tanswered 10 months ago0Hi there,I understand that you want to extract the number 0 after processBatches, but you are not getting your desired results.By looking at your filter pattern, your log event message, it consists of 10 space-delimited fields, while your filter pattern consists of 3 fields.This is how I extracted your filter pattern:06-22-2022 14:01:01:: 1 DB::TABLE_UPDATE batches- ZZZZ\Noodles\GhostProcessor\Batches::processBatches 0 batches successfully closed[06-22-2022, 14:01:01::, 1, DB::TABLE_UPDATE, batches-, ZZZZ\Noodles\GhostProcessor\Batches::processBatches, number=0, batches, successfully, closed]Reference:[1] https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.htmlI hope the above information is helpful. For any concerns, feel free to reach out.CommentSharePhindianswered a year ago"


Question: convert outputs with empty subtitles

"We have created a Media Convert job with two audio tracks and three subtitle tracks. The job definition is the attached JSON.When playing the convert result in VLC or JW Player, the video and audio qualities and the 3 types of subtitles appear, but when clicking on any subtitle, nothing appears. In S3 the 3 subtitle files appear, but they are empty.https://drive.google.com/file/d/1Gk_2FxdS98VTP3kPl_3yvNIrELHDEU9M/view?usp=sharingFollowComment"

Answer: "0Reviewing your job config, it seems you are using 3 separate WebVTT file sources. If the 3 output CC files are being generated, yet contain no information, it may be related to the TimeCode alignment of the video source and the WebVTT captions sidecar files.You could run a quick test using, CC Burn-in as the CC output format, with each WebVTT source. (Use clipping do only run an 3-5min job). If the TimeCodes are misaligned you won't see CC burned in.Please check the CC sidecar output format being selected when creating the CMAF container. (Are they separate sidecar files or included in the CMAF wrapper?) Please see the following list for CC formats supported for output formats.https://docs.aws.amazon.com/mediaconvert/latest/ug/sidecar-captions-support-tables-by-container-type.htmlCommentShareMike-MEanswered 17 days ago"


Question: Is there a way to prevent instances from terminating?

"We are building a solution for an application that sometimes needs to process data for 2-3 days. On the other hand, we don't want all users to have the same Disconnect Timeout of 72 hours or more. We know that one solution could be to use two fleets with two timeouts, but I wonder if there is a way for our application to stop the session ending? How does AppStream kill sessions? Is there any way to block a session kill attempt if the application is processing data?FollowCommentLes 7 months ago@Mayank_J You write "Unless your application is capable of keeping the session active" what does that mean? If application is processing data (which doesn't involve human interaction, so there won't be any inputs) does that process count as alive? I mean, if one uses AppStream for generating videos that counts as a active process and session wouldn't be stopped, right?ShareMayank_J 7 months agoRunning process on OS is not equivalent to active session. Your processes can still run even if the session is in disconnected state (similar to locking a physical machine). If you run the command "query session" on the OS you can check the session state. This is what is monitored to check the status of the session. Unless there is an active interaction with the session like keyboard and mouse interaction, the session is considered idle. Once the idle time out expires, the session will be disconnected and once the disconnect time out expires, the session will end and the instance will be terminated.ShareFrank Huxol 7 months agoI don't know, if that would work and it feels more like some hacky thing. But maybe you can write a powershell script and have it run regularly via task scheduler. That script could:Check the CPU loadCheck the idle time of that machineIf CPU load is high and idle time is above a particular threshold: Move the mouse to emulate being active ... don't know if that actually counts for AppStream to not kick out users from that instance. Of course, the streaming session would probably need to stay open for that whole duration.We did something similar not to extend the life of a session, but to shorten it (via aws appstream expire-session call, when a particular budget has been used up)SharerePost-User-5267178 7 months agoHey @Mayank_J! Thanks for your answers. But can I ask you what do you mean by running the "query session" command? Is it possible to that query during the session (I mean without Admin permissions)?Share"

Answer: "0Maximum session duration that you can set in the AppStream 2.0 console is 5760 minutes (96 hours)Idle disconnect timeout in minutes, the amount of time that users can be idle (inactive) before they are disconnected from their streaming session. Users are considered idle when they stop providing keyboard or mouse input during their streaming session.Disconnect timeout in minutes time interval begins after Idle disconnect timeout provided ends. Users are notified before they are disconnected due to inactivity. If they try to reconnect to the streaming session before the time interval specified in Disconnect timeout in minutes has elapsed, they are connected to their previous session. Otherwise, they are connected to a new session with a new streaming instance. Setting this value to 0 disables it. When this value is disabled, users are not disconnected due to inactivity. Refer https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.htmlCommentSharePreenesh_Nanswered 7 months agoLes 7 months agoI understand the concept of Disconnect Timeout. Let me rephrase my question: How does AppStream agent evaluate if session is active?  Is it based on CPU utilization since for data processing no user input is neccessary (imagine video rendering)?ShareMayank_J 7 months agoAppstream service communicates with the Appstream agent on the fleet instance and monitors the session on the streaming instance.. When a particular timeout is reached the service performs the action, that is disconnect, end session etc.. The Appstream service is not aware of what's happening at the OS level wrt to your application. Unless your application is capable of keeping the session active, there is no way to change this behavior. The only solution is to use multiple fleets.ShareMayank_J 7 months agoAppstream uses different mechanism to check the session status, I believe Windows API and it is not based on resource consumption.Share0Would it be possible to prevent the instance termination with help of After Session Script? Maybe by checking the CPU utilization? Is it possible to monitor utilization from session? Does it need admin permissions?CommentSharerePost-User-5267178answered 7 months ago"


Question: Get AWS caller Identity with .net core

"When I execute this with the aws cli, i.ex. inside a fargate task, I can see the UserId that my application is going to use    aws sts get-caller-identitywith this output on the console    {        "Arn": "arn:aws:sts::643518765421:assumed-role/url_process_role/6ae81f92-66f3-30de-1eaa-3a7d1902bad9",        "UserId": "ARDYOAZLVOAQXTT5ZXTV4:4ea81f97-66f3-40de-beaa-3a7d1902bad9",        "Account": "692438514791"    }I would like to get the same information but using the C# SDK. I tried with the methods exposed in https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/net-dg-config-creds.html where I can see some account related details but not the assigned UserId.So far I've tried with this but I cannot see  any profile when running in a Fargate task.var awsChain = new Amazon.Runtime.CredentialManagement.CredentialProfileStoreChain();System.Console.WriteLine($"Found {awsChain.ListProfiles().Count} AWS profiles.");My final goal is to get it and add to some task processed with Fargate to save a correlation Id in the database when something fails and easily find the Fargate log stream.Edited by: guillemsola on May 17, 2019 3:50 PMFollowComment"

Answer: 0I finally found it. The example will only work inside an AWS task as the endpoint is not publicly available.var getSessionTokenRequest = new GetSessionTokenRequest                    {                        DurationSeconds = 7200 // seconds                    };                    var stsClient = hostContext.Configuration.GetAWSOptions().CreateServiceClient<IAmazonSecurityTokenService>();                    var iden = stsClient.GetCallerIdentityAsync(new GetCallerIdentityRequest { }).Result;                    System.Console.WriteLine($"A={iden.Account} ARN={iden.Arn} U={iden.UserId}");CommentShareguillemsolaanswered 4 years ago


Question: AWS Transcribe splices number (dollar values) references

"We're finding that Amazon Transcribe consistently transcribes money amounts incorrectly. For example,  "up to 3000 and $11 per month" in lieu of " up to $3011.00 per month". The latter is presented by Microsoft so the variant is not solely a byproduct of dialect or pronunciation. Has anyone noticed similar artifacts? Does anyone know if there are settings that can correct the splicing that Amazon Transcribe presents?FollowComment"

Answer: "0Hi,Thanks for reaching out and apologies for the delayed response. I would just like to confirm that we have reached out to the Transcribe service team regarding this behavior.The service team investigated the issue and has confirmed that this is indeed a bug. They have a fix for this bug that is currently pending deployment.We will let you know once we have received further updates. Thanks in advance for your patience!CommentShareSUPPORT ENGINEERRyan_Aanswered a year agoAWS-User-9169042 a year agoThis is great! Thank you for the update!!ShareAWS-User-9169042 10 months agoHi, there! Checking in to see if the aforementioned bug fix has been pushed to prod... Thank you!Share"


Question: How to rewind Job bookmark programatically

"I am using Glue service to read the files and migrating to database. The same script is run for 30-40 tables. The S3 path and table name are changing dynamically through a csv file I am passing. Doing this to avoid creating that many jobs.Each datasource being read includes their own dedicated transformation_ctx property. Next time when the job runs again it picks where the tables where last read.The problem I am facing is when any of the table load fails. For those too the file was read already but write did not happen, due to which I would lose the data which was read but not written for that specific table in the next run.Below are the possibilities I have come up with:1. Make the entire job fail if any of the table load is failing2. Add notification for failed table sent over email (so that I could troubleshoot) and rewind bookmark for the failed table and process next tables.I am unable to achieve the second option, as I don't want to stop other tables from being written. I would like to rewind the bookmark by code or reprocess files for that table only, not all tables.Can I achieve this with any other way?FollowComment"

Answer: "0You can only rewind job bookmarks to any previous job run - https://docs.aws.amazon.com/cli/latest/reference/glue/reset-job-bookmark.htmlSince there are multiple tables being processed in a single job, this would mean reprocessing data for all of the tables - even for those tables where this issue didn't happen. It seems like the first option would be better - to make the entire job fail even if one table load is failing.CommentShareMeghana_Sanswered a year ago"


Question: Best method for exporting/downloading an AWS image to an offline location where it can be run locally as a vmdk or vdi image?

"We are planning on spinning down a few of our hosted AWS virtual machines, but wanted to be able to download them to later be launched/run locally as a VMWare vmdk or Microsoft VDI.   What's the most common method for doing this?FollowComment"

Answer: 0Accepted AnswerSounds like a solid use case for the VM Import/Export service. You can export directly from an instance or from an AMI.CommentShareAWSJoeanswered a year agoKearnsWest IT a year agoThis is exactly what I was looking for.  Thanks @AWSJoe!Share


Question: appSpec.yml file for aws codedeploy

"Hello,Do we always require appspec.yaml file in our repository to use AWS codedeploy?FollowComment"

Answer: "2No, the appspec.yaml file is not always required to use AWS CodeDeploy. The appspec.yaml file is used to specify the deployment actions to be taken by CodeDeploy, but it is only necessary if you are using the "Application" deployment type. If you are using the "Blue/Green" or "In-place" deployment types, the appspec.yaml file is not required.No, appspec.yaml is not always required for AWS CodeDeploy. It's only necessary for "Application" deployment type.CommentShareHarsh Upadhyeanswered 5 months agodigpal parmar 5 months agoThanks for answerI think the application is default but there are two types of deployments 1. in-place 2. blue-green (mainly for load balancing)can you  please answer why the YAML file needs for in-place and not blue-greeThanks.Share1Accepted AnswerIt's the appspec.yaml file that defines the deployment processes in your project.  If you dont have that I'm not sure how you would:Map the source files in your application revision to their destinations on the instance.Specify custom permissions for deployed files.Specify scripts to be run on each instance at various stages of the deployment process (hooks).The appspec.yaml is applicable whether doing blue/green or in-place deployment.CommentShareEXPERTskinsmananswered 5 months ago"


Question: How can I request rights to delete WorkDocs profile?

Is there a way to be added to list of owners able to delete profiles?FollowComment

Answer:
"0Hi,

Unfortunately, there is no way to be added to list of owners able to delete profiles. Even if your administrator can change existing user information and settings by changing user role to power user, see this document [1] to modify user Information. By changing the role of the user, your are basically giving a user special set of permissions this document [2] for more explanation about user roles. Only administrator are able to delete profiles.For more information about how to set permissions for a Power user, see Security – public share settings [3] and Security – external invitations[4].Reference:[1] https://docs.aws.amazon.com/workdocs/latest/adminguide/edit_user.html[2] https://docs.aws.amazon.com/workdocs/latest/adminguide/users_ovw.html[3] https://docs.aws.amazon.com/workdocs/latest/adminguide/manage-sites.html#external_share_settings[4] https://docs.aws.amazon.com/workdocs/latest/adminguide/manage-sites.html#external_share_settings[5] https://docs.aws.amazon.com/workdocs/latest/adminguide/workdocs-amazon-business-admin.html

I hope the below Information is helpful. Feel free to reach out at anytime.CommentSharePhindianswered a year ago"


Question: NICE DCV Web Client UI React components

"Hello,I have recently prototyped a custom web client using the React component provided in the latest SDK version 1.1.0.I was wondering if it would be possible in a future release to provide individual components that are currently part of the main DCVViewer - in particular the buttons and widgets present within the toolbar (file upload manager, preferences, copy/paste etc). It would be preferable for our use case to embed some of these within our own custom application header.Thank youFollowComment"

Answer: "0Thanks for the feedback, we will take into account for our future roadmap.CommentShareRobertoAtAWSanswered a year ago"


Question: Traffic Mirroring - Seeing significant NetworkPacketsSkipMirrorIn and NetworkPacketsSkipMirrorOut counts in CloudWatch at fairly low network rates.

"My test setup uses two m5.4xlarge instances to generate a single unidirectional flow of UDP packets from one instance to another at a fixed speed. I have a Traffic Mirror session configured to Mirror all traffic from the instance generating the test traffic.  The mirror sends traffic to a third instance (m5zn.2xlarge) which is monitoring the VXLAN mirrored packets. The m5.4xlarge has a min network adapter capacity of 5Gbps and the m5zn.2xlarge has a min network capacity of 10Gbps. Test traffic is a single flow of mixed size UDP traffic averaging 450Bytes. The three instances are in the same region, VPC, and subnet.  Using CloudWatch, I monitored NetworkPacketsSkipMirrorIn and NetworkPacketsSkipMirrorOut and compared them to the actual count of packets sent. All network packets were delivered, but I observed the following % packet losses with the mirrored packets:750 Mbps (1.5 Gbps w/Mirrored Traffic) - 0.4% NetworkPacketsSkipMirrorIn+Out1000 Mbps (2.0 Gbps w/Mirrored Traffic) - 1.74% NetworkPacketsSkipMirrorIn+Out1250 Mbps (2.5 Gbps w/Mirrored Traffic) - 6.4% NetworkPacketsSkipMirrorIn+Out1500 Mbps (3.0 Gbps w/Mirrored Traffic) - 12.85% NetworkPacketsSkipMirrorIn+OutIs this normal? Is there a practical limit to the amount of traffic that can be mirrored in a given Traffic Mirroring session or in a given VPC? Could it be related to using only a single unidirectional flow in my test? I understand that mirrored traffic is the first to be dropped when there is congestion. Can the amount of congestion be measured somehow? Is there a way I can get some additional insight into what is causing the high SkipMirror packet counts?FollowComment"


Question: Not able to see BEGIN exam option for the cloud practitioner exam from today

"Hello Amazon team,today I had my cloud practitioner exam scheduled for 12:15 a.m. I was online at 11:40, as mentioned in the registration e-mail and followed all the steps for the online check-in, but unfortunately I got no begin exam button displayed.I logged in and out several times, I also tried several browsers, followed all the steps,  but still no button there.Log in to your AWS Certification AccountOn the homepage, click "Manage Pearson VUE Exams", you are taken to the Pearson VUE dashboardClick on your scheduled exam under "Purchased Online Exams"Click "Begin Exam" and follow the on-screen prompts to complete the check-in processI also could not find an option to reschedule my exam.I already created a ticket but got no feedback. Could you please help me out?Order Number/Invoice0063-8883-8685Registration ID428861157StatusExpiredFollowComment"

Answer: "0Please submit a ticket to the AWS Training & Certification customer support team, and they will provide assistance. If you already submitted a case, please allow at least 48 hrs to get a response.CommentShareNelliT-AWSanswered 3 months agorePost-User-5114083 a month agoToday my exam was scheduled but i didn't get "begin exam" option it self.Share"


Question: VPC Endpoint Fargate to CodeCommit

"I'm using Amplify, and in the VPC created by Amplify, I've created a VPC Endpoint to CodeCommit.  DNS Hostnames are enabled on the VPC, DNS Resolution is enabled on VPC, Private DNS Names are enabled for the endpoint.  The DHCP Option set attached to the VPC uses the AmazonProvidedDNS name servers.  The Fargate task is run in the given VPC, on the same subnets as the endpoint is configured for.  For some reason, however, when looking up the service by it's name (git-codecommit.us-east-1.amazonaws.com), DNS resolution fails.  I can see that name in both the Private DNS as well as the regular DNS names for the VPC Endpoint.  It seems that everything should be properly configured, but the  container in Fargate cannot resolve the service using DNS.FollowComment"

Answer: "0is the issue happening only from container in Fargate ? did you test it from an EC2 instance in the same subnet ? Could you share the error that you are getting during the DNS resolution ?CommentShareAWS-User-0271691answered a year agoJohn S a year agoThis is the error:2022/07/15 02:43:44 [error] 31#31: *10 git-codecommit.us-east-1.amazonaws.com could not be resolved (110: Operation timed out), client: 10.0.0.33, server: git-proxy, request: "GET /myrepo/info/refs?service=git-upload-pack HTTP/1.1", host: "amplify-app.execute-api.us-east-1.amazonaws.com"I haven't tested through EC2 instances, mainly because there is no internet gateway on this VPC.  Ingress is through API Gateway.ShareAWS-User-0271691 a year agoCould you try do a dig to the Amazon DNS server directly from the container. Please use the below command.dig git-codecommit.eu-west-3.amazonaws.com @<Amazon DNS server i.e VPC CIDR+2>ShareJohn S 10 months agoRunning into issues doing that.  I keep getting errors when trying to deploy updated container.  Only thing I've changed is the inclusion of the dig command, and I keep getting generic errors without much information like this:{"errorType": "Error","errorMessage": "The execution didn't succeed","stack": ["Error: The execution didn't succeed","    at Runtime.exports.handler (/var/task/index.js:102:13)","    at processTicksAndRejections (internal/process/task_queues.js:97:5)"]}I had dealt with this before, and I know it's either related to building or possibly running the image, but I don't have any issues locally when building and running the image.  So, without any real details in the error log I can't tell what's going on and why I can't deploy this updated image to check DNS...This is my Dockerfile:FROM nginx:alpineRUN apk add bind-toolsCOPY ./nginx.conf /etc/nginx/conf.d/default.confEXPOSE 80CMD ["sh","-c","dig git-codecommit.us-east-1.amazonaws.com @10.0.0.2 && nginx -g 'daemon off;'"]Share"


Question: Deploying CDK application in Marketplace

I have a CDK application which creates some infrastructure with some serverless functions and storages. Can I deploy my CDK application in AWS Marketpalce?FollowComment


Question: Greengrass V2: LegacySubscriptionRouter component target LambdaNotFoundException

"I have a Greengrass Lambda component subscribed to the aws.greengrass.SNS output topic sns/message/status using the aws.greengrass.LegacySubscriptionRouter component with the following configuration:        {            "subscriptions": {                "GreengrassSnsOutput": {                    "id": "GreengrassSnsOutput",                    "source": "component:aws.greengrass.SNS",                    "subject": "sns/message/status",                    "target": f"component:MyComponentName",                }            }        }That works as expected, but if I update the Lambda corresponding to MyComponentName, I get the following error message in the main Greengrass log file:com.aws.greengrass.lambdamanager.LambdaNotFoundException: Lambda arn:aws:lambda:region:account:function:my-function-name:# does not existThe developer guide suggests that v2.1.0...Adds support to specify component names instead of ARNs for source and target. If you specify a component name for a subscription, you don't need to reconfigure the subscription each time the version of the Lambda function changes.I took that to mean nothing needs to happen with respect to the subscription after a new component version with the same name but a new Lambda ARN is deployed. Is that right or is there something else that needs to be done?I'm using the following component versions:  "aws.greengrass.LegacySubscriptionRouter": {    "componentVersion": "2.1.4"  },  "aws.greengrass.Nucleus": {    "componentVersion": "2.5.5"  },  "aws.greengrass.SNS": {    "componentVersion": "2.1.0"  },FollowComment"

Answer: "1Hi,Please use a RESET configuration update to ensure that the configuration used is what you expect it to be for the subscription router component. Use RESET: [""] to reset all of the configuration of that component to the default; then use MERGE to merge in your desired configuration. https://docs.aws.amazon.com/greengrass/v2/developerguide/update-component-configurations.html#reset-configuration-updateThe error message does not match the configuration, so I think you still have configuration deployed from a previous attempt, using RESET will remove it.CommentShareEXPERTMichaelDombrowski-AWSanswered a year ago"


Question: Sagemaker Lifecycle configuration

Trying to create a lifecycle config for notebook instance.Also there is nothing in cloudwatch logs corresponds to this failure.FollowComment

Answer: "0From the screenshot, it looks like your LCC is taking longer than 5 minutes. SageMaker notebooks don't support scripts that run longer than 5 minutes (https://docs.aws.amazon.com/sagemaker/latest/dg/notebook-lifecycle-config.html). You can use the nohup command to run scripts longer than 5 minutes (see an example here - https://aws.amazon.com/premiumsupport/knowledge-center/sagemaker-lifecycle-script-timeout/#:~:text=If%20a%20lifecycle%20configuration%20script,ignores%20the%20hang%20up%20signal.)Ideally, you should see a CW log stream in log group /aws/sagemaker/NotebookInstances in the format [notebook-instance-name]/[LifecycleConfigHook]. If you don't see it, make sure your notebook has the necessary permissions to write logs to CloudWatch, and has internet access/VPC endpoint to reach CloudWatch.CommentShareDurga_Sanswered 6 months agorePost-User-0868940 6 months agoI tried nohup command also in script  but still getting same error.ShareDurga_S 6 months agoAre you able to view CW logs? Can you share the script (if it's from our samples)?Another recommendation is to run the LCC shell script from the terminal, and see if it succeeds and how long it takes. That will give us an idea of whether it's an issue with the script or with the execution time.Share0Based on the name of the lifecycle in the error I'm assuming it's related to https://github.com/aws-samples/amazon-sagemaker-notebook-instance-lifecycle-config-samples/tree/master/scripts/auto-stop-idle , is that correct?I've been recently found that the .sh file used has some issues when running on aws2 notebooks. If you look in the logs you may see that it doesn't identify the python version being run then it exits the lifecycle.  https://github.com/aws-samples/amazon-sagemaker-notebook-instance-lifecycle-config-samples/issues/109I still haven't found any documented differences in how python is used/loaded, but I've tried setting up the idle function a few different ways. Running though the scrips manually after the notebook is up will work. If all else fails I'm looking at just loading the needed files in the lifecycle then setting a scheduled task to finish the setup. I know that's not as nice but if I can't find anything else that's where I'm heading.CommentShareHitchhiker_Ford_Prefectanswered 2 months ago"


Question: Splitting data into test and train

Please guide me with a tutorial for splitting the data into train and test data.AWS is using Sagemaker for machine learning for the new customers.I am a beginner in machine learning.Please throw some lightFollowComment

Answer: "1Hi there, you can follow this tutorial to get started : https://aws.amazon.com/getting-started/hands-on/build-train-deploy-machine-learning-model-sagemaker/CommentSharehangduonganswered 4 months ago0there are quite a few resources you can start with, one of the resource I recommend is the Sagemaker notebook's build-in example, you can access it via https://[yournotebook].notebook.[yourregion].sagemaker.aws/tree#examples or the forth tab of the notebook.you can also view some good examples here - https://github.com/aws/amazon-sagemaker-examplesorhttps://sagemaker-examples.readthedocs.io/en/latest/generally speaking, you need to use the standard ML library to split the training and test dataset such as:sklearn.model_selection's  train_test_split such ashttps://sagemaker-examples.readthedocs.io/en/latest/sagemaker-python-sdk/scikit_learn_randomforest/Sklearn_on_SageMaker_end2end.html#Prepare-data.most of the examples needs skills on python pandas to clean and prepare your training dataanother option I can think of is using AWS Data Wrangler such as from https://aws.amazon.com/blogs/machine-learning/create-train-test-and-validation-splits-on-your-data-for-machine-learning-with-amazon-sagemaker-data-wrangler/hope that works.CommentSharerafaxuanswered 4 months ago"


Question: CloudFormation return values for MediaLive Inputs

"I have a CFn template that deploys a MediaLive pipeline that gets used by internal people that don't know a lot about the AWS Elemental Media Services. I would like to have the people that deploy this template refer to the Outputs of the CloudFormation template to determine the MediaLive Input destination that they need to push RTMP content to. Documentation (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-medialive-input.html#aws-resource-medialive-input-return-values) says that the "Destinations" return value should do what I need.Consider the following CFn:Outputs:   MediaLiveInputDestination:     Value: !GetAtt <Resource>.DestinationsThe template errors when being deployed, stating "Template format error: Every Value member must be a string.". I presume that an array is being passed back to CFn, which means that I have to specify a sub-value under Destinations - but there is no documentation that I can find to determine what sub-values are returned (I've tried the obvious candidates of ".A" and ".0" to no avail).Any suggestions?FollowComment"

Answer: "0Accepted AnswerI just tested this and it works. Can you try it out?AWSTemplateFormatVersion: 2010-09-09Parameters:  Stream1:    Description: StreamName1    Type: String    Default: test/test1  Stream2:    Description: StreamName2    Type: String    Default: test/test2Metadata:  'AWS::CloudFormation::Designer':    0c5c0850-c9e8-4019-97b0-d950aaf22611:      size:        width: 60        height: 60      position:        x: 151        'y': 145      z: 0Resources:  MLI5AM0O:    Type: 'AWS::MediaLive::Input'    Properties:      Type: RTMP_PUSH      Name: Testing12345      InputSecurityGroups:        - 2461108      Destinations:        - StreamName: !Ref Stream1        - StreamName: !Ref Stream2    Metadata:      'AWS::CloudFormation::Designer':        id: 0c5c0850-c9e8-4019-97b0-d950aaf22611Outputs:  StreamingPrimaryURL:    Description: Primary Ingest    Value: !Select [ 0, !GetAtt MLI5AM0O.Destinations]      StreamingSecondaryURL:    Description: Secondary Ingest    Value: !Select [ 1, !GetAtt MLI5AM0O.Destinations]KeyValueDescriptionExport nameStreamingPrimaryURLrtmp://52.201.128.200:1935/test/test1Primary Ingest-StreamingSecondaryURLrtmp://54.173.229.233:1935/test/test2Secondary Ingest-CommentShareElementalJohnanswered 3 years ago"


Question: "How to determine if an object is encrypted with a "regular" S3-SSE KMS key, or an S3 Bucket Key with S3 Inventory?"

"I have a very large bucket with many files. The bucket contains a mix of mostly "old" files encrypted with a non bucket key KMS key, and some new files that are using the new BucketKey.I do not want to call a HEAD operation on all of them to determine if ServerSideEncryptionConfiguration contains BucketyKeyEnabled for performance and cost reasons. However, I can't just check the bucket level settings, as the bucket contains a mix of encrypted objects.Documentation for S3 Inventory indicates that Encryption Status will not contain this info:Encryption status – Set to SSE-S3, SSE-C, SSE-KMS, or NOT-SSE. Theserver-side encryption status for SSE-S3, SSE-KMS, and SSE withcustomer-provided keys (SSE-C).I believe both old and new files will just return SSE-KMS.Is there a way to access this info either via S3 Inventory (through yet undocumented behavior/config), or via another efficient method?I do not want to just use a "all files before the date the Bucket Key was turned on" method, as while that may work for this specific use case, I need a solution with a broader scope for the future.FollowComment"

Answer: "0Accepted AnswerAs of today this information is not available in inventory report and you will have to use S3 HEAD api calls to generate bucket key status on an object. However, we are aware of this feedback and are working on an update to release Bucket Key status in the inventory reportCommentShareAWS-User-3682361answered 2 years ago"


Question: Building a real-time dashboard with processed data from Kinesis data analytics.

I have a requirement to build a real-time dashboard for my e-commerce platform which will track user behavior metrics. Is there any AWS service that can be used for visualizing this data which is to be processed in real-time by Kinesis Data Analytics?FollowComment

Answer: "0Hi,You can look into this guide as part of the best practice in Solution library: https://aws.amazon.com/solutions/implementations/real-time-web-analytics-with-kinesis/User data is sent to Kinesis Firehose which then can be sent to a variety of destinations such as https://docs.aws.amazon.com/firehose/latest/dev/create-destination.htmlHope it helps ;)CommentShareEXPERTalatechanswered 2 months ago"


Question: Delete old alarms with not resource

The idea is to find a way to identify old alarms with non-existent resources and possibly delete them.FollowComment

Answer: "1Hey Nicolas,Are you referring to cloudwatch alarms? Are you familiar with lambda? At a high level, I would recommend creating a lambda function with a trigger from eventbridge that will delete the alarm when a resource is no longer associated with the alarm.CommentShareCloud_Ganswered 5 months agoNicolasM 5 months agoYes when I am refering to alarm are CloudWatch Alarm, my point is which could be the best way to identify a CloudWatch alarm whihc is not in use becouse the resource where thre metrics come has been remove.Share0Makes sense. Leveraging Lambda would be your best option to accomplish that. Since lambda can be triggered by cloudtrail (which logs all API calls) or cloudwatch or eventbridge, you can have lambda remove those alarms. You could also create a function that routinely runs on a cron job that first calls all the cloudwatch alarms and lists them all, and using "if" statements, deletes alarms that do not have resources associated. Below is an example that you may want to try using as a base template:import boto3def lambda_handler(event, context):    # Create a CloudWatch client    cloudwatch = boto3.client("cloudwatch")    # List all CloudWatch alarms    alarms = cloudwatch.describe_alarms()    # Create an EC2 client    ec2 = boto3.client("ec2")    # Iterate over the alarms    for alarm in alarms["MetricAlarms"]:        # Check if the alarm is associated with an EC2 instance        if alarm["Namespace"] == "AWS/EC2" and alarm["Dimensions"]:            dimension = alarm["Dimensions"][0]            if dimension["Name"] == "InstanceId":                # Retrieve the EC2 instance                instance_id = dimension["Value"]                instances = ec2.describe_instances(InstanceIds=[instance_id])                if not instances["Reservations"]:                    # The instance does not exist, delete the alarm                    cloudwatch.delete_alarms(AlarmNames=[alarm["AlarmName"]])CommentShareCloud_Ganswered 5 months ago"


Question: Data Retrieval and Data Transfer OUT in Internet

"Hi,I have 32TB of data stored on S3 Standard bucket and would like to make a copy to my on-premise SQL Server (local machine) via SQL Server Integration Services (SSIS).(1) I am wondering does it count as Data Retrieval or Data Transfer OUT in Internet?(2) If I use aws s3 sync (aws CLI API) to download the data to my hard drive, does it count as Data Retrieval or Data Transfer OUT in Internet?(3) The rate ($0.09/GB) for Data Retrieval or Data Transfer OUT in Internet is the same for S3 Standard plan, I am wondering would it help to reduce the cost (based on my need) if I switch to S3 Standard-IA and perform data retrieval actions?Wish my questions can be answered. Thank you very much.FollowComment"

Answer: "1Accepted AnswerThe best option with the 32 TB of data is to directly copy from S3 standard to your on-prem server. This will be charged as Data transfer Out. The reason being the data is transferred from S3 to your network through internet and  retrievals charges are not applicable.Please note , S3 transfer out are based on tiered pricing with $.09/GB is for up to 10TB and is lower after that.If you switch to S3 Standard -IA- 0.01$/GB Retrieval fee applies to put the data from IA back into S3-Standard. AWS then applies ,The $0.09 data transfer fee from S3 to outside .In addition to that you will pay for the GET request as well ($.01 per 10,000 requests)CommentShareAneesh_Vanswered 17 days agorePost-User-5342340 17 days agoThank you very much for the feedback. Would it help to lower the data-transfer-out cost via Amazon Cloudfront?Share1All of the scenarios you mention will be counted as Data Transfer Out - the data is being transferred from S3 to your network across the internet. This is regardless of the storage class in S3 and the tools used to retrieve that data.You can reduce the cost by using Direct Connect - the data transfer charges are lower when you're using a private network to do the transfer. However, for one-time transfer purposes it's not really practical.CommentShareEXPERTBrettski-AWSanswered 17 days agoEXPERTTushar_Jreviewed 4 days agorePost-User-5342340 17 days agoThank you so much for your kind response!Share"


Question: ECS Fargate task running in private subnet can't pull container from private ECR repository

"UPDATE: Turns out the subnet ACLs didn't allow inbound traffic on the ephemeral ports. After adding a rule for that it started working. NAT gateway is enough, no need for the VPC endpoints.I've got a private ECR repository and a VPC with a private and a public subnet.The public subnet has an internet gateway and a NAT gateway in it. From the private subnet 0.0.0.0/0 is routed through the NAT gateway.I've got endpoints defined for:com.amazonaws.us-east-1.ecr.apicom.amazonaws.us-east-1.ecr.dkrcom.amazonaws.us-east-1.logscom.amazonaws.us-east-1.s3 (gateway)When I don't have the endpoints in the private subnet, this is what I get:ResourceInitializationError: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve ecr registry auth: service call has been retried 3 time(s): RequestError: send request failed caused by: Post "https://api.ecr.us-east-1.amazonaws.com/"The furthest I can get with pulling the image is when I have the endpoints inside the private subnet, but even then I receive this error:CannotPullContainerError: ref pull has been retried 5 time(s): failed to copy: httpReadSeeker: failed open: failed to do request: Get "https://prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.com/I tried all the variations for the endpoints, public subnet, private subnet, gateway endpoint in both or either.The NAT policy allows everything. The security group of the task allows All for 0.0.0.0/0 inbound and outbound.The ecsTaskExecutionRole has AmazonECSTaskExecutionRolePolicy and I also tried allowing S3 and ECR list and get actions for all resources. Didn't help.The only thing I can think of is that the ACL list of the private subnet restricts some inbound traffic that it should allow. It only allows a few ports from specific IP addresses. But then I don't know why moving the endpoints into the private subnet let's me get as far as attempting to pull the image.Outbound traffic is allowed in each subnet for all traffic, 0.0.0.0/0.It's a Linux image.I think it should work with either the NAT gateway (maybe not, because of the private ECR) or the VPC endpoints.Did someone face the same issue at one point? Am I missing something that I don't allow in the ACL?FollowComment"

Answer: "0You should definitely run a test without the NACLs in place to ensure that the network configuration is correct. Then you can try putting back the NACLs to see when things fail.As a general note (and to try and help with your troubleshooting): NACLs are stateless - so you do need to add the ephemeral ports if you want to use NACLs.But in this case, I would ask "why use NACL?" - because if most of your traffic is outbound (i.e. initiated from instances/containers in your VPC) from a private subnet then (a) NAT Gateway won't allow traffic to be initiated from the internet to your resources; and (b) security groups (which are stateful) are there to protect your resources.The advice I normally give customers is: use security groups as much as possible because they are stateful and easy to manage. Use NACLs where you must but only as a blunt object - for example, to stop two networks from communicating with each other completely. Trying to nail down ephemeral ports with NACLs is a lot of hard work for (probably) little benefit. Of course, every situation is different and NACLs are a useful tool; but useful when used for the right reasons.CommentShareEXPERTBrettski-AWSanswered 3 months ago"


Question: User profile cannot be loaded on WindowsServer2008 R2. [EC2]

Unable to log on to the WindowsServer2008 R2 on EC2.The screen show a message likes "The User Profile Service service failed the logon. User profile cannot be loaded."Then I try to restart from the console but still the same.How can I fix a problem ? I don't even know what caused this problem.FollowComment

Answer: "0Hi there!From the notes, I understand that you are not able log on to the WindowsServer2008 R2 on EC2. And the error you getting is “The User Profile Service service failed the log on.”The “User Profile Service service failed the log on” error could be caused by several reasons, which can be checked on the event viewer application logs by filtering source to User Profile Service, to check the root cause with EC2 rescue. In your case Windows cannot log on because your profile cannot be loaded. This happens because the default profile, stored in C:\Users\Default, is corrupt in some way.This is how to can solve the issue:Note: Please make a snapshot before performing below steps, you can check document link [1] for steps on how to create a snapshot.Attach the volume with issue to working instance with the same OS version as secondary drive.Replace X:\Users\Default from the corrupted volume with the C:\Users\Default from the working instance.I hope you find the above information helpful.Have a great day ahead!References:[1] https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ebs-creating-snapshot.html#ebs-create-snapshotCommentShareLettyanswered a year ago"


Question: Patching SQL Server 2019 on EC2 failing

"The SQL Server instance on an EC2 server was pre-installed by AWS, but when attempting to patch the installation, the process fails due to an attempt to download Python and R from third-party sites, which are inaccessible. There is no need for Python or R to be installed with SQL Server, but the option to exclude them was not available during the installation. Despite attempting to skip the upgrade, the installation process hangs during the Python and R download phase.FollowComment"

Answer: "0Since you don't need Python and R installed with SQL Server, you can try disabling their installation during the SQL Server upgrade process. To do this, use the command line parameter "/SkipInstallerRunCheck" when you run the SQL Server upgrade.To use the "/SkipInstallerRunCheck" parameter, follow these steps:Open the Command Prompt as an Administrator.Navigate to the directory where the SQL Server setup files are located.Run the SQL Server setup executable file and specify the "/SkipInstallerRunCheck" parameter. For example:setup.exe /SkipInstallerRunCheckFollow the instructions in the SQL Server setup wizard, and when prompted for features to install, deselect the options for Python and R services.Note that this parameter only disables the installer run check and does not actually remove any installed components. Therefore, if you have already installed Python and R services, you will need to uninstall them separately after the installation or upgrade is complete.Also, keep in mind that disabling the installation of Python and R services may affect any applications or scripts that rely on them. Therefore, make sure to assess the impact of disabling these features before doing so.CommentSharemishdaneanswered 2 months ago"


Question: Retrieve iso 8601 timestamp

"How to fetch timestamp values which are in the iso 8601 format from Athena to QuickSight.idshipdatestatusiso_8601Epoc12022-02-09 07:00:00OPEN2022-07-26T00:15:41+00:00165879454139422022-08-02 20:00:00CLOSED2022-07-31T21:46:23+00:00165930398310032022-08-02 21:00:00OPEN2022-07-31T21:46:23+00:011659303983100I am using the below query,but i am unable to fetch any rows matching with the iso_8601 timestamp.Query:select epoc,iso_8601,shipdate,from_unixtime(cast(substr(cast(1658794541394 as varchar), 1, 10) AS bigint))from newtable where  iso_8601 >= from_unixtime(cast(substr(cast(1658794541394 as varchar), 1, 10) AS bigint))The from_unixtime(cast(substr(cast(1658794541394 as varchar), 1, 10) AS bigint)) is returning the value as2022-07-26 00:15:41.000 but the column iso_8601 has value 2022-07-26T00:15:41+00:00. Hence my query is not meeting the condition.Could you please let me know how to resolve the issue.FollowComment"

Answer: "0iso_8601 is interpreted as string , you need to convert with parseDate function i.e. parseDate(replace(substring({date_in_ISO},1,19),'T'," "),'yyyy-MM-dd HH:mm:ss')For more help refer parseDateCommentShareAshish_Panswered 10 months ago"


Question: SES "manual approval is prohibitive to adoption

"This whole "manual approval" process is completely insane. Its one thing to request quota increases, but to prevent sending to any outside recipient without submitting some custom email to support, then waiting for ???? amount of time and praying they get back to you before you can even you use the most basic features of the service is ridiculous.Any other email provider would be out business instantly with this type of obtuse on-boarding process. Please do better AWS. This is beyond frustrating. Every piece of our infrastructure is deployed through one-click in CloudFormation... except this absurd process.FollowComment"


Question: How do I create a private offer for my product?

"Hi. I am a seller on AWS marketplace and I want to create a private offer to offer a discount to my client.But I can't figure out how to create my private offer. I have studied AWS documentation and videos on Youtube and that only made me more confused.If I follow this link : https://aws.amazon.com/marketplace/management/offers/, I can create a private offer, but the form looks nothing like the video (https://www.youtube.com/watch?v=PVL4069oqC0) and there is no way to establish any other duration but annual.I can't find any specific AWS article that covers how to CREATE a private offer, not just subscribe to it. What am I doing wrong?FollowComment"

Answer: "0The procedure described in this document says that a time period can be set.https://docs.aws.amazon.com/marketplace/latest/userguide/private-offers-overview.html#offer-submission-processAlso, the following documents seem to allow for custom durations depending on the product.https://docs.aws.amazon.com/marketplace/latest/userguide/private-offers-overview.html#supported-products-private-offersCommentShareEXPERTRiku_Kobayashianswered 8 days ago"


Question: Multiple MFA devices

"As a user of a hardware U2F security key, I always follow best practice and register a backup key in case the primary is damaged or lost.  In the old AWS support forums, your customers have been asking for this since 2013.  Nine years later and this still appears to be impossible.  When will this critical feature be added?FollowCommentrePost-User-3886256 8 months ago+1 Having the ability to setup multiple MFA devices is criticalShareuser-8ff0d0e36734 7 months ago+100 it is absolutely ridiculous that AWS does not support multiple MFA methods on both root and non-root user accounts. Users should be able to configure at least two security keys and TOTP devices.Share"

Answer: "4+1Having the ability to setup multiple MFA devices is criticalCommentShareRafael Paulinoanswered a year ago4+1Assigning at least 2 U2F keys should not only be supported, it should be required.CommentShareslankfordanswered a year ago3This has been a customer request as you say for quite some time.  If you have not yet submitted a support ticket requesting that you be added as a "+1" (which is AWS' way of indicating a request is supported and based on customer's demand helps prioritize work) to this feature request.As an interim solution, if your MFA token were to be damaged it is possible to work with AWS Support to gain access to the account to sync a new token.  This does require that you have certain information which would have been added to the account when it was setup.  Here is the AWS documentation regarding how to accommodate a lost or broken MFA device: https://aws.amazon.com/premiumsupport/knowledge-center/lost-broken-mfa/CommentShareAllison_Panswered a year agojmathes a year agoBy now, this is a request for internal reorganization. If AWS has been aware of this consistent feature request for 8 years, no manager or product owner has prioritized, and every other cloud provider has had it for years, there's a problem with AWS' internal incentive structure.Do we have to submit a support ticket to be added as a +1? Isn't that what an upvote is for?ShareAWS-User-6887479 a year agoThe fact that they offer U2F at all is largely a win. After recently getting my MULTIPLE keys, I've found most places don't allow them. Though, AWS is the first service that didn't allow my to register my backup keys.Please allow me to add a second key.Share3+1I would also really appreciate an explanation that convinces me the process to accommodate a lost or broken MFA device is not a recipe for a social engineering attack.thanks!BillCommentShareBilllanswered a year ago1It should now be possible to add multiple MFA devices, although I still can't do it with some of my accounts. It is now possible to add up to 8 MFA devices.From the blog post, to register an MFA device:Sign in to the AWS Management Console and do the following:For a root user, choose My Security Credentials.For an IAM user, choose Security credentials.For Multi-factor authentication (MFA), choose Assign MFA device.Select the type of MFA device that you want to use and then choose Next.I raised a support request and got the following response. I have unique passwords for all accounts so they must be creating the Amazon.com account. I've seen some accounts show Amazon.com when changing credentials, so its probably something to do with that. The user account I raised this on was created in 2019, but the organisation was created years ago."We are gradually rolling out the new multiple MFA feature to AWS accounts. At this time, the feature has not been activated for your account because we are unable to separate your AWS and Amazon.com accounts. AWS customers who created accounts before September 2017 use the same credentials to sign in to AWS and Amazon.com. While we can’t provide you with a specific timeframe when your account can be separated, we continuously evaluate eligibility for this separation process. We might automatically complete the separation for you in the future. At that time, you will be able to use the new multiple MFA feature."I received an email from Amazon containing the following, so they seem to be working toward resolving this:Greetings from Amazon Web Services,In the past, you have used the same email address and password to sign in to Amazon.com and AWS. In response to customer feedback, AWS is updating your account to make your access to Amazon.com and AWS independent. You can continue using this email address and your current password to sign in to Amazon.com. However, the next time that you sign in to AWS, you will be prompted to create a new password and will have the option to register a new multi-factor authentication (MFA) device. MFA is a best practice that adds an extra layer of protection on top of your email and password.AWS will never email you and ask you to disclose your password. You will see the prompts to create a new password and register a new MFA device only when you visit the AWS Console at https://console.aws.amazon.com which will direct you to our secure sign-in experience hosted on the signin.aws subdomain.This update to your AWS account also gives you the option to secure your AWS sign-in with additional MFA device types such as hardware security keys [1]. In addition, this update can help you monitor root user activity with AWS CloudTrail at no additional cost [2].[1] To learn more about the types of MFA supported on AWS, visit our AWS IAM MFA User Guide: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html[2] To learn more about about monitoring sign-in events to the Console, visit our AWS CloudTrail User Guide: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.htmlCommentShareFydonanswered 7 months agokdambiec 7 months agoThat only works for me for the first device, and then afterwards I don't see Assign MFA device to add a second device.Shareuser-8ff0d0e36734 7 months agoin typical AWS fashion, it doesn't appear to be rolled out to all accounts. i can add multiple hardware keys on none of the root accounts i am responsible for; only on one IAM user.ShareHMOF 6 months agoI also don't see this on either of my accounts yet.Share1My current workaround is to create several users, but this is a pain. Not to mention that they do not support Safari.CommentSharepgtaboadaanswered a year agouser-8ff0d0e36734 7 months agoThis isn't really a workaround. While you can certainly create multiple IAM users and grant them administrative permissions in the account, it is not a replacement for the root user.Share0You can now assign multiple MFA devices in IAM, https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/.CommentShareStephenHeverin_AWSanswered 6 months agoHMOF 6 months agoThis is not working for many of us, as this thread reports. I have full access to AWS from the console (admin access) and I am not able to add an additional MFA device to my account.ShareLinda 6 months agoI have AdministratorAccess permission. It also doesn't work for one of my aws account.ShareFydon 6 months agoOn Stackoverflow posting answer that contains content already covered by another answer is discouraged. How does it work here? I also linked to the same blog post but provide more detail in the answer I posted last week.Sharekzaky 6 months agoA small number of AWS accounts require additional configuration changes on our end before customers can take advantage of the new feature. We are currently working on making the required configuration changes and we will notify you when your account configuration is updated. For additional support, please submit a support request or reach out to your designated technical account manager.Share0Is there any official response from Amazon about this?I need this as well. I have multiple machines, simply can't share one key between them.CommentSharedusanpanicstanswered 7 months agokdambiec 7 months agoThey just announced the feature recently.Sharekzaky 6 months agoA small number of AWS accounts require additional configuration changes on our end before customers can take advantage of the new feature. We are currently working on making the required configuration changes and we will notify you when your account configuration is updated. For additional support, please submit a support request or reach out to your designated technical account manager.Share0You can now assign multiple MFA devices in IAM but not work on my account.I can't add another MFA device. All I can see is  Remove or Resync. Why?CommentShareLindaanswered 6 months agokzaky 6 months agoA small number of AWS accounts require additional configuration changes on our end before customers can take advantage of the new feature. We are currently working on making the required configuration changes and we will notify you when your account configuration is updated. For additional support, please submit a support request or reach out to your designated technical account manager.Share0My client is a very small business and its accounts have no access to support, is there an estimated ETA of when the rest of the 'old' accounts will have the ability to add a second MFA device?He would not like to pay a support plan for this reason alone.CommentSharejpablos11answered 4 months ago"


Question: Update CF custom header value

"Hi team,I have a lambda authorizer that validates the **value ** of a header: x-origin-verify (custom header added in Cloud Front distribution) which is in secret manager.in my Scenario, the value x-origin-verify on the secret manager is rotated each hour.how can I update the value of the custom header x-origin-verify in Cloud Front with the latest value rotated from the secret manager?in my CDK can I just reference the value in a secret manager? or that will work only one timeotherwise what is the best way to update the custom header (x-origin-verify) value in CF distribution as soon as this value is rotated on the secret manager.otherwise, how can I implement that using lambda at edge? an example for it would be very helpfulThank you :)FollowComment"

Answer: "0Hello,While you could potentially build some automation to update the value on the CloudFront distribution, this update would be eventually consistent as the change propagates to all CloudFront edge PoPs. I suspect this would cause some issues for you. Instead, as you alluded to, you can use Lambda@Edge to do a lookup on each viewer response and append the appropriate security header. Please check out this blog for some guidance on appending security headers using Lambda@Edge and Amazon CloudFront.CommentShareEXPERTScottanswered a year agoJess a year agoThank you, but with this solution, the lambda function needs to pull the secret from the secret manager every millisecond though. That would not be a bit lot?lambda 1 (lambda edge responsible for setting the secret in headers) needs to pull from secret manager. We cannot pull secret on every request or that would be too expensive and slow.lambda 2 (lambda for API GW authorizer) needs to pull secret to validate the header and at least the response can be cached, if we cache lambda 1, then we can get into synchronization issue.Share0Another blog was published demonstrating Lambda@Edge and SecretsManager along with secret rotation, How to enhance Amazon CloudFront origin security with AWS WAF and AWS Secrets Manager. The rotation process adds a new version of the secret while retaining the original version. The downstream systems, API GW authorizer in your case, check if the the header value matches the new **or ** previous versions of the secret to allow for some propagation delay.Regarding your performance and Secrets Manager request cost concerns, Lambda functions can be optimized to cache the secrets values after the first invocation in a new execution environment. The Operating Lambda: Performance optimization – Part 2 blog post has a great overview in the Optimizing static initialization section.CommentShareEdward_Sanswered a year ago"