Question: trigger lambda based on an event in a raw stream

I run a 3rd party application ton EC2 that produces a raw stream of its events. I want to trigger a certain action to take place (likely within a lambda) based on a certain event appearing in the stream. How do I do this? Is it a subscription of some sort (like RSS ?) or something else?FollowComment

Answer: "1It depends on how you emit the events? Are you using EventBridge? SQS? Kinesis Data Streams? Each one of them have the option to trigger a Lambda function and also include a filter on the events.CommentShareEXPERTUrianswered 7 months agorePost-User-8564696 7 months agoThe events come out of my 3rd party app, as a stream; It's a URL which resolves to a page of logs that automatically refreshes and updates when new events take placeShareUri EXPERT7 months agoLambda function can trigger based of the services I listed above, or by calling the Invoke API. If 3rd party app makes calls to an http endpoint with the events, you can enable Lambda function URLs and point the events there. You can also place the Lambda behind an API Gateway and point the app to that endpoint.Share0If your application is writing to syslogs, then there is an open source tool from AirBnB that has a plugin to send syslogs to kinesis - https://medium.com/airbnb-engineering/introducing-syslog-to-aws-kinesis-via-osquery-da4fc19de5ceOnce you are able to get the messages into a Kinesis Data Stream, then you can use the Kinesis Data Stream as an event source for Lambda, as Uri suggested above - https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.htmlYou can also look at Logstash. Logstash has an input plugin for Syslogs - https://www.elastic.co/guide/en/logstash/current/plugins-inputs-syslog.html and an output plugin for Kinesis - https://github.com/samcday/logstash-output-kinesisDisclaimer: I have not tested these open source tools myself so you need to try them out yourself and ensure they work for your use-case. Neither I nor AWS endorse any of these tools in any way.CommentShareEXPERTIndranil Banerjee AWSanswered 7 months ago"


Question: RecommenderArn is not in GetRecommendationsRequest.builder

"I am begginning in aws personalize basicsso I imported data sets and created recommenders in the consoleand now I want to get the recommendations in code using aws SDK for javathe problem is when I wanted to create a GetRecommendationsRequest to send to the getRecommendations in the builder a recommenderArn does not exist only a campaignArn but I am using domain data groups and in the docs it says there is supposed to be a  recommenderArnthis code is from DOCS:public static void getRecs(PersonalizeRuntimeClient personalizeRuntimeClient, String recommenderArn, String userId){      try {          GetRecommendationsRequest recommendationsRequest = GetRecommendationsRequest.builder()                  .recommenderArn(recommenderArn)                  .numResults(10)                  .userId(userId)                  .build();          GetRecommendationsResponse recommendationsResponse = personalizeRuntimeClient.getRecommendations(recommendationsRequest);          List<PredictedItem> items = recommendationsResponse.itemList();          for (PredictedItem item: items) {              System.out.println("Item Id is : "+item.itemId());          }      } catch (AwsServiceException e) {          System.err.println(e.awsErrorDetails().errorMessage());          System.exit(1);      }  }does anyone know what might be the issue ?FollowComment"

Answer: 1its ok its solved now was using older version that did not have the recommenderArnCommentShareIKEanswered 7 months ago


Question: Node production build in Elastic Beanstalk

"I uploaded React application in EBS using react-scripts in package.json, however, the app works fine except React Tools in Chrome always showing (This page is using the development build of React).How can I start my environment as production build?ThanksFollowComment"

Answer: "0Since the React configuration seems to be related, I hope the following site will be of help. [1] [2][1] Optimizing Performance - Reacthttps://en.reactjs.org/docs/optimizing-performance.html[2] reactjs - Prod build of React App allows React Dev Tools and show components in source tab inside Browser - Stack Overflowhttps://stackoverflow.com/questions/54949117/prod-build-of-react-app-allows-react-dev-tools-and-show-components-in-source-tabCommentSharemn87answered 8 months ago"


Question: Athena Snowflake Federated Query Fails

"Setup a serverlessrepo-AthenaSnowflakeConnector to enable query Federation; after the connector setup i am able to query the tables using data source name and table name but when i tried to use with "lambda:MyLambdaFunctionName" in my select statement got into the below error.GENERIC_USER_ERROR: Encountered an exception[com.amazonaws.services.secretsmanager.model.ResourceNotFoundException] from your LambdaFunction[xxxlambdfnxxxx] executed in context[retrieving meta-data] with message[Secrets Manager can't find the specified secret. (Service: AWSSecretsManager; Status Code: 400; Error Code: ResourceNotFoundException; Request ID: ABCD8e00-9999-XXXX-863Y-XX36Y588XNNN; Proxy: null)]This query ran against the "POCDB" database, unless qualified by the query. Please post the error message on our forumor contact customer supportwith Query Id:XXX7020Y-4Y41-4917-9520-NNN741X0NaNNAltered the IAM inline policy to provide access to all secrets as well{            "Effect": "Allow",            "Action": "secretsmanager:GetSecretValue",            "Resource": "*"        }what is causing the issue any guidance will be greatly appreciated.Thanks in Adavnce!FollowComment"

Answer: "0Hello,Looking at your error message Secrets Manager can't find the specified secret , it appears that the secret specified while creating your connector is either invalid or unavailable in your account.Please ensure that you are providing a valid secret name which is present in the account where you are creating the connector. The connector retrieves the username and password from the specified secret.You can find an example article here and hereCommentShareSUPPORT ENGINEERChiranjeevi_Nanswered a year agoYogaK a year agoHi Chiranjeevi_N, thanks a lot for taking time to respond; As I mentioned in my question I am able to run the query with the below wayselect * from <database Name>.<table Name>but only when i try to use it for cross data source querying(Federation) i am getting the error.  when the connector reads the secret manager using Athena Data Source and Database name; why it fails to read secrets manager while doing cross source querying.you can refer the below article.https://aws.amazon.com/blogs/big-data/query-snowflake-using-athena-federated-query-and-join-with-data-in-your-amazon-s3-data-lake/Share"


Question: Why AWS don't tell how to remove port 25?

"Hi all,I paid to have instance to build my company mail server using Plesk penal which it has reach security build-in.After installation and configure the port 25 is prohibit by AWS, I try to request to remove but it no hope, and they don't even tell me the way how can AWS remove it.So any idea how to host mail server in AWS without port 25?Thanks,FollowComment"

Answer: "0I couldn't afford to use AWS SES, I would pay 10K per year because my email account staff a lot.Yep, I have try but then AWS have replied:Hello,Thank you for submitting your request to have the email sending limit removed from your >account and/or for an rDNS update.After a thorough review, we confirmed our original finding and cannot grant your request.Please consider looking into the Simple Email Service (SES) https://aws.amazon.com/ses/.We cannot assist you further with this issue and we may not respond to additional messages on this subject.The last statement is NO WAY meaning?I don't know what to fix if they don't tell what I am wrong to follow their rule to remove port 25, could you please tell me what going on or how to fix my problem to have AWS remove it?CommentShareAWS-User-9094989answered a year agoBrettski-AWS EXPERTa year agoBy my rough calculations in order to spend $10k per year on SES you'd need to be sending around 2,000,000 messages and 5TB of data per month (naturally things are highly variable). At those levels you're going to be paying only just less than $10k per month just in outbound VPC data charges. So I don't know that SES is really that expensive. I've had to make up some numbers to get to my figured but in any case I still think SES is at least close to being viable.I'd strongly recommend you reach out to your local AWS Solutions Architect to discuss options.Share0You will need to create a support case to unblock port 25. See this page for more information.Or you might consider using SES.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: The redshfit auto-snapshot retention period has expired. The snapshot does not delete and exists. why? Can I know the cause?

"Hello, Currently, I set the redshift auto-snapshot retention period to 1 day. The redshift version is ra3.xplus.As far as I know, redshift auto-snapshots are automatically deleted when the retention period is exceeded in redshift.However, if you check the snapshot in the redshift console, the snapshot still exists even after the retention period has expired.Can someone please assist with this issue? Can I know the cause?FollowCommentCHELSEA IP 10 months agoCan you confirm with me if it's still there? Maybe it needs some time to refreshShare"

Answer: 0Your understanding is correct indeed. Automatic snapshots are managed and deleted by Redshift. Double check if your is a manual snapshot. If it is indeed automatic snapshot and Redshift has NOT deleted it after the defined retention period then kindly open up a Support Ticket for further investigation.CommentShareMilindOkeanswered 9 months ago


Question: Redshift COPY command CPU spikes

"A customer is running into the CPU spikes (it goes to almost 100%) on all compute nodes, while running COPY command to load data into Redshift cluster from S3. They are running a cluster of 2 ds2.xlarge nodes which gives total of 4 slices to work in parallel.After noticing the spike, they added a third node to the cluster, but still seeing the same behavior.The files being copied are csv, in the compressed GZIP format.Anyone seen this issue before? Any pointers will be much helpful, thanks!FollowComment"

Answer: "0Accepted AnswerWhile proper splitting of files is very important and highly recommended, it shouldn't cause a CPU spike across the cluster.What is usually the cause of a CPU spike like what you're describing is if you are loading into a table without any compression settings. The default setting for COPY is that COMPUPDATE is ON.  What happens is that Redshift will take the incoming rows, run them through every compression setting we have and return the the appropriate (smallest) compression.To fix the issue, it's best to make sure that compression is applied to the target table of the COPY statement. Run Analyze Compression command if necessary to figure out what the compression should be and manually apply it to the DDL. For temporary tables LZO can be an excellent choice to choose because it's faster to encode on these transient tables than say ZSTD. Just to be sure also set COMPUPDATE OFF in the COPY statement.CommentShareEXPERTTony-AWSanswered 6 years ago"


Question: How do Thing names work in IoT?

"I'm a little confused about what a Thing's "name" really means in IoT services.I created a Thing with a name ("thing1") and created a certificate for it at the same time. That certificate is only assigned to thing1.I set up a client using the certificate, and it was able to connect to the IoT service and send shadow updates as "thing1". Then I tried having that device send shadow updates as "thing2" or "thing3". To my surprise, this worked, even though there is no "thing2" or "thing3" defined on my account.I had planned to give each of my devices its own certificate and assumed that by having separate certificates, the devices would not be able to spoof another device. But this doesn't seem to be the case.What's the recommended way to achieve the security I want?FollowCommentFrank a year agoAs an FYI, I also had the device try sending using a name that IS assigned to another device -- and that worked too.Share"

Answer: "1Accepted AnswerHi Frank. If the device has a certificate that is registered with IoT Core, it may be able to connect, even without a corresponding Thing registered. This is because it can authenticate, but it doesn't necessarily mean it will be authorized to do anything. That depends on your use of AWS IoT policies.In general, each device should have its own certificate and own private key. If the device has been securely provisioned, and the private key is securely held on the device, then only that device will be able to authenticate using that certificate. Best practices:https://docs.aws.amazon.com/wellarchitected/latest/iot-lens/identity-and-access-management-iam.htmlEnsure that each device has its own unique X.509 certificate in AWS IoT and that devices should never share certificates (one certificate for one device rule). In addition to using a single certificate per device, when using AWS IoT, each device must have its own unique thing in the IoT registry, and the thing name is used as the basis for the MQTT ClientID for MQTT connect.You can attach an AWS IoT Policy to each certificate. You can use AWS IoT policy variables to then limit which devices can connect using that certificate. An example taken from https://docs.aws.amazon.com/iot/latest/developerguide/connect-and-pub.htmlFor a connection to be successful, the thing name must be registered in the AWS IoT Core registry and be authenticated using an identity or principal attached to the thing{    "Version": "2012-10-17",    "Statement": [      {        "Effect": "Allow",        "Action":["iot:Publish"],        "Resource": ["arn:aws:iot:us-east-1:123456789012:topic/${iot:Connection.Thing.ThingName}"]      },      {        "Effect": "Allow",        "Action": ["iot:Connect"],        "Resource": ["arn:aws:iot:us-east-1:123456789012:client/${iot:Connection.Thing.ThingName}"]      }    ]}More information:https://docs.aws.amazon.com/iot/latest/developerguide/iot-authorization.htmlhttps://docs.aws.amazon.com/iot/latest/developerguide/iot-policy-variables.htmlhttps://docs.aws.amazon.com/iot/latest/developerguide/example-iot-policies.htmlhttps://aws.amazon.com/blogs/iot/understanding-the-aws-iot-security-model/Additionally you may be interested in using AWS IoT Device Defender. It can audit your fleet helping you to detect any compromised devices.CommentShareEXPERTGreg_Banswered a year agoFrank a year agoThank you for all the details, I'll review these documents today.Share"


Question: [Announcement] The AWS Lambda console now supports the option to share test events between developers

"Developers can now share test events with other developers in their AWS account. Test events provide developers the ability to define a sample event in the Lambda console, and then invoke a Lambda function using that event to test their code. Previously, test event were only available to the developers who created them. With this launch, developers can make test events available to other team members in their AWS account using granular IAM permissions. This capability makes it easier for developers to collaborate and streamline testing workflows. It also allows developers to use a consistent set of test events across their entire team.Access the AWS Lambda console to get started. To learn more about sharing test events, review our documentation (https://docs.aws.amazon.com/lambda/latest/dg/testing-functions.html).The capability to share AWS Lambda Test Events is based on Amazon EventBridge Schemas. This capability is available in the regions where AWS Lambda and Amazon EventBridge are available. For more information on availability, please see the AWS Region table (https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/).FollowCommentSrikanth_N SUPPORT ENGINEERa year agoThis is an announcement migrated from AWS Forums that does not require an answer.Share"


Question: How come Amplify Studio is disabled on default?

"Is there a safety reason as to why Amplify Studio is turned off by default?Assuming it's because of Amplify CLI, but just got curious.FollowComment"

Answer: "0Thank you for reaching out to us regarding the above query.Please note that there are no security concerns for Studio being disabled by default when you initialize your app via Amplify CLI.You can create backend for your Amplify application in two ways - 1. Using "amplify init" in Amplify CLI. or 2. Building app backend directly from Amplify console.When you create your app backend from CLI, it is assumed that you'll be using Amplify CLI itself to add/manage the cloud resource categories. Hence Amplify Studio is not enabled by default in Amplify console. However, if you wish to use Studio, you can go the Amplify Studio settings in console and toggle the Enable Amplify Studio button to enable it.But when you create your app backend from Amplify console directly, the Amplify Studio is enabled by default to let you control your backend environment without using Amplify CLI.So, there are no underlying safety reasons for Amplify Studio being turned off by default.Having said that, in case you have further queries, please feel free to reach out to us by opening a support case with AWS from support center dashboard using the following link.Best regards, Rohit K.CommentShareSUPPORT ENGINEERRohit_Kanswered 4 months ago"


Question: Observing Pod to Pod network flows in EKS Cluster

"I need to find network flows between pods, both pods from different nodes and pods from same node as well. I tried VPC Flow logs, but it only provides pod IPs and no identifier of the pod (e.g. pod id, labels).  Another limitation VPC Flow logs doesn't provide flows within the same node. Also, I tried Container Insight as well, but it does not give flow information. Is there any way we can find network flows with src and destination pod information? Is there a way I can use Amazon VPC CNI for getting this information? I do not wish to use Cilium or Calico or any eBPF-based agent.FollowComment"

Answer: "0Hi!To start with, check out this article for a great solution to address your challenge with a little extension.  Very simply, the EKS cluster is deployed with worker nodes (EC2) and these have one or more ENIs attached to accommodate the pods deployed with the VPC CNI.You will always need to map the IP with the pod name in the VPC which you can see using this command:kubectl get pods --all-namespaces -o wideThe main issue is that these can change if the pod migrates, gets restarted etc.  You could use the solution above and extend it further with Athena to merge the flowlogs data with a "pod name to IP mapping" document to create the picture you are looking for.    See the INSERT INTO function for some ideas.CommentShareMstein-AWSanswered 2 months agorePost-User-0145687 2 months agoHi @Mstein, Thanks for the reply. But this link, I am not able to open this article in "check out this article for a great solution". While I can open the INSERT INTO link.Share0AWS Detective allows you to examine VPC flow log information for your EKS workloads, display visual summaries about these network flows, and aggregate information by EKS pods.https://aws.amazon.com/about-aws/whats-new/2023/01/amazon-detective-vpc-flow-logs-visualizations-eks-workloads/CommentShareAWS-User-7455027answered 2 months agorePost-User-0145687 2 months agoThis still does not capture flows between pods within the same node. @Mstein-AWS and @AWS-User-7455027Share"


Question: fail a glue job if the called stored procedure fails

"Hi all,I'm using a glue job that reads CSV files from S3 and injects data to MySQL RDS.at the end of my pyspark glue script, I call a stored procedure. the issue is the glue job status end by succeeding but the stored procedure execution fails.is there any way to fail the glue job if the execution of the called stored procedure fails?when glue script calls myStoredProcedure() it's an async call?appreciate any helpimport pymysqlwith conn.cursor() as cur:   insertQry="CALL myStoredProcedure()"   cur.execute(insertQry)   conn.commit()   cur.close()   conn.close()   job.commit()************* OR **********************from py4j.java_gateway import java_importjava_import(sc._gateway.jvm,"java.sql.Connection")java_import(sc._gateway.jvm,"java.sql.DatabaseMetaData")java_import(sc._gateway.jvm,"java.sql.DriverManager")java_import(sc._gateway.jvm,"java.sql.SQLException")source_jdbc_conf = glueContext.extract_jdbc_conf(glue_connection_name)conn = sc._gateway.jvm.DriverManager.getConnection(source_jdbc_conf.get('url') + '/' + database_name, source_jdbc_conf.get('user'), source_jdbc_conf.get('password')) stmt = conn.createStatement(); rs = stmt.executeQuery('call ' + stored_proc); conn.close()FollowComment"

Answer: "1Hello,Stored procedure is a part of Python procedure and the stored procedure is not executed on glue resources. So, I do not believe it waits for confirmation whether it is successful or notBut, you can try to enclose the code for stored procedure within try/except block to capture the exception if the job fails. Glue job will capture the exception. Otherwise, there is no way Glue will know what is going on since stored procedure is a part of Python procedure. You can also try to set up sys.exit(1) to make sure it will throw something as well. Please refer bellow link for more detailsREFERENCES:https://stackoverflow.com/questions/6720119/setting-exit-code-in-python-when-an-exception-is-raisedCommentShareSUPPORT ENGINEERVishali_Nanswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: Sagemaker XGBoost Forecast Horizon Perameter

Which XGBoost hypertuning perameter is used to set the forecast horizon?I do not see a parameter listed here: https://docs.aws.amazon.com/sagemaker/latest/dg/xgboost_hyperparameters.htmlFollowComment

Answer: "0That's because you can XGBoost only for regression, classification (binary and multiclass), and ranking problems, but not for forecasts. See more info here: https://docs.aws.amazon.com/sagemaker/latest/dg/xgboost.htmlFor forecasting you could use, for example, DeepAR: https://docs.aws.amazon.com/sagemaker/latest/dg/deepar.htmlCommentShareHeikoanswered a year ago"


Question: AWS DX : missing Connection details.

"Hi,IHAC who created a DX few months ago but the person in charge left. When checking the setup now.at the provider side (Megaport) everything seems ok. Connection is active, VIF details can be seen, etc.at the AWS console, we can see a VIF but showing status as down.at the AWS console, under DX, there no connection.I am surprised that the console does not list any connection if there is still a VIF. The customer cannot create a new VIF because there is no active connection.What could be the problem here ?Thanks.FollowComment"

Answer: "0How many accounts the customer has?It might be that the DX connection is created in another account (account B), and a VIF is created with an owner of a different account (Account A).In this case in Account A, you will be able to see a VIF, but you will not be able to see the DX connection.If you click on the VIF ID in the Virtual interfaces page, were you able to see a Connection ID in the "General configurations" section?CommentShareJason_Sanswered a year ago"


Question: Can't run angular tests within an Amplify Console Pipeline on amazonlinux:1

I cannot install google chrome headless (last version) on the amazonlinux:1. some suggestions on which modules I have to install in amplify.yml to succesfully run "ng test”? will the Amplify Console building machine AMI be updated to “linux 2” soon?FollowComment

Answer: "0Accepted AnswerWe just upgraded our build image to amazonlinux:2 and also have cypress installed in the build image. Can you try running your tests?CommentSharenikhil1986answered 4 years ago0thank you very much, the update to amazonlinux:2 solves my issue. I can now run angular tests installing chrome in pre-build step (curl https://intoli.com/install-google-chrome.sh | bash) with no issue.Edited by: fabiovitali on Jul 8, 2019 6:07 AMCommentSharefabiovitalianswered 4 years ago"


Question: Cannot switch to enabled region in console

Hello I have enabled the Hong Kong region and used it for years.And now I found that I cannot select it from the drop down menu.FollowComment

Answer: "0Just be patient: it may need a few hours to propagate.Loot at https://docs.aws.amazon.com/general/latest/gr/rande-manage.html"This process takes a few minutes for most accounts, but this can take several hours. You cannot use the Region until this process is complete."CommentShareDidier_AWSanswered 16 days ago0As stated in my question, I had already used the region for years and created many resources in it.So do it means that I need to wait for hours for every login? If no, what will trigger the region list reset?CommentShareGinanswered 16 days ago"


Question: Get EC2 DescribeInstances API response in JSON

"Hi,I am trying to get the API response of EC2 DescribeInstances API in JSON format. specifying Accept=application/json header works for other APIs but not in DescribeInstances API. Is there any workaround to get the response in JSON?Edit:I am not using SDK/CLI. I am making the API request separately using JAVA by deriving v4 sign key.FollowCommentManu a month agoHow are you calling this API is it through cli or SDK?Share"

Answer: "0How do you make a request?If it is an SDK, it should be converted to json on the code side.CommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-0825577 a month agoI make the request as a separate API request via Java. I am not using SDK here.SharerePost-User-0825577 a month agoAny update?Share"


Question: How can I play a custom audio message (greeting) to an inbound customer every time agent answers a call AND the message played is specific to the agent?

"An agent will record their own custom greeting, "Thank you for calling [...] How can I help you?". We want the ability to play that audio immediately as soon as the inbound call is connected to the agent. We currently have a custom CCP UI and are using amazon-connect-streams to initialize and handle agents and contacts.FollowComment"

Answer: "0Hello,With a flow that has “Set working queue” and then “Transfer to queue”, I dont think it will work - cause no block can be played after the “Transfer to queue” block.However, if you set the Agent queue instead of a standard queue, then perhaps you could use a flow that has“Set working queue” -> “Play prompt” -> “Transfer to queue”CommentSharerePost-User-8131306answered 2 months ago0Hello,Can you please try the following Doc might be useful for your Scenariohttps://docs.aws.amazon.com/connect/latest/adminguide/dynamically-select-prompts.htmlBest Regards,Ramy HusseinCommentShareRamyHanswered 2 months ago0You could accomplish this as part of a customer whisper flow using prompts from an S3 bucket.Custom implementation would be required to resolve an agent ARN to the specific prompt you are looking to play (Lambda and DynamoDB could be an example), but prompts from an S3 bucket are the recommended pattern for dynamic recorded audio greetings.CommentShareEXPERTAWS-samfredanswered 2 months ago"


Question: TXT Records not resolved

"Hey there,my new TXT records are nor resolving. After I create a new record it is working for about 1-2 days after 24 hours. And than again the same. According to dnschecker.org the TXT record is not resolving any more and my Emails are not going through.Any Idea what can i do next?Cheers!FollowComment"

Answer: "0Unfortunately I'm stuck with this problem. I really don't know how i can solve this problem by myself.Any Suggestions?https://dnschecker.org/?#TXT/maxassist.deCommentSharePyrospyanswered 4 years ago0Hi,Thanks for including the domain name. That allowed me to review your hosted zones and domain registration.You have two hosted zones named maxassist.de, owned by two accounts. The two hosted zones have different sets of four name servers. The domain registration is currently using the name servers from the hosted zone that does not include the TXT record.There are a couple of ways to resolve this problem. I'll assume that you don't have access to the account that created the hosted zone that the domain registration is currently using. Here's how you make the TXT record resolve:Get the name servers for the hosted zone that contains the TXT record. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the domain registration for maxassist.de to use the name servers that you got in step 1. See "Adding or Changing Name Servers and Glue Records for a Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlIf you do have access to the account that created the other hosted zone, I recommend that you delete the hosted zone that does not contain the TXT record. See "Deleting a Public Hosted Zone":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/DeleteHostedZone.htmlNormally, I'd recommend that you wait a couple of days before deleting the hosted zone that is currently in use because DNS resolvers might have the names of your name servers cached. However, in this case, the A record for maxassist.de is identical in both hosted zones, and the extra records (the TXT record and an A record for www.maxassist.de) are in the hosted zone that you'll be switching to.ScottCommentShareEXPERTAWS-User-6179575answered 4 years ago0Thanks a lot Scott,Even if I have no idea about how it is possible that the domain is registered in 2 hosted zones by 2 different account, i´m happy to get it work by changing the NS Records like you suggested me. Hoping now it will say like this now.Anyway, thanks a lot for your help.MaxCommentSharePyrospyanswered 4 years ago"


Question: Can we use  both “SLES” for Non production and “SLES for SAP” for Prod landscape?

Can we use  both “SLES” for Non production and “SLES for SAP” for Prod landscape?“NOTE: This is a common question asked by AWS customers. The AWS team is posting it to provide an answer that can benefit everyone.”FollowComment

Answer: "0Accepted AnswerThe Nitro system enables EC2 High Memory instances to operate as fully integrated EC2 instances, while presenting them as bare-metal servers. All the CPU and memory on the host are directly available for your SAP workloads without a hypervisor, allowing for maximum performance. With virtualization overheads removed, near-bare metal performance is achieved. Due to this, about ~5-15% more HANA working memory is available, improving overall performance of the SAP System.“NOTE: This answer is provided by the SAP on AWS speciality team and is accurate at the time of publish. Please check comments as the answer may have changed/services evolved.“CommentSharedemouzonanswered a year ago"


Question: EFS does not Automaticall mount on Reboot

EFS mount point is created in Instance via Bootstrap.when the same instance is Rebooted EFS does not Automatically MountsHELP?FollowComment

Answer: "0Hi.AWS EFS does not automatically mounts in a EC2 Intance. But there are diferent ways to automatically mount the EFS.Here in the link number [1], you can select between different options. And also It will depend on the services that you are using.Probably if your are using Auto Scaling group, you can mount it using the user data in the auto scaling group.If you are using a single EC2 instance, you can use either the fstab configuration in the [1] link or you can mount it using a crontab in a linux environment.And also you can configure an automount in the EC2 Launch Instance Wizard.All this information it's in the same link.Hope this can help you.Best regards![1] Auto mount  on reboot.https://docs.aws.amazon.com/efs/latest/ug/mount-fs-auto-mount-onreboot.htmlCommentShareHernandez Edgaranswered a year ago"


Question: How to make Lex replay the user AlphaNumberic Input.

"I am busy building an IVR system. The user interating with the bot is asked for a reference number which is of type AMAZON.AlphaNumeric. When it is time to confirm the input, I wan to replay the reference number back to the user to confirm their input. What I want the bot to do is say out the reference number character by character NOT as a word. What Amazon Lex is doing is try to spell out a reference number like "AZkq239U". That's not what I want I want the bot to spell the reference number character by character e.g "A", then "Z", then "k" etc. How do I do this?FollowComment"

Answer: 1<say-as> or interpret-as should help you with that https://docs.aws.amazon.com/polly/latest/dg/supportedtags.htmldavidCommentSharedmaciasanswered 4 months agoEXPERTAWS-samfredreviewed 2 months agorePost-User-7338662 4 months agoThat worked. Thanks DavidShare


Question: Condition to limit S3 access from AWS network only

"I need to provide an assess to my S3 to partners companies which has their own AWS accountsI'd like to limit access to my S3 bucket by AWS network only.The reason is to prevent anyone from downloading resources directly to on premises servers. Because according to my understanding, when partner will be downloading data from my S3 to EC2 (for example) in their AWS account in the same region this data transfer would not be charged. The region could be limited by s3:LocationConstraint condition.So my question is which policy condition should be used to limit by AWS network?FollowCommentSmotrov a year agoHmm... It seams like I can't use s3:LocationConstraint for GetObject.It is written in documentation:"Not all conditions make sense for all actions. For example, it makes sense to include an s3:LocationConstraint condition on a policy that grants the s3:CreateBucket Amazon S3 permission. However, it does not make sense to include this condition on a policy that grants the s3:GetObject permission."Is there any other way to limit readings from specific region?Share"

Answer: "1You can try the aws:SourceVpc condition of IAM Policy document.Check the details from the documentation! :)CommentShareEXPERTposquit0answered a year agoSmotrov a year agoGood idea! Thank you however it requires that the in-VPC service on the other side. Non-VPC Lambda for example, will not be able to access the data.In the meanwhile, pretty good workaround!Thank you.Share0HelloYes you can do that, Please follow the AWS Support Blog https://aws.amazon.com/premiumsupport/knowledge-center/block-s3-traffic-vpc-ip/Thank YouGKCommentShareGKanswered a year agoSmotrov a year agoThank you for your comment.Unfortunately either of suggested restrictions doesn't solves the issue.VPC endpoint service with our partners will cause per GB charge.Not all partners are ready to setup a NAT with static IP. Again because of per GB price.In our case we are talking about hundreds of terabytes per month so we are really sensitive in this questions.As it is written here https://aws.amazon.com/s3/pricing/You pay for all bandwidth into and out of Amazon S3, except for the following:...Data transferred from an Amazon S3 bucket to any AWS service(s) within the same AWS Region as the S3 bucket (including to a different account in the same AWS Region)....So my question is how to put exactly this statement into policy condition.Share0You could write a bucket policy that uses the SourceIP condition and limits it to EC2 CIDR address for your region.curl https://ip-ranges.amazonaws.com/ip-ranges.json > ip-ranges.jsonjq -r '.prefixes[] | select(.region=="us-east-1") | select(.service=="EC2") | .ip_prefix' < ip-ranges.jsonCommentShareEXPERTkentradanswered a year ago"


Question: What is the right VPC setup for loading data from S3 to Aurora

"I have an Aurora DB setup with MYSQL8.0 in Oregon (This is Aurora serverless v2 and there is no Data API in this version). This has VPC, subnets, VPC security group and public access turned on. The main route table of the VPC has a route with com.amazonaws.us-west-2.s3 as destination and an endpoint of the vpc as target. When I try loading data into aurora from S3 (the bucket is in N.California) using the LOAD DATA FROM S3 's3-us-west-1:.... statement, I keep getting ERROR 1815 (HY000): Internal error: Unable to initialize S3Stream. I have also rebooted the DB's writer instance after all the IAM and VPC changes. What am I missing?FollowCommentAWS-User-0357409 3 months agoHi,Can you confirm what your IAM policy allows for this access?  I would check both the S3 bucket policy and the role associated with your Aurora setup.SharerePost-User-1458258 3 months agoThanks for your comment. The role associated with Aurora seems to have the right access. What would be the right S3 bucket policy?SharerePost-User-1458258 3 months ago{"Version": "2012-10-17","Id": "s3accesspolicy","Statement": [{"Sid": "VPC endpoint access to S3","Principal": "","Action": "s3:GetObject","Effect": "Allow","Resource": ["arn:aws:s3:::bucket","arn:aws:s3:::bucket/"],"Condition": {"StringEquals": {"aws:sourceVpce": "vpce-ID"}}}]}I am using a policy similar to this for the buckets, but still get the S3Stream error for buckets both within and outside the DB's regionShare"

Answer: "1You are loading data from another region, so the VPC gateway endpoint will not be used, the route table has a prefix list of IPs for S3 in Oregon. Your VPC needs to have an Internet Gateway and the route table associated with the Aurora subnets needs a '0.0.0.0/0' route to the IGW. See: Gateway endpoints.Traffic that's destined for the service (Amazon S3 or DynamoDB) in a different Region goes to the internet gateway because prefix lists are specific to a Region.CommentShareEXPERTkentradanswered 3 months ago"


Question: "when you will add new size to lightsail more than 32gb,8cpu"

"hi right now the max size in lightsail is 32gb, 8cpu i know that i can go to ec2 for higher but is there ETA to add higher size to lightsail?FollowComment"

Answer: 0Thank you for your post. Your feature request for bigger instance size has been noted by the team.CommentShareAWS-SUManswered 3 months ago


Question: IoT broker: Publish mqtt messages with messageExpiry doesn't seem to work

"I'm using boto3 to publish messages to some mqtt topic. I've tried both approaches retain=True and retain=False messages with a generally low value for messageExpiry (initially 10 seconds and then 1, 60, 120, and other values in case that was the issue) but it doesn't seem to work.With retain=True I'd expect the message to expire and delete itself after messageExpiryseconds, but it doesn't (a client connecting after the publish does receive the message, of course). With retain=False I would expect a client that connects a few seconds after the publish operation (but before messageExpiry seconds) to receive the published message, but it doesn't.So not sure if I'm missing some configuration, messageExpiry doesn't work as I would expect (though according to the table from https://docs.aws.amazon.com/iot/latest/developerguide/mqtt.html#mqtt5 it should work) or I'm doing something wrong.FollowComment"

Answer: "0Hi jesusgs. I concur with your findings. In using either boto3 or the AWS CLI, I find that the messageExpiry parameter isn't working. Conversely, if I publish using the MQTT test client in AWS IoT Core, it does work.I'm of the (perhaps mistaken) belief it's an issue on our side with the IoT data plane HTTP Publish operation. I've raised it internally and will post back here when I know more.CommentShareEXPERTGreg_Banswered 2 months ago"


Question: AWS Connect - Contact Details

"Hi,Is there available API for getting the customer endpoint by specific contact. I need to get the $.CustomerEndpoint.Address of the customer or more details of the caller info (phone number, name, location etc if available) without modifying the contact flow?Refhttps://docs.aws.amazon.com/connect/latest/APIReference/Welcome.htmlhttps://docs.aws.amazon.com/connect/latest/adminguide/connect-attrib-list.htmlFollowComment"

Answer: "0No API as far as I know. But, If your have access to the CTR (you can enable data streaming to get a copy of the Contact Trace Record upon closing contact )  you'll have all the information about the contact. If he contact is closed, you should try to add an update to regenerate the CTR.You will find customer endpoint at ContactTraceRecord.CustomerEndpoint.AddressCommentShareKikeanswered 4 months agoEXPERTAWS-samfredreviewed 2 months ago"


Question: AWS Lambda scaling: multiple Lambda functions?

"I am developing NET Core 6 AWS Lambda <-> RDS PostgreSQL. Is this good idea: to create multiple AWS Lambda functions which will perform their functionality: get data, post/put data. send emails to customers  about successful operations, create reports? I.e. instead one large NET 6 Lambda have multiple Lambda functionsWhere can I read about this kind of approach?FollowComment"

Answer: "1Accepted AnswerHi,answer is depends on your context, thought AWS best practice is to use specialized Lambda functions compared with all-purpose functionshttps://docs.aws.amazon.com/lambda/latest/operatorguide/specialized-all-purpose.htmlHope it helps ;)CommentShareEXPERTalatechanswered a month agoEXPERTBrettski-AWSreviewed a month ago1Using one large lambda? That must be avoided. SQS SNS https://docs.aws.amazon.com/AmazonS3/latest/userguide/how-to-enable-disable-notification-intro.htmlhttps://aws.amazon.com/blogs/compute/building-well-architected-serverless-applications-introduction/Hope this helps you..CommentShareCloudoceananswered a month agoOleg a month agoIt is exactly about what have i asked. Also, how one Lambda can communicate with other? Where it can get the address?Sharealatech EXPERTa month agoYou should use sdk to invoke one lambda from the other one https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-lambda/classes/invokecommand.html, or maybe use step functions for sequence/parallel execution.Share"


Question: grant access to one role in another account to all objects in an S3 bucket?

"Is it possible to grant (read) access to one role in another account to all objects within one bucket while still having "Block all public access" on?I "fear" that specifying "All" objects in my policy might make my policy "public" in which case it is ignored as long as "Block all public access" is on.Is it correct?If so, how should I setup my S3 bucket security to only grant access to that outside role?FollowComment"

Answer: "1Hi there,The short answer to this question is yes, it is possible to grant a cross account role access to your bucket while having S3 Block Public Access setting activated. Digressing a bit, S3 Block Public Access settings[1] are used to provide control across an entire AWS Account or at the individual S3 bucket level to ensure that objects never have public access. Public access is granted to buckets and objects through access control lists (ACLs), bucket policies, or both.Now a bucket policy is considered to be granting public access if it contains the Principal value as follows without any restricting conditions:"Principal": "*"'*' here is used as a wildcard, to be interpreted as providing anonymous access or access to all.If such a bucket policy is enabled on a bucket and if the S3 Block Public Access settings are 'on', then S3 Block Public Access settings override the S3 permissions that allow public access. (Specifying all object resources in the bucket policy by itself does not render a bucket public.) Therefore, you can provide access to a cross account role using a bucket policy similar to:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "cross_account_role_ARN","Action": "s3:GetObject","Resource": "arn:aws:s3:::your_bucket_name/*"}]}This policy provides read access to all objects in your S3 bucket only to the cross account role. In case you're looking to provide console access, you can also add "s3:ListBucket" permission[2] (with the bucket as the resource) to list all objects in the bucket.Hope this helps!References:[1] S3 Block Public Access - https://aws.amazon.com/s3/features/block-public-access/[2] Actions defined by Amazon S3 - https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-actions-as-permissions[-] Bucket policy examples - https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.htmlCommentShareSUPPORT ENGINEERDeepika_Kanswered 2 years ago1I tried to be VERY agressive with my permissions but still unable to read anything in the bucket...{"Version": "2012-10-17","Id": "Policy1631205389485","Statement": [{"Sid": "Stmt1631205373926","Effect": "Allow","Principal": "","Action": "s3:","Resource": "arn:aws:s3:::my-bucket-here/*"}]}I did not even setup the Block All Policy AccessAnd yet, if I try to browseaws s3 --profile saml ls s3://my-bucket-hereI get this error message...An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access DeniedIt looks like I have opened all doors!!!Edited by: EricGfK on Sep 9, 2021 5:52 PMCommentShareEricGfKanswered 2 years ago1Apparently, I had to mention both bucket and bucket content in the policy...        "Resource": \[              "arn:aws:s3:::my-bucket-name",              "arn:aws:s3:::my-bucket-name/*"          ]CommentShareEricGfKanswered 2 years ago"


Question: CloudFormation keeps throwing InvalidBucketAclWithBlockPublicAccessError for my S3 bucket template's deployment

"GoalCreate an S3 bucket that my service is going to write images to and anyone is going to be able to read the image from because I am going to show the image on my service's web page.ProblemSo I have a pretty generic (I think) template for an S3 bucket that should allow anyone to read objects inside it: SomeS3Bucket:    Type: "AWS::S3::Bucket"    Properties:      BucketName: "some-bucket-name"      AccessControl: PublicRead      OwnershipControls:        Rules:          - ObjectOwnership: BucketOwnerPreferred # without it it complains about ownership being set to BucketOwnerEnforced      BucketEncryption:        ServerSideEncryptionConfiguration:          - ServerSideEncryptionByDefault:              SSEAlgorithm: "AES256"            BucketKeyEnabled: false      CorsConfiguration:        CorsRules:          - AllowedHeaders:              - "*"            AllowedMethods:              - "PUT"              - "POST"              - "DELETE"              - "GET"            AllowedOrigins:              - "*"An attempt to deploy this template always results in an error like this: Bucket cannot have public ACLs set with BlockPublicAccess enabled (Service: Amazon S3; Status Code: 400; Error Code: InvalidBucketAclWithBlockPublicAccessError)Tried adding:PublicAccessBlockConfiguration:        BlockPublicAcls: false        BlockPublicPolicy: false        IgnorePublicAcls: false        RestrictPublicBuckets: falseBut that didn't help either.Also tried setting ObjectOwnership to ObjectWriter, checked the BlockPublicAccess configuration on my AWS account level. Nothing points me to the root cause of the issue.Would really appreciate any help on this.Tried creating a stack from the AWS Console and with aws-cli/2.6.4 Python/3.9.11 Linux/5.10.16.3-microsoft-standard-WSL2 exe/x86_64.ubuntu.20 prompt/off.FollowComment"

Answer: "1Amazon has recently begun rolling out a change to how new buckets are created, see https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.htmlFor new buckets created after this update, all S3 Block Public Access settings will be enabled, and S3 access control lists (ACLs) will be disabled. These defaults are the recommended best practices for securing data in Amazon S3. You can adjust these settings after creating your bucket.You need to add the PublicAccessBlockConfiguration, as well as set ObjectOwnership to ObjectWriter - that you've got under control - and at the same time ensure that you do not have the AccessControl set initially. AccessControl can only be modified after the bucket has been created.CommentSharetherightstuffanswered a month agoAarbel a month agoHad the problem with AWS CDK using accessControl: s3.BucketAccessControl.PUBLIC_READ while creating / updating buckets.Removing it and adding objectOwnership: s3.ObjectOwnership.OBJECT_WRITER solved the problemShare1I tried to create the same in my environment from the management console and was able to deploy it without any problems.The template is as follows.AWSTemplateFormatVersion: '2010-09-09'Description: S3 TemplateResources:  SomeS3Bucket:      Type: "AWS::S3::Bucket"      Properties:        BucketName: !Sub "some-bucket-name-${AWS::AccountId}"        AccessControl: PublicRead        OwnershipControls:          Rules:            - ObjectOwnership: BucketOwnerPreferred # without it it complains about ownership being set to BucketOwnerEnforced        BucketEncryption:          ServerSideEncryptionConfiguration:            - ServerSideEncryptionByDefault:                SSEAlgorithm: "AES256"              BucketKeyEnabled: false        CorsConfiguration:          CorsRules:            - AllowedHeaders:                - "*"              AllowedMethods:                - "PUT"                - "POST"                - "DELETE"                - "GET"              AllowedOrigins:                - "*"CommentShareEXPERTRiku_Kobayashianswered a month ago0Block Public Access can also be set at the Organization level via an SCP - is this possible in your environment?I'd advise looking at one of your other buckets in the S3 console to see what its Block Public Access settings are and, if set, where they've come from.CommentShareEXPERTskinsmananswered a month ago"


Question: This site can’t be reached after changing Name Servers

"Hello,I have a registered domain via Amazon Route 53 but I am hosting it somewhere else, on a shared hosting. I have changed Name Servers and on Whois-LookUp I can see that the End-Point for them has been successfully changed.Now, the issue is when I try to access my website, it says the following:"This site can’t be reachedThe webpage at LINK might be temporarily down or it may have moved permanently to a new web address.ERR_NAME_RESOLUTION_FAILED"Also, I have deleted the Host Zone for that particular domain, which was created by default.FollowComment"

Answer: "0Hi,DNS resolvers typically cache the names of name servers for two days. DNS resolvers that have sent a query to Route 53 in the last couple of days for your website (say, www.mishovski.com) still are using the Route 53 name servers instead of the name servers for your new DNS service.Unfortunately, because you deleted the Route 53 hosted zone, resolvers can't get the information from Route 53. Extra unfortunately, there's no way to create another Route 53 hosted zone that has the same set of four Route 53 name servers, so you can't reproduce your hosted zone in the interim.You'll need to wait for the two-day cache duration (commonly known as "TTL" or "time to live") to expire. At that point, DNS resolvers will start sending queries to the new DNS service.For an overview of how this works, see "How Amazon Route 53 Routes Traffic for Your Domain" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/welcome-dns-service.html#welcome-dns-service-how-route-53-routes-trafficScottCommentShareEXPERTAWS-User-6179575answered 3 years ago"


Question: Guardduty on AWS organization vs individual accounts

"Hi, One of my cust has an AWS Organization & control tower with about 15 accounts. I wanted to enable Guardduty to about 10 accounts in them. Is it better to do at individual account level or in AWS org. Are there any cost implications if done from AWS org. Thanks.FollowComment"

Answer: "1Accepted AnswerTo answer the questions in reverse order for you, there are no additional AWS cost implications by managing Amazon GuardDuty at the AWS Organizations level.   By managing it at the AWS Organizations level however, you can consolidate findings into a central view and manage account enrollment centrally, thereby saving time and effort by not having to log into each account individually or do additional work to export results from each account.Technically you still do enable GuardDuty in each individual account, but doing it at the Organization level makes the task centralized and efficient.CommentShareAllison_Panswered a year ago"


Question: Comodo SSL Cert onto a Lightsail Instance of Wordpress

"I've migrated my website from A2 Hosting onto a Lightsail instance of Wordpress, pointed my domain from Godaddy and installed a Let's Encrypt SSL cert onto my site. Everything is running fine.However, I have a Comodo Essential SSL certificate that I would like to replace the Let's Encrypt cert but cannot seem to find any clear step-by-step instructions. Comodo support gave me their list but it's not so clear and mentions Load-Balancing - which I would rather not use due to the pricing.I would be extremely grateful if anyone has a clear list of instructions on how to deploy the cert without breaking what I've set up so far.Thanks.FollowComment"

Answer: "0Hi biospherix,Bitnami has some documentation on how to configure a SSL support with Apache. https://docs.bitnami.com/aws/apps/wordpress/administration/enable-https-ssl-apache/Let us know if that helps you.Thanks for using Lightsail!JonathanCommentShareAWS-User-7183595answered 3 years ago0Thank you Jonathan, that indeed worked ! Much appreciated.Edited by: biospherix on Jan 23, 2020 1:55 AMCommentSharebiospherixanswered 3 years ago0Worked perfectly.CommentSharebiospherixanswered 3 years ago"


Question: TimeoutError The action failed because a job worker exceeded its timelimit

"Hello,I created a pipeline that calls a step function that to deploys to CloudFormation. The pipeline invokes a lambda function that starts the step function.The step function runs fine by itself, but the pipeline times out at 20 minutes.I added a sort of keep-alive using put_job_success_result continuation Token. This is called from a step the step function every 5 minutes, which then re-invokes the lambda function. It grabs the new job_id from that and stuffs it in SSM so the SF can send put_job_success/fail_results and tokens downstream). The lambda function does not reinvoke the step function when a continuation token is in the event.But even with the continuation token I still see timeouts on long executions. I have everything logged so I can see the continuation token is being passed and the new job is started, but sometimes it just fails."TimeoutError The action failed because a job worker exceeded its timelimit. If this is a custom action, make sure that the job worker is configured correctly."Is there a better way to handle this lambda invoke action timeout? I see in the documentation it should be an hour for an invoke action, but this is 20 minutes, but sometimes much less.Thanks,LMFollowComment"

Answer: "0Hello! Sorry for taking so long to respond.I just want to make sure that we're on the same page around how to use continuation tokens.When you use the lambda invoke action with continuations, you need to call PutJobSuccessResult for the job ID that your lambda was given within 15 minutes of receiving the job. Note that the JobID matters - you can't keep calling PutJobSuccessResult with the original job ID, because using continuations results in a new job (the first job is done - it was a success :) )What I think it happening is that you are sending the first job ID with subsequent PutJobSuccessResult calls - could you check this is the case?This hypothesis is supported by the time limit being 20 minutes. If you're calling PutJobSuccess for the first time five minutes after you get the first job, then the second job would time out 15 minutes after that, or 20 minutes into the action.If you'd like, please PM me a job ID and the region the action is in, and I can take a look at what's going on.Thanks!MatthewCommentShareAWS-User-3346008answered 4 years ago"


Question: Receiving S3 503 slow down responses

"We have an application that stores a large volume of data in one S3 bucket. Lately, we have started receiving 503 slow-down error messages. Reading the docs, it seems like the API is related to the Prefix and Partitions that S3 creates internally based on the Folder structure.Our current structure is /uploads/receipt_image_v2/<UUID>/<FILENAME> ... I wonder if we should do something different? We have millions of UUID and 1-2 images per UUID in the S3 bucket.I can't find any way to see how many partitions there are for our S3 bucket.FollowComment"

Answer: "2Accepted AnswerYour application can achieve at least 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second per prefix in a bucket. You can work with customer support to pre partition the bucket based on your folder naming structure. Last time we did it we had to create a new bucket & work with support to pre partition it & copy data from the old bucket to new one.CommentSharevenky81answered 6 months agoEXPERTChris_Greviewed 6 months agoabhigupta-mb 6 months agoThanks, I wasn't aware that this is something that customer support could do!Though our bucket is 100s of TBs in size, so I doubt transferring data to a new bucket will be feasible.Sharevenky81 6 months agoAlso another very important thing: Before you go down the rabbit hole just find out what operation is causing the 503. Most times I find the issue is List operations. If it is then I would suggest to configure an inventory report on the bucket to deliver to another bucket & use that inventory report instead of list files.Share0Hihave a look at https://aws.amazon.com/premiumsupport/knowledge-center/http-5xx-errors-s3/ to troubleshoot HTTP 500 or 503 error from Amazon S3.Also have a look at:https://aws.amazon.com/premiumsupport/knowledge-center/s3-503-within-request-rate-prefix/If there is a fast spike in the request rate for objects in a prefix, Amazon S3 might return 503 Slow Down errors while it scales in the background to handle the increased request rate. To avoid these errors, you can configure your application to gradually increase the request rate and retry failed requests using an exponential backoff algorithm [1].[1] https://docs.aws.amazon.com/general/latest/gr/api-retries.htmlCommentShareNuno_Qanswered 6 months ago"


Question: ECS cluster network changes

"I'm trying to modify the networking configuration for my ECS cluster. During the creation process, I was able to specify the VPC and subnets, but I did not see an option to specify a security group. How can I specify a security group for my ECS cluster, and how can I add additional security groups to the cluster after it has been created? Thank you.FollowComment"

Answer: "0The below might help you.https://stackoverflow.com/questions/57827251/change-aws-ecs-services-security-groupsCommentSharerePost-User-5208427answered 2 months ago0To specify a security group for the EC2 instances in your ECS cluster, you can use the launch template or launch configuration that you used to create your EC2 instances. You can specify a security group in the launch template or launch configuration, and any EC2 instances launched with that template or configuration will have the specified security group.To add additional security groups to your ECS cluster after it has been created, you can modify the launch template or launch configuration to include the additional security group(s), and then update your EC2 instances using the updated template or configuration.Alternatively, you can add the additional security group(s) directly to the EC2 instances in your cluster using the EC2 console or AWS CLI. To do this, locate the EC2 instances in your cluster and modify their security group settings to include the additional group(s).Keep in mind that when you modify the security groups associated with your EC2 instances, you may also need to update the security group settings for any load balancers or other resources that communicate with the instances.CommentSharekishanpokaranswered 2 months ago"


Question: Options to accelerate s3 copy of 4TB worth files between S3 buckets in same region

"A customer has S3 bucket that contains 12.2 million files which totals to 4TB data. Most of the files in the bucket are less than a few MB. All of the files are in one folder. They have to move these files from one bucket to another. They said last time they tried it took them days to transfer. They are looking ways to reduce the copy time.One recommendation could be to batch and compress (using tar, zip, etc) the files before transfer. In that case, Is there any approximate ideal size we can recommend?Also, are there any other/additional solutions that we can recommend to reduce the time to transfer data between buckets in same region.FollowComment"

Answer: "1Accepted AnswerCheck out: https://docs.aws.amazon.com/emr/latest/ReleaseGuide/UsingEMR_s3distcp.htmlUsing S3DistCp, you can efficiently copy large amounts of data fromAmazon S3 into HDFS where it can be processed by subsequent steps inyour Amazon EMR cluster. You can also use S3DistCp to copy databetween Amazon S3 buckets or from HDFS to Amazon S3. S3DistCp is morescalable and efficient for parallel copying large numbers of objectsacross buckets and across AWS accounts.CommentShareEXPERTmhjworkanswered 3 years ago0You can parallelize your copying process with the aws s3 cli, using sync and --exclude and --include. For example, if all your files are in one folder, you might break them down by the letter of the alphabet they are starting with or some other scheme that you know will distribute them in parts.Performance is better when the the "prefixes" of the url are well distributed, so it will be better if all files are in the "top folder", not in some sub folder.I used this method to transfer 280000 images for someone and recall that each aws s3 sync process needed about 1/3 of a CPU, so was using a 4 core server to run around 10 processes in parallel.CommentShareJochen Daumanswered a year ago"


Question: Redshift Datashares for Views of External Schema Tables

"I have cluster A and cluster B. Cluster A has an external schema called 'landing_external' that contains many tables from our glue data catalog. Cluster A also has a local schema that is comprised of views that leverage data from 'landing_external' - this schema is called 'landing'.Cluster A has a datashare that Cluster B is the consumer of. The 'landing' schema is shared with Cluster B, however, anytime a user attempts to select data from any of the views in 'landing' schema, they receive an error ERROR: permission denied for schema landing_external. I thought that creating all of the views with option 'WITH NO SCHEMA BINDING' would address this permission gap but it does not.Any ideas on what I am missing?FollowComment"

Answer: "1Accepted AnswerRedshift data sharing is for data that is contained and managed in Redshift, aka Redshift Managed Storage (RMS), thus the name "redshift data" sharing.CommentShareMilindOkeanswered 2 months agotjtoll 2 months agoThat is fair - I'll mark this as the accepted answer. However, I should share that being able to share views on top of external schema data across shares would help centralize business logic applied on top of views across all data shares. Instead, those views need to be created on any consumer clusters.Share0as per your latest comment I apologize for the confusion in my previous response. You're correct that external schemas cannot be added to data shares directly. As an alternative solution, you can create views in the 'landing' schema on Cluster A that reference the tables in the 'landing_external' schema. You can then share the 'landing' schema with Cluster B. This way, users in Cluster B can query the views without having direct access to the 'landing_external' schema.How to exampleOn Cluster A, create views in the 'landing' schema that reference the tables in the 'landing_external' schema:CREATE VIEW landing.view1AS SELECT * FROM landing_external.table1;Repeat this for each table in the 'landing_external' schema.Add the 'landing' schema to the data share, if you haven't already:CREATE SHARE landing_share;ALTER SHARE landing_share ADD SCHEMA landing;Grant usage on the data share to the consumer account for Cluster B:GRANT USAGE ON SHARE landing_share TO ACCOUNT '<ConsumerAccountIdentifier>';On Cluster B, create a new database that uses the shared 'landing' schema:CREATE DATABASE landing_db FROM SHARE <ProducerAccountIdentifier>.landing_share;This workaround allows users in Cluster B to query the data in the 'landing_external' schema without directly sharing the external schema. However, this may not be the most efficient solution if you have a large number of tables in the 'landing_external' schema. In such cases, you might consider automating the view creation process using a script or stored procedure.CommentShareEXPERTsdtslmnanswered 2 months agotjtoll 2 months agoI could be missing something, but I believe that is exactly what I am doing currently that presents this error:ERROR: permission denied for schema landing_externalSharemeyerovb a month agoTo get past that permission denied just "grant usage on landing_external to public", but even then the consumer will throw the error message "Localized temp table cannot be created while getting lbv definition".  This is because https://docs.aws.amazon.com/redshift/latest/dg/considerations.html#limitations-datashare states "Amazon Redshift doesn't support adding external schemas, tables, or late-binding views on external tables to datashares.".  You can work around it by making a materialized view against the external table and having it refresh on a scheduleShare0You're receiving the permission error because the external schema 'landing_external' isn't shared with Cluster B, while the views in the 'landing' schema are referencing the 'landing_external' schema.To resolve this issue, you need to share the 'landing_external' schema with Cluster B:-- On Cluster A, create a new data share that includes the 'landing_external' schemaCREATE SHARE landing_external_share;ALTER SHARE landing_external_share ADD SCHEMA landing_external;-- Grant usage on the new data share to the consumer account for Cluster BGRANT USAGE ON SHARE landing_external_share TO ACCOUNT '<ConsumerAccountIdentifier>';-- On Cluster B, create a new database that uses the shared 'landing_external' schemaCREATE DATABASE landing_external_db FROM SHARE <ProducerAccountIdentifier>.landing_external_share;After completing these steps, users in Cluster B should have the required permissions to access the 'landing_external' schema and execute queries on the views in the 'landing' schema without encountering permission errors.CommentShareEXPERTsdtslmnanswered 2 months agotjtoll 2 months agoUnfortunately it does not appear that external schemas can be added to datashares:ERROR: External schema "landing_external" cannot be added to datashares.Share"


Question: Send DICOM files via HTTPS

I want to send DICOM files via HTTPS to an image recognition model hosted on ECS.The idea is that clients can send their DICOM files to the model's endpoint and get back the model's prediction.Is it possible to do so? Is there a better alternative?FollowComment

Answer: "1DICOM files are typically quite large (in MBs). A better approach would be to upload it to an Amazon S3 bucket and then have your recognition model read it from S3. A bit of wiring will be require on your client side to sequence the multiple API calls together.See:https://docs.aws.amazon.com/AmazonS3/latest/userguide/PresignedUrlUploadObject.htmlCommentSharedspanswered 5 months ago0As suggested in previous answers I had to use a pre-signed URL to upload large objects. I followed the architecture mentioned in this video.It is essentially a serverless architecture where a Lambda function (behind and API endpoint) requests for a pre-signed URL, then returns it to the client and the client then uploads his object into an S3 bucket.CommentShareapssganswered 4 months agodsp 4 months agoexcellent! if you could pls mark my answer as accepted so others will benefit as well.Share"


Question: CodeCatalyst - cannot re-use Space name after it has been deleted

"I deleted a space several days ago from within CodeCatalyst. I also made sure that it was deleted from the associated AWS account.I've tried to create a new space using that same name, but CodeCatalyst tells me that the Space name is already taken.Do I need to carry out some other action to make the name available again?FollowComment"


Question: AWS Tansfer Family  server not accessible

"When we try to send a file from Unix box to  S3 bucket via AWS transfer family resolve hostname of Endpoint is not found correctly and there is error generate for SFTP logs "changing state from STATE_NOT CONNECTED to STATE_CLOSED"   and connection timeout. For the last 6 months, File transfer was successful without any issues. Below are errors in cloudwatch logs of the AWS transfer family:ERRORS KEX_FAILURE MESSAGE= "no matching key exchange method found"  Kex=diffie-hellman-group1-sha1FollowComment"

Answer: "0Accepted AnswerHello Jo-Harrison,To your query, when you mention Endpoint is not found correctly, do you mean DNS resolution isn't working as expected. Could you try connecting directly via the server's IP address rather than the hostname and see if you are able to access your servers? Are you aware of any changes made with your DNS provider concerning the custom hostname of your server?The errors from your SFTP log seem to be related to a custom client and might be related to the KEX error message seen within CloudWatch logs. Are you aware of any changes made to your client itself? Could you test from a different client such as FileZilla or WinSCP and confirm if things are working fine?From the error message in CloudWatch logs for your server, it seems that the client is attempting to establish an SFTP connection to the Transfer server using the KEX algorithm - diffie-hellman-group1-sha1. This particular KEX algorithm is not supported by AWS Transfer service and therefore any attempts from a client using this KEX algorithm will be dropped by the server. Supported KEX algorithms - (A). Could you check the client configuration on what SFTP session parameters it is using to establish connections to the server and if anything has changed recently?References:(A) - https://docs.aws.amazon.com/transfer/latest/userguide/security-policies.html#cryptographic-algorithmsLet me know if you have questions.Sagar.CommentShareEXPERTsagarb-awsanswered a year agoJo-Harrison a year agoIssue has been resolved as client changes there DNS configuration  and  client rollback the changes it is  working fine nowShare"


Question: API Gateway and Lambda Integration

"I am trying the subject resource creation using Terraform. I tried in many ways, aws_lambda_function.lambda: Creating... fails.│ Error: error creating Lambda Function (1): ValidationException:│       status code: 400, request id: 58bfb330-637e-4b9a-9d74-a67b43aa7449It looks like a well-known error based on this git page. https://github.com/hashicorp/terraform-provider-aws/issues/13709Has anyone got it resolved? Thanks.FollowComment"

Answer: "0Terraform has detailed logs which can be enabled by setting the TF_LOG environment variable. You can set TF_LOG to one of the log levels TRACE, DEBUG, INFO, WARN or ERROR to change the verbosity of the logs. This will cause detailed logs to appear on stderr and may provide additional context around the error without knowing more about the code you are trying to deploy.CommentShareRoBanswered a year agoAWS-User-5291433 a year agoI already tried. Nothing new in the detailed logs. Whatever apply command shows the same is there in it.export TF_LOG=TRACEterraform apply 2>&1 | apply.txtShare"


Question: Limitation API Gateway/Lambda with querying

"Hey all! Hope your are doing well. I have been trying to write a query service for some internal databases in my VPC. My current setup is API Gateway with a Lambda that queries the database which works fine, but unfortunately I ran into two issues:API Gateway default timeout is 30s which is not very long for queries.Lambda response size limit is 6mb, which is fine but also not suitable for the biggest queries.Are there any serverless services I can use to solve this problem? I do require custom domain / authentication. Some solution I thought of were:Chunking request, which should work fine but I think 30s is still not very long. It is a temporary solution for now.Using ALB as a "api" to trigger lambdas, which would fix the timeout, but response size limit is still 6mb.Hosting my own API on a EC2/Container, which I can do but I like serverless solutions.Using websockets, but it seems harder to attach existing apps to a WS compared to a REST api.If somebody has some input would really appreciate it! Thanks in advance.FollowComment"

Answer: "0Hi there!Both, the 30 sec timeout limit and 6mb payload size are hard limits in Lambda.However, as a part of workaround, I would suggest a workaround around the same wherein you can process payloads that are over this 6MB limit.== OPTION 1 ==Instead of sending a huge payload directly to the Lambda function, you can upload the payload as an object to an S3 bucket, And then use the “Bucket Name” and “Object Name” to fetch the payload larger than 6 MB from s3 while executing the Lambda function using AWS SDKs to GET object from the bucket. This will allow the function to read the payload from the S3 object and process the data.In case of sending out a response payload with size larger than 6 MB, I would recommend you to store the payload in S3 bucket and then pass the pre-signed URL generated for that payload stored inside S3 bucket to the end user/client in order to download the payload directly from S3 Bucket. For more details around the same please refer this documentation link below [1].I would also like to share that on checking further around this, I found that there is an active feature request and is in the Lambda Service Team’s consideration (regarding the 6mb payload limit).== OPTION 2 ==As for alternatives to the Lambda Service, where you can have more control over the underlying environment, could be AWS Fargate.AWS Fargate - a serverless version where containers are run on AWS-managed servers which you don't have to pay for - instead you pay for compute time [2].Therefore as per your requirement, you can use ECS Fargate as an alternative. With AWS Fargate, you don't need to manage servers, handle capacity planning, or isolate container workloads for security. Fargate handles the infrastructure management aspects of your workload for you. You can schedule the placement of your containers across your cluster based on your resource needs, isolation policies, and availability requirements.Hope this helps!Ahmad[1] https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html[2] https://aws.amazon.com/fargate/CommentShareAhmad Tariqanswered 3 months agoD Joe 3 months agoThank you Ahmad! I considered option 1 but thought it wouldn't fit well, seems (like you said) more like a workaround then a proper solution. Fargate seems interesting, but I would still be bound to the 30s from api gateway. I think I even might be better off hosting an api on a docker container / ec2 right?ShareAhmad Tariq 3 months agoHi again,You are right, API Gateway 30s timeout is indeed a hard limit. To overcome this:You could invoke your backend asynchronously [1]. This will mean that your backend will return a response to API Gateway straight away which will avoid timeout, and your backend can execute for longer than 29 seconds. In your backend you would return HTTP code 202 which means that the request has been accepted for processing, but the processing has not been completed. In the client you can implement polling logic to check the status of the backend.As for hosting the API on a container/EC2, this could certainly work, and would provide you with complete control over your environment configurations, if this is your use case.[1] https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-invoke-lambda/Share0Hi,To overcome Api GW limit, you can look at Application Load Balancer. You can increase timeout response from 60s to 4000shttps://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#connection-idle-timeoutAs per lambda, you can evaluate Fargate to move your workload there. More details here: https://ecsworkshop.com/introduction/ecs_basics/fargate/.Hope it helps!CommentShareEXPERTalatechanswered 3 months ago"


Question: Number of EC2 instances for a large number of Cloud9 developers

"Assuming I have a team of 20 developers using Cloud9, and that I wish to host the Cloud9 developer environments on AWS, therefore selecting EC2 instances.In that case, will we need 20 EC2 instances, one for each Cloud9 developer?Or is there a way of sharing a single EC2 instance by multiple developers?Are there ways of running Cloud9 envs on AWS other than on EC2 instances?Any other ideas how cost may be optimized for a large team of Cloud9 developers?Thanks,JuliusFollowComment"

Answer: "0If you have devs working on the same code, at the same time, you can actually share Cloud9 environments.  This way you can see who marked up what code, sort of like a shared google doc.  You can have one nice size Cloud9 instance rather than an individual environment for each developer.Some details . . .https://docs.aws.amazon.com/cloud9/latest/user-guide/share-environment.htmlCommentSharetedtrentanswered 5 months ago"


Question: Need to find latency between Singapore and London Servers

"Hi Experts,we have some servers hosted in Singapore and now we want to host some servers in London . now we want these 2 servers.so can you confirm what is min latency we can achieve between these 2 regions .currently we are using VPC peering and we are able to achieve 190-200 ms ..FollowComment"

Answer: "0We don't publish latency figures and instead recommend that customers test for themselves which you've done.However, if we look at the raw figures:Shortest path between Singapore and London (as the crow flies) is 10,841 kilometres. In a perfect world (where data is transmitted at the speed of light and there are no other delays) the round-trip time would be around 73 milliseconds. But the world isn't perfect and the speed of light in fibre optic is actually about two-thirds of the speed of light in a vacuum so assuming the best case there (again, no other delays) the round-trip time would be around 94 milliseconds.But: The fibre paths are generally not the shortest path. Looking at the global fibre network map we can see that the path is not direct. A search tells me that the distance is somewhere between 17,000 kilometres (best case) to 21,000 kilometres (worst case). Let's take the best case here.At 17,000 kilometres the round-trip time (in fibre-optic) is around 148 milliseconds. And again: This is assuming there are no other delays on the path. And again, that is best case. The path could easily be longer and therefore the latency could be higher.Where could other delays be coming from?If there is any place where the signal passes over copper cabling then the speed of the signal drops again to one-third of the speed of light.Each router that the packets pass over introduces small amounts of delay - and even if each router only delays the packets by half a millisecond - that adds up. 20 routers would add 10 milliseconds of delay in one direction. Round-trip time means that delay is doubled. And it would not be difficult to have 20 routers between servers on opposite sides of the world - in fact, I think that's a low number.AWS encrypts traffic on our backbone when it travels between regions. Encryption takes a small amount of time as well. That's an additional delay.The network is shared so latency is going to be slightly variable.There are probably other causes too...But, as you can see - 190-200 milliseconds seems pretty reasonable.CommentShareEXPERTBrettski-AWSanswered 7 months agoEXPERTTushar_Jreviewed 7 months ago"


Question: "Hosting on AWS, React.js + Node.js app"

"I developed a web app, its frontend is made with react js and the backend is made with node js. Some data provided by clients are delivered to the backend and then they are processed and delivered again to an AWS Lambda function in order to start some additional executions. Locally everything works fine. My doubt is about the choice of the right way to host my web app: what are the instruments able to make my project hosted by aws? I read about amplify, lightsail, ec2 and so on... Can you give me some advice?FollowComment"

Answer: "0Accepted AnswerYou can use Lightsail Node.js blueprint to deploy your frontend/backend: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-quick-start-guide-nodejsYou can setup VPC peering to allow backend to communicate with Lambda function on your AWS account. Below page can help you with this.https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-set-up-vpc-peering-with-aws-resourcesIn terms of whether you should choose Lightsail or EC2 for VPS hosting, it would depend on your full use-case/scale.CommentShareAWS-User-5087265answered 5 months agoMichele 5 months agoMy backend communicate with SQS, and SQS is connected with Lambda. Can I use aws sdk as I do locally in my backend in order to send messages to SQS from my React + Node app deployed on lighsail?Share0My recommendation is use S3 + cloudfront for the frontend in react and API Gateway + Lambda for the backend.You can use amplify to simplify the deployment process and create a CI/CD pipeline, but not is mandatory.Don't use lightsail, and avoid EC2 unless some backend dependency force to use it instead of lambda.CommentShareCarlos Garcesanswered 5 months agoMichele 5 months agoCan you give me some more information about why do not use laighsail? Because it seems to me that is the right choice in order to have fixed deployment costs. And then I would like to preserve lamba concurrency to the clients requests processing. The backend in my app is only about some get and post requests and some message delivery to SQS in order to make lambdas execute. The ost of the work is made by lambda and sqs, backend is only about delivery to them.ShareCarlos Garces 5 months agoCloudfront + S3 + AWS Lambda is more cost effective than lightsail. Also if you are already using AWS Lambda in other parts of the application, use the same technology for the backend made more sense.Share"


Question: Config for lambda internal queue batch size

"have a query around lambda trigger notifications:sources i am referring to:https://docs.aws.amazon.com/lambda/latest/dg/with-s3-example.htmlhttps://docs.aws.amazon.com/lambda/latest/dg/with-sqs-example.htmlObservations:though trigger from S3 has field records a list  in the payload but it has only one record while sqs payloads have a no of events as per the batch sizeQuery:Couldn’t find if  any aggregation happens in lambda’s internal queue,  and in case there is any operation happening in the lambda’s internal queue, how can we config the batch size for the internal queue?Add is the batchSize always 1 in case of S3?FollowComment"

Answer: "0Although I can't find any document stating that the batchSize will always be 1 I think it will be.Nevertheless usually when I implemented these lambda's I used one of the following patterns:just create a loop over the records. just in case it changes in future...refuse events that have > 1 record count, generate an error -> cloudwatch logs -> alarmCommentShareJaccoPKanswered a year ago0Only Event source mapping (SQS, Kinesis, MQ, DDB Streams) invocation allow for batching. All other invocation, synchronous (e.g., API Gateway) or asynchronous (e.g., S3, even though there is an internal queue), deliver the events to Lambda with a single event at a time.If you want to handle S3 events in a batch you can use S3 -> SQS -> Lambda.CommentShareEXPERTUrianswered a year ago"


Question: CloudWatch sensitive data count is not refreshed on the other user account

"We applied Data Protection Policy on a log group. Then we found that it detected some sensitive data included in some logs. (20 items in the picture below)So we deleted the logs that included the sensitive data. But when we checked it from the OTHER user account, it didn't show the corrected number of sensitive data (still seeing 20 items in the AWS console).It seems that if you push the "reset alert" button on the top of the UI, it refreshes the number of the sensitive data, but the refresh doesn't look applied when you check it on the other user account (it still shows the old number of sensitive data count).Do you know why do we see this behavior & how to apply the latest sensitive data count on EVERY user seeing the AWS console? Thank you.FollowComment"


Question: AWS Network Firewall limiations

"There are hard limits for AWS Network Firewall, namely:Maximum stateful rule group capacity. For more information: 30,000Maximum number of stateful rule groups per firewall policy: 20Let's say I want to use AWS Managed Rules and also create my own rules and this is not possible, because AWS is providing 20 rule groups. Each set of managed rule groups counts as a single rule group toward the maximum number of stateful rule groups per firewall policy. So there is no space left for my own rule groups. What is really intereseting, it is not possible to use all of 20 AWS Managed rule groups, because when I try to use it it will exceed 30.000 capacity.My question is, why these limits are so low?FollowComment"

Answer: "0You are right regarding trying to manage all stateful managed rule group will hit the 30000 hard limit. You can think rule groups as containers of rule groups, therefore you can group your rule groups by functionality (for example botnet, malware) and type (stateful/stateless) under separate policies which will give you the flexibility:not to hit the limitsmanage your rule groups and policies easilyCommentSharebullittbirantanswered 7 months ago"


Question: WorkDocs Drive Fails on Intel Mac OSX Monterey after a short period of running

"I have a Mac mini, Intel i5, 32GB, 256GB SSD, 2018. I was using WorkDocs Drive under Big Sur without any issues. Just upgraded to Monterey, Mac OSX Version 12.0.1, and after the final reboot, I see many macFUSE errors generated by WorkDocs Drive. Uninstalled WorkDocs Drive and also deleted all references to macFUSE from the various locations on my Mac boot drive, rebooted. Reinstalled WorkDocs Drive fresh using the latest WorkDocs download mac client from Amazon (from here: https://amazonworkdocs.com/en/clients ). The WorkDocs drive appears to work fine for about 30 mins or so, and then I get macFUSE errors (about 6 popup windows), and WorkDocs shuts down and stops working, and I cannot restart WorkDocs Drive without reinstalling it. Once I reinstall the WorkDocs Drive, the same issue returns: WorkDocs Drive works for about 30 mins, then fails with the same macFUSE errors (synch related?). Your help in resolving this issue would be greatly appreciated. Thank you.WorkDocs Drive Fails on Mac OSX Monterey after a short period of runningFollowComment"


Question: Is there way to acces flask app video capture inside ec2 instance [can't find camera by index]

"Hello everyone, I have a flask app that streams live video; however, when I try to deploy it to an EC2 instance, I receive the problem "can't find camera by index." Could you guys please assist me with this? I've tried a few internet solutions, but they didn't work.FollowComment"


Question: Credit / extend duration

"Hi,I have AWS credit in my account. The credit will expire soon but we did not used all the amount yet.How can I extend the credit duration ? What is the process ?Thanks for your help,FollowComment"

Answer: "1Accepted AnswerHi Fabien,As per the details in the FAQ linked below, "The AWS Activate team is unable to extend the expiration date of AWS credits, even if there are remaining credits left unused." You can view all the details here:https://aws.amazon.com/activate/faq/— Brian D.CommentShareEXPERTAWS Support - Briananswered a year agoFabienG a year agoThanks for your replyShare"


Question: Associating a specific resources to WAF classic and WAF v2

"I'm trying to associate WAF classic and WAF v2 to a specific resource in my environment so that I can compare metrics from both web ACLs before upgrading to WAF v2. During my test, each time I associate the resource to one web ACL, it removes the resource from the previous association. Any suggestions on how to implement WAF classic and WAF v2 on the same resource so I can compare metrics before disassociating WAF classicFollowComment"

Answer: "3Hi,There is a Restrictions on multiple associations:You can associate a single web ACL with one or more AWS resources, according to the following restrictions:You can associate each AWS resource with only one web ACL. The relationship between web ACL and AWS resources is one-to-many.You can associate a web ACL with one or more CloudFront distributions. You cannot associate a web ACL that you have associated with a CloudFront distribution with any other AWS resource type**Refer this for more information **- https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.htmlCommentShareAWS-CSinghanswered 5 months ago"


Question: Why is client connection cycling after subscription?

"Can connect and publish without issue.Can see subscription registered at the DashboardFollowed immediately by the disconnect notice and then a continuous connect/disconnect loop$aws/events/presence/disconnected/AMX_IOT_TESTAugust 17, 2021, 14:24:17 (UTC-0700){"clientId": "AMX_IOT_TEST","timestamp": 1629235457576,"eventType": "disconnected","clientInitiatedDisconnect": false,"sessionIdentifier": "c17091a0-452c-4075-868e-5b50356b7636","principalIdentifier": "2fab2eec1f3a614028957b190965aaf2985eec1656ca2710837e5e86935b2e55","disconnectReason": "CONNECTION_LOST","versionNumber": 1323}Subscribed$aws/events/subscriptions/subscribed/AMX_IOT_TESTAugust 17, 2021, 14:24:17 (UTC-0700){"clientId": "AMX_IOT_TEST","timestamp": 1629235457548,"eventType": "subscribed","sessionIdentifier": "c17091a0-452c-4075-868e-5b50356b7636","principalIdentifier": "2fab2eec1f3a614028957b190965aaf2985eec1656ca2710837e5e86935b2e55","topics": ["topic_1"]}Subscribe is as per the PubSub Examplepublic class TestTopicListener extends AWSIotTopic {**public TestTopicListener(String topic, AWSIotQos qos) {**      **super(topic, qos);**  **}**  **@Override**  **public void onMessage(AWSIotMessage message) {**      **System.out.println(System.currentTimeMillis() _ ": <<< " _ message.getStringPayload());**  **}**  }AWSIotTopic subscriber = new TestTopicListener("topic_1", TestTopicQos);try {**client.subscribe(subscriber, true);**} catch (AWSIotException e1) {**e1.printStackTrace();**}The exception handler is never caughtThis is the sequence observed on the hardware after subscribe() is invoked(14:32:35.118)::  Aug 17, 2021 2:34:07 PM com.amazonaws.services.iot.client.core.AwsIotConnection onConnectionFailure(14:32:35.118)::  INFO: Connection temporarily lost(14:32:35.118)::  Aug 17, 2021 2:34:07 PM com.amazonaws.services.iot.client.core.AbstractAwsIotClient onConnectionFailure(14:32:35.118)::  INFO: Client connection lost: AMX_IOT_TEST(14:32:37.988)::  Aug 17, 2021 2:34:10 PM com.amazonaws.services.iot.client.core.AwsIotConnection$1 run(14:32:37.989)::  INFO: Connection is being retried(14:32:38.973)::  Aug 17, 2021 2:34:11 PM com.amazonaws.services.iot.client.core.AwsIotConnection onConnectionSuccess(14:32:38.975)::  INFO: Connection successfully established(14:32:38.984)::  Aug 17, 2021 2:34:11 PM com.amazonaws.services.iot.client.core.AbstractAwsIotClient onConnectionSuccess(14:32:38.985)::  INFO: Client connection active: AMX_IOT_TESTTried various Policy inputs but same result{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["iot:Publish","iot:RetainPublish"],"Resource": ["arn:aws:iot:us-west-2:xxxxxxx:topic/sdk/test/java","arn:aws:iot:us-west-2:xxxxxxx:topic/topic_1","arn:aws:iot:us-west-2:xxxxxxx:topic/topic_2","arn:aws:iot:us-west-2:xxxxxxx:topic/amx/itg/test/*"]},{"Effect": "Allow","Action": ["iot:Subscribe"],"Resource": ["arn:aws:iot:us-west-2:xxxxx:topicfilter/sdk/test/java","arn:aws:iot:us-west-2:xxxxx:topicfilter/topic_1","arn:aws:iot:us-west-2:xxxxx:topicfilter/topic_2","arn:aws:iot:us-west-2:xxxxx:topicfilter/amx/itg/test/duet"]},{"Effect": "Allow","Action": ["iot:Receive"],"Resource": ["arn:aws:iot:us-west-2:xxxxx:topic/topic_1","arn:aws:iot:us-west-2:xxxxx:topic/topic_2","arn:aws:iot:us-west-2:xxxxx:topic/amx/itg/test/duet"]},{"Effect": "Allow","Action": ["iot:Connect"],"Resource": [,"arn:aws:iot:us-west-2:xxxxx:client/${iot:Connection.Thing.ThingName}*"]}]}Hardware is embedded Jave 1.8SDK is aws-iot-device-sdk-javaFollowComment"

Answer: 0Downgraded the MQTT client from 1.2.5 to 1.1.1 (should have read the fine print).Issue was in AwsIotMqttClientListener with connectionLost() being called in the MQTT client.CommentShareIRCraigieanswered 2 years ago


Question: DKIM signing DISABLED but no changes were made on the DNS records

HiI got an email that my DKIM signing was DISABLEDBut I made not changes to the DNSI also doubled checked and the DNS records still existsWhat might be the problem in this case?FollowComment

Answer: "0I found a similar phenomenon occurring.In this case, it was fixed after giving it some time.https://repost.aws/questions/QUurC5Q89AReeDGcWfOQUXtg/dkim-signing-disabled-for-multiple-domainsAlso, the following troubleshooting document states that the DKIM setup procedure must be repeated from the beginning.https://docs.aws.amazon.com/ses/latest/dg/troubleshoot-dkim.htmlThis means that Amazon SES can no longer find the required CNAME records (if you used Easy DKIM) or the required TXT record (if you used BYODKIM) records on your DNS server. The notification email will inform you of the length of time in which you must re-publish the DNS records before your DKIM setup status is revoked and DKIM signing is disabled. If your DKIM setup is revoked, you must restart the DKIM set-up procedure from the beginning.CommentShareEXPERTRiku_Kobayashianswered 20 days ago"