Question: push browser camera to aws rtmp server

"i am using python and in frontend javascript.I am using ffmpeg to push video to rtmp server.ffmpeg -y -f mp4 -stream_loop -1 -re -i myvideo.mp4-b:v 3M -vcodec libx264 -r 30.0 -s 1280x720-c:a copy -b:a 96k-f flv "rtmps://dfdf222.global-contribute.live-video.net:443/app/"I test with OBS software, it is working well.It is working well but I am not getting how to push to rtmp server of my browser camera? i mean from javascript?i am trying like this:    <video id="vid" autoplay></video>    open and stream    It is working but not getting any way to push from browser to rtmp server. I know browser doesnt support rtmp  protocol, we need to send it from the backend but can I push it to the server so that it pushes to rtmp server?Does anyone know the way?FollowComment"

Answer: "0Apologies for late response.While I'm unsure how the ffmpeg has been implemented/integrated into your javascript framework, I believe you would have known about the ffmpeg guide https://trac.ffmpeg.org/wiki/Capture/Webcam explains how to access the webcam while using the various OS.With that said, you may consider trying out the recently released IVS Web Broadcast SDK, which provides the off-the-shelf solution you may need and reduces complication. As the term, the Web Broadcast SDK works within the browser and does not require a backend server to stream into IVS.The following guide helps you to know all about the Web Broadcast SDK https://aws.github.io/amazon-ivs-web-broadcast/docs/sdk-guides/introductionI hope this helps. :)CommentShareAWS-Sathia-Saithanyaanswered 10 months ago-1Hi,You may have to include both Stream URL and the Stream key in the FLV endpoint:Example FFmpeg command:ffmpeg -re -1 -i $VIDEO_FILEPATH -r 30 -c:v libx264 -pix_fmt yuv420p -profile:v main -preset veryfast -x264opts "nal-hrd=cbr:no-scenecut" -minrate 3000 -maxrate 3000 -g 60 -c:a aac -b:a 160k -ac 2 -ar 44100 -f flv rtmps://**INGEST_ENDPOINT**:443/app/**STREAM_KEY**Please refer the following document for more details:https://docs.aws.amazon.com/ivs/latest/userguide/getting-started-set-up-streaming.html#ffmpegCommentShareAWS-Sathia-Saithanyaanswered a year agorePost-User-3201146 a year agoHi, You have not understand questions, i am not streaming recorded videos ! I want to live stream my webcam. like when user signup to my application, they can go live. but I am not getting any way to push from browser to rtmp. can you please help in this case?Share"


Question: How/where is data copied in sagemaker pipelines?

"example contrived for this question, I understand , when we create a sagemaker pipeline, with steps to process data and then to run training, the data is copied a local instance in some opt/ml/.. directory i would assume. this is s3 file mode for training. so if i pull down the data manually from notebok or terminal and copy it to wherever sagemaker wants. when i run the pipeline, how can i tell sagemaker that the data is already present in the local instance such that it doesn't have to download from the s3 uri ?FollowComment"

Answer: "0From the question above what I understood is you have already copied the data to local instance and would like avoid coping it with each pipeline run.With SageMaker SDK local mode, you can also specify a local path instead s3 url,  the local files/dataset will be  used instead of downloading the files from S3.This documentation shows how to specify local mode and input - https://sagemaker.readthedocs.io/en/stable/overview.html#local-modeCommentShareAWS-User-4002812answered 4 days ago"


Question: Neo4J can't access instance

"I have a running instance of Neo4J, at least the UI says so...I've tried accessing both Public IPv4 DNS and Public IPv4 address with no luck...I can SSH into it and systemctl status neo4j.It is started and saysBolt enabled on [some IP address]:7687Remote interface available at http://[some IP address]:7474/Tried both of them in the browser with no luckFollowComment"

Answer: 0Own mistakeCommentShareApercanswered 2 years ago


Question: Changes to connection handling with Aurora Postgres?

"Were any changes made to how connections are handled between PostgreSQL and Aurora Postgres?  Specifically, there are limitations in Postgres with connections due to memory usage, and a customer wants to know if any improvements were made with Aurora.In addition, if the connection "math" is the same as vanilla Postgres, is the total max connections for a cluster equal to the # of replicas * max connections per, or something else?Thanks for any insights!FollowComment"

Answer: "0Accepted AnswerThis documentation page shows the difference between Aurora PostgreSQL and plain vainilla PostgreSQL on RDS: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.AuroraPostgreSQL.Compare.htmlLikewise, these are the features that are supported in PostgreSQL on RDS:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_PostgreSQL.html#PostgreSQL.Concepts.General.FeatureSupport.ExtensionsCommentShareAWS-User-9465269answered 4 years ago"


Question: AWS Text Extraction

How to solve Access Denied Exception in AWS textract when uploading an image?FollowComment

Answer: "1Assuming you are in the console, there are a few instances where you may receive an Access Denied error:If the AWS Management Console tells you that you're not authorized to perform an action, then you must contact your administrator for assistance, and ask them to update your role's or user's policies. They will be able to grant you access to the action you are trying to perform. For instance the following example error occurs when a user tries to run DetectDocumentText on a test image but does not have textract:DetectDocumentText permissions:User: arn:aws:iam::123456789012:user/userabc is not authorized to perform: textract:DetectDocumentText on resource: textimage.pngIf you receive an error that you're not authorized to perform the iam:PassRole action, your policies must be updated to allow you to pass a role to Amazon Textract. When using Textract you can implicitly pass an existing role to the service instead of creating a new service role or service-linked role. To do this, you must have permissions to pass the role to the service. If not you may receive an error similar to the one below:User: arn:aws:iam::123456789012:user/userabc is not authorized to perform: iam:PassRoleIn this case, the user's policies must be updated to allow them to perform the iam:PassRole actionIn summary, you may have access to the console and be able to consult existing resources, but additional permissions may be needed to have the service perform certain actions on your behalf, including detecting and analyzing a document.You can find more info here: https://docs.aws.amazon.com/textract/latest/dg/security_iam_troubleshoot.html#security_iam_troubleshoot-no-permissionsCommentShareNZanswered 2 months ago"


Question: Announcement: Amazon RDS for Oracle - End of Support Timeline for DB snapshots

"[Source: https://forums.aws.amazon.com/ann.jspa?annID=8848]End of Support Timeline for DB snapshots on versions 11.2.0.2, 11.2.0.3 and 12.1.0.1Updated February 4, 2022Extended the deletion timeline from Feb 15, 2022 to April 31, 2022.Old DB snapshots Deprecation - Timeline summary:• Now through April 31, 2022: You can upgrade 11.2.0.2, 11.2.0.3 and 12.1.0.1 DB snapshots manually to the supported snapshot versions. Please review the documentation for the supported upgrade paths [[1]].• May 1, 2022: Amazon RDS for Oracle starts the automatic deletion of these old DB snapshots.Updated October 20, 2021Amazon RDS for Oracle deprecated 11.2.0.2, 11.2.0.3 and 12.1.0.1 database versions. As a result, we are deprecating the DB snapshots taken from these deprecated databases. If you currently have one or more Amazon RDS for Oracle DB snapshots, taken from the deprecated database versions. You must upgrade these old snapshots to ensure continued availability of these snapshots.Old DB snapshots Deprecation - Timeline summary:• Now through Apr 31, 2022: You can upgrade 11.2.0.2, 11.2.0.3 and 12.1.0.1 DB snapshots manually to the supported snapshot versions. Please review the documentation for the supported upgrade paths [[1]].• May 1, 2022: Amazon RDS for Oracle starts the automatic deletion of these old DB snapshots.Additional Notes:For a step-by-step guide on how to update your DB snapshots, please review the Best Practices for upgrading AmazonRDS for Oracle DB snapshots blog [[2]]To learn more about upgrading an oracle DB snapshots, review the documentation [[1]].Please contact us through AWS Support [[3]] or the AWS Developer Forums [[4]] should you have any questions or concerns.[[1]] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBSnapshot.Oracle.html[[2]] https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-for-oracle-database-snapshots/[[3]] https://aws.amazon.com/support[[4]] https://forums.aws.amazon.com/forum.jspa?forumID=60FollowComment"


Question: SSM fingerprint changed

"Hey all, hoping someone can help me out here. I'm running SSM on a few instances in a hybrid setup, ie it is installed on actual PCs. All the PCs are Ubuntu. SSM works wonderfully on there. However, today I did an OS upgrade from Ubuntu 18 to 20 and the SSM agent went mental. The main error is thisJan 25 18:46:16 p0xxxxx amazon-ssm-agent\[3863\]: 2022-01-25 18:46:15 INFO \[OnPremCredsProvider\] Calculated hardware difference, regenerating fingerprint...Jan 25 18:46:16 p0xxxxxx amazon-ssm-agent\[3863\]: 2022-01-25 18:46:15 ERROR \[CredentialRefresher\] Retrieve credentials produced unrecoverable aws error: MachineFingerprintDoesNotMatch: Fingerprint does not match 9366ec5a-de7a-4aeb-a6db-998a0f1747d7It is reporting that everything changed, ip, disk, memory, cpu etc etc so it is generating a completely new fingerprint for the box. I have two questions on thisCan I somehow change the fingerprint in SSM so that this can connect again, or do I have to do a new activation?How can I prevent this? I know in the AWS docs there is a command you're supposed to be able to run where you umount /etc/machine-id and then do something else. On my boxes the machine-id is not mounted so the command seems to have no effect.FollowComment"


Question: Can we use spot fleet in cluster config section?

"During testing slurm with parallelcluster, I found we only support independent spot instance.I am wondering whether we can support spot fleet, which we can leverage aws spot fleet feature to help maintain capacity.FollowComment"

Answer: "0Hello sheperd,thank you for your interest.Spot fleet aren't supported. May I ask you on which of the request types and configuration strategies you were mostly interested in?ThanksCommentSharelukeseawalkeranswered 2 years ago0Hi Luca,I am using slurm scheduler, and use spot compute node.Right now, I found it took a long time for pcluster to start new spot instance and configure it to be ready to handle jobs.I am wondering whether using spot fleet to start multiple spot instances in parallel may help or not.By the way, how can I control the lifecycle of spot compute nodes via configuration?thanks,SheperdCommentSharesheperdanswered 2 years ago0Hello sheperd,spot_pricecan be configured for compute nodes.For PCluster 3.x see https://docs.aws.amazon.com/parallelcluster/latest/ug/Scheduling-v3.html#Scheduling-v3-SlurmQueuesFor PCluster 2.x see https://docs.aws.amazon.com/parallelcluster/latest/ug/cluster-definition.html#spot-priceCommentSharelukeseawalkeranswered 2 years ago"


Question: Can I set a security group for each workspace that is launched?

"Can I set a security group for each workspace that is launched?  1 workspace has security group A, and another workspace has security group B.FollowComment"

Answer: "1Hi,When you register a directory with WorkSpaces, it creates two security groups, one for directory controllers and another for WorkSpaces in the directory. The security group for directory controllers has a name that consists of the directory identifier followed by **_controllers **(for example, d-12345678e1_controllers). The security group for WorkSpaces has a name that consists of the directory identifier followed by _workspacesMembers (for example, d-123456fc11_workspacesMembers).You can add a default WorkSpaces security group to a WorkSpaces directory. After you associate a new security group with a WorkSpaces directory, new WorkSpaces that you launch or existing WorkSpaces that you rebuild will have the new security group. When you associate multiple security groups with a WorkSpaces directory, the rules from each security group are effectively aggregated to create one set of rules.To add a security group to an existing WorkSpace without rebuilding it, you assign the new security group to the elastic network interface (ENI) of the WorkSpace. Security GroupsYou can use the Amazon WorkSpaces API to programmatically launch the WorkSpaces,  find the ENI assigned, and assign security groups to the ENI belonging to the WorkSpace. In your example you can use the API to launch 1 workspace has security group A attached to ENI, and launch another workspace and assign security group B to the ENI.CommentShareEXPERTDzung_Nanswered a year ago0Hi, just to elaborate on this sentence: "When you associate multiple security groups with a WorkSpaces directory, the rules from each security group are effectively aggregated to create one set of rules."This sentence is found in the public documentation here: https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-security-groups.htmlHowever, when using an AWS Managed Microsoft Directory Service as my directory for AWS WorkSpaces, I was only able to associate 1 Security Group to the AWS Workspaces Directory at a time using the web console. (Have not tested CLI but assume its the same)It is possible to have multiple security groups attached to the ENI of the workspace itself but I was not able to attach multiple security groups to the domain controller ENI of the AWS managed directory service.Drop down list allowing 1 selection of security group to be chosen:Notice there are no checkboxes or multi select options above.When bypassing the workspaces web console itself and attempting to add an additional security groups to the AWS Microsoft directory service ENI directly using the EC2, Network Interfaces console, I got this error:This feedback has been sent to the AWS documentation team, for review.CommentSharePeter-John Manswered 6 months ago"


Question: External carrier for AWS pinpoint

"Hello there,We would like to implement AWS pinpoint for our project, but right now we are in develop phase so, We need a short code, but we want to use our own provider for short code,can we use our own short code for your service?, or should we request the short code from your service?FollowComment"

Answer: 1It would be easier to request a short code from Pinpoint. Another option is to use custom channel in your journey/campaign and create a lambda function that uses the api from our own provider to send messages.CommentShareAnaAtAWSanswered 6 months ago


Question: Restricting access to some resources

"I made this extremely simplified schema of my app.I am struggling to find a solution to prevent users from accessing resources they don't "own", obviously my apis can access to database, and check if a user can acces to a specific file, but how can i do it on cloudfront?I read about signed cookies, but in all examples i found they grant access to whole cloudfront distribution.I also read about signed url, but being the distribution used also for streaming hls content i can't create a signed url for each single "micro" file of each single stream.any idea?thank youFollowComment"

Answer: "0For this use case I'd normally recommend using a signed URL as it does pretty much what you're asking for.Could you explain more about why you can't create a signed URL for each file? Yes, there's a little bit of compute overhead there; but it happens at the back end and there is already logic in the API to determine file ownership so you're already 90% of the way there.CommentShareEXPERTBrettski-AWSanswered 4 months ago0Hi, thanks for the answer.Streaming through internet means split a single mp4 file in many smaller files.Converting a single mp4 file in a format streamable means create a folder containing an m3u8 playlist file and many *.ts files indexed in that m3u8 playlist file, usually one each 10 seconds of the content to stream.To play this files you have to "pass" the m3u8 file to your player, and it will take care about retrieving each single "ts" file listed in the playlist.I can generate a signed url using jolly characters to get all the content of the folder, the "m3u8" file and all the "ts" files.But, to make the url safe i have to put an expiring time on it, let say 20 minutes.What happen when the player tryies to get the next ts file after the signed url has expired?i could intercept this event and generate a new url to replace the expired one but i don't think that videoplayer would like changing source while playing it.this is a really big problem.CommentShareRobertoanswered 4 months ago"


Question: How to hide the .user.ini file on Lightsail

I have a WordPress site hosted on Lightsail and one of my plugins called Wordfence scanned and reported that I need to hide .user.ini file to prevent a security breach. Can anyone help me with this issue? ThanksFollowComment

Answer: "0I think the problem can be solved by adding the following setting in .htaccess to prevent external access to .user.ini.<FilesMatch "^(\.user\.ini)">order allow,denydeny from all</FilesMatch>CommentShareEXPERTRiku_Kobayashianswered 23 days ago"


Question: Certificate Requests Stuck In Pending Validation

"Hi,I am trying to create a couple of new certificate requests in Certificate Manager since yesterday, but they all wind up stuck in the "Pending Validation" state when using DNS validation, although I do see the button that allows Certificate Manager to create the CNAME records in Route53 and I add those CNAMEs to my route53.What do I need to do to get the certificate validated?Thanks,GrazianoFollowComment"

Answer: "0I found the answer here https://forums.aws.amazon.com/thread.jspa?threadID=273734&tstart=0The Name Servers in my domain registrar didn't match the ones in route53, so used them instead and it worked.That's probably because the domain was transferred from an external provider into AWS, therefore the original Name Servers where different.CommentShareAkallabethanswered 4 years ago"


Question: "AWS Site-to-Site VPN tunnel is available, put cant ping to ec2 instance"

I spin up an EC2 instance in a public subnet on a /24. created a security group allowing SSH and ICMP from 0.0.0.0/0.Site-to-SIte VPN tunnel is up and running and using strongswan.However ping to the 169 address (inside tunnel) and to the ec2 instance does not workFollowComment

Answer: "0Hello,Have you tried disabling src/dst check on the Strongswan instance? refer below link:Disable source/destination checksCommentShareEXPERTTushar_Janswered a year agorePost-User-7944981 a year agoHello,Thank you for the response. The src/dst check has been disabled on the AWS ec2 instance. Need to that on Strongswan Instance as well. The Strongswan instance is an ubunto 20.04 linux vm that runs on-premises and does not have a gui.ShareTushar_J EXPERTa year agoWhat is the Flow for Example:  Ubuntu (On-prem) ---S2S VPN--- VGW --- VPC (EC2 in public subnet)?  See this KC article for troubleshooting steps: https://aws.amazon.com/premiumsupport/knowledge-center/vpn-cgw-vpg-traffic/Share"


Question: max. number of IP free ip per subnet for multiple ALB

"Understand that we need to reserve a max. of 8 free IP per subnet for the ALB/ELB/NLB as per https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-backend-instances.html.My questions is, if my customer have 10 ALB in the subnet, what is the max. of free ip that I need to reserve ? Is it still 8 or 80 ip addresses?FollowComment"

Answer: "0Accepted AnswerThis actually depends a lot on how big the ELBs might scale. Each ELB could use up more than 100 IPs (Private & Public), so if they have 8 ELBs that all are taking the maximum amount of traffic they will need 800+ IPs.When creating an ELB we check for 8 free IPs in each subnet to be used and won't let you create one without it. However, 8 is really the minimum we need for a single ELB to handle most workloads and failure cases safely.Best practice is to give ELBs their own subnet(s), either by making one large (/18 - /21) one per AZ or by making a new one (like a /25 or /26) for each ELB with.CommentShareEXPERTzobAWSanswered 5 years ago"


Question: Amazon conncet call quality issues

Can an auto answer cause call quality issues?FollowComment

Answer: "0No, auto answer or manual answer should have no impact on the call quality.davidCommentSharedmaciasanswered 23 days ago-1When a call is auto-answered, agents may not have the opportunity to screen the call or adjust audio settings to optimize call quality. This can lead to issues such as low volume, echoing, or dropped calls. Additionally, if there are multiple agents on the line or if the customer is using a low-quality headset or phone, this can further impact the call quality.CommentShareEXPERTsdtslmnanswered a month ago"


Question: My Desktop is empty

"Hello,I need help.All the icons and apps that were on my desktop on the server are gone, and now the screen is dark and I can't access any kind of settings to try to solve this problem.How do I restore the system so I can have access to my information again?Thank you for your attention!FollowComment"

Answer: "0If this is an EC2 instance running Windows, you can force a reboot through the AWS console.If this is an Amazon Workspaces instance, from the Workspaces Client, you can initiate a reboot by clicking "Amazon WorkSpaces" and choose "Restart Workspace". If that doesn't work, you can force a reboot from the AWS consoleCommentShareAaron Doddanswered 9 months agoLuis Voltolini 9 months agoHi,I reboot the instance and it started working again.ThanksShare0Hi,I reboot the instance and it started working again.ThanksCommentShareLuis Voltolinianswered 9 months ago"


Question: Can't create environment - Europe West

"Hi,Trying to launch an application, all default settings, Java platform, uploaded .zip file...  It just doesn't seem to be launching the instance or ever get any further than the log shown below...We tried launching in a different region - exact same steps - works without issue (developer's own account)The log below is for another try, default settings, but this time selecting the demo app...  It just seems to never get past the point of having to create the actual instances.2:46pmLaunched environment: LLBokun-env. However, there were issues during launch. See event log for details.2:46pmCreating Auto Scaling group named:awseb-e-xe3r2rem3x-stack-AWSEBAutoScalingGroup-1C2M5G5VA3XCY failed. Reason: Group did not stabilize. {current/minSize/maxSize} group size = {0/1/1}. Failed Scaling Activity: No default subnet for availability zone: 'eu-central-1c'. Launching EC2 instance failed.2:46pmStack named 'awseb-e-xe3r2rem3x-stack' aborted operation. Current state: 'CREATE_FAILED' Reason: The following resource(s) failed to create: AWSEBAutoScalingGroup.2:00pmEnvironment health has transitioned from Pending to Severe. Initialization in progress (running for 15 minutes). There are no instances.1:45pmEnvironment health has transitioned to Pending. Initialization in progress (running for 11 seconds). There are no instances.1:45pmCreated EIP: 52.28.99.1671:45pmCreated security group named:awseb-e-xe3r2rem3x-stack-AWSEBSecurityGroup-L25C6RXHWIZL1:44pmUsing elasticbeanstalk-eu-central-1-485314591840 as Amazon S3 storage bucket for environment data.1:44pmcreateEnvironment is starting.Help appreciated, thanks in advance!FollowComment"

Answer: "0For anyone else stumbling upon this, the problem (as per log) was that no default VPC existed.How to create a new default VPC:  https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/In my case, I create a new VPC with subnets/routing/etc and did custom config and places environment inside that VPCCommentShareRiaanOSFIanswered 4 years ago0Hello,As the error suggests, the environment failed to create mainly because the beanstalk was not able to find the default subnet in eu-central-1c. Usually such error occurs if you have not explicitly specified a custom VPC while creating the environment or if the default VPC has been deleted in the region.If we do not specify a custom VPC, beanstalk will by default, try to use the default VPC and subnets to launch the environment. Could you try recreating the default VPC and create a new EB environment:https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/CommentShareKaushikM-AWSanswered 4 years ago"


Question: MSK cluster timing out

"I reported this before: We try to migrate to MSK, but at the point where I have some low load on the cluster representing the idle state of our application with just a few messages per minute total coming from about 30 clients the MSK brokers just start to fail with timeouts.ARN of the cluster: arn:aws:kafka:eu-west-1:499577160181:cluster/eks-20190111-production-201902-20190708/6e3e6674-9c9b-40bb-98b4-506edf76a6b2-4Output from kafka-broker-api-versions:b-1.....kafka.eu-west-1.amazonaws.com:9092 (id: 1 rack: subnet-0e2b1a418025f9b10) -> ERROR: org.apache.kafka.common.errors.DisconnectExceptionb-3.....kafka.eu-west-1.amazonaws.com:9092 (id: 3 rack: subnet-000880b697986a0d8) -> ERROR: org.apache.kafka.common.errors.DisconnectExceptionb-2.....kafka.eu-west-1.amazonaws.com:9092 (id: 2 rack: subnet-0f50b40038ca2bf62) -> (Produce(0): 0 to 7 [usable: 7],Fetch(1): 0 to 10 [usable: 10],ListOffsets(2): 0 to 4 [usable: 4],Metadata(3): 0 to 7 [usable: 7],LeaderAndIsr(4): 0 to 1 [usable: 1],StopReplica(5): 0 [usable: 0],UpdateMetadata(6): 0 to 4 [usable: 4],ControlledShutdown(7): 0 to 1 [usable: 1],OffsetCommit(8): 0 to 6 [usable: 6],OffsetFetch(9): 0 to 5 [usable: 5],FindCoordinator(10): 0 to 2 [usable: 2],JoinGroup(11): 0 to 3 [usable: 3],Heartbeat(12): 0 to 2 [usable: 2],LeaveGroup(13): 0 to 2 [usable: 2],SyncGroup(14): 0 to 2 [usable: 2],DescribeGroups(15): 0 to 2 [usable: 2],ListGroups(16): 0 to 2 [usable: 2],SaslHandshake(17): 0 to 1 [usable: 1],ApiVersions(18): 0 to 2 [usable: 2],CreateTopics(19): 0 to 3 [usable: 3],DeleteTopics(20): 0 to 3 [usable: 3],DeleteRecords(21): 0 to 1 [usable: 1],InitProducerId(22): 0 to 1 [usable: 1],OffsetForLeaderEpoch(23): 0 to 2 [usable: 2],AddPartitionsToTxn(24): 0 to 1 [usable: 1],AddOffsetsToTxn(25): 0 to 1 [usable: 1],EndTxn(26): 0 to 1 [usable: 1],WriteTxnMarkers(27): 0 [usable: 0],TxnOffsetCommit(28): 0 to 2 [usable: 2],DescribeAcls(29): 0 to 1 [usable: 1],CreateAcls(30): 0 to 1 [usable: 1],DeleteAcls(31): 0 to 1 [usable: 1],DescribeConfigs(32): 0 to 2 [usable: 2],AlterConfigs(33): 0 to 1 [usable: 1],AlterReplicaLogDirs(34): 0 to 1 [usable: 1],DescribeLogDirs(35): 0 to 1 [usable: 1],SaslAuthenticate(36): 0 [usable: 0],CreatePartitions(37): 0 to 1 [usable: 1],CreateDelegationToken(38): 0 to 1 [usable: 1],RenewDelegationToken(39): 0 to 1 [usable: 1],ExpireDelegationToken(40): 0 to 1 [usable: 1],DescribeDelegationToken(41): 0 to 1 [usable: 1],DeleteGroups(42): 0 to 1 [usable: 1])I do not see anything particular in the CloudWatch metrics, except that network traffic went up when I started my services, and went down when presumably the timeouts started.FollowComment"

Answer: "0+1CommentShareronnyroeanswered 4 years ago0I restored our application to use our own self-hosted Kafka cluster (on shared t3.medium instances).It is now 12h later, and the MSK cluster was left to itself over night. It is still timing out on two of the three brokers.@AWS: I would have expected by now that at least your monitoring would have noticed an issue, and would have restarted the failing brokers. Please advise on how to proceed.b-2.….kafka.eu-west-1.amazonaws.com:9092 (id: 2 rack: subnet-0f50b40038ca2bf62) -> (Produce(0): 0 to 7 [usable: 7],Fetch(1): 0 to 10 [usable: 10],ListOffsets(2): 0 to 4 [usable: 4],Metadata(3): 0 to 7 [usable: 7],LeaderAndIsr(4): 0 to 1 [usable: 1],StopReplica(5): 0 [usable: 0],UpdateMetadata(6): 0 to 4 [usable: 4],ControlledShutdown(7): 0 to 1 [usable: 1],OffsetCommit(8): 0 to 6 [usable: 6],OffsetFetch(9): 0 to 5 [usable: 5],FindCoordinator(10): 0 to 2 [usable: 2],JoinGroup(11): 0 to 3 [usable: 3],Heartbeat(12): 0 to 2 [usable: 2],LeaveGroup(13): 0 to 2 [usable: 2],SyncGroup(14): 0 to 2 [usable: 2],DescribeGroups(15): 0 to 2 [usable: 2],ListGroups(16): 0 to 2 [usable: 2],SaslHandshake(17): 0 to 1 [usable: 1],ApiVersions(18): 0 to 2 [usable: 2],CreateTopics(19): 0 to 3 [usable: 3],DeleteTopics(20): 0 to 3 [usable: 3],DeleteRecords(21): 0 to 1 [usable: 1],InitProducerId(22): 0 to 1 [usable: 1],OffsetForLeaderEpoch(23): 0 to 2 [usable: 2],AddPartitionsToTxn(24): 0 to 1 [usable: 1],AddOffsetsToTxn(25): 0 to 1 [usable: 1],EndTxn(26): 0 to 1 [usable: 1],WriteTxnMarkers(27): 0 [usable: 0],TxnOffsetCommit(28): 0 to 2 [usable: 2],DescribeAcls(29): 0 to 1 [usable: 1],CreateAcls(30): 0 to 1 [usable: 1],DeleteAcls(31): 0 to 1 [usable: 1],DescribeConfigs(32): 0 to 2 [usable: 2],AlterConfigs(33): 0 to 1 [usable: 1],AlterReplicaLogDirs(34): 0 to 1 [usable: 1],DescribeLogDirs(35): 0 to 1 [usable: 1],SaslAuthenticate(36): 0 [usable: 0],CreatePartitions(37): 0 to 1 [usable: 1],CreateDelegationToken(38): 0 to 1 [usable: 1],RenewDelegationToken(39): 0 to 1 [usable: 1],ExpireDelegationToken(40): 0 to 1 [usable: 1],DescribeDelegationToken(41): 0 to 1 [usable: 1],DeleteGroups(42): 0 to 1 [usable: 1])b-1.….kafka.eu-west-1.amazonaws.com:9092 (id: 1 rack: subnet-0e2b1a418025f9b10) -> ERROR: org.apache.kafka.common.errors.DisconnectExceptionb-3.….kafka.eu-west-1.amazonaws.com:9092 (id: 3 rack: subnet-000880b697986a0d8) -> ERROR: org.apache.kafka.common.errors.DisconnectExceptionCommentShareankonanswered 4 years ago0Hi Ankon we are looking into this issue.  Did you cut a trouble ticket with our support team?CommentShareAWS-User-6643836answered 4 years ago0Yes, we have changed our support plan, and opened a support request.CommentShareankonanswered 4 years ago0I got a reply from AWS support now, esssentially saying:This is a known issue with Kafka 2.1.0, it’s a deadlock described in https://issues.apache.org/jira/browse/KAFKA-7697They claim that they do work-around that issue by restarting affected brokers (see https://forums.aws.amazon.com/thread.jspa?messageID=895763#895763)They suggest using 1.1.1 for production, and advise against using 2.1.0 in production.While they are investigating fix options including providing newer Kafka versions, there are no ETAs.I hope this helps anyone else reading through this forum.CommentShareankonanswered 4 years ago0Thanks for the follow up.  We are working on supporting 2.2.1 which does not have this known issue.CommentShareAWS-User-6643836answered 4 years ago0Kafka 2.2.1 support is live for new clustersCommentShareAWS-User-6643836answered 4 years ago"


Question: Capturing Application logs to Central log account CloudWatch using CWAgent

"Can you take a look at credentials section of config file?I am working on a configuration file to send logs to directly Cross account CloudWatch, there by to S3 to eliminate the maintanance of S3 buckets at each account level.I am following this documentation of AWS:https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-common-scenarios.html#CloudWatch-Agent-send-to-different-AWS-accountNormally without credentials section, logs were going to same account CloudWatch. But if I add credentials section and add related policies in the sender and receiver account, I couldn't see logs in receiver's CloudWatch.Config File:{  "agent": {    "credentials": {      "role_arn": "arn:aws:iam::512425977391:role/CWAgent-Receive-Role"    },    "metrics_collection_interval": 60,    "region": "us-east-1",    "debug": false  },  "logs": {    "logs_collected": {      "files": {        "collect_list": [          {            "file_path": "C:\\AppData\\*",            "log_group_name": "Server-1",            "log_stream_name": "{instance_id}",            "retention_in_days": 7          }        ]      }    }  }}IAM Policy at Sender Account is:Role Name: CWAgent-Send-Role{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "sts:AssumeRole"            ],            "Resource": [                "arn:aws:iam::512425977391:role/CWAgent-Receive-Role"            ]        }    ]}IAM Policy at Receiver Account is:(Which is added to trust relationship)Role Name: CWAgent-Receive-Role{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::166355562301:role/CWAgent-Send-Role"            },            "Action": "sts:AssumeRole"        }    ]}FollowComment"


Question: HIVE_UNSUPPORTED_FORMAT: Output format org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat with SerDe org.openx.data.jsonserde.JsonSerDe is not supported. If a data manifest file was generated

"HIVE_UNSUPPORTED_FORMAT: Output format org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat with SerDe org.openx.data.jsonserde.JsonSerDe is not supported. If a data manifest file was generated at 's3://athena-one-output-bucket/Unsaved/2022/11/24/0a5467bf-8b9a-4119-bc89-c891d1e26744-manifest.csv', you may need to manually clean the data from locations specified in the manifest. Athena will not delete data in your account.This query ran against the "covid_dataset" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 0a5467bf-8b9a-4119-bc89-c891d1e26744FollowComment"


Question: SSL certificate for transferred domain remains "Pending"

"Hi!I would like to have an SSL certificate for my domain that had been registered with Namecheap but has been transferred to AWS Route 53 a few days ago. I first followed this article and then this video but neither of those earned me a valid SSL certificate.On whois.com, I see that the nameservers for my domain are still those from Namecheap (at the time of me writing this). That might be important. Or not.This question seems to be equivalent to my situation but the answer has been archived and thus, I cannot access it.Can someone with higher powers than me please retrieve that (3-year old) answer and post it here? An up-to-date solution would be even better.Thanks a lot!FollowComment"

Answer: "2Accepted AnswerThank you for the detailed description.I assume that "transferred to AWS Route 53" refers to creating a Route 53 Hosted Zone [1], instead of transferring the domain from Namecheap to Route 53 [2]. In this case, you would find 4 name servers (NS) listed in the hosted zone, something similar to:ns-123.awsdns-11.comns-456.awsdns-22.co.ukns-789.awsdns-33.orgns-1010.awsdns-44.net(or refer to [3] to get the above NS)Now go to Namecheap, go to "CustomDNS", and put the above 4 hosted zones, with more details in https://www.namecheap.com/support/knowledgebase/article.aspx/767/10/how-to-change-dns-for-a-domain/.Give it some time (up to 24 hours) for the changes to propagate. If the assumption is incorrect or the issue persists, please feel free to provide additional information. Thank you.[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/MigratingDNS.html[2] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-transfer.html[3] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlCommentShareweidianswered 8 months agoEXPERTChris_Greviewed 8 months agoMatthias 8 months agoI did transfer the domain to AWS (via Route 53 > Registered domains > Transfer domain). The domain now shows up under Route 53 > Registered domains. Additionally, it does not show up anymore under Namecheap's "Domain List".As a consequence, the "CustomDNS" section is not available anymore on Namecheap. => Unfortunately, I cannot make the changes you have suggested.=> Assuming that your suggested procedure might now be available on the side of Route 53, I have added the Namecheap name servers – see whois – to my domain's NS record (those four that you mentioned are still there). However, the issue still remains.How can I proceed?Shareweidi 8 months agoThanks again for the details. I'm glad that you found a solution moving forward :)For the future reference, here's link to update NS record in AWS side https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.html#domain-name-servers-glue-records-adding-changingShare0Solved. I had transferred the domain from Namecheap to Route 53, and created a hosted zone with nameservers provided by AWS.However, I had not changed the nameservers of my domain. Updating them to those provided by the hosted zone resolved the issue.To my understanding, this is indeed the solution provided by @weidi, yet on the side of AWS instead of Namecheap.CommentShareMatthiasanswered 8 months ago"


Question: Constant creation of Test-env EC2 instance

"Subject: Constant creation of Test-env EC2 instanceDear AWS Support Team,I am writing to inquire about the constant creation of an EC2 instance named "Test-env" on my AWS account. I have noticed that this instance is being created automatically on a regular basis, without any action on my part.I would like to understand the reason for this behavior and how I can disable it, as it is causing unnecessary expenses for my account. I have checked my AWS account settings, but I could not find any option to disable this automatic creation.Could you please provide me with more information on why this instance is being created and how I can disable this feature? I would appreciate any guidance or support that you can offer.Thank you for your attention to this matter.Best regards,YevhenFollowComment"

Answer: "0Please check in the EC2 console under Autoscaling Groups (for the same region as your Test-env instance) to see if you have any configured.  You can also look at Test-env's Tags to see if it has been tagged as owned by an Autoscaling Group.CommentShareEXPERTskinsmananswered 2 months ago0In addition to the above answer, please sort out how did you create the instance.CloudFormation - there may be a code which constantly creates instanceElastic Beanstack - chances are ELB, or an autoscaling policy is interpreting your instance being shutdown as a crash, so it's creating a new one to replace it, i.e. doing what it is programmed to do.Spot Requests - even though you terminated the instance, the spot request would make a new one everytime the bid could be fulfilled.CommentSharerePost-User-7136343answered 2 months ago"


Question: Lightsail ssh/rdp browser - Log in failed CLIENT_UNAUTHORIZED [769]

"I have no clue, what to do - I can no longer log into my aws lighetsail ubuntu server. Where to start? Something to to with the region or my private key? I can't connect with putty either - like I did just days ago...FollowComment"

Answer: "0Evening all. Did all of the above on my Lightsail Ubuntu 22.04 instance but was STILL getting the client_unauthorized 769 error.I'm beginning to think this may have been an issue dating back from my upgrade from 20.04 --> 22.04, but a scheduled hardware outage on my service made me take a closer look.Did the following to get it back:SSH in via Putty and went to /etc/sshChecked SSHD was running viasystemctl status sshdAttempted to log in via Web Console SSH and received 769 errorRansystemctl status sshdagain found the status message:userauth_pubkey: key type ssh-rsa-cert-v01@openssh.com not in PubkeyAcceptedAlgorithms [preauth]Took a backup of /etc/ssh/sshd_config usingcp -a /etc/ssh/sshd_config /etc/ssh/BACKUP.sshd_configEditted sshd_config usingvi sshd_configUNCOMMENTED the line saying  PubkeyAuthentication yesImmediately after this line added a line saying: PubkeyAcceptedKeyTypes ssh-rsa,ssh-rsa-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-ed25519Saved the file using:wqRestarted sshd service using: systemctl restart sshdChecked it was running using systemctl status sshdAttempted to log via the web console AND WAS SuccessfulChecked the status again and saw the following message:Accepted publickey for ubuntu from xx.xxx.xxx.xx port 12807 ssh2: RSA-CERT etc. etc.CommentSharelloydtechanswered 8 months agoSlava a month agoThanx a lot, bro!Actually must be focused at 8.Share0I'm guessing you might have recently updated Ubuntu - I too was facing this issue and found the exact steps to fix it (comparing a lightsail instanced that was working)Step 1) Download the default keyStep 2) Connect using a terminal app with that keyStep 3) sudo nano /etc/ssh/sshd_configStep 4) Add  Include /etc/ssh/sshd_config.d/*.confI put it around line 10 - there is a gap there between a bunch of commented itemsStep 5) At the very bottom you should see TrustedUserCAKeys /etc/ssh/lightsail_instance_ca.pubAdd CASignatureAlgorithms +ssh-rsa on the next lineStep 6) Ctrl + X to save and exitStep 7) sudo service ssh restartThe web terminal should now workCommentShareSFLWAanswered 2 years ago0Thank you! Downloading the default key made it so that I could log in with Putty (after converting the pem-file to pkk), and I now have access to my server again. I did follow the guide, I cannot log inn trough ssh on web, but as long as I can log in with my ssh client I'm all good :)CommentShareJoachimSchraderanswered 2 years ago0OpenSSH versions 8.2 and later removed ssh-rsa from the list of algorithms accepted for certificate signatures, which is needed for Lightsail's browser-based SSH feature to work. If you recently manually upgraded your instance to Ubuntu 20.04, you can re-enable browser-based SSH by adding the following line to /etc/ssh/sshd_config:CASignatureAlgorithms +ssh-rsaThat change will have to be done using another SSH client, e.g. the ssh utility included with Linux systems or PuTTY in Windows.The above advice only applies if you manually upgraded your instance to Ubuntu 20.04. If you initially created the instance with the Ubuntu 20.04 blueprint provided by Lightsail, you do not need to apply this fix.Edited by: briant-aws on May 3, 2021 2:54 PMEdited by: briant-aws on May 3, 2021 3:05 PMCommentSharetanbriananswered 2 years ago"


Question: AWS VPN Client with fixed EIP for interfaces

"Since the AWS VPN Client interfaces are being recreated periodically, the attached EIP are released and new Public IP Address is assigned. How can we ensusre the interface always use the specific EIP for outgoing traffic from AWS VPN Client interface.FollowComment"

Answer: "0I see that you have a problem connecting to your AWS Client VPN service because the IP address associated with it is continuously changing,This is an expected behavior of the AWS VPN Client service, and as such, it is recommended that the customer uses the DNS provided by Amazon as stated in the Client VPN documentation under the limitations and rules section of the documentation found here: https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.htmlAdditionally, if you want to route out the traffic from the client network interface, you can create a NAT gateway inside the same VPC as the client interface, but in a public subnet. Similar scenarios and their recommended architecture can be found here: https://aws.amazon.com/blogs/networking-and-content-delivery/using-aws-client-vpn-to-scale-your-work-from-home-capacity/CommentShareAhmed_Manswered 10 months ago"


Question: Create cost anomaly subscription with percentage threshold with CloudFormation

"I'm trying to create "AWS::CE::AnomalySubscription" with percentage threshold (not dollars) but it fails with"Properties validation failed for resource CostAnomalySubscription with message: #: required key [Threshold] not found #: extraneous key [ThresholdExpression] is not permitted"ThresHold only allows dollar value, not percentage. I want to define percentage value.By looking at the documentation at https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ce-anomalysubscription.html it says that ThresholdExpression should be used and Threshold is deprecated.A snippet from my template in yaml:CostAnomalySubscription:Type: 'AWS::CE::AnomalySubscription'Properties:SubscriptionName: "MySubscription"ThresholdExpression:- '{ "Dimensions": { "Key": "ANOMALY_TOTAL_IMPACT_PERCENTAGE", "MatchOptions": [ "GREATER_THAN_OR_EQUAL" ], "Values": [ "10" ] } }'Frequency: "DAILY"MonitorArnList: [!Ref CostAnomalyServiceMonitor]Subscribers: [{"Type": "EMAIL","Address": "abc@def.com"}]To me it seems currently this is not possible using CloudFormation. When will it be? And how long it takes for AWS to NOT release anything until it's fully supported by CloudFormation or at least get the documentation right.From documentation:Threshold(deprecated)The dollar value that triggers a notification if the threshold is exceeded.This field has been deprecated. To specify a threshold, use ThresholdExpression. Continued use of Threshold will be treated as shorthand syntax for a ThresholdExpression.One of Threshold or ThresholdExpression is required for this resource.Required: YesType: DoubleUpdate requires: No interruptionFollowComment"

Answer: "0Accepted AnswerAWS::CE::AnomalySubscription resource doesn't support ThresholdExpression contrary to the document. AWS is working on it and, according to the CloudFormation coverage roadmap, the fix is coming soon.CommentShareTimo Tapanainenanswered 5 months agoAkiK 5 months agoThanks for pointing me to the roadmap and you are correct the fix for ThresholdExpressions seems to be coming "soon".Share"


Question: Where can I find additional logging related to OIDC flow in Cognito

"I am using Cognito with an Opensearch dashboard and am trying to integrate a client with OIDC.  The process starts ok the user is redirected to the IDP which forwards back to my Cognito instance with a code.  However, I then immediately receive,https://<cluster_domain>/_dashboards/app/home?error_description=Response+is+malformed.&state=<something>&error=invalid_requestI have validated that the token and user endpoints function manually, is there somewhere I can get more verbose details about this invalid request.FollowComment"

Answer: "0Hello,In regards to Cognito, I would like to shed some light on the logging capabilities ------ CloudTrail -----Amazon Cognito is integrated with AWS CloudTrailCloudTrail captures a subset of API calls for Amazon Cognito as events, including calls from the Amazon Cognito console and from code calls to the Amazon Cognito API operations.Please note though that the Hosted UI and federation calls are currently not included in CloudTrail.https://docs.aws.amazon.com/cognito/latest/developerguide/logging-using-cloudtrail.htmlIf you wanted to filter in CloudTrail a specific API call, you can use, for example, the 'EventName: ListUserPools' filter in the CloudTrail Event History console. You can also search for any API call made to your account's User Pools by using the 'Event Source: cognito-idp.amazonaws.com' filter. You can find a sample Cognito CloudTrail event log in reference here - https://docs.aws.amazon.com/cognito/latest/developerguide/logging-using-cloudtrail.html#understanding-amazon-cognito-entriesFurthermore, the CloudTrail service logs User Pool API calls that received a HTTP response from cognito-idp service. Requests that failed due to routing issues, TLS errors, or other client/server side issues are not logged in Cloudtrail.------ Advanced Security Feature -----The other option available in Cognito is "Advanced Security". This feature can be fully enabled or run only in audit mode which does not act on any events, but only logs login events which should allow you to see the login attempts. The "Audit Only" mode also publishes event statistics to CloudWatch. These login events are logged under each user profile which means they only log events for users who are in the system. So you will not be able to see events for non-existing users for example.https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-advanced-security.html------ OIDC -----In regards to OIDC work flow - https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-oidc-flow.html- Your user lands on the Amazon Cognito built-in sign-in page, and is offered the option to sign in through an OIDC IdP such as Salesforce.- Your user is redirected to the OIDC IdP's authorization endpoint.- After your user is authenticated, the OIDC IdP redirects to Amazon Cognito with an authorization code.- Amazon Cognito exchanges the authorization code with the OIDC IdP for an access token.- Amazon Cognito creates or updates the user account in your user pool.- Amazon Cognito issues your application bearer tokens, which might include identity, access, and refresh tokens.The external IdP flows logging can be best captured by HAR logs to check for any HTTP GET, POST and redirects (request and response parameters).https://aws.amazon.com/premiumsupport/knowledge-center/support-case-browser-har-file/Other than that if there are any authentication issues on the third party IdP side with credentials, you can try to query the log of that third party identity provider directly to check for any errors.----- Error at hand ------> error=invalid_requestThis would usually indicate an issue with the request parameters."If client_id and redirect_uri are valid, but the request parameters have other problems (for example, if response_type is not included; if code_challenge is supplied but code_challenge_method is not supplied; or if code_challenge_method is not 'S256'), the authentication server redirects the error to client's redirect_uri."HTTP 1.1 302 Found Location: https://client_redirect_uri?error=invalid_requesthttps://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html-> "is there somewhere I can get more verbose details about this invalid request."In this specific case, to answer your question, we require details that are non-public information related to your configurations to be able to troubleshoot your environment. Please open a support case with AWS using the following link - https://console.aws.amazon.com/support/home#/case/createCommentShareSUPPORT ENGINEERYash_Canswered a year ago"


Question: Webview2 Browser Control blocked by firewall

"I am unable to install an application (Tradestation) due to an error that Microsoft Edge Webview2 Browser Control is blocked by firewall. I have tried to install Microsoft Edge browser, webview2 control from Microsoft and also tried by disabling the firewall. However the issue is still not resolved.Please let me know if you have faced the similar scenario and the steps to address the issue.Thanks.FollowComment"


Question: AWS IAM Identity Center (SSO) - Assign Group to Organizational Unit

"Hi all,Working on an enterprise architecture/environment, having a huge number of AWS Accounts, We are facing some difficulties to assign Users/Groups to multiple-accounts.So I'm asking if there is a way to assign Users/Groups to the whole Organizational Unit instead of selecting multiple-accounts each time we need to give access to a new employee/developer ?Thanks alotPeterFollowComment"

Answer: "0As far as I know, we can't specify OU to assign AWS accounts to Users/Groups.You would be able to easily implement it by AWS CLI or SDK.If AWS CLI, the following commands help you.https://docs.aws.amazon.com/cli/latest/reference/organizations/list-accounts-for-parent.htmlhttps://docs.aws.amazon.com/cli/latest/reference/sso-admin/create-account-assignment.htmlCommentSharesuzukianswered 9 months ago"


Question: Revert to an image or snapshot on the same instance so you dont loose IP

"Hello, I changed the port for RDP and it now isn't letting me connect. I allowed it through the firewall and everything. I have done this successfully before. I must have done something wrong, stupid me.. Luckily I have I created an image before I did the change.So my question is: Is there a way to revert to an image or snapshot on the same instance so I don't lose the IP?Edited by: csneedhelp on Sep 20, 2020 2:49 PMFollowComment"

Answer: 0I just had to go into Security Groups and add in the new port.. Hah!CommentSharecsneedhelpanswered 3 years ago


Question: Athena permission denied on S3 path

"Hi everyone,I am creating a simple datalake with S3, Glue and Athena through Terraform (Infrastructure As A Code), which is managed by Lake Formation. I grant all the permissions in both IAM and Lake Formation needed for the workflow roles and also Athena users. However, from time to time (I deploy and destroy the infrastructure many times under dev environment)  I got an error when I try to query the glue tables in Athena: Permission denied on S3 path: s3://XXX/XX. This query ran against the "XXXX" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 0adbb706-4500-4c3b-8f0d-3174fa4e12b9. The error affects all the tables in the database when it occurs. When I redeploy the same code, the error might not occur at all. I searched on AWS and internet but has not found the reason and a solution. Has anyone encountered this error or known the reason ? Any solution for this problem?  By the way, I don't have KMS encryption yet just have S3-SSE turned on at this moment.Thank you very much in advance.FengFollowComment"

Answer: "0Accepted AnswerHello,Thanks for sharing the Query ID.When registering a Lake Formation path, we follow up by granting permissions to the path from "Data Locations" to the role that needs to access LF managed tables with locations that are registered.Looking at the S3 logs for the provided Athena Query ID, the authentication process is looking similar to when a location is registered with Lake Formation [1]. The process being as follows:A principal runs a SELECT query in Athena.Athena analyses the query and checks Lake Formation permissions to see if the principal has been granted access to the table and table columns.If the principal has access, Athena requests credentials from Lake Formation. If the principal does not have access, Athena issues an access denied error.Lake Formation issues credentials to Athena to use when reading data from Amazon S3, along with the list of allowed columns.Athena uses the Lake Formation temporary credentials to query the data from Amazon S3. After the query completes, Athena discards the credentials.Now, to answer your question - the error for the shared Query ID happened because of a missing s3:ListBucket permission from the Lake Formation end.Although, currently checking the Role that you are using, I could see that the Role being assumed by Athena (AWSServiceRoleForLakeFormationDataAccess) has permission for the S3 path (s3://xxxx-xxxxx-xxxx-xxx-us-east-1-123456789000/xxxxxx_xxxxx), so you should not be encountering this error at this very moment as I write this.Once you register your S3 bucket (xxxx-xxxxx-xxxx-xxx-us-east-1-123456789000) in Lake Formation, it updates your Role (AWSServiceRoleForLakeFormationDataAccess) with the missing permissions (s3:ListBucket in your case for the given Query ID) automatically.That being said, I would recommend that you check that the S3 bucket is getting registered appropriately, when you are doing a deployment through Terraform, so that you do not run into these errors again.References:[1] Using Athena to query data registered with AWS Lake Formation - https://docs.aws.amazon.com/athena/latest/ug/security-athena-lake-formation.htmlCommentShareSUPPORT ENGINEERNitin_Sanswered 4 months agoFeng Wang 4 months agoHi Nitin, Thanks for the quick answer and detailed explanation. As you pointed out, I don't see the error now after a few redeployment trials. I will pay attention to s3: ListBucket permission if the error occurs next time. One thing I don't understand is that since I did not see any error in terraform deployment and the terraform deployment should be very reproducible and stable, why missing permission issue could happen sometimes? It is caused by a  bug in terraform, or AWS lake formation or IAM services?   Thanks again.Share"


Question: ELB Rule if Host Header is not equal to

"I am looking to write a rule for ELB that redirects to a certain host, if the Host Header does not match that host. The use case is trying to access to the underlying site using the IP address and not the domain name.I have it working if I manually do if HOST HEADER = {IP ADDRESS} but this isn't ideal as any time a new network interface is created or IP address updated I will need to update the rules.Is there a way to do != in the value for host header?FollowComment"

Answer: "0HelloAs far as I know, there is NO possibility to use not equal in ALB rules, But there are some possible ways you can use it to work permanently.Possible solutions:You can Create a Lambda function that will trigger when new Network interface is created and update it in the ALB host headersYou can also use Lambda function as a target to your load balancer Thank YouGKCommentShareGKanswered a year ago"


Question: Transfer Family Custom Identity provider Authentication using API Gateway Cross Account

Is it possible to integrate a transfer family custom identity provider on account A with an API Gateway on Account B using IAM authorizer settings? And how to do it?FollowComment

Answer: "0Hello Danniel,AWS Transfer Family doesn't support cross account IdentityProvider setups. Therefore, you would be unable to use an API_Gateway in Account B for a Transfer server in Account A. Further, this is true for Lambda_IDP and DirectoryServices_IDP authentication types as well.I would suggest you submit a Feature Request to Transfer Family team by reaching out via AWS Support.-- SagarCommentShareEXPERTsagarb-awsanswered 8 months ago"


Question: Looking for guidance/documentation to migration Oracle Fusion Middleware applications from Oracle Cloud to AWS

"Hi, We are looking to migrate all our Oracle applications - Oracle Fusion Middleware, Oracle SOA Suite 12c, Oracle OBIEE 12c, Oracle OID, Oracle ODI etc and also Oracle databases (19c) from Oracle Cloud Infrastructure to AWS.  All of them are running on Oracle Linux 7.  We have terraform scripts used to deploy those infrastructure components.  We want to know if the same terraform scripts we used to deploy those infrastructure components into Oracle Cloud can be used to deploy/migrate to AWS or do we need to rewrite everything.  Anyone done anything like this and any documentation/guidance on this would be of great help.  If we can reuse the terraform script we used in Oracle Cloud with some modifications, is there any guidance on what/how to modify those terraform scripts.  Hope my question is clear, but any more clarification, please let us know.  ThanksFollowComment"

Answer: "0Hi, It is possible to migrate your Oracle applications - Oracle Fusion Middleware, Oracle SOA Suite 12c, Oracle OBIEE 12c, Oracle OID, Oracle ODI etc and also Oracle databases (19c) from Oracle Cloud Infrastructure to AWS. The terraform scripts may need modifications to use in AWS cloud. Here is a blog about running Oracle applications in AWS cloud - https://aws.amazon.com/blogs/apn/overview-of-oracle-e-business-suite-on-aws-a-new-whitepaper-now-available/Please contact your account team to discuss your requirements in detail.CommentShareSVanswered a year agoAWS-User-8243736 a year agoThank you for your reply. It's very useful and I read the whitepaper and it covers how to deploy Oracle EBS on to AWS.  Actually, my question is specifically about migration from Oracle Cloud to AWS. We have all the those applications and oracle databases running on Oracle Cloud and would like to migrate to AWS and wondering if there are any tools/guidance/documents available to helps us do the migration process smooth. ThanksShare"


Question: How to design a access pattern for products data management on Dynamodb (single table) with fine grained access control?

have some products and we want give access to employees to manage it (update)fine grained access control with cognito and IAM policyemployee id will be cognito user id(e#)use caseas on the table have 2 product and suppose we  want to give UpdateItem access for product p#1 to employee e#2our thoughtswe will copy the product (p#1) and create a new item on table with PK e#2 and SK p#1 so now a employee can query the products with his cognito user id (pk = userid(e#2) and sk = begins_with = p#)after work done we can copy the updated data (PK e#2  SK p#1) and put it on the products data (PK p#1  SK p#1) and remove from the employee access by deleting the item (PK e#2  SK p#1)Is it good practice or there any other way to access control with cognito authenticationFollowComment


Question: Need a recommendation for a webserver service

"I am not familiar with servers or webhosting and wanted a preconfigured server if possible.I want to setup and make the following work:A persistent windows-based webserver (mainly that won't block API calls) to test my html page's functionality as I make changes.I also want to run stable diffusion on the same server locally for testing so it will need a dedicated nVidia video card and least 20GB of storage space.Roughly 10gb for Stable Diffusion, and some space to temporarily store small video, image, and audio files that are being created and manipulated.I will be connecting on/off at night to work on the project and may have a few other developers occasionally logging in server side.  The usage of the website itself should be no more than 5 people at a time and any data used will be in small spurts.FollowComment"

Answer: "0Hi, @Nathan Trimble.I recommend using an IaaS compute instance such as Amazon EC2.Because your requirements are complex.In addition, Amazon WorkSpaces can be adopted for applications where multiple people connect and use it as a development client.I think most of your requirements can be covered with EC2 instances.Only some instance types support nVidia. (P4d, G4)https://www.nvidia.com/en-us/data-center/gpu-cloud-computing/amazon-web-services/However, these GPU instances are very expensive for normal scenarios.For development or staging use, I would also suggest dropping the requirements and picking something smaller.CommentShareEXPERTiwasaanswered 5 months ago"


Question: Data Migration from On-Prem Tape Archive

"Hi,Can I migrate data on tape archive on-prem to AWS using AWS Datasync? This is a complete migration, NOT extending your storage. The amount of data is 10TB with max 500KB file size, bandwidth 500Mbps. I know there is the option of Snowball but on this case I want to know more about Datasync. Once agent is installed on the on-prem VM, can it discover and read the tape storage with NFS protocol or further configuration are required to present the tape storage to the Datasync Agent?Thank you,Amanuel.FollowComment"

Answer: "0Amanuel,If I understand your question correctly it comes in two parts.Can you use DataSync to migrate data from your network to AWS S3, and probably one of the Glacier categories of storage.Can you use DataSync to discover and read the tape storage.For question #1, the answer is YES.  you can definitely setup an AWS DataSync agent on your network and attach to a NAS or File Server as a Mounted File System.  Data transferred to this File system will be automagically transferred to the Selected AWS Destination, to include a variety of S3 storage classes, EFS, FSx for windows or FSx for Lustre.For question #2, the answer is NO.For a Tape Backup system, you will need some software or utility to transform the data from the Tape backup to files, and then transfer the file data to the DataSync Mounted File System discussed in Question #1.I hope this helpsCamAmendment to respond to 3rd question.Aman,To address your additional question - as in most IT questions - it ‘depends’.10 TB is not THAT large, and your network bandwidth would accommodate direct transmission in a matter of hours during off-peak usage, so both options are viable in your use-case.AWS Snowball (and related services) provides a mechanism to migrate large quantities of data to AWS, especially when your ability to network to AWS is bandwidth constrained.If the intent is to migrate the tape data to AWS S3, but you are NOT seeking to replicate a Tape Library - just a data archive, then it makes sense to approach this with a DataSync Agent as a Mounted File on a dedicated server network connected to AWS.   To accomplish this, you will need an extraction utility to convert the Tape Library data into files.If you use AWS Snowball, you will still require an extraction utility to convert the Tape Library data into files on the AWS Snowball Appliance.Your Result?  A Collection of File-Objects in S3, probably utilizing one of the Glacier or Deep Archive S3 Services, depending upon business requirements.IF the intent is to replace the On-Prem Tape Library with an AWS Virtual Tape Library in AWS S3, then you would use Storage Gateway Tape Gateway, and it has a utility to transform existing Tape Libraries into its AWS S3 backed Virtual Tape Library.  You can convert this to an AWS Snowball Appliance with Storage Gateway, OR you can do this direct to a Storage Gateway Tape Gateway, Networked to AWS S3.Your Result?  An AWS S3 backed Virtual Tape Libraries leveraging Storage Gateway Tape Gateway, probably utilizing one of the Glacier or Deep Archive S3 Services as the backend storage.Again, i hope this makes sense and that it helps?CommentShareCamBeeleranswered 3 months agoAman 3 months agoGreat answer Cambeeler!For reason stated in the second question, does it make it preferable to use Snowball? For this case we have 10TB of data stored in tape library 500KB MAX file size can be transferred over 1Gbps utilizing 70-80% off-peak hours.Thank you.Share"


Question: "Use DCV gateway, but it is not logging into instance - Brings up CTRL-ALT-DELETE screen"

"I have (finally) got the DCV Gateway working, however it does not log in directly into the windows session.I have it going to the DCV Gateway --> DCV Server with external Authentication --> presents CTRL-ALT-DELETE screen instead of logging in directly.I have tried both HKEY_USERS\S-1-5-18\Software\GSettings\com\nicesoftware\dcv\security\authentication: system or noneIt is reaching the External Authentication server and responding with (username below is the OS account):<auth result='yes'><username>username</username></auth>Getting this in the log (sanitized host, users, ipaddresses):2022-06-09 18:15:26,518420 [  3556:3192  ] DEBUG frontend-handler - Incoming connection request message [(msg: 472)(bin: 0)(pad: 0)] from 10.10.10.10:554702022-06-09 18:15:26,518420 [  3556:3192  ] INFO  http-user-auth - Requesting token authentication for session console using verifier https://host/rest/dcv/auth2022-06-09 18:15:26,518420 [  3556:3192  ] DEBUG http-user-auth - Sending message2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG http-user-auth - Message sent to verifier https://host/rest/dcv/auth2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG http-user-auth - Content-length: 122, reading 122 bytes2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG http-user-auth - Auth result: yes2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG http-user-auth - Username: username2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG frontend-handler - Connection request from client 10.10.10.10:55470 has valid token (user: username)2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG usercredentials - No domain name to be converted2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG throttler - New connection for user username added, now 1 of 102022-06-09 18:15:26,643420 [  3556:3192  ] INFO  usercredentials - Cannot trigger credential provider without auth data2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  connection - Client Information for 10.10.10.10:55470: dcv web client/Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 (1.1.329), System: Win32 web (transport: websocket)2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG channel - Channel main (1, 000002A3DA440060) created for client 10.10.10.10:554702022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG main-channel - Sent connection confirm for session console to 10.10.10.10:554702022-06-09 18:15:26,643420 [  3556:3192  ] INFO  channel - Channel main (1, 000002A3DA440060) of connection 1 successfully established with client 10.10.10.10:554702022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG session - Connection 1 established, adding to session2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  session-manager - Client 1 (user: username) connected to session with ID console2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG session - New client 1 connected to session console2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG connection - Client connection 1 established2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG connection - Checking authorized channels of connection 1 for user 'username'2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  connection - Channel 'audio' authorized for user 'username': notifying channel.2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  main-channel - Send channel notification for channel audio to 10.10.10.10:55470 in session console2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  connection - Channel 'input' authorized for user 'username': notifying channel.2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  main-channel - Send channel notification for channel input to 10.10.10.10:55470 in session console2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  connection - Channel 'display' authorized for user 'username': notifying channel.2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  main-channel - Send channel notification for channel display to 10.10.10.10:55470 in session console2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  connection - Channel 'clipboard' authorized for user 'username': notifying channel.2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  main-channel - Send channel notification for channel clipboard to 10.10.10.10:55470 in session console2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  connection - Channel 'filestorage' not available for user 'username', backend not available.2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  connection - Channel 'redirection' authorized for user 'username': notifying channel.2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  main-channel - Send channel notification for channel redirection to 10.10.10.10:55470 in session console2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  connection - Channel 'usb' not available for user 'username', backend not available.2022-06-09 18:15:26,643420 [  3556:3192  ] INFO  connection - Channel 'smartcard' not available for user 'username', user not authorized.2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG main-channel - Starting main protocol for session console2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG main-channel - Sending to 10.10.10.10:55470 channel notification for channel input in session console2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG main-channel - Sending to 10.10.10.10:55470 channel notification for channel display in session console2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG main-channel - Sending to 10.10.10.10:55470 channel notification for channel audio in session console2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG main-channel - Sending to 10.10.10.10:55470 channel notification for channel clipboard in session console2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG main-channel - Sending to 10.10.10.10:55470 channel notification for channel redirection in session console2022-06-09 18:15:26,643420 [  3556:3192  ] DEBUG main-channel - Sending license updates notification for session console to main channel 000002A3DA4400602022-06-09 18:15:27,066446 [  3556:3192  ] DEBUG throttler - Available tokens 992022-06-09 18:15:27,066446 [  3556:3192  ] DEBUG throttler - Adding tokens, new available tokens number is 1002022-06-09 18:15:27,066446 [  3556:3192  ] DEBUG http-service - Incoming connection from 10.10.10.10:55474 (establish-timeout: 5 sec)2022-06-09 18:15:27,082046 [  3556:3192  ] DEBUG http-service - Checking headers for GET request (path: /ws) from client 10.10.10.102022-06-09 18:15:27,082046 [  3556:3192  ] DEBUG http-service - Websocket handler called2022-06-09 18:15:27,082046 [  3556:3192  ] DEBUG frontend-handler - Incoming connection request message [(msg: 328)(bin: 0)(pad: 0)] from 10.10.10.10:554742022-06-09 18:15:27,082046 [  3556:3192  ] DEBUG frontend-handler - Checking channel connection token with id 22022-06-09 18:15:27,082046 [  3556:3192  ] DEBUG auth-token - Checking claims: {"cid": "1", "sid": "console", "ch": "input"}2022-06-09 18:15:27,082046 [  3556:3192  ] DEBUG frontend-handler - Insert token 2 in the set of already spent tokens2022-06-09 18:15:27,082046 [  3556:3192  ] DEBUG frontend-handler - Channel connection request from client 10.10.10.10:55474 has valid token (channel: input)2022-06-09 18:15:27,082046 [  3556:3192  ] DEBUG channel - Channel input (2, 000002A3DA442080) created for client 10.10.10.10:554742022-06-09 18:15:27,082046 [  3556:3192  ] DEBUG DCV - Sent connection confirm to 10.10.10.10:554742022-06-09 18:15:27,082046 [  3556:3192  ] INFO  channel - Channel input (2, 000002A3DA442080) of connection 1 successfully established with client 10.10.10.10:554742022-06-09 18:15:27,082046 [  3556:3192  ] DEBUG connection - Data channel input for connection 1 is ready (000002A3DA442080)2022-06-09 18:15:27,082046 [  3556:3192  ] DEBUG connection - Data channel input connected for client connection 12022-06-09 18:15:27,082046 [  3556:3192  ] INFO  input - Client 10.10.10.10:55474 can handle input status updates. Session ID: console.FollowComment"

Answer: "0Hello! Are you using the DcvSimpleExternalAuthenticator that we provide [1] or did you implement your own? Have you modified the default.perm file [2] in C:\Program Files\NICE\DCV\Server\conf to use the keyboard-sas? Due to the nature of this issue I would suggest that you reach to us on a Support Case so that we can follow through and provide you with a solution.[1] Use External Authentication - https://docs.aws.amazon.com/dcv/latest/adminguide/external-authentication.html[2] Working with permissions files - https://docs.aws.amazon.com/dcv/latest/adminguide/security-authorization-file-create.htmlCommentShareSUPPORT ENGINEERFrancisco_Lanswered a year ago0Replies to your questions are below.I did submit a support case with NICE support directly (authors of DCV) and this is what they said surprisingly:> Unfortunately, automatic login on Windows using the Credential Provided is currently not supported when using the DCV external authenticator, and the DCV gateway currently requires an external authenticator to work. I filed a a feature request for this, here is the internal ticket number for you for reference/escalation: DCV-5617This kinda defeats the whole purpose with external authenticator.The documentation implies it should bypass the built-in winLogin process https://docs.aws.amazon.com/dcv/latest/adminguide/external-authentication.html. To me it seems like a bug not a feature request, but whatever.Without gateway/external authenticator, DCV web browser and DCV client can bypass the O/S login.I hope this get resolved quickly.Answers to your questions:[1] - I used my own authentication server[2] - Yes we have modified the permission file:%any% deny file-download file-upload smartcard printerusername allow builtinAnother feature request (related) to the permissions file:I would rather control the permissions through the response from the External Authentication instead of a file the user could change.Something like:<auth result="yes"><username>username</username><permissions><deny>file-download file-upload smartcard printer</deny><allow>builtin</allow></permissions></auth>CommentShareLtnSnoopyanswered a year ago"


Question: Amplify custom domain troubleshoot

"I add a custom domain for Amplify web host site, but I can't access my part. I use Route 53 nameservers for domain on GoDaddy.How long does it take before it works?FollowComment"


Question: Failed to Monitor Agent in Amazon Connect

I have enabled the Recording and analytics behavior option to monitor real-time and post-call analytics but when I try to monitor real-time metrics it shows me an error "Failed to monitor agent".FollowComment

Answer: "1Did you set the call recording for both agents and customer?davidCommentSharedmaciasanswered 5 months agorePost-User-1240951 5 months agoYes, I have set call recording for both agents and customer.Share1Can you walk through what you're doing when you try to monitor an agent? Are they actively on a call?davidCommentSharedmaciasanswered 5 months agorePost-User-1240951 5 months agoYes they are actively on a call.Share"


Question: Invalid Service in Action

"MSK has released a new feature. Basically, kafka client can authenticate and authorize using IAM. Link is below:https://aws.amazon.com/about-aws/whats-new/2021/05/introducing-iam-access-control-amazon-msk/I tried out this by following the official documentation,https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#configure-clients-for-iam-access-controlBut when I try to create policy in step 3 i.e. Create Authorization policies, I get the following errorInvalid Service In Action: The service kafka-cluster:Connect specified in the action does not exist.When I checked the IAM actions, resources and conditions for MSK from https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedstreamingforapachekafka.html, I could not see any actions for kafka-cluster.How can I use this new feature to authenticate and authorize kafka client using IAM Access Control?What am I doing wrong here?Any help would be highly appreciatedFollowComment"

Answer: "0Never mind, it turns out that the documentation needs to be updated.CommentShareMouzmaanswered 2 years ago0Can you copy/paste the documentation that needs to be updated?CommentShareAWS-User-5769575answered 2 years ago"


Question: PackedPolicSize limit varies from one AWS account to the other

"We have flows where we get make a call to STS GetFederatedToken APIs , pass a json session policy doc constraining access to S3 bucket for whoever uses the token or presigned url based off the token. We realize the policy size limit is 2048 characters. However, with one AWS account we are finding that the limit is 1024 characters. AWS doc says the limit is 2048 characters . Why this discrepancy?Error seen :Packed policy consumes 100% of allotted space, please use smaller policy. (Service: AWSSecurityTokenService; Status Code: 400; Error Code: PackedPolicyTooLarge; Request ID: cc5bc934-aab3-4783-b68b-33295aa7cdea; Proxy: null)FollowComment"

Answer: "0Hi,Generally, the "PackedPolicyTooLarge" error is returned when the size of session policies, session Tags and/or User info (such as a username passed via a NameID claim) is too large to fit the encoded session token blob. However, kindly note that the policy character limit is not the only criteria that returns this exception.There are mainly two restrictions on the limit of a policy where gets passed to STS. The first is, as mentioned, the length of the policy. You can receive this error even though you meet other defined session policy and session tag limits [1].In addition to this limit, there is another type called “PackedPolicySize”, which is a percentage value that indicates the size of the policy in packed form. With this said, please note that the service rejects any policy with a packed size greater than 100 percent, which means the policy exceeded the allowed space. As this value gets close to 100%, small changes to the policy may cause STS to reject your policy. For more information regarding the same, kindly refer to the following documentation [2].Note: An AWS conversion compresses the passed session policies and session tags into a packed binary format that has a separate limit. Your request can fail for this limit even if your plaintext meets the other requirements. The PackedPolicySize response element indicates by percentage how close the policies and tags for your request are to the upper size limit.References:[1] PackedPolicyTooLarge - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html#API_AssumeRole_Errors[2] PackedPolicyLimit - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.htmlCommentShareSUPPORT ENGINEERrePost-User-0230995answered 7 months agorePost-User-6806004 7 months agoDoes PackedPolicySize limit differ from one account to the other? Is this something you can request AWS to increase?In our tests what we are finding is that the request to STS works for one account and the exact same request (with exactly the same policy) does not work in another aws account? What could be causing this discrepancy?ShareLWfromAWS 7 months agoIt isn't set by account and is not a quota that can be adjusted. Whitespaces are characters used in the total calculation and to make sure that in all environments you're trying to assume the role from that all unnecessary whitespaces (tabs, new lines, spaces) are removed from the policy document. You can easily see whitespace charecters in cloudtrail logs for assumerole calls where a session policy was passed in.If you have support plan it would be valuable to to engage support here and have them assist you in comparing the different cloud trail logs from your AssumeRole calls.Share0We've since added a dedicated support doc for PackedPolicyTooLarge: https://repost.aws/knowledge-center/iam-role-aws-sts-errorTake a look.CommentShareLWfromAWSanswered 23 days ago"


Question: Amazon SES for personal email?

"I host my website using Lightsail and I was wondering if I can use Amazon SES for my personal email, is this the right service or should I look into other options?FollowComment"

Answer: "0Hi Sosadinho,While Amazon SES is capable of receiving email, it doesn't provide an IMAP server for incoming mail. This means that you can't use Amazon SES with an email client (such as Outlook or Thunderbird) to receive email.We do have a service called Amazon WorkMail, which offers a lot of the benefits of Amazon SES, but also includes more traditional email features. For example, it includes an IMAP server, as well as a web-based client. You can learn more at https://aws.amazon.com/workmail/.Thanks for using Amazon Web Services!Brent @ AWSCommentShareAWS-User-4207280answered 4 years ago0Hi Brent, Thank you!!By any chance, Do you know how many email aliases I can have per user account? I couldn't find that information on the features or user guide.Kind RegardsEdited by: Sosadinho on Apr 2, 2019 12:23 AMCommentShareSosadinhoanswered 4 years ago0Found the answer here...https://forums.aws.amazon.com/message.jspa?messageID=895941#895941CommentShareSosadinhoanswered 4 years ago"


Question: Can I not run Xen hypervisor in a bare-metal instance?

"Hi,I am trying to run my own Xen hypervisor in a bare-metal instance.I tried two things:Create a regular Linux bare-metal instance, and then build and install Xen from source code in the instance.Create a AMI containing Xen hypervisor from Virtualbox and import it to an AWS bare-metal instance.Both failed with status "1/2 checks passed".I am wondering what I missed.Thank you.FollowCommentAWS-User-1636653 a year agoIf your running it on my platform it's not ready yet . I need a IT department to clan the platform up . If your trying to help me please have at it . If not please contact Amazon IT department for me and tell them I need there help  .. I would greatly appreciate itShare"

Answer: 0I could use support bringing all my cloud to one platform.CommentShareAWS-User-1636653answered a year ago


Question: Unable to restore Aurora MySQL 5.7 snapshot into a Aurora MySQL 8 instance due to schema inconsistencies

"I have an Aurora MySQL 5.7 instance which I have snapshot. Then using that snapshot, I have tried to restore into an Aurora MySQL 8 instance. I encountered the below error.{            "id": "schemaInconsistencyCheck",            "title": "Schema inconsistencies resulting from file removal or corruption",            "status": "OK",            "description": "Error: Following tables show signs that either table datadir directory or frm file was removed/corrupted. Please check server logs, examine datadir to detect the issue and fix it before upgrade",            "detectedProblems": [                {                    "level": "Error",                    "dbObject": "mywebsite",                    "description": "present in INFORMATION_SCHEMA's INNODB_SYS_TABLES table but missing from TABLES table"                }            ]},This is due to an orphaned table called mywebsite/#sql-ib402-103581324 inside the INNODB_SYS_TABLES table which I have tried to drop like below:use mywebsite;drop table `#sql-ib402-103581324`;AND also trieduse mywebsite;drop table `#mysql50##sql-ib402-103581324`;Both times, I've gotten Unknown table error message.Can anyone help me out here?FollowComment"

Answer: "0HiI would suggest you to restore the snapshot in the same version and try upgrading the DB to the latest version in your case 8, Did you tried this ?Information from AWS docs:"During the upgrade process, all snapshot actions are disabled for this DB snapshot. Also, the DB snapshot status changes from available to upgrading, and then changes to active upon completion. If the DB snapshot can't be upgraded because of snapshot corruption issues, the status changes to unavailable. You can't recover the snapshot from this state.""NoteIf the DB snapshot upgrade fails, the snapshot is rolled back to the original state with the original version.Thank YouGKCommentShareGKanswered a year agoAWS-User-9702481 a year agoYes, I have tried. Upgrade failed.Share"


Question: ""Application is busy, please try again in a few minutes""

"when requesting ForgotPassword, using the Cognito's API I am getting this.No explanation, nothing.The same question was deleted from... everywhere!Any idea?FollowComment"

Answer: "0Hello,I understand that you are receiving the error "Application is busy, please try again in a few minutes." This error usually occurs whenever any API limit is reached. Explanations of quota requirements for Cognito, such as for categories like UserAuthentication and UserAccountRecovery are listed in the following link.https://docs.aws.amazon.com/cognito/latest/developerguide/limits.html#identify-quota-requirementsThere are several methods for optimizing quotas when dealing with a peak call rate:Retry the attempt after a back-off waiting periodUse an external database for frequently updated attributesValidate JWT tokens on the client sideThrottle traffic to your web application with a waiting roomPlease visit the link below for more on optimizing quotas.https://docs.aws.amazon.com/cognito/latest/developerguide/limits.html#optimize-quotasPlease note that there is a maximum number of user pool operations that you can perform in your account and only adjustable quotas can be increased. ForgotPassword has a default quota of 30 RPS and cannot be adjusted.However, these are recommended solutions for if an API limit is reached. One way to verify whether or not this is the case is through a HAR file. This file would have the necessary information to properly troubleshoot your issue. Although, it is not recommended to share this information over a public platform like re:post due to privacy and security concerns. Instead, please feel free to reach out to AWS Support for further assistance.https://console.aws.amazon.com/support/home#/case/create?issueType=technicalCommentShareNuzhat_Sanswered 10 months agoSUPPORT ENGINEERSumukhi_Previewed 10 months ago"


Question: using ingest-geoip or Nginx filebeat/metricbeat module on Amazon ElasticSearch

"I am trying to use the Nginx module for filebeat/metricbeat, which in turn seems to require ingest-geoip This is the error they got:Dec 03 08:37:45 ip-10-1-2-5 filebeat[30775]: 2020-12-03T08:37:45.077Z ERROR [publisher_pipeline_output] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://<OUR_AWS_ELK_INSTANCE>)): Connection marked as failed because the onConnect callback failed: Error loading pipeline for fileset nginx/access: This module requires the following Elasticsearch plugins: ingest-geoip. You can install them by running the following commands on all the Elasticsearch nodes:Dec 03 08:37:45 ip-10-1-2-5 filebeat[30775]: sudo bin/elasticsearch-plugin install ingest-geoipIs there a way to install ingest-geoip or any other workaround to use Nginix module for filebeat/metricbeat on ES?FollowComment"

Answer: "0Accepted AnswerAs of now Amazon Elasticsearch service does not have the ingest-geoip module built in. So, there are 2 ways you can tackle this error:Use logstash: In this method instead of sending data from Filebeat -> Elasticsearch, send it via logstash. You can do something like Filebeat -> Logstash -> Elasticsearch.In this case add the geoip filter in logstash and enrich the data for IP. A sample conf may look like:input {  beat { .. }}filter {    geoip {      source => "ip_field_name"    }}output {  elasticsearch { .. }}2) Skip the geoip parsing and just send the data to Elasticsearch. You won't get the geo details extracted, but you can still send the rest of data to Elasticsearch.For this go to your filebeat installation path, for example: filebeat-7.10.0-darwin-x86_64/module/nginx/access/ingest/pipeline.yml  and comment out or remove the section related to geoip.- geoip:    field: source.ip    target_field: source.geo    ignore_missing: true- geoip:    database_file: GeoLite2-ASN.mmdb    field: source.ip    target_field: source.as    properties:    - asn    - organization_name    ignore_missing: trueCommentSharePrashant Agrawalanswered 2 years ago"


Question: ALB Health Check

I recently migrated an IIS Dot net application (lift & shift) from on-premise to the cloud.How do I implement a health check (what should be the path pointing to?) for an IIS application in the Target Group? The target has 3 EC2 instances.FollowComment

Answer: "0Your Application Load Balancer periodically sends requests to its registered targets to test their status. These tests are called health checks.Each load balancer node routes requests only to the healthy targets in the enabled Availability Zones for the load balancer. Each load balancer node checks the health of each target, using the health check settings for the target groups with which the target is registered. After your target is registered, it must pass one health check to be considered healthy. After each health check is completed, the load balancer node closes the connection that was established for the health check.The load balancer sends a health check request to each registered target every HealthCheckIntervalSeconds seconds, using the specified port, protocol, and ping path. Each health check request is independent and the result lasts for the entire interval.Reference : https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.htmlCommentShareEXPERTAWS-User-Nitinanswered 4 months agorePost-User-9219791 4 months agoI am aware how ALB health check works. I am not sure how to implement health check for dot net application. The index page as path doesn't seem to work.Share"


Question: Upgrade PHP 7.4 to 8.1 on Lamp stack

"I'm using Lamp stack by bitnami as webserver on Lightsail and need to upgrade PHP from 7.4 to 8.* to work with Laravel 9.Although i followed a lot of instructions by bitnami, PHP 8 does not work.after all, "php -v" command says : 7.4 and "install php 8.*" command says : it is already installed.Any help would be appreciated.FollowComment"

Answer: "1AWS Lightsail's Bitnami LAMP Stack php version cannot be directly updated to php 8.0. It requires you to deploy a new stack with the latest version. However, LAMP stack with PHP version 8.* support is currently not available. This is still a feature request with our product team.CommentShareSUPPORT ENGINEERJeff_Banswered 8 months agoNima 7 months agoThanks for update, JeffThen, what is your approach or solution regarding this issue? should i migrate to EC2 or downgrade my Laravel to v8 ?Share"


Question: aws patch manager error

"when I scan my ec2 machine using aws patch manager, I am getting this error[ERROR]:Error loading entrance module.Traceback (most recent call last):File "/var/log/amazon/ssm/patch-baseline-operations/common_os_selector_methods.py", line 125, in _get_snapshot_infossm_client = client_selector.get_default_client(instance_id, region, "ssm")File "/var/log/amazon/ssm/patch-baseline-operations/patch_common/client_selector.py", line 61, in get_default_clientFollowComment"

Answer: "0The error you're encountering seems to be a problem with the Amazon SSM Agent or the Patch Manager script.Verify the Amazon SSM Agent version:sudo amazon-ssm-agent -versionVerify the instance IAM role: Ensure that your EC2 instance has the necessary IAM role and permissions to use Patch Managerif both does not work for youplease check the agent logs /var/log/amazon/ssm on your instanceCommentShareEXPERTsdtslmnanswered 2 months agoRam 2 months agoThanks ! everything is fine, error solved after run update commandShare0Hello,Please make sure that only one patch task is active on the instance at a time.This type of error generally occurs when multiple patch tasks are active on an instance.Hope this helps.CommentShareSUPPORT ENGINEERVinay_Sanswered 2 months ago"


Question: Increase Limit on Lineage Tracking entities for sagemaker

"My Team is trying to onboard to sagemaker lineage tracking entities and we basically track models, datasets, associations between these entities all the way to endpoints. Currently, we have been using another system for the same. We currently require that we create dataset entities prior to our training job so that we can use this to reference during our training jobs. The problem comes with the constraints on the amount of manual entities that can be created. As per the doc, the limits areMaximum number of manually created lineage entitiesActions: 3000Artifacts: 6000Associations: 6000Contexts: 500Our current system holds about 1500 datasets and 1000 models which means that we might hit the limit in the near future if we onboard to sagemaker. Is there a provision to increase the limits on these? I am not sure why these limits are placed. These entities must be pretty cheap to store. Please let me know if there is any way to get this limit increasedFollowComment"

Answer: "0You can double-check in the self-service AWS Service Quotas tool on your AWS account, but it looks to me like these quotas are not listed there (for now, at least)....So please raise a request via AWS Support from your account: Yes I believe there is flexibility in these quotas, but if you can include information in the request about projected requirements, usage pattern and the use case, that should help the team there assess the ask as quickly as possible.CommentShareEXPERTAlex_Tanswered a year ago"


Question: Cognito remember devices

"For a user pool under device tracking I have it set to user opt-in and allow users to bypass MFA for trusted devices set to yes. However I'm never presented with the option to remember my browser when I'm prompted to login. Also I notice that the cookies issued have no expiration and are per session. I want the option to remember browsers and cookies to remain persistent, what am I missing?FollowComment"

Answer: "0Hello m1systems,I understand that you are having difficulty getting your device to remember your credentials.A probable reason for this issue is that you have not enabled remember device functionPlease refer to this article and scroll down to the (Optional) Call UpdateDeviceStatus for detailed information:https://aws.amazon.com/premiumsupport/knowledge-center/cognito-user-pool-remembered-devices/The step you would want to complete would be the "If you choose User Opt In, then you must include an UpdateDeviceStatus API call."If you select User Opt-In, you can remember devices only when your application's users opt to do so. When a user signs in with a new device, the response from the request to initiate tracking indicates whether the user should be prompted about remembering their device. You must create the user interface to prompt users. If the user opts to have the device remembered, the device status is updated with a 'remembered' state.This documentation will explain how to complete the next task:https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html#amazon-cognito-user-pools-setting-up-remembered-devicesYou must also create the user interface to prompt users. If the user opts to have the device remembered, the device status is updated with a 'remembered' state.For your cookies to stay persistent, for hosted UI we don’t have mechanism to configure cookie settings but rather change default duration for access and ID tokenPlease let us know if you have any further questions. We are happy to assist you!CommentShareIssac_Aanswered 10 months agom1systems 10 months agoSo just to clarify there's no option to remember devices through the AWS hosted forms then?Share"