Question: How do I export data from one of my route 53 hosted zones and send the content to another Amazon account without any down time?

"I am currently managing a web domain in my Route 53 Amazon account. The client has now set up their own Route 53 account, and has asked me if I can reconfigure the setup I have done for them in my account and transfer the data to his Route 53 account in his brand new Amazon account.Thanks in advanceFollowComment"

Answer: "1HiYou can simply create a new hosted zone in the client's account and migrate the records.AWS Guide -> https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-migrating.htmlThe primary concern for downtime would be the time it takes to propagate the DNS records to use the new nameservers for the new hosted zone. However, this can be easily avoided by keeping the old hosted zone active until the DNS propagation is done.As the old zone is active even if the names servers are not updated to the new hosted zone end users will still be able to route to the relevant domains since records are still available in the old hosted zone.CommentShareBisinaanswered 10 days ago"


Question: How to receive IoT device simulator's data to AWS IoT core.

"I want to show data on Quicksight made by AWS IoT device simulator.[https://repost.aws/questions/QUeJmozwQnTWefA45Ti4aGjQ/canot-find-the-data-iot-simulator-generated]I don't know how to set IoT core in order to receive IoT device simulator's data.If anyone know handson or procedure about this, please let me know.FollowComment"

Answer: "0Accepted AnswerHi. Generally, you would use AWS IoT Rules to route the data to another service. In the blog I shared yesterday, it mentioned rules in the patterns, but didn't detail how to use them.This workshop walks you through how to build one possible pattern: https://iot-analytics.workshop.aws/CommentShareEXPERTGreg_Banswered a year agoTom177 a year agoThanks a lot again for very useful information.I think I will be able to run through reading workshop documents.ShareTom177 6 months agoHello Greg_B. I was able to see the document you taught me in June about handson how to show Device Simulator Data on Quicksightwhich URL washttps://iot-analytics.workshop.aws/2-streaming-workflow/1-iot-device-simulation.htmlbut now I cannot see the document.Was the URL address changed?I need to see the document.Would you show me the new URL or document place?ShareGreg_B EXPERT6 months agoHi Tom. Try this: https://catalog.us-east-1.prod.workshops.aws/workshops/0b80a6a3-a589-4745-9d60-33fee175ccf3/en-US/2-streaming-workflow/1-iot-device-simulationShareTom177 6 months agoGreg thank you very much and kind of you to notice me new URL. I was saved! I'll try again with this workshop document. Thank's again!Share"


Question: No further functionality after "eventType": "INITIATED" message while implementing Amazon Connect high-volume outbound communications

"I have just created Campaign in Connect with Contact flow, Then IAM policies, EventBridge and Pinpoint stuff with Creation of Segments & Journeys and in return i got the first event as "eventType": "INITIATED" with Type "VOICE".But then it stuck and nothing happen, it should dial a number using outbound queue as mention in the Documentation as below:{    "version": "0",    "id": "35af9eb2-5dda-fafc-48ce-78f223478a85",    "detail-type": "Amazon Connect Contact Event",    "source": "aws.connect",    "account": "XXX92XXX3XXX",    "time": "2022-05-31T08:21:52Z",    "region": "us-east-1",    "resources": [        "arn:aws:connect:us-east-1:XXX92XXX3XXX:instance/8XXXXXX9-1XXa-4XXf-bXXf-3XXXXXXXXX4",        "arn:aws:connect:us-east-1:XXX92XXX3XXX:instance/8XXXXXX9-1XXa-4XXf-bXXf-3XXXXXXXXX4/contact/7b552ed3-b276-42ea-9837-31f8622f4fde"    ],    "detail": {        "initiationTimestamp": "2022-05-31T08:21:52.769Z",        "contactId": "7b552ed3-b276-42ea-9837-31f8622f4fde",        "channel": "VOICE",        "instanceArn": "arn:aws:connect:us-east-1:XXX92XXX3XXX:instance/8XXXXXX9-1XXa-4XXf-bXXf-3XXXXXXXXX4",        "initiationMethod": "API",        "eventType": "INITIATED",        "campaign": {            "campaignId": "8b00b16f-b083-4a00-ae86-58332f524b2b"        }    }}In the end after the time ends it closed the journey with message "Message Not Sent".It should dial an outbound number at numbers added through segment and than return the events but somehow it doesn't working.In CSV segment file what format we have to used for phone number? e.g. General! when we add E.164 phone in CSV file and saved it, it throw an alert "some features in your workbook might be lost if you save it as csv UTF-8 (comma delimited)". May be its changing the format.FollowComment"

Answer: "0Hi Abdul.  When you triggered the call in the Journey, did you have an agent logged in and in Available status?  Also, be sure the agent you are using has the queue associated with the campaign in their routing profile.  I have had similar results when I logged in with the wrong test agent or if I was not in Available.CommentShareWagsanswered a year agoAbdul Qayyum a year agoyeah i have rechecked a dozen times, agent is logged in and in available state.Share0For First time while you are trying with HVOC Functionality. your call will not get triggered due to the limits associated to making HVOC with your Connect instance from Pinpoint is zero.  Raise the support ticket with AWS.Below are the some information they will ask you for HVOC.please can you kindly share with me the following information:1.) How many calls do you perform on a daily basis2.) What times of the day do you make your outbound calls3.) What countries are you seeking to call4.) Do you have your campaign list known ahead of the day or is it dynamic?5.) Is the call backed by an agent or is it fully automated?.CommentShareTEJA Kanswered 2 months ago"


Question: Amazon MQ RabbitMQ Support for Streams

When can we expect support for streams to be enabled for RabbitMQ?FollowComment

Answer: 0We are planning to support Streams in the future but we don't have a confirmed timeline. Please submit a feature request through your Account Manager or Technical Account Manager so we can track interest.CommentShareTrevor_Danswered 7 months ago


Question: Cross account access from Athena to S3

"Hi,I have a customer who has an S3 bucket in one account and wants to run Athena queries from a different account on data stored in the bucket.  They don't want to provide root account level access to that bucket. Is there is an easier way to have granular cross account permissions implemented, other then bucket policies?Could S3 Access Points be an option?ThanksFollowComment"

Answer: "0Accepted AnswerWith Lake formation, it is super easy to granting/manage centralize access to various AWS services which include Athena, RS-S, EMR, etc.In order to build cross account Data Lake -Grant access to your cross account bucket by following below dochttps://docs.aws.amazon.com/lake-formation/latest/dg/register-cross-account.htmlRegister your bucket in Lake formationCreate databaseGrant access to registered bucket and databaseCrawl you registered bucketStart granting access to different Personashttps://docs.aws.amazon.com/lake-formation/latest/dg/permissions-reference.htmlYou can follow below doc to learn how to build it.https://aws.amazon.com/blogs/big-data/access-and-manage-data-from-multiple-accounts-from-a-central-aws-lake-formation-account/CommentShareNavnit_Shuklaanswered 3 years ago"


Question: Unable to stop an instance

"Unable to stop an instance that had stop protection enabled. So while trying to change the stop protection, facing the below error."An error occurred while changing the stop protection setting of this instance."I have also enabled termination protection for this instance.FollowComment"

Answer: "0Hi.Normally, the error does not occur because the stop is not required to change the stop protection setting.What error do I get when I try to disable stop protection from the CLI?aws ec2 modify-instance-attribute --instance-id i-01234567890abc --no-disable-api-stopCommentShareEXPERTiwasaanswered a year ago0Hi,From the notes, I understand that you are unable to stop an instance that had Stop Protection enabled. You will need to ensure Stop Protection (and Termination Protection, if applicable) for this instance are disabled. To rule out any browser issues, you may use the AWS CLI as a workaround, with a user or role that can perform this action. See below CLI command:You can use the AWS CLI command below to validate the state of the instance:$ aws ec2 describe-instances --instance-id i-1234567890abcdef0To disable Stop Protection via the AWS CLI, use the command below:aws ec2 modify-instance-attribute --instance-id i-1234567890abcdef0 --no-disable-api-stopTo disable Termination Protection via the AWS CLI, use the command below:$ aws ec2 modify-instance-attribute --no-disable-api-termination --instance-id i-1234567890abcdef0For the above AWS CLI command,  you must use the latest version of AWS CLI Version 2, see link [1]. For disabling Stop Protection for an instance of your choosing, see link [2].Resources:-[1] https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html[2] https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-attribute.htmlCommentShareAsisiphoanswered a year ago"


Question: Storing Application Load Balancer access logs in a KMS-encrypted S3 bucket

"I was recently working on enabling Access Logs for my app's Application Load Balancer, and wanted to store those logs in an encrypted S3 bucket. It's trivial to do this using S3's own managed encryption, but I can't figure out how to get it working using KMS-managed encryption. I continue to get "Access Denied for bucket: (bucket). Please check S3bucket permission" in the ALB Edit Load Balancer Attributes page.I think that I need to grant the ELB service access to the KMS key so it can encrypt the log files before storing them in the bucket. I've tried modifying the Key policy to allow this but my attempts have been fruitless so far.Has anyone else managed to get this working, or does anyone know if is it supported?Edited by: cmeinschein on Feb 27, 2019 11:13 AMFollowComment"

Answer: "0Same probleme here.The CloudTrail event generated:{            "eventVersion": "1.05",            "userIdentity": {                "type": "AWSAccount",                "principalId": "AIDAIC3Q6OY7XTEX2MMHK",                "accountId": "156460612806"            },            "eventTime": "2019-05-13T08:33:37Z",            "eventSource": "s3.amazonaws.com",            "eventName": "PutObject",            "awsRegion": "eu-west-1",            "sourceIPAddress": "AWS Internal",            "userAgent": "[aws-internal/3 aws-sdk-java/1.11.526 Linux/4.9.137-0.1.ac.218.74.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.202-b08 java/1.8.0_202 vendor/Oracle_Corporation]",            "errorCode": "AccessDenied",            "errorMessage": "Access Denied",            "requestParameters": {                "bucketName": "logging-alpha-eu-west-1",                "Host": "logging-alpha-eu-west-1.s3-eu-west-1.amazonaws.com",                "x-amz-acl": "bucket-owner-full-control",                "key": "AWSLogs/000000000000/ELBAccessLogTestFile"            },            "responseElements": null,            "additionalEventData": {                "SignatureVersion": "SigV4",                "CipherSuite": "ECDHE-RSA-AES128-SHA",                "bytesTransferredIn": 0,                "AuthenticationMethod": "AuthHeader",                "x-amz-id-2": "xxxxxxxxxxx",                "bytesTransferredOut": 243            },            "requestID": "XXXXXX",            "eventID": "XXXXXXX",            "readOnly": false,            "resources": [                {                    "type": "AWS::S3::Object",                    "ARN": "arn:aws:s3:::logging-alpha-eu-west-1/AWSLogs/000000000000/ELBAccessLogTestFile"                },                {                    "accountId": "000000000000",                    "type": "AWS::S3::Bucket",                    "ARN": "arn:aws:s3:::logging-alpha-eu-west-1"                }            ],            "eventType": "AwsApiCall",            "recipientAccountId": "000000000000",            "sharedEventID": "xxxxxxxx"        }I've tried with the following statement on my KMS Key but it still does not work:{            "Effect": "Allow",            "Principal": {                "AWS": "*"            },            "Action": "*",            "Resource": "*"}If I change the bucket default encryption to the "AES256" encryption, everything is working great.BenoîtEdited by: bsauvere on May 13, 2019 2:03 AMCommentSharebsauvereanswered 4 years ago0Hi,storing ALB access logs in a S3 bucket with SSE-KMS encryption enabled is still not supported.To encrypt your access logs, you can enable server-side encryption with Amazon S3-managed encryption keys (SSE-S3):https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.htmlCommentShareAWS-User-3760894answered 4 years ago"


Question: AWS IoT  - Provisioning devices that don't have device certificates using fleet provisioning

"Hello,I have a couple of questions about the provisioning process by either trusted user or provisioning claim:If you do not want to put too much trust on the supplier, how would you provide it the ability to establish provisioning claim certificates so it can install them on the device during manufacturing?If the device is delivered and then being reset to factory settings - how the device can be recovered if the provisioning claim certificate is expired/revoked?If you choose to use the trusted-user approach, how would you connect to the device's local web server? More specifically how would you securely install TLS certificate for the device's local web server?If the IoT device is Greengrass (V2) would it make more sense to use HSM Key (e.g., USB A  Yubico) just to support secure re-bootstrapping of the device (so it can load all the initial secrets/certificates/ssm-activation codes)?FollowComment"

Answer: "1Accepted AnswerHi, yossico.We don't support HSM for fleet provisioning. Using our PKCS11 module, you can use just in time registration ("JITR"). Hope that works for your use case.These might help:https://docs.aws.amazon.com/greengrass/v2/developerguide/manual-installation.htmlhttps://docs.aws.amazon.com/iot/latest/developerguide/jit-provisioning.htmlhttps://aws.amazon.com/blogs/iot/setting-up-just-in-time-provisioning-with-aws-iot-core/CommentShareLihaoanswered a year ago"


Question: Elastic beanstalk Enhanced health not generating healthd/application.log files

"I have Enhanced health reporting turned on for my Elastic beanstalk environment. The environment  is:Multicontainer docker setup running in “Amazon Linux 2”It has an nginx proxy (Configuration > Software shows: Log streaming: disabled / Proxy server: nginx / Rotate logs: disabled / X-Ray daemon: disabled)Enhanced monitoring is on (Configuration > Monitoring shows: CloudWatch Custom Metrics-Environment: CloudWatch Custom Metrics-Instance: / Health event log streaming: disabled / Ignore HTTP 4xx: enabled / Ignore load balancer 4xx: disabled System: Enhanced)However, on the Health page, none of the requests, response, or latency fields are populating, while load & CPU utilization are populating. It is my understanding that this data is populated from a log file that is written to /var/log/nginx/healthd/, but that directory is empty. It seems like this is a bug or some sort of misconfiguration. Does anyone know why this might be happening?I included some relevant info from the machine below.The healthd config file (I commented out the group_id, which is a uuid in the actual file):$ cat /etc/healthd/config.yamlgroup_id: XXXXlog_to_file: trueendpoint: https://elasticbeanstalk-health.us-east-2.amazonaws.comappstat_log_path: /var/log/nginx/healthd/application.logappstat_unit: secappstat_timestamp_on: completionThe output of the healthd daemon log—showing warnings for not finding previous application.log.YYYY-MM-DD-HH files:$ head /var/log/healthd/daemon.log# Logfile created on 2022-04-02 21:02:22 +0000 by logger.rb/66358A, [2022-04-02T21:02:24.123304 #4122]   ANY -- : healthd daemon 1.0.6 initializedW, [2022-04-02T21:02:24.266469 #4122]  WARN -- : log file "/var/log/nginx/healthd/application.log.2022-04-02-21" does not existW, [2022-04-02T21:02:29.266806 #4122]  WARN -- : log file "/var/log/nginx/healthd/application.log.2022-04-02-21" does not existW, [2022-04-02T21:02:34.404332 #4122]  WARN -- : log file "/var/log/nginx/healthd/application.log.2022-04-02-21" does not existW, [2022-04-02T21:02:39.406846 #4122]  WARN -- : log file "/var/log/nginx/healthd/application.log.2022-04-02-21" does not existW, [2022-04-02T21:02:44.410108 #4122]  WARN -- : log file "/var/log/nginx/healthd/application.log.2022-04-02-21" does not existW, [2022-04-02T21:02:49.410342 #4122]  WARN -- : log file "/var/log/nginx/healthd/application.log.2022-04-02-21" does not existW, [2022-04-02T21:02:54.410611 #4122]  WARN -- : log file "/var/log/nginx/healthd/application.log.2022-04-02-21" does not existW, [2022-04-02T21:02:59.410860 #4122]  WARN -- : log file "/var/log/nginx/healthd/application.log.2022-04-02-21" does not existThe /var/logs/nginx/ directory with perms and ownership. Is nginx supposed to own healthd?$ ls -l /var/log/nginx/total 12-rw-r--r-- 1 root  root  11493 Apr  4 21:15 access.logdrwxr-xr-x 2 nginx nginx     6 Apr  2 21:01 healthddrwxr-xr-x 2 root  root      6 Apr  2 21:02 rotatedThe empty /var/logs/nginx/healthd/ directory:$ ls /var/log/nginx/healthd/# this directory is emptyFollowComment"

Answer: "0Accepted AnswerIt turns out that even though the Elastic Beanstalk web console is showing my setup as having an nginx proxy, for multicontainer docker + docker compose, it doesn’t use an Elastic Beanstalk proxy, so I needed to have my own nginx container report this information.There is helpful info in these:How to generally have container logs mounted properly: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/create_deploy_docker.container.console.html#docker-env-cfg.healthd-loggingHow to set up your own nginx to log in the right format: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/health-enhanced-serverlogs.html#health-enhanced-serverlogs.configureAfter all that I had my own nginx logging healthd info to NGINXDIR="/var/log/eb-docker/containers/nginx/healthd" and an empty directory HEALTHDDIR="/var/log/nginx/healthd", so I created an .ebextensions script that:Does mkdir -p "$NGINXDIR" && chmod 777 "$NGINXDIR" (would love to hear advice on a tighter perms and/or user/group owners for that directory)Sets up a symlinks in the HEALTHDDIR pointing to my NGINXDIR:      if [ -L "$HEALTHDDIR" ]; then        echo "is symlink: $HEALTHDDIR"      else        mv "$HEALTHDDIR" "$BACKUPDIR"        echo "moved $HEALTHDDIR to $BACKUPDIR"        ln -s "$NGINXDIR" "$HEALTHDDIR"        echo "linked $NGINXDIR to $HEALTHDDIR"      fiSeems to be working now and I’m now seeing data in the “Nxx Responses” and “PNN Latency” columns, which are reading from the last 10 seconds and updating regularly.CommentSharepetersprstanswered a year ago"


Question: CNAME for domain.com without www

"Hi!  I've been struggling with this issue and have been unable to find a solution.  Thanks for your help!My website url is www.domain.com - domain.com redirects to www.domain.com.Currently, I have 2 A records (one for domain.com and one for www.domain.com) both of which point to my server's IP address.I would like to stop specifying an IP address and instead use CNAME record(s) to point domain.com and www.domain.com to my server's CNAME.I was able to easily do this for www.domain.com but I'm unable to setup a CNAME for domain.com (without the www).What am I doing wrong?Is there another way to accomplish this without using 2 CNAMES?Thanks for your help!FollowComment"

Answer: "0Hi,That's a limitation of DNS. However, you can route traffic for domain.com and for www.domain.com to your resources without using IP addresses if you're using an AWS service that supports Route 53 alias resource record sets. For more information, see "Choosing Between Alias and Non-Alias Resource Record Sets" in the Amazon Route 53 Developer Guide:http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.htmlNote that if you're using an S3 bucket that's configured as a website endpoint, you need to create a second bucket and configure it as a redirector. This is explained in "Getting Started with Amazon Route 53":http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/getting-started.htmlScottCommentShareEXPERTAWS-User-6179575answered 6 years ago0Scott, thanks for your reply.  I'm a bit of a noob with this type of DNS configuration and I don't think I fully understand what the article is recommending I do.I have a cname setup for www.domain.com and it's working properly.I have an A recomrd setup for domain.com that points to an IP address.  It's working properly as well.I'd like to replace the A record for domain.com with a CNAME for domain.com.Can you walk me through what the settings should be for that?When I try to create a CNAME for domain.com, I'm unable to do because I need to give the CNAME a name i.e. "www".Thanks!CommentShareGabriel Silvermananswered 6 years ago0Hi,The short story is that you can't create a CNAME for domain.com because DNS forbids creating CNAME records at the root of a domain. Various DNS services offer workarounds; with Route 53, the workaround is to create an alias record. However, you can create an alias record only if the resource that you're routing your traffic to is a CloudFront distribution, an S3 bucket, an Elastic Beanstalk environment, or an ELB load balancer.You created a CNAME record to route traffic from www.domain.com to domain.com. Nothing more to do there.If you're using one of the resources listed above, you can create an alias record for domain.com. That saves you the trouble of specifying an IP address.If you're using another resource, such as a web server running on an EC2 instance, you need to specify an IP address somewhere so Route 53 knows what IP address to return in response to DNS queries for www.domain.com and domain.com. That's the A record that you currently have for domain.com. Everything is working properly, so you're done. :-)ScottCommentShareEXPERTAWS-User-6179575answered 6 years ago"


Question: Using Textract for extracting long form text in FORMs mode

"We have a set of documents that contain question and answer sections like "Enter Statement of Interest Below" that are followed by an area for users to enter in long form text. When we have run a few of these documents through textract, we have found that depending on the formatting of the responses textract has a difficult time recognizing these fields as key value pairs.For example, if the value for one of these fields has one sentence of text per line (contained within the box allotted for text entry) only the first line is associated with the sections question (key value pair). Another quirk we found is that if a large block of text has been copied and pasted into the text entry block, then textract does not even recognize it as a key value. However, we were able to use queries that contained the full text of the "key" field as the query value (Enter Statement of Interest Below) the expected text was extracted but this was hit or miss at times based on the formatting of the long form text.We are wondering if this is result due to the formatting of the input documents or a quirk of textract itself.You can find a copy of the input document here.FollowComment"

Answer: "1Hello,Thanks for using AWS Textract service. Ideally, Textract form option is used for key-value pair detection of words up to a few sentences[1]. I believe the current requirement is for a long paragraph here under value. We would need sample filled forms for analysis as Textract service is a fully managed service and pre-trained models are used for OCR services based on the requirement.Regarding the text not being recognized, there are multiple possible scenarios ranging from DPI of the image to the language[2]. Please go through them and I would also suggest to reach out to AWS Support[3] (Textract), along with your issue/use case in detail and sample documents. We will troubleshoot accordingly by including the service team for suggestions on your exact requirement.[1] https://docs.aws.amazon.com/textract/latest/dg/how-it-works-kvp.html[2] https://docs.aws.amazon.com/textract/latest/dg/textract-best-practices.html[3] https://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-casehttps://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-caseCommentShareSUPPORT ENGINEERRakeshanswered 5 months ago"


Question: "ApiGateway WebSockets - Are the responses sentby integration response route, guaranteed to be in same order than the sent messages?"

"Hi,I try to get a way to verify if my messages were properly handled by ApiGatwayso that i can resend them if a connectiontimeout is triggered.as overriding requestId may not be possible with ApiGateway WebSockets (i posted another question related to that)i thought that relying on order of messages could help.As i already have a ApiGateway response route,sent by service response (i use SQS behin websocket api) i wondered if the order of the responses is guaranteed to be the same thanthe order of sent messages?If not, what is the recommended way of handling send retries when a connection timeout triggers, or even if an unexpected close event triggers.ThanksSebFollowComment"

Answer: "0If you call the postToConnection API multiple times, there is not guarantee that the messages will get to the client in the same order. If order is important, do not send the second message until you get an ack on the first message.CommentShareEXPERTUrianswered 15 days agorePost-User-0857877 15 days agoThanks, but i was not thinking about postToConnection  api, but more the integration reponse from ApiGateway. Maybe it uses same api in background?ShareUri EXPERT13 days agoSorry, my bad. I thought you were referring to messages send by the backend.If you get two messages and send these messages to the integration for processing, and they return a response, which API GW should send back to the client, you have no control in which order the client messages will be processed, so you don't know in which order the responses will arrive back to API Gateway.Bottom line, you can't rely on message ordering for the responses.Share"


Question: connecting via ssh to wordpress ami

"Hello, I recently created an EC2 instance with installed the wordpress AMI, by bitnami. I need to know if it is somehow possible to connect to the server console. Because for now I tried to connect using the serial console but it always tells me that there is an error. As you will surely notice, an operating system like Ubuntu is not installed on the server, but rather the wordpress ami. So I need to know if there is a way to connect via ssh to that server or not.Thanks in advanceFollowComment"

Answer: "3as you can see from the linkhttps://bitnami.com/stack/wordpress/cloud/aws/amisWordpress AMI s are based on Debianand while creating app you can select security rules that who can connect with SSH to the imageSo review NSG first before connecting with SSH then follow these steps to connecthttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.htmlCommentShareEXPERTsdtslmnanswered a month ago3Can you connect with certificate not passwordPlease followhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/putty.htmlCommentShareEXPERTsdtslmnanswered a month ago0yes, the ami is https://aws.amazon.com/marketplace/pp/prodview-bzstv3wbn5wkq?sr=0-1&ref_=beagle&applicationId=AWS-EC2-Console but when trying to connect via dashboard I get this:Furthermore, I can't connect via putty for example because I don't have the instance passwordCommentSharerePost-User-5518076answered a month agosdtslmn EXPERTa month agoCan you connect with certificate not passwordPlease followhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/putty.htmlShare0Are the following AMIs used?If so, I think SSH is possible since you are using Debian 11.https://aws.amazon.com/marketplace/pp/prodview-bzstv3wbn5wkq?sr=0-1&ref_=beagle&applicationId=AWS-EC2-ConsoleYou have probably set up a key pair when you created EC2, so SSH using that key pair.SSH is possible using the methods in the following document.Also, configure the inbound rules of the EC2 security group to allow SSH.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.htmlCommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: Windows Activation failed in EC2 instance

"I am using Windows Server 2019 Datacenter in EC2 Instance. Now I received the following error:"We can't activate Windows on this device as we can’t connect to your organization's activation server. Make sure you're connected to your organization's network and try again. If you continue having problems with activation, contact your organization's support person. Error code: ‘OxC004F074"For your kind reference, I also attached the image for the same.Kindly help me to activate the windows.FollowComment"

Answer: "1Hi - Please see if this troubleshooting guide helps https://aws.amazon.com/premiumsupport/knowledge-center/windows-activation-fails/CommentShareEXPERTAWS-User-Nitinanswered 4 months agoVignesh D 4 months agoDear Nitin, I Tried this "Manual Mode" but it did not work for me. I got the same error after running "slmgr /ato" commandShare"


Question: What are EFS files starting with .nfs?

"I'm trying to debug a file-based PHP CMS that is continuously trying to write a file, but failing. I saw the following:-rw-r--r-- 1 webapp webapp  87717 Aug  2 09:01 response.cache-rw-r--r-- 1 webapp webapp 167700 Aug  2 09:57 .nfs3bb62bc5d551a49f0000000cThere's the old file response.cache and a file starting with ".nfs" that contains updated content. My guess is that EFS is in the process of writing the file while other instances of the PHP script try to read/write it. In any case, it appears to be a part of the issue.What is that file?FollowComment"

Answer: "1Accepted AnswerHi dodov,In Linux running over NFS, .nfs files are created when a file opened on a client is deleted from the file system while still opened. The client renames the file to a fairly long string like you're seeing in order to discourage other clients or processes from using the file.Usually you can find out what process is causing using the lsof command, in this case:lsof .nfs3bb62bc5d551a49f0000000cThis will output the process that is working with the file, and if necessary, you can then kill said process.CommentShareJack Hemionanswered 10 months agododov 10 months agoSo this is a Linux feature, rather than an EFS feature? What doesn't make sense to me is that in my case, files were never deleted (to my knowledge, at least). They were only read and written rapidly. Is there another reason why .nfs files could appear? Do you know of any documentation on the matter?Share"


Question: AWS Distributed Load test

"Hi , I was testing Distributed load test . I am also having an autoscaling group with an ALB, which was set to scale out in case of CPU utilization of 60 %.After the test, the CPU utilization reached 10% and the web page of my EC2 instance started giving 5XX errors, so the ALB saw the machine as unhealthy. Accordingly the autoscaling group deleted this machine and created a new one.This should not have happened. As when we try to access the ec2 web page directly without the ALB during the 10% CPU utilization it is working fine. but from the ALB DNS name it is giving us the 5XX errorsCan someone please help explain why this is happening and what should be edited in the distributed load test ?FollowComment"

Answer: "0Hello,Do you have logs from the ALB and also logs from the application/web servers that run inside the EC2 ? I think analyzing the logs (both from ALB and from apps) will help paint a clearer picture of what happened. The CPU load might be ok, but there could be issues on other component, ex: memory, disk I/O, or even application configuration. It happened to me once, and it turned out I wrongly set up my application's concurrency, and it was clearly shown in my application logs.CommentShareFrankanswered 5 months ago"


Question: Can I specify the python version?

"Can I, in the command line, switch the python version 'on the fly'? Or specify the path to the interpreter. unlinking and linking python versions could break other things. If I "ln -s python3.6 /usr/bin/python" it works. if it is "ln -s python2 /usr/bin/python" it don't work.FollowComment"

Answer: 0If you have a Python file (say utility.py) you can run it from the command line by specifying which Python interpreter: python3.6 utility.py or python3 utility.py.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: VITIS HLS GUI often crashes with NICE DCV

"Hi. This is a follow-up to post https://forums.aws.amazon.com/thread.jspa?messageID=990108&#990108.I successfully installed NICE DCV for FPGA development using the guide (https://github.com/aws/aws-fpga/blob/master/developer_resources/DCV.md), and was able to launch vitis_hls (GUI) in my web browser.The problem is that vitis_hls crashes very often (about every 10 minutes), with the error message on the upper right corner:"A Problem has OccurredA problem in the gnome-terminal-3.28.2-3.el7 package has been det..."and this error message goes away about 5 seconds later. (I am not sure how to view more detailed message...)I first thought it was due to lack of memory in m5.xlarge, so I switched to m5.2xlarge, but the problem persists.I also checked the problem exists in both N. California and Seoul AWS server as well.I also did some quick search on AWS Forum - nothing comes up.Could anyone help me with this?FollowComment"

Answer: "0Hi Young,Is there a 'solution' folder created by vitis_hls? One way to check if it's an issue with the GUI is to run vitis_hls in command line mode.The folder might have a script.tcl file and running it successfully on the command line might show an issue with either the tool or the Gnome GUI.To run manually:vitis_hls -f script.tclAnother thing to check: does /var/log/messages show any errors worth looking at on the OS side that could cause such a crash?Let me know if this doesn't help.-DeepCommentShareDeep_Panswered 2 years ago0Thanks so much for looking into the problem.Launching from the command line is working fine - it appears to be a GUI problem.Here is /var/log/messages. Should I adjust the resolution of DCV before launching Vitis HLS?==========================================================org.gnome.Shell.desktop: Window manager warning: Window 0x2800003 (java) sets an MWM hint indicating it isn't resizable, but sets min size 397 x 299 and max size 2147483647 x 2147483647; this doesn't make much sense.org.gnome.Shell.desktop: Window manager warning: Buggy client sent a _NET_ACTIVE_WINDOW message with a timestamp of 0 for 0x2800003 (java)kernel: gnome-terminal-[6106]: segfault at 24b7c ip 00007fa6ea579570 sp 00007ffd202d50b0 error 4 in ld-2.17.so[7fa6ea570000+22000]abrt-hook-ccpp: Process 6106 (gnome-terminal-server) of user 1000 killed by SIGSEGV - dumping coreabrt-server: Generating core_backtraceabrt-server: Duplicate: core backtraceabrt-server: DUP_OF_DIR: /var/spool/abrt/ccpp-2021-07-15-05:56:28-7671abrt-server: Deleting problem directory ccpp-2021-07-16-09:39:49-6106 (dup of ccpp-2021-07-15-05:56:28-7671)abrt-applet.desktop: abrt-applet: repeated problem in gnome-terminal-3.28.2-3.el7, not showing the notificationabrt-server: Email address of sender was not specified. Would you like to do so now? If not, 'user@localhost' is to be used [y/N]abrt-server: Email address of receiver was not specified. Would you like to do so now? If not, 'root@localhost' is to be used [y/N]abrt-server: Sending an email...abrt-server: Sending a notification email to: root@localhostabrt-server: Email was sent to: root@localhostsystemd: Created slice User Slice of root.systemd: Started Session 2 of user root.systemd: Removed slice User Slice of root.dbus[850]: [system] Activating service name='org.freedesktop.problems' (using servicehelper)dbus[850]: [system] Successfully activated service 'org.freedesktop.problems'kernel: gnome-terminal-[6974]: segfault at 2427c ip 00007f154af78570 sp 00007fffe7193f70 error 4 in ld-2.17.so[7f154af6f000+22000]abrt-hook-ccpp: Process 6974 (gnome-terminal-server) of user 1000 killed by SIGSEGV - dumping coreabrt-server: Generating core_backtraceabrt-server: Email address of sender was not specified. Would you like to do so now? If not, 'user@localhost' is to be used [y/N]abrt-server: Email address of receiver was not specified. Would you like to do so now? If not, 'root@localhost' is to be used [y/N]abrt-server: Sending an email...abrt-server: Sending a notification email to: root@localhostabrt-server: Email was sent to: root@localhostCommentShareYoungChoianswered 2 years ago0Hi Young,I'm not sure if this is an issue with the Gnome terminal server or if it is an actual issue related to the Xilinx tool.I can suggest trying a different desktop manager with a different terminal emulator.sudo yum --enablerepo=epel -y groups install "MATE Desktop"sudo bash -c 'echo PREFERRED=/usr/bin/mate-session > /etc/sysconfig/desktop'echo "/usr/bin/mate-session" > ~/.Xclients && chmod +x ~/.Xclients#Reboot after this stepsudo systemctl start dcvserversudo dcv create-session --name my-session --user centos --owner centos my-sessionYou should be able to use the mate terminal after this and try it out.Let me know if that also causes this issue.-DeepCommentShareDeep_Panswered 2 years ago"


Question: Can't access my lightsail system using aws load balancer. Health check 303.

"Hi all,Problem description:For testing purpose, I have a system with 2 lightsail instances connecting to a separated database. I set a port so that the each instance can be accessed via that port without any problem. Let's say the port is 1010. The 2 instances can be accessed using <IP>:1010 without any problem.Now I want to access the whole lightsail system with a AWS load balancer via the 1010 port when connecting to one of them. And then I face a problem after doing the below steps:I set up target group by using private IP of the 2 lightsail instances, with protocol = HTTP and Port = 1010I set up a new security group to accept all traffic and all ip4 destinationIn the "Listeners and routing" section, I add a record Protocol = HTTP, Port = 1010, target group = the created target groupBut end up I fail to connect to my lightsail system. After some study, I found there is a error in my Target: Health Status = unhealthy, Health status details = Health checks failed with these codes: [303]The weird part is individual server can be accessed very well, but not the case when connecting to load balancer.My question is, are there any mistakes in my AWS settings causing this problem? If yes, hope I can get some hints to solve this.A little bit long. Thank you.FollowComment"

Answer: "0it appears that the health check of the target group is failing, which is resulting in the "unhealthy" status. The health check failure code 303 suggests that the HTTP request to the target is being redirected to a different location.Here are a few things you can check:Health check settings: Make sure that the health check settings in the target group are configured correctly. Check the protocol, port, and path of the health check to ensure that they match the settings of your application.Security group settings: Ensure that the security group of the instances allows traffic from the load balancer. Also, make sure that the security group of the load balancer allows traffic to the instances.Application configuration: Verify that your application is configured to respond to requests from the load balancer. Ensure that the application is listening on the correct port and is not redirecting the requests to a different location.Network settings: Check the network configuration of the instances to ensure that they can receive traffic from the load balancer. Make sure that the instances are not blocking traffic from the load balancer by using a firewall or other network security settings.I hope these hints help you to identify and resolve the issue.CommentShareFrank Idugboeanswered a month ago0You'll need to enable VPC peering between your AWS account default VPC and Lightsail.See: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-set-up-vpc-peering-with-aws-resourcesI was able to create an application load balancer in my account that has a target group with "IP" target type. I needed to register IP addresses of my Lightsail instances using a command like this:aws elbv2 register-targets --target-group-arn TARGET_GROUP_ARN \   --targets Id=PRIVATE_IP1,AvailabilityZone=all Id=PRIVATE_IP2,AvailabilityZone=allThe load balancer must be in your default VPC so that it can peer with the resources in the Lightsail VPC.In each Lightsail instance's firewall settings, you will need to allow TCP traffic on port 1010 from your default VPC's CIDR (e.g. 172.31.0.0/16,  but actual value of this CIDR can be found in VPC console for your default VPC)In the command above, you will need to specify TARGET_GROUP_ARN, PRIVATE_IP1 and PRIVATE_IP2 which are the private ip addresses of your two Lightsail instances.More details can be found here: https://repost.aws/knowledge-center/lightsail-add-application-load-balancerCommentSharePavel - AWSanswered a month ago"


Question: EC2 no longer reachable via SSH or HTTP

"I have an EC2 instance that is no longer reachable.I was setting up a CAS (Central Authentication Server) Client for SSO. But was getting a Port Occupied error in the validation tests during the maven build.So I was using lsof and ufw to check and open ports so see if I could fix itI then moved to the EC2 Security Group tab in the console to see if the port was being blocked there.After trying several thingsI wondered if I had needed to restart the EC2 instance for the changes to takeand upon doing so, by rebooting from the console, the instance became unreachable.I attempted to undo what I had done in the Security Group. But no luck and including a restart.Since the EC2 had an ELB that it was registered to and some googling revealed that it might be the issue. I tried unregistering and reregistering the instance and just removing the instance from the ELB.I have also tried the Amazon Support EC2 Resue SSM but that failed in executionFollowComment"

Answer: 0Remade the setup with fixed the issueCommentSharekevinmuppattaanswered 3 years ago


Question: How to be a better professional?

"Hello, my name is Victor and I am 18 years old and I have been studying cloud computing for some time... I have 2 Azure certifications but my great passion is AWS and today I come to ask for tips and guidance on how to grow within this platform, I am studying to remove AWS Practitioner this month and in January I will remove Architected Solutions.What is the main thing I have to know/understand to become an excellent professional in the future?FollowComment"

Answer: "1Hey Victor,First of all, congrats on pursuing your passion!I can give you some general guidance, but the industry is so broad that it's hard to give a more precise answer.Study, study and study. Doesn't really matter what, but this industry moves too fast, so we have to keep up.Everyone has their own way of learning, but I always recommend people to learn by doing as much as possible.Learn to code. Regardless if you want to be a developer or not, to successfully work with cloud you have to understand SDLC and to be able to do some coding yourself.Don't be overwhelmed. There are just too many services and technologies out there. You will not know all of them and no one does. Be mindful of the shiny object and try to keep in mind that technology must have a (business) goal. It must serve a purpose. Technology per technology doesn't make sense.Understand that hard skills can only take you so far in terms of career progression, so be mindful of also developing your soft skills.Don't be afraid of the unknown. Working with something you don't know/don't have experience can be a great growth opportunity.You are young, so don't let others talk you down just because you are less experienced/tenured or younger. Time will come when you will have more technical knowledge about things than other older/more tenured engineers. Trust your instincts.At the same time, be humble and have the apprentice mindset. Sometimes you may not agree with someone and speaking up may be a good opportunity for you to learn from other's perspective.Very important - Have fun! Seriously, be careful with burning-out and with fomo.CommentSharefercunhaanswered 6 months ago1Hello!I assume you already know about the benefits of cloud computing. You should sign up for an AWS account and get a feel for the AWS Console. Follow AWS tutorials to provision resources: https://aws.amazon.com/getting-started/You should then learn what Infrastructure as Code is and how it relates to DevOps on AWS: https://docs.aws.amazon.com/whitepapers/latest/introduction-devops-aws/infrastructure-as-code.htmlFinally you should learn about the six pillars of the Well Architected Framework to help you design good architectures: https://aws.amazon.com/architecture/well-architectedCommentSharemasseanswered 6 months ago"


Question: "Anything on the roadmap for this limitation "You cannot reference the security group of a peer VPC that's in a different Region. Instead, use the CIDR block of the peer VPC.""

"Anything on the roadmap for this limitation "You cannot reference the security group of a peer VPC that's in a different Region. Instead, use the CIDR block of the peer VPC." https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.htmlFollowComment"

Answer: 0Please reach out to your local AWS Solutions Architect - it's the best way to discuss and request features in services.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: Transit Gateway: Connect two DCs via VPN with overlapping CIDR range

Consider a setup similar to:DC1: 192.168.1.0/24DC2: 192.168.1.0/24VPC1: 10.0.0.0/16VPC2: 10.1.0.0/16You want to use a Transit Gateway and site-to-site VPN to connect each on-premises data center with one of the VPCs. Is this possible if the DCs have the same CIDR Ranges? How does the TGW know where to route traffic back?FollowComment

Answer: "0Accepted AnswerI see different use cases here:VPC1 <-> DC1VPC1 <-> DC2VPC2 <-> DC1VPC2 <-> DC2Separately, use cases 1 and 4 together, or use cases 2 and 3 together are doable by creating two separate route tables for VPCs and have data center CIDRs pointing to VPN attachments.if you want to do all of them together then the complication arises and you need to NAT DC1 or DC2 (one of them) to something like 192.168.2.0/24 and use that NATed range as destination in the route table. Here the aim is to make one DC's range look different for TGW. This NAT can be done either in Customer Gateway side or AWS by spinning up NAT appliance in a separate VPC then use that as destination for traffic destined to a DC.With NAT in picture things generally get messy.CommentShareEXPERTVKanswered 3 years ago"


Question: unable to connect to "Standard with Amazon Linux 2" workspaces instance

"HelloI can't connect to the subject mentioned workspaces instance via web browser and get the error [url=https://ibb.co/6nd0vLS][img]https://i.ibb.co/vwt4sRW/3-Workspaces.png[/img][/url]. I am trying to connect from web browser as shown in  [url=https://imgbb.com/][img]https://i.ibb.co/cwwG8vm/4-Workspaces.png[/img][/url]I can however connect to the windows instance without issues.Edited by: sickpig24 on Sep 4, 2020 7:07 PMFollowComment"

Answer: 0Just read that web access does not work for linux workspaces. This should be displayed on the login page itself.CommentSharesickpig24answered 3 years ago


Question: AWS CLI needs to be converted to PowerShell

"Below is the AWS CLI that needs to be converted to PowerShell$export_AWS = aws configservice select-aggregate-resource-config --expression "SELECT accountId,awsRegion,arn,resourceId WHERE resourceType = 'AWS::EC2::Instance'" --configuration-aggregator-name XXXXXXXXXFollowComment"

Answer: "0You will find the documentation for the PowerShell CmdLets for AWS here: https://docs.aws.amazon.com/powershell/latest/reference/index.htmlThe appropriate CmdLet counterpart for your cli command is Select-CFGServiceAggregateResourceConfig and the command would look like this:Select-CFGAggregateResourceConfig -ConfigurationAggregatorName XXXXXXXXX -Expression "SELECT accountId,awsRegion,arn,resourceId WHERE resourceType = 'AWS::EC2::Instance'"CommentShareEXPERTAndreas Seemuelleranswered 8 months agoKalaimani Thirupathi 8 months agoYour kind response is greatly appreciated. Using AWS CLI, I am able to obtain the response, however when I attempt to execute the command that you provided, I receive the following error message. Could you please let me know if there is anything else I need to doSelect-CFGAggregateResourceConfig : The configuration aggregator does not exist. Check the configuration aggregator name and try again.At line:1 char:1Select-CFGAggregateResourceConfig  -ConfigurationAggregatorName  ...  + CategoryInfo          : InvalidOperation: (Amazon.PowerShe...rceConfigCmdlet:SelectCFGAggregateResourceConfigCmdlet) [Select-CFGAggregateResourceConfig], InvalidOperationException  + FullyQualifiedErrorId : Amazon.ConfigService.Model.NoSuchConfigurationAggregatorException,Amazon.PowerShell.Cmdlets.CFG.SelectCFGAggregateResourceConfigCmdletI have used the same name.ShareAndreas Seemueller EXPERT8 months agoHi Kalaimani,The error message indicates that no Configuration Aggregator with the specified name exists:https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/services/config/model/NoSuchConfigurationAggregatorException.htmlThis can have 3 potential causes:You misspelled the name of the configuration aggregatorYour AWS Tools for PowerShell are configured to use a region where your Configuration Aggregator is not definedYour AWS Tools for PowerShell are configured to use an AWS account where your Configuration Aggregator is not definedShareAndreas Seemueller EXPERT8 months agoYou can validate this via the following statements:Get-CFGConfigurationAggregatorList: Lists the defined Configuration Aggregators for your PowerShell environmentIf the list is empty you can use the following commands:Get-STSCallerIdentity: Lists the AWS Account ID your tools are configured to useGet-DefaultAWSRegion: Lists the default region your tools are configured to useShareKalaimani Thirupathi 8 months agoThanks @Andreas_S, its working after defining the region. In order to select one Tag Value in an EC2 instance, I need one more piece of assistance. I tried the following one, but it did not workSelect-CFGAggregateResourceConfig -ConfigurationAggregatorName xxxxxxxx -Expression "SELECT Select-CFGAggregateResourceConfig -ConfigurationAggregatorName org-cfg-aggr -Expression "SELECT accountId,awsRegion,arn,TagKey=tag['Key'], TagValue=tag['Value'],resourceId WHERE resourceType = 'AWS::EC2::Instance' AND accountID IN ('xxxxxxx')"  -Region WestAdditionally, I would appreciate your assistance in obtaining the backup and backup copy status for the EC2 instanceSelect-CFGAggregateResourceConfig -ConfigurationAggregatorName XXXXXX -Expression "SELECT accountId, recoveryPointArn, details, backupJobId, backupSizeInBytes, backupVaultName, backupVaultArn, bytesTransferred,  iAmRoleArn, percentDone, resourceArn, resourceType, startBy, state, statusMessage WHERE resourceType = 'AWS::Backup::Backup' AND accountID IN ('xxxxxxxxx')"  -Region WestShare"


Question: HOw do I give permission to lamda function?

I am trying to send HTTP PoST request from Postman API to AWS IoT core.But getting a {message forbidden} error.So I am trying to create a Lambda authorizer.While creating I get the following message:"API Gateway needs your permission to invoke your Lambda function:"And not able to proceed further.Kindly help.FollowComment

Answer: 0Please refer to below documents:https://docs.aws.amazon.com/apigateway/latest/developerguide/permissions.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/iam-authentication-api-gateway/Hope it helps.CommentShareEXPERTalatechanswered 4 months ago


Question: This account is currently blocked and not recognized as a valid account.

"Our AWS account is blocked and not able to create any instances. I had raised a ticket and AWS team responded as it has to be addressed by Verification team. This is again some 15 hours ago.Kindly let me know if there is a way to reach out to verification team, so that we can get some assistance to resolve this issue at the earliest.FollowComment"

Answer: "1This AWS verification team with email address aws-verification@amazon.com are unprofessional people. Despite repeated emails requesting for feedback on why they have blocked or suspended my account inspite of having provided all necessary documents, I receive no reply.This is something that I hope AWS management should look into. These guys whoever is in charge of the AWS verification team need to be reminded of AWS core leadership principles of "customer obsession". In my experience to date, they are the anti-thesis of this AWS leadership principle and a big letdown for the company.I am shocked that so many other customers have had to deal with nightmares of AWS-verification team behavior.What a shame....CommentSharerePost-User-7238334answered 9 months ago0You can try them at aws-verification@amazon.com or contact AWS Support.  https://support.aws.amazon.com/#/contacts/aws-account-support/ and https://console.aws.amazon.com/support/.CommentSharejsoncanswered a year ago"


Question: Can't access or create S3 Buckets

"Background: I have this AWS account from back when EC2 was launched as a beta service (2008?) and have S3 buckets created for over a decade. I haven't very actively used the console or the AWS account in the past 5 years or so. Maybe my last login was back in 2020 or 2021.When I recently logged into AWS console, I was shown a message that apparently my account is now considered a "root" account and I'll need another user account to access my S3 buckets/files. Since then I've tried the following, but still can't access my S3 buckets.I created a new "Identity Center" account, which for whatever reason I can't login to.I had a couple of existing "IAM" accounts which I've used for various services including S3. I turned on "Console Access" on one of them and was able to successfully login to it.Using my root account, I've also created a policy to include three policies related to "StorageLens" and attached them to the IAM user.I still keep getting the error "You or your AWS administrator must update your IAM permissions to allow s3:GetStorageLensConfiguration and s3:GetStorageLensDashboard. After you obtain the necessary permissions, choose Refresh. Learn more about Identity and access management in Amazon S3"Any ideas what am I missing or how can I identify what's going on with the permissions?Thanks!FollowComment"

Answer: 0Is there a bucket policy denying access? You could also try the Policy Simulator to see what is blocking you.CommentShareEXPERTkentradanswered 15 days ago


Question: DB Log Processing through Kinesis Data streams and Time Series DB

"Hi Team, I have an architecture based question, How  Postgre SQL DB log processing can be captured  through  AWS lambda , aws Kinisis Data streams and finally Data should loads into Time Stream Database.  Providing  High level scenario:Draft Data flow :Aurora Postgre DB  ----DB Logs Processing to ---->** Lambda** --->Ingestion to ----> **Kinesis Data Streams ** ---Process and Join context data  and insert  --- Insert to  --------> Time Stream  DatabaseI believe ,  we can process / loads the AWS IoT (sensors , device data) to Time Stream Database through Lambda , Kinesis Streams , Kinesis Data analytics and finally Time series Database and we can  do  analytics on time series data . But i am not sure How the postgre SQL db  logs (write ahead logs)  process through Lambda and ingest through Kinesis streams and finally load into Time Stream Database .  and above flow also required to Joins some tables like Event driven tables with  associated Account , Customer tables and then it will load into Time Series Database .  would like to know if above flow would be accurate , as we are not processing any sensors / devices data ( where sensors data captures all measures and dimensions data from device and loads into Time Stream DB )  so Time Series database always a primary database .  if anyone can through some lights , how postgre sql db logs can be  integrated with Time Stream database through Kinesis Data streams , Lambda .   Need your helpThanksFollowComment"

Answer: "0Hi, many thanks for your question.I'd suggest taking a look at AWS Database Migration Service that can stream changes from PostgreSQL (https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.PostgreSQL.html)  database to a number of destinations, including Amazon Kinesis Data Stream (https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Kinesis.html) . Then you can use Amazon Kinesis Data Analytics for Apache Flink to enrich your data and send it to Amazon TimeStream DB.Hope it helps.CommentShareAlex_Tanswered a year agoAWS-User-8897895 a year agoThanks for your suggestion and really appreciated .Both the links  make sense to us .Here , Team want to try to load postgre db logs into Timestream DB  (through write access logs)  using  Lambda and then Kinesis data streams ,  But they donot want to use Kinesis Data Analytics for apache flink , as per my understanding Kinesis Data analytics for apache flink is required here and even you have also suggested above .and we are not  sure about  How Postgre database - write access logs can configured in Postgre and any mandatory postgre db version is required to enabled write access logs.As per my understanding , Kinesis data streams , kinesis fire hose , kinesis data analytics  for apache flink services are  ideal  aws services to  read real time/IoT Data (sensor, device , web logs) data through some protocol and it loads data into Time Series DB and after that we can some analytics query on time series database based on timestamp partition.this is my understanding .this is my thought , Just reading postgre DB logs through Lambda and pushing it to Time Series Database won't be a ideal scenario for Real time Data reading / Event driven scenario.  here we are creating many data hubs .one more thought , Time Series DB data always good to capture event data as it captures Dimension and Measures of a device / sensor in one table so analytical would be easy . i think , Time Series DB table won't support Joins with another time series db table.Share"


Question: Exception in User Class: com.amazonaws.SdkClientException : Unable to execute HTTP request: readHandshakeRecord AWS GLUE

"Hey Guys!I am trying to Read a large amout of data(About 45GB in 5.500.000 files) in S3 and rewrite in a partitioned folder (In another Folder inside the same Bucket) but I am facing this error:Exception in User Class: com.amazonaws.SdkClientException : Unable to execute HTTP request: readHandshakeRecordWhen I tried with just one file in the same folder it works.do you have any Ideia what could be the Problem?Code(running using 60 DPUs, Glue 4.0):import com.amazonaws.services.glue.util.JsonOptionsimport com.amazonaws.services.glue.{DynamicFrame, GlueContext}import org.apache.spark.SparkContextobject GlueApp {  def main(sysArgs: Array[String]): Unit = {    val spark: SparkContext = new SparkContext()    val glueContext: GlueContext = new GlueContext(spark)        val dynamicFrame = glueContext.getSourceWithFormat(      connectionType="s3",      format="parquet",      options=JsonOptions("""{"paths": ["s3://bucket/raw-folder"],"recurse": true, "groupFiles": "inPartition", "useS3ListImplementation": true}""")    ).getDynamicFrame()            glueContext.getSinkWithFormat(        connectionType="s3",        options=JsonOptions("""{"path": "s3://bucket/partition-folder"}"""),        format="parquet",        formatOptions=JsonOptions("""{"compression": "snappy","blockSize": 268435456, "pageSize": 1048576, "useGlueParquetWriter": true}""")    ).writeDynamicFrame(dynamicFrame.repartition(10))        }  }BestFollowComment"

Answer: "0The "Unable to execute HTTP request: readHandshakeRecord" exception is likely caused by insufficient memory issue. When reading large amount of small file,s spark driver keeps track of metadata for each file it reads and keeps this in memory, such may put a lot pressure on the driver memory can cause malfunctions with Http/API calls. I'd recommend you to check "glue.driver.jvm.heap.usage" and "glue.ALL.jvm.heap.usage" metrics in cloudwatch console [1] to see what the memory usage looks like.To fix this issue, I suggest you to consider following optimization:use S3ListImplementationWhen AWS Glue lists files, it creates a file index in driver memory. If 'useS3ListImplementation' is set to True, it doesn't cache the list of files in memory all at once. Instead, AWS Glue caches the list in batches. This will help reduce out of memory errors within Spark driver. [2]change Worker types.a. Use G.2x worker type. The G.2x worker type has more memory. This will help alleviate memory pressure on the driver.b. Increase the number of worker. You can refer to "glue.driver.ExecutorAllocationManager.executors.numberMaxNeededExecutors" [3]to determine the optimal number of worker which can maximize the parallelism and performance.Use bounded executionIf you still face the same issue, you can try the bounded execution [4] to split and distribute the large number of files to multiple job runs. With this setting, you can set how many files will be processed at one glue job.I hope this information helps you resolve the issue. In case the issue still persists after implemented the optimization above, I'd recommend you to cut a support ticket with the Glue job details, our support team will be happy to help you further troubleshoot and resolve the issue.Ref:[1] https://docs.aws.amazon.com/glue/latest/dg/monitoring-awsglue-with-cloudwatch-metrics.html#:~:text=all%20Spark%20executors.-,AWS%20Glue%20Metrics,-AWS%20Glue%20profiles[2] https://aws.amazon.com/premiumsupport/knowledge-center/glue-oom-java-heap-space-error/[3] https://docs.aws.amazon.com/glue/latest/dg/monitoring-awsglue-with-cloudwatch-metrics.html#glue.driver.ExecutorAllocationManager.executors.numberMaxNeededExecutors[4] https://docs.aws.amazon.com/glue/latest/dg/bounded-execution.htmlCommentShareEthan_Hanswered 3 months ago"


Question: aws smb for windows not connecting to active directory made by AWS director

"I am trying to set up a network drive on my windows 10 home desktop that can reach my files in S3 using the storage gateway. I have done the following:1.) Set up a m4.xlarge EC2 server with 150GB of EBS to serve as cache2.) I have configured the required ports of 80, 22, 139, and 445 for SMB3.) I have used AWS active directory service to set up my microsoft AD in the AWS cloud4.) I have created the file gateway5.) When I click edit SMB settings and type in my active directory, username, and password, the active directory status says failed to join ( network error).Can someone please help me? I have had no luck and have been going around in circles.FollowComment"

Answer: "0got itCommentSharearavichandrananswered 3 years agoRob_H EXPERTa month agoDon't forget to accept that answer if it solved your issue. this helps others in the future to know it solved your problem. Thank you!Share0This issue is normally caused when the gateway is unable to resolve the domain used to the domain controller addresses.Since this is AWS Managed AD, It's recommended to use the domain controller IP addresses as the DNS servers for the Storage Gateway.Once that is set then the join domain should succeed.Thank you,Brian C @AWSCommentShareBrian Canswered 3 years agoEXPERTRob_Hreviewed a month ago"


Question: Workaround for Lambda 15 minute timeout

"Customer is trying to use a Lambda function to handle resizing of EC2 instances across the organization. The script will stop the instance, resize it, and then start the instance. However some EC2 instances take longer than 15 minutes to stop and Lambda ends up timing out. I understand the 15 minute timeout is a hard limit but are there any workaround or retry methods the customer could leverage?FollowComment"

Answer: "1Accepted AnswerCustomer should decouple the process into 2 or more steps. One lambda that stops the instance and puts a message in a Queue (SQS). By using the invisibility feature (https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-message-timers.html) the customer can control the other function to trigger only at every 5 mins interval. That other function basically checks if the instance is stopped then does what ever it needs. If the instance is not stopped, it puts the message back in the queue.CommentSharesebperanswered 3 years ago"


Question: AWS Direct Connect route limit

"Hi there,I am currently planning for network upgrade on existing Direct Connect from On-Prem to AWS region. Currently we are advertising 50+ prefixes into Transit Gateway through DXG, but I hear that there is a limit on the max number of prefix. Can anyone confirm and advise any work around as we are keep on consolidating our branch network connectivity to use service in AWS cloud.FollowComment"

Answer: "2Accepted AnswerHi,Yes, there is a limit of 100 routes limit via Direct Connect with transit vif or privat vif(https://docs.aws.amazon.com/directconnect/latest/UserGuide/limits.html), if your route advertise more than that, the BGP session will go idle (DOWN).You can do a route summarization if you can or consider using Transit Gateway Connect to build a overlay GRE tunnel with BGP session to advertise your routing information.Pls refer to the blog for deployment details (https://aws.amazon.com/blogs/networking-and-content-delivery/integrate-sd-wan-devices-with-aws-transit-gateway-and-aws-direct-connect/)This not only increase the route advertised from 100 to 1000, you can also build upto 4 GRE tunnels so as to increase your traffic up to 20Gbps to the Transit Gateway.GaryCommentShareGaryKo_AWSanswered a year ago1There's another limit you may need to be aware of depending on your architecture.  Each TGW/DXGW Association can list at most 20 prefixes.  These prefixes, covering your VPCs, are propagated to on-prem.  Hopefully in your case for IPv4 you can use a single summary block but you still have an issue to solve if using site-to-site VPN as your fail-over link, because by default that will have propagated each VPC prefix.  Those more specific prefixes will have precedence over the DX summary block.  The workaround is to add static summary blocks to propagate for the VPN, and tell your on-prem router to ignore the specific VPC prefixes.BTW future use of IPv6 across DX like this doesn't look easy at the moment.  If you've let AWS assign VPC IPv6 CIDRs for you and you have a lot of VPCs, no way can you list them all with that limit of 20 prefixes.  I raised a Product Feature Req about this a while back.CommentShareEXPERTskinsmananswered a year ago"


Question: Unable to see X-Ray trace for AWS Batch job

"I am running a batch job that starts an EC2 instance and runs a Java application, and I am trying to generate X-Ray trace for the job. In my docker entrypoint I install X-Ray daemon and start itcurl https://s3.us-west-2.amazonaws.com/aws-xray-assets.us-west-2/xray-daemon/aws-xray-daemon-3.x.rpm -o /tmp/xray.rpmyum install -v -y /tmp/xray.rpmxray -o -n us-west-2 &My Java code is instrumented as suchtry {    Segment segment = AWSXRay.beginSegment("load-data-segment");    logger.info("Segment started traceID={}, segment", segment.getTraceId(), segment.prettySerialize());    Subsegment subSegment = AWSXRay.beginSubsegment("load-data-sub-segment");    logger.info("started subSegment traceId={}, {}", subSegment.getTraceId(), subSegment.prettySerialize());    subSegment.putAnnotation("job_id", "load-data-job");    ...} finally {    logger.info("Ending subsegment {}, {}", subSegment.getTraceId(), subSegment.prettySerialize());    AWSXRay.endSubsegment();    logger.info("Ending segment {}, {}", segment.getTraceId(), segment.prettySerialize());    AWSXRay.endSegment();}And I can see from CloudWatch log that the daemon is installed and started, and the segments are created and eventually terminated normally....EVENTS  1667282262329   Running X-Ray: xray -o -n us-west-2 &   1667282258652EVENTS  1667282262329   Getting Secret: dev-shared-kc-local.yml 1667282258654EVENTS  1667282262329   2022-11-01T05:57:38Z [Info] Initializing AWS X-Ray daemon 3.3.5 1667282258658EVENTS  1667282262329   2022-11-01T05:57:38Z [Info] Using buffer memory limit of 321 MB 1667282258658EVENTS  1667282262329   2022-11-01T05:57:38Z [Info] 5136 segment buffers allocated  1667282258658EVENTS  1667282262329   2022-11-01T05:57:38Z [Info] Using region: us-west-2 1667282258679EVENTS  1667282262329   2022-11-01T05:57:38Z [Info] HTTP Proxy server using X-Ray Endpoint : https://xray.us-west-2.amazonaws.com   1667282258679EVENTS  1667282262329   2022-11-01T05:57:38Z [Info] Starting proxy http server on 127.0.0.1:2000    1667282258679...VENTS  1667282262329   2022-11-01 05:57:41,933 [main] [default] INFO  - Segment started traceID=1-6360b555-5161dc6ff45fcca197606de8, segment   1667282261934EVENTS  1667282262329   2022-11-01 05:57:41,941 [main] [default] INFO  - started subSegment traceId=null, { 1667282261941EVENTS  1667282262329     "name" : "load-data-sub-segment", 1667282261941EVENTS  1667282262329     "id" : "348f5fd5734d2002",    1667282261941EVENTS  1667282262329     "start_time" : 1.667282261934E9,  1667282261941EVENTS  1667282262329     "in_progress" : true  1667282261941EVENTS  1667282262329   }   1667282261941......EVENTS  1667282596467   2022-11-01 06:03:16,334 [main] [default] INFO  - Ending subsegment null, {  1667282596334...EVENTS  1667282596467   2022-11-01 06:03:16,336 [main] [default] INFO  - Ending segment 1-6360b555-5161dc6ff45fcca197606de8However I am completely unable to find any tracing from X-Ray console. I use the queries like annotation.job_id, but nothing shows up. I think I have all the necessary polices added to my role (AWSXRayDaemonWriteAccess), but I am suspecting if I didn't set it up properly. Where and how can I start debugging this? I feel like completely at wits' end. Thank you for any suggestions!FollowComment"

Answer: "0The code looks good overall, I don't find any problem.Would you mind add log for segment.isSampled() ? XRay SDK does not emit segment if sample flag is 0/false.CommentShareAWS-User-3368379answered 7 months agorePost-User-9305106 7 months agoThank you for suggestion. Here's the output2022-11-03 20:11:36,083 [main] [default] INFO  - Segment: isSampled: true, isRecording: true, isEmitted false, isError false, isFault false, inProgress true, isRecording true2022-11-03 20:11:36,093 [main] [default] INFO  - subSegment: isFault false, isError false, isEmitted false, inProgress true, isThrottle false        1667506296094Share0Still not find any problem. Please print Daemon debug logs by xray -o -n us-west-2 -l dev and check whether X-Ray Daemon has logs like2022-11-06T20:54:30-08:00 [Debug] Received request on HTTP Proxy server : /GetSamplingRules2022/11/06 20:54:31 http: proxy error: context canceled2022-11-06T20:55:00-08:00 [Debug] Skipped telemetry data as no segments found2022-11-06T20:55:05-08:00 [Debug] Received request on HTTP Proxy server : /GetSamplingRules2022-11-06T20:55:09-08:00 [Debug] processor: sending partial batch2022-11-06T20:55:09-08:00 [Debug] processor: segment batch size: 1. capacity: 502022-11-06T20:55:10-08:00 [Info] Successfully sent batch of 1 segments (1.501 seconds)CommentShareAWS-User-3368379answered 7 months ago"


Question: "Best way to restart a Greengrass component, from another component"

"My requirement is to have one greengrass component, upon receipt of an MQTT message, update the local config file for another component, and then restart the other component.Upon restarting, this config file is read by another gg component.My issue is running the 'greengrass-cli component restart' command from another component, as it does not have sufficient priveleges to run that command.I know another approach would be to send an IPC message from one component to another, and upon receipt of that message, the receiving component could do some restart/re-init task. However in our use case, it would be far easier to simply restart the other component altogether.Are there any suggested ways to achieve this? Is it possible to restart a component in any way other than the 'greengrass-cli component restart' command?FollowComment"

Answer: "0Another way to fulfill your use case is to have the "other" component to watch the config file. This is similar to the IPC solution but with this approach you are not limited to the programming languages supported by the Greengrass SDK.CommentShareEXPERTMassimilianoAWSanswered a year agoAWS-User-9962534 a year agoHi , apologies for the delay on this follow up -The documentation for the greengrass-cli component has a configuration for "AuthorizedPosixGroups". If I explicitly add the user (ggc_user) to this group, will I be able to invoke the restart command from another component without using any of the workarounds suggested?LInk to docs: https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-cli-component.htmlShare0Using the CLI is the only way to restart a component at this time. Assuming that you control the code in the component which is reading the configuration file, you could update it such that it calls exec to create a new instance of itself with the updated configuration. Even more ideally, it could be written to dynamically update based on configuration changes, for example by using our configuration subscription IPC https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-component-configuration.html#ipc-operation-subscribetoconfigurationupdate.CommentShareEXPERTMichaelDombrowski-AWSanswered a year ago0Hi , apologies for the delay on this follow up -The documentation for the greengrass-cli component has a configuration for "AuthorizedPosixGroups". If I explicitly add the user (ggc_user) to this group, will I be able to invoke the restart command from another component without using any of the workarounds suggested?LInk to docs: https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-cli-component.htmlCommentShareAWS-User-9962534answered a year ago"


Question: Why is my EFS File system policy blocking Fargate from mounting the EFS even though it includes the Task Execution Role arn?

"I'm currently using an EFS mounted on a Fargate task. The task uses roles CustomECSTaskExecutionAgent for task execution and CustomECSTaskAgent for the task. With no file system policy in place, Fargate mounts fine and my task is able to read/write to the EFS. However, my company requires a File System Policy for each EFS so I added the following{    "Version": "2012-10-17",    "Id": "efs-statement-8e30733a-a93f-414f-b5b6-284bd5a02c0a",    "Statement": [        {            "Sid": "efs-statement-7c9d03e6-379b-422e-afe6-4d92e7ff4303",            "Effect": "Allow",            "Principal": {                "AWS": [                    "arn:aws:iam::<accountid>:role/CustomECSTaskAgent",                    "arn:aws:iam::<accountid>:role/CustomECSTaskExecutionAgent",                    "arn:aws:iam::<accountid>:role/CustomEC2Agent"                ]            },            "Action": "elasticfilesystem:*",            "Resource": "arn:aws:elasticfilesystem:us-east-1:<accountid>:file-system/fs-id"        }    ]}With this policy Fargate is not able to mount the drive, I get the following error:ResourceInitializationError: failed to invoke EFS utils commands to set up EFS volumes: stderr: b'mount.nfs4: access denied by server while mounting fs-id.efs.us-east-1.amazonaws.com:/' : unsuccessful EFS utils command execution; code: 32If I add the following statement to the policy then Fargate is able to mount the drive but the task fails immediately because it is not able to read/write. I cannot keep the below statement because it is too permissive and I'd like to know what Principal I need for 1. Fargate to mount successfully 2. For my task to read/write        {            "Sid": "efs-statement-7c9d03e6-379b-422e-afe6-4d92e7ff4303",            "Effect": "Allow",            "Principal": {                "AWS": "*"            },            "Action": "elasticfilesystem:ClientMount",            "Resource": "arn:aws:elasticfilesystem:us-east-1:<accountid>:file-system/fs-id"        }FollowCommentOlly 7 months agoAfter removing the file system policy and starting my Fargate container, then looking through CloudTrail I noticed that the connection to the EFS from the container came through as an anonymous principal{    "eventVersion": "1.08",    "userIdentity": {        "type": "AWSAccount",        "principalId": "",        "accountId": "ANONYMOUS_PRINCIPAL"    },    "eventTime": "2022-11-03T13:10:48Z",    "eventSource": "elasticfilesystem.amazonaws.com",    "eventName": "NewClientConnection",    "awsRegion": "us-east-1",    "sourceIPAddress": "AWS Internal",Share"

Answer: 0Can you check and make sure that one of those IAM roles defined in the EFS policy are set as default in your Fargate instances..Refer the below on how credentials configuration does affect the default IAM role the instance takes when talking to STS service.Refer:https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.htmlYou can also get the IAM role your instances are using by default by running the command "aws sts get-caller-identity".CommentShareRRP_AWSanswered 7 months agoOlly 7 months agoWhen I run aws sts get-caller-identity from my laptop I get my account. I cannot run this command from any Fargate instance because they are serverless. So how do I find out the default IAM role that is used by Fargate? I have an EC2 instance I use for development and when I run that same command I get "Arn": "arn:aws:sts::<account-id>:assumed-role/CustomEC2Agent/i-<somenumber>"Share


Question: Quicksight automation via cloudformation (IotAnalytics datasource)

"Hi, i trying to automate QS with cloudformation and im stuck with datasource json template.the goal is create datasource which reference to aws iot analytics data set.I have tried everything without success.below is mine template:{  "AWSTemplateFormatVersion": "2010-09-09",  "Description": "--",  "Parameters" : {    "DataSetName" : {      "Type" : "String",      "Default" : "test_dataset",      "Description" : "datasetName"    }  },   "Resources": {    "testQSdatasource": {      "Type" : "AWS::QuickSight::DataSource",      "Properties" : {        "AwsAccountId" : {"Ref": "AWS::AccountId"},        "DataSourceId" : "test_data_source_1",        "Name" : "Analytics_data_source1",        "Type" : "AWS_IOT_ANALYTICS",        "DataSourceParameters": {          "AwsIotAnalyticsParameters": {            "DataSetName": {"Ref": "DataSetName"}          }        }      }    }  }}i found also that docs not mentioned AwsIotAnalyticsParameters or anything similar that referenced to iot analytics.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-quicksight-datasource-datasourceparameters.htmlSo is it even possible to  create QS datasource which refer to iot analytics dataset?FollowComment"

Answer: "0Looks like we do not have IoT analytics supported in AWS::QuickSight::DataSource DataSourceParameters https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-quicksight-datasource-datasourceparameters.htmlOne option could be to use CLI as referred here https://awscli.amazonaws.com/v2/documentation/api/latest/reference/quicksight/create-data-source.html. The ListDataSources has AWS_IOT_ANALYTICS in it and belowAwsIotAnalyticsParameters -> (structure)The parameters for IoT Analytics.DataSetName -> (string)Dataset name.CommentShareEXPERTAWS-User-Nitinanswered 2 months agorePost-User-2798649 2 months agoHi AWS-User_Nitin  , I did try to create datasource also via CLI with this code:aws quicksight create-data-source --aws-account-id "<my-account-id>" --data-source-id "test123" --name "test123" --type "AWS_IOT_ANALYTICS" --data-source-parameters '{"AwsIotAnalyticsParameters":{"DataSetName" : "test_30_day_dataset_dev"}}'but this also fails. Here is CLI response: An error occurred (InvalidParameterValueException) when calling the CreateDataSource operation: DataSourceParameters field is incorrectly setShare0up..I also try to create datasource via CLI with this code:aws quicksight create-data-source --aws-account-id "<my-account-id>" --data-source-id "test123" --name "test123" --type "AWS_IOT_ANALYTICS" --data-source-parameters '{"AwsIotAnalyticsParameters":{"DataSetName" : "test_30_day_dataset_dev"}}'but this also fails.Here is CLI response: An error occurred (InvalidParameterValueException) when calling the CreateDataSource operation: DataSourceParameters field is incorrectly setDoes someone knows what may cause that error msg?CommentSharerePost-User-2798649answered a month ago"


Question: Telnet to MSK brokers REALLY slow....

"I have created a 3-broker MSK instance (not serverless) and a Windows EC2 instance in the same VPC. The MSK producer client running on the Windows EC2 machine can connect to the MSK cluster without any delays or timeouts. However, if I try to confirm network connectivity from the same machine to each of the MSK cluster brokers using Windows Telnet, it can take up to 10 - 15 minutes to establish a connection to each broker.Does any know why this might be the case?Thanks.FollowComment"

Answer: "0Hello,From reading over your Question, I understand that you have a 3 broker MSK instance and a Windows EC2 instance all in the same VPC. You're not facing any connection issues with the MSK producer client running on the Windows EC2 machine connecting to the MSK cluster; however, you are seeing delays (10-15mins), when trying to confirm network connectivity using Telnet. You are wondering why this is occurring.Please correct me if I have misunderstood your concerns in any way whatsoever.GUIDANCE:I recommend since you are unable to communicate successfully with your MSK cluster, start by performing the following connectivity test. This test will verify to see if there are any specific networking issues within your AWS MSK Cluster that can be causing this slowness.a. Use any of the methods described in "Getting the bootstrap brokers for an Amazon MSK cluster" to get the addresses of the bootstrap brokers 1.b. In the following command replace "bootstrap-broker" with one of the broker addresses that you obtained in the previous step. Replace "port-number" with 9094 if the cluster is set up to use TLS authentication. If the cluster doesn't use TLS authentication, replace "port-number" with 9092. Run the command from the client machine.Command: telnet bootstrap-broker port-numberRepeat the previous command for all the bootstrap brokers.Use any of the methods described in "Getting the Apache ZooKeeper connection string for an Amazon MSK cluster" to get the addresses of the cluster's Apache ZooKeeper nodes 2.On the client machine run the following command, replacing "Apache-ZooKeeper-node" with the address of one of the Apache ZooKeeper nodes that you obtained in the previous step. The number 2181 is the port number. Repeat for all the Apache ZooKeeper nodes.Command: telnet Apache-ZooKeeper-node 2181Note: If the client machine is able to access the brokers and the Apache ZooKeeper nodes, this means there are no connectivity issues. In this case, run the following command to check whether your Apache Kafka client is set up correctly. To get "bootstrap-brokers", use any of the methods described in Getting the bootstrap brokers for an Amazon MSK cluster. Replace "topic" with the name of your topic.Command: <path-to-your-kafka-installation>/bin/kafka-console-producer.sh --broker-list bootstrap-brokers --producer.config client.properties —topic topicIf the previous command succeeds, this means that your client is set up correctly. If you're still unable to produce and consume from an application, debug the problem at the application level.If the client machine is unable to access the brokers and the Apache ZooKeeper nodes, see the following subsections for guidance that is based on your client-machine setup.References:I hope the above is able to assist you with the Telnet to Broker slowness you are encountering. If you have any further questions, comments, or concerns, I'd be glad to address them.Thanks and have a great day.CommentShareiChibbyanswered 4 months ago"


Question: Trigger databrew job multiple times

"Hi, I am using databrew for data quality checks of S3 files. The files arrive continuously. Every time a  files arrives I have an eventbridge job which triggers the databrew job. I have the below questions:is there a way I can trigger the same Databrew profile job multiple times for different files(for ex: let's say we have files xyz1, xyz2, xyz3, etc). they all have same schema and should trigger the same job.If two different (different schemas) files arrive (ex: xyz1, pqr1), can same profile job  be configured for 2 different files? The rules for these 2 files will be different. I dont think same profile job can be used, but just thought to check.Thanks!!FollowComment"

Answer: "0For question 1, define different EventBridge patterns and rules for each file convention that invoke the same profile job.  For question 2, you should use different profile jobs that are invoked using similar EventBridge scenario as in question 1.CommentShareAWSdaveanswered 4 months ago"


Question: Inconsistent results with role tag

"I'm trying to make Polly say 'live' (as in 'Live from New York!') using the role tag.  It works fine when live is at the beginning of the sentence.  But if the word is buried in the middle of the sentence, the pronunciation changes.I'm using the Windows CIL interface and Neural voices. My region is set to us-east-1.I've also tried various workarounds using the phoneme tag, but I can't get anything to work.  I think it's because I need to escape characters in the ph= option (like stress marks in ipa, and <? in x-samp), but \ doesn't seem to be working as an escape in CIL.  AWS keeps returning "Invalid SSML Request" when i attempt to escape anything.Here are the role commands I'm sending:aws polly synthesize-speech --output-format mp3 --engine neural --voice-id Joanna --text "<speak><amazon:domain name='conversational'><prosody rate='97%'><w role='amazon:SENSE_0'>Live</w> from New York, it's Saturday Night!<break time='.1s'/></prosody></amazon:domain></speak>" --text-type ssml good.mp3aws polly synthesize-speech --output-format mp3 --engine neural --voice-id Joanna --text "<speak><amazon:domain name='conversational'><prosody rate='97%'>When sharing compatible files, select Request control. <break time='.35s'/>This allows you to <w role='amazon:SENSE_0'>live</w> edit the open documents during your video session.<break time='.1s'/></prosody></amazon:domain></speak>" --text-type ssml bad.mp3And here are the various phonem tags I've tried:aws polly synthesize-speech --output-format mp3 --engine neural --voice-id Joanna --text "<speak><amazon:domain name='conversational'><prosody rate='97%'>When sharing compatible files, select Request control. <break time='.35s'/>This allows you to <phoneme alphabet='ipa' ph='līv'>live</phoneme> edit the open documents during your video session.<break time='.1s'/></prosody></amazon:domain></speak>" --text-type ssml live1.mp3aws polly synthesize-speech --output-format mp3 --engine neural --voice-id Joanna --text "<speak><amazon:domain name='conversational'><prosody rate='97%'>When sharing compatible files, select Request control. <break time='.35s'/>This allows you to <phoneme alphabet='ipa' ph='laɪv'>live</phoneme> edit the open documents during your video session.<break time='.1s'/></prosody></amazon:domain></speak>" --text-type ssml live2.mp3aws polly synthesize-speech --output-format mp3 --engine neural --voice-id Joanna --text "<speak><amazon:domain name='conversational'><prosody rate='97%'>When sharing compatible files, select Request control. <break time='.35s'/>This allows you to <phoneme alphabet='ipa' ph='lɪv'>live</phoneme> edit the open documents during your video session.<break time='.1s'/></prosody></amazon:domain></speak>" --text-type ssml live3.mp3aws polly synthesize-speech --output-format mp3 --engine neural --voice-id Joanna --text "<speak><amazon:domain name='conversational'><prosody rate='97%'>When sharing compatible files, select Request control. <break time='.35s'/>This allows you to <phoneme alphabet='ipa' ph='\ˈlɪv'>live</phoneme> edit the open documents during your video session.<break time='.1s'/></prosody></amazon:domain></speak>" --text-type ssml live4.mp3aws polly synthesize-speech --output-format mp3 --engine neural --voice-id Joanna --text "<speak><amazon:domain name='conversational'><prosody rate='97%'>When sharing compatible files, select Request control. <break time='.35s'/>This allows you to <phoneme alphabet='ipa' ph='"lɪv'>live</phoneme> edit the open documents during your video session.<break time='.1s'/></prosody></amazon:domain></speak>" --text-type ssml live5.mp3aws polly synthesize-speech --output-format mp3 --engine neural --voice-id Joanna --text "<speak><amazon:domain name='conversational'><prosody rate='97%'>When sharing compatible files, select Request control. <break time='.35s'/>This allows you to <phoneme alphabet='x-sampa' ph='"lIv'>live</phoneme> edit the open documents during your video session.<break time='.1s'/></prosody></amazon:domain></speak>" --text-type ssml live6.mp3aws polly synthesize-speech --output-format mp3 --engine neural --voice-id Joanna --text "<speak><amazon:domain name='conversational'><prosody rate='97%'>When sharing compatible files, select Request control. <break time='.35s'/>This allows you to <phoneme alphabet='x-sampa' ph='l<? ī ?>v'>live</phoneme> edit the open documents during your video session.<break time='.1s'/></prosody></amazon:domain></speak>" --text-type ssml live7.mp3Edited by: sharonhuston on Apr 7, 2020 10:11 AMMore in this issue:  I'm also getting inconsistent results between the web console and the CIL.  Look at these two identical entries.  The console says "live" correctly, the command line does not.link:https://learning.realpage.com/downloads/sharon/cil.pnglink:https://learning.realpage.com/downloads/sharon/console.pngEdited by: sharonhuston on Apr 7, 2020 1:29 PMFollowComment"

Answer: "0Accepted AnswerHi,To most easily get "live" (rhyming with "dive"), you can use:<w role="amazon:NN">live</w>And to get "live" (rhyming with "give"), you can use:<w role="amazon:VB">live</w>The role amazon:SENSE_0 won't work. The sense roles are numbered starting from amazon:SENSE_1. They are also typically used to disambiguate pronunciations that couldn't be done via part of speech, (e.g. "bass" as in the frequency range/guitar, or "bass" as in the fish). So the sense roles wouldn't help here.Regarding the <phoneme> tag, to get the equivalent of <w role="amazon:NN">live</w> (rhyming with "dive"), the following would be the canonical ways to do so:<phoneme alphabet="ipa" ph="ˈlaɪv">live</phoneme><phoneme alphabet="x-sampa" ph=""laIv">live</phoneme>For the equivalent of <w role="amazon:VB">live</w> (rhyming with "give"), the following would be the canonical ways to do so:<phoneme alphabet="ipa" ph="ˈlɪv">live</phoneme><phoneme alphabet="x-sampa" ph=""lIv">live</phoneme>The IPA primary stress mark character ˈ does not need to be escaped because it is not the same as the single quote character '.However, with X-SAMPA, the primary stress marker is the double quote, so it would have to be replaced in a double-quoted shell command using the equivalent XML entity: "For the inconsistency between the CLI and the console, thank you for reporting that. I was unable to reproduce it on my end. Despite this, the suggestions I provided above should adequately provide you the synthesis you're looking for.Edited by: anton-at-aws on Apr 10, 2020 7:28 AMCommentShareanton-at-awsanswered 3 years ago0Thank you!!  This is really helpful!!  It is nice to know that amazon:NN exists.  The Supported SSML Tags page in the documentation only lists VB and VBD.Edited by: sharonhuston on Apr 10, 2020 9:17 AMEdited by: sharonhuston on Apr 10, 2020 9:17 AMCommentSharesharonhustonanswered 3 years ago"


Question: AWS F1 instance generates AFIs

"After compiling the RTL, I can get a DCP. Then, a AFI will be generated using the aws ec2 create-fpga-image  API. I wonder if a bitstream is generated during this process. If generated, whether the bitstream is encrypted.FollowComment"

Answer: "0Dear customerThank you so much for your interest in using F1 instances. The output of create-image will be an AFI and the customer will use the AGFI ID provided as output by create-image to program FPGA with the design. There is no bitfile required as part of the F1 development flow.  Please refer to https://github.com/aws/aws-fpga/blob/master/hdk/README.md for step by step instructions. These AFI images are F1 specific versions of FPGA bitstream files to program FPGAs on F1 instances. Please feel free to let us know if you have any further questions. ThanksCommentShareAWS-User-7905434answered 2 months ago0By generating an AFI, a bitstream is generated, but this bitstream is only used by internal AWS tools. It is not directly visible to or interactable with by the customer.https://github.com/aws/aws-fpga/blob/a6e03487314959c9846e2095bf0b8cd0183a0b48/FAQs.md#general-f1-faqsThe developers' output is a Design Checkpoint (DCP) and not an FPGA bitstream: The FPGA bitstream is actually generated by AWS after the developer submits the DCP.Generated bitstreams are encrypted.CommentSharejacobmgn_awsanswered 2 months ago"


Question: Specify Powershell 7 when running SSM scripts

"Is there a way to specify, on Windows, that the SSM Agent runs a powershell script using PowerShell 7 vs. PowerShell 5?FollowComment"

Answer: "0Unfortunately, it is not possible to specify the PowerShell version while running a AWS-RunPowerShellScript run command. However, you can work around it by calling PowerShell 7 and pass a command/script. The following invokes a PowerShell 7 command of Get-Host.& "C:\Program Files\PowerShell 7\pwsh.exe" -Command "Get-Host"CommentShareTaka_Manswered 7 months ago"


Question: "Lamba url + .net core api, how to remove duplicate cors 'Access-Control-Allow-Origin'"

"From the chrome console.  Access to fetch at 'https://lambdaurl' from origin 'https://localhost:5002' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed. Have the server send the header with a valid value, or, if an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.It looks like both the core web api and lambda are adding the 'Access-Control-Allow-Origin':* header and chrome is not happy.  Is there a way to configure lambda url to not duplicate the header.FollowCommentAWS-User-4953333 a year agoCan you provide more details around what you were doing?Share"

Answer: "3Accepted AnswerIf you handle CORS in your .NET code, you can deactivate the automatic CORS handling for the Lambda function. This option can be deactivated either using AWS Management Console or via AWS CLI. If you deploy your function using IaC (e.g. CloudFormation or SAM), do not set the corresponding configuration there, that means - do not specify the Cors or FunctionUrlConfig object.Note that automatic CORS handling is deactivated by default.You could also read this blog post which explains how to configure Lambda URLs.Alternatively, you can leverage the Lambda function functionality to automatically handle CORS for you. Then, you should remove the CORS configuration from your .NET Web API initialization code (AddCors() and UseCors() methods).CommentShareDmitry Balabanovanswered a year agoAWS-User-4834855 a year agoThank you!Share"


Question: "EC2 Windows Server unexpected shutdown SYSTEM_SERVICE_EXCEPTION, random"

"Hi!We have an EC2 instance running Windows Server, which is shutting down randomly, ussually once a day, no pattern detected.It seems related to a driver, but reinstalled the AWS drivers. I'm guessing if there is a hardware problem ....not sure what that means in EC2...I upgraded PV drivers using this instructions, but no luck https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/Upgrading_PV_drivers.htmlAttached you can see both dump files, however I could not figure out what to do....could you please help?The log says:The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff800016b19df, 0xfffff88005917ed0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 112119-15350-01.The minidump says it's thisSYSTEM_SERVICE_EXCEPTION (3b)An exception happened while executing a system service routine.Arguments:Arg1: 00000000c0000005, Exception code that caused the bugcheckArg2: fffff800016b19df, Address of the instruction which caused the bugcheckArg3: fffff88005917ed0, Address of the context record for the exception that caused the bugcheckArg4: 0000000000000000, zero.FollowComment"

Answer: "0finally, reinstall in new serverCommentSharemobilenikanswered 3 years ago"