Question: How do I disassociate a a Database Proxy from a Lambda function?

"Hi. I've a associated a database proxy to a lambda function. Now I need the proxy to be removed from that function. I do not see any remove button (only the Add database proxy button), so how can I remove it without deleting the proxy itself?Thank you in advance.FollowComment"

Answer: "1Accepted AnswerYou can disassociate the Database Proxy by removing the IAM policy for that proxy (rds-db:connect permissions) in the Lambda function's execution role.CommentSharejoahnaanswered 8 months ago0To remove related associations, also use the deregister-db-proxy-targets command.aws rds deregister-db-proxy-targets    --db-proxy-name proxy_name    [--target-group-name target_group_name]    [--target-ids comma_separated_list]       # or    [--db-instance-identifiers instance_id]       # or    [--db-cluster-identifiers cluster_id]CommentShareMarc Schurichtanswered 8 months ago"


Question: Using a Single Application to Serve customers in-and-outside of Mainland China

"I am developing an iOS & Android application to be used for Account Creation, Product Registration, and File Distribution. The project has a requirement to be able to serve Mainland China and North America from a single application. I hope to migrate my application from Firebase to AWS to support these needs and comply with American and Chinese legislation on the storage of user data within their respected countries.Is there a feasible solution to this problem? I assume I would need to have an AWS and an AWS China account, but would I be able to make the application decide which Server Regions to use depending on if the user is inside or outside of the China.FYI I am a Sole Developer on this project for my employer, Junior at that with little database experience, an ideal solution wouldn't be too complicated to implement and maintain but all suggestions are welcome.FollowComment"

Answer: "0Hello,Tim here from the AWS Support Team, and I see you have some questions around making your iOS and Android application compliant in China and North American regions.This would take some careful planning and domain specific knowledge of your application. We do have some information on getting started in the Beijing and Ningxia region[1].As the next steps, if you haven’t done so yet, I’d recommend working with your employer to contact our sales support team at this link [2] if you haven’t begun using AWS [being sure to mention the project], or if you do have AWS accounts already, to contact our Compliance support team[3].[1] https://aws.amazon.com/blogs/enterprise-strategy/getting-started-with-aws-services-in-aws-china-beijing-region-and-aws-china-ningxia-region/[2] https://aws.amazon.com/contact-us/sales-support/[3] https://aws.amazon.com/contact-us/compliance-support/CommentShareSUPPORT ENGINEERTim_Panswered a year ago"


Question: Possible to use nest json when configuring rule target constant input

"Good Morning,What I am trying to accomplish is to have a Cloudwatch rule that is scheduled to run daily that will go into an Athena database and create a new partition in several tables for that day using a constant target input. It is for a single database with several different tables and different s3 locations. Is it possible to set up the input using nested json and if so is this proper format--{"albPathFragment": "/AWSLogs/409148389496/elasticloadbalancing/","database": "site-reliability",{"table": "ha_east_rest_osp_alb","location": "xxxx-elblogs/Alb-Logs","region": "us-east-1"},{"table": "ha_west_rest_osp_alb""location": "xxxx-elblogs-uw2/Alb-Logs","region": "us-west-2"}}TIA,BillFollowComment"

Answer: 0Figured out what the issue was - my json wasn't formatted correctly. When formatted correctly works like a charmCommentSharebyoungmananswered 3 years ago


Question: Metric graphs of Instances in Lightsail without any data

The Metric graphs of Instances in Lightsail have not any data for few days.But the instance works normally.I have reboot the instance but the problem still exists.How can I fix it?FollowComment

Answer: "0Which metrics are not showing data?https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-viewing-instance-health-metricsCommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-5450804 2 months agoCPU utilization & Burst capacityShare0There are a few things you can check:Check the status of your instance. Make sure that your instance is running and healthy. You can do this by going to the Lightsail console and selecting your instance. If your instance is not running, you can start it by clicking the Start button. If your instance is healthy, you will see a green check mark next to the Status column.Check the CloudWatch metrics for your instance. CloudWatch is a service that collects and stores metrics from your AWS resources. You can use CloudWatch to view metrics for your Lightsail instance. To do this, go to the CloudWatch console and select the Metrics tab. In the Namespaces list, select Lightsail. You will see a list of metrics for your instance. If the metric graphs are not generating new data, you will see a MissingData message next to the metric.Check the Lightsail logs. Lightsail logs all of the events that occur on your instance. You can use the Lightsail console to view the logs. To do this, go to the Lightsail console and select your instance. Click the Logs tab. You will see a list of logs for your instance. If you see any errors in the logs, this may be the cause of the problem.Restart the CloudWatch agent. To restart the CloudWatch agent, go to the CloudWatch console and select the Metrics tab. In the Namespaces list, select CloudWatch Agent. Click the Restart button.Check the CloudWatch agent logs. The CloudWatch agent logs all of the events that occur when it collects metrics. You can use the CloudWatch console to view the logs. To do this, go to the CloudWatch console and select the Logs tab. In the Log Groups list, select CloudWatch Agent. You will see a list of logs for the CloudWatch agent. If you see any errors in the logs, this may be the cause of the problem.CommentShareMarawan Mamdouhanswered 2 months agorePost-User-5450804 a month agoNot applicable to my problem…Share"


Question: Node.js application Buffers are created as empty in ECS Fargate

"Hello, I'm running a NodeJS microservice API on ECS Fargate.One of these services uses NodeJS's Buffer.from constructor to create a new buffer from a string however the buffer creation is faulty and it seems to happen only with the deployed ECS Fargate version (testing locally as well as a built copy on a separate server and there it works, buffer is properly created). For some reason, Buffers created in ECS Fargate are empty - they are valid Buffers but the size is 0 bytes when it should be 32 bytes.Debugging shows that the payload exists the moment the Buffer is being created. I'm a first time user of Fargate and ECS in general and I have no idea if there are some kind of hidden limitations with ECS runtimes that I can't seem to find from documentation.The service is allocated with 0.25vCPU and 1GB of RAM. From graphs I can see that the CPU utilization is 10% and MemoryUtilization is 8% so it doesn't seem to be an actual resource starvation that is causing it.Is this intended behaviour with ECS or is this something that is configurable or am I just overlooking something?FollowCommentHenrique Santana 4 months agoIt should not have any issues. Are you done something similar to this? |var buf = Buffer.from('abc');console.log(buf); If yes, it shouldn't create an empty buffer. What about the logs? What are you seeing on them?Share"


Question: Athena query "Access denied when writing to location: s3://***"

"As the title, i've try to test a query to create a new database. The workgroup been set, and the query is pretty simple like this along with the error.So i checked the iam, seems fineThen the s3 policyAnd the odd part is the query result is failed, but the database is actually been created.BTW, ive try the create a new table in this database too, same error of failed, but table is created.Is anyone can help me to solve this?FollowComment"

Answer: "0I request you to check a few more things on your end:Are there any Access Control Lists enabled on your bucket? If yes, please check whether the account has the write permissions or not.Are the s3 bucket and the Athena not in the same account? If you are trying to access the s3 bucket which is in an account other than the account from which this Athena query has been run, then please follow this documentation.I think that within your bucket policy, another resource might be missing which is 'arn:aws:s3::<your-bucket>'. Please try to add this as well.Please check if there are any group permissions that are added on top of your role which is preventing the access to the s3 bucket for writing data.CommentShareSUPPORT ENGINEERChaituanswered 8 months ago"


Question: How can you add redundancy for an EventBridge message router bus

"I have been looking into event-driven architecture for asynchronous communication between services and a design pattern I see quite often is the Single Bus*, Multi Account pattern, where services publish events to a Global message router EventBridge event bus, which then routes these events to other service's local EventBridge event buses based on Rules and they can decide how they want to use the event. A bunch of AWS Serverless talks mention the advantages but none have talked about how a central router bus like this can be a single point of failure. I am looking for ways I can minimize this risk by adding redundancy or otherwise.AWS talks referenced:AWS re:Invent 2022 - Building next-gen applications with event-driven architectures (API311-R) AWS re:Invent 2020: Building event-driven applications with Amazon EventBridgeFollowComment"

Answer: 0I think this has been discussed in several talk. You probably like to look at a MultiBus Multi Account pattern.AWS re:Invent 2022 - Designing event-driven integrations using Amazon EventBridge (API307-R)CommentShareJimmyDqvanswered 2 months ago


Question: EKS - antivirus and best practices

"Hi,For compliance and ISO reasons there could be needs of implementing antivirus (think realtime scanning, file scanning, file integrity monitoring, etc.).What are the best practices around this and EKS? I tried to find anything around antivirus on AWS pages and documentation without any luck. When looking for the same in Google Cloud and GKE I find both information, guides and references.The kind of questions or should I say answers I am looking for is for example: Protection of worker nodes, protection of containers running, pros & conns with different approaches and so on.Anyone have any experience in this here?Thanks in advance for any feedback.Br,AFollowComment"

Answer: "0Hi kjellkod,I am searching for articles and documentation on recommendations and best practices on installing anti-virus in AWS EKS optimized worker nodes as well.I particularly like this note which can be found from the articlehttps://cloud.google.com/solutions/installing-antivirus-and-file-integrity-monitoring-on-container-optimized-os"Note: Container-Optimized OS is already hardened and is engineered to prevent execution of non-containerized applications. Compliance auditors frequently accept these measures as a sufficiently secure compensating control instead of AV and possibly even FIM if properly documented."Especially when you have security folks who do not understand how Linux, Kubernetes and containers works and insist on installing anti-virus on every worker-nodes, pods just for compliance sake and scanning everything. Do they even know that most anti-virus scan for files looking for Windows virus signatures. Hence if we have samba server serving files to windows clients, then it makes sense to install anti-virus on Linux to prevent the spreading of viruses. My security folks even scan /proc, /sys, /dev etc! You will realize that the anti-virus will take up all the CPU and memory and makes the server crawls. For anti-virus software that uses kernel hooks, you may start to see a lot of error messages in your /var/log/messages. If you update the kernel and the anti-virus kernel module is not up to date yet, you may not even be able to boot up properly if you enable it.Not saying we do not need anti-virus on Linux, essence is that you must know what you are protecting and tune it properly. If not, it is just wasting precious cpu and memory.Amazon EKS optimized Linux is based on Redhat. Look at Redhat article on "Is an virus protection software needed for Red Hat Enterprise Linux?https://access.redhat.com/solutions/9203Back to anti-virus on EKS worker nodes. I hope AWS will also publish something like saying that the AMI image provided is already optimized and hardened. The image is also scanned and free of virus.We never expose worker nodes to public. Only the pods run applications which exposes the services. So is there a need to scan the worker node? Any changes to the file system will be gone when we spin up the next worker node. That is the same for containers. So if you want to scan, scan the file shares if your services uses some persistence storage to store files.just sharing my thoughts.Best Regards.CommentSharelancezanswered 3 years ago"


Question: Network Error - 53 when trying to mount on Windows 10 Pro

"Hi,I am having problem similar to another user when trying to set up the aws storage gateway for windows. I have done the following:I have configured an EC2 instance with size m4.xlarge and 150 GB of cache.I have set up the following inbound ports for my security group: 80, 20048, 22, 111, and 2049.I have set up the file gateway and selected the intended S3 bucket.When I try to mount the drive via command prompt, I get the following error: Network Error - 53.Can someone please help me?FollowComment"

Answer: "0I see you mentioned Windows 10 and the NFS ports. For NFS on Windows it would require the Services for NFS feature be installed on the client.Though if you are using Windows as the client I would recommend SMB over NFS.If you are still having issues if you can PM me your instance ID along with Gateway ID information I can take a look on my side to help troubleshoot.Thank You,Brian C. (AWS)CommentShareBrian Canswered 3 years ago0Hi Brian,Sorry for my late reply. I am still having issues setting up the storage gateway for a windows 10 NFS client. I am trying to implement the storage gateway as a network drive to access my files stored in S3.The example I am referencing can be seen in the youtube video here in this link: https://www.youtube.com/watch?v=tP5edaxBEEII want to implement the file and storage gateway exactly as is shown in the youtube video.Can you please help me?Sincerely,AdithyaCommentSharearavichandrananswered 3 years ago0Adithya,While the video you linked is great, it was made before we offered SMB as an option for File Gateway. For Windows we'd recommend SMB over NFS.From the setup it sounds like you are wanting to use the gateway in EC2 but the client be onprem. For best performance. the gateway should be as close to the clients as possible and if the client is onprem then we recommend running the gateway onprem in one of our supported hypervisors such as VMware, Hyper-V, or KVM. This is due to NFS and SMB being latency sensitive when it comes to performance.With that said, if you are wanting to test this on Windows with NFS, the Network Error 53 generally means a connectivity issue. The Windows NFS client is limited to NFS 3 only so you'd need to make sure that ports 111, 2049, and 20048 are open between the gateway and your client.If you are still getting that error with all 3 ports open, please PM me your EC2 instance ID along with the Gateway ID and region.Thank you,Brian C.CommentShareBrian Canswered 3 years ago"


Question: Authorization header (what about in form parameter?)

We currently support Authorization being passed in the header.But we have one customer saying that they cannot pass header parameter and can only pass form parameter.How can we enforce Auth if authorization is coming from form parameters?Note: we are using Hydra as OAuth2 serverFollowComment

Answer: "0Hello:Unfortunately there is currently no native authorization in API Gateway that supports access to the payload (where form parameters would be present). You would have to pass this information to your integration and authorize the request in your integration.Regards,BobCommentShareEXPERTAWS-User-0395676answered 4 years ago0when you say Integration... you mean like in a Lambda Integration. I will be checking the client credentials against hydra in one of the Lambda itselfthat is exactly what I am thinking. But having doubts if it beats the best practicesunfortunately, we need to support the customer's needsCommentShareJohnson965answered 4 years ago0when you say Integration... you mean like in a Lambda IntegrationCorrect. Apologies for the inconvenience.Regards,BobCommentShareEXPERTAWS-User-0395676answered 4 years ago"


Question: Glue Studio - Visual graph editor for an existing job

I created the Glue job with the neat graph editor.Is there no way to edit the same job once run with that editor???FollowComment

Answer: 0You can do this by visiting "Jobs" in the AWS Glue page and selecting your existing job. You should be able to edit visually from thereCommentShareghudginsanswered 6 months ago


Question: "Additional costs for monitoring web requests ,web ACLS and rules"

"I would like to enable Amazon CloudWatch to monitor web requests ,web ACLS and rules but the documentation does not say if there is an additional charges for that. I know there is charges for using CloudWatch for WAF logs. Please if anyone could clarify if there is an additional charges to my question.Here is the link belowhttps://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.htmlFollowComment"

Answer: "0Cloudwatch charge you by use. Check calculator for estimate.https://calculator.aws/#/addService/CloudWatchI recommend you send logs to opensearch service, is better to create dashboards and filter for this type of job.https://aws.amazon.com/blogs/security/how-to-analyze-aws-waf-logs-using-amazon-elasticsearch-service/CommentSharepinguinouyanswered 5 months ago"


Question: Double vCPU units to the number configured are used in EKS Fargate

HiWe are running 500 instances in EKS Fargate profile. Here is the k8s configuration as per https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html          resources:             limits:               cpu: '2'               memory: 16Gi             requests:               cpu: '2'               memory: 16GiExpectation:1000 vCPUs should be usedActual:Cloudwatch shows 2000 vCPUs getting consumed.Cost is double than than estimated amount.Any help is much appreciated.ThanksFollowComment

Answer: "2WS Fargate allocates CPU resources in terms of AWS vCPU units. For each vCPU, Fargate provides 1024 CPU units. The CPU value you specify in your pod configuration is converted to an equivalent number of vCPU units.In your configuration, you've specified '2' for the CPU limit and request, which means you're requesting 2 vCPUs for each pod. If you're running 500 such instances, you would indeed expect a total of 1000 vCPUs to be used.However, EKS on Fargate has a different method for vCPU calculation. As per the official AWS documentation, the actual number of vCPUs available for your application to use is 1/2 of what is specified in the CPU value. The remaining half is reserved for system-level processes.This could be the reason why CloudWatch shows 2000 vCPUs getting consumed. Your application is using 1000 vCPUs (2 vCPUs for each of the 500 instances), and the same amount is being used by system-level processes, leading to a total of 2000 vCPUs.Unfortunately, there is not much you can do about this since it's a feature of how EKS on Fargate works. If the cost is higher than what you're willing to pay, you might need to consider other options like using EC2 instances for your EKS clusters or optimizing your application to use fewer resources.CommentShareEXPERTsedat_salmananswered 19 days agorePost-User-6312243 19 days agoThanks for your explanation. Can you please point me to the documentation that mentions about the system level processes that is accounted in the billing. Also will the memory also be doubled? In our case, we specified 16GB. Does it account for 32 GB ?Share"


Question: Greengrass v2 - moquette - Empty server certificate chain

HelloI have ESP32 configured to connect to AWS IoT Core - working fine.I'd like to use Greengrass for local processing and messages filtering.For this I installed Greengrass V2 on RPi device with following components:aws.greengrass.clientdevices.mqtt.Bridge2.0.1Runningaws.greengrass.Nucleus2.4.0Finishedaws.greengrass.clientdevices.IPDetector2.0.2Runningaws.greengrass.clientdevices.Auth2.0.2Runningaws.greengrass.clientdevices.mqtt.Moquette  2.0.1RunningI replaced AmazonRootCA1.pem with /greengrass/v2/work/aws.greengrass.clientdevices.Auth/ca.pemI assume ESP32 is able to connect - no errors in greengrass.log fileHowever Moquette shows "Empty server certificate chain" error2021-09-03T08:22:07.061Z [INFO] (nioEventLoopGroup-3-4) io.moquette.broker.metrics.MQTTMessageLogger: Channel Inactive. {}2021-09-03T08:22:09.504Z [ERROR] (nioEventLoopGroup-3-5) io.moquette.broker.NewNettyMQTTHandler: Unexpected exception while processing MQTT message. Closing Netty channel. CId=null. {}io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty server certificate chainat io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:478)at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)at io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)at io.moquette.broker.metrics.BytesMetricsHandler.channelRead(BytesMetricsHandler.java:51)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:719)at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:655)at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:581)at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493)at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989)at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)at java.base/java.lang.Thread.run(Thread.java:829)Caused by: javax.net.ssl.SSLHandshakeException: Empty server certificate chainat java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:336)at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:292)at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:283)at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:390)at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:375)at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1074)at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1061)at java.base/java.security.AccessController.doPrivileged(Native Method)at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1008)at io.netty.handler.ssl.SslHandler.runAllDelegatedTasks(SslHandler.java:1557)at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1571)at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1455)at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1282)at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1329)at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:508)at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:447)... 25 moreAny idea what is wrong with my deployment?FollowComment

Answer: "0It looks the Moquette is using/greengrass/v2/work/aws.greengrass.clientdevices.mqtt.Moquette/keystore.jksfor SSL certificatesI was trying to verify what certificates are imported there, however password is required.Listing certs in keystore shows:keytool -list -v -keystore /greengrass/v2/work/aws.greengrass.clientdevices.mqtt.Moquette/keystore.jksEnter keystore password:*****************  WARNING WARNING WARNING  ******************* The integrity of the information stored in your keystore  **** has NOT been verified!  In order to verify its integrity, **** you must provide your keystore password.                  *******************  WARNING WARNING WARNING  *****************Keystore type: PKCS12Keystore provider: SUNYour keystore contains 1 entryAlias name: pkCreation date: 3 Sep 2021Entry type: PrivateKeyEntryCertificate chain length: 0Can anyone check /greengrass/v2/work/aws.greengrass.clientdevices.mqtt.Moquette/keystore.jks of his Greengrass deployment?CommentSharebrestomekanswered 2 years ago0Hi,Thanks for using Greengrass.Which address and port are you connection to from your ESP32?The supported way to get the CA and the address is not by copying /greengrass/v2/work/aws.greengrass.clientdevices.Auth/ca.pem. The client device is expected to use the discovery API to get the broker information.See this tutorial to learn about discovery and broker-client device interaction: https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-discover-api.htmlFor the discovery to work, client device has to be associated to the core beforehand. https://docs.aws.amazon.com/greengrass/v2/developerguide/associate-client-devices.htmlAfter following this workflow, if you still get the same issue, please reply with greengrass.log attached.In the meanwhile, for the logs snippet you provided, can you provide the complete greengrass.log file?CommentSharesushantAtAWSanswered 2 years ago0To check the server certificate being used by the broker, can you run the following command:openssl s_client -showcerts -connect localhost:8883This assumes, you have not configured the server port to be something different than 8883.CommentSharesushantAtAWSanswered 2 years ago0HelloMy device is associated with Core Device and I'm able to use discovery API to get CA certificate and IP address of Greengrass device.I'm using Arduino as follows to connect to IOT Core endpoint#include "WiFiClientSecure.h"#include <MQTTClient.h>       -> https://github.com/256dpi/lwmqttWiFiClientSecure net = WiFiClientSecure();MQTTClient client = MQTTClient(256);net.setCACert(AWS_CERT_CA);           <- for IoT Core this is AmazonRootCA1.pem, for Greengrass it's CA cert from discovery APInet.setCertificate(AWS_CERT_CRT);     <- Device certnet.setPrivateKey(AWS_CERT_PRIVATE); <- Device private keynet.setInsecure();                                  <- temporary enabled for troubleshootingwhile (!client.connect(THINGNAME)) {Serial.print(".");delay(500);Serial.println(client.lastError());Serial.println(client.returnCode());}For AWS IoT core endpoint this code is working.For Greengrass it doesn't with error showed in first post.I also tested Greengrass core with Python test scripts - test passed - I was able to connect to Greengrass core with client cert and keygreengrass.log for ESP32:2021-09-03T19:23:03.178Z [DEBUG] (nioEventLoopGroup-3-3) io.moquette.broker.AutoFlushHandler: Initializing autoflush handler on channel [id: 0xbc5f1c8d, L:/192.168.0.148:8883 - R:/192.168.0.143:53004] Cid: null. {}2021-09-03T19:23:03.625Z [DEBUG] (nioEventLoopGroup-3-3) io.moquette.broker.MQTTConnection: readCompleted client CId: null. {}2021-09-03T19:23:03.739Z [ERROR] (nioEventLoopGroup-3-3) io.moquette.broker.NewNettyMQTTHandler: Unexpected exception while processing MQTT message. Closing Netty channel. CId=null. {}io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty server certificate chaingreengrass.log for Python test:2021-09-03T19:23:33.380Z [DEBUG] (nioEventLoopGroup-3-1) io.moquette.broker.AutoFlushHandler: Initializing autoflush handler on channel [id: 0xddaefe2f, L:/192.168.0.148:8883 - R:/192.168.0.150:55917] Cid: null. {}2021-09-03T19:23:33.601Z [DEBUG] (nioEventLoopGroup-3-1) io.moquette.broker.MQTTConnection: readCompleted client CId: null. {}2021-09-03T19:23:33.608Z [INFO] (nioEventLoopGroup-3-1) com.aws.greengrass.device.DeviceAuthClient: Creating new session. {}2021-09-03T19:23:33.611Z [DEBUG] (nioEventLoopGroup-3-1) com.aws.greengrass.device.DeviceAuthClient: Certificate was not issued by local CA. {}2021-09-03T19:23:33.613Z [DEBUG] (nioEventLoopGroup-3-1) software.amazon.awssdk.core.interceptor.ExecutionInterceptorChain: Creating an interceptor chain that will apply interceptors in the following order: [software.amazon.awssdk.core.internal.interceptor.HttpChecksumRequiredInterceptor@9a16d6, software.amazon.awssdk.awscore.interceptor.HelpfulUnknownHostExceptionInterceptor@152af19]. {}2021-09-03T19:23:33.619Z [DEBUG] (nioEventLoopGroup-3-1) software.amazon.awssdk.request: Sending Request: DefaultSdkHttpFullRequest(httpMethod=POST, protocol=https, host=greengrass-ats.iot.eu-west-1.amazonaws.com, port=8443, encodedPath=/greengrass/v2/verifyClientDeviceIdentity, headers=[amz-sdk-invocation-id, Content-Length, Content-Type, User-Agent], queryParameters=[]). {}According to IoT Core and MQTT broker (Moquette)  documentation, MQTT versions on both endpoints are the same MQTT v3.1.1I also checked TLS of IoT Core and MQTT broker (Moquette) - except certificates, SSL sessions are sameI have no idea why with IoT Core endpoint ESP32 can connect and exchange messages, but with Greengrass it's failing.CommentSharebrestomekanswered 2 years ago0I'll check this library for greengrass communicationhttps://github.com/aws-samples/arduino-aws-greengrass-iotCommentSharebrestomekanswered 2 years ago0I was able to connect ESP32 to Greengrass with https://github.com/aws-samples/arduino-aws-greengrass-iotCommentSharebrestomekanswered 2 years ago"


Question: Error in Connecting DynamoDB table from PyCharm Python file

"Code: ResourceNotFoundException, Message: Requested resource not foundFollowComment"


Question: AWS Client VPN Certs

Using AWS Client VPN with the mutual authentication option via certs can we have separate client certs for each connecting machine or do they all have to use the same client cert?FollowComment

Answer: "0Accepted AnswerCustomers can create multiple Client Certificates as long as the CA of the certificate is the same and CVPN is aware of it.You only need to upload the client certificate to ACM when the Certificate Authority (Issuer) of the client certificate is different from the Certificate Authority (Issuer) of the server certificateSo by associating the Client Cert with CVPN, you are telling CVPN what CA to trust.CommentSharejkapsanswered 4 years ago"


Question: Cloud rendering with AWS + Nvidia for Octane 2021

"Hi,In my current job, I work in a studio that specializes in 3D and VFX.Our goal is to render scenes from our pipeline on an AWS virtual machine with the best GPU configuration.We use the following software in our pipeline:Maya Autodesk 2021 (using Octane 2021) , After Effects 2020.Is it possible to use your services in combination with AWS for rendering scenes from our pipeline?Could you please explain how? Can you give us a tutorial or a guide on how to do that?Waiting for your replay,Thank you.FollowComment"


Question: How to consume EC2 Image shared using AWS RAM

"Hi,I want to share EC2 Image Builder AMI using AWS Resource Access Manager with AWS user outside organisation.I have prepared EC2 Image Builder AMI on source AWS account. Created AWS RAM resource to share the same AMI. Also added AWS account ID of destination AWS Account as a Principal.I accepted resource sharing invitation in destination AWS account. I could see Image recipe for the shared AMI and output resource pointing to source AMI.When I click on AMI ID, it opens AMI section in EC2 console and says no "No matching image found".I expect the AMI to be available in the destination account, so that I can create new EC2 instance based on shared AMI using AWS RAM mechanism.Not sure why I am not seeing shared AMI in destination AWS account. Though I see the shared resource in AWS RAM section.Can someone suggest how can I consume the shared EC2 Image using AWS RAM in destination account?Thanks in advance.FollowComment"

Answer: 0Just checking....make sure you are in the same region.CommentShareEXPERTkentradanswered 2 months agorePost-User-9687007 2 months agoYes I am using same region for both the accounts. Thanks for the response.Share


Question: Amazon lex Chat Bot test

"Hello im trying to test my chatbot, but this keeps appearing "Cannot call DialogCodeHook for Intent OrderMedicine. BotAlias/LocaleId TestBotAlias/en_US doesn't have an associated Lambda Function."FollowComment"

Answer: "0Accepted AnswerHi, if you're creating a custom chat bot with Amazon Lex, you'll need to deploy a Lambda function for it to use. Please refer to this tutorial for further understanding on how to do so.https://docs.aws.amazon.com/lex/latest/dg/getting-started-ex2.htmlCommentSharehamltmanswered 8 months ago0Recommend you to use Lex v2 and Lex v1 if you are not already on Lex V2.Please use this link https://docs.aws.amazon.com/lexv2/latest/dg/lambda.html#lambda-attach to attach lambda function to a Lex v2 bot. If not you could always disable the lambda integration/code hook by unchecking the "Use a Lambda function for initialization and validation" checkbox at the very end of the intent page.CommentShareDonanswered 8 months ago"


Question: "How to free a instance, been "stopping" for 15 min."

"I have a lightsail server that times out. FAQ reccommended that I start and stop but it is stuck in stopping phase for over 15 min. No msg about degraded hardware, fairly new instance and low usasage. Is this common and do you have any tricks to try?FollowComment"

Answer: 0Stopped less than a minute after I posted question.CommentSharerePost-User-6756402answered 8 months ago


Question: Unable to switch to gp3 Storage Type an RDS MS SQL Server

"I have an RDS MS SQL Server (SQL Server Web Edition) version 15.00.4236.7.v1 with instance type db.t3.large and I want to switch Storage Type from gp2 to gp3, but everytime I try to apply the change the following message shows:We're sorry, your request to modify DB instance db-name has failed.Cannot modify the instance class because there are no instances of the requested class available in the current instance's availability zone. Please try your request again at a later time.RDS is running in N.Virginia (us-east-1), specifically use1-az2.Any thoughs ?FollowComment"

Answer: "0Hello,I have tested this with similar configuration and the AZ as you have mentioned and I am able to modify the instance from gp2 to gp3. Can you please give a try once again.Hope it helps and if does, please accept the answer so that community benefits for clarity, Thank you!CommentSharegokul_Ganswered 3 months ago0Hello @gokul_G I tried again and it failed again:Do you think it has to be something in my account ?CommentShareHigheranswered 3 months ago"


Question: AWS Certificate Manager Pending Validation when DNS validation is successful

"I'm attempting to renew a certificate created in AWS Certificate Manager (ACM), but I'm stuck in the dreadful PENDING_VALIDATION status; this is a DNS validated certificate where I validated using the CNAME record.Under domains I can see the domain validation has a status of Success and Renewal Status of SuccessIf I run aws acm describe-certificate --certificate-arn "examplearn", I get a return showing DomainValidationOptions with the ValidationStatus being success for the CNAME validation.Replaced with "example" for sensitive values{    "Certificate": {        "CertificateArn": "arn:aws:acm:us-east-1:example:certificate/certid",        "DomainName": "*.example.com",        "SubjectAlternativeNames": [            "*.example.com"        ],        "DomainValidationOptions": [            {                "DomainName": "*.example.com",                "ValidationDomain": "*.example.com",                "ValidationStatus": "SUCCESS",                "ResourceRecord": {                    "Name": "examplename",                    "Type": "CNAME",                    "Value": "examplevalue"                },                "ValidationMethod": "DNS"            }        ],        "Serial": "",        "Subject": "CN=*.example.com",        "Issuer": "Amazon",        "CreatedAt": "2019-01-17T12:53:01-08:00",        "IssuedAt": "2021-10-22T21:21:50.177000-07:00",        "Status": "ISSUED",        "NotBefore": "2021-10-22T17:00:00-07:00",        "NotAfter": "2022-11-23T15:59:59-08:00",        "KeyAlgorithm": "RSA-2048",        "SignatureAlgorithm": "SHA256WITHRSA",        "InUseBy": [            "example",            "example",            "example",            "example"        ],        "Type": "AMAZON_ISSUED",        "RenewalSummary": {            "RenewalStatus": "PENDING_VALIDATION",            "DomainValidationOptions": [                {                    "DomainName": "*.example.com",                    "ValidationDomain": "*.example.com",                    "ValidationStatus": "SUCCESS",                    "ResourceRecord": {                        "Name": "examplename",                        "Type": "CNAME",                        "Value": "examplevalue"                    },                    "ValidationMethod": "DNS"                }            ],            "UpdatedAt": "2022-09-21T23:39:15.161000-07:00"        },        "KeyUsages": [            {                "Name": "DIGITAL_SIGNATURE"            },            {                "Name": "KEY_ENCIPHERMENT"            }        ],        "ExtendedKeyUsages": [            {                "Name": "TLS_WEB_SERVER_AUTHENTICATION",                "OID": "1.3.6.1.5.5.7.3.1"            },            {                "Name": "TLS_WEB_CLIENT_AUTHENTICATION",                "OID": "1.3.6.1.5.5.7.3.2"            }        ],        "RenewalEligibility": "ELIGIBLE",        "Options": {            "CertificateTransparencyLoggingPreference": "ENABLED"        }    }}Followed instructions successfully in https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-pending-validation/  (checking cname response exactly matches what is in acm CNAME values when copy pasting)The site domain registration is in Route 53 with NS pointing to cloudflare, where DNS is managed.Is there something obvious that pops out to you?  Thank you!FollowComment"

Answer: "0Accepted AnswerThe update is an asynchronous process, so you should wait a little longer and contact support if it seems impossible.Understanding renewal timingManaged renewal for ACM certificates is an asynchronous process. This means that the steps don't occur in immediate succession. After all domain names in an ACM certificate have been validated, there might be a delay before ACM obtains the new certificate. An additional delay can occur between the time when ACM obtains the renewed certificate and the time when that certificate is deployed to the AWS resources that use it. Therefore, changes to the certificate status can take up to several hours to appear in the consolehttps://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-renewal.htmlCommentSharetakakunianswered 7 months agoEXPERTTushar_Jreviewed 7 months agorePost-User-6135265 7 months agoThank you for the consolation!  Decided to finally pay for the upgrade for support since this has been over a day.SharerePost-User-6135265 7 months agoCertificate was renewed after contacting amazon support; yay!Share"


Question: Node.js Elastic Beanstalk environment error Cannot find module 'node-linux-arm64/package.json'

"I am having issues getting my Node.js project to run on AWS Elastic Beanstalk.It was running fine for months, but after the Christmas break, it is now failing.Here is the output from the eb-engine.log file:[INFO] Executing instruction: Use NPM to install dependencies[INFO] use npm to install dependencies[INFO] Running command /bin/sh -c npm config set jobs 1[INFO] Running command /bin/sh -c npm --production installnpm ERR! code 1npm ERR! path /var/app/staging/node_modules/nodenpm ERR! command failednpm ERR! command sh -c node installArchSpecificPackagenpm ERR! node:internal/modules/cjs/loader:936npm ERR! throw err;npm ERR! ^npm ERR!npm ERR! Error: Cannot find module 'node-linux-arm64/package.json'npm ERR! Require stack:npm ERR! - /var/app/staging/node_modules/node/installArchSpecificPackage.jsnpm ERR! at Function.Module._resolveFilename (node:internal/modules/cjs/loader:933:15)npm ERR! at Function.resolve (node:internal/modules/cjs/helpers:108:19)npm ERR! at ChildProcess.<anonymous> (/var/app/staging/node_modules/node-bin-setup/index.js:19:27)npm ERR! at ChildProcess.emit (node:events:527:28)npm ERR! at maybeClose (node:internal/child_process:1092:16)npm ERR! at Process.ChildProcess._handle.onexit (node:internal/child_process:302:5) {npm ERR! code: 'MODULE_NOT_FOUND',npm ERR! requireStack: [npm ERR! '/var/app/staging/node_modules/node/installArchSpecificPackage.js'npm ERR! ]npm ERR! }This is using the "Node.js 16 running on 64bit Amazon Linux 2/5.6.3" platform.Any help would be greatly appreciated.FollowComment"

Answer: "0Accepted AnswerHopefully, this helps someone else if they experience this same issue.The issue was caused by one of my project dependencies that updated.Within the source code of this dependency, it was requiring a different version of node within its package.json.Removing the dependency on the module within our app resolved the problem.CommentSharelewis-12answered 5 months ago"


Question: What resources do SSM managed instances actually need permissions for?

"The AmazonSSMManagedInstanceCore managed policy includes **Resource: *** in all of its permission clauses, including for ssm:GetParameter[s].  I do not wish to give all of my instances permissions to read all of our parameters, and there are likely other resources I do not want them all having access to (PutInventory seems like another one I might prefer to tighten).  What resources, parameters in particular, does SSM actually need access to for managing instances?FollowComment"

Answer: "0AmazonSSMManagedInstanceCore IAM Policy enables an instance to use Systems Manager core service functionality. It provides minimum permissions which allow an instance to:Register as a managed instanceSend heartbeat informationSend and receive messages for Run Command and Session ManagerRetrieve State Manager association detailsRead parameters in Parameter StoreFor more details about this policy, please refer to the following Blog Post[1]However, it is not required to have the ability to read parameters, the AmazonSSMManagedInstanceCore policy is a baseline policy that includes the most common actions used. You can create your own IAM Policy that provides access to the System Manager features you wish to use in your environment. Please refer to following documentation[2] for a list of SSM Actions that are available within Systems Manager.Additionally, the Systems Manager documentation will often include IAM Polices/Permissions required for each service within Systems Manager. For an example of this, see the following SSM Documentation for Session Manager[3] which goes over the minimal permissions you can provide to an EC2 instance to allow access for Session Manager Actions on your EC2 instance.So you can create an IAM Policy within your account to provide your EC2 Instance with permissions for the SSM services you wish to use rather then only use the AmazonSSMManagedInstanceCore IAM Policy.[1] Applying managed instance policy best practices - https://aws.amazon.com/blogs/mt/applying-managed-instance-policy-best-practices/[2] Actions, resources, and condition keys for AWS Systems Manager - Actions defined by AWS Systems Manager - https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanager.html#awssystemsmanager-actions-as-permissions[3] Create a custom IAM role for Session Manager - https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-create-iam-instance-profile.htmlCommentShareSUPPORT ENGINEERMichael_Hanswered a year ago"


Question: issue access to s3 bucket from eu-north-1

"Hi, i have issue with vpc in region eu-north-1.Access from VPC(eu-north-1) to different region s3, we have a problem:curl -v "https://s3.eu-west-1.amazonaws.com/user-uploads.wheely.com/52c2bef8d8e6beac57000001.jpg "Trying 52.218.54.2...TCP_NODELAY setExpire in 200 ms for 4 (transfer 0x55a69820bfb0)Connected to s3.eu-west-1.amazonaws.com (52.218.54.2) port 443 (#0)ALPN, offering h2ALPN, offering http/1.1successfully set certificate verify locations:CAfile: noneCApath: /etc/ssl/certsTLSv1.3 (OUT), TLS handshake, Client hello (1):TLSv1.3 (IN), TLS handshake, Server hello (2):TLSv1.2 (IN), TLS handshake, Certificate (11):TLSv1.2 (IN), TLS handshake, Server key exchange (12):TLSv1.2 (IN), TLS handshake, Server finished (14):TLSv1.2 (OUT), TLS handshake, Client key exchange (16):TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):TLSv1.2 (OUT), TLS handshake, Finished (20):TLSv1.2 (IN), TLS handshake, Finished (20):SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256ALPN, server did not agree to a protocolServer certificate:**  subject: C=US; ST=Washington; L=Seattle; O=Amazon.com, Inc.; CN=**.s3-eu-west-1.amazonaws.comstart date: Jun 23 00:00:00 2021 GMTexpire date: Jul 24 23:59:59 2022 GMTsubjectAltName: host "s3.eu-west-1.amazonaws.com" matched cert's "s3.eu-west-1.amazonaws.com"issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert Baltimore CA-2 G2SSL certificate verify ok.GET /user-uploads.wheely.com/52c2bef8d8e6beac57000001.jpg HTTP/1.1Host: s3.eu-west-1.amazonaws.comUser-Agent: curl/7.64.0Accept: /< HTTP/1.1 404 Not Found< x-amz-request-id: VBNDTTWEMGP30VVQ< x-amz-id-2: 08f8noW5EJEP9MjNJCIuKWGOcnx9QDgkqotd+j97dPAw9naIm9KGDIVHU4h32CszXX/zvRI8bOw=< Content-Type: application/xml< Transfer-Encoding: chunked< Date: Mon, 20 Sep 2021 09:09:05 GMT< Server: AmazonS3<<?xml version="1.0" encoding="UTF-8"?>  Connection #0 to host s3.eu-west-1.amazonaws.com left intact<Error>NoSuchBucket<Message>The specified bucket does not exist</Message><BucketName>user-uploads.wheely.com</BucketName><RequestId>VBNDTTWEMGP30VVQ</RequestId><HostId>08f8noW5EJEP9MjNJCIuKWGOcnx9QDgkqotd+j97dPAw9naIm9KGDIVHU4h32CszXX/zvRI8bOw=</HostId></Error>if i try access from different region(eu-central-1) - it ok:curl -v "https://s3.eu-west-1.amazonaws.com/user-uploads.wheely.com/52c2bef8d8e6beac57000001.jpg "Trying 52.218.62.91...TCP_NODELAY setConnected to s3.eu-west-1.amazonaws.com (52.218.62.91) port 443 (#0)ALPN, offering h2ALPN, offering http/1.1successfully set certificate verify locations:CAfile: /etc/ssl/cert.pemCApath: noneTLSv1.2 (OUT), TLS handshake, Client hello (1):TLSv1.2 (IN), TLS handshake, Server hello (2):TLSv1.2 (IN), TLS handshake, Certificate (11):TLSv1.2 (IN), TLS handshake, Server key exchange (12):TLSv1.2 (IN), TLS handshake, Server finished (14):TLSv1.2 (OUT), TLS handshake, Client key exchange (16):TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):TLSv1.2 (OUT), TLS handshake, Finished (20):TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):TLSv1.2 (IN), TLS handshake, Finished (20):SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256ALPN, server did not agree to a protocolServer certificate:**  subject: C=US; ST=Washington; L=Seattle; O=Amazon.com, Inc.; CN=**.s3-eu-west-1.amazonaws.comstart date: Jun 23 00:00:00 2021 GMTexpire date: Jul 24 23:59:59 2022 GMTsubjectAltName: host "s3.eu-west-1.amazonaws.com" matched cert's "s3.eu-west-1.amazonaws.com"issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert Baltimore CA-2 G2SSL certificate verify ok.GET /user-uploads.wheely.com/52c2bef8d8e6beac57000001.jpg HTTP/1.1Host: s3.eu-west-1.amazonaws.comUser-Agent: curl/7.64.1Accept: /< HTTP/1.1 200 OK< x-amz-id-2: 13D01/jpX99SA6XRl9OVR1aQfGG0nJSWSw3aGRhG3dgyzRKTnwDsKq9QFy5d6HM1/TP9uRi1BAc=< x-amz-request-id: TNSRCJ433TJC0HDD< Date: Mon, 20 Sep 2021 09:09:01 GMT< Last-Modified: Tue, 24 Nov 2015 10:20:34 GMT< ETag: "1ef9ea0628ab23e230205ed7f307d43f"< Accept-Ranges: bytes< Content-Type: image/jpeg< Server: AmazonS3< Content-Length: 58183<Warning: Binary output can mess up your terminal. Use "--output -" to tellWarning: curl to output it to your terminal anyway, or consider "--outputWarning: <FILE>" to save to a file.Failed writing body (0 != 153)Closing connection 0TLSv1.2 (OUT), TLS alert, close notify (256):Maybe different routes to s3.If i try access to different region s3(from vpc region eu-north-1) , i get 404 error.FollowComment"

Answer: 0@Sarasaws can you help me? in region eu-north-1 issue with s3. Or path-style disable in this region? but not access to bucket via virtual hosted-style.CommentShareagrigorovanswered 2 years ago0Fix via instance iam role.CommentShareagrigorovanswered 2 years ago


Question: "Mange users permission at Instance, using SSM"

"Hi,I am new to use SSM alternative of SSH connection.So, I am trying to create a permissions for users to be used when using SSM.For example: I don't need all users to act as an (ec2-user), I need user to check the specific file only, or had a user without ability to reboot the services at instances.FollowComment"

Answer: "1If I understand your question correctly you need some local users on your ec2-instance and you need some solution that e.g. IAM users or federated users which can access the instance with their own local user.Here is the documentation how to enable this with linux instances:https://docs.aws.amazon.com/systems-manager/latest/userguide/session-preferences-run-as.htmlThere is also a blog post which describe some solution to provide access for AD users:https://aws.amazon.com/blogs/mt/configuring-aws-systems-manager-session-manager-support-federated-users-using-session-tags/CommentSharesazecisanswered 5 months agorePost-User-2140084 5 months agoThank you for sharing the details.But, I am trying to:Enable SSO with my Azure AD (already I did this).Grant users access to act at my EC2 using their Azure AD credentials.I need to assign permissions/roles to them and let them use only SSM, the alternative of using an SSH connection. I need this with different permissions, I don't need all to use the ec2-user account.Sharesazecis 5 months agoFirst of all ec2-user is not used at all by the SSM. By default it has it's own user, i.e. ssm-user.The blog describes the following solution:Corporate user browses to the ADFS portal sign-in page and provides Active Directory authentication credentials.The IdP authenticates the user and returns a SAML assertion that includes the PrincipalTag:SSMSessionRunAs=username.Client posts the assertion to the AWS SAML endpoint.The endpoint validates the assertion with an AWS STS endpoint and requests temporary security credentials on behalf of the user.Temporary credentials are returned using AWS STS AssumeRoleWithSAML. The session will be tagged with PrincipalTag:SSMSessionRunAsThe endpoint sends the sign-in URL back to the client as a redirect.The client browser is redirected to AWS Management Console.The client accesses the AWS Systems Manager console and starts the Session Manager session for a Linux instance.Session Manager starts the session using the user name specified for the SSMSessionRunAs tag for the federated session.Session starts in the given AD user context and a browser-based shell opens in a new tab.Share"


Question: File Gateway Xattr to object metadata support?

"Hi,New time experimenter to Storage Gateway!Hopefully a basic question:Does File Gateway support NFS Extended File attributes that would automatically be added to object metadata?I appreciate with 'normal' API interactions with S3 (ie outside of the file gateway framework) you can add object metadata/tags directly in the upload PUT call, but as the file gateway deals with all that we can't control that side of things.I understand xattrs with NFS only gained solid support with linux 5.9 kernel so the answer to this may be 'no not at this time... but..... watch this space'.The current workaround would be object tags added via lambda, but a ) that costs, and b) tags are ideally used to aid with things like filtering billing  etc.. (to my limited knowledge) so filling with loads of custom tags for object metadata may be undesirable.Thanks in advance!Owen.Edited by: omorgan on Jun 21, 2021 3:56 PMEdited by: omorgan on Jun 21, 2021 3:57 PMFollowComment"

Answer: "0Hi Owen,Thanks for experimenting with Storage Gateway and for your question.You are right, we don’t currently support extended attributes. Your workaround approach is sensible and you clearly understand the implications.  We will make note of your ask and consider it as part of our backlog, in case we get more demand from other customers.Thank you again for the inquiry, and let us know if there are any other questions you have or if we can help you in anyway.Best,AWS Storage Gateway teamCommentShareDaniela_Banswered 2 years ago0Thanks for the update I do appreciate it!Hopefully its something the team considers as I can see it being useful for those (kind of like us) who are trying to move from systems that are trying to use Xattrs  and file metadata to improve automation etc..As stated there is the option to use tags and Lambda's / API to add useful info, but as tags seem mainly focused towards aiding with understanding billing and adding filters to bills etc.. it seems less than optimal to use tags for essentially object metadata reasons.I appreciate taking to time to respond as it has helped massively!Owen.CommentShareommpsanswered 2 years ago"


Question: Chalice Cloudformation CI/CD pipeline multiple accounts (AWS Organizations)

"In a Chalice Lambda that is build using AWS Pipelines, how do I (best) configure and deploy different system environment variables for each of our AWS Organizations account (dev vs qa vs prod).Example:Do I need to run chalice package --stage 3 times and create 3 different artifacts (bit inefficient)?buildspec.yamlversion: 0.2phases:  install:    runtime-versions:      python: 3.8    commands:      - pip3 install --upgrade pip      - pip3 install --upgrade awscli      - aws --version      - pip3 install chalice      - pip3 install -r requirements.txt      - chalice package /tmp/packaged      - aws cloudformation package --template-file /tmp/packaged/sam.json --s3-bucket ${APP_S3_BUCKET} --output-template-file transformed.yamlartifacts:  type: zip  files:    - transformed.yamlconfig.json:{  "version": "2.0",  "app_name": "budderfly-ke2portal",  "iam_policy_file": "policy.json",  "autogen_policy": false,  "stages": {    "dev": {      "api_gateway_stage": "api",     "IOT_DATA_ENDPOINT": "https://dev-ats.iot.us-west-2.amazonaws.com"    },    "qa": {      "api_gateway_stage": "api",     "IOT_DATA_ENDPOINT": "https://qa-ats.iot.us-west-2.amazonaws.com"    },    "prod": {      "api_gateway_stage": "api",      "IOT_DATA_ENDPOINT": "https://prod-ats.iot.us-west-2.amazonaws.com"    }  }}FollowCommenthameedullah a year agochalice package is creating the final package, so yes you will have to run it 3 times. to create different packages for different environments. You can do that in single build or 3 different builds.Share"

Answer: "1Accepted AnswerHello,To create 3 different artifacts/packages for the respective environments, the chalice package command would have to be run 3 times. This can be done in the same build by adding the various commands and then outputting the artifacts as secondary artifacts. Also, the commands can also be run separately in a pipeline using 3 different build stages. See an example of outputting multiple artifacts here.CommentShareUgochukwu_Ianswered a year agoAias a year agoThank you.I now ended up using resource files in Chalice, i.e.:      - chalice package --merge-template dev.json /tmp/dev      - chalice package --merge-template qa.json /tmp/qa      - chalice package --merge-template prod.json /tmp/prod      - aws cloudformation package --template-file /tmp/dev/sam.json --s3-bucket ${APP_S3_BUCKET} --output-template-file devtransformed.yaml      - aws cloudformation package --template-file /tmp/qa/sam.json --s3-bucket ${APP_S3_BUCKET} --output-template-file qatransformed.yaml      - aws cloudformation package --template-file /tmp/prod/sam.json --s3-bucket ${APP_S3_BUCKET} --output-template-file prodtransformed.yamlwith:artifacts:  files:    - "*.yaml"  secondary-artifacts:    devartifacts:#      base-directory: $CODEBUILD_SRC_DIR      files:        - devtransformed.yaml    qaartifacts:#      base-directory: $CODEBUILD_SRC_DIR      files:        - qatransformed.yaml    prodartifacts:#      base-directory: $CODEBUILD_SRC_DIR      files:        - prodtransformed.yamlthen update the codecommit pipeline to use those 3 artifacts.Share"


Question: How Amplify Auth and Cognito Hosted UI set cookie?

"Hello, I was able to use Amplify Auth and Cognito Hosted UI and enforce cookie storage. However, I do not know which one set-cookie, or which one store the auth information into my web browser cookie?A. Cognito Hosted UI (exchange response code then set-cookie via HTTP response header)B. myweb.amplify.com (redirected url/?code=123xxx) web server exchange the response code and set-cookie via HTTP response headerC. Amplify Auth javascript from client side (my web browser) exchange the response code and set-cookieHere is my Amplify Auth configuration and I used Cognito Hosted UI as wellAmplify.configure({    Auth: {            cookieStorage: {      // - Cookie domain (only required if cookieStorage is provided)      domain: '.yourdomain.com',      // (optional) - Cookie path      path: '/',      // (optional) - Cookie expiration in days      expires: 365,      // (optional) - See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite      sameSite: 'strict' | 'lax',      // (optional) - Cookie secure flag      // Either true or false, indicating if the cookie transmission requires a secure protocol (https).      secure: true    },}})FollowComment"

Answer: "1It appears that you are using Amazon Cognito Hosted UI to handle user authentication for your web application. When a user signs in to your application using Cognito Hosted UI, the following process occurs:The user is redirected to the Cognito Hosted UI login page.The user enters their login credentials and submits the form.If the login is successful, Cognito Hosted UI exchanges the login response code for a set of access and refresh tokens.Cognito Hosted UI then sends a set-cookie header in the HTTP response with the access and refresh tokens as the cookie value.Therefore, the correct answer to your question is:A. Cognito Hosted UI (exchange response code then set-cookie via HTTP response header)The set-cookie header is sent by Cognito Hosted UI in the HTTP response after the user successfully signs in, and it is stored in the web browser's cookie storage by the web browser.CommentShareSeanSianswered 5 months agohai 5 months agoThank you for very clear explanation, I understand that flow. I am still confused because two things.After successfully logged in with the Cognito Hosted UI, I see the redirect_url with an appended code like: mydomain.amplify.com/?code=12345xxx => what does this mean? Does this mean mydomain.amplify.com will exchange the code for credentials (IdToken, AccessToken) and set credentials into my browser cookie?The amplify configuration below. My web is NextJS. Does this mean that the Amplify JS code living inside web browser exchange the code for credentials and set credentials to cookie? If I remove cookieStorage setting, then the credentials will be stored in LocalStorage instead.Amplify.configure({    Auth: {            cookieStorage: {      // - Cookie domain (only required if cookieStorage is provided)      domain: '.yourdomain.com',      // (optional) - Cookie path      path: '/',      // (optional) - Cookie expiration in days      expires: 365,      // (optional) - See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite      sameSite: 'strict' | 'lax',      // (optional) - Cookie secure flag      // Either true or false, indicating if the cookie transmission requires a secure protocol (https).      secure: true    },}})and client/browser call  const user = await Auth.federatedSignIn({              provider: CognitoHostedUIIdentityProvider.Cognito            })Share"


Question: Vivado dcps - All nets and leaf cells hidden

"When I open any of my checkpoint dcps placed here, ex./home/centos/src/project_data/aws-fpga/hdk/cl/examples/cl_dram_dma/build/checkpoints/All of the nets and leaf cells show up as "<hidden>". IIRC I used to seeing the shell and "customer logic" showing up and being able to look at schematics of how the customer logic synthesized?Is there something I'm missing?ThanksFollowComment"

Answer: 0I seems like I just needed to dig through several layers of unnamed <hidden> modules to find the CL block... going through the utilization report and not through Netlist window was helpful...CommentShareabsurdfatalismanswered 3 years ago


Question: aurora serverless restarts in every ~ 4 hours

"Hello all,We have one serverless v1 in production and the last few days I see in logs that it restarts in about every 4 hours.I see in the log that it started up.FollowComment"

Answer: "0Hi, can you please checka.) if any script is connecting to db orb.) any user is connecting to db using a sql client.c.) Pause after inactivity property is checked.Other than above there should be no reason for db to start every 4 hours.ThanksAbhineetCommentShareabhineet-sanswered 10 months ago"


Question: Publishing an MX record for Amazon SES email receiving

"Story: Send email to a unique email id and SES will receive it and store it in the S3 bucket as a PDF file.I followed aws article (https://aws.amazon.com/premiumsupport/knowledge-center/ses-receive-inbound-emails/#) and updated the DNS configuration using aws article (https://docs.aws.amazon.com/ses/latest/DeveloperGuide/receiving-email-mx-record.html). When i try to enter the simple record it was error out "record type is already exist".We are hosting our website from aws, and using office365 email server. I see we have one MX record for office 365 email server in Route 53 with the value 0 xxxxxxl-com.mail.protection.outlook.com.. My question is how I can add 2nd MX record for the same domain in Route 53 to for SES to receive inbound emails?.FollowComment"

Answer: 0update the same record and add the second MX record details with a different value.CommentShareJPaulanswered 2 years ago


Question: How to pass float numbers to Lambda event object

"I have a Lambda function running Python 3.8 and am trying to run a test event using the JSON event object. When I try to put a float in the JSON, it tells me that my JSON is not formatted properly. How do you pass floats or are only strings allowed?FollowComment"

Answer: "2Accepted AnswerThis is a sample event with a float https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-concepts.html#gettingstarted-concepts-eventAre you able to share what your event looks like?CommentShareKishananswered a year agoEXPERTBrettski-AWSreviewed a year agoAWS-User-5311484 a year agoThank you, that helps. I did not have my leading zero. I had .55 and it requires it to be 0.55.Share"


Question: "Private IP address change, effect(s)?"

"Hello All,What are the effects of changing the Private IP address within the EC2 Instance? I'm wondering what issues will occur and if even this can be done, and if so what are the repercussions?We're trying to set up a site-to-site VPN with our company and they are wanting to change/map these IPs/CIDR Blocks.Is there any documentation (I'd be surprised if there wasn't) that talked about this?Thank youFollowComment"

Answer: "0Hello,When EC2 instances are launched, the primary elastic network interface is assigned a reserved private IP address from the default VPC DHCP pool. The private IP address stays assigned to the network interface until it is deleted. The instance's primary network interface cannot be removed; it stays assigned to the instance until the instance is deleted. It is not possible to remove or change the private IP address of the primary network interface, but it is possible to add more private IP addresses to the network interface.Note: You can manually assign a static private IP address for your Windows network adapter, but if the network interface IP address and Windows adapter’s IP addresses don’t match, the network connection will not work. https://aws.amazon.com/premiumsupport/knowledge-center/static-private-ip-windows/https://aws.amazon.com/premiumsupport/knowledge-center/custom-private-primary-address-ec2/Thank you.CommentShareAWS-User-5718909answered 3 years ago"


Question: Volume is instance/AMI locked and backup snapshots cannot be used on other instances

"I have an EC2 instance that creates backup snapshots of attached volumes via lifecycle policy. We have discovered that the backup snapshots are useless as they are instance/AMI locked. When I create new volumes from the snapshot, and attach them to other instances, I receive the following error:The Instance configuration for this AWS Marketplace product is not supported. Please see the AWS Marketplace site for more information about supported instance types, regions, and operating systems.The volume / snapshot is a NON-OS DISK.All Instances, volumes, and snapshots are within US-East1cHow can I get this volume unlocked so future snapshots of the volume can be restored on new instances (and actually used as a backup)?Thanks!FollowComment"

Answer: "0Dear User,Thanks for posting a query on re:post.We would like to check with you on below 2 points :Ensure that the values for architecture type and virtualisation type parameters are same for both the source instance type and new AMI (being created from snapshot).Let us know if the issue still persists even after this check.Regards,NikhilCommentShareAWS-User-8643694answered 6 months ago0Wow, this is amazing. The volume is from an m5 instance and cannot be attached to m6i instances. But it CAN be attached to other m5 instances.Okay, so we were hoping to migrate all m5 instances to m6. However, instance type cannot be changed if an old m5 AMI locked is attached. How can I get these volumes to accept new m6 instances?CommentSharerePost-User-6709179answered 6 months ago"


Question: "aws-sdk-php, to instantiate the IamClient, it requires you to pass in a "region".  If IAM is Global, why is region required?"

"This could be a fundamental question about how IAM works, but my understanding is that IAM is global.  When I create a user/role/policy through the web console, I don't specify a region.  And from within IAM in the web console, region is set to "Global" (through the dropdown in the upper right corner).But when I try to instantiate the AWS SDK for PHP - IamClientuse Aws\Iam\IamClient;use Aws\Exception\AwsException;$client = new IamClient([    'profile' => $aws_profile,    'region' => $aws_region,    'version' => '2010-05-08']);It will fail if I don't set the Region.So why does this SDK require region to be set?  Is this value used somewhere that I'm not seeing?Sorry if this is the wrong place for this.  The PHP Development forum using the AWS SDK for PHP (https://forums.aws.amazon.com/forum.jspa?forumID=80)  appears to have been shutdown and it redirects to repost.aws - but I don't see any SDK specific questions here, and this won't even let me tag my question with PHP or SDK...FollowComment"

Answer: "1Accepted AnswerAWS endpoints are regional. For example here are the IAM endpoints.. You experience something similar in the S3 console, it will indicate global, but actually the buckets and objects are region-scoped, they exist in a region. The bucket name has to be unique within the partition so you don't have to specify the region in the ARNIAM resource (user, groups, roles, policies) are partition-scoped (globally-scoped).  They can be referenced, accessed, managed from any region in the partition. You will noticed that IAM resource ARNs do not specify the region.CommentShareEXPERTkentradanswered a year agoAWS-User-3699386 a year agoOk, so basically, the region I set doesn't matter, just so something is set?Sharekentrad EXPERTa year agoIn the IAM case, yes. It uses that region value to construct/find the endpoint that it calls.Share"


Question: Asking about party system in AWS

"Hi everyoneI’m working on implementing the party system for our game since I am now done implementing basic matchmaking through Gamelift. I am wondering if AWS / GameLift has support for party invites. I have not found anything yet that indicates this is true.  Of course, I can make a ChatService for party invitation which is handling real-time messages between users on an EC2 instance but ideally, I don’t want to develop the ChatService by myself. What I want is that after a party leader invites a new user to a party, the new user immediately recognizes that he was invited to the party somewhat real-time. Is a party invitation system of some sort present somewhere in AWS / GameLift?Any help is appreciated.FollowComment"

Answer: "0Unfortunately, there is nothing pre-built here that I know of that solves your use case.While its somewhat easy to build a party system for a specific game wofklow things can get complex for generalized cases esp wrt player identities and notifications (also plenty of spaces such as consoles or mobile where there are pre-existing components you may also need to integrate with).So you'll probably need to roll your own based on top of whatever notification/chat mechanism you are using. If you are working with an AWS SA they can probably help assist with the design.CommentSharerePost-User-5332620answered 4 years ago0Thank you very much and What is an AWS SA?CommentSharerePost-User-7829175answered 4 years ago0Apologies for the jargon, by an SA I meant an AWS Solutions Architect.Depending on your company size/support level you may be working with one already: https://aws.amazon.com/premiumsupport/There are of course lots of other forums/ways of getting help with design.CommentSharerePost-User-5332620answered 4 years ago0Oh.. I got it... Thank you very much!!!CommentSharerePost-User-7829175answered 4 years ago"


Question: Distributed Cache Comparison Analysis

"Hi AWS,I need to compare ehcache, Aws Redis, Aws cache, mem cache based on these factors:Distributed cachingEvictionOther caching critical capabilitiesInitial Licensing costInfrastructure costSkills / Workforce AvailabilityMaintainancePlease guide.FollowComment"


Question: RDS: Difference between RX and NetworkReceiveThroughput?

"I was analyzing the network performance of the Database we have on RDS, which has enhanced monitoring turned on. I am confused with two metrics (one from enhanced monitoring, another from CloudWatch), that theoretically mean the same, but are showing different values.For a given time range, 'RX' graph under Enhanced Monitoring says that 3.27 GiB (approximately). And according to the AWS documentation, RX means "The number of bytes received per second.".But for the same time range, if you plot 'NetworkReceiveThroughput' in CloudWatch, I see 3.6 million bytes per second (approximately), which is close to 3.6MB per second. And if you look up the documentation on this term, it says "The incoming (receive) network traffic on the DB instance, including both customer database traffic and Amazon RDS traffic used for monitoring and replication."Though NetworkReceiveThroughput is slightly different from RX since it includes AWS internal traffic that transmits monitoring data as well, I should have seen a higher value than RX in my case. Why are these values different by a huge margin? What am I getting wrong?FollowComment"

Answer: "1Hello,Thank you for reaching out to us via AWS re:Post - First of all, I would like to thank you for bringing this to our attention.We have a known bug that the console shows the "units" of RX and TX wrong - this has been reported by other users too and is being checked by the internal team. Since any change in the prod console goes through rigorous testing, auditing etc. we do not have an ETA when this would be released but for now, judging by the screenshots it seems the units in RX and TX are in MB. However, to confirm for your instance - I would recommend you to reach out to AWS Premium Support Team so that they can do a deep dive on the internal metrics for the instance and confirm what I just shared here.Hope this helps in your project Thank You!CommentShareEXPERTNIRUPAM_danswered 10 months agoMSP_ELLUCIAN 10 months agoThanks. I have created a support case. Will comment here once I receive an update.Share"


Question: Can I upload recordings into WorkDocs?

"Hi, I want to upload recordings into WorkDocs? Can we upload it?FollowComment"

Answer: "0I can confirm that mp4s recordings can be uploaded into WorkDocs, as I have personally done this. If you have issues with performing this action, I would recommend logging a support ticket.CommentShareBill_Hanswered a year agoAWS-User-1397738 a year agoHi thanks for the quick answer!! Appreciate it!! Should I click Upload -> Upload files button and upload these recordings?Share0The following file types are supported for audio and video .mp4, .3gp, .mov, .m4a, and .m4v.As long as your recordings are one of the above, it should be possible.Reference: https://docs.aws.amazon.com/workdocs/latest/userguide/file-types.htmlCommentShareArun_PCanswered a year ago"


Question: Are the broker IP addresses static?

"Hi,I am creating a cluster deployment of Amazon MQ (with RabbitMQ engine).Are the broker IP addresses static? and is it also true after maintenance?Thank you.FollowComment"

Answer: "1Thank you so much for reaching out !AmazonMQ broker IPs will never change under any circumstance for either ActiveMQ or RabbitMQ which are private or public brokers. The Architecture is built in such a way that you are essentially interacting with an NLB Created in the AWS Account as opposed to the broker instance itself (which can change); this is shown in the service architecture in the below links:ActiveMQ https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-broker-architecture.htmlRabbitMQ https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/rabbitmq-broker-architecture.htmlCommentShareAWS-User-7034028answered 2 years ago0Hi there,The IP address is generally not static and can subject to change after it goes through a restart and/or maintenance window.CommentShareTPKohlianswered 2 years ago0Hi ranand,Paritosh-AWS is correct. To further clarify, for ActiveMQ, we don't change the data traffic ENI, we just reattach it to the new broker instances (if instance replacement happens for any reason i.e. MWs or instances going unhealthy), hence IPs are not changed for ActiveMQ brokers. For RabbitMQ, we use NLBs and the IPs of endpoints created are static.CommentShareTPKohlianswered 2 years ago0The IP addresses of ActiveMQ brokers in AWS are not static by default. AWS Elastic Load Balancer (ELB) is commonly used to distribute traffic across multiple instances of ActiveMQ brokers, and ELB assigns dynamic IP addresses to the instances. This allows for scalability and fault tolerance, as instances can be added or removed dynamically.If you require static IP addresses for your ActiveMQ brokers, you can configure an Elastic IP (EIP) for the instances or use other networking solutions such as Network Load Balancer (NLB) or Application Load Balancer (ALB) with static IP address support. By associating EIPs or using load balancers with static IP addresses, you can ensure consistent access to your ActiveMQ brokers.It's important to note that managing static IP addresses may involve additional configuration and cost considerations, so evaluate your requirements.CommentSharehimanshustallongmailcomanswered 18 days ago"


Question: Panorama applicance registration impossible with version 4.3.45

"Hello,I would like to register my panorama appliance but it stuck when reading the file.I use the cli and the interface version but it doesn't work in any case.I did a full reset but now it use the  4.3.45.here my occ.log file :2023-02-13 13:52:46.737 INFO start(113) Core daemon starting...2023-02-13 13:52:46.739 INFO registerPlugin(53) Registered plugin 12023-02-13 13:52:46.740 INFO registerHandler(35) Plug-in message ID 308: installed2023-02-13 13:52:46.740 INFO registerHandler(35) Plug-in message ID 309: installed2023-02-13 13:52:46.740 INFO registerHandler(35) Plug-in message ID 204: installed2023-02-13 13:52:46.740 INFO loadPlugin(16) Initializing plug-in: /opt/aws/panorama/occ/plugins/libAwsOmniCloudAgentLib.so2023-02-13 13:52:47.414 INFO registerHandler(35) Plug-in message ID 200: installed2023-02-13 13:52:47.414 INFO registerHandler(35) Plug-in message ID 202: installed2023-02-13 13:52:47.415 INFO registerHandler(35) Plug-in message ID 310: installed2023-02-13 13:52:47.415 INFO registerHandler(35) Plug-in message ID 404: installed2023-02-13 13:52:47.415 INFO registerHandler(35) Plug-in message ID 405: installed2023-02-13 13:52:47.415 INFO registerHandler(35) Plug-in message ID 205: installed2023-02-13 13:52:47.416 INFO registerHandler(35) Plug-in message ID 406: installed2023-02-13 13:52:47.416 INFO registerHandler(35) Plug-in message ID 407: installed2023-02-13 13:52:47.416 INFO registerPlugin(53) Registered plugin 22023-02-13 13:52:47.416 INFO CThreadTask(23) Creating cloud agent thread TerminationWatcher!2023-02-13 13:52:47.417 INFO start(202) initializing cloud agent plug in...2023-02-13 13:52:47.417 INFO start(206) Client IoT configuration file does not exist! Waiting 60s before retry2023-02-13 13:53:47.420 INFO start(206) Client IoT configuration file does not exist! Waiting 60s before retry2023-02-13 13:54:47.421 INFO start(206) Client IoT configuration file does not exist! Waiting 60s before retry2023-02-13 13:55:47.421 INFO start(206) Client IoT configuration file does not exist! Waiting 60s before retryFollowCommentrePost-User-0363861 4 months agoHi Nabil,When you say "register the Panorama appliance", I assume you are talking about the provisioning step? This is the one where you download some certificates onto a USB and plug it into the device.In that case, here are some tips:Make sure to complete the provisioning process within 5 minutes of generating/downloading the certificate zip.Make sure the certificate zip was not renamed or modified after downloading, and that it is the only thing present on the USB.Plug the USB into the USB 3.0 port on the device.Provisioning must be done after performing a factory reset (holding down the power + reset buttons for 5 seconds or so when the device is in the powered off state). The LEDs on the device will turn blue if the provisioning process is underway after plugging in the USB to the USB 3.0 port.[See also: https://docs.aws.amazon.com/panorama/latest/dev/appliance-manage.html#appliance-manage-reset and the instructions provided on the AWS Panorama console page during the provisioning step]If you were able to successfully complete the provisioning step and this issue still persists, please provide us with the account number, device id, and region of the issue. Any additional logs that you can help provide (syslog, kern_log, and others in the device log group) will also be helpful in identifying the issue.Thanks.ShareNabil 4 months agoHello,Yes, I mean the provision, I follow the procedure you mention and still have the issue. To what email I can send you the information needed ?ThanksSharerePost-User-0363861 3 months agoHi Nabil,Please open a ticket with AWS Support or post your logs here so that we can better assist you.SharerePost-User-0363861 3 months agoPlease also make sure that your device is connected to the internet during provisioning. Provisioning steps are documented here: https://docs.aws.amazon.com/panorama/latest/dev/gettingstarted-setup.html#gettingstarted-deviceShare"


Question: Aws Sdk Java - ReleaseAddress API response issue

"We are using AWS java sdk 2. When we are trying to delete an elastic IP address that is mapped with a nat gateway, we are getting an authFailure error code instead of an inUse error code.For other resources, if we try delete a resource that is already in use, we are getting the inUse error code but releaseAddress is not returning the inUse error code.Am I missing something or it is an issue on AWS API side?FollowComment"

Answer: "0Generally speaking, AuthFailure would relate to the IAM permissions, or could be related to an SCP policy applied to your account. This would be checked before anything else.If you are having success deleting other addresses, then this may be due to tag based policies, for example.[1] https://docs.aws.amazon.com/AWSEC2/latest/APIReference/errors-overview.html#CommonErrors : Error codes for the Amazon EC2 API - Common client error codes[2] https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html : Controlling access to and for IAM users and roles using tagsCommentShareSUPPORT ENGINEERWayne_Ganswered 2 months ago"


Question: Commercial vs GovCloud

"Is there any page that will indicate when a service will become available in GovCloud?  I know that there is a page called "AWS GovCloud (US) compared to Standard AWS Regions". This is a list of what is available in GovCloud. But, is there any page that has an ETA on when a specific service will become available in GovCloud?  It also would be nice to know if there is a Service in GovCloud where specific functionality does not work yet.   We recently ran into an issue where RedShift queries in GovCloud cannot be saved.Any insights are appreciated...Larry CermakFollowComment"

Answer: "3Larry,Unfortunately service roadmaps are not publicly available.  Each service leverages customer requested enhancements and feedback to help prioritize features to be implemented.For any given service, you may submit a support ticket requesting this information or if you have an account manager you can request information from them on these services and capabilities.CommentShareAllison_Panswered a year agoEXPERTHernitoreviewed a year ago"


Question: EKS Upgrade Failed from 1.13 to 1.14

"We had a cluster created on version 1.12. We managed to upgrade it to 1.13 successfully. We also upgrade the nodes.It ran for 2 weeks and today, we decided to upgrade it to 1.14.The cluster upgrade from 1.13 to 1.14 was triggered from AWS EKS console. It was in 'updating' state for more than an hour before marking it as failed. We checked the errors section, it showed none.When I check the actual cluster version using kubectl version command, it shows v1.14.9-eks-f459c0.The AWS console still shows 1.13 and when I try to upgrade it fails. We have coredns, cni, kube-proxy all at expected versions as mentioned in https://docs.aws.amazon.com/eks/latest/userguide/update-cluster.htmlAny pointers would be very much appreciated as this is a production environment.Thanks,AbhishekFollowComment"

Answer: "0Well, we contacted AWS support. They debugged and got back to us saying it was because the security groups per ENI limit on our account was set to 1. They increased it to 5 and then the upgrade was successful.None of the parties are sure why the limit was set to 1.CommentShareasomwanshianswered 3 years ago"


Question: Using react in hit design layout

"Hi!I would like to create a task where turks have to choose between the 2 videos. The 2 videos need to play in a synchronized fashion (e.g. if I pause one video, the other pauses too). I created a react web app that can do this.I am hoping I can port my app to AMT. When creating a project, in the design layout, can I use react? And if so I presume I have to put everything in just one file; for example, I can't have a separate file for the HTML and for the js files.Thanks!BassamFollowComment"

Answer: "0Hi Bassam,You can absolutely use your React app in your MTurk task.Essentially, you just include the assets.crowd.aws script import, a script import for your react app, and a hidden input within <crowd-form> where your app dumps the answer data to be submitted, eg<script src="https://assets.crowd.aws/crowd-html-elements.js"></script><script src="your react app's url.js"></script><crowd-form>    <input type="hidden" name"answer"/></crowd-form>This blog post (https://aws.amazon.com/blogs/machine-learning/build-a-custom-data-labeling-workflow-with-amazon-sagemaker-ground-truth/) talks about how to do this within the context of a SageMaker Ground Truth task, but the exact same approach works when using <crowd-form> with MTurk directly.Reference: https://docs.aws.amazon.com/sagemaker/latest/dg/sms-ui-template-crowd-form.htmlEdited by: SamH@AWS on Feb 27, 2020 1:30 PMCommentShareAWS-User-6870314answered 3 years ago0Got it. Thanks a lot SamH!CommentSharebassamHanswered 3 years ago0You're welcomeCommentShareAWS-User-6870314answered 3 years ago"


Question: Glue Jobs have no access to current schemas (Glue Catalog)

"Hi,Context : I would like to extract a table from an oracle database and write the data in a parquet format on S3. I use " glue connection",  "glue database" and  "glue crawler". All works fine !Issue: Glue set decimal(38,0) as column type in the data catalog rather than string. I updated the data Catalog with the new column type. Nevertheless in my Glue ETL job the column type is stil "decimal" ( I can see it because I print the schema).I extract the data using the create_dynamic_frame.from_catalog( database="", table_name="", transformation_ctx=""). I set the role with fullAcess to Glue/S3/Cloudwatch/EC2. When I print the schema, there is no difference after changing the column type in the data catalog.Could you help me ?FollowComment"

Answer: "0Glue DynamicFrames are self-describing and no schema is required on creation. Instead, the schema is computed on-the-fly with inconsistent types encoded as choice types.https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-pyspark-extensions-dynamic-frame.htmlIn your case, you can use the ApplyMapping class to specify the column type after reading the catalog table.https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-pyspark-transforms-ApplyMapping.htmlCommentShareedokemwaanswered 7 months ago"


Question: AWS MediaConvert  major sudden slowdown in transcoding speed

"Hi,I have been using AWS MediaConvert for a while to transcode videos. Since the 25th of May, I notice that the transcoding step takes half an hour when using a sample small video. This in contrast to a couple of seconds of how it used to be before the 25th. The same video is used and there are no changes to the configuration of the MediaConvert job.For example, now I see in the mediaconvert dashboard the submit time of  2022-06-02 13:23:54 and a finish time of 2022-06-02 13:49:58An example of a long running job id: 1654169034448-uehndvAn example of a fast running job id: 1653030543613-wixaa6What can explain this sudden major increase in transcoding time by AWS Mediaconvert?FollowComment"

Answer: "1Accepted AnswerOur service team reviewed the logs for job 1654169034448-uehndv and found that the image source configured for the Image Inserter Processor could not be found at the time the job was run. The job retried many times before eventually timing out on fetching the image. If you resubmit your job with a updated/corrected path to the source image, it should transcode quickly.CommentShareSUPPORT ENGINEERRichard Wanswered a year ago"


Question: ProvisionedThroughputExceededException after the update of node package from aws-sdk to @aws-sdk/client-dynamodb and @aws-sdk/lib-dynamodb

"Hello, following the imminent deactivation of the aws-sdk library, I have updated my project ( nodejs lambda ) by installing the new @aws-sdk/client-dynamodb and @aws-sdk/lib-dynamodb packages to allow the same code to continue to be used with minimal update changes. The libraries worked as I expected, but after slightly more intensive use, a number of throughput problems were encountered. At first I thought this was normal, but then reading the monitoring logs, I noticed that the read or write capacity used to make the call was double that of the same call made with the previous aws-sdk library.Under certain circumstances, it becomes so high that it does not allow new calls to be made for a long time unless the total capacity of the reference table is naturally increased. Trying again with the old library, the capacity returned to normal instead.Is it possible to understand why this difference in capacity? Am I doing something wrong?To avoid this, I am writing the modified part of the code for a little help:aws-sdkconst AWS = require("aws-sdk");const doc = require('dynamodb-doc');\AWS.config.update({region: 'eu-west-1'});const dynamo = new doc.DynamoDB(new AWS.DynamoDB());....dynamo.query(param, cb)@aws-sdkconst { DynamoDB  } = require("@aws-sdk/client-dynamodb");const { DynamoDBDocument } = require("@aws-sdk/lib-dynamodb");const clientDynamo = new DynamoDB({region: 'eu-west-1'});const dynamo = DynamoDBDocument.from(clientDynamo);....dynamo.query(param).then(...)FollowComment"

Answer: "1Accepted AnswerThere is no difference in capacity consumption between clients. Ensure that you set you are not setting your reads to be strongly consistent, as this would consume double the capacity and is aligned with your issue.Read consistency is eventual consistent by default.SDK V2npm listNodetest@ /Users/lhnng/Documents/Nodetest├── aws-sdk@2.1380.0└── dynamodb-doc@1.0.0{ TableName: 'test', CapacityUnits: 150.5 }SDK V3npm listNodetestV3@ /Users/lhnng/Documents/NodetestV3├── @aws-sdk/client-dynamodb@3.284.0└── @aws-sdk/lib-dynamodb@3.272.0{  CapacityUnits: 150.5,  GlobalSecondaryIndexes: undefined,  LocalSecondaryIndexes: undefined,  ReadCapacityUnits: undefined,  Table: undefined,  TableName: 'test',  WriteCapacityUnits: undefined}Request:client.query({    "TableName": 'test',    "KeyConditionExpression": `#pk = :val`,    "ExpressionAttributeNames": {        "#pk": "pk"    },    "ExpressionAttributeValues": {        ":val": "sample_pk"    },    "ReturnConsumedCapacity": "TOTAL"})    .promise() // V2 has promise, V3 returns a promise by default    .then(res => console.log(res['ConsumedCapacity']))    .catch(err => console.log(err))ConclusionAs I mentioned previously, there are no differences in consumed capacity depending on the client. I also ran using the CLI to assure you that there are no differences:aws dynamodb query \--table-name test \--key-condition-expression "#pk = :pk" \--expression-attribute-values '{":pk":{"S":"sample_pk"}}' \--expression-attribute-names '{"#pk":"pk"}' \--select COUNT \--return-consumed-capacity TOTAL{    "Count": 26,    "ScannedCount": 26,    "ConsumedCapacity": {        "TableName": "test",        "CapacityUnits": 150.5    }}CommentShareEXPERTLeeroy Hannigananswered 17 days agorePost-User-9739080 17 days agoThank you very much for your reply, however as you can see from the configuration I have brought, I have not entered any changes. If there is a way to set the parameter to the default value, I would thank you if you could explain how. Or is there some reason why @aws-sdk keeps saying that I have reached ProvisionedThroughputExceededException preventing me from continuing whereas with aws-sdk it doesn't?ShareLeeroy Hannigan EXPERT17 days agoCan you provide me the version which you used in V2 and the version you now use in your upgraded V3. I will run some tests to ensure the SDK has not regressed.SharerePost-User-9739080 16 days agoOf course:aws-sdk: "2.1380.0"dynamodb-doc: "1.0.0"@aws-sdk/client-dynamodb: "3.284.0"@aws-sdk/lib-dynamodb: "3.272.0"ShareLeeroy Hannigan EXPERT16 days agoThanks for that, updated my answer with my testsShareJia Li 16 days agoI also tested for pagination scan, and the results arewith aws-sdk 2, the results like{ TableName: 'test', ScannedCount: 2969, CapacityUnits: 128.5 }{ TableName: 'test', ScannedCount: 2969, CapacityUnits: 128.5 }{ TableName: 'test', ScannedCount: 2969, CapacityUnits: 128.5 }{ TableName: 'test', ScannedCount: 2969, CapacityUnits: 128.5 }{ TableName: 'test', ScannedCount: 2969, CapacityUnits: 128.5 }And everything works fine, all results are scanned without error.With @aws-sdk v3The result like{ TableName: 'test', ScannedCount: 2969, CapacityUnits: 128.5 }{ TableName: 'test', ScannedCount: 2940, CapacityUnits: 128.5 }ProvisionedThroughputExceededExceptionSo the scanned count and Consumed CapacityUnits are no difference, but aws-sdk v3throws error.ShareShow 5 more comments-1I have the exact same issue, I am using aws-sdk v2 and scan all data from dynamodb by while loop with LastEvaluatedKey, and everything works fine, after I upgrade to @aws-sdk/client-dynamodb, the ProvisionedThroughputExceededException is thrown, all configuration are exactly same, I am not setting ConsistentRead to true, I also tried paginateScan,  the same error occurs.CommentShareJia Lianswered 17 days ago"


Question: Multi-region Keyspaces

"I am trying to find out if Keyspaces can be replicated to multiple regions? I see that they replicate within the region, but what if you are operating in multiple regions for availability?FollowComment"

Answer: 0The multi-region replication is not supported by Amazon Keyspaces today. A potential workaround is to export keyspaces table as CSV file to S3 bucket in the primary region and then replicating this CVS file from S3 to Keyspaces table in another region via spark/EMR.Overview of Amazon EMRCommentShareTaka_Manswered 7 months ago


Question: How to connect stm32f4 board to AWS mqtt

"Kindly guide or share some examples code.I have stm board stm32f4, gsm module mc60, and AWS account want to use AWS mqtt guide for thisFollowComment"

Answer: "-1Hi. Please take a look at the answer I gave to this question: https://repost.aws/questions/QUXPPxyhHsRqaS10Ld6B3uZA/starting-point-and-tutorial-for-simple-iot-project-with-microcontroller-and-gsm . Your needs appear similar, but without the OTA part.CommentShareEXPERTGreg_Banswered a month agorePost-User-9609689 13 days agoYour response is not helpful kindly give proper responseShareGreg_B EXPERT13 days agoDid you read the linked answer? Like your question, it's an STM32 board for which I think there's no known reference integration, and it uses a cellular interface too. Points 1, 2 and 3 would seem to me to address your question. Could you please elaborate on what else you're looking for?Share"