Question: EC2 instance rejecting connections after 7 minutes

"When launching an EC2 instance, I can successfully connect to it for 7 minutes at a time. Then, it disconnects me and I have to stop and start the instance to allow connections again.I've tried both Linux and MSWindows instances.I've tried SSM, SSH, and RDP (where appropriate)If I setup a cron job, pinging www.google.com, it still pings successfully, even though I get disconnected.I have tried this from several machines and networks, to see if somehow my personal network is a problem. it doesn't seem to matter. 7 minutes after boot, I get disconnected and can't reconnect.It doesn't matter if I have a lot of network traffic or a little.Cloudtrail doesn't show anything in the timeframe.I can also connect to other EC2 instances on other AWS accounts and stay connected for hours and hours.Any idea on what could be causing my disconnects after 7 minutes?FollowCommentbullfrogmiah a year agoThe strangeness increases.  Now I'm not able to connect to any instances at all.I've verified a public IP on a new instance, the Subnet has 0.0.0.0/0 routing to an internet gateway.  Security group is wide open to ssh (0.0.0.0/0 in bound port 22),I've been working in us-east-1, but tried us-west-1, as well.I've setup a new VPC, subnets, and IGW.  Same results.I can connect to other accounts instances.ShareBrettski-AWS EXPERTa year agoWhat instance type(s) are you using?Share"

Answer: "0Accepted AnswerI have heard back from AWS support on this. They report:"I'd like to inform you that the team has reverted with an update. The team has stated that they have made some troubleshooting steps and they have resolved the issue."And sure enough, it is now working as expected. So....Attention future folks! Make sure that you've taken all the troubleshooting steps necessary, like NACL review, public IP for instance, Security Group open enough, internet gateway on the subnet, and any other possible technical reasons for failure. Then, even with the free 'basic' account, enter an "account and billing" ticket, explaining the problem. Then a few days later, after some back and forth, they'll fix your account.I wonder if they isolated my account by accident?CommentSharebullfrogmiahanswered a year ago0Seven minutes is an odd time; especially if it is consistent across operating systems; and that the instances continue to communicate even thought you can't connect to them.Are you using a restrictive inbound security group for the instances? Is it possible that your public IP is changing (your ISP; upstream NAT devices) and that's causing the issue?CommentShareEXPERTBrettski-AWSanswered a year agobullfrogmiah a year agoThanks for the response.  I've got no restrictive inbound security group and the NACL is wide open, too.  Security group is set to allow inbound port 22 from 0.0.0.0/0.Share"


Question: EC2 spot instance keeps rebooting

"We run a number of EC2/Ubuntu 20.04 instances in our VPC, as spot instances. All but one are fine, and the last keeps rebooting on an irregular basis. It looks (from journalctl) as though it's doing a controlled (rather than kp) shutdown and then reboots. We simply cannot work out why this is happening, when other instances have no such problems. Is there a particular parameter I should be looking at?FollowComment"

Answer: 0Are you seeing instance interruption notices for that instance?CommentShareEXPERTBrettski-AWSanswered a year ago


Question: Supported MediaLive framerates

Is there a list of supported MediaLive frame rates ?Does MediaLive support 23.98fps?FollowComment

Answer: "1Hi tastee,Yes, MediaLive can support most common frame rates. To get a 23.98 frame rate, specify the numerator of 24000 and the denominator as 1001.Regards,SteveCommentShareSteve_Wanswered 7 months ago"


Question: Transfer emails received using SES email receiving to another region?

"We're heavily using eu-central-1, which does not support SES email receiving. To make email receiving work I'm trying to set something up in eu-west-1. What's the best way to transfer the emails to eu-central-1?Some options I have considered:Have a Lambda run on each email received that writes to some S3 bucket in eu-central-1. Is it possible to write from a Lambda in eu-west-1 to an S3 bucket in eu-central-1?Write the email to an S3 bucket in eu-west-1 directly. Is this possible? If possible we could monitor the eu-central-1 bucket using e.g. EventBridge and do further processing from there.This must have come up before.FollowComment"

Answer: "0Accepted AnswerYes, you can do all of those things - and many others such as "run an EC2 instance to do the transfer".The correct answer depends on what you want to do with the emails once they're in eu-central-1. If you need to write it into a bucket in the target region then a Lambda is definitely the easiest (and probably least expensive) way of doing that - noting that you will get some inter-region data transfer charges. But you're going to get those no matter what you do.But if you've got some other system in the target region why not have the Lambda deliver directly to that?CommentShareEXPERTBrettski-AWSanswered a month agotibbe a month agoIn eu-central-1 I want to do some processing in a Lambda (e.g. do some lookups in a DynamoDB table in that region) and eventually write parts of the email to DynamoDB, again in that region.Another way of phrasing it: if I could receive emails in eu-central-1 I would have them delivered to a Lambda or a topic, listened to by a Lambda.ShareBrettski-AWS EXPERTa month agoYou can do it either way; if the majority of your processing is going to be in eu-central-1 then store the data there and trigger Lambda functions/Step Functions/whatever. It'll reduce inter-region data transfer charges and make access to the data quicker (less latency).Share"


Question: [AppRunner] Invalid start command

"hello everyone,I am facing a problem when deploying an application on Apprunner. I am a newbie to this service and I get the following error:[AppRunner] Invalid start command. Update the start command you provided during the App Runner service configuration and re-try. - CannotStartContainerError: ResourceInitializationError: failed to create new container runtime task: failed to create shim task: failed to create task: rpc error: code = Unknown desc = failed to create init process I/O: 1 error occurred: * failed to start binary process: fork/exec /sbin/shim-loggers-for-containerd: argument list too long : unknownthe image is successfully extracted from the ECR, below is my Dockerfile, am I doing something wrong?FROM php:7.4-apacheCOPY docker/apache/shared/shortorangerdc.conf /etc/apache2/sites-enabled/shortorangerdc.confCOPY ./docker/apache/shared/php.ini /usr/local/etc/php.iniCOPY ./docker/apache/shared/php.ini /usr/local/etc/php/php.iniRUN curl -sS https://getcomposer.org/installer | php -- \&& mv composer.phar /usr/local/bin/composer \&& apt-get update -yq && apt-get install -y systemctl cron python3 libxml2-dev libpng-dev libjpeg-dev libfreetype-dev libwebp-dev zlib1g-dev libzip-dev librabbitmq-dev libssh-dev \&& docker-php-ext-configure gd  --with-freetype --with-jpeg --with-webp \&& pecl install amqp \&& docker-php-ext-install -j$(nproc)  gd pdo pdo_mysql soap zip bcmath sockets \&& docker-php-ext-enable amqp \&& sed -i.bak "s/Listen 80/Listen 8080/g" "/etc/apache2/ports.conf" && sed -i.bak "s/Listen 443/Listen 8443/g" "/etc/apache2/ports.conf" \&& a2enmod rewriteRUN mkdir /var/www/shortorangerdcWORKDIR /var/www/shortorangerdcCOPY composer.json .RUN composer installCOPY . .RUN chmod +x ./bin/console CMD ["apache2-foreground"]ENTRYPOINT ["docker-php-entrypoint"]EXPOSE 9091please i need help.thanksFollowComment"


Question: [issue] AWS SDK javascript v3 DynamoDb Client BatchWriteItemCommand

"Hello,my code leads to this error: Cannot read properties of undefined (reading '0') in AWS Lambda (nodeJs 18).Here comes the related code:import { DynamoDBClient, BatchWriteItemCommand } from "@aws-sdk/client-dynamodb";const client = new DynamoDBClient({ region: "eu-west-1" });async function addBuildingRoomEvents(events) {    try {        const exp = Math.round((Date.now() + (2 * 60 * 60) * 1000) / 1000); // seconds        let putRequests = [];        for (const event of events) {            const item = {                timestamp: event.timestamp,                uuid: generateUUID(),                building_room_uuid: event.buildingRoomUuid,                building_uuid: event.buildingUuid,                expiration_timestamp: exp,                event_type: event.eventType,                event_attribute_name: event.eventAttributeName,                event_attribute_value: event.eventAttributeValue.toString(),                hvac_uuid: event.itemUuid            }            const putRequest = { PutRequest: { Item: item } };            putRequests.push(putRequest);        }        const params = {            RequestItems: {                'event_building_room': putRequests            }        };        console.log(`[addBuildingRoomEvents] params: ${JSON.stringify(params)}`);        const response = await client.send(            new BatchWriteItemCommand(params)        );        return response;    } catch (err) {        throw err;    }}This code creates for instance those params:{    "RequestItems": {        "event_building_room": [            {                "PutRequest": {                    "Item": {                        "timestamp": 1676575456197,                        "uuid": "ff1493f1-737a-44e70-ya96a-afc30133e5cf",                        "building_room_uuid": "226c0c82-86ac-445f8-yb1de-3525366f4d61",                        "building_uuid": "348af157-2177-4bb3-b322-cf8ff2f54d11",                        "expiration_timestamp": 1676582656,                        "event_type": "request",                        "event_attribute_name": "desired_temperature",                        "event_attribute_value": "10",                        "hvac_uuid": "e1858b08-0258-4c71-bf9a-d79a1b2de523"                    }                }            },            {                "PutRequest": {                    "Item": {                        "timestamp": 1676575456197,                        "uuid": "ecaccce5-8c10-443ee-ybbf9-adab7aaeb7fd",                        "building_room_uuid": "226c0c82-86ac-445f8-yb1de-3525366f4d61",                        "building_uuid": "348af157-2177-4bb3-b322-cf8ff2f54d11",                        "expiration_timestamp": 1676582656,                        "event_type": "request",                        "event_attribute_name": "mode",                        "event_attribute_value": "heat",                        "hvac_uuid": "e1858b08-0258-4c71-bf9a-d79a1b2de523"                    }                }            },            {                "PutRequest": {                    "Item": {                        "timestamp": 1676575456197,                        "uuid": "2f65a6ee-2dec-44153-ya904-8317364ef869",                        "building_room_uuid": "226c0c82-86ac-445f8-yb1de-3525366f4d61",                        "building_uuid": "348af157-2177-4bb3-b322-cf8ff2f54d11",                        "expiration_timestamp": 1676582656,                        "event_type": "request",                        "event_attribute_name": "power",                        "event_attribute_value": "false",                        "hvac_uuid": "e1858b08-0258-4c71-bf9a-d79a1b2de523"                    }                }            }        ]    }}I suspect that I am supposed to write Json with type specification but I can't figure how to do it.Thank you for your help.FollowComment"

Answer: "3Accepted AnswerYou need to use a higher level client, such as the Document Client. Try instantiate your client like below:import { DynamoDBClient, } from "@aws-sdk/client-dynamodb";import { DynamoDBDocumentClient, BatchWriteCommand} from "@aws-sdk/lib-dynamodb";const ddb = new DynamoDBClient({ region: "eu-west-1" });const client = DynamoDBDocumentClient.from(ddb);...... const response = await client.send(            new BatchWriteCommand(params)        );This should allow you to work with native JSON with no issue.Be sure you have installed the @aws-sdk/lib-dynamodb if you do not have the entire @aws-sdk package installed.An example can be seen hereCommentShareEXPERTLeeroy Hannigananswered 4 months ago"


Question: No event after PotentialMatchCreated

"I'm testing GameLift matchmaking with a very simple ruleset:{  "name":  "simplest_match",  "ruleLanguageVersion":  "1.0",  "playerAttributes": [],  "teams": [{    "name":  "players",    "maxPlayers":  2,    "minPlayers":  2  }],  "rules": [],  "expansions": []}I'm relying on event notifications instead of calling DescribeMatchmaking (will that work?).After calling StartMatchmaking for two users, events MatchmakingSearching and PotentialMatchCreated are received, and some time after it, MatchmakingTimedOut events.Why wasn't a MatchmakingSucceeded event received?What is needed to happen after the PotentialMatchCreated to have a successful match?FollowComment"

Answer: "0Accepted Answer@REDACTEDUSERRegarding the MinSize and MaxSize attributes, what is the proper channel to report the fleet creation bug?P.S.: I was able to workaround it by using a custom resource:const sdkCall: cr.AwsSdkCall = {  service: 'GameLift',  action: 'updateFleetCapacity',  parameters: {    FleetId: fleetId,    MinSize: props.minSize,    MaxSize: props.maxSize,  },  physicalResourceId: physicalFleetId,};new cr.AwsCustomResource(this, "FleetCapacity", {  resourceType: 'Custom::GameLiftFleetCapacity',  onCreate: sdkCall,  onUpdate: sdkCall,  ...});CommentSharerePost-User-4914704answered 2 years ago0I’m relying on event notifications instead of calling DescribeMatchmaking (will that work?).Yes, that's the recommended way. Check out the architecture diagram for one of our example backend infrastructure: https://github.com/aws-samples/amazon-gamelift-persistent-sampleAfter calling StartMatchmaking for two users, events MatchmakingSearching and PotentialMatchCreated are received, and some time after it, MatchmakingTimedOut events.Why wasn’t a MatchmakingSucceeded event received?The Matchmaking timed out, and therefore it didn't succeed.Is your matchmaking configuration timeout set at a reasonable value? (e.g. >30 seconds)Are you using standalone flexmatch (i.e. you don't have to create fleet, it simply just sends you a message in SQS without trying to place players into game sessions) or queue flexmatch? If queue flexmatch, is your queue timeout set at a reasonable value? (e.g. >30 seconds)If using queue flexmatch, do you have any location filter or player latency filter setup to prevent players from being placed into your fleets?If using queue flexmatch, is there enough capacity in your fleet? I.e. does the fleet have an active instance with at least 1 available process?Are you calling StartMatchmaking twice with 1 players in each request, or StartMatchmaking once with 2 players in the request?CommentSharerePost-User-7108006answered 2 years ago0I'm using queue FlexMatch. The timeouts are big enough. No latency filter setup.Currently the fleets (spot and on-demand) have no instance running, although they are configured to maintain a buffer of 20% of game session availability.StartMatchmaking was called once for each player.CommentSharerePost-User-4914704answered 2 years ago0Currently the fleets (spot and on-demand) have no instance runningI see. This is the issue. If you are using FlexMatch with queues, then FlexMatch will ensure that your players are placed into a server process before calling the matchmaking "successful", otherwise, it'll continue to wait for a server process to be available until it times out.If you look at DescribeMatchmaking API, you'll see that it returns the IP address, DnsName and port of the server process that your players are placed in: https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeMatchmaking.htmlalthough they are configured to maintain a buffer of 20% of game session availability.Autoscaling should have scaled up the fleet for you since your available is at 0% (because there is no instances running). Did you by any chance set the min/max/desired fleet capacity to 0? Or [stopped fleet autoscaling action](https://docs.aws.amazon.com/cli/latest/reference/gamelift/stop-fleet-******If you want to simply test out your ruleset without having your players placed into any instances (and therefore save some cost on running instances), you can use Standalone mode on your matchmaking configuration instead, see: https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateMatchmakingConfiguration.html#gamelift-CreateMatchmakingConfiguration-request-FlexMatchMode. With this mode selected, matchmaking will not try to place game session into instances, and immediately send you successful events if players are matched.NOTE: there is some charges for standalone flexmatch, see pricing plan, but for development purposes it should be cheap (if not for free with free tier)CommentSharerePost-User-7108006answered 2 years ago0The fleets were created via CloudFormation/CDK with MinSize: 1 and MaxSize: 10, and no manual change was done after creation. Strangely enough, the max size of 10 can't be seen anywhere in the Console.Right after deploying the fleet, we can see that it has one instance running. After some minutes, it has no instances, even with the 20% buffer configuration.What I want to test is the full matchmaking + session placement flow, with the proper auto scaling of game servers.CommentSharerePost-User-4914704answered 2 years ago0Could you try removing the autoscaling configuration and see if that resolves the "instance scaling down" issue?If scaling policy was the issue, could you share how you setup the scaling policy? Was it via console or AWS CLI/SDK? If you believe you've setup everything correctly and it's still not working, you could provide us with the fleet id and the GameLift team can take a look.Strangely enough, the max size of 10 can’t be seen anywhere in the ConsoleIs should be under the fleet details page > "Scaling" tab:REMOVEDUPLOADCommentSharerePost-User-7108006answered 2 years ago0I realized that, when deploying via CDK, the values in that area of the Console is always 0 for Min and 1 for Max! (just like in your snapshot) That's why I though the Max fleet size were nowhere in Console.The fleet is created this way:new gamelift.CfnFleet(this, "Fleet", {  ...  minSize: 1,  maxSize: 10,  ...});Manually setting the Min value in console seems to force the instance creation, and then it seems that the autoscaling works as expected.What defines the value in the "Available" column? I see varying values here, and right now it is zero. Does it relate to the fleet type (spot vs on-demand)?CommentSharerePost-User-4914704answered 2 years ago0Glad that you got unblocked! "Available" column shows your account's available allowance on how many EC2 instances it can still allocate in a remote location for the current AWS region. If you run out of "Available" instances, you can either create a new remote location and put the fleet behind a queue so it automatically puts game sessions in one of the locations for you, or you could go through request for a limit increase on the AWS GameLift console.We have plans to make this concept more clear in the console.CommentSharerePost-User-7108006answered 2 years ago0This is actually intentional.From our docs on the MinSize field and MaxSize field:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-gamelift-fleet.html#cfn-gamelift-fleet-******MaxSize: The maximum value that is allowed for the fleet's instance count. When creating a new fleet, GameLift automatically sets this value to "1". MinSize: The minimum value allowed for the fleet's instance count. When creating a new fleet, GameLift automatically sets this value to "0". Sorry if this was confusing. We'll see if we can make this experience better, e.g. actually making it work as intended, or at least show a warning if non-default values were provided. (We cannot disallow these fields anymore for backwards compatibility reasons)I've created this as a feature request.GLIFT-15365CommentSharerePost-User-7108006answered 2 years ago"


Question: orchestrating a REST request

"I have a use case wherein a lambda receives a REST request from the client.  It then will need to call some N lambdas (scatter) using REST API and then wait to hear back from each of the N lambdas to collect (gather) the responses, consolidate the responses and respond back to the client. I'm thinking  of using a step function (using parallel flow?) along with callback pattern when calling each of the N lambdas.  Can you please share your ideas, blogs, github demos etc? Error handling is also essential.FollowComment"

Answer: "3We have a workshop on the scatter gather pattern. It doesn't use step functions - https://catalog.us-east-1.prod.workshops.aws/workshops/e8738cf6-6eb0-4d1d-9e98-ae240d229535/en-US/scatter-gatherThere is a blog that talks about dynamic parallelism in Step Functions - https://aws.amazon.com/blogs/aws/new-step-functions-support-for-dynamic-parallelism/CommentShareEXPERTIndranil Banerjee AWSanswered 9 months agoEXPERTChris_Greviewed 9 months agoAWS-User-8049274 9 months agoThank you!Share0If I understand correctly, the clients connect to a REST API in API Gateway which invokes a Lambda which calls N other Lambda, using a REST API.If this is the case, you could simplify it by invoking a synchronous Express workflow directly from API Gateway (eliminating the first Lambda function). The workflow will use a Map state to invoke all other Lambda functions (eliminating the second REST API, and without a need for a callback). When the Map state finishes, you have all the results and you can combine them, either in the state machine itself or in another Lambda function, depending on what you need to do. The combined result will be sent back to API Gateway, which will use a Response mapping to filter the actual response sent the client.CommentShareEXPERTUrianswered 9 months agoAWS-User-8049274 9 months agoThank you! I will explore this further but pls share if there's an example or blog post around this technique.ShareUri EXPERT9 months agoThis is a blog about synchronous workflows. This is a blog post about the Map state.Share"


Question: How can I receive the header and footer in getting the public key from KMS?


Question: Copying labeled dataset for AWS Rekognition from one account to another

"Hi,We have separate accounts for dev, stage and production and I'm wondering if it's possible to copy labeled dataset  which was created on dev account to stage and production accounts?Thanks.FollowComment"

Answer: "1Sure you can copy in another s3 bucket in same or different Region, the json and xml file from you original dataset.In the destination account you can re-use the dataset imported itCommentShareGiuseppe_Banswered a year ago"


Question: AWS Amplify - how to get “Cognito Identity Id” from Cognito

"There appears to be two different ids that identify users in an AWS Amplify project that uses AWS Cognito:“Cognito Identity Id” and…“Cognito Sub”Is there any way to get a “Cognito Identity Id” purely from Cognito itself, using the CognitoIdentityServiceProvider? For example, if a new user is created programmatically and there’s an associated table indexed on their “cognito identity id” and I want to set values in that table before the user logs in. It seems like it is only exposed in requests by that actual user.For more context on what I understand these terms to be:Cognito Identity IdIs this the id from the identity pool?This is a uuid with the region prefixed, e.g.,: "us-east-1:12345678-beef-cafe-face-1234567890ab"Accessed via:In frontend code with the Auth module: Auth.currentUserInfo().then(user => user.id)In backend API requests for an authenticated user: req.apiGateway.event.requestContext.identity.cognitoIdentityIdNot available in the results of: new AWS.CognitoIdentityServiceProvider().listUsers(params)Notes:This id is treated as a "userId" in various Amplify examples/docsI’ve seen examples of people saving this manually in Cognito with a custom parameter of "custom:identity_id", which can only be set during an authenticated request by that userCognito SubThis appears to be something like a unique id for the user pool?This is a uuidAccessed via:In frontend code with the Auth module: Auth.currentUserInfo().then(user => user.attributes.sub)In backend API requests for an authenticated user: req.apiGateway.event.requestContext.identity.cognitoAuthenticationProvider.match(/CognitoSignIn:([^:]+)$/)[1]In the results of CognitoIdentityServiceProvider queriesFollowComment"


Question: How can I include contents-available when sending GCM messages via pinpoint?

"I want to send push notification to my iOS application by FCM service.I created a pinpoint project, and when I send as below in lambda, application receive messages well.let params = {    ApplicationId: applicationID /* required */,    SendUsersMessageRequest: {      /* required */      MessageConfiguration: {        /* required */        GCMMessage: {          "RawContent": `{\"notification\": {\"title\": \"${title}\",\"body\":\"${message}\", \"sound\":\"default\"}, \"content_available\": \"true\"}`        },      },      Users: users,    },  };  try {    return await pinpoint.sendUsersMessages(params).promise();  } catch (err) {    console.log('Error - ', err);  }And I want to contain content_available value for iOS background handler, but when application received message this value is deleted like below. LOG  A new FCM message arrived! {"messageId":"1656044924598337","data":{"pinpoint.campaign.campaign_id":"_DIRECT"},"notification":{"body":"TEST body","sound":"default","title":"TEST title"},"from":"560179008583"}How can i contain contents-available value in GCMMessage?Please share the guided or advice.ThanksFollowComment"


"See this in security hub:"The finding is in a WARNING state. The SNS topic associated with this rule is owned by a different account. The current account cannot obtain the subscription information. The account that owns the SNS topic must grant to the current account the sns:ListSubscriptionsByTopic permission for the SNS topic."Anyone have the correct json code I would need to add to the access policy? All accounts are under the same ORG, so can use that as a condition. I saw this post: https://github.com/aws-samples/aws-secure-environment-accelerator/issues/875So, similar to this?{"Sid": "SNS-Cross-Acct","Effect": "Allow","Principal": {"AWS": "*"},"Action": "sns:ListSubscriptionsByTopic","Resource": "sns topic arn","Condition": {"StringEquals": {"aws:PrincipalOrgID": "org-id"},"StringLike": {"aws:PrincipalArn": "arn:aws:iam:::roleid/aws-service-role/securityhub.amazonaws.com/AWSServiceRoleForSecurityHub"}}}FollowComment"

Answer: "0the aws:PrincipalArn condition is too restrictive as it's trying to match an exact service role ARN. But the aws:PrincipalArn includes the account ID, which can vary if you have multiple accounts. You'd better use aws:SourceArn and set its value to the ARN of the Security Hub service role in the account where the SNS topic resides.Second, the value of the Resource field should be the ARN of the SNS topic you want to grant access to. The ARN has the following format: arn:aws:sns:region:account-id:topicname.CommentShareEXPERTsedat_salmananswered 22 days ago"


Question: AWS Secrets Manager with boto3 in python

"I've heard that it's not a best practice to use aws configure to store secrets in a config file on my machine, which totally makes sense.  How do I use AWS Secrets manager to get the keys when connecting to AWS requires keys in the first place?  Does my question make sense?  Would this code work?  https://boto3.amazonaws.com/v1/documentation/api/latest/guide/secrets-manager.htmlFollowComment"

Answer: "1Accepted AnswerGood question!What you may see if you're running things locally is to put the initial credentials into your configuration file locally.  However, there is still an authentication need - to authenticate into an IAM entity that has access to AWS, for example an IAM User or IAM role.If your application is running in AWS, that's where the integration of AWS IAM and Secrets Management is fantastic.  For example, if your app is running on an ec2, the ec2 IAM Role will need IAM permissions to access the Secret (also considering Secret Resource policy and KMS as needed) and can retrieve it programatically using CLI or Boto3 like the link you've shared: https://repost.aws/questions/QUAsOpdhR-QAKVZEL0nRGTkw/aws-secrets-manager-with-boto-3-in-python.CommentSharejsoncanswered a year agojschwar313 a year agoI see.  And since the secrets I do have stored have very limited access and no admin access, even if they did get out, the impact would be minor.Share0It depends how you are executing the code that is retrieving the secrets.For example if you are executing your python script from an EC2 machine, you assign an IAM role to the machine which gives it access to Secrets Manager. Boto3 will automatically pick up the permissions and you wont need to supply credentials.CommentSharevlttnvanswered a year agojschwar313 a year agoI see what you mean.  For now, I'm executing this python script on my own PC at home, but I've heard that putting secrets in a config file is not a best practice.  What do you think?  Is there a way to use secrets manager to get the secrets from my pc?  I doubt it, right?  Thanks.Share"


Question: Create cron job using AWS lambda

"Hi guys,I'd like to implement a mobile app (using Xamarin) that inserts and modifies "events" on a calendar (table on DynamoDB). So I found a post which tells how launch a lambda function inserting rows in a table (using AWS Streams). Ok, at the moment, my app can write in that table (timestamp and duration) and a lambda starts.Now, I need that the lambda function creates the cron job which starts at "timestamp" time for a "duration" seconds. In particular, that cron should send a mqtt message to an IoT device..Thanks a lotGiacoFollowComment"

Answer: 0Got it!https://boto3.amazonaws.com/v1/documentation/api/latest/guide/cw-example-events.htmlCommentSharegiacoanswered 3 years ago


Question: Is it possible to test locally SageMaker Inference Pipelines?

Is it possible to test locally SageMaker Inference Pipelines? I would like to be able to easily troubleshoot and find the appropriate serialization between containersFollowComment

Answer: "0Accepted AnswerIf you are referring to using local mode via the SM PySDK, then pipeline deployment is not supported.As an alternative, given your three inference containers, you could manually run the services locally and then implement a kind of facade function that invokes the three services in pipeline and manages input/output accordingly.CommentShareEXPERTGiuseppe_Panswered 3 years ago"


Question: How to create a Redshift user with selective schema permissions?

"How can I create a new user in Redshift who has SELECT access to all existing schemas, but has full permissions to create and modify their own schemas?FollowComment"

Answer: "1Create a new user with the desired username using the CREATE USER command, for example:CREATE USER new_user WITH PASSWORD 'password';Grant SELECT access to all existing schemas using the GRANT command, for example:GRANT USAGE ON ALL SCHEMAS IN DATABASE my_database TO new_user;Grant the user full permissions to create and modify their own schemas using the GRANT command, for example:GRANT ALL ON SCHEMA my_schema TO new_user;With these steps, you have created a new Redshift user with SELECT access to all existing schemas and full permissions to create and modify their own schemas.CommentShareEXPERTsedat_salmananswered 2 months agoalishahzad 2 months agoThank you very much for your response.I am able to achieve what was required with a small modification in the below statement:instead of this:GRANT ALL ON SCHEMA my_database TO new_user;I used this:GRANT CREATE ON DATABASE my_schema TO new_user;Share"


Question: How to modify blue/green switchover mapping

"My MySQL 5.6 RDS cluster is reaching end of life. I've created a blue/green deployment, as suggested in the notification. When I attempt the switchover, it returns the message, "DB instance rl-dev-e1a has a different role than rl-dev-e1a-green-r0puam" the blue role is a writer instance and the green role is a reader instance. The blue e1b is a reader instance and the green e1b is a writer instance. It appears the mappings are crossed. How do I change the mappings, so that the blue writer is mapped to the green writer and the blue reader is mapped to the green reader?FollowComment"

Answer: "2This error is because your green cluster has had a role change, the writer in that cluster switched frm one node to another node.In order to resolve this issue you can call failover-db-cluster on the green cluster to make rl-dev-e1a-green-r0puam the writer and then blue green deployment switchover will succeed.Thanks,CommentShareMODERATORphilawsanswered 5 months agoEdTGuy 5 months agoThank you. The switchover is now progressing.Share"


Question: ACM Troubleshooting: Help Needed

"Hello,Help needed!I opened an AWS account. I also opened two domain names.I am running some projects and need SSL certificates but unfortunately as hard as I had tried repeatedly, I couldn't get the certificate status change from pending state to issued.I knew I received two seperate emails to verify the 2 domains which I didn't attend to on time. However, I later resent the emails and followed the processes, consequently, I verified the two domains to be mine.However, I still find it hard to use ceritificate manager to issue an SSL certificate till now. I had read the documentations over and over but I can't get any solution yet.Please kindly assist because I am stuck and can't move forward in my projects. Thanks!FollowComment"

Answer: "0If a certificate is showing as "issued" in Certificate Manager then it should be available for you to associate with resources like a CloudFront distribution or the listener for a Load Balancer, provided these are in the same region as the certificate.Note that there isn't a certificate for you to download from AWS Console, nor will you get a certificate emailed to you as an attachment. It remains as an object inside ACM that can be associated with other resources in their configs.See https://www.youtube.com/watch?v=GW7RkWUZL4E for associating with load balancers, and https://www.youtube.com/watch?v=AY0iJyCOkOc for CloudFront distributions.If you want a certificate that you can install into an EC2 instance then ACM can't do this, you'll need to procure a certificate from a third party such as letsencrypt.com.CommentShareRWCanswered 12 days agorePost-User-0167980 12 days agoThank you. I really appreciate this. I can understand the above. However, I am trying to request the certificate from AWS ACM.ShareRWC 12 days agoJust to understand where you are, you've verified the domain is yours, yes?In AWS Console -> AWS Certifciate Manager (ACM) -> Request a certificate -> Request a public certificateFill out the details for the cert that you want (as you've already verified the domain in R53, select DNS validation).Click on the pending cert, click on create records in R53, wait a few minutes for everything to propagate through....It's now validated and issued, and ready for use https://docs.aws.amazon.com/acm/latest/userguide/acm-services.htmlShare0First of all try to check your domain setting and check it to hit on browser and then try it again because some time it takes more then one dayCommentShareArsalananswered 12 days agorePost-User-0167980 12 days agoThanks for the response. I had done that before. It's not working yet.Share"


Question: AWS Oregon Down?

"Hello there,We are having issues with Oregon region. Session Manager with all the EC2 Instances are too slow. Therefore I tried to stop an Instance and started again. Now it's not working. Unable to connect to that instance via Serial console too. Can't see anything specific in the Health Dashboard/Status Page.[Update]We spotted an issue with a attached volume. Fixed it. But still Session Manager is slow. But able to access via SSH without any issues.FollowComment"

Answer: "0In such situations the best place for you to check is AWS SHD (Service Health Dashboard); then use the search filter 'Region = Oregon', I see all services running healthy (Green):https://health.aws.amazon.com/health/statusCommentShareEXPERTTushar_Janswered 4 months ago"


Question: [Announcement] AWS Snowball is now available in the AWS Middle East (UAE) Region

"AWS Snowball is now available in the AWS Middle East (UAE) RegionPosted On: Mar 6, 2023AWS Snowball Edge devices are now available in the AWS Middle East (UAE) Region.AWS Snowball, a member of the AWS Snow Family, is an edge computing, data migration, and edge storage device that comes in two configurations - Snowball Edge Storage Optimized and Snowball Edge Compute Optimized. The Snowball Edge Storage Optimized device provides 80 TB of Amazon S3 compatible object storage and is designed for local storage and large-scale data transfer. You can use these devices for data collection, machine learning and processing, and storage in environments with intermittent connectivity (like manufacturing, industrial, and transportation) or in extremely remote locations (like military or maritime operations) before shipping the devices back to AWS.AWS Snowball Edge Storage Optimized is offered with on-demand pricing option, which includes 10 days of device use and a per-day fee for each additional day you use the device before sending it back to AWS. AWS Snowball Edge Compute Optimized is available in Monthly and 1-Year Commit pricing options. For complete pricing details, visit the AWS Snowball pricing page. To get started, visit the AWS Management Console. For Regional availability, check the Regional Service Availability pages for the latest information. To learn more, visit the AWS Snowball Edge documentation or the AWS Snowball product page.FollowComment"


Question: Pinpoint SMS unsubscribe/resubscribe

I'm facing some issues while implementing Two-way SMS unsubscribe/resubscribe using AWS Pinpoint SMS. We are not using "self-managed opt-outs". When I unsubscribe through "STOP" I am not receiving further messages which is expected but when I try to resubscribe I am not receiving messages. Pinpoint Logs are still showing number is opted out.FollowComment

Answer: "0Hi,Thanks for reaching out. Can you kindly clarify how exactly you are resubscribing the number?I would like to understand how you are doing this at the moment. That said, you will need to opt-in numbers which have opted-out via the opt-in api -> https://docs.aws.amazon.com/cli/latest/reference/sns/opt-in-phone-number.html.$ aws sns opt-in-phone-number --phone-number +1XXXXXXXXPlease do note that there is a hard limitation here that opted-out numbers can only be opted-in once every 30 days. This is discussed in the above documentation.CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago"


Question: moto equivalent library for java/kotlin

I found that the moto open source library provides a way to mock multiple AWS service apis to enable faster and simple unit testing. But I couldn't find the similar/equivalent library in Java/Kotlin. Hence reaching out to this forum to check any leads on this topic. Any help will be super helpful.FollowComment

Answer: "0HI there,Thank you for reaching out to us. It seems that the library you are talking about is a 3rd party library implemented for Python. You can make use of AWS SDK for Java to create AWS services using Java however this does not contain the mock functionality of Moto library.Unfortunately I cannot comment on any 3rd party library that might provide your desired functionality. I am sorry for the inconvenience this might cause to you.CommentShareAWS-User-113answered a year ago"


Question: Default password for Amazon SageMaker studio lab instance.

What is the default password for Amazon SageMaker studio lab instance console?FollowComment

Answer: "1There is no default password.After signing in your SageMaker Studio Lab account, you access the instance via the Open project button where you get access to Jupyter Lab interface.CommentShareEXPERTMassimilianoAWSanswered 4 months agoAlvin Kimata 4 months agoWhat is the default password for the AWS SageMaker studio lab instance terminal?Please refer to the image in the post above.I am also unable to login as root in the cli with the commandsu as it requires a password to login as admin.Share0Is there any particular reason you need to have default password? Amazon SageMaker Studio Lab instance is fully managed by AWS and it's preinstalled with common packages and libraries. you don't need to switch to privileged user in order to install additional packages/libraries. "studio-lab-user" should have sufficient permissions for you to perform most common tasks.CommentShareJian_AWSanswered 4 months agoMichele Monclova 2 months agoStudio Lab does not give SUDO access.  That is one of the limitations of this service.Share"


Question: Cognito Custom Email Sender Code Decryption

"I am implementing a custom email sending Lambda for Cognito. When attempting to decrypt the "code" I am receiving the "Aws::KMS::Errors::InvalidCiphertextException" exception.I have a symmetric KMS key assigned to the Lambda via the Cognito User Pool, and can successfully trigger the Lambda.I have attempted to use both "Base64.decode64" and Base64.strict_decode64" before passing the ciphertext to the decode method.The CloudTrail logs are showing that Cognito is using the KMS GenerateKeyPair method, and providing an encryption context:{  "userpool-id": "my-user-pool",  "aws-crypto-public-key": "AULXovx/...==" }I have therefore attempted to pass this "encryption_context" to the decrypt method, however the "aws-crypto-public-key" is unique to each request. The KMS documentation explains (as best I can understand) that public keys are not applicable for symmetric keys.Questions:Have I correctly understood the requirements to decode the ciphertext input?If so, how can I retrieve the public-key value for the given ciphertext input?Language: RubySDK Version: 3FollowComment"

Answer: "0Accepted AnswerI was using the wrong library to decrypt the ciphertext. Cognito is using the Encryption SDK to encrypt the code, not KMS, therefore it requires the use of the same SDK to decrypt.Notes:The Encryption SDK, in this circumstance, is using the symmetric KMS key configured on the user pool to perform the encryption.The Encryption SDK is not currently available for RubyCommentSharemarckysharkyanswered a year ago"


Question: Manual installation of GGC V2 Core device

"Hi,In our project we've managed to add the greengrass to our Yocto image. The fresh greengrass is in /greengrass/v2 directory. It can start but obviously it's starting with all the default values.Installation greengrass by executing the commands from https://docs.aws.amazon.com/greengrass/v2/developerguide/getting-started.html is not an option.What we need is to prepare the config files and other stuff so that the greengrass will be able to connect to to cloud and operate. We can generate the certificates and other needed stuff and ship to the device. Any examples on that field or maybe some hints?Is it possible to setup while configs in /greengrass/v2/config manually?FollowComment"

Answer: "0Hi, we're doing exactly this right now.  We generate the device certs ourselves, and I have a "deviceConfig.tmp" template file that our install scripts take the thing name and substitute that in the template and generate "deviceConfig.yaml".  From there we can pass:--config ./deviceConfig.yamlin to the installer and it will use those values.  We also have a provisioning template attached to our CA to provision the IoT thing.  When Greengrass starts, it will (after two minutes) send the appropriate messages, and a GG Core device is automatically created.Hope that helps!CommentSharerchamberlinanswered 2 years ago0Hi,Many thanks for some advices. I will try to implement something similar on our end.CommentShareszymon888answered 2 years ago0We now have documentation for manually setting up Greengrass. See: https://docs.aws.amazon.com/greengrass/v2/developerguide/manual-installation.htmlCheers,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago"


Question: Trouble using display name for AWS SES sender address

"I'm working in .NET with the AWS SDK for Amazon SES mail.  I'm trying to add a display name to the sender address like so:using (var client = new AmazonSimpleEmailServiceClient(RegionEndpoint.USWest2)){    var sendRequest = new SendEmailRequest    {        Source = "My Website <noreply@mywebsite.com>"Sometimes this works, but sometimes it throws an exception:Amazon.Runtime.Internal.HttpErrorResponseExceptionHandler.HandleException(IExecutionContext executionContext, HttpErrorResponseException exception) Local address contains control or whitespace.When it fails, it seems as if it's trying to validate the display part as if it were the email address.I know with the Amazon SES SMTP Interface I can set the sender address like so:MailMessage message = new MailMessage();message.From = new MailAddress("noreply@mywebsite.com", "My Website");and the desired "My Website noreply@mywebsite.com" is achieved and works fine.  But if I want to use the AWS SDK, I get this error intermittently.  Has anyone else seen this or know what's going on?  It seems as if the display name in AWS SDK may just not be supported.FollowComment"

Answer: "1Accepted AnswerIf you want to specify the display name ('friendly name') that contains spaces, you should put that sender name in double quotes. Do not forget to escape them:Source = "\"My Website\" <noreply@mywebsite.com>"In general, always prefer that format.Please refer to the Amazon SES Developer Guide. Please also refer to the RFC5322 standard.CommentShareDmitry Balabanovanswered a year agoTom Peterson a year agoThis worked for me, though since it worked intermittently in the past, I can't fully test it.  I didn't find anything in the documentation about surrounding the friendly name in quotes in case of whitespace, but since the quote marks don't show up literally in the email header when delivered, it makes sense that they would be acting to delimit the contents as a single string.  We'll go with it. Thanks.Share"


Question: AWS SSO redirect support

"We've just enabled AWS SSO with our corporate gsuite as the IdP, mainly to reduce confusion in trying to get our less devops-y staff into things like our cloudwatch dashboards in a read-only way. We've saved them from having to keep track of another account with SSO (great!), but unfortunately it looks like there's no way right now to get them where they want to be without landing on a nearly empty user portal page, and drilling a couple clicks down into the lone AWS Account "app". Is there any hope for a way to more fully customize the SSO user portal in the future, to avoid having to interact several times with a page containing only one viable option? The ability to provide a redirect link in the querystring specifying where to take the user immediately after signing in, would also fit the bill.FollowComment"


Question: IoT Core pricing of basic ingest and QoS 1 combination

"According to the following document, PUBACK is metered as a single message. When a 5KB message is sent from a device with QoS 1, it will be charged as two messages.https://aws.amazon.com/iot-core/pricing/additional-details/#MessagingIn case of the combination of QoS 1 and Basic Ingest, a message from the device will not be charged, but PUBACK will be charged as one message, is this correct?According to the following document, QoS 1 can be used for Basic Ingest as well.https://docs.aws.amazon.com/iot/latest/developerguide/iot-basic-ingest.htmlFollowComment"

Answer: 0Accepted AnswerPUBACK messages sent by IoT Core to the device are not metered.https://aws.amazon.com/iot-core/pricing/additional-details/CommentShareEXPERTMassimilianoAWSanswered 2 years ago


Question: AWS IoT Subscribe from ESP32

"Hi all,My MCU - ESP32 fails to reconnect only for subscribing after 3rd trial of reconnection so publishing is working fine. Is this a feature of AWS IoT Core or a bug of my ESP32?FollowCommentGreg_B EXPERTa year agoDo you mean the MQTT connection succeeds every time, but the subscription attempt fails sometimes? Can you please share some logs?Share"

Answer: "0Thanks for the reply @Greg_B.MQTT connection succeeds every time but subscription fails after thrid reconnection of the MQTT after Wi-Fi fails.I took screenshots so I summarized them on g-doc.https://docs.google.com/document/d/1PfqNQNrrz0z_zbLjRPhGYh1IT4QjtDhEzknMuQX_UGg/edit?usp=sharingThanks in advance.CommentSharetakaanswered a year agoGreg_B EXPERTa year agoUnfortunately that link is not working.Sharetaka a year agoSorry for the inconvenience. Please try this, https://docs.google.com/document/d/1PfqNQNrrz0z_zbLjRPhGYh1IT4QjtDhEzknMuQX_UGg/edit?usp=sharingShare"


Question: Airflow EMR Hook failing while requesting to add a step

"Hope everyone is doing well!Here's the context of the issue I'm facing, I'm working on a company that is supporting a really old airflow version, here are the details of the version and some components.airflow=1.10.1=py36_0python=3.6.2=0botocore=1.12.226=py_0awscli=1.16.236=py36_0boto3=1.9.199=py_0boto=2.49.0=py36_0Since a couple of days ago, we have been facing an issue on a DAG that is supposed to have part of the code to add a task to an EMR cluster and we are facing the following issue:Traceback (most recent call last):  File "/home/conda/.conda/envs/airflow36/lib/python3.6/site-packages/airflow/models.py", line 1659, in _run_raw_task    result = task_copy.execute(context=context)  File "/src/src/dags/data_conversion/operators/emr.py", line 69, in execute    response = emr.add_job_flow_steps(JobFlowId=job_flow_id, Steps=steps)  File "/home/conda/.conda/envs/airflow36/lib/python3.6/site-packages/botocore/client.py", line 357, in _api_call    return self._make_api_call(operation_name, kwargs)  File "/home/conda/.conda/envs/airflow36/lib/python3.6/site-packages/botocore/client.py", line 661, in _make_api_call    raise error_class(parsed_response, operation_name)botocore.exceptions.ClientError: An error occurred (ValidationException) when calling the AddJobFlowSteps operation: A job flow that is shutting down, terminated, or finished may not be modified.And here is the part of the code affected:        job_flow_id = context['task_instance'].xcom_pull(task_ids=self.cluster_creator_operator_name)[0]        emr = EmrHook(aws_conn_id=self.aws_conn_id).get_conn()        logging.info('Adding steps to %s', job_flow_id)        response = emr.add_job_flow_steps(JobFlowId=job_flow_id, Steps=steps)        if not response['ResponseMetadata']['HTTPStatusCode'] == 200:            raise AirflowException('Adding steps failed: %s' % response)        else:            logging.info('Steps %s added to JobFlow', response['StepIds'])            return response['StepIds']Based on my research, I've found a stackoverflow post (https://stackoverflow.com/questions/64634755/mrjob-im-having-a-client-error-while-using-emr) where it is mentioned that botocore package is deprecated as well as in the github it is mentioned that is no longer support the version of python we are using.Would this be the correct analysis for the issue? I've also found this link (https://stackoverflow.com/questions/65595398/mrjob-in-emr-is-running-only-1-mrstep-out-of-3-mrsteps-and-cluster-is-shutting-d) where it is suggested to persist an EMR cluster but not sure if will be useful because I suspect the Airflow classes are invoking botocore package and I would be unable to override that.Thanks a lot.FollowComment"


Question: Is any component of Sagemaker still involved in production  inferencing

"Are any components of the SageMaker Engine involved still during production ( inference) , I had a discussion with someone saying Sagemaker has nothing to do with production anymore because everything is deployed , containerized and executed somewhere  in a VM  or cluster.,   I think there are some instances the main engine is working in production  and please correct me  if i am wrong 1. Billing records - have to be generated -so something is connected to the engine ?  does the model help here or is it just pure EC2 etc compute measured ? Who manages the endpoints ( server less, and asynch) ?   if we need to use Sage maker monitor  this is also alive during production.  Question is What  main components are  active in production  outside model or does mode communicate to engine still?    As an addendum someone mentioned to me if it is deployed to EC2 or K8s yes it is disconnected from the main services in production you CANNOT use Model monitor in this scenario?  --- but if you deploy to SAGEMAKER INFERENCE?  you can use model monitor in prod.  You deploy to an endpoint for real time... What is SageMAker Inference - as a concept or as some physical thing because there are 71 options in Sagemaker inference ?FollowCommentTasio EXPERT7 months agoWhat do you mean by "involved in production"?. SageMaker hosting is a model serving feature that uses SageMaker managed infrastructure.Share"

Answer: 0What do you mean exactly by "production" in the context?CommentShareJimmy Zhaoanswered 4 months agorePost-SoniaA-8678285 4 months agoJimmy it is what it means production after itis depoloyed --- made use of.. Reason why i ask is the AZ's of SagemKer may not count anynore if it is deployed in a app outside of the AZs Sagemaker uses . Sagemaker has nothing to do with that model running somewhereShare


Question: Can a soft bounce still turn to hard bounce

"Read from AWS blog post written in 2012 (https://aws.amazon.com/blogs/messaging-and-targeting/email-definitions-bounces):  that SES will automatically try to resend a message that has generated a soft bounce over a period of time until the message either delivers or the system will no longer retry the delivery and in turn generates a hard bounce.  Is this still valid? If it is, does this mean that the event/notification we received after 840 minutes is for that final hard bounce? Or it still depends on the bounceType that we received?FollowComment"


Question: MotionSet appears not to update after it is saved

"I'll keep this simple. I'm working on an animgraph (along with the GSG tutorials on YouTube). I have my motionset already created. I added another motion to the set and saved the set. The motionset is selected for the animgraph in the animgraph window. See first screenshot: white arrows show the new motion within the motionset (bigger white arrow) and also the motionset chosen for the animgraph (bottom right arrow).REMOVEDUPLOADThe red arrow is where my issue comes up. When I click "select motions", I get a list of motions from the motionset, but it is outdated. The list does not contain the new animation "malcom_standing_jump_up". I confirmed that the motionset was saved by saving it again, and also by using "save as". It still does not update this list of motions to choose from for the node in the animgraph. See second screenshot for list missing the new "malcom_standing_jump_up" animation:REMOVEDUPLOADOnly by reloading the entire editor does it seem to recognize the change made to the motionset. This is annoying as it is much more time consuming... and it has happened for the previous animations I added as well ("malcom_idle_anim", "malcom_walking_anim", and "malcom_running_anim").Thanks for any help!Follow"

Answer: "0Accepted AnswerAlso - just to double check, you are adding the new motions on the Motion Sets tab, and NOT on the Motions tab? When you add new motions to a Motion Set, you should be on the Motion Sets tab, have your Motion Set selected at the top of the window, and then scroll down to where it says Motion Set below. Then use the blue open folder icon button to add motions to your motion set.REMOVEDUPLOADThe Motions tab is there so that you can load motions to preview on your Actor, but it does not place those motions in your Motion Set - in order to add motions to your Motion Set, you need to be on the Motion Set tab.Just wanted to be clear about how you are adding motions - if you're already doing this, we can continue to address your issue.SharerePost-User-0479726answered 5 years ago0Hi @REDACTEDUSERSharerePost-User-0479726answered 5 years ago0I think this was the issue. All of a sudden it started to load fine and I was wondering why. I didn't realize the motions tab doesn't load it into the currently selected motionset. Thanks :)SharerePost-User-6739708answered 5 years ago"


Question: When does Amplify stop trying to verify a custom domain?

"When does Amplify stop trying to verify a custom domain? I'm sure that there used to be a 24 hour expiration after adding the domain, but in our recent tests, a domain is still in the PENDING_VERIFICATION state well after 24 hours. Has this changed?FollowComment"

Answer: "0Amplify Hosting checks for DNS records for pending domain until 48 hrs. Although, it is important to update your CNAME records as soon as you create your custom domain. After your app is created in the Amplify console, your CNAME record is checked every few minutes to determine if it resolves. If it doesn’t resolve after an hour, the check is made every few hours, which can lead to a delay in your domain being ready to use.Reference - Troubleshooting custom domainsCommentShareSUPPORT ENGINEERVishal_Nanswered 2 months ago"


Question: Does Elastic Load Balancing service limit traffic based on payload size?

I would like to implement an upload API to handle large files (i.e. 1GB+). The architecture that I have in mind looks like this (I am intentionally avoiding uploads to S3).I know that some services like the API Gateway limit request payloads to a maximum of 10MB per request. Does ELB impose a similar limitation that would make the above architecture unworkable?FollowComment

Answer: "0Hi.Assuming it's an Application Load Balancer, it's fine if the backend is ECS.Lambda has a 1MB limit (HTTP 413: Payload too large)https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html#http-413-issuesIt is better to adjust the timeout value. Default is 60 seconds.https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.htmlCommentShareEXPERTiwasaanswered 4 months ago"


Question: "New Lambda streaming, can't get basic demos to work as expected, TTFB = full running time"

"Hello everyone,I've been toying with the newly introduced response streaming for my application.I managed to get both functionurls and @aws-sdk invocation to return the payloads... But there's no actual streaming happening.The behaviour I'm observing is as follows:Function is calledData is streamed inside the functionWhen the stream is FINISHED, the data gets pushed out of the function all at once.This appears to be the case no matter if I invoke with a function URL or with  @aws-sdk.I then proceeded to clone and deploy the example here: https://github.com/aws-samples/serverless-patterns/tree/main/lambda-streaming-ttfb-write-samLiterally just executed sam deploy and followed the instructions (deploying in us-east-1).Results appear to be absolutely identical (no streaming whatsoever in practice).I attach my testing results with cURL$ curl --request GET 'https://an6ke7jhzxvqceai5dcem3p3yu0xxfvk.lambda-url.us-east-1.on.aws/' --user <omitted>  --aws-sigv4 'aws:amz:us-east-1:lambda' -vkN -w "Connect: %{time_connect} TTFB: %{time_starttransfer} Total time: %{time_total} \n"Note: Unnecessary use of -X or --request, GET is already inferred.*   Trying 34.237.128.22:443...* Connected to an6ke7jhzxvqceai5dcem3p3yu0xxfvk.lambda-url.us-east-1.on.aws (34.237.128.22) port 443 (#0)* ALPN, offering h2* ALPN, offering http/1.1* TLSv1.0 (OUT), TLS header, Certificate Status (22):* TLSv1.3 (OUT), TLS handshake, Client hello (1):* TLSv1.2 (IN), TLS header, Certificate Status (22):* TLSv1.3 (IN), TLS handshake, Server hello (2):* TLSv1.2 (IN), TLS header, Certificate Status (22):* TLSv1.2 (IN), TLS handshake, Certificate (11):* TLSv1.2 (IN), TLS header, Certificate Status (22):* TLSv1.2 (IN), TLS handshake, Server key exchange (12):* TLSv1.2 (IN), TLS header, Certificate Status (22):* TLSv1.2 (IN), TLS handshake, Server finished (14):* TLSv1.2 (OUT), TLS header, Certificate Status (22):* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):* TLSv1.2 (OUT), TLS header, Finished (20):* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):* TLSv1.2 (OUT), TLS header, Certificate Status (22):* TLSv1.2 (OUT), TLS handshake, Finished (20):* TLSv1.2 (IN), TLS header, Finished (20):* TLSv1.2 (IN), TLS header, Certificate Status (22):* TLSv1.2 (IN), TLS handshake, Finished (20):* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256* ALPN, server did not agree to a protocol* Server certificate:*  subject: CN=*.lambda-url.us-east-1.on.aws*  start date: Jan 25 00:00:00 2023 GMT*  expire date: Feb 24 23:59:59 2024 GMT*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M02*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.* Server auth using AWS_SIGV4 with user '<omitted>'* TLSv1.2 (OUT), TLS header, Supplemental data (23):> GET / HTTP/1.1> Host: an6ke7jhzxvqceai5dcem3p3yu0xxfvk.lambda-url.us-east-1.on.aws> Authorization: <omitted>> X-Amz-Date: 20230428T135031Z> User-Agent: curl/7.81.0> Accept: */*>* TLSv1.2 (IN), TLS header, Supplemental data (23):* Mark bundle as not supporting multiuse< HTTP/1.1 200 OK< Date: Fri, 28 Apr 2023 13:50:35 GMT< Content-Type: text/html< Transfer-Encoding: chunked< Connection: keep-alive< x-amzn-RequestId: 1158cbe9-5b6b-4071-9ee1-e5f1d47a935d< x-custom-header: Example-Custom-Header< X-Amzn-Trace-Id: root=1-644bcf27-0b4f283715bc43f77c6f5e95;sampled=0<
First write2!

Streaming h1

Streaming h2

Streaming h3

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Quisque vitae mi tincidunt tellus ultricies dignissim id et diam. Morbi pharetra eu nisi et finibus. Vivamus diam nulla, vulputate et nisl cursus, pellentesque vehicula libero. Cras imperdiet lorem ante, non posuere dolor sollicitudin a. Vestibulum ipsum lacus, blandit nec augue id, lobortis dictum urna. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia curae; Morbi auctor orci eget tellus aliquam, non maximus massa porta. In diam ante, pulvinar aliquam nisl non, elementum hendrerit sapien. Vestibulum massa nunc, mattis non congue vitae, placerat in quam. Nam vulputate lectus metus, et dignissim erat varius a.

DONE!
* TLSv1.2 (IN), TLS header, Supplemental data (23):* Connection #0 to host an6ke7jhzxvqceai5dcem3p3yu0xxfvk.lambda-url.us-east-1.on.aws left intactConnect: 0.081320 TTFB: 4.397358 Total time: 4.397620It seems that TTFB is basically exactly equal to the full runtime of the function.Same result with @aws-sdkimport { Lambda, InvokeWithResponseStreamCommand } from "@aws-sdk/client-lambda"import { Readable, Transform } from "stream"const test = async () => {    const lambda = new Lambda({});        console.log(Date.now())    const r = await lambda.send(new InvokeWithResponseStreamCommand({ FunctionName: "lambda-streaming-ttfb-write-sam-StreamingFunction-F2fitaTVUmF3" }));    console.log(r)    for await (const event of r.EventStream) {        console.log("received", Date.now())        console.log(Buffer.from(event.PayloadChunk?.Payload ?? "<end>").toString("utf-8"))    }};test()and the output1682689911868{  '$metadata': {    httpStatusCode: 200,    requestId: '6d33da19-738c-4a85-8ab3-2490fb9d926d',    extendedRequestId: undefined,    cfId: undefined,    attempts: 1,    totalRetryDelay: 0  },  ExecutedVersion: '$LATEST',  ResponseStreamContentType: 'application/vnd.amazon.eventstream',  EventStream: {    [Symbol(Symbol.asyncIterator)]: [AsyncGeneratorFunction: [Symbol.asyncIterator]]  },  StatusCode: 200}received 1682689916354{"statusCode":200,"headers":{"Content-Type":"text/html","X-Custom-Header":"Example-Custom-Header"}}
First write2!

Streaming h1
received 1682689916355
Streaming h2
received 1682689916355
Streaming h3
received 1682689916355
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Quisque vitae mi tincidunt tellus ultricies dignissim id et diam. Morbi pharetra eu nisi et finibus. Vivamus diam nulla, vulputate et nisl cursus, pellentesque vehicula libero. Cras imperdiet lorem ante, non posuere dolor sollicitudin a. Vestibulum ipsum lacus, blandit nec augue id, lobortis dictum urna. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia curae; Morbi auctor orci eget tellus aliquam, non maximus massa porta. In diam ante, pulvinar aliquam nisl non, elementum hendrerit sapien. Vestibulum massa nunc, mattis non congue vitae, placerat in quam. Nam vulputate lectus metus, et dignissim erat varius a.
received 1682689916356
DONE!
received 1682689916356<end>Note the timestamps are essentially identical and the TTFB is basically equal to the runtime.Are there any special caveats, or special adjustment needed, or explicit request to be made, for the actual streaming function to be enabled?The results above are for the example repos, deployed without modifying anything (I just wrote some code to test the output).Because the current situation appears to be that TTFB is completely unaffacted by this setup.FollowCommentUri EXPERTa month agoCan you please post your code to make sure there is no coding issue?Share"

Answer: "1Accepted AnswerI had the same issue. I swapped my region from US-EAST-1 to US-EAST-2 and the same code worked like charm! Either this feature is broken in US-EAST-1 or it may not be available yet (contrary to the announcements)CommentSharerePost-User-8330484answered 9 days ago0I have the same issue!CommentSharerePost-User-2870168answered a month ago-1To indicate to the runtime that Lambda should stream your function’s responses, you must wrap your function handler with the streamifyResponse() decorator. This tells the runtime to use the correct stream logic path, allowing the function to stream responses.RESPONSE_STREAM enables your function to stream payload results as they become available if you wrap the function with the streamifyResponse() decorator. Lambda invokes your function using the InvokeWithResponseStream API. If InvokeWithResponseStream invokes a function that is not wrapped with streamifyResponse(), Lambda does not stream the response and instead returns a buffered response which is subject to the 6 MB size limit.Reference : https://aws.amazon.com/blogs/compute/introducing-aws-lambda-response-streaming/CommentShareEXPERTAWS-User-Nitinanswered a month agorePost-User-5435199 a month agoThe handler is definitely wrapped.Mine was wrapped already, but the one I'm testing here is this one:https://github.com/aws-samples/serverless-patterns/blob/main/lambda-streaming-ttfb-write-sam/src/index.jsfrom the aws-samples repo.I didn't change a single letter of the code, just hit sam deploy -gAnd I'm getting the results above (check the outputs).Share"


Question: IoT sql query rule - comparing 2 arrays of objects returns null/undefined?

"Greetings,I'm trying to compare 2 arrays in a sql query. Everything seems to work fine while getting data from dynamodb and MQTT broker server.But if I try to compare both arrays, doesn't return anything or its undefined.My sql query:SELECT ts, objects, (SELECT id FROM get_dynamodb('table', 'key_name', 'key_value', 'rolearn').ids) AS db, (SELECT id from objects) as obj_idsFROM 'subscribed/topic'WHERE objects != []Result:{"ts": 1615807935588,"objects": [{"id": 1,"planet": "jupiter"},{"id": 2,"planet": "mars"},],"db": [{"id": 2},{"id": 3}],"obj_ids": [{"id": 1},{"id": 2}]}So far it's ok, now all I want to do is compare if "obj_ids" and "db" arrays are different (obj_ids != db), and by the aws documentation https://docs.aws.amazon.com/iot/latest/developerguide/iot-sql-operators.html#iot-sql-operators-not-eq I can compare both arrays.So if I do:SELECT ts, objects, (SELECT id FROM get_dynamodb('table', 'key_name', 'key_value', 'rolearn').ids) AS db, (SELECT id from objects) as obj_idsFROM 'subscribed/topic'WHERE objects != []AND obj_ids != dbThe code doesn't return anything. I've already tested comparing 2 objects arrays hardcoded into the query and it works just has I intended.SELECT ([{"id": 1},{"id": 2}| != [{"id": 1}|) as resultFROM 'subscribed/topic'(| => ])Result:{"result": true}Any response will be appretiated.Thanks!FollowComment"

Answer: 0https://stackoverflow.com/questions/66662269/aws-iot-core-sql-query-rule-comparing-2-object-arrays-returns-null-undefined/66819712#66819712Problem solved.CommentShareneliomarcelinoanswered 2 years ago


Question: Textract - Extract form key values in reading order

"Hi all,I'm currently using textract to try process a multi page pdf form using python which overall is going well.I'm having some specific issues though with the key values. Upon extracting them they don't seem to be in any specific order. Was wondering if there was a suggested method to keep them in roughly reading order or organise them that way.There are multiple fields in the form that have duplicate keys (e.g Yes/No questions) and so was hoping to maintain that to map which Yes/No response belongs to which question.Uploading the example doc to the web ui and downloading the response keyvalues.csv has it in exactly the order I'm looking for but I'm not sure how they arrange it that way.CheersFollowComment"

Answer: "0Textract does not guarantee any sort of ordering of Forms response today. General recommendation is to followBest Practices for Amazon Textract to ensure input documents are optimized for better results.CommentShareTaka_Manswered 7 months agorePost-User-0140026 5 months agoI am also looking to maintain the order of text in the key/value response with getDocumentAnalysis.  Processing medical reports where sections repeat, so a group of keys are duplicated, for example multiple physicians; AttLName, AttFName, AttMName. I cannot ensure the First Name is associated with the correct Last Name.  It seems to me that the order of data returned by the API is by Confidence Score(desc).  When I run the same document through the AWS Analyze Document service from the AWS Console the order is preserved.  Why are the results from the console and the API different?Share"


Question: AWS C++ SDK GetMedia call with Live KVS stream

"I am currently working on implementing a C++ project to retrieve the most up to date fragment from a Live KVS Stream using GetMedia.However whenever GetMedia is called, the program will currently hang at that point until the stream has been stopped, only after this will the GetMedia call return some data.My question is:Is there a way to retrieve the latest fragment in a stream using GetMedia, while the stream is active and live streaming from a Pi 4. Without having to stop the stream?My Current Code is the following, please let me know if there is anything I am missing or ways I could improve or solve this issueAws::SDKOptions options;    options.loggingOptions.logLevel = Aws::Utils::Logging::LogLevel::Info;    Aws::InitAPI(options);    {        Aws::Auth::AWSCredentials aws_credentials;        aws_credentials.SetAWSAccessKeyId("MY_ACCESS_KEY");        aws_credentials.SetAWSSecretKey("MY_SECRET_KEY");        Aws::Auth::SimpleAWSCredentialsProvider provider = Aws::Auth::SimpleAWSCredentialsProvider(aws_credentials);        Aws::Client::ClientConfiguration clientConfig;        clientConfig.region = Aws::Region::EU_WEST_1;        Aws::KinesisVideo::KinesisVideoClient client = Aws::KinesisVideo::KinesisVideoClient(aws_credentials, clientConfig);        Aws::KinesisVideo::Model::GetDataEndpointRequest request;        request.SetStreamName("MY_STREAM_NAME");        request.SetAPIName(Aws::KinesisVideo::Model::APIName::GET_MEDIA);                Aws::KinesisVideo::Model::GetDataEndpointOutcome result = client.GetDataEndpoint(request);        cout << result.GetError().GetExceptionName() + ": " + result.GetError().GetMessage() << endl;        cout << result.GetResult().GetDataEndpoint() << endl;        cout << "GetDataEndpoint successful: " << result.IsSuccess() << endl;        Aws::KinesisVideoMedia::KinesisVideoMediaClient* videoMediaClient = new Aws::KinesisVideoMedia::KinesisVideoMediaClient(aws_credentials, clientConfig);        Aws::KinesisVideoMedia::Model::GetMediaRequest getMediaRequest;        getMediaRequest.SetStreamName("MY_STREAM_NAME");        Aws::KinesisVideoMedia::Model::StartSelector selector;        selector.WithStartSelectorType(Aws::KinesisVideoMedia::Model::StartSelectorType::NOW);        getMediaRequest.SetStartSelector(selector);        videoMediaClient->OverrideEndpoint(result.GetResultWithOwnership().GetDataEndpoint());        videoMediaClient->EnableRequestProcessing();        videoMediaClient->SetServiceClientName("kinesisvideo");        Aws::KinesisVideoMedia::Model::GetMediaOutcome outcome = client->GetMedia(request);        if (outcome.IsSuccess()) {            cout << "Success" << endl;            char buffer[1024];            outcome.GetResultWithOwnership().GetPayload().read(buffer, 1024);            cout << buffer<< endl;        } else {            cout << "Failure" << endl;        }    }    ShutdownAPI(options);FollowComment"

Answer: "0Hi, this is Jorge and thanks for using this channel to discuss the issue. From my internal discussion with the KVS service team you should proceed and create a ticket with AWS if you have a support contract. If not, this id the best guidance I can provide to you;GetMedia can be called with the start selector NOW to start reading from the latest chunk i.e tip of the ingested data.-> https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_dataplane_StartSelector.html#termCan you please help us with the exact setup (what SDK version you are using, etc.) and first reproduce the scenario. We do not have access to reproduce this on a raspberry pi device. We recommend you to repro on any linux machine.Looking forward for your feedback on this query.CommentShareAWS-User-5519546answered a year ago"


Question: Redshift: Slow read speeds

We have a golang client running on k8s pod reading data from redshift table. Table has 50 columns and 10 million records and query looks like thisselect * from tablename where id > 0 and id < 5000000we are seeing that reading 5000 records is taking around 30 seconds which is very slow. what are the redshift metrics one should look at in these cases?FollowCommentjgrcloud EXPERTa year agoWhy are you getting 5M records from Redshift at a time? That isn't a typical pattern for Redshift.Share

Answer: "1Redshift is a columnar database. So instead of using select * from a table, selecting specific columns  will perform lot better.Based on query you have provided, please try creating sort key on column id and see if it helps.Typically Redshift takes care of  updating statistics automatically but you can also update it using analyze table command.https://docs.aws.amazon.com/redshift/latest/dg/t_Analyzing_tables.htmlCommentShareNita_Sanswered a year ago0Hello, to improve performance for this specific query and table, I would first explore data model optimizations such as ensuring that you have optimal compression and sort keys (e.g. id column) for the table (distribution style is also important in most cases but since this query doesn't involve joins, not so much). You can easily add these characteristics to your table via the ALTER command. Try looking at the Redshift Advisor recommendations in the Redshift console to see if there any data model optimizations recommended by the Redshift ML algorithms. Another aspect worth considering is if you have an underpowered Redshift cluster vis-a-vis this workload and/or other concurrent workloads. Try examining the CPU utilization for example to see if it is peaking. Try experimenting with an increased node count to see if it results in improved query runtimes.CommentShareasser_manswered a year ago"


Question: AppStream 2.0 with existing Azure SSO Federation

"We have SSO through Azure configured in our environment where users connect to the IAM/SSO page, log on with their azure credentials and MFA and are assigned Permission Sets.    All good.  I want to use Appstream 2.0 using the existing identity provider.In Applications, I choose Appstream, get all the attribute matching configured, get the Relay State done.  Role/Policy configured correctly as far as I know. The problem is that the Appstream sso app has it's own metadata fields that are presumably different than the existing one.  The setup guide for Appstream says you should take the metadata from the Appstream app and create a new even though I already have one configured in IAM.So users get the error belowError: Failed to assume role: Issuer not present in specified provider (service: AWSOpenIdDiscoveryService; status code: 400; error code: AuthSamlInvalidSamlResponseException)This error can occur if the issuer in the SAML response does not match the issuer declared in the federation metadata file. The metadata file was uploaded to AWS when you created the identity provider in IAM.Am I missing something to get this working?I saw the info below and doesn't seem like you can have more than one SAML provider and we already have one.Q: Can I connect more than one identity source to IAM Identity Center?No. At any given time, you can have only one directory or one SAML 2.0 identity provider connected to IAM Identity Center. But, you can change the identity source that is connected to a different one.FollowComment"

Answer: "0Accepted AnswerI created a new saml provider in IAM and everything works now.CommentSharerePost-User-1579460answered 14 days ago0Hello,I hope you're doing well.Thank you for reaching out to us with your concern.I understand that you want to use Appstream 2.0 using the existing identity provider. When tried assuming the role, users facing access denied error. Hence you reached out to us for assistance.Unfortunately, I am unable to fully answer this question without additional context. Basically I need to have saml response to identify the exisiting setup. Hence, I would request you to create a Support ticket. Where we can have a more visibility to dive deep into your exisiting structure and can provide you the resolution.CommentSharerePost-User-5962359answered 17 days agorePost-User-1579460 17 days agoThank you for responding.  If I had access to paid support I wouldn't be using re:Post though.I think I might have been confused in my original post.  I believe there is a restriction of having one SAML provider linked to SSO in "IAM Identity Center" which isn't a problem. But you are allowed more than one SAML Identity Provider in "Identity and Access Management (IAM)" ?  If this is the case I just need to create a new SAML provider there and link it with the Role and Application.Share"


Question: Cloudfront Domain Name not open on Android or iOS

"i have error on hitting cloudfront domain name on mobile and getting this errorError>AccessDenied<Message>Access Denied</Message><RequestId>KC1PW5W7VNBFV5RA</RequestId><HostId>v2Q/Pizn9qoQPgtQYQWB4kTs8Q7+ij0cQuWsOCuBji0d3rj5Jjw1YmjhCuPyJ4JiDMfeo43JGpCXimRyl8YjXw==<FollowCommentBrettski-AWS EXPERT5 months agoMore information would help to solve this problem. Are you saying it works from a desktop browser? If you haven't tested that, the output from a curl command would also help.Share"

Answer: "0If CloudFront origin is an S3 bucket, check the following things:Confirm that the objects in the bucket aren't encrypted by AWS Key Management Service (AWS KMS).  CloudFront distributions don't support AWS KMS-encrypted objects. You must remove AWS KMS encryption from the S3 objects that you want to serve using the distribution. Instead of using AWS KMS encryption, use AES-256 to encrypt your objects.Confirm that there is no explicit "Deny" in the bucket policy for the s3:GetObject actionIf the bucket policy grants public read access, confirm that AWS account that owns the bucket also owns the objectConfirm that the requested objects exist in the bucketConfirm that Amazon S3 Block Public Access is turned off for the bucketIf Requester Pays is turned on, confirm that the request includes the request-payer parameterIf you're using a Referer header to restrict access from CloudFront to your S3 origin, then review the custom headerConfirm that there's no explicit "Deny" Service control policies (SCPs) attached by your organization's management accountCommentShareOleksii Bebychanswered 5 months agorePost-User-2892578 5 months agoi checked here is my s3 setting (1) Default encryption Encryption key type:Amazon S3-managed keys (SSE-S3), 2) Bucket Key :Disabled, 3)Requester pays :Disabledi have checked but still getting errorSharerePost-User-2892578 5 months agoyes it is working on desktop browser?ShareOleksii Bebych 4 months agocan you share your S3 bucket policy ?Share"


Question: Urgent: AWS Still Charging Me Money for Elastic IP  (Yet All EC2 Instances Are Deleted as well as all its related resources)

"As part of a VPC lab (preparing me for the certification of AWS Solution Architect), I used two EC2 instances (I connected one to the Internet and I accessed from my computer, I isolated the other, but by letting it communicate with the first EC2 instance (in local), so I created Nat Gateway, Routertables etc). At the end I made a general cleanup: I removed everything starting with the two EC2 instances, and everything else. It was before yesterday. Today, by accessing My Billing Dashboard, I noticed that AWS is Charging Me Money for 28.5 Hours for this -See Screenshot_1 ($ 0.005 per elastic ip addresse not attached to a running instance per hour (prorated)). So, I went to EC2 Dashboard, and I found that yes I have 1 elastic IP (so directly I released it, since there is no "delete" option, only "release option"), and since that, Elastic IP turns to 0 (as you see in Screenshot_2). Now by accessing My Billing Dashboard to verify that it worked, I found that the 28.5 hours have become 38.5 hours !!!! While I have no Elastic IP (NOW): for more details, see Scrresnshot 1 and 2 (Attached here). Please, I Need Help to stop this incomrhensible Reason for Still Charging Me Money!FollowComment"

Answer: 1Accepted AnswerIt is possible that this is charging by the hour but the billing console may one update once a day. The charges here likely reflect the time between you releasing it and it counting the time before that period.The below page referencing billing data.https://docs.aws.amazon.com/billingconductor/latest/userguide/best-practices.html#bp-frequencyAWS billing data is updated at least once a day.CommentShareDavidanswered 21 days ago


Question: Autoscale Classic Load Balancer on TCP connections - client holding connection till it terminates

"I have Classic Load Balancer to load balance TCP communication. For example I have two instances of TCP server (service) behind classic load balancer.Client application let say 10 instances - request for a connection and every instance will get connected to one out of two instances and we will start sending messages. Client application will keep the connection unless it is kicked out by server being idle or something similar.If I now add two more instances behind that load balancer, will load balancer will kill existing connections so that 10 instances get connected to 4 instances instead of existing two? This is because clients are already connected and holding connections for more than one messages probably hours!If this is not possible what is design pattern to autoscale TCP load balancing?Thanks in Advance!FollowComment"

Answer: "1Hello,Classic Load Balancer (CLB) hold two separate connections, front-end (client <> CLB) and Backend (CLB <> server). CLB will not terminate connections unless they reach the idle timeout (Ie, no data has been sent on the connection for X seconds). In other words, CLB will not forcefully terminate established and active connections to rebalance them  because new backends has been addedWhen you add two more instances behind CLB, once they are registered and healthy, CLB will include these two new instances as part of its routing algorithm (round robin for TCP listener), for every new incoming connection, the request will land on any of the now 4 instances.Note that cross-zone will also impact how your requests are distributedYou can refer to https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.html for more detail.CommentShareAWS-Yecineanswered a year ago"


Question: Pre token generation lambda trigger is not working properly in .Net core.

"Hello Team,The pre-token generation lambda trigger for Cognito is not working properly for .net core, It is throwing this error:"error_description=Error+in+SAML+response+processing%3A+Invalid+version+in+Lambda+response.+Version+should+be+1+&error=server_error".Same event is working fine for node js but it is not working in .net core, here is the payload response which I'm returning from Pre-Token generation lambda trigger for .Net core after modifying the claims:{"request": {"groupConfiguration": {"groupsToOverride": ["us-east-1_P139c87yU_Okta"],"iamRolesToOverride": [],"preferredRole": null},"clientMetadata": null,"userAttributes": {"sub": "fb010969-9c01-4533-b12b-c09d454ee10f","identities": "[{\"userId\":\"piyush.joshi@gartner.com\",\"providerName\":\"Okta\",\"providerType\":\"SAML\",\"issuer\":\"https://urldefense.com/v3/__http://www.okta.com/exk3uaojhs7McUi195d75C5C22,5C5C22primary5C5C22:true,5C5C22dateCreated5C5C22:1644401968942*7D**A22__;JSUlJSUlJSUlJSUlJSUlJV0l!!NmrTbz2Y!j8OBTzi57qqJa6c8x7egkmYdRuvuglBU0LwQm17-u2m-pf-EOQrrffVrzMnxkxiy0pE$ ,"cognito:user_status": "EXTERNAL_PROVIDER","email_verified": "false","email": "piyush.joshi@gartner.com"}},"response": {"claimsOverrideDetails": {"claimsToAddOrOverride": null,"claimsToSuppress": null,"groupOverrideDetails": {"groupsToOverride": ["User","us-east-1_P139c87yU_Okta"],"iamRolesToOverride": [],"preferredRole": null}}},"version": "1","triggerSource": "TokenGeneration_HostedAuth","region": "us-east-1","userPoolId": "us-east-1_P139c87yU","userName": "Okta_piyush.joshi@gartner.com","callerContext": {"awsSdkVersion": "aws-sdk-unknown-unknown","clientId": "nbkmuarn0v3pph35s4cnsr7li"}}*FollowComment"

Answer: "0Hi,May I ask if this event is somehow truncated? It does not seem to be a valid JSON. I've used our internal JSON lint tool and there seems to be an issue with the formatting under "userAttributes"        "userAttributes": {            "sub": "fb010969-9c01-4533-b12b-c09d454ee10f",            "identities": "[{\"userId\":\"piyush.joshi@gartner.com\",\"providerName\":\"Okta\",\"providerType\":\"SAML\",\"issuer\":\"https://urldefense.com/v3/__http://www.okta.com/exk3uaojhs7McUi195d75C5C22,5C5C22primary5C5C22:true,5C5C22dateCreated5C5C22:16444019689427D**A22__;JSUlJSUlJSUlJSUlJSUlJV0l!!NmrTbz2Y!j8OBTzi57qqJa6c8x7egkmYdRuvuglBU0LwQm17-u2m-pf-EOQrrffVrzMnxkxiy0pE$ , "            cognito: user_status ": "Two things to note is that there is an opening brace in 'identities' but there is no closing. Also, the "issuer" key does not seem to have an escaped \". I just want to clarify this first if perhaps you have truncated this. If so, can you please provide the full event?If the object is working Node but not in .NET then this seems to imply that there is actually some sort of difference with the way the Node Lambda returns the response as opposed to the .NET Lambda. I would suggest checking how exactly you are returning this response in the .NET Lambda as it may be returning it differently than expected.I would also suggest doing an additional test by invoking both Lambda's via API Gateway. This is to confirm if the Lambda's are indeed returning the expected format back to the requester.CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago"


Question: Step functions pass input into Fargate instance :

"by looking at this AWS document: https://docs.aws.amazon.com/step-functions/latest/dg/sample-project-container-task-notification.htmlstep functions can totally instantiate/manage fargate or ECS Task.  Speaking about fargatethe example put fargate as first step.   suppose fargate is the 2nd step, can we get the output message from first step (larger than 8K) into fargate task through either .sync or .waitForTaskToken model?   Instead of passing input parameters through fargate containerOverride's command or commands?If above is possible, does the code inside fargate suppose to do something like :GetActivityTaskResult getActivityTaskResult =client.getActivityTask(new GetActivityTaskRequest().withActivityArn(stringActivityArn));  String taskToken = getActivityTaskResult.getTaskToken();  String taskInput = getActivityTaskResult.getInput();In this step function instantiate fargate model (.sync or .waitForTaskToken), does fargate instances gets created each time when step functions "calls" it?   That is, we actually would like to  set desire_count and min count both to zero and forget about scaling alarms or metrics.   If above is true, does it respect the max_count?  I guess cost-wise, it is fine with us because how many concurrent fargate running does not matter anymore.  Cost is based on usage.is ECS or fargate able to return output values to the calling step function?   that is, using sendSucess or some other api to send output back to step function for next step to use (become the input of next step)?FollowComment"

Answer: "0from this re:POST : https://repost.aws/questions/QUCWMj_HPIQi6nmpUrbS3UTQ/step-functions-lambda-and-ecsit seems like the only way to pass values into fargate is through command line or environment variable?   since we can use json path,  if the message is very large, then pass$Input through command line or environment counted as 6 bytes or the actually message size?When calling AWSStepFunctionsClient.sendTaskSucess(SendTaskSuccessRequest request).  does the message have size limit?CommentShareDavidYenanswered a year ago"


Question: WordPress + SMTP + SES + Gmail

"Hello AWS,I'm a noob so please go easy! :-)Multiple questions here.TL;DR Can I have WordPress and Emails via Gmail using EC2 and SES?I want to move all my websites from a VPS server I have (single point of failure) to AWS.The plan was for each website to have its own EC2/Lightsail instance. (independent points of failure).OK, so far I've spun up an EC2 instance and a Lightsail instance.I've installed Bitnami WordPress from the marketplace.https://aws.amazon.com/marketplace/pp/B00NN8Y43U?ref=cns_srchrowand changed external DNS, I can see my websites. All is good so far!Problem #1 - WordPress is not sending any emailsContact forms, password forms, registration forms etc, are not sending out any emails!I looked through the Bitnami WordPress installation and spotted the preinstalled plugin WP-Mail-SMTP.https://wordpress.org/plugins/wp-mail-smtp/I guess once I have SES working it will just a case of configuring this plugin to get WordPress working.Problem #2 - No Email ServerAfter reading the docs I appreciate SES is a gateway and not a Mail Server.So what's the missing piece?Lambda?WorkMail?Some Mail Server from the marketplace instead of SES? or as well as?Problem #3 - Configuring SES is awkwardStarted up SES.Verified the domain by adding DNS records.Verified an email address.I'm stuck here!!!Where did the verification email go?How do I verify? I've no email client at this point in time.This is confusing!!The AWS SES documentation is terse.UPDATE Some progress.Verified a Gmail account I own.Successfully sent a test email from info@mydomain.com to Gmail.Replied from Gmail and it failed. with a 550.This above part was really badly explained in every tutorial I watched.I assumed I was trying to verify info@mydomain.comThis needs to be made more clear in the SES documentation.OK, now I'm going to setup Receiving emails.Problem #4 - Gmail as an Email clientMost of my customers use Gmail.They have an existing someone@gmail.com accountAnd they just want to add their domain email info@somecompany.com as a secondary account.So they waste no time learning the nuances of a new Email Client.Is Gmail a compatible email client for use with SES?Possible Solutions?Install some sort of email server on every EC2 instance? Bloat???Spin up an extra separate EC2 instance that's a dedicated email server handling all emails for every EC2 WordPress server that I create? Is this possible?WorkMail seems to be too expensive. Initially cheap at just $4 pppm. The cost of WorkMail subtracts from the cheapness of EC2/Lightsail as you scale up the number of users.SES and Lambda solution? Will this allow expected functionality e.g. reply to, reply to all, forward, CC, BCC etc?I've watched multiple youtube videos and read many tutorials.I can't find a clear step-by-step guide on how to set this up (if it's even possible?)Surely I can't be the first person to encounter this scenario???Is AWS a good solution fit for a solo web developer like me?Any advice is welcomed.Thanks in advance.Edited by: LordLiverpool on Feb 2, 2019 9:56 AMFollowComment"

Answer: "0I found this on the web,Article Here:https://medium.com/@ashan.fernando/forwarding-emails-to-your-inbox-using-amazon-ses-2d261d60e417I don't know why the marvellous forum software is striking out my link????Image here:http://i1091.photobucket.com/albums/i395/LordLiverpool/Over%20Engineered_zpsanh3lhdy.pngHas anyone got a setup like this working?Edited by: LordLiverpool on Feb 5, 2019 8:18 AMCommentShareLordLiverpoolanswered 4 years ago0Hey, I was wondering that why there are no answers to your post? I also faced some issues with WordPress and SMTP settings a while ago. I friend wrote on how to integrate Amazon SES with WordPress in detail in a guide. Checkout his guide: https://reviewsnguides.com/wp-mail-smtp-plugin/CommentSharekevinsnowanswered 3 years ago"