Question: Limit access to CloudWatch Logs Insights query results

"Hey guys,I created an IAM Identity Center permission set and group. The permission set attached to the group only allows the users inside the group to view CloudWatch logs generated by a specific account (our Crypto account), the statement looks like this:Note: The statement with the ID "DescribeCryptoTrail" limits the user to only view logs from our Crypto account."Statement":{         "Sid": "DescribeCryptoTrail",          "Action": "logs:GetLogEvents",          "Effect": "Allow",          "Resource": [                 "arn:aws:logs:eu-west-1:ACCOUNT-ID:log-group:aws-controltower/CloudTrailLogs:log-stream:ORG-ID_CRYPTO-ACCOUNT-ID_CloudTrail_eu-west-*"    ]} This works well since the user gets a permission denied error when he tries to view logs from a different account, but now my concern is how do I limit access to the queries the users can return in CloudWatch Logs Insights? For example, the users in the Crypto-Access group should only be able to return queries that were generated by the Crypto account.So far, I have tried using statements such as:{"Sid": "AdditionalPermissions",                 "Action":          [                         "logs:FilterLogEvents"         ],                 "Effect": "Allow",                 "Resource":         [             "arn:aws:logs:eu-west-1:ACCOUNT-ID:log-group:aws-controltower/CloudTrailLogs:log-stream:ORG-ID_CRYPTO-ACCOUNT-ID_CloudTrail_eu-west-*"                 ]     },     {         "Sid": "AdditionalPermissionsTwo",                 "Action":          [                        "logs:DescribeQueryDefinitions"                  ],                  "Effect": "Allow",                  "Resource":          [             "arn:aws:logs:eu-west-1:ACCOUNT-ID:log-group:aws-controltower/CloudTrailLogs:log-stream:ORG-ID_CRYPTO-ACCOUNT-ID_CloudTrail_eu-west-*"                  ]     }This is a similar approach as to what worked for granting access to the CloudWatch logs, but this time it seems I need to grant access to the entire log group judging from the error:not authorized to perform: logs:FilterLogEvents on resource: arn:aws:logs:eu-west-1:ACCOUNT-ID:log-group:aws-controltower/CloudTrailLogs:log-stream:* because no identity-based policy allows the logs:FilterLogEvents actionThis indicates that I need to provide access to the main log group, I can't limit it to a specific path in the log group.Is there any other way I can force query results based on the IAM policy, or maybe a way I can require a user to include a filter in the query such as filter recipientAccountId = "CRYPTO-ACCOUNT-ID"Thanks in advanceFollowComment"

Answer: "0Hello,As per the AWS Doc on Actions, resources, and condition keys for Amazon CloudWatch Logs, the APIs - FilterLogEvents only supports log-group* Resource types.Note - log-group resource ARN -> arn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}However, as evident from the policy above, you are trying to restrict FilterLogEvents API with a log stream resource type instead ->  arn:aws:logs:eu-west-1:ACCOUNT-ID:log-group:aws-controltower/CloudTrailLogs:log-stream:ORG-ID_CRYPTO-ACCOUNT-ID_CloudTrail_eu-west-*.Note - log-stream resource ARN -> arn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}:log-stream:${LogStreamName}Additionally note that the "Run Query" button calls "FilterLogEvents" action in the back end. Hence, you can only restrict it to a specific log group.Similarly, DescribeQueryDefinitions API currently doesn't support any Resource ARN restriction as evident from above AWS Doc as well. Remember if there is no value for this column (Resource types), you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. Hence, you can't restrict it with a log group or log stream resource type. It's basically an all or nothing List API operation which you can't restrict at the given time.*Also, please note that these two IAM actions/Cloudwatch Logs APIs currently do not support any condition keys either.CommentShareSUPPORT ENGINEERYash_Canswered 4 months ago"


Question: Custom IAM  policy

"Hi Community,assume we have the following policy for an IAM user{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "iam:GetUser",                "iam:CreateUser",                "iam:CreateAccessKey"            ],            "Resource": "arn:aws:iam::*:user/iot.*"        },        {            "Sid": "VisualEditor1",            "Effect": "Allow",            "Action": "iam:AddUserToGroup",            "Resource": "arn:aws:iam::*:group/CUSTOMGROUP"        }    ]}He should now be able to perform GetUser, CreateUser and CreateAccessKey for all IAM users starting with iot.Second rule should allow him to add IAM user to the Group CUSTOMGROUPEverything works fine, but I want that the user is only allowed to add other IAM users starting with iot. to the group CUSTOMGROUPHow can this be achieved? I was thinking about adding something like"Condition": {"StringLike": {"iam:user": ["iot.*"]}}This does not work... any idea if this is possible at all?FollowComment"

Answer: "2Accepted AnswerHello,The action "AddUserToGroup" does not support any condition key. Hence, it is possible to restrict this action on specific username.Our IAM user guide has a comprehensive listing of each service, and the Access Level required, Resource Types allowed, and Condition Keys that can be used with their actions [1].However that there is an existing feature request in place for this. As is the case with all feature requests, the internal team takes them seriously and evaluates every request, but we are unable to share any rough ETA for delivering this feature as inclusion of any new feature needs rigorous testing and shall be prioritized along with the team's additional workload. However, any new announcements will be made in our What's New page What's New page [https://aws.amazon.com/new/] and our Official Blog [https://aws.amazon.com/blogs/aws/].[1]https://docs.aws.amazon.com/service-authorization/latest/reference/list_identityandaccessmanagement.htmlCommentShareSUPPORT ENGINEERAWS-User-6158549answered 7 months agohrc 7 months agoexcellent and fast feedback, thank you.Share"


Question: Can't access site on ec2 instance via public IPV4 address (Using Amazon Linux)

"Hi All,I'm not able to figure out what steps needs to be done in order to access the webbrowser through IPV4 address.Showing this site can't be reached please help me , I'm new to AWS.what I have done:-I have set the inbound rules HTTP (80) and SSH(22)Thanks in advance!!!FollowComment"

Answer: "1There are multiple things that will need to be checked, please refer to this in depth troubleshooting guide.To summarize, check the following:Check that the instance is running and passing both health checksCheck that the instance OS is booting correctly and the webserver is runningCheck both Network ACL and Security Group rulesCheck the instance has the correct DNS configurationCommentShareNickanswered a year ago0Hi, @Vaibhav VermaIn addition to Nick's confirmation pointsIs EC2 given a public IP address?Is an internet gateway attached to your VPC?Is the route to the Internet gateway set at 0.0.0.0/0 in the route table of the subnet where EC2 is deployed?CommentShareEXPERTiwasaanswered a year ago"


Question: Is Cognito authorizor not valid to safely control one time use API gateway access?

"Months ago I went through this documentation  and built a cognito pool with four lambda triggers that control signing in from a website.This mechanism adds the user cognito if they do not already exist in the pool and then authorizes them and get a jwt token from cognito which controls access to API gateway APIs.The problem is that when I use this setup, the JWT takes 5 MINUTES at the minimum to expire and there doesnt seem to be any valid way to expire that token before that time frame.If this is indeed true, I effectively cannot rely on Cognito for senstiive APIs where I must make sure a user can only use it once with the credentials they are given.For instance, maybe I have an order creation API. In my testing, a user can grab the token from F12's network response and make thousands of fake orders using postman before the 5 minute expiration time expires after authorizing.I have seen documentation about token revocation, and found two api endpoints involved with cancelling tokens but even after using them this 'feature' of being able to reuse the token as much as you want still exists until the 5 minute timeout is over.To contrast, with OAuth, it looks as through the token can be set to be short lived and expire 10 seconds after issuance. I could give the user a 10-20 second valid window and this would probably cover me as it would take most of that time to break into F12 and get the JWT in the first place.Am I maybe using this wrong and is there a way that the cognito token doesnt provide wide open access beyond its initial use?  I'd prefer to use Cognito but I think unless I can get around this I have to look at other options.Thanks!FollowComment"

Answer: "0You can reduce the token expiration time of your Cognito user pool in the App client settings under Token Configuration. The minimum value is 1 minute, so if you need a shorter time, you'll need to use another authorization service. Additionally, you can revoke a user's access token at any time by using the AdminInitiateAuth API action with the "REVOKE_ACCESS" token challenge. This would prevent the token from being used for further API requests until the user logs in again and receives a new token.CommentShareDivyam Chauhananswered 4 months ago0No, AWS Cognito authorizer alone is not enough to ensure safe control of one-time use access to an API Gateway. Additional measures such as time-based policies or unique tokens would need to be implemented to prevent replay attacks and ensure the secure usage of the API.CommentShareMuhammad Imrananswered 4 months ago"


Question: Is there anyway of testing route53 domain registration through API/SDK

"Hey, is there anyway of testing the process of registration route53 domain through API/SDK within an Sandbox/Test Enviroment without actually buying these domains.FollowCommentliebezeit 4 months agoYeah no kidding. How the heck does AWS expect us to develop an domain-reg app with no sandbox or at least a "fake-response" option for domain registration calls?I'll bet the number of API calls to RegisterDomain is close to zero!Share"


Question: "Fluent Bit Logs, Kinesis vs OpenSearch (ElasticSearch) Directly"

"I have Fargate Service with FireLens and Fluent Bit.I want to send logs to OpenSearch (or ElasticSearch). Two good options:Firelens / FluentBit -> kinesis plugin with compression and aggregation -> Kinesis Data Stream -> Kinesis Firehose with Lambda that decompresses and parses logs -> OpenSearch (or ElasticSearch).Firelens / FluentBit -> es plugin -> Open Search (or ElasticSearch).First version saves bandwidth over the network and custom log parsing can be done.But if no custom log parsing is needed, how can I measure that the second solution is better?Is it better by the way?FollowComment"

Answer: "0While either option could work. Its typically better to air on the side caution and store the logs. You can always have the logs for later use with other services, audits, observability (across your entire stack). To that end, you can use the Kinesis solution for log preservation/parsing, but it also adds more moving parts to your solution. What i would do isFirelens/Fluent Bit -> CloudWatch -> OpenSearch (or ES)This gives you the best of both benefits of the solutions you highlighted. Unless there is another reason for Kenisis, i.e. real time analytics for example, this simplifies the pipeline considerably.Here are some resources to get you startedFirelens/Fluent Bit -> CloudWatch https://aws.amazon.com/blogs/containers/fluent-bit-integration-in-cloudwatch-container-insights-for-eks/CloudWatch -> OpenSearch https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_OpenSearch_Stream.html.CommentShareinvaderZYManswered a year agoLaszlo a year agoI have CloudWatch parallel or next to the others like this:Firelens / FluentBit:Cloudwatch pluginkinesis plugines pluginShareinvaderZYM a year agoYou only have to have the cloudwatch agent so no need for Kenisis (unless you need it for other reasons besides logging). Firelens/Fluent Bit willl rout and log and the CloudWatch agent will aggregate the logs for you in cloudwatch. Then you simply push the AWS Logs into OpenSearch. In the case I'm highlighting you will not need neither Kinesis plugin or ES plugin.ShareLaszlo a year agoI appreciate your desire for simplicity. And for a Lambda, who has no FireLens next to it your solution will be the winning one. Just wanted to know a more scientific reason too. Nevertheless I will try to find some more advantage to it and post the answer here as soon as I find it.Share"


Question: Unable to send calls to campaign using CLI

"HiI am trying to invoke outbound campaigns using the StartOutboundVoiceContact CLI/API without pinpoint.aws connect start-outbound-voice-contact --destination-phone-number +1xxx --contact-flow-id xxx  --instance-id xx --source-phone-number +1xxx --campaign-id xxxx  --traffic-type CAMPAIGN --answer-machine-detection-config EnableAnswerMachineDetection=true,AwaitAnswerMachinePrompt=trueBut the calls do not follow the campaign logic. I have set it check if 100% agents are available in queue before dialing out.  Both for predictive and progressive mode.As soon as I hit the CLI calls are dialing out to the destination number even if there are 0 agents logged into the queue.It looks like the CLI / API does not follow the campaign but simply put the calls into the contact as normal calls even hough I have specified the traffic type as CAMPAIGN.Any idea what is wrong ?FollowComment"

Answer: "0when you are using the CLI to make the outbound call, even with CAMPAIGN ID specified, it is ignored.  So the call is made right away with AMD enabled.  The only way that pacing taken into account is when you use this with AWAS Pinpoint.  AWS Pinpoint is checking the strategy in your campaign before request Connect to make the call.The logic in this is to use this API to make self-service outbound with AMD without any agent dependencies.CommentShareClarenceChoianswered 3 months agoAbilash 3 months agoThat makes completely no sense. Why would AWS create an API and mention an API attribute, release it and completely ignore it.This then forces me to use pinpoint to use as a dialer instead of creating my own dialer.What other solution do I have to use HVCO via API and not use pinpoint.Share"


Question: S3 access over VPN

"From on-premises, if a customer wants to access S3 through their Storage Gateway over a VPN connection bypassing the S3 public endpoint, is the only option to setup a proxy server fleet on EC2 and use the S3 endpoint in the VPC? I'm looking for alternate, simpler approaches if there are any.FollowComment"

Answer: "0Accepted AnswerGateway endpoints (S3, DynamoDB) cannot be extended outside of a VPC (https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html#vpc-endpoints-limitations ).We used to publish a design pattern that talks about using an ASG fleet of proxy servers inside the VPC to provide this connectivity, however the blog post has been removed, and the only link I can find is this one: https://d0.awsstatic.com/aws-answers/Accessing_VPC_Endpoints_from_Remote_Networks.pdfThe design pattern works and is used by lots of customers, but obviously has additional service / management costs to consider.CommentShareEXPERTBrettski-AWSanswered 4 years ago"


Question: Debian-11 build process has lost its ethernet interfaces

"We are using Yocto build-system (kirkstone) to compile images for i.MX8 based development board and we are trying to move the build process to AWS EC2 based environment for CI integration. We are currently using  Debian (AMI: debian-11-amd64-20220503-998, type: t3.2xlarge) EC2 image from AWS marketplace.We have configured the EC2 machine with one external interface that binds to public IP and the machine is able to communicate with the outside world. This is the output of the ip addr from the login shelladmin@ip-XXX-XXX-XXX-XXX:~$ ip a show1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo       valid_lft forever preferred_lft forever    inet6 ::1/128 scope host       valid_lft forever preferred_lft forever2: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000    link/ether XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff    altname enp0s5    inet XXX-XXX-XXX-XXX/20 brd XXX.XXX.XXX.XXX scope global dynamic ens5       valid_lft 2992sec preferred_lft 2992sec    inet6 XXXX::XXXX:XXXX:XXXX:XXXX/64 scope link       valid_lft forever preferred_lft foreverBut, after we try to compile our Yocto project we get several build errors due to fetch failing as some of our recipes fail to fetch sources from outside world.If I launch a development shell with bitbake -c devshell my-app it will no longer see the ethernet devices but only the local interface which is in down state and has no IP attached to itadmin@ip-XXX-XXX-XXX-XXX:~/yocto/build/tmp/work/x86_64-linux/my-app/1.0.0-r0/my-app-1.0.0$ ip a show1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000    link/loopback 00:00:00:00:00:00 brd 00:00:200:00:00:00and I can also see that resolving outside connections no longer workadmin@ip-XXX-XXX-XXX-XXX:~/yocto/build/tmp/work/x86_64-linux/my-app/1.0.0-r0/my-app-1.0.0$ traceroute6 www.google.comwww.google.com: Temporary failure in name resolutionCannot handle "host" cmdline arg `www.google.com' on position 1 (argc 1)This is the output from process treeadmin@ip-XXX-XXX-XXX-XXX:~/yocto/build/tmp/work/x86_64-linux/my-app/1.0.0-r0/my-app-1.0.0$  ps f    PID TTY      STAT   TIME COMMAND    943 pts/1    Ss     0:00 /bin/bash    994 pts/1    R+     0:00  \_ ps f    758 pts/0    Ss     0:00 -bash    830 pts/0    Sl+    0:01  \_ python3 /home/admin/yocto/sources/poky/bitbake/bin/bitbake my-app -c devshell    941 pts/0    S+     0:00      \_ sh -c screen -r devshell_939    942 pts/0    S+     0:00          \_ screen -r devshell_939Another thing that seems off is that the build process has somehow lost all its groups and there is a group nogroup addedadmin@ip-XXX-XXX-XXX-XXX:~/yocto/build/tmp/work/x86_64-linux/my-app/1.0.0-r0/my-app-1.0.0$ groupsadmin nogroupWhen running the groups from the login shell the user has admin adm dialout cdrom floppy sudo audio dip video plugdev netdev that seem to be lost when launching the development shell.We are using the build system in multiple local development environments (based on Debian-11) and the build system is able to connect to outside world just fine so this relates to the AWS EC2 Debian image that we are using.Why are the interfaces not displayed and how can we work-around this issue so that the build process can access the source repositories from the build environment?FollowComment"


Question: Register domain error TLDRulesViolation

"I'm trying to register a domain. all form compiled correctly (State: Veneto) but when i click Register domain an error occours:ErrorAction:RegisterDomainCommandRegion:us-east-1Status code:TLDRulesViolationError message:[ADMIN.STATE not allowed, expected one of the following: AG, AL, AN, AO, AP, AQ, AR, AT, AV, BA, BG, BI, BL, BN, BO, BR, BS, BT, BZ, CA, CB, CE, CH, CI, CL, CN, CO, CR, CS, CT, CZ, EN, FC, FE, FG, FI, FR, GE, GO, GR, IM, IS, KR, LC, LE, LI, LO, LT, LU, MB, MC, ME, MI, MN, MO, MS, MT, NA, NO, NU, OG, OR, OT, PA, PC, PD, PE, PG, PI, PN, PO, PR, PT, PU, PV, PZ, RA, RC, RE, RG, RI, RM, RN, RO, RSM, SA, SI, SO, SP, SR, SS, SV, TA, TE, TN, TO, TP, TR, TS, TV, UD, VA, VB, VC, VE, VI, VR, VS, VT, VV, OWNER.STATE not allowed, expected one of the following: AG, AL, AN, AO, AP, AQ, AR, AT, AV, BA, BG, BI, BL, BN, BO, BR, BS, BT, BZ, CA, CB, CE, CH, CI, CL, CN, CO, CR, CS, CT, CZ, EN, FC, FE, FG, FI, FR, GE, GO, GR, IM, IS, KR, LC, LE, LI, LO, LT, LU, MB, MC, ME, MI, MN, MO, MS, MT, NA, NO, NU, OG, OR, OT, PA, PC, PD, PE, PG, PI, PN, PO, PR, PT, PU, PV, PZ, RA, RC, RE, RG, RI, RM, RN, RO, RSM, SA, SI, SO, SP, SR, SS, SV, TA, TE, TN, TO, TP, TR, TS, TV, UD, VA, VB, VC, VE, VI, VR, VS, VT, VV, TECH.STATE not allowed, expected one of the following: AG, AL, AN, AO, AP, AQ, AR, AT, AV, BA, BG, BI, BL, BN, BO, BR, BS, BT, BZ, CA, CB, CE, CH, CI, CL, CN, CO, CR, CS, CT, CZ, EN, FC, FE, FG, FI, FR, GE, GO, GR, IM, IS, KR, LC, LE, LI, LO, LT, LU, MB, MC, ME, MI, MN, MO, MS, MT, NA, NO, NU, OG, OR, OT, PA, PC, PD, PE, PG, PI, PN, PO, PR, PT, PU, PV, PZ, RA, RC, RE, RG, RI, RM, RN, RO, RSM, SA, SI, SO, SP, SR, SS, SV, TA, TE, TN, TO, TP, TR, TS, TV, UD, VA, VB, VC, VE, VI, VR, VS, VT, VV, BILL.STATE not allowed, expected one of the following: AG, AL, AN, AO, AP, AQ, AR, AT, AV, BA, BG, BI, BL, BN, BO, BR, BS, BT, BZ, CA, CB, CE, CH, CI, CL, CN, CO, CR, CS, CT, CZ, EN, FC, FE, FG, FI, FR, GE, GO, GR, IM, IS, KR, LC, LE, LI, LO, LT, LU, MB, MC, ME, MI, MN, MO, MS, MT, NA, NO, NU, OG, OR, OT, PA, PC, PD, PE, PG, PI, PN, PO, PR, PT, PU, PV, PZ, RA, RC, RE, RG, RI, RM, RN, RO, RSM, SA, SI, SO, SP, SR, SS, SV, TA, TE, TN, TO, TP, TR, TS, TV, UD, VA, VB, VC, VE, VI, VR, VS, VT, VV]FollowComment"

Answer: 0This link provides a list of all the Route 53 supported TLDs.  I am not clear what TLD you were trying to register but check and verify it is in the list.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar-tld-list.htmlHope this helps you!CommentShareEXPERTiBehranswered 25 days ago


Question: How to know how many times the file was downloaded and how many times it was downloaded successfully

"Hello, I want to know how many times my file from s3 was downloaded successfully, i.e. there was no interruption in download process and client downloaded full size fileFollowComment"

Answer: "0Hello,I'm Mike with the Storage Gateway service.  Do you have a Storage Gateway virtual or physical appliance deployed to access S3?  If you don't, then you'll want to retag your question with "S3" or "Simple Storage Service" to get the correct eyes on the problem.Storage Gateway has the ability for the user to turn on auditing to get Windows style logs of users accessing data through a gateway.  If you are accessing S3 directly, then I defer to an S3 expert to answer your question.BTW, even if you have a SGW, you can still turn on whatever S3 logging/tracking you wish for an additional layer of information.  SGW is completely compatible with S3 monitoring tools.Mike H.SGW SMECommentShareMike-HAWSanswered a year ago"


Question: javascript v3 sdk s3.GetObjectCommand download stream

"In the new v3 javascript sdk, how does streaming download of an s3 object work?  I used to use getObject(params).createReadStream().pipe(out),  but createReadStream is not defined here:s3.send(new GetObjectCommand(params)).createReadStream();FollowComment"

Answer: "0This answers it:https://github.com/aws/aws-sdk-js-v3/issues/1096the returned property, Body, is a streamable, so response.Body.pipe(createWriteStream(fileName));CommentSharemcobb-pryonanswered 2 years ago"


Question: [EC2.21] Security Hub finding issue

"Hello,I am working on improving security compliance in my project and recently I've come across security finding related to network ACL:[EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389. I've updated my ACLs in the following manner:Rule NumberTypeProtocolPort RangeSourceAllow/Deny10SSH(22)TCP(6)220.0.0.0/0Deny11SSH(22)TCP(6)22::/0Deny20RDP(3389)TCP(6)33890.0.0.0/0Deny21RDP(3389)TCP(6)3389::/0Deny100All trafficAllAll0.0.0.0/0Allow*All trafficAllAll0.0.0.0/0DenyAccording to ACL evaluation rules ports 22 and 3389 are blocked, but check still fails. I suppose that it looks only for record that allows for all traffic and ignores the order of the rules. In my opinion the current rule validation is wrong. What are your thoughts on this?FollowComment"

Answer: "0Hello,NACL is attached to proper subnet and I have no doubts that NACL itself works that way. My issue is that despite the configuration described above, the one you've confirmed that should "do the job" my Security Hub check EC2.21 that validates this setup (blocking ports 22 and 3389) fails.CommentSharem4t22answered a year ago-1Greetings from AWS..!!So as per your configurations for ingress rules in Network ACL, the rule evaluation order should be as below.10 - will deny IPv4 traffic for TCP Port 22 from any source IP - if matches will not check next rule else will check next rule until last rule.11 - will deny IPv6 traffic for TCP Port 22 from any source IP21 - will deny IPv4 traffic for TCP Port 3389 from any source IP22 - will deny IPv6 traffic for TCP Port 3389 from any source IP100 - Any other traffic will be allowed other than that is not matching the above rules.However, you mentioned that it does not evaluate that way, meaning the traffic sourced from any IP address destined to tcp port 22 and 3389 is getting passed. For that I would recommend below steps to be checked.Is the Network ACL to which the inbound rules are configured is associated to the subnet of the resource or not.?If the Association is correct, please refer the VPC Flow Logs [1] and check if the traffic is being ACCEPT or REJECT for the interesting traffic. With this rules, any traffic destined for the resource in the subnet associated with this Network ACL, you should be seeing REJECT for DENY rules.However, if you still see the traffic passing, I would request you to open a case with Technical Support Team to further troubleshoot this. As ideally this should not be the case."A network ACL contains a numbered list of rules. We evaluate the rules in order, starting with the lowest numbered rule, to determine whether traffic is allowed in or out of any subnet associated with the network ACL."Reference:[1] Logging IP traffic using VPC Flow Logs - https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.htmlCommentSharerePost-User-1196895answered a year ago"


Question: "Glue to Snowflake connector, is it mandatory?"

"I’m reading a blog posted last year around moving data from Snowflake to S3,    I shared the link with customer who need to move data between Snowflake and S3.https://aws.amazon.com/blogs/big-data/performing-data-transformations-using-snowflake-and-aws-glue/Now customer comes back saying they need spin up EKS/ECS containers and because the instruction mentioned marketplace and they’ve tried to use the official connector from marketplace called “Snowflake Connector for AWS Glue”.Because I don’t have Snowflake environment, so I’m not sure if the marketplace snowflake connector is mandatory ?My understanding is it doesn’t, as the blog sounds quite clear to load the JDBC jar to access Snowflake. But it’s still quite confusing for me.  If it doesn’t, why we release that connector on marketplace?If there are 2 approaches to do so (one using custom connector, one using marketplace connector), what's the difference between them? (performance, scalability, support)FollowComment"

Answer: "1Accepted AnswerHi,The “Snowflake Connector for AWS Glue” is delivered as a container and as such the MarketPlace page shows that the supported services are ECS and EKS, BUT there is no need for the customer to spin an ECS/EKS cluster at all.As describe in the Glue documentation on how to subscribe to a marketplace connector once you have subscribed to the Snowflake Connector you will be asked to configure and then llaunch it. At that point you will be brought back to Glue Studio where you will be asked to create the connection for the connector.As you notice in this flow there are no steps in which an ECS/EKS cluster will be deployed.To understand the difference between a Spark and a JDBC connector please refer to this blog posthope this helpsCommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Unable to Ingest the Data into S3 Bucket through Pentaho ETL

"Actually we are facing a PIPE Closed Error while we ingesting the data into S3 bucket through Pentaho ETL. This Particular error is facing while we running multiple flows in parallel of same type in same time.Adding to it, the data size is not more than 500 MB.FollowComment"


Question: Unable to perform actions with AWS Timestream (Endpoint Discovery failed)

"I unable to perform any actions with Timestream (us-west-2), including querying/ingesting data into tables, listing tables, and creating new databases.  All of them give me "Endpoint discovery failed to refresh the required endpoints" error.  I have tried performing these commands through Python's boto3 and through AWS CLI.  I have tried using an IAM user with admin permissions and a role with all Timestream permissions.  Everything gives me the same error.  I am able to perform all these actions in the console.FollowCommentrePost-User-0418440 a year agoHi there,Which boto3 and botocore are you using? Can you try to upgrade them to the latest version? Also Is it possible to post a code snapshot of your Python code and AWS CLI?SharerePost-User-2337808 a year agoI am using v1.24.19 for boto3 and v1.27.19 botocore.  I tried upgrading them to the latest version (v1.24.21 and v1.27.21) but I get the same error.Below is my client creation code.  I have used the same code to assume a different role with a different profile for S3 before and it worked fine.session = boto3.Session()roleClient = session.client('sts')assumedRole = roleClient.assume_role(RoleArn=roleARN, RoleSessionName='role')credentials = assumedRole['Credentials']awsKey = credentials['AccessKeyId']awsSecretKey = credentials['SecretAccessKey']awsSessionToken = credentials['SessionToken']client = boto3.client('timestream-write',aws_access_key_id=awsKey,aws_secret_access_key=awsSecretKey,aws_session_token=awsSessionToken,)For writing it's just the one line of code for testing:result = self.client.write_records(DatabaseName=self.database, TableName=self.table, Records=records, CommonAttributes={})I tried setting the database and table names to empty strings and it gives the same error so it's failing before it gets to check those variables.  For the AWS CLI, I used the example from the docs:aws timestream-write create-database --database-name myFirstDatabaseShare"

Answer: "1Accepted AnswerMaybe it's looking for the Timestream endpoint in the wrong region by default. Try passing region_name=us-west-2 in the config parameter when creating a client--SydCommentShareSydanswered a year agorePost-User-2337808 a year agoWorking fine now that I added the region_name to the config in client creation, thanks!Share"


Question: Cannot Get Error from getObject API to download/get an object(audio file) from S3

"My call recordings of amazon connect are being stored on S3 in .wav file, i am looking to get and play those recordings in a third party application. For this i am using getObject API & trying to get/download the .wav files by name but i am getting the Cannot Get Error.At the same time i do want to provide the path in key e.g. Connect/Lab/2022/04/08/abc.wav, is it possible?How to resolve it? here is my code:require("dotenv").config();const expres = require("express");const app = expres();app.listen(3001);const aws = require("aws-sdk");aws.config.update({    secretAccessKey: process.env.ACCESS_SECRET,    accessKeyId: process.env.ACCESS_KEY,    region: process.env.REGION})const BUCKET = process.env.BUCKETconst Key = '/connect/oblab2/CallRecordings/2022/04/08/'const s3 = new aws.S3(secretAccessKey = process.env.ACCESS_SECRET, accessKeyId = process.env.ACCESS_KEY); app.get("/download/filename", async(req, res)=>{    const filename = req.params.filename    let x = await s3.getObject({Bucket:BUCKET, Key:Key + filename}).promise();    res.send(x.Body);})FollowComment"

Answer: "1Accepted AnswerAchieved it through:require("dotenv").config();const aws = require('aws-sdk');const expres = require("express");const app = expres();app.listen(3001);app.get('/getfilefromS3', async (req, res, next) => {  aws.config.update({    secretAccessKey: process.env.ACCESS_SECRET,    accessKeyId: process.env.ACCESS_KEY,    region: process.env.REGION  })  const s3 = new aws.S3(secretAccessKey = process.env.ACCESS_SECRET, accessKeyId = process.env.ACCESS_KEY);  var params = { Bucket: process.env.BUCKET, Key: "connect/oblab2/CallRecordings/2022/04/08/" + req.query.filename };  s3.getObject(params, function (err, data) {    if (err) {      res.status(200);      res.end('Error Fetching File');    }    else {      res.attachment(params.Key); // Set Filename      res.type(data.ContentType); // Set FileType      res.send(data.Body);        // Send File Buffer    }  });})```And than hitting endpoint:http://localhost:3001/getfilefromS3?filename=filename.wavCommentShareAbdul Qayyumanswered a year ago"


Question: AWS Workspace Image and bundle creation - original workspace question

"Dumb Question: Once you create an image and a bundle from a workspace, can you safely delete that original workspace without affecting the image and bundle you created?FollowComment"

Answer: "4Accepted AnswerHi dbryan.  Yes you can delete the original WorkSpace once the image is created.CommentShareRobert_Fanswered a year ago0Just as correctly answered by Robert above you can delete the WorkSpace.However, I would strongly recommend you do not delete the original WorkSpace until you confirm that you can launch a new WorkSpaces from the Image successfully without any issues hence, you can move forward with the deletion of the of the original WorkSpaceCommentShareChibuike_Aanswered a year agorePost-User-dbryan a year agoWelp, too late now, its gone =) Will find out !Share"


Question: Mounting EFS in codebuild fails with "Error retrieving region"

"Hello,I have a buildspec that mounts an EFS drive. I get the following error:[Container] 2019/12/17 05:03:23 Running command mount -t efs fs-11112222.efs.ap-south-1.amazonaws.com:/ /efs Error retrieving region I have changed the efs name in above code for this post.I have followed documentation here: https://docs.aws.amazon.com/codebuild/latest/userguide/sample-efs.html#sample-efs-create-acbNote that the documentation is asking to use amazon linux image in codebuild, but, uses apt-get in buildspec. That fails. I changed it to the amazonlinux equivalent yum commands.I have ensured that the codebuild has "PrivilegedMode" True.I am able to mount the EFS drive from an EC2 instance that is in the same subnet as the codebuild config.If I remove the EFS mounting instructions in buildspec, my build runs fine... Meaning, network and internet access looks fine.Please help!Best,SachinEdited by: sdole on Dec 17, 2019 5:51 AMFollowComment"

Answer: "0I found this code in efs_utils. It seems like this code is looking for instance metadata service on codebuild. Maybe it cannot find that in docker?https://github.com/aws/efs-utils/blob/master/src/mount_efs/init.py#L130CommentSharesdoleanswered 3 years ago0I found 2 problems and changed code to work around those problems.in ap-south-1, codebuild does not support ap-south-1c AZ, hence one of my mount points was probably not good for Codebuild.efs-utils codebase makes an instance metadata lookup for finding current region. Not sure whether or not Codebuild supports instance metadata lookup.To work around: I deleted the EFS mountpoint in ap-south-1c that codebuild does not support and switched to nfs-utils instead of efs-utils.Now, my setup works.I am disappointed about the snowflakish variation that ap-south-1c is not supported. How will I account for that in my automation? I will need to code in such one off exclusions. No?I opened a bug on efs-utils for them to fix the instance metadata lookup.https://github.com/aws/efs-utils/issues/37CommentSharesdoleanswered 3 years ago0Of the two changes you made, it's likely #2 is the only one that made a difference. When you mount an EFS file system via DNS, Route53 will return the IP address for the mount target in the same AZ as the client. If there is no mount target in the local AZ the mount will fail in order to avoid cross-az network charges. However, there is no problem with mount targets in extra AZs, they will simply be ignored by your client.The EFS mount helper forms the DNS name using the file system id and local region, with the latter looked up in EC2 instance metadata. Since your codebuild instance is running inside a container, and the metadata URL is different than with traditional EC2, this call is failing. As a workaround, you can edit the EFS mount helper configuration file (/etc/amazon/efs/efs-utils.conf) and hardcode region in the line that defines DNS name format:dns_name_format = {fs_id}.efs.{region}.amazonaws.comOne reason you may decide to try this rather than using nfs-utils is if you want to take advantage of TLS encryption, IAM authorization, or EFS Access Points.CommentShareAWS-User-4040733answered 3 years ago"


Question: "When I restart instance, SSM is connected. but after a few minute, SSM isn't connected.(Target Not Connected)"

"When I restart instance, SSM is connected. but after a few minute, SSM is connected.(Target Not Connected)How can I debug and solve this problem?FollowComment"

Answer: "0Please refer to the troubleshooting steps listed here for TargetNotConnectedhttps://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-troubleshooting.html#ssh-target-not-connectedCommentShareEXPERTAWS-User-Nitinanswered 8 months ago0Could you please check if SSM agent is installed. I am not sure which OS you are using. Please also make sure you are using AWS CLI v2.Hence here is the link that might help https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html -- [1]Check if all the steps are performed and also if the SSM installed on the instance is not out of date. You can discover this by trying to start the session from Systems Manager in the AWS console; basically going to Systems Manager->Fleet Manager->{INSTANCE_ID}->Instance Actions->Start SessionIt will throw an error if it is out of date.https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.html -- [2]As mentioned in the link below, this error is also returned if you attempt to start a session on a managed node that is located in a different AWS account or AWS Region.https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-troubleshooting.html#ssh-target-not-connected  [3]Once you verify the same, please check if the instances have the proper outbound connectivity? (Outbound to some AWS services including ec2messages.region.amazonaws.com, ssm.region.amazonaws.com, ssmmessages.region.amazonaws.comCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 8 months ago"


Question: Storage Gatweay (file) for migration?

"I have around 20TB of data that I need to migrate to AWS over the next couple of weeks, and I know that Snowball will make this a breeze. However, I've been considering other options since I have a 1Gb internet circuit + time and I'm thinking about leveraging the Storage Gateway in File Mode. I launched an appliance on my VMware network and was able to get everything working. However, if I understand this service correctly, it copies the data to the "Cache" disk.From the docs:The cache storage acts as the on-premises durable store for data that is pending upload to Amazon S3 from the upload buffer. When your application performs I/O on a volume or tape, the gateway saves the data to the cache storage for low-latency access. When your application requests data from a volume or tape, the gateway first checks the cache storage for the data before downloading the data from AWS.So let's say I want to move data in 5TB batches, I believe I would need a 5TB Cache volume? Is that accurate? So the process would be copy 5TB of data to the appliance, when in turn sends that data to S3. Wouldn't it just be quicker to run a tool like Cloudberry and just send the data right to the S3 bucket? Seems like the process is operations intensive, one job to copy the data and the other job to send to AWS. Just curious to see other folks experience with using Storage Gateway in this manner. Also, we don't have direct connect, so that's off the table.FollowComment"

Answer: "0Looks like I'm gonna roll with Datasync, and will use File Gateway to access any needed files.CommentShareOvidio B.answered 3 years ago0Ovidio B. wrote:Looks like I'm gonna roll with Datasync, and will use File Gateway to access any needed files.That's what we recommend as well. POSIX (NFS) metadata is preserved when you copy over the files using DataSync, so when your NFS clients access the migrated files via File Gateway, original ownership and permissions on the files are presented to them.CommentShareAWS-User-9826533answered 3 years ago"


Question: How to Stop Daily Emails About VPN Connections

"Hi,I have just started receiving daily emails to the following effect:"You're receiving this message because you have at least one VPN Connection in the us-west-2 Region, for which your VPN Customer Gateway is not using both tunnels. This mode of operation is not recommended as you may experience connectivity issues if your active tunnel fails."I am perfectly content having one or zero tunnels in place for the identified VPN connections. I did not receive these emails before a couple weeks ago and some of these VPNs have been in the described state for well over a year.Where is the setting to disable this check or stop the emails?Thank You.FollowComment"

Answer: 1The only way this can be addressed is by opening a support issue.CommentSharePrismanswered 4 years ago1Can confirm.Opened a support ticket and they opted us out of the VPC tunnel notification.CommentSharenolsonvivialanswered 2 years ago


Question: An error occurred while calling o128.pyWriteDynamicFrame. Record is incomplete.

got while running Glue job: An error occurred while calling o128.pyWriteDynamicFrame. Record is incomplete.any help is appreciatedFollowComment

Answer: "0Hi,the error seems to indicate that the step that initiated the write has as input a  DynamicFrame with some data issue. It could be a special characters that splits one record in two lines, but it is not really possible to say with the limited info.You should try to look at the logs of the job.In Glue Studio open the jobs then select the tab Runs or in the left pane select Monitoring then follow the instruction in this documentation page.You can also try to enable run insight  to get a different formatting for the logs, that should be easier to read.hope this helps, if you are not able to find the issue, please update the question with more info from the logs, and about your job.Thank youCommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Stack in UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS state

"Hey,30h ago and apply a new CF template to my development environment, and it couldn't finish. In the morning I saw that stack is still in UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS state, and I opened a ticket for AWS to fix it as it looks like Internal Error of AWS (trying to disconnect WebACL from the resource that was deleted by that CF stack before). I opened a ticket to AWS technical team 24h ago, but no answer - wondering if there is any aws-cli command to force delete or force fix stack?2022-06-21 22:54:55 UTC+1000rCisProcessorWebACLAssociationDELETE_IN_PROGRESS-2022-06-21 22:51:53 UTC+1000rCisProcessorWebACLAssociationDELETE_FAILEDInternal Failure2022-06-21 22:51:53 UTC+1000rCisProcessorWebACLAssociationDELETE_IN_PROGRESS-FollowComment"

Answer: "0Hello there,Greetings for the day!Note- Since we do not have the visibility into the resources, I am providing you the general guidance steps that might help in resolving the issue.Unfortunately there is no awscli command that you can used in this scenario. By going through the information shared in the query that a resource has gone into Delete_Failed state with reason Internal Failure, your stack is now stuck in UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS state.A CloudFormation stack gets stuck in the UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS or UPDATE_COMPLETE_CLEANUP_IN_PROGRESS state when [1] :CloudFormation is still in the process of removing old resources, or can't remove those resources due to a dependency issue.Resource cleanup is paused because a sibling stack of a nested stack fails to update or roll back.In this scenario, since the resource is failing to delete with reason INTERNAL FAILURE, we do not have much information to proceed with. The next step would be to check the AWS CloudTrail Event History and find the corresponding API which is failing. Once the failed API is identified, try to resolve the error message.If the reason mentioned is API is also INTERNAL FAILURE then you need to check with the AWS Support on the progress of the ticket and they need to unstuck this stuck stack.Article for Reference :[1] https://aws.amazon.com/premiumsupport/knowledge-center/cloudformation-stack-cleanup-stuck/CommentShareSUPPORT ENGINEERGurpreet Singhanswered a year ago"


Question: Is there any usage of private key after AWS Cloud HSM cluster is initialized?

"Hello,This question is related to Cloud HSM cluster initialization process and usage of the private key once cluster is initialized.What is the usage of the private key which was used to the sign the cluster CSR ? Based on https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr, once we signed the CSR, we have to secure the private key to the secure storage (offline HSM). If you can demonstrate that you own the key, you can also demonstrate that you own the cluster and the data it contains.Documentation says that this private key will not be used for Cloud HSM operations except only for specific purposes such as restoring from a backup however Cluster Backup and Restore process mentioned on https://docs.aws.amazon.com/cloudhsm/latest/userguide/create-cluster-from-backup.html doesn't mention the usage of private key to restore the cluster from a backup.I am confused here if the private key has been used in the backup process or not? If yes, then I foresee some security challenges and concerns to connect offline HSM with AWS platform to make usage of the private key in a back up operation? How can I expose the previously secured private key in a offline HSM to the AWS platform?Please clarify the usage of Cloud HSM cluster signing private key here.ThanksFollowComment"


Question: the sending rate of AWS SES

"Hello,I'm using the SES service to send mails to users.The maximum send rate has been raised to 30,  if I raise it to 40 or more,will it cost separate charge for raising the sending limits?And how  much is the the maximum of sending rate?I am looking farward to your reply.Best regards,FollowComment"

Answer: "1No, it will not cost separate charge for raising the sending limits.i have raised it to 50 ( send rate ) and no increase in the cost.you just need to raise quota increase requests/tickets with proper description like ( why you want to increase your quota. )( As of now for sandbox.)Daily sending quota200 emails per 24-hour periodMaximum send rate1 email per secondAs there is no such maximum sending rate specified by AWS. you can increase as per your demands and environments but many things need to comply for this to increase like ( high quality content, low bounce and complaint rates, not exceeding your daily sending quota ). rest depends upon  the aws support team.  If they find it genuine and comply with there standards you sending rate gets Approved else rejected.CommentShareutkarsh-awsanswered 8 months ago1Hi - Below resource provide a very detailed and good insights on Service quotas in Amazon SEShttps://docs.aws.amazon.com/ses/latest/dg/quotas.htmlAlso for Increasing your Amazon SES sending quotas, https://docs.aws.amazon.com/ses/latest/dg/manage-sending-quotas-request-increase.html provides very good insight.Per above , sending rate is an adjustable quota. There is no maximum limit provided publically but below note from the above resource should be reviewed if you are requesting manually.In order to prevent our systems from being used to send unsolicited or malicious content, we have to consider each request carefully. If we're able to do so, we'll grant your request within the specified times listed below for the type of increase requested. However, if we need to obtain additional information from you, it might take longer to resolve your request. We reserve the right not to grant your request if your use case doesn't align with our policies.Sending quota or Sending rate: Up to 24 hours.CommentShareEXPERTAWS-User-Nitinanswered 8 months ago"


Question: DAG import errors are not disappearing in the UI even after resolving them

"I'm facing an issue with the Airflow Web UI in the Managed Airflow environment. I uploaded a DAG file in the Airflow designated bucket in S3. It had few import errors. I fixed them and re-uploaded the file. But I still see the errors in the UI. The DAG ran fine without any issues.I thought since the web server process is not getting restarted, it's unaware of the fixes done. So, I made a minor change in the Airflow configuration options of the environment, thereby forcing the services to restart. But it did not help.I have a couple of questions:Why there is no option to restart or stop the Airflow environment? It would be helpful in reducing the costs for the customer as well as in restarting UI after making any changes to the configurationHow to let the webserver process know that the DAG import errors have been resolved so it does not show the errors in the UI anymore?Edited by: ArjunAnaji on May 30, 2021 10:49 AMFollowComment"

Answer: "1Accepted AnswerHi!While no dedicated restart option exists, adding/removing/altering an arbitrary configuration override or log level option will force a restart.Stopping an environment is not an option as there are numerous dependencies in Airflow such as the meta database that cannot be easily stopped. As an alternative, environments can be created and destroyed via API or CloudFormation.MWAA is running open source Airflow, either 1.10.12 or 2.0.2, and does not alter it's behavior.  If the web server is not being updated to the lack of errors, it is likely that the scheduler responsible for serializing the DAGs has not completed or still sees errors.  See your DAG processing logs in CloudWatch (may require INFO level logging).  You can also debug locally using https://github.com/aws/aws-mwaa-local-runnerThanks!CommentShareJohn_Janswered 2 years ago"


Question: Accessing API Gateway both Public and Private endpoint

"My customer want to access both private and public REST API Gateway from one VPC with enable private DNS name. This VPC has VPC endpoint to access private API Gateway and internet GW or NAT GW to access public API Gateway.Public API Gateway assumes an external service that is built on AWS, not my customer's service.According to the official AWS document "https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html", if I want to public API Gateway in these situations, they need an edge optimized custom domain.Is it possible not only for edge-optimized custom domains but also regional custom domains?FollowComment"

Answer: "0Accepted AnswerIf private DNS is enabled, you can either use Edge optimized custom domain names or regional custom domain names to connect to your public APIs. This is described here.Also this article from premium support might be handyCommentShareEXPERTPawan-AWSanswered 2 years ago"


Question: redshift error when grant select on table: Operation not supported on external tables

"I have a redshift table that I would like to grant access to a user,if I run:GRANT SELECT ON ALL TABLES IN SCHEMA schema_name to user_name;it works,however, if I run:GRANT SELECT ON schema_name.table_name to user_name;I got the following error:ERROR: Operation not supported on external tablesAny ideas why?Thanks!FollowComment"

Answer: "0Accepted AnswerYou are seeing this error since SELECT is not a supported privilege type for external schema.Supported privilege are CREATE, ALTER, DROP. Refer following doc for details.https://docs.aws.amazon.com/redshift/latest/dg/r_GRANT.htmlGRANT { { CREATE | ALTER | DROP }  [, ...] | ALL [ PRIVILEGES ] }    ON EXTERNAL SCHEMA schema_name [, ...]    TO { IAM_ROLE iam_role } [, ...] [ WITH GRANT OPTION ]   If you want to grant SELECT privilege for tables in an external schema, use the following syntax.GRANT { { SELECT | ALTER | DROP | DELETE | INSERT }  [, ...] | ALL [ PRIVILEGES ] }    ON EXTERNAL TABLE schema_name.table_name [, ...]    TO { { IAM_ROLE iam_role } [, ...] | PUBLIC } [ WITH GRANT OPTION ]CommentShareYota_Hanswered 4 months ago"


Question: Opensearch query to return number of events over rate threshold

"For a given time window I would like to return the total number of events that occurred over a certain rate threshold in any given month, for example I have a load balancer receiving requests each request generates an event, if the threshold is 1 event per second how many events were there in any given calendar month where the rate of requests was higher than 1 per second over a 1 minute window in any minute of that monthI understand that the best way to solve this would be to create a rollup index that calculates this and provides the value every minute however this isn't helpful when trying to look retrospectively at dataFollowComment"

Answer: "0Hi, Looks like you were trying to find out a way to do some 'alerting' system by using this query, if I understand correctly.In Opensearch, there are several aggregation functions [1]but what you were looking for is a steady function that keeps reviewing the incoming event and pop up a message when the threshold is met.To be more specifically, seems like you are looking for an analytics application that can query the streaming data, which is what Kinesis analytics application[2] does.By the way, maybe you can try to use the Opensearch Dashboard[3]. Inside Dashboard there are some analytics metrics what can be used to do similar analytics.I hope you find above information useful![1]https://opensearch.org/docs/latest/opensearch/aggregations/[2]https://aws.amazon.com/kinesis/data-analytics/[3]https://docs.aws.amazon.com/opensearch-service/latest/developerguide/dashboards.htmlCommentShareSUPPORT ENGINEERPeter-Canswered 7 months ago"


Question: Lex Slack Integration - responding to Slack's app_mention event

"Hi, is there a way to get a Lex bot to respond to the app_mention event from Slack?I would like to be able to @mention my bot in a Slack channel that the bot is part of and have the bot respond accordingly.If I use the message.channels Slack event, the bot will listen to all messages in the channel it's part of, but I was hoping to have the bot be able to just listen to the app_mention event instead.FollowComment"

Answer: "0Accepted AnswerHi Joseph,The Lex service does not currently support the app_mention event. I can see that a feature request has already been raised previously for this functionality. While I am unable to comment on if/when this feature may get released, I request you to keep an eye on our  What's New and Blog pages for any new feature announcements.CommentShareSUPPORT ENGINEERRyan_Aanswered a year agoJoseph a year agoHi Ryan, thanks for the response. Hopefully that feature gets implemented.Share"


Question: Auto start an EC2 instance 5 minutes after it auto shuts due to an alarm

"An alarm has been set on our EC2 instance to auto shut if "idle" for a certain time period (based on CPU utilization). Is there a way to auto start the instance, say 5 minutes after it auto shuts due to the alarm?FollowComment"

Answer: "0It would probably be a better idea to just exclude the instance from the alarm to begin with. You can also shut off the alarm. Unless the idle CPU is an indication of a system problem in that case you may want to handle that a different way. Ex: Auto scaling group with health check.CommentShareEvananswered 5 months ago0You can build a solution using DynamoDB and lambda.Log all the instanceid's,state and shutdowntime and trigger the lambda to take action as needed.Note : Also consider shutting down the services running inside the EC2 gracefully to avoid data inconsistency and corruption.CommentSharerePost-User-6379467answered 5 months ago0Thank you @rePost-User-6379467 and @Evan for your repliesCommentShareUserABanswered 5 months ago0Assuming this is really what you need, you can set an EventBridge rule that will catch the instance terminated events. This event can create an EventBridge schedule for 5 minutes from now that will start the instance.CommentShareEXPERTUrianswered 5 months ago"


Question: Boto3 SDK get_metric_data returned empty values

"I have a lambda written in python 3.9 with boto3 cloudwatch client trying to retrieve CloudFront BytesDownloaded. Valid CloudFront Distribution ID with data showing from the CloudFront console. But lambda returned MetricDataResults with empty values.What am I doing wrong?Thanks!KarlResults from lambda's CloudWatch log:[INFO]2022-07-11T19:18:28.793Z68cbba6b-5aa4-4f8d-b0d8-8fbe7abf185bCloudFront bytesdownloaded for distribution <distribution id> from 2022-06-11 19:18:28 to 2022-07-11 19:18:28:{"MetricDataResults": [{"Id": "CloudFrontBytesDownloaded","Label": "BytesDownloaded","Timestamps": [],"Values": [],"StatusCode": "Complete"}],"Messages": [],"ResponseMetadata": {"RequestId": "<request id>","HTTPStatusCode": 200,"HTTPHeaders": {"x-amzn-requestid": "<x amen request id>","content-type": "text/xml","content-length": "528","date": "Mon, 11 Jul 2022 19:18:28 GMT"},"RetryAttempts": 0}}------------------------ lambda code ----------------------import json, boto3, logging, datetimelogger = logging.getLogger()logger.setLevel(logging.INFO)def lambda_handler(event, context):client = boto3.client('cloudwatch')endTime = datetime.datetime.now()startTime = endTime - datetime.timedelta(days=30)response = client.get_metric_data(    MetricDataQueries=[        {            'Id': 'CloudFrontBytesDownloaded',            'MetricStat': {                'Metric': {                    'Namespace': 'AWS/CloudFront',                    'MetricName': 'BytesDownloaded',                    'Dimensions': [                        {                            'Name': 'DistributionId',                            'Value': '<valid distribution id>'                        },                        {                            'Name': 'Region',                            'Value': 'Global'                        }                    ]                },                'Period': 600,                'Stat': 'Sum',                'Unit': 'Bytes'            },        },    ],    StartTime=startTime,    EndTime=endTime,)logger.info("CloudFront bytesdownloaded for distribution <valid distribution id> from "     + startTime.strftime("%Y-%m-%d %H:%M:%S") + " to " + endTime.strftime("%Y-%m-%d %H:%M:%S") + ": " + json.dumps(response))json.dumps(response)return {    'statusCode': 200,    'body': json.dumps('aota-cloudfront-bytesdownloaded completed successfully!')}FollowComment"

Answer: "0Hi, I think it's because you have Unit=Bytes.  The defined unit for BytesDownloaded is None.  Try omitting "Unit" from your query.From the boto3 documentation:In a Get operation, if you omit Unit then all data that was collected with any unit is returned, along with the corresponding units that were specified when the data was reported to CloudWatch. If you specify a unit, the operation returns only data that was collected with that unit specified. If you specify a unit that does not match the data collected, the results of the operation are null. CloudWatch does not perform unit conversions.Also make sure you're querying us-east-1 (you're probably already doing that).CommentShareEXPERTskinsmananswered a year ago"


Question: How to restore a deleted snapshot - haven't enabled recycle bin

"Deleted a snapshot by mistake. I don't see recycle bin in navigation and have not configured retention rules. By default, does it save the deleted snapshot somewhere? ThanksFollowComment"

Answer: 0Hi - Would recommend to open a support case and provide further details to see what would be the appropriate actions.Reference to open a support case - https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlCommentShareEXPERTAWS-User-Nitinanswered 8 months ago


Question: Disable third party tracking?

"I've taken Cloud9 out for a test drive and I mostly love it, but it seems it isn't possible to login without disabling 3rd party tracking protection. I would really love it if you removed this. For me, it's a deal breaker and really no one should have to disable privacy settings to use web-based software. I mean, I'm already logged in - you know who I am! But disabling the settings for Cloud9 means re-enabling them everytime I stop using the IDE. Way too much friction. And this is the only service from AWS that I've encountered that works this way.Would you consider removing this? If not, is there a workaround?Edited by: jhannah on Jul 30, 2019 9:38 AMFollowComment"

Answer: 0I'm leaving this here for anyone else who has trouble logging in to Cloud9 w/o disabling third party tracking cookies. You have to whitelist one or more AWS domains (depending on what region(s) you're using Cloud9 in). Here's a resource:https://docs.aws.amazon.com/cloud9/latest/user-guide/troubleshooting.html#troubleshooting-env-loadingCommentSharejhannahanswered 4 years ago0AWS Cloud9 has been updated so that you no longer need to enable third-party cookies to open the IDE. More details here: https://forums.aws.amazon.com/ann.jspa?annID=7207CommentShareanester-awsanswered 4 years ago


Question: How to set java 11 path in amazon linux 2  docker image

I am creating a docker with amazon Linux 2 and installed the java 11 and passed it to my code build and getting error java path is not set. any suggestions to set path in DockerfileFollowComment

Answer: "0Accepted AnswerHi there,To set the Java 11 path in an Amazon Linux 2 Docker image, you can use the ENV command in your Dockerfile to set the JAVA_HOME environment variable. For example:ENV JAVA_HOME /usr/lib/jvm/java-11-openjdkThis will set the JAVA_HOME environment variable to the path where Java 11 is installed on your Amazon Linux 2 Docker image. You can then use this environment variable to run Java 11 commands, such as java and javac, from anywhere in your container.In order for this to work, you will need to ensure that Java 11 is installed on your Docker image. You can do this by running yum install java-11-openjdk or a similar command to install the Java 11 package on your image.Once Java 11 is installed and the JAVA_HOME environment variable is set, you should be able to run Java 11 commands in your container. For example:$ java -versionopenjdk version "11.0.9.1" 2021-11-28OpenJDK Runtime Environment (build 11.0.9.1+1-Amazon)OpenJDK 64-Bit Server VM (build 11.0.9.1+1-Amazon, mixed mode, sharing)You can also add the JAVA_HOME bin directory to your PATH environment variable so that you can run Java 11 commands without specifying the full path to the java binary. For example:ENV PATH "$PATH:$JAVA_HOME/bin"This will allow you to run Java 11 commands simply by typing java or javac, without needing to specify the full path to the binary.I hope this helps! Let me know if you have any other questions.CommentShareajmarcinanswered 6 months ago"


Question: ¿How can we crate a lambda which uses a Braket D-Wave device?

"We are trying to deploy a Lambda with some code which works in a Notebook. The code is rather simple and uses D-Wave — DW_2000Q_6. The problem is that when we execute the lambda (container lambda due to size problems), it give us the following error:{  "errorMessage": "[Errno 30] Read-only file system: '/home/sbx_user1051'",  "errorType": "OSError",  "stackTrace": [    "  File \"/var/lang/lib/python3.8/imp.py\", line 234, in load_module\n    return load_source(name, filename, file)\n",    "  File \"/var/lang/lib/python3.8/imp.py\", line 171, in load_source\n    module = _load(spec)\n",    "  File \"<frozen importlib._bootstrap>\", line 702, in _load\n",    "  File \"<frozen importlib._bootstrap>\", line 671, in _load_unlocked\n",    "  File \"<frozen importlib._bootstrap_external>\", line 843, in exec_module\n",    "  File \"<frozen importlib._bootstrap>\", line 219, in _call_with_frames_removed\n",    "  File \"/var/task/lambda_function.py\", line 6, in <module>\n    from dwave.system.composites import EmbeddingComposite\n",    "  File \"/var/task/dwave/system/__init__.py\", line 15, in <module>\n    import dwave.system.flux_bias_offsets\n",    "  File \"/var/task/dwave/system/flux_bias_offsets.py\", line 22, in <module>\n    from dwave.system.samplers.dwave_sampler import DWaveSampler\n",    "  File \"/var/task/dwave/system/samplers/__init__.py\", line 15, in <module>\n    from dwave.system.samplers.clique import *\n",    "  File \"/var/task/dwave/system/samplers/clique.py\", line 32, in <module>\n    from dwave.system.samplers.dwave_sampler import DWaveSampler, _failover\n",    "  File \"/var/task/dwave/system/samplers/dwave_sampler.py\", line 31, in <module>\n    from dwave.cloud import Client\n",    "  File \"/var/task/dwave/cloud/__init__.py\", line 21, in <module>\n    from dwave.cloud.client import Client\n",    "  File \"/var/task/dwave/cloud/client/__init__.py\", line 17, in <module>\n    from dwave.cloud.client.base import Client\n",    "  File \"/var/task/dwave/cloud/client/base.py\", line 89, in <module>\n    class Client(object):\n",    "  File \"/var/task/dwave/cloud/client/base.py\", line 736, in Client\n    @cached.ondisk(maxage=_REGIONS_CACHE_MAXAGE)\n",    "  File \"/var/task/dwave/cloud/utils.py\", line 477, in ondisk\n    directory = kwargs.pop('directory', get_cache_dir())\n",    "  File \"/var/task/dwave/cloud/config.py\", line 455, in get_cache_dir\n    return homebase.user_cache_dir(\n",    "  File \"/var/task/homebase/homebase.py\", line 150, in user_cache_dir\n    return _get_folder(True, _FolderTypes.cache, app_name, app_author, version, False, use_virtualenv, create)[0]\n",    "  File \"/var/task/homebase/homebase.py\", line 430, in _get_folder\n    os.makedirs(final_path)\n",    "  File \"/var/lang/lib/python3.8/os.py\", line 213, in makedirs\n    makedirs(head, exist_ok=exist_ok)\n",    "  File \"/var/lang/lib/python3.8/os.py\", line 213, in makedirs\n    makedirs(head, exist_ok=exist_ok)\n",    "  File \"/var/lang/lib/python3.8/os.py\", line 223, in makedirs\n    mkdir(name, mode)\n"  ]}It seems that the library tries to write to some files which are not in /tmp folder.I'm wondering if is possible to do this, and if not, what are the alternatives.imports used:import boto3from braket.ocean_plugin import BraketDWaveSamplerfrom dwave.system.composites import EmbeddingCompositefrom neal import SimulatedAnnealingSamplerFollowComment"

Answer: "0Hi, and thank you very much for your question!As you noted, AWS Lambda allows for writing in the /tmp folder and the dwave determines where it will cache data based on this algorithm.We currently support running Braket in Notebook Instances you can create through our console, or as Braket Hybrid Jobs, which is more similar to your use of containers.However, we would really appreciate to understand more about your use case to see if that's something we should look into more deeply. Could you please give us more information about your use case, what you're trying to do, and why you think AWS Lambda will work well for it?CommentSharekrneta-at-awsanswered a year ago"


Question: Sagemaker Studio is not opening after deleting lifecycle configuration

"I was working on a sagemaker studio for ML work, I attached Lifecycle Configuration with it, which was creating problem. Then I deleted the lifecycle configuration without detaching it, and this problem is happening. Can't start sagemaker studio notebook and this is shown.Any suggestion to fix this ?FollowComment"

Answer: "1Accepted AnswerYou can try detaching the LCC script using the CLI. You can use the CloudShell from console, since your console role is able to perform updates on the domain.Use the update-domain CLI call, and provide an empty configuration for the default user settings, something like-aws sagemaker update-domain --domain-id d-abc123 \--default-user-settings '{"JupyterServerAppSettings": {  "DefaultResourceSpec": {    "InstanceType": "system"   },}}'CommentShareDurga_Sanswered 7 months agohabibalsaki 7 months agoThanks a lot for your answer.Share"


Question: VPC Endpoint & Access from On-prem

"When accessing a public service via VPC Endpoint of "Interface" type, such as EKS from on-premises, do you need to use proxies or are proxies only needed for "Gateway" type?FollowComment"

Answer: "0Accepted AnswerThey are only needed for the "Gateway" type (S3 and DynamoDB), but you will need your on-prem DNS to resolve the interface endpoint IP address accordingly.CommentShareAlbertanswered 3 years ago"


Question: Endorsement client failed

"I keep getting this error , due to which i have to spin up a new fabric network every time ,endorser client failed to connect to 0.0.0.0:7051: failed to create new connection: connection error: desc = "transport: error while dialing: dial tcp 0.0.0.0:7051: connect: connection refused"Am i missing anything in the configuration  that causes this issueFollowComment"

Answer: "0Hello,Thank you for contacting us and for using Amazon Managed Blockchain.I understand that you keep getting error :connection error: desc = "transport: error while dialing: dial tcp 0.0.0.0:7051: connect: connection refused"The error message you are seeing is due to a connection issue between your endorser client and the peer node. This could be caused by a number of reasons such as incorrect connection details for your Hyperledger Fabric network.Please have a look at the instructions at Chainstack Docs: Hyperledger Fabric tools to correctly connect to the network[1].The error message means that the endorser client is unable to connect to the peer at the specified address and port. There are a few possible reasons for this error:The peer may not be running.The peer may be running, but the endorser client may not have the correct network configuration.The peer may be running, and the endorser client may have the correct network configuration, but the peer may be refusing connections.To troubleshoot this error, you can try the following steps:Verify that the peer is running. You can do this by checking the logs for the peer.Verify that the endorser client has the correct network configuration. You can do this by checking the connection profile for the endorser client.Verify that the peer is not refusing connections. You can do this by checking the logs for the peer.If you have verified that all of the above are correct, and you are still getting the error, you may need to contact us at, AWS support for assistance.To help you with further investigation on this issue, please feel free to cut a support ticket and provide more details about your account information like Blockchain network ID and the number of nodes in your network and we'd be glad to assist you further.Please open a support case with AWS using the link:https://console.aws.amazon.com/support/home?#/case/createThank youResources :[1] https://support.chainstack.com/hc/en-us/articles/900000804043-Connecting-to-a-Hyperledger-Fabric-network-fails-with-error-getting-endorser-client-for-channel-CommentShareSUPPORT ENGINEEROjasvi_Banswered 2 months ago"


Question: EKS can't scale Managed Node Group from 0

I have a use case where i'd like a nodegroup to be zero and to scale up automatically when we deploy a workload. The kubectl deployment scales correctly if the desiredcount is 1 or above but its stuck on a loop when the initial count 0. I see this issue https://github.com/aws/containers-roadmap/issues/724 still open. Is this still a shortcoming? Are there any potential workarounds for this?FollowComment

Answer: "0Hello there,EKS Supports scaling managed node group to zero. More details in below article,https://aws.amazon.com/blogs/containers/catching-up-with-managed-node-groups-in-amazon-eks/Also, you can create a Fargate profile for a new namespace (like scaling-namespace) and run Cluster-Autoscaler (CA) pod on scaling-namespace so that CA can scale your application pod based on their scheduled status "Pending".CommentSharesaiteja313answered a year ago0With EKS support for Kubernetes 1.24, the Cluster Autoscaler has been extended to also support scale to zero for managed nodegroups. You can see more details in the announcement blog.CommentSharetrevorrobertsjranswered 5 months ago"


Question: Instance will no longer connect to Bitnami/website MIA

"Hello,my name is Justin and I own a smaller company in Virginia, and thank you in advance for your help and guidance. I started working on a new domain/website several weeks back after getting the technical end set up first and surprisingly I've had no issues until now. My set up is Google domain to AWS (basic plan/$3.99/month), using Lightsail and WordPress. I followed the set up for my instance from an AWS certified specialist on YouTube. That said, I have not set up anything for storage/containers/etc tho I do have my static page set up for my landing page.So, Sunday night I finished working on the site on wordpress with no issues outside of a jetpack warning that had been up for 2 days. It stated that my domain name and IP address were both fighting for the same spot and I needed to select one or it would go into safe mode. Outside of this, my primary updates outside of verbage was in installed a few plug ins. The last one was PayPal which was around $60 for the year. I went thru the process of setting all the pages up and everything worked great.The following morning I had planned on fixing the jetpack issue but once I logged on, or attempted to, I realized that the website was down. All pages refused to load and a few times I got a 504 gateway timeout error message. I attempted to log in thru WordPress but I had the same issue, no loading.I then attempted to relaunch the instance via AWS; however, the instance wouldnt connect correctly to Bitnami. Basically, the black terminal screen comes up but is empty. I then created a second instance (can only have 2 max) and attempted to connect to Bitnami again. This time, it was a success. Circle back to verify and my instance 1 still has the same results of not completely connecting to Bitnami.I'm new, and have a basic account,meaning no technical support. Any help would be GREATLY appreciated!!Sincerely,JustinFollowCommentChris_W a year agoIf you connect to your WordPress instance, is there anything remarkable in the WordPress logs? I'm not exactly sure where the logs would "live," but this would be my best guess where to start: https://docs.bitnami.com/aws-templates/apps/wordpress/troubleshooting/debug-errors-apache/Share"

Answer: "0Hi Justin,    It sounds like there is a connectivity issue with your first EC2 instance. Here are a few recommended things you can check. Try reconnecting after each troubleshooting step to verify if the fix works.         - Make sure EC2 Security groups allow the right IP addresses and ports of the service you are connecting to    - If you are using an ALB, follow the guide linked below to see if that is the issue    - Attempt to connect to the first EC2 instance via the command line or via the Management Console using EC2 connect to verify connections can be made    - Check if your EC2 is using an elastic IP address, as EC2's without an EIP change their IP after reboot.    - Verify that any route tables/NACLs in your VPC allow the type of traffic you need         If there are no issues with your second EC2, you may try creating an AMI and relaunch another EC2 with that AMI.         Guides:    - https://aws.amazon.com/premiumsupport/knowledge-center/504-error-alb/    - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html    - https://docs.aws.amazon.com/toolkit-for-visual-studio/latest/user-guide/tkv-create-ami-from-instance.htmlCommentShareEthan_Hanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: Unable to create alias during code catalyst onboarding.

"While attempting to sign up for code catalyst, I go through the process until I get to the "Create your alias" step.If I choose an alias that has clearly already been chosen (alias), then it tells me immediately that it is unavailable.If I enter my desired alias, it does not do anything.Tracing the response through the browser I get:{"errors":[{"message":"request change failure: FAILED_GOVERNANCE","locations":[{"line":2,"column":3}],"path":["createUserDetails"],"extensions":{"name":"ValidationException"},"name":"ValidationException"}],"data":{"createUserDetails":null}}I saw that another individual had a similar problem: https://repost.aws/questions/QUbeV0idyfTuGVG-FmnzLS0Q/cant-create-alias-in-codecatalystIt would seem he got past the issue by using a different email address which I am unwilling to do.The email address I am using is an @gmail.com address.FollowCommentSimon Hanmer 4 months agoHi Rick, it was myself that raised the ticket you mentioned and the original email is still failing with the same problem about the alias. My solution wasn't technically a new email, I just used the 'address+prefix@gmail.com' trick so still get the emails associated with the builder ID in my normal email inbox.Share"

Answer: "2Accepted AnswerI was able to complete the registration today without adding any +stuff to my address.It looks like whatever issue was causing this to fail was solved.CommentShareRick Morananswered 4 months ago1Today I was able to complete the registration. The error didn't occur again.CommentShareJulian Michelanswered 4 months ago0Hi Rick,Thank you for reporting the issue. I have sent this to our team. They are currently reviewing the account. I will get back to you as soon as i have an update from them.RegardsSundareshCommentShareMODERATORSundaresh_Ianswered 4 months ago0I get the same error message when I try to create the CodeCatalyst space:The following AWS account is already used as a billing account for another CodeCatalyst space: xxxxxxxxxx. Choose a different AWS account and try again.In the developer mode of my browser, I can see this output:{"errors":[{"message":"request change failure: FAILED_GOVERNANCE","locations":[{"line":2,"column":3}],"path":["createSpace"],"extensions":{"name":"ValidationException"},"name":"ValidationException"}],"data":{"createSpace":null}}My e-mail address starts with "mail@...". Is this forbidden? The e-mail is used in my personal Amazon account as well as AWS account root user e-mail in one of my AWS accounts. Could this cause the issue?Thanks.CommentShareJulian Michelanswered 4 months ago"


Question: Android 12: Trust anchor for certification path not found

"Hi,I have an android app that was tested on mobile phones using Android 8/9/10/11/12, and Android 8/9/10/11 phones are working normally, but I can’t receive notifications on android 12. Can anyone make any suggestions?The exception I am getting (Only Android 12)!"MqttException (0) - javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found."further information:https://stackoverflow.com/questions/70163257/mqtt-can-not-connect-to-aws-serverfurther information(2021/12/9):I use the same account to create an identity pool in Amazon Cognito, and set up different regions for testing. If the region is set to us-west-2, the MQTT connection fails, and the region is set to ap-southeast-1 then the MQTT connection succeeds. What will be the effect on identity pool? Or any other suggestions?(notice: Android 8/9/10/11 phones are normal, only android 12 has an error message.)FollowCommentSachin 3 months agoI am also facing same problem, for mqtt connection to aws using ssl certificates.kindly help me to resolve this problem.Every connection this give error.Share"

Answer: "1Accepted Answerhey @pc9705atgmi, Bruno, Jason I think I've found the problem. According to https://docs.aws.amazon.com/iot/latest/developerguide/iot-connect-devices.html old accountEndpointPrefix of type iot:Data should not be used. It is described as legacy 'Verisign' endpoint and it obviously doesn't work with Android 12.Call:aws iot describe-endpoint --endpoint-type iot:Data-ATSand you will get new accountEndpointPrefix ending with -ats (or you can just add -ats to your current accountEndpointPrefix) and try again.It works fine for me now.GoranCommentShareEXPERTgoranopacicanswered a year ago1Hi Bruno, Jason,I've tried on Samsung S21 and Google Pixel 4. Both with Android 12. The same problem.People are reporting it on other websites too: https://github.com/aws-amplify/aws-sdk-android/issues/2741GoranCommentShareEXPERTgoranopacicanswered a year ago0Can you please clarify what AWS servers you are connecting to?Are they self-managed? If so can you check its configurations?CommentShareJason_Sanswered 2 years agopc9705atgmi 2 years agoThanks for your reply!My reply is as follows:AWS Iot Server.Sorry! I don't know what "Are they self-managed?" means.Android 8/9/10/11 phones are working normally. So I don't think it is a matter of configurations.Share0hey @pc9705atgmi - this seems to be an indication that the signing rootCA isn't present on that device.  Have you tried a different Android12 device?  Also, getting additional details on that rootCA failing validation might help.  In odd cases where devices are on a local network that have proxies, i have seen similar issues w/ certificate validation.hope that helps!CommentShareBruno_Manswered 2 years ago"


Question: Cloud9 fails to install and Failed Bash. Exit code 1.

Trying out the basic Cloud9 IDE installation and it says it cannot install pip. Description of full error here.Installation StartedPackage Cloud9 IDE 1pip is required to install CodeIntel. Please install pip and try againexiting with 1Failed Bash. Exit code 1.One or more errors occured. Please try to resolve them and restart AWS Cloud9 or visit https://forums.aws.amazon.com/forum.jspa?forumID=268I tried looking at that forumID but no info? Thx.FollowComment

Answer: "0As the message suggest, you need to install pip on your instance yourself. Most of OS distributions should provide a default way to install it, for example sudo apt-get install python-pip for Ubuntu, sudo yum install python-pip for CentosCommentShareanester-awsanswered 6 months ago"


Question: I received an email today and they would a reply -BUT how?

"RE:[CASE 9497402891] ******** e PLEASE LET ME KNOW WHY?from Ian AWSFollowCommentJohn Rotenstein a year agoSorry, but your question is unclear. How is this related to AWS? Please provide A LOT more information so that we can understand what you are asking.Share"

Answer: "0If you wish to discuss this matter further, respond to this case from your Support Center, here:https://console.aws.amazon.com/support/homeCommentShareBriNasAWSanswered a month ago"


Question: TwinMaker Knowledge Graph is now generally available for AWS IoT TwinMaker

"AWS IoT TwinMaker makes it easier to create digital twins of real-world systems such as buildings, factories, industrial equipment, and production lines. Now with the feature launch of TwinMaker Knowledge Graph, customers can query their digital twins, contextualize data from disparate data sources, and gain deeper insights into their real-world systems. As a result, customers can save time performing functions like root cause analysis and drive more informed business decisions.To build a TwinMaker Knowledge Graph, customers create entities which are virtual representations of real-world systems, and then define the physical or logical relationships between those entities. Customers can then query the TwinMaker Knowledge Graph with open source query language partiQL. For example, customers can query all entities with name containing “pump”, or find all entities connected to an entity of interest. The query capability enables customers to perform functions like root cause analysis and predict the impacted entities and systems when changes are introduced into their physical systems. This can improve operational efficiency and reduces time to resolve issues. With data contextualized from disparate data sources, customers can drive informed decisions and anticipate where issues are likely to occur in the future.  To learn more, visit our developer guide and API reference.TwinMaker Knowledge Graph is generally available, and you can use it in the following AWS Regions: US East (N. Virginia), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Europe (Frankfurt), and Europe (Ireland).For pricing information, please visit AWS IoT TwinMaker pricing page. To learn more visit the AWS IoT TwinMaker product page. Use the AWS Management Console to get started, or visit our GitHub repository for a sample digital twin application.FollowComment"


Question: Not able to clone a codecommit repository

I followed these steps to get access to codecommit but i'm not able to clone repositories.Install latest pip and git-remote-codecommitCreate and IAM user with policy AWSCodeCommitPowerUser and attach SSH and AWS Git credentials.Configure the IAM user locally.I get the following error when try to clone through ssh:Cloning into 'nfs-utils'...Enter passphrase for key '/home/risbhat/.ssh/id_rsa': no such identity: /home/risbhat/.ssh/id_ed25519: No such file or directoryPermission denied (publickey).fatal: Could not read from remote repository.I can see the repository exists and I have added the ssh keys/Git credentials to my IAM user. Am i missing some step?FollowComment

Answer: "0Accepted AnswerYes i was using this command:git clone codecommit::us-west-2://default@nfs-utilsI realized that i have access to these repos only through a isengard account created by my team and not through personal account. So something like this worked for me:git clone codecommit::us-west-2://karoo-source@nfs-utils (karoo-source is the profile created through the team's isengard account)CommentSharerePost-User-8224285answered 10 months ago0What does your clone command look like?  Given you've installed git-remote-codecommit, are you using something like this?:git clone codecommit::region://iam-principal@repo-nameCommentShareEXPERTskinsmananswered 10 months ago"


Question: How to download s3 file to Window 2022 EC2 instance with CloudFormation Init? Getting Access Denied error.

"I'm trying to download a file from an S3 bucket onto a EC2 Windows server. I'm set up the IAM role, policy, and profile. In the CloudFormation::Init section of the server, I have different configSets and one of them is downloading a file from the bucket.--- Some items not shown ---"Parameters": {        "S3BucketName": {            "Description": "The name of an existing S3 bucket that the server needs to access.",            "Type": "String",            "Default": "ccw-to-rds-poc-1"        },--- Some parameters not shown ---"InstanceRole":{         "Type":"AWS::IAM::Role",         "Properties":{            "AssumeRolePolicyDocument":{               "Statement":[                  {                     "Effect":"Allow",                     "Principal":{                        "Service":[                           "ec2.amazonaws.com"                        ]                     },                     "Action":[                        "sts:AssumeRole"                     ]                  }               ]            },            "Path":"/"         }      },      "RolePolicies":{         "Type":"AWS::IAM::Policy",         "Properties":{            "PolicyName":"S3Download",            "PolicyDocument":{               "Statement":[                  {                     "Action":[                        "s3:GetObject"                     ],                     "Effect":"Allow",                     "Resource": {"Fn::Join": ["", ["arn:aws:s3:::", {"Ref": "S3BucketName"}]]}                  }               ]            },            "Roles":[               {                  "Ref":"InstanceRole"               }            ]         }      },      "InstanceProfile":{         "Type":"AWS::IAM::InstanceProfile",         "Properties":{            "Path":"/",            "Roles":[               {                  "Ref":"InstanceRole"               }            ]         }      },      "myAppServer": {        "Type": "AWS::EC2::Instance",        "Metadata": {            "AWS::CloudFormation::Authentication": {                "S3AccessCreds": {                    "type": "S3",                    "roleName": {                        "Ref": "InstanceRole"                    },                    "buckets" : [{"Ref": "S3BucketName"}]                }            },            "AWS::CloudFormation::Init": {                "configSets": {                    "downloadS3Data": ["downloadS3"],                    "Full": [{"ConfigSet": "downloadS3Data"}, "fullServer"],                    "default": [ {"ConfigSet": "Full"}],                    "App": [{"ConfigSet": "downloadS3Data"}, "appServer"],                    "Interface": [{"ConfigSet": "downloadS3Data"}, "interfaceServer"],                    "Notification": [{"ConfigSet": "downloadS3Data"}, "notificationServer"]                },                "downloadS3": {                    "files": {                        "C:\\Users\\Administrator\\Documents\\s3download.bak": {                            "source": "https://ccw-to-rds-poc-1.s3.us-east-2.amazonaws.com/test.txt",                            "authentication": "S3AccessCreds"                        }                    }                },                "fullServer": {                    "commands": {                        "test": {                            "command": "echo \"$MAGIC\"",                            "env": {"MAGIC": "I am from the full server env"},                            "cwd": "C:\\Users\\Administrator\\Desktop"                        }                    }                },                --- Some config sets not shown ---            }        },        "Properties": {            "IamInstanceProfile": {                "Ref": "InstanceProfile"            },            "ImageId": "ami-012bb86d0081c5240",            "InstanceType": "t2.small",            "KeyName": {"Ref": "keypair"},            "SecurityGroupIds": ["sg-0d0b50ca1774707b7"],            "UserData" : {                "Fn::Base64" : {                    "Fn::Join" : [                        "",                        [                            "<powershell>\n",                                "cfn-init.exe -v -s ", {"Ref" : "AWS::StackId"}, " -r YourInstance -c ", {"Ref": "CCWServerType"} , " --region ", {"Ref" : "AWS::Region"}, "\n",                            "</powershell>\n",                            "<persist>true</persist>"                        ]                    ]                }            }        }    }When the server runs "cfn-init.exe -v -s ", {"Ref" : "AWS::StackId"}, " -r YourInstance -c ", {"Ref": "CCWServerType"} , " --region ", {"Ref" : "AWS::Region"}, "\n",,It creates the s3download.bak, but it is empty and gives an Access Denied, (HTTP Error 403). Is there something I'm not doing correctly with the IAM configurations that is causing this?EDIT:I thought that because I am accessing the entire bucket and not just a specific item, like mentioned in this article that might be the issue. However, after trying "Action":["s3:*Object"] and "Action":["s3.Get*"], I still get the same access denied error.FollowComment"

Answer: "1Accepted AnswerIt looks like the issue might be caused by your IAM policy. You've specified the bucket ARN as the resource for the s3:GetObject action, but for this action the resource needs to be an object(s). You could also use a wildcard to allow access to the whole bucket - e.g. arn:aws:s3:::bucket/* [1].In this case, try replacing the resource with:"Resource": {"Fn::Join": ["", ["arn:aws:s3:::", {"Ref": "S3BucketName"}, "/*"]]}[1] https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-arn-format.html#s3-arn-examplesCommentShareEdanswered 8 months ago0Did you check if the IAM user has file permissions to the file in the bucket and the directory on the Windows server?CommentSharejschwar313answered 8 months ago"


Question: Amazon Linux 2023 image not supporting php7.3 version

"In my dockerfile I use the below as base image to build my application image.FROM public.ecr.aws/amazonlinux/amazonlinux:latestOnce there was change in the base image version change from AMI2 to 2023, my dockerfile fails to build most of the packages which includes php7.3 version. It support only version 8Can I get any assistance on how to install the version 7.3 in 2023 image version.FollowComment"

Answer: "0Accepted AnswerI checked the documentation here and it seems that php 8.1 is indeed included.https://docs.aws.amazon.com/ja_jp/linux/al2023/release-notes/new-packages.htmlAmazon Linux 2023 cannot use the EPEL repository, according to the following documentation.https://docs.aws.amazon.com/linux/al2023/ug/compare-with-al2.html#epelTherefore, installation of php 7.3 may need to be done from source.CommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-2225618 2 months agoThanks for the update. I will try building from source and also check if we can upgrade our application to use php8.1Share"


Question: RDS SSL error

"Hi,I am trying to connect to RDS through Lambda NodeJS 12.x with SSL. However I am receiving these errors:  Error: 4506652096:error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol:  library: 'SSL routines',  function: 'ssl_choose_client_version',  reason: 'unsupported protocol',  code: 'HANDSHAKE_SSL_ERROR'I am connecting like this:const pool  = mysql.createPool({  connectionLimit     : 10,  host                : 'db.cqgcxllqwqnk.eu-central-1.rds.amazonaws.com',  ssl                 : {    ca                : fs.readFileSync(__dirname + '/rds-ca-2019-root.pem')  },  user                : ‘xxxxx’,  password            : ‘xxxxxx’,  database            : ‘xxxxxx’,  multipleStatements  : true});When I connect with the certificate through MySql Workbench everything works just fine.Any idea on how to solve this?Thanks a lot!FollowComment"

Answer: "0Hi,Ensure that your Lambda function has the necessary role attached to it, to be allow it connect to the RDS instance located in your VPC [1].Also make sure that the client's certificate matches the database instances certificate, in your case the  rds-ca-2019 is being used with the lambda, the RDS instance should also make user of this certificate. If your instance was launched after 14 January 2020 it would already have the latest certitifcate [2]Hope this is of some help/MrKReferences:[1] https://docs.aws.amazon.com/lambda/latest/dg/services-rds-tutorial.html[2] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.htmlCommentShareMrKanswered 3 years ago0Hi MrK,Thank you for your reply. Unfortunately those are not the issues as I can connect just fine without SSL and the database is updated to use the new certificate. As mentioned I connect with that certificate just fine through MySQL WorkBench.CommentShareKasperSanswered 3 years ago0I am experiencing the same issue, did you get it resolved?CommentSharejltxwesleyanswered 3 years ago0The MySQL version was too old, needed to upgrade (I upgraded to 8)CommentShareKasperSanswered 2 years ago"


Question: Is it possible to use a non-default bridge network when running CodeBuild locally?

"When I run codebuild locally it creates the default docker network and volumes as in the below output. Is there a way to use different bridge network and volumes instead of these default ones? I tried modifying the docker command in codebuild_build.sh to add a network (below build command output shows --network mylocaltestingnetwork) but that didn't help as such.The reason I am trying to use a different network and volumes is because I am using localstack along with it, and the bridge network and volumes need to be accessible from the codebuild local container.If I configure my localstack to use the agent-resources_default network created by local codebuild then codebuild is able to access localstack. But, I would like to keep the dependency external to both codebuild and localstack by using a separate bridge network.$ ./codebuild_build.sh -i public.ecr.aws/codebuild/amazonlinux2-x86_64-standard:3.0 -a codebuild-output/ -b buildspec-local.yml -c -p localstackBuild Command:docker run -it -v /var/run/docker.sock:/var/run/docker.sock -e "IMAGE_NAME=public.ecr.aws/codebuild/amazonlinux2-x86_64-standard:3.0" -e "ARTIFACTS=<repo path>/codebuild-output/" --network mylocaltestingnetwork -e "SOURCE=<repo path>" -e "BUILDSPEC=<repo path>/buildspec-local.yml" -e "AWS_CONFIGURATION=<homedir>/.aws" -e "AWS_PROFILE=localstack" -e "INITIATOR=<user>" public.ecr.aws/codebuild/local-builds:latestRemoving network agent-resources_defaultRemoving volume agent-resources_source_volumeRemoving volume agent-resources_user_volumeCreating network "agent-resources_default" with the default driverCreating volume "agent-resources_source_volume" with local driverCreating volume "agent-resources_user_volume" with local driverCreating agent-resources_agent_1 ... doneCreating agent-resources_build_1 ... doneAttaching to agent-resources_agent_1, agent-resources_build_1agent_1  | [Container] 2022/01/14 15:57:15 Waiting for agent pingagent_1  | [Container] 2022/01/14 15:57:17 Waiting for DOWNLOAD_SOURCEagent_1  | [Container] 2022/01/14 15:57:23 Phase is DOWNLOAD_SOURCEFollowComment"


Question: Is Code-Artifact scheduled 443-port-removal change delayed ?

"We were expecting this change Code-Artifact-Operational-Change to take effect as of March 27, 2023. However, it seems like it's not there yet. Any idea why it didn't happen on the scheduled date?If i understood correctly, The summary of this change was that, CodeArtifact will no longer return the 443 port on the generated urls in the package-lock/yarn.lock files. However, in my case it seems like CodeArtifact is still returning the urls with 443 port appended.Tried cleaning my npm/yarn cache.Tried deleting the entire lock file and re-generated it again.Is there something we have to do on our end for this change to take effect?FollowComment"

Answer: "1Accepted AnswerHi,This change has not yet been enabled in all regions. It is currently enabled in:ap-south-1ap-southeast-1ap-southeast-2ap-northeast-1eu-west-3eu-south-1eu-central-1Additional regions will be enabled this week. You do not need to take any action for this to occur.CommentShareCarl Lewisanswered 2 months agoAshiqur-Rahman 2 months agoMakes sense, Thank you.Share"