Question: Download and access Sagemaker algorithm containers

"I currently work with AWS Sagemaker and try to pull prebuild images from ECR.However, I ran into issues while pulling some images, and others worked.I successfully logged into the corresponding accounts ECR repo.E.g., I can pull the following image without issues:683313688378.dkr.ecr.us-east-1.amazonaws.com/sagemaker-scikit-learn:0.23-1-cpu-py3And I run into the following issue with the next image:docker pull 382416733822.dkr.ecr.us-east-1.amazonaws.com/pca:1Error response from daemon: pull access denied for 382416733822.dkr.ecr.us-east-1.amazonaws.com/pca, repository does not exist or may require 'docker login': denied: User: XXXXXXXXXX is not authorized to perform: ecr:BatchGetImage on resource: arn:aws:ecr:us-east-1:382416733822:repository/pca because no resource-based policy allows the ecr:BatchGetImage actionIt seems like the resource based policy denies access.Is it not intended to download e.g. the PCA container image?FollowComment"

Answer: "0Hello, 1P Built-algorithm containers such as PCA are not publicly available and that is why you cannot pull it. The same would apply to LInear Leaner or BlazingText containers. Hope that answers your questionCommentShareChristian_Kanswered 17 days ago"


Question: How long can items in AWS Backup be retained for?

"It  never mentioned on their docs or faq or etc, we need to save the EC2's and associated EBS blocks for at least 7 years. We were thinking of storing the AMI in a S3 but AWS Backup is more simple, but I cant find if it can support that length of time. No answer on here https://aws.amazon.com/backup/faqs/FollowComment"

Answer: "0"AWS Backup can retain snapshots between 1 day and 100 years (or indefinitely, if you do not enter a retention period), and continuous backups between 1 and 35 days."This is what shows up under the "Retention period" info/description page in the Backup console when creating an AWS Backup plan.Additionally, the AWS Backup docs say this:"Snapshot backups can be taken as frequently as every hour. Snapshot backups can be stored for up to a maximum of 100 years. Snapshots can by copied for full or incremental backups."Source: https://docs.aws.amazon.com/aws-backup/latest/devguide/point-in-time-recovery.htmlIf you're planning to keep the backup for 7 years and not planning to restore it often, then it's also a good idea to make use of lifecycle policies in the AWS Backup plan to move those backups to cold storage so you save on backup costs :) Best practice says to move the backups to cold storage after 8 days:"If you want your backups to be incremental, you must have at least one warm backup. Because each backup to cold storage is a full backup, AWS Backup recommends that you set your lifecycle settings to not move your backup to cold storage until after at least 8 days."Source: https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup-plan.htmlCommentShareKrishnaanswered 7 months ago"


Question: Client API Throttling in API Gateway

"Customer that is looking to implement throttling on their APIs exposed via API Gateway and would like to know if that throttling occurs before invocation of a Lambda custom authorizer, which they are also implementing.FollowComment"

Answer: "0Accepted AnswerThere are different types of rate limiting that can be applied on API Gateway. The different types of rate limiting can be found on this security whitepaper on page 11.https://d1.awsstatic.com/whitepapers/api-gateway-security.pdf?svrd_sip6If the rate limiting leverages usage plans with an API key (the apiKeySource is set to AUTHORIZER) then the Lambda Authorizer needs to be invoked since the Lambda Authorizer function must return usage plan's API keys as the usageIdentifierKey property value. See link below:https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-lambda-authorizer-output.htmlIf the rate limiting is enforced by API setting on the resource/method then the custom authorizer does not need to get invoked.If any of the limits are exceeded for the rate limit, Amazon API Gateway blocks the request and returns a 429 Too Many Requests error response to the client. Client logic or SDKs should be configured to retry such errors, although with increasing back off intervals upon repeat failures of the same type.CommentShareMODERATORAWS-User-0569570answered 2 years ago"


Question: Please Erase

"Please EraseEdited by: alejandroi on Dec 4, 2020 9:54 AMFollowComment"

Answer: 0Please EraseCommentSharealejandroianswered 2 years ago


Question: "Greengrass V2 Deployment Stuck In Progress, Remote Device"

"We have a remote device, which we cannot access physically, so we cannot view the logs, and I have some questions about debugging steps.Issue Description:Component deployed with Greengrass 2.5.6Deployment (updating to 2.7.0) stalled and not progressing for hours.Component is connected to AWS IoT, reports Healthy and ConnectedDeployment Details:Single device deployment, lists as 'in-progress'Deployment does not show under Remote Actions -> Jobs. I can see other in-progress greengrass deployments under Jobs, but not that deployment.Question - is the deployment not showing up under 'Jobs' normal ? At what stage of the process should the deployment be visible under jobs ? Is this indicative of an issue where the deployment is not actually reaching the edge device itself ?FollowCommentMassimilianoAWS EXPERT10 months agoWhat is the connection throughput of the device? The Greengrass Nucleus package is about 36 MB and it might take a while to download on slow connections.Share"

Answer: "1Hi, it is indeed normal that single device deployments do not show up under Remote Action | Jobs since deployments targeted to single devices do not use AWS IoT Jobs. To check if the deployment has been received by the device you can navigate to Core Devices | <your device>, click on the Thing link and then select the Device Shadows tab. You should have a device shadow called AWSManagedGreengrassV2Deployment. The content of this device shadow will reflect the current status of your deployment.If the deployment has not yet received the device you should only have a "desired" and "delta" nodes in the document.If the deployment has reached the device and the device reported back you should also have a "reported" node with some information reported by the device, including the "status".Finally, if the deployment has completed successfully, you should have a "reported" status with "status": "SUCCEEDED".CommentShareEXPERTMassimilianoAWSanswered 10 months agoAWS-User-9962534 10 months agoThanks for the explanation.The device shadow does contain a "reported" node with a "status" key:"reported": {      "ggcVersion": "2.5.6",      "fleetConfigurationArnForStatus": "arn:aws:greengrass:<region><id>:configuration:thing/<thing-name>:7",      "statusDetails": {},      "status": "IN_PROGRESS"    }it remains this way for over 24 hours, unless I cancel the deployment. Are there any more remote debug steps I can take ? I do not have access to the logs on the device.Share0Hi. Unlike a Thing group deployment, a single Thing deployment doesn't use jobs. It instead uses shadows. If you look at the shadows for the Thing associated with the Greengrass core device, you'll see the AWSManagedGreengrassV2Deployment shadow.By the way, to help with remote debugging in future, you might consider the Log manager component:https://docs.aws.amazon.com/greengrass/v2/developerguide/monitor-logs.html#enable-cloudwatch-logshttps://docs.aws.amazon.com/greengrass/v2/developerguide/log-manager-component.htmlCommentShareEXPERTGreg_Banswered 10 months ago"


Question: "Is it possible in AWS to monitor my email and whenever an email is received, save any email attachments on that email to S3?"

"The main 3 questions I want to get out of this are:Is this possible?Is this reliable long-term?If the above are true, how do I set it up?As the title shows, I want to monitor my email address. I have a 365 Outlook account which is hosted on Microsoft Exchange. Whenever an email is received, I want to store the attachment of the email into S3 so that I can pass it to AWS Textract using Lambda.If this is not possible, I would like to store the entire email in S3 and then use Lambda to parse for the attachment information and send that to AWS Textract.From AWS documentation, I have assumed I will use AWS SES, but am unsure. WorkMail does not sound like the correct service for this.I would like some reassurance on if this is a reliable way to get email attachments or if this is even the right service to do this on or if I am better off using a third-party source.Thank you in advance for anyone who can help with this, I really appreciate it.FollowComment"

Answer: "0I believe it is possible to store emails received by Amazon SES in S3.This can be done using the methods described below.https://repost.aws/knowledge-center/ses-receive-inbound-emailsCommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-2682515 2 months agoThank you for the response!Ok, so it seems that works for storing all incoming emails. However, does this work for storing only email attachments or does the entire email have to be saved?And if you cannot store email attachments directly, how would one pull the email attachments out of the S3 bucket object? This use case does not work for me unless I can programmatically send the attachments to Textract.ShareRiku_Kobayashi EXPERT2 months agoSave all e-mails to S3.The following blog is in Japanese but matches what you want to do.https://dev.classmethod.jp/articles/ses-get-attachfile-lambda/Share"


Question: To access Grafana via DNS on EKS cluster

"Hi AWS,I have installed Grafana on EKS cluster via Helm. I need to add ingress to it so that I can access Grafana via DNS. Please provide me any link for the AWS blog post or steps to perform the same.ThanksArjun GoelFollowComment"

Answer: "0Hi Arjun,TL;DR: you have to choose an Ingress technology first. This should be a decision that you (or your team) make and most of them will work on EKS as EKS is a Kubernetes cluster just like any other. You can find some options here https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/Keep in mind that Ingress is not the only option when it comes to exposing applications in a Kubernetes cluster. You can see other ways here https://kubernetes.io/docs/tutorials/kubernetes-basics/expose/expose-intro/If you want something more AWS specific this may help https://aws.amazon.com/premiumsupport/knowledge-center/eks-kubernetes-services-cluster/CommentSharefercunhaanswered 5 months ago"


Question: How to deal with shadow updates initated by device not and server

"We are developing an IoT Device that can changes states based on Shadow Updates initiated by our app. But the device can also change states based on internal/local events.our design is:Device subscribes to shadow delta: $aws/things/max1/shadow/update/deltaDevice publishes to shadow update $aws/things/max1/shadow/updateServer request device changes publishing to device shadow: $aws/things/max1/shadow/updateThis works well for server-initiated requests.But if the device initiates a change, publishes the state update, he will get the DELTA of the previously requested server state. And this is not desired by us.Example:Server: activateDevice: activateDevice: stand-byShadow delta: Activate <-- undesiredHow can we do a better design here?FollowComment"

Answer: "1A /delta message will be published immediately whenever there's a mismatch between values of a field that is present in both the desired and reported properties of the shadow document. If you keep your current shadow design, the way you could prevent that additional /delta message is by removing the desired property from the document when the device publishes the /update.https://docs.aws.amazon.com/iot/latest/developerguide/device-shadow-document.html#device-shadow-empty-fieldsIf an update causes the desired or reported properties to become null, it is removed from the document. The following shows how to remove the desired property by setting it to null. You might do this when a device updates its state, for example.{     "state": {        "reported": {            "color": "red"         },         "desired": null     } }You can also remove individual fields rather than the whole property.https://docs.aws.amazon.com/iot/latest/developerguide/device-shadow-data-flow.htmlThe device or client publishes a $aws/things/thingName/shadow/name/shadowName/update request topic with a state document that assigns null values to the properties of the shadow to delete. Only the properties to change need to be included in the document. This is an example of a document that deletes the engine property.{  "state": {    "desired": {      "engine": null    }  }}More generally though, I would recommend you consider to separate your up from your down so to speak. Separate status from command/control.https://docs.aws.amazon.com/iot/latest/developerguide/device-shadow-document.html#delta-stateFields that are in the reported section and not in the desired section are not included in the delta.Because of the above, if you separate status and command/control, you will never get the unwanted delta. ie. Where possible, do not have the device independently modify fields in the reported property if those fields (can) appear in the desired property. This separation won't always be convenient.At scale, you can take advantage of named shadows: have one (or more) shadow for purely reporting device status and one (or more) shadow to handle command and control from app or cloud. In this way, the status shadow document would never have desired or delta properties. The device would just report status by updating the reported property.CommentShareEXPERTGreg_Banswered a year agotom-iot a year agoHi GregThanks for the quick and detailed reply, looks like I cannot format the reply to your comment here unfortunately.So if we want to keep the Delta functionality, it seems like our best option is option 1, setting the desired variable to 'null' after the request was met by the device. The settings of the variable to 'null' should be done by the server, if the request was met. Perhaps this can even be done by a function programmed into aws iot core rule engine? To be honest this should be a built-in feature to Shadows if you ask me, since without it, the delta feature is incomplete for any use-case where the device can change states independently of the server (based on built-in sensors or intervals for example).But perhaps I am missing something about using currentState and reportedState? The server updates the shadow with desiredState, the devices will change and update the shadow with reportedState and desiredState? And then the device can update just reportedState if it was self-triggered? I guess this will work and nullify the need to nullify the desiredState parameter :)Finally, if we switch to named shadows, device subscribes to downlinkShadow and publishes to uplinkShadow  but then Delta won't work? Or like in example A, device will update downlinkShadow with confirmation after request was met? Similar to option 2, just maybe neater?Looking forward to continuing the discussion with you on this.RegardsShareGreg_B EXPERTa year agoHi Tom.It seems I didn't explain myself very well. I've edited the answer to try to improve clarity.The setting to null needs to be done by the device. Not the server. Else you will still get the unwanted delta.In regards to named/multiple shadows, each shadow can have its own desired and delta properties. So the "downlinkShadow" would/could still use desired and delta properties for command/control/configuration. The device would still publish to the "downlinkShadow" but only to acknowledge that it applied the delta.Share0Hi Tom,the device should only report it's state:when starting up/reconnecting andwhen a local action is changing its state (say a local switch turning on/off a lamp).When starting up/reconnecting, the device reports the actual state, in the reported section. If it receives a delta, that indicates that the server has requested a different state while the device was offline, hence the device should update its state and report it.When a local action is changing the state, the device should update both the desired and reported state, either by setting the desired state equal to the reported state, or to null in case you want to differentiate between server set state and device set state.CommentShareEXPERTMassimilianoAWSanswered 8 months ago"


Question: dynamodb pagination

"i try to use pagination. but how can i control if querystring parameters changes or do i have to control?there is sentence here: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Query.Pagination.htmlthat says: "Construct a new Query request, with the same parameters as the previous one" at step 2.maybe i don't have to control query string parameters but at least page parameter will change for every api call.if i have to check querystring parameters how?FollowComment"

Answer: "1querystring parameters changes or do i have to controlIm not sure on which querystring params you are referring to but pagination works like this:Request up to 1MB of dataDynamoDB returns 1MB and provides you with a LastEvaluatedKey which is a pointer to the last item it readIn subsequent requests, you pass LastEvaluatedKey to the ExclusiveStartKey parameter, which tells DynamoDB where to begin readingThis logic keeps happening until there is no LastEvaluatedKey returned, which means you have read all the data available.CommentShareEXPERTLeeroy Hannigananswered 2 months ago"


Question: Workaround after removal of vendored version of botocore

"Customer uses botocore.vendored that are impacted by the upcoming changes:https://aws.amazon.com/blogs/developer/removing-the-vendored-version-of-requests-from-botocore/In their words:The main problem is that when using python in a Lambda, you were not able to import requests, hence us using botocore.vendored.Do you know how to use requests now when in a Lambda function?FollowComment"

Answer: "0Accepted AnswerYou can create a Lambda Layer for the requests library:https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.htmlor you can include your dependencies within your Lambda artifact upon upload, which would look something like:https://docs.aws.amazon.com/lambda/latest/dg/lambda-python-how-to-create-deployment-package.html#python-package-dependenciesIn the second route, you would just include the version of requests in the requirement file before you run pip.CommentShareAWS-User-2274324answered 4 years ago"


Question: Water Gem

"Hey,I might be missing something but, i cant seem to get the water gem to work. I have enabled it and compiled the game, but its not showing up in the editor. I want to use it to create an inf ocean. Anyone have any suggestions?Follow"

Answer: "0Accepted AnswerThere should be a "Gem.Water.Editor.<blabla>.dll" in the directory where you start the editor.In the editor it should show up under "add component"->Environment->Infinite ocean.SharerePost-User-7836246answered 5 years ago0In the projectconfigurator make sure that your project is selected as the default project.If you're building using visual studio, run "lmbr_waf.bat show_option_dialog" and check in Visual Studio Project Generator tab generate_vs_projects_automatically. This will regenerate your solution file in the dir solutions.run lmbr_waf.bat configureThen either open the solution file and build using visual studio (change for now debug to profile to test it) or runlmbr_waf.bat build_win_x64_vs2015_profile(assuming 64bit and vs2015)the binaries should be in the directory: bin64vc140For debug builds change "profile" to "debug" and the final dir is bin64vc140.debugSharerePost-User-7836246answered 5 years ago0I dont seem to have that file. I have the Gem file that shows all the ones enabled in the project. I also dont seem to have the option listed below. This is with the newest version currect?SharerePost-User-1354821answered 5 years ago0I have done the steps above all over again as i did them already before imade this thread. Its the same as before. its enabled and shows in advanced settings and there is the file there but still unable to add and no option to add in the editor.SharerePost-User-1354821answered 5 years ago"


Question: How do I update materials?

"So I have a function that sets up a material:    IMaterial* DynamicUITextureComponent::SetupNewMaterial(){AZStd::string materialName = "EntMat_" + GetEntityId().ToString();IMaterialManager* matManager = GetIEditor()->Get3DEngine()->GetMaterialManager();IMaterial* material{ matManager->CloneMaterial(matManager->GetDefaultMaterial())};material->SetName(materialName.c_str());material->GetShaderItem().m_pShaderResources->GetTexture(0)->m_Name = m_renderTargetName.c_str();return material;}and after that function, the returning material is set as the entities material:    m_UIMaterial = SetupNewMaterial();EBUS_EVENT_ID(id, LmbrCentral::MaterialRequestBus, SetMaterial, m_UIMaterial);But this only shows the default material and not my render target I actually want to display.If I check the render target viar_ShowRenderTarget RENDERTARGETNAMEI am able to see the texture.Also if I write the targets name directly into the material (in material editor) it works, so I ran confirm, that this should work at run time in theory.Whats missing is sort of an update to my changes after creating the material.Follow"

Answer: "0Accepted AnswerTry this:    IMaterial* DynamicUITextureComponent::SetupNewMaterial(){AZStd::string materialName = "EntMat_" + GetEntityId().ToString();IMaterialManager* matManager = GetIEditor()->Get3DEngine()->GetMaterialManager();IMaterial* material{ matManager->CloneMaterial(matManager->GetDefaultMaterial()) };material->SetName(materialName.c_str());SInputShaderResources inputShaderResources{ material->GetShaderItem().m_pShaderResources };inputShaderResources.m_Textures[EFTT_DIFFUSE].m_Name = m_renderTargetName.c_str();material->AssignShaderItem(gEnv->pRenderer->EF_LoadShaderItem("Illum", true, 0, &inputShaderResources));return material;}SharerePost-User-5460328answered 6 years ago0Thanks, that worked!SharerePost-User-5460328answered 6 years ago0Np, I gotcha, bro!SharerePost-User-5460328answered 6 years ago"


Question: How do you reduce Vegetation Draw Calls?

"I am using the vegetation painter and using the same vegetation pieces over and over again, about 16 pieces in total.What I do not understand is, how come the engine uses multiple draw calls to keep drawing the same vegetation object as well as shadow objects? Aren't the objects instanced? The more vegetation I put down, even though it is the same 16 objects which should be instanced, the more draw calls the engine makes.How do I reduce draw calls on instanced objects? Anyone know? There's obviously something here in terms of optimization I am overlooking.Thanks.Follow"

Answer: "0Accepted AnswerGood morning!I am one of the Technical Artists on the Lumberyard Support team. I was just looking through your post and wanted to try and assist!When using vegetation they are all considered separate objects, unless you actually merge them! To get that draw call count down try using the "AutoMerged" parameter in the Vegetation menu. This will take all of the objects you painted in each stroke and merge them in to one object. I included some examples below:Without "AutoMerged" On:REMOVEDUPLOADWith "AutoMerged" On:REMOVEDUPLOADI hope this helps!-MajorBlissSharerePost-User-4093265answered 6 years ago0Thank you! I did not know what auto-merge did so I did not use it. This helps out a lot.SharerePost-User-4975070answered 6 years ago0No problem, glad to help!SharerePost-User-4093265answered 6 years ago"


Question: Change Aurora PostgreSQL timezone

"I need to change the default timezone of AWS Aurora PostgreSQL cluster from UTC to CST. We can change it by creating a custom cluster parameter group and then use it in the cluster.Now my question is what will happen during daylight savings? Will there be any impact of daylight savings to the DB cluster? Do we need to make any change regarding daylight savings in the cluster, instance? Do we need to reboot the cluster?Please suggest.FollowComment"

Answer: "0You are correct, a parameter group is the correct way to change the timezone. More information here: https://aws.amazon.com/premiumsupport/knowledge-center/aurora-mysql-change-timezone/However, it’s a best practice to use the UTC time zone at the database layer. Because UTC doesn't observe daylight savings (DST), you don’t have to adjust the time later when it shifts.If you must use a local time zone, convert the time zone at the application layer instead. Before changing your time zone, consult your database administrator or application team.Please also refer to this link for more information on changing the timezone setting: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Concepts.RegionsAndAvailabilityZones.html#Aurora.Overview.LocalTimeZoneAfter you set the local time zone, all new connections to the database reflect the change. In some cases, you might have open connections to your database when you change the local time zone. If so, you don't see the local time zone update until after you close the connection and open a new connection.Hope it helps,JonCommentShareEXPERTJonathan_Danswered 3 months agovneekhra 3 months agoHello Jon,I have changed it to US/Central and it is working as expected. Also it seems whenever daylight savings starts or ends, there should be no impact on the timezone because the value is US/Central and not anything related to UTC-06 or UTC-05 or CST or CDT. Whatever be the current time it will show that, after daylight savings starts or ends. What do you suggest?ShareJonathan_D EXPERT3 months agoI still suggest storing the data in UTC to avoid possible confusions and do the conversion at the app layer if possible.It appears Postgresql uses the IANA/Olson timezone database to automatically apply daylight saving time at any given date and store this data in an internal table: https://www.postgresql.org/docs/current/view-pg-timezone-names.html. This means that a specific datetime may have two offsets. Please have a look at this documentation for more information: https://www.postgresql.org/docs/15/datatype-datetime.html#DATATYPE-TIMEZONESAlso please accept this answer if that helped you!ThanksShare"


Question: ApplicationLoadBalancedFargateService with listener on one port and health check on another fails health check

"Hi, I have an ApplicationLoadBalancedFargateService that exposes a service on one port, but the health check runs on another.  Unfortunately, the target fails health check and terminates the task.  Here's a snippet of my code    const hostPort = 5701;    const healthCheckPort = 8080;    taskDefinition.addContainer(stackPrefix + 'Container', {      image: ecs.ContainerImage.fromRegistry('hazelcast/hazelcast:3.12.6'),      environment : {        'JAVA_OPTS': `-Dhazelcast.local.publicAddress=localhost:${hostPort} -Dhazelcast.rest.enabled=true`,         'LOGGING_LEVEL':'DEBUG',        'PROMETHEUS_PORT': `${healthCheckPort}`},        portMappings: [{containerPort : hostPort, hostPort: hostPort},{containerPort : healthCheckPort, hostPort: healthCheckPort}],        logging: ecs.LogDriver.awsLogs({streamPrefix: stackPrefix, logRetention: logs.RetentionDays.ONE_DAY}),    });    const loadBalancedFargateService = new ecsPatterns.ApplicationLoadBalancedFargateService(this, stackPrefix + 'Service', {      cluster,      publicLoadBalancer : false,      desiredCount: 1,      listenerPort: hostPort,      taskDefinition: taskDefinition,      securityGroups : [fargateServiceSecurityGroup],      domainName : env.getPrefixedRoute53(stackName),      domainZone : env.getDomainZone(),    });    loadBalancedFargateService.targetGroup.configureHealthCheck({      path: "/metrics",       port: healthCheckPort.toString(),      timeout: cdk.Duration.seconds(15),        interval: cdk.Duration.seconds(30),      healthyThresholdCount: 2,      unhealthyThresholdCount: 5,      healthyHttpCodes: '200-299'    });Any suggestions on how I can get this to work?  thanksFollowComment"

Answer: "0Hello there,Looking into your code, a few things I noticed:For Fagete Service, there is no need to define host port, since the host port and the container port should be the same.You should use taskImageOptions tp define container portHere is an example code snippet:    const service = new EcsPatterns.ApplicationLoadBalancedFargateService(this, 'demoService', {      cluster: cluster,      publicLoadBalancer: true,      certificate,      memoryLimitMiB: 2048,      cpu: 512,      desiredCount: 2,      serviceName: 'demoService',      taskImageOptions: {        containerName: 'web',        containerPort: 8080,   // Your container or app port        executionRole,        taskRole,        environment: {          ...        },        image: ecs.ContainerImage.fromEcrRepository(repository),        logDriver: new ecs.AwsLogDriver({          logGroup,          streamPrefix: props.serviceName,        }),      },    })    service.targetGroup.configureHealthCheck({      path: '/v1/healthcheck',    })With above example, ApplicationLoadBalancedFargateService configures health check against container port 8080, but with a different path /v1/healthcheck as per overriding.CommentShareSUPPORT ENGINEERZhiyuan_Lanswered a year ago"


Question: "Can't SSH into EC2, HTTP Not Working"

"I don't even really know where to start.  I have an t2.small instance with like a LAMP stack that I've been happily running for years and today the web sites are unreachable and I can't SSH in.  All AWS console information looks like everything is in order and I've rebooted a bunch.  Pinging the IP times out. I can't make any sense of the system log and I feel like I'm in way over my head now.  Where can I even get help, here?FollowCommentrePost-User-5857843 2 months agoCreated a new instance and still no connectivity, is it something with my account/billing?  I've been down for many hours now, this is the first time I've had any sort of outage in 7 years other than reboot time.Share"

Answer: "0Note: Answering this question assuming your security group has port 22 inbound traffic allowed from your source IP.Do you have SSM agent installed/enabled on your instance? If yes try connecting using it. Below is the guide if you need help connecting via SSM. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/session-manager.htmlAlso if you think you lost the key you can try couple of methods to get into system. I found a nice re:Post article explaining the same which should be able to get you in to your system via SSH.Try this: https://repost.aws/knowledge-center/user-data-replace-key-pair-ec2CommentShareJyotir Ravalanswered 2 months agorePost-User-5857843 2 months agoThanks for the reply.  SSM isn't installed.  Port 22 is open to my IP and as I mentioned before I can't ping the IP so it's probably disconnected from any network.   I've been logging in with my key pretty frequently so I know where that is and what it is.My main problem is that I set this up so long ago with the absolute minimum knowledge of how it works and I think I've just been lucky.Like do I just make another instance and point it to the filestore and point the elastic ip to the instance?SharerePost-User-5857843 2 months agoI mean not everything looks normal, something went screwy with my CPU today when this all went sidewayshttps://kunamakst.s3.us-west-2.amazonaws.com/wp-content/uploads/ScreenRegion_230407_185623.pngShare0Could it be that the boot volume has run out of space? That can cause all kinds of havoc. If so, you could detach the root volume and attach to a working instance and expand the volume and file system. Then reattach the expanded volume to the broken instance.Also, if you are over your head on this you may want to consider using AWS IQ to get some help.Also, take a snapshot of the instance's volume(s) so you can go back to a known state.Open up an Account and billing case with AWS support and make sure your account was not isolated in some way.CommentShareEXPERTkentradanswered 2 months agorePost-User-5857843 2 months agoUnlikely to be full, I expanded it to many GB beyond what I was using. I created another instance that I cannot access either so expanding anything still won’t work if I can’t connect to anythingShare"


Question: Use data field as dynamic or static title

"Hi,Is there a way to use the contents of a specific field in timestream data for the title of a visualization scatter graph in quicksight?ThanksMikeFollowComment"

Answer: "0Accepted AnswerHello Mike,Thank you for reaching out to AWS.Please follow below steps to achieve the use-case you are looking for :-On the right corner of the analysis go to -> Settings -> It will open "Format Visual" panel in the lift side . Here you can see "Edit Title" option under "Title".If you create a parameter with the required filed (which you would like to add in the title), then you can click on "Edit Title" and add this parameter to the title . This will display the values of the parameter (instead of the column name).I hope you find this information helpful.CommentSharePriyaAWS2020answered a year agoAWS-User-6540243 a year agoHi, thank you for the response.  I have added parameters before and linked them to the title.. however they never actually show whats in the field only the default value that I first set the parameter too.  Is there something I am doing wrong?Share"


Question: Removing Domain Verification Record after verification in SES

"Hello,A customer is asking about whether is it possible to remove the TXT record from their domain once the domain verification process for SES has finished.They mention an [answer from the AWS Forums][1] indicating that they shouldn't. If so, they'd like to know what's the technical reason for it.Thanks![1]: https://forums.aws.amazon.com/thread.jspa?threadID=243741&tstart=0FollowComment"

Answer: "0Accepted AnswerThey shouldn't remove the TXT record as the process of having the domain verified runs periodically. Unfortunately, they should keep the TXT record all the time.The reason is basically that AWS need to know that customer is still owner of the domain.In this public documentation: http://docs.aws.amazon.com/ses/latest/DeveloperGuide/verified-domain-revocation.html We state:"Amazon SES periodically reviews domain verification status, and revokes verification in cases where it is no longer valid. If Amazon SES is unable to detect the TXT record information required to confirm ownership of a domain, you will receive an Amazon SES Domain Verification REVOCATION WARNING email from Amazon SES."CommentShareEXPERTJPanswered 6 years agoEXPERTsedat_salmanreviewed 13 days ago"


Question: Guided Experience - custom view

"When I customize a view (in this case, the CARD view), the changes do not persist. I modified last night and this morning the default template is there, with none of my changes. I cannot find a way in the console to create a new view.FollowComment"

Answer: 1Accepted AnswerViews today are created in the contact flow.  The view designer is a tool to help visually design the view and provide reference JSON that can be transferred into the contact flow.CommentSharegthomasanswered 24 days ago


Question: Automate sending emails with attachments when file in S3 is updated?

"I have a file in my S3 bucket that is updated daily and I want to automate sending that file as an email attachment whenever it gets updated, using SES. There are some guides that explain this but I have not been able to get any of them to work and I do not know how to code. I have followed the guides in the two links below and am able to automate sending an email when the S3 file is updated but cannot figure out how to include an attachment. Hoping someone can advise what JSON code I can use to make this work. If there are multiple steps involved I will need it in layman's terms because again, I do not know how to code.https://docs.aws.amazon.com/lambda/latest/dg/with-s3-example.htmlhttps://repost.aws/knowledge-center/lambda-send-email-sesFollowComment"

Answer: "1You can't do this without some coding.You'd need to use the raw email API instead, see https://docs.aws.amazon.com/ses/latest/dg/send-email-raw.html.This will require you to write some code to read the file from S3, and create the message.If you are OK with sending a link to the file instead of attaching it, it might be easier to generate a presigned URL (https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html) and putting that in the message text.CommentShareShahar Mosekanswered 2 months agorePost-User-5731080 2 months agoThanks for your reply. In my particular use case it has to be an attachment, so the second link won't work for me. The first link gives really vague guidance on how to include attachments, perhaps it would make sense to a software developer but I wouldn't know how to build this code myself. Ultimately I'm looking for a guide more like what the second person responded with but I tried that yesterday and didn't work.Share0Here is a good example on how to use Lambda Functions to send attachments in email using SES:https://mrrishisingh.medium.com/email-s3-objects-as-attachment-7a534e78601cAlthough I agree with the previous answer that it is easier and more elegant to just send the pre-signed URL in the email body because the recipient(s) will not have to use the extra bandwidth to download the file that comes with the attachment in the email.This will also have impacts on the costs since sending attachments will incur $0.12 for each GB of attachments you send vs $0.0004 per 1,000 GET Requests directly from S3 plus the data Transfer Out at $0.09 per GBCommentShareNuno_Qanswered 2 months agorePost-User-5731080 2 months agoThanks for your reply. I did try this link yesterday and definitely feel like I followed all the steps as outlined but it didn't work. Perhaps I didn't update the code correctly but I figure I just need to update at the top where it says "sender = abc@abc.com" to the correct email as well as update the two rows below that: recipient and region.Share"


Question: How to access a DynamoDB table from Spark SQL?

"[https://docs.aws.amazon.com/emr/latest/EMR-Serverless-UserGuide/using-ddb-connector.html#using-ddb-connector-query](This doc page) describes connecting to dynamodb from spark, however it is incomplete.In particular, I want to know aboutval dataFrame = sparkSession.sql("SELECT DISTINCT feature_class \    FROM ddb_features \    ORDER BY feature_class;")Where is ddb_features configured to point to the Features table in DynamoDB? Also, what library do I need to pull in?FollowComment"


Question: Domain not connecting

"Hi guys,I've created a Zone on Route 53 placing my elastic IP and on my registrar the 4 NS that was there but after more than a day it's still not connecting. Any advice?Image https://photos.app.goo.gl/eY1BPznTojUTdeXJ6On my security group inbound I have the 5 permissions and 1 on outbound (the ones with 0's"FollowComment"

Answer: "0Hi,I understand that you  are unable connect to your domain.Please perform a nslookup or dig to confirm is your domain is resolving to an IP address$ nslookup domainNameIf the domain resolves to the an IP address then the issue is related to connecting to the IP and not DNSAs a workaround please see the attached document [1] to troubleshoot the issue.You can do a whois lookup, this is to identify that your domain registrar has updated the name server you have provided.I hope this helpsResources:-[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/troubleshooting-domain-unavailable.htmlCommentShareAsisiphoanswered a year agorePost-User-2160957 a year agoHi, I got this:Server:         172.31.0.[PRIVATE]Address:        172.31.0.[PRIVATE]#53Non-authoritative answer:Name:   xxxx.com.brAddress: 3.12.91.[ELASTIC IP]Still not working...Share"


Question: Recommended testing tool/software/solution for application's latency

"I have a customer asking whether there is a recommended tool/software/solution for their application running on AWS. The customer is going to expose their application/APIs to their end users (B2B) across regions and has concern about network latency, inter-AWS services latency, and their own application latency. My own experience with Jmeter, soapUI and cloudwatch/x-ray was working for me, but I am wondering whether there are better solutions out there.Appreciate your sharing.FollowComment"

Answer: "0Accepted AnswerFrom the user perspective, load tests tools like JMeter, Gatling and DLT  can give latency metrics.CloudWatch metrics for CloudFront and ELB also provides good insights regarding latency, but for Inter-Services it's probably best to have a APM (Dynatrace, AppDynamics) and/or a tracing solution, like X-Ray or Zipkin.CommentShareEXPERTJairo_Janswered 3 years ago"


Question: AWS Device Farm physical device: Can I upgrade chrome version from "default"?

"When testing my app on an AWS Device Farm physical device via automation, is it possible to upgrade the version of chrome it comes with by default?For example when using an Android 8 device, the default version of chrome is a few upgrades behind. It would be very useful to be able to upgrade chrome therefore to the version that current Android 8 users will be using.If not possible on a "public" device, is this possible with a "private" one?FollowComment"

Answer: "0If it's your private device, you can install and update different apps except for system apps. Chrome being a part of the system's bundle meaning you cannot upgrade it. My suggestion would be to use a newer version Android to get the latest version of ChromeCommentShareAWS-User-5934004answered a year ago"


Question: AWS WAF is blocking CloudWatch's Synthetic Canary

"Hello,Is anyone else having issues with the Synthetic Canaries being blocked by the AWS WAF Managed Rules' AWSManagedIPReputationList and/or AWSManagedReconnaissanceList?Is there a way to let the WAF know that those requests are safe?Right now my approach has been to whitelist the public IP of the request (but this IP is dynamic os it won't last long) or set to count those rules but then I'm leaving a little bit open the site.Thanks for you comments.Regards.FollowComment"

Answer: "2One option you have is to configure your Canary to use a specific request header or cookie, then look for the presence of that in a custom WAF rule. You could either allow the traffic and not process any other rules, or you could add a label, which you could then use in a scope-down statement to bypass the rule(s) that are currently blocking your CanaryCommentSharePaul_Lanswered a year agoHigher a year agoThanks for the reply.By any change do you have an example of how to insert a custom header in the Canary code, I have very little knowledge of NodeJS.Kind Regards.Share"


Question: Obtaining prior versions of the Well Architected Framework

"I need to understand the differences between the December 2021 and December 2022 versions of the framework but I can't find a link to a prior version in PDF or HTML.Anyone could help?Thanks in advance,FollowComment"

Answer: "0Hi, here is the history of changes on the Well Architected Framework : https://docs.aws.amazon.com/wellarchitected/latest/framework/document-revisions.htmlTo point out specifically,The below definition of level of efforts is added and also called out in each of the steps" The level of effort is categorizing the amount of time, effort, and complexity a task requires forimplementation. Each organization needs to consider the size and expertise of the team and thecomplexity of the workload for additional context to properly categorize the level of effort for theorganization.• High: The work might take multiple weeks or multiple months. This could be broken out intomultiple stories, releases, and tasks.• Medium: The work might take multiple days or multiple weeks. This could be broken out intomultiple releases and tasks.• Low: The work might take multiple hours or multiple days. This could be broken out into multipletasks. "The recommendations and best practices have been updated inline with a risk rating. These are on appendix.There are no major changes on this version, but we recommend picking up the latest version and also use the Well Architected tool for reviewing the architecture - https://docs.aws.amazon.com/wellarchitected/latest/userguide/intro.htmlCommentShareArunanswered 5 months ago0Hi ThereIf you know the previous version number, you can use the CLISee https://awscli.amazonaws.com/v2/documentation/api/latest/reference/wellarchitected/get-lens-version-difference.htmlex:aws wellarchitected get-lens-version-difference --lens-alias arn:aws:wellarchitected::aws:lens/wellarchitected --base-lens-version <version>CommentShareEXPERTMatt-Banswered 5 months ago"


Question: How to stream AWS DeepLens video to a website?

I am building a web app to display aggregate and analytics results of a DeepLens-hosted model. I also want to display the live stream from DeepLens on the website. What would be the simplest way to do this?FollowComment

Answer: "0Accepted AnswerAmazon Kinesis Video Streams for AWS DeepLens Video library is a Python module that should meet your needs, bandwidth is always something to be consider. You can find the integration documentation here:https://docs.aws.amazon.com/deeplens/latest/dg/deeplens-kinesis-video-streams-api.htmlYou can also find example of reading the Amazon Kinesis Video Streams HLS Output Streams here: https://aws.amazon.com/blogs/aws/amazon-kinesis-video-streams-adds-support-for-hls-output-streams/CommentSharePaul_Aanswered 4 years ago"


Question: Beginner cannot get root access to the AWS Command Line Interface

"Hello Forum.Question: Can someone show me how to get root user access to the AWS Command Line Interface?I am stuck on Step 3 (Module 3: Setting Up the AWS CLI) of the getting started guide found here:https://aws.amazon.com/getting-started/guides/setup-environment/Here are the steps I have taken:Module 1: Create Your Account.I created an account a few years ago but it has been dormant. I just today decided to learn Amazon AWS.Module 2: Secure Your Account.I went through the steps to secure my account. I secured the root user account. I created an IAM user account for myself. There are now two accounts, the root user (myself) and the user account, also for myself.Module 3: Setting Up the AWS CLI.I downloaded and installed the AWS Command Line Interface. I accessed the AWS CLI from the C prompt on my computer. I configured the credentials to access my AWS account.Here is the problem: I configured the credentials using the IAM user account and not the root user account./* I mistakenly used the credentials for the user instead of the root user below */aws configureAWS Access Key ID [None]: ANOTREALACCESSKEYID AWS Secret Access Key [None]: ANOTREALSECRETACCESSKEYDefault region name [None]: eu-west-1Default output format [None]: jsonNow the AWS CLI will not let me into root user area. It tells me that I do not have permissions for access to that area.I am a beginner. All of this is kind of confusing. I would appreciate any assistance with this matter anyone can provide.Thank you in advance.FollowComment"

Answer: "0Accepted AnswerYou are on the right track. Here's a warning from the AWS documentation at https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html:We strongly recommend that you do not use the root user for your everyday tasks, even the administrative ones. Instead, adhere to the best practice of using the root user only to create your first IAM user. Then securely lock away the root user credentials and use them to perform only a few account and service management tasks. To view the tasks that require you to sign in as the root user, see AWS Tasks That Require Root User. For a tutorial on how to set up an administrator for daily use, see Creating your first IAM admin user and user group.You can give the IAM user the privileges that you need for your learning purposes.CommentShareEXPERTIndranil Banerjee AWSanswered a year agoknox a year agoThank you for responding. I appreciate the information.ShareIndranil Banerjee AWS EXPERTa year agoIf you like my response, can you please "Accept" my answer. ThanksShare"


Question: File corrupted after upload to S3 using Lambda and API Gateway

"Hi people,I am trying upload the file using Lambda to S3 way API GateWay, i am using the code below, the file is sent to S3 such as show the images 'test_using_postman.png' and 's3_file.png', however when I try open, the show message the file corrupted such as show the 'open_file_with_problem.png'. The images are below.Somone know the happened ?Thank you!Images:Test Using Postman: https://drive.google.com/open?id=1eenEnvuMQU28iI_Ltqzpw9OlCvIcY5FgS3 File: https://drive.google.com/open?id=1b1_CmIhzfc8mQj_rwCK6Xy30gzoP6HcKOpen File with problem: https://drive.google.com/open?id=1o54rLB9wWF1KxdUOkq3xAGVET7UWoqgfCode NodeJS: const crypto = require('crypto');var AWS = require('aws-sdk');AWS.config.update({region: 'us-east-1'});module.exports.arquivo_upload =  (event, context, callback) => {    let BUCKET_NAME = 'XXXXX';  let fileContent = event.body;  let filePath = 'upload/';  let fileName = crypto.createHash('md5').update('niby_'+Date.now()).digest("hex");  s3 = new AWS.S3({apiVersion: '2006-03-01'});  var uploadParams = {      Bucket: BUCKET_NAME,       Key: filePath+fileName+'.png',       Body: fileContent,      ContentType: "image/png"    };  s3.upload(uploadParams, function (err, data) {    if (err) {      console.error(err);      callback(null,{        statusCode:400,        body: JSON.stringify(err),      });    } if (data) {      console.info(data.Location);      callback(null,{        statusCode:200,        body: JSON.stringify(data.Location),      });    }  });}Edited by: LeandroBR on Apr 8, 2020 3:49 PMFollowComment"

Answer: "0I resolved this problem! I sending file using base64 to API Gateway and lambda functions setup parameter "ContentEncoding: 'base64'"....buf = new Buffer(obj.content,'base64')  let fileName = crypto.createHash('md5').update(config.application_name+'_'+Date.now()).digest("hex");  s3 = new AWS.S3({apiVersion: config.s3.version});  var uploadParams = {      Bucket: config.s3.bucket_name,       Key: config.s3.file_path+fileName+obj.extension,       Body: buf,      ContentEncoding: 'base64',      *ContentType: obj.content_type,*      ACL: "public-read"    };  s3.upload(uploadParams, function (err, data)...Edited by: LeandroBR on Apr 12, 2020 11:47 AMCommentShareLeandroBRanswered 3 years ago"


Question: Application not loading in Windows Server

I'm trying to run a dedicated server using Windows Server 2019. When I tell the server application to begin it gets stuck on a loading screen and never starts. Any ideas?FollowComment

Answer: "0Hi Automatic,I understand you are trying to run a dedicated Windows Server  2019, server application is stuck at the loading page and does not start. Please correct me if i misunderstood.To further understand the issue with your instance I would recommend taking a screenshot of your instance, using a link[1] below. The potential causes could be OS boot issues or might be with the application, you can use task manager to verify the size of the application or what applications could be using up more CPU. I have included link more information on the common issues and troubleshooting steps click on the link[2].I hope the above information is helpful.Reference links:[1]https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/common-issues.html[2]https://aws.amazon.com/premiumsupport/knowledge-center/ec2rescue-windows-troubleshoot/CommentShareWinnieanswered a year ago"


Question: Issue with SSO user registration

"I have created a user and sent them an invite however when they go to the invite to complete their registration an error occurs. The message is simply "It's not you, it's us - We couldn't complete your request right now. Please try again later".  We tried again later with the same result.  We deleted the original user and recreated it; same result.  Has anyone come across this situation and have an steps for resolution?FollowComment"

Answer: "0Hey there,The exact reason as to 'why' this is happening to you, I cannot say. However, it is very likely that this is due to a configuration which is being applied to the device both you and your user are attempting this action from. I have seen customers report this same error and when they attempt the action on a mobile device (phone or tablet), or another workstation which is not on the corporate network, they are successful.The next step here would be to try this action on another device, removing the corporate network and policies from the equation. You can also capture a .HAR file of the error-causing transaction in-flight and review it to see if there are any errors being returned from AWS endpoints.If you cannot find anything that appears to be the cause, then I would advise on contacting AWS Support for a more thorough investigation of the matter (this will require a HAR file from you, showcasing the error in-flight). If you don't have at least a Support Plan of 'Developer', then you can raise a case against Customer Support and request a once-off in order to have the underlying matter explained.CommentShareCiaran Carragheranswered a year agoAWS-User-4815031 a year agoGood call. I will have them try an alternate device.Share0Do you have checked Troubleshooting steps from AWS Docs?Troubleshooting AWS SSO issueshttps://docs.aws.amazon.com/singlesignon/latest/userguide/troubleshooting.htmlCommentShareBruno Lopesanswered a year ago"


Question: AccessDeniedException when access secretsmanager:GetSecretValue

"Hi AWS Team, I am facing an error when access secrets manager. I already gave access my account to secrets manager. here the detail of error.02-12-2023 03:07:15 PM [Build] (node:437) UnhandledPromiseRejectionWarning: AccessDeniedException: User: arn:aws:sts::397674710086:assumed-role/bullet-system-build-role-5c8717b2af5c41ad8edf3268812503f0/AWSCodeBuild-096e93d0-384f-4a62-8a95-cb784b90908d is not authorized to perform: secretsmanager:GetSecretValue on resource:......kindly please help.Thank you.FollowComment"

Answer: "0Hi Fadholi,You need to make sure that whoever is using SecretsManager (a lambda, an ec2, an IAM user, etc..), must have a policy allowing the GetSecretValue action.https://docs.aws.amazon.com/mediaconnect/latest/ug/iam-policy-examples-asm-secrets.htmlCommentShareEXPERTalatechanswered 4 months agoFadholi 4 months agoHi @alatech,Thanks for the response.Yes, I did. here my detail confirguration.{"Version": "2012-10-17","Statement": [{"Action": ["secretsmanager:","cloudformation:CreateChangeSet","cloudformation:DescribeChangeSet","cloudformation:DescribeStackResource","cloudformation:DescribeStacks","cloudformation:ExecuteChangeSet","ec2:DescribeSecurityGroups","ec2:DescribeSubnets","ec2:DescribeVpcs","kms:DescribeKey","kms:ListAliases","kms:ListKeys","lambda:ListFunctions","rds:DescribeDBClusters","rds:DescribeDBInstances","redshift:DescribeClusters","tag:GetResources"],"Effect": "Allow","Resource": ""},}]could you please give me correction, if i'm wrong?Thank you.ShareFadholi 4 months agoFyi, I can access secrets manager after build with above configuration, but I cannot access it in pre build.Sharealatech EXPERT4 months agoCan you elaborate what you meant by pre build? At least I m glad the above suggested policy worksShareFadholi 4 months agowe are using apprunner.yaml. inside of it we have this configuration:version: 1.0runtime: nodejs14build:commands:pre-build:- n 14.18.3 // for update node version- yarn env // execute code to get SecretValue from secrets manager..........while we are doing 'yarn env'. the error appear as below:AccessDeniedException: User: arn:aws:sts::397674710086:assumed-role/bullet-system-build-role-5c8717b2af5c41ad8edf3268812503f0/AWSCodeBuild-1a0e8fed-51e8-4abc-b034-658a5af6cc6c is not authorized to perform: secretsmanager:GetSecretValue on resource:.....Sharealatech EXPERT4 months agoHave you followed this? https://aws.amazon.com/about-aws/whats-new/2023/01/aws-app-runner-secrets-configuration-aws-secrets-systems-manager/ Your issue seems related to app rubber not being able to get the secret then. In particular, are you using environment variables to integrate with secret manager?Also does the bullet-system-build-role has secret manager permission?ShareShow 3 more comments0Hi @Fadholi,If you want to access secrets part of build, just make sure to assign the required permissions to Access role instead of Instance RoleCommentShareHarianswered 3 months ago"


Question: Install RabbitMQ plugin: rabbitmq-event-exchange

"I need to use an alternative port for RabbitMQ 5672. Following instructions, I found out I can use a NLB to connect to AmazonMQ RabbitMQ but I found an issue regarding available plugins on AWS RabbitMQ.It doesn't support (yet?) rabbitmq-event-exchange which is a very simple plugin that publish internal events to a topic and allow to subscribe to those.Maybe someone in the service team can provide a hint if this plugin is in the short term map or any workaround for this?FollowComment"

Answer: "0Hi,This plugin is on our roadmap and will be available in 6 - 10 months.CommentShareVignesh Selvam - AWSanswered a year ago0Any updates?CommentSharerePost-User-1946444answered 2 days ago"


Question: No module named 'boto3'

"Hi,This may be a dumb question. I want to use boto3 library in the Lambda function (import boto3) but have encountered this error:[2019-06-20T15:52:17.548-07:00][FATAL]-lambda_runtime.py:347,Failed to initialize Lambda runtime due to exception: No module named 'boto3'Here is my setup.--Jetson Nano running JetPack 4.2--Python 3.7 with boto3 installed (no problem running locally)--Greengrass 1.9.1--Lambda function config:----Python 3.7 runtime----both UID and GID = 1000 (nvidia)----memory = 2048 MB and timeout = 10 minutes (more than enough)Thank you!,AdrianFollowComment"

Answer: "0The problem disappears on TX2 (also running JetPack 4.2).I guess Greengrass is still somehow not very compatible with Nano then?CommentShareAdrian-LIanswered 4 years ago0Was boto3 installed globally or locally for the nvidia user?Another option would be to bundle the boto3 library along with the lambda.CommentShareJennaSysanswered 4 years ago0Hi,Boto3 is installed both globally and for Nvidia user.It's OK. I will just use TX2 instead of Nano.Edited by: Adrian-LI on Jun 24, 2019 10:10 AMCommentShareAdrian-LIanswered 4 years ago0Hi ,We're investigating the issue. Presently, Greengrass has been tested on the TX2.What's the output of:pip install boto3python --versionpython3 --versionThanks,KR-AWSCommentShareKR-AWSanswered 4 years ago0I faced the same error in my Jetson Nano. It was caused because boto3 was installed for Python 3.6 but NOT for Python 2.7. To solve it, you have to make sure you're installing it for 2.7 version:This shall output Python 2.7:python --versionNext, run below commands:sudo apt-get install python-pipsudo python -m pip install boto3To test it, simply start a new terminal and type:pythonimport boto3Regards.CommentSharefrancisco-mxanswered 4 years ago0Hello,One way to make sure you don't run into import not found is to bring the dependency with your lambda code.in the root of your zip file for your lambda code, something like:pip install boto3 -t .Thanks,RedaCommentShareredab_awsanswered 4 years ago0I am getting an error [FATAL]-lambda_runtime.py:108,Failed to import handler function "ModbusMasterLambda.function_handler" due to exception: No module named boto3  with Greengrassversion Greengrass-Linux-armv7l-1.8.2.tar.lambda Python 2.7I also tried with the deployment package(Layer) but the issue is the same.facing this issue with Greengrass onlyThank YouVisualCommentSharevisualanswered 3 years ago0Hi visual,Did you try the above:This shall output Python 2.7:python2.7 --versionNext, run below commands:sudo apt-get install python-pipsudo python2.7 -m pip install boto3What OS are you running?Thanks,KR-AWSCommentShareKR-AWSanswered 3 years ago0Hi KR-AWSThanks for your response.I am getting this error on AWS Lambda and as per AWS DocumentsLink:https://docs.aws.amazon.com/lambda/latest/dg/lambda-python-how-to-create-deployment-package.html"If your function depends on libraries other than the SDK for Python (Boto 3), install them to a local directory with pip, and include them in your deployment package"facing this issue with Greengrass only. individually the functionality is working without Greengrass.But I also tried using the deployment package.ThanksVisualEdited by: visual on Jan 8, 2020, 9:19 PMEdited by: visual on Jan 8, 2020 9:27 PMCommentSharevisualanswered 3 years ago0Hi Visual,Greengrass doesn't follow exactly what Lambda on the cloud does, for example Greengrass does not bundle boto3 library; you must include it yourself in the zip file that you upload to Lambda. The easiest way to do this is to navigate to your own code and then dopip install -t . boto3which will install boto3 and all of its dependencies into your current directory. Then you can zip up all the code and put it on Lambda. The layout of your zip file should look likeyour_code.py, boto3 (directory), botocore (directory), ... other files and directoriesHopefully that makes sense. You can follow this guide for using boto3 and other AWS services from Greengrass: https://docs.aws.amazon.com/greengrass/latest/developerguide/create-config-lambda.html--MichaelEdited by: MichaelDombrowski-AWS on Jan 9, 2020 9:49 AMAdditionally, Greengrass does not use Lambda layers, so all of your code that you need to be deployed to Greengrass must be in the lambda function zip itself and not in a layer.CommentShareEXPERTMichaelDombrowski-AWSanswered 3 years ago0Hi MichaelDombrowski-AWS,Thanks a lot for your response. finally the issue is resolved.CommentSharevisualanswered 3 years ago"


Question: Broken DAG: No module name 'airflow.providers'

"After updating my environment I received the error in the subject.From logs all I can see is:[2020-12-17 17:23:20,156] {{scheduler_job.py:1603}} WARNING - No viable dags retrieved from /usr/local/airflow/dags/dag_saphir_invoices_dummy.pyAt 14:00 CET didn't fail.Attached my requirements file.FollowComment"

Answer: "0Hi!The import apache-airflow[all] is not supported, which will block the subsequent import of apache-airflow-backport-providers-amazon.  The line boto3==1.14.44 is not required as boto3 is included by default.  As such, if you just use a requirements.txt with the single lineapache-airflow-backport-providers-amazonthen you should be all set.Thanks!CommentShareJohn_Janswered 2 years ago0Thanks!CommentShareJorgeAguirreanswered 2 years ago"


Question: AWS Cost customized budget creation

"Hi, I was about to create a custom budget report for ec2 usage, my issue is with budget scope under customized budget, i am not able to get any dropdown filters when i try to select a specific cost dimension, i tried all of them, no drop downs are loading when i select any dimension under dimension dropdown.FollowComment"

Answer: "0Accepted AnswerI'm curious, do you have permission to see the data? If you go to Cost Explorer, can you see the data there?CommentShareEXPERTShlomo Dubrowinanswered 3 months agorePost-User-1617690 3 months agoMight be some issue with those filters, now i tried and it worked. Thanks for the responseShare"


Question: Deploying a Random Forest Model on Amazon Sagemaker always getting a UnexpectedStatusException with Reason: AlgorithmError

"Hey I am trying to deploy my RandomForest Classifier on Amazon Sagemaker but get a StatusException Error even though the script worked fine before:The script runs fine and prints out the confusion matrix and accuracy as expected. When I try to deploy the model to amazon Sagemaker using the script it does not work.! python script.py --n-estimators 100 --max_depth 2 --model-dir ./ --train ./ --test ./ \Confusion Matrix:[[13 8][ 1 17]]Accuracy: 0.7692307692307693I used the Estimator from Sagemaker Python SDKfrom sagemaker.sklearn.estimator import SKLearnsklearn_estimator = SKLearn(entry_point='script.py',role = get_execution_role(),instance_count=1,instance_type='ml.m4.xlarge',framework_version='0.20.0',base_job_name='rf-scikit')I launched the training job as followssklearn_estimator.fit({'train':trainpath, 'test': testpath}, wait=False)Here I am trying to deploy the model which leads to the StatusExceptionError that I cannot seem to fixsklearn_estimator.latest_training_job.wait(logs='None')artifact = m_boto3.describe_training_job(TrainingJobName=sklearn_estimator.latest_training_job.name)['ModelArtifacts'['S3ModelArtifacts']print('Model artifact persisted at ' + artifact)2022-08-25 12:03:27 Starting - Starting the training job....2022-08-25 12:03:52 Starting - Preparing the instances for training............2022-08-25 12:04:55 Downloading - Downloading input data......2022-08-25 12:05:31 Training - Downloading the training image.........2022-08-25 12:06:22 Training - Training image download completed. Training in progress..2022-08-25 12:06:32 Uploading - Uploading generated training model.2022-08-25 12:06:43 Failed - Training job failedUnexpectedStatusException                 Traceback (most recent call last)<ipython-input-37-628f942a78d3> in <module>----> 1 sklearn_estimator.latest_training_job.wait(logs='None')2 artifact = m_boto3.describe_training_job(3     TrainingJobName=sklearn_estimator.latest_training_job.name)['ModelArtifacts']['S3ModelArtifacts']45 print('Model artifact persisted at ' + artifact)~/anaconda3/envs/python3/lib/python3.6/site-packages/sagemaker/estimator.py in wait(self, logs)2109             self.sagemaker_session.logs_for_job(self.job_name, wait=True, log_type=logs)2110         else:-> 2111             self.sagemaker_session.wait_for_job(self.job_name)21122113     def describe(self):~/anaconda3/envs/python3/lib/python3.6/site-packages/sagemaker/session.py in wait_for_job(self, job, poll)3226             lambda last_desc: _train_done(self.sagemaker_client, job, last_desc), None, poll3227         )-> 3228         self._check_job_status(job, desc, "TrainingJobStatus")3229         return desc3230~/anaconda3/envs/python3/lib/python3.6/site-packages/sagemaker/session.py in _check_job_status(self, job, desc, status_key_name)3390                 message=message,3391                 allowed_statuses=["Completed", "Stopped"],-> 3392                 actual_status=status,3393             )3394UnexpectedStatusException: Error for Training job rf-scikit-2022-08-25-12-03-25-931: Failed. Reason: AlgorithmError: framework error:Traceback (most recent call last):File "/miniconda3/lib/python3.7/site-packages/sagemaker_containers/_trainer.py", line 84, in trainentrypoint()File "/miniconda3/lib/python3.7/site-packages/sagemaker_sklearn_container/training.py", line 39, in maintrain(environment.Environment())File "/miniconda3/lib/python3.7/site-packages/sagemaker_sklearn_container/training.py", line 35, in trainrunner_type=runner.ProcessRunnerType)File "/miniconda3/lib/python3.7/site-packages/sagemaker_training/entry_point.py", line 100, in runwait, capture_errorFile "/miniconda3/lib/python3.7/site-packages/sagemaker_training/process.py", line 291, in runcwd=environment.code_dir,File "/miniconda3/lib/python3.7/site-packages/sagemaker_training/process.py", line 208, in check_errorinfo=extra_info,sagemaker_training.errors.ExecuteUserScriptError: ExecuteUserScriptError:ExitCode 1ErrorMessage ""Command "/miniconda3/bin/python script.py"ExecuteUserScriptErrI am happy for some helpFollowComment"


Question: AWD DMS setting CDC file size

"Hi Everyone,I configured an AWS DMS to migrate data from an AWS Managed Oracle database to a S3 Bucket.The CDC has been creating file greater than 32MB.  I was expecting to have file with at most 32MB due to the cdcMinFileSize. In my bucket there are files greater than 200MB.cdcMaxBatchInterval - The maximum interval length condition, defined in seconds, to output a file to Amazon S3. The default value is 60 seconds.cdcMinFileSize - The minimum file size condition, defined in KB, to output a file to Amazon S3. The default value is 32000 KB.WriteBufferSize - The size, in KB, of the in-memory file write buffer used when generating .csv files on the local disk at the AWS DMS replication instance. The default value is 1000 KB.I was wondering if my oracle database committed a large transaction that lead to this scenario. But during the processing on the Replication Instance would break the file into chunks to fit the 32MB?Thanks in advance.FollowComment"

Answer: "0cdcMinFileSize defines the least or smallest file that AWS DMS will create on S3. If you are seeing a 200 MB file, its expected. Bottom line, with the default setting of 32000 (KB) for cdcMinFileSize, you will not see any files on S3 smaller than 32000 KB.CommentShareD-Raoanswered 7 months ago"


Question: Migrating catalog table to Aurora Mysql target

"Hi, I have a source database in Aurora Mysql created in 2014. We enable binlogs in this instance to use the DMS service on June 20, 2020. I want to move some catalog tables from my source database to my target database(also an Aurora Mysql instance) but although the replication task works perfectly and no error logs are shown on CloudWatch related to the task, the table is not created at my target database. This catalog table hasn't been edited since 2014(before the date when we enable binlogs) so my guess is that there is a problem related to the available binlogs for that table( it hasn't been edited so it hasn't had binlogs related) so the DMS ignores the table. Also, I have tried:Creating a replication task with a table that has been edited after June 20. It works perfectly and the table is replicated to the target database.Creating a replication task for a table that doesn't exist at my source endpoint. I received the same behavior; the replication task works perfectly, no error logs are shown at CloudWatch and the table doesn't exist at the target database (This was the expected behavior but I would have expected that an error would have been triggered letting me know that the table didn't exist at the source endpoint.Any thoughts at this behavior?Edited by: fahernandez on Jul 2, 2020 5:02 PMFollowComment"

Answer: 0It was an error while giving permission to the source database user. When the source table in the database doesn't exists or doesn't have enough permission. the process will run successfully but the table won't be migrated.CommentSharefahernandezanswered 3 years ago


Question: EC2 - Could not set DHCPv4 address: Connection timed out (sa-east-1a)

"Our c6i.2xlarge 3-year reserved instance, running for its first 5 days, generated this log entry Could not set DHCPv4 address: Connection timed out on Jan 28 02:59:51 UTC, followed by Failed and Configured. From there on, the machine became unresponsive and AWS finally raised a StatusCheckFailed_Instance at 06:59 UTC. At 09:06 UTC machine was stopped and restarted through the Console.I found these apparently related issues, but still clueless:CoreOS goes offline on DHCP failure on Amazon VPCCoreOS on EC2 losing network connection once a dayThe box is running MySQL 5.7.36 and Memcache 1.5.6 on top of Ubuntu 18.04. I would be thankful if someone could help me identify the root cause of this issue, and:Could this be related to ntp-systemd-netif.service ?This instance type has a separate channel for EBS, but with network down, and no customers making requests (no usage logs on the application machine, except the "MySQL connection timeouts"), what would explain a surge on EBS disk reads? CloudWatch graphs below.We have an EFS disk attached to this instance, that started failing at 04:04 UTC probably related to network failure. No errors reported at EFS sa-east São Paulo status page.Jan 28 02:17:01 ip-172-xxx-xxx-xxx CRON[18179]: pam_unix(cron:session): session opened for user root by (uid=0)Jan 28 02:17:01 ip-172-xxx-xxx-xxx CRON[18180]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)Jan 28 02:17:01 ip-172-xxx-xxx-xxx CRON[18179]: pam_unix(cron:session): session closed for user rootJan 28 02:29:11 ip-172-xxx-xxx-xxx systemd-networkd[728]: ens5: ConfiguredJan 28 02:29:11 ip-172-xxx-xxx-xxx systemd-timesyncd[623]: Network configuration changed, trying to establish connection.Jan 28 02:29:12 ip-172-xxx-xxx-xxx systemd-timesyncd[623]: Synchronized to time server 169.254.169.123:123 (169.254.169.123).Jan 28 02:29:12 ip-172-xxx-xxx-xxx systemd[1]: Started ntp-systemd-netif.service.Jan 28 02:59:51 ip-172-xxx-xxx-xxx systemd-timesyncd[623]: Network configuration changed, trying to establish connection.Jan 28 02:59:51 ip-172-xxx-xxx-xxx systemd-networkd[728]: ens5: Could not set DHCPv4 address: Connection timed outJan 28 02:59:51 ip-172-xxx-xxx-xxx systemd-networkd[728]: ens5: FailedJan 28 02:59:51 ip-172-xxx-xxx-xxx systemd-networkd[728]: ens5: ConfiguredJan 28 02:59:51 ip-172-xxx-xxx-xxx systemd-timesyncd[623]: Synchronized to time server 169.254.169.123:123 (169.254.169.123).Jan 28 02:59:51 ip-172-xxx-xxx-xxx systemd-timesyncd[623]: Network configuration changed, trying to establish connection.Jan 28 02:59:51 ip-172-xxx-xxx-xxx systemd-timesyncd[623]: Synchronized to time server 169.254.169.123:123 (169.254.169.123).Jan 28 03:00:01 ip-172-xxx-xxx-xxx systemd[1]: Started ntp-systemd-netif.service.Jan 28 03:01:21 ip-172-xxx-xxx-xxx systemd-udevd[503]: seq 16407 '/kernel/slab/proc_inode_cache/cgroup/proc_inode_cache(4935:ntp-systemd-netif.service)' is taking a long timeJan 28 03:01:28 ip-172-xxx-xxx-xxx systemd-udevd[503]: seq 16408 '/kernel/slab/:A-0000040/cgroup/pde_opener(4935:ntp-systemd-netif.service)' is taking a long timeJan 28 03:01:34 ip-172-xxx-xxx-xxx systemd-udevd[503]: seq 16409 '/kernel/slab/kmalloc-32/cgroup/kmalloc-32(4935:ntp-systemd-netif.service)' is taking a long timeJan 28 03:01:40 ip-172-xxx-xxx-xxx systemd-udevd[503]: seq 16410 '/kernel/slab/kmalloc-4k/cgroup/kmalloc-4k(4935:ntp-systemd-netif.service)' is taking a long timeJan 28 03:17:03 ip-172-xxx-xxx-xxx CRON[18284]: pam_unix(cron:session): session opened for user root by (uid=0)Jan 28 03:17:12 ip-172-xxx-xxx-xxx CRON[18285]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)Jan 28 03:19:34 ip-172-xxx-xxx-xxx snapd[6419]: autorefresh.go:530: Cannot prepare auto-refresh change: Post https://api.snapcraft.io/v2/snaps/refresh: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)Jan 28 03:19:34 ip-172-xxx-xxx-xxx CRON[18284]: pam_unix(cron:session): session closed for user rootJan 28 03:28:44 ip-172-xxx-xxx-xxx snapd[6419]: stateengine.go:149: state ensure error: Post https://api.snapcraft.io/v2/snaps/refresh: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)Jan 28 03:36:35 ip-172-xxx-xxx-xxx systemd[1]: Starting Ubuntu Advantage Timer for running repeated jobs...Jan 28 04:01:18 ip-172-xxx-xxx-xxx systemd[1]: Started ntp-systemd-netif.service.Jan 28 04:03:09 ip-172-xxx-xxx-xxx systemd-udevd[503]: seq 16496 '/radix_tree_node(4961:ntp-systemd-netif.service)' is taking a long timeJan 28 04:04:00 ip-172-xxx-xxx-xxx kernel: nfs: server fs-0ac698ea1xxxxxxxx.efs.sa-east-1.amazonaws.com not responding, timed outJan 28 04:06:13 ip-172-xxx-xxx-xxx kernel: nfs: server fs-0ac698ea1xxxxxxxx.efs.sa-east-1.amazonaws.com not responding, timed outJan 28 04:06:26 ip-172-xxx-xxx-xxx kernel: nfs: server fs-0ac698ea1xxxxxxxx.efs.sa-east-1.amazonaws.com not responding, timed outJan 28 04:09:14 ip-172-xxx-xxx-xxx kernel: nfs: server fs-0ac698ea1xxxxxxxx.efs.sa-east-1.amazonaws.com not responding, timed outJan 28 04:09:26 ip-172-xxx-xxx-xxx kernel: nfs: server fs-0ac698ea1xxxxxxxx.efs.sa-east-1.amazonaws.com not responding, timed outJan 28 04:12:15 ip-172-xxx-xxx-xxx kernel: nfs: server fs-0ac698ea1xxxxxxxx.efs.sa-east-1.amazonaws.com not responding, timed outJan 28 04:12:26 ip-172-xxx-xxx-xxx kernel: nfs: server fs-0ac698ea1xxxxxxxx.efs.sa-east-1.amazonaws.com not responding, timed outJan 28 04:12:36 ip-172-xxx-xxx-xxx kernel: nfs: server fs-0ac698ea1xxxxxxxx.efs.sa-east-1.amazonaws.com not responding, timed outJan 28 04:15:15 ip-172-xxx-xxx-xxx kernel: nfs: server fs-0ac698ea1xxxxxxxx.efs.sa-east-1.amazonaws.com not responding, timed outJan 28 04:15:26 ip-172-xxx-xxx-xxx kernel: nfs: server fs-0ac698ea1xxxxxxxx.efs.sa-east-1.amazonaws.com not responding, timed outJan 28 04:15:34 ip-172-xxx-xxx-xxx kernel: nfs: server fs-0ac698ea1xxxxxxxx.efs.sa-east-1.amazonaws.com not responding, timed outJan 28 04:16:39 ip-172-xxx-xxx-xxx sshd[4657]: pam_unix(sshd:session): session closed for user ubuntuJan 28 04:17:30 ip-172-xxx-xxx-xxx systemd-logind[974]: Failed to abandon session scope, ignoring: Connection timed outJan 28 04:18:00 ip-172-xxx-xxx-xxx systemd-logind[974]: Removed session 27.Cloud Watch GraphsThanks!FollowComment"

Answer: "1I just found this and hope this response helps. Generally  instance status check failure usually occurs due to the following reasons:Startup configurationExhausted memoryCorrupted file systemIncompatible kernel (Operating System itself)Some script causing the issueThe error " Could not set DHCPv4 address" is not a cause but a symptom of Connectivity issues and just shows the instance was unable to communicate outbound to renew its dhcp lease. What it does not say is what was blocking the connection. The same blockage would have likely prevented healthchecks from succeeding hence the status check failure.Most common cause of the issue is an Internal Firewall. From my experience, I have seen a few dhcp lease renewal failures where servers are running  Trend DSA. You can verify if there is any security agent installed on the OS.If the system logs like syslog are still available, I would also recommend checking to see if they contain any errors/logs indicating memory exhaustion?The Cloudwatch logs might no longer be available due to time, however, checking to see if there was a spike in Network In/Out traffic around the time of the status check failures can also be a good indicator of why status checks failed.CommentShareAWS-User-9002671answered 7 months ago"


Question: I can't reach EC2 instance even if all trafic is allowed

"I can't reach my EC2 instance anymore. I tried to ping and traceroute  it and it's not reachable. I have a web server on that instance and is not available anymore. This happened all of a sudden because this used to work and I didn't do any changes to the network or instance. I am not sure what happened.This are my configurations for this instance:https://cln.sh/GSmNXWhttps://cln.sh/vmvVIpFollowCommentimpr a year agoOk, so I created a new instance with the same configuration: all connections open and I also can't reach itShare"

Answer: "0Can you SSH into it and see if your webserver is still running? If not have you tried rebooting it? If those are your security groups in the screenshots, and they are wide open on all ports to all addresses, I hate to say it, but my guess would be that it's been compromised somehow.CommentShareJohn Voldanswered a year agoimpr a year agoYes, I tried rebooting it but is the same. I have running on the instance Windows Server and I can use RDP to connect to it. The webserver is still running and working normally but is not accessible from outside the server.Share0Check the Windows Firewall settings and make sure that it is allowing connections to your web sever.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: How can I grant permission to a user to view Elasticache Metrics in Elasticache console?

"I have tried by adding an inline policy in Identity center as follows;"Effect": "Allow","Action":"cloudwatch:""Resource": ["arn:aws:elasticache:ap-south-1:**:****:cache-name"]But still when I check in elasticache console it says "you can't view the metrics, no cloudwatch:getmetricdata permission"Evene I tried by just giving Action: cloudwatch:GetMetricData but no luckHow can I fix this?FollowComment"

Answer: 0If the action in the inline policy was literally: "cloudwatch:" then that won't work. You are missing an action or asterisk (*) after the colon. I was able to recreate this by not having anything after the colon.Either use: "cloudwatch:GetMetricData" or "cloudwatch:*" to resolve this.If you did try "cloudwatch:GetMetricData" and it didn't work still ensure that the resource ARN is correct and that you are using an Allow effect in the policy.CommentShareCarlo Mencarellianswered 5 months ago


Question: Connections time out of a client request to a Network Load Balancer

"I connected two AWS Accounts with a peering connection. All subnets on each side are allowed to talk with each other. If I try to communicate between the two sides with the IPs of the instances it works fine. I added a NLB on one side to avoid IPs and use a DNS name as a host. The ECS service registers the IP automatically to the NLB target group to achieve the goal.The client on one side tries to make a request through the NLB to the same target as before.The NLB is configured as internal and assigned to 3 AZ, the target group contains the IP of the target I want to reach.Each AZ contains a subnet with its own small range of IPs(1.0.x.0/20) but all the CIDR used for the rules are using the broader IP range(1.0.0.0/16) to cover them all. There are no overlappings between any IP ranges on both Accounts.The NLB has 3 private IPs(one for each AZ) registered on its DNS entry.I can do the request to the IP behind the NLB with success and the request to the NLB IP which is associated with the AZ on which the target IP is located.The request to the two other IPs of the NLB results in a timeout.There's one ACL for the whole Account which allows all traffic, the default security group allows the traffic of the CIDR of both Accounts and the routing tables contains an entry to route the traffic to the peering connection for the CIDR of the other side and one route for the local CIDR to "local".I also tried the Reachability Analyzer with the peer connection as sender and the NLB as a receiver and specify the IP of the target in the target group. This test succeeds because it uses the one NIC which is in the same AZ.I tried to use the peer connection as sender and the other two NICs of the NLB and set the IP of the target which fails with NO_PATH.To me, it looks like the NLB doesn't route the request to the other NIC. But I couldn't find any limitations to this kind of setup on the documentation.FollowComment"

Answer: "0Did you enabled Cross-zone load balancing option for NLB? Or, is the target group located in all AZ which your NLB is located.CommentShareEXPERTposquit0answered a year agoAWS-User-5257795 a year agoCross-zone load balancing is disabled. For test purpose I enabled it once to be sure the documentation isn't misleading but it didn't change anything.The target group is assigned to the same vpc and it contains only one target which is in one of the 3 AZ assigned to the NLB.Share"


Question: AWS Managed Grafana primary account switch as a organization member account

"Hi,I have few aws accounts now want to join another OU.One of them is a Grafana  management account.But if I change all my accounts under a new OU, as shown in the figure below,Are there any effects of Grafana management account access to data sources in other accounts?If it is affected, how can the Grafana management account access data sources in other accounts?FollowComment"


Question: AWS Grafana: How to see the server logs

"Hi,I have a workspace and I can access the Grafana Dashboard (Settings). I have this error when I test my data source.db query error: failed to connect to server - please inspect Grafana server log for detailsI cannot find logs panel in the Grafana Dashboard or tab for logs in the AWS Workspace, so where is the server logs? I cannot find any information about server logs in the documentation https://docs.aws.amazon.com/grafana/latest/userguide/using-grafana-v9.htmlThank you for any helpFollowComment"

Answer: 0The only way to access Amazon Managed Grafana is using Cloudtrailhttps://docs.aws.amazon.com/grafana/latest/userguide/logging-using-cloudtrail.htmlbut if you want to view Grafana service logs you cannot access them maybe you can check with the AWS supportCommentShareEXPERTsedat_salmananswered 3 days ago


Question: Cannot modify the instance class because there are not enough availability

"HI,I am getting the following message when I try to upgrade by db.t2.small instance to a db.t3.small in the Sydney zone.Cannot modify the instance class because there are not enough availability zones that have the requested instance class. Please try your request again at a later time. (Service: AmazonRDS; Status Code: 400; Error Code: InsufficientDBInstanceCapacity; Request ID: 371ac3cf-edd8-4308-8f3b-0279a15fb539)Does anyone know why this is ? I tried it a couple of times over a couple of days.FollowComment"

Answer: 0Accepted AnswerHad the same issue in eu-central-1 (Frankfurt). Could not launch a m5 instance. Nothing you can do. Try again at a later time. Maybe it helps to raise the issue through your support channel or give feedback on the site.CommentShareraupachanswered 4 years ago


Question: [Announcement] Introducing real-time collaborative notebooks in EMR Studio

"Amazon EMR Studio is an integrated development environment (IDE) that makes it easy for data scientists and data engineers to develop, visualize, and debug big data and analytics applications written in R, Python, Scala, and PySpark. Today we are excited to announce that data scientists, engineers, and analysts can collaborate in real-time across teams using EMR Studio.An EMR Studio Workspace provides a fully-managed serverless JupyterLab instance in the cloud. Previously, only one user could use a Workspace at a time. With the latest release, Workspace owners can invite other users and collaborate using notebooks in real-time. When collaboration is enabled, multiple users can open, edit, and see real time edits made by other collaborators in the same notebook. Real-time collaboration enables data scientists, engineers, and analysts to author, debug, or review notebooks in real-time. Workspace owners can toggle real-time collaboration features on or off using a one click toggle.Real-time collaboration with EMR Studio is available in US East (Ohio), US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Ireland), Europe (Frankfurt), Europe (London), Europe (Stockholm), Europe (Paris), Asia Pacific (Mumbai), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo) and South America (Sao Paulo) regions.To learn more about real time collaboration in EMR Studio see our documentation here. To see the feature in action see the demo video here.FollowCommentNguyen_M SUPPORT ENGINEERa year agoThis is an announcement migrated from AWS Forums that does not require an answerShare"


Question: Opensearch Serverless Custom Packages

Does opensearch serverless support custom packages like in the managed cluster.If not available is there a way to achieve this in the serverless option.FollowComment

Answer: 0Currently this is not supported.CommentShareRoianswered 14 days ago


Question: Would like the ability to group contacts without creating new chat rooms

"Is there a way to group my contacts into separate groups, i.e. I have worked at 5 different buildings within my node, with additional contacts in different areas of the business, example DML2, UTR, OTR and RTS.Would like ability to group them together without having to create new chime rooms, favorites etc.FollowComment"

Answer: "0The Amazon Chime app does not have any way to group contacts. (You can put them in "favorites" and then re-order them how you would like. But, the groups would not be labeled.)Besides using a chat room, the only other idea I could think of for you would be to start a multi-party chat with the group of users. (Admittedly, that's only helpful if you want to chat with them all at the same time and it's not much different than a chat room.)CommentShareDougLanswered 8 months ago"


Question: Client VPN Connection to Route 53 Private Hosted Zone

"I have one privately hosted zone in my vpc using Route 53. I also have one client vpn connection to that vpc, which is functioning normally. I have also enabled "DNS Configuration" in the Client VPN Settings. But my client is not able to access the hostname of the webitse hosted in the private hosted zone. Though they are able to access the website using client vpn connection but by using ip address. I want them to access it using hostname.I have tried defining the DNS ip in client vpn settings asAWS Provided DNS (VPC CIDR + 2)2.Route 53 inbound endpoint ips.Both did not work. Help me out on this.FollowComment"

Answer: "0I believe you are almost here. The Route53 Inbound IPs must be used in the DNS server that is being used in your VPN. You have to create a forward rule for the private hosted zone domain pointing to the Inbound IPs. The clients shouldn't query the inbound IPs directly.For reference -> https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-forwarding-inbound-queries.htmlCommentSharefercunhaanswered 6 months agorePost-User-3110425 6 months agoSo what exactly is the request track. If im not wrong-Client VPN settings should include the DNS ip of Route 53 input endpoint.The input endpoint internally will resolve to VPC+2.The DNS Server at VPC+2 will forward the request to Route 53 resolver.Route 53 Resolver uses the forward rule.Am i correct on this?Sharefercunha 6 months agoThe R53 endpoint doesn't go in the VPN configuration. It goes in the configuration of the DNS server that is used by the VPN. See https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.html#resolver-overview-forward-network-to-vpcThe VPN clients will get a DNS server from the DHCP service and that server must know which domains must be resolved by R53.This will be the flow:[VPN Client]-------DNS Query------>[VPN DNS Server]----------DNS FORWARD THROUGH THE VPN--------------->[R53 Resolver Inbound Endpoint]Share0Hello,There is a Knowledge Center article with detail steps on how to allow end users (clients connected to Client VPN) to query resource records hosted in my Amazon Route 53 private hosted zone.https://aws.amazon.com/premiumsupport/knowledge-center/client-vpn-resolve-resource-records/CommentShareEXPERTTushar_Janswered 6 months agorePost-User-3110425 6 months agoYes i referred the article and it says-"Depending on your server configuration and the values that you specify for the "DNS Server IP address" parameter, the resolution of the private hosted zone domain varies"So what value should i specify. I did specify (VPC+2) and even the inbound endpoint ips but both did not work. Should i add something else as well?SharerePost-User-3110425 6 months agoSo what exactly is the request track. If im not wrong-Client VPN settings should include the DNS ip of Route 53 input endpoint.The input endpoint internally will resolve to VPC+2.The DNS Server at VPC+2 will forward the request to Route 53 resolver.Route 53 Resolver uses the forward rule. Am i correct on this?Share"


Question: AWS Redshift Serverless COPY Error

"I am trying to copy data from S3 into redshift serverless and get the following error.ERROR: Not authorized to get credentials of role arn:aws:iam::xxx Detail: ----------------------------------------------- error: Not authorized to get credentials of role arn:aws:iam::xxx code: 30000 context: query: 5031 location: xen_aws_credentials_mgr.cpp:402 process: padbxxx [pid=10282] ----------------------------------------------- [ErrorId: 1-6209a3af-30de21be27e8b5e412626606]The role used has AmazonRedshiftAllCommandsFullAccess and AmazonRedshift-CommandsAccessPolicy-20220213T191838 which was created through the UI as well as a trust relationship as follows{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"Service": ["sagemaker.amazonaws.com","redshift-serverless.amazonaws.com","redshift.amazonaws.com"]},"Action": "sts:AssumeRole"}]}Am I missing something?FollowCommentrePost-User-7152107 SUPPORT ENGINEERa year agoHi, Did you resolve this issue?Share"

Answer: 0is the role set as Default role?and are you providing the authorization in the copy command?it might be best to open support ticket if these do not helpCommentShareMilindOkeanswered a year ago


Question: how do I delete content from the datastore?

Using IoT Analytics but cannot find button to empty the contents. Can only delete the entire data store.FollowComment

Answer: "0Hello, you can try instead of setting retention period of the data store.https://docs.aws.amazon.com/cli/latest/reference/iotanalytics/update-datastore.htmlPlease let me know if this does help. Thank you!CommentShareAWS-User-9634033answered 10 months ago"


Question: aws cloudhsm key creation

how can I create pkcs11 keys inside aws cloudhsm and how can I set id of created pkcs11 keyFollowComment

Answer: "0Hi,You can start reading this guide, which has plenty of information about setting up those keys with cloudhsm:https://docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-library.htmlHope it helps ;)CommentShareEXPERTalatechanswered 2 months ago"


Question: Sidewalk without LoRa

Is there a way to use sidewalk without LoRa and just with bluetooth?FollowComment

Answer: 0Amazon Sidewalk enables low-bandwidth and long-range connectivity at home and beyond using Bluetooth LE for short-distance communication and LoRa and FSK radio protocols at 900MHz frequencies to cover longer distances.Referencehttps://docs.aws.amazon.com/iot/latest/developerguide/amazon-sidewalk-overview.htmlCommentShareEXPERTAWS-User-Nitinanswered 6 days ago


Question: Sharing Access to External Parties in Workdocs specific folders

"Hi all,I work in Tax Compliance and on a daily basis we need to share huge files (xlxs, pdf, etc) with our 3P Audit Teams (external) but Outlook has a limit of attachments for 20mb. That way we would like to use a specifc folder in Workdocs to share files with external parties (our External Auditors).PS: The idea is for them to be able to view, download and add files into this folder.Is there any guide or step-by-step on how to do that?Creating the folderGiving them access/Registering them into WorkdocsThank you very much in advance.FollowComment"

Answer: "0Hi,I would recommend to create the access for individual persons. This way you can block access for individual users, e.g. if an employee of your supplier leaves the company. It also allows you to attribute log entries to the person that caused them.You would start by collecting a list of email addresses of the people you want to invite to your workdocs deployment. This has be done by a Workdocs Administrator: https://docs.aws.amazon.com/workdocs/latest/adminguide/invite_user.htmlIf you assign these users the role "Guest users" no costs will be induced, but they can only view the data that you share with them. If you want them to commend / update / create files you need to grant them the "User" role, which is a payed user type (currently 5 USD/month):https://docs.aws.amazon.com/workdocs/latest/adminguide/users_ovw.htmlAfter that I would recommend to create a folder structure by external party. On this level you can create the necessary permissions for the invited employees of that company. This will be inherited by every subfolder and file that you create:https://docs.aws.amazon.com/workdocs/latest/adminguide/permissions.htmlCommentShareEXPERTAndreas Seemuelleranswered a year ago"


Question: SSL certificate not valid on EC2

I'm trying to configure SSL for my domain by the instruction given by this article ref:  https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04#prerequisites  . Now after doing these steps it always showing "Site's security certificate is not trusted." How can I solve this by making the certificate trusted for all user accessing the website.FollowComment

Answer: "0You have a valid SSL certificate. However, because it is a self signed certificate (created by yourself and not by Certificate Authority) browsers don't trust it.You have two free options:Create an Elastic Load Balancer and add a Certificate created by AWS Certificate Manager (please refer to https://docs.aws.amazon.com/acm/latest/userguide/acm-services.html)Use a free certificate from a CA like Let's Encrypt. It is very straightforward to set up. (please refer to https://letsencrypt.org/getting-started/)Hope that helps.Edited by: gonzie on Feb 6, 2018 10:59 AMCommentSharegonzieanswered 5 years ago"


Question: Better way to view multiple instance within a security group at the same time

"On Services > EC2 instances,Is there a way to align  the column such that it shows the following information:The lab region the instance is current inWhat is the subnet or subnet it is currently inWhat is the security group id it is currently inWhat is the private IPv4 address.Essentially, I just want the instances to show up more columns,rather than me going to click on the Instance ID and clicking on multiple tabs.Source:  I am using the official Amazon courseware: Architecting on AWS - Lab 1 - Explore using the AWS API to deploy an EC2FollowComment"

Answer: "1You can go to EC2 page by selecting EC2 service.Right side setting icon on the "Instance" gridClick there and you can add more columns.Its showing all the columns which you are requesting for. Only region column is not showing because you will be already inside particular region so you can only see Ec2 instance of particular region.Hope this will helps.CommentShareMaulik_Makadiyaanswered a year ago0Hi, good question!If you're looking at the AWS Console, you can search by attributes including security group ID:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.htmlIf using CLI or APIs, that can also be done via describe-instances and using the filters: https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.htmlAnd for viewing options on console, it's possible to change the viewing options/details on the console to display or hide different attributes.CommentSharejsoncanswered a year ago"