Question: Setup AWS SES to host email

"I want to try AWS SESI have a domain and created 5 email accounts , it is hosted in a email hosting company currently , now I want to move it to AWS SES to host those email accounts , could AWS SES have such function ? if yes , would advise the step how to do the setup ?thanksFollowComment"

Answer: "0Amazon SES is a service primarily for sending and receiving email from applications. It does not have storage and does not offer interfaces for client apps to check their mail. So, it would not meet all your requirements to replace hosted email.However, if you want a service more like traditional email hosting, check out Amazon WorkMail: https://aws.amazon.com/workmail/CommentShareDougLanswered 5 months ago"


Question: Can't access workmail - 403 Forbidden *after* successfully logging in.

"I'm encountering a really odd error when trying to use webmail today, regardless of which user in my org I try.I log into the app as usual, there's a redirection into https://webmail.mail.eu-west-1.awsapps.com/workmail/?auth_code=<zip>&organization=<zip>&region=eu-west-1&wdc_csrf_token=<zip> that then fails with a 403 Forbidden, and just gets stuck there. A refresh just takes me back to the login screen. If I try the wrong password on the login screen it successfully tells me I've entered incorrect credentials.I tried resetting the user's password, several users, different browser, different PC & Mobile (browser), different network, Outlook Exchange setup. Nothing worked. The webmail was in working condition although it hadn't been checked in a few months. There's no special permissions or setup on my org.What's going on? Any ideas?Edited by: Nriveros on Jul 6, 2021 9:05 AMFollowComment"

Answer: "0The problem subsists today - hoping to catch some @AWS staff attention, as I really have no idea what could be the actual problem, since there's no explanation whatsoever on the webapp (or any of the other login patterns, really). The workmail has been in use for the past few years without any problems, and is now blocking an SSL renewal due in a couple of weeks.Edited by: Nriveros on Jul 9, 2021 1:28 AMCommentShareNriverosanswered 2 years ago0Hi Nriveros,The organization has an access control rule that denies access for IP addresses outside of the specified IP range. https://docs.aws.amazon.com/workmail/latest/adminguide/access-rules.html.Please reset you access control rules and it should fix the issue.Thanks,SowmyaCommentShareSasanapuri-AWSanswered 2 years ago"


Question: How Route 53 and other DNS system works

"Hi guys!I have a question about the DNS and Route 53. For example, my company has a public website named www.abc.com. I would like to use Route 53 as my company DNS registrar and save my domain as a record in Route 53.My question is how my user in the world can resolve my domain. I know that most of users use Google DNS 8.8.8.8 as their DNS server. Does Google DNS connect to Route 53 to resolve my DNS query or users have to enter Amazon Route 53 DNS server to resolve my domain.Lastly, how different between using my own public DNS server in my network and using Route 53. I mean the workflowIf you know the workflow for all of my situation, please kindly share with me.FollowComment"

Answer: "1Hi Steven,This link has the detail steps explaining how to make Route53 as your domain's registrar and all the steps involved in it.If you make Route53 as the Authoritative DNS for your domain a typical flow would look like below, this is just an example:CommentShareEXPERTTushar_Janswered 7 months agoEXPERTIndranil Banerjee AWSreviewed 7 months ago"


Question: S3 deletes files by itself

"dears,i just found out that S3 deleted my files by itself, don't know why, don't know how?is there any log i can find to tell by what happen ?does anyone know what happen ?FollowComment"

Answer: "1Hi,Have you configured a lifecycle rule to automatically expire objects older than a certain number of days? You can review why an S3 object has been deleted though server access logs or AWS CloudTrail data events, but both had to be previously enabled on the bucket or CloudTrail.CommentShareMikel Del Tioanswered 21 days ago0Follow below article and verify lifecycle settingshttps://s3browser.com/amazon-s3-object-expiration.aspx#:~:text=Amazon%20S3%20Object%20Expiration%20Overview,-Recently%20Amazon%20S3&text=The%20prefix%20(e.g.%20%22logs%2F,expiration%20rules%20for%20different%20prefixes.CommentShareHemant Chughanswered 20 days ago0i didn't enable any lifecycle settingsCommentSharedotshubanswered 20 days ago"


Question: failed to connect to all addresses error

"Hello,When using Greengrass v2 with Sagemaker component the intermittent error below is seen when the device powers off and on. Could you please advise what could be the possible errors?eturn self.client.ListModels(agent_pb2.ListModelsRequest())File "/usr/local/lib/python3.6/dist-packages/grpc/_channel.py", line 923, in callreturn _end_unary_response_blocking(state, call, False, None)File "/usr/local/lib/python3.6/dist-packages/grpc/_channel.py", line 826, in _end_unary_response_blockingraise _InactiveRpcError(state)grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:status = StatusCode.UNAVAILABLEdetails = "failed to connect to all addresses"debug_error_string = "{"created":"@1650457997.824138381","description":"Failed to pick subchannel","file":"src/core/ext/filters/client_channel/client_channel.cc","file_line":4143,"referenced_errors":[{"created":"@1650457988.031111729","description":"failed to connect to all addresses","file":"src/core/ext/filters/client_channel/lb_policy/pick_first/pick_first.cc","file_line":398,"grpc_status":14}]}"FollowComment"

Answer: "0Hi,Would you be able to provide the full log at /greengrass/v2/logs/aws.greengrass.SageMakerEdgeManager.log , along with any other relevant log files?Could you also turn on the debug mode with the SagemakerEdgeLogVerbose config option specified here? https://docs.aws.amazon.com/greengrass/v2/developerguide/sagemaker-edge-manager-component.html#sagemaker-edge-manager-component-log-fileAre there any other applications that could interfere with that socket?Thanks!CommentShareavipinkuanswered a year ago"


Question: Help deleting orphaned Lambda ENIs?

I am trying to delete a VPC subnet but I can't due to orphaned Lambda ENIs.I am seeing 3 ENIs connected to the subnet (which I'm trying to delete) under network interfaces within the EC2 configuration section.The ENIs in question are all pre-fixed with AWS Lambda VPC ENI- and I'm unable to delete them.Notes:I have removed this subnet from the Lambda VPC Configuration (and any versions)Two of the named Lambdas no longer existThey have been in this state for at least 3 weeks if not moreENIs:eni-0b86ffce0ca45c937eni-082c7cfda48e304e8eni-0a1b06ae1ff6f54c7Could someone please help me to remove these?FollowComment

Answer: "1There might be other Lambda functions still connected to these ENIs. You may follow this guide to find any other any Lambda functions and function versions that are still using the network interface and how to delete the ENIs.https://aws.amazon.com/premiumsupport/knowledge-center/lambda-eni-find-delete/CommentSharejoahnaanswered a year agoBarry G a year agoMany thanks, the subnet has been removed. The script pointed me to exactly what I needed to cleanup. Thanks!Share"


Question: Scp Tag enforcement is not working on Ec2.

"I have created an SCP to deny ec2 resource creation if there is no tag. The instance is only get created if it has an environment tag key mentioned in it.Here is my policy :{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Scp1",      "Effect": "Deny",      "Action": [        "ec2:CreateTags",        "ec2:RunInstances"      ],      "Resource": [        "arn:aws:ec2:*:*:instance/*",        "arn:aws:ec2:*:*:volume/*"      ],      "Condition": {        "ForAllValues:StringEquals": {          "aws:RequestTag/environment": "true"        }      }    }  ]}FollowComment"

Answer: "0Yes I am trying to achieve this thing but I want to achieve this by using AWS SCP.All post which I have seen they all have same json file as mine. But while implementation it is not working.CommentShareShubhamanswered a year agoRichardFan a year agoSo what condition type you are using?ForAllValues:StringEquals? Or StringNotLike?ShareShubham a year agoI have used Both but no luck.ShareRichardFan a year agoCan you also post the policy you use with StringNotLike to see if there is any other issue?ShareShubham a year ago{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Scp1",      "Effect": "Deny",      "Action": [        "ec2:RunInstances"      ],      "Resource": [        "arn:aws:ec2:*:*:instance/*",        "arn:aws:ec2:*:*:volume/*"      ],      "Condition": {        "ForAllValues:StringEquals": {          "aws:RequestTag/environment": "true"        }      }    }  ]}{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Scp1",      "Effect": "Deny",      "Action": [        "ec2:RunInstances"      ],      "Resource": [        "arn:aws:ec2:*:*:instance/*",        "arn:aws:ec2:*:*:volume/*"      ],      "Condition": {        "ForAllValues:StringNotLike": {          "aws:RequestTag/environment": "true"        }      }    }  ]}ShareRichardFan a year agoYour policy with"ForAllValues:StringNotLike": {          "aws:RequestTag/environment": "true"        }means all your new EC2 instances need to have a tag environment and the tag value must be exactly trueIs this what you expect and what you get?ShareShow 5 more comments0I guess you are trying to achieve something like this: https://aws.amazon.com/premiumsupport/knowledge-center/iam-policy-tags-deny/ (Sid: AllowRunInstancesWithRestrictions1)Your policy can be modified as follow:{    "Effect": "Deny",    "Action": [        "ec2: CreateTags",        "ec2: RunInstances"    ],    "Resource": [        "arn:aws:ec2:*:*:instance/*",        "arn:aws:ec2:*:*:volume/*"    ],    "Condition": {        "StringNotLike": {            "aws:RequestTag/cost_center": "?*"        }    }}CommentShareRichardFananswered a year ago"


Question: CI/CD on ECS Fargate

"Hi AWS,I am following this blog post https://aws.amazon.com/blogs/containers/ci-cd-pipeline-for-testing-containers-on-aws-fargate-with-scaling-to-zero/ to learn about building CI/CD pipelines for containers on ECS Fargate but while accessing the CloudFormation Template and Dockerfile stored in the zipped format I am getting the following error.Here is the URL for the files stored: https://d268s23yov0ww.cloudfront.net/aws-autostart-pipeline.zipand here is the error screenshot:Please acknowledge this as I am stucked because of the same.Thank youFollowComment"

Answer: "0Here comes the trick, the code for the cloudformation templates and Dockerfile has been stored on this GitHub Repo: https://github.com/kennycoder/aws-autostart-pipelineHaving said that AWS should fix it as it must be read by other developers.CommentSharerePost-User-3199525answered 10 months ago"


Question: AWS lambda function times out invoked from aws java sdk V2

"I have created a AWS lambda function (written in python) that reads a tar.gz file from one S3 bucket, unzips and untars it and writes the extracted files to another S3 bucket. Tar inside the GZ is of >1GB size so lambda takes more time to complete the task. I invoke this lambda function from a java client. I am using AWS SDK V2 for Java (software.amazon.awssdk.*), and using Lambda sync client software.amazon.awssdk.services.lambda.LambdaClient.Though the lambda invocation works (lambdaClient.invoke(invokeRequest)), but it fails with "Read timed out" error. In the background (in AWS) the lambda completes its execution after sometime.Following is the lambda client bean creation code.LambdaClient lambdaClient = LambdaClient.builder()        .credentialsProvider(awsCredentialsProvider)                .region(Region.US_EAST_1)                .overrideConfiguration(ClientOverrideConfiguration.builder()                .apiCallTimeout(Duration.ofMinutes(30))                .apiCallAttemptTimeout(Duration.ofMinutes(30))                        .build()                )                .build();Following is the lambda invocation code.//This is a user defined pojo object that maps to lambda input json payloadUntarLambdaPayload untarLambdaPayload = UntarLambdaPayload.builder()                .sourceBucket(lambdaProps.getSourceBucket())                .destinationBucket(lambdaProps.getDestinationBucket())                .sourceKey("myTarFile.tar.gz")                .build();ObjectMapper mapper = new ObjectMapper();String jsonRequest = mapper.writeValueAsString(untarLambdaPayload);SdkBytes payload = SdkBytes.fromUtf8String(jsonRequest);            InvokeRequest invokeRequest = InvokeRequest.builder()                    .functionName(lambdaProps.getFunctionName())                    .overrideConfiguration(AwsRequestOverrideConfiguration.builder()                            .apiCallTimeout(Duration.ofMinutes(30))                            .apiCallAttemptTimeout(Duration.ofMinutes(30)).build())                    .payload(payload)                    .build();            InvokeResponse res = lambdaClient.invoke(invokeRequest);And I am getting the below exception.software.amazon.awssdk.core.exception.SdkClientException: Unable to execute HTTP request: Read timed outat software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build(SdkClientException.java:102)at software.amazon.awssdk.core.exception.SdkClientException.create(SdkClientException.java:47)at software.amazon.awssdk.core.internal.http.pipeline.stages.utils.RetryableStageHelper.setLastException(RetryableStageHelper.java:204)at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:83)at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:36)at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:56)at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:36)at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.executeWithTimer(ApiCallTimeoutTrackingStage.java:80)at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:60)at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:42)at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallMetricCollectionStage.execute(ApiCallMetricCollectionStage.java:48)at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallMetricCollectionStage.execute(ApiCallMetricCollectionStage.java:31)at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:37)at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:26)at software.amazon.awssdk.core.internal.http.AmazonSyncHttpClient$RequestExecutionBuilderImpl.execute(AmazonSyncHttpClient.java:193)at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.invoke(BaseSyncClientHandler.java:103)at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.doExecute(BaseSyncClientHandler.java:167)at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.lambda$execute$1(BaseSyncClientHandler.java:82)at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.measureApiCallSuccess(BaseSyncClientHandler.java:175)at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:76)at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:45)at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:56)at software.amazon.awssdk.services.lambda.DefaultLambdaClient.invoke(DefaultLambdaClient.java:2355)My code's further logic depends on the successful completion of the lambda function. If lambda is timed out then code cannot proceed with processing the untarred files in S3 bucket#2.I tried overrideConfiguration with apiCallTimeout and apiCallAttemptTimeout in InvokeRequest  (as well as in Lambda Client), but it did not work. I am going to do research on LambdaClient waiter functionality for which I haven't got any help so far on how to use it with Lambda.How can I make the lambdaClient.invoke(invokeRequest) wait until the lambda running in AWS completes its execution?FollowComment"

Answer: "1Accepted AnswerWhere does the client side of your code runs at (the app that is using Java SDK)? What might be happening is you're hitting the TCP Keepalive timeout. There's no traffic being sent either way on your TCP connection When SDK waits for Lambda to reply. Network appliances that you might have along the way might be closing idle connection after some period of time. For example if your app runs in a VPC environment and using NAT Gateway or VPC Endpoints for outbound connections to Lambda, the idle connections will be closed after 350 seconds. In this case the behavior will be consistent with what you're observing - the Lambda side will continue to run, and the client side will eventually timeout.If above description fits your case, you can try remediating it by doing two steps - (1) reducing the OS level TCP Keepalive time (2) enabling TCP Keepalive in Java SDK.  I'm going to add some details on both steps below.NOTE: Those steps are using advanced techniques by changing the default behavior for OS-level TCP keepalive settings and App-level HTTP client configuration. Use below description as a reference only, and make sure you understand what you're doing if you decide to apply it to real environments. This is a good article explaining TCP keepalive.By default it is common for a Linux environment to be configured with 7200 seconds (2 hours) of TCP Keepalive interval, which is obviously too high for your scenario. You can see the configuration by runningcat /proc/sys/net/ipv4/tcp_keepalive_timecat /proc/sys/net/ipv4/tcp_keepalive_intvlYou can update these settings by adding below properties to /etc/sysctl.conf and rebooting your system. You might want to use different values. In case you do have NAT Gateway or VPC Endpoint on your path make sure your keepalive is below 350 seconds. Other network appliances might have different timeouts. Below config means wait for 120 seconds before starting to send keepalive probes, and then send them with 30 second intervals.net.ipv4.tcp_keepalive_time=120net.ipv4.tcp_keepalive_intvl=30After reboot run the same cat commands to make sure new settings were applied.Build a custom ApacheHttpClient, enable TCP Keepalive, and use it when building your Lambda client. See below for a reference.        ApacheHttpClient.Builder apacheHttpClientBuilder = ApacheHttpClient.builder();        apacheHttpClientBuilder.connectionMaxIdleTime(Duration.ofSeconds(900));        apacheHttpClientBuilder.connectionTimeToLive(Duration.ofSeconds(900));        apacheHttpClientBuilder.socketTimeout(Duration.ofSeconds(900));        apacheHttpClientBuilder.tcpKeepAlive(true);        SdkHttpClient sdkHttpClient = apacheHttpClientBuilder.build();        RetryPolicy retryPolicy = RetryPolicy.builder().numRetries(0).build();        ClientOverrideConfiguration clientOverrideConfiguration = ClientOverrideConfiguration.builder()                .apiCallAttemptTimeout(Duration.ofSeconds(900))                .apiCallTimeout(Duration.ofSeconds(900))                .retryPolicy(retryPolicy)                .build();        LambdaClientBuilder lambdaClientBuilder = LambdaClient.builder();        lambdaClientBuilder.overrideConfiguration(clientOverrideConfiguration);        lambdaClientBuilder.httpClient(sdkHttpClient);        LambdaClient lambdaClient = lambdaClientBuilder.build();        InvokeRequest invokeRequest = InvokeRequest.builder().functionName(FUNCTION_NAME).build();        InvokeResponse invokeResponse = lambdaClient.invoke(invokeRequest);ApacheHttpClient class is coming from https://mvnrepository.com/artifact/software.amazon.awssdk/apache-clientCommentShareAnton Aleksandrovanswered a year agoAWS-User-2361124 a year agoThank a lot!! Spot on!! Using above code with ApacheHttpClient fixed the timeout issue.It is a POC, and currently I am running it in local. Yes, the client side of my code runs at the app that uses AWS Java SDK V2.When I will deploy it to my company's Java8/Openshift environment then I will test there. If it does not work as is then will apply the keepalive properties to /etc/sysctl.conf and see if that works.Thanks again!!ShareAnton Aleksandrov a year ago@AWS-User-2361124 Glad it worked for you! If you don't mind, can you please share the tcp keepalive values on your system? In my previous tests I couldn't get this approach to work without updating /etc/sysctl.conf on Linux-based OS, so I'm interested to see what settings do you have and what OS you're using. Also, can you please keep me posted with outcome of running the app on the OpenShift environment? Kubernetes-based environments require some additional tweaking in order to be able to update TCP keepalive. I have documented the steps for EKS, but would like to learn your OpenShift configuration.ShareAWS-User-2361124 a year agoI've run this on Windows so far. I don't know where to see tcp keepalive in windows.I will keep you posted when I will deploy it on linux/openshiftShare0Hi,When reading your question, I am unsure of how long you are waiting prior to receiving the timeout error. Is this error raised after several minutes, or does this get returned immediately?The max timeout for Lambda is 15 minutes. This maximum cannot be overridden, and if you are getting this error after 15 minutes, then that helps me to understand if this error is valid or not.If this is a valid error, meaning that you have exceeded the 15 minute timeout, then I suggest a different approach to solving this workload. First, you can try increasing the size of your lambda runtime. More CPUs and more memory may be the key to completing the operation within the time limit. If that does not solve the timeout, consider breaking the operation into separate activities, and have a separate lambda that runs separate operations. You can tie these different lambdas together using Step Functions. While this will take some work to separate the operations and create the Step Function job, the overall cost difference will be minor, since all of these operations are serverless. If these suggestions still do not solve this, then you will need to have your workload run in a persistent state that does not timeout. EC2 instances will meet this need.CommentShareByron_Ganswered a year agoAWS-User-2361124 a year agoThank you for the answer @Byron_G.It waits for ~120 seconds before timing out. AWS lambda timeout is set as 15 mins.The above suggestion given by Anton worked.Share"


Question: are federated IDPs consulted on token refresh via cognito user pools?

"As I understand it, when a user logs into a cognito user pool via federated IDP, the access token and refresh tokens are managed exclusively by cognito, so I can integrate with a single IDP and let cognito handle any details of the federated auth. This is exactly what I want, but I'm wondering if cognito is managing any corresponding refresh token for the federated IDP and checking in when a corresponding cognito token is refreshed. I'd like to be able to ensure that if the federated authentication is no longer valid then the cognito refresh will fail and wondering if cognito manages any of this automatically or if I need to integrate with the federated IDP and invalidate the corresponding user myself.FollowComment"

Answer: "0Accepted AnswerHi,Cognito doesn't validate with external IdP during refresh token flow, if the refresh token that is issued by Cognito is still valid, end-user can continue to get new access and id tokens from Cognito without needing to re-authenticate with the external IdP.If you have a use-case that requires validation with external IdP then I'd recommend using a short-lived refresh token (1 hour is the shortest TTL for refresh token) and this will force sign-in when token expires.CommentShareEXPERTMahmoud Matoukanswered a year agoemattheis a year agoThanks! That's what I assumed. In my case, I'd like to keep the long-lived refresh tokens for user convenience so I'm looking at ways to know if a federated identity has changed. Apple and Google both have some options:https://developer.apple.com/documentation/sign_in_with_apple/processing_changes_for_sign_in_with_apple_accountshttps://developers.google.com/identity/protocols/riscShare"


Question: Amazon doesn't work to send emails.

"I have created my plesk server with Lightsail, this is a hosting that I will use exclusively for myself but when creating email accounts the messages did not enter or leave the server.I sent permission to support to unblock port 25 and they only told me no and that I was thinking of using amazon ses, so I proceeded to create a service and connect my domain to amazon ses but it still doesn't work.I have managed to send emails but I have not been able to get them to leave the server and when I write to the inefficient technical support they only respond to me that I should consider using Amazon ses which I have not been able to make it work either and there is very little information on how to configure it on a lightsail plesk serverFollowComment"


Question: RDS Oracle 19c database - Grant DBMS_XA

"In an RDS Oracle 19c database, we try to give a user permissions to sys.dbms_xa with the admin user and it tells us "insufficient privileges"Command "GRANT EXECUTE ON SYS.DBMS_XA TO USER"Can you help us?FollowComment"

Answer: "0When you create an Amazon RDS for Oracle database instance, the default master user is created and granted the maximum user permissions on the DB instance with some limitations. Use this account for any administrative tasks, such as creating additional user accounts in the database. Because Amazon RDS is a managed service, SYS and SYSTEM users can't be used by default.Please check this Knowledge Center Article : https://aws.amazon.com/premiumsupport/knowledge-center/rds-oracle-user-privileges-roles/**Example: **SQL> GRANT SELECT ON SYS.DBA_TABLESPACE_USAGE_METRICS to EXAMPLE-USERNAME;GRANT SELECT ON SYS.DBA_TABLESPACE_USAGE_METRICS to EXAMPLE-USERNAME*ERROR at line 1:ORA-01031: insufficient privilegesSQL> EXECUTE  rdsadmin.rdsadmin_util.grant_sys_object(  p_obj_name => 'DBA_TABLESPACE_USAGE_METRICS', p_grantee => 'ADMIN', p_privilege => 'SELECT', p_grant_option => true);CommentShareSharathK-AWSanswered a year ago"


Question: DMS CDC for SQL Server - Replication

"I am using MS-SQL Server 2012 and 2016 on-prem. I want to capture CDC from this database and load it into Redshift using DMS. Since our tables have primary keys, MS-Replication seems to be the only option that will help facilitate this. Currently replication is not enabled and I want to understand the performance impact, any gotchas, possibles issues that can arise when turning replication on.FollowComment"

Answer: "0Accepted Answer==>MS-Replication seems to be the only option that will help facilitate this.In our documentation [1] it's written "MS-CDC, to capture changes for tables without primary keys", but if you read in details that is mentioned only when MS-replication isn't possible due to missing primary key. However, you can still use "MS-CDC to capture changes for tables, with or without primary keys. MS-CDC must be enabled at the database level, and for all of the tables individually".==>Currently replication is not enabled and I want to understand the performance impact, any gotchas, possibles issues that can arise when turning replication on.Kindly note in case of MS-Replication enabled on source database, DMS doesn't uses all replication components (i.e. Distributor, publisher & subscriber), but only distributor and publisher. However for ongoing changes, data is actually read from transaction log using sql server fn_dblog and fn_dump_dblog. So it won't have the same performance impact as you have it while running MS-replication(migrating data using Replication from sql server to sql server). As highlighted above, still if you identify that MS-replication is taking more resources, you can still go ahead and use MS-CDC to read changes.[1] https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.SQLServer.htmlCommentShareEXPERTViqashanswered 3 years ago"


Question: SES - suppression lists (don't send bounce emails)

I use an SES + SNS account to send emails to my client.I've started using the "Account Level Suppression List" for some customer emails that are being bounced. I have SNS topic set to send all bounces to a support email.But in that configuration I have not found an option to filter and not send bounce emails that are in the suppression list at the Account level. Is there any way of doing this?FollowComment

Answer: 0Maybe I don't fully understand your question but just wondering why you need to explicitly not send bounce emails? We at ValueInvesting.io - Discounted Cash Flow and WACC simply just ignore if the emails bounce.CommentShareAWS-User-8103096answered a year agoSultanovich a year agoThe problem is that although an email is already within the "Account Level Suppression List" our support email continues to receive the email from that bounced email.I really think that if we already decided to put you on the "Account Level Suppression List" there is no point in getting the email. That is what we want to avoid.Share


Question: Connection times out when trying to connect to IoT Core on Portenta H7

I am trying to connect to the MQTT broker and it says connection timed-out. The policy allows all actions and even the internet connection speed is fast.FollowComment

Answer: "0@Greg_BI am connecting to the MQTT broker on port 8883 with an X.509 certificate. This is my IoT policy:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "*",      "Resource": "*"    }  ]}I am following this guide:http://create.arduino.cc/projecthub/Arduino_Genuino/securely-connecting-an-arduino-mkr-wifi-1010-to-aws-iot-core-a9f365but I am trying to connect an Arduino Portenta H7.CommentShareAtharvaanswered 10 months agoGreg_B EXPERT10 months agoHi Atarva. Thanks for the link. The steps in that guide seem OK, but it depends on the CSR sketch being supported for your device and your device having an ATECC608A. I take it that it does?I note in the comments that other users have had difficulty getting the format of the certificate string correct. Please review the comments and re-trace your steps. Please share the device logs. Please also enable CloudWatch logs (https://docs.aws.amazon.com/iot/latest/developerguide/cloud-watch-logs.html) if you haven't already, and share any info from there.Share0Hi Atharva. Please refer to our Diagnosing connectivity issues documentation if you haven't already.If that doesn't help you resolve the issue, please then provide device logs and other relevant information about your connection such as protocol (MQTT or MQTT over WebSocket), port (8883 or 443), authentication type (X.509 certificate or something else), your IoT policy etc.CommentShareEXPERTGreg_Banswered 10 months ago"


Question: when trying to sign in to AWS I am receiving and error message back that "skylight quit unexpectedly"

When trying to sign in to my AWS account I try and click the bar to put my username in and the app closes out and sends back an error message stating that "skylight quit unexpectedly"FollowComment

Answer: "0This appears to be related to your WorkSpaces. For more information on troubleshooting common launch errors, visit Troubleshoot WorkSpaces issues.CommentShareBriNasAWSanswered 17 days ago"


Question: Crashing ECS Scheduled Task Remains Running

"We have a Java Spring Boot ECS Fargate Scheduled Task that has been running every hour for many months with no issues. On April 8, we noticed that our containers stopped terminating themselves on failure, and we racked up a decent bill once we noticed that we had hundreds of "running" containers that were simply doing nothing. I've looked at the logs and while we did see a spate of failures recently, we've seen similar/identical errors previously but with containers that terminated themselves. These tasks are connecting to Redis and getting an OOM error (which still needs looked into as well), but I think that problem simply surfaced this other much more costly problem.Has there been a change in behavior for scheduled tasks?FollowComment"

Answer: "0Accepted AnswerIf the process started by the ENTRYPOINT does not terminate instance will remain running.   That is the only way I know to have a container instance self-terminate.CommentShareRobert Loveanswered a month agoctucker a month agoTurns out, we had added a service that was holding a thread open and preventing the rest of the container from terminating.Share"


Question: How to run a command after deployment when using aws code pipeline BUT NOT aws code deploy

"I have a node application that I need to depoy to Elastic Beanstalk. I am using Code Pipeline to run the build and to deploy to Beanstalk, but then I need to start (npm start) the node server.How can I run the start command on Beanstalk after the code is deployed?Please note I am not using Code Deploy, the pipeline is deploying directly to Banstalk. Or do I need to use it (Code Deploy)?FollowComment"

Answer: "0Hello,I'm not super familiar with Elastic Beanstalk.  But if you are using containers, you should put the npm start command in the Entrypoint script when you build your image. If your run on EC2 it seems like .ebextensions is your answer.Hope this points you in the right direction!CommentShareCarl Ostrandanswered 4 months ago"


Question: "When using Rekognition, if you previously saved 1 million images in a Collection and do a SearchFaceByImage of 1 new image against those 1 million images, do you need to pay for 1 million API calls?"

"When using Rekognition, if you previously saved 1 million images in a Collection and do a SearchFaceByImage of 1 new image against those 1 million images, do you need to pay for 1 million API calls?FollowComment"

Answer: "1See the "Pricing example 2 – Multiple APIs and Face Detection" section in the Amazon Rekognition Pricing page.You will need to pay: (1) 1 million images * IndexFaces + (2) face meta data storage = 1 million faces metadata objects x $0.00001/face per month + (3) 1 new image * SearchFacesbyImageOnce the faces are indexed, you don't need to run the IndexFaces again. The information will be stored as metadata.CommentShareMia Canswered 9 months agoEXPERTChris_Greviewed 9 months ago"


Question: Can't Create SQS Queue From Docker-based Lambda

"Hi all,I'm write a lambda function in Python to create SQS queues when specific events occur via EventBridge. The function is then packaged as a Docker image. When I try to create the queue using the create_queue client methodimport boto3sqs = boto3.client("sqs")// sqs = boto3.client("sqs", endpoint_url="https://sqs.us-east-1.amazonaws.com")sqs.create_queue(QueueName="my-test-queue")I receive eitherAn error occurred (AccessDenied) when calling the CreateQueue operation: Access to the resource https://sqs.us-east-1.amazonaws.com/ is denied.orAn error occurred (AccessDenied) when calling the CreateQueue operation: Access to the resource https://sqs.amazonaws.com/ is denied.even though the Lambda function has the correct sqs:CreateQueue policy attached to its role.{    "Statement": [        {            "Action": [                "sqs:CreateQueue"            ],            "Resource": [                "*"            ],            "Effect": "Allow"        }    ]}The lambda IS NOT attached to any VPC.I tried to use ZIP based and console-created functions and the error does not occur.Does anybody have any idea about why I receive the error when the function is packaged as Docker image?Many thanks!FollowComment"

Answer: "0Accepted AnswerThe IAM policy on your lambda function must not have the correct permissions. There are a few things to try:Can you temporary grant sqs:* permissions instead of just CreateQueue and test that?Can you look at CloudTrail to see which API calls are getting denied?CommentShareChris Pollardanswered 10 months agoGianmarco 10 months agoThanks everybody for your replies!I figured out that the problem was about how the CreateQueue API returns the error message. Although the error was saying that I was not authorised to execute the CreateQueue operation, the lack of authorisation was not about it but it was about the TagQueue one.Part of the code was trying to callsqs.create_queue(QueueName="my-test-queue", tags={"Key1": "Value1"})which internally, it seems, calls the TagQueue operation. Of course, the TagQueue operation requires the sqs:TagQueue policy, which was not available within the role. The CreateQueue API response was catching the internal tag queue error, replying as something happened at that level.I hope this can help others who are running into these kind of issues.Share0If the lambda works fine when deployed using a zip file or from the console, then there is no issue with IAM permissions.If it is not working as expected only when it is deployed as a container, then there must be some issue with the container configuration. Please make sure you have followed the steps as mentioned in this blog post - https://aws.amazon.com/blogs/aws/new-for-aws-lambda-container-image-support/Have you tested the container locally?CommentShareEXPERTIndranil Banerjee AWSanswered 10 months ago0Hello,I agree with Indranil, It's probably a configuration issue in the container. My first guess would be that you have set one or more environment variables in the image:AWS_SECRET_ACCESS_KEYAWS_ACCESS_KEY_IDAWS_SESSION_TOKENAWS_PROFILEIf you run the shell command env, it will print all your environment variables, you can do this at the end of your docker file or when the lambda starts.  You can also unset this with this command in your Dockerfile: RUN unset AWS_ACCESS_KEY_ID; unset AWS_SECRET_ACCESS_KEY; unsetAWS_ACCESS_KEY_ID; unset AWS_PROFILEOr that the image has a ~/.aws/... directory so that the program picks up the wrong credentials (not from your role). If this is the case, run this in your docker file: RUN rm -rf ~/.awsFind more info about how the boto3 client reads its credentials here: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.htmlGood luck!CommentShareCarl Ostrandanswered 10 months ago"


Question: CloudFormation Macro registration

Hi. I'm developing few CloudFormation Macros and wondering if there is any option for registering  these for use by all CloudFormation users?FollowComment

Answer: "0Hi ssuk,I'm unaware of any 'community' sharing tool for CloudFormation. Is this what you were searching?I'll search and update my comment in case I find any information that might help.Best regards,Gabriel BartholomeuCommentShareGabriel Bartholomeuanswered 10 months agossuk 10 months agoHi Gabriel,  Yes, I'm looking for a sharing tool, something like Serverless plugins(https://www.serverless.com/framework/docs/guides/plugins) do.Share0There is some ability to share Resource Types and/or Modules, which could contain a Macro. Details on the CloudFormation Public Registry can be found here:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/registry.htmlYou will need to determine if this option suits your use case.CommentSharedanjhdanswered 10 months ago"


Question: AWS Glue 3.0 Docker Image - cannot install Jupyter NBExtensions

"I have set up my local glue development environment following instructions at https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-libraries.html and its working . I am trying to extend Jupyter by installing NB Extensions as in https://jupyter-contrib-nbextensions.readthedocs.io/en/latest/install.htmlpip command executes finepip install jupyter_contrib_nbextensions --userI encounter an error on this step :jupyter contrib nbextension install --userPermissionError: [Errno 13] Permission denied: '/home/glue_user/.jupyter/migrated'I get a similar error on the Docker Log as well[W 2022-06-01 07:43:44.083 LabApp] [Errno 13] Permission denied: '/home/glue_user/.jupyter/lab/workspaces'Any help ?**Docker Image : **amazon/aws-glue-libs:glue_libs_3.0.0_image_01**Docker Started using : **docker run -it -v ~/.aws:/home/glue_user/.aws -v $JUPYTER_WORKSPACE_LOCATION:/home/glue_user/workspace/jupyter_workspace/ -e AWS_PROFILE=$PROFILE_NAME -e DISABLE_SSL=true --rm -p 4040:4040 -p 18080:18080 -p 8998:8998 -p 8888:8888 --name glue_jupyter_lab amazon/aws-glue-libs:glue_libs_3.0.0_image_01 /home/glue_user/jupyter/jupyter_start.shFollowCommentKoustavC a year agoSetting up the VS was easier.I did not find where to do this step though which is Step 8 on the VS set upPaste the following JSON and save it.{"python.defaultInterpreterPath": "/usr/bin/python3","python.analysis.extraPaths": ["/home/glue_user/aws-glue-libs/PyGlue.zip:/home/glue_user/spark/python/lib/py4j-0.10.9-src.zip:/home/glue_user/spark/python/",]}Share"

Answer: "0Permissions appear to be incorrect.1st terminaldocker run -it -v ~/.aws:/home/glue_user/.aws -v $JUPYTER_WORKSPACE_LOCATION:/home/glue_user/workspace/jupyter_workspace/ -e AWS_PROFILE=$PROFILE_NAME -e DISABLE_SSL=true --rm -p 4040:4040 -p 18080:18080 -p 8998:8998 -p 8888:8888 --name glue_jupyter_lab amazon/aws-glue-libs:glue_libs_3.0.0_image_01 /home/glue_user/jupyter/jupyter_start.sh2nd terminal$ docker exec glue_jupyter_lab ls -la /home/glue_usertotal 84drwx------ 1 glue_user root 4096 Jun  2 14:14 .drwxr-xr-x 1 root      root 4096 Feb 25 05:27 ..drwxrwxrwx 1      1000 1000 4096 Apr 13 09:44 .awsdrwxr-xr-x 1 glue_user root 4096 Feb 25 05:28 aws-glue-libs-rw-r--r-- 1 glue_user root   18 Jul 15  2020 .bash_logout-rw-r--r-- 1 glue_user root  193 Jul 15  2020 .bash_profile-rw-r--r-- 1 glue_user root 5441 Mar 31 11:22 .bashrcdrwxr-xr-x 1 glue_user root 4096 Jun  2 14:14 .cachedrwxr-xr-x 2 glue_user root 4096 Apr  1 06:10 .certsdrwxr-xr-x 2 glue_user root 4096 Jun  2 14:14 .ipythondrwxr-xr-x 1 glue_user root 4096 Apr  1 06:10 jupyterdrwxr-xr-x 3 root      root 4096 Apr  1 06:10 .jupyterdrwxr-xr-x 1 glue_user root 4096 Jun  2 14:14 livydrwx------ 1 glue_user root 4096 Apr  1 06:42 .localdrwxr-xr-x 1 glue_user root 4096 Jun  2 14:13 sparkdrwxr-xr-x 2 glue_user root 4096 Apr  1 06:10 .sparkmagicdrwxr-xr-x 3 glue_user root 4096 Apr  1 06:39 workspace$ The owner of .jupyter is root.How to fix2nd terminaldocker exec -u 0:0 glue_jupyter_lab chown -R glue_user.root /home/glue_user/.jupyterNow the .jupyter directory will be owned by glue_user.CommentSharemoritalousanswered a year agoKoustavC a year agoYes , but then the chown permission is denied on the docker console. Its asking for the root password , which I do not knowShare"


Question: 多网络接口，多ip地址配置路由策略，从那个公网ip进入就从对应的ip出去。

我在亚马逊云购买了一台服务器，并配置了两个弹性网络接口和对应的4个ip地址！配置如下然后我配置了路由策略，不知道对不对。network:ethernets:eth0:addresses:- 172.31.18.102/20- 172.31.19.19/20dhcp4: nonameservers:addresses:- 8.8.8.8routes:- to: 0.0.0.0/0via: 172.31.16.1table: 100- to: 172.31.18.102via: 0.0.0.0scope: linktable: 100- to: 172.31.19.19scope: linktable: 100routing-policy:- from: 172.31.18.102table: 100priority: 300routing-policy:- from: 172.31.19.19table: 100priority: 300eth1:addresses:- 172.31.30.237/20- 172.31.17.231/20dhcp4: noroutes:- to: 0.0.0.0/0via: 172.31.16.1table: 101- to: 172.31.30.237via: 0.0.0.0scope: linktable: 101- to: 172.31.17.231scope: linktable: 101routing-policy:- from: 172.31.30.237table: 101routing-policy:- from: 172.31.17.231table: 101version: 2我所有的公网ip都可以ping通，但是我的需求是ssh 52.52.106.253这个ip进入的，curl请求网站就从52.52.106.253这个ip出去，现在的出口ip都是50.18.215.189。可以帮助实现我的需求吗？FollowComment


Question: How to remove PinPoint service (not project)

"I am getting charged for having Pinpoint. I don't want it.  How can I completely remove it from my account?Note: I don't even have any projects, nor ever did.FollowComment"

Answer: "1For some reason I am getting charged about $.60/month (or such). I have never used it. Also, I am getting a notice about a new AWS policy with phone numbers, yet I don't have any phone numbers.I just want to nuke it.CommentShareGrandpa-Ganswered 10 months ago0Hello,With Amazon Pinpoint, you pay only for what you use. There are no contract negotiations and no minimum charges.Please check the Pinpoint pricing for details with respect to the charges. However, if you do not use the service, there should not be any charge associated to the same. Please reach out to the AWS Accounts and Billing team and they should be able to track down the usage and reimburse the costs, if unexplained.Link- https://aws.amazon.com/pinpoint/pricing/CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago"


Question: Combatibility with redis api for testing mockups

"I am just getting started with Golang and ElastiCache and wish to be able to use https://github.com/elliotchance/redismock. I realize that the full cluster capabilities differ significantly, but would I be able to do testing of my code using a mock redis client and have that code work when deployed against an Elasticache cluster?FollowComment"

Answer: "0Hi imarsman2,ElastiCache Redis is fully compatible with the Redis APIs and as you can see in this documentation [1] self-managed Redis applications can be migrated seamlessly to ElastiCache for Redis without any code changes. The only modification you need to apply when migrating your code to ElastiCache is to enter the endpoint of the cluster, see "Finding Connection Endpoints" [2] for more details about the endpoints. For your particular use case, if redismock is deigned to be compatible with Redis (with or without the cluster protocol), your code should not have problems to interact with redismock and ElastiCache.Please also note that in order to deliver a managed service experience, a few commands requiring advanced privileges are restricted in ElastiCache [3].I hope this will help![1] https://aws.amazon.com/elasticache/redis/[2] https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Endpoints.html[3] https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/RestrictedCommands.htmlCommentShareAWS-User-6380649answered 2 years ago0That is indeed helpful! Thank-you.CommentShareimarsman_xmlteamanswered 2 years ago"


Question: How do I trigger inline lambda function within cloudformation template during stack creation?

"I am trying to create S3 bucket based on a condition whether the bucket already exists or not. I am trying to use inline lambda for this purpose. How do I trigger the inline lambda function? Is there any other way to accomplish what I am trying to do here?FollowCommentkentrad EXPERT5 months agoWhat will you do if the bucket exists?ShareJMK 5 months agoIf it exists, do nothing. If it doesn't exist, create it.Sharekentrad EXPERT5 months agoOK for CloudFormation to not manage the bucket? What if the bucket is owned by another account?ShareJMK 5 months agoBucket is going to be created and owned by the same account.Share"

Answer: "0Hello,So you can use a lambda function that takes and event as input which can contain a "bucket_name" field with the name you want. Then using the native boto3 library, create an s3 client and check if it exists already by calling the "head_bucket" method. If it doesn't exist, have the function create it with the "create_bucket" api call. finally, you can add a statement to just print the bucket name if it already exists. Feel free to reference the code below as a base:*You will need to replace the "event" and "context" parameters with the desired event and objects for when the function is called.Hope this helps!import boto3def create_s3_bucket(event, context):    # Get the bucket name from the event data    bucket_name = event['bucket_name']        # Create an S3 client    s3 = boto3.client('s3')        # Check if the bucket already exists    try:        s3.head_bucket(Bucket=bucket_name)    except s3.exceptions.NoSuchBucket:        # Create the bucket if it does not exist        s3.create_bucket(Bucket=bucket_name)        print(f'Bucket {bucket_name} created')    else:        print(f'Bucket {bucket_name} already exists')CommentShareCloud_Ganswered 5 months agoJMK 5 months agoThank you for your response. I have already tried what you have suggested. The function doesn't get triggered and the bucket name doesn't get passed to the function either because I don't see S3 bucket. I see that the function is created but the Custom Resource remains in "Create in Progress" status until I delete the stack.Share0What are you using as an event trigger for Lambda? CloudTrail or EventBridge?CommentShareCloud_Ganswered 5 months ago"


Question: How to solve instances with failed status checks?

"Hi, I am EC2 user and suddenly I can't connect to EC2 server through SSH and it's giving me 'instance status check fail'.Therefore, I rebooted the EC2 and checked the booting log following document:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.html#troubleshooting-retrieve-system-logsHowever, none of the expected errors written on the official documents are matching with my booting log. I am using Elastic IP.What should I do?FollowComment"

Answer: "0Hello,I understand that you did not find any answer with the common problems and solutions. Actually there are many problems that could cause what you are telling us, in which case I give you some more options:Validate which check status you have the error:If we have the System status checks, in which you would have to wait for AWS to fix the error or try to redeploy the instance, it is very likely that the problem is an underlying hardware error (since it would be within its scope according to with the responsibility model).If we have an error at the Instances status check level, the error can generally come from the operating systems or network level, although there are also changes such as a resize of the instance size that could cause this problem, here you can go ahead with the stepDocs: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-system-instance-status-check.htmlHere I recommend you go in this sequence:Check the latest changes made to the instances.Validates if these changes were able to affect the behavior of the instance.Using the Monitoring options, validate the status of the instance in Actions, Monitor and troubleshoot, Get system log and in Monitor and troubleshoot, Get Instances Screenshoot if you find any errors at the operating system level. In Get system log you could get an error log at the time of boot (disk error, memory, etc) and in Get Instances Screenshoot you could visually verify it in an image of the terminal, from the error look for the solution. If you wish, you can share the logs that appear in the console with us.Docs: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.htmlGreetings.CommentSharehmunozanswered 4 months ago"


Question: EC2 - Other charges

"Hi,This month I moved out from AWS free tier and now I am seeing charges under EC2 - Other category. I do not have any EC2 instances running. I had created certain instances earlier which I stopped. Here is a snapshot of my EC2 dashboard: https://ibb.co/ZNS5fZLAny pointers on how can I check this?TIA,dbeingsFollowComment"

Answer: "1You have two instances with two provisioned volumes. Even not running you pay for those volumes that are provisioned. In order to stop paying you must to terminate those instances. And to make sure please check your AMIs and snapshots, if you have something there it will also have a cost.CommentShareWesley Milananswered 5 months agoEXPERTkentradreviewed 5 months ago1You are paying for the EBS volumes , AMI and Snapshots although the cost for AMI and snapshots are minimal even if your instances are stopped.If your application has some logic towards it then AMI/snapshots needs to be there as backup from where you can just get the data back whenever you need it.CommentShareShashank Abhishekanswered 5 months ago0After stopped EC2 following thing you need to check :Any elastic IP attached to EC2 should get de allocate. if keep there then there will be charges for reservationDefault EBS volume you need to delete also if any extra EBS volume you added can check in EBSIf any ELB ( load balancer ) attached to EC2You can go to Billing dashboard select month can find there EC2 category what are you getting charge can easily find.CommentShareAvinash Shashikant Dalvianswered 5 months ago"


Question: Amplify - host two apps on a single domain?

"I have a Vue js app running on a subdomain - app.domain.com.The homepage is simple html/css and I want to host it at www.domain.comI want to keep these two projects separate as I am managing the Vue code, and someone else is handling the non-app pages using different technologies with different deployment schedules.Both are in their own git repo and I have set up two separate Amplify apps. I have already successfully set up the Vue application to point to the 'app' subdomain.Trying to set the domain for the homepage Amplify application to www.domain.com tells me (correctly) that domain.com is in use with another Amplify app.Any suggestions as to how I get around this?For example, can I put the two projects in the same repo, pointing one to  app.domain.com  and the other to www.domain.com?ThanksFollowComment"

Answer: "1Accepted AnswerThis is possible but I think you can not do it from GUI. I have 2 Amplify applications sharing the same domain; blog.carriageretun.nl and personal.carriagereturn.nl. You can read the full story from https://carriagereturn.nl/aws/amplify/static/web/hosting/2019/01/18/amplify.htmlWhen you assign custom domain for your application, Amplify Console GUI will always want to take over the whole domain. I had carriagereturn.nl hosted on Route 53 and when I sliced a sub-domain blog.carriagereturn.nl, it wasn’t possible to assign it for app, but Amplify Console always register it as carriagereturn.nl. Work-a-round is use AWS CLI to assign a sub-domain for app. Here is an example from AWS Forum showing how to do this. Remember to replace ROOT_DOMAIN, SUB_DOMAIN, APP_ID and BRANCH with your application specific values.aws amplify --region us-east-1 create-domain-association \ --app-id APP_ID --domain-name ROOT_DOMAIN \ --sub-domain-settings "[{\"prefix\": \"SUB_DOMAIN\",\"branchName\": \"BRANCH\"}]"CommentShareKalluanswered 4 months agorePost-User-KevDev 4 months agoThanks for the prompt response Kallu - looks like it will work for my use case.SharerePost-User-KevDev 4 months agoWorks perfectly - thanks again!Share"


Question: Cannot create appflow connector profile from AWS CLI

"I am trying to create a connector profile to create a connection with Salesforce for Appflow flows using this doc: https://docs.aws.amazon.com/appflow/latest/userguide/salesforce.html#salesforce-global-connected-appUsing the above aws doc, I tried to create a connector profile using the AWS CLI.I am using the below input:{  "connectorProfileName": "<connector name>",  "connectorType": "Salesforce",  "connectionMode": "Public",  "connectorProfileConfig": {      "connectorProfileProperties": {           "Salesforce": {               "instanceUrl": "https://<instance>.salesforce.com",              "isSandboxEnvironment": true          }      },      "connectorProfileCredentials": {           "Salesforce": {               "accessToken": "<access token>",              "refreshToken": "<refresh token>",              "clientCredentialsArn": "arn:aws:secretsmanager:us-west-2:<aws account>:secret:<secret name>",              "oAuthRequest": {                "authCode": "<code>",                "redirectUri": "https://test.salesforce.com/"              }          }      }  }}The response body I get is: {"message":"Client Error in the service"}As you can see, the response is not very helpful so I do not know where am I going wrong.Did I forget a field in the request payload. Did I input incorrect values? I simply do not know and hope someone can lead me to the right direction.I am aware of the ability to create this kind of profile through the console but it does not satisfy our use case.FollowComment"

Answer: "0Make sure you are using the latest version of AWS CLI.CommentShareEXPERTkentradanswered 8 months ago0Hi there,From the documentation follow the steps to create Secrets Manager with clientId and clientSecret and encrypt it using KMS Key, which has permission attached to be accessed by AppFlow. (You can skip this step, if it is already configured)There are two methods to create connector profile in Salesforce.Method 1: With authCode{  "connectorProfileName": "<connector name>",  "connectorType": "Salesforce",  "connectionMode": "Public",  "connectorProfileConfig": {      "connectorProfileProperties": {           "Salesforce": {               "instanceUrl": "InstanceURL",              "isSandboxEnvironment": true          }      },      "connectorProfileCredentials": {           "Salesforce": {              "clientCredentialsArn": "arn:aws:secretsmanager:{Region}:{Account-Id}:secret:{SecretKey}",              "oAuthRequest": {                "authCode": "<AuthCode>",                "redirectUri": "<RedirectUri>"              }          }      }  }}Method 2: Without AuthCode{  "connectorProfileName": "<connector name>",  "connectorType": "Salesforce",  "connectionMode": "Public",  "connectorProfileConfig": {      "connectorProfileProperties": {           "Salesforce": {               "instanceUrl": "InstanceURL",              "isSandboxEnvironment": true          }      },      "connectorProfileCredentials": {           "Salesforce": {               "accessToken": "<AccessToken>",              "refreshToken": "<RefreshToken>"          }      }  }}How to generate authCode ?Auth code can be generated using URL: https://<DOMAIN>/services/oauth2/authorize?response_type=code&client_id=<CONSUMER_KEY>&redirect_uri=<Redirect_Url>NOTE:<DOMAIN_URL> and <CONSUMER_KEY> can be viewed in Salesforce "My Domain" and "Manage Connected Apps" respectively.redirect_uri = Callback URL configured in your Salesforce Connected AppGenerated authCode can be used in creating connector profile using Method 1How to generate AccessToken and RefreshToken ?Once you get AuthCode from previous step, accessToken and refreshToken can be generated using below method:$ curl --location --request POST 'https://login.salesforce.com/services/oauth2/token?code=<authcode>&grant_type=authorization_code&client_id=<CONSUMER_KEY>&client_secret=<CONSUMER_SECRET>&redirect_uri=<redirectURI>' Sample Output:{ "access_token": "XXXXX", "refresh_token": "XXXXX", "signature": "XXXXX", "scope": "refresh_token SOMETHING", "id_token": "XXXXX", "instance_url": "InstanceURL", "id": "https://login.salesforce.com/id/XXXXX/XXXXX ", "token_type": "Bearer", "issued_at": "XXXXX" }access_token and  refresh_token can be used in creating connector profile using Method 2CommentShareSUPPORT ENGINEERNarayan_Sanswered 8 months ago"


Question: spinning off Sagemaker Ground Truth Labelling hosted UI with boto3

"Hi all!I would like to kindly ask how to spin off Sagemaker Ground Truth hosted labelling UI https://XXX.labeling.REGION.sagemaker.aws with boto3? With the hosted labelling UI, I could create a Cognito App that would allow the private workforce team to be authenticated and to perform labelling.Creating Private workforce from Sagemaker console creates a Cognito user pool and the App client automatically. The App is accessible under the URL https://XXX.labeling.REGION.sagemaker.aws and allows to perform the labelling. https://XXX.labeling.REGION.sagemaker.aws/oauth2/idpresponse is being set as an allowed callback URL as well as https://YYY.cloudfront.net. Allowed sign-out URL is being set as https://XXX.labeling.us-east-1.sagemaker.aws/logout.Btw. why is it necessary to set https://YYY.cloudfront.net as a callback?Thank you very much for you support,FollowComment"

Answer: "0Install and configure boto3 if you haven't done so already.Use the create_labeling_job function from the SageMaker client in boto3. Pass necessary parameters like HumanTaskConfig, InputConfig, and OutputConfig containing information about the labeling workforce, input data location, and output data location.import boto3sagemaker_client = boto3.client('sagemaker')response = sagemaker_client.create_labeling_job(    LabelingJobName='your-labeling-job-name',    LabelAttributeName='your-label-attribute-name',    InputConfig={        'DataSource': {            'S3DataSource': {                'ManifestS3Uri': 's3://your-input-data-bucket/your-manifest-file.manifest'            }        },        'DataAttributes': {            'ContentClassifiers': [                'FreeOfPersonallyIdentifiableInformation',                'FreeOfAdultContent',            ]        }    },    OutputConfig={        'S3OutputPath': 's3://your-output-data-bucket/'    },    RoleArn='your-sagemaker-execution-role-arn',    HumanTaskConfig={        'WorkteamArn': 'your-workteam-arn',        'UiConfig': {            'UiTemplateS3Uri': 's3://your-ui-template-bucket/your-ui-template.zip'        },        'PreHumanTaskLambdaArn': 'your-pre-human-task-lambda-arn',        'TaskKeywords': ['your-task-keyword'],        'TaskTitle': 'Your Task Title',        'TaskDescription': 'Your Task Description',        'NumberOfHumanWorkersPerDataObject': 1,        'TaskTimeLimitInSeconds': 600,        'TaskAvailabilityLifetimeInSeconds': 86400,        'MaxConcurrentTaskCount': 10,        'AnnotationConsolidationConfig': {            'AnnotationConsolidationLambdaArn': 'your-annotation-consolidation-lambda-arn'        }    })CommentShareEXPERTsedat_salmananswered 2 months agoadam 2 months agoTo create a labelling job, WorkteamArn is required. To create a Work Team, CognitoMemberDefinition (with UserPool, UserGroup, and ClientId) is required. To create a user pool with client App, callback URLs (i.e., https://XXX.labeling.REGION.sagemaker.aws and possibly https://YYY.cloudfront.net) are required. My question is, how to spin off https://XXX.labeling.REGION.sagemaker.aws? What does https://YYY.cloudfront.net do?Share"


Question: AWS Single Sign-On switch over

"I sheard my new active directory with my old account for an SSO switch over but i cant see the AD on the list of directories.,FollowComment"

Answer: "2Hi there!When it comes to AWS Managed Microsoft AD directory, when sharing this directory with cross accounts, it does not share the entire configuration. AWS Identity Center must link to a Directory that is created in its own account.It is also important to note that currently AWS Identity Center only supports 1 Identity Source per Organization. So should you wish to switch to a different source, the current configuration may be lost.If you are referring to the "Connect Active Directory" console page, and not being able to list your AD there, this could be explained by the AD not having been configured in the "old" account, as these configurations exist on a per account basis. Additionally, the documentation following should help with this setup: Create your AWS Managed Microsoft AD directoryFor further investigation I would recommend reaching out directly to AWS Support.CommentShareristanswered a month ago0Good answer Luke!CommentShareMichaelanswered a month ago"


Question: Summarize Transit Gateway Prefixes across Multiple TGW

"Customer with 2 Transit Gateways, both associated with the same Direct Connect gateway.They are looking to consolidate the prefixes on TGW A.Currently they have:TGW A10.1.112.0/20, 10.1.144.0/20, 10.1.160.0/20, 10.1.176.0/20, 10.1.204.0/24, 10.1.224.0/20, 10.1.241.0/24 etcTGW B10.1.0.0/20, 10.1.16.0/20, 10.1.208.0/20and would like to consolidate down to:TGW A10.1.0.0/16TGW B10.1.0.0/20, 10.1.16.0/20, 10.1.208.0/20My question is, will prefixes be resolved using the longest prefix first? So routes matching the longer subnet masks on TGW B will still be routed, with everything else under the /16 mask being routed to TGW A?FollowComment"

Answer: "0Accepted AnswerTGW is not the issue here explicitly. In Direct Connect Gateway you cannot currently have two Associations in DXGW with overlapping prefixes in their allow listif you created TGW B Association first, the 3 routes (10.1.0.0/20, 10.1.16.0/20, 10.1.208.0/20) would be added to the allowed list in the Direct Connect Gateway association settings, when you attempt to place 10.1.0.0/16 into the Direct Connect Gateway TGW A Association, you will get an error:"The requested allowed routes overlap with one or more existing allowed routes on the direct connect gateway"CommentShareAWS-User-0547701answered 2 years ago"


Question: 403 Error with SSL Cloudfront Static S3 website

"Hi,First time posting here so please be gentle :-)I have set up a very basic S3 site with Domain name using Route 53. All works swell on HTTP, I have followed a few guides and am banging my head against a brick wall. I used AWS certificate manager to create a wildcard certificate for *.mydomainname.com.... all works fine. created the cname records required in Route 53, all looks ok.Created a Cloudfront distribution and attached the certificate, and pointed to my S3 endpoint.I then updated my A name records to point to my cloudfront distribution. on http I get a 403 error, on https I now get an error of : "This might be because the site uses outdated or unsafe TLS security settings. If this keeps happening, try contacting the website’s owner."When I curl the domain I get the following errors on http and https on my domain and cloudfront domain nameC:\Users>curl -I http://example.cloudfront.netHTTP/1.1 301 Moved PermanentlyServer: CloudFrontDate: Tue, 03 Sep 2019 13:17:52 GMTContent-Type: text/htmlContent-Length: 183Connection: keep-aliveLocation: https://mysite.cloudfront.net/X-Cache: Redirect from cloudfrontVia: 1.1 example.cloudfront.net (CloudFront)X-Amz-Cf-Pop: LHR62-C2X-Amz-Cf-Id: S1MQtfkSEz9ZCMJwJMBmXY2s-EuKqKbOvr8ncQJVHknlqN6dt5Qkpg==C:\Users>curl -I https://example.cloudfront.netHTTP/1.1 200 OKContent-Type: text/htmlContent-Length: 234Connection: keep-aliveDate: Tue, 03 Sep 2019 13:04:32 GMTCache-Control: no-cacheLast-Modified: Sat, 10 Aug 2019 19:57:14 GMTETag: "ba30a221741da38d0f133cfd1524a452"Server: AmazonS3X-Cache: Miss from cloudfrontVia: 1.1  (CloudFront)X-Amz-Cf-Pop: LHR62-C2X-Amz-Cf-Id: b0HMW-WdPpe5ffTrJCc69uXil_3FSyjV0YDekoQ7k23r1cRO21Ubvg==C:\Users>curl -I http://mysite.comHTTP/1.1 403 ForbiddenServer: CloudFrontDate: Tue, 03 Sep 2019 13:05:15 GMTContent-Type: text/htmlContent-Length: 556Connection: keep-aliveX-Cache: Error from cloudfrontVia: 1.1 415cafe4893fa18caeab8a2e966de6c1.cloudfront.net (CloudFront)X-Amz-Cf-Pop: LHR62-C2X-Amz-Cf-Id: MtGq2dHVISm9pKZqfdbpjqfjekV5Mp6j8ZvGhGo-x3Aqau9fBzpZtA==C:\Users>curl -I https://mysite.comcurl: (35) schannel: next InitializeSecurityContext failed: SEC_E_ILLEGAL_MESSAGE (0x80090326) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.Someone please help as I'm not sure what I'm doing wrong, porbably DNS but it all looks ok to me and the amazon support seems to be telling me the same thing over and over. Thank you in advance.FollowComment"

Answer: "0Accepted AnswerPieceratops wrote:Thank you for replying it is much appreciated. In my certificate I have additional names for www.mysite.com and mysite.com of which I have CNAME entires in Route 53. Is that enough?Yes, that should be enough for the certificate.1) it looks like your "mysite.com" domain is not associated with your CloudFront distribution through a alternate domain name entry.I thought this was done through association at the beginning of the cloudfront set up? So I used my S3 as the origin?I see that you've set up S3 as your origin, but when I view your CloudFront distribution settings, the only internet domain name associated with it from a customer viewer point of view is d123.cloudfront.net name. With that name, only the default CloudFront certificate will be used. Even if you have Route 53 correctly configured to point 'mysite.com' to your CloudFront distribution, CloudFront won't recognize the incoming request as one that's associated with your distribution, because you don't have the alternate domain entry configured.  (Or if you do, I can't see it and there's a defect that we need to look into.)Follow ONE of these:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.html  has instructions that make it a one stop shop;-OR-https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-procedures.html#cnames-and-https-updating-cloudfront   takes you through a bit more of the CloudFront console pages, and explains the different CloudFront options.I would also suggest turning on logs, especially while getting things set up-- they're a huge help for debugging. If you're concerned about having logs pile up, you can configure S3 to automatically delete them after a short period of time.I have CNAME entries for mysite.com and www.mysite.com which were automatically created when I requested the cert (the handiness of using Route 53), are these just for the validation? I changed them to point to the cloudfront distribution but nothing seems to have changed?I have A records for mysite.com and www.mysite.com both pointing to my S3 bucket. I know this is something stupid I am doing but I have tried so many different combinations that I'm baffled nowEdited by: RonS@AWS on Sep 5, 2019 6:47 PM  --removed extra instructions that weren't required any longer--CommentShareAWS-User-8830163answered 4 years ago0Hi there-- There's a couple of things you need to do to make that last step work:it looks like your "mysite.com" domain is not associated with your CloudFront distribution through a alternate domain name entry.Pay attention to https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-requirements . Specifically, you say that your cert is for *.mysite.com, however you attempted to connect to 'mysite.com'.  The cert that you're associating with your account will treat those differently.Hopefully those two things will get you launched!CommentShareAWS-User-8830163answered 4 years ago0Hi,Thank you for replying it is much appreciated. In my certificate I have additional names for www.mysite.com and mysite.com of which I have CNAME entires in Route 53. Is that enough?1) it looks like your "mysite.com" domain is not associated with your CloudFront distribution through a alternate domain name entry.I thought this was done through association at the beginning of the cloudfront set up? So I used my S3 as the origin?I have CNAME entries for mysite.com and www.mysite.com which were automatically created when I requested the cert (the handiness of using Route 53), are these just for the validation? I changed them to point to the cloudfront distribution but nothing seems to have changed?I have A records for mysite.com and www.mysite.com both pointing to my S3 bucket. I know this is something stupid I am doing but I have tried so many different combinations that I'm baffled now :-(Thanks againEdited by: Pieceratops on Sep 4, 2019 12:03 AMEdited by: Pieceratops on Sep 4, 2019 12:17 AMEdited by: Pieceratops on Sep 4, 2019 1:08 AMCommentSharePieceratopsanswered 4 years ago0Thank you! I had not created the alternate domains on my cloudfront distribution! Once I did that the http to https redirect started working correctly.Many thanks again for your help.CommentSharePieceratopsanswered 4 years ago"


Question: Unable to establish a connection on VPN Tunnel 2

"I'm working with a partner who has a SonicWall firewall (NSA 6.5) and we're attempting to establish a Site-To-Site VPN between my AWS VPN and his SonicWall.   We are able to get tunnel 1 up and active, but tunnel 2 throws the following error.   Does anyone have a thought on what causes the following error we are seeing in CloudWatch?Thanks for any suggestions,DB{"event_timestamp": 1669073636,"details": "AWS tunnel was unable to decrypt the security payload(s)","dpd_enabled": true,"nat_t_detected": true,"ike_phase1_state": "established","ike_phase2_state": "down"}FollowComment"

Answer: "0There are specific troubleshooting instructions in this Knowledge base article for VPN Phase2 issues:https://aws.amazon.com/premiumsupport/knowledge-center/vpn-tunnel-phase-2-ipsec/Can you clarify if you are using Policy based VPN or Route based VPN, if route based is it Static route based or BGP?Lastly, are you using IKEv1 or IKEv2?If you are using IKEv2 you can change the Start-up action for the VPN, see this documentationStartup action: The action to take when establishing the VPN tunnel for a new or modified VPN connection. By default, your customer gateway device initiates the IKE negotiation process to bring the tunnel up. You can specify that AWS must initiate the IKE negotiation process instead.CommentShareEXPERTTushar_Janswered 6 months agoDB 6 months agoHi Tushar, thanks for your reply.   The tunnels are Route base, static and we are using IKEv2.   We are using a Start-up option of 'Add', but I have tried 'Start'  as well with no success.    Tunnel 1 works fine for us, as we are only get the error I mentioned above on Tunnel 2.   The AWS config for Tunnel 1 matches tunnel 2.    Do you happen to know what the error "AWS tunnel was unable to decrypt the security payload(s)" means?ShareTushar_J EXPERT6 months agoIf the configs of tunnel1 and tunnel2 are matching exactly then I suggest to open a Support ticket with AWS and SonicWall.ShareDB 6 months agoOk thanks.  I'll go that route.Share0To activate both tunnels. The ipsec tunnel config should have overlapip=yes parameter set. By default, it is no.From ipsec spec,a boolean (yes/no) that determines, when (left|right)subnet=vhost: is used, if the virtual IP claimed by this states created from this connection can with states created from other connections.Note that connection instances created by the Opportunistic Encryption or PKIX (x.509) instantiation system are distinct internally. They will inherit this policy bit.The default is no.This feature is only available with kernel drivers that support SAs to overlapping conns. At present only the (klips) mast protocol stack supports this feature.CommentShareHari Karthigasuanswered 2 months ago"


Question: RDS MySql Aurora - Select into outfile S3 stopped working with error: No response body

"When running select into outfile s3 we are all of a sudden receiving this error:ERROR 63994 (HY000): S3 API returned error: Unknown:No response body.This started two days ago, the error response isn't mentioned in any of the documentation.  This has been working perfectly for over a year since set up, all of a sudden multiple regions and RDS clusters are showing the same error.Has anyone seen the same error or know how to troubleshoot it further?   I've already followed the document here https://aws.amazon.com/premiumsupport/knowledge-center/amazon-aurora-upload-data-S3/And checked all our existing IAM roles etc, this is all automated by CDK and nothing has changed recently as far as I'm aware.ThanksFollowComment"


Question: Specify outbound caller ID using Connect Streams?

"We want to give our Streams application the ability to specify the caller ID for outbound calls based on the destination (based on value in our system, not based on country or area code). How can we initiate an outbound call for a specific agent that will use a specific caller ID number? I would think that this should be done by passing an attribute to the outbound call (we are currently using agent.connect() to initiate the call) and to then use a Lambda function called from the outbound whisper flow to specify the caller ID, but it doesn't seem possible to pass any attributes when initiating a call. We are open to any possible solutions.FollowComment"

Answer: "0You could possibly improvise on the example provided here https://aws.amazon.com/premiumsupport/knowledge-center/connect-dynamic-outbound-caller-id/It is using a Lambda function to set the outbound number into a variable outbound_number in Step 6. The function in the example determines it based on the a country but you could have your own logic to determine it.You may find this useful as well https://docs.aws.amazon.com/connect/latest/adminguide/queues-callerid.htmlCommentShareKishananswered a year agoAJ Spetner a year agoYes, I know I can use a Lambda to set the outbound caller ID (as I mentioned in my  question). My question is how I can pass the criteria to the outbound whisper flow. Our custom dialer (using streams) is what specifies the outbound caller ID number based on the person being called. How can I pass data to the whisper flow that the Lambda can then use to determine the caller ID?Share"


Question: Multipart upload process verification

"I'm using windows 10 with all the latest fixes and I have wireshark installed, too.  How can I verify that my AWS upload to my S3 bucket is using 6 processes like I told it to use in the config.  I'm not that familiar with wireshark and tasklist doesn't help me either.  I have my upload script coded in Python using boto3.FollowCommentjschwar313 8 months agoIn another forum, I was advised to use Process Explorer in Sysinternals Suite by Microsoft to see how many processes are running for a given parent/child relationship.  It shows that I'm only running one aws_pc_backup process.  I configured it to run 6, which I start running in aws_pc_backup, so I expected to see 6 children of aws_pc_backup.  Did I do something wrong?  I coded aws_copy_backups to call aws_pc_backup and aws_pc_backup starts the upload process using a config with 6 processes.  I code this in python using the boto3 utility.  Is there something I'm missing here?Here's the screen print of that Process Explorer screen:Sharejschwar313 8 months agoI did some more research and I'm using the client upload_file method to upload to s3.  In one area it mentions that a config can be provided, but in another area it doesn't mention config at all.  Which is the case?Did mention it here: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/s3.htmlNo mention here:  https://boto3.amazonaws.com/v1/documentation/api/latest/guide/s3-uploading-files.htmlSharejschwar313 8 months agoBy the way, I did double check.  I do, of course, have threads=True in my code.Sharejschwar313 8 months agoI will create an issue in GitHub under boto3 for this.Sharejschwar313 8 months agoi submitted an issue on this in github.https://github.com/boto/boto3/issues/3445Share"

Answer: "0Accepted AnswerI figured it out myself.  Process explorer in windows 10 from the sysinternals suite has an option to check properties of a process and then see how many threads that process is using.  I was able to see that my process was using 6 threads, so I'm happy.  Here's the screen print.CommentSharejschwar313answered 8 months ago"


Question: AWS Identity Center showing retired AD group

"I recently renamed one of the AD groups which was mapped to my AWS identity center from **access_group_thractor ** to access_group_tractor.I then went into AWS Identity Center and deleted the old group and added the new groupWhen I go back into the application the old group name **access_group_thractor ** keeps showing up inside AWS Identity center after deleting and adding the correct group name.FollowCommentChris 3 months agoTwo questions: 1) Why don't you manage the groups directly in the AD? 2) Did you set up AD sync?ShareDJFA_Cloud 3 months ago@chris The groups are created and managed in AD, also AD Sync is setupShare"

Answer: "0Hi,You should look at the ADsync attribute mapping. A Group might have different attribute (Common name, display name, etc.) and the one you changed might not be the used for the mapping and the creation in Identity Center.JeffCommentShareJeff Lombardo-AWSanswered 2 months ago"


Question: Compatibility issues on DLAMI with aws-neuron-dkms

"I have setup a DLAMI (both with Deep Learning Base AMI (Amazon Linux 2) Version 57.2 (ID: ami-07d28e42a376a75fe) or Deep Learning Base AMI (Ubuntu 18.04) Version 56.6 (ID: ami-0be3ca7b9b68fa36c)) and machine inf1.6xlarge.Then I installed everything according to https://awsdocs-neuron.readthedocs-hosted.com/en/v1.17.0/neuron-intro/pytorch-setup/pytorch-quickstart.html and to https://awsdocs-neuron.readthedocs-hosted.com/en/latest/frameworks/torch/torch-neuron/setup/pytorch-install.html#install-neuron-pytorch.Now when I go into the Jupyter Notebook of this one here https://awsdocs-neuron.readthedocs-hosted.com/en/latest/src/examples/pytorch/resnet50.html it seems to work nicely in the beginning but, at the end I get an error atmodel_neuron = torch.jit.load('resnet50_neuron.pt')saying2023-Apr-21 11:17:54.0589  8816:8816  ERROR   NRT:nrt_init                                This Neuron Runtime (compatibility id: 6) is not compatible with the installed aws-neuron-dkms package.2023-Apr-21 11:17:54.0589  8816:8816  ERROR   NRT:nrt_init                                Installed aws-neuron-dkms supports Runtime compatibility id range: 2 - 4.2023-Apr-21 11:17:54.0589  8816:8816  ERROR   NRT:nrt_init                                Please make sure to upgrade to latest aws-neuron-dkms; for detailed installation instructions visit Neuron documentation.---------------------------------------------------------------------------RuntimeError                              Traceback (most recent call last)Cell In[6], line 12      9 output_cpu = model(image)     11 # Load the compiled Neuron model---> 12 model_neuron = torch.jit.load('resnet50_neuron.pt')     14 # Run inference using the Neuron model     15 output_neuron = model_neuron(image)File ~/aws_neuron_venv_pytorch/lib/python3.8/site-packages/torch_neuron/jit_load_wrapper.py:13, in jit_load_wrapper.<locals>.wrapper(*args, **kwargs)     11 @wraps(func)     12 def wrapper(*args, **kwargs):---> 13     script_module = jit_load(*args, **kwargs)     14     found_neuron_function = False     15     for node in script_module.graph.nodes():File ~/aws_neuron_venv_pytorch/lib/python3.8/site-packages/torch/jit/_serialization.py:162, in load(f, map_location, _extra_files)    160 cu = torch._C.CompilationUnit()    161 if isinstance(f, str) or isinstance(f, pathlib.Path):--> 162     cpp_module = torch._C.import_ir_module(cu, str(f), map_location, _extra_files)    163 else:    164     cpp_module = torch._C.import_ir_module_from_buffer(    165         cu, f.read(), map_location, _extra_files    166     )RuntimeError: The PyTorch Neuron Runtime could not be initialized. Neuron Driver issues are loggedto your system logs. See the Neuron Runtime's troubleshooting guide for help on thistopic: https://awsdocs-neuron.readthedocs-hosted.com/en/latest/However, this is how it looks like on my Ubuntu machine(aws_neuron_venv_pytorch) ubuntu@ip-172-31-13-82:~/aws-neuron-sdk/src/examples/pytorch$ sudo apt-get install aws-neuron-dkms -yReading package lists... DoneBuilding dependency tree       Reading state information... Doneaws-neuron-dkms is already the newest version (2.3.26.0).0 upgraded, 0 newly installed, 0 to remove and 17 not upgraded.(aws_neuron_venv_pytorch) ubuntu@ip-172-31-13-82:~/aws-neuron-sdk/src/examples/pytorch$ sudo apt-get install aws-neuron-tools -yReading package lists... DoneBuilding dependency tree       Reading state information... Doneaws-neuron-tools is already the newest version (2.1.4.0).0 upgraded, 0 newly installed, 0 to remove and 17 not upgraded.Hence, it seems I have the most recent versions up and running. Do you know how to fix that?FollowComment"


Question: MWAA stuck in a loop while Creating Environment

"I created a VPC and subnets for MWAA and then took nearly all the defaults form there. I clicked on create and it has showed "creating" for nearly two hours. Eventually it went to a state of Create Failed. Cloudtrail shows that it was continuously creating and deleting an ENI and then it deleted the VPC endpoints.There is nothing that I can find that tells me what was wrong so I can correct it.How to I find out why this is happened?Edited by: SlobberingHorde on Jan 22, 2021 10:22 AMFollowComment"

Answer: "0Hi!Generally, a create failed after such a long time is due to MWAA not being able to access Amazon Elastic Container Registry (ECR) from your VPC.  Please check your VPC, or use the quick create link in the MWAA console to create a new one.Thanks!CommentShareJohn_Janswered 2 years ago0can AWS please delete resources from my account as they are currently stuck. Account id: 613348631361arn:aws:airflow:ap-southeast-2:613348631361:environment/my-mwaa-environmentarn:aws:airflow:ap-southeast-2:613348631361:environment/MyAirflowEnvironmentCommentSharejorourkeanswered 2 months ago"


Question: Can I rotate my secret every hour?

"I use SecretsManager to rotate my third-party OAuth access tokens, which look like the following:{:access_token "",:token_type "bearer",:expires_in 3600,:scope "full-access",:refresh_token ""}Currently, the minimum rotation interval in the UI is measured in days, however, as you can see, my service access tokens expire in 1 hour (3600s). Is there a way to specify the rotation to 1 hour or do I need to trigger manual immediate rotation and manage the time expiration in my applications?FollowComment"

Answer: "1I know this was 3 years ago, but I thought I would add a reply here as I came across this problem myself yesterday and wanted to share how I addressed it.Create the Secret and the Rotation configuration (including Lambda) as "normal" but without a Schedule. This means that whilst the secret can rotate it will never do it automatically but it means the RotateSecret API call works as designed.Create a simple 1 stage Step Function to execute the RotateSecret API call for this secret.Create a Rule in EventBridge using cron of 0 * * * ? *   (hourly) and have the Step function be the target.I now have the secret rotation occuring every hour.CommentSharedanjhdanswered a year agoPabloVera 10 months agoHi Danjhd, would you please explain how do you create a secret with rotation configuration (including Lambda) without the schedule? When doing it from the console, adding a schedule is required.Share0Secrets Manager does not support rotation intervals less than a day. You can, however, create a   regularly scheduled CloudWatch event (https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-Scheduled-Rule.html)  that will call your rotation lambda with your desired frequency.Of course, as with any lambda, the code must be idempotent and be able to handle the case where Lambda retries the call.CommentShareAWS-User-9028130answered 4 years ago0Do I call the lambda directly or do I tell secretsmanager to Rotate and let it do it's normal event execution?It seems like I can execute a rotation via the SDK, so rather than having CloudWatch Events re-implement the functionality of SecretsManager, I can have lambda call SecretsManager with something like:(secretsmanager/rotate-secret  :secret-id arn)Perhaps I can create a new even to trigger that code path. Thanks for your help.Edited by: leetcharmer on Jun 25, 2019 5:58 PMCommentShareleetcharmeranswered 4 years ago0What you propose should generally work. However, you have to keep the failure scenarios in mind. If a previous rotation failed (after the standard 5 retires), the next invocation of rotate-secret will restart the rotation, but will throw a InvalidRequestException with the message "A previous rotation isn’t complete. That rotation will be reattempted." This could happen, for example, if the database was down for a period of time or there were networking problems.If the lambda (the one invoked by CloudWatch) throws this exception, the implementation might retry, which will cause multiple retries of the rotation and possibly two back to back rotations if the first one suddenly succeeds. This may or may not be a problem for your applications, but you may need to add extra error handling to the lambda.CommentShareAWS-User-9028130answered 4 years ago"


Question: Workmail Failing on iPhone for One User Account Only

"We have multiple users in our organization, all who use WorkMail on mobile devices, specifically iPhones. Every account works well except for one. I can see no difference in permissions or in how it was set up, the account simply fails to validate when configured automatically or manually. We have tried the same account on multiple phones, from IOS 11-14. We have tried all of the tricks in the setup guide including manually configuring with our server etc. Any ideas?FollowComment"


Question: Pods IP address in EKS worker nodes

"Hi guy,I'm new for EKS and I have a question about IP address of pods in worker nodes.When I create an EKS cluster with some worker nodes then deploy a pod and do "kubectl get" command, I see each pod has its own IP address. I don't know how pods can get IP, do they use the IP of worker node. Any architecture or diagram can illustrate the IP allocation for pods.If you know how to answer my question, please help me.Thanks!FollowComment"

Answer: "0If each pod has an IP from your VPC you are using the VPC-CNI networking mode. The EKS Best Practices guide has a lot of information about the different networking modes and diagrams for how the VPC-CNI works.CommentShareNoah_Lanswered 6 months ago0Hello Steven,When you create an EKS cluster, VPC CNI plugin is installed into your cluster and it provides networking for pods.The VPC CNI allocates ENIs (Elastic Network Interfaces) to each worker node and uses the secondary IP range from each ENI for pod IP addresses.The VPC CNI runs an IPAMD (IP Address Management Daemon) on every node which is responsible for maintaining a warm pool of IP addresses, and assigning IP addresses to the pods.However, if you run a pod with hostNetwork: true, the pod will get the IP address of the host that it is running on.Please go through this EKS Best Practices document for more information related to EKS networking.Please leave a comment if you have any further questions. Thank you!CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 6 months agoEXPERTTasioreviewed 6 months ago"


Question: transition to glacier immediately

"Can we transition from S3 standard to s3 Glacier class immediately by putting 0 days in lifecycle rule. I have tried but it but data still in s3 standard class does it take time for transition?, My data is about 74 MB only. is there any minimum period till that time I must keep that data in S3 standard class?FollowComment"

Answer: "0If your objective is to store an object directly in Glacier, why do you want to go through S3 Standard first and then use a life-cycle policy to move the object to Glacier. You can use the CLI or SDK to directly upload archives to Glacier - https://docs.aws.amazon.com/amazonglacier/latest/dev/uploading-an-archive.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 9 months ago"


Question: How to contact AWS Academy Instructors at Appalachian State University

"I am interested in attaining information about AWS Academy from a human that is at ASU in Boone NC. I have seen the list here but have found no way to move forward with learning more about the program. I assumed AWS Knowledge Center might supply such information, thought that maybe my account support might lead me to a learning track more verbose than skill builder, but am still searching for contact information that will lead to a physical person to talk to. Any help would be great. Thank you ahead of time.FollowComment"

Answer: 0There is a contact form for Academy. See: Contact AWS Academy.CommentShareEXPERTkentradanswered 10 months ago


Question: "AWS Amplify/Appsync - Added a table to the schema, but api not updated"

HiI have added an additional table to schema.graphql and run amplify publish. The table has been created but I am not seeing new methods in the mutations.js/queries.js/subscriptions.js files to reflect the new table. This is a vue js app. Is there any other command I need to run to update the local sources?ThanksFollowComment

Answer: "0Hi AlatechThanks for your suggestion. I tried amplify push (which I think just pushes the backend) and then tried publish (I think pushes back and frontend?). Anyway, if I now do an 'amplify status' it returns that there are no changes in any of the Auth, Api or Hosting (the 3 amplify services I am using). If I do an 'amplify push' it simply returns with 'no changes detected' and returns. I have edited the schema a few times and tried push and publish and the files in /graphql/amplify are not being updated to reflect the new table. They have code to reflect the existing tables I have created.CommentSharerePost-User-KevDevanswered 3 months agoalatech EXPERT3 months agoThat is odd.Can you try to update the apiamplify update apiand then select GraphQL and Disable Conflict Detection as see if helps?SharerePost-User-KevDev 3 months agoHi AlatechLooks like conflict detection is already off. I ran the command and it provides the status:Conflict detection (required for DataStore)DisabledI will post a support query with AWS and update this post if/when I get a resolutionShare0Hi,You can try with amplify push.Modify the resources and even before deployment, it should show all resources that are going to be updated and Unchnged ones.Hope it helpsCommentShareEXPERTalatechanswered 3 months ago"


Question: How to request query from AWS Amplify with condition(Android Kotlin)?

"I have a question about use of conditionally requesting AWS Amplify queries.In the Amplify sample codes, I had to request every queries in database and add them to other array with condition(ex. owner == userId) to use it.fun queryNotes() {        Log.i(TAG, "Querying notes")        Amplify.API.query(            ModelQuery.list(NoteData::class.java),            { response ->                Log.i(TAG, "Queried")                Log.i(TAG, response.toString())                for (noteData in response.data) {                    Log.i(TAG, noteData.name)                    // TODO should add all the notes at once instead of one by one (each add triggers a UI refresh)                    UserData.addNote(UserData.Note.from(noteData))                }            },            { error -> Log.e(TAG, "Query failure", error) }        )    }However, if there are lots of queries(over than hundred thousands), i expected that it would cause low service quality such as low speed or excessive use of Amplify server resources.I want to know whether my expectation is right or wrong.If it is wrong, I want to know why it is wrong.If it is right, I want to know how to solve it such as giving condition on the requesting step or setting request condition on the Amplify studio.FollowComment"