Question: use django developing web site in aws ec2

"When I try to start the Django web server using the command "uvicorn DLAEv1.asgi: application --host 52.4.xxx.52 --port 8004",  I always get error "error while attempting to bind on address ('52.4.xxx.52', 8004)": cannot assign requested addressFollowComment"

Answer: "0Hi,I understand that you're trying to bind django on the Elastic IP addr 52.4.xxx.52 on an EC2 instance.Elastic IP addr are not directly binded on an EC2 instance, they are associated with an ENI of your EC2 instance which usually has a private IP from the VPC. That's why Django is unable to find this IP addr to bind on.If you have only one interface mounted on your EC2 instance you can find out with this command on linux " ip addr " and "ipconfig" on windows.finally, replacing your --host 52.4.xxx.52 with the local IP will fix the issue. ( ie : --host 172.31.xxx.xxx )For ref : https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.htmlCommentShareJulienanswered a year ago"


Question: Input route parameters in WebSocket API with VPC Link integration

"I have a WebSocket API with a VPC link integration. When supplying the EndPoint URL I would like to input a route parameter (e.g. /users/{userId}/info). However I don't seem to be able to substitute this for an actual value. I have tried to use the available variables such as $request.body.userId and $input.body.userId. I have also tried to supply the variable by mapping it using request templates, but nothing seems to work.Does anybody know if it at all possible and if so, how?FollowComment"


Question: Elastic BeanStalk can't connect to ElastiCache Redis

"I'm having issues connecting from Elastic BeanStalk to ElastiCache Redis. When I SSH into the EBS instance and try to use redis-cli to connect, it times out. This is how I set up my environment:I have an existing VPC with two subnets.I created a Security Group specifically for this that has an Inbound rule for IPv4, Custom TCP, port 6379, source 0.0.0.0/0I created an ElastiCache Redis cluster with the following relevant parameters:Cluster mode: disabledLocation: AWS Cloud, Multi-AZ enabledCluster settings: number of replicas - 2Subnet group settings: existing subnet group with two associated subnetsAvailability Zone placements: no preferenceSecurity: encryption at rest enabled, default keySecurity: encryption in transit enabled, no access controlSelected security groups: the one I described aboveAs for the EBS environment, it has this configuration:Platform: managed, Node.js 16 on Amazon Linux 2 5.5.3Instance settings: Public IP address UNCHECKED, both Instance subnets checkedEverything else left defaultAfter getting all of that set up, I would SSH into the EBS instance and follow the directions here to install redis-cli and try to connect: https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/GettingStarted.ConnectToCacheNode.htmlI've tried using the Primary endpoint, the Reader endpoint, and all of the individual node endpoints, but I get a timeout error for all of them.Is there some configuration that I'm missing?FollowComment"

Answer: "0Hi there,I understand you are trying to connect to your Redis cluster from your Elastic Beanstalk instance but you are getting the timeout error. Timeout error is usually caused by how you have configured your security groups, Network Access Control Lists and Route Tables. If your EBS instance and Redis cluster are in the same VPC. On your inbound rules for Redis Cluster allow access from the security group used by your EBS instance instead of 0.0.0.0/0.  When your Redis cluster is in the same VPC as the instance, the security group that you will use to control access to your cluster is the one associated with the VPC [1]. If your EBS instance and Redis cluster are in different VPCs you will have to setup a VPC connection first following the steps in this documentation and ensure that:SG and NACL on the ElastiCache allow inbound traffic from on port 6379 from the security group used by your EBS instance and,SG and NACL on the Beanstalk instance allow outbound connections to the ElastiCache on the port 6379References:Using Elastic Beanstalk with Amazon ElastiCacheCommentShareCebianswered a year ago"


Question: How to increase the S3 Bucket Naming Characters from 63 to higher

"Hi Team,I have a requirement of creating a s3 bucket with prefix and Suffix. Prefix has a env name and Suffix has a region along with account number. Which led to exceed the naming limit (0 - 63). is there a way to increase it any other suggestionsFollowComment"

Answer: "0Accepted AnswerSorry, this is a hard limit you can't change.I think you could have longer names (128 char, I think...) in us-east-1 a long time ago, but that does not seem to be the case anymore.CommentShareCarl Ostrandanswered 7 months agorePost-User-2738569 7 months agoThanks You @Cark OstrandShare0The S3 file name (object key name) limit is 1,024 bytes ~ 1024 chars. I have just created an object with more than 100 chars. It is likely due to the OS limit of the computer you are using. You can rename the file using AWS CLI or SDK. You can refer to the documentation at https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-prefixes.htmlCommentShareronald_lanswered 7 months agorePost-User-2738569 7 months agoHi ronald_IThanks for you reply. I am trying create bucket with a specific name which has limit of 0 - 63. Unfortunately my bucket name has 64 chars. But not s3 object nameShare"


Question: Approach to prevent out-of-band (clickops) updates to CloudFormation created resources

"At one of my client organisation we have deployed almost all the AWS resources via CloudFormation/DevOps. On some occasions, users made updates to some of the resources directly via AWS console resulting in drift and other challenges. Thus, I am looking to see if there is any option to prevent users from making “updates” to all CloudFormation created resources.I can think of an option of deploying an SCP like below but not clear about all all actions need to be included in the SCP to prevent updates to many of the AWS resources which are deployed currently. Moreover this may result in a very long list of actions which may hit SCP policy limits as well. In this example I have only included ec2:RebootInstances for testing purpose but in reality I want to prevent all update/delete actions across all the resources.{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": "ec2:Describe*","Resource": "*"},{"Sid": "VisualEditor1","Effect": "Deny","Action": "ec2:RebootInstances","Resource": "*","Condition": {"StringNotEquals": {"aws:PrincipalArn": ["arn:aws:iam::xxxxxxxx:user/devopsuser",""]},"StringEquals": {"ec2:ResourceTag/DeploymentType": ["CloudFormation","Terraform"]}}}]}Is there any option available for this requirement?FollowComment"

Answer: "1To save yourself from specifying every action, you can use a wildcard for API actions (write actions) like Create*. Obviously, to prevent users from making out-of-band changes, restricting write actions would suffice. For those resources/actions that support tags, you can implement Attribute Based Action Control (ABAC). Using ABAC, you can reduce the number of policies (not only SCPs but IAM policies as well). Multiple users/roles can use the same policies but have different access based on tags (attributes).Also, you can consider using AWS Config to detect changes and apply remediation. This is more of a reactive solution but can help detect unpredicted changes.CommentShareTaka_Manswered 9 months ago1Thinking out loud here: most AWS resources created by AWS CloudFormation that support tagging (which is nearly all of them) often get AWS-generated cloud formation tags, i.e. aws:cloudformation:stack-id and so on. Might be worth looking into creating a policy that denies any action if these tags are present on the resources? Might not work for all resources, not all API calls support resource-level tagging conditions but that's a good "covers everything it can".CommentShareJohnPrestonanswered 9 months ago0Answers from Taka_M and JohnPreston are great.  I'm also looking into those methods.  In addition, if you are considering even more locked-down resources, you could also provision resources via Service Catalog or an external Pipeline such as GitHub/GitLab/Bitbucket/etc..  This way you could give access to those tools instead of direct access to the resources in the console, and keep console access mostly read-only.  As an example, we're looking to give EC2 console access (SSH/RDP) via Session Manager, and also restart the instance in the console, but otherwise read-only.  Hope this helps.CommentShareRob_Elanswered 9 months ago0Thank you all for all the great suggestions. I think I will start with an option of building a SCP based on CFN tags with limited console access in lower environment and try it out. For SCP, as per Taka_M's suggestion probably identifying suitable wildcards (Create* etc) makes more sense.CommentSharemj123answered 9 months ago"


Question: Amazon Route 53 query pricing

"Hi guys!I have 2 questions about Amazon Route 53 pricingFirstly, I see the price for standard queries is$0.40 per million queries – first 1 Billion queries / month$0.20 per million queries – over 1 Billion queries / monthWhat happens if my Route 53 is attacked by a large number of queries from Internet. Will I be charged for this invalid queries.Secondly, what happens if my Route 53 receive a query for a hostname that is not exist in record of Hosted Zone? Will I be charged for this query.If you know the answer, please help me.FollowComment"

Answer: "0Accepted AnswerFor your second question, you can find the answer in the following page - https://aws.amazon.com/route53/pricing/It says *"We charge the standard rate for the following DNS queries:Queries for which the domain name or subdomain name matches a record name but not the record type. For example, suppose you create a record for acme.example.com and specify a type of A. If we receive queries for acme.example.com with a type of AAAA, we'll charge for those queries. Some browsers automatically send both "A" and "AAAA" queries for a specified domain or subdomain name, so we recommend that you create both "A" and "AAAA" records where applicable.Queries for a record that doesn't exist (w.example.com)."*For your first question, do read up about Shield and Shield Advanced on the following page - https://aws.amazon.com/shield/faqs/CommentShareEXPERTIndranil Banerjee AWSanswered 7 months agoSteven 7 months agoThanks for your answer but I want to know how we could prevent Route 53 from being queried for a record that doesn't exist. My customers don't want to pay for this fee.Share"


Question: Disable direct access via static IP address to my website

"Hi,I have an AWS lightsail instance and now I can access to my website via domain and static IP address. I want to disable access to my website via IP address and keep access via domain name. Please, could you help me how can I do that?Thanks in AdvanceFollowComment"

Answer: "1Edit: Corrected the answer so that it actually makes sense.When a HTTP/HTTPS request is made to your web server, one of the headers passed is Host. If someone is using a browser and types http://www.example.com/ then you'll see www.example.com in the Host header. If they type http://1.2.3.4 then you'll see 1.2.3.4.So what you can do is configure your web server only to serve up your website when the Host header is your domain name. What you'd also generally do is configure it to serve a static page (which could be blank, it could show an error, it could be any HTML) for people accessing the web server with any other hostname.It depends on which web server software you're using, but for example: with Apache you'd configured this using the VirtualHost directive.CommentShareEXPERTBrettski-AWSanswered 9 months ago"


Question: My domain is still unresolvable

"Hi,I'm newby with Route 53 and I'm wondering why my domain venus-dating.com is still unresolvable.Here are the name servers set to my domain on Route 53:Name serversns-1474.awsdns-56.orgns-161.awsdns-20.comns-928.awsdns-52.netns-2010.awsdns-59.co.ukHere are the records for hosted zones:venus-dating.comASimpleNo35.181.129.231  600venus-dating.comNSSimpleNons-1690.awsdns-19.co.uk.  172800venus-dating.comNSSimpleNons-372.awsdns-46.com.  172800venus-dating.comNSSimpleNons-1376.awsdns-44.org.  172800venus-dating.comNSSimpleNons-1005.awsdns-61.net.  172800venus-dating.comSOASimpleNons-1690.awsdns-19.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400         900@.venus-dating.comASimpleNo35.181.129.231    600www.venus-dating.comASimpleNo35.181.129.231    600I precise that IP 35.181.129.231 is a public IP attached to my Lightsail Instance.I reseted all records this morning, but I'm not very confident in the fact that could solve my DNS issue.Many tahnks for your help and advises.FollowCommentGary Mclean 23 days agoI see its working now..ShareAWS-SUM 22 days agoHi Farid, please remove those nameservers, records, IP, domain-name, etc details from this post because they are pieces of information specific to your resources that are better to not share publicly.Share"

Answer: "0Hi Gary,Thanks for your reply!It's working now.But I added subdomain admin.venus-dating.com few hours ago inside the domain zone venus-dating.com but I have no results when I check DNS resolution...Should I create a new zone for this subdomain?CommentShareFaridanswered 23 days agoGary Mclean 23 days agoIs it a new subdomain or a simple A record or CNAME?Do you want records such as host1.admin.Venus-dating.com ?ShareGary Mclean 19 days agoYes, you will need a sub domain created in Route53 and also create NS records in the route domain pointing to the NS records of your subdomainShare0I checked your domain on Whois and your name servers are not correct.Your domain record needs the name servers updating to match the NS records in your route53 zone.Update the GLUE records as per https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlAlso ensure your route53 zone is public and not privateCommentShareGary Mcleananswered 23 days ago"


Question: EC2 instances are still showing as running on permanent failed dedicated host.

Please help to move the EC2 instances from permanent failed dedicated host.FollowComment

Answer: "0Can you recover the data using the method described in this document?https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-hosts-recovery.html#dedicated-hosts-recovery-workingIf you are using instance store volumes, please recover according to the following method.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-hosts-recovery.html#dedicated-hosts-recovery-unsupportedCommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: Performance Insights Counter Metrics and Database Load graphs not visible.

"Hello,We have an db.t3.large RDS instance running Postgres 11.4.  We have enabled performance insights but when we go to view the page for our database, we only see the bar chart at the bottom of the page.  Where the Counter Metrics and Database Load graphs should be visible, we only see a spinner that never loads the graphs.I have tried disabling and enabling performance insights on the database without success.Anyone else see this issue or have any ideas?Thank you and kind regards,Sean FlahertyFollowComment"

Answer: "0Accepted AnswerThere was an issue like this but it should be fixed now. It occurred when unselecting all the counter metrics. Workaround is to click 24h or 1 week time frame button, exit Performance Insight dashboard and then come back in.KyleCommentShareAWS-User-1731424answered 4 years ago"


Question: Getting "botocore.exceptions.EndpointConnectionError" on lambda client using boto

"I have a lambda function which invokes another lambda function using boto and it used to work. suddenly it started giving connection error. Below is the code of invocation-lambda_client = s.create_client('lambda',                                config=Config(connect_timeout=5, read_timeout=900, retries={'max_attempts': 2}))def some_func(payload):    response = lambda_client.invoke(        FunctionName=os.environ['another_func'],        InvocationType='RequestResponse',        Payload=json.dumps(payload)    )    return responseit gives error - botocore.exceptions.EndpointConnectionError: Could not connect to the endpoint URL: "https://lambda.us-west-1.amazonaws.com/2015-03-31/functions/arn%3Aaws%3Alambda%3Aus-west-1%3A{account_id}%3Afunction%3Afunc_name/invocations"FollowComment"


Question: Preventing high cost with Aws Personalize

I was testing AWS Personalize recommenders and I realize that I was using all which charge for real-time recommendations. Is there a way to use them not for charge on real-time?FollowComment

Answer: "2Accepted AnswerYes, take a look at asynchronous batch for Amazon Personalize here:https://docs.aws.amazon.com/personalize/latest/dg/recommendations-batch.htmlCommentShareEXPERTAshleyMilleranswered a year agoEXPERTFabrizio@AWSreviewed a year agoAWS-User-3037600 a year agoHi @amiller. Thanks for your answer. After tried this approach, I'm having this error on output file: "output":{"recommendedItems":[]},"error":"User error: Required fields for the provided recipe are userId"}. My input file its a json with:{"userId":"244922300825"}{"userId":"244922300827"}...ShareAshleyMiller EXPERTa year agoCan you post your the line of code that invokes the Personlize API?Share"


Question: Application Load balancer with ECS

"Hello, I have my dockerize app and I deployed that with ECS. Now I have one doubt, I choose the number of instances two, and the number of tasks also two, and it works well. My question is If I terminate one instance then in the target group, two tasks work on a single instance and after a couple of minutes new instance is automatically created but in the target group both task uses that first instance only. And in this case, the second instance is created successfully but ALB not using the second instance. Can someone guide me? ThanksFollowComment"

Answer: "2Accepted AnswerWhen using ECS with EC2 tasks do not re-balance automatically after a failure event unless autoscaling tells it to for some other reason (eg responding to performance). Check out this sample code which uses Cloudwatch events to modify a service back to 1 desired count and then back to 2 to respread the tasks.You might also want to consider using fargate instead of EC2. You can configure fargate to use all the possible AZ's in a region (usually 3) so if one task fails due to an AZ issue it will be restarted in a different AZ to the other task within the service by defaultCommentShareEXPERTPeter_Ganswered 7 months agorePost-User-9617035 7 months agoDoes it mean, till any of the failures the second EC2 instance will be running idle?SharePeter_G EXPERT7 months agotill any failure or if autoscaling tells ecs to scale up more than 2. EG you could change the desired count to 3 and then back down to 2 for a rebalanceShare"


Question: Desktop Pattern Refresh

"When a Windows Server 2022 instance starts up, it runs a short script to set the desktop pattern to Ec2Wallpaper.jpg, and also reset some other settings.Anyone know how to get that not to run?ThanksFollowComment"

Answer: "0Hi ThereThese settings are configured vie the EC2Launch service.  You can change the settings, here is the documentationhttps://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2launch-v2-settings.htmlCommentShareEXPERTMatt-Banswered 4 months ago"


Question: SSH key managment for multiple accounts

"Hi,We need to achieve:Possibility to create/delete ssh key pairs for instances hosted in multiple accounts, in one place (centralization)Possibility to assign permissions for the user we are ssh'ing into inside the instance, for example : IAM - admin user, should have admin ssh key, which will give full read/write permissions in virtual machine in which user is ssh'ing, and the IAM - support user, should have support ssh key, which will give less permissions.Any suggestions, in what we can look into, are welcome.As i googled a bit, the "AWS system manager" - "session manager" looks like it would work for us, but does it work for instances hosted in multiple accounts?JoannFollowComment"

Answer: "1Accepted AnswerYes, this is possible using roles in the different accounts. Here is an example of how one organization set this up, Replacing SSH access to reduce management and security overhead with AWS Systems Manager.CommentShareEXPERTkentradanswered a year ago1Additionally, please note you can also use AWS Secrets Manager to securely store and rotate SSH key pairsHow to use AWS Secrets Manager to securely store and rotate SSH key pairsCommentShareEXPERTTushar_Janswered a year ago"


Question: Lambda Function to detach policy from user

I have created an Cloudwatch Alarm which will trigger the Lambda Function where I need to create a lambda function to detach policy from IAM user.FollowComment

Answer: "2Hi - Not very clear what your ask is but yes you can use like detach-user-policy which removes the specified managed policy from the specified user.CommentShareEXPERTAWS-User-Nitinanswered 7 months agoEXPERTIndranil Banerjee AWSreviewed 7 months ago1The following document provides AWS SDK examples for detaching a policy from an IAM user - https://docs.aws.amazon.com/IAM/latest/UserGuide/example_iam_DetachUserPolicy_section.htmlThe example is only in Go, Python and Rust, but if you do not speak any of these languages, then you can find documentation details on the SDK in different langugages here - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachUserPolicy.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 7 months agoShubham 7 months agook Thanks!Share"


Question: EBS Snapshot and Volume creation

"We are currently working on designing a resilient system that can handle storage failure. I would like to know if this is even possible to achieve from an infrastructure point. The system will be consist of ELB -> ALB -> EC2. The autoscaling group will have 2 pool, one warm and one active pool (both contain a max of 1 instance). In order to achieve high resiliency we are planning on creating a snapshot of active instances EBS volume every 3 minute. In warm autoscaling pool we will have a warm instance ready to go. We will run a lambda every 3 minutes that will pull the latest snapshot and attach to the warm pool instance. In that way if any time the active goes down, the warm instance can come up with latest snapshot data. In theory this looks doable but is there any technical issues that we might run into? Also, how much time it takes for a volume to be built from a 500GB snapshot?Other info:a) There is only ~5KB/sec of data written per second during business hours only.b) The EBS volume will have around 500GB of dataThanksFollowCommentNuno_Q 8 months agoFurther information is needed to advise on the right architecture/solution:Is the resilience solution designed to be resilient by using just one Availability Zone or resilient thru the region where the application is deployed?Is the data stored in a folder/file system?Are the EC2's behind the ELB's in different AZs?The Operating System of the EC2s is Linux or Windows?Sharejg_dh 8 months agoHi @Nuno_Q, please find the answers below:Is the resilience solution designed to be resilient by using just one Availability Zone or resilient thru the region where the application is deployed?--Multi AZ onlyIs the data stored in a folder/file system?--Data will be stored in multiple foldersAre the EC2's behind the ELB's in different AZs?-- YesThe Operating System of the EC2s is Linux or Windows?-- Linux (RHEL8)Share"

Answer: "0Hello,This is not a good system design for resiliency, and is going to get expensive fast.  AutoScaling is designed for stateless instances, meaning there ideally shouldn't be any important data stored directly on the EBS volume of the ASG instance.  See bottom half for alternatives, and pick whatever might work for your specific application/architecture.Issues I see with it:Snapshot costs + timeA new warm pool instance would have to be launched each time you make a new snapshot/AMI, incurring EC2 running costs while it bootstrapsThere's only 1 running instance, so no mater how fast the warm pool instance is to come up, there's still going to be downtime while the failover happens (this might be acceptable for your use case, but something to be aware of)There would still be data loss from the last snapshotAlternative options:Create a data tier (RDS, DDB, or some other database/data storage layer) so store data in that the instances can retrieve so that each new instance would be identical.  This way you don't need to worry about warm pools at all unless the application itself has a very long bootup time.  This would also allow you to use the dynamic scaling part of AutoScaling to add/remove instance depending on loadAdd an EFS volume to the instance to store the data that might change, and have a userdata script in the ASGs Launch Template which mounts the EFS volume to any new instance (this could also remove the warm pool if its not needed).Have a secondary data volume(s) on the instance which is set to not be deleted when the instance is terminated.  Attach this volume to newly launched/started instancesRun 2 smaller instances at once (if the application supports it), to be safer in case of an AZ outage or issue with one of the instances (this could be done in addition to either of the above)CommentShareShahad_Canswered 8 months ago"


Question: AWS StepFunctions: sum() function returns error about not finding path

"I have a StepFunction with input:{  "Jobs": [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0]}and I want the sum of the values in this array. According to the Json-Path docs there should exist a .sum() function for this. When I try it here it even works. So I defined the following Pass state:"Sum Jobs": {  "Type": "Pass",  "Parameters": {   "Jobs.$": "$.Jobs.sum()"  }},Nevertheless executions fail with:"An error occurred while executing the state 'Sum Jobs' (entered at the event id #249). The JSONPath '$.Jobs.sum()' specified for the field 'Jobs.$' could not be found in the input '{\"Jobs\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0]}'"FollowComment"

Answer: "-1AWS Step Functions does not support functions in the path reference. It uses JSONPath expressions to identify a node, however has the following constraints:You can access object fields using only dot (.) and square bracket ([ ]) notation.The operators @ .. , : ? * aren't supported.Functions such as length() aren't supported.This Step Functions documentation that covers this can be found here.CommentShareSteveanswered a year agoMatthias Pichler a year agoThis is only valid for Reference Paths: i.e. ItemsPath, ResultPath and OutputPath. However InputPath, Parameters and ResultSelector can use the whole JsonPath syntax. I use filter expressions in these regularly. If you read the docs closely it distinguishes between normal and reference paths in the section you linked to and then states in each section which path is a reference path. For example in the blue box hereShare"


Question: External IDP's identity token validation failure

"While trying out https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html, getting the below error. What STS is actually looking for the validation? If the IDP's jwks API response contains x5c having public key and root CA certificates, can it handle token signature validation?<ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">    <Error>        <Type>Sender</Type>        InvalidIdentityToken        <Message>Couldn't retrieve verification key from your identity provider,  please reference AssumeRoleWithWebIdentity documentation for requirements</Message>    </Error>    <RequestId>dfd6341d-9686-4acb-8e41-03471c6f5ef0</RequestId></ErrorResponse>FollowComment"


Question: What does the Elemental Link Rack Mount Kit accessory consist of?

"I have a need to mount Elemental Links to 1RU shelves.  I came across the Rack Mount Kit as an available accessory when ordering.  What does the kit consist of, and do I need one kit per Link device?FollowComment"


Question: Duration of SageMaker caching of multi-model endpoints

"SageMaker offers a flag to indicate whether to cache models for a multi-model endpoint, that is enabled by default.https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_MultiModelConfig.htmlFor what duration does this get cached?I tried searching "sagemaker cache duration" and "ModelCacheSetting" but did not find any hits.  The use case is GDPR compliance and endpoint deletion and cleanup.FollowComment"

Answer: "0Based on our docThe cached models are unloaded and/or deleted from disk only when a container runs out of memory or disk space to accommodate a newly targeted model.In other words, if possible, the model will remain in memory and/or disk.CommentShareAWS-User-5210721answered 5 months ago"


Question: "Is it possible to update the user-defined authorizer context (i.e., event.requestContext.authorizer.context) after the initial authorizer lambda has already run?"

"I have a NodeJS/Websocket/API Gateway/Lambda application that is making use of the authorizer lambda's context capability (i.e., event.requestContext.authorizer.context) to store certain session data.  This context data is conveniently available for every subsequent lambda invocation after (and including) the websocket's $connect event.The problem is that some of the session data we have stored in the context will eventually become stale. Is there a way to update this authorizer context data after the authorizer has already run? I am honestly just trying to avoid unnecessary calls to DynamoDB.FollowComment"


Question: Upsert operation on PostGres or Aurora from S3 CSV file using aws_s3.table_import_from_s3

"Importing tens of thousands of rows into a PostGres table from S3 is awesome and incredibly fast, but is there any way to perform Upserts using the same process without creating staging tables?Ideally it would be nice to have the equivalent of the conflict keyword, and perform an update if the PK is already present, but is there anything simpler than a staging+merge operation? At the moment it looks like it needs:Create temporary tableaws_s3.table_import_from_s3 into temporary tableMERGE operation into main tableClear temporary tableand it needs this for all 20 tables we're merging...Open to any suggestionsFollowComment"

Answer: "0Your current architecture sounds standard (and good!).Part of the reason that CSV import is so fast is that it's only handling a limited set of functions. I'm pretty sure there's no ability to handle the on conflict idea there.CommentSharemdahlmananswered a year ago0Thanks for the feedback.What would be a nice simplification of the solution would be if there was a way of parsing the JSON structure in the S3 bucket directly as part of the import, as I currently have to split the JSON into individual files for each 'table' for the import process, then write a custom stored procedure to do the merge from each bucket.First world problems...CommentShareNotitiaanswered a year ago"


Question: Snapshots of encrypted EBS volumes

We know that the first snapshot of an EBS volume is a full copy and the next snapshots are incremental i.e. only the blocks that have been changed since the last snapshot are copied to S3.I want to know if this is true for encrypted volumes as well. Are the subsequent snapshots of an encrypted EBS volume full or incremental?FollowComment

Answer: "0Yes it's the same for encrypted volumes - the storage is incremental but you can use any snapshot as if it was a full one.  If you want more visibility you can query the sizes of your snapshots with a script like this Python one:## Works out approximate EBS snapshot sizes using the "EBS Direct APIs", available since Dec 2019,# to get the number of blocks in a volume's oldest snapshot, and number of changed blocks between# each two snapshots.# Still doesn't take into account any other optimisations like compression that AWS might do,# but is a lot better than the console which just shows volume size for every snapshot.# Also note by default the volume size is used as a quick approximation of the oldest snapshot's# size because it contains all data for the volume. But often the oldest snapshot will actually# be a lot smaller because EBS doesn't copy empty blocks.  You can get a more accurate estimate# by passing "--list-blocks" or "-l" which will count the number of blocks in each oldest snapshot# but it takes a lot longer.# # Version History:# 1-Jun-2022 Steve Kinsman - Initial version.import boto3import argparseparser = argparse.ArgumentParser(description='EBS Snapshot Sizes Report')parser.add_argument('--volumeid', type=str)parser.add_argument('-l', '--list-blocks', action='store_true')args = parser.parse_args()ebs = boto3.client('ebs')ec2 = boto3.client('ec2')def initial_snapshot_size(snapshotid):    """    Calculate size of an initial snapshot in GiB by listing its blocks.    """    num_blocks = 0    response = ebs.list_snapshot_blocks(        SnapshotId=snapshotid,        MaxResults=1000    )    blocksize_kb = response.get('BlockSize', 0) / 1024    while True:        num_blocks += len(response.get('Blocks', []))        # check if there's more to retrieve            token = response.get('NextToken', '')        if token == '':            break        response = ebs.list_snapshot_blocks(            NextToken=token,            SnapshotId=snapshotid,            MaxResults=1000        )    return num_blocks * blocksize_kb / (1024 * 1024)filters = []if args.volumeid:    # Filter snapshots by the specified volume id    filters = [        {            'Name': 'volume-id',            'Values': [                args.volumeid            ]        }    ]snapshots = ec2.describe_snapshots(OwnerIds=['self'], Filters=filters).get('Snapshots', [])if snapshots:    # Sort snapshots by volume ID and then by tomestamp    snapshots.sort(key=lambda snapshot: snapshot['VolumeId'] + str(snapshot['StartTime']))    # For each volumeid go through the snapshots, reporting oldest one based on all data in the volume,    # then subsequent ones have size calculated from the changed blocks    v_prev = None    sid_prev = None    total_gb = 0    num_volumes = 0    for row in snapshots:        v = row['VolumeId']        sid = row['SnapshotId']        # Strip off ms & timezone info        timestamp = str(row['StartTime']).split('.')[0].split('+')[0]        # Is this for the same volume as last time?        # And not for the special vol-ffffffff whose snapshots won't be related to each other?        if v == v_prev and v != 'vol-ffffffff':            # Same volume as previous, so work out what changed            change_info = ebs.list_changed_blocks(FirstSnapshotId = sid_prev,SecondSnapshotId = sid)            num_changed = len(change_info['ChangedBlocks'])            blockSize_kb = (change_info['BlockSize'] / 1024) if num_changed else 0            gb = num_changed * blockSize_kb / (1024 * 1024)            total_gb += gb            print(f' - {timestamp}, {sid_prev} to {sid}: {gb:0.3f} GiB')        else:            # new volume            num_volumes += 1            gb = row['VolumeSize']            # Have we been asked to get a more accurate initial snapshot size by listing its blocks?            if args.list_blocks:                gb = initial_snapshot_size(sid)            total_gb += gb            print(f'{v}:')            print(f" - {timestamp}, Initial Snapshot {sid}: {gb:0.3f} GiB")            v_prev = v            sid_prev = sid    print (f'Total snapshot storage estimate: {total_gb:0.3f} GiB across {num_volumes} volumes')else:    print('No snapshots in this region owned by me.')        CommentShareEXPERTskinsmananswered a year ago"


Question: Different Total Cost in Cost Explorer vs API

"Hi,I'm having an issue related to a discrepancy between what is shown in the Cost Explorer and Billing pages in the AWS console vs what is returned over the API.Previous to March 2023, both views (console and API) would show the same total cost. March 2023 was the first month we implemented a Savings Plan so we changed from using the Unblended data set to using Amortized (this change was applied to both our console settings and API usage) - I believe the Savings Plan is the source of this issue somehow, since it just showed up this month.Viewing our cost for March 2023 in Cost Explorer shows the total cost as $17,409 as seen here:However, when attempting to pull the same data over the API, it shows $16,843 as the total cost for the month. The code used to query the API is the following in Python:    client = boto3.client("ce")    total_cost = client.get_cost_and_usage(        TimePeriod={"Start": '2023-03-01', "End": '2023-03-31'},        Granularity="MONTHLY",        Metrics=["AmortizedCost"],    )["ResultsByTime"]    print(total_cost)# -> [{'TimePeriod': {'Start': '2023-03-01', 'End': '2023-03-31'}, 'Total': {'AmortizedCost': {'Amount': '16843.7283177265', 'Unit': 'USD'}}, 'Groups': [], 'Estimated': False}]This discrepancy exists no matter which data set I use (unblended or amortized) and also only exists for March 2023.Does anyone have insight on how I might rectify? We rely on the API for running some cost analysis that can't be done through the console but if it's giving inaccurate costs we can't use it.Thanks!FollowComment"

Answer: "1Accepted AnswerHello mburger,You're finding different values because CE API deals with End (in TimePeriod) as exclusive.The boto3 documentation says:The end of the time period that you want the usage and costs for. The end date is exclusive. For example, if end is 2017-05-01 , AWS retrieves cost and usage data from the start date up to, but not including, 2017-05-01.With that in place, promote the following changes in your code to find the same you saw at the screenshot:    client = boto3.client("ce")    total_cost = client.get_cost_and_usage(        TimePeriod={"Start": '2023-03-01', "End": '2023-04-01'},        Granularity="MONTHLY",        Metrics=["AmortizedCost"],    )["ResultsByTime"]    print(total_cost)After test it, share your findings!CommentShareNightCrawleranswered 2 months agomburger 2 months agoYes, that brings the numbers into alignment, thank you for your help!Share-1Hello, check if Cost Explorer you're seeing it Aggregating costs by 'Amortized' (in Advanced options section). It seems that the screenshot was get with Unblended (the default).CommentShareNightCrawleranswered 2 months agomburger 2 months agoYes - Cost Explorer shows the same number regardless of whether using "Amortized" or "Unblended" data sets. The screenshot was taken using "Amortized".Worth noting that the API also reports the same cost regardless of which basis is used (Amortized or Unblended)I've updated the screenshot to show the advanced settings as well.Share"


Question: Unable to Upgrade EKS Control Plane or Managed Node Groups

"I have an EKS cluster that is currently on v1.17 with a set of managed nodegroups on v1.16. I'm trying to upgrade both to v1.18, but I've run into a catch-22 problem.To upgrade the control plane version to 1.18 the nodegroups must match the current cluster version (1.17), and upgrading the nodegroups to 1.17 results in an error ("Cluster's kubernetes version 1.17 is not supported for nodegroup. Minimum supported kubernetes version is 1.18"). Trying to create a new nodegroup results in the same error.My question is: is there a way to get out of this situation and potentially upgrade both components syncronously or is this cluster simply stuck at its current version indefinitely? It seems problematic that clusters can get into this state in the first place simply because they weren't mnaually upgraded for a period of time.FollowComment"

Answer: "0You should follow this guide https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html to make sure you keep your cluster upgraded before it is in end of support.If you are using gitops (with argocd or flux), you can create a new cluster and sync your yaml's from git to the new cluster.If you are not using gitops you can create a snapshot of all the yamls in your cluster with a tool like https://velero.io/and recreate your resources in a new cluster from the snapshot yamls'sCommentSharedovanswered 4 months agoChang 2 months agoWhat happens if you're in the situation described in the question? Do you need to create a new EKS cluster?Share0For future reference, you can create a self managed node group with the desired version for the nodes and then upgrade the cluster version.I used eksctl to create the self managed node groups but found it would update the existing security group rules and that it would also affect the aws-load-balancer-controller because of the newly created security groups. There was a bit of downtime for the time it took to manually update the security groups and the load balancer target groups.CommentShareChanganswered a month ago"


Question: AWS Config Gard Rule Evaluation

"Hello folksI am having a hard time understanding how AWS guard rules that fail and pass are evaluated when used with Config. I wanted to replicate an existing rule that detects public S3 buckets: https://github.com/aws-cloudformation/cloudformation-guard/blob/901d40a6f01553d14adf9ab398c7eec55c2b5a36/guard/resources/rules-dir/s3_bucket_public_read_prohibited.guardI realized that this rule applies to a cloudformation template. I wanted to apply it to a Config recorded object so i adapted the rule to:rule isPublicAccessBlockConfigurationBlockSecure when isPublicAccessBlockConfigurationBlockPresent {  supplementaryConfiguration.PublicAccessBlockConfiguration exists   supplementaryConfiguration.PublicAccessBlockConfiguration.blockPublicAcls == true  supplementaryConfiguration.PublicAccessBlockConfiguration.blockPublicPolicy == true  supplementaryConfiguration.PublicAccessBlockConfiguration.ignorePublicAcls == true  supplementaryConfiguration.PublicAccessBlockConfiguration.restrictPublicBuckets == true }When testing this locally (cfn-guard) i got a fail on an open bucket with an explanation along the lines:Property traversed until [/supplementaryConfiguration] in data [PublicBucketAccess-test-fail.json] is not compliant with [PublicBucketAccess.guard/absentPublicAccessBlockConfigurationBlock] due to retrieval error.I was under the assumption that if there is a retrieval error, Config marks the resource as non-compliant but it either provides no results or marks it as compliant and does not give any error. However, when i changed to:rule isBucketToBeSecured when resourceType == "AWS::S3::Bucket" {  ...some checks...}rule isPublicAccessBlockConfigurationBlockPresent when isBucketToBeSecured {  supplementaryConfiguration.PublicAccessBlockConfiguration exists }rule isPublicAccessBlockConfigurationBlockSecure when isPublicAccessBlockConfigurationBlockPresent {  supplementaryConfiguration.PublicAccessBlockConfiguration.blockPublicAcls == true  supplementaryConfiguration.PublicAccessBlockConfiguration.blockPublicPolicy == true  supplementaryConfiguration.PublicAccessBlockConfiguration.ignorePublicAcls == true  supplementaryConfiguration.PublicAccessBlockConfiguration.restrictPublicBuckets == true }It now works. Does anyone know why Config has such a strange evaluation mechanism where a failure to retrieve a key gives no compliance results or marks the resources as good to go?Also, is there a cleaner way to test for the existence of a key before trying to access subkeys without causing a failure. When i used:rule taggedBucketIsSecure2 when resourceType == "AWS::S3::Bucket" {  let publicAccessBlockConfiguration = supplementaryConfiguration.PublicAccessBlockConfiguration  when %publicAccessBlockConfiguration exists {    supplementaryConfiguration.PublicAccessBlockConfiguration.blockPublicAcls == true    supplementaryConfiguration.PublicAccessBlockConfiguration.blockPublicPolicy == true    supplementaryConfiguration.PublicAccessBlockConfiguration.ignorePublicAcls == true    supplementaryConfiguration.PublicAccessBlockConfiguration.restrictPublicBuckets == true  }}I got:Rule [PublicBucketAccess.guard/taggedBucketIsSecure2] is not applicable for template [PublicBucketAccess-test-fail.json]I assume the problem is that since when does not evaluate to true, it skips the evaluation and instead of marking the resource as non-compliant it either fails or marks it as compliant.Thanks in advanceFollowComment"


Question: Only can reachable one day

"I have a instance, everything is perfect when the first day after it is set, reachable by Putty and set system.But when time pass after to 2nd day, the instance is not reachable more, no matter from external by Putty or connect inside of EC2, wrong information as below:Failed to connect to your instanceWe were unable to connect to your instance. Make sure that your instance network settings are configured correctly for EC2 Instance Connect. For more information, check Task 1 under the Set up EC2 Instance Connect AWS documentation.When i stop and reboot to get a new IP address, everything will be fine again, but only good in one day as well.FollowComment"

Answer: "0It looks like the instance ends up being unresponsive after gradual increase in load over the day. Depending on the instance type chose, you should check the CPU Utilisation / CPU Credits of the instance before you attempt a stop + reboot to rule out CPU bottleneck. Memory metrics are not available by default and you would need to configure CloudWatch agent for this. Another quick fix alternative, would be to switch to a higher instance type to check if the system uptime increases also. But that would obviously mean an increase in cost for that duration.Based on the behaviour you described, I'd assume system resources being a constraint and the need to switch to higher instance type. But better to validate it with metrics--SydCommentShareSydanswered 10 months ago"


Question: Cannot run Sample Project at iPhone - I see only black screen

"Hi,I am trying to deploy SampleProject to iPhone device.I configured iOS envirionment as described in the tutorial:https://s3.amazonaws.com/gamedev-tutorials/Tutorials/Mobile_iOS-Building_a_Project-(01)_Building_iOS.pdfand compiled game via XCode (debud profile) (and earlier by waf command in command line for profile target).But after installation to the iPhone device the screen is blacka and I get a few errors in console like:debug: <12:43:35> [Error] ERROR: CShaderSrv::Compile: could not connect to 192.168.2.104 (sys_net_errno=AzSockError::eASE_ENETUNREACH, retrying 0)debug: <12:43:35> [Error] ERROR: CShaderSrv::Compile: could not connect to 192.168.2.104 (sys_net_errno=AzSockError::eASE_ENETUNREACH, retrying 0)debug: <12:43:35> [Error] ERROR: CShaderSrv::Compile: failed to compile SunShaftsGenPS (Network Error)debug: <12:43:35> [Error] <?xml version="1.0"?><Compile Version="2.1" JobType="Compile" Profile="ps_5_0" Program="cbuffer PER_BATCH:register(b0)At specified machine 192.168.2.104 I have started Asset Processor and CrySCompileServer. Cache folder is shared with mac. All ports are opened.I do not see any activity in Asset Processor and CrySCompileServer during building and deployining in XCode.And then I have looped errors like:!!ASSERT!!Condition: !resToClear->m_bStencilLoadDontCareMessage : File : /Users/Sylwek/Downloads/lumberyard-1.9.0.1-398643-mac/dev/BinTemp/uber_files/CryRenderMetal/../../../Code/CryEngine/RenderDll/XRenderD3D9/DXMETAL/Implementation/METALContext.cppLine : 2418debug: <12:51:59> [Error] DXGL: Resource was given MTLLoadActionDontCare stencil flag. Stencil target's view cannot be set to be cleared. : [@?] /Users/Sylwek/Downloads/lumberyard-1.9.0.1-398643-mac/dev/BinTemp/uber_files/CryRenderMetal/../../../Code/CryEngine/RenderDll/XRenderD3D9/DXMETAL/Implementation/METALContext.cpp(2421)2017-07-24 12:51:59.507563+0200 SamplesProjectLauncher[698:170308] Execution of the command buffer was aborted due to an error during execution. Insufficient Permission (to submit GPU work from background) (IOAF code 6)2017-07-24 12:51:59.507661+0200 SamplesProjectLauncher[698:170308] Execution of the command buffer was aborted due to an error during execution. Insufficient Permission (to submit GPU work from background) (IOAF code 6)2017-07-24 12:51:59.507733+0200 SamplesProjectLauncher[698:170308] Execution of the command buffer was aborted due to an error during execution. Insufficient Permission (to submit GPU work from background) (IOAF code 6)2017-07-24 12:51:59.507761+0200 SamplesProjectLauncher[698:170308] Execution of the command buffer was aborted due to an error during execution. Insufficient Permission (to submit GPU work from background) (IOAF code 6)debug: <12:51:59> [Error] DXGL: This process does not have aceess to use device : [@?] /Users/Sylwek/Downloads/lumberyard-1.9.0.1-398643-mac/dev/BinTemp/uber_files/CryRenderMetal/../../../Code/CryEngine/RenderDll/XRenderD3D9/DXMETAL/Implementation/METALContext.cpp(2827)autoexec.cfg has:map Camera_Sample The mobile screen is black. Do you have any idea how to resolve it ?Follow"

Answer: "0Accepted AnswerHello @REDACTEDUSERThe problem you are experiencing is that the game running on the iPhone is unable to connect to the remote shader compiler (CrySCompileServer).ERROR:CShaderSrv::Compile: could not connect to 192.168.2.104(sys_net_errno=AzSockError::eASE_ENETUNREACH, retrying 0)Please verify that the firewall on the PC is setup correctly to allow the CrySCompileServer to be able to accept connections, receive and send data. Also make sure you create a config.ini file in the same directory of the CrySCompileServer executable that you are using and add an entry for the whitelist that contains the IP address of the iOS device you are using. Something like:whitelist=192.168.2.104You can also specify a net mask to allow a range of IP addresses to connect:whitelist=192.168.2.0/8orwhitelist=192.168.0.0/16The first example will allow any device that has an IP address that starts with 192.168.2 to connect. The second example allows any device that has an IP address that starts with 192.168 to connect.Thanks,ChrisSharerePost-User-1597227answered 6 years ago0Hi Jasiuj,The binding error is the remote shader compiler (CrySCompileServer) trying to connect to port 80 on the host computer and that is failing. I get the same error here when I start up the remote shader compiler and I'm able to connect to it with no problems.In general I have found when the game cannot connect to the remote shader compiler but you can telnet/ping it then it is a firewall issue or a network connectivity issue. If you are running windows 7 I would recommend removing the CrySCompileServer from the allowed applications then running the CrySCompileServer. This should prompt you if you want to add it as an exception to the firewall and you should say yes. For Windows 10 it is a bit trickier since it does not seem to handle exceptions the same way as Windows 7. I have had to go into the Windows 10 firewall and explicitly add the CrySCompileServer to the allowed applications to give it access.Something else to try is making sure the iOS device and the PC are on the same subnet. We have had reports from some of our internal teams that if the mobile device was on a different subnet as the PC then the mobile device would not connect to the remote shader compiler.As for which executable to run - either is fine. One is built with VS2013 and the other with VS2015. The code is the same between the both.Let me know how it goes.Thanks,ChrisSharerePost-User-1597227answered 6 years ago0Hi Chris,We have already provided this data. So we have still the same problem.Also I observed that Remote Shader Compiler have one warning:Could not bind server socketLoading shader cache from C:\Amazon\Lumberyard\1.9.0.1\dev\Tools\CrySCompileServer\x64\profile\Cache\Cache.dat0 shaders loaded from cacheCreating cache backup...Move C:\Amazon\Lumberyard\1.9.0.1\dev\Tools\CrySCompileServer\x64\profile\Cache\Cache.bak to C:\Amazon\Lumberyard\1.9.0.1\dev\Tools\CrySCompileServer\x64\profile\Cache\Cache.bak2Copy C:\Amazon\Lumberyard\1.9.0.1\dev\Tools\CrySCompileServer\x64\profile\Cache\Cache.dat to C:\Amazon\Lumberyard\1.9.0.1\dev\Tools\CrySCompileServer\x64\profile\Cache\Cache.bakCache backup done.caching enabledReadythat could not bint to server.By I can connect it via telnet from mac computer (this IP I already provided to white list - the IP of the mac computer where xcode is lunched from where I started game at iPhone device connected by cable).There I have in profile a two version of it:CrySCompileServer_vc120x64.exeCrySCompileServer_vc140x64.exeAs I understand it doesn't netter which one I have started ? Also the game I build as debug target on mac.SharerePost-User-0352889answered 6 years ago0Hi Chris,Thank You very much you resolve my problem.What I do wrong: I added and configured only MAC computer with Xcode and add it to CrySCompileServer white list instead configure it for my iPhone IOS device.So I turn on Wi-Fi connection, set static IP for my iPhone, bridge my Wi-Fi network with my Cable Network (I have 2 independent networks), then add this IP from iPhone device to white list of CrySCompileServer and everything works perfectly.Thank you for so fast response :)Kind regards,JanSharerePost-User-0352889answered 6 years ago0Excellent! I'm glad you got it worked out. Continue to post questions on the Forums so that we can help you on your journey of creating an iOS game with Lumberyard!Thanks,ChrisSharerePost-User-1597227answered 6 years ago0Hey guys, I was just wondering if how you got past the aligned allocation issue? I'm not able to deploy the Sample Project to my device, I am getting this error "Aligned allocation function of type ‘void*(std::size_t,std::align_val_t)’ is only available on IOS 11 or newer AZStdContainers.ini". Is this new unexpected behavior, and is there a way to bypass this?SharerePost-User-1886298answered 2 years ago"


Question: AWS Application Load Balancer and Http2 Persistent Connections ("keep alive")

"I have some questions about the "AWS Application Load Balancer" in regard to http2 persistent connections:Does the "AWS Application Load Balancer" itself maintain its own internal http2-connection-pool? (or nah?)If the load balancer does indeed maintain its own http2-connection-pool for persistent http2 connections I have these follow-up questions:I can't find anything in the AWS docs explaining how the size(s) of the http2-connection-pools (maintained by ALB) are configured (if at all).Can it maintain for example 2 million http2 connections open at the same time (for the sake of ultra low latency). At what cost (are there scaling costs)? Any links that elaborate on these aspects?Does the ALB, by default, maintain a fixed-size http2-connection-pool between itself and the browsers (clients) or are these connection-pools dynamically sized? If they are fixed-size how big are they by default? If they are dynamic what rules govern their expansion/contraction and what's the max amount of persistent http2-connections that they can hold? 30k? 40k? 5million?Let's assume we have 20k http2-clients that run single-page-applications (SPAs) with sessions lasting up to 30mins. These clients need to enjoy ultra-low latency for their semi-frequent http2-requests through AWS ALB (say 1 request per 4secs which translates to about 5k requests/second landing on the ALB):Does it make sense to configure the ALB to have a hefty http2-connection-pool so as to ensure that all these 20k http2-connections from our clients will indeed be kept alive throughout the lifetime of the client-session?Reasoning: In this way no http2-connection will be closed and reopened (guarantees lower jitter because reestablishing a new http2-connection involves some extra latency - at least that's my intuition about this and I'd be happy to stand corrected if I miss something)FollowComment"

Answer: "2Accepted AnswerHi Dominick, thanks for reaching out!So, when it comes to the concurrent connection limits of an Application Load Balancer, there is no upper limitations on the amount of traffic it can serve; it can scale automatically to meet the vast majority of traffic workloads.An ALB will scale up aggressively as traffic increases, and scale down conservatively as traffic decreases. As it scales up, new higher capacity nodes will be added and registered with DNS, and previous nodes will be removed. This effectively gives an ALB a dynamic connection pool to work with.When working with the client behavior you have described, the main attribute you'll want to look at when configuring your ALB will be the Connection Idle Timeout setting. By default, this is set to 60 seconds, but can be set to a value of up to 4000 seconds. In your situation, you can set a value that will meet your need to maintain long-term connections of up to 30 minutes without the connection being terminated, in conjunction with utilizing HTTP keep-alive options within your application.As you might expect, an ALB will start with an initial capacity that may not immediately meet your workload. But as stated above, the ALB will scale up aggressively, and scale down conservatively, scaling up in minutes, and down in hours, based on the traffic received. I highly recommend checking out our best practices for ELB evaluation page to learn more about scaling and how you can test your application to better understand how an ALB will behave based on your traffic load. I will highlight from this page that depending on how quickly traffic increases, the ALB may return an HTTP 503 error if it has not yet fully scaled to meet traffic demand, but will ultimately scale to the necessary capacity. When load testing, we recommend that traffic be increased at no more than 50 percent over a five minute interval.When it comes to pricing, ALBs are charged  for each hour that the ALB is running, and the number of Load Balancer Capacity Units (LCU) used per hour. LCUs are measured based on a set of dimensions on which traffic is processed; new connections, active connections, processed bytes, and rule evaluations, and you are charged based only on the dimension with the highest usage in a particular hour.As an example using the [ELB Pricing Calculator], assuming the ~20,000 connections are ramped up by 10 connections per second, with an average connection duration of 30 minutes (1800 seconds) and sending 1 request every 4 seconds for a total of 1GB of processed data per hour, you could expect a rough cost output of:1 GB per hour / 1 GB processed bytes per hour per LCU for EC2 instances and IP addresses as targets = 1 processed bytes LCUs for EC2 instances and IP addresses as targets10 new connections per second / 25 new connections per second per LCU = 0.40 new connections LCUs10 new connections per second x 1,800 seconds = 18,000 active connections18,000 active connections / 3000 connections per LCU = 6 active connections LCUs1 rules per request - 10 free rules = -9 paid rules per request after 10 free rulesMax (-9 USD, 0 USD) = 0.00 paid rules per requestMax (1 processed bytes LCUs, 0.4 new connections LCUs, 6 active connections LCUs, 0 rule evaluation LCUs) = 6 maximum LCUs1 load balancers x 6 LCUs x 0.008 LCU price per hour x 730 hours per month = 35.04 USDApplication Load Balancer LCU usage charges (monthly): 35.04 USDCommentShareSUPPORT ENGINEERJustin_Banswered a year agoEXPERTHernitoreviewed a year agoDominick Sidiropoulos a year agoYou are a legend!Share"


Question: Cloudformation - Check if S3 folder exists and apply policy to the specific folder

"Hello:I am writing a cloudformation template to create an S3 bucket. This S3 bucket can have multiple folders created programmatically.  So I want to apply a bucket policy that checks if a specific folder exists and allow only specific file types.For ex, if there is an S3 bucket called 'my-test-s3' with nested folders /folder1/folder2/pdf, I want to check if the folder 'pdf' exists. If it does, only allow for file types of *.pdf in this folder. How do I write the bucket policy for this using cloudformation template? I tried this below. However, this prevents creation of any folders inside my 'S3Bucket'.  I am looking for some guidance on this.Sid: Stmt1631632005699Effect: DenyPrincipal:AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root/'Action:- 's3:PutObject'NotResource:- !Sub arn:aws:s3:::${S3Bucket}///pdf/*.pdfFollowComment"

Answer: "0Accepted AnswerSomething like this:{  "Id": "Policy1649706507409",  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Stmt1649706435908",      "Action": [        "s3:PutObject"      ],      "Effect": "Allow",      "Resource": "arn:aws:s3:::mybucket/*.pdf",      "Condition": {        "StringLike": {          "s3:prefix": "pdf/"        }      },      "Principal": "*"    },    {      "Sid": "Stmt1649706506153",      "Action": [        "s3:PutObject"      ],      "Effect": "Deny",      "NotResource": "arn:aws:s3:::mybucket/*.pdf",      "Condition": {        "StringLike": {          "s3:prefix": "pdf/"        }      },      "Principal": "*"    }  ]}CommentShareEXPERTkentradanswered a year ago"


Question: Amplify Studio questions on workload and production readiness

"Good Day Everyone,Is Amplify studio ready to be used for building production workloads. I have few quick questions with regards to this:Can you manage multiple environments say Dev, STG and ProdIs there any pipeline that can be configured to rollout a deployment in the case of various environmentsIt uses cognito, I would like to integrate with Active Directory does this support.Cheers..!!Regards,Anandan. NFollowComment"


Question: EC2 instance is not reachable by public IP

"Hey guys,I understand there is a million questions like this every day. However mine is different. I did not change a thing in my account. All VPC resources were created by Amazon. I tried all troubleshooting tutorials I could find to no avail. I tried launching instances in 3 different regions - same result. Again I did not create/configure any of the VPC stuff, the instance is launched into a default VPC, default subnet and SG is default too.Thanks,DenisFollowComment"

Answer: "0Accepted AnswerHi Denis,It is expected that you would not be able to reach instance over its public IP with default settings.default security group associated to the instance, allow inbound traffic from network interfaces (and their associated instances) that are assigned to the same security group.[+]: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#DefaultSecurityGroupTherefore, to access instance over its public IP from your source machine, please add inbound rules to the security group.To access windows instances:[+]: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html#add-rule-authorize-accessTo access linux instances:[+]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html#add-rule-authorize-accessI hope this helps.CommentShareAWS-User-7021355answered 3 years ago0Oh, man. It's so simple it's embarrassing. Thank you very much!CommentSharebukharovanswered 3 years ago"


Question: Cant connect to EC2 instance with FTP client

"I recently launched a new t4g.micro instance and I cannot seem to connect to the instance with FileZilla to transfer files. I had a t4g.nano in Canada but I changed to a t4g.micro in Ohio since it better fit what I needed. I was able to connect and transfer files for the first few minutes just fine, but after that I couldn't do anything besides launching a new instance and having the same few minutes to transfer files. I've tried restarting the instance, opening and closing ports and waiting a few hours to see if it would fix itself. Nothing I've tried has worked so far, does anyone know the issue?FollowCommentChris_G EXPERTa year agoAre you able to SSH to the instance?Share"

Answer: "0Hello,Could you provide more clarity with your situation? To restate your issue, you cannot connect or do anything after transferring the files. Are you trying to access the files afterward?Since we don’t have access to your instance or Filezilla configuration, you may want to check the connection log in Filezilla to see if you can find any connection errors occurring [1]. Also, you can check the FTP log on the instance itself to try to identify at what point the connectivity errors are occurring. The FTP logs in the OS of the instance will depend on which version of FTP you are using. For SFTP, check /var/log/secure. For vsftpd, check /var/log/vsftpd.log or /var/log/xferlog. For PureFTPd or ProFTPD, check /var/log/messages.References:https://wiki.filezilla-project.org/Logs#Changing_the_verbosityCommentShareMelanie_Sanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: how to add autoscaling policy to an sagemaker endpoint via terraform?

"based on the documentation here, https://github.com/aws/amazon-sagemaker-examples/blob/main/async-inference/Async-Inference-Walkthrough.ipynb, an autoscaling policy could be added to an sagemaker async endpoint . I want to set this via terraform and have this so far (sample below) , but i'm not how to set Dimensions attribute in  TargetTrackingScalingPolicyConfiguration in terraform?  TargetTrackingScalingPolicyConfiguration={        "TargetValue": 5.0, SageMakerVariantInvocationsPerInstance        "CustomizedMetricSpecification": {            "MetricName": "ApproximateBacklogSizePerInstance",            "Namespace": "AWS/SageMaker",            "Dimensions": [{"Name": "EndpointName", "Value": endpoint_name}],            "Statistic": "Average",        },resource "aws_appautoscaling_target" "sagemaker_target" {  max_capacity       =  3  min_capacity       = 1  resource_id        = "myendpoint"  scalable_dimension = "sagemaker:variant:DesiredInstanceCount"  service_namespace  = "sagemaker"}resource "aws_appautoscaling_policy" "sagemaker_policy" {  name               = "somepolicy"  policy_type        = "TargetTrackingScaling"  resource_id        = aws_appautoscaling_target.sagemaker_target.resource_id  scalable_dimension = aws_appautoscaling_target.sagemaker_target.scalable_dimension  service_namespace  = aws_appautoscaling_target.sagemaker_target.service_namespace  target_tracking_scaling_policy_configuration {    customized_metric_specification{      metric_name = "ApproximateBacklogSizePerInstance"      namespace =  "AWS/SageMaker"      Dimensions = ....?????      statistic =  "Average"    }    target_value       = 3    scale_in_cooldown  =300    scale_out_cooldown = 600  }}FollowComment"

Answer: "0Hi,This Dimensions refer to the CloudWatch dimensions of metric ApproximateBacklogSizePerInstance. It's the same dimension when you first define the metric as described in doc hereCommentShareAWS-User-5210721answered 7 months ago"


Question: How to change instance type without losing data

"Hi,I have a t3.large instance created, with 3 EBS volumes,  root,  /opt and /local/notesdata and I would like to change it to a m5.large.On /opt,  I have my main program installed (HCL Domino 12, a popular email server).  That program, has his data on an additional volume mount on /local/notesdata.While I am aware that I can detach that 2 volumes,  create a new instance using m5.large,  and attach that volumes on them,    and I am not sure if Domino will launch correctly withouth some information stores on the root/main volumen  (where the service is created, for example).  Also, I would lost my /home directories on the new instance created.So, basically,  how do I change a famility from a type to another one ?   Is the information stores on the root volume  ( /etc configuration,  /home directories,  inet.d services) lost  ?  Should I recreate manually all the information that was setup on the root volume when I do a new instance ?Thks !!!FollowComment"

Answer: "3Accepted AnswerThe information is not lost if you change the instance type, except the instance store-backed instances. You also have to make sure your source and target instance types are compatible with each other. For more information on compatibility check please see: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/resize-limitations.htmlYou can:Safely shutdown the instance (make sure the shutdown behavior is not set to terminate).Change the instance type andStart the instance again.The procedure for instance store-backed instances is documented on below url: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/resize-instance-store-backed-instance.htmlCommentSharehameedullahanswered a year ago"


Question: Issue on EC2 stopping

"HelloEC2 instance with id 0106ab792da490bbb  has been stuck to stopping since Thursday 10th of June .According  AWS  https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesStopping.html  If, after 10 minutes, the instance has not stopped, post a request for help in the Amazon EC2 forum. To help expedite a resolution, include the instance ID, and describe the steps that you've already taken.I applied the force stopping process but it is still on stopping statusFollowComment"

Answer: "0According the support case id which I raised in AWS Support Team the issue  was related to operational issue in the FrankfurtThe instance was stuck in stopping state due to the stuck EBS volume. The EBS volume was showing as ‘In Use’ but the instance was showing in stopping state.   For EBS volume stuck  AWS Support Team  has reached out to the internal service team and got a response that the issue was fixed with the EBS volume , and  the instance ‘i-0106ab792da490bbb’ now showing in stopped state and Volume state is available.The issue is fixedCommentSharekostastheocharoulisanswered 2 years ago0According the support case id which I raised in AWS Support Team the issue  was related to operational issue in the FrankfurtThe instance was stuck in stopping state due to the stuck EBS volume. The EBS volume was showing as ‘In Use’ but the instance was showing in stopping state.   For EBS volume stuck  AWS Support Team  has reached out to the internal service team and got a response that the issue was fixed with the EBS volume , and  the instance ‘i-0106ab792da490bbb’ now showing in stopped state and Volume state is available.The issue is fixedCommentSharekostastheocharoulisanswered 2 years ago0According the support case id which I raised in AWS Support Team the issue  was related to operational issue in the FrankfurtThe instance was stuck in stopping state due to the stuck EBS volume. The EBS volume was showing as ‘In Use’ but the instance was showing in stopping state.   For EBS volume stuck  AWS Support Team  has reached out to the internal service team and got a response that the issue was fixed with the EBS volume , and  the instance ‘i-0106ab792da490bbb’ now showing in stopped state and Volume state is available.The issue is fixedCommentSharekostastheocharoulisanswered 2 years ago"


Question: How to Allow a Site Hosted with Amazon to Be Embedded in an iFrame?

"Hello,I'm trying to embed our website in an iFrame on another website but instead get the error message "xxxx.com refused the connection.".I have talked to the support for the other website (its a booking system provider) and they told me that I need to activate iFrame on AWS.I have tried to google how to "activate iFrame" on AWS but I can't find anywhere how I do this?I'm not that experienced with web hosting and especially not AWS and our web developer guy recently stopped answering us and we have not yet found another reliable developer. :)I would really appreciate you help.Best regardsMathiasFollowComment"

Answer: "1Hi,The issue is due to CORS (Cross-Origin Resource Sharing). It is a security feature that's implemented by web browsers to prevent unauthorized access to resources on a web page.Assuming your site is hosted in s3, you can enable cors and bucket policies reading this article: https://repost.aws/knowledge-center/s3-configure-corsCommentShareEXPERTalatechanswered 4 months ago0Thanks a lot for your answer alatech. I just found out it is hosted in EC2 and not S3. I searched for forum threads regarding this question and I do belive I need some professional help to configure CORS. :)I think I will contact a developer to help me with this if there is not a detailed manual on how to configure CORS to allow my site to me embedded in iFrame. :)CommentShareMathiasanswered 4 months ago"


Question: Need to change NS for .co.uk domain registed at Route 53 but hosted at Gandi

"I recently registered a .co.uk domain thinking it could be hosted on Route 53. I later learned Route 53 isn't compatible with the storefront service that the domain was intended to point to. Cloudflare is compatible and I've  moved NS authority to their platform and updated NS in Route 53. However, .co.uk domains are managed by Gandi and I also need to update NS records there. Simply updating on Route 53 didn't update Gandi. I don't have a Gandi account, how do I make these changes?FollowComment"

Answer: "0Hi ,if would  like to transfer your domain .co.uk since its supported that you can transfer it to AWS  you can follow this link[1]https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-transfer-to-route-53.htmlIf you want to migrate DNS service to Amazon Route 53 for a domain that is currently getting traffic[2]https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/migrate-dns-domain-in-use.htmlCommentSharerePost-User-9017359answered a year ago"


Question: AWS MWAA Environment error INCORRECT_CONFIGURATION using existing VPC (not created by MWAA)

"Hi team,I saw several questions which relate to my question:MWAA stuck in a loop while Creating EnvironmentAWS MWAA Environment error "INCORRECT_Configuration"But, I still can't resolve the issue. I did verify the MWAA environment with aws-support-tools for MWAA.Here is the detail:please ignore on the Testing connectivity to the following service endpoints from MWAA enis... part since the AWS MWAA creation is failed so there is no active connectivity.(venv) [ec2-user@xxxx verify_env]$ python ./verify_env.py --envname airflow-reproduce-error-2please send support the following informationIf a case is not opened you may open one here https://console.aws.amazon.com/support/home#/case/createPlease make sure to NOT include any personally identifiable information in the caseAirflowConfigurationOptions :  {}AirflowVersion :  2.5.1Arn :  arn:aws:airflow:ap-southeast-1:xxxxx:environment/airflow-reproduce-error-2CreatedAt :  2023-05-09 08:30:03+00:00DagS3Path :  dagsEnvironmentClass :  mw1.smallExecutionRoleArn :  arn:aws:iam::xxxxx:role/service-role/AmazonMWAA-airflow-reproduce-error-2-gtEO4GLastUpdate :  {'CreatedAt': datetime.datetime(2023, 5, 9, 8, 30, 3, tzinfo=tzlocal()), 'Error': {'ErrorCode': 'INCORRECT_CONFIGURATION', 'ErrorMessage': 'You may need to check the execution role permissions policy for your environment, and that each of the VPC networking components required by the environment are configured to allow traffic. Troubleshooting: https://docs.aws.amazon.com/mwaa/latest/userguide/troubleshooting.html'}, 'Status': 'FAILED'}LoggingConfiguration :  {'DagProcessingLogs': {'Enabled': False, 'LogLevel': 'WARNING'}, 'SchedulerLogs': {'Enabled': True, 'LogLevel': 'WARNING'}, 'TaskLogs': {'Enabled': True, 'LogLevel': 'INFO'}, 'WebserverLogs': {'Enabled': True, 'LogLevel': 'WARNING'}, 'WorkerLogs': {'Enabled': True, 'LogLevel': 'WARNING'}}MaxWorkers :  10MinWorkers :  1Name :  airflow-reproduce-error-2NetworkConfiguration :  {'SecurityGroupIds': ['sg-0d69257297ef7bf77'], 'SubnetIds': ['subnet-061f5b0d526d19b32', 'subnet-052af55a94725413d']}RequirementsS3ObjectVersion :  nullRequirementsS3Path :  requirements.txtSchedulers :  2ServiceRoleArn :  arn:aws:iam::xxxxx:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAASourceBucketArn :  arn:aws:s3:::xxxxx-airflow-stgStatus :  CREATE_FAILEDTags :  {}WebserverAccessMode :  PUBLIC_ONLYWeeklyMaintenanceWindowStart :  THU:23:30VPC:  vpc-06a7b7e73e27af6d6 ### Checking the IAM execution role arn:aws:iam::xxxxx:role/service-role/AmazonMWAA-airflow-reproduce-error-2-gtEO4G using iam policy simulationUsing AWS CMKAction: airflow:PublishMetrics is allowed on resource arn:aws:airflow:ap-southeast-1:xxxxx:environment/airflow-reproduce-error-2 ✅Action: s3:ListAllMyBuckets is blocked successfully on resource arn:aws:s3:::xxxxx-airflow-stg ✅Action: s3:ListAllMyBuckets is blocked successfully on resource arn:aws:s3:::xxxxx-airflow-stg/ ✅Action: s3:GetObject* is allowed on resource arn:aws:s3:::xxxxx-airflow-stg ✅Action: s3:GetObject* is allowed on resource arn:aws:s3:::xxxxx-airflow-stg/ ✅Action: s3:GetBucket* is allowed on resource arn:aws:s3:::xxxxx-airflow-stg ✅Action: s3:GetBucket* is allowed on resource arn:aws:s3:::xxxxx-airflow-stg/ ✅Action: s3:List* is allowed on resource arn:aws:s3:::xxxxx-airflow-stg ✅Action: s3:List* is allowed on resource arn:aws:s3:::xxxxx-airflow-stg/ ✅Action: logs:CreateLogStream is allowed on resource arn:aws:logs:ap-southeast-1:xxxxx:log-group:airflow-airflow-reproduce-error-2-* ✅Action: logs:CreateLogGroup is allowed on resource arn:aws:logs:ap-southeast-1:xxxxx:log-group:airflow-airflow-reproduce-error-2-* ✅Action: logs:PutLogEvents is allowed on resource arn:aws:logs:ap-southeast-1:xxxxx:log-group:airflow-airflow-reproduce-error-2-* ✅Action: logs:GetLogEvents is allowed on resource arn:aws:logs:ap-southeast-1:xxxxx:log-group:airflow-airflow-reproduce-error-2-* ✅Action: logs:GetLogGroupFields is allowed on resource arn:aws:logs:ap-southeast-1:xxxxx:log-group:airflow-airflow-reproduce-error-2-* ✅Action: logs:DescribeLogGroups is allowed on resource * ✅Action: cloudwatch:PutMetricData is allowed on resource * ✅Action: sqs:ChangeMessageVisibility is allowed on resource arn:aws:sqs:ap-southeast-1:*:airflow-celery-* ✅Action: sqs:DeleteMessage is allowed on resource arn:aws:sqs:ap-southeast-1:*:airflow-celery-* ✅Action: sqs:GetQueueAttributes is allowed on resource arn:aws:sqs:ap-southeast-1:*:airflow-celery-* ✅Action: sqs:GetQueueUrl is allowed on resource arn:aws:sqs:ap-southeast-1:*:airflow-celery-* ✅Action: sqs:ReceiveMessage is allowed on resource arn:aws:sqs:ap-southeast-1:*:airflow-celery-* ✅Action: sqs:SendMessage is allowed on resource arn:aws:sqs:ap-southeast-1:*:airflow-celery-* ✅Action: kms:Decrypt is allowed on resource arn:aws:kms:*:111122223333:key/* ✅Action: kms:DescribeKey is allowed on resource arn:aws:kms:*:111122223333:key/* ✅Action: kms:Encrypt is allowed on resource arn:aws:kms:*:111122223333:key/* ✅Action: kms:GenerateDataKey* is allowed on resource arn:aws:kms:*:111122223333:key/* ✅If the policy is denied you can investigate more at https://policysim.aws.amazon.com/home/index.jsp?#roles/AmazonMWAA-airflow-reproduce-error-2-gtEO4GThese simulations are based off of the sample policies here https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-create-role.html#mwaa-create-role-json### Checking if log groups were created successfully...number of log groups match suggesting they've been created successfully ✅### Trying to verify nACLs on subnets...nacl: acl-0b2023fba14350376 allows port 5432 on egress ✅nacl: acl-0b2023fba14350376 allows port 5432 on ingress ✅### Trying to verify if route tables are valid...### Verifying 'block public access' is enabled on the s3 bucket or account...Checking if public access is blocked at the bucket levelChecking if public access is blocked at the account levelThe account level access block config is not sets3 bucket, arn:aws:s3:::xxxxx-airflow-stg, or account blocks public access ✅### Trying to verifying ingress on security groups...ingress for security groups have at least 1 rule to allow itself ✅ ### Testing connectivity to the following service endpoints from MWAA enis...no enis found for MWAA, exiting test for  sqs.ap-southeast-1.amazonaws.complease try accessing the airflow UI and then try running this script againno enis found for MWAA, exiting test for  api.ecr.ap-southeast-1.amazonaws.complease try accessing the airflow UI and then try running this script againno enis found for MWAA, exiting test for  monitoring.ap-southeast-1.amazonaws.complease try accessing the airflow UI and then try running this script againno enis found for MWAA, exiting test for  kms.ap-southeast-1.amazonaws.complease try accessing the airflow UI and then try running this script againno enis found for MWAA, exiting test for  s3.ap-southeast-1.amazonaws.complease try accessing the airflow UI and then try running this script againno enis found for MWAA, exiting test for  env.airflow.ap-southeast-1.amazonaws.complease try accessing the airflow UI and then try running this script againno enis found for MWAA, exiting test for  env.airflow.ap-southeast-1.amazonaws.complease try accessing the airflow UI and then try running this script againno enis found for MWAA, exiting test for  ops.airflow.ap-southeast-1.amazonaws.complease try accessing the airflow UI and then try running this script againno enis found for MWAA, exiting test for  api.airflow.ap-southeast-1.amazonaws.complease try accessing the airflow UI and then try running this script againno enis found for MWAA, exiting test for  logs.ap-southeast-1.amazonaws.complease try accessing the airflow UI and then try running this script again### Checking CloudWatch logs for any errors less than 1 hour oldFound the following failing logs in cloudwatch: Log group:  airflow-airflow-reproduce-error-2-SchedulerLog group:  airflow-airflow-reproduce-error-2-TaskLog group:  airflow-airflow-reproduce-error-2-WebServerLog group:  airflow-airflow-reproduce-error-2-WorkerWhen I created a new MWAA env with new VPC, the MWAA env successfully created. I guess the issue comes from the VPC because I'm using the existing VPC and don't want the MWAA created new one for me. But I'm struggling how to investigate it.Any suggestions on how to check further about it?Is there any end to end tutorial how to setup new MWAA with existing VPC?Thanks!FollowComment"


Question: Identifying amortized cost column in AWS cost and usage report

"Hello,We are ingesting CUR data for our own internal BI use cases. AWS Cost Explorer user interface provides a toggle to see amortized cost and net amortized  cost for a resource. We want to surface the same in our inhouse BI dashboard.So in cost and usage report CSV, which is the column which reflects the above information for a resource ? Documentation is not very clear.What would the value of this column be for resources which does not have any RIs/discounts ?Any examples would help. Thanks.FollowComment"

Answer: "0The following help section in the Well Architected CUR Query Library has some good explanations: https://wellarchitectedlabs.com/cost/300_labs/300_cur_queries/query_help/Also there is an amortized cost by charge type example here as well:https://wellarchitectedlabs.com/cost/300_labs/300_cur_queries/queries/global/CommentShareamazonchrisanswered a year ago0Depending on whether account(s) have any RI or SP discount, you would need to use different columns for this as there's no one single "amortized cost" column in CUR. Here are few examples:if there are RIs and there's usage that's benefiting from their discount, you would use column "reservation/EffectiveCost"for SPs there's separate column for that - "savingsPlan/SavingsPlanEffectiveCost"and for anything else, you would normally use "lineItem/UnblendedCost" (unless you know exactly why you need it, "lineItem/BlendedCost" can be used in some circumstances)As for examples, check out CUR query library as mentioned by @amazonchris earlier https://wellarchitectedlabs.com/cost/300_labs/300_cur_queries/query_help/CommentShareEXPERTNataliya_Ganswered a year ago"


Question: Is it possible to create Parallel Pipelines in Sagemaker

I want to bind processing pipeline to multiple training pipeline. I just want to compare algorithm accuracy. Same dataset will be trained by multiple algorithms and will be predicted by them. My goal for the future is consolidate predict results of different algorithms and generate combined/consolidated resulst. Is is possible to do in SageMaker.Example Schema:            - Train_Algo1       Process    - Train_Algo2    - Predict Result            - Train_AlgoNFollowComment

Answer: "0I'd recommend checking out SageMaker Pipelines for this - especially if you're able to use SageMaker Studio for the graphical pipeline management UIs.You can build your pipeline definition through the SageMaker Python SDK, just like you might normally define Training and Processing jobs. In fact pipeline steps (like TrainingStep) typically just wrap around the standalone constructs (like Estimator) that you might be using already.Pipeline steps are executed in paralllel by default, unless there is an implicit (properties data) or explicit (depends_on) dependency between them.SM Pipelines can take parameters, so you could expose necessary training hyperparameters or pre-processing parameters up to the pipeline level, and use the pipeline to kick off multiple end-to-end runs with different configurations.By turning on step caching, you could prevent your pre-processing from being re-run if the input parameters are unchanged (however, note that caching doesn't look at ongoing executions: So better to trigger one pipeline execution first and wait a bit for the processing step to complete, rather than triggering ~20 all at once so none of them see a cached processing result and all re-run the job)....And Pipelines automatically tag SageMaker Experiments config (Pipeline = Experiment; Execution = Trial; Step = Trial Component) which you can then use to plot and compare multiple training jobs in the SM Studio UI. So for example your pipeline might just be Pre-process > Train > Evaluate > RegisterModel. If you right click your pipeline's "Experiment" in SMStudio Experiments and Trials view, you can open a list of the executed training jobs and select multiple to scatter-plot the final loss/accuracy vs the hyperparameters.If you run your evaluation as a SageMaker Processing Job which outputs a JSON in model quality metrics format, you can even have your pipeline load the model into SM Model Registry tagged with this data. This way, you'd be able to see and compare the metrics between model versions (and even charts e.g. ROC curves in classification case) through the SMStudio Model Registry UI.Some relevant code samples:https://github.com/aws/amazon-sagemaker-examples/tree/main/sagemaker-pipeline-compare-model-versionshttps://github.com/aws/amazon-sagemaker-examples/tree/main/sagemaker-pipeline-parameterizationCommentShareEXPERTAlex_Tanswered a year ago"


Question: UiTextInputBus strange behavior

"Guys, since version 1.8 I have seen this issue but I am not sure if I am using this bus correctly.Whenever I call UiTextInputBus.Event.SetText(entId, str), the text string is placed in the input field but it does not show up.The only way to make it appears is to have a whitespace in the field before I call it. But for fields that the user is editing is a little bit annoying because I have to track all the events to left a whitespace there.What am I doing wrong?Tks!Follow"

Answer: "0Accepted AnswerThanks @REDACTEDUSERIn the meantime, you can fix this by adding the following line to UiTextInputComponent.cpp:m_childTextStateDirtyFlag = true;Add that line to the following functions (at the beginning is fine):void UiTextInputComponent::SetText(const AZStd::string& text)void UiTextInputComponent::SetTextEntity(AZ::EntityId textEntity)void UiTextInputComponent::SetPlaceHolderTextEntity(AZ::EntityId textEntity)SharerePost-User-8946916answered 6 years agoEXPERTsedat_salmanreviewed 10 days ago0Hi @REDACTEDUSERtextEntity = UiTextInputBus.Event.GetTextEntity(textInputEntityId)UiTextBus.Event.SetText(textEntity, "Hello world!")Here are the Lua script reference pages for UiTextInputBus and UiTextBus:http://docs.aws.amazon.com/lumberyard/latest/developerguide/lua-scripting-ces-api-ui-uitextinputcomponent.htmlhttp://docs.aws.amazon.com/lumberyard/latest/developerguide/lua-scripting-ces-api-ui-uitextcomponent.htmlHope that helps!SharerePost-User-8946916answered 6 years ago0Apologies - I actually didn't realize there was a SetText method directly available on the UiTextInputBus. I'll look into this a little more to see what's going on!SharerePost-User-8946916answered 6 years ago0I think there's an issue with how the text input component updates when its text element value changes. I'm investigating this and will update once I have more information!SharerePost-User-8946916answered 6 years ago0tks! it is working!SharerePost-User-4308601answered 6 years ago0Great! Thank you for confirming that it's working for you now. We'll include that fix in a future release.SharerePost-User-8946916answered 6 years ago0Fixed in 1.12, thanks.SharerePost-User-6364908answered 5 years ago"


Question: GitHub repository for Realtime Servers?

"Is there an official repository for Realtime Servers, so we can easily track the code changes between each version and perhaps submit bugfixes and PR?And in general, is other GameLift products' source codes hosting on GitHub?Currently, the SDK seems can be only downloaded from this documentation page:https://aws.amazon.com/gamelift/getting-started/#Developer_Resources_and_DocumentationFollowComment"

Answer: 0Accepted AnswerThe Realtime servers code or sdk is not available on Github currently. The documentation page you linked above is the only way to get access to rts sdk.CommentSharerePost-User-8861461answered 2 years ago


Question: "NameError: name 'self' is not defined" in CDK with python

"I'm just using the sample code from: https://docs.aws.amazon.com/cdk/api/v1/python/aws_cdk.aws_healthlake/CfnFHIRDatastore.html#aws_cdk.aws_healthlake.CfnFHIRDatastore.add_deletion_overrideAnd I'm adding the import statements not included in that example.#!/usr/bin/env python3import aws_cdk as cdkimport aws_cdk.aws_healthlake as healthlakefrom constructs import Constructfrom healthlake.healthlake_stack import HealthlakeStackapp = cdk.App()class HealthlakeStack():    def __init__(self, scope: Construct, id: str, **kwargs) -> None:        super().__init__(scope, id, **kwargs)    cfn_fHIRDatastore = healthlake.CfnFHIRDatastore(self, "MyCfnFHIRDatastore",        datastore_type_version="R4"    )HealthlakeStack(app, "HealthLake")app.synth()When I run cdk synth on this, I get back:Traceback (most recent call last):  File "app.py", line 13, in <module>    class HealthlakeStack():  File "app.py", line 17, in HealthlakeStack    cfn_fHIRDatastore = healthlake.CfnFHIRDatastore(self, "MyCfnFHIRDatastore",NameError: name 'self' is not definedAnd if I remove self, I get:Traceback (most recent call last):  File "app.py", line 11, in <module>    class HealthlakeStack():  File "app.py", line 15, in HealthlakeStack    cfn_fHIRDatastore = healthlake.CfnFHIRDatastore("MyCfnFHIRDatastore",  File "redacted/python/site-packages/jsii/_runtime.py", line 86, in __call__    inst = super().__call__(*args, **kwargs)TypeError: __init__() missing 1 required positional argument: 'id'And I tried a few other things. I'm guessing I'm just not nesting this correctly or something else basic to Python.FollowComment"

Answer: "0Accepted AnswerThe problem was that I was trying to create the class in the app.py file, which is where an import statement of that same class was! I just had to revert to the code created by cdk init app --language python and add my code in the healthlake/healthlake_stack.py file where the class definition belongs.CommentShareyann_stonemananswered a year ago"


Question: Can't install any packages on Amazon Linux 2 instance

"I have launched an ec2(Amazon Linux 2) but I am not able to install any packages. Below errors and instructions, I am getting every time. The image is attached.One of the configured repositories failed (Unknown),and yum doesn't have enough cached data to continue. At this point the onlysafe thing yum can do is fail. There are a few ways to work "fix" this: 1. Contact the upstream for the repository and get them to fix the problem. 2. Reconfigure the baseurl/etc. for the repository, to point to a working    upstream. This is most often useful if you are using a newer    distribution release than is supported by the repository (and the    packages for the previous distribution release still work). 3. Run the command with the repository temporarily disabled        yum --disablerepo=<repoid> ... 4. Disable the repository permanently, so yum won't use it by default. Yum    will then just ignore the repository until you permanently enable it    again or use --enablerepo for temporary usage:        yum-config-manager --disable <repoid>    or        subscription-manager repos --disable=<repoid> 5. Configure the failing repository to be skipped, if it is unavailable.    Note that yum will try to contact the repo. when it runs most commands,    so will have to try and fail each time (and thus. yum will be be much    slower). If it is a very temporary problem though, this is often a nice    compromise:        yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=trueFollowComment"

Answer: "1Hi rePost-User-5598008, could you update your post with more network information?From the first couple lines we can see your server received a time out in port 443.Is your instance connected to the internet? If not, do you mind trying AWS Knowledge Center - EC2 Update YUM without internet ?Have you checked the Security Groups rules for this specific instance?Can you reach any other endpoint?telnet amazonlinux-2-repos-ap-south-1.s3.dualstack.ap-south-1.amazonaws.com 443 (should show Connected)telnet amazon.com 443( should show Connected)CommentShareGabriel Bartholomeuanswered 10 months ago1Hello @prabal_suryaWe answered your question in the latest episode of AWS Supports You. Please take a look at the YouTube video here, and we hope it helps answer your question! https://www.youtube.com/watch?v=lzadlmq4LcMPlease don't hesitate to comment here if you have any follow up questions. If this helped to answer your question, please make sure to mark this question as answered.Have a great day!CommentShareEXPERTRob_Hanswered 10 months ago"


Question: Is the DeepRacer service down?

"Getting error:“Couldn't retrieve reinforcement learning models”And I’m unable to see any of my models, and the service seems to have lost it’s ‘connection’ with the VPC it built.I have tried to start again, but getting many errors when trying to create the Account resources.Is DeepRacer down?FollowComment"

Answer: 0see here:https://forums.aws.amazon.com/ann.jspa?annID=6755seems it's down for maintenance : )CommentShareNick-Kuhlanswered 4 years ago


Question: Linux 2 OpenSSH Failing Vulnerability Scan

"My Linux 2 server is failing because of OpenSSH version is before version 8.5 (documented in CVE-2021-28041).What I would like to know, is there anywhere that AWS documents that they have addressed this issue, CVE-2021-28041?I recognize that AWS does update the binaries on their own, and when I checked RedHat, they describe the issue as a non-issue for them, because the issue was introduced in version 8.3.   I assume that is the same for AWS Linux 2, but I need to prove it to my provider or I fail my PCI Compliance vulnerability assessment.    It would be great if AWS simply identified it, and documented that they are updating OpenSSH directly, and did not include this vulnerability, or something to that effect.FollowComment"

Answer: "0Hi,Thank you for reaching out to AWS re:Post. I understand you want documentation on a specific CVE (CVE-2021-28041).From my investigation there are no AWS documentations on CVE-2021-28041. CVE-2021-28041 does not affect OpenSSH on Amazon Linux 2. The bug was introduced in OpenSSH 8.2 and since it has not been backported it would not affect earlier versions.Unfortunately, there are no details on this particular CVE as of now. For further details on Amazon Linux 2 security and privacy events you can refer to the Amazon Linux Security Center [1]. Unfortunately, you would not be able to find any details regarding to your CVE here since it doesn’t pertain to Amazon Linux 2.Please contact if you have any further questions, and feel free to reach out to us via a support case to facilitate a discussion on the specifics of your resources.[1] Amazon Linux Security - https://alas.aws.amazon.com/CommentSharePraneetha_Ganswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: Redshift cluster stuck at "Modifying"

"Hi all,Our Redshift cluster (ra3.4xlarge) is stuck at "Modifying (preparing for resize)" for many hours now. Is there something we can do to forcefully cancel the operation and/or reboot the cluster?Any pointers much appreciated -- thanks in advance!FollowComment"

Answer: "0Hello,Can you delete the cluster and create a new one from backup. If you use the same cluster name, the endpoint will also be the same. It will have a different IP, but the conx string should be the same. Please open a Support case with AWS, if it still doesn't change.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 8 months agoShrikant 8 months agoI was unable to delete the cluster, or indeed do any operations at all on it, for the duration that it was stuck in "Modifying (preparing for resize)" status.It finally went to Active after roughly 5 hours of being stuck in this state, and the Events log showed this:The requested elastic resize operation for Amazon Redshift cluster '<REDACTED>' failed at 2022-09-21 11:21 UTC due to internal errorI opened a support case with AWS, but was told they don't really know why and will have to do an internal RCA to figure out what happened.Share"