Question: AWS Code Pipeline Failed replicating artifact

"I have a build pipeline that has a source of AWS Code Commit. When there is a commit, this runs a build script in AWS Code Build that builds the project artifact. The final stage deploys this artifact into an S3 bucket in a different region which fails with the following error:Replication of artifact 'BuildArtifact' failed: Failed replicating artifact from bucket 1 in region-1 to bucket 2 in region-2: Check source and destination artifact buckets exist and pipeline role has permission to access it.According to the logs, the artifact upload is successful but I find no file in none of the buckets. I have tried giving the code pipeline role full access to S3 but didn't change anything. I have also tried re-creating the pipeline (with the same parameters) but this still gives the same error.FollowComment"


Question: Error installing ATG drives

"Hello,I'm trying to run Using-PCIM-Port example from https://github.com/awslabs/aws-fpga-app-notes/tree/master/Using-PCIM-PortFollowing the read me, I was able to Load AFI, (agfi-0d132ece5c8010bf7) build ATG drivers and by the time I install I hit on a Errorsudo insmod atg_driver.ko slot=0x0finsmod: ERROR: could not insert module atg_driver.ko: Device or resource busy.dmesg logs:[  181.293259] IPv6: ADDRCONF(NETDEV_UP): ens3: link is not ready[  181.388658] IPv6: ADDRCONF(NETDEV_UP): ens3: link is not ready[  181.749638] IPv6: ADDRCONF(NETDEV_CHANGE): ens3: link becomes ready[  182.766973] tun: Universal TUN/TAP device driver, 1.6[  182.771777] tun: (C) 1999-2004 Max Krasnyansky maxk@qualcomm.com[  182.778610] virbr0: port 1(virbr0-nic) entered blocking state[  182.783989] virbr0: port 1(virbr0-nic) entered disabled state[  182.789778] device virbr0-nic entered promiscuous mode[  182.955985] virbr0: port 1(virbr0-nic) entered blocking state[  182.961290] virbr0: port 1(virbr0-nic) entered listening state[  182.966475] IPv6: ADDRCONF(NETDEV_UP): virbr0: link is not ready[  183.013277] virbr0: port 1(virbr0-nic) entered disabled state[  838.922911] Installing atg module[  838.926951] vendor: 1d0f, device: f001[  838.931777] Enable result: 0[  838.935241] xdma 0000:00:0f.0: BAR 0: can't reserve [mem 0xc4000000-0xc5ffffff][  838.943842] atg_driver: cannot obtain the OCL regionHow can I fix this ?I'm using a x16 card on centos.Edited by: TJ25 on Mar 30, 2020 9:02 AMFollowComment"

Answer: "0Hi TJ25,Could you check if xdma is inserted at this point?lsmod | grep xdmaIf it is, try removing it and you should be able to insert the atg driver.sudo rmmod xdma;sudo insmod atg_driver.ko slot=0x0f;-DeepCommentShareDeep_Panswered 3 years ago"


Question: Your Request For Accessing AWS Resources Has Been Validated

"Hi Team,I have received the below email from aws.[You recently requested an AWS Service that required additional validation. Your request has now been validated for AWS Asia Pacific (Mumbai) region(s). If you are still experiencing difficulty, please contact us at aws-verification@amazon.com <[[mailto:aws-verification@amazon.com]]>.]This is 2 year old aws account. I was using only us-east-1 region. when I tried creating resources in another region, I got the email. I had not requested for any validation.What is the reason I got this mail from aws?FollowComment"

Answer: "0Not all regions are enabled by default, some need to be enabled and AWS execute some process before you can use them.   You can read documentation in Managing AWS Regions.CommentShareromerogtanswered 7 months ago"


Question: Adding MFA to Workspaces "failed" problem

"I have been attempting to add Mult-Factor Authentication to my workspaces account for my user base.  I have configured the radius server using Free Radius from this post here:https://aws.amazon.com/blogs/desktop-and-application-streaming/integrating-freeradius-mfa-with-amazon-workspaces/and all goes according to plan. I have the FreeRadius server using LinOTP running. The problem is in the very last step, when I go to enable MFA in workspace , I put in the information and it just says "failed".Specifically,Step 6: Enable MFA on your AWS DirectoryCommunication between the AWS Managed Microsoft AD RADIUS client and your RADIUS server require you to configure AWS security groups that enable communication over port 1812. Edit your Virtual Private Cloud (VPC) security groups to enable communications over port 1812 between your AWS Directory Service IP end points and your RADIUS MFA server.Navigate to your Directory Service consoleClick the Directory you want to enable MFA on. Select Network & Security tab, scroll down to Multi-factor authentication, click Actions and Enable. In Enable multi-factor authentication (MFA) configure MFA settings:Display label: ExampleRADIUS server IP address(es): Private IP of the Amazon Linux 2 instancePort: 1812Shared secret code: the one set in /etc/raddb/clients.confConfirm shared secret code: as precedingProtocol: PAPServer timeout (in seconds): 30Max retries: 3This operation can take between 5-10mins to complete. Once the Radius status is “completed” you can test MFA authentication from the WorkSpace client.I really have two questions:How do I do this part? Edit your Virtual Private Cloud (VPC) security groups to enable communications over port 1812 between your AWS Directory Service IP end points and your RADIUS MFA server. Maybe I'm not setting up the endpoints correctly ? Do I go to the VPC and add endpoints there? CAn you pleae be specific.How do I get more information from just the "failed" in red --- how do I access the creation logs?Thanks in advance,JonFollowComment"

Answer: "0Hello Jon, You need to allow connectivity between your Domain Controllers and Radius Server on port 1812. If this is properly configured, I would recommend that you open a support case with Premium Support so they can provide additional logging details.Another option is to enable some port listener in your radius server so that you can see if you receive packages from the Domain Controllers IPs to verify ports are not blocked.Thank youJuanCommentShareEXPERTJuanmaGomezOkanswered a year ago0Thank you Juan for your answer.  I have solved it by running free radius in debugging mode and watching the logs. What was happening was that despite using the internal IP from the VPC (both are using the same VPC) Microsoft AD was trying to do the request through the external IP and the FreeRadius server was rejecting the call as foreign. I fixed it by creating an endpoint within the VPC from workspaces to EC2.  Then it started working internally and authenticated because it never left the VPC.  The key realization was setting up the endpoints.CommentShareAWS-User-6508273answered a year ago"


Question: AWS Managed AD - Add office 365 Administrative Template

"Hi;I am currently using AWS Managed MS AD. While configuring the GPO of my domain, i noted that in the GPO Office 365 Administrative Template was not added to the GPO. I try to add the GPO but it is not possible.Can someone advise me how can i add additional Administrative templates to AWS Managed MS AD?RegardsFollowComment"

Answer: "0Can you please provide more information around the statement, "I try to add the GPO but it is not possible."The rights to import administrative templates have been provided.  Just ensure your user account is a member of "AWS Delegated Group Policy Administrators".  For example, I just followed the instructions provided here and successfully built a Central Store.https://support.microsoft.com/en-us/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administraCommentShareJoeD_AWSanswered 4 years ago0Thanks for the advise.  I was able to add the template following the procedure you provide.CommentSharePeianswered 4 years ago"


Question: Kinesis Data Stream ingesting from IoT Core and API Gateway and activating Lambda function

"Hello Community,I am architecting a solution and I would like some advice in best practices and AWS services limitations.My final goal is to have a PLC that will send its readings to the cloud and get in response the control signals for the components it is controlling. The cloud scheme I have so far would work like this:PLC sends sensor data via MQTT to IoT CoreAn IoT Rule forwards the data to a Kinesis Data StreamAn API using API Gateway makes a call to weather data and passes to the same Kinesis Data StreamThe Stream is passed to a Firehose for raw data storage in S3The Stream is passed to Kinesis Analytics for some feature engineeringThe stream then triggers a lambda function that hold an ML model6.1 The lambda function also needs static data stored in a S3 bucketThe lambda function uses as input the sensor data from the PLC, the weather data from the API, and the features engineered by Analytics, and outputs the control signals for the PLCFinally the IoT Core publishes the lambda output back to the PLCMain questions:Can the same stream hold data from 2 different sources, the IoT Core and API Gateway?How can I ensure the data is coupled in the same timestamp, meaning the sensor data at 12:00:00 is coupled with the weather data at 12:00:00?Is there any service that I should be using or that I'm using in excess?FollowComment"

Answer: "0I can help answer the questions related to AWS IoT Core and the Kinesis Data Stream (KDS) action. As the synthesis of data is downstream of IoT Core and API Gateway, I assume you are looking for correlated timestamps there. So to answer the IoT side of this question:How can I ensure the data is coupled in the same timestamp, meaning the sensor data at 12:00:00 is coupled with the weather data at 12:00:00?Depending upon the resolution needed, if the sending devices have good a time source such as NTP (~1ms from upstream stratums), you could inject the timestamp as part of the MQTT application message (payload). That can then parsed by Kinesis Data Anayltics (KDA) or applications reading from Kinesis Data Firehouse for correlation.If the devices do not have a precise time source, you can use the IoT Rules Engine to add a timestamp key value pair. Note: there will be short duration of 10s to 100s of milliseconds added time due to the publish from the device to AWS IoT Core, and then delivery to the Rules Engine. Something to take into consideration if correlation <1sec is needed.Adding the timestap  is easy if the payload is JSON. You can use something like SELECT *, timestamp() as my_timestamp as part of the rule., If it isn't JSON and some form of binary, you can still create a new payload format in JSON where the binary payload is base64 encoded. In might look something like this:{  "timestamp": 1481825251155,  "payload":  "eyAidGVtcGVyYXR1cmUiOiAzMyB9Cg=="}I'm not a Kinesis expert, so will defer to others on best practices for 1 v 2 streams and what a KDA application might look like.Hope this helps, please let me know if you have follow up questions!CommentShareGavin_Aanswered 4 months ago"


Question: Virtual Server Problem

"When ever I open my virtual server, there seems to be another ms dos screen in the middle of the screen. There are some options to use on this ms dos command line window but which ever I tried did not help to get rid of this window at all. On every attempt of the opening virtual server this ms dos command line windows appears and stays in there. How can I remove this from screen please?Thanks.FollowComment"


Question: Mapping multiple values for a requestParameter key

"Hello there,Is it possible to pass multiple values to a single request parameter key in integration requests? JSON like or encoded string?A typical use case could be passing the sub property from the authorizer in the SNS message payload, together with other parametersSo far I have tried this:integration.request.querystring.Message.foo: method.request.path.foointegration.request.querystring.Message.bar: method.request.path.barintegration.request.querystring.Message.userId: context.authorizer.claims.subBut when I make the request via Postman I have this error:    "Error": {        "Code": "MalformedInput",        "Message": "Start of list found where not expected",        "Type": "Sender"    },Is this even possible? The docs do not mention itFollowComment"

Answer: "0Accepted AnswerIt's not possible via the parameter mapping but doable within the request body mapping template with request override feature.https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-override-request-response-parameters.htmlPlease note that the request/response override is only available in REST API.CommentShareAWS-User-3921561answered 3 years ago0up please =)CommentShareteoanswered 3 years ago0Hello, first of all, thank you very much for the response.And yes it worked by using mapping template, I thought they were only for body.This is the working solution, underrequestTemplates:                 application/json:#set($foo = $input.params('foo'))#set($userId = $context.authorizer.claims.sub)$input.json("$")#set($context.requestOverride.querystring.Message = "{    ""foo"":  ""$foo"",        ""userId"" : ""$userId""}")"CommentShareteoanswered 3 years ago"


Question: SES not delivered to Yahoo mail

"Hello,Emails sent with SES were not delivered to Yahoo.The emails work fine and arrive in Inbox for Gmail.What should I do to fix the problem?I really appreciate any help you can provide.MinaFollowCommentzallin-work 2 months agoAre you getting any kind of a bounce back or error message?  Here is the SES documentation for blackhole lists and providers that might be blocking requests: https://docs.aws.amazon.com/ses/latest/dg/faqs-dnsbls.htmlShare"

Answer: "0To troubleshoot and fix the issue of emails not being delivered to Yahoo through Amazon SES, you can:Check bounce messages for error codes and explanations.Review your sending reputation and improve it if necessary.Authenticate your emails with DKIM, SPF, and DMARC records to ensure they're from a legitimate source.Contact Yahoo support if all other steps fail, to find a solution.CommentSharerePost-User-0306754answered 2 months ago"


Question: "The following cgroup subsystems are not mounted: devices, memory"

"everybody, my system uses cgroup2. Greengrass only use CGroup. What should I do to make Greengrass run on my system? In other words, Greengrass only supports CGroup, not cgroup2?My raspberry4B version:pi@raspberrypi:/greengrass/ggc $ uname -aLinux raspberrypi 5.10.92-v8+ #1514 SMP PREEMPT Mon Jan 17 17:39:38 GMT 2022 aarch64 GNU/LinuxMy cgroup like this:pi@raspberrypi:/greengrass/ggc $ mount | grep cgroupcgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)greeengrass error starting:pi@raspberrypi:/greengrass/ggc/core $ sudo ./greengrassd startWaitingStopped greengrass daemon, exiting with successSetting up greengrass daemonValidating hardlink/softlink protectionWaiting for up to 1m10s for Daemon to startGreengrass daemon running with PID: 1191. Some system components failed to start. Check 'runtime.log' for errorscheck with tool[greengrass-dependency-checker-GGCv1.11.x]:Missing required dependencies:1. It looks like the cgroups directory is not mounted on the device.Refer to the official Greengrass documentation to fix this.FollowComment"

Answer: 2Please see: https://github.com/aws-samples/aws-greengrass-samples/issues/41#issuecomment-974845635You must explicitly disable cgroup v2 as Greengrass lambda supports only cgroup v1. You may also choose to not use Lambda or to use lambda in process mode rather than container mode.CommentShareEXPERTMichaelDombrowski-AWSanswered a year agoMichaelDombrowski-AWS EXPERTa year agoPlease also take note that you are using Greengrass V1. Greengrass V1 is now in maintenance mode and should not be used for any reason for new development.https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-v2-whats-new.htmlSharedenggang-1985 a year agothank you very much!!Share


Question: "about (sqs, dynamodb stream) -> lambda batch size"

"Hello,I'm learning about (sqs, dynamodb stream) -> lambda.My question isif my lambda's source (sqs or dynamodb stream) batchSize is set to 10000(using maxBatchingWindow) and total payload byteSize is over 6MB(lambda max payload for sync invocation),does lambda automatically split batches into 6MB payloads and run seperately?So don't need to think about byteSize exceeding 6MB when setting batch size, is that right?FollowComment"

Answer: "0Accepted AnswerYou do not need to think about it. Batch size are always limited by the payload size, in addition to the number of messages/window size that you configure.CommentShareEXPERTUrianswered 22 days ago"


Question: ground truth for re identification task

I have a vehicle re identification (in multiple cameras) task and I want to label some of my own data with the right identity considering each vehicle timestamp and direction. Is this something I can use sagemaker's ground truth for? and if it's possible how much will it cost for about 500 images?FollowComment

Answer: "2Yes, data labeling is a capability provided by SageMaker Ground Truth. You have three different options on who is going to perform the labeling work: an internal team in your company, third-part vendors or the Amazon Mechanical Turk workers. The first option is free of charge and the other options have different prices. For reference, see this page for more details:https://aws.amazon.com/sagemaker/data-labeling/pricing/CommentShareAWS-User-8651363answered a year agoEXPERTChris_Greviewed 9 months agoAWS-User-8651363 a year agoHello, if the answer met your expectation, please mark that as accepted. Thank youShare"


Question: AWS on FTP-CLIENT

"I am new to networking and servers. I want to GET data from the FTP client set up in AWS to the FTP server set up in the company LAN, but the FTP server set up in the company LAN has a local address. Question 1: What should I do to resolve the address? Normally, an FTP client is placed on the company LAN, and FTP communication is performed within the company LAN. After collecting the files, I think it would be good to PUT the data to the FTP server set up in AWS, but I think this is a special case. Question 2: Please tell me the most balanced method and server arrangement.FollowComment"

Answer: "0So you will need to connect the AWS and Company networks together in order to use local addresses.This can be done via Direct Connect or VPN.The alternative method is to expose the company FTP server to the internet with a Public IP.This could be done by a firewall which can also restrict access from your VPC (use EIP on NAT).Once you have a public IP for the company FTP server you can use that to connect from the cloud.CommentShareRobin Fordanswered 6 months ago0In addition to Robin's answer, you could also look at the AWS Transfer family to implement a FTP server backed by S3 or EFS.CommentShareEXPERTkentradanswered 6 months ago"


Question: Connection timeouts during automated snapshots of SQL server instance

We're seeing connection timeouts almost every time an automated backup/snapshot is performed on out SQL server instance. Does anyone know why this occurs and is there any configuration changes that might alleviate the issue?FollowComment

Answer: 0I think this page explains the errors we're seeing:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CreateSnapshot.htmlThe timing of the IO suspension mentioned here matches the timing of the errors we're seeing.CommentSharelandrewanswered 3 years ago


Question: Using ACM Private CA as Microsoft enterprise CA server

"Per https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_ldap_server_side.html, in order to enable LDAPS for ManagedAD, I need a Microsoft enterprise CA server. Can ACM Private CA be used as a Microsoft enterprise CA server or do I need to set one up on an EC2 instance?FollowCommentJoeD_AWS a year agoCiaran is right.  We currently do not support ACM Private CA.  However we should build that integration.  I will share your feature request with both teams.Share"

Answer: "1Howdy!AWS ACM-PCA won't suffice here. Looking through the AWS MAD documentation on creating a template in your CA, you need to create a 'Kerberos Authentication' template. This is not a supported template variety in ACM-PCA.CommentShareCiaran Carragheranswered a year ago"


Question: Xgboost hyperparameter tuning : worse metrics than RandomizedSearchCV

"I have implemented hyperparameter tuning using the 1.5-1 sagemaker xgboost container, for a binary classifier with a F1:validation objective, loading data from a csv file. Compared to a simple RandomizedSearchCV with same parameter exploration (versions 1.5.1 or 1.6.2), the metrics are significantly worse using sagemaker (0.42 vs 0.59 for best model). I am trying to understand where such discrepancy could come from. Have you observed such a thing and how could I resolve the situation?Thanks in advance.FollowComment"

Answer: "0Hello,Thank you for using AWS SageMaker.To better understand the root cause of this issue, we need to understand the job configuration along with internal logs and also other factors that could have lead to the observation that you have observed at your end while comparing the tuning jobs. As this medium is not appropriate to share job details along with logs, we encourage you to reach out to AWS Support by opening case so that the engineers can assist your case and help you overcome the issue. To open a support case with AWS using the link: https://console.aws.amazon.com/support/home?#/case/createCommentShareSUPPORT ENGINEERKartik_Ranswered 2 months ago"


Question: A lot of IP of amazon SES blocked today from spamcop

"Today we have a great impact due to the large number of IPs blocked by spamcop.net: Some IPs affected:54.240.27.19154.240.27.19254.240.27.4554.240.27.2354.240.27.30What options do we have with this? Amazon wants us to pay for dedicated IPs?"action":"failed","status":"5.3.0","diagnosticCode":"smtp; 550-"JunkMail rejected - a27-30.smtp-out.us-west-2.amazonses.com\n550-[54.240.27.30]:52309 is in an RBL: Blocked - see\n550 https://www.spamcop.net/bl.shtml?54.240.27.30""FollowComment"


Question: [deepracer]  about originally included model 'sample_single_cam'

"if we log in deepracer private IP, we can see AWS deepracer control console.  Also, we can test "sample_single_cam" model because it is originally included. So, is 'Sample_single_cam model' for every type of track? and if we do not change any hyperparameter and reward fucntion when we make a model, is it same with 'sample single cam model'?  I am also curious about algorithm type , hyper parameter and reward funcion of sample single cam!thanksFollowComment"

Answer: "0The sample single cam is a sample model trained for reinvent 2019 track which incentivizes center line following using the default center line reward function, using PPO algorithm and default hyperparameters.CommentShareAWS-Pratikanswered 8 months ago"


Question: How to implement rate limiting in API gateway per user?

"Hi, If I am understanding correctly, the throttling limit in API gateway stage is for the endpoint. So, a limit of 100 request per sec will mean the endpoint will only respond to the first 100 request from anyone accessing it and will throw error after the 10 requests. What I need is to restrict the endpoint to have only 5 requests per second per user and no overall quota limit for the endpoint. So how can I implement it?FollowComment"

Answer: "0You can rate limit per client (user) in API Gateway using Usage Plans with API Keys.  The options are described in this document, page 9 (pdf page 12) :https://d1.awsstatic.com/whitepapers/api-gateway-security.pdfThis developer guide describes setting it up in the AWS Console:https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-usage-plans-with-console.htmlPlease note, there are two options for API Keys.  First your API consumers can pass in the API Key you share with them in the X-API-Key  header.  Second option is to use a Lambda authorizer to return the API key as part of the authorization response.https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-key-source.htmlCommentSharecyrkanswered 16 days ago"


Question: Setting up Route 53 to point to Lightsail static IP

I have a registered domain on Route 53 and a Lightsail instance with a static IP. I can't seem to get the domain configured to point to the static IP.  I can enter the static IP x.xxx.xxx.xxx into the browser and get to my website.  But when I try to type www.my_domain.com I get an error.  I've tried all the step by step instructions to both set up DNS in Lightsail or (as I'd prefer) set up Hosted Zone in Route 53 to point to the static IP in Lightsail.  Is there a good step by step guide that addresses possible failure modes and how to troubleshoot them?  Is AWS support intervention required if name server (NS) and start of authority (SOA) changes are made?FollowComment

Answer: "0Hi,The Lightsail doc about configuring DNS is here:https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-create-dns-entryTo use Route 53 for DNS, do the following (most of which you've probably already done):Perform Step 1 in the Lightsail doc, "Complete the prerequisites."Create a Route 53 hosted zone that has the same name as the domain. See "Creating a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingHostedZone.htmlCreate an A record in the Route 53 hosted zone that points to the static IP that you created in step 1. See "Creating Records by Using the Amazon Route 53 Console":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.htmlGet the names of the name servers that Route 53 assigned to your hosted zone. See "Getting the Name Servers for a Public Hosted Zone":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlPerform step 4 in the Lightsail doc, which talks about updating the name servers for your domain registration.If you used Route 53 to register the domain, see "Adding or Changing Name Servers and Glue Records for a Domain" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlScottCommentShareEXPERTAWS-User-6179575answered 4 years ago0Thanks. That fixed it. My mistake seems to have been adding a CNAME record in Route 53 as well which is doesn't seem to be necessary. I appreciate the help!CommentSharehansonbrosanswered 4 years ago"


Question: "Glue, SQL Server and Table Location with spaces"

"Hi,I'm trying to use Glue to get a table from SQL Server (I have the schema). This table has a "Location" with an space (I cannot change the "Location" in AWS).This generate an error:py4j.protocol.Py4JJavaError: An error occurred while calling o96.getDynamicFrame.: com.microsoft.sqlserver.jdbc.SQLServerException: Sintaxis incorrecta cerca de la palabra clave 'of'.After investigating, I detected that it is because the space. I tried to add [] but I couldn't.Also I cannot change the database.Any idea?Thanks for the helpFollowComment"


Question: Custom CCP Iframe frame-ancestors issue

"I have used a Custom CCP using one from Github and when i launch the softphone i get the page display and then pop up for a login, then i log in but it takes me to the amazon connect console in the pop and the main page has a sad face displayed. When i look at Chrome logs i see there is an issue with frame-ancestors.Has anyone come across this i have added the domain in the amazon connect aws console under origins. Any pointers would be welcomeFollowComment"

Answer: "0Hello,Thank you for reaching out to us. I understand that you are not able to load custom CCP iframe due to frame-ancestors issue. This issue is basically from the browser side. Could you please try below optionsBy enabling 3rd party cookies for the page in the browser and correcting the domain, making sure the instance Access Url domain and the CCP iframe domain matchCSP the Same Origin iframe [1]Now suppose you want to allow a page to be framed, for example within an iframe, but only from the same site (same origin). In this case you can use : frame-ancestors 'self'And this would allow your iframe code:<iframe src="/same/site/url.html">Using frame-ancestors 'self' is similar to using X-Frame-Options: sameoriginSpecifying a URINow suppose we want to allow https://a.example.com and https://b.example.com to frame our page, we can specify it with frame-ancestors like this: frame-ancestors https://a.example.com https://b.example.comDownload Ignore X-Frame headers extension for Chrome [2]Hope this helps.References:[1] https://content-security-policy.com/frame-ancestors/[2] https://stackoverflow.com/questions/68356006/amazon-connect-ccp-iframe-is-being-denied-even-after-whitelisting-the-domain-namCommentShareSUPPORT ENGINEERNamratha_Kanswered 9 months ago"


Question: AWS Numpy Runtime.ImportModuleError: Unable to import module 'lambda_function': Unable to import required dependencies: numpy:

"IMPORTANT: PLEASE READ THIS FOR ADVICE ON HOW TO SOLVE THIS ISSUE!Importing the numpy C-extensions failed. This error can happen formany reasons, often due to issues with your setup or how NumPy wasinstalled.We have compiled some common reasons and troubleshooting tips at:https://numpy.org/devdocs/user/troubleshooting-importerror.htmlPlease note and check the following:The Python version is: Python3.9 from "/var/lang/bin/python3.9"The NumPy version is: "1.24.2"and make sure that they are the versions you expect.Please carefully study the documentation linked above for further help.Original error was: No module named 'numpy.core._multiarray_umathAND What does this definesThe Python version is: Python3.9 from "/var/lang/bin/python3.9"FollowComment"

Answer: "1Accepted AnswerHi,the issue could be due to many reasons:Make sure you build/install the numpy library in the lambda by specifying the platform to be linuxCreate a Layer (https://repost.aws/knowledge-center/lambda-python-function-layer) or use an existing one containing numpyAls, you may consider to deploy the Lambda as container instead of zipHope it helps ;)CommentShareEXPERTalatechanswered 2 months agoMayur 2 months agoHow can I create a layer to invoke my lambda function.Means where I have to write --- pass a list of dependencies included with the layer metadata.{"dependencies": {"requests": "latest","numpy": "== 1.20.1","keyring": ">= 4.1.1"},"layer": {"name": "a-sample-python-lambda-layer","description": "this layer contains requests, numpy and keyring libraries","compatible-runtimes": ["python3.6","python3.7","python3.8"],"license-info": "MIT"}}You can create a layer to invoke your Lambda function and pass a list of dependencies included with the layer metadata.The following example creates Python Lambda layers containing requests (latest version), numpy (version 1.20.1), and keyring (version >= 4.1.1) libraries. You can invoke the Lambda function with a payload similar to the following:AND What does this definesThe Python version is: Python3.9 from "/var/lang/bin/python3.9"Share"


Question: Amazon Workspaces (Windows) : Is it possibile to use Google G Suite IdP for SSO ?

"I am building out a Workspaces demo for a customer. They only use G Suit (for apps and identity) and have no Active Directory. The ask is if it is possible to use Google G Suite as an IdP to provide their users a SSO experience between G Suite and their Workspaces environment.I understand that Workspaces needs an AD compliant directory using either (AD Connector to a running AD, Simple AD or AWS Managed Microsoft AD) to host the Workspaces users.  I do not know however if it is possible to federate between G Suit, AD and therefore Workspaces (which I imagine would be the approach if this is possible?).Any guidance or suggestions on this would be most appreciated.Thanks.FollowComment"

Answer: "0Accepted AnswerWorkSpaces does require an actual Active Directory setup, so G Suite authentication won't work for WorkSpaces authentication. They can still use it for in-session authentication to their existing applications; we don't limit what customers can or cannot run from within the WorkSpaces. Federation can't happen to any SAML provider into Active Directory; this is a limitation of Active Directory and not the service itself.CommentShareEXPERTMatt_Janswered 3 years ago"


Question: Free tier usage Sagemaker

"Hi, I have a question about the free tier usage of AWS Sagemaker.It says on the free tier page:Amazon SageMaker250 Hoursper month of t2.medium notebook usage for the first two monthsDoes this mean that you have to start using Sagemaker right away when you start your account or your two months will be void? Or does this mean that the first two months you're using Sagemaker, up to 250 hours per month of t2.medium notebook usage is free?I really just want to test something but I have to know if I can still do this for free. I've had my account since september 2018 so >2 months.The FAQ page that's referred to about expiring offers FREE TRIAL (What's the difference between expiring and non-expiring offers? VIEW FAQs >> https://aws.amazon.com/free/faqs/?ft=n) doesn't give an answer to my question.Thanks in advance.FollowComment"

Answer: "0Hello?CommentShareEttolanswered 4 years ago0Hello,Sorry for any confusion caused!The SageMaker trial begins after your first use of SageMaker -  if you have not yet launched any SageMaker resources you will still be eligible for the 2 month trial period.We can take a look at your account and advise directly if you create a support case: http://amzn.to/aws-support-center.I hope this helps!Warmest Regards,-RachaelAWSCommentShareEXPERTAWS Support - Raeanswered 4 years ago0but free tire is only for micro instances , but there is no micoro instances on sagemaker ?CommentShareSandy1234answered a month ago"


Question: S3 SSL security hub check fails

"Hi,ive put in a s3 bucket policy that I thought should cover the issue below:https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#s3-5-remediationbut the alert is not going, my policy is below{    "Version": "2012-10-17",    "Id": "BUCKET-POLICY",    "Statement": [        {            "Sid": "TerraformAccountAccessRole",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::xxx:role/TerraformAccountAccessRole"            },            "Action": "s3:*",            "Resource": [                "arn:aws:s3:::security-statefile/*",                "arn:aws:s3:::security-statefile"            ]        },        {            "Sid": "EnforceTls",            "Effect": "Deny",            "Principal": "*",            "Action": "s3:*",            "Resource": [                "arn:aws:s3:::security-statefile/*",                "arn:aws:s3:::security-statefile"            ],            "Condition": {                "Bool": {                    "aws:SecureTransport": "false"                },                "NumericLessThan": {                    "s3:TlsVersion": "1.2"                }            }        }    ]}FollowComment"

Answer: "1Separating out the Deny policy into multiple statements will pass the Security Hub check. i.e. have the "aws:SecureTransport": "false" part on its own, and the TlsVersion in another statement.CommentShareThomas_Manswered a year ago0Expanding a bit on the answer by Thomas: the evaluation logic for multi-key conditions follows logical AND. This means that your policy requires both conditions must evaluate to true in order to DENY access. The first condition checks if the transport is over SSL and the second checks if the TLS version is less than 1.2. From this you get that access is denied only when there is no SSL. But if one uses SSL then no matter what the TLS version is - the access will be granted. What you need is a bucket policy that evaluates both conditions as logical OR and this boils down to what Thomas wrote: you must put two, separate statements each with a single condition. Please, take a look at this blog post where it is explained in depth.CommentShareRafalPanswered 9 months ago"


Question: Does AWS ban IP addresses from services?

"I have a bunch of SQS services & s3 backup services that use a single IP address(NAT). As from today morning, I've lost complete connectivity to any & all aws services. Any TCP connection doesn't proceed beyond the firsy SYN packet. Has anyone ever heard of AWS perm-banning an IP address? I've got a bunch of business critical transactions stuck in SQS queues due to this :(sudo tcpdump -i eth0 host 18.133.45.123 -n &curl -v https://eu-west-2.queue.amazonaws.com/*   Trying 18.133.45.123...* TCP_NODELAY set16:20:47.610811 IP 197.248.216.154.33256 > 18.133.45.123.443: Flags [S], seq 2128825396, win 29200, options [mss 1460,sackOK,TS val 480045 ecr 0,nop,wscale 7], length 016:20:48.611248 IP 197.248.216.154.33256 > 18.133.45.123.443: Flags [S], seq 2128825396, win 29200, options [mss 1460,sackOK,TS val 480296 ecr 0,nop,wscale 7], length 016:20:50.627280 IP 197.248.216.154.33256 > 18.133.45.123.443: Flags [S], seq 2128825396, win 29200, options [mss 1460,sackOK,TS val 480800 ecr 0,nop,wscale 7], length 016:20:54.851253 IP 197.248.216.154.33256 > 18.133.45.123.443: Flags [S], seq 2128825396, win 29200, options [mss 1460,sackOK,TS val 481856 ecr 0,nop,wscale 7], length 016:21:01.934970 IP 197.248.216.154.42816 > 18.133.45.123.443: Flags [S], seq 3361955245, win 29200, options [mss 1460,sackOK,TS val 158275010 ecr 0,nop,wscale 7], length 016:21:02.960332 IP 197.248.216.154.42816 > 18.133.45.123.443: Flags [S], seq 3361955245, win 29200, options [mss 1460,sackOK,TS val 158275264 ecr 0,nop,wscale 7], length 016:21:03.043229 IP 197.248.216.154.33256 > 18.133.45.123.443: Flags [S], seq 2128825396, win 29200, options [mss 1460,sackOK,TS val 483904 ecr 0,nop,wscale 7], length 016:21:04.965428 IP 197.248.216.154.42816 > 18.133.45.123.443: Flags [S], seq 3361955245, win 29200, options [mss 1460,sackOK,TS val 158275768 ecr 0,nop,wscale 7], length 016:21:07.625705 IP 197.248.216.154.52394 > 18.133.45.123.443: Flags [S], seq 3840675465, win 29200, options [mss 1460,sackOK,TS val 3898989 ecr 0,nop,wscale 7], length 016:21:08.629690 IP 197.248.216.154.52394 > 18.133.45.123.443: Flags [S], seq 3840675465, win 29200, options [mss 1460,sackOK,TS val 3899240 ecr 0,nop,wscale 7], length 016:21:09.093703 IP 197.248.216.154.42816 > 18.133.45.123.443: Flags [S], seq 3361955245, win 29200, options [mss 1460,sackOK,TS val 158276800 ecr 0,nop,wscale 7], length 016:21:10.645819 IP 197.248.216.154.52394 > 18.133.45.123.443: Flags [S], seq 3840675465, win 29200, options [mss 1460,sackOK,TS val 3899744 ecr 0,nop,wscale 7], length 0Console is not accessible toosudo tcpdump -i eth0 host 99.83.252.222 -n &curl -v  http://console.aws.amazon.com/*   Trying 99.83.252.222...* TCP_NODELAY set16:21:46.099953 IP 197.248.216.154.36516 > 99.83.252.222.80: Flags [S], seq 773244091, win 29200, options [mss 1460,sackOK,TS val 494668 ecr 0,nop,wscale 7], length 016:21:47.107267 IP 197.248.216.154.36516 > 99.83.252.222.80: Flags [S], seq 773244091, win 29200, options [mss 1460,sackOK,TS val 494920 ecr 0,nop,wscale 7], length 016:21:49.123236 IP 197.248.216.154.36516 > 99.83.252.222.80: Flags [S], seq 773244091, win 29200, options [mss 1460,sackOK,TS val 495424 ecr 0,nop,wscale 7], length 016:21:53.219258 IP 197.248.216.154.36516 > 99.83.252.222.80: Flags [S], seq 773244091, win 29200, options [mss 1460,sackOK,TS val 496448 ecr 0,nop,wscale 7], length 0FollowCommentrePost-User-7504397 3 months agoAs an aside, I have access to other devices (customers) from the same provider that are OK (i.e. it's not a provider routing issue/firewall)Share"

Answer: "0Hi,AWS will not block these requests natively.  They do have services that can prevent "bad actors" on the internet, but the configuration and services you mention would only utilize Security Groups, S3 bucket policies, and NACLs.  I'm assuming those have not changed in your environment.  I would suspect that there may be a service provider in the path that could potentially filter based on individual IP addresses in the AFRINIC RIR, but this would be difficult to confirm.CommentShareAWS-User-0357409answered 3 months ago"


Question: What to fill in last name while creating new AWS certification account?

"I am trying to create a new AWS certification account and I am asked to mandatorily provide a last name. What should I fill here, since my government IDs only have my first name? (Urgent)FollowComment"

Answer: "1First Name and Last Name are mandatory for AWS Certification. But I do understand the fact that "It is okay to not have a surname"I believe you are stuck in this page,Please verify your name before you proceed to your AWS Certification Account.https://www.certmetrics.com/amazon/candidate/verify_name.aspx?msg=trueTo resolve this issue, I would suggest you to contact AWS Training and Certification,https://support.aws.amazon.com/#/contacts/aws-trainingYou may visit the above link and scroll down the page and fill up the form and someone from AWS will respond to you shortly with a solution.CommentShareDeepurajanswered 6 months agorePost-User-1052738 6 months agoI attempted to get in touch with the AWS Training and Certification Support team. I haven't heard anything from them yet. It's been 24 hours.ShareDeepuraj 6 months agoYou may wait for about 48 hours more and see, most probably you should get a reply by that timeframe. As you know it was a little busy schedule for the past 4 days due to AWS re:Invent 2022. Hopefully they will respond back to you in the next couple of days.Share"


Question: Fix waf body size rules in my AWS accounts

"I was sent an email indicating I need to apply a size constraint rule or define oversize handling behavior on Body or JSON body rules for all of your AWS WAF web ACLs.The message also mentions: To help you update Body or JSON body rules, we are developing a 1-click tool which will be available by early December.I'm trying to find this "1-click tool" the message refers too.Is this the one-click-tool in the documentation below?I'm reviewing this documentation here - https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl-size-conditions.htmlAlso for Continue in the documentation, it mentions it will inspect contents that are within the size limitations. I'm under the assumption that it's AWS who automatically enforces these size limitations and it's the customer (me) who must define the way the size limitations are handled, if I'm not mistaken.I'm also wondering is there any best practices or suggestions on what approach to take when defining options for oversize handling?ThanksFollowComment"

Answer: "0A limitation of AWS WAF is that it won't inspect body content after the first 8KB.  You can apply a rule across all your WAFs checking for body>8KB and just reporting it for a while.  Then inspect which of your workloads never have to handle genuine requests >8KB, and can have that rule changed to be a "block".If you have any remaining workloads that genuinely need to handle requests >8KB, you may be able to mitigate further if you can identify certain patterns that these request relate to, e.g.:Add a top-priority rule that explicitly allows only those requests, based on URL for example.Then for other requests, block them if > 8KB.Inspect the remainder.This may end up being a better solution, but as the requests matching the top-level rule become completely unscanned it may end up being worse, depending on your particular workload.CommentShareEXPERTskinsmananswered 6 months ago0Regarding 1-click tool which will be available by early December:All the new features are only supported in WAFv2. If there are any non-compliant WAFv2 WebACLs then customers should be able to see this in their WAF console  :In AWS WAF, only the first 8KB ( i.e. bytes 1 through 8,192 bytes ) of the body content is inspected. The remaining content beyond 8,192 bytes  isn't inspected by default. This is a hard service limit and can't be changed.That means that any malicious payload that starts after the 8,192nd byte in a POST request will completely bypass AWS WAF unless you’ve explicitly added a rule to block any POST request greater than 8KB in size.  Since inspection limit is within first 8KB, AWS relayed the decision to the customers for the way these oversized requests to be handled.The 'Continue' as an option within the oversize handling states that: If any request is oversized against the WAF’s inspection size limit, then that oversized payload ( payload content after 8,192 bytes ) will be ignored and AWS WAF will inspect the request components that are within the size limitations ( payload content from byte 1 through 8,192 bytes ) and the rule action will take place.For example,if you want to allow the request if the body contains ‘hello’ and you don't want the oversized contents ( after 8,192 bytes ) to be inspected, you can use ‘Continue’ as the oversize handling behavior as below:     * Action : ALLOW     * Statement : ByteMatch          * FTM : Body         * Contains : “hello”         * OversizeHandling : CONTINUEHere, WAF inspects bytes 1 through 8,192 bytes of the body content and the rule action ‘ALLOW’ takes place if the request contains the string 'hello', even if the request content crosses the WAF size limit ( > 8,192 bytes )For example,2) If you want to block the request if the body contains ‘hello’ and you don't want the oversized contents ( > 8,192 bytes ) to be inspected, you can use ‘Continue’ as the oversize handling behavior as below:        * Action : BLOCK        * Statement : ByteMatch             * FTM : Body            * Contains : “hello”            * OversizeHandling : CONTINUEHere, WAF inspects bytes 1 through 8,192 bytes of the body content and the rule action ‘BLOCK’ takes place if the request contains the string 'hello', even if the request content crosses the WAF size limit ( 8,192 bytes )Suppose you configure a custom rule with a request body that contains XSS injection attacks and your request body is 9,000 bytes. You can choose from the following oversize handling actions:Continue: AWS WAF inspects bytes 1 through 8,192 bytes of the body content for XSS attack. The remaining 8,193 through 9000 byte content isn't inspected.Match: AWS WAF marks this request as containing an XSS attack and takes the rule action (either ALLOW or BLOCK). It doesn’t matter whether the request body includes an XSS attack pattern or not.Not match: AWS WAF marks this request as not containing an XSS attack regardless of the request body content.CommentSharePrajwalBanagaranswered 6 months ago"


Question: Send Email using Amazon SES from PowerApps

"Hi All,I have a question regarding Amazon SES. Is there any way to send Bulk emails using Amazon SES from Microsoft PowerApps application?FollowComment"

Answer: "0Hello Vishal,In powerapps search for a SMTP connecto (e.g. https://learn.microsoft.com/en-us/connectors/smtp/), then you can setup the AWS SES service and using the SMTP interface, more information here: https://docs.aws.amazon.com/ses/latest/dg/send-email-smtp.htmlHope it helps,LuisCommentShareluisanswered 6 months ago"


Question: Lightsail Database Instance stuck at "Storage Full" state

"My lightsail mysql db instance has no storage space left. I don't know the reason why and it was a test db, so nothing important. But now I cannot perform any operation on it. I cannot not delete it, cannot stop it, cannot add additional storage.. So it is stuck at storage full status.FollowComment"

Answer: "0Accepted AnswerHi,We are trying to fix it as soon as possible. I can't give a exactly time now, but it shouldn't be very long. You don't need to buy the support plan, but if it's not urgent, I suggest wait a little bit and delete it by yourself, then contact customer support so we can refund you for this unable-to-delete time.Best wishes,JoyCommentShareshiqiawsanswered 4 years agoSCL a year agoHi, shiqiawsI am currently having the same problem, the database cannot be increased in capacity, stopped, or deleted. How do I notify AWS and ask for help? (My current support plan is basic)Share0Can you connect to it from the terminal in your account (or via SSH)?CommentShareRobMManswered 4 years ago0Hi,Sorry about the inconvenience, we're currently working on this issue and it will be out soon. If it's urgent, please feel free to reach out to customer support and we are happy to help deleting the instance.Best wishes,JoyCommentShareshiqiawsanswered 4 years ago0Hello,thank you for the quick reply. It is not urgent, but what do you mean by soon? 1 week, 1 month, 3 months? Would you delete the instance, even If I don't have a support plan or should I buy one?CommentSharebarkintanswered 4 years ago"


Question: "[AWS DMS] Failed to upload file '/rdsdbdata/data/tasks/...' to bucket <bucket> as 'filename', status = 4"

"The version of the replication instance is 3.4.7It was working fine, but after maintenance, the error below has occurred and the work stopped.I wonder what could be the cause of the possible error, also where the file /rdsdbdata/data/tasks/ is created.https://aws.amazon.com/premiumsupport/knowledge-center/dms-task-successful-no-data-s3/?nc1=h_lsI referred to the document in the link above, but in the example of the document, it is a case of downloading file, i'm not sure if it fits my case.[SOURCE_CAPTURE ]W: Got 7 headers at error exception (anw_retry_strategy.cpp:91)[SOURCE_CAPTURE ]W: header: 'connection'='close' (anw_retry_strategy.cpp:94)[SOURCE_CAPTURE ]W: header: 'server'='AmazonS3' (anw_retry_strategy.cpp:94)[SOURCE_CAPTURE ]W: header: 'transfer-encoding'='chunked'[SOURCE_CAPTURE ]E: ExpiredToken: Unable to parse ExceptionName: ExpiredToken Message: The provided token has expired.[SOURCE_CAPTURE ]E: Failed to upload file '/rdsdbdata/data/tasks/...' to bucket <bucket> as 'filename', status = 4FollowComment"


Question: Can't specify SPEKE version 2 on "Apple HLS" packaging

Why there is no SPEKE version 2 options when package type is "Apple HLS"?It seems like using the same key for video and audio makes it much easier for content to be compromised.Why MediaPackage doesn't support separate keys encryption for audio/video in "Apple HLS"?FollowComment

Answer: "1There is no SPEKE v2 option in MediaPackage when package type is "Apple HLS" is because MediaPackage does not support SPEKE v2 for Apple HLS[1].At this time MediaPackage doesn't support multiple encryption keys for audio and video in Apple HLS endpoints since it doesn't support SPEKE v2, instead MediaPackage supports separate encryption keys i.e. SPEKE v2 in CMAF Apple HLS endpoints.CommentShareSUPPORT ENGINEERLakshayanswered 6 months agobi 5 months agoHi, Thank you for your answer.I asked an additional question about the CMAF Apple HLS endpoints.Could you answer the question?https://repost.aws/questions/QUYKaeVIM0So-QvRvdBO0d5g/what-is-the-speke-v-2-response-cpix-hls-signaling-data-tags-looks-likeShare"


Question: Check routing table in virtual private gateway

"I am using VPN Site to Site and Direct Connect. Both connect to VPC through virtual private gateway.When I tracert from on premises to AWS, it routes through Direct Connect. If DX down, it routes through VPN Site to SiteBut when i tracert from AWS VPC to onpremises, it still routes through VPN Site to Site first.How can we check routing table in virtual private gateway and change priority to DX first when connect from AWS to onpremisesFollowComment"

Answer: "0HiThe route table of the Virtual Private Gateway is what you have configured in your VPC route table, there is no separate table although the VGW does have logic.From your description it looks like you could have a static. or more specific route advertised from the VPN, that takes priority over the routes from the Direct Connect.For Example, If Direct Connect is advertising 10.0.0.0/8 and VPN is advertising 10.0.0.0/16, addresses in the 10.0.0.0/16 will go down the VPN.If there are not more specific routes from the VPN it could be that both the Direct Connect and the VPN are advertising the same routes via BGP. In these cases the new BGP session generally take priority. What you would need to do is implement AS_PATH to provide preference information to AWS.For Example, set Direct Connect AS_PATH 65001 (your ASN) and VPN AS_PATH as 65001,65001 this way Direct Connect will take preference in BGP because of the shorter path.Take a look at vpn-route-priority which explains the route preferences in more detail.Also look at DX Routing as it shows AS_PATH and also BGP local preference tags which could also help.CommentShareRobin Fordanswered 4 months agoEXPERTTushar_Jreviewed 4 months ago"


Question: Kinesis Stream Throttling

"Hi All,I have a simple putRecordsRequest to Kinesis using the AWS SDK. I am running this code as a load generator in conjunction with TPS Generator to perform some load testing. When doing the load tests at high tps such as 100K, I get a LimitExceededExpectation: Rate exceeded for stream ingest-event-rishprak-dev-iad. Furthermore, looking at the cloudwatch dashboards for this stream, nearly all of the PutRecords are throttled - 99.7% PutRecords throttled. I have already increased the shards provisioned for the stream to 200 so that write capacity is 200k records per second. Could anyone provide me any insight as to why I am getting throttled in this stream?ARN is arn:aws:kinesis:us-east-1:407205872689:stream/ingest-event-rishprak-dev-iadFollowComment"

Answer: "0Hello,Unfortunately we cannot troubleshoot your specific instance through re:Post, you will need to submit a ticket to our support team to troubleshoot your current Kinesis Data Stream.If you're receiving the error message LimitExceededException, this is not related to the PutRecords method.  This error message is associated with other methods such as:createStreamdescribeLimitsdescribeStreamdescribeStreamSummaryIf you were running into a throttling/throughput issue, you might receive an error ProvisionedThroughputExceededException.Can you confirm if you're utilizing partitions and if you're performing any additional methods outside of PutRecords?CommentShareEXPERTChris_Ganswered a year ago"


Question: AnalyzeExpenseResponse returns Non JSON format output in Java

"Hi,I am using AnalyzeExpense for extracting invoice data and I am using the following code:***TextractClient textractclient = TextractClient.builder().region(Region.EU_WEST_1).build();AnalyzeExpenseRequest request = AnalyzeExpenseRequest.builder().document(Document.builder().s3Object(S3Object.builder().name("my_file.pdf").bucket("textract-console-eu-west-1-28f4ed17-0a66-4382-88ca-30b327cea233").build()).build()).build();AnalyzeExpenseResponse result = textractclient.analyzeExpense(request);System.out.println("Result: " + result.toString());***The result is show as:Result: AnalyzeExpenseResponse(DocumentMetadata=DocumentMetadata(Pages=1), ExpenseDocuments=[ExpenseDocument(ExpenseIndex=1, SummaryFields=[ExpenseField(Type=ExpenseType(Text=VENDOR_NAME, Confidence=99.30162), ValueDetection=ExpenseDetection(Text=PDSVISION, Geometry=Geometry(BoundingBox=BoundingBox(Width=0.2754717, Height=0.024333334, Left=0.03254717, Top=0.016), Polygon=[Point(X=0.03254717, Y=0.016), Point(X=0.30801886, Y=0.016), Point(X=0.30801886, Y=0.040333334), Point(X=0.03254717, Y=0.040333334)]), Confidence=99.0582), PageNumber=1), ExpenseField(Type=ExpenseType(Text=OTHER, Confidence=95.5), LabelDetection=ExpenseDetection(Text=Our Order No:, Geometry=Geometry(BoundingBox=BoundingBox(Width=0.10712053, Height=0.010183533, Left=0.28589082, Top=0.29408652), Polygon=[Point(X=0.28589082, Y=0.29408652), Point(X=0.39301136, Y=0.29408652), Point(X=0.39301136, Y=0.30427003), Point(X=0.28589082, Y=0.30427003)]), Confidence=95.44447), ValueDetection=ExpenseDetection(Text=SO2631, Geometry=Geometry(BoundingBox=BoundingBox(Width=0.0567838, Height=0.00983429, Left=0.28696728, Top=0.3110361),........So, the result is not in JSON format.How can I extract the fields from this output? like how can I extract INVOICE_NUMBER, INVOICE_DATE,..... in java?Thanks & Regards,SamehFollowComment"

Answer: "1Hi Sameh, thanks for using Textract service. Please see the guidance here https://docs.aws.amazon.com/textract/latest/dg/analyzing-document-expense.html. You can use result.expenseDocuments() to get ExpenseDocuments. This will be a list of ExpenseDocument objects, you can further extract information from these objects.CommentShareAWS-Shayneanswered a year agoAWS-Textract a year agoThank you. This is very helpful and I am able to extract the data.But I can see one of the fields (Invoice Total) is picked from wrong place, how can I learn this invoice and tell the AWS from where it can pick the correct Total value? so that if this invoice sent again, AWS will be able to pick the correct value.As I know is AWS Textract has self learning and use AI to extract the data from the invoice, so is there anyway I can tell the AWS the correct location to pock the value?ShareAWS-Shayne a year agoHi, unfortunately we don't support custom config or training for AnalyzeExpense. We will keep improving the model quality to provide more accurate detections.Share"


Question: HTTP API Integration with lamda function and stage variable not working

"I have an HTTP API with two stages dev and prod.  Each stage has a stage variable 'environment', for the dev stage the value is 'blue' and for the prod stage the value is 'red'.I have a helloworld lambda function that has two aliases 'red' and 'blue'.  Each of the aliases points to a different version of the lambda function.Using the console:I created a lambda function integration using the arn of the helloworld function and the stage variable:  arn:aws:lambda:us-east-1:XXXXXX:function:helloworld1:${stageVariables.environment}From this AWS blog post https://aws.amazon.com/blogs/compute/building-better-apis-http-apis-now-generally-available/ , I understand that I cannot use the "Grant API permission . . . " toggle and instead must use an ARN of a role that has permissions to invoke the lambda function.  After some investigation, I understand that this role must have iam:PassRole permission.  I've entered the ARN of a role that has IAMFullAccess.I can save the integration and then attach the integration to a GET /helloworld endpoint.With that all set up,  https://<domain>/dev/helloworld or https://<domain>/prod/helloworld both return a response: 404 Not Found.How do I set up an HTTP API to use stage variables to select the alias of the integrated lambda function? What exactly must the IAM role be capable of to make this work?Thanks!tomEdited by: T. Hoag on Aug 3, 2021 9:16 PMFollowComment"

Answer: "0To make an HTTP API integration work with stage variables and a lambda function with aliases:Create an HTTP API. (not REST)Create two or more stages in the API.  For this example, I'm creating two stages and naming them ‘development’ and ‘production’.In each stage, create a stage variable 'lambda_alias'.  In the ‘development’ stage, give the variable the value 'dev' and in ‘production’: 'prod'. Deploy the stages of the API if they are not auto-deployed.In your lambda function, create an alias called 'prod' and have the alias point to the first version of your lambda function.  Create a second alias 'dev' and have it point to $LATEST.  In this example, the lambda function is named ‘helloworld1’ .  This assumes that the lambda function has at least one version and has been deployed one or more times since the version was made.  Both version 1 and the latest deployment provide output that are different (so that on you can check that the setup is working properly).Save and copy the ARN of the helloworld1 function.Back in the API console, create a lambda function integration.For the lambda function name, you cannot use the lambda function name from the drop down OR the lambda function ARN that you previously copied.  Instead, you must use a gateway ARN with the invocations action.  Use the following as a template with your values for region and the previously copied function ARN. Do not make any substitutions for ${stageVariables.lambda_alias}arn:aws:apigateway:<AWS_REGION>:lambda:path/2015-03-31/functions/<LAMBDA_ARN_YOU_COPIED>:${stageVariables:lambda_alias}/invocationsSave (Create button) the integration.A side-note on the “Why?” for the remaining steps.  When you create the integration with a lambda function that contains a stage variable, it opens a small security hole.  Left unchecked, the integration would run any aliased version of the lambda function.  A bad actor could add an alias to the lambda function to accomplish some nefarious purpose.  To prevent this bad behavior, AWS security takes a disallow stance on all integrations with a lambda function that use stage variables.  The following steps tell AWS which alaised versions of the lambda function to allow.After the save operation is complete, there is an “Invoke Permission” section on the “Integration details for route”. Expand the details for that section.The ‘Example Policy Statement’ must be run for each lambda function alias.   Do not run the code example as written: run it once for each of your lambda function aliases that you want API Gateway to have permission to run, substituting the alias value for ${stageVariables.lambda_alias}.  Using a configured AWS CLI with a user that has sufficient privileges, run the ‘add-permission’ command for both helloworld1:dev and helloworld1:prod.  Double check that you get a response similar to the one shown on the integration details page.Attach the integration to an API route -- I’m using ‘howdy’ as the route.Make a request to the /production/howdy and the ‘prod’ alias of the lambda function will be invoked.  A request to the /development/howdy will invoke the ‘dev’ alias of the lambda function.Releasing new versions of a lambda function will only require you to update which version of the function that prod and dev aliases point to.  You do not need to make any additional changes to the API integration.CommentShareT. Hoaganswered 2 years ago"


Question: Does DCV Connection Gateway need a public IP address if behind an Application Load Balancer

"One of our security requirements is to not have any instances have a public IP address, including the DCV Connection Gateway instance.Is this possible?Client --> ALB --> DCV Connection Gateway instance --> DCV server InstanceFollowComment"

Answer: "1You won’t need a public IP for the DCV Connection gateway instance if it is registered as a target to the ALB and is present in the same VPC as ALB, the ALB will be able to communicate to the instance via their private IP. ALB targets do not need to be public, they just need to be accessible by ALB.CommentShareSUPPORT ENGINEERShubham_Tanswered 2 months agoLtnSnoopy 2 months agoHmm - we must have a configuration issue then. We have set it up as you described and it does not work until we give the DCV Gateway a public IP address. Have you tested this? We are using a ALB (application load balancer) not a NLB (network load balancer) if that makes any difference.Sharegabemv-AWS 18 days agoTypically you would have: [NICE DCV Client (thick or browser)] --tcp/udp with tls--> [NLB - typically public if you want to reach it from anywhere] -> [Connection Gateway - Private] -> [Target Virtual Desktop - Private]Share"


Question: Transferring a domain registered at an external registrar to Amazon Lightsail

"I have a domain registered with an external registrar that is about to expire and I want to transfer it to my Amazon Lightsail instance.I currently have the domain configured in Amazon Lightsail and in the external domain registrar I have configured the DNS of my DNS Zone of my Amazon Lightsail instance.Is it possible to deregister the domain at the external registrar and have it managed and billed at Amazon Lightsail?FollowCommentPriyavart_K a month agoHi, To use your domain from external registered provider. you can  transfer the domain from registerar to AWS by using Route 53 , follow the instructions .https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-transfer-to-route-53.htmlShare"

Answer: 1Accepted AnswerAmazon Lightsail uses Amazon Route 53 for DNS.This link provides full documentation for transferring your domain from an existing Registrar to Route 53.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-transfer.htmlCommentShareEXPERTiBehranswered a month ago


Question: "Crawler pulled Snowflake table, but Athena failed to query it."

"Using Glue we can crawl snowflake table properly in catalog but Athena failed to query table data:HIVE_UNSUPPORTED_FORMAT: Unable to create input formatGoogling results suggested it's because of table created by crawler has empty "input format", "Output format"... yes they are empty for this table crawled from Snowflake. So the question is1 why didn't crawler set them? (crawler can classify the table is snowflake correctly)2 what the values should be if manual edit is needed?Is Snowflake table able to be queried by Athena?Any idea? Thanks,FollowCommentGonzalo Herreros 3 months agoThat error means Athena doesn't recognize it's a special table and it's trying to use it like a standard Hive table.I don't think it's possible for Athena to query a JDBC table at this timeShare"

Answer: "1Hi,You can query Snowflake using Athena via the Federated query feature of Athena. Crawling the Snowflake tables will add them to your data catalog, but you can't point Athena directly to these tables and query them. I will drop the blog on how to set up the Athena connector for Snowflake, and also a blog on crawling your Snowflake tables and the use cases for that.Athena Federated query to SnowflakeCrawling Snowflake tables with AWS GlueCommentSharehamltmanswered 3 months agofengliplatform 2 months agoThanks for the links! It seems "crawling Snowflake table schema to catalog" is NOT a way to go. Would you please confirm that?ShareGonzalo Herreros 2 months agoIn general crawled tables are meant to be used by Glue jobs, there is no guarantee that Athena or other tools outside of Glue will be able to read it. But any day Athena can add the support for that kind of tableShare"


Question: How to configure Sender ID on SMS

"I am setting up a new environment using a new account under the same payee/root account. In order to set up the env I need to configure Sender ID on SMS messages. I have registered Sender ID in India, have a principal entity, and have approved SMS templates.AWS Support is refusing to configure the Sender ID because the account is new. Root / payee account has been active for more than a year.This is the second time such an incident is happening. Last time I had to tag AWS Support on twitter to get the ticket escalated.Has someone faced similar issue, is there a better way to get help?FollowCommentSabya 7 months agoI followed the channel that worked last time - tweeted tagging AWS support. The ticket was sent for senior review. Work is done.It was disappointing to get the level of help from AWS.Now the team is refusing to configure Cognito to use Sender ID to send SMS. I have another case from a different account where it was done. I am wondering if I should tweet or move to Azure.Share"

Answer: "0Hi Sabya,You can request one by creating a new case in the AWS Support Center. There's a useful guide here to setting it up, which may be helpful, and save you from delay in getting it approved: https://docs.aws.amazon.com/sns/latest/dg/channels-sms-awssupport-sender-id.htmlHowever, if you've tried that, and it's still being blocked because the account is new (which is not unusual), but the root / payee account is not, then I'd raise a ticket to get it fixed, and ask for the process to be reviewed.CommentShareJon Ranswered 7 months agoSabyasachi Bose 7 months agoI already have a case opened. This in my second not to great experience in last two months.May I ask you to get Case ID 10758380021  & Case ID 10758380021 reviewed. In the first Case ID you will notice the request was closed with exact same message 5-6 times even after explaining AWS Organisation structure, sending evidences of credits and past bills. Irrespective of what I say or ask the support team always responded with exact same standard message and closed the ticket. It is rude.Both times I had to send message on twitter tagging AWS Support and eventually case was picked up for senior review. I shouldn't need to write on social media if support is able to answer the queries.I would love to know if I am asking for something that I should have solved on my own. As far as I know SNS and Cognito cannot send SMS using Sender ID unless they are configured by Support. If there is an option to set it up myself I would love to do it and not ask.Thank youSabyaShare0To answer your question, we require details that are non-public information. Please open a support case with AWS using the following link https://console.aws.amazon.com/support/home#/case/createCommentShareThato_Banswered 7 months ago"


Question: AWS Comprehend scan list for frequently used words and phrases?

AWS Comprehend or any other AWS services can effectively review all of the forum's postings and provide scan list for frequently used words and phrases (such as "disappointed " and "take care")?FollowComment

Answer: "0Amazon Comprehend uses natural language processing (NLP) to extract insights about the content of documents. It develops insights by recognizing the entities, key phrases, language, sentiments, and other common elements in a document. For example, using Amazon Comprehend you can search social networking feeds for mentions of products or scan an entire document repository for key phrases.You can run real-time analysis for small workloads or you can start asynchronous analysis jobs for large document sets. You can use the pre-trained models that Amazon Comprehend provides, or you can train your own custom models for classification and entity recognition.All of the Amazon Comprehend features can analyze UTF-8 text documents as the input files. In addition, custom entity recognition can analyze image files, PDF files, and Word files.Reference: https://docs.aws.amazon.com/comprehend/latest/dg/realtime-console-analysis.html -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago"


Question: I am considering signing up for a AMAZON S3 storage server

"I am considering signing up for a AMAZON S3 storage server.Here are my needs:-I have 3 Terabytes of audio music filesI would like to store them in the Amazon S3 server.-I need the ability to download the files directly from FILEZILLA, which is a FTP program at https://filezilla-project.org/-I need exact step by step instructions from you, which demonstrate exactly how I would go about downloading the files directly from my Amazon S3 server with Filezilla.FollowComment"

Answer: "0There's an option to select Amazon S3 after creating a new site, where you input your secret and access key. Here's the step by step instructions.Filezilla Pro Connection to Amazon S3CommentShareIhteshamanswered a year ago0Does anyone have an answer which is clear and does not leave out all of the important steps to getting this setup?CommentSharemywebguyanswered 10 months ago0FileZilla offers clear guidance on this.https://filezillapro.com/docs/v3/cloud/configure-filezilla-pro-to-connect-to-s3/NOTE: This is a pro feature.CommentShareRobin Fordanswered 6 months ago"


Question: EC2 Instance Shutdown by SystemD event "Power key pressed" without any inform in advance.

"On Jan 04 12:00 GMT, our EC2 t3a.medium instance placed in AZ ap-southeast-1cHas been shutdown (and kept down not restarted -- even Auto-Recovery feature has turned on) from the Physical (or Virtualized)with SystemD event "Power key pressed"but without any inform in advance from AWS.Can anyone one confirm that this issue is the cause from AWS datacenter or has any notified information to share with us?FollowComment"


Question: Network connectivity from local vlan to vpc.

"I have a aws vpc with a 10.1.12.0/26 subnet. I have created a Internet Gateway, Virtual Private Gateway and Customer Gateway. I have setup s2s vpn with on premisis pfsense. Both tunnels are up and running. I have 2 ec2 servers.I have setup routes for my aws network of 10.1.12.0/26 with the target local. I have setup a route for my pfsense vlan 10.1.10.0/26 target virtual private gateway. I have setup security groups that allow all traffic inbound/outbound.I am unable to ping aws from my pfsense vlan. Ive have run the packet capture on pfsense. All I see is ICMP echo requFollowComment"

Answer: "2Accepted AnswerI suggest you check the following:Make sure you're using route-based VPN and not policy-based VPN, if you're using policy-based VPN then make sure you're only defining one CIDR on the pfsense as the proxy ID, defining two CIDRs will cause multiple security associations and that would cause connectivity issue. Refer to [1].If you're using static VPN, make sure you enable asymmetric routing on the pfsense, if you don't want to enable the asymmetric routing on the pfsense, then disable one of the tunnels and have only one tunnel up and test the connectivity. This is to roll out the asymmetric routing issue. Refer to [2].Make sure the traffic is being allowed in the NACL.If the above does not resolve the issue, I suggest enabling VPC flow logs and see if the traffic is being received by the EC2 from on-prem. Refer to [3].Make sure you have a proper static route on the AWS VPN side for your on-prem network 10.1.10.0/26. Refer to [4].References:https://repost.aws/knowledge-center/vpn-connection-instabilityhttps://repost.aws/knowledge-center/vpn-configure-tunnel-preferencehttps://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.htmlhttps://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-edit-static-routes.htmlCommentShareMatt_Eanswered a month agoUser-6950612 a month agoThank You, I figured it out. I forgot to add a rule to the pfsense wan interface to allow access to the my aws subnet.Share"


Question: S3 bucket default encryption for object uploads

"Since the launch of default encryption feature earlier this year for S3 buckets and objects uploaded to S3,  I've been adding objects to an existing bucket and I am not seeing the default encryption being shown in the Console for these objects. Does anyone have any insight?FollowComment"

Answer: "0Accepted AnswerStarting January 5, 2023, the automatic encryption status for S3 bucket default encryption configuration and all new object uploads is visible in AWS CloudTrail logs across all AWS Regions, including the AWS GovCloud (US) Regions and the AWS China Regions. Over the next few weeks, we will roll out this automatic encryption status to the Amazon S3 console, S3 Inventory, S3 Storage Lens, and Amazon S3 API responses in the AWS CLI and AWS SDKs in all Regions. During the next few weeks, the automatic encryption status will also be rolled out to the Amazon S3 console, S3 Inventory, S3 Storage Lens, and as an additional Amazon S3 API response header in the AWS Command Line Interface and AWS SDKs. When this update is complete in all AWS Regions, we will update the documentation.Will Amazon S3 encrypt my existing objects that are unencrypted? No. Beginning on January 5, 2023, Amazon S3 only automatically encrypts new object uploads. To encrypt existing objects, you can use S3 Batch Operations to create encrypted copies of your objects. These encrypted copies will retain the existing object data and name and will be encrypted by using the encryption keys that you specify.Above answers referenced from: https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.htmlCommentShareAarthi Kannananswered 4 months agoEXPERTTushar_Jreviewed 4 months ago"


Question: Unable to SSH Windows Ec2 instance

"Hi,Created an EC2 instance on default VPC.Added security group to allow all traffic (inbound and outbound)Routing table includes the target as the internet gateway for source 0.0.0.0/0I am able to connect to the EC2 instance through Remote Desktop.Yet when I try to SSH using the following command,I get request timed out.ssh -i <download pem file> ec2-user@<public ip>Thanks in advance.FollowComment"

Answer: "0Hi SushilMathewThank you for posting your issue :)By default, you will only be able to RDP (Remote Desktop) into your instance because this is a Windows Instance so it is not possible to SSH into. The SSH client is for connecting to Linux Instances. However, if you would like to SSH into your Windows instance then you will need to do some custom configurations by installing it on the instance.The link below will give you details on how to get SSH to work on your Windows instance however one thing you need to remember is that the link provided is not an AWS link which means you will need to use it at your own risk.https://medium.com/@pasindujay/how-to-connect-to-aws-ec2-windows-instance-with-openssh-b5dfd0a9e749Kind regardsCommentSharenaz97answered 2 years ago0Thank you so much. Is it possible to ping it? as i am facing the same issue with ping tooEdited by: SushilMathew on May 11, 2021 3:00 AMCommentShareSushilMathewanswered 2 years ago0Hi SushilMathewYou're welcome :)As per your first message, your security group allows traffic to everyone so that should be no problem if that was the case. However, you're having issues with the Ping utility because your Firewall is enabled in your Remote Desktop, to give you some more insight on this - Some firewalls will block ping signals by default. Windows devices have built-in firewalls which when enabled with default settings, will automatically block ping requests. The Ping Utility not working means that you are unreachable in the network, and ICMP is used to check if your server is reachable. So, with ICMP blocked, you will have issues when trying to ping your Windows Instance.To resolve this you can connect to your Remote Desktop and navigate to the Control Panel > System and Security > Windows Defender Firewall and disable your firewall.I hope this helps, please reach out if you have any other questions :)CommentSharenaz97answered 2 years ago"


Question: Can I do the incoming & outgoing tests call during the test of the amazon connect contact center while using my own Indian mobile number?

"If I use my own Indian mobile number during the amazon connect flow, in that situation can I do the incoming & outgoing tests call during the test of the Amazon Connect contact center while using my own Indian mobile number?FollowComment"

Answer: "0Accepted AnswerYes, you can.1- if you are making an outgoing call from your India Local line and in the same time placing yourself in the queue and using SoftPhone option on CCP and you are using normal internet and not VPN, call will come through normally.2- For making an outgoing calls from Amazon Connect. you will need to assign a phone number ( from amazon connect ) in the Queue related to your routing profile so the call can go through to your India local number.https://docs.aws.amazon.com/connect/latest/adminguide/create-queue.htmlBest Regards,Ramy HusseinCommentShareRamyHanswered 2 months ago0Yes, you can use your own Indian mobile number to test incoming and outgoing calls in Amazon Connect contact center. However, there are a few things to keep in mind:Make sure your phone number is supported: Amazon Connect supports phone numbers from many countries and regions. You should verify that your Indian mobile number is supported by Amazon Connect before attempting to use it for testing.Thank you.CommentSharerePost-User-0899580answered 2 months agoNishat 2 months agoCan you please guide me, on how can verify my number with Amazon before using it? I did not started yet for creating my connect flow. I am stuck in these steps.Share"


Question: "Mechanical Turk: Surveying student in France, Belgium or Switzerland"

I want to survey college students in French-speaking countries (with a survey in French obviously). Can I get such a a sample with Mechanical Turk? I am not interested in researching US/international college students speaking French.Thank you!Jean-LouisFollowComment


Question: Does the Ruby Lambda Runtime support Ruby 3.0?

"Does the current Ruby Lambda runtime support applications written with Ruby 3.x features and Gems? Its not 100% clear from the documentation. And this issue Ruby 3.0 Support? #14 in aws/aws-lambda-ruby-runtime-interface-client implies that it does, though the README says it only supports up to 2.7.x.But then the Runtime docs Building Lambda functions with Ruby says it supports "SDK 3.1.0".  Not clear if that is Ruby or the AWS SDK.If we set the Lambda Environment variableGEM_PATH/var/task/vendor/bundle/ruby/3.0.0It seems to "work" with the 3.0 Gems we install...FollowCommentrePost-User-3540186 4 months agoI have not seen any updates re. 3.* support from AWS. How are you getting around this issue for now?ShareRobert J Berger 4 months agoWe just switched everything back to 2.7. It was a bummerShare"

Answer: 3Your authentic source of information is https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.htmlThis document mentions the version of Ruby that is supported is 2.7Version 3.1.0 is the version of the Ruby SDK - https://docs.aws.amazon.com/sdk-for-ruby/v3/api/CommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago


Question: Does AWS Private CA support indirect CRLs?

We need to maintain an indirect CRL for a multi-level PKI architecture and would like to use a single CRL issuer to accomplish this. Does AWS Private CA support the creation and management of indirect CRLs?FollowComment

Answer: "0Hi,Yes. AWS Private Certificate Authority (CA) supports indirect CRLs. To use indirect CRLs with AWS Private CA, you can specify one or more CDPs when creating the CRL. The CDPs can be specified as URLs or DNS names in the CRL Distribution Points extension of the CA certificate. Refer here for more details: https://docs.aws.amazon.com/privateca/latest/userguide/ca-lifecycle.htmlThanksArunCommentShareArunanswered 3 months agoDani 3 months agoHi Arun, that link doesn't mention anything about configuring CDPs or indirect CRLs. I understand that it's probably possible to generate certificates with custom CDPs. My question is about whether or not AWS PCA supports the management of indirect CRLs. In other words, does PCA have the ability to automatically sign a CRL with a CA different than the issuing CA?ShareArun 3 months agohi Dani,ACM PCA currently doesn't support automatic signing of CRL's with a different CA than the issuing CA. If you want to sign the CRL with a different CA, you will have to sign the CRL and then distribute it to the appropriate parties. Alternatively, you could configure the issuing CA to issue the CRL as and indirect CRL, where the CRL has a reference to another CRL issued by a different CAShare"


Question: S3 bucket policy to allow access through VPC endpoint and an IAM user only

"I have a S3 bucket having sensitive data, i have a use case such that only a specific IAM user can put objects to the bucket and it is only accessible through a VPC endpoint. how can i achieve this?FollowComment"

Answer: "0Hey, Thanks for the answer. But i want to restrict access on S3, so there is an IAM user that uploads to the s3 bucket from internet and it has only put object rights. I want my s3 to be configured such that only the user can upload the s3 bucket and it can be accessed through vpc endpoint. All other access must be deniedCommentSharerePost-User-5383065answered 10 months agoSoumith Avunoori 10 months agoI believe creating a bucket policy to only allow the endpoint to access that you created or restrict any other VPC endpoints if you want to.Share0VPC endpoints for S3 are secured through VPC endpoint access policies, which allows you to set which S3 buckets the endpoints should and should not have access to. By default, any user or service within the VPC, using credentials from any AWS account, has access to any Amazon S3 resource.Use these together with S3 bucket policies to further refine access control over your buckets and objects.Go to VPC and select Endpoints.Then select Create Endpoint and search for the S3 service. Select the VPC where you would want to register the endpoint.Choose which route tables will have the VPC endpoint entryModify your endpoint access control policy if you must. The example below shows a policy that allows only GetObject and PutObject actions to an S3 bucket named my_bucket and the objects in it.Add any tags you like. Then select Create endpointTo further refine access control to your S3 bucket and objects, you can create bucket policies that restrict VPC endpoint or VPC access.The following is an example of an Amazon S3 bucket policy that restricts access to examplebucket unless the origin is from the VPC endpoint vpce-1a2b3c4d. The aws:sourceVpce condition is used to specify the endpoint.If you have resources in your AWS VPC that are connecting to Amazon S3, and you don’t want them to go through the public internet or use the S3 bucket DNS, then you should make use of Amazon S3 VPC Endpoint. Be sure to follow the principle of Least Privilege by setting up Endpoint Policies and S3 Bucket Policies so that only the appropriate entities get access to your buckets and objects.I hope this answer helps you.ThanksCommentShareSoumith Avunoorianswered 10 months ago0Can you create an IAM user only on that endpoint that has access to that private bucket?  Would that work?  No other user would have access to it then.CommentSharejschwar313answered 10 months ago0But if a user/role is created with S3FullAccess then, it will have access to the bucket. We want to avoid that and place restriction at bucket level. So need bucket policy to satisfy those two requirementsCommentSharerePost-User-5383065answered 10 months ago0no.  you don't have to grant full access.  Here's an article about granting access to a bucket.  Hope this helps.  https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example1.htmlCommentSharejschwar313answered 10 months ago"


Question: File of a ManagedInstance in Config

"Hello,Is it possible to record any changes of a file of a SSM:ManagedInstance in Config ?I have SSM and Config that are configured. My instance is running SSM agent. In Config, I record the three types for SSM (SSM:ManagedInstanceInventory, SSM:PatchCompliance, and SSM:AssociationCompliance). The global inventory in SSM is configured with every possible parameters, and I also target a file, /etc/ssh/sshd_config. I can see a new record in Config's timeline of my instance when I install a new application (for instance, nmap), but I have no new record for any renaming of the file nor when I edit the file (for instance, changing "PermitRootLogin no" -> "PermitRootLogin yes"). I know that the file is targeted because it is in SSM's inventory.Am I doing something wrong ? Is it even possible to record any changes in a file through SSM inventory and Config ? For the information, I am in Stockholm's region (eu-north-1).Thanks !Edited by: acaitr on Jan 28, 2019 4:54 PMFollowComment"

Answer: "0We do not support recording changes to "files" in AWS Config. We only collect SSM inventory for the following types: installed applications, network configuration and AWS software components.Thanks,SidCommentShareAWS-User-2424938answered 4 years ago0It would be great to track Files. This would essentially allow an easy setup for file integrity monitoring.CommentShareForums-User-7813077answered 4 years ago"


Question: CloudFront Setup

"Hello Dev,I running a WordPress site and want to serve all assets (CSS, HTML, JS, Images) through CDN is there any step by step tutorial ??FollowComment"

Answer: "0Accepted AnswerHi, @NV Deals.AWS provides an official plugin and setup instructions.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/WordPressPlugIn.htmlIf you have any reason why you don't want to use this plugin, please let me know.CommentShareEXPERTiwasaanswered 10 months agoNV Deals 10 months agoHello @iwasaI have updated as per docs but still not Deliver assets from CDN  https://prnt.sc/0DenXNjmoynI  Website: https://nvdeals.in/ShareNV Deals 10 months agoI setup but images not showing on my site  https://prnt.sc/1ZzBa__-RSC9  but media url has changed https://prnt.sc/IdQ5NJiYl501Share"


Question: Lightsail: can't upgrade to large container

"We've deployed 2 containers into a medium lightsail container. Front end and Python containers.The Python container is failing to deploy now because it appears to be too big.When I try to upgrade to a large container, I get an error:"Sorry, you've either reached or will exceed your maximum limit of Lightsail container services."Any ideas?FollowComment"

Answer: "1The error: "Sorry, you've either reached or will exceed your maximum limit of Lightsail container services" error occurs as AWS implements limits on resources for each account to help protect the overall infrastructure of AWS. Refer[1]This error could also occure due to the limitation on the new established account; the service quota page[1] also mentioned the "New AWS accounts might start with quotas that are lower than those described". You can create the amount of the LightSail Container services as been described on the service quota page [1].To resolve this, kindly place a limit increase request from your Support Dashboard in your AWS account and the team will process the new limit for your account.References:[1] https://docs.aws.amazon.com/general/latest/gr/lightsail.html#limits_lightsailCommentShareSUPPORT ENGINEERAWS-User-9822082answered a year ago1Please cut us a ticket for limit increase request for further assistant. You may have used up the limit in your account.CommentShareAWS-User-2776000answered a year ago0Hi team, thanks for your answers. I have opened a ticket and the service team has confirmed my need for a container service limit increase, I expect the issue to be resolved this week.CommentShareDennisanswered a year ago"


Question: Using CDK/Cfn to add multiple iot policies to a principal

"Hi, is there an "array" way to add multiple iot policies to a principal? At the moment, I'm doing the following...const policyPrincipalAttachment1 = new iot.CfnPolicyPrincipalAttachment(this, "policy principal attachment 1", {  policyName: "iot-policy-1",  principal: iotCertificate.attrArn,});const policyPrincipalAttachment2 = new iot.CfnPolicyPrincipalAttachment(this, "policy principal attachment 2", {  policyName: "iot-policy-1",  principal: iotCertificate.attrArn,});ThanksGaryFollowComment"

Answer: "1Accepted AnswerHi gary,There is no construct that accept an array of policies to attach to a principal, but, the beauty of CDK is that is programmatic, so that you can loop asfor (var i = 1, i<= N; i++) {    new iot.CfnPolicyPrincipalAttachment(this, "policy principal attachment " + i, {      policyName: "iot-policy-" + i,      principal: iotCertificate.attrArn,   });}Hope it helps ;)CommentShareEXPERTalatechanswered 3 months agogary 3 months agoThanks alatech, my policy names are actually not incremental but that's ok, I can put them in an array and iterate through it. I only have 4 policies at them moment, so something to consider if things get bigger.Share"


Question: Error in importing library util

i was working on forecasting analysis in aws sagemkaker and i have refered the notes in github as well as in youtube there is a library of util i am unable to import it.FollowComment

Answer: "0Hi there,I suggest you use import utils after pip installing it using the following code:pip install python-utilsRegards NNCommentShareNtiyiso Ngonyamaanswered 9 months agorePost-User-8026650 9 months agoi will try your suggestion is it going to perform the same role as util?ShareNtiyiso Ngonyama 9 months agoYes since I believe there is no util library and the library you are looking for is utils.SharerePost-User-8026650 9 months agook i will check on it but the docs i referred for forecasting analysis is updated recently[Github] i mean 10 months ago thats why i have a concern regarding this.Thanks for your helpShare"


Question: Iam all user activity email alert

"hi team,Is there any way to send email notification for all iam users activity in aws ? Please share suggestionsFollowComment"

Answer: "1CloudTrail will have IAM user activity.  You can get CloudTrail events in EventBridge and create rules to match what you're interested in, or via CloudWatch Logs where you can create Metric Filters and alarms.  You can target SNS for notifications or process via Lambda for example.CommentShareEXPERTskinsmananswered 4 months agobala 4 months agoHi Skinsman,I used to create cloudwatch event rule and created lambda function but however its not working below is the event pattern.{"source": ["aws.iam"],"detail-type": ["AWS API Call via CloudTrail"],"detail": {"eventSource": ["iam.amazonaws.com"]}}Share0One thing to add, you should well define what activities you want to be alerted, you probably don't want to be overwhelmed by alert mails.CommentShareyhaifaanswered 4 months agobala 4 months agomainly i need for iam policy,role changes, network changes only.Share0I would like to understand what you are trying to solve for? What is your requirement? But, to answer your question, you can send trails via email, but that can be overwhelming for your mail system. A much better architecture would be to use SQS with SNS. You can find relevant documentation details here.CommentShareAWS-User-4960174answered 4 months agobala 4 months agoHi, I am trying to get email alerts for aws all resource changes and activity.Share"


Question: Using RequestStreamHandler for multiple event sources and split on batch failures

"I have a use case(Scenario 1) where I have a **lambda **which listens to kinesis streams from **DynamoDB **changes, if there is an error while processing any record in the batch of kinesis stream I return the sequence number of the record back so that the batch can be split and since I have defined the max retries, after the retries are exhausted the failed record goes to SQS.This SQS also we are planning to have it as event source of the same above lambda(Scenario 2). Now the issue is, in case of single event source of KDS(Scenario 1) I was using **RequestHandler **and for batch failure I was returning the sequence number of failed record in the StreamEventResponse. In Scenario 2, I am using RequestStreamHandler since I have multiple event sources(KDS and SQS) and I am writing the sequence number of failed record as below in the OutputStream. However it looks like Lambda is not treating it as failure and not performing any retries. Is there a way to achieve scenario 2 using RequestStreamHandler where I can return the seq number for lambda to retry?**Scenario 2 where KDS and SQS are the event sources for the same lambda**public void handleRequest(InputStream input, OutputStream output, Context context) throws IOException{      final byte[] byteArray= IOUtils.toByteArray(input);      String request= new String(byteArray, StandardCharSets.UTF_8);      KinesisEvent kinesisEvent=new ObjectMapper.readValue(request,KinesisEvent.class);      String seqNo= kinesisEvent.getRecords().get(0).getKinesis().getSequenceNumber();      List<StreamEventResponse.BatchItemFailure> batchItemFailures = new ArrayList();      batchItemFailures.add(new StreamEventResponse.BatchItemFailure(seqNo));      byte[] failures = SerializationUtils.serialize(new StreamEventResponse(batchItemFailures));      output.write(failures); }FollowComment"