Question: AppStream 2.0 - how to launch a default app ?

"Customer is testing AppStream to run an LMS for their customers. They plan on integrating their own application in a web app, handle the users via Cognito. However, they want the UX to be as smooth as possible, and therefore automatically launch the default application (their own), when the user clicks on a button that creates the URL (e.g. via the CreateStreamingURL API) - they want to skip the "Choose your app to get started".Is there a way to do so?FollowComment"

Answer: "1Accepted AnswerWhen you request the URL with the CreateStreamingUrl API, you can specify an ApplicationId parameter - see https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateStreamingURL.html#API_CreateStreamingURL_RequestSyntax.CommentShareEXPERTMatt_Janswered 3 years ago"


Question: Timeline on availability of db.r6i in Europe/Frankfurt

Is there an ETA of the availability of db.r6i DB instance class in the Europe/Frankfurt region.On https://aws.amazon.com/about-aws/whats-new/2022/04/amazon-rds-mysql-m6i-r6i-instances-instance-sizes-128-vcpus-1024-gib-ram/ it was announced only in a limited number of regions.FollowComment

Answer: "1Im not a AWS employee and have almost the same question (with a different service, EKS).R6 instances are already available in eu-central-1b and eu-central-1c, but not eu-central-1a. I just checked and you can actually already create a Single-DB-Instance or with a single read replica since it only needs 2 availability zones.If you need 3 zones availability the question is:When will r6 instances be available in eu-central-1a , so we can actually use R6 instances in services that need all three zones?CommentShareAWS-User-8277318answered 9 months ago"


Question: Redirecting a domain to an external URL

"Probably a noob question, but please forgive my sudden loss of google-fu. With a domain hosted on Route 53, is there a cheap and reliable (ie set it up once and not need to touch it until the redirect target changes) way to redirect to an external URL (a Google Scholar profile page)?S3 buckets seem to have a redirect facility (under Static Website Hosting), but it doesn't work for me. I guess that's only good for redirecting to a domain, but I need an exact URL. Do I need Cloudfront, and would the cost be prohibitive? This will be very low-traffic.I'd like to use a https connection, so that visitors are just bounced seamlessly to the Scholar page with no browser warnings.FollowComment"

Answer: "2Accepted AnswerI think CloudFront would be a good fit for this - it will provide the lowest latency for your users as the redirect will be served from their nearest Point of Presence (POP), and the volume of traffic should be low enough to fit into the free tier.There are a number of ways you could set this up, but I think the simplest would be to put an index.html into an S3 bucket, and serve that through CloudFront. This is outlined in detail here. Your index.html should simply redirect the user to the target URL. If it is unlikely to change, then you can set long TTL values in CloudFront to maximize the number of requests that will be served from cache.Note that Origin Access Identities specified in the article linked above have been superseded by Origin Access Control .CommentSharePaul_Lanswered 7 months agorePost-User-7206218 7 months agoThanks! Followed the instructions up to where it says I need to point a CNAME record at the CloudFront distribution. That sounds like I need to create a CNAME record at the domain apex, which is impossible? Could you clarify please?SharePaul_L 7 months agoRoute53 has a special resource type called an Alias which can be used for the domain apex: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.htmlShare"


Question: SageMaker Training Job stuck in Stopping

I started the training job and there was GPU memory error but training job's status never changed to Failed status. So I stopped the training job but It is in stopping status for a day.  How can I solve this problem?job name:pipelines-sx4yjpfpdg39-Training-EzzST0hXahFollowComment

Answer: "0Hello,I understand that you started a training job and there was a GPU memory error but the training job's status never changed to Failed status. You then stopped the training job but it is in stopping status for a day.Since the job is in ‘Stopping’ state for almost a day, to find the root cause of the issue, back end details associated with the job need to be checked. Hence, it is recommended to open a support case with AWS to further troubleshoot this and terminate the job. Kindly provide the training job arn and AWS region in the case.The internal team can look into the issue and force stop the training job. Please be assured that you will not be charged for this training job since it is in stopping state.You can open a support case with AWS using the following linkhttps://console.aws.amazon.com/support/home#/case/createCommentSharerePost-User-2504179answered 3 months ago"


Question: How to grant users read only permission to Athena

"My understanding is that the IAM action "athena:StartQueryExecution" is required to permit SQL queries to be run in Athena. However, it's still possible to perform INSERT INTO statements.Is there a way to restrict access to Athena and only allow read-only queries?FollowComment"

Answer: "0Accepted AnswerYes, it's possible if you use Lake Formation to grant access to your Athena users or roles. When you grant access to tables, just grant as SELECT only access previlages.https://docs.aws.amazon.com/lake-formation/latest/dg/access-control-fine-grained.htmlCommentShareSatish_Sanswered 3 years ago"


Question: mongorestore to documentdb error

I am testing offline migration from MongoDB to DocumentDB using mongodump/mongorestore and got the following error:`mongorestore --username <username> --password <password> --uri="mongodb://my-documentdb-cluster.cluster-abcd1234.us-east-2.docdb.amazonaws.com:27017" –-sslCAFile rds-combined-ca-bundle.pem --db <dbname> /var/lib/mongodb/dumps/dump2022-02-03T09:54:15.042-0500error parsing command line options: error parsing positional arguments: provide only one polling interval in seconds and only one MongoDB connection string. Connection strings must begin with mongodb:// or mongodb+srv:// schemes2022-02-03T09:54:15.042-0500try 'mongorestore --help' for more information`Where did I do wrong?Thanks in advance!FollowComment

Answer: "1The main reason you are seeing "error parsing positional arguments" is the first '-' in '–-sslCAFile' is actually a Unicode EN DASH.Also, it's not clear in the original post if this is a multi-line or single line command. Use the \ character only for multi-line input.2 other changes to make are:use --host option instead of --uriadd --ssl optionThe command should look like the following:mongorestore -ssl --username <username> --password <password> \--host="mongodb://my-documentdb-cluster.cluster-abcd1234.us-east-2.docdb.amazonaws.com:27017" \--sslCAFile rds-combined-ca-bundle.pem --db <dbname> /var/lib/mongodb/dumps/dumpCommentSharedbonseranswered a year ago"


Question: Aurora MySQL parameter group set `block_encryption_mode`

"I wanted to change the block_encryption_mode by parameter group, but this is not available in the default.aurora-mysql5.7 parameter group.Any idea how to set it (except setting it directly in the database)?There were several unanswered questions regarding this "issue" in the old forum as well.FollowComment"

Answer: "0Unfortunately, block_encryption_mode is not modifiable by Aurora DB and Cluster parameter group today. Need to set  it directly in the database.CommentShareYUTAKA_Hanswered a year ago"


Question: Introduction to FreeRTOS on an STM32 MCU - AWS Workshop

"Currently i am working on STM32 IOT board which has AWS database sync where from AWS the signal has to reach at STM32 board. While doing so i have followed the specific steps mentioned in AWS workshop as below,https://catalog.us-east-1.prod.workshops.aws/workshops/b5857416-f2f6-4188-8562-053ec5f983ef/en-US/lab-0/lab-0-6-step-1-and-2By doing these steps i am facing build issues. It seems like package information are not correct.Could you please support for further ?FollowComment"

Answer: "0Hi Debasish. It's not clear to me what part of the workshop you mean when you say "AWS database sync" because there's no database used in the workshop. Are you able to share the specific error you're getting?Please review the prerequisites: https://catalog.us-east-1.prod.workshops.aws/workshops/b5857416-f2f6-4188-8562-053ec5f983ef/en-US/lab-0#software-prerequisites. Take particular care to:Install precisely V2.0.0 of X-CUBE-AWS.Install the X-CUBE-AWS package at the recommended path on a Windows machine, otherwise you will likely get build errors because paths exceed the Windows 260-character limit.Ensure STM32CubeIDE is not newer than 1.8.0.CommentShareEXPERTGreg_Banswered a month ago"


Question: Responding an image from lambda

"I am trying to develop an application in which I am trying to respond an image/file on an api call to the lambda through api gateway.I am trying to use matplotlib and pandas layers to generate a figure ,save it and then respond as a FileResponse (fastapi) . But its not working .Data is being taken from dynamodb.The lambda is itself not working in saving the figure .I would appreciate any help.FollowComment"

Answer: "0What is the error you are getting? Where is your Lambda trying to save the image to? Local file? Lambda only supports writing files to /tmp folder.CommentShareEXPERTUrianswered 7 months agokkrishna2100 7 months agoMatplotlib created a temporary config/cache directory at /tmp/matplotlib-8j65adly because the default path (/home/sbx_user1051/.config/matplotlib) is not a writable directory; it is highly recommended to set the MPLCONFIGDIR environment variable to a writable directory, in particular to speed up the import of Matplotlib and to better support multiprocessing.This the error I am getting.Sharekkrishna2100 7 months agoimport jsonimport boto3import pandas as pdfrom matplotlib import pyplot as pltfrom boto3.dynamodb.conditions import Keyfrom datetime import datetimedynamo=boto3.resource('dynamodb')table=dynamo.Table('airplotdata')def lambda_handler(event, context):# TODO implementresponse=table.query(KeyConditionExpression=Key('id').eq('12468'),ProjectionExpression="#c,aqi,co,so2,pm25,pm10",ExpressionAttributeNames = {'#c': 'timestamp'})items=response['Items']df=pd.DataFrame(items)df['timestamp'] = df['timestamp'].apply(lambda x: datetime.strptime(x, '%Y-%m-%d %H:%M:%S'))dfm = df.melt('timestamp', var_name='metrics', value_name='metric_vals')dfm.plot(kind='line',figsize=(12,12))plt.savefig("/tmp/output")return {    'statusCode': 200,    'body': json.dumps('Hello from Lambda!')}This is my code.Sharekkrishna2100 7 months agoI am having problem in plt.savefig("/tmp/output")Share0Got a successful response after 5 seconds of computation the function time out was 3 seconds.CommentSharekkrishna2100answered 7 months agoBERGUIGA 7 months agoSo you need to change the function timeout :)Share0as I understand your lambda is responsible for the creation of the image and save it on /tmp folder? or on S3 ?CommentShareBERGUIGAanswered 7 months ago"


Question: Best practices for securing MQTT communication

"What are the best practices for securing MQTT communication between IoT devices and the AWS IoT Core service, including certificate management, MQTT over TLS, and fine-grained IAM policies for IoT devices?FollowComment"

Answer: "1Accepted AnswerHi sdtslmn. All communication is encrypted using TLS, no matter which device communication protocol you use. There are several client authentication options, but new devices would most commonly use X.509 certificates, with IoT policies (rather than IAM policies) for authorization).In terms of best practices:https://docs.aws.amazon.com/iot/latest/developerguide/iot-security.htmlhttps://docs.aws.amazon.com/iot/latest/developerguide/security-best-practices.htmlhttps://docs.aws.amazon.com/wellarchitected/latest/iot-lens/sec-best-practices.htmlhttps://docs.aws.amazon.com/whitepapers/latest/device-manufacturing-provisioning/device-manufacturing-provisioning.htmlCommentShareEXPERTGreg_Banswered 2 months ago"


Question: Trying to use GreengrassCoreIPCClientV2().get_thing_shadow()

"The following code looks valid to me. But when I try to run it, inside a greengrass component, I get an incomprehensible error:...blahblahblaheventstreamrpc.py", line 723, in _on_continuation_messageraise shapeawsiot.greengrasscoreipc.model.ServiceErrorwhat? Whats' the error??? :(I dont see anything relevant in the greengrass.log to explain this either. Justlifecyclemanager.GenericExternalService: service-errored. {exitCode=1,  ...."Here's my actual code:import osfrom awsiot.greengrasscoreipc.clientv2 import GreengrassCoreIPCClientV2THINGNAME = os.getenv("AWS_IOT_THING_NAME")CLIENTOBJ = GreengrassCoreIPCClientV2()def create_deviceshadow_cache():    print("DEBUG: thingname is " + THINGNAME)    shadow_response = CLIENTOBJ.get_thing_shadow(thing_name=THINGNAME)    print("DEBUG: Printing shadow info: " + shadow_response.payload)create_deviceshadow_cache()FollowCommentMichaelDombrowski-AWS EXPERT8 days agoWhat is your component recipe?Does your component depend on the shadow manager component? It must for this to work.Share"

Answer: "0Accepted AnswerAha. Thanks Michael. After fixing that, .. it still gives me the same error in my component log :-/  But now at least, the main greengrass.log shows me a related error.2023-05-23T15:28:07.053Z [WARN] (Thread-7) com.aws.greengrass.shadowmanager.ipc.GetThingShadowRequestHandler: handle-get-thing-shadow. Not authorized to get shadow. {thing name=demo-device, shadow name=null}com.aws.greengrass.authorization.exceptions.AuthorizationException: Principal com.bolthole.copyshadow is not authorized to perform aws.greengrass.ShadowManager:aws.greengrass#GetThingShadow on resource $aws/things/demo-device/shadowWhich is odd, because I thought I have allowed all required perms, as shown below.Any further enlightenment you can give?In recipe, copied more or less from AWS examples:ComponentConfiguration:  DefaultConfiguration:    accessControl:      aws.greengrass.ShadowManager:        'com.bolthole.copyshadow:shadow:1':          policyDescription: 'Allows access to shadows'          operations:            - 'aws.greengrass#GetThingShadow'            - 'aws.greengrass#UpdateThingShadow'            - 'aws.greengrass#DeleteThingShadow'          resources:            - $aws/things/{iot:thingName}/shadow        'com.bolthole.copyshadow:shadow:2':          policyDescription: 'Allows access to things with shadows'          operations:            - 'aws.greengrass#ListNamedShadowsForThing'          resources:            - {iot:thingName}And in my thing policy, I have:    {      "Effect": "Allow",      "Action": "iot:GetThingShadow",      "Resource": "*"    }(edit: walk through comments for final solution)CommentSharerePost-User-8804953answered 7 days agoMichaelDombrowski-AWS EXPERT7 days agoDid you enable interpolate configuration?https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-nucleus-component.html#greengrass-nucleus-component-configuration-interpolate-component-configurationWhen you deploy, use RESET: https://github.com/aws-greengrass/aws-greengrass-nucleus/issues/1470#issuecomment-1559595709SharerePost-User-8804953 7 days agoLooks like it is getting properly interpolated. Looking at effectiveConfig.yaml shows         aws.greengrass.ShadowManager:          com.bolthole.copyshadow:shadow:1:            operations:            - "aws.greengrass#GetThingShadow"            - "aws.greengrass#UpdateThingShadow"            - "aws.greengrass#DeleteThingShadow"            policyDescription: "Allows access to shadows"            resources:            - "$aws/things/demo-device/shadow"            - "$aws/things/demo-device/shadow/name/myNamedShadow"ShareMichaelDombrowski-AWS EXPERT7 days agowhat about the second policy you had? I think you need to wrap the {iot:thingName} in quotes or else yaml will treat it as a map.SharerePost-User-8804953 7 days agoHUH!there were a buncha other lines, that were NOT quoted, and used {iot:thingName}, and worked.but that one line, I guess since its not in the middle of some other string... it has to be quoted."Interesting" feature. Thanks for that.Even more "interesting", is that.. given that I cut-n-pasted from AWS docs...THE AWS DOCS ARE WRONG!!!https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-local-shadows.htmlSharerePost-User-8804953 7 days agoAlmost working. At least I can now call the get shadow function. But now yet another underdocumented category of error.I'm trying to get the default non-named shadow.I created one in the GUI, and it got autonamed "Classic Shadow'.But the code I have in my first post here isnt working.2023-05-24T02:18:26.808Z [WARN] (Thread-7) com.aws.greengrass.shadowmanager.ipc.GetThingShadowRequestHandler: handle-get-thing-shadow. Shadow does not exist. {thing name=demo-device, shadow name=null}I thought leaving shadow name null would be the way to get default shadow, but that doesnt seem to work. Nor does shadow_name="". Same error, "Shadow does not exist"But I cant set the name to "Classic Shadow" either. So what am I supposed to do?ShareShow 5 more comments"


Question: How do I get the pricing data for EC2 in the Python SDK? (New to python)

"I'm new to python so please bear with me. I'm following the layout of the data in this link:https://aws.amazon.com/blogs/aws/aws-price-list-api-update-new-query-and-metadata-functions/and this is the relevant code:  for price in responsee['PriceList']:                price_dict = json.loads(price)                product = price_dict['product']                attributes = product['attributes']                terms = price_dict['terms']                on_demand_terms = terms['OnDemand']                for dimension in on_demand_terms:                    pricedimension = dimension['priceDimension']                    for y in pricedimension:                        if vcpu == attributes['vcpu']:                            finalprice = y['pricePerUnit']['USD']                            print(finalprice)and the error message I generally get is this:    pricedimension = dimension['priceDimension']                      ~~~~~~~~~^^^^^^^^^^^^^^^^^^ TypeError: string indices must be integers, not 'strI've tried everything I could think of but I can't figure out how to get to "priceperUnit". that's basically what I'm trying to do. I don't know how to get thru the last layers in the data.'terms': {'OnDemand': {'24GRA8RB2KZ9NPCS.JRTCKXETXF': {'effectiveDate': '2017-09-01T00:00:00Z',                                                        'offerTermCode': 'JRTCKXETXF',                                                        'priceDimensions': {'24GRA8RB2KZ9NPCS.JRTCKXETXF.6YS6EN2CT7':just to be clear, what I'm trying to get through with "dimension" is the key after OnDemand that starts with "24GRA". it is apparently a string and is not being registered as a dictionary, it is not fetching the other values when I try to use the dictionary route.also, is this really grabbing all the products for ec2? the list seems a little short. there are hundreds of instances for ec2, but this seems to only be grabbing one price? I apologize as I am new to python. I've been doing this for about a year now.Please advise.FollowComment"

Answer: "0To get the key right after 'OnDemand' beginning with '24GR', you can do:for price in responsee['PriceList']:price_dict = json.loads(price)product = price_dict['product']attributes = product['attributes']terms = price_dict['terms']key = terms['OnDemand']key = str(key)key = key.split(str("'"),1)[1]key = key.split(str("'"),1)[0]CommentShareGerman Rizoanswered a month ago"


Question: Aurora MySQL Upgrade From 2.10.1 to 3.01.0 (MySQL 5.7 to 8) Failing

"I restored a snapshot of an Aurora MySQL 5.7 cluster with an upgrade to MySQL 8 and it did not perform the upgrade.  The cluster was restored as MYSQL 5.7.  The upgrade-prechecks.log contains the following errors for 6 of my stored procedures:The following routines contain keywords like 'QUERY CACHE', 'GROUP BY' with 'ASC' or 'DESC', 'SQL_CACHE', 'SQL_NO_CACHE' which are not supported in major version 8.0. It is recommended to drop these routines or rebuild routines without any of the above keywords before upgrade.",The 6 stored procedures do not use any keywords and run fine on a local instance of MYSQL 8. They all use a 'GROUP BY' but do not use a 'GROUP BY' with 'ASC' or 'DESC'.4 of the stored procedures are grouping by columns that contain Desc e.g. GROUP BY VehicleModelDescription.   The other 2 do not but do contain columns with Desc in the name in other parts of the proc.I suspect the upgrade checked is incorrectly checking for DESC or ASC in the group by.FollowComment"

Answer: "0Hello,From my understanding, upgrade from 2.10.1 to 3.01.0 failed with the below error message that can be found in the upgrade-prechecks.log. However, when you checked the affected six procedures does not contain the exact deprecated keywords.Error Message :The following routines contain keywords like 'QUERY CACHE', 'GROUP BY' with 'ASC' or 'DESC', 'SQL_CACHE', 'SQL_NO_CACHE' which are not supported in major version 8.0. It is recommended to drop these routines or rebuild routines without any of the above keywords before upgrade.As you are aware of, the prechecks failed as a result of the stored procedures containing the one of the above keywords resulting to an error message. So it seems there are four(4) stored procedures that contains GROUP BY with DESC. Based on the https://dev.mysql.com/doc/refman/8.0/en/mysql-nutshell.html#mysql-nutshell-removals , the deprecated ASC or DESC qualifiers for GROUP BY clauses are removed.According to the documentation https://aws.amazon.com/blogs/database/amazon-aurora-mysql-3-with-mysql-8-0-compatibility-is-now-generally-available/  If you need to sort the results of the query that uses GROUP BY with the ASC or DESC qualifier, you need to modify the query to use the ORDER BY clause with the ASC or DESC qualifier instead.I would recommend that you please work closely with your DBA in changing the keywords in the stored procedures which have been deprecated. Also, please check the six stored procedures for the other keywords as it may also contain 'QUERY CACHE', 'SQL_CACHE' and 'SQL_NO_CACHE.Additionally, you can consider dropping and recreating the stored procedures without any of the deprecated keywords and then retry upgrade to 3.01.0.I hope this information can help resolve the issue.If the information above does not help resolve the upgrade issue, please open a support case with AWS using the following https://console.aws.amazon.com/support/home#/case/create and provide details on the stored procedures along with upgrade-prechecks.log in the support case.CommentShareSUPPORT ENGINEERSomto_Manswered a year ago"


Question: Does EKS perform any updates without initiation from administrator?

Premise:Updates of kubernetes version or of the node group AMI drain nodes and and gracefully terminate any pods running on the nodes.We want to make sure that this happens only at times that we choose.Question: Must any updates that are performed be initiated by me (or by some other principal such as terraform)?FollowComment

Answer: "2Accepted AnswerAmazon EKS does NOT initiate the update(Nodes) without your consent. In other words,  you have the right to initiate the update.https://docs.aws.amazon.com/eks/latest/userguide/update-managed-node-group.htmlPS. Amazon EKS will automatically upgrade existing control planes (not nodes) to the oldest supported version through a gradual deployment process after the end of support date. After the automatic control plane update, you must manually update cluster add-ons and Amazon EC2 nodes. Amazon EKS does not allow control planes to stay on a version that has reached end of support.CommentShareEunsu_Shinanswered 6 months agoEXPERTTushar_Jreviewed 6 months ago"


Question: Speed limitations for TCP connections in different Availability Zones.

"I have been testing TCP transfers on EC2 instances in the United Kingdom and Singapore, but the speed of individual TCP connections is only 13-17MB/s. How can I improve the transfer speed? I have tried using VPC, but not work.FollowComment"

Answer: "2TCP performance can be greatly influenced by latency. There's not much you can do about the latency between London and Singapore - the AWS network will route via the quickest path.Depending on how much you can control the protocol you're using, you might have better results with UDP because it is affected less by latency because there are no mandatory acknowledgement packets. If not, you might consider transferring data using multiple parallel TCP streams.CommentShareEXPERTBrettski-AWSanswered 9 days ago"


Question: How to configure SSL certificate for aws loadbalancer correctly

"Actually i have correctly configure the ACM SSL certificate and attach with my listener of the load balancer then how it is not working, Please help me to figure out this problem.FollowComment"

Answer: 0Make sure your Security Group is updated  if you have added the new listener.CommentShareEXPERTkentradanswered 2 months ago


Question: Potential risks of Account name change?

"Trying to change some of the AWS account names because of some SSO related tasks. They are following the following link, but wondering whether there is any potential risks that they need to be aware. Any suggestion?https://aws.amazon.com/premiumsupport/knowledge-center/change-organizations-name/FollowComment"

Answer: "0The only concern is that it currently requires root access to change account names, but there are no depencies on the account names themselves that would be of concern.CommentShareAndrew_Banswered a year ago"


Question: Help me understand

"I have been away from my AWS account for a while because of the charges. This week, i started using it, not for anything but just seeing how much i am being charged for doing nothing really. Sticking to t2 micro at 750 hours per month.Please can someone help me understand why i am being charged:$0.00 per GB-month of General Purpose (SSD) provisioned storage under monthly free tier30 GB-Mo @ USD 0.00, and then$0.10 per GB-month of General Purpose SSD (gp2) provisioned storage - US East (Northern Virginia)7.656 GB-Mo @ USD 0.77Why am i being charged this? Can someone explain? Are we billed for going through the account? How did i use 7.656 GB-Mo in a few days of just viewing AWS account and billing statements.Thank you in advance for looking into this.Have a wonderful day!FollowComment"

Answer: "3Hi ThereNo you are not being charged just for navigating around the AWS console.You might be exceeding the Free-Tier for EBS by 7.656 GB. You get 30GB of EBS volume storage per month for one year under free tier.  Do you have more than 30GB of EBS volumes in your account?  You can view this by going into the console, navigating to the EC2 service, and clicking on Volumes.  See Free Tier Pricing Details You can also track your free tier usage and setup alerts by following the instructions in this articleAlso check your free-tier expiration.  Free tier starts on the date you sign up for AWS.  So its also possible that your free-tier benefits for EBS volumes have just expired, and you are now starting to be billed mid-month for the usage.  See this article for more information about free tier and what happens when it expireshttps://aws.amazon.com/premiumsupport/knowledge-center/free-tier-expiring/In either case, I suggest setting up billing alerts on your account so that you are notified when charges cross a threshold that you define.  See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.htmlCommentShareEXPERTMatt-Banswered 10 months agorePost-User-7875641 10 months agoHello mthwbard,Thanks for responding to my question.I still haven't figured out where the charges are coming from. My account is 4 mo. Though i have created many instances (78GiB) in volume but all of them has been stopped. I always make it a point of duty to stop all instances after using them. Will it be better if i terminate them? Volume state = in use; volume status=okay. I didn't do anything on my account for a week and it has increased by over a dollar.I have seven  sda1 and just one xvda volumes attached to the 8 instances i have which have all been stopped a week ago.I just want to understand which of the activities is incurring costs so i can know how to plan ahead. Thank you.Share0For EBS volumes in particular, you are not charged for the utilization of resources (e.g. how much storage you actually have on that volume versus how much is not used), but you're charged for what you provision: https://aws.amazon.com/ebs/pricing/This means that if you create 8Gb EBS volume and attach it to your instance, then you will be charged for 8Gb of EBS storage per month (in the region where you run your resources). You may be for example actively utilizing only 4Gb of your provisioned EBS storage, but nevertheless, the pricing works based on what you've provisioned for your volume (full volume).The billing is also pro-rated. Which means, that effectively, if you only use one 8Gb volume, then in a 30-days month you would be charged approx. for 273Mb (pro-rated) on a daily basis.CommentShareEXPERTNataliya_Ganswered 10 months agorePost-User-7875641 10 months agoThanks Nataliya for your response.It's beginning to make sense, but i need to understand better.I have 8 instances in total (which have all been stopped like a week ago and earlier for older instances). Total volume is (78GiB). I always make it a point of duty to stop all instances after using them. Will it be better if i terminate them?Currently a quick glance at the volumes under EBS shows volume state = in use; volume status=okay. I didn't do anything on my account for a week or two, but my bill ALWAYS increases. WHen i looked at the attached instances, it shows i have seven  sda1 and just one xvda volumes attached to the 8 instances.$0.10 per GB-month of General Purpose SSD (gp2) provisioned storage - US East (Northern Virginia)21.297 GB-Mo. Cost = USD 2.13.I'd like to understand which of the activities are incurring costs so i know how to plan ahead. Thank you.Share"


Question: 403 Forbidden when try to access the custom domain

"{     "message": "Forbidden" }When trying to access a custom domain, the API Gateway REST response code is 403.The API Mapping has been set up.The following notice appears while attempting a direct API call:{     "Message": "User: anonymous is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-east-1:************:xxxxxxxxxx/dev/POST/v1/notification" }FollowComment"

Answer: "1Accepted AnswerHi403 Forbidden “anonymous is not authorized to perform: execute-api:Invoke on resource:” errors usually occur when the caller isn't authorized to access an API that's using IAM authorization. Or, the API has an attached resource policy that doesn't explicitly allow the caller to invoke the API.To learn more about troubleshooting API Gateway 403 error visit link [1]That said, to further investigation this issue we’d require additional details. I recommend opening a support case with AWS Premium Support using the following link[2]Reference:[1] Troubleshooting 403 errors - https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-troubleshoot-403-forbidden/[2] Create Support Case https://console.aws.amazon.com/support/home#/case/create.CommentShareKgaugelo Sanswered 5 months ago"


Question: Specific sender not coming through to AWS Workmail inbox

"I'm using Workmail for my organization, and have noticed that emails from one specific sender are not coming through to my inbox. Some relevant information:The email is not showing up in Junk/Spam or any other folders.There are no settings in the Workmail Inbound rules that would cause this email to be blocked.There are not settings in the SES Email Receiving rules that would cause the conflict.The sender is getting a successful delivery status that reads:Delivered (inbound-smtp.us-east-1.amazonaws.com:25:250 OKCan someone recommend how to further diagnose this?FollowComment"


Question: A Record (Cloudflare) pointing to EC2 instance not reachable

"I have a subdomain that I want to point my EC2 instance. My instance is running a 3rd party software that requires HTTPS. I use Cloudflare for all my DNS routing and created an A Record to point to my EC2 IP address. I have no problems access it by IP, but fails when using the subdomain address (test.mydomain.com). Receiving an Error 520 message - Web server is returning an unknown error. I made sure that:EC2 security group port 80/443 is open for both 0.0.0.0/0 and ::/0Cloudflare SSL/TLS is set at FlexibleNot sure what I'm missing?FollowComment"

Answer: 0Hi.Are you hosting a web server on EC2?You should check the access log and error log of the web server. Then you should find the reason why Cloudflare responds with 520 error.CommentShareEXPERTiwasaanswered a year ago0Another troubleshooting step: Edit the hosts file on your PC and add test.mydomain.com as an entry with the IP address of your instance. Then you will be able to see what the instance is returning. You can also do this with tools like curl and wget by setting the Host header in the request.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: MWAA Heartbeat failure

Our MWAA Environment regularly seesThe scheduler does not appear to be running. Last heartbeat was received x minutes ago.messages and scheduling times are delayed on dags.I have checked the scheduler logs and there are no errors from installing dependencies or any error messages before or after heartbeats dropping to zero. I also have included--constraint "https://raw.githubusercontent.com/apache/airflow/constraints-2.2.2/constraints-3.7.txt"in the requirements file.There are 2 schedulers running withscheduler.parsing_processes=7but I have experimented with smaller numbers.In the logs I do seeCreating session with aws_access_key_id=None region_name=us-east-1 role_arn is Nonebut we are able to use the KuberneteOperator correctly and our dags are being pulled form s3 so I don't believe  this message is helpful.Aiflow Version 2.2.2Happy to add any additional information.FollowComment

Answer: "0MWAA has a maximum of 4 vCPUs (for a large environment).  As such, you essentially have 4 parallel processes.  Exceeding the Airflow default scheduler.parsing_processes of 2 will leave no resources left to actually schedule any tasks or update the heartbeat, as you're encountering with your error.Creating session with aws_access_key_id is an INFO level log item in the Airflow Amazon provider package and not specific to MWAA nor attached to any error condition.Airflow is highly sensative to DAG parsing, as it runs Python import on every Python file.  Recommend using .airflowignore to avoid parsing files that do not create top-level DAG objects and remove top-level code wherever possible (i.e. most code should be executed in a task, rather than by the parsing action--see example here)CommentShareJohn_Janswered 7 months ago"


Question: IAM User cannot create S3 Batch Operation

"Hi, I have IAM User with full access S3 Role, and I have assign the role of creating batch operations to replace & delete tagging like in this link https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-iam-role-policies.html#batch-ops-iam-role-policies-create . But when the user tries to create a batch operation, they get error message. * An internal error prevented this job from being created. Wait a few minutes and choose Create job again. If the problem persists, contact AWS Support*How to solve this? ThxFollowCommentrowanu 3 months agoCan you share the role policies? Without seeing the code it's hard to give a meaningful answer.If I had to guess, I would check that the role trusts the batchoperations.s3.amazonaws.com service principal.Share"


Question: Error while saving rule with Input Transformer: Invalid InputTemplate

"I have set up CloudWatch rule that would post a message to SNS on CloudBuild project failure.I wanted to use new Input Transformer feature to craft an email message based on JSON event data.Here is a sample event:{  "version": "0",  "id": "1cb6e284-2c0a-4b4d-95f2-7dc042733d11",  "detail-type": "CodeBuild Build State Change",  "source": "aws.codebuild",  "account": "123456789012",  "time": "2017-07-12T00:42:28Z",  "region": "us-east-1",  "resources": [    "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:a68ca311-846f-4ca4-b606-ae36de59542b"  ],  "detail": {    "build-status": "FAILED",    "project-name": "SampleProjectName",    "build-id": "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:a68ca311-846f-4ca4-b606-ae36de59542b",    "current-phase": "COMPLETED",    "current-phase-context": "[]",    "version": "1"  }}Here is my input path{  "project": "$.detail.project-name"}and input templateBuild failed <project>```I'm getting the following error upon saving the rule  -----  There was an error while saving rule **failed-build**.  Details: **Invalid InputTemplate for target Id38459876381764 : \\[Source: Build failed null; line: 1, column: 6\]..**    Could you please share your events and templates and/or pinpoint an error in mine?FollowComment"

Answer: "1Accepted AnswerHi Ma,You were seeing this error message because CWE rule only allows users to use a String (with double quotes)"Build failed <project>"or a JSON in the input template.{  "Build failed": <project>}Edited by: yongataws on Aug 8, 2017 10:25 AMCommentShareAWS-User-1310785answered 6 years ago0Thank you, I've added the double quotes and it works now!CommentSharemaanswered 6 years ago"


Question: AWS ECS Fargate | Images from Private Gitlab Registry

HelloWe have a private Gitlab deployment running on EC2 instances which hosts our container registry in a private subnet. We want to setup ECS Fargate and the tasks execution is returning unable to resolve gitlab.company.com. Is it possible for Fargate to pull images from private registries that are running in local/private networks?ThanksFollowComment

Answer: "0Fargate is also recognized for use in private registries.https://aws.amazon.com/jp/blogs/compute/introducing-private-registry-authentication-support-for-aws-fargate/I thought "extra_hosts" in the following document might be relevant, since it seems that name resolution is not working.https://github.com/ayufan/gitlab-ci-multi-runner/blob/master/docs/configuration/advanced-configuration.mdCommentShareEXPERTRiku_Kobayashianswered a month agoAbdul Wajid a month agoThanks for the response. The article explains how we can setup private registries but does not provide any details if the registry can be in private network.extra_hosts variable seems to be container variable. My understanding is that the fargate host first pulls the image from the registry and then spins up the container, this variable comes into effect when the container is started. (I could be wrong). There might be a way to have the manipulate fargate hosts so it can talk to private registry on a private network. Maybe using private link but I am not sure if thats the right path. Thoughts?Share0Hello Abdul,Thank you for using AWS services.Have you tried using VPC Endpoint ? I've recently experimented similar use-case to pull an image from Private ECR to my ECS Cluster, i was able to do so using the VPC Endpoint (My ECS Cluster was provisioned with Fargate as capacity Provider). While creating the VPCEndpoint, please make sure to enable Private DNS Name.Reference:https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.htmlCommentShareDinesh Polaanswered a month ago"


Question: Best IAM policy for User

Which AWS IAM policy is most secure and best for user for all services and resources  accessFollowComment

Answer: "0When it comes to AWS IAM (Identity and Access Management) policies, the principle of least privilege is recommended for security. It means granting users the minimum permissions necessary to perform their required tasks and access the necessary AWS services and resources.To provide a secure and comprehensive access policy for a user with access to all AWS services and resources, you can use the managed policy called "AdministratorAccess". This policy grants full administrative access to all AWS services and resources within the AWS account.The "AdministratorAccess" policy provides the user with broad privileges, allowing them to manage all resources, create and delete services, modify configurations, and access sensitive information. It is important to exercise caution when assigning this policy and ensure that it is only assigned to trusted users who require extensive administrative capabilities.Keep in mind that with great power comes great responsibility. Granting the "AdministratorAccess" policy to a user means they have unrestricted access to your AWS resources, and any mistakes or misconfigurations could have significant consequences. It is crucial to regularly review and audit user permissions, monitor account activity, and follow security best practices to maintain a secure environment.In addition to the "AdministratorAccess" policy, you may also consider using more restrictive policies tailored to specific roles or responsibilities within your organization. By applying the principle of least privilege and granting only the necessary permissions, you can further enhance security and minimize the potential impact of unauthorized actions.Remember to regularly review and update IAM policies based on changes in roles, responsibilities, and the evolving security requirements of your organization.CommentSharehimanshustallongmailcomanswered 13 days agoEXPERTRiku_Kobayashireviewed 13 days ago"


Question: How to grant permission to create a log file in sagemaker?

"I created a serverless endpoint in sagemaker based on the documentation provided. I have my model  (artifactory) zipped up and uploaded to s3, created a model and then created an endpoint configuration , then finally created the endpointresponse = client.create_endpoint(    EndpointName="serverless-endpoint",    EndpointConfigName="serverless-endpoint-config")on the endpoint invocation,  cloudwatch logs show error below -log4j:ERROR setFile(null, true) called failed.java.io.FileNotFoundException: logs/ts_metrics.log (No such file or directory)at java.base/java.io.FileOutputStream.open0 (Native Method)at java.base/java.io.File......this looks like permission error , but i'm not sure how to give access/permission to create file in sagemaker.FollowComment"

Answer: "0Hello, does the execution role associated with the model have the proper CloudWatch permissions ?CommentShareAWS-User-8651363answered a year ago"


Question: How to ensure DMS writing CDC data in order to S3 target?

"Hi all, our team is currently using DMS to capture CDC data from our source RDS DB to S3 target. Occasionally, we see that DMS is writing multiple updates for the same record with a given ID to an S3 file with the same CDC timestamp (set by enabling the timestamp_column_name setting). Some questions around this:Can I rely on the order of the record stored in the file to represent the transaction order?I read up on the doc that DMS has preserve_transaction S3 target setting, keen to know this a bit further as I am currently using date_partition_enabled setting which cannot be used in tandem with preserve_transactionCheersFollowComment"


Question: What is the simplest way to extract all 26 tables from a single DynamoDB db into AWS Glue Catalog?

"My source db is DynamoDB. It has 26 tables.I am trying to build AWS QuickSight reports using AWS Athena that builds the specific views for said reports. however, I seem to only be able to select a single table in creating the Glue job despite being able to select all tables i need for the crawler of the entire DB from Dynamo. What is the simplest route to get a complete extract of all tables that is queryable in Athena.I dont want to connect the reports direct to dynamoDB as it s a production database and want to create some separation to avoid any performance degradation by a poor query etc.How to extract these tables?FollowComment"

Answer: "0Thnx, by the way: I do ETL DynamoDB->S3 , 5 tables transformed ok,but on the 6th I received:An error occurred while calling o397.pyWriteDynamicFrame. Unsupported case of DataType: com.amazonaws.services.glue.schema.types.StringType@4a2a46aa and DynamicNode: longnode.What can be the reason? where to check?That is the log2022-03-21 15:13:32,301 ERROR [Executor task launch worker for task 5.0 in stage 13.0 (TID 132)] util.Utils (Logging.scala:logError(94)): Aborting taskjava.lang.RuntimeException: Unsupported case of DataType: com.amazonaws.services.glue.schema.types.StringType@4a4c524e and DynamicNode: longnode.at scala.sys.package$.error(package.scala:30)at com.amazonaws.services.glue.writers.parquet.ParquetWriteSupport.writeField(ParquetWriteSupport.scala:144)at com.amazonaws.services.glue.writers.parquet.ParquetWriteSupport.$anonfun$writeFields$2(ParquetWriteSupport.scala:82)at com.amazonaws.services.glue.writers.parquet.ParquetWriteSupport.consumeField(ParquetWriteSupport.scala:322)at com.amazonaws.services.glue.writers.parquet.ParquetWriteSupport.$anonfun$writeFields$1(ParquetWriteSupport.scala:82)at com.amazonaws.services.glue.writers.parquet.ParquetWriteSupport.$anonfun$writeFields$1$adapted(ParquetWriteSupport.scala:78)at scala.collection.Iterator.foreach(Iterator.scala:941)at scala.collection.Iterator.foreach$(Iterator.scala:941)at scala.collection.AbstractIterator.foreach(Iterator.scala:1429)at scala.collection.IterableLike.foreach(IterableLike.scala:74)at scala.collection.IterableLike.foreach$(IterableLike.scala:73)at scala.collection.AbstractIterable.foreach(Iterable.scala:56)at com.amazonaws.services.glue.writers.parquet.ParquetWriteSupport.writeFields(ParquetWriteSupport.scala:78)at com.amazonaws.services.glue.writers.parquet.ParquetWriteSupport.$anonfun$write$1(ParquetWriteSupport.scala:70)at com.amazonaws.services.glue.writers.parquet.ParquetWriteSupport.consumeMessage(ParquetWriteSupport.scala:310)at com.amazonaws.services.glue.writers.parquet.ParquetWriteSupport.write(ParquetWriteSupport.scala:70)at com.amazonaws.services.glue.writers.parquet.ParquetWriteSupport.write(ParquetWriteSupport.scala:32)at org.apache.parquet.nimble.hadoop.InternalParquetRecordWriter.write(InternalParquetRecordWriter.java:161)at org.apache.parquet.nimble.hadoop.ParquetRecordWriter.write(ParquetRecordWriter.java:87)at com.amazonaws.services.glue.writers.parquet.ParquetWriter.write(ParquetWriter.scala:157)at com.amazonaws.services.glue.writers.DynamicRecordWriter.safeWrite(DynamicRecordWriter.scala:52)at com.amazonaws.services.glue.writers.parquet.ParquetWriterFactory$$anon$2.write(ParquetWriter.scala:239)at com.amazonaws.services.glue.writers.parquet.ParquetWriterFactory$$anon$2.write(ParquetWriter.scala:238)at com.amazonaws.services.glue.sinks.GlueParquetHadoopWriter.$anonfun$writeParquetNotPartitioned$1(GlueParquetHadoopWriter.scala:53)at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)at org.apache.spark.util.Utils$.tryWithSafeFinallyAndFailureCallbacks(Utils.scala:1473)at org.apache.spark.sql.glue.SparkUtility$.tryWithSafeFinallyAndFailureCallbacks(SparkUtility.scala:39)at com.amazonaws.services.glue.sinks.GlueParquetHadoopWriter.writeParquetNotPartitioned(GlueParquetHadoopWriter.scala:64)at com.amazonaws.services.glue.sinks.GlueParquetHadoopWriter.$anonfun$doParquetWrite$1(GlueParquetHadoopWriter.scala:179)at com.amazonaws.services.glue.sinks.GlueParquetHadoopWriter.$anonfun$doParquetWrite$1$adapted(GlueParquetHadoopWriter.scala:178)at org.apache.spark.scheduler.ResultTask.runTask(ResultTask.scala:90)at org.apache.spark.scheduler.Task.run(Task.scala:131)at org.apache.spark.executor.Executor$TaskRunner.$anonfun$run$3(Executor.scala:497)at org.apache.spark.util.Utils$.tryWithSafeFinally(Utils.scala:1439)at org.apache.spark.executor.Executor$TaskRunner.run(Executor.scala:500)at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)at java.lang.Thread.run(Thread.java:748)CommentShareOleganswered a year agoFabrizio@AWS EXPERTa year agofrom the error it seems that one of the column in the sixth table has a data type that is not supported in Parquet ?could you share the schema in Dynamo DB?Share0To clarify the question:you have already crawled your DynamoDByou have already 26 tables in the Glue Catalog pointing directly to DynamoDByou do not want to access DynamoDB through Athenayou want to export the data to S3 (optimally in Parquet format) using AWS Glue ETLyou want to export the data from all table in a single job.If you are using Glue Studio , you can actually use multiple source nodes in a single jobs and then transform each table and write it out, all the steps will be done sequentially though.If you are writing your own job in pyspark you could use the Glue API to list the table names in the Glue Catalog and then loop on the list of names and reuse the same code.Still if you are not going to join the tables in the job it would be better to parametrize the job passing the table name, and then run a workflow or a step-function that call the job with a different runtime parameter (table name) you could run all the exports in parallel.Finally you could also have the parameter hard coded and have one job by table (no need to code the same job over and over ) using CloudFormation template to deploy the other 25 version of the jobs one the script is finalized.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Transit VPC DR Cross-Region Replication Best Practices

"We have an older transit VPC that we built manually (i.e. not using an AWS templated build). I am looking to replicate the resources running in that transit VPC (Edge, CSR Router, VPN host) to a different region for redundancy/DR.I know peering connections can be created to possibly work for this, but the subnets cannot overlap...creating a need to then reconfigure our SD-WAN setup if we need to cut over. I was also wondering if I can simply create a DR transit VPC in the DR region and apply the same subnet CIDR as is configured in our current Transit VPC , and then simply image the instances needed into the DR Transit VPC and spin up with the same IP addressing they currently have if/when needed.Just looking for general guidance/best practices, as the AWS documentation on the matter seems to suggest a few possible paths forward, but none of which seem to capture our specific needs.FollowComment"

Answer: "0Hello,Since the transit VPC components you mention (Edge, CSR Router, VPN host) are not native AWS constructs there is no easy way to replicate these across the regions especially with same IPs as you indicated.I would recommend going through the below link and specifically the table that shows Transit VPC Vs Transit Gateway solution comparison. You could consider using TransitGateway to terminate the VPN at each site, do the inter-region TGW Peering for the connectivity between the regions. You could still have Inspection VPCs at both regions that can host your fleet of Firewall appliances behind a GWLB, this VPC can do East-West or North-South traffic inspection.https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/transit-vpc-solution.htmlAs for connectivity between the regions below are some of your options:VPC Inter-region Peering (Non-transitive connection)TGW <> TGW Inter-region peering (Supports only Static routing currently)IPSEC VPN between the CSRs (You can run BGP over IPSEC)There are many factors involved here (Cost, Security, ease of implementation, operations etc) so you would need to carefully evaluate each of the options and decide which one suits for your particular use-case.CommentShareEXPERTTushar_Janswered 10 months ago"


Question: Blue/Green deployment created for MariaDB stuck in Provisioning

"We have a MariaDB RDS in version 10.5.x and instance type of r5.xlarge. I created a Blue/Green Deployment to upgrade both DB version and instance type to r6g.xlarge. It creates the master instance in Green Deployment and upgraded to the latest MariaDB version yet the Blue/Green Deployment stuck in Provisioning.Earily we have created a Blue/Green Deployment for another RDS and everything goes smooth with a very similar background. I have no idea on what should we do regarding it.FollowCommentrePost-User-8916968 3 months agoWe have same issue with Aurora Mysql 5.7 and instance type r6g.large , deployment stuck in Provisioning ( Status - Creating read replica of source in Progress) .ShareTom Lo 3 months agoWe deleted the replica in the blue deployment and recreate the blue/green deployment and create the replica afterwards once deployed, everything works.Share"

Answer: 0It is not exactly clear what your issue is. But you can use the AWS console to describe both the green instances and the blue green deployment to see what step is currently in provisioning.CommentShareMODERATORphilawsanswered 3 months ago0This can happen when your source cluster has too old of a version. If you cannot select your current version when creating a new cluster then this might be the issue. Either upgrade your source database cluster to a newer version or file for an exclusion request with support.CommentShareHunter Fanswered 3 months ago


Question: VPC Interface Endpoint Limitation on one subnet per Availability Zone for "Enable Private DNS Name"

"Per this, only one subnet per AZ can be used with "Enable Private DNS Name" option.This is a show stopper for customer implementation as there are multiple subnets in a AZ customer want to use the endpoint. Specially, when customers have a solid use case for using SSM but don’t want to use internet for this.Wondering, what is the suggested workaround and tentative plan to remove this limitation ??As a workaround, may be creating a internal R53 entry , associating with the VPC and creating the service specific Cnames to resolve to the vpc endpoints ??? Would that work ??FollowComment"

Answer: "0Accepted AnswerPrivate DNS Name options applies to the entire VPC,  any Instance in the VPC can resolve private DNS Name of interface endpoint via Amazon Provided DNS.CommentShareAWS-User-1891174answered 5 years ago"


Question: S3 gateway SMB share slow save in windows to folder with 500+ objects

"Hello,We are experiencing a very slow file saving when the file is being saved in a folder with more then 500 objects . applications can hang for over a minute. Saving to folders with few objects is not an issue. Using S3 gateway with for VMware  with SMB share.FollowComment"

Answer: "0Hello,I'm Mike with the Storage Gateway team.A performance problem like you describe can have many different causes, so if you do have premium support, I strongly recommend opening a case so that we can examine your issue in detail.  If not, here are common things to check that can significantly impact performance:Undersized gateway VM.  Make sure that you have at least 4 processors and 16 GB of RAM allocated to your file gateway VM.  We strongly recommend that you set the memory reservation to 16GB of RAM as well.Undersized cache disk.  If you are using a minimum sized cache disk (150GB), you may be churning your locally cached data.  A larger cache may be needed.  You can look at your gateway metrics to see if you have high dirty cache or a low cache hit rate that may indicate a larger cache is needed:** https://aws.amazon.com/blogs/storage/aws-storage-gateway-provides-simplified-monitoring-for-file-gateway **** https://docs.aws.amazon.com/filegateway/latest/filefsxw/monitoring-file-gateway.html#understanding-file-gateway-metrics **Your underlying VMware datastore may be underperforming or oversubscribed for IOPS.  High performance listing of files and quick reads/writes are directly affected by the VMware storage under the datastores that hold your file gateway disks.  If the underlying storage is slow, your gateway will be slow.  Make sure the root disk and the cache disk are on high performing shared storage.  The root disk especially is important when listing files and is a small 80-100GB disk.  If you have shared SSD that you can easily move the root disk to, I would recommend it.  The cache disk needs to be on shared storage that is fast, but can work quite well on most SAN connected storage arrays.Please let me know if you have any other questions.Mike H., AWS SGW, SECommentShareMike-HAWSanswered a year agoAWS-User-5691104 a year agoHi, thank you for a quick reply.confirmed 4 processors and 16gb ramdisks are never full, usually at 0% dirty cache and 100% cachethis is on same VM host, both servers and S3 gatewaythis is the video of the issue. i am saving a simple text file. Video shows gateway monitor screen as well. This gets much worse for larger fileshttps://filipptest.s3.us-east-1.amazonaws.com/Videos/S3-gateway-save.mp4Share0Hello, has anyone else experienced the above issue? this was not an issue with cached files gateway that was used previously.CommentShareAWS-User-5691104answered a year ago"


Question: SPF selector for DNS record

"one of our vendors sent me this:In the meantime, is it possible to get the SPF selector for the DNS records we need to create for DKIM? I can submit the request and at least start the process on that piece if you can let me know what SPF selector to use.where can i find this spf selector, in the AWS console..we need to connect an app to Saml SSO with Okta, our dNS records are from AWSFollowComment"

Answer: "1AWS uses TXT as a record type for DNS under the Route 53 service. You need to copy the value of the generated SPF record inside a TXT entry following the instructions on this link: https://aws.amazon.com/premiumsupport/knowledge-center/route53-spf-record/For DKIM, it works the same, you need to set up the DKIM contents inside a TXT record. If you have problems with the record length you can split it as discussed in this postCommentSharenissyangelanswered a year agoEXPERTToni_Sreviewed a year agoToni_S EXPERTa year agoAs Nissyangel points it out SPF and DKIM information are actually DNS TXT records.Share"


Question: Toggle AI/Physics mode gone?

Is this functionality with 1.12 now removed or am I doing something wrong? Can't find this button in editorFollow

Answer: "0Accepted AnswerHello @REDACTEDUSERThis feature seems to have been stolen away by gremlins unfortunately, however Santa Clause was very generous this holiday season and as such has provided us with a patch to re-enable that functionality. 6238-aiphysicspatch.txt|attachment (12.9 KB)aiphysicspatch.txtHappy holidays!SharerePost-User-5162062answered 5 years ago0Hahaha xD As always these annoying gremlins... ;-) Thanks very much for that great support!Happy holidays!SharerePost-User-7036053answered 5 years ago0Where are we supposed to paste that code? Thanks in advance.SharerePost-User-8843326answered 5 years ago0I'd like to have this feature in 1.12.0.1, but it seems that this patch is for a different version (1.12.0.0?). Can we get a patch for 1.12.0.1 as well?SharerePost-User-0273337answered 5 years ago"


Question: API for Send Invite by Email address

"Hi,I'm looking for a way to send Email Invite programmatically.SendInvitation API documentation [1] utilizes UserArn, while I'm looking for a way to send the invite via email address. I wonder if there is any API for this?Thanks.[1] https://docs.aws.amazon.com/a4b/latest/APIReference/API_SendInvitation.htmlFollowComment"

Answer: "0Accepted AnswerYes, we have the createUser API available for that.https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateUser.htmlCommentShareMilo Oostergoanswered 4 years ago0Thanks, milo@aws.  So, the procedure is:Create a User with  CreateUser API  >> and obtain  UserArnUse SendInvitation API and UserArn to send invite by emailAm I correct?CommentShareuseranswered 4 years ago0Yes, that is correct. Use CreateUser -> UserArn -> SendInvitation. But also use PutInvitationConfiguration API to initialize your invitation email template.CommentShareAWS-Mike_Canswered 4 years ago0Thanks, @aws-mikec!CommentShareuseranswered 4 years ago"


Question: Initializing 2 NICs Automatically in Ubuntu AMI (Cloud-init issue)

"I'm trying to standup a Ubuntu 20.04 based AMI with 2 NICs connected to 2 different subnets and have those NICs configured automatically.  I've read the guidance about creating file in /etc/netplan to define the NIC interface but have been reading through cloud-init python scripts, since EC2 is using it to init the NICs, to figure out why this isn't done automatically and I think I found the root cause ... it seems cloud-init starts out properly configuring both NICs but then deletes the config for the primary NIC meaning that in order to SSH I would need to go over the secondary NIC.  I managed to get cloud-init to initialize both NICs correctly by editing the following file and commenting out the following lines of code/usr/lib/python3/dist-packages/cloudinit/net/__init__.pydef _bringup_device(self):  ....        #self.cleanup_cmds.append(                                                                                #    ['ip', '-family', 'inet', 'link', 'set', 'dev', self.interface,                                                #     'down'])                                                                                #self.cleanup_cmds.append(                                                                                #    ['ip', '-family', 'inet', 'addr', 'del', cidr, 'dev',                                                          #     self.interface])def _bringup_router(self):        ...        #self.cleanup_cmds.insert(                                                                                #    0,                                                                                #    ['ip', '-4', 'route', 'del', self.router, 'dev', self.interface,                                                   #     'src', self.ip])        ....        #self.cleanup_cmds.insert(                                                                                #    0, ['ip', '-4', 'route', 'del', 'default', 'dev', self.interface])  To confirm that the solution works I delete all the cloud-init collateral and reboot to force it to restart.  I also created a new custom AMI from the EC2 instance after deleting the files and confirmed that a new EC2 comes up with both NICs properly configured toorm -rf /var/lib/cloud/*Having to modify + maintain a custom copy of cloud-init is probably not a sustainable long term solution ... would this be a cloud-init issue or an EC2 cloud-init config issue?  What's the best course of action to have this as an available long term solution?  I think having cloud-init handle the NIC initialization vs. having to hand craft a file in /etc/netplan/ is probably a more sustainable long term solution.ThanksFollowComment"

Answer: "0You may want to either open an issue or even a PR on Canonical's cloud-init repo. But, for now you could do the "work" in the User Data section rather than cloud-init, either allocating attaching and starting the adapter or just modifying the config.CommentShareEXPERTRaphaelanswered a year ago"


Question: Quantifying cost saving when migrating a monolithic app to microservices

My client has asked me to estimate how much he would save if he moved his Ruby on Rails monolithic application to an environment where they only use microservices (EKS and Lambda). The calculation does not need to be exact although I want it to be realistic.I don’t know whether to start using the pricing calculator or maybe just use some example of other clients and give a benchmark. What are your thoughts on the best approach?ThanksFollowComment

Answer: "0Accepted AnswerI don't think migrating a monolith to microservices generally results in direct cost savings, although it's certainly possible in some situations.If the monolith is currently scaled for peak load, then there's obviously some potential costs savings moving it to elastic infrastructure, where the cost saving is going to be related to the difference between peak and base load. Additional direct savings from moving to microservices could come in if there's any event-based or v.peaky capabilities that can be hived off into microservices, and therefore removing the need to scale the whole monolith infrastructure elastically.To try and calculate the potential savings in such cases you'd need to work out the difference between base and peak load for the monolith's various capabilities, and then create some indicative figures if there were actual savings in elastically-scaling individual capabilities.However, it's also more expensive to operate microservices, since there's more moving parts, so my suggestion would be to do those calculations, but be prepared for the move to microservices potentially costing more.CommentShareAWS-User-6381783answered 3 years ago"


Question: Elemental MediaConvert burn in caption using TTML caption input not working

"I tried to use Elemental MediaConvert to generate a video with burned-in caption using TTML file as the source of the caption. But when I set Pass style information to ENABLED under the Output -> Captions tab in the console, the caption did not appear in the output video.  I could not figure out why this happened. The format for the TTML file follows the guideline in https://docs.aws.amazon.com/mediaconvert/latest/ug/ttml-style-formatting.html.Below is the JSON request body used for the job:{"Settings": {"TimecodeConfig": {"Source": "ZEROBASED"},"OutputGroups": [{"CustomName": "MP4","Name": "File Group","Outputs": [{"ContainerSettings": {"Container": "MP4","Mp4Settings": {}},"VideoDescription": {"CodecSettings": {"Codec": "H_264","H264Settings": {"MaxBitrate": 1000000,"RateControlMode": "QVBR","SceneChangeDetect": "TRANSITION_DETECTION"}}},"AudioDescriptions": [{"CodecSettings": {"Codec": "AAC","AacSettings": {"Bitrate": 96000,"CodingMode": "CODING_MODE_2_0","SampleRate": 48000}}}],"NameModifier": "_hardsub_en","CaptionDescriptions": [{"CaptionSelectorName": "Captions Selector 1","DestinationSettings": {"DestinationType": "BURN_IN","BurninDestinationSettings": {"ShadowXOffset": 0,"TeletextSpacing": "AUTO","Alignment": "CENTERED","ShadowColor": "NONE","FontOpacity": 255,"FontSize": 20,"FallbackFont": "PROPORTIONAL_SANSSERIF","FontColor": "WHITE","FontResolution": 96,"ShadowYOffset": 0,"StylePassthrough": "ENABLED"}},"LanguageCode": "ENG"}]}],"OutputGroupSettings": {"Type": "FILE_GROUP_SETTINGS","FileGroupSettings": {"Destination": "s3://destBucket/"}}}],"Inputs": [{"AudioSelectors": {"Audio Selector 1": {"DefaultSelection": "DEFAULT"}},"VideoSelector": {},"TimecodeSource": "ZEROBASED","CaptionSelectors": {"Captions Selector 1": {"SourceSettings": {"SourceType": "TTML","FileSourceSettings": {"SourceFile": "s3://sourceBucket/test video_en.ttml"}}}},"FileInput": "s3://sourceBucket/test video.mp4"}]},"AccelerationSettings": {"Mode": "DISABLED"},"StatusUpdateInterval": "SECONDS_60","Priority": 0}This is a sample of the TTML file:<?xml version="1.0" encoding="utf-8"?><tt xmlns="http://www.w3.org/ns/ttml" xmlns:ttp="http://www.w3.org/ns/ttml#parameter" ttp:timeBase="media" xmlns:tts="http://www.w3.org/ns/ttml#style" xml:lang="en" xmlns:ttm="http://www.w3.org/ns/ttml#metadata">  <head>    <metadata>      <ttm:title></ttm:title>    </metadata>    <styling>      <style xml:id="s0" tts:backgroundColor="black" tts:fontStyle="normal" tts:fontSize="20" tts:fontFamily="proportionalSansSerif" tts:color="white" />I have tried to do some research and tried different inputs but I cannot figure out what was wrong, so I would like to ask for help in figuring out what was wrong with this and how should I make it work. Thank you in advance for the help.FollowComment"


Question: AWS architecture diagram

"Is it possible to create a diagram of my architecture in one click? I.e. a diagram which will describe the instances and their relationship?How can I get the full description of an instance? I.e. processor, cores... etc.FollowComment"

Answer: "3If you have a CloudFormation template, then you can load that up in the CloudFormation Console and click on 'View in Designer' on the home page, which will provide you the architecture, and the relationship between each resources as per your CF template. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/working-with-templates-cfn-designer.htmlFor viewing the processor details, you can either do via the console or CLI. If via the console, then go to the EC2 console, by searching for EC2 in the AWS management console, and then click on instances, which should list all your instances in the region. Click on preferences and make sure you have selected the 'Instance Type'. This should give you the details of the instance type which you can use to derive the vCPU's, cores etc. If you are doing it via CLI, then use $ aws ec2 describe-instances and this must list all your instances along with instance types. Use the instance type against https://aws.amazon.com/ec2/instance-types/ to validate the detailsCommentShareArunanswered 4 months ago0No, it's not possible to create a diagram of your architecture in one click. However, there are various tools and services that can help you create architecture diagrams, such as AWS CloudFormation Designer, Lucidchart, and Draw.io.To get the full description of an instance, you can use the AWS CLI or AWS Management Console. In the AWS Management Console, go to the EC2 Dashboard, select the instance you want to view, and click on the "Description" tab to see details such as instance type, vCPU, memory, and storage.CommentShareEXPERTsdtslmnanswered 2 months ago"


Question: Cognito User Pool Groups and retrieving IAM from Lambda

"A customer is building a serverless solution. Clients would make an api call, trigger custom authorizer/lambda using request parameter, and authenticate the user in the user pool. However, to generate a policy doc, they don't want to grant a blanket 'Allow' to the request. They want to apply IAM policies to user groups in cognito, and pass that to lambda authorizer. Has anyone encountered this? How to retrieve the Iam role/policy attached to the group in cognito user pools?FollowComment"

Answer: "0Accepted AnswerIt seems like they're trying to fight the conventional pattern. Serverless or not, why would they not authenticate & authorize the user directly via Cognito first, and then use the Cognito JWT as authN/Z to the api call? Everything they are after (group based policies, access control on the api) is essentially trivial if they do the identity bits first.CommentShareEXPERTQuint Van Demananswered 5 years ago"


Question: When will you release the new Greengrass Snap providing SDK v1.9.x

"HiThe Greengrass Snap currently provides Greengrass 1.8However 1.8 only works with nodejs 6.10 lambdas. This version of nodejs is about to be deprecated on AWS infrastructure by the end of the month.It becomes urgent to release the new snap version shipping greengrass 1.9 otherwise it will be impossible to deploy new lambdas to existing greengrass gateways.Can you communicate on the estimated time of release of the new snap ?Best regards,--Jean-PhilippeEdited by: Jips71 on May 19, 2019 10:25 AMFollowComment"

Answer: "0Accepted AnswerHi Jips71,We are aware of the issue. Unfortunately we can't provide an estimate for when the Snap package will be updated. I'll update this post with more info as it becomes available.Thanks,KR-AWSCommentShareKR-AWSanswered 4 years ago0FYI I posted this issue on snapcraft.io for cross referencing :  https://forum.snapcraft.io/t/nodejs-runtime-issues-with-the-greengrass-support-interface-and-the-aws-iot-greengrass-snap/11424/4I’m willing to help but couldn’t identify another place like a Github repo where I would, for example, post a pull-request to update the snap.Please answer and point me to the right place/direction to contribute if not here :-)CommentShareJips71answered 4 years ago0thanks KRI hope this will be done soon.RegardsCommentShareJips71answered 4 years ago0Do you have any news on that topic ?When will the new version of the greengrass snap will be updated ? Right now we are stuck with the non working stack ubuntu core _ aws greengrass _NodeJS ; which is very promising otherwise. My team feels like moving away to another approach and we are craving for any news about a fix to this.CommentShareJips71answered 4 years ago0Hi Jean-Philippe,Unfortunately I can not communicate an exact date at this time, but can assure you that we're actively working on it.In the meantime, your team may be able to use the Greengrass docker container with the Docker snap to avoid the need for manual install. Would that be a viable option?Thanks,-joeCommentShareJoeAtAWSanswered 4 years ago0OK. Thank you very much. A few weeks had passed since the last answer that's why I upped the thread.Since we have no ETA, and the absence of nodejs lambdas in greengrass is a significant issue to us (because the snap means stability, sandboxing of technical issues "in the wild", and cost effectiveness in production), we inferred that it would be fixed quickly and were waiting "actively" while focusing on other sides of our project. We will now investigate the docker approach that you kindly suggested.However, since there is no other place to track this topic,  I'll ask again in a few weeks if you have some news about the new snap version.Regards,--Jean-PhilippeCommentShareJips71answered 4 years ago0HelloAs mentioned in my previous post, I send a ping after a few weeks to see if you have news on this topic.2 months have passed on this thread without any significant information or evolution of the situation. It is unusual to remain without any sign of AWS on this kind of problem. Could you give us some information on the latest development of the AWS Greengrass Snap and its compatibility with NodeJS, or at least give us something to chew while we wait: for example the underlying reason, technical or otherwise, why it is taking so long to patch a closed source piece of software with patches already open sourced elsewhere - namely NodeJS 8 or 10 and the latest version of AWS Greengrass 1.9.x.Like me, other users like dahlborg are concerned by this problem. See https://forums.aws.amazon.com/thread.jspa?messageID=907419&tstart=0#907419.Best regards,Jean PhilippeCommentShareJips71answered 4 years ago0Hi Jips71,There's an announcement about Greengrass and Snap support.https://forums.aws.amazon.com/ann.jspa?annID=6967I'll continue to post updates as they become available.Thanks,KR-AWSCommentShareKR-AWSanswered 4 years ago0Thanks KR !--Jean-PhilippeCommentShareJips71answered 4 years ago"


Question: How to remove Redshift serverless VPC network or remove Redshift server ?

"When you create a redshift serverless configuration, an VPC network is created, with endpoints, ....I see that I have charge for the VPC network so I want to stop all the charge on my account. Redshift serverless was only a test.When I try to delete the resource I always received this error : Operation is not allowed for requester-managed VPC endpoints for the service. Like this one : https://stackoverflow.com/questions/66158833/unable-to-delete-aws-vpc-endpoint?rq=1.The creator of these resource is not me (shown as a number) as it's Amazon that create the resource.I can't :update to Vpc network on Redshift Serverlessdelete Redshift serverlessno aws cli options exists for redshift serverno terraform resource exists for redshift serverWill I am stuck and I need to pay this VPC for all the time ?FollowComment"

Answer: "1Hello,currently you can not delete it by yourselves but you can open a support ticket providing the AWS account id and region in which your serverless is , support can delete it for you.If you do not have support you can just send an email to the email address you can find in the Amazon Redshift Serverless documentation page.Ask to delete the endpoint and share the AWS AccountID and region in which the endpoint was created.We plan to provide the delete capability during GA.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year agofuuzetsu a year agoHi Fabrizio,One can only open a support ticket if they are on a support plan which means that one is either forced to pay for the support plan or keep paying for the VPC until GA happens one day: either way the user is forced to pay money which seems a bit strange considering AWS offers $500 free credit to evaluate Redshift Serverless to start with.Please advise on how to get rid of Redshift Serverless without having to upgrade support plan.ShareFabrizio@AWS EXPERTa year ago@fuuzetsu. Please find my updated answer with details on how to ask AWS to delete your Redshift Serverless without support.ShareAJP a year agoas on date (17 March 2022) the email Id isredshift-preview-serverless@amazon.comhttps://docs.aws.amazon.com/redshift/latest/mgmt/serverless-whatis.htmlShare0I have sent email to mentioned email address and waiting for serverless redshift to be deleted. I have hard time to understand how preview started without a delete button.CommentShareAWS-User-2569548answered a year ago"


Question: Importing Ubuntu 20.04 cloud images

"Following the instructions at https://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-image-import.html.Doing aaws ec2 import-image --disk-containers Format=OVA,UserBucket="{S3Bucket=<RedactedBucket>,S3Key=ubuntu-18.04-server-cloudimg-amd64.ova}"Using the image at https://cloud-images.ubuntu.com/releases/bionic/release/ubuntu-18.04-server-cloudimg-amd64.ova, works as expected and the AMI is created fine.But the same using https://cloud-images.ubuntu.com/releases/focal/release/ubuntu-20.04-server-cloudimg-amd64.ova, i.e the 20.04 image returnsClientError: We were unable to read your import's initramfs/initrd to determine what drivers your import requires to run in EC2.I know there are AMIs available with the Ubuntu 20.04, I am trying to understand what causes this error and how to overcome it in a custom OVA I am building.TIAFollowCommentrePost-User-6811098 10 months agoHad this exact same error trying to import an ubuntu 20.04 image, created on Virtualbox, starting from the ubuntu focal-server-cloudimg-amd64.ova , using default kernel 5.4.0-121-generic.Please help!Share"

Answer: "1I looked into this and I think I've figured out what's happening. Canonical made a change to their cloud images in which "server" versions no longer include microcode related packages:https://bugs.launchpad.net/ubuntu/+source/debian-installer/+bug/1938588The microcode packages, (amd64-microcode and intel-microcode) change the format of the initrd when they're installed. The file can either be a single CPIO archive or a 2-part CPIO archive with 1 part being compressed:https://unix.stackexchange.com/questions/505746/content-of-initramfsOne of these formats can cause the import service to return a client error. There are 2 general approaches for working around the issue:If you'd like to use the base image for Ubuntu 20, simply use a EC2 ready AMI from Canonical. They publish their AMI account number to make it easy to find these official images:https://ubuntu.com/server/docs/cloud-images/amazon-ec2If you have an existing image that has content and modifications you'd like to import, I would try to rebuild the initrd files by installing the microcode packages. Make sure to have a backup first, but then you can attempt to install the microcode packages:sudo apt-get install -y dracut-core amd64-microcode intel-microcodeAfter the microcode packages are added the initrd should rebuild automatically in the correct format and resolve the issue, allowing the import to complete normally.CommentShareJames Wanswered 3 months ago"


Question: Storage Gateway eventbridge events not firing on large multi-part uploads

"Hopefully not an indication of a bug....I've got my storage gateway sending eventbridge events that then triggers a step function. I also, for debugging, have the same filtered event going to SNS to email me, and a seperate eventbridge rule which does not filter the events, it just emails me. everything the file gateway sends.This setup is working well for using the upload complete event to trigger my step function and I have verified it is working on a mix of uploaded dataHOWEVER, I used the storage gateway to upload 3 very large files (200GB+ each) to the S3 bucket and noticed these did NOT trigger the upload complete step function and I did NOT receive event emails (ie the storage gateway did not send any events and because I have the 2nd rule that is unfilted and sends every event I know the storage gateway didn't send an event). I'm seeing no further upload activity from the metrics on the storage gateway, and the object appear in S3 as their full size so the uploads have clearly completed.Its clear the file gateway uploaded these very large files as multi-part uploads, and I'm wondering if this is the reason I didn't receive any event emails (or the step function being triggered). I highly doubt that is the desired behaviour as I expect 'upload complete' to apply to all objects, not just ones uploaded whole. I was hoping the Storage gateway events would be 'more reliable' as AWS's own blog post about file upload events suggested over S3 based event triggering.Can you confirm if this behaviour is actually the expected desired behavior, or if I have to employ a work-around using s3 eventbridge events (multipart upload complete? )Thanks in advance,Owen.FollowComment"

Answer: "0Accepted AnswerOwen,Thank you for taking time to post about your experience with the S3 File Gateway. I work on the storage gateway product team and I would be interested in learning more about how you use storage gateway. Would you be interested in connecting?JesseCommentSharejesse_awsanswered 4 months agoOmmps 4 months agoTL;dr we are wanting to store long term data, that doesn't yet have a known 'end date' in terms of retention. some data could eventually be removed within a few months, others years... but we don't know that at the point of upload.To aid in malware protection, Bucket versioning is enabled, and we want to enable 'legal hold' on the objects as soon as we can after upload. again, we cannot use the default retention rules as we don't have an end date, so a legal hold allows us that 'infinite' hold.So we want to trigger a lambda, after a short-ish delay to apply the hold to the objects. However, and fully understandably, the Storage Gateway eventbridge events will fire when folder objects are created. This is 100% understandable. We wanted however, to not trigger the stepfunction we are using to create the time delay every single time as it was, at that time, just a simple start -> wait -> trigger lambda -> end process, so triggering the step function would trigger the lambda, all adding to costs, yes very small, but 1000's of very small become very big very quickly. and with many 10,000's of files, and maybe as many folder objects it gets expensive.putting a filter onto the eventbridge rule that simply says 'is the uploaded object larger than 0 bytes' is a no brainer... bar the very odd and quite bizarre limitation of the numeric compare...the range given (-5.0e9 and +5.0e9 inclusive ) is what appears to be a 32bit signed int. I'm not sure why that limitation is imposed.Share0I've found the answer, and I still think its a terrible limitation.....we were applying filtering to the eventbridge rule as such:{"detail": {"object-size": [{"numeric": [">", 0]}]},"detail-type": ["Storage Gateway Object Upload Event"],"source": ["aws.storagegateway"]}Turns out, the numeric test can only deal with values in the range -5.0e9 and +5.0e9 inclusive[ 1 ]....  so objects over 5GB in size were being filtered out due to the numeric comparison not being able to do a simple 'is the object greater than 0 bytes in size' test. The point of the test is to stop our step functions triggering when folders are created on the storage gateway, and only trigger for actual file objects.Is there a better way to achieve what we want within the limits of the json filtering - ie trigger on the upload event, but not if the event was for a folder object being created (ie a 0 byte object).can I also ask why does such a numeric limitation even exist?Owen.EDIT: I have found a solution by adding a choice in the step function where I can use the NumericGreaterThan and NumericEquals choices. These seem to not have the odd limitations put on the Eventbridge filters...... but it now means I'm running the step function on every object upload instead of only when I know the lambda is actually needed. So it does have cost implications.CommentShareOmmpsanswered 4 months ago"


Question: Cloudformation rollback alarm trigger cannot be removed

"I have created Cloudformation stack with rollback trigger alarm configured. Now, I am not able to remove the alarm from the rollback configuration.To replicate:Have stack with rollback alarmUpdate stack so that there is no rollback alarm, by providing empty list for "rollback triggers"."RollbackConfiguration": {    "MonitoringTimeInMinutes": 2,    "RollbackTriggers": []}Update succeeds, however, the console still shows that rollback trigger alarm is configured.Subsequent updates still check the alarm. I.e on subsequent updates, if an alarm occurs the stack is rolled back.According to docs here: To remove all currently specified triggers, specify an empty list for this parameter.However, specifying an empty list does not seem to work and I have NO way to remove rollback alarm.Can anybody replicate?FollowCommentmyronix88 10 months agoCan you please post the exact steps to replicate?Share"

Answer: "0Hello,To answer your question, we require details that are non-public information. Please open a support case with AWS using the following link - https://support.console.aws.amazon.com/support/home#/case/createCommentShareSUPPORT ENGINEERrePost-User-2635668answered 10 months ago"


Question: Amazon Transcribe is misplacing punctuation (period) and incorrectly moving words to next/previous sentences.

"While attempting to review the Transcribed Closed Caption, we found a frequent and consistent error where the punctuation is applied in the wrong place. We reviewed the video(s) carefully and found that the audio is very clear and concise where one sentence end and another begin. Despite that, we see punctuation errors.We are not exactly sure, how can we solve this problem. Is there an existing mechanism to deal with such an issue?Examples of missed Punctuation:Wrong 1:… who are unloading the shipment use 40 inches by 48 inches...Correct 1:… who are unloading the shipment. Use 40 inches by 48 inches…Wrong 2:… or FMVS test units that have moving…Correct 2:… or FMVS test. Units that have moving…Wrong 3:… and when stored liquid products must adhere…Correct 3:… and when stored. Liquid products must adhere…Wrong 4:… the edge of the pallet. More than one inchCorrect 4:… the edge of the pallet more than one inch…FollowComment"

Answer: "0Amazon Transcribe is a machine learning-based service and may occasionally make errors, especially when it comes to punctuation and capitalization. However, there are some ways to mitigate these errors:Review the transcribed text carefully and correct any errors manually. This can be time-consuming, but it will help ensure the accuracy of the text.Use a post-processing tool to correct punctuation errors automatically. For example, you could use a regular expression to search for common punctuation errors and correct them automatically.Consider using a punctuation-aware language model or tool to improve the accuracy of the transcribed text. There are many language models available that are specifically designed to handle punctuation and capitalization errors.Provide feedback to Amazon Transcribe. If you notice consistent errors or issues with the service, you can provide feedback to Amazon so that they can improve the accuracy of the service in the future.Keep in mind that even with these measures, there may still be occasional errors in the transcribed text. It's important to review the text carefully and make any necessary corrections to ensure the accuracy of the final output.CommentSharehashanswered a month ago"


Question: Multicast packet is not working on my testing virtual router

"Trying to setup a multicast testing environment between AWS Cloud and OnPrem. The following is my setup.EC2----TGW(Multicast)---CSR1000v-----(VPN)-----ISR4000----LinuxI want to mcjoin(https://github.com/troglobit/mcjoin) to verify the multicast performance, but it failed at the CSR1000v.It works with 2 EC2-linuxs sitting in the same VPC. I am not sure any additional configuration I should have done on TGW.FollowComment"

Answer: "2Accepted AnswerMutlicast between EC2 instance works is asumping your setup in TGW for Multicast domain is good.Try to check the following:You must disable source/destination checks on your CSR1000v EC2 instance.You may need to build a GRE tunnel over the VPN Connection between CSR1000v and ISR4000, such that multicast packet can be passed over.Checking PIM configuratio and neigbhor relationship.Static join the multicast group on the Onprem ISR4000.Check and increase your mcjoin TTL (according to your link, the default TTL is 1, so it may be get dropped at CSR1000v).Verify if you can see the correct (S,G) mroute.CommentShareGaryKo_AWSanswered a year agoEXPERTBrettski-AWSreviewed a year agoAWS-User-2187006 a year agoThanks, it is working after changing the TTL to a larger number.Share"


Question: AWS Dynamodb - PartiQL

"Hi,i am using Dynamodb ExecuteStatement with Parameter attribute in nodejs.I am dynamically passing string array to one of the column. But i am getting below error while executing. please suggest the fix.InvalidParameterType: Expected params.Parameters[1].SS[0] to be a stringCode Snippet:Parameters: [{S: <dynamic value 1>    },     { SS: [<dynamic value 2>] // eg: l1,l2    }FollowCommentMLGuy a year agoCan you please write the query that you are trying to execute? and the table/object structure you are using?Share"

Answer: "0Statement: `UPDATE "lab_results"SET "notification_status"= 'Notified'WHERE "cerner_millennium_id" = ?AND "lab_result_id" IN ?Reading a json request which is in below format and passing the same to the above query for updation.{"cerner_millennium_id" : "1","lab_result_id" : ["lr3","lr4"]}CommentShareAWS-User-2358195answered a year ago"


Question: Cloudfront with latency based domain as origin finds wrong region

"I have a limitation whereby I must run both HTTP and WS through a single TLD, and unfortunately it appears that API gateway requires a separate domain for each protocol as they're separate APIs (correct me if I'm wrong, as that would probably solve the issue).The way that I've currently implemented it is as followsmessages.foo.com -> cloudfront dist -> origin messages-http.foo.commessages.foo.com/ws -> cloudfront dist -> behaviour w/ origin messages-ws.foo.comBoth messages-http.foo.com and messages-ws.foo.com are deployed in many regions. The two main ones I'll focus on are af-south-1 and eu-central-1 where I noticed the issue.If I visit messages-http.foo.com from a machine in af-south-1, latency based routing finds the api gateway/lambda in af-south-1, as expected.However, if I visit messages.foo.com from the same machine in af-south-1, it finds the api gateway/lambda in eu-central-1.The api gateways in each region are regional endpoints with custom domains in front, with latency based routing in route 53.Having read this page about the Cloudfront cache locations in EMEA, it seems to suggest that there are edge locations, but no edge caches in Africa and I wondered if this could be the cause of my issue? By the time the request hits Cloudfront, the closest origin latency wise is now Europe, not Africa?I'm looking for either alternate solutions to 1 domain->2 api gateways (http & ws), or how to route my traffic properly from Cloudfront to latency based routed domains.Any suggestions would be much appreciated.FollowComment"

Answer: "0Hi,I wonder whether you perhaps have a Lambda@Edge function associated with your CloudFront distribution behaviors. If so, it may affect your latency-based routing decisions (as these functions are running in Regional Edge Caches, and not in the edge location (as described in this CloudFront Function announcement: https://aws.amazon.com/blogs/aws/introducing-cloudfront-functions-run-your-code-at-the-edge-with-low-latency-at-any-scale).Also, you could have a look at the response headers your received from CloudFront, tracing which Edge location actually received your request (you are looking for a response header called X-Amz-Cf-Pop). Perhaps it would help you troubleshooting your routing issue further.CommentShareTzoori Tamamanswered a year agobenswinburne a year agoI do have a function running, but I thought I'd accounted for the above- I use a cloudfront function, not a lambda@edge function to rewrite the path of the request from /wss to / (as api gateway ws endpoints must be on the root path, and the behaviour must have a non root path). Given it's a Cloudfront function, should it not be running in Africa at the edge as opposed to the regional cache location?Sharebenswinburne a year agoThe POP being hit when making a request from a machine in Africa is TLV50-C2, Tel-Aviv.Sharebenswinburne a year agoHaving rejigged some configuration, I've removed the need for the cloudfront function completely, so now a request is cloudfront -> behaviour to origin -> custom domain (latency routed) -> regional api gateway. Unfortunately this hasn't changed anything. The pop which handles the cloudfront request is still tel aviv.Share"


Question: Error 403 in Amazon Chime

"I keep getting error code 403 Forbidden when trying to update my Amazon Chime Voice Connector Termination Host. I am logged in with the root account, so I shouldn't be receiving any permissions issues. Because of this, I can only receive inbound calls, and outbound calls are disconnected with the same 403 error. This only started recently. Does anyone have any ideas or how they were able to solve this problem for themselves? AWS bill is current. Any help is appreciated as this is my business telephone number.FollowComment"


Question: Starting HTML server on Lightsail Windows instance

"I created a new Windows Server 2019 instance on Lightsail.  I'd like to use it to serve web pages from a small application I'm making using Panel (a Python library based on Bokeh and Tornado).  So far I've been unable to connect to the HTML server -- I get a timeout from my browser, and the log messages from the server don't show any attempt to connect.What I've done so far:created a static IP address for my machineinstalled Python and all the libraries I need for my applicationlaunched the server using the default settings, which allow connections from the local machine on port 5006verified the application was running by using Edge to connect to http://localhost:5006/app (replacing "app" with the name of my application)restart the server, this time using --allow-websocket-origin='*' (a Bokeh option needed when connections are coming from the outside; I've tested this option on my local network)configure the firewall on the Windows OS to allow connections on port 5006tried connecting to my server from an outside system, with the URL http://nnn.nnn.nnn.nnn:5006/app (using the static IP address of my Windows instance)When that didn't work (no connection made), I tried restarting the server with another option that told it to use port 80, and tried the same URL but without the port number, but that didn't work either.Any help would be appreciated...FollowComment"

Answer: "0Hi,AWS Lightsail has its own Firewall, you can check in the console and open the port to the IP range you desire.Cheers!CommentShareDavidCaballeroanswered 4 months ago"


Question: re:Post - Unlink Builder ID to re-link with existing re:Post account

"Hello AWS,I logged in with AWS Builder profile which took me to the signing page directly, which did not link to this existing account.  Then tying to add a login link after signing into this account, it says the builder ID is already linked elsewhere. How can I reset and link the builder ID to this account?Thank you,FollowComment"

Answer: "0To link a login, you need to start from the "link login" flow when signed in with the original login. Can you give us more details on the steps you took that resulted in accidental profile creation?As for resetting your builder ID and linking it to this profile, please ensure both profiles have the same verified email address. I can then take care of the reset and relinking for you.CommentShareMODERATORAdamanswered 6 months ago0Sorry for the late reply.On the login page I instead of login with AWS Management Console went to Log in with Builder ID which went ahead and created the account for re:Post although I did not even complete the registration process realizing that this would create a duplicate account.How do I go about resetting my BuilderID for re:Post? Signin to the AWS Console for this current re:Post user, and logging to the AWS Console is done using AWS SSO.Name, profile and nickname are also the same JohnPreston both for re:Post via AWS Management console login and Builder ID Profile.Email addresses are technically the same too.Let me know if there is anything else you need to help with merging the two profiles into one for re:Post (it should use this one).EDIT: I have deleted my Builder ID which I only had used for CodeWhisperer so I will try to create a new account in Builder once deletion is completed.CommentShareJohnPrestonanswered 6 months ago"